From 16b0f1d79cbe394796b7899102d666fad137447b Mon Sep 17 00:00:00 2001
From: Wasim Amiri <7220175+wasimxyz@users.noreply.github.com>
Date: Fri, 28 Aug 2026 16:28:39 -0700
Subject: [PATCH 1/6] Serve the run report as an MCP App so hosts can reuse the
 web UI.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 web/.gitignore                                |    3 +
 .../[instrumentId]/runs/[runId]/page.tsx      |   87 +-
 web/app/mcp/v1/route.ts                       |   21 +-
 .../runs/aunty/aunty-plate-report.tsx         |   31 +-
 .../runs/aunty/aunty-well-dialog.tsx          |   69 +-
 web/components/runs/colony-data-table.tsx     |   59 +-
 web/components/runs/image-carousel-report.tsx |   25 +-
 web/components/runs/pdf-carousel-report.tsx   |   23 +-
 web/components/runs/raman-report-section.tsx  |   13 +-
 web/components/runs/raman-spectrum-viewer.tsx |   29 +-
 .../runs/report-data-source-provider.tsx      |   53 +
 web/components/runs/report-items-provider.tsx |   32 +-
 web/components/runs/run-report-section.tsx    |   98 +-
 web/components/runs/run-video-player.tsx      |   57 +-
 .../runs/variants/dishcam-run-detail.tsx      |    2 -
 .../runs/variants/gel-doc-run-detail.tsx      |    6 +-
 .../variants/hina-microscope-run-detail.tsx   |    6 +-
 .../variants/instant-raman-run-detail.tsx     |    6 +-
 .../runs/variants/tape-station-run-detail.tsx |    6 +-
 web/components/runs/video-carousel-report.tsx |    9 +-
 web/hooks/use-report-items.ts                 |   70 +-
 web/hooks/use-resolved-file-url.ts            |   46 +
 web/lib/api/files.ts                          |   46 +-
 web/lib/mcp/absolute-url.ts                   |   12 +
 web/lib/mcp/catalog/register.ts               |    7 +
 web/lib/mcp/catalog/tools.ts                  |    2 +
 web/lib/mcp/catalog/types.ts                  |    6 +
 web/lib/mcp/cors.ts                           |   26 +
 web/lib/mcp/resources.defs.ts                 |   14 +
 web/lib/mcp/resources.ts                      |   28 +
 web/lib/mcp/run-report-html.ts                |   74 +
 web/lib/mcp/tools/index.ts                    |    2 +
 web/lib/mcp/tools/report-views.defs.ts        |  123 ++
 web/lib/mcp/tools/report-views.output.ts      |   32 +
 web/lib/mcp/tools/report-views.ts             |  256 ++++
 web/lib/mcp/tools/runs.defs.ts                |    7 +
 web/lib/mcp/ui-apps.ts                        |   24 +
 web/lib/mcp/ui-csp.ts                         |   48 +
 web/lib/runs/report-table.ts                  |   35 +
 web/lib/runs/rest-report-data-source.ts       |   75 +
 web/lib/runs/view-data-source.ts              |   21 +
 web/mcp-apps/run-report.css                   |   45 +
 web/mcp-apps/run-report.html                  |   13 +
 web/mcp-apps/run-report/app.tsx               |  193 +++
 web/mcp-apps/run-report/data-hub-origin.ts    |   14 +
 web/mcp-apps/run-report/host-bridge.ts        |  205 +++
 web/mcp-apps/run-report/instrument-report.tsx |  310 ++++
 web/mcp-apps/run-report/main.tsx              |   18 +
 web/mcp-apps/run-report/mcp-data-source.ts    |  124 ++
 web/mcp-apps/vite.config.ts                   |   25 +
 web/package-lock.json                         | 1296 ++++++++++++-----
 web/package.json                              |    9 +-
 web/proxy.ts                                  |    4 +
 web/tests/integration/mcp.test.ts             |    2 +-
 web/tests/mcp/mcp-catalog.test.ts             |    2 +-
 web/tests/mcp/mcp-protocol.test.ts            |  108 +-
 .../unit/mcp-container-dimensions.test.ts     |   44 +
 web/tests/unit/mcp-cors.test.ts               |   25 +
 .../unit/rest-report-data-source.test.ts      |  108 ++
 59 files changed, 3452 insertions(+), 682 deletions(-)
 create mode 100644 web/components/runs/report-data-source-provider.tsx
 create mode 100644 web/hooks/use-resolved-file-url.ts
 create mode 100644 web/lib/mcp/absolute-url.ts
 create mode 100644 web/lib/mcp/cors.ts
 create mode 100644 web/lib/mcp/run-report-html.ts
 create mode 100644 web/lib/mcp/tools/report-views.defs.ts
 create mode 100644 web/lib/mcp/tools/report-views.output.ts
 create mode 100644 web/lib/mcp/tools/report-views.ts
 create mode 100644 web/lib/mcp/ui-apps.ts
 create mode 100644 web/lib/mcp/ui-csp.ts
 create mode 100644 web/lib/runs/report-table.ts
 create mode 100644 web/lib/runs/rest-report-data-source.ts
 create mode 100644 web/lib/runs/view-data-source.ts
 create mode 100644 web/mcp-apps/run-report.css
 create mode 100644 web/mcp-apps/run-report.html
 create mode 100644 web/mcp-apps/run-report/app.tsx
 create mode 100644 web/mcp-apps/run-report/data-hub-origin.ts
 create mode 100644 web/mcp-apps/run-report/host-bridge.ts
 create mode 100644 web/mcp-apps/run-report/instrument-report.tsx
 create mode 100644 web/mcp-apps/run-report/main.tsx
 create mode 100644 web/mcp-apps/run-report/mcp-data-source.ts
 create mode 100644 web/mcp-apps/vite.config.ts
 create mode 100644 web/tests/unit/mcp-container-dimensions.test.ts
 create mode 100644 web/tests/unit/mcp-cors.test.ts
 create mode 100644 web/tests/unit/rest-report-data-source.test.ts

diff --git a/web/.gitignore b/web/.gitignore
index 120b8df9..c895a52b 100644
--- a/web/.gitignore
+++ b/web/.gitignore
@@ -43,3 +43,6 @@ next-env.d.ts
 # Optional local dump from `npm run mcp-catalog:generate` (same idea;
 # production serves GET /mcp/v1/schema.json).
 /mcp-catalog.json
+
+# Self-contained MCP Apps View (built by `npm run mcp-apps:build`).
+/mcp-apps/dist/
diff --git a/web/app/(app)/instruments/[instrumentId]/runs/[runId]/page.tsx b/web/app/(app)/instruments/[instrumentId]/runs/[runId]/page.tsx
index fa2e14b8..22c50592 100644
--- a/web/app/(app)/instruments/[instrumentId]/runs/[runId]/page.tsx
+++ b/web/app/(app)/instruments/[instrumentId]/runs/[runId]/page.tsx
@@ -2,6 +2,7 @@ import { notFound } from "next/navigation";
 import type { Metadata } from "next/types";
 import { Suspense } from "react";
 import { SignInRequired } from "@/components/auth/sign-in-required";
+import { RestReportDataSourceProvider } from "@/components/runs/report-data-source-provider";
 import { RunAttributionsSection } from "@/components/runs/run-attributions-section";
 import { RunCommentsSection } from "@/components/runs/run-comments-section";
 import {
@@ -207,48 +208,50 @@ async function RunDetailContentBody({
     `/instruments/${instrumentId}/runs/${encodeURIComponent(rid)}`;
 
   return (
-    <WatcherStatusProvider isWatcherOnline={isWatcherOnline}>
-      <RunDetailVariant
-        attributionsSlot={
-          <RunAttributionsSection
-            attributions={run.attributions}
-            instrumentId={run.instrumentId}
-            runId={run.runId}
-          />
-        }
-        auntyPlate={auntyPlate}
-        fileStats={fileStats}
-        files={filesPage.data}
-        filesDownloadableCount={filesPage.downloadableCount}
-        filesPagination={filesPage.pagination}
-        instrumentId={instrumentId}
-        reportFiles={reportFiles}
-        reportItems={reportItems}
-        run={run}
-        runId={runId}
-        runNavSlot={
-          <RunNav
-            next={
-              adjacentRuns.nextRunId
-                ? {
-                    href: toRunHref(adjacentRuns.nextRunId),
-                    runId: adjacentRuns.nextRunId,
-                  }
-                : null
-            }
-            previous={
-              adjacentRuns.previousRunId
-                ? {
-                    href: toRunHref(adjacentRuns.previousRunId),
-                    runId: adjacentRuns.previousRunId,
-                  }
-                : null
-            }
-          />
-        }
-        wellData={wellData}
-      />
-    </WatcherStatusProvider>
+    <RestReportDataSourceProvider instrumentId={instrumentId} runId={runId}>
+      <WatcherStatusProvider isWatcherOnline={isWatcherOnline}>
+        <RunDetailVariant
+          attributionsSlot={
+            <RunAttributionsSection
+              attributions={run.attributions}
+              instrumentId={run.instrumentId}
+              runId={run.runId}
+            />
+          }
+          auntyPlate={auntyPlate}
+          fileStats={fileStats}
+          files={filesPage.data}
+          filesDownloadableCount={filesPage.downloadableCount}
+          filesPagination={filesPage.pagination}
+          instrumentId={instrumentId}
+          reportFiles={reportFiles}
+          reportItems={reportItems}
+          run={run}
+          runId={runId}
+          runNavSlot={
+            <RunNav
+              next={
+                adjacentRuns.nextRunId
+                  ? {
+                      href: toRunHref(adjacentRuns.nextRunId),
+                      runId: adjacentRuns.nextRunId,
+                    }
+                  : null
+              }
+              previous={
+                adjacentRuns.previousRunId
+                  ? {
+                      href: toRunHref(adjacentRuns.previousRunId),
+                      runId: adjacentRuns.previousRunId,
+                    }
+                  : null
+              }
+            />
+          }
+          wellData={wellData}
+        />
+      </WatcherStatusProvider>
+    </RestReportDataSourceProvider>
   );
 }
 
diff --git a/web/app/mcp/v1/route.ts b/web/app/mcp/v1/route.ts
index 4e93d457..d4699518 100644
--- a/web/app/mcp/v1/route.ts
+++ b/web/app/mcp/v1/route.ts
@@ -2,6 +2,7 @@ import { createMcpHandler, withMcpAuth } from "mcp-handler";
 import { authBaseURL } from "@/lib/auth";
 import { MCP_ADVERTISED_SCOPES } from "@/lib/mcp/advertised-scopes";
 import { verifyMcpToken } from "@/lib/mcp/auth";
+import { mcpCorsPreflight, withMcpCors } from "@/lib/mcp/cors";
 import { MCP_SERVER_INSTRUCTIONS } from "@/lib/mcp/instructions";
 import { registerPrompts } from "@/lib/mcp/prompts";
 import { registerResources } from "@/lib/mcp/resources";
@@ -49,19 +50,25 @@ async function authHandler(req: Request): Promise<Response> {
   const res = await mcpAuthHandler(req);
   const challenge = res.headers.get("WWW-Authenticate");
   if (!challenge || challenge.includes(ADVERTISED_SCOPES)) {
-    return res;
+    return withMcpCors(res);
   }
   const rewritten = challenge.replace(/scope="[^"]*"/, ADVERTISED_SCOPES);
   if (rewritten === challenge) {
-    return res;
+    return withMcpCors(res);
   }
   const headers = new Headers(res.headers);
   headers.set("WWW-Authenticate", rewritten);
-  return new Response(res.body, {
-    status: res.status,
-    statusText: res.statusText,
-    headers,
-  });
+  return withMcpCors(
+    new Response(res.body, {
+      status: res.status,
+      statusText: res.statusText,
+      headers,
+    })
+  );
+}
+
+export function OPTIONS(): Response {
+  return mcpCorsPreflight();
 }
 
 export { authHandler as GET, authHandler as POST };
diff --git a/web/components/runs/aunty/aunty-plate-report.tsx b/web/components/runs/aunty/aunty-plate-report.tsx
index 2cc51215..b1d790d2 100644
--- a/web/components/runs/aunty/aunty-plate-report.tsx
+++ b/web/components/runs/aunty/aunty-plate-report.tsx
@@ -1,7 +1,6 @@
 "use client";
 
-import dynamic from "next/dynamic";
-import { useCallback, useMemo, useState } from "react";
+import { lazy, Suspense, useCallback, useMemo, useState } from "react";
 import { AuntyPlateGrid } from "@/components/runs/aunty/aunty-plate-grid";
 import { AuntySeriesToggle } from "@/components/runs/aunty/aunty-series-toggle";
 import { AuntyWellsProvider } from "@/components/runs/aunty/aunty-wells-provider";
@@ -15,10 +14,10 @@ import {
 
 // The dialog pulls in Recharts and the CSV parser, which nothing on the page
 // needs until a well is opened, so they load as a separate chunk.
-const AuntyWellDialog = dynamic(() =>
-  import("@/components/runs/aunty/aunty-well-dialog").then(
-    (mod) => mod.AuntyWellDialog
-  )
+const AuntyWellDialog = lazy(() =>
+  import("@/components/runs/aunty/aunty-well-dialog").then((mod) => ({
+    default: mod.AuntyWellDialog,
+  }))
 );
 
 export function AuntyPlateReport({ curvesFileId, plate }: AuntyPlateData) {
@@ -87,15 +86,17 @@ function AuntyExperimentSection({
           onWellClick={openDialog}
           seriesId={seriesId}
         />
-        <AuntyWellDialog
-          curvesFileId={curvesFileId}
-          experiment={experiment}
-          onOpenChange={setOpen}
-          onSeriesChange={setSeriesId}
-          open={open}
-          seriesId={seriesId}
-          seriesOptions={available}
-        />
+        <Suspense fallback={null}>
+          <AuntyWellDialog
+            curvesFileId={curvesFileId}
+            experiment={experiment}
+            onOpenChange={setOpen}
+            onSeriesChange={setSeriesId}
+            open={open}
+            seriesId={seriesId}
+            seriesOptions={available}
+          />
+        </Suspense>
       </div>
     </AuntyWellsProvider>
   );
diff --git a/web/components/runs/aunty/aunty-well-dialog.tsx b/web/components/runs/aunty/aunty-well-dialog.tsx
index fe0d0de3..b1e673a8 100644
--- a/web/components/runs/aunty/aunty-well-dialog.tsx
+++ b/web/components/runs/aunty/aunty-well-dialog.tsx
@@ -1,6 +1,5 @@
 "use client";
 
-import { parse } from "csv-parse/browser/esm/sync";
 import { AlertTriangle } from "lucide-react";
 import { useCallback, useEffect, useRef, useState } from "react";
 import { AuntySeriesToggle } from "@/components/runs/aunty/aunty-series-toggle";
@@ -9,6 +8,7 @@ import {
   useAuntyWellsActions,
   useAuntyWellsState,
 } from "@/components/runs/aunty/aunty-wells-provider";
+import { useReportDataSource } from "@/components/runs/report-data-source-provider";
 import { SeekerToolbar } from "@/components/runs/report-item-seeker";
 import { Button } from "@/components/ui/button";
 import {
@@ -28,6 +28,8 @@ import {
   parseAuntyCurvesCsv,
   presentWellValues,
 } from "@/lib/runs/aunty";
+import { fetchAllTableRows } from "@/lib/runs/report-table";
+import type { ReportDataSource } from "@/lib/runs/view-data-source";
 
 const WELL_SEEKER_LABELS = {
   empty: "No wells found.",
@@ -48,29 +50,22 @@ type CurvesState =
 const curvesCache = new Map<number, Promise<Map<string, AuntyPoint[]>>>();
 
 async function downloadCurves(
+  dataSource: ReportDataSource,
   fileId: number
 ): Promise<Map<string, AuntyPoint[]>> {
-  // The download endpoint 302-redirects to a short-lived presigned S3 URL, so
-  // the browser follows the redirect and reads the bytes straight from S3.
-  const res = await fetch(`/api/v1/files/${fileId}/download`);
-  if (!res.ok) {
-    throw new Error(`Failed to load curves (HTTP ${res.status})`);
-  }
-  const text = await res.text();
-  const rows = parse(text, {
-    columns: true,
-    skip_empty_lines: true,
-    trim: true,
-  }) as Record<string, string>[];
+  const { rows } = await fetchAllTableRows(dataSource, fileId);
   return indexAuntyCurves(parseAuntyCurvesCsv(rows));
 }
 
-function loadCurves(fileId: number): Promise<Map<string, AuntyPoint[]>> {
+function loadCurves(
+  dataSource: ReportDataSource,
+  fileId: number
+): Promise<Map<string, AuntyPoint[]>> {
   const cached = curvesCache.get(fileId);
   if (cached) {
     return cached;
   }
-  const pending = downloadCurves(fileId).catch((err: unknown) => {
+  const pending = downloadCurves(dataSource, fileId).catch((err: unknown) => {
     curvesCache.delete(fileId);
     throw err;
   });
@@ -95,6 +90,7 @@ export function AuntyWellDialog({
   seriesId: AuntySeriesId;
   seriesOptions: AuntySeriesId[];
 }) {
+  const dataSource = useReportDataSource();
   const state = useAuntyWellsState();
   const actions = useAuntyWellsActions();
   const selectedWellLabel = state.selectedItem?.filename ?? null;
@@ -103,26 +99,29 @@ export function AuntyWellDialog({
   const [curves, setCurves] = useState<CurvesState>({ status: "idle" });
   const requestId = useRef(0);
 
-  const startLoad = useCallback((fileId: number) => {
-    const id = requestId.current + 1;
-    requestId.current = id;
-    setCurves({ status: "loading" });
-    loadCurves(fileId)
-      .then((index) => {
-        if (requestId.current === id) {
-          setCurves({ status: "ready", index });
-        }
-      })
-      .catch((err: unknown) => {
-        if (requestId.current === id) {
-          setCurves({
-            status: "error",
-            message:
-              err instanceof Error ? err.message : "Failed to load curves",
-          });
-        }
-      });
-  }, []);
+  const startLoad = useCallback(
+    (fileId: number) => {
+      const id = requestId.current + 1;
+      requestId.current = id;
+      setCurves({ status: "loading" });
+      loadCurves(dataSource, fileId)
+        .then((index) => {
+          if (requestId.current === id) {
+            setCurves({ status: "ready", index });
+          }
+        })
+        .catch((err: unknown) => {
+          if (requestId.current === id) {
+            setCurves({
+              status: "error",
+              message:
+                err instanceof Error ? err.message : "Failed to load curves",
+            });
+          }
+        });
+    },
+    [dataSource]
+  );
 
   useEffect(() => {
     if (open && curvesFileId != null) {
diff --git a/web/components/runs/colony-data-table.tsx b/web/components/runs/colony-data-table.tsx
index bc47f2f0..a6a17287 100644
--- a/web/components/runs/colony-data-table.tsx
+++ b/web/components/runs/colony-data-table.tsx
@@ -1,6 +1,5 @@
 "use client";
 
-import { parse } from "csv-parse/browser/esm/sync";
 import {
   AlertTriangle,
   ChevronLeft,
@@ -8,6 +7,7 @@ import {
   ExternalLink,
 } from "lucide-react";
 import { useEffect, useMemo, useRef, useState } from "react";
+import { useReportDataSource } from "@/components/runs/report-data-source-provider";
 import { Button } from "@/components/ui/button";
 import { Skeleton } from "@/components/ui/skeleton";
 import {
@@ -18,27 +18,26 @@ import {
   TableHeader,
   TableRow,
 } from "@/components/ui/table";
-import type { RunFile } from "@/lib/api/instrument-runs";
+import { useResolvedFileUrl } from "@/hooks/use-resolved-file-url";
+import { fetchAllTableRows } from "@/lib/runs/report-table";
+import type { ReportDataSource } from "@/lib/runs/view-data-source";
 import { cn } from "@/lib/utils";
 
 const PAGE_SIZE = 10;
 
 type CsvRow = Record<string, string>;
 
-async function fetchCsvRows(fileId: number): Promise<CsvRow[]> {
-  // The download endpoint 302-redirects to a short-lived presigned S3 URL;
-  // the browser follows transparently, so CSV bytes flow directly from S3
-  // with zero Vercel Fast Origin Transfer.
-  const res = await fetch(`/api/v1/files/${fileId}/download`);
-  if (!res.ok) {
-    throw new Error(`Failed to load CSV (HTTP ${res.status})`);
-  }
-  const text = await res.text();
-  return parse(text, {
-    columns: true,
-    skip_empty_lines: true,
-    trim: true,
-  }) as CsvRow[];
+export interface ColonyTableFile {
+  filename: string;
+  id: number;
+}
+
+async function fetchCsvRows(
+  dataSource: ReportDataSource,
+  fileId: number
+): Promise<CsvRow[]> {
+  const { rows } = await fetchAllTableRows(dataSource, fileId);
+  return rows;
 }
 
 type AsyncResult =
@@ -50,8 +49,9 @@ type LoadState =
   | { status: "ready"; rows: CsvRow[] }
   | { status: "error"; message: string };
 
-export function ColonyDataTable({ file }: { file: RunFile }) {
-  const downloadUrl = `/api/v1/files/${file.id}/download`;
+export function ColonyDataTable({ file }: { file: ColonyTableFile }) {
+  const dataSource = useReportDataSource();
+  const downloadUrl = useResolvedFileUrl(file.id);
   const fileId = file.id;
 
   const [asyncResult, setAsyncResult] = useState<AsyncResult | null>(null);
@@ -82,7 +82,7 @@ export function ColonyDataTable({ file }: { file: RunFile }) {
       return;
     }
     let cancelled = false;
-    fetchCsvRows(fileId)
+    fetchCsvRows(dataSource, fileId)
       .then((rows) => {
         cacheRef.current.set(fileId, rows);
         if (cancelled) {
@@ -101,7 +101,7 @@ export function ColonyDataTable({ file }: { file: RunFile }) {
     return () => {
       cancelled = true;
     };
-  }, [fileId, retryNonce]);
+  }, [dataSource, fileId, retryNonce]);
 
   function handleRetry() {
     cacheRef.current.delete(fileId);
@@ -113,12 +113,19 @@ export function ColonyDataTable({ file }: { file: RunFile }) {
     <div className="flex flex-col gap-2">
       <div className="flex items-center justify-between">
         <h3 className="font-medium text-sm">{file.filename}</h3>
-        <Button asChild className="h-7 gap-1 text-xs" size="sm" variant="ghost">
-          <a href={downloadUrl} rel="noopener noreferrer" target="_blank">
-            <ExternalLink className="size-3" />
-            Open as CSV
-          </a>
-        </Button>
+        {downloadUrl && (
+          <Button
+            asChild
+            className="h-7 gap-1 text-xs"
+            size="sm"
+            variant="ghost"
+          >
+            <a href={downloadUrl} rel="noopener noreferrer" target="_blank">
+              <ExternalLink className="size-3" />
+              Open as CSV
+            </a>
+          </Button>
+        )}
       </div>
       {state.status === "loading" && (
         <Skeleton aria-label="Loading CSV" className="h-72 w-full" />
diff --git a/web/components/runs/image-carousel-report.tsx b/web/components/runs/image-carousel-report.tsx
index 95135945..717d3e45 100644
--- a/web/components/runs/image-carousel-report.tsx
+++ b/web/components/runs/image-carousel-report.tsx
@@ -7,9 +7,11 @@ import {
   type ReportViewerProps,
   useReportItemsContext,
 } from "@/components/runs/report-items-provider";
+import { useResolvedFileUrl } from "@/hooks/use-resolved-file-url";
 
 function SelectedImage() {
   const { state } = useReportItemsContext();
+  const src = useResolvedFileUrl(state.selectedItem?.id);
 
   if (!state.selectedItem) {
     return (
@@ -20,6 +22,14 @@ function SelectedImage() {
     );
   }
 
+  if (!src) {
+    return (
+      <div className="flex h-64 items-center justify-center rounded-md border bg-muted/30 text-muted-foreground text-sm">
+        Loading{"\u2026"}
+      </div>
+    );
+  }
+
   return (
     <div className="overflow-hidden rounded-md border bg-muted/30">
       {/* biome-ignore lint/performance/noImgElement: auth-gated download URLs are not next/image candidates */}
@@ -27,7 +37,7 @@ function SelectedImage() {
         alt={state.selectedItem.filename}
         className="mx-auto block max-h-[70vh] w-auto object-contain"
         height={600}
-        src={`/api/v1/files/${state.selectedItem.id}/download`}
+        src={src}
         width={800}
       />
     </div>
@@ -36,19 +46,10 @@ function SelectedImage() {
 
 // For instruments whose report data is purely imagery (Hina microscope, gel
 // doc): one image at a time, seeked against the run's full image set.
-export function ImageCarouselReport({
-  initialPage,
-  instrumentId,
-  runId,
-}: ReportViewerProps) {
+export function ImageCarouselReport({ initialPage }: ReportViewerProps) {
   return (
     <ReportDataShell total={initialPage.pagination.total}>
-      <ReportItemsProvider
-        initialPage={initialPage}
-        instrumentId={instrumentId}
-        kind="image"
-        runId={runId}
-      >
+      <ReportItemsProvider initialPage={initialPage} kind="image">
         <ReportItemSeeker />
         <SelectedImage />
       </ReportItemsProvider>
diff --git a/web/components/runs/pdf-carousel-report.tsx b/web/components/runs/pdf-carousel-report.tsx
index f9d3a7b7..a2adafd9 100644
--- a/web/components/runs/pdf-carousel-report.tsx
+++ b/web/components/runs/pdf-carousel-report.tsx
@@ -9,9 +9,11 @@ import {
   useReportItemsContext,
 } from "@/components/runs/report-items-provider";
 import { Button } from "@/components/ui/button";
+import { useResolvedFileUrl } from "@/hooks/use-resolved-file-url";
 
 function SelectedPdf() {
   const { state } = useReportItemsContext();
+  const downloadUrl = useResolvedFileUrl(state.selectedItem?.id);
 
   if (!state.selectedItem) {
     return (
@@ -21,7 +23,13 @@ function SelectedPdf() {
     );
   }
 
-  const downloadUrl = `/api/v1/files/${state.selectedItem.id}/download`;
+  if (!downloadUrl) {
+    return (
+      <div className="flex h-[70vh] items-center justify-center rounded-md border bg-muted/30 text-muted-foreground text-sm">
+        Loading{"\u2026"}
+      </div>
+    );
+  }
 
   return (
     <>
@@ -49,19 +57,10 @@ function SelectedPdf() {
 
 // TapeStation and other PDF-primary instruments: one PDF at a time, seeked
 // against the run's full PDF set.
-export function PdfCarouselReport({
-  initialPage,
-  instrumentId,
-  runId,
-}: ReportViewerProps) {
+export function PdfCarouselReport({ initialPage }: ReportViewerProps) {
   return (
     <ReportDataShell total={initialPage.pagination.total}>
-      <ReportItemsProvider
-        initialPage={initialPage}
-        instrumentId={instrumentId}
-        kind="pdf"
-        runId={runId}
-      >
+      <ReportItemsProvider initialPage={initialPage} kind="pdf">
         <ReportItemSeeker />
         <SelectedPdf />
       </ReportItemsProvider>
diff --git a/web/components/runs/raman-report-section.tsx b/web/components/runs/raman-report-section.tsx
index 0830b591..b3ad3836 100644
--- a/web/components/runs/raman-report-section.tsx
+++ b/web/components/runs/raman-report-section.tsx
@@ -8,19 +8,10 @@ import {
   type ReportViewerProps,
 } from "@/components/runs/report-items-provider";
 
-export function RamanReportSection({
-  initialPage,
-  instrumentId,
-  runId,
-}: ReportViewerProps) {
+export function RamanReportSection({ initialPage }: ReportViewerProps) {
   return (
     <ReportDataShell total={initialPage.pagination.total}>
-      <ReportItemsProvider
-        initialPage={initialPage}
-        instrumentId={instrumentId}
-        kind="spectrum"
-        runId={runId}
-      >
+      <ReportItemsProvider initialPage={initialPage} kind="spectrum">
         <ReportItemSeeker />
         <RamanSpectrumViewer />
       </ReportItemsProvider>
diff --git a/web/components/runs/raman-spectrum-viewer.tsx b/web/components/runs/raman-spectrum-viewer.tsx
index 7727e0b3..26600325 100644
--- a/web/components/runs/raman-spectrum-viewer.tsx
+++ b/web/components/runs/raman-spectrum-viewer.tsx
@@ -1,9 +1,9 @@
 "use client";
 
-import { parse } from "csv-parse/browser/esm/sync";
 import { AlertTriangle } from "lucide-react";
 import { startTransition, useEffect, useMemo, useRef, useState } from "react";
 import { CartesianGrid, Line, LineChart, XAxis, YAxis } from "recharts";
+import { useReportDataSource } from "@/components/runs/report-data-source-provider";
 import { useReportItemsContext } from "@/components/runs/report-items-provider";
 import { Button } from "@/components/ui/button";
 import {
@@ -14,6 +14,8 @@ import {
 } from "@/components/ui/chart";
 import { Skeleton } from "@/components/ui/skeleton";
 import { ToggleGroup, ToggleGroupItem } from "@/components/ui/toggle-group";
+import { fetchAllTableRows } from "@/lib/runs/report-table";
+import type { ReportDataSource } from "@/lib/runs/view-data-source";
 
 interface SpectrumPoint {
   intensity: number;
@@ -43,21 +45,11 @@ const CSV_HEADER_INTENSITY = "Intensity";
 const CSV_HEADER_DARK = "Intensity (dark-subtracted)";
 const CSV_HEADER_WAVENUMBER = "Wavenumber";
 
-async function fetchSpectrum(fileId: number): Promise<SpectrumPoint[]> {
-  // The download endpoint 302-redirects to a short-lived presigned S3 URL.
-  // The browser follows the redirect transparently, so the bytes flow
-  // directly from S3 to the user with zero Vercel Fast Origin Transfer.
-  const res = await fetch(`/api/v1/files/${fileId}/download`);
-  if (!res.ok) {
-    throw new Error(`Failed to load spectrum (HTTP ${res.status})`);
-  }
-  const text = await res.text();
-
-  const rows = parse(text, {
-    columns: true,
-    skip_empty_lines: true,
-    trim: true,
-  }) as Record<string, string>[];
+async function fetchSpectrum(
+  dataSource: ReportDataSource,
+  fileId: number
+): Promise<SpectrumPoint[]> {
+  const { rows } = await fetchAllTableRows(dataSource, fileId);
 
   if (rows.length === 0) {
     throw new Error("Spectrum CSV is empty");
@@ -220,6 +212,7 @@ type AsyncResult =
   | { fileId: number; status: "error"; message: string };
 
 export function RamanSpectrumViewer() {
+  const dataSource = useReportDataSource();
   const { state: items } = useReportItemsContext();
   const selectedId = items.selectedItem?.id ?? null;
   const [visible, setVisible] = useState<Series[]>(ALL_SERIES);
@@ -262,7 +255,7 @@ export function RamanSpectrumViewer() {
     }
 
     let cancelled = false;
-    fetchSpectrum(selectedId)
+    fetchSpectrum(dataSource, selectedId)
       .then((points) => {
         cacheRef.current.set(selectedId, points);
         if (cancelled) {
@@ -286,7 +279,7 @@ export function RamanSpectrumViewer() {
     return () => {
       cancelled = true;
     };
-  }, [selectedId, retryNonce]);
+  }, [dataSource, selectedId, retryNonce]);
 
   function handleRetry() {
     if (selectedId == null) {
diff --git a/web/components/runs/report-data-source-provider.tsx b/web/components/runs/report-data-source-provider.tsx
new file mode 100644
index 00000000..ea2b8023
--- /dev/null
+++ b/web/components/runs/report-data-source-provider.tsx
@@ -0,0 +1,53 @@
+"use client";
+
+import { createContext, type ReactNode, use, useMemo } from "react";
+import { createRestReportDataSource } from "@/lib/runs/rest-report-data-source";
+import type { ReportDataSource } from "@/lib/runs/view-data-source";
+
+const ReportDataSourceContext = createContext<ReportDataSource | null>(null);
+
+export function ReportDataSourceProvider({
+  children,
+  dataSource,
+}: {
+  children: ReactNode;
+  dataSource: ReportDataSource;
+}) {
+  return (
+    <ReportDataSourceContext.Provider value={dataSource}>
+      {children}
+    </ReportDataSourceContext.Provider>
+  );
+}
+
+// Created here rather than on the server page because the source is a bag of
+// functions and cannot cross the server/client boundary as a prop.
+export function RestReportDataSourceProvider({
+  children,
+  instrumentId,
+  runId,
+}: {
+  children: ReactNode;
+  instrumentId: string;
+  runId: string;
+}) {
+  const dataSource = useMemo(
+    () => createRestReportDataSource({ instrumentId, runId }),
+    [instrumentId, runId]
+  );
+  return (
+    <ReportDataSourceProvider dataSource={dataSource}>
+      {children}
+    </ReportDataSourceProvider>
+  );
+}
+
+export function useReportDataSource(): ReportDataSource {
+  const dataSource = use(ReportDataSourceContext);
+  if (!dataSource) {
+    throw new Error(
+      "useReportDataSource must be used within a <ReportDataSourceProvider>"
+    );
+  }
+  return dataSource;
+}
diff --git a/web/components/runs/report-items-provider.tsx b/web/components/runs/report-items-provider.tsx
index 52bbad78..6950cfec 100644
--- a/web/components/runs/report-items-provider.tsx
+++ b/web/components/runs/report-items-provider.tsx
@@ -1,6 +1,7 @@
 "use client";
 
-import { createContext, type ReactNode, use } from "react";
+import { createContext, type ReactNode, use, useEffect } from "react";
+import { useReportDataSource } from "@/components/runs/report-data-source-provider";
 import {
   type UseReportItemsResult,
   useReportItems,
@@ -18,32 +19,45 @@ export interface ReportItemsContextValue extends UseReportItemsResult {
 // Props every report-data viewer receives from its run-detail variant.
 export interface ReportViewerProps {
   initialPage: ReportItemsPage;
-  instrumentId: string;
-  runId: string;
 }
 
 const ReportItemsContext = createContext<ReportItemsContextValue | null>(null);
 
+// Optional. The MCP View wraps carousels so the seeker can restore position
+// without threading a persist key through every shared renderer.
+export const ReportPersistKeyContext = createContext<string | undefined>(
+  undefined
+);
+
 export function ReportItemsProvider({
   children,
   initialPage,
-  instrumentId,
   kind,
-  runId,
 }: {
   children: ReactNode;
   initialPage: ReportItemsPage;
-  instrumentId: string;
   kind: ReportItemKind;
-  runId: string;
 }) {
+  const dataSource = useReportDataSource();
+  const persistKey = use(ReportPersistKeyContext);
   const { state, actions } = useReportItems({
+    fetchReportItems: dataSource.fetchReportItems,
     initialPage,
-    instrumentId,
     kind,
-    runId,
   });
 
+  useEffect(() => {
+    const fileId = state.selectedItem?.id;
+    if (!persistKey || fileId == null) {
+      return;
+    }
+    try {
+      window.localStorage.setItem(persistKey, JSON.stringify({ fileId }));
+    } catch {
+      // Private mode and quota failures are fine; restore is optional.
+    }
+  }, [persistKey, state.selectedItem?.id]);
+
   return (
     <ReportItemsContext.Provider value={{ state, actions, meta: { kind } }}>
       {children}
diff --git a/web/components/runs/run-report-section.tsx b/web/components/runs/run-report-section.tsx
index 22f37b45..181b6f73 100644
--- a/web/components/runs/run-report-section.tsx
+++ b/web/components/runs/run-report-section.tsx
@@ -1,9 +1,11 @@
+"use client";
+
 import { ExternalLink } from "lucide-react";
 import { ColonyDataTable } from "@/components/runs/colony-data-table";
 import { ReportDataShell } from "@/components/runs/report-data-shell";
 import { RunVideoPlayer } from "@/components/runs/run-video-player";
 import { Button } from "@/components/ui/button";
-import type { RunFile } from "@/lib/api/instrument-runs";
+import { useResolvedFileUrl } from "@/hooks/use-resolved-file-url";
 import {
   fileStem,
   isCsvFile,
@@ -13,54 +15,88 @@ import {
   posterFileIdsByVideoFilename,
 } from "@/lib/runs/run-file-types";
 
-function ProcessedImagePreview({ file }: { file: RunFile }) {
-  const downloadUrl = `/api/v1/files/${file.id}/download`;
+export interface ReportSectionFile {
+  category: "processed" | "raw";
+  contentType: string | null;
+  deletedAt: Date | null;
+  filename: string;
+  id: number;
+}
+
+function ProcessedImagePreview({ file }: { file: ReportSectionFile }) {
+  const downloadUrl = useResolvedFileUrl(file.id);
 
   return (
     <div className="flex flex-col gap-2">
       <div className="flex items-center justify-between">
         <h3 className="font-medium text-sm">{file.filename}</h3>
-        <Button asChild className="h-7 gap-1 text-xs" size="sm" variant="ghost">
-          <a href={downloadUrl} rel="noopener noreferrer" target="_blank">
-            <ExternalLink className="size-3" />
-            Full size
-          </a>
-        </Button>
+        {downloadUrl && (
+          <Button
+            asChild
+            className="h-7 gap-1 text-xs"
+            size="sm"
+            variant="ghost"
+          >
+            <a href={downloadUrl} rel="noopener noreferrer" target="_blank">
+              <ExternalLink className="size-3" />
+              Full size
+            </a>
+          </Button>
+        )}
       </div>
       <div className="overflow-hidden rounded-md border bg-muted/30">
-        {/* biome-ignore lint/performance/noImgElement: auth-gated download URLs are not next/image candidates */}
-        <img
-          alt={file.filename}
-          className="h-auto w-full"
-          height={600}
-          src={downloadUrl}
-          width={800}
-        />
+        {downloadUrl ? (
+          // biome-ignore lint/performance/noImgElement: auth-gated download URLs are not next/image candidates
+          <img
+            alt={file.filename}
+            className="h-auto w-full"
+            height={600}
+            src={downloadUrl}
+            width={800}
+          />
+        ) : (
+          <div className="flex h-64 items-center justify-center text-muted-foreground text-sm">
+            Loading{"\u2026"}
+          </div>
+        )}
       </div>
     </div>
   );
 }
 
-function PdfPreview({ file }: { file: RunFile }) {
-  const downloadUrl = `/api/v1/files/${file.id}/download`;
+function PdfPreview({ file }: { file: ReportSectionFile }) {
+  const downloadUrl = useResolvedFileUrl(file.id);
 
   return (
     <div className="flex flex-col gap-2">
       <div className="flex items-center justify-between">
         <h3 className="font-medium text-sm">{file.filename}</h3>
-        <Button asChild className="h-7 gap-1 text-xs" size="sm" variant="ghost">
-          <a href={downloadUrl} rel="noopener noreferrer" target="_blank">
-            <ExternalLink className="size-3" />
-            Open in new tab
-          </a>
-        </Button>
+        {downloadUrl && (
+          <Button
+            asChild
+            className="h-7 gap-1 text-xs"
+            size="sm"
+            variant="ghost"
+          >
+            <a href={downloadUrl} rel="noopener noreferrer" target="_blank">
+              <ExternalLink className="size-3" />
+              Open in new tab
+            </a>
+          </Button>
+        )}
       </div>
       <div className="overflow-hidden rounded-md border">
-        <iframe
-          className="h-[80vh] w-full"
-          src={downloadUrl}
-          title={file.filename}
-        />
+        {downloadUrl ? (
+          <iframe
+            className="h-[80vh] w-full"
+            src={downloadUrl}
+            title={file.filename}
+          />
+        ) : (
+          <div className="flex h-[80vh] items-center justify-center text-muted-foreground text-sm">
+            Loading{"\u2026"}
+          </div>
+        )}
       </div>
     </div>
   );
@@ -70,7 +106,7 @@ export function RunReportSection({
   files,
   title = "Report Data",
 }: {
-  files: RunFile[];
+  files: ReportSectionFile[];
   title?: string;
 }) {
   const processedCsvs = files.filter(
diff --git a/web/components/runs/run-video-player.tsx b/web/components/runs/run-video-player.tsx
index 28dc6175..f3fa7fbd 100644
--- a/web/components/runs/run-video-player.tsx
+++ b/web/components/runs/run-video-player.tsx
@@ -1,9 +1,8 @@
+"use client";
+
 import { ExternalLink } from "lucide-react";
 import { Button } from "@/components/ui/button";
-
-function fileDownloadUrl(fileId: number): string {
-  return `/api/v1/files/${fileId}/download`;
-}
+import { useResolvedFileUrl } from "@/hooks/use-resolved-file-url";
 
 export function RunVideoPlayer({
   fileId,
@@ -14,33 +13,45 @@ export function RunVideoPlayer({
   filename: string;
   posterFileId?: number;
 }) {
-  const downloadUrl = fileDownloadUrl(fileId);
-  const posterUrl =
-    posterFileId === undefined ? undefined : fileDownloadUrl(posterFileId);
+  const downloadUrl = useResolvedFileUrl(fileId);
+  const posterUrl = useResolvedFileUrl(posterFileId);
 
   return (
     <div className="flex flex-col gap-2">
       <div className="flex items-center justify-between gap-2">
         <h3 className="truncate font-medium text-sm">{filename}</h3>
-        <Button asChild className="h-7 gap-1 text-xs" size="sm" variant="ghost">
-          <a href={downloadUrl} rel="noopener noreferrer" target="_blank">
-            <ExternalLink className="size-3" />
-            Open in new tab
-          </a>
-        </Button>
+        {downloadUrl && (
+          <Button
+            asChild
+            className="h-7 gap-1 text-xs"
+            size="sm"
+            variant="ghost"
+          >
+            <a href={downloadUrl} rel="noopener noreferrer" target="_blank">
+              <ExternalLink className="size-3" />
+              Open in new tab
+            </a>
+          </Button>
+        )}
       </div>
       {/* `preload="none"` keeps the MP4 off the wire until play; the JPEG is the still. */}
       <div className="overflow-hidden rounded-md border bg-muted/30">
-        {/* biome-ignore lint/a11y/useMediaCaption: instrument preview has no captions */}
-        <video
-          className="h-auto max-h-[70vh] w-full"
-          controls
-          key={fileId}
-          playsInline
-          poster={posterUrl}
-          preload="none"
-          src={downloadUrl}
-        />
+        {downloadUrl ? (
+          // biome-ignore lint/a11y/useMediaCaption: instrument preview has no captions
+          <video
+            className="h-auto max-h-[70vh] w-full"
+            controls
+            key={fileId}
+            playsInline
+            poster={posterUrl ?? undefined}
+            preload="none"
+            src={downloadUrl}
+          />
+        ) : (
+          <div className="flex h-64 items-center justify-center text-muted-foreground text-sm">
+            Loading{"\u2026"}
+          </div>
+        )}
       </div>
     </div>
   );
diff --git a/web/components/runs/variants/dishcam-run-detail.tsx b/web/components/runs/variants/dishcam-run-detail.tsx
index 571f3c3d..081fc89f 100644
--- a/web/components/runs/variants/dishcam-run-detail.tsx
+++ b/web/components/runs/variants/dishcam-run-detail.tsx
@@ -57,9 +57,7 @@ export function DishcamRunDetail({
 
       <RunDetail.VideoCarousel
         initialPage={reportItems}
-        instrumentId={instrumentId}
         posterFileIds={posterFileIdsByVideoFilename(reportFiles)}
-        runId={runId}
       />
     </>
   );
diff --git a/web/components/runs/variants/gel-doc-run-detail.tsx b/web/components/runs/variants/gel-doc-run-detail.tsx
index 8a204ada..25b2661c 100644
--- a/web/components/runs/variants/gel-doc-run-detail.tsx
+++ b/web/components/runs/variants/gel-doc-run-detail.tsx
@@ -63,11 +63,7 @@ export function GelDocRunDetail({
         />
       </RunDetail.FilesMetadataLayout>
 
-      <RunDetail.ImageCarousel
-        initialPage={reportItems}
-        instrumentId={instrumentId}
-        runId={runId}
-      />
+      <RunDetail.ImageCarousel initialPage={reportItems} />
     </>
   );
 }
diff --git a/web/components/runs/variants/hina-microscope-run-detail.tsx b/web/components/runs/variants/hina-microscope-run-detail.tsx
index bba3ca41..d8eba52d 100644
--- a/web/components/runs/variants/hina-microscope-run-detail.tsx
+++ b/web/components/runs/variants/hina-microscope-run-detail.tsx
@@ -61,11 +61,7 @@ export function HinaMicroscopeRunDetail({
         />
       </RunDetail.FilesMetadataLayout>
 
-      <RunDetail.ImageCarousel
-        initialPage={reportItems}
-        instrumentId={instrumentId}
-        runId={runId}
-      />
+      <RunDetail.ImageCarousel initialPage={reportItems} />
     </>
   );
 }
diff --git a/web/components/runs/variants/instant-raman-run-detail.tsx b/web/components/runs/variants/instant-raman-run-detail.tsx
index feb1cc5d..f224d5ca 100644
--- a/web/components/runs/variants/instant-raman-run-detail.tsx
+++ b/web/components/runs/variants/instant-raman-run-detail.tsx
@@ -53,11 +53,7 @@ export function InstantRamanRunDetail({
         />
       </RunDetail.FilesMetadataLayout>
 
-      <RunDetail.RamanReport
-        initialPage={reportItems}
-        instrumentId={instrumentId}
-        runId={runId}
-      />
+      <RunDetail.RamanReport initialPage={reportItems} />
     </>
   );
 }
diff --git a/web/components/runs/variants/tape-station-run-detail.tsx b/web/components/runs/variants/tape-station-run-detail.tsx
index dcb97ee2..b1049626 100644
--- a/web/components/runs/variants/tape-station-run-detail.tsx
+++ b/web/components/runs/variants/tape-station-run-detail.tsx
@@ -68,11 +68,7 @@ export function TapeStationRunDetail({
       </RunDetail.FilesMetadataLayout>
 
       {pdfCount > 0 || csvReportFiles.length === 0 ? (
-        <RunDetail.PdfCarousel
-          initialPage={reportItems}
-          instrumentId={instrumentId}
-          runId={runId}
-        />
+        <RunDetail.PdfCarousel initialPage={reportItems} />
       ) : null}
       {csvReportFiles.length > 0 && (
         <RunDetail.Report
diff --git a/web/components/runs/video-carousel-report.tsx b/web/components/runs/video-carousel-report.tsx
index 1280a4e3..11e5b88a 100644
--- a/web/components/runs/video-carousel-report.tsx
+++ b/web/components/runs/video-carousel-report.tsx
@@ -39,18 +39,11 @@ function SelectedVideo({
 // filename → file-id map so full `RunFile` rows never reach the client.
 export function VideoCarouselReport({
   initialPage,
-  instrumentId,
   posterFileIds,
-  runId,
 }: ReportViewerProps & { posterFileIds: Record<string, number> }) {
   return (
     <ReportDataShell total={initialPage.pagination.total}>
-      <ReportItemsProvider
-        initialPage={initialPage}
-        instrumentId={instrumentId}
-        kind="video"
-        runId={runId}
-      >
+      <ReportItemsProvider initialPage={initialPage} kind="video">
         <ReportItemSeeker />
         <SelectedVideo posterFileIds={posterFileIds} />
       </ReportItemsProvider>
diff --git a/web/hooks/use-report-items.ts b/web/hooks/use-report-items.ts
index 346fda3b..6e999de1 100644
--- a/web/hooks/use-report-items.ts
+++ b/web/hooks/use-report-items.ts
@@ -6,9 +6,9 @@ import {
   type ReportItem,
   type ReportItemKind,
   type ReportItemsPage,
-  reportItemsUrl,
   type SeekerSource,
 } from "@/lib/runs/report-items";
+import type { ReportDataSource } from "@/lib/runs/view-data-source";
 
 const SEARCH_DEBOUNCE_MS = 300;
 
@@ -28,10 +28,9 @@ interface Selection {
 }
 
 export interface UseReportItemsOptions {
+  fetchReportItems: ReportDataSource["fetchReportItems"];
   initialPage: ReportItemsPage;
-  instrumentId: string;
   kind: ReportItemKind;
-  runId: string;
 }
 
 export type UseReportItemsResult = SeekerSource;
@@ -41,10 +40,9 @@ function errorMessage(err: unknown): string {
 }
 
 export function useReportItems({
+  fetchReportItems,
   initialPage,
-  instrumentId,
   kind,
-  runId,
 }: UseReportItemsOptions): UseReportItemsResult {
   const [cache, setCache] = useState<Record<string, CacheEntry>>(() => ({
     "": {
@@ -78,24 +76,19 @@ export function useReportItems({
   const selectedItem = items[selectedIndex - offset] ?? null;
 
   const fetchWindow = useCallback(
-    async (
-      params: { anchor?: number; offset: number; search: string },
-      signal: AbortSignal
-    ): Promise<ReportItemsPage> => {
-      const response = await fetch(
-        reportItemsUrl(instrumentId, runId, {
-          ...params,
-          kind,
-          limit: REPORT_ITEMS_WINDOW,
-        }),
-        { signal }
-      );
-      if (!response.ok) {
-        throw new Error(`Failed to load report items (${response.status})`);
-      }
-      return (await response.json()) as ReportItemsPage;
-    },
-    [instrumentId, kind, runId]
+    (params: {
+      anchor?: number;
+      offset: number;
+      search: string;
+    }): Promise<ReportItemsPage> =>
+      fetchReportItems({
+        kind,
+        offset: params.offset,
+        limit: REPORT_ITEMS_WINDOW,
+        search: params.search || undefined,
+        anchor: params.anchor,
+      }),
+    [fetchReportItems, kind]
   );
 
   useEffect(() => {
@@ -112,8 +105,11 @@ export function useReportItems({
       return;
     }
     const controller = new AbortController();
-    fetchWindow({ offset: 0, search: query }, controller.signal)
+    fetchWindow({ offset: 0, search: query })
       .then((page) => {
+        if (controller.signal.aborted) {
+          return;
+        }
         setCache((prev) => ({
           ...prev,
           [query]: {
@@ -152,10 +148,13 @@ export function useReportItems({
         const nextOffset = isForward
           ? offset + items.length
           : Math.max(0, offset - REPORT_ITEMS_WINDOW);
-        const page = await fetchWindow(
-          { offset: nextOffset, search: query },
-          controller.signal
-        );
+        const page = await fetchWindow({
+          offset: nextOffset,
+          search: query,
+        });
+        if (controller.signal.aborted) {
+          return entry;
+        }
         // A backward window clamped at 0 can overlap what is already loaded,
         // so drop the rows it duplicates before joining the two runs.
         const overlap = Math.max(0, nextOffset + page.data.length - offset);
@@ -184,7 +183,9 @@ export function useReportItems({
         }
         return entry;
       } finally {
-        setIsBusy(false);
+        if (!controller.signal.aborted) {
+          setIsBusy(false);
+        }
       }
     },
     [entry, fetchWindow, hasMore, hasPrevious, isBusy, items, offset, query]
@@ -247,8 +248,11 @@ export function useReportItems({
       }
 
       const controller = new AbortController();
-      void fetchWindow({ anchor, offset: 0, search: "" }, controller.signal)
+      void fetchWindow({ anchor, offset: 0, search: "" })
         .then((page) => {
+          if (controller.signal.aborted) {
+            return;
+          }
           setCache((prev) => ({
             ...prev,
             "": {
@@ -264,7 +268,11 @@ export function useReportItems({
           setSearchInput("");
           setQuery("");
         })
-        .catch((err: unknown) => setError(errorMessage(err)));
+        .catch((err: unknown) => {
+          if (!controller.signal.aborted) {
+            setError(errorMessage(err));
+          }
+        });
     },
     [fetchWindow, query, selectedItem]
   );
diff --git a/web/hooks/use-resolved-file-url.ts b/web/hooks/use-resolved-file-url.ts
new file mode 100644
index 00000000..dba95d39
--- /dev/null
+++ b/web/hooks/use-resolved-file-url.ts
@@ -0,0 +1,46 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { useReportDataSource } from "@/components/runs/report-data-source-provider";
+
+// REST returns a path string synchronously; the View's MCP source returns a
+// Promise (fresh presigned URL). Read the sync path during render so the
+// carousel never paints the previous file's URL for a frame.
+export function useResolvedFileUrl(
+  fileId: number | null | undefined
+): string | null {
+  const dataSource = useReportDataSource();
+  const [asyncResult, setAsyncResult] = useState<{
+    fileId: number;
+    url: string;
+  } | null>(null);
+
+  const resolved =
+    fileId == null ? undefined : dataSource.resolveFileUrl(fileId);
+
+  useEffect(() => {
+    if (fileId == null || resolved == null || typeof resolved === "string") {
+      return;
+    }
+    let cancelled = false;
+    resolved.then((url) => {
+      if (!cancelled) {
+        setAsyncResult({ fileId, url });
+      }
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [fileId, resolved]);
+
+  if (fileId == null) {
+    return null;
+  }
+  if (typeof resolved === "string") {
+    return resolved;
+  }
+  if (asyncResult?.fileId === fileId) {
+    return asyncResult.url;
+  }
+  return null;
+}
diff --git a/web/lib/api/files.ts b/web/lib/api/files.ts
index 83e4beca..f3ba2d03 100644
--- a/web/lib/api/files.ts
+++ b/web/lib/api/files.ts
@@ -1,4 +1,4 @@
-import { and, eq, isNotNull, isNull, sql } from "drizzle-orm";
+import { and, eq, inArray, isNotNull, isNull, sql } from "drizzle-orm";
 import { db } from "@/lib/db";
 import { files, instrumentRuns } from "@/lib/db/schema";
 
@@ -16,6 +16,50 @@ export async function getActiveFileById(
   return file ?? null;
 }
 
+export async function getActiveFilesByIds(ids: number[]): Promise<
+  Array<{
+    filename: string;
+    id: number;
+    s3Bucket: string | null;
+    s3Key: string | null;
+  }>
+> {
+  if (ids.length === 0) {
+    return [];
+  }
+  return await db
+    .select({
+      id: files.id,
+      filename: files.filename,
+      s3Bucket: files.s3Bucket,
+      s3Key: files.s3Key,
+    })
+    .from(files)
+    .where(and(inArray(files.id, ids), isNull(files.deletedAt)));
+}
+
+// Filename suffix match for JSON artifacts (e.g. `_aunty_plate.json`).
+export async function findActiveFileBySuffix(
+  runInternalId: string,
+  suffix: string
+): Promise<FileRow | null> {
+  if (suffix.length === 0) {
+    return null;
+  }
+  const [file] = await db
+    .select()
+    .from(files)
+    .where(
+      and(
+        eq(files.instrumentRunId, runInternalId),
+        isNull(files.deletedAt),
+        sql`right(${files.filename}, ${suffix.length}) = ${suffix}`
+      )
+    )
+    .limit(1);
+  return file ?? null;
+}
+
 export type FileDownloadLookup =
   | { ok: true; filename: string; s3Bucket: string; s3Key: string }
   | { ok: false; reason: "not_found" | "not_uploaded" };
diff --git a/web/lib/mcp/absolute-url.ts b/web/lib/mcp/absolute-url.ts
new file mode 100644
index 00000000..0ebd6925
--- /dev/null
+++ b/web/lib/mcp/absolute-url.ts
@@ -0,0 +1,12 @@
+import { authBaseURL } from "@/lib/auth";
+
+// Local-mirror helpers return a path like `/api/local-s3/...`. Inside a
+// cross-origin View iframe that resolves against the sandbox origin, so MCP
+// app-visible tools must prefix the app origin.
+export function toAbsoluteDownloadUrl(url: string): string {
+  if (/^https?:\/\//i.test(url)) {
+    return url;
+  }
+  const path = url.startsWith("/") ? url : `/${url}`;
+  return `${authBaseURL}${path}`;
+}
diff --git a/web/lib/mcp/catalog/register.ts b/web/lib/mcp/catalog/register.ts
index 7547dd4b..e251934d 100644
--- a/web/lib/mcp/catalog/register.ts
+++ b/web/lib/mcp/catalog/register.ts
@@ -1,5 +1,6 @@
 import { type ZodType, z } from "zod";
 import type { McpToolAnnotations } from "@/lib/mcp/catalog/types";
+import type { McpToolUiMeta } from "@/lib/mcp/ui-apps";
 
 /** Config object passed to `server.registerTool` (name is separate). */
 export function toolRegistrationConfig<
@@ -12,12 +13,14 @@ export function toolRegistrationConfig<
   inputSchema: TSchema;
   outputSchema?: TOutput;
   annotations?: TAnnotations;
+  _meta?: McpToolUiMeta;
 }): {
   title: string;
   description: string;
   inputSchema: z.ZodObject<TSchema>;
   outputSchema?: TOutput;
   annotations: TAnnotations;
+  _meta?: McpToolUiMeta;
 };
 export function toolRegistrationConfig<
   TAnnotations extends McpToolAnnotations | undefined,
@@ -28,11 +31,13 @@ export function toolRegistrationConfig<
   inputSchema?: undefined;
   outputSchema?: TOutput;
   annotations?: TAnnotations;
+  _meta?: McpToolUiMeta;
 }): {
   title: string;
   description: string;
   outputSchema?: TOutput;
   annotations: TAnnotations;
+  _meta?: McpToolUiMeta;
 };
 export function toolRegistrationConfig(def: {
   title: string;
@@ -40,6 +45,7 @@ export function toolRegistrationConfig(def: {
   inputSchema?: Record<string, ZodType>;
   outputSchema?: ZodType;
   annotations?: McpToolAnnotations;
+  _meta?: McpToolUiMeta;
 }) {
   return {
     title: def.title,
@@ -52,6 +58,7 @@ export function toolRegistrationConfig(def: {
     // Discriminated unions (e.g. get_run_archive) must stay intact.
     ...(def.outputSchema ? { outputSchema: def.outputSchema } : {}),
     annotations: def.annotations,
+    ...(def._meta ? { _meta: def._meta } : {}),
   };
 }
 
diff --git a/web/lib/mcp/catalog/tools.ts b/web/lib/mcp/catalog/tools.ts
index 94f15da5..d9c973d7 100644
--- a/web/lib/mcp/catalog/tools.ts
+++ b/web/lib/mcp/catalog/tools.ts
@@ -2,6 +2,7 @@ import type { McpToolDef } from "@/lib/mcp/catalog/types";
 import { DISCOVERY_TOOL_DEFS } from "@/lib/mcp/tools/discovery.defs";
 import { FILE_TOOL_DEFS } from "@/lib/mcp/tools/files.defs";
 import { INSTRUMENT_TOOL_DEFS } from "@/lib/mcp/tools/instruments.defs";
+import { REPORT_VIEW_TOOL_DEFS } from "@/lib/mcp/tools/report-views.defs";
 import { RUN_TOOL_DEFS } from "@/lib/mcp/tools/runs.defs";
 import { WATCHER_TOOL_DEFS } from "@/lib/mcp/tools/watchers.defs";
 
@@ -9,6 +10,7 @@ import { WATCHER_TOOL_DEFS } from "@/lib/mcp/tools/watchers.defs";
 export const MCP_TOOL_DEFS: readonly McpToolDef[] = [
   ...INSTRUMENT_TOOL_DEFS,
   ...RUN_TOOL_DEFS,
+  ...REPORT_VIEW_TOOL_DEFS,
   ...FILE_TOOL_DEFS,
   ...WATCHER_TOOL_DEFS,
   ...DISCOVERY_TOOL_DEFS,
diff --git a/web/lib/mcp/catalog/types.ts b/web/lib/mcp/catalog/types.ts
index eb6a37cd..99b9a2a5 100644
--- a/web/lib/mcp/catalog/types.ts
+++ b/web/lib/mcp/catalog/types.ts
@@ -1,4 +1,5 @@
 import type { ZodType } from "zod";
+import type { McpToolUiMeta } from "@/lib/mcp/ui-apps";
 
 export const MCP_TOOL_GROUPS = {
   instruments: "Instruments",
@@ -19,6 +20,11 @@ export interface McpToolAnnotations {
 }
 
 export interface McpToolDef {
+  /**
+   * MCP Apps (SEP-1865) tool metadata. Passed through to `registerTool`.
+   * Hosts that do not implement Apps ignore the key.
+   */
+  _meta?: McpToolUiMeta;
   annotations?: McpToolAnnotations;
   description: string;
   group: McpToolGroup;
diff --git a/web/lib/mcp/cors.ts b/web/lib/mcp/cors.ts
new file mode 100644
index 00000000..fb2f3417
--- /dev/null
+++ b/web/lib/mcp/cors.ts
@@ -0,0 +1,26 @@
+// Browser MCP hosts (basic-host, in-page clients) call `/mcp/v1` cross-origin
+// with a Bearer token. Discovery already uses `*`; keep the transport aligned.
+export const MCP_CORS_HEADERS: Record<string, string> = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
+  "Access-Control-Allow-Headers":
+    "Authorization, Content-Type, Accept, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID",
+  "Access-Control-Expose-Headers": "Mcp-Session-Id, WWW-Authenticate",
+  "Access-Control-Max-Age": "86400",
+};
+
+export function mcpCorsPreflight(): Response {
+  return new Response(null, { status: 204, headers: MCP_CORS_HEADERS });
+}
+
+export function withMcpCors(response: Response): Response {
+  const headers = new Headers(response.headers);
+  for (const [key, value] of Object.entries(MCP_CORS_HEADERS)) {
+    headers.set(key, value);
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
diff --git a/web/lib/mcp/resources.defs.ts b/web/lib/mcp/resources.defs.ts
index 4dd611ff..8124823d 100644
--- a/web/lib/mcp/resources.defs.ts
+++ b/web/lib/mcp/resources.defs.ts
@@ -1,4 +1,8 @@
 import type { McpResourceDef } from "@/lib/mcp/catalog/types";
+import {
+  MCP_APP_MIME_TYPE,
+  RUN_REPORT_UI_RESOURCE_URI,
+} from "@/lib/mcp/ui-apps";
 
 export const instrumentsResource = {
   name: "instruments",
@@ -36,9 +40,19 @@ export const instrumentFilterOptionsResource = {
   uriTemplate: "datahub://instruments/{instrumentId}/filter-options",
 } as const satisfies McpResourceDef;
 
+export const runReportUiResource = {
+  name: "run-report",
+  description:
+    "MCP Apps view for a Data Hub instrument run report. Linked from get_run_report.",
+  mimeType: MCP_APP_MIME_TYPE,
+  kind: "static",
+  uri: RUN_REPORT_UI_RESOURCE_URI,
+} as const satisfies McpResourceDef;
+
 export const MCP_RESOURCE_DEFS = [
   instrumentsResource,
   meResource,
   glossaryResource,
   instrumentFilterOptionsResource,
+  runReportUiResource,
 ] as const;
diff --git a/web/lib/mcp/resources.ts b/web/lib/mcp/resources.ts
index 425992ae..b72fba23 100644
--- a/web/lib/mcp/resources.ts
+++ b/web/lib/mcp/resources.ts
@@ -5,12 +5,19 @@ import type { InstrumentType } from "@/lib/db/schema";
 import { completeInstrumentId } from "@/lib/mcp/completions";
 import { DATAHUB_GLOSSARY } from "@/lib/mcp/glossary";
 import { resolveInstrumentFilterOptions } from "@/lib/mcp/instrument-filter-options";
+import { loadRunReportHtml } from "@/lib/mcp/run-report-html";
 import { getMcpUserId } from "@/lib/mcp/tools/helpers";
+import {
+  MCP_APP_MIME_TYPE,
+  RUN_REPORT_UI_RESOURCE_URI,
+} from "@/lib/mcp/ui-apps";
+import { runReportUiMeta } from "@/lib/mcp/ui-csp";
 import {
   glossaryResource,
   instrumentFilterOptionsResource,
   instrumentsResource,
   meResource,
+  runReportUiResource,
 } from "./resources.defs";
 
 // Instrument types with structured filter-options. Must match `search_runs` args.
@@ -195,4 +202,25 @@ export function registerResources(server: McpServer) {
       };
     }
   );
+
+  const uiMeta = runReportUiMeta();
+  server.registerResource(
+    runReportUiResource.name,
+    runReportUiResource.uri,
+    {
+      description: runReportUiResource.description,
+      mimeType: runReportUiResource.mimeType,
+      _meta: uiMeta,
+    },
+    async () => ({
+      contents: [
+        {
+          uri: RUN_REPORT_UI_RESOURCE_URI,
+          mimeType: MCP_APP_MIME_TYPE,
+          text: loadRunReportHtml(),
+          _meta: uiMeta,
+        },
+      ],
+    })
+  );
 }
diff --git a/web/lib/mcp/run-report-html.ts b/web/lib/mcp/run-report-html.ts
new file mode 100644
index 00000000..83e8e7d6
--- /dev/null
+++ b/web/lib/mcp/run-report-html.ts
@@ -0,0 +1,74 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { authBaseURL } from "@/lib/auth";
+
+export const DATA_HUB_ORIGIN_PLACEHOLDER = "%%DATA_HUB_ORIGIN%%";
+
+const BUILT_HTML_PATH = path.join(
+  process.cwd(),
+  "mcp-apps/dist/run-report.html"
+);
+
+// Minimal MCP App so `resources/read` and basic-host work before the first
+// Vite build. The real bundle overwrites this once `mcp-apps:build` runs.
+export const HELLO_WORLD_RUN_REPORT_HTML = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <meta name="data-hub-origin" content="${DATA_HUB_ORIGIN_PLACEHOLDER}" />
+  <title>Data Hub run report</title>
+  <style>
+    :root { color-scheme: light dark; font-family: system-ui, sans-serif; }
+    body { margin: 1rem; }
+  </style>
+</head>
+<body>
+  <h1>Data Hub run report</h1>
+  <p id="status">Connecting…</p>
+  <script>
+    let nextId = 1;
+    function sendRequest(method, params) {
+      const id = nextId++;
+      window.parent.postMessage({ jsonrpc: "2.0", id, method, params }, "*");
+      return new Promise((resolve, reject) => {
+        function listener(event) {
+          if (event.data && event.data.id === id) {
+            window.removeEventListener("message", listener);
+            if (event.data.result) resolve(event.data.result);
+            else reject(event.data.error);
+          }
+        }
+        window.addEventListener("message", listener);
+      });
+    }
+    (async () => {
+      await sendRequest("ui/initialize", {
+        protocolVersion: "2026-01-26",
+        clientInfo: { name: "data-hub-run-report", version: "0.0.0" },
+        appCapabilities: { availableDisplayModes: ["inline", "fullscreen"] },
+      });
+      window.parent.postMessage(
+        { jsonrpc: "2.0", method: "ui/notifications/initialized" },
+        "*"
+      );
+      document.getElementById("status").textContent =
+        "Hello from the Data Hub run report view.";
+    })().catch((err) => {
+      document.getElementById("status").textContent =
+        "Failed to initialize: " + (err && err.message ? err.message : err);
+    });
+  </script>
+</body>
+</html>
+`;
+
+export function loadRunReportHtml(): string {
+  const html = existsSync(BUILT_HTML_PATH)
+    ? readFileSync(BUILT_HTML_PATH, "utf8")
+    : HELLO_WORLD_RUN_REPORT_HTML;
+  return html.replaceAll(
+    DATA_HUB_ORIGIN_PLACEHOLDER,
+    authBaseURL.replace(/\/$/, "")
+  );
+}
diff --git a/web/lib/mcp/tools/index.ts b/web/lib/mcp/tools/index.ts
index d3ccce14..af86ccba 100644
--- a/web/lib/mcp/tools/index.ts
+++ b/web/lib/mcp/tools/index.ts
@@ -2,12 +2,14 @@ import type { McpServer } from "@modelcontextprotocol/server";
 import { registerDiscoveryTools } from "@/lib/mcp/tools/discovery";
 import { registerFileTools } from "@/lib/mcp/tools/files";
 import { registerInstrumentTools } from "@/lib/mcp/tools/instruments";
+import { registerReportViewTools } from "@/lib/mcp/tools/report-views";
 import { registerRunTools } from "@/lib/mcp/tools/runs";
 import { registerWatcherTools } from "@/lib/mcp/tools/watchers";
 
 export function registerTools(server: McpServer) {
   registerInstrumentTools(server);
   registerRunTools(server);
+  registerReportViewTools(server);
   registerDiscoveryTools(server);
   registerWatcherTools(server);
   registerFileTools(server);
diff --git a/web/lib/mcp/tools/report-views.defs.ts b/web/lib/mcp/tools/report-views.defs.ts
new file mode 100644
index 00000000..8f38ba83
--- /dev/null
+++ b/web/lib/mcp/tools/report-views.defs.ts
@@ -0,0 +1,123 @@
+import { z } from "zod";
+import type { McpToolDef } from "@/lib/mcp/catalog/types";
+import {
+  REPORT_VIEW_TABLE_DEFAULT_LIMIT,
+  REPORT_VIEW_TABLE_MAX_LIMIT,
+  RUN_REPORT_UI_RESOURCE_URI,
+} from "@/lib/mcp/ui-apps";
+import {
+  REPORT_ITEMS_MAX_LIMIT,
+  REPORT_ITEMS_WINDOW,
+} from "@/lib/runs/report-items";
+import {
+  reportViewArtifactOutputSchema,
+  reportViewItemKindSchema,
+  reportViewItemsOutputSchema,
+  reportViewTableOutputSchema,
+} from "./report-views.output";
+
+const APP_ONLY_META = {
+  ui: {
+    resourceUri: RUN_REPORT_UI_RESOURCE_URI,
+    visibility: ["app"] as const,
+  },
+};
+
+const INTERNAL_STEER =
+  "Internal. Used by the Data Hub run report view. Call `get_run_report` instead.";
+
+export const reportViewItemsTool = {
+  name: "report_view_items",
+  group: "runs",
+  scope: "files:read",
+  title: "Report View Items",
+  description: INTERNAL_STEER,
+  outputSchema: reportViewItemsOutputSchema,
+  inputSchema: {
+    instrumentId: z.string().describe("Instrument identifier"),
+    runId: z.string().describe("Run identifier within the instrument"),
+    kind: reportViewItemKindSchema.describe(
+      "Report item kind: image, pdf, spectrum, or video"
+    ),
+    offset: z
+      .number()
+      .int()
+      .min(0)
+      .optional()
+      .describe("Window start index (default: 0)"),
+    limit: z
+      .number()
+      .int()
+      .min(1)
+      .max(REPORT_ITEMS_MAX_LIMIT)
+      .optional()
+      .describe(
+        `Items per window (default: ${REPORT_ITEMS_WINDOW}, max: ${REPORT_ITEMS_MAX_LIMIT})`
+      ),
+    search: z.string().optional().describe("Filename substring filter"),
+    anchor: z
+      .number()
+      .int()
+      .positive()
+      .optional()
+      .describe("File id to centre the window on; overrides offset when found"),
+  },
+  annotations: { readOnlyHint: true },
+  _meta: APP_ONLY_META,
+} as const satisfies McpToolDef;
+
+export const reportViewTableTool = {
+  name: "report_view_table",
+  group: "runs",
+  scope: "files:read",
+  title: "Report View Table",
+  description: INTERNAL_STEER,
+  outputSchema: reportViewTableOutputSchema,
+  inputSchema: {
+    instrumentId: z.string().describe("Instrument identifier"),
+    runId: z.string().describe("Run identifier within the instrument"),
+    fileId: z.number().int().describe("Numeric file ID of the CSV"),
+    offset: z
+      .number()
+      .int()
+      .min(0)
+      .optional()
+      .describe("Row offset (default: 0)"),
+    limit: z
+      .number()
+      .int()
+      .min(1)
+      .max(REPORT_VIEW_TABLE_MAX_LIMIT)
+      .optional()
+      .describe(
+        `Rows to return (default: ${REPORT_VIEW_TABLE_DEFAULT_LIMIT}, max: ${REPORT_VIEW_TABLE_MAX_LIMIT})`
+      ),
+  },
+  annotations: { readOnlyHint: true },
+  _meta: APP_ONLY_META,
+} as const satisfies McpToolDef;
+
+export const reportViewArtifactTool = {
+  name: "report_view_artifact",
+  group: "runs",
+  scope: "files:read",
+  title: "Report View Artifact",
+  description: INTERNAL_STEER,
+  outputSchema: reportViewArtifactOutputSchema,
+  inputSchema: {
+    instrumentId: z.string().describe("Instrument identifier"),
+    runId: z.string().describe("Run identifier within the instrument"),
+    suffix: z
+      .string()
+      .min(1)
+      .describe("Filename suffix of the JSON artifact, e.g. _aunty_plate.json"),
+  },
+  annotations: { readOnlyHint: true },
+  _meta: APP_ONLY_META,
+} as const satisfies McpToolDef;
+
+export const REPORT_VIEW_TOOL_DEFS = [
+  reportViewItemsTool,
+  reportViewTableTool,
+  reportViewArtifactTool,
+] as const;
diff --git a/web/lib/mcp/tools/report-views.output.ts b/web/lib/mcp/tools/report-views.output.ts
new file mode 100644
index 00000000..952d88c5
--- /dev/null
+++ b/web/lib/mcp/tools/report-views.output.ts
@@ -0,0 +1,32 @@
+import { z } from "zod";
+import { REPORT_ITEM_KINDS } from "@/lib/runs/report-items";
+
+export const reportViewItemSchema = z.object({
+  id: z.number().int(),
+  filename: z.string(),
+  downloadUrl: z.string(),
+});
+
+export const reportViewItemsOutputSchema = z.object({
+  data: z.array(reportViewItemSchema),
+  pagination: z.object({
+    anchor_index: z.number().int().nullable().optional(),
+    limit: z.number().int(),
+    offset: z.number().int(),
+    total: z.number().int(),
+  }),
+});
+
+export const reportViewTableOutputSchema = z.object({
+  columns: z.array(z.string()),
+  rows: z.array(z.record(z.string(), z.string())),
+  total: z.number().int(),
+});
+
+export const reportViewArtifactOutputSchema = z.object({
+  suffix: z.string(),
+  filename: z.string(),
+  artifact: z.unknown(),
+});
+
+export const reportViewItemKindSchema = z.enum(REPORT_ITEM_KINDS);
diff --git a/web/lib/mcp/tools/report-views.ts b/web/lib/mcp/tools/report-views.ts
new file mode 100644
index 00000000..94acb34a
--- /dev/null
+++ b/web/lib/mcp/tools/report-views.ts
@@ -0,0 +1,256 @@
+import type { McpServer } from "@modelcontextprotocol/server";
+import { parse } from "csv-parse";
+import {
+  findActiveFileBySuffix,
+  getActiveFileById,
+  getActiveFilesByIds,
+  lookupFileForDownload,
+} from "@/lib/api/files";
+import {
+  getAuntyPlateData,
+  getRunReportFiles,
+  lookupRunByNaturalKey,
+} from "@/lib/api/instrument-runs";
+import { getReportItemsPage } from "@/lib/api/report-items";
+import { toAbsoluteDownloadUrl } from "@/lib/mcp/absolute-url";
+import { toolRegistrationConfig } from "@/lib/mcp/catalog/register";
+import {
+  errorResult,
+  getMcpUserId,
+  structuredResult,
+} from "@/lib/mcp/tools/helpers";
+import {
+  REPORT_VIEW_TABLE_DEFAULT_LIMIT,
+  REPORT_VIEW_TABLE_MAX_LIMIT,
+  REPORT_VIEW_TABLE_SCAN_CAP,
+} from "@/lib/mcp/ui-apps";
+import { REPORT_ITEMS_WINDOW } from "@/lib/runs/report-items";
+import { getPresignedDownloadUrl, getS3ObjectStream } from "@/lib/s3";
+import {
+  reportViewArtifactTool,
+  reportViewItemsTool,
+  reportViewTableTool,
+} from "./report-views.defs";
+
+function requireMcpUser(authInfo: Parameters<typeof getMcpUserId>[0]) {
+  const userId = getMcpUserId(authInfo);
+  if (!userId) {
+    return {
+      ok: false as const,
+      error: errorResult("Authenticated user not available on this session."),
+    };
+  }
+  return { ok: true as const, userId };
+}
+
+async function streamToBuffer(
+  stream: import("node:stream").Readable
+): Promise<Buffer> {
+  const chunks: Buffer[] = [];
+  for await (const chunk of stream) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks);
+}
+
+async function parseCsvPage(
+  bucket: string,
+  key: string,
+  offset: number,
+  limit: number
+): Promise<{
+  columns: string[];
+  rows: Record<string, string>[];
+  total: number;
+}> {
+  const stream = await getS3ObjectStream(bucket, key);
+  const parser = stream.pipe(
+    parse({ columns: true, skip_empty_lines: true, trim: true })
+  );
+
+  let index = 0;
+  const rows: Record<string, string>[] = [];
+  let columns: string[] = [];
+
+  try {
+    for await (const record of parser) {
+      const row = record as Record<string, string>;
+      if (index === 0) {
+        columns = Object.keys(row);
+      }
+      if (index >= offset && rows.length < limit) {
+        rows.push(row);
+      }
+      index += 1;
+      if (index >= REPORT_VIEW_TABLE_SCAN_CAP) {
+        break;
+      }
+    }
+  } finally {
+    parser.destroy();
+    stream.destroy();
+  }
+
+  return { columns, rows, total: index };
+}
+
+export function registerReportViewTools(server: McpServer) {
+  server.registerTool(
+    reportViewItemsTool.name,
+    toolRegistrationConfig(reportViewItemsTool),
+    async (args, ctx) => {
+      const auth = requireMcpUser(ctx.http?.authInfo);
+      if (!auth.ok) {
+        return auth.error;
+      }
+
+      const run = await lookupRunByNaturalKey(args.instrumentId, args.runId);
+      if (!run) {
+        return errorResult(
+          `Run '${args.runId}' not found for instrument '${args.instrumentId}'.`
+        );
+      }
+
+      const page = await getReportItemsPage(run.id, {
+        kind: args.kind,
+        offset: args.offset ?? 0,
+        limit: args.limit ?? REPORT_ITEMS_WINDOW,
+        search: args.search,
+        anchorId: args.anchor,
+      });
+
+      const stored = await getActiveFilesByIds(
+        page.data.map((item) => item.id)
+      );
+      const byId = new Map(stored.map((file) => [file.id, file]));
+
+      const data = await Promise.all(
+        page.data.map(async (item) => {
+          const file = byId.get(item.id);
+          if (!(file?.s3Bucket && file.s3Key)) {
+            return { ...item, downloadUrl: "" };
+          }
+          // Omit filename so the URL is not forced to Content-Disposition:
+          // attachment — nested PDF iframes need inline rendering.
+          const url = await getPresignedDownloadUrl(file.s3Bucket, file.s3Key);
+          return { ...item, downloadUrl: toAbsoluteDownloadUrl(url) };
+        })
+      );
+
+      return structuredResult({ data, pagination: page.pagination });
+    }
+  );
+
+  server.registerTool(
+    reportViewTableTool.name,
+    toolRegistrationConfig(reportViewTableTool),
+    async (args, ctx) => {
+      const auth = requireMcpUser(ctx.http?.authInfo);
+      if (!auth.ok) {
+        return auth.error;
+      }
+
+      const run = await lookupRunByNaturalKey(args.instrumentId, args.runId);
+      if (!run) {
+        return errorResult(
+          `Run '${args.runId}' not found for instrument '${args.instrumentId}'.`
+        );
+      }
+
+      const file = await getActiveFileById(args.fileId);
+      if (!file || file.instrumentRunId !== run.id) {
+        return errorResult(
+          `File '${args.fileId}' not found on run '${args.runId}'.`
+        );
+      }
+      const download = await lookupFileForDownload(args.fileId);
+      if (!download.ok) {
+        return errorResult(
+          download.reason === "not_uploaded"
+            ? `File '${args.fileId}' has not been uploaded yet.`
+            : `File '${args.fileId}' not found on run '${args.runId}'.`
+        );
+      }
+
+      const limit = Math.min(
+        args.limit ?? REPORT_VIEW_TABLE_DEFAULT_LIMIT,
+        REPORT_VIEW_TABLE_MAX_LIMIT
+      );
+      const offset = Math.max(args.offset ?? 0, 0);
+
+      try {
+        const table = await parseCsvPage(
+          download.s3Bucket,
+          download.s3Key,
+          offset,
+          limit
+        );
+        return structuredResult(table);
+      } catch (err) {
+        console.error(`Failed to parse CSV for file ${file.id}:`, err);
+        return errorResult(`Failed to parse CSV for file '${args.fileId}'.`);
+      }
+    }
+  );
+
+  server.registerTool(
+    reportViewArtifactTool.name,
+    toolRegistrationConfig(reportViewArtifactTool),
+    async (args, ctx) => {
+      const auth = requireMcpUser(ctx.http?.authInfo);
+      if (!auth.ok) {
+        return auth.error;
+      }
+
+      const run = await lookupRunByNaturalKey(args.instrumentId, args.runId);
+      if (!run) {
+        return errorResult(
+          `Run '${args.runId}' not found for instrument '${args.instrumentId}'.`
+        );
+      }
+
+      if (args.suffix.endsWith("_aunty_plate.json")) {
+        const runFiles = await getRunReportFiles(run.id);
+        const plate = await getAuntyPlateData(runFiles);
+        if (!plate) {
+          return errorResult(
+            `No artifact ending with '${args.suffix}' on run '${args.runId}'.`
+          );
+        }
+        const plateFile = runFiles.find(
+          (file) =>
+            file.filename.endsWith("_aunty_plate.json") &&
+            file.deletedAt === null
+        );
+        return structuredResult({
+          suffix: args.suffix,
+          filename: plateFile?.filename ?? `${args.runId}_aunty_plate.json`,
+          artifact: plate,
+        });
+      }
+
+      const file = await findActiveFileBySuffix(run.id, args.suffix);
+      if (!(file?.s3Bucket && file.s3Key)) {
+        return errorResult(
+          `No artifact ending with '${args.suffix}' on run '${args.runId}'.`
+        );
+      }
+
+      try {
+        const stream = await getS3ObjectStream(file.s3Bucket, file.s3Key);
+        const buf = await streamToBuffer(stream);
+        const artifact: unknown = JSON.parse(buf.toString("utf8"));
+        return structuredResult({
+          suffix: args.suffix,
+          filename: file.filename,
+          artifact,
+        });
+      } catch (err) {
+        console.error(`Failed to parse artifact ${file.s3Key}:`, err);
+        return errorResult(
+          `Failed to parse JSON artifact ending with '${args.suffix}'.`
+        );
+      }
+    }
+  );
+}
diff --git a/web/lib/mcp/tools/runs.defs.ts b/web/lib/mcp/tools/runs.defs.ts
index d5758d8e..e38c995d 100644
--- a/web/lib/mcp/tools/runs.defs.ts
+++ b/web/lib/mcp/tools/runs.defs.ts
@@ -2,6 +2,7 @@ import { z } from "zod";
 import { mcpMetadataFilterInputSchema } from "@/lib/api/run-metadata-filters";
 import { fileStatusEnum } from "@/lib/db/schema";
 import type { McpToolDef } from "@/lib/mcp/catalog/types";
+import { RUN_REPORT_UI_RESOURCE_URI } from "@/lib/mcp/ui-apps";
 import { RUN_STATUS_VALUES } from "@/lib/runs/run-status";
 import {
   addRunCommentOutputSchema,
@@ -134,6 +135,12 @@ export const getRunReportTool = {
     runId: z.string().describe("Run identifier within the instrument"),
   },
   annotations: { readOnlyHint: true },
+  _meta: {
+    ui: {
+      resourceUri: RUN_REPORT_UI_RESOURCE_URI,
+      visibility: ["model", "app"],
+    },
+  },
 } as const satisfies McpToolDef;
 
 export const listRunFilesTool = {
diff --git a/web/lib/mcp/ui-apps.ts b/web/lib/mcp/ui-apps.ts
new file mode 100644
index 00000000..2c07902d
--- /dev/null
+++ b/web/lib/mcp/ui-apps.ts
@@ -0,0 +1,24 @@
+export const RUN_REPORT_UI_RESOURCE_URI = "ui://data-hub/run-report";
+
+export const MCP_APP_MIME_TYPE = "text/html;profile=mcp-app";
+
+export const REPORT_VIEW_TABLE_DEFAULT_LIMIT = 50;
+
+export const REPORT_VIEW_TABLE_MAX_LIMIT = 200;
+
+// Stop counting after this many CSV rows so a pathological file cannot
+// pin the MCP request. `total` is then a floor, not an exact count.
+export const REPORT_VIEW_TABLE_SCAN_CAP = 50_000;
+
+export type McpUiToolVisibility = "model" | "app";
+
+export interface McpUiToolMeta {
+  resourceUri?: string;
+  visibility?: readonly McpUiToolVisibility[];
+}
+
+export interface McpToolUiMeta {
+  ui?: McpUiToolMeta;
+  // registerTool types `_meta` as a string index signature.
+  [key: string]: unknown;
+}
diff --git a/web/lib/mcp/ui-csp.ts b/web/lib/mcp/ui-csp.ts
new file mode 100644
index 00000000..82a9714d
--- /dev/null
+++ b/web/lib/mcp/ui-csp.ts
@@ -0,0 +1,48 @@
+import { authBaseURL } from "@/lib/auth";
+
+function s3VirtualHostedOrigin(bucket: string, region: string): string[] {
+  const origins = [`https://${bucket}.s3.${region}.amazonaws.com`];
+  // us-east-1 (and some older clients) also emit the regionless host.
+  origins.push(`https://${bucket}.s3.amazonaws.com`);
+  return origins;
+}
+
+// Origins the run-report View may load images, video, nested PDF frames, and
+// optional direct `fetch` from. Anything omitted is denied by the host CSP.
+export function runReportUiCspDomains(): string[] {
+  const region = process.env.AWS_REGION ?? "us-west-1";
+  const origins = new Set<string>();
+
+  for (const bucket of [
+    process.env.S3_RAW_DATA_BUCKET,
+    process.env.S3_ARCHIVES_BUCKET,
+  ]) {
+    if (bucket) {
+      for (const origin of s3VirtualHostedOrigin(bucket, region)) {
+        origins.add(origin);
+      }
+    }
+  }
+
+  if (process.env.NODE_ENV !== "production") {
+    origins.add(authBaseURL);
+    origins.add("http://localhost:3000");
+    origins.add("http://127.0.0.1:3000");
+  }
+
+  return [...origins];
+}
+
+export function runReportUiMeta() {
+  const domains = runReportUiCspDomains();
+  return {
+    ui: {
+      csp: {
+        resourceDomains: domains,
+        frameDomains: domains,
+        connectDomains: domains,
+      },
+      prefersBorder: true,
+    },
+  };
+}
diff --git a/web/lib/runs/report-table.ts b/web/lib/runs/report-table.ts
new file mode 100644
index 00000000..5642b473
--- /dev/null
+++ b/web/lib/runs/report-table.ts
@@ -0,0 +1,35 @@
+import type { ReportDataSource } from "@/lib/runs/view-data-source";
+
+// Must stay at or below `REPORT_VIEW_TABLE_MAX_LIMIT`; the MCP tool rejects larger pages.
+const DEFAULT_TABLE_PAGE = 200;
+
+// Raman, Aunty curves, and the colony table all need every row. `fetchTable`
+// is paginated for the View's MCP envelope, so callers that chart or index
+// the full file walk pages here.
+export async function fetchAllTableRows(
+  dataSource: ReportDataSource,
+  fileId: number,
+  pageSize = DEFAULT_TABLE_PAGE
+): Promise<{ columns: string[]; rows: Record<string, string>[] }> {
+  const first = await dataSource.fetchTable({
+    fileId,
+    offset: 0,
+    limit: pageSize,
+  });
+  if (first.rows.length >= first.total) {
+    return { columns: first.columns, rows: first.rows };
+  }
+  const rows = first.rows.slice();
+  while (rows.length < first.total) {
+    const page = await dataSource.fetchTable({
+      fileId,
+      offset: rows.length,
+      limit: pageSize,
+    });
+    if (page.rows.length === 0) {
+      break;
+    }
+    rows.push(...page.rows);
+  }
+  return { columns: first.columns, rows };
+}
diff --git a/web/lib/runs/rest-report-data-source.ts b/web/lib/runs/rest-report-data-source.ts
new file mode 100644
index 00000000..d8973794
--- /dev/null
+++ b/web/lib/runs/rest-report-data-source.ts
@@ -0,0 +1,75 @@
+import { parse } from "csv-parse/browser/esm/sync";
+import { type ReportItemsPage, reportItemsUrl } from "@/lib/runs/report-items";
+import type { ReportDataSource } from "@/lib/runs/view-data-source";
+
+function restFileUrl(fileId: number): string {
+  return `/api/v1/files/${fileId}/download`;
+}
+
+// Browser-side source for the Next.js run page. Closures hold the natural-key
+// route ids; `fetchArtifact` is unused here because plate JSON is loaded on
+// the server and passed in as props.
+export function createRestReportDataSource(args: {
+  instrumentId: string;
+  runId: string;
+}): ReportDataSource {
+  const tableCache = new Map<
+    number,
+    { columns: string[]; rows: Record<string, string>[] }
+  >();
+
+  return {
+    async fetchReportItems({ kind, offset, limit, search, anchor }) {
+      const response = await fetch(
+        reportItemsUrl(args.instrumentId, args.runId, {
+          kind,
+          offset,
+          limit,
+          search: search ?? "",
+          anchor,
+        })
+      );
+      if (!response.ok) {
+        throw new Error(`Failed to load report items (${response.status})`);
+      }
+      return (await response.json()) as ReportItemsPage;
+    },
+
+    async fetchTable({ fileId, offset, limit }) {
+      let parsed = tableCache.get(fileId);
+      if (!parsed) {
+        // Same 302-to-S3 download the viewers used to issue themselves, so
+        // the web app still makes one GET per file and then slices in memory.
+        const res = await fetch(restFileUrl(fileId));
+        if (!res.ok) {
+          throw new Error(`Failed to load table (HTTP ${res.status})`);
+        }
+        const rows = parse(await res.text(), {
+          columns: true,
+          skip_empty_lines: true,
+          trim: true,
+        }) as Record<string, string>[];
+        parsed = {
+          columns: rows.length === 0 ? [] : Object.keys(rows[0]),
+          rows,
+        };
+        tableCache.set(fileId, parsed);
+      }
+      return {
+        columns: parsed.columns,
+        rows: parsed.rows.slice(offset, offset + limit),
+        total: parsed.rows.length,
+      };
+    },
+
+    fetchArtifact() {
+      return Promise.reject(
+        new Error(
+          "fetchArtifact is not available over REST; the web app loads artifacts on the server"
+        )
+      );
+    },
+
+    resolveFileUrl: restFileUrl,
+  };
+}
diff --git a/web/lib/runs/view-data-source.ts b/web/lib/runs/view-data-source.ts
new file mode 100644
index 00000000..d8925363
--- /dev/null
+++ b/web/lib/runs/view-data-source.ts
@@ -0,0 +1,21 @@
+import type { ReportItemKind, ReportItemsPage } from "@/lib/runs/report-items";
+
+// Contract shared by the Next.js run page (REST) and the MCP Apps View.
+// The View agent implements the MCP-backed side against this exact shape.
+// biome-ignore assist/source/useSortedInterfaceMembers: keep the published method order
+export interface ReportDataSource {
+  fetchReportItems(args: {
+    kind: ReportItemKind;
+    offset: number;
+    limit: number;
+    search?: string;
+    anchor?: number;
+  }): Promise<ReportItemsPage>;
+  fetchTable(args: { fileId: number; offset: number; limit: number }): Promise<{
+    columns: string[];
+    rows: Record<string, string>[];
+    total: number;
+  }>;
+  fetchArtifact(args: { suffix: string }): Promise<unknown>;
+  resolveFileUrl(fileId: number): Promise<string> | string;
+}
diff --git a/web/mcp-apps/run-report.css b/web/mcp-apps/run-report.css
new file mode 100644
index 00000000..4c848d6e
--- /dev/null
+++ b/web/mcp-apps/run-report.css
@@ -0,0 +1,45 @@
+@import "../app/globals.css";
+
+@source "../components";
+@source "../hooks";
+@source "../lib";
+@source ".";
+
+/* Host style variables win when present; Data Hub tokens stay as fallbacks. */
+:root {
+  --background: var(--color-background-primary, oklch(1 0 0));
+  --foreground: var(--color-text-primary, oklch(0.145 0 0));
+  --card: var(--color-background-secondary, oklch(1 0 0));
+  --card-foreground: var(--color-text-primary, oklch(0.145 0 0));
+  --primary: var(--color-text-primary, oklch(0.205 0 0));
+  --primary-foreground: var(--color-text-inverse, oklch(0.985 0 0));
+  --muted: var(--color-background-secondary, #f7f7f7);
+  --muted-foreground: var(--color-text-secondary, oklch(0.556 0 0));
+  --border: var(--color-border-primary, oklch(0.922 0 0));
+  --ring: var(--color-ring-primary, oklch(0.708 0 0));
+  --radius: var(--border-radius-md, 0.625rem);
+}
+
+[data-theme="dark"] {
+  --background: var(--color-background-primary, oklch(0.145 0 0));
+  --foreground: var(--color-text-primary, oklch(0.985 0 0));
+  --card: var(--color-background-secondary, oklch(0.21 0 0));
+  --card-foreground: var(--color-text-primary, oklch(0.985 0 0));
+  --primary: var(--color-text-primary, oklch(0.922 0 0));
+  --primary-foreground: var(--color-text-inverse, oklch(0.205 0 0));
+  --muted: var(--color-background-secondary, oklch(0.269 0 0));
+  --muted-foreground: var(--color-text-secondary, oklch(0.708 0 0));
+  --border: var(--color-border-primary, oklch(1 0 0 / 10%));
+  --ring: var(--color-ring-primary, oklch(0.556 0 0));
+}
+
+/* Do not set min-height: 100% here. The SDK measures html with
+   height: max-content; stretching to the host-set iframe height made
+   that measurement follow the iframe and loop on size-changed. */
+html,
+body,
+#root {
+  margin: 0;
+  color: var(--foreground);
+  background: var(--background);
+}
diff --git a/web/mcp-apps/run-report.html b/web/mcp-apps/run-report.html
new file mode 100644
index 00000000..15d81991
--- /dev/null
+++ b/web/mcp-apps/run-report.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="data-hub-origin" content="%%DATA_HUB_ORIGIN%%">
+    <title>Data Hub run report</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="./run-report/main.tsx"></script>
+  </body>
+</html>
diff --git a/web/mcp-apps/run-report/app.tsx b/web/mcp-apps/run-report/app.tsx
new file mode 100644
index 00000000..c61a83cb
--- /dev/null
+++ b/web/mcp-apps/run-report/app.tsx
@@ -0,0 +1,193 @@
+import type { App } from "@modelcontextprotocol/ext-apps";
+import { useApp, useHostStyles } from "@modelcontextprotocol/ext-apps/react";
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import { useCallback, useMemo, useState } from "react";
+import { ReportDataSourceProvider } from "@/components/runs/report-data-source-provider";
+import { runDetailUrl } from "./data-hub-origin";
+import {
+  persistKey,
+  useContainerDimensions,
+  useDarkClass,
+  useOpenLinkInterceptor,
+} from "./host-bridge";
+import {
+  InstrumentReport,
+  type RunReportToolResult,
+} from "./instrument-report";
+import { createMcpReportDataSource } from "./mcp-data-source";
+
+function structuredToolResult(
+  result: CallToolResult
+): RunReportToolResult | null {
+  const payload = result.structuredContent;
+  if (payload && typeof payload === "object") {
+    const record = payload as Partial<RunReportToolResult>;
+    if (record.instrumentId && record.runId && record.instrumentType) {
+      return {
+        instrumentId: record.instrumentId,
+        runId: record.runId,
+        instrumentType: record.instrumentType,
+        metadata: record.metadata,
+        reportFiles: record.reportFiles ?? [],
+      };
+    }
+  }
+  const text = result.content?.find((block) => block.type === "text");
+  if (text && "text" in text) {
+    try {
+      return structuredToolResult({
+        ...result,
+        structuredContent: JSON.parse(text.text),
+      });
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+
+export function RunReportApp() {
+  const [toolResult, setToolResult] = useState<CallToolResult | null>(null);
+  const [cancelled, setCancelled] = useState(false);
+
+  const { app, error } = useApp({
+    appInfo: { name: "data-hub-run-report", version: "0.0.0" },
+    capabilities: {
+      availableDisplayModes: ["inline", "fullscreen"],
+    },
+    onAppCreated: (created) => {
+      created.ontoolresult = (result) => {
+        setCancelled(false);
+        setToolResult(result);
+      };
+      created.ontoolcancelled = () => {
+        setCancelled(true);
+      };
+      created.onerror = console.error;
+    },
+  });
+
+  useHostStyles(app, app?.getHostContext());
+  useContainerDimensions(app);
+  useDarkClass();
+  useOpenLinkInterceptor(app);
+
+  if (error) {
+    return (
+      <p className="p-4 text-destructive text-sm">
+        Failed to connect: {error.message}
+      </p>
+    );
+  }
+  if (!app) {
+    return <p className="p-4 text-muted-foreground text-sm">Connecting…</p>;
+  }
+  if (cancelled) {
+    return (
+      <p className="p-4 text-muted-foreground text-sm">
+        Report load was stopped.
+      </p>
+    );
+  }
+  if (!toolResult) {
+    return (
+      <p className="p-4 text-muted-foreground text-sm">Waiting for run…</p>
+    );
+  }
+
+  const parsed = structuredToolResult(toolResult);
+  if (!parsed) {
+    return (
+      <p className="p-4 text-destructive text-sm">
+        Run report result was missing instrument or run identifiers.
+      </p>
+    );
+  }
+
+  return <ConnectedReport app={app} result={parsed} />;
+}
+
+function ConnectedReport({
+  app,
+  result,
+}: {
+  app: App;
+  result: RunReportToolResult;
+}) {
+  const dataSource = useMemo(
+    () =>
+      createMcpReportDataSource({
+        app,
+        instrumentId: result.instrumentId,
+        runId: result.runId,
+      }),
+    [app, result.instrumentId, result.runId]
+  );
+  const storageKey = persistKey(result.instrumentId, result.runId);
+  const [displayMode, setDisplayMode] = useState(
+    () => app.getHostContext()?.displayMode ?? "inline"
+  );
+  const [linkFallback, setLinkFallback] = useState<string | null>(null);
+
+  const openRun = useCallback(async () => {
+    const url = runDetailUrl(result.instrumentId, result.runId);
+    if (app.getHostCapabilities()?.openLinks) {
+      const response = await app.openLink({ url });
+      if (response.isError) {
+        setLinkFallback(url);
+      }
+      return;
+    }
+    setLinkFallback(url);
+  }, [app, result.instrumentId, result.runId]);
+
+  const toggleFullscreen = useCallback(async () => {
+    const hostModes = app.getHostContext()?.availableDisplayModes ?? [];
+    const next = displayMode === "inline" ? "fullscreen" : "inline";
+    if (!hostModes.includes(next)) {
+      return;
+    }
+    const response = await app.requestDisplayMode({ mode: next });
+    setDisplayMode(response.mode);
+  }, [app, displayMode]);
+
+  const canToggle = (
+    app.getHostContext()?.availableDisplayModes ?? []
+  ).includes(displayMode === "inline" ? "fullscreen" : "inline");
+
+  return (
+    <div className="flex flex-col gap-3 p-3">
+      <div className="flex flex-wrap items-center gap-2">
+        <button
+          className="rounded-md border px-2 py-1 text-sm"
+          onClick={() => void openRun()}
+          type="button"
+        >
+          Open in Data Hub
+        </button>
+        {canToggle ? (
+          <button
+            className="rounded-md border px-2 py-1 text-sm"
+            onClick={() => void toggleFullscreen()}
+            type="button"
+          >
+            {displayMode === "fullscreen" ? "Exit fullscreen" : "Fullscreen"}
+          </button>
+        ) : null}
+      </div>
+      {linkFallback ? (
+        <p
+          className="break-all text-muted-foreground text-xs"
+          id="open-link-fallback"
+        >
+          {linkFallback}
+        </p>
+      ) : (
+        <p hidden id="open-link-fallback" />
+      )}
+      <ReportDataSourceProvider dataSource={dataSource}>
+        <InstrumentReport persistKey={storageKey} result={result} />
+      </ReportDataSourceProvider>
+    </div>
+  );
+}
diff --git a/web/mcp-apps/run-report/data-hub-origin.ts b/web/mcp-apps/run-report/data-hub-origin.ts
new file mode 100644
index 00000000..05851b8d
--- /dev/null
+++ b/web/mcp-apps/run-report/data-hub-origin.ts
@@ -0,0 +1,14 @@
+export function dataHubOrigin(): string {
+  const meta = document.querySelector('meta[name="data-hub-origin"]');
+  const content = meta?.getAttribute("content")?.replace(/\/$/, "") ?? "";
+  if (content && !content.includes("%%")) {
+    return content;
+  }
+  return "";
+}
+
+export function runDetailUrl(instrumentId: string, runId: string): string {
+  const origin = dataHubOrigin();
+  const path = `/instruments/${encodeURIComponent(instrumentId)}/runs/${encodeURIComponent(runId)}`;
+  return origin ? `${origin}${path}` : path;
+}
diff --git a/web/mcp-apps/run-report/host-bridge.ts b/web/mcp-apps/run-report/host-bridge.ts
new file mode 100644
index 00000000..2f33facb
--- /dev/null
+++ b/web/mcp-apps/run-report/host-bridge.ts
@@ -0,0 +1,205 @@
+import type { App, McpUiHostContext } from "@modelcontextprotocol/ext-apps";
+import { useDocumentTheme } from "@modelcontextprotocol/ext-apps/react";
+import { useEffect } from "react";
+
+export type HostContainerDimensions = NonNullable<
+  McpUiHostContext["containerDimensions"]
+>;
+
+export interface DocumentSizeStyles {
+  height: string;
+  maxHeight: string;
+  maxWidth: string;
+  minHeight: string;
+  overflow: string;
+  width: string;
+}
+
+const EMPTY_SIZE_STYLES: DocumentSizeStyles = {
+  height: "",
+  maxHeight: "",
+  minHeight: "",
+  overflow: "",
+  width: "",
+  maxWidth: "",
+};
+
+// The spec's View Behavior snippet sets height/maxHeight/width/maxWidth on
+// `document.documentElement`. Overflow is not in that snippet, but without it
+// a capped View paints past the box and the host iframe clips the rest.
+export function documentStylesForContainerDimensions(
+  dimensions: HostContainerDimensions | undefined
+): DocumentSizeStyles {
+  const styles: DocumentSizeStyles = { ...EMPTY_SIZE_STYLES };
+  if (!dimensions) {
+    return styles;
+  }
+
+  if ("height" in dimensions && typeof dimensions.height === "number") {
+    styles.height = "100vh";
+    styles.minHeight = "100%";
+    styles.overflow = "auto";
+  } else if (
+    "maxHeight" in dimensions &&
+    typeof dimensions.maxHeight === "number" &&
+    dimensions.maxHeight > 0
+  ) {
+    styles.maxHeight = `${dimensions.maxHeight}px`;
+    styles.overflow = "auto";
+  }
+
+  if ("width" in dimensions && typeof dimensions.width === "number") {
+    // Fill the host-controlled iframe. `100vw` includes the scrollbar gutter
+    // and can start a horizontal overflow loop with `overflow: auto`.
+    styles.width = "100%";
+  } else if (
+    "maxWidth" in dimensions &&
+    typeof dimensions.maxWidth === "number" &&
+    dimensions.maxWidth > 0
+  ) {
+    styles.maxWidth = `${dimensions.maxWidth}px`;
+  }
+
+  return styles;
+}
+
+function sizeStylesEqual(
+  left: DocumentSizeStyles,
+  right: DocumentSizeStyles
+): boolean {
+  return (
+    left.height === right.height &&
+    left.maxHeight === right.maxHeight &&
+    left.minHeight === right.minHeight &&
+    left.overflow === right.overflow &&
+    left.width === right.width &&
+    left.maxWidth === right.maxWidth
+  );
+}
+
+function readSizeStyles(target: CSSStyleDeclaration): DocumentSizeStyles {
+  return {
+    height: target.height,
+    maxHeight: target.maxHeight,
+    minHeight: target.minHeight,
+    overflow: target.overflow,
+    width: target.width,
+    maxWidth: target.maxWidth,
+  };
+}
+
+function writeSizeStyles(
+  target: CSSStyleDeclaration,
+  styles: DocumentSizeStyles
+): void {
+  target.height = styles.height;
+  target.maxHeight = styles.maxHeight;
+  target.minHeight = styles.minHeight;
+  target.overflow = styles.overflow;
+  target.width = styles.width;
+  target.maxWidth = styles.maxWidth;
+}
+
+export function applyContainerDimensions(
+  dimensions: HostContainerDimensions | undefined,
+  target: CSSStyleDeclaration = document.documentElement.style
+): void {
+  const next = documentStylesForContainerDimensions(dimensions);
+  if (sizeStylesEqual(readSizeStyles(target), next)) {
+    return;
+  }
+  writeSizeStyles(target, next);
+}
+
+export function useContainerDimensions(app: App | null): void {
+  useEffect(() => {
+    if (!app) {
+      return;
+    }
+    const apply = () => {
+      applyContainerDimensions(app.getHostContext()?.containerDimensions);
+    };
+    apply();
+    app.addEventListener("hostcontextchanged", apply);
+    return () => {
+      app.removeEventListener("hostcontextchanged", apply);
+    };
+  }, [app]);
+}
+
+function isHttpUrl(value: string): boolean {
+  return /^https?:\/\//i.test(value);
+}
+
+export function useDarkClass(): void {
+  const theme = useDocumentTheme();
+  useEffect(() => {
+    document.documentElement.classList.toggle("dark", theme === "dark");
+  }, [theme]);
+}
+
+// Shared report components use `<a target="_blank">`. The sandbox blocks
+// popups, so intercept those clicks and ask the host to open the URL.
+export function useOpenLinkInterceptor(app: App | null): void {
+  useEffect(() => {
+    if (!app) {
+      return;
+    }
+
+    const onClick = (event: MouseEvent) => {
+      const target = event.target;
+      if (!(target instanceof Element)) {
+        return;
+      }
+      const anchor = target.closest("a");
+      if (!anchor) {
+        return;
+      }
+      const href = anchor.getAttribute("href");
+      if (!href || href.startsWith("#") || href.startsWith("javascript:")) {
+        return;
+      }
+      const opensExternally =
+        anchor.target === "_blank" || isHttpUrl(href) || href.startsWith("/");
+      if (!opensExternally) {
+        return;
+      }
+
+      event.preventDefault();
+      event.stopPropagation();
+      const url = isHttpUrl(href)
+        ? href
+        : new URL(href, window.location.href).href;
+
+      if (app.getHostCapabilities()?.openLinks) {
+        void app.openLink({ url });
+        return;
+      }
+      const fallback = document.getElementById("open-link-fallback");
+      if (fallback) {
+        fallback.textContent = url;
+        fallback.hidden = false;
+      }
+    };
+
+    document.addEventListener("click", onClick, true);
+    return () => document.removeEventListener("click", onClick, true);
+  }, [app]);
+}
+
+export function persistKey(instrumentId: string, runId: string): string {
+  return `data-hub:run-report:${instrumentId}:${runId}`;
+}
+
+export function readPersistedFileId(key: string): number | undefined {
+  try {
+    const raw = window.localStorage.getItem(key);
+    if (!raw) {
+      return;
+    }
+    const parsed = JSON.parse(raw) as { fileId?: number };
+    return typeof parsed.fileId === "number" ? parsed.fileId : undefined;
+  } catch {
+    return;
+  }
+}
diff --git a/web/mcp-apps/run-report/instrument-report.tsx b/web/mcp-apps/run-report/instrument-report.tsx
new file mode 100644
index 00000000..b592a9c7
--- /dev/null
+++ b/web/mcp-apps/run-report/instrument-report.tsx
@@ -0,0 +1,310 @@
+import { type ReactNode, useEffect, useState } from "react";
+import { AuntyPlateReport } from "@/components/runs/aunty/aunty-plate-report";
+import { ImageCarouselReport } from "@/components/runs/image-carousel-report";
+import { PdfCarouselReport } from "@/components/runs/pdf-carousel-report";
+import {
+  PlateMapGrid,
+  PlateMapWithIndexSlider,
+} from "@/components/runs/plate-map-grid";
+import { RamanReportSection } from "@/components/runs/raman-report-section";
+import { useReportDataSource } from "@/components/runs/report-data-source-provider";
+import { ReportPersistKeyContext } from "@/components/runs/report-items-provider";
+import type { ReportSectionFile } from "@/components/runs/run-report-section";
+import { RunReportSection } from "@/components/runs/run-report-section";
+import { RunSectionCard } from "@/components/runs/run-section-card";
+import { VideoCarouselReport } from "@/components/runs/video-carousel-report";
+import type { RawWellRow } from "@/lib/api/instrument-runs";
+import type { InstrumentType } from "@/lib/db/schema";
+import type { AuntyPlateData } from "@/lib/runs/aunty";
+import { extractPlateMaps } from "@/lib/runs/extract-plate-maps";
+import {
+  emptyReportItemsPage,
+  type ReportItemKind,
+  type ReportItemsPage,
+  reportItemKindForInstrument,
+} from "@/lib/runs/report-items";
+import { fetchAllTableRows } from "@/lib/runs/report-table";
+import { isCsvFile } from "@/lib/runs/run-file-types";
+import { readPersistedFileId } from "./host-bridge";
+
+interface ReportFileRef {
+  category: string;
+  contentType: string | null;
+  filename: string;
+  id: number;
+}
+
+export interface RunReportToolResult {
+  instrumentId: string;
+  instrumentType: string;
+  metadata: unknown;
+  reportFiles: ReportFileRef[];
+  runId: string;
+}
+
+const HEATMAP_MEASUREMENT_TYPES = new Set([
+  "Endpoint",
+  "Well Scan",
+  "Kinetic",
+  "Spectrum",
+]);
+
+function asInstrumentType(value: string): InstrumentType {
+  return value as InstrumentType;
+}
+
+function toSectionFiles(files: ReportFileRef[]): ReportSectionFile[] {
+  return files.map((file) => ({
+    id: file.id,
+    filename: file.filename,
+    category: file.category === "processed" ? "processed" : "raw",
+    contentType: file.contentType,
+    deletedAt: null,
+  }));
+}
+
+function firstProcessedCsv(files: ReportFileRef[]): ReportFileRef | undefined {
+  return files.find((file) => file.category === "processed" && isCsvFile(file));
+}
+
+function isAuntyPlateData(value: unknown): value is AuntyPlateData {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  return "plate" in value;
+}
+
+export function InstrumentReport({
+  persistKey,
+  result,
+}: {
+  persistKey: string;
+  result: RunReportToolResult;
+}) {
+  const instrumentType = asInstrumentType(result.instrumentType);
+  const kind = reportItemKindForInstrument(instrumentType);
+
+  if (
+    kind === "image" &&
+    (instrumentType === "gel_doc" || instrumentType === "hina_microscope")
+  ) {
+    return (
+      <CarouselKindReport
+        kind={kind}
+        persistKey={persistKey}
+        render={(page) => <ImageCarouselReport initialPage={page} />}
+      />
+    );
+  }
+  if (kind === "pdf" && instrumentType === "tape_station") {
+    return (
+      <CarouselKindReport
+        kind={kind}
+        persistKey={persistKey}
+        render={(page) => <PdfCarouselReport initialPage={page} />}
+      />
+    );
+  }
+  if (kind === "video" && instrumentType === "dishcam") {
+    return (
+      <CarouselKindReport
+        kind={kind}
+        persistKey={persistKey}
+        render={(page) => (
+          <VideoCarouselReport initialPage={page} posterFileIds={{}} />
+        )}
+      />
+    );
+  }
+  if (kind === "spectrum" && instrumentType === "instant_raman") {
+    return (
+      <CarouselKindReport
+        kind={kind}
+        persistKey={persistKey}
+        render={(page) => <RamanReportSection initialPage={page} />}
+      />
+    );
+  }
+  if (instrumentType === "aunty") {
+    return <AuntyReport />;
+  }
+  if (instrumentType === "plate_reader") {
+    return <PlateReaderReport files={result.reportFiles} result={result} />;
+  }
+
+  return <RunReportSection files={toSectionFiles(result.reportFiles)} />;
+}
+
+function CarouselKindReport({
+  kind,
+  persistKey,
+  render,
+}: {
+  kind: ReportItemKind;
+  persistKey: string;
+  render: (page: ReportItemsPage) => ReactNode;
+}) {
+  const dataSource = useReportDataSource();
+  const [page, setPage] = useState<ReportItemsPage | null>(null);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    const anchor = readPersistedFileId(persistKey);
+    void dataSource
+      .fetchReportItems({
+        kind,
+        offset: 0,
+        limit: 50,
+        anchor,
+      })
+      .then(setPage)
+      .catch((err: unknown) => {
+        setError(err instanceof Error ? err.message : "Failed to load items");
+        setPage(emptyReportItemsPage());
+      });
+  }, [dataSource, kind, persistKey]);
+
+  if (error) {
+    return <p className="text-destructive text-sm">{error}</p>;
+  }
+  if (!page) {
+    return <p className="text-muted-foreground text-sm">Loading…</p>;
+  }
+  return (
+    <ReportPersistKeyContext.Provider value={persistKey}>
+      {render(page)}
+    </ReportPersistKeyContext.Provider>
+  );
+}
+
+function AuntyReport() {
+  const dataSource = useReportDataSource();
+  const [plate, setPlate] = useState<AuntyPlateData | null>(null);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    void dataSource
+      .fetchArtifact({ suffix: "_aunty_plate.json" })
+      .then((artifact) => {
+        if (isAuntyPlateData(artifact)) {
+          setPlate(artifact);
+          return;
+        }
+        setError("Aunty plate artifact had an unexpected shape.");
+      })
+      .catch((err: unknown) => {
+        setError(err instanceof Error ? err.message : "Failed to load plate");
+      });
+  }, [dataSource]);
+
+  if (error) {
+    return <p className="text-destructive text-sm">{error}</p>;
+  }
+  if (!plate) {
+    return <p className="text-muted-foreground text-sm">Loading…</p>;
+  }
+  return (
+    <AuntyPlateReport curvesFileId={plate.curvesFileId} plate={plate.plate} />
+  );
+}
+
+function PlateReaderReport({
+  files,
+  result,
+}: {
+  files: ReportFileRef[];
+  result: RunReportToolResult;
+}) {
+  const dataSource = useReportDataSource();
+  const [rows, setRows] = useState<RawWellRow[] | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const csv = firstProcessedCsv(files);
+
+  useEffect(() => {
+    if (!csv) {
+      setRows([]);
+      return;
+    }
+    void fetchAllTableRows(dataSource, csv.id)
+      .then((table) => setRows(table.rows ?? []))
+      .catch((err: unknown) => {
+        setError(err instanceof Error ? err.message : "Failed to load wells");
+        setRows([]);
+      });
+  }, [csv, dataSource]);
+
+  if (error) {
+    return <p className="text-destructive text-sm">{error}</p>;
+  }
+  if (rows === null) {
+    return <p className="text-muted-foreground text-sm">Loading…</p>;
+  }
+  if (rows.length === 0) {
+    return (
+      <RunSectionCard title="Plate Maps">
+        <p className="text-muted-foreground text-sm">
+          No report data has been generated for this run.
+        </p>
+      </RunSectionCard>
+    );
+  }
+
+  const metadata =
+    result.metadata && typeof result.metadata === "object"
+      ? (result.metadata as Record<string, unknown>)
+      : {};
+  const measurementType =
+    typeof metadata.measurement_type === "string"
+      ? metadata.measurement_type
+      : "";
+  const heatmap =
+    HEATMAP_MEASUREMENT_TYPES.has(measurementType) ||
+    rows.some((row) => Number.isFinite(Number(row.value)));
+  const groups = extractPlateMaps(rows, {
+    kinetic: measurementType === "Kinetic",
+    spectrum: measurementType === "Spectrum",
+  });
+
+  if (groups.length === 0) {
+    return (
+      <RunSectionCard title="Plate Maps">
+        <p className="text-muted-foreground text-sm">
+          No report data has been generated for this run.
+        </p>
+      </RunSectionCard>
+    );
+  }
+
+  return (
+    <RunSectionCard
+      className="min-w-0"
+      contentClassName="min-w-0"
+      count={groups.length}
+      title="Plate Maps"
+    >
+      <div className="flex min-w-0 flex-col gap-10">
+        {groups.map((group, index) =>
+          group.mode === "kinetic" ? (
+            <PlateMapWithIndexSlider
+              frameLabels={group.frameLabels}
+              frames={group.frames}
+              heatmap={heatmap}
+              key={`${group.plateName}-${index}`}
+              plateName={group.plateName}
+              sliderAxis={group.sliderAxis}
+              wavelength={group.wavelength}
+            />
+          ) : (
+            <PlateMapGrid
+              data={group.wells}
+              heatmap={heatmap}
+              key={`${group.plateName}-${index}`}
+              plateName={group.plateName}
+              wavelength={group.wavelength}
+            />
+          )
+        )}
+      </div>
+    </RunSectionCard>
+  );
+}
diff --git a/web/mcp-apps/run-report/main.tsx b/web/mcp-apps/run-report/main.tsx
new file mode 100644
index 00000000..73671efd
--- /dev/null
+++ b/web/mcp-apps/run-report/main.tsx
@@ -0,0 +1,18 @@
+import { StrictMode } from "react";
+import { createRoot } from "react-dom/client";
+import { TooltipProvider } from "@/components/ui/tooltip";
+import "../run-report.css";
+import { RunReportApp } from "./app";
+
+const root = document.getElementById("root");
+if (!root) {
+  throw new Error("run-report root element is missing");
+}
+
+createRoot(root).render(
+  <StrictMode>
+    <TooltipProvider>
+      <RunReportApp />
+    </TooltipProvider>
+  </StrictMode>
+);
diff --git a/web/mcp-apps/run-report/mcp-data-source.ts b/web/mcp-apps/run-report/mcp-data-source.ts
new file mode 100644
index 00000000..241112cc
--- /dev/null
+++ b/web/mcp-apps/run-report/mcp-data-source.ts
@@ -0,0 +1,124 @@
+import type { App } from "@modelcontextprotocol/ext-apps";
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import { REPORT_VIEW_TABLE_MAX_LIMIT } from "@/lib/mcp/ui-apps";
+import {
+  REPORT_ITEM_KINDS,
+  type ReportItemsPage,
+} from "@/lib/runs/report-items";
+import type { ReportDataSource } from "@/lib/runs/view-data-source";
+
+interface ToolEnvelope<T> {
+  artifact?: unknown;
+  columns?: string[];
+  data?: T;
+  filename?: string;
+  pagination?: ReportItemsPage["pagination"];
+  rows?: Record<string, string>[];
+  suffix?: string;
+  total?: number;
+}
+
+function structuredPayload<T>(result: CallToolResult): T {
+  if (result.isError) {
+    const text = result.content
+      ?.map((block) => ("text" in block ? block.text : ""))
+      .join("\n");
+    throw new Error(text || "Tool call failed");
+  }
+  if (result.structuredContent != null) {
+    return result.structuredContent as T;
+  }
+  const textBlock = result.content?.find((block) => block.type === "text");
+  if (textBlock && "text" in textBlock) {
+    return JSON.parse(textBlock.text) as T;
+  }
+  throw new Error("Tool result had no structured content");
+}
+
+export function createMcpReportDataSource(args: {
+  app: App;
+  instrumentId: string;
+  runId: string;
+}): ReportDataSource {
+  const urlCache = new Map<number, string>();
+
+  return {
+    async fetchReportItems({ kind, offset, limit, search, anchor }) {
+      const result = await args.app.callServerTool({
+        name: "report_view_items",
+        arguments: {
+          instrumentId: args.instrumentId,
+          runId: args.runId,
+          kind,
+          offset,
+          limit,
+          search,
+          anchor,
+        },
+      });
+      const payload = structuredPayload<ReportItemsPage>(result);
+      for (const item of payload.data) {
+        const withUrl = item as { id: number; downloadUrl?: string };
+        if (withUrl.downloadUrl) {
+          urlCache.set(withUrl.id, withUrl.downloadUrl);
+        }
+      }
+      return payload;
+    },
+
+    async fetchTable({ fileId, offset, limit }) {
+      const result = await args.app.callServerTool({
+        name: "report_view_table",
+        arguments: {
+          instrumentId: args.instrumentId,
+          runId: args.runId,
+          fileId,
+          offset,
+          limit: Math.min(limit, REPORT_VIEW_TABLE_MAX_LIMIT),
+        },
+      });
+      return structuredPayload<{
+        columns: string[];
+        rows: Record<string, string>[];
+        total: number;
+      }>(result);
+    },
+
+    async fetchArtifact({ suffix }) {
+      const result = await args.app.callServerTool({
+        name: "report_view_artifact",
+        arguments: {
+          instrumentId: args.instrumentId,
+          runId: args.runId,
+          suffix,
+        },
+      });
+      const payload = structuredPayload<ToolEnvelope<unknown>>(result);
+      return payload.artifact ?? payload;
+    },
+
+    async resolveFileUrl(fileId: number) {
+      const cached = urlCache.get(fileId);
+      if (cached) {
+        return cached;
+      }
+      // Kind is required and filters the window, so try every kind. A hit
+      // also warms the cache for neighbouring files of that kind.
+      await Promise.all(
+        REPORT_ITEM_KINDS.map((kind) =>
+          this.fetchReportItems({
+            kind,
+            offset: 0,
+            limit: 1,
+            anchor: fileId,
+          })
+        )
+      );
+      const resolved = urlCache.get(fileId);
+      if (resolved) {
+        return resolved;
+      }
+      throw new Error(`No download URL for file ${fileId}`);
+    },
+  };
+}
diff --git a/web/mcp-apps/vite.config.ts b/web/mcp-apps/vite.config.ts
new file mode 100644
index 00000000..4fbd90f6
--- /dev/null
+++ b/web/mcp-apps/vite.config.ts
@@ -0,0 +1,25 @@
+import path from "node:path";
+import tailwindcss from "@tailwindcss/vite";
+import react from "@vitejs/plugin-react";
+import { defineConfig } from "vite";
+import { viteSingleFile } from "vite-plugin-singlefile";
+
+const root = import.meta.dirname;
+
+export default defineConfig({
+  root,
+  plugins: [react(), tailwindcss(), viteSingleFile()],
+  resolve: {
+    alias: {
+      "@": path.resolve(root, ".."),
+    },
+  },
+  build: {
+    target: "es2022",
+    rollupOptions: {
+      input: path.resolve(root, "run-report.html"),
+    },
+    outDir: path.resolve(root, "dist"),
+    emptyOutDir: true,
+  },
+});
diff --git a/web/package-lock.json b/web/package-lock.json
index 7d2e65dc..5d3e2f2d 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -56,17 +56,23 @@
       },
       "devDependencies": {
         "@biomejs/biome": "^2.4.16",
+        "@modelcontextprotocol/ext-apps": "^1.7.5",
+        "@modelcontextprotocol/sdk": "^1.30.0",
         "@tailwindcss/postcss": "^4.2.1",
+        "@tailwindcss/vite": "^4.3.3",
         "@types/node": "^25.5.0",
         "@types/pg": "^8.20.0",
         "@types/react": "^19.2.14",
         "@types/react-dom": "^19.2.3",
+        "@vitejs/plugin-react": "^4.7.0",
         "drizzle-kit": "^0.31.10",
         "postcss": "^8",
         "tailwindcss": "^4.2.1",
         "tsx": "^4.23.1",
         "typescript": "^5.9.3",
         "ultracite": "^7.8.3",
+        "vite": "^6.4.3",
+        "vite-plugin-singlefile": "^2.3.3",
         "vitest": "^4.1.2"
       }
     },
@@ -1163,9 +1169,9 @@
       }
     },
     "node_modules/@babel/helper-plugin-utils": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.28.6.tgz",
-      "integrity": "sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz",
+      "integrity": "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -1302,6 +1308,38 @@
         "@babel/core": "^7.0.0-0"
       }
     },
+    "node_modules/@babel/plugin-transform-react-jsx-self": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-self/-/plugin-transform-react-jsx-self-7.29.7.tgz",
+      "integrity": "sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk4v0TTEFfm53fw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-react-jsx-source": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-source/-/plugin-transform-react-jsx-source-7.29.7.tgz",
+      "integrity": "sha512-06IyK09H3wi4cGbhDBwp5gUGo0IKtnYa8tyTiephirPCK6fbobVGiXMMI5zLQ4aKEYP3wZ3ArU44o+8KMrSG/Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
     "node_modules/@babel/plugin-transform-typescript": {
       "version": "7.28.6",
       "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.28.6.tgz",
@@ -2025,18 +2063,6 @@
         "@noble/ciphers": "^1.0.0"
       }
     },
-    "node_modules/@emnapi/core": {
-      "version": "1.11.2",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
-      "integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "@emnapi/wasi-threads": "1.2.2",
-        "tslib": "^2.4.0"
-      }
-    },
     "node_modules/@emnapi/runtime": {
       "version": "1.11.2",
       "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
@@ -2047,17 +2073,6 @@
         "tslib": "^2.4.0"
       }
     },
-    "node_modules/@emnapi/wasi-threads": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
-      "integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
     "node_modules/@esbuild-kit/core-utils": {
       "version": "3.3.2",
       "resolved": "https://registry.npmjs.org/@esbuild-kit/core-utils/-/core-utils-3.3.2.tgz",
@@ -3172,6 +3187,36 @@
         "node": ">=20"
       }
     },
+    "node_modules/@modelcontextprotocol/ext-apps": {
+      "version": "1.7.5",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/ext-apps/-/ext-apps-1.7.5.tgz",
+      "integrity": "sha512-TjPH2S2y5UEGKhmI6+XGFuqfqOV4ppe1x6DA3txnUaEWkgtA4G5vo14jGKFZmegdkZ1H4QMLyujLvoU1BEdnAg==",
+      "dev": true,
+      "license": "MIT",
+      "workspaces": [
+        "examples/*"
+      ],
+      "dependencies": {
+        "@standard-schema/spec": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "peerDependencies": {
+        "@modelcontextprotocol/sdk": "^1.29.0",
+        "react": "^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0",
+        "zod": "^3.25.0 || ^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "react": {
+          "optional": true
+        },
+        "react-dom": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@modelcontextprotocol/sdk": {
       "version": "1.30.0",
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz",
@@ -3225,22 +3270,23 @@
         "node": ">=20"
       }
     },
-    "node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.5.tgz",
-      "integrity": "sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q==",
+    "node_modules/@napi-rs/lzma-linux-x64-gnu": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-linux-x64-gnu/-/lzma-linux-x64-gnu-1.5.1.tgz",
+      "integrity": "sha512-oTXEIha4SsuXdTA4Iyskj0kpdx2yVXdhd75c2v3xGrHFfVMsbhTPZU/nMPL4sWKo4pBHm3aucLaqGlF696dTyQ==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "@tybys/wasm-util": "^0.10.2"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
-      },
-      "peerDependencies": {
-        "@emnapi/core": "^1.7.1",
-        "@emnapi/runtime": "^1.7.1"
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^22.20 || ^24.12 || >=25"
       }
     },
     "node_modules/@next/env": {
@@ -3484,16 +3530,6 @@
         "node": ">=14"
       }
     },
-    "node_modules/@oxc-project/types": {
-      "version": "0.133.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.133.0.tgz",
-      "integrity": "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==",
-      "devOptional": true,
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/Boshen"
-      }
-    },
     "node_modules/@radix-ui/number": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/@radix-ui/number/-/number-1.1.1.tgz",
@@ -5028,26 +5064,43 @@
         "url": "https://opencollective.com/immer"
       }
     },
-    "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
-      "integrity": "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==",
+    "node_modules/@rolldown/pluginutils": {
+      "version": "1.0.0-beta.27",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-beta.27.tgz",
+      "integrity": "sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@rollup/rollup-android-arm-eabi": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.63.1.tgz",
+      "integrity": "sha512-UZ8sUxPTiHWYX9QNdJedb1kDZSpS1t/VPWBWGSgqHNi9w3Cu6IXvu2mzbhiTiPvtrqgTQJ+zqiAq2iPIPilpaQ==",
       "cpu": [
-        "arm64"
+        "arm"
       ],
       "license": "MIT",
       "optional": true,
       "os": [
         "android"
+      ]
+    },
+    "node_modules/@rollup/rollup-android-arm64": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.63.1.tgz",
+      "integrity": "sha512-cQ4nFQABN5cDvDpbvJ7bMStCpnaVxynZrRMfUJYgxcIk9Sh54FIO1vtfkg0B69REjER77ioZ/ov+eAApx/KmLQ==",
+      "cpu": [
+        "arm64"
       ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
     },
-    "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.3.tgz",
-      "integrity": "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==",
+    "node_modules/@rollup/rollup-darwin-arm64": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.63.1.tgz",
+      "integrity": "sha512-FQNqd1lRy/0QhDk3xeRIkSBiCpXCiDnZO3YLVdcDKN1UBiKToNftCzcXYNLshmPDUMlu2TdeS8tGcsU6f3YF1Q==",
       "cpu": [
         "arm64"
       ],
@@ -5055,15 +5108,12 @@
       "optional": true,
       "os": [
         "darwin"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
+      ]
     },
-    "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.3.tgz",
-      "integrity": "sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==",
+    "node_modules/@rollup/rollup-darwin-x64": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.63.1.tgz",
+      "integrity": "sha512-pvD16V939D3CloK0+qikpGaxiPrDUXTe7Y5cWOMkMSy7m1cawa8EGy/kXYi/G/cKAC4HDAbSnzCIk1WmsoOKXg==",
       "cpu": [
         "x64"
       ],
@@ -5071,15 +5121,25 @@
       "optional": true,
       "os": [
         "darwin"
+      ]
+    },
+    "node_modules/@rollup/rollup-freebsd-arm64": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.63.1.tgz",
+      "integrity": "sha512-pcFGeL2345VwdTnJhA6zLbew+YgWB0qBG2+dMtXjCicf6+rm6kO6cOoh5VnTe0ZMrMRgRyuHmCJxZWrIdzYuOw==",
+      "cpu": [
+        "arm64"
       ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ]
     },
-    "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.3.tgz",
-      "integrity": "sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==",
+    "node_modules/@rollup/rollup-freebsd-x64": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.63.1.tgz",
+      "integrity": "sha512-mRJlqSRulVzcKq/LKA6ICSIc3K/l4fzlVn/gePn2nXIHy8seRi5z/eeRE0d/XMBxcMldiXtQTSpRj0tkkC3g8Q==",
       "cpu": [
         "x64"
       ],
@@ -5087,226 +5147,293 @@
       "optional": true,
       "os": [
         "freebsd"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
+      ]
     },
-    "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.3.tgz",
-      "integrity": "sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==",
+    "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.63.1.tgz",
+      "integrity": "sha512-YDUNvVM85TI3g/1OpnqKP1h4NeW/j64DfWMf+G3M809xNk1bJSnpFp4sh83NpmVE5DXnkh8ULor4LTVZKoYLHw==",
       "cpu": [
         "arm"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
+      ]
     },
-    "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.3.tgz",
-      "integrity": "sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==",
+    "node_modules/@rollup/rollup-linux-arm-musleabihf": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.63.1.tgz",
+      "integrity": "sha512-7Mcn71p9ZuQFAj+h+dhQXy/yeLePRS2yKRnmW1DijA9thKO5qap0GNOIQK4yQ6iP3SU0Mrb/yWo8h8vgRba8lw==",
       "cpu": [
-        "arm64"
+        "arm"
+      ],
+      "libc": [
+        "musl"
       ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
+      ]
     },
-    "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.3.tgz",
-      "integrity": "sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==",
+    "node_modules/@rollup/rollup-linux-arm64-gnu": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.63.1.tgz",
+      "integrity": "sha512-4YiLQTX6U4CSl0L9cluep9A9W6UmTfqBDc2/CH6wlu54pl4E7Jn3cOD8oxzvBDEGk/JMKgJ47C8g+radF7mwvg==",
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
+      ]
     },
-    "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.3.tgz",
-      "integrity": "sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==",
+    "node_modules/@rollup/rollup-linux-arm64-musl": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.63.1.tgz",
+      "integrity": "sha512-2ra8F7w8OquwZN9z2/fKFnli69wa8PLwaVzRMIPGb13ByMJwC28Fbp8YcVGoUhlYMTt7j5j9bNgpysrN2UM+vw==",
       "cpu": [
-        "ppc64"
+        "arm64"
+      ],
+      "libc": [
+        "musl"
       ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
+      ]
     },
-    "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.3.tgz",
-      "integrity": "sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==",
+    "node_modules/@rollup/rollup-linux-loong64-gnu": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.63.1.tgz",
+      "integrity": "sha512-Sy20ncyhjmBP0Ml+UvQbimjlk6VFgjW5uNP+qqwHB00mTE8Bl2C1TuHTlRwK2YoXeZbee5lP2XevBWVkAQAtSQ==",
       "cpu": [
-        "s390x"
+        "loong64"
+      ],
+      "libc": [
+        "glibc"
       ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
+      ]
     },
-    "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.3.tgz",
-      "integrity": "sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==",
+    "node_modules/@rollup/rollup-linux-loong64-musl": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.63.1.tgz",
+      "integrity": "sha512-noITLp8oNjYliPnGWmLyelIHwULGqbHloQHGw1rtxbWhTuWooRpnZarZQJ1y9EUC4szuCusCc+HEpUtxpIwYvA==",
       "cpu": [
-        "x64"
+        "loong64"
+      ],
+      "libc": [
+        "musl"
       ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
+      ]
     },
-    "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.3.tgz",
-      "integrity": "sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==",
+    "node_modules/@rollup/rollup-linux-ppc64-gnu": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.63.1.tgz",
+      "integrity": "sha512-hlxxXd+F1mWiAcaFR7Sv9ZQT6m6UfI8+Vy/kFJzztq2pDMU/0wZ9sish0iszNZvsQDo8Gc0i5yuFEOz5dDf6fA==",
       "cpu": [
-        "x64"
+        "ppc64"
+      ],
+      "libc": [
+        "glibc"
       ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
+      ]
     },
-    "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.3.tgz",
-      "integrity": "sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==",
+    "node_modules/@rollup/rollup-linux-ppc64-musl": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.63.1.tgz",
+      "integrity": "sha512-EF7OpqQTQ/BvGqLzUi4rEHuagCV9MugAUXSHemwPW5vxZ75RR+jxO/2j95Ph2dalMpFHSVECjRoioHZgA9zOYA==",
       "cpu": [
-        "arm64"
+        "ppc64"
+      ],
+      "libc": [
+        "musl"
       ],
       "license": "MIT",
       "optional": true,
       "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
+        "linux"
+      ]
     },
-    "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.3.tgz",
-      "integrity": "sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==",
+    "node_modules/@rollup/rollup-linux-riscv64-gnu": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.63.1.tgz",
+      "integrity": "sha512-wQO3JesW9PRkwlabQ27y7sPfVOOTLRG73I4F2UYHG5PXun3J9U3y+b7ezVKSYbsvSKGQ1k1cq8Qlun4C9kLt3w==",
       "cpu": [
-        "wasm32"
+        "riscv64"
+      ],
+      "libc": [
+        "glibc"
       ],
       "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "@emnapi/core": "1.10.0",
-        "@emnapi/runtime": "1.10.0",
-        "@napi-rs/wasm-runtime": "^1.1.4"
-      },
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
-    },
-    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/core": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@emnapi/wasi-threads": "1.2.1",
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/runtime": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
-      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
+      "os": [
+        "linux"
+      ]
     },
-    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
-      "integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
+    "node_modules/@rollup/rollup-linux-riscv64-musl": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.63.1.tgz",
+      "integrity": "sha512-ouAGwhO6wHRXdnOVCOsB0tRFkA7nhNB2Nwax6oECXN0YiN8EYUTBAOudADOB1PI+yDL61TeNx/u7MVCzksNbkQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
+      "os": [
+        "linux"
+      ]
     },
-    "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.3.tgz",
-      "integrity": "sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==",
+    "node_modules/@rollup/rollup-linux-s390x-gnu": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.63.1.tgz",
+      "integrity": "sha512-q2R38Sn+1J8RxhfJ+T54wSWmyKXWec+9jgDfqO2AtArEqHO5R2aeayp5H5OYLr5UYDVGsVaZPEFUooMhYCdz5A==",
       "cpu": [
-        "arm64"
+        "s390x"
+      ],
+      "libc": [
+        "glibc"
       ],
       "license": "MIT",
       "optional": true,
       "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
+        "linux"
+      ]
     },
-    "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.3.tgz",
-      "integrity": "sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==",
+    "node_modules/@rollup/rollup-linux-x64-gnu": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.63.1.tgz",
+      "integrity": "sha512-gfI5T24WLLuFfSKw7Go/zDXjAAV0fny0swTaDv+WjK7vqcw4cRhFfdsyKL1n+ukI+ooBxn3bVQnyrn06WpI50w==",
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-x64-musl": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.63.1.tgz",
+      "integrity": "sha512-4h6XqthmB4Hspji84wvgk+ElodTsGj+dbZqHJHHtKxj4mYq0ANSEEPX9ys3moJueqsRjwpaJYH7874Itwnj2ow==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-openbsd-x64": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.63.1.tgz",
+      "integrity": "sha512-dlfCOa87o1VAYegLQ9EKilx2JCeRofiyPGhTCmqnuXZ6bMPiycO1rq1+sKoulAp7pGLIsTIw+1x5R+zgh5LhhA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ]
+    },
+    "node_modules/@rollup/rollup-openharmony-arm64": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.63.1.tgz",
+      "integrity": "sha512-cjkLbOlfcm3QGhMM1J5zaZjsw1GggbN6rw9UTSSRrPrR1KkcXnN7Uq9rPw34xImQ9VOY9GN+6u2Zj80B9ptkcw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-arm64-msvc": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.63.1.tgz",
+      "integrity": "sha512-Li1KdUnWGE4N3e1F/B4RTB1ms+nG4WBgjByO46pkeBVX/2UBsY53xf5vK9WygVmnH3RwncIST7lkSdLSY6P9lg==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-ia32-msvc": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.63.1.tgz",
+      "integrity": "sha512-t4ZYOSoLTgwhuFMrmTMLx/+i1DQVK7HYqMc6kY46EApwi8X0nIVphzdNoThU3xt6n+N5urG1/gxBdCaKDLavfg==",
+      "cpu": [
+        "ia32"
       ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      }
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
     },
-    "node_modules/@rolldown/pluginutils": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
-      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
-      "devOptional": true,
-      "license": "MIT"
+    "node_modules/@rollup/rollup-win32-x64-gnu": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.63.1.tgz",
+      "integrity": "sha512-RgroPfMmKlD1RzSDxvwgcPiy2HNQKoYV7OmwIXDsk73uKW5t6B/V8KIy27SMv/FNXFo/oSBtWc9J0X7t91ezZg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-x64-msvc": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.63.1.tgz",
+      "integrity": "sha512-at8QVep6S3h5Y6gSbdGU06bRY5WJkf6WUduM9YtvYMbYhB1MOFfUgc6kehitQXzOtMSaT70q7f9ydPhpqu821w==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
     },
     "node_modules/@sec-ant/readable-stream": {
       "version": "0.4.1",
@@ -6479,37 +6606,335 @@
       "inBundle": true,
       "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "@emnapi/core": "^1.7.1",
-        "@emnapi/runtime": "^1.7.1",
-        "@tybys/wasm-util": "^0.10.1"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
+      "dependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1",
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+      "version": "0.10.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+      "version": "2.8.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "0BSD",
+      "optional": true
+    },
+    "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.2.2.tgz",
+      "integrity": "sha512-qPmaQM4iKu5mxpsrWZMOZRgZv1tOZpUm+zdhhQP0VhJfyGGO3aUKdbh3gDZc/dPLQwW4eSqWGrrcWNBZWUWaXQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.2.2.tgz",
+      "integrity": "sha512-1T/37VvI7WyH66b+vqHj/cLwnCxt7Qt3WFu5Q8hk65aOvlwAhs7rAp1VkulBJw/N4tMirXjVnylTR72uI0HGcA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/postcss": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/postcss/-/postcss-4.2.2.tgz",
+      "integrity": "sha512-n4goKQbW8RVXIbNKRB/45LzyUqN451deQK0nzIeauVEqjlI49slUlgKYJM2QyUzap/PcpnS7kzSUmPb1sCRvYQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@alloc/quick-lru": "^5.2.0",
+        "@tailwindcss/node": "4.2.2",
+        "@tailwindcss/oxide": "4.2.2",
+        "postcss": "^8.5.6",
+        "tailwindcss": "4.2.2"
+      }
+    },
+    "node_modules/@tailwindcss/vite": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.3.tgz",
+      "integrity": "sha512-yYU8cogLeSh/ms2jh8Fj7jaba/EWa7Ja6GoUqYZaraEuCI5YS6ms6ObZgjjedm+jm6XZjdNRWBpPP6Z86oOxcw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@tailwindcss/node": "4.3.3",
+        "@tailwindcss/oxide": "4.3.3",
+        "tailwindcss": "4.3.3"
+      },
+      "peerDependencies": {
+        "vite": "^5.2.0 || ^6 || ^7 || ^8"
+      }
+    },
+    "node_modules/@tailwindcss/vite/node_modules/@tailwindcss/node": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.3.tgz",
+      "integrity": "sha512-/T8IKEsf9VTU6tLjgC7+sv2mOPtQxzE2jMw7u4Tt40Tx+QSZxpzh95/H6cMKoja9XuW7iMdLJYBB0o9G1CaAgg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/remapping": "^2.3.5",
+        "enhanced-resolve": "^5.24.1",
+        "jiti": "^2.7.0",
+        "lightningcss": "1.32.0",
+        "magic-string": "^0.30.21",
+        "source-map-js": "^1.2.1",
+        "tailwindcss": "4.3.3"
+      }
+    },
+    "node_modules/@tailwindcss/vite/node_modules/@tailwindcss/oxide": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.3.tgz",
+      "integrity": "sha512-krXjAikiaFSPaK/FkAQT5UTx3VormQaiZ5hBFlJZ9UFQGB/rwg1MZIhHAG9smMQRTdyJxP6Qt5MwMtdyU5FWrA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20"
+      },
+      "optionalDependencies": {
+        "@tailwindcss/oxide-android-arm64": "4.3.3",
+        "@tailwindcss/oxide-darwin-arm64": "4.3.3",
+        "@tailwindcss/oxide-darwin-x64": "4.3.3",
+        "@tailwindcss/oxide-freebsd-x64": "4.3.3",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.3",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.3",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.3.3",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.3.3",
+        "@tailwindcss/oxide-linux-x64-musl": "4.3.3",
+        "@tailwindcss/oxide-wasm32-wasi": "4.3.3",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.3",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.3.3"
+      }
+    },
+    "node_modules/@tailwindcss/vite/node_modules/@tailwindcss/oxide-android-arm64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.3.tgz",
+      "integrity": "sha512-Y85A2gmPSkl5Ve5qR86GL4HT509cFqQh1aes9p3sSkyTPwt0Pppf3GkwGe4JPACcRYjgJIEhQgM6dBClnr0NYw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/vite/node_modules/@tailwindcss/oxide-darwin-arm64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.3.tgz",
+      "integrity": "sha512-BiaWatpBcERQFDlOjRDpIVXuFK5PJez5SA4JMg6VYZdBYU+qKfV/vqjcIs+IYmtitf1xYQZTwXvU/8y4lfZUGw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/vite/node_modules/@tailwindcss/oxide-darwin-x64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.3.tgz",
+      "integrity": "sha512-fAeUqfV5ndhxRwai8cXGzdLvul9utWOmeTkv69unv4ZXixjn61Z+p9lCWdwOwA3TYboG3BwdVuN/RDjhBRl0mw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/vite/node_modules/@tailwindcss/oxide-freebsd-x64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.3.tgz",
+      "integrity": "sha512-iyf5bV6+wnAlflVeEy7R25dupxTNECZN5QMI0qNT6eT+EgaGdZcKhGkr5SdoaWiLJ3spLqIY9VCeSGrwmtg4kw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/vite/node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.3.tgz",
+      "integrity": "sha512-aAYUprJAJQWWbRrPvtjdroZ56Md+JM8pMiopS6xGEwDfLhqj+2ver2p4nU4Mb3CRqcMmNBjo8KkUgcxhkzVQGQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/vite/node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.3.tgz",
+      "integrity": "sha512-nDxldcEENOxZRzC2uu9jrutZdAAQtb+8WWDCSnWL1zvBk1+FN+x6MtDViPB5AJMfttVCUhehGWus3XBPgatM/w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/vite/node_modules/@tailwindcss/oxide-linux-arm64-musl": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.3.tgz",
+      "integrity": "sha512-Md44bD6veX/PC5iyF8cDVnw4HBIANZepRZZ7a8DQOvkfo5WUBwcp6iAuCUz23u+4SUkhJlD3eL7hNdW8ezd/kA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/vite/node_modules/@tailwindcss/oxide-linux-x64-gnu": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.3.tgz",
+      "integrity": "sha512-tx7us1muwOKAKWao2v/GaafFeQboE6aj88vC6ziN2NCGcRm8gWUhwjzg+YdVB1e4boAtdtma4L43onunI6NS4w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/vite/node_modules/@tailwindcss/oxide-linux-x64-musl": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.3.tgz",
+      "integrity": "sha512-SJxX60smvHgasZoBy11dX6YRjXJFovwWBoedhbQPOBzgFWBHGB+TVPWB9BxzR7TTxU8FQZAI2AyiNCMzFm8Img==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
       }
     },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
-      "version": "0.10.1",
+    "node_modules/@tailwindcss/vite/node_modules/@tailwindcss/oxide-wasm32-wasi": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz",
+      "integrity": "sha512-jx1+rPhY/5Ympkktd656HBWEBLxP7dH06losBLjjf5vgCODXvi9KhtftWcMIwTFIDqBr7cRnQkdLnAG+IOlGvQ==",
+      "bundleDependencies": [
+        "@napi-rs/wasm-runtime",
+        "@emnapi/core",
+        "@emnapi/runtime",
+        "@tybys/wasm-util",
+        "@emnapi/wasi-threads",
+        "tslib"
+      ],
+      "cpu": [
+        "wasm32"
+      ],
       "dev": true,
-      "inBundle": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "tslib": "^2.4.0"
+        "@emnapi/core": "^1.11.1",
+        "@emnapi/runtime": "^1.11.1",
+        "@emnapi/wasi-threads": "^1.2.2",
+        "@napi-rs/wasm-runtime": "^1.1.4",
+        "@tybys/wasm-util": "^0.10.2",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
-      "version": "2.8.1",
-      "dev": true,
-      "inBundle": true,
-      "license": "0BSD",
-      "optional": true
-    },
-    "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.2.2.tgz",
-      "integrity": "sha512-qPmaQM4iKu5mxpsrWZMOZRgZv1tOZpUm+zdhhQP0VhJfyGGO3aUKdbh3gDZc/dPLQwW4eSqWGrrcWNBZWUWaXQ==",
+    "node_modules/@tailwindcss/vite/node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.3.tgz",
+      "integrity": "sha512-3rc292Ca2ceK6Ulcc/bAVnTs/3nDtoPhyEKlgPv+yQJQi/JS/AMJlqzxvlDacL1nekbrcf6bTqp/jV4qgnPxNQ==",
       "cpu": [
         "arm64"
       ],
@@ -6523,10 +6948,10 @@
         "node": ">= 20"
       }
     },
-    "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.2.2.tgz",
-      "integrity": "sha512-1T/37VvI7WyH66b+vqHj/cLwnCxt7Qt3WFu5Q8hk65aOvlwAhs7rAp1VkulBJw/N4tMirXjVnylTR72uI0HGcA==",
+    "node_modules/@tailwindcss/vite/node_modules/@tailwindcss/oxide-win32-x64-msvc": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.3.tgz",
+      "integrity": "sha512-yJ0pwIVc/nYeGoV02WtsN8KYyLQv7kyI2wDnkezyJlGGjkd4QLwDGAwl47YpPJeuI0M0ObaXGSPjvWDPeTPggw==",
       "cpu": [
         "x64"
       ],
@@ -6540,19 +6965,12 @@
         "node": ">= 20"
       }
     },
-    "node_modules/@tailwindcss/postcss": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/postcss/-/postcss-4.2.2.tgz",
-      "integrity": "sha512-n4goKQbW8RVXIbNKRB/45LzyUqN451deQK0nzIeauVEqjlI49slUlgKYJM2QyUzap/PcpnS7kzSUmPb1sCRvYQ==",
+    "node_modules/@tailwindcss/vite/node_modules/tailwindcss": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.3.tgz",
+      "integrity": "sha512-gOhV3P7ufE62QDGg1zVaTgCR+EtPv92k2nIhVcVKcLmxT1sUBsQGhnZj175j+MqRt4zLF7ic+sCYjfhxMxj7YQ==",
       "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@alloc/quick-lru": "^5.2.0",
-        "@tailwindcss/node": "4.2.2",
-        "@tailwindcss/oxide": "4.2.2",
-        "postcss": "^8.5.6",
-        "tailwindcss": "4.2.2"
-      }
+      "license": "MIT"
     },
     "node_modules/@tanstack/devtools-event-client": {
       "version": "0.4.3",
@@ -6674,14 +7092,49 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/@tybys/wasm-util": {
-      "version": "0.10.2",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
-      "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
+    "node_modules/@types/babel__core": {
+      "version": "7.20.5",
+      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz",
+      "integrity": "sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "tslib": "^2.4.0"
+        "@babel/parser": "^7.20.7",
+        "@babel/types": "^7.20.7",
+        "@types/babel__generator": "*",
+        "@types/babel__template": "*",
+        "@types/babel__traverse": "*"
+      }
+    },
+    "node_modules/@types/babel__generator": {
+      "version": "7.27.0",
+      "resolved": "https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.27.0.tgz",
+      "integrity": "sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.0.0"
+      }
+    },
+    "node_modules/@types/babel__template": {
+      "version": "7.4.4",
+      "resolved": "https://registry.npmjs.org/@types/babel__template/-/babel__template-7.4.4.tgz",
+      "integrity": "sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.1.0",
+        "@babel/types": "^7.0.0"
+      }
+    },
+    "node_modules/@types/babel__traverse": {
+      "version": "7.28.0",
+      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.28.0.tgz",
+      "integrity": "sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.28.2"
       }
     },
     "node_modules/@types/chai": {
@@ -6775,9 +7228,9 @@
       "license": "MIT"
     },
     "node_modules/@types/estree": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
-      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
       "license": "MIT"
     },
     "node_modules/@types/estree-jsx": {
@@ -7219,6 +7672,27 @@
         "node": ">= 20"
       }
     },
+    "node_modules/@vitejs/plugin-react": {
+      "version": "4.7.0",
+      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-4.7.0.tgz",
+      "integrity": "sha512-gUu9hwfWvvEDBBmgtAowQCojwZmJ5mcLn3aufeCsitijs3+f2NsrPtlAWIR6OPiqljl96GVCUbLe0HyqIpVaoA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/core": "^7.28.0",
+        "@babel/plugin-transform-react-jsx-self": "^7.27.1",
+        "@babel/plugin-transform-react-jsx-source": "^7.27.1",
+        "@rolldown/pluginutils": "1.0.0-beta.27",
+        "@types/babel__core": "^7.20.5",
+        "react-refresh": "^0.17.0"
+      },
+      "engines": {
+        "node": "^14.18.0 || >=16.0.0"
+      },
+      "peerDependencies": {
+        "vite": "^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0"
+      }
+    },
     "node_modules/@vitest/expect": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.2.tgz",
@@ -8677,14 +9151,14 @@
       }
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.20.1",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.20.1.tgz",
-      "integrity": "sha512-Qohcme7V1inbAfvjItgw0EaxVX5q2rdVEZHRBrEQdRZTssLDGsL8Lwrznl8oQ/6kuTJONLaDcGjkNP247XEhcA==",
+      "version": "5.24.5",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.24.5.tgz",
+      "integrity": "sha512-L1l8TNvomm6UVW5B253AGxQagSQr+vGwhMlrrfRS2qmhx46AMpMVJKQYLvWYbysTMY8VoicOvzHzoHMbyzB+4A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.4",
-        "tapable": "^2.3.0"
+        "tapable": "^2.3.3"
       },
       "engines": {
         "node": ">=10.13.0"
@@ -9955,9 +10429,9 @@
       "license": "ISC"
     },
     "node_modules/jiti": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz",
-      "integrity": "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==",
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
+      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
       "devOptional": true,
       "license": "MIT",
       "bin": {
@@ -12563,6 +13037,16 @@
         }
       }
     },
+    "node_modules/react-refresh": {
+      "version": "0.17.0",
+      "resolved": "https://registry.npmjs.org/react-refresh/-/react-refresh-0.17.0.tgz",
+      "integrity": "sha512-z6F7K9bV85EfseRCp2bzrpyQ0Gkw1uLoCel9XBVWPg/TjRj94SkJzUTGfOa4bs7iJvBWtQG0Wq7wnI0syw3EBQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/react-remove-scroll": {
       "version": "2.7.2",
       "resolved": "https://registry.npmjs.org/react-remove-scroll/-/react-remove-scroll-2.7.2.tgz",
@@ -12858,38 +13342,50 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/rolldown": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.3.tgz",
-      "integrity": "sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==",
+    "node_modules/rollup": {
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.63.1.tgz",
+      "integrity": "sha512-3Df9jsstwhccuEfmAMi9l8XUh/GOkVObmFTU7CCVBysEbcOZLl84jCtaAZMcPiMz2EGKsATzQcU+Xr3n/wU6cg==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "=0.133.0",
-        "@rolldown/pluginutils": "^1.0.0"
+        "@types/estree": "1.0.9"
       },
       "bin": {
-        "rolldown": "bin/cli.mjs"
+        "rollup": "dist/bin/rollup"
       },
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">=18.0.0",
+        "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.0.3",
-        "@rolldown/binding-darwin-arm64": "1.0.3",
-        "@rolldown/binding-darwin-x64": "1.0.3",
-        "@rolldown/binding-freebsd-x64": "1.0.3",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.0.3",
-        "@rolldown/binding-linux-arm64-gnu": "1.0.3",
-        "@rolldown/binding-linux-arm64-musl": "1.0.3",
-        "@rolldown/binding-linux-ppc64-gnu": "1.0.3",
-        "@rolldown/binding-linux-s390x-gnu": "1.0.3",
-        "@rolldown/binding-linux-x64-gnu": "1.0.3",
-        "@rolldown/binding-linux-x64-musl": "1.0.3",
-        "@rolldown/binding-openharmony-arm64": "1.0.3",
-        "@rolldown/binding-wasm32-wasi": "1.0.3",
-        "@rolldown/binding-win32-arm64-msvc": "1.0.3",
-        "@rolldown/binding-win32-x64-msvc": "1.0.3"
+        "@napi-rs/lzma-linux-x64-gnu": "1.5.1",
+        "@rollup/rollup-android-arm-eabi": "4.63.1",
+        "@rollup/rollup-android-arm64": "4.63.1",
+        "@rollup/rollup-darwin-arm64": "4.63.1",
+        "@rollup/rollup-darwin-x64": "4.63.1",
+        "@rollup/rollup-freebsd-arm64": "4.63.1",
+        "@rollup/rollup-freebsd-x64": "4.63.1",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.63.1",
+        "@rollup/rollup-linux-arm-musleabihf": "4.63.1",
+        "@rollup/rollup-linux-arm64-gnu": "4.63.1",
+        "@rollup/rollup-linux-arm64-musl": "4.63.1",
+        "@rollup/rollup-linux-loong64-gnu": "4.63.1",
+        "@rollup/rollup-linux-loong64-musl": "4.63.1",
+        "@rollup/rollup-linux-ppc64-gnu": "4.63.1",
+        "@rollup/rollup-linux-ppc64-musl": "4.63.1",
+        "@rollup/rollup-linux-riscv64-gnu": "4.63.1",
+        "@rollup/rollup-linux-riscv64-musl": "4.63.1",
+        "@rollup/rollup-linux-s390x-gnu": "4.63.1",
+        "@rollup/rollup-linux-x64-gnu": "4.63.1",
+        "@rollup/rollup-linux-x64-musl": "4.63.1",
+        "@rollup/rollup-openbsd-x64": "4.63.1",
+        "@rollup/rollup-openharmony-arm64": "4.63.1",
+        "@rollup/rollup-win32-arm64-msvc": "4.63.1",
+        "@rollup/rollup-win32-ia32-msvc": "4.63.1",
+        "@rollup/rollup-win32-x64-gnu": "4.63.1",
+        "@rollup/rollup-win32-x64-msvc": "4.63.1",
+        "fsevents": "~2.3.2"
       }
     },
     "node_modules/rou3": {
@@ -13560,9 +14056,9 @@
       "license": "MIT"
     },
     "node_modules/tapable": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.2.tgz",
-      "integrity": "sha512-1MOpMXuhGzGL5TTCZFItxCc0AARf1EZFQkGqMm7ERKj8+Hgr5oLvJOVFcC+lRmR8hCe2S3jC4T5D7Vg/d7/fhA==",
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
+      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -14115,6 +14611,134 @@
         "d3-timer": "^3.0.1"
       }
     },
+    "node_modules/vite": {
+      "version": "6.4.3",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.3.tgz",
+      "integrity": "sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "esbuild": "^0.25.0",
+        "fdir": "^6.4.4",
+        "picomatch": "^4.0.2",
+        "postcss": "^8.5.3",
+        "rollup": "^4.34.9",
+        "tinyglobby": "^0.2.13"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
+      "engines": {
+        "node": "^18.0.0 || ^20.0.0 || >=22.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0",
+        "jiti": ">=1.21.0",
+        "less": "*",
+        "lightningcss": "^1.21.0",
+        "sass": "*",
+        "sass-embedded": "*",
+        "stylus": "*",
+        "sugarss": "*",
+        "terser": "^5.16.0",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "jiti": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "lightningcss": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vite-plugin-singlefile": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/vite-plugin-singlefile/-/vite-plugin-singlefile-2.3.3.tgz",
+      "integrity": "sha512-XVnGH0QzbOa8fxRSsHdCarVN1BSBXNi7uLMQYlrGRN5apdHkk62XQWRJhVever0lnfuyBkwn+kvVChdm/OoOUg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "micromatch": "^4.0.8"
+      },
+      "engines": {
+        "node": ">18.0.0"
+      },
+      "peerDependencies": {
+        "rollup": "^4.59.0",
+        "vite": "^5.4.21 || ^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "rollup": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vite/node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vite/node_modules/picomatch": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/vitest": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.2.tgz",
@@ -14237,84 +14861,6 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/vitest/node_modules/vite": {
-      "version": "8.0.16",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.16.tgz",
-      "integrity": "sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==",
-      "devOptional": true,
-      "license": "MIT",
-      "dependencies": {
-        "lightningcss": "^1.32.0",
-        "picomatch": "^4.0.4",
-        "postcss": "^8.5.15",
-        "rolldown": "1.0.3",
-        "tinyglobby": "^0.2.17"
-      },
-      "bin": {
-        "vite": "bin/vite.js"
-      },
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      },
-      "funding": {
-        "url": "https://github.com/vitejs/vite?sponsor=1"
-      },
-      "optionalDependencies": {
-        "fsevents": "~2.3.3"
-      },
-      "peerDependencies": {
-        "@types/node": "^20.19.0 || >=22.12.0",
-        "@vitejs/devtools": "^0.1.18",
-        "esbuild": "^0.27.0 || ^0.28.0",
-        "jiti": ">=1.21.0",
-        "less": "^4.0.0",
-        "sass": "^1.70.0",
-        "sass-embedded": "^1.70.0",
-        "stylus": ">=0.54.8",
-        "sugarss": "^5.0.0",
-        "terser": "^5.16.0",
-        "tsx": "^4.8.1",
-        "yaml": "^2.4.2"
-      },
-      "peerDependenciesMeta": {
-        "@types/node": {
-          "optional": true
-        },
-        "@vitejs/devtools": {
-          "optional": true
-        },
-        "esbuild": {
-          "optional": true
-        },
-        "jiti": {
-          "optional": true
-        },
-        "less": {
-          "optional": true
-        },
-        "sass": {
-          "optional": true
-        },
-        "sass-embedded": {
-          "optional": true
-        },
-        "stylus": {
-          "optional": true
-        },
-        "sugarss": {
-          "optional": true
-        },
-        "terser": {
-          "optional": true
-        },
-        "tsx": {
-          "optional": true
-        },
-        "yaml": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
diff --git a/web/package.json b/web/package.json
index 0a62c7ed..d09b32b0 100644
--- a/web/package.json
+++ b/web/package.json
@@ -6,7 +6,8 @@
   "license": "MIT",
   "scripts": {
     "dev": "next dev --turbopack",
-    "build": "next build",
+    "mcp-apps:build": "vite build --config mcp-apps/vite.config.ts",
+    "build": "npm run mcp-apps:build && next build",
     "start": "next start",
     "lint:check": "ultracite check",
     "lint:fix": "ultracite fix",
@@ -80,17 +81,23 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.16",
+    "@modelcontextprotocol/ext-apps": "^1.7.5",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@tailwindcss/postcss": "^4.2.1",
+    "@tailwindcss/vite": "^4.3.3",
     "@types/node": "^25.5.0",
     "@types/pg": "^8.20.0",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
+    "@vitejs/plugin-react": "^4.7.0",
     "drizzle-kit": "^0.31.10",
     "postcss": "^8",
     "tailwindcss": "^4.2.1",
     "tsx": "^4.23.1",
     "typescript": "^5.9.3",
     "ultracite": "^7.8.3",
+    "vite": "^6.4.3",
+    "vite-plugin-singlefile": "^2.3.3",
     "vitest": "^4.1.2"
   },
   "overrides": {
diff --git a/web/proxy.ts b/web/proxy.ts
index 8474b5a0..b8c40d01 100644
--- a/web/proxy.ts
+++ b/web/proxy.ts
@@ -17,6 +17,10 @@ const publicPrefixes = [
   "/consent",
   "/api/auth",
   "/api/v1",
+  // Local S3 mirror bytes. The MCP Apps View loads these from a
+  // cross-origin sandbox with no session cookie; the route 404s when
+  // `LOCAL_S3_MIRROR` is unset or `NODE_ENV` is production.
+  "/api/local-s3",
   // MCP authenticates via OAuth (or flagged PAT fallback), never a
   // session cookie — a redirect to `/login` would surface as opaque HTML
   // instead of a 401 + WWW-Authenticate challenge.
diff --git a/web/tests/integration/mcp.test.ts b/web/tests/integration/mcp.test.ts
index 4d501c60..dc6a4cec 100644
--- a/web/tests/integration/mcp.test.ts
+++ b/web/tests/integration/mcp.test.ts
@@ -11,7 +11,7 @@ import {
 } from "@/tests/integration/helpers";
 
 /** Bump when adding/removing an MCP tool so the change shows up in review. */
-const EXPECTED_MCP_TOOL_COUNT = 32;
+const EXPECTED_MCP_TOOL_COUNT = 35;
 
 function jsonRpc(method: string, params: unknown = {}, id = 1) {
   return {
diff --git a/web/tests/mcp/mcp-catalog.test.ts b/web/tests/mcp/mcp-catalog.test.ts
index d378eef5..ee6e6835 100644
--- a/web/tests/mcp/mcp-catalog.test.ts
+++ b/web/tests/mcp/mcp-catalog.test.ts
@@ -33,7 +33,7 @@ describe("MCP catalog document", () => {
 
   it("publishes outputSchema for every tool", () => {
     const doc = buildMcpCatalogDocument();
-    expect(MCP_TOOL_DEFS).toHaveLength(32);
+    expect(MCP_TOOL_DEFS).toHaveLength(35);
     for (const def of MCP_TOOL_DEFS) {
       expect(def.outputSchema, `${def.name} missing outputSchema`).toBeTruthy();
       const tool = doc.tools.find((t) => t.name === def.name);
diff --git a/web/tests/mcp/mcp-protocol.test.ts b/web/tests/mcp/mcp-protocol.test.ts
index e7cb4f20..71d40db9 100644
--- a/web/tests/mcp/mcp-protocol.test.ts
+++ b/web/tests/mcp/mcp-protocol.test.ts
@@ -296,6 +296,8 @@ vi.mock("@/lib/api/instrument-runs", () => ({
   getRanByFilterOptions: vi
     .fn()
     .mockResolvedValue([{ userId: "u-1", displayName: "Alice" }]),
+  getRunReportFiles: vi.fn().mockResolvedValue([]),
+  getAuntyPlateData: vi.fn().mockResolvedValue(null),
 }));
 
 // The write-tool happy path goes through the raw Drizzle client. Stub out
@@ -450,10 +452,23 @@ vi.mock("@/lib/api/run-reports", () => ({
   }),
 }));
 
+vi.mock("@/lib/api/report-items", () => ({
+  getReportItemsPage: vi.fn().mockResolvedValue({
+    data: [{ id: 42, filename: "data.csv" }],
+    pagination: { limit: 50, offset: 0, total: 1 },
+  }),
+}));
+
 vi.mock("@/lib/api/files", () => ({
   getActiveFileById: vi
     .fn()
     .mockImplementation(async (id: number) => (id === 42 ? MOCK_FILE : null)),
+  getActiveFilesByIds: vi
+    .fn()
+    .mockImplementation(async (ids: number[]) =>
+      ids.includes(42) ? [MOCK_FILE] : []
+    ),
+  findActiveFileBySuffix: vi.fn().mockResolvedValue(null),
   lookupFileForDownload: vi.fn().mockImplementation((id: number) => {
     if (id === 42) {
       return {
@@ -587,6 +602,10 @@ vi.mock("@/lib/s3", () => ({
   getPresignedDownloadUrl: vi
     .fn()
     .mockResolvedValue("https://s3.example.com/signed-url"),
+  getS3ObjectStream: vi.fn().mockImplementation(async () => {
+    const { Readable } = await import("node:stream");
+    return Readable.from([Buffer.from("Well,Value\nA1,0.1\n")]);
+  }),
   // Mirror the real export so consumers (e.g. `tools.ts`) that import
   // it for the response payload see a numeric value instead of
   // `undefined`. Tests that read `expiresInSeconds` off a tool result
@@ -806,7 +825,7 @@ describe("MCP Protocol (in-memory)", () => {
 
   it("every registered tool advertises outputSchema", async () => {
     const { tools } = await client.listTools();
-    expect(tools).toHaveLength(32);
+    expect(tools).toHaveLength(35);
     for (const tool of tools) {
       const schema = tool.outputSchema as
         | { type?: string; oneOf?: unknown; anyOf?: unknown }
@@ -1309,6 +1328,59 @@ describe("MCP Protocol (in-memory)", () => {
     expectStructuredMatchesText(result);
   });
 
+  it("get_run_report advertises the run-report UI resource", async () => {
+    const { tools } = await client.listTools();
+    const report = tools.find((t) => t.name === "get_run_report");
+    expect(report?._meta).toEqual({
+      ui: {
+        resourceUri: "ui://data-hub/run-report",
+        visibility: ["model", "app"],
+      },
+    });
+  });
+
+  it("report_view tools are app-visible and require an authenticated user", async () => {
+    const { tools } = await client.listTools();
+    for (const name of [
+      "report_view_items",
+      "report_view_table",
+      "report_view_artifact",
+    ] as const) {
+      const tool = tools.find((t) => t.name === name);
+      expect(tool?._meta).toEqual({
+        ui: {
+          resourceUri: "ui://data-hub/run-report",
+          visibility: ["app"],
+        },
+      });
+      const result = await client.callTool({
+        name,
+        arguments:
+          name === "report_view_artifact"
+            ? {
+                instrumentId: "test-plate-reader",
+                runId: "run-1",
+                suffix: "_aunty_plate.json",
+              }
+            : name === "report_view_table"
+              ? {
+                  instrumentId: "test-plate-reader",
+                  runId: "run-1",
+                  fileId: 42,
+                }
+              : {
+                  instrumentId: "test-plate-reader",
+                  runId: "run-1",
+                  kind: "image",
+                },
+      });
+      expect(result.isError).toBe(true);
+      const text = (result.content as Array<{ type: string; text: string }>)[0]
+        .text;
+      expect(text).toBe("Authenticated user not available on this session.");
+    }
+  });
+
   it("list_run_files returns error for nonexistent run", async () => {
     const result = await client.callTool({
       name: "list_run_files",
@@ -1618,6 +1690,40 @@ describe("MCP Protocol (in-memory)", () => {
     expect(uris).toContain("datahub://instruments");
     expect(uris).toContain("datahub://me");
     expect(uris).toContain("datahub://glossary");
+    expect(uris).toContain("ui://data-hub/run-report");
+  });
+
+  it("run-report UI resource advertises the MCP Apps MIME type and CSP", async () => {
+    const { resources } = await client.listResources();
+    const runReport = resources.find(
+      (r) => r.uri === "ui://data-hub/run-report"
+    );
+    expect(runReport?.mimeType).toBe("text/html;profile=mcp-app");
+    const listMeta = runReport?._meta as
+      | {
+          ui?: {
+            csp?: { resourceDomains?: string[] };
+            prefersBorder?: boolean;
+          };
+        }
+      | undefined;
+    expect(listMeta?.ui?.prefersBorder).toBe(true);
+    expect(listMeta?.ui?.csp?.resourceDomains).toEqual(
+      expect.arrayContaining(["http://localhost:3000"])
+    );
+
+    const { contents } = await client.readResource({
+      uri: "ui://data-hub/run-report",
+    });
+    expect(contents).toHaveLength(1);
+    expect(contents[0].mimeType).toBe("text/html;profile=mcp-app");
+    expect((contents[0] as { text: string }).text).toMatch(/<!DOCTYPE html/i);
+    const readMeta = contents[0]._meta as
+      | { ui?: { csp?: { frameDomains?: string[] } } }
+      | undefined;
+    expect(readMeta?.ui?.csp?.frameDomains).toEqual(
+      expect.arrayContaining(["http://localhost:3000"])
+    );
   });
 
   it("reads the glossary resource", async () => {
diff --git a/web/tests/unit/mcp-container-dimensions.test.ts b/web/tests/unit/mcp-container-dimensions.test.ts
new file mode 100644
index 00000000..c07dd397
--- /dev/null
+++ b/web/tests/unit/mcp-container-dimensions.test.ts
@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import { documentStylesForContainerDimensions } from "@/mcp-apps/run-report/host-bridge";
+
+describe("documentStylesForContainerDimensions", () => {
+  it("leaves height unbounded when neither height nor maxHeight is set", () => {
+    expect(documentStylesForContainerDimensions({ width: 640 })).toMatchObject({
+      height: "",
+      maxHeight: "",
+      overflow: "",
+    });
+  });
+
+  it("fills a host-fixed height", () => {
+    expect(
+      documentStylesForContainerDimensions({ width: 640, height: 800 })
+    ).toMatchObject({
+      height: "100vh",
+      minHeight: "100%",
+      overflow: "auto",
+    });
+  });
+
+  it("caps flexible height so the View can scroll instead of growing past maxHeight", () => {
+    expect(
+      documentStylesForContainerDimensions({ width: 640, maxHeight: 720 })
+    ).toEqual({
+      height: "",
+      maxHeight: "720px",
+      minHeight: "",
+      overflow: "auto",
+      width: "100%",
+      maxWidth: "",
+    });
+  });
+
+  it("treats maxHeight 0 as omitted", () => {
+    expect(
+      documentStylesForContainerDimensions({ width: 400, maxHeight: 0 })
+    ).toMatchObject({
+      maxHeight: "",
+      overflow: "",
+    });
+  });
+});
diff --git a/web/tests/unit/mcp-cors.test.ts b/web/tests/unit/mcp-cors.test.ts
new file mode 100644
index 00000000..ee22ae2e
--- /dev/null
+++ b/web/tests/unit/mcp-cors.test.ts
@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vitest";
+import { mcpCorsPreflight, withMcpCors } from "@/lib/mcp/cors";
+
+describe("MCP CORS", () => {
+  it("answers preflight without requiring auth", () => {
+    const response = mcpCorsPreflight();
+    expect(response.status).toBe(204);
+    expect(response.headers.get("Access-Control-Allow-Origin")).toBe("*");
+    expect(response.headers.get("Access-Control-Allow-Headers")).toMatch(
+      /Authorization/
+    );
+  });
+
+  it("copies CORS onto an existing MCP response", async () => {
+    const inner = new Response("ok", {
+      status: 200,
+      headers: { "Content-Type": "text/plain" },
+    });
+    const wrapped = withMcpCors(inner);
+    expect(wrapped.status).toBe(200);
+    expect(wrapped.headers.get("Content-Type")).toBe("text/plain");
+    expect(wrapped.headers.get("Access-Control-Allow-Origin")).toBe("*");
+    expect(await wrapped.text()).toBe("ok");
+  });
+});
diff --git a/web/tests/unit/rest-report-data-source.test.ts b/web/tests/unit/rest-report-data-source.test.ts
new file mode 100644
index 00000000..18de2b5f
--- /dev/null
+++ b/web/tests/unit/rest-report-data-source.test.ts
@@ -0,0 +1,108 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { fetchAllTableRows } from "@/lib/runs/report-table";
+import { createRestReportDataSource } from "@/lib/runs/rest-report-data-source";
+import type { ReportDataSource } from "@/lib/runs/view-data-source";
+
+describe("createRestReportDataSource", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("builds the existing report-items URL and download path", async () => {
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        data: [{ id: 1, filename: "a.png" }],
+        pagination: { limit: 50, offset: 0, total: 1 },
+      }),
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const source = createRestReportDataSource({
+      instrumentId: "inst-1",
+      runId: "run-1",
+    });
+
+    await source.fetchReportItems({
+      kind: "image",
+      offset: 0,
+      limit: 50,
+      search: "gel",
+    });
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      "/api/v1/instruments/inst-1/runs/run-1/report-items?kind=image&offset=0&limit=50&search=gel"
+    );
+    expect(source.resolveFileUrl(42)).toBe("/api/v1/files/42/download");
+  });
+
+  it("parses a CSV once, then serves paginated slices from cache", async () => {
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      text: async () => "col_a,col_b\n1,2\n3,4\n5,6\n",
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const source = createRestReportDataSource({
+      instrumentId: "inst-1",
+      runId: "run-1",
+    });
+
+    const first = await source.fetchTable({ fileId: 9, offset: 0, limit: 2 });
+    const second = await source.fetchTable({ fileId: 9, offset: 2, limit: 2 });
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock).toHaveBeenCalledWith("/api/v1/files/9/download");
+    expect(first).toEqual({
+      columns: ["col_a", "col_b"],
+      rows: [
+        { col_a: "1", col_b: "2" },
+        { col_a: "3", col_b: "4" },
+      ],
+      total: 3,
+    });
+    expect(second.rows).toEqual([{ col_a: "5", col_b: "6" }]);
+    expect(second.total).toBe(3);
+  });
+
+  it("rejects fetchArtifact because no browser REST route exists", async () => {
+    const source = createRestReportDataSource({
+      instrumentId: "inst-1",
+      runId: "run-1",
+    });
+    await expect(
+      source.fetchArtifact({ suffix: "_aunty_plate.json" })
+    ).rejects.toThrow(/not available over REST/);
+  });
+});
+
+describe("fetchAllTableRows", () => {
+  it("walks paginated fetchTable until every row is collected", async () => {
+    const pages = [
+      {
+        columns: ["n"],
+        rows: [{ n: "1" }, { n: "2" }],
+        total: 3,
+      },
+      {
+        columns: ["n"],
+        rows: [{ n: "3" }],
+        total: 3,
+      },
+    ];
+    const dataSource: Pick<ReportDataSource, "fetchTable"> = {
+      fetchTable: vi.fn(({ offset }) =>
+        Promise.resolve(pages[offset === 0 ? 0 : 1])
+      ),
+    };
+
+    const result = await fetchAllTableRows(
+      dataSource as ReportDataSource,
+      7,
+      2
+    );
+
+    expect(result.rows.map((r) => r.n)).toEqual(["1", "2", "3"]);
+    expect(dataSource.fetchTable).toHaveBeenCalledTimes(2);
+  });
+});

From 2b7744fa93cf41b04ca06221e508e57717ef0906 Mon Sep 17 00:00:00 2001
From: Wasim Amiri <7220175+wasimxyz@users.noreply.github.com>
Date: Fri, 28 Aug 2026 17:22:35 -0700
Subject: [PATCH 2/6] Stop the MCP run-report View from looping and refresh
 expired file URLs.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 developer-docs/README.md                      |   1 +
 developer-docs/architecture.md                |   1 +
 developer-docs/getting-started.md             |   2 +
 developer-docs/mcp-apps.md                    |  28 ++
 web/components/runs/image-carousel-report.tsx |   6 +-
 web/components/runs/pdf-carousel-report.tsx   |   6 +-
 web/components/runs/raman-report-section.tsx  |   6 +-
 web/components/runs/report-items-provider.tsx |  51 +++-
 web/components/runs/run-report-section.tsx    |  64 +++--
 web/components/runs/video-carousel-report.tsx |  12 +-
 web/hooks/use-resolved-file-url.ts            |  49 +++-
 web/lib/mcp/resources.ts                      |   8 +-
 web/lib/mcp/run-report-html.ts                |  42 ++-
 web/lib/mcp/tools/report-views.defs.ts        |  27 +-
 web/lib/mcp/tools/report-views.output.ts      |   1 +
 web/lib/mcp/tools/report-views.ts             |  56 +---
 web/lib/mcp/tools/runs.defs.ts                |   9 +-
 web/lib/mcp/ui-apps.ts                        |  15 +
 web/lib/mcp/ui-csp.ts                         | 102 ++++---
 web/lib/runs/parse-csv-page.ts                |  60 ++++
 web/lib/runs/report-table.ts                  |  20 +-
 web/lib/runs/rest-report-data-source.ts       |   1 +
 web/lib/runs/view-data-source.ts              |  21 +-
 web/mcp-apps/run-report/app.tsx               |  89 +++---
 web/mcp-apps/run-report/host-bridge.ts        |  24 +-
 web/mcp-apps/run-report/instrument-report.tsx | 126 ++++----
 web/mcp-apps/run-report/mcp-data-source.ts    | 111 +++++--
 web/mcp-apps/run-report/parse-tool-result.ts  |  40 +++
 web/proxy.ts                                  |   8 +-
 web/tests/mcp/mcp-protocol.test.ts            |   9 +-
 web/tests/unit/mcp-absolute-url.test.ts       |  27 ++
 web/tests/unit/mcp-data-source.test.ts        | 118 ++++++++
 web/tests/unit/mcp-parse-csv-page.test.ts     |  38 +++
 web/tests/unit/mcp-parse-tool-result.test.ts  |  46 +++
 web/tests/unit/mcp-report-views.test.ts       | 272 ++++++++++++++++++
 web/tests/unit/mcp-run-report-html.test.ts    |  42 +++
 web/tests/unit/mcp-ui-csp.test.ts             |  47 +++
 .../unit/rest-report-data-source.test.ts      |  24 ++
 web/tests/unit/use-resolved-file-url.test.ts  |  28 ++
 39 files changed, 1328 insertions(+), 309 deletions(-)
 create mode 100644 developer-docs/mcp-apps.md
 create mode 100644 web/lib/runs/parse-csv-page.ts
 create mode 100644 web/mcp-apps/run-report/parse-tool-result.ts
 create mode 100644 web/tests/unit/mcp-absolute-url.test.ts
 create mode 100644 web/tests/unit/mcp-data-source.test.ts
 create mode 100644 web/tests/unit/mcp-parse-csv-page.test.ts
 create mode 100644 web/tests/unit/mcp-parse-tool-result.test.ts
 create mode 100644 web/tests/unit/mcp-report-views.test.ts
 create mode 100644 web/tests/unit/mcp-run-report-html.test.ts
 create mode 100644 web/tests/unit/mcp-ui-csp.test.ts
 create mode 100644 web/tests/unit/use-resolved-file-url.test.ts

diff --git a/developer-docs/README.md b/developer-docs/README.md
index 1958c5c9..901e366f 100644
--- a/developer-docs/README.md
+++ b/developer-docs/README.md
@@ -10,6 +10,7 @@ see the root [README](../README.md#documentation) for that split.
 - [Getting started](getting-started.md) — development setup, environment variables, running locally
 - [Local development](local-development.md) — zero-credential dev workflow for the web app + API + database (no watcher / Lambda needed)
 - [Architecture](architecture.md) — system overview, data flow, and design decisions
+- [MCP Apps](mcp-apps.md) — run-report View bundle, `mcp-apps:build`, and the gitignored HTML artifact
 - [Testing](testing.md) — per-package test frameworks, the shared test-server fixture, S3 mocking
 - [Watcher](watcher.md) — CLI commands, configuration, run detection, upload modes
 - [Lambda](lambda.md) — processing pipeline, supported instruments, adding new instruments
diff --git a/developer-docs/architecture.md b/developer-docs/architecture.md
index 87b42ff4..6a4baf8b 100644
--- a/developer-docs/architecture.md
+++ b/developer-docs/architecture.md
@@ -60,5 +60,6 @@ Steps 1–3 are the same, but the watcher does not upload immediately. Instead:
 - **Public page metadata, gated bodies.** Routes commonly shared into Slack/Notion (dashboard, instruments, instrument and run detail, settings) are reachable without a session so link unfurlers can read `<head>` metadata; the page or layout renders a `SignInRequired` CTA in place of the real body when there's no session. `/watchers/*` stays redirected to `/login` by `web/proxy.ts`. Three independent layers prevent search indexing: a `robots` field on the root layout, an `app/robots.ts` that disallows generic crawlers from the product (with `/docs`, the homepage, and icon files allowed so Google can show a favicon, plus an allow-list for Slack/Discord/LinkedIn unfurl bots), and an `X-Robots-Tag: noindex, nofollow` header on responses other than those icon files.
 - **Shared library for contracts.** Instrument IDs, S3 utilities, and environment config live in `data-hub-shared` so they stay consistent across Lambda and the watcher without duplicating code.
 - **Wildcard PAT scope for the legacy backfill.** Migration `0022_pat_scopes` backfilled every pre-existing token with `["*"]` so deployed watchers and the Lambda kept working once scope enforcement shipped. `POST /api/v1/tokens` rejects `*` from API callers, so every token minted since carries explicit least-privilege scopes; see [Security and permissions](https://datahub.arcadiascience.com/docs/security#token-scopes) for the scope vocabulary.
+- **MCP Apps run report.** `/mcp/v1` also serves a `ui://data-hub/run-report` HTML View (built by `npm run mcp-apps:build` into a gitignored `web/mcp-apps/dist/run-report.html`) plus three app-only tools the host uses to fetch items, CSV pages, and JSON artifacts. See [MCP Apps](mcp-apps.md).
 - **MCP for AI access (OAuth).** Streamable-HTTP MCP at `/mcp/v1` exposes tools, resources, and prompts. Clients use Better Auth as the OAuth AS (issuer `{BETTER_AUTH_URL}/api/auth`); discovery via `/.well-known/oauth-protected-resource` (incl. `/mcp/v1`), `/.well-known/oauth-authorization-server`, and `/.well-known/openid-configuration`, with consent at `/consent` (shows registered redirect hosts from the DB). Coarse scopes: transport requires `read` (WWW-Authenticate still advertises `read write` so clients request both); mutating tools need `write`. Access tokens must be JWTs with `aud` = `{origin}/mcp/v1` (clients pass RFC 8707 `resource` at token exchange); verified offline via JWKS (~1h), so revoking consent does not kill them immediately. `MCP_ALLOW_PAT_AUTH=true` optionally accepts PATs outside production (hard-disabled on Vercel production and on self-hosted production with a non-loopback `BETTER_AUTH_URL`; PAT `write` requires the `*` wildcard). See [Local development](local-development.md#connecting-an-mcp-client) and the [MCP overview](https://datahub.arcadiascience.com/docs/mcp).
 - **Integration tests against a real server.** The shared `testing.py` module spins up a real Next.js server backed by a Postgres database, so Lambda and watcher integration tests exercise the actual API surface.
diff --git a/developer-docs/getting-started.md b/developer-docs/getting-started.md
index 196e08cb..cc54a8b7 100644
--- a/developer-docs/getting-started.md
+++ b/developer-docs/getting-started.md
@@ -110,6 +110,8 @@ Other database commands:
 
 ## Running locally
 
+A production `npm run build` in `web/` runs `mcp-apps:build` first so the MCP Apps run-report View is in the serverless bundle. See [MCP Apps](mcp-apps.md). `make dev` does not rebuild that View; re-run `npm run mcp-apps:build` after changing `web/mcp-apps/`.
+
 ```sh
 # Start the web app dev server (Turbopack).
 make dev
diff --git a/developer-docs/mcp-apps.md b/developer-docs/mcp-apps.md
new file mode 100644
index 00000000..96d44ba7
--- /dev/null
+++ b/developer-docs/mcp-apps.md
@@ -0,0 +1,28 @@
+# MCP Apps (run report View)
+
+Data Hub ships an [MCP Apps](https://modelcontextprotocol.io/specification/2026-01-26/apps) View so a host (today: Arcadia Chat) can render a run report inside a sandboxed iframe. The server advertises `ui://data-hub/run-report` and three app-only tools (`report_view_items`, `report_view_table`, `report_view_artifact`). Hosts must hide tools whose `visibility` does not include `"model"`.
+
+Hosts may prefetch and cache the HTML resource. Do not treat a single `resources/read` as the only time the View is fetched.
+
+## Build
+
+The View is a Vite + Tailwind app under `web/mcp-apps/`. `npm run build` in `web/` runs `mcp-apps:build` first, then `next build`. Next's output tracing includes `mcp-apps/dist/run-report.html` in the `/mcp/v1` function bundle.
+
+```sh
+cd web
+npm run mcp-apps:build
+```
+
+The built file is gitignored. Self-hosters and CI must run that step (or `npm run build`) so `resources/read` serves the real View. In development, a missing artifact falls back to a placeholder page and logs a warning. In production, a missing artifact throws.
+
+## Local development
+
+`make dev` / `next dev` does not rebuild the View on every save. After changing files under `web/mcp-apps/` or shared report components, re-run `npm run mcp-apps:build` (or use a one-off Vite watch if you are iterating on the View alone).
+
+Presigned download URLs last 15 minutes. The View refreshes a cached URL after 80% of that window.
+
+## Related code
+
+- Tool defs: `web/lib/mcp/tools/report-views.defs.ts`, `web/lib/mcp/tools/runs.defs.ts` (`get_run_report`)
+- Resource + CSP: `web/lib/mcp/resources.ts`, `web/lib/mcp/ui-csp.ts`, `web/lib/mcp/run-report-html.ts`
+- View entry: `web/mcp-apps/run-report/app.tsx`
diff --git a/web/components/runs/image-carousel-report.tsx b/web/components/runs/image-carousel-report.tsx
index 717d3e45..26855e44 100644
--- a/web/components/runs/image-carousel-report.tsx
+++ b/web/components/runs/image-carousel-report.tsx
@@ -6,6 +6,7 @@ import {
   ReportItemsProvider,
   type ReportViewerProps,
   useReportItemsContext,
+  useReportViewerPage,
 } from "@/components/runs/report-items-provider";
 import { useResolvedFileUrl } from "@/hooks/use-resolved-file-url";
 
@@ -47,9 +48,10 @@ function SelectedImage() {
 // For instruments whose report data is purely imagery (Hina microscope, gel
 // doc): one image at a time, seeked against the run's full image set.
 export function ImageCarouselReport({ initialPage }: ReportViewerProps) {
+  const page = useReportViewerPage(initialPage);
   return (
-    <ReportDataShell total={initialPage.pagination.total}>
-      <ReportItemsProvider initialPage={initialPage} kind="image">
+    <ReportDataShell total={page.pagination.total}>
+      <ReportItemsProvider initialPage={page} kind="image">
         <ReportItemSeeker />
         <SelectedImage />
       </ReportItemsProvider>
diff --git a/web/components/runs/pdf-carousel-report.tsx b/web/components/runs/pdf-carousel-report.tsx
index a2adafd9..5d38b03b 100644
--- a/web/components/runs/pdf-carousel-report.tsx
+++ b/web/components/runs/pdf-carousel-report.tsx
@@ -7,6 +7,7 @@ import {
   ReportItemsProvider,
   type ReportViewerProps,
   useReportItemsContext,
+  useReportViewerPage,
 } from "@/components/runs/report-items-provider";
 import { Button } from "@/components/ui/button";
 import { useResolvedFileUrl } from "@/hooks/use-resolved-file-url";
@@ -58,9 +59,10 @@ function SelectedPdf() {
 // TapeStation and other PDF-primary instruments: one PDF at a time, seeked
 // against the run's full PDF set.
 export function PdfCarouselReport({ initialPage }: ReportViewerProps) {
+  const page = useReportViewerPage(initialPage);
   return (
-    <ReportDataShell total={initialPage.pagination.total}>
-      <ReportItemsProvider initialPage={initialPage} kind="pdf">
+    <ReportDataShell total={page.pagination.total}>
+      <ReportItemsProvider initialPage={page} kind="pdf">
         <ReportItemSeeker />
         <SelectedPdf />
       </ReportItemsProvider>
diff --git a/web/components/runs/raman-report-section.tsx b/web/components/runs/raman-report-section.tsx
index b3ad3836..399f99ba 100644
--- a/web/components/runs/raman-report-section.tsx
+++ b/web/components/runs/raman-report-section.tsx
@@ -6,12 +6,14 @@ import { ReportItemSeeker } from "@/components/runs/report-item-seeker";
 import {
   ReportItemsProvider,
   type ReportViewerProps,
+  useReportViewerPage,
 } from "@/components/runs/report-items-provider";
 
 export function RamanReportSection({ initialPage }: ReportViewerProps) {
+  const page = useReportViewerPage(initialPage);
   return (
-    <ReportDataShell total={initialPage.pagination.total}>
-      <ReportItemsProvider initialPage={initialPage} kind="spectrum">
+    <ReportDataShell total={page.pagination.total}>
+      <ReportItemsProvider initialPage={page} kind="spectrum">
         <ReportItemSeeker />
         <RamanSpectrumViewer />
       </ReportItemsProvider>
diff --git a/web/components/runs/report-items-provider.tsx b/web/components/runs/report-items-provider.tsx
index 6950cfec..28b8b02f 100644
--- a/web/components/runs/report-items-provider.tsx
+++ b/web/components/runs/report-items-provider.tsx
@@ -18,16 +18,55 @@ export interface ReportItemsContextValue extends UseReportItemsResult {
 
 // Props every report-data viewer receives from its run-detail variant.
 export interface ReportViewerProps {
-  initialPage: ReportItemsPage;
+  initialPage?: ReportItemsPage;
 }
 
 const ReportItemsContext = createContext<ReportItemsContextValue | null>(null);
 
-// Optional. The MCP View wraps carousels so the seeker can restore position
-// without threading a persist key through every shared renderer.
-export const ReportPersistKeyContext = createContext<string | undefined>(
-  undefined
-);
+const ReportPersistKeyContext = createContext<string | undefined>(undefined);
+
+const ReportViewerPageContext = createContext<ReportItemsPage | null>(null);
+
+export function ReportPersistKeyProvider({
+  children,
+  persistKey,
+}: {
+  children: ReactNode;
+  persistKey: string;
+}) {
+  return (
+    <ReportPersistKeyContext.Provider value={persistKey}>
+      {children}
+    </ReportPersistKeyContext.Provider>
+  );
+}
+
+export function ReportViewerPageProvider({
+  children,
+  page,
+}: {
+  children: ReactNode;
+  page: ReportItemsPage;
+}) {
+  return (
+    <ReportViewerPageContext.Provider value={page}>
+      {children}
+    </ReportViewerPageContext.Provider>
+  );
+}
+
+export function useReportViewerPage(
+  initialPage?: ReportItemsPage
+): ReportItemsPage {
+  const fromContext = use(ReportViewerPageContext);
+  const page = initialPage ?? fromContext;
+  if (!page) {
+    throw new Error(
+      "Report viewer is missing a page. Render it inside ReportViewerPageProvider or pass initialPage."
+    );
+  }
+  return page;
+}
 
 export function ReportItemsProvider({
   children,
diff --git a/web/components/runs/run-report-section.tsx b/web/components/runs/run-report-section.tsx
index 181b6f73..3bba1fd0 100644
--- a/web/components/runs/run-report-section.tsx
+++ b/web/components/runs/run-report-section.tsx
@@ -1,6 +1,7 @@
 "use client";
 
 import { ExternalLink } from "lucide-react";
+import { useMemo } from "react";
 import { ColonyDataTable } from "@/components/runs/colony-data-table";
 import { ReportDataShell } from "@/components/runs/report-data-shell";
 import { RunVideoPlayer } from "@/components/runs/run-video-player";
@@ -109,25 +110,54 @@ export function RunReportSection({
   files: ReportSectionFile[];
   title?: string;
 }) {
-  const processedCsvs = files.filter(
-    (f) => f.category === "processed" && f.deletedAt === null && isCsvFile(f)
-  );
-
-  const processedVideos = files.filter(
-    (f) => f.category === "processed" && f.deletedAt === null && isVideoFile(f)
-  );
-  const posterFileIds = posterFileIdsByVideoFilename(files);
-  const videoStems = new Set(processedVideos.map((f) => fileStem(f.filename)));
+  const {
+    pdfFiles,
+    posterFileIds,
+    processedCsvs,
+    processedImages,
+    processedVideos,
+  } = useMemo(() => {
+    const processedCsvs: ReportSectionFile[] = [];
+    const processedVideos: ReportSectionFile[] = [];
+    const processedImages: ReportSectionFile[] = [];
+    const pdfFiles: ReportSectionFile[] = [];
+    const videoStems = new Set<string>();
 
-  const processedImages = files.filter(
-    (f) =>
-      f.category === "processed" &&
-      f.deletedAt === null &&
-      isImageFile(f) &&
-      !videoStems.has(fileStem(f.filename))
-  );
+    for (const file of files) {
+      if (file.deletedAt !== null) {
+        continue;
+      }
+      if (file.category === "processed" && isVideoFile(file)) {
+        processedVideos.push(file);
+        videoStems.add(fileStem(file.filename));
+      }
+    }
+    for (const file of files) {
+      if (file.deletedAt !== null) {
+        continue;
+      }
+      if (file.category === "processed" && isCsvFile(file)) {
+        processedCsvs.push(file);
+      } else if (
+        file.category === "processed" &&
+        isImageFile(file) &&
+        !videoStems.has(fileStem(file.filename))
+      ) {
+        processedImages.push(file);
+      }
+      if (isPdfFile(file)) {
+        pdfFiles.push(file);
+      }
+    }
 
-  const pdfFiles = files.filter((f) => f.deletedAt === null && isPdfFile(f));
+    return {
+      pdfFiles,
+      posterFileIds: posterFileIdsByVideoFilename(files),
+      processedCsvs,
+      processedImages,
+      processedVideos,
+    };
+  }, [files]);
 
   const totalCount =
     processedCsvs.length +
diff --git a/web/components/runs/video-carousel-report.tsx b/web/components/runs/video-carousel-report.tsx
index 11e5b88a..c76582ab 100644
--- a/web/components/runs/video-carousel-report.tsx
+++ b/web/components/runs/video-carousel-report.tsx
@@ -6,6 +6,7 @@ import {
   ReportItemsProvider,
   type ReportViewerProps,
   useReportItemsContext,
+  useReportViewerPage,
 } from "@/components/runs/report-items-provider";
 import { RunVideoPlayer } from "@/components/runs/run-video-player";
 
@@ -37,13 +38,16 @@ function SelectedVideo({
 // DishCam and other video-primary instruments: one MP4 at a time, seeked
 // against the run's full processed-video set. `posterFileIds` is a slim
 // filename → file-id map so full `RunFile` rows never reach the client.
+const EMPTY_POSTER_FILE_IDS: Record<string, number> = {};
+
 export function VideoCarouselReport({
   initialPage,
-  posterFileIds,
-}: ReportViewerProps & { posterFileIds: Record<string, number> }) {
+  posterFileIds = EMPTY_POSTER_FILE_IDS,
+}: ReportViewerProps & { posterFileIds?: Record<string, number> }) {
+  const page = useReportViewerPage(initialPage);
   return (
-    <ReportDataShell total={initialPage.pagination.total}>
-      <ReportItemsProvider initialPage={initialPage} kind="video">
+    <ReportDataShell total={page.pagination.total}>
+      <ReportItemsProvider initialPage={page} kind="video">
         <ReportItemSeeker />
         <SelectedVideo posterFileIds={posterFileIds} />
       </ReportItemsProvider>
diff --git a/web/hooks/use-resolved-file-url.ts b/web/hooks/use-resolved-file-url.ts
index dba95d39..0da83b00 100644
--- a/web/hooks/use-resolved-file-url.ts
+++ b/web/hooks/use-resolved-file-url.ts
@@ -2,10 +2,20 @@
 
 import { useEffect, useState } from "react";
 import { useReportDataSource } from "@/components/runs/report-data-source-provider";
+import type { ReportDataSource } from "@/lib/runs/view-data-source";
 
-// REST returns a path string synchronously; the View's MCP source returns a
-// Promise (fresh presigned URL). Read the sync path during render so the
-// carousel never paints the previous file's URL for a frame.
+export function peekSyncFileUrl(
+  dataSource: ReportDataSource,
+  fileId: number
+): string | undefined {
+  return dataSource.peekFileUrl?.(fileId) ?? undefined;
+}
+
+// REST exposes `peekFileUrl` so the carousel can paint the path during
+// render. The View's MCP source is async — calling it during render
+// would allocate a new Promise every time and loop if that Promise
+// were an effect dependency. Only the effect, keyed on `fileId`,
+// may call `resolveFileUrl`.
 export function useResolvedFileUrl(
   fileId: number | null | undefined
 ): string | null {
@@ -15,29 +25,40 @@ export function useResolvedFileUrl(
     url: string;
   } | null>(null);
 
-  const resolved =
-    fileId == null ? undefined : dataSource.resolveFileUrl(fileId);
+  const syncUrl =
+    fileId == null ? undefined : peekSyncFileUrl(dataSource, fileId);
 
   useEffect(() => {
-    if (fileId == null || resolved == null || typeof resolved === "string") {
+    if (fileId == null || syncUrl != null) {
       return;
     }
     let cancelled = false;
-    resolved.then((url) => {
-      if (!cancelled) {
-        setAsyncResult({ fileId, url });
-      }
-    });
+    const pending = dataSource.resolveFileUrl(fileId);
+    if (typeof pending === "string") {
+      setAsyncResult({ fileId, url: pending });
+      return;
+    }
+    pending
+      .then((url) => {
+        if (!cancelled) {
+          setAsyncResult({ fileId, url });
+        }
+      })
+      .catch(() => {
+        if (!cancelled) {
+          setAsyncResult(null);
+        }
+      });
     return () => {
       cancelled = true;
     };
-  }, [fileId, resolved]);
+  }, [dataSource, fileId, syncUrl]);
 
   if (fileId == null) {
     return null;
   }
-  if (typeof resolved === "string") {
-    return resolved;
+  if (syncUrl != null) {
+    return syncUrl;
   }
   if (asyncResult?.fileId === fileId) {
     return asyncResult.url;
diff --git a/web/lib/mcp/resources.ts b/web/lib/mcp/resources.ts
index b72fba23..3510512a 100644
--- a/web/lib/mcp/resources.ts
+++ b/web/lib/mcp/resources.ts
@@ -11,7 +11,7 @@ import {
   MCP_APP_MIME_TYPE,
   RUN_REPORT_UI_RESOURCE_URI,
 } from "@/lib/mcp/ui-apps";
-import { runReportUiMeta } from "@/lib/mcp/ui-csp";
+import { runReportUiMeta, runReportUiMetaSnapshot } from "@/lib/mcp/ui-csp";
 import {
   glossaryResource,
   instrumentFilterOptionsResource,
@@ -203,14 +203,14 @@ export function registerResources(server: McpServer) {
     }
   );
 
-  const uiMeta = runReportUiMeta();
+  void runReportUiMeta();
   server.registerResource(
     runReportUiResource.name,
     runReportUiResource.uri,
     {
       description: runReportUiResource.description,
       mimeType: runReportUiResource.mimeType,
-      _meta: uiMeta,
+      _meta: runReportUiMetaSnapshot(),
     },
     async () => ({
       contents: [
@@ -218,7 +218,7 @@ export function registerResources(server: McpServer) {
           uri: RUN_REPORT_UI_RESOURCE_URI,
           mimeType: MCP_APP_MIME_TYPE,
           text: loadRunReportHtml(),
-          _meta: uiMeta,
+          _meta: await runReportUiMeta(),
         },
       ],
     })
diff --git a/web/lib/mcp/run-report-html.ts b/web/lib/mcp/run-report-html.ts
index 83e8e7d6..a63d97a0 100644
--- a/web/lib/mcp/run-report-html.ts
+++ b/web/lib/mcp/run-report-html.ts
@@ -63,12 +63,40 @@ export const HELLO_WORLD_RUN_REPORT_HTML = `<!DOCTYPE html>
 </html>
 `;
 
+interface HtmlCache {
+  origin: string;
+  rendered: string;
+}
+
+let cached: HtmlCache | null = null;
+
+function withOrigin(html: string, origin: string): string {
+  return html.replaceAll(DATA_HUB_ORIGIN_PLACEHOLDER, origin);
+}
+
+export function resetRunReportHtmlCache(): void {
+  cached = null;
+}
+
 export function loadRunReportHtml(): string {
-  const html = existsSync(BUILT_HTML_PATH)
-    ? readFileSync(BUILT_HTML_PATH, "utf8")
-    : HELLO_WORLD_RUN_REPORT_HTML;
-  return html.replaceAll(
-    DATA_HUB_ORIGIN_PLACEHOLDER,
-    authBaseURL.replace(/\/$/, "")
-  );
+  const origin = authBaseURL.replace(/\/$/, "");
+  if (cached && cached.origin === origin) {
+    return cached.rendered;
+  }
+
+  if (!existsSync(BUILT_HTML_PATH)) {
+    if (process.env.NODE_ENV === "production") {
+      throw new Error(
+        "Run report View HTML is missing. Run `npm run mcp-apps:build` before `next build`."
+      );
+    }
+    console.warn(
+      "mcp-apps/dist/run-report.html is missing; serving the placeholder page."
+    );
+    return withOrigin(HELLO_WORLD_RUN_REPORT_HTML, origin);
+  }
+
+  const rendered = withOrigin(readFileSync(BUILT_HTML_PATH, "utf8"), origin);
+  cached = { origin, rendered };
+  return rendered;
 }
diff --git a/web/lib/mcp/tools/report-views.defs.ts b/web/lib/mcp/tools/report-views.defs.ts
index 8f38ba83..97a9cab2 100644
--- a/web/lib/mcp/tools/report-views.defs.ts
+++ b/web/lib/mcp/tools/report-views.defs.ts
@@ -3,7 +3,7 @@ import type { McpToolDef } from "@/lib/mcp/catalog/types";
 import {
   REPORT_VIEW_TABLE_DEFAULT_LIMIT,
   REPORT_VIEW_TABLE_MAX_LIMIT,
-  RUN_REPORT_UI_RESOURCE_URI,
+  runReportToolUiMeta,
 } from "@/lib/mcp/ui-apps";
 import {
   REPORT_ITEMS_MAX_LIMIT,
@@ -16,22 +16,15 @@ import {
   reportViewTableOutputSchema,
 } from "./report-views.output";
 
-const APP_ONLY_META = {
-  ui: {
-    resourceUri: RUN_REPORT_UI_RESOURCE_URI,
-    visibility: ["app"] as const,
-  },
-};
-
-const INTERNAL_STEER =
-  "Internal. Used by the Data Hub run report view. Call `get_run_report` instead.";
+const APP_ONLY_META = runReportToolUiMeta(["app"]);
 
 export const reportViewItemsTool = {
   name: "report_view_items",
   group: "runs",
   scope: "files:read",
   title: "Report View Items",
-  description: INTERNAL_STEER,
+  description:
+    "Return a paginated window of run report items (images, PDFs, spectra, or videos) with download URLs. Used by the Data Hub run report view. Call `get_run_report` instead.",
   outputSchema: reportViewItemsOutputSchema,
   inputSchema: {
     instrumentId: z.string().describe("Instrument identifier"),
@@ -71,7 +64,8 @@ export const reportViewTableTool = {
   group: "runs",
   scope: "files:read",
   title: "Report View Table",
-  description: INTERNAL_STEER,
+  description:
+    "Return parsed CSV columns and rows for a run file. Pass `full` to load the whole file up to the scan cap in one call. Used by the Data Hub run report view. Call `get_run_report` instead.",
   outputSchema: reportViewTableOutputSchema,
   inputSchema: {
     instrumentId: z.string().describe("Instrument identifier"),
@@ -92,6 +86,12 @@ export const reportViewTableTool = {
       .describe(
         `Rows to return (default: ${REPORT_VIEW_TABLE_DEFAULT_LIMIT}, max: ${REPORT_VIEW_TABLE_MAX_LIMIT})`
       ),
+    full: z
+      .boolean()
+      .optional()
+      .describe(
+        "When true, ignore offset/limit and return the whole file up to the scan cap"
+      ),
   },
   annotations: { readOnlyHint: true },
   _meta: APP_ONLY_META,
@@ -102,7 +102,8 @@ export const reportViewArtifactTool = {
   group: "runs",
   scope: "files:read",
   title: "Report View Artifact",
-  description: INTERNAL_STEER,
+  description:
+    "Return a JSON artifact from a run by filename suffix. Aunty plate data is assembled from the plate file plus curves file id. Used by the Data Hub run report view. Call `get_run_report` instead.",
   outputSchema: reportViewArtifactOutputSchema,
   inputSchema: {
     instrumentId: z.string().describe("Instrument identifier"),
diff --git a/web/lib/mcp/tools/report-views.output.ts b/web/lib/mcp/tools/report-views.output.ts
index 952d88c5..e2c0b2f7 100644
--- a/web/lib/mcp/tools/report-views.output.ts
+++ b/web/lib/mcp/tools/report-views.output.ts
@@ -21,6 +21,7 @@ export const reportViewTableOutputSchema = z.object({
   columns: z.array(z.string()),
   rows: z.array(z.record(z.string(), z.string())),
   total: z.number().int(),
+  truncated: z.boolean().optional(),
 });
 
 export const reportViewArtifactOutputSchema = z.object({
diff --git a/web/lib/mcp/tools/report-views.ts b/web/lib/mcp/tools/report-views.ts
index 94acb34a..025fa8c2 100644
--- a/web/lib/mcp/tools/report-views.ts
+++ b/web/lib/mcp/tools/report-views.ts
@@ -1,5 +1,4 @@
 import type { McpServer } from "@modelcontextprotocol/server";
-import { parse } from "csv-parse";
 import {
   findActiveFileBySuffix,
   getActiveFileById,
@@ -24,6 +23,7 @@ import {
   REPORT_VIEW_TABLE_MAX_LIMIT,
   REPORT_VIEW_TABLE_SCAN_CAP,
 } from "@/lib/mcp/ui-apps";
+import { parseCsvPage } from "@/lib/runs/parse-csv-page";
 import { REPORT_ITEMS_WINDOW } from "@/lib/runs/report-items";
 import { getPresignedDownloadUrl, getS3ObjectStream } from "@/lib/s3";
 import {
@@ -53,47 +53,6 @@ async function streamToBuffer(
   return Buffer.concat(chunks);
 }
 
-async function parseCsvPage(
-  bucket: string,
-  key: string,
-  offset: number,
-  limit: number
-): Promise<{
-  columns: string[];
-  rows: Record<string, string>[];
-  total: number;
-}> {
-  const stream = await getS3ObjectStream(bucket, key);
-  const parser = stream.pipe(
-    parse({ columns: true, skip_empty_lines: true, trim: true })
-  );
-
-  let index = 0;
-  const rows: Record<string, string>[] = [];
-  let columns: string[] = [];
-
-  try {
-    for await (const record of parser) {
-      const row = record as Record<string, string>;
-      if (index === 0) {
-        columns = Object.keys(row);
-      }
-      if (index >= offset && rows.length < limit) {
-        rows.push(row);
-      }
-      index += 1;
-      if (index >= REPORT_VIEW_TABLE_SCAN_CAP) {
-        break;
-      }
-    }
-  } finally {
-    parser.destroy();
-    stream.destroy();
-  }
-
-  return { columns, rows, total: index };
-}
-
 export function registerReportViewTools(server: McpServer) {
   server.registerTool(
     reportViewItemsTool.name,
@@ -172,11 +131,14 @@ export function registerReportViewTools(server: McpServer) {
         );
       }
 
-      const limit = Math.min(
-        args.limit ?? REPORT_VIEW_TABLE_DEFAULT_LIMIT,
-        REPORT_VIEW_TABLE_MAX_LIMIT
-      );
-      const offset = Math.max(args.offset ?? 0, 0);
+      const full = args.full === true;
+      const limit = full
+        ? REPORT_VIEW_TABLE_SCAN_CAP
+        : Math.min(
+            args.limit ?? REPORT_VIEW_TABLE_DEFAULT_LIMIT,
+            REPORT_VIEW_TABLE_MAX_LIMIT
+          );
+      const offset = full ? 0 : Math.max(args.offset ?? 0, 0);
 
       try {
         const table = await parseCsvPage(
diff --git a/web/lib/mcp/tools/runs.defs.ts b/web/lib/mcp/tools/runs.defs.ts
index e38c995d..ba41cb88 100644
--- a/web/lib/mcp/tools/runs.defs.ts
+++ b/web/lib/mcp/tools/runs.defs.ts
@@ -2,7 +2,7 @@ import { z } from "zod";
 import { mcpMetadataFilterInputSchema } from "@/lib/api/run-metadata-filters";
 import { fileStatusEnum } from "@/lib/db/schema";
 import type { McpToolDef } from "@/lib/mcp/catalog/types";
-import { RUN_REPORT_UI_RESOURCE_URI } from "@/lib/mcp/ui-apps";
+import { runReportToolUiMeta } from "@/lib/mcp/ui-apps";
 import { RUN_STATUS_VALUES } from "@/lib/runs/run-status";
 import {
   addRunCommentOutputSchema,
@@ -135,12 +135,7 @@ export const getRunReportTool = {
     runId: z.string().describe("Run identifier within the instrument"),
   },
   annotations: { readOnlyHint: true },
-  _meta: {
-    ui: {
-      resourceUri: RUN_REPORT_UI_RESOURCE_URI,
-      visibility: ["model", "app"],
-    },
-  },
+  _meta: runReportToolUiMeta(["model", "app"]),
 } as const satisfies McpToolDef;
 
 export const listRunFilesTool = {
diff --git a/web/lib/mcp/ui-apps.ts b/web/lib/mcp/ui-apps.ts
index 2c07902d..052cb227 100644
--- a/web/lib/mcp/ui-apps.ts
+++ b/web/lib/mcp/ui-apps.ts
@@ -19,6 +19,21 @@ export interface McpUiToolMeta {
 
 export interface McpToolUiMeta {
   ui?: McpUiToolMeta;
+  // Deprecated flat key. Hosts that still read `ui/resourceUri` need
+  // this alongside the nested `ui.resourceUri` the spec prefers.
+  "ui/resourceUri"?: string;
   // registerTool types `_meta` as a string index signature.
   [key: string]: unknown;
 }
+
+export function runReportToolUiMeta(
+  visibility: readonly McpUiToolVisibility[]
+): McpToolUiMeta {
+  return {
+    ui: {
+      resourceUri: RUN_REPORT_UI_RESOURCE_URI,
+      visibility,
+    },
+    "ui/resourceUri": RUN_REPORT_UI_RESOURCE_URI,
+  };
+}
diff --git a/web/lib/mcp/ui-csp.ts b/web/lib/mcp/ui-csp.ts
index 82a9714d..ba8625a2 100644
--- a/web/lib/mcp/ui-csp.ts
+++ b/web/lib/mcp/ui-csp.ts
@@ -1,48 +1,86 @@
 import { authBaseURL } from "@/lib/auth";
+import { toAbsoluteDownloadUrl } from "@/lib/mcp/absolute-url";
+import { getPresignedDownloadUrl } from "@/lib/s3";
 
-function s3VirtualHostedOrigin(bucket: string, region: string): string[] {
-  const origins = [`https://${bucket}.s3.${region}.amazonaws.com`];
-  // us-east-1 (and some older clients) also emit the regionless host.
-  origins.push(`https://${bucket}.s3.amazonaws.com`);
-  return origins;
-}
-
-// Origins the run-report View may load images, video, nested PDF frames, and
-// optional direct `fetch` from. Anything omitted is denied by the host CSP.
-export function runReportUiCspDomains(): string[] {
-  const region = process.env.AWS_REGION ?? "us-west-1";
-  const origins = new Set<string>();
-
-  for (const bucket of [
-    process.env.S3_RAW_DATA_BUCKET,
-    process.env.S3_ARCHIVES_BUCKET,
-  ]) {
-    if (bucket) {
-      for (const origin of s3VirtualHostedOrigin(bucket, region)) {
-        origins.add(origin);
-      }
-    }
-  }
+let cachedDomains: string[] | undefined;
+let inflight: Promise<string[]> | undefined;
 
-  if (process.env.NODE_ENV !== "production") {
-    origins.add(authBaseURL);
-    origins.add("http://localhost:3000");
-    origins.add("http://127.0.0.1:3000");
+function localDevOrigins(): string[] {
+  if (process.env.NODE_ENV === "production") {
+    return [];
   }
-
-  return [...origins];
+  return [authBaseURL, "http://localhost:3000", "http://127.0.0.1:3000"];
 }
 
-export function runReportUiMeta() {
-  const domains = runReportUiCspDomains();
+function cspFromDomains(domains: string[]) {
   return {
     ui: {
       csp: {
         resourceDomains: domains,
         frameDomains: domains,
-        connectDomains: domains,
+        // The View loads images, video, and nested PDF frames from these
+        // origins. Tool calls go through the host, so `connect-src` is
+        // unused — keep it empty so a declared `csp` key does not grant
+        // a cross-origin `fetch`.
+        connectDomains: [] as string[],
       },
       prefersBorder: true,
     },
   };
 }
+
+async function probeBucketOrigin(bucket: string): Promise<string | undefined> {
+  try {
+    // Sign a throwaway key so the origin matches whatever style
+    // `getPresignedDownloadUrl` actually emits (virtual-hosted, path-style,
+    // custom endpoint, or the local-mirror path).
+    const url = await getPresignedDownloadUrl(bucket, "__mcp-app-csp-probe__");
+    return new URL(toAbsoluteDownloadUrl(url)).origin;
+  } catch {
+    return;
+  }
+}
+
+export function runReportUiCspDomains(): Promise<string[]> {
+  if (cachedDomains) {
+    return Promise.resolve(cachedDomains);
+  }
+  if (!inflight) {
+    inflight = (async () => {
+      const origins = new Set<string>();
+      for (const bucket of [
+        process.env.S3_RAW_DATA_BUCKET,
+        process.env.S3_ARCHIVES_BUCKET,
+      ]) {
+        if (!bucket) {
+          continue;
+        }
+        const origin = await probeBucketOrigin(bucket);
+        if (origin) {
+          origins.add(origin);
+        }
+      }
+      for (const origin of localDevOrigins()) {
+        origins.add(origin);
+      }
+      const list = [...origins];
+      cachedDomains = list;
+      return list;
+    })();
+  }
+  return inflight;
+}
+
+export function resetRunReportUiCspCache(): void {
+  cachedDomains = undefined;
+  inflight = undefined;
+}
+
+export function runReportUiMetaSnapshot() {
+  return cspFromDomains(cachedDomains ?? localDevOrigins());
+}
+
+export async function runReportUiMeta() {
+  const domains = await runReportUiCspDomains();
+  return cspFromDomains(domains);
+}
diff --git a/web/lib/runs/parse-csv-page.ts b/web/lib/runs/parse-csv-page.ts
new file mode 100644
index 00000000..6ff113a8
--- /dev/null
+++ b/web/lib/runs/parse-csv-page.ts
@@ -0,0 +1,60 @@
+import type { Readable } from "node:stream";
+import { parse } from "csv-parse";
+import { REPORT_VIEW_TABLE_SCAN_CAP } from "@/lib/mcp/ui-apps";
+import { getS3ObjectStream } from "@/lib/s3";
+
+export interface ParsedCsvPage {
+  columns: string[];
+  rows: Record<string, string>[];
+  total: number;
+  truncated: boolean;
+}
+
+export async function parseCsvPageFromStream(
+  stream: Readable,
+  offset: number,
+  limit: number,
+  scanCap = REPORT_VIEW_TABLE_SCAN_CAP
+): Promise<ParsedCsvPage> {
+  const parser = stream.pipe(
+    parse({ columns: true, skip_empty_lines: true, trim: true })
+  );
+
+  let index = 0;
+  const rows: Record<string, string>[] = [];
+  let columns: string[] = [];
+  let truncated = false;
+
+  try {
+    for await (const record of parser) {
+      const row = record as Record<string, string>;
+      if (index === 0) {
+        columns = Object.keys(row);
+      }
+      if (index >= offset && rows.length < limit) {
+        rows.push(row);
+      }
+      index += 1;
+      if (index >= scanCap) {
+        truncated = true;
+        break;
+      }
+    }
+  } finally {
+    parser.destroy();
+    stream.destroy();
+  }
+
+  return { columns, rows, total: index, truncated };
+}
+
+export async function parseCsvPage(
+  bucket: string,
+  key: string,
+  offset: number,
+  limit: number,
+  scanCap = REPORT_VIEW_TABLE_SCAN_CAP
+): Promise<ParsedCsvPage> {
+  const stream = await getS3ObjectStream(bucket, key);
+  return parseCsvPageFromStream(stream, offset, limit, scanCap);
+}
diff --git a/web/lib/runs/report-table.ts b/web/lib/runs/report-table.ts
index 5642b473..ad105bff 100644
--- a/web/lib/runs/report-table.ts
+++ b/web/lib/runs/report-table.ts
@@ -5,19 +5,25 @@ const DEFAULT_TABLE_PAGE = 200;
 
 // Raman, Aunty curves, and the colony table all need every row. `fetchTable`
 // is paginated for the View's MCP envelope, so callers that chart or index
-// the full file walk pages here.
+// the full file walk pages here. The MCP source answers the first page
+// with the whole file (one S3 GET) and slices later pages from memory.
 export async function fetchAllTableRows(
   dataSource: ReportDataSource,
   fileId: number,
   pageSize = DEFAULT_TABLE_PAGE
-): Promise<{ columns: string[]; rows: Record<string, string>[] }> {
+): Promise<{
+  columns: string[];
+  rows: Record<string, string>[];
+  truncated: boolean;
+}> {
   const first = await dataSource.fetchTable({
     fileId,
     offset: 0,
     limit: pageSize,
   });
+  let truncated = first.truncated === true;
   if (first.rows.length >= first.total) {
-    return { columns: first.columns, rows: first.rows };
+    return { columns: first.columns, rows: first.rows, truncated };
   }
   const rows = first.rows.slice();
   while (rows.length < first.total) {
@@ -26,10 +32,16 @@ export async function fetchAllTableRows(
       offset: rows.length,
       limit: pageSize,
     });
+    if (page.truncated) {
+      truncated = true;
+    }
     if (page.rows.length === 0) {
       break;
     }
     rows.push(...page.rows);
   }
-  return { columns: first.columns, rows };
+  if (rows.length < first.total) {
+    truncated = true;
+  }
+  return { columns: first.columns, rows, truncated };
 }
diff --git a/web/lib/runs/rest-report-data-source.ts b/web/lib/runs/rest-report-data-source.ts
index d8973794..ea1a2b4d 100644
--- a/web/lib/runs/rest-report-data-source.ts
+++ b/web/lib/runs/rest-report-data-source.ts
@@ -70,6 +70,7 @@ export function createRestReportDataSource(args: {
       );
     },
 
+    peekFileUrl: restFileUrl,
     resolveFileUrl: restFileUrl,
   };
 }
diff --git a/web/lib/runs/view-data-source.ts b/web/lib/runs/view-data-source.ts
index d8925363..c384c159 100644
--- a/web/lib/runs/view-data-source.ts
+++ b/web/lib/runs/view-data-source.ts
@@ -1,5 +1,12 @@
 import type { ReportItemKind, ReportItemsPage } from "@/lib/runs/report-items";
 
+export interface ReportTablePage {
+  columns: string[];
+  rows: Record<string, string>[];
+  total: number;
+  truncated?: boolean;
+}
+
 // Contract shared by the Next.js run page (REST) and the MCP Apps View.
 // The View agent implements the MCP-backed side against this exact shape.
 // biome-ignore assist/source/useSortedInterfaceMembers: keep the published method order
@@ -11,11 +18,15 @@ export interface ReportDataSource {
     search?: string;
     anchor?: number;
   }): Promise<ReportItemsPage>;
-  fetchTable(args: { fileId: number; offset: number; limit: number }): Promise<{
-    columns: string[];
-    rows: Record<string, string>[];
-    total: number;
-  }>;
+  fetchTable(args: {
+    fileId: number;
+    offset: number;
+    limit: number;
+  }): Promise<ReportTablePage>;
   fetchArtifact(args: { suffix: string }): Promise<unknown>;
   resolveFileUrl(fileId: number): Promise<string> | string;
+  // Synchronous cache/path lookup for render. The MCP source is async, so
+  // calling `resolveFileUrl` during render would allocate a Promise every
+  // time. REST implements this as the download path.
+  peekFileUrl?(fileId: number): string | null;
 }
diff --git a/web/mcp-apps/run-report/app.tsx b/web/mcp-apps/run-report/app.tsx
index c61a83cb..e38d6920 100644
--- a/web/mcp-apps/run-report/app.tsx
+++ b/web/mcp-apps/run-report/app.tsx
@@ -1,7 +1,7 @@
 import type { App } from "@modelcontextprotocol/ext-apps";
 import { useApp, useHostStyles } from "@modelcontextprotocol/ext-apps/react";
 import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
-import { useCallback, useMemo, useState } from "react";
+import { useCallback, useEffect, useMemo, useState } from "react";
 import { ReportDataSourceProvider } from "@/components/runs/report-data-source-provider";
 import { runDetailUrl } from "./data-hub-origin";
 import {
@@ -15,36 +15,7 @@ import {
   type RunReportToolResult,
 } from "./instrument-report";
 import { createMcpReportDataSource } from "./mcp-data-source";
-
-function structuredToolResult(
-  result: CallToolResult
-): RunReportToolResult | null {
-  const payload = result.structuredContent;
-  if (payload && typeof payload === "object") {
-    const record = payload as Partial<RunReportToolResult>;
-    if (record.instrumentId && record.runId && record.instrumentType) {
-      return {
-        instrumentId: record.instrumentId,
-        runId: record.runId,
-        instrumentType: record.instrumentType,
-        metadata: record.metadata,
-        reportFiles: record.reportFiles ?? [],
-      };
-    }
-  }
-  const text = result.content?.find((block) => block.type === "text");
-  if (text && "text" in text) {
-    try {
-      return structuredToolResult({
-        ...result,
-        structuredContent: JSON.parse(text.text),
-      });
-    } catch {
-      return null;
-    }
-  }
-  return null;
-}
+import { parseRunReportToolResult } from "./parse-tool-result";
 
 export function RunReportApp() {
   const [toolResult, setToolResult] = useState<CallToolResult | null>(null);
@@ -70,7 +41,6 @@ export function RunReportApp() {
   useHostStyles(app, app?.getHostContext());
   useContainerDimensions(app);
   useDarkClass();
-  useOpenLinkInterceptor(app);
 
   if (error) {
     return (
@@ -95,7 +65,7 @@ export function RunReportApp() {
     );
   }
 
-  const parsed = structuredToolResult(toolResult);
+  const parsed = parseRunReportToolResult(toolResult);
   if (!parsed) {
     return (
       <p className="p-4 text-destructive text-sm">
@@ -129,11 +99,31 @@ function ConnectedReport({
   );
   const [linkFallback, setLinkFallback] = useState<string | null>(null);
 
+  useOpenLinkInterceptor(app, setLinkFallback);
+
+  useEffect(() => {
+    const apply = () => {
+      const mode = app.getHostContext()?.displayMode;
+      if (mode === "inline" || mode === "fullscreen") {
+        setDisplayMode(mode);
+      }
+    };
+    apply();
+    app.addEventListener("hostcontextchanged", apply);
+    return () => {
+      app.removeEventListener("hostcontextchanged", apply);
+    };
+  }, [app]);
+
   const openRun = useCallback(async () => {
     const url = runDetailUrl(result.instrumentId, result.runId);
     if (app.getHostCapabilities()?.openLinks) {
-      const response = await app.openLink({ url });
-      if (response.isError) {
+      try {
+        const response = await app.openLink({ url });
+        if (response.isError) {
+          setLinkFallback(url);
+        }
+      } catch {
         setLinkFallback(url);
       }
       return;
@@ -147,8 +137,12 @@ function ConnectedReport({
     if (!hostModes.includes(next)) {
       return;
     }
-    const response = await app.requestDisplayMode({ mode: next });
-    setDisplayMode(response.mode);
+    try {
+      const response = await app.requestDisplayMode({ mode: next });
+      setDisplayMode(response.mode);
+    } catch {
+      // Host refused or timed out; keep the last known mode.
+    }
   }, [app, displayMode]);
 
   const canToggle = (
@@ -160,7 +154,11 @@ function ConnectedReport({
       <div className="flex flex-wrap items-center gap-2">
         <button
           className="rounded-md border px-2 py-1 text-sm"
-          onClick={() => void openRun()}
+          onClick={() => {
+            void openRun().catch(() => {
+              setLinkFallback(runDetailUrl(result.instrumentId, result.runId));
+            });
+          }}
           type="button"
         >
           Open in Data Hub
@@ -168,7 +166,11 @@ function ConnectedReport({
         {canToggle ? (
           <button
             className="rounded-md border px-2 py-1 text-sm"
-            onClick={() => void toggleFullscreen()}
+            onClick={() => {
+              void toggleFullscreen().catch(() => {
+                // Host refused or timed out; keep the last known mode.
+              });
+            }}
             type="button"
           >
             {displayMode === "fullscreen" ? "Exit fullscreen" : "Fullscreen"}
@@ -176,15 +178,10 @@ function ConnectedReport({
         ) : null}
       </div>
       {linkFallback ? (
-        <p
-          className="break-all text-muted-foreground text-xs"
-          id="open-link-fallback"
-        >
+        <p className="break-all text-muted-foreground text-xs">
           {linkFallback}
         </p>
-      ) : (
-        <p hidden id="open-link-fallback" />
-      )}
+      ) : null}
       <ReportDataSourceProvider dataSource={dataSource}>
         <InstrumentReport persistKey={storageKey} result={result} />
       </ReportDataSourceProvider>
diff --git a/web/mcp-apps/run-report/host-bridge.ts b/web/mcp-apps/run-report/host-bridge.ts
index 2f33facb..e85c2dbe 100644
--- a/web/mcp-apps/run-report/host-bridge.ts
+++ b/web/mcp-apps/run-report/host-bridge.ts
@@ -140,7 +140,10 @@ export function useDarkClass(): void {
 
 // Shared report components use `<a target="_blank">`. The sandbox blocks
 // popups, so intercept those clicks and ask the host to open the URL.
-export function useOpenLinkInterceptor(app: App | null): void {
+export function useOpenLinkInterceptor(
+  app: App | null,
+  onFallback: (url: string) => void
+): void {
   useEffect(() => {
     if (!app) {
       return;
@@ -172,19 +175,24 @@ export function useOpenLinkInterceptor(app: App | null): void {
         : new URL(href, window.location.href).href;
 
       if (app.getHostCapabilities()?.openLinks) {
-        void app.openLink({ url });
+        void app
+          .openLink({ url })
+          .then((response) => {
+            if (response.isError) {
+              onFallback(url);
+            }
+          })
+          .catch(() => {
+            onFallback(url);
+          });
         return;
       }
-      const fallback = document.getElementById("open-link-fallback");
-      if (fallback) {
-        fallback.textContent = url;
-        fallback.hidden = false;
-      }
+      onFallback(url);
     };
 
     document.addEventListener("click", onClick, true);
     return () => document.removeEventListener("click", onClick, true);
-  }, [app]);
+  }, [app, onFallback]);
 }
 
 export function persistKey(instrumentId: string, runId: string): string {
diff --git a/web/mcp-apps/run-report/instrument-report.tsx b/web/mcp-apps/run-report/instrument-report.tsx
index b592a9c7..76339351 100644
--- a/web/mcp-apps/run-report/instrument-report.tsx
+++ b/web/mcp-apps/run-report/instrument-report.tsx
@@ -1,4 +1,4 @@
-import { type ReactNode, useEffect, useState } from "react";
+import { type ReactNode, useEffect, useMemo, useState } from "react";
 import { AuntyPlateReport } from "@/components/runs/aunty/aunty-plate-report";
 import { ImageCarouselReport } from "@/components/runs/image-carousel-report";
 import { PdfCarouselReport } from "@/components/runs/pdf-carousel-report";
@@ -8,7 +8,10 @@ import {
 } from "@/components/runs/plate-map-grid";
 import { RamanReportSection } from "@/components/runs/raman-report-section";
 import { useReportDataSource } from "@/components/runs/report-data-source-provider";
-import { ReportPersistKeyContext } from "@/components/runs/report-items-provider";
+import {
+  ReportPersistKeyProvider,
+  ReportViewerPageProvider,
+} from "@/components/runs/report-items-provider";
 import type { ReportSectionFile } from "@/components/runs/run-report-section";
 import { RunReportSection } from "@/components/runs/run-report-section";
 import { RunSectionCard } from "@/components/runs/run-section-card";
@@ -19,6 +22,7 @@ import type { AuntyPlateData } from "@/lib/runs/aunty";
 import { extractPlateMaps } from "@/lib/runs/extract-plate-maps";
 import {
   emptyReportItemsPage,
+  REPORT_ITEMS_WINDOW,
   type ReportItemKind,
   type ReportItemsPage,
   reportItemKindForInstrument,
@@ -89,47 +93,37 @@ export function InstrumentReport({
     (instrumentType === "gel_doc" || instrumentType === "hina_microscope")
   ) {
     return (
-      <CarouselKindReport
-        kind={kind}
-        persistKey={persistKey}
-        render={(page) => <ImageCarouselReport initialPage={page} />}
-      />
+      <CarouselKindReport kind={kind} persistKey={persistKey}>
+        <ImageCarouselReport />
+      </CarouselKindReport>
     );
   }
   if (kind === "pdf" && instrumentType === "tape_station") {
     return (
-      <CarouselKindReport
-        kind={kind}
-        persistKey={persistKey}
-        render={(page) => <PdfCarouselReport initialPage={page} />}
-      />
+      <CarouselKindReport kind={kind} persistKey={persistKey}>
+        <PdfCarouselReport />
+      </CarouselKindReport>
     );
   }
   if (kind === "video" && instrumentType === "dishcam") {
     return (
-      <CarouselKindReport
-        kind={kind}
-        persistKey={persistKey}
-        render={(page) => (
-          <VideoCarouselReport initialPage={page} posterFileIds={{}} />
-        )}
-      />
+      <CarouselKindReport kind={kind} persistKey={persistKey}>
+        <VideoCarouselReport />
+      </CarouselKindReport>
     );
   }
   if (kind === "spectrum" && instrumentType === "instant_raman") {
     return (
-      <CarouselKindReport
-        kind={kind}
-        persistKey={persistKey}
-        render={(page) => <RamanReportSection initialPage={page} />}
-      />
+      <CarouselKindReport kind={kind} persistKey={persistKey}>
+        <RamanReportSection />
+      </CarouselKindReport>
     );
   }
   if (instrumentType === "aunty") {
     return <AuntyReport />;
   }
   if (instrumentType === "plate_reader") {
-    return <PlateReaderReport files={result.reportFiles} result={result} />;
+    return <PlateReaderReport result={result} />;
   }
 
   return <RunReportSection files={toSectionFiles(result.reportFiles)} />;
@@ -138,11 +132,11 @@ export function InstrumentReport({
 function CarouselKindReport({
   kind,
   persistKey,
-  render,
+  children,
 }: {
+  children: ReactNode;
   kind: ReportItemKind;
   persistKey: string;
-  render: (page: ReportItemsPage) => ReactNode;
 }) {
   const dataSource = useReportDataSource();
   const [page, setPage] = useState<ReportItemsPage | null>(null);
@@ -154,7 +148,7 @@ function CarouselKindReport({
       .fetchReportItems({
         kind,
         offset: 0,
-        limit: 50,
+        limit: REPORT_ITEMS_WINDOW,
         anchor,
       })
       .then(setPage)
@@ -171,9 +165,11 @@ function CarouselKindReport({
     return <p className="text-muted-foreground text-sm">Loading…</p>;
   }
   return (
-    <ReportPersistKeyContext.Provider value={persistKey}>
-      {render(page)}
-    </ReportPersistKeyContext.Provider>
+    <ReportPersistKeyProvider persistKey={persistKey}>
+      <ReportViewerPageProvider page={page}>
+        {children}
+      </ReportViewerPageProvider>
+    </ReportPersistKeyProvider>
   );
 }
 
@@ -208,17 +204,12 @@ function AuntyReport() {
   );
 }
 
-function PlateReaderReport({
-  files,
-  result,
-}: {
-  files: ReportFileRef[];
-  result: RunReportToolResult;
-}) {
+function PlateReaderReport({ result }: { result: RunReportToolResult }) {
   const dataSource = useReportDataSource();
   const [rows, setRows] = useState<RawWellRow[] | null>(null);
+  const [truncated, setTruncated] = useState(false);
   const [error, setError] = useState<string | null>(null);
-  const csv = firstProcessedCsv(files);
+  const csv = firstProcessedCsv(result.reportFiles);
 
   useEffect(() => {
     if (!csv) {
@@ -226,29 +217,16 @@ function PlateReaderReport({
       return;
     }
     void fetchAllTableRows(dataSource, csv.id)
-      .then((table) => setRows(table.rows ?? []))
+      .then((table) => {
+        setRows(table.rows ?? []);
+        setTruncated(table.truncated);
+      })
       .catch((err: unknown) => {
         setError(err instanceof Error ? err.message : "Failed to load wells");
         setRows([]);
       });
   }, [csv, dataSource]);
 
-  if (error) {
-    return <p className="text-destructive text-sm">{error}</p>;
-  }
-  if (rows === null) {
-    return <p className="text-muted-foreground text-sm">Loading…</p>;
-  }
-  if (rows.length === 0) {
-    return (
-      <RunSectionCard title="Plate Maps">
-        <p className="text-muted-foreground text-sm">
-          No report data has been generated for this run.
-        </p>
-      </RunSectionCard>
-    );
-  }
-
   const metadata =
     result.metadata && typeof result.metadata === "object"
       ? (result.metadata as Record<string, unknown>)
@@ -257,15 +235,29 @@ function PlateReaderReport({
     typeof metadata.measurement_type === "string"
       ? metadata.measurement_type
       : "";
-  const heatmap =
-    HEATMAP_MEASUREMENT_TYPES.has(measurementType) ||
-    rows.some((row) => Number.isFinite(Number(row.value)));
-  const groups = extractPlateMaps(rows, {
-    kinetic: measurementType === "Kinetic",
-    spectrum: measurementType === "Spectrum",
-  });
 
-  if (groups.length === 0) {
+  const heatmap = useMemo(
+    () =>
+      HEATMAP_MEASUREMENT_TYPES.has(measurementType) ||
+      (rows ?? []).some((row) => Number.isFinite(Number(row.value))),
+    [measurementType, rows]
+  );
+  const groups = useMemo(
+    () =>
+      extractPlateMaps(rows ?? [], {
+        kinetic: measurementType === "Kinetic",
+        spectrum: measurementType === "Spectrum",
+      }),
+    [measurementType, rows]
+  );
+
+  if (error) {
+    return <p className="text-destructive text-sm">{error}</p>;
+  }
+  if (rows === null) {
+    return <p className="text-muted-foreground text-sm">Loading…</p>;
+  }
+  if (rows.length === 0 || groups.length === 0) {
     return (
       <RunSectionCard title="Plate Maps">
         <p className="text-muted-foreground text-sm">
@@ -282,6 +274,12 @@ function PlateReaderReport({
       count={groups.length}
       title="Plate Maps"
     >
+      {truncated ? (
+        <p className="text-muted-foreground text-xs">
+          This file is larger than the report can load. The maps use the first
+          rows only.
+        </p>
+      ) : null}
       <div className="flex min-w-0 flex-col gap-10">
         {groups.map((group, index) =>
           group.mode === "kinetic" ? (
diff --git a/web/mcp-apps/run-report/mcp-data-source.ts b/web/mcp-apps/run-report/mcp-data-source.ts
index 241112cc..303a6035 100644
--- a/web/mcp-apps/run-report/mcp-data-source.ts
+++ b/web/mcp-apps/run-report/mcp-data-source.ts
@@ -16,8 +16,26 @@ interface ToolEnvelope<T> {
   rows?: Record<string, string>[];
   suffix?: string;
   total?: number;
+  truncated?: boolean;
 }
 
+interface CachedUrl {
+  expiresAt: number;
+  url: string;
+}
+
+interface CachedTable {
+  columns: string[];
+  rows: Record<string, string>[];
+  total: number;
+  truncated: boolean;
+}
+
+// Keep in lockstep with `PRESIGNED_DOWNLOAD_URL_EXPIRY_SECONDS` in
+// `lib/s3.ts`. Do not import that module — it pulls the AWS SDK into
+// the View bundle. Refresh at 80% of the 15-minute lifetime.
+export const URL_CACHE_TTL_MS = 15 * 60 * 1000 * 0.8;
+
 function structuredPayload<T>(result: CallToolResult): T {
   if (result.isError) {
     const text = result.content
@@ -35,14 +53,38 @@ function structuredPayload<T>(result: CallToolResult): T {
   throw new Error("Tool result had no structured content");
 }
 
+function readCachedUrl(
+  cache: Map<number, CachedUrl>,
+  fileId: number
+): string | undefined {
+  const hit = cache.get(fileId);
+  if (!hit) {
+    return;
+  }
+  if (Date.now() >= hit.expiresAt) {
+    cache.delete(fileId);
+    return;
+  }
+  return hit.url;
+}
+
+function writeCachedUrl(
+  cache: Map<number, CachedUrl>,
+  fileId: number,
+  url: string
+): void {
+  cache.set(fileId, { url, expiresAt: Date.now() + URL_CACHE_TTL_MS });
+}
+
 export function createMcpReportDataSource(args: {
   app: App;
   instrumentId: string;
   runId: string;
 }): ReportDataSource {
-  const urlCache = new Map<number, string>();
+  const urlCache = new Map<number, CachedUrl>();
+  const tableCache = new Map<number, CachedTable>();
 
-  return {
+  const source: ReportDataSource = {
     async fetchReportItems({ kind, offset, limit, search, anchor }) {
       const result = await args.app.callServerTool({
         name: "report_view_items",
@@ -60,28 +102,49 @@ export function createMcpReportDataSource(args: {
       for (const item of payload.data) {
         const withUrl = item as { id: number; downloadUrl?: string };
         if (withUrl.downloadUrl) {
-          urlCache.set(withUrl.id, withUrl.downloadUrl);
+          writeCachedUrl(urlCache, withUrl.id, withUrl.downloadUrl);
         }
       }
       return payload;
     },
 
     async fetchTable({ fileId, offset, limit }) {
-      const result = await args.app.callServerTool({
-        name: "report_view_table",
-        arguments: {
-          instrumentId: args.instrumentId,
-          runId: args.runId,
-          fileId,
+      let parsed = tableCache.get(fileId);
+      if (!parsed) {
+        // One tool call returns the whole file up to the scan cap. Paging
+        // after that is in-memory so a 20k-row CSV is not 100 S3 GETs.
+        const result = await args.app.callServerTool({
+          name: "report_view_table",
+          arguments: {
+            instrumentId: args.instrumentId,
+            runId: args.runId,
+            fileId,
+            full: true,
+          },
+        });
+        const payload = structuredPayload<{
+          columns: string[];
+          rows: Record<string, string>[];
+          total: number;
+          truncated?: boolean;
+        }>(result);
+        parsed = {
+          columns: payload.columns,
+          rows: payload.rows,
+          total: payload.total,
+          truncated: payload.truncated === true,
+        };
+        tableCache.set(fileId, parsed);
+      }
+      return {
+        columns: parsed.columns,
+        rows: parsed.rows.slice(
           offset,
-          limit: Math.min(limit, REPORT_VIEW_TABLE_MAX_LIMIT),
-        },
-      });
-      return structuredPayload<{
-        columns: string[];
-        rows: Record<string, string>[];
-        total: number;
-      }>(result);
+          offset + Math.min(limit, REPORT_VIEW_TABLE_MAX_LIMIT)
+        ),
+        total: parsed.total,
+        truncated: parsed.truncated,
+      };
     },
 
     async fetchArtifact({ suffix }) {
@@ -97,16 +160,20 @@ export function createMcpReportDataSource(args: {
       return payload.artifact ?? payload;
     },
 
+    peekFileUrl(fileId: number) {
+      return readCachedUrl(urlCache, fileId) ?? null;
+    },
+
     async resolveFileUrl(fileId: number) {
-      const cached = urlCache.get(fileId);
+      const cached = readCachedUrl(urlCache, fileId);
       if (cached) {
         return cached;
       }
       // Kind is required and filters the window, so try every kind. A hit
       // also warms the cache for neighbouring files of that kind.
-      await Promise.all(
+      await Promise.allSettled(
         REPORT_ITEM_KINDS.map((kind) =>
-          this.fetchReportItems({
+          source.fetchReportItems({
             kind,
             offset: 0,
             limit: 1,
@@ -114,11 +181,13 @@ export function createMcpReportDataSource(args: {
           })
         )
       );
-      const resolved = urlCache.get(fileId);
+      const resolved = readCachedUrl(urlCache, fileId);
       if (resolved) {
         return resolved;
       }
       throw new Error(`No download URL for file ${fileId}`);
     },
   };
+
+  return source;
 }
diff --git a/web/mcp-apps/run-report/parse-tool-result.ts b/web/mcp-apps/run-report/parse-tool-result.ts
new file mode 100644
index 00000000..80c7c82e
--- /dev/null
+++ b/web/mcp-apps/run-report/parse-tool-result.ts
@@ -0,0 +1,40 @@
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import type { RunReportToolResult } from "./instrument-report";
+
+function asRunReport(payload: unknown): RunReportToolResult | null {
+  if (!payload || typeof payload !== "object") {
+    return null;
+  }
+  const record = payload as Partial<RunReportToolResult>;
+  if (!(record.instrumentId && record.runId && record.instrumentType)) {
+    return null;
+  }
+  return {
+    instrumentId: record.instrumentId,
+    runId: record.runId,
+    instrumentType: record.instrumentType,
+    metadata: record.metadata,
+    reportFiles: record.reportFiles ?? [],
+  };
+}
+
+// Single pass over structured content, then one JSON parse of the text
+// block. A recursive fallback would stack-overflow when the text parses
+// but still lacks identifiers.
+export function parseRunReportToolResult(
+  result: CallToolResult
+): RunReportToolResult | null {
+  const fromStructured = asRunReport(result.structuredContent);
+  if (fromStructured) {
+    return fromStructured;
+  }
+  const text = result.content?.find((block) => block.type === "text");
+  if (!(text && "text" in text)) {
+    return null;
+  }
+  try {
+    return asRunReport(JSON.parse(text.text));
+  } catch {
+    return null;
+  }
+}
diff --git a/web/proxy.ts b/web/proxy.ts
index b8c40d01..195ec2e3 100644
--- a/web/proxy.ts
+++ b/web/proxy.ts
@@ -17,9 +17,11 @@ const publicPrefixes = [
   "/consent",
   "/api/auth",
   "/api/v1",
-  // Local S3 mirror bytes. The MCP Apps View loads these from a
-  // cross-origin sandbox with no session cookie; the route 404s when
-  // `LOCAL_S3_MIRROR` is unset or `NODE_ENV` is production.
+  // Local S3 mirror. GET/HEAD must stay public: the MCP Apps View loads
+  // bytes from a cross-origin sandbox with no session cookie. PUT is
+  // public too because local presigned uploads (watcher, fixture
+  // processing) have no session. The route 404s when the mirror is
+  // unset or `NODE_ENV` is production, so this never writes in prod.
   "/api/local-s3",
   // MCP authenticates via OAuth (or flagged PAT fallback), never a
   // session cookie — a redirect to `/login` would surface as opaque HTML
diff --git a/web/tests/mcp/mcp-protocol.test.ts b/web/tests/mcp/mcp-protocol.test.ts
index 71d40db9..e46112cd 100644
--- a/web/tests/mcp/mcp-protocol.test.ts
+++ b/web/tests/mcp/mcp-protocol.test.ts
@@ -1336,6 +1336,7 @@ describe("MCP Protocol (in-memory)", () => {
         resourceUri: "ui://data-hub/run-report",
         visibility: ["model", "app"],
       },
+      "ui/resourceUri": "ui://data-hub/run-report",
     });
   });
 
@@ -1352,6 +1353,7 @@ describe("MCP Protocol (in-memory)", () => {
           resourceUri: "ui://data-hub/run-report",
           visibility: ["app"],
         },
+        "ui/resourceUri": "ui://data-hub/run-report",
       });
       const result = await client.callTool({
         name,
@@ -1719,11 +1721,16 @@ describe("MCP Protocol (in-memory)", () => {
     expect(contents[0].mimeType).toBe("text/html;profile=mcp-app");
     expect((contents[0] as { text: string }).text).toMatch(/<!DOCTYPE html/i);
     const readMeta = contents[0]._meta as
-      | { ui?: { csp?: { frameDomains?: string[] } } }
+      | {
+          ui?: {
+            csp?: { connectDomains?: string[]; frameDomains?: string[] };
+          };
+        }
       | undefined;
     expect(readMeta?.ui?.csp?.frameDomains).toEqual(
       expect.arrayContaining(["http://localhost:3000"])
     );
+    expect(readMeta?.ui?.csp?.connectDomains).toEqual([]);
   });
 
   it("reads the glossary resource", async () => {
diff --git a/web/tests/unit/mcp-absolute-url.test.ts b/web/tests/unit/mcp-absolute-url.test.ts
new file mode 100644
index 00000000..5e21fa47
--- /dev/null
+++ b/web/tests/unit/mcp-absolute-url.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("@/lib/auth", () => ({
+  authBaseURL: "http://localhost:3000",
+}));
+
+import { toAbsoluteDownloadUrl } from "@/lib/mcp/absolute-url";
+
+describe("toAbsoluteDownloadUrl", () => {
+  it("leaves http(s) URLs unchanged", () => {
+    expect(
+      toAbsoluteDownloadUrl("https://bucket.s3.us-west-1.amazonaws.com/k")
+    ).toBe("https://bucket.s3.us-west-1.amazonaws.com/k");
+    expect(
+      toAbsoluteDownloadUrl("http://127.0.0.1:3000/api/local-s3/b/k")
+    ).toBe("http://127.0.0.1:3000/api/local-s3/b/k");
+  });
+
+  it("prefixes a relative local-mirror path with the auth origin", () => {
+    expect(toAbsoluteDownloadUrl("/api/local-s3/raw/run/file.png")).toBe(
+      "http://localhost:3000/api/local-s3/raw/run/file.png"
+    );
+    expect(toAbsoluteDownloadUrl("api/local-s3/raw/run/file.png")).toBe(
+      "http://localhost:3000/api/local-s3/raw/run/file.png"
+    );
+  });
+});
diff --git a/web/tests/unit/mcp-data-source.test.ts b/web/tests/unit/mcp-data-source.test.ts
new file mode 100644
index 00000000..1b41c403
--- /dev/null
+++ b/web/tests/unit/mcp-data-source.test.ts
@@ -0,0 +1,118 @@
+import type { App } from "@modelcontextprotocol/ext-apps";
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  createMcpReportDataSource,
+  URL_CACHE_TTL_MS,
+} from "@/mcp-apps/run-report/mcp-data-source";
+
+function okResult(structuredContent: unknown): CallToolResult {
+  return {
+    content: [{ type: "text", text: JSON.stringify(structuredContent) }],
+    structuredContent,
+  } as CallToolResult;
+}
+
+function errorResult(message: string): CallToolResult {
+  return {
+    content: [{ type: "text", text: message }],
+    isError: true,
+  } as CallToolResult;
+}
+
+describe("createMcpReportDataSource", () => {
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it("peeks a cached URL and refreshes after the TTL", async () => {
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-01-01T00:00:00Z"));
+    const callServerTool = vi.fn().mockResolvedValue(
+      okResult({
+        data: [
+          { id: 7, filename: "a.png", downloadUrl: "https://s3.example/a" },
+        ],
+        pagination: { limit: 1, offset: 0, total: 1 },
+      })
+    );
+    const source = createMcpReportDataSource({
+      app: { callServerTool } as unknown as App,
+      instrumentId: "inst",
+      runId: "run",
+    });
+
+    await source.fetchReportItems({
+      kind: "image",
+      offset: 0,
+      limit: 1,
+    });
+    expect(source.peekFileUrl?.(7)).toBe("https://s3.example/a");
+    expect(await source.resolveFileUrl(7)).toBe("https://s3.example/a");
+    expect(callServerTool).toHaveBeenCalledTimes(1);
+
+    vi.setSystemTime(new Date(Date.now() + URL_CACHE_TTL_MS + 1));
+    expect(source.peekFileUrl?.(7)).toBeNull();
+  });
+
+  it("loads a CSV once with full:true and pages from memory", async () => {
+    const rows = Array.from({ length: 5 }, (_, i) => ({ n: String(i) }));
+    const callServerTool = vi.fn().mockResolvedValue(
+      okResult({
+        columns: ["n"],
+        rows,
+        total: 5,
+        truncated: false,
+      })
+    );
+    const source = createMcpReportDataSource({
+      app: { callServerTool } as unknown as App,
+      instrumentId: "inst",
+      runId: "run",
+    });
+
+    const first = await source.fetchTable({ fileId: 9, offset: 0, limit: 2 });
+    const second = await source.fetchTable({ fileId: 9, offset: 2, limit: 2 });
+
+    expect(callServerTool).toHaveBeenCalledTimes(1);
+    expect(callServerTool.mock.calls[0][0]).toMatchObject({
+      name: "report_view_table",
+      arguments: { fileId: 9, full: true },
+    });
+    expect(first.rows).toEqual([{ n: "0" }, { n: "1" }]);
+    expect(second.rows).toEqual([{ n: "2" }, { n: "3" }]);
+    expect(first.truncated).toBe(false);
+  });
+
+  it("keeps a successful URL when another kind lookup fails", async () => {
+    const callServerTool = vi.fn(
+      ({
+        name,
+        arguments: args,
+      }: {
+        name: string;
+        arguments: { kind?: string };
+      }) => {
+        if (name === "report_view_items" && args.kind === "image") {
+          return okResult({
+            data: [
+              { id: 3, filename: "a.png", downloadUrl: "https://s3.example/a" },
+            ],
+            pagination: { limit: 1, offset: 0, total: 1 },
+          });
+        }
+        return errorResult("boom");
+      }
+    );
+    const source = createMcpReportDataSource({
+      app: { callServerTool } as unknown as App,
+      instrumentId: "inst",
+      runId: "run",
+    });
+
+    await expect(source.resolveFileUrl(3)).resolves.toBe(
+      "https://s3.example/a"
+    );
+    expect(callServerTool).toHaveBeenCalledTimes(4);
+  });
+});
diff --git a/web/tests/unit/mcp-parse-csv-page.test.ts b/web/tests/unit/mcp-parse-csv-page.test.ts
new file mode 100644
index 00000000..6507cc02
--- /dev/null
+++ b/web/tests/unit/mcp-parse-csv-page.test.ts
@@ -0,0 +1,38 @@
+import { Readable } from "node:stream";
+import { describe, expect, it } from "vitest";
+import { parseCsvPageFromStream } from "@/lib/runs/parse-csv-page";
+
+function csvStream(text: string): Readable {
+  return Readable.from([Buffer.from(text)]);
+}
+
+describe("parseCsvPageFromStream", () => {
+  const csv = "col_a,col_b\n1,2\n3,4\n5,6\n7,8\n";
+
+  it("pages from an offset and reports the scanned total", async () => {
+    const page = await parseCsvPageFromStream(csvStream(csv), 1, 2);
+    expect(page.columns).toEqual(["col_a", "col_b"]);
+    expect(page.rows).toEqual([
+      { col_a: "3", col_b: "4" },
+      { col_a: "5", col_b: "6" },
+    ]);
+    expect(page.total).toBe(4);
+    expect(page.truncated).toBe(false);
+  });
+
+  it("clamps the returned rows to limit", async () => {
+    const page = await parseCsvPageFromStream(csvStream(csv), 0, 1);
+    expect(page.rows).toEqual([{ col_a: "1", col_b: "2" }]);
+    expect(page.total).toBe(4);
+  });
+
+  it("stops at the scan cap and sets truncated", async () => {
+    const page = await parseCsvPageFromStream(csvStream(csv), 0, 50, 2);
+    expect(page.rows).toEqual([
+      { col_a: "1", col_b: "2" },
+      { col_a: "3", col_b: "4" },
+    ]);
+    expect(page.total).toBe(2);
+    expect(page.truncated).toBe(true);
+  });
+});
diff --git a/web/tests/unit/mcp-parse-tool-result.test.ts b/web/tests/unit/mcp-parse-tool-result.test.ts
new file mode 100644
index 00000000..27e7e805
--- /dev/null
+++ b/web/tests/unit/mcp-parse-tool-result.test.ts
@@ -0,0 +1,46 @@
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import { describe, expect, it } from "vitest";
+import { parseRunReportToolResult } from "@/mcp-apps/run-report/parse-tool-result";
+
+const valid = {
+  instrumentId: "gel-doc-1",
+  runId: "run-9",
+  instrumentType: "gel_doc",
+  metadata: {},
+  reportFiles: [],
+};
+
+describe("parseRunReportToolResult", () => {
+  it("reads structured content", () => {
+    expect(
+      parseRunReportToolResult({
+        content: [],
+        structuredContent: valid,
+      } as CallToolResult)
+    ).toEqual(valid);
+  });
+
+  it("parses a text block once when structured content is missing", () => {
+    expect(
+      parseRunReportToolResult({
+        content: [{ type: "text", text: JSON.stringify(valid) }],
+      } as CallToolResult)
+    ).toEqual(valid);
+  });
+
+  it("returns null for text that parses but lacks identifiers", () => {
+    expect(
+      parseRunReportToolResult({
+        content: [{ type: "text", text: JSON.stringify({ ok: true }) }],
+      } as CallToolResult)
+    ).toBeNull();
+  });
+
+  it("returns null for invalid JSON text", () => {
+    expect(
+      parseRunReportToolResult({
+        content: [{ type: "text", text: "not-json" }],
+      } as CallToolResult)
+    ).toBeNull();
+  });
+});
diff --git a/web/tests/unit/mcp-report-views.test.ts b/web/tests/unit/mcp-report-views.test.ts
new file mode 100644
index 00000000..a3671194
--- /dev/null
+++ b/web/tests/unit/mcp-report-views.test.ts
@@ -0,0 +1,272 @@
+import { Client } from "@modelcontextprotocol/client";
+import { InMemoryTransport, McpServer } from "@modelcontextprotocol/server";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const MOCK_RUN_UUID = "11111111-1111-4111-a111-111111111111";
+
+vi.mock("@/lib/auth", () => ({
+  authBaseURL: "http://localhost:3000",
+}));
+
+vi.mock("@/lib/mcp/tools/helpers", async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import("@/lib/mcp/tools/helpers")>();
+  return {
+    ...actual,
+    getMcpUserId: vi.fn(() => "user-1"),
+  };
+});
+
+vi.mock("@/lib/api/instrument-runs", () => ({
+  lookupRunByNaturalKey: vi.fn(async (_instrumentId: string, runId: string) =>
+    runId === "run-1"
+      ? { id: MOCK_RUN_UUID, instrumentId: "test-plate-reader", runId: "run-1" }
+      : null
+  ),
+  getRunReportFiles: vi.fn(),
+  getAuntyPlateData: vi.fn(),
+}));
+
+vi.mock("@/lib/api/report-items", () => ({
+  getReportItemsPage: vi.fn(),
+}));
+
+vi.mock("@/lib/api/files", () => ({
+  getActiveFileById: vi.fn(),
+  getActiveFilesByIds: vi.fn(),
+  lookupFileForDownload: vi.fn(),
+  findActiveFileBySuffix: vi.fn(),
+}));
+
+vi.mock("@/lib/s3", () => ({
+  getPresignedDownloadUrl: vi
+    .fn()
+    .mockResolvedValue("https://s3.example.com/signed"),
+  getS3ObjectStream: vi.fn(),
+}));
+
+vi.mock("@/lib/runs/parse-csv-page", () => ({
+  parseCsvPage: vi.fn(),
+}));
+
+import {
+  findActiveFileBySuffix,
+  getActiveFileById,
+  getActiveFilesByIds,
+  lookupFileForDownload,
+} from "@/lib/api/files";
+import {
+  getAuntyPlateData,
+  getRunReportFiles,
+} from "@/lib/api/instrument-runs";
+import { getReportItemsPage } from "@/lib/api/report-items";
+import { registerReportViewTools } from "@/lib/mcp/tools/report-views";
+import { parseCsvPage } from "@/lib/runs/parse-csv-page";
+import { getS3ObjectStream } from "@/lib/s3";
+
+function parseStructured(result: {
+  structuredContent?: unknown;
+  content: unknown;
+}): Record<string, unknown> {
+  if (
+    result.structuredContent &&
+    typeof result.structuredContent === "object"
+  ) {
+    return result.structuredContent as Record<string, unknown>;
+  }
+  const block = (result.content as Array<{ type: string; text?: string }>).find(
+    (item) => item.type === "text"
+  );
+  return JSON.parse(block?.text ?? "{}") as Record<string, unknown>;
+}
+
+describe("report_view tools (authenticated)", () => {
+  let client: Client;
+  let server: McpServer;
+
+  beforeEach(async () => {
+    server = new McpServer(
+      { name: "data-hub-test", version: "1.0.0" },
+      { capabilities: { tools: {} } }
+    );
+    registerReportViewTools(server);
+    client = new Client({ name: "test-client", version: "1.0.0" });
+    const [clientTransport, serverTransport] =
+      InMemoryTransport.createLinkedPair();
+    await Promise.all([
+      client.connect(clientTransport),
+      server.connect(serverTransport),
+    ]);
+  });
+
+  afterEach(async () => {
+    await client.close();
+    await server.close();
+    vi.clearAllMocks();
+  });
+
+  it("report_view_items returns download URLs", async () => {
+    vi.mocked(getReportItemsPage).mockResolvedValue({
+      data: [{ id: 42, filename: "gel.png" }],
+      pagination: { limit: 50, offset: 0, total: 1 },
+    });
+    vi.mocked(getActiveFilesByIds).mockResolvedValue([
+      {
+        id: 42,
+        s3Bucket: "raw",
+        s3Key: "gel.png",
+      } as never,
+    ]);
+
+    const result = await client.callTool({
+      name: "report_view_items",
+      arguments: {
+        instrumentId: "test-plate-reader",
+        runId: "run-1",
+        kind: "image",
+      },
+    });
+    expect(result.isError).toBeFalsy();
+    const parsed = parseStructured(result);
+    expect(parsed.data).toEqual([
+      {
+        id: 42,
+        filename: "gel.png",
+        downloadUrl: "https://s3.example.com/signed",
+      },
+    ]);
+  });
+
+  it("report_view_table clamps limit and forwards offset", async () => {
+    vi.mocked(getActiveFileById).mockResolvedValue({
+      id: 42,
+      instrumentRunId: MOCK_RUN_UUID,
+    } as never);
+    vi.mocked(lookupFileForDownload).mockResolvedValue({
+      ok: true,
+      filename: "data.csv",
+      s3Bucket: "raw",
+      s3Key: "data.csv",
+    });
+    vi.mocked(parseCsvPage).mockResolvedValue({
+      columns: ["n"],
+      rows: [{ n: "1" }],
+      total: 3,
+      truncated: false,
+    });
+
+    const result = await client.callTool({
+      name: "report_view_table",
+      arguments: {
+        instrumentId: "test-plate-reader",
+        runId: "run-1",
+        fileId: 42,
+        offset: 2,
+        limit: 200,
+      },
+    });
+    expect(result.isError).toBeFalsy();
+    expect(parseCsvPage).toHaveBeenCalledWith("raw", "data.csv", 2, 200);
+  });
+
+  it("report_view_table rejects a limit above the schema max", async () => {
+    const result = await client.callTool({
+      name: "report_view_table",
+      arguments: {
+        instrumentId: "test-plate-reader",
+        runId: "run-1",
+        fileId: 42,
+        limit: 201,
+      },
+    });
+    expect(result.isError).toBe(true);
+    expect(parseCsvPage).not.toHaveBeenCalled();
+  });
+
+  it("report_view_table full=true reads from row 0 up to the scan cap", async () => {
+    vi.mocked(getActiveFileById).mockResolvedValue({
+      id: 42,
+      instrumentRunId: MOCK_RUN_UUID,
+    } as never);
+    vi.mocked(lookupFileForDownload).mockResolvedValue({
+      ok: true,
+      filename: "data.csv",
+      s3Bucket: "raw",
+      s3Key: "data.csv",
+    });
+    vi.mocked(parseCsvPage).mockResolvedValue({
+      columns: ["n"],
+      rows: [{ n: "1" }],
+      total: 50_000,
+      truncated: true,
+    });
+
+    const result = await client.callTool({
+      name: "report_view_table",
+      arguments: {
+        instrumentId: "test-plate-reader",
+        runId: "run-1",
+        fileId: 42,
+        full: true,
+        offset: 99,
+        limit: 10,
+      },
+    });
+    expect(result.isError).toBeFalsy();
+    expect(parseCsvPage).toHaveBeenCalledWith("raw", "data.csv", 0, 50_000);
+    expect(parseStructured(result).truncated).toBe(true);
+  });
+
+  it("report_view_artifact returns Aunty plate data", async () => {
+    const plate = { plate: { wells: [] }, curvesFileId: 9 };
+    vi.mocked(getRunReportFiles).mockResolvedValue([
+      {
+        filename: "run-1_aunty_plate.json",
+        deletedAt: null,
+      } as never,
+    ]);
+    vi.mocked(getAuntyPlateData).mockResolvedValue(plate as never);
+
+    const result = await client.callTool({
+      name: "report_view_artifact",
+      arguments: {
+        instrumentId: "test-plate-reader",
+        runId: "run-1",
+        suffix: "_aunty_plate.json",
+      },
+    });
+    expect(result.isError).toBeFalsy();
+    expect(parseStructured(result)).toMatchObject({
+      suffix: "_aunty_plate.json",
+      filename: "run-1_aunty_plate.json",
+      artifact: plate,
+    });
+  });
+
+  it("report_view_artifact parses a JSON suffix file", async () => {
+    vi.mocked(findActiveFileBySuffix).mockResolvedValue({
+      filename: "run-1_meta.json",
+      s3Bucket: "raw",
+      s3Key: "run-1_meta.json",
+    } as never);
+    const { Readable } = await import("node:stream");
+    vi.mocked(getS3ObjectStream).mockResolvedValue(
+      Readable.from([Buffer.from('{"ok":true}')]) as never
+    );
+
+    const result = await client.callTool({
+      name: "report_view_artifact",
+      arguments: {
+        instrumentId: "test-plate-reader",
+        runId: "run-1",
+        suffix: "_meta.json",
+      },
+    });
+    expect(result.isError).toBeFalsy();
+    expect(parseStructured(result)).toMatchObject({
+      suffix: "_meta.json",
+      filename: "run-1_meta.json",
+      artifact: { ok: true },
+    });
+  });
+});
diff --git a/web/tests/unit/mcp-run-report-html.test.ts b/web/tests/unit/mcp-run-report-html.test.ts
new file mode 100644
index 00000000..1b7e8b7d
--- /dev/null
+++ b/web/tests/unit/mcp-run-report-html.test.ts
@@ -0,0 +1,42 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("node:fs", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("node:fs")>();
+  return {
+    ...actual,
+    existsSync: vi.fn(() => false),
+    readFileSync: vi.fn(),
+  };
+});
+
+vi.mock("@/lib/auth", () => ({
+  authBaseURL: "http://localhost:3000",
+}));
+
+import {
+  HELLO_WORLD_RUN_REPORT_HTML,
+  loadRunReportHtml,
+  resetRunReportHtmlCache,
+} from "@/lib/mcp/run-report-html";
+
+describe("loadRunReportHtml", () => {
+  afterEach(() => {
+    resetRunReportHtmlCache();
+    vi.unstubAllEnvs();
+  });
+
+  it("serves the placeholder in non-production when the artifact is missing", () => {
+    vi.stubEnv("NODE_ENV", "test");
+    const html = loadRunReportHtml();
+    expect(html).toContain("Hello from the Data Hub run report view.");
+    expect(html).toContain("http://localhost:3000");
+    expect(html).not.toContain("%%DATA_HUB_ORIGIN%%");
+    expect(HELLO_WORLD_RUN_REPORT_HTML).toContain("%%DATA_HUB_ORIGIN%%");
+  });
+
+  it("throws in production when the artifact is missing", () => {
+    vi.stubEnv("NODE_ENV", "production");
+    resetRunReportHtmlCache();
+    expect(() => loadRunReportHtml()).toThrow(/mcp-apps:build/);
+  });
+});
diff --git a/web/tests/unit/mcp-ui-csp.test.ts b/web/tests/unit/mcp-ui-csp.test.ts
new file mode 100644
index 00000000..33e7214a
--- /dev/null
+++ b/web/tests/unit/mcp-ui-csp.test.ts
@@ -0,0 +1,47 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/lib/auth", () => ({
+  authBaseURL: "http://localhost:3000",
+}));
+
+vi.mock("@/lib/s3", () => ({
+  getPresignedDownloadUrl: vi.fn(),
+}));
+
+import {
+  resetRunReportUiCspCache,
+  runReportUiMeta,
+  runReportUiMetaSnapshot,
+} from "@/lib/mcp/ui-csp";
+import { getPresignedDownloadUrl } from "@/lib/s3";
+
+describe("runReportUiMeta", () => {
+  afterEach(() => {
+    resetRunReportUiCspCache();
+    vi.unstubAllEnvs();
+    vi.mocked(getPresignedDownloadUrl).mockReset();
+  });
+
+  it("derives the S3 origin from a signed URL and leaves connectDomains empty", async () => {
+    vi.stubEnv("S3_RAW_DATA_BUCKET", "dotted.bucket.name");
+    vi.mocked(getPresignedDownloadUrl).mockResolvedValue(
+      "https://s3.us-west-1.amazonaws.com/dotted.bucket.name/__mcp-app-csp-probe__"
+    );
+
+    const meta = await runReportUiMeta();
+    expect(meta.ui.csp.resourceDomains).toEqual(
+      expect.arrayContaining(["https://s3.us-west-1.amazonaws.com"])
+    );
+    expect(meta.ui.csp.frameDomains).toEqual(meta.ui.csp.resourceDomains);
+    expect(meta.ui.csp.connectDomains).toEqual([]);
+    expect(meta.ui.prefersBorder).toBe(true);
+  });
+
+  it("snapshots local origins before the probe finishes", () => {
+    const snapshot = runReportUiMetaSnapshot();
+    expect(snapshot.ui.csp.resourceDomains).toEqual(
+      expect.arrayContaining(["http://localhost:3000"])
+    );
+    expect(snapshot.ui.csp.connectDomains).toEqual([]);
+  });
+});
diff --git a/web/tests/unit/rest-report-data-source.test.ts b/web/tests/unit/rest-report-data-source.test.ts
index 18de2b5f..77d8269c 100644
--- a/web/tests/unit/rest-report-data-source.test.ts
+++ b/web/tests/unit/rest-report-data-source.test.ts
@@ -34,6 +34,7 @@ describe("createRestReportDataSource", () => {
       "/api/v1/instruments/inst-1/runs/run-1/report-items?kind=image&offset=0&limit=50&search=gel"
     );
     expect(source.resolveFileUrl(42)).toBe("/api/v1/files/42/download");
+    expect(source.peekFileUrl?.(42)).toBe("/api/v1/files/42/download");
   });
 
   it("parses a CSV once, then serves paginated slices from cache", async () => {
@@ -103,6 +104,29 @@ describe("fetchAllTableRows", () => {
     );
 
     expect(result.rows.map((r) => r.n)).toEqual(["1", "2", "3"]);
+    expect(result.truncated).toBe(false);
     expect(dataSource.fetchTable).toHaveBeenCalledTimes(2);
   });
+
+  it("marks the table truncated when paging stops short of total", async () => {
+    const dataSource: Pick<ReportDataSource, "fetchTable"> = {
+      fetchTable: vi.fn(({ offset }) =>
+        Promise.resolve({
+          columns: ["n"],
+          rows: offset === 0 ? [{ n: "1" }] : [],
+          total: 5,
+          truncated: true,
+        })
+      ),
+    };
+
+    const result = await fetchAllTableRows(
+      dataSource as ReportDataSource,
+      7,
+      1
+    );
+
+    expect(result.rows).toEqual([{ n: "1" }]);
+    expect(result.truncated).toBe(true);
+  });
 });
diff --git a/web/tests/unit/use-resolved-file-url.test.ts b/web/tests/unit/use-resolved-file-url.test.ts
new file mode 100644
index 00000000..323c5a83
--- /dev/null
+++ b/web/tests/unit/use-resolved-file-url.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it, vi } from "vitest";
+import { peekSyncFileUrl } from "@/hooks/use-resolved-file-url";
+import type { ReportDataSource } from "@/lib/runs/view-data-source";
+
+describe("peekSyncFileUrl", () => {
+  it("reads peekFileUrl and does not call resolveFileUrl", () => {
+    const resolveFileUrl = vi.fn(() => {
+      throw new Error("should not be called");
+    });
+    const dataSource = {
+      peekFileUrl: (fileId: number) => `/api/v1/files/${fileId}/download`,
+      resolveFileUrl,
+    } as unknown as ReportDataSource;
+
+    expect(peekSyncFileUrl(dataSource, 12)).toBe("/api/v1/files/12/download");
+    expect(resolveFileUrl).not.toHaveBeenCalled();
+  });
+
+  it("does not call resolveFileUrl on an async source", () => {
+    const resolveFileUrl = vi.fn(() => Promise.resolve("https://s3.example/a"));
+    const dataSource = {
+      resolveFileUrl,
+    } as unknown as ReportDataSource;
+
+    expect(peekSyncFileUrl(dataSource, 12)).toBeUndefined();
+    expect(resolveFileUrl).not.toHaveBeenCalled();
+  });
+});

From a06fd2c9bf0f7a3c71949401f470f8ab5baf34a5 Mon Sep 17 00:00:00 2001
From: Wasim Amiri <7220175+wasimxyz@users.noreply.github.com>
Date: Sat, 29 Aug 2026 20:25:42 -0700
Subject: [PATCH 3/6] Derive the MCP Apps CSP origin synchronously and document
 the View.

The origins came from presigning a throwaway key per bucket. That is async,
so `registerResource` snapshotted a possibly-empty cache for `resources/list`
while `resources/read` awaited the real list, and a cold instance advertised
no origins on its first listing. `s3BucketOrigin` now composes the origin
beside the `S3Client`, so one synchronous `runReportUiMeta` serves both paths
and they cannot disagree. It also skips the S3 hosts under `LOCAL_S3_MIRROR`,
where the mirror already serves bytes from the app's own origin.

Expands `developer-docs/mcp-apps.md` into a full implementation reference:
host render flow, the three app-only tools, the shared data source, the
build, and known limitations.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 developer-docs/README.md           |   2 +-
 developer-docs/mcp-apps.md         | 169 ++++++++++++++++++++++++++++-
 web/lib/mcp/resources.ts           |   7 +-
 web/lib/mcp/ui-csp.ts              |  96 +++++-----------
 web/lib/s3.ts                      |  15 ++-
 web/tests/mcp/mcp-protocol.test.ts |   2 +
 web/tests/unit/mcp-ui-csp.test.ts  |  66 ++++++-----
 7 files changed, 254 insertions(+), 103 deletions(-)

diff --git a/developer-docs/README.md b/developer-docs/README.md
index 901e366f..6908da2a 100644
--- a/developer-docs/README.md
+++ b/developer-docs/README.md
@@ -10,7 +10,7 @@ see the root [README](../README.md#documentation) for that split.
 - [Getting started](getting-started.md) — development setup, environment variables, running locally
 - [Local development](local-development.md) — zero-credential dev workflow for the web app + API + database (no watcher / Lambda needed)
 - [Architecture](architecture.md) — system overview, data flow, and design decisions
-- [MCP Apps](mcp-apps.md) — run-report View bundle, `mcp-apps:build`, and the gitignored HTML artifact
+- [MCP Apps](mcp-apps.md) — run-report View: host render flow, the three app-only tools, the shared data source, `mcp-apps:build`, and the gitignored HTML artifact
 - [Testing](testing.md) — per-package test frameworks, the shared test-server fixture, S3 mocking
 - [Watcher](watcher.md) — CLI commands, configuration, run detection, upload modes
 - [Lambda](lambda.md) — processing pipeline, supported instruments, adding new instruments
diff --git a/developer-docs/mcp-apps.md b/developer-docs/mcp-apps.md
index 96d44ba7..3a0c4a07 100644
--- a/developer-docs/mcp-apps.md
+++ b/developer-docs/mcp-apps.md
@@ -1,8 +1,121 @@
 # MCP Apps (run report View)
 
-Data Hub ships an [MCP Apps](https://modelcontextprotocol.io/specification/2026-01-26/apps) View so a host (today: Arcadia Chat) can render a run report inside a sandboxed iframe. The server advertises `ui://data-hub/run-report` and three app-only tools (`report_view_items`, `report_view_table`, `report_view_artifact`). Hosts must hide tools whose `visibility` does not include `"model"`.
+Data Hub's MCP server serves the run report as an interactive HTML page, so a chat client that supports the MCP Apps extension renders the same report the website renders instead of rebuilding it from JSON.
 
-Hosts may prefetch and cache the HTML resource. Do not treat a single `resources/read` as the only time the View is fetched.
+MCP Apps ([SEP-1865](https://modelcontextprotocol.io/specification/2026-01-26/apps)) is an extension to the Model Context Protocol. The server publishes an HTML page at a `ui://` address, the client fetches that page and runs it inside a locked-down iframe, and the page asks the client to make tool calls on its behalf. Throughout this page, "host" means the chat client doing that work, and "View" means the HTML page.
+
+The same React components render both surfaces. The web app feeds them over REST and the View feeds them over MCP tool calls.
+
+## What the server publishes
+
+- `ui://data-hub/run-report` is a resource whose body is one self-contained HTML file, served with the media type `text/html;profile=mcp-app`.
+- `get_run_report` carries a pointer to that resource, so a host knows to render the page when the model calls the tool.
+- `report_view_items`, `report_view_table`, and `report_view_artifact` are three read-only tools the View calls to fetch its own data.
+
+Adding those three took the tool count from 32 to 35. Two tests pin that number so the change shows up in review: `web/tests/mcp/mcp-catalog.test.ts` and `web/tests/integration/mcp.test.ts`.
+
+### Tool metadata
+
+`runReportToolUiMeta` in `web/lib/mcp/ui-apps.ts` writes the resource pointer twice:
+
+```ts
+{
+  ui: { resourceUri: "ui://data-hub/run-report", visibility: ["app"] },
+  "ui/resourceUri": "ui://data-hub/run-report",
+}
+```
+
+The nested `ui.resourceUri` is what the current spec asks for. The flat `ui/resourceUri` key is deprecated and is kept because some hosts still read it. `visibility` is `["model", "app"]` on `get_run_report` and `["app"]` on the three view tools.
+
+## How a host renders a run report
+
+1. The model calls `get_run_report` for an instrument and a run.
+2. The host reads `_meta.ui.resourceUri` on that tool and fetches the resource at `ui://data-hub/run-report`.
+3. The server returns the HTML plus a content security policy naming the S3 origins the page may load bytes from.
+4. The host renders the HTML in a sandboxed iframe on an origin separate from its own.
+5. The page sends `ui/initialize` to the host over `window.postMessage`, and the host replies with the current theme, display mode, container size, and its own capabilities.
+6. The page sends `ui/notifications/initialized`, and the host pushes the `get_run_report` result into the page.
+7. The page reads the instrument type, instrument ID, and run ID out of that result and renders the matching report.
+8. Every later data fetch is a `tools/call` that the page asks the host to forward to the server.
+
+Steps 5 and 6 happen inside `useApp` from `@modelcontextprotocol/ext-apps`. `web/mcp-apps/run-report/app.tsx` only supplies the callbacks (`ontoolresult`, `ontoolcancelled`, `onerror`).
+
+## How the View fetches data
+
+### Report items — images, PDFs, spectra, and videos
+
+1. The View calls `report_view_items` with the instrument, run, item kind, and a window offset.
+2. The server looks up the run by its instrument ID and run ID, then asks `getReportItemsPage` for one window of matching files.
+3. The server signs a download URL for every file in that window and returns those URLs alongside the file IDs and filenames.
+4. The View stores each URL in an in-memory cache keyed by file ID.
+5. The carousel renders the selected item from that cache without another tool call.
+
+Windows are 50 items by default and 200 at most. The signed URLs deliberately leave out the filename so S3 does not add a `Content-Disposition: attachment` header, which would stop a PDF from rendering inside a nested iframe.
+
+### CSV tables
+
+1. The View calls `report_view_table` with `full: true` the first time it needs a file.
+2. The server streams the CSV out of S3 and parses it, stopping after 50,000 rows.
+3. The server returns the column names, the rows, the number of rows it scanned, and a `truncated` flag that is true when it hit that ceiling.
+4. The View caches the parsed rows and answers every later page request by slicing the cache.
+
+One tool call per file replaces one HTTP request per visible page, so paging through a 20,000-row table does not become 100 round trips.
+
+### JSON artifacts
+
+1. The View calls `report_view_artifact` with a filename suffix such as `_aunty_plate.json`.
+2. The server finds the one active file on that run whose filename ends with the suffix.
+3. The server reads the object from S3, parses the JSON, and returns the parsed value.
+
+Aunty plate data takes a separate branch inside the same tool. The server rebuilds it with `getAuntyPlateData`, which pairs the plate JSON with the file ID of the curves CSV so the View can load the curves as a table later.
+
+### Download URLs for files that never came through a window
+
+`RunReportSection` renders files listed by `get_run_report`, which does not include download URLs. Those components ask the data source to resolve a URL by file ID:
+
+1. The View checks the URL cache for that file ID and returns the cached URL if it is still fresh.
+2. On a miss, the View calls `report_view_items` once for each of the four item kinds with `anchor` set to the file ID and `limit` set to 1.
+3. Whichever call matches puts a freshly signed URL into the cache.
+4. The View reads the cache again and returns the URL, or throws if no kind matched.
+
+The item kind is a required argument and filters the window, so there is no way to ask for one file without naming its kind. Four calls per uncached file is the cost of that.
+
+## One set of components, two data sources
+
+The seven instrument renderers used to call `fetch("/api/v1/…")` directly, which only works inside Next.js. They now take a data source through React context, and each surface supplies its own.
+
+`web/lib/runs/view-data-source.ts` defines the contract:
+
+| Method | What it does |
+| --- | --- |
+| `fetchReportItems` | Returns one window of report items for a kind. |
+| `fetchTable` | Returns a page of parsed CSV rows for a file. |
+| `fetchArtifact` | Returns a parsed JSON artifact by filename suffix. |
+| `resolveFileUrl` | Returns a URL for a file's bytes, possibly asynchronously. |
+| `peekFileUrl` | Returns a URL synchronously if one is already known, so a component can paint during render. |
+
+Two implementations exist:
+
+- `web/lib/runs/rest-report-data-source.ts` backs the web app. `resolveFileUrl` and `peekFileUrl` both return `/api/v1/files/{id}/download`, which 302-redirects the browser to S3, so file bytes still never pass through Vercel.
+- `web/mcp-apps/run-report/mcp-data-source.ts` backs the View. Every method is a tool call through the host, and it keeps the URL and table caches described above.
+
+`peekFileUrl` exists because the MCP source is asynchronous. Calling `resolveFileUrl` during render would allocate a new Promise on every render, and using that Promise as an effect dependency caused a render loop during development. Only the effect in `useResolvedFileUrl`, keyed on the file ID, is allowed to call `resolveFileUrl`.
+
+## What each instrument renders in the View
+
+`InstrumentReport` in `web/mcp-apps/run-report/instrument-report.tsx` picks a renderer from the instrument type:
+
+| Instrument type | Renderer |
+| --- | --- |
+| `gel_doc`, `hina_microscope` | `ImageCarouselReport` |
+| `tape_station` | `PdfCarouselReport` |
+| `dishcam` | `VideoCarouselReport` |
+| `instant_raman` | `RamanReportSection` |
+| `aunty` | `AuntyPlateReport` |
+| `plate_reader` | `PlateMapGrid` / `PlateMapWithIndexSlider` |
+| `generic`, `qpcr`, `epson_v700_scanner`, `fplc` | `RunReportSection` |
+
+The carousel renderers remember which file the user had selected. The View writes the selected file ID to `localStorage` under `data-hub:run-report:{instrumentId}:{runId}`, and reads it back on the next load to anchor the first window on that file.
 
 ## Build
 
@@ -13,16 +126,62 @@ cd web
 npm run mcp-apps:build
 ```
 
+`vite-plugin-singlefile` inlines all JavaScript and CSS into the HTML, so the output is one file with no external requests. It currently measures 1,278,570 bytes, or 345,760 bytes gzipped. Recharts and the shadcn component tree account for most of that.
+
+Tailwind cannot see the shared components from the Vite root on its own, so `web/mcp-apps/run-report.css` names them explicitly:
+
+```css
+@import "../app/globals.css";
+
+@source "../components";
+@source "../hooks";
+@source "../lib";
+@source ".";
+```
+
 The built file is gitignored. Self-hosters and CI must run that step (or `npm run build`) so `resources/read` serves the real View. In development, a missing artifact falls back to a placeholder page and logs a warning. In production, a missing artifact throws.
 
 ## Local development
 
 `make dev` / `next dev` does not rebuild the View on every save. After changing files under `web/mcp-apps/` or shared report components, re-run `npm run mcp-apps:build` (or use a one-off Vite watch if you are iterating on the View alone).
 
-Presigned download URLs last 15 minutes. The View refreshes a cached URL after 80% of that window.
+Browser-based hosts reach `/mcp/v1` from a different origin, so `web/lib/mcp/cors.ts` sends `Access-Control-Allow-Origin: *` on that route and answers preflight requests. The route authenticates with a Bearer token only and never sets `Access-Control-Allow-Credentials`, so a browser will not attach a session cookie to those requests.
+
+`web/proxy.ts` also lets `/api/local-s3` through without a session, because the View loads file bytes from a cross-origin sandbox that has no cookie. That route returns 404 whenever `NODE_ENV` is `production` or `LOCAL_S3_MIRROR` is unset, so it cannot expose anything on a real deploy.
+
+## Content security policy
+
+The host builds the sandbox iframe's policy out of what the server declares on the resource, so the server has to name every origin the View loads bytes from. An origin it leaves out is an image, video, or PDF the View cannot display.
+
+`runReportUiMeta` in `web/lib/mcp/ui-csp.ts` puts the raw-data and archives bucket origins in both `resourceDomains` (images and video) and `frameDomains` (the nested PDF preview), and adds `authBaseURL`, `http://localhost:3000`, and `http://127.0.0.1:3000` outside production. It leaves the S3 hosts out entirely when `LOCAL_S3_MIRROR` is set, because the mirror serves bytes from the app's own origin. `connectDomains` stays empty: every tool call travels through the host over `postMessage`, so the View never issues a cross-origin `fetch`, and the field is declared rather than omitted so that having a `csp` object cannot grant one.
+
+The bucket origin comes from `s3BucketOrigin` in `web/lib/s3.ts`, which sits beside the `S3Client` so that setting `endpoint` or `forcePathStyle` on the client forces an update in the same file. Composing it as a string keeps `runReportUiMeta` synchronous, and that matters: `registerResource` attaches the policy to the `resources/list` entry and the `resources/read` body from the same call, and it cannot await anything before the listing.
+
+## Serving the HTML
+
+`web/lib/mcp/run-report-html.ts` reads the built file from disk on the first request and caches it in module memory. Before serving it, the function replaces the `%%DATA_HUB_ORIGIN%%` placeholder in the page's `<meta name="data-hub-origin">` tag with the deploy's own origin. The View reads that tag to build the "Open in Data Hub" link, which it hands to the host through `openLink` because the sandbox blocks popups.
+
+## Limitations
+
+- **App-only tools stay in `tools/list` for every client.** Hiding tools whose `visibility` excludes `"model"` is the host's job under the spec. `mcp-handler` builds a fresh server for each request and registers tools before `initialize`, so this server cannot vary its tool list per client.
+- **Signed URLs expire after 15 minutes.** The View treats a cached URL as stale after 12 minutes, which is 80% of that window. Nothing schedules a timer, so the refresh happens on the next render rather than on a clock. A `<video preload="none">` that a user first plays more than 15 minutes after load will request an expired URL and fail without retrying.
+- **A file whose URL cannot be resolved shows "Loading…" indefinitely.** `useResolvedFileUrl` sets its state to `null` on failure, and if it was already `null` React skips the re-render, so the effect never runs again. Files still awaiting upload land here, because `getReportItemsPage` excludes rows with no S3 key.
+- **`truncated` is only surfaced for the plate reader.** `fetchAllTableRows` returns the flag, but the Aunty curves dialog, the Raman spectrum viewer, and the colony table all discard it, so a CSV over the 50,000-row scan cap renders as though it were complete.
+- **Production hosts need a second hostname for the sandbox iframe.** That is configured on the host side, not here.
+- **Hosts may prefetch and cache the HTML.** Do not treat a single `resources/read` as the only time the View is fetched.
+
+## Why this design
+
+- **One HTML file with everything inlined.** A page split across separate JavaScript and CSS files would need those origins in `resourceDomains` and would add round trips inside a sandbox the host controls. Inlining trades a larger single response for a page that cannot fail halfway.
+- **Tool calls instead of direct HTTP from the View.** The sandbox has no session cookie and no token, so a `fetch` back to `/api/v1` would be unauthenticated. Routing every request through the host reuses the token the host already holds and keeps `connectDomains` empty.
+- **`report_view_table` returns a whole file at once.** The alternative is one S3 GET per visible page, and the View pages through tables that instrument software writes in long format with tens of thousands of rows. The 50,000-row ceiling bounds the work; see the limitation above about the flag not reaching every caller.
+- **A data source interface rather than props.** A data source is a set of functions, and functions cannot cross the server-to-client boundary as props in the App Router. `RestReportDataSourceProvider` therefore builds the REST source inside a client component instead of receiving it from the server page.
 
 ## Related code
 
 - Tool defs: `web/lib/mcp/tools/report-views.defs.ts`, `web/lib/mcp/tools/runs.defs.ts` (`get_run_report`)
-- Resource + CSP: `web/lib/mcp/resources.ts`, `web/lib/mcp/ui-csp.ts`, `web/lib/mcp/run-report-html.ts`
-- View entry: `web/mcp-apps/run-report/app.tsx`
+- Tool handlers: `web/lib/mcp/tools/report-views.ts`
+- Resource, CSP, and HTML loading: `web/lib/mcp/resources.ts`, `web/lib/mcp/ui-csp.ts`, `web/lib/mcp/run-report-html.ts`, `web/lib/mcp/ui-apps.ts`
+- View entry: `web/mcp-apps/run-report/app.tsx`, `web/mcp-apps/run-report/main.tsx`
+- Host bridge (theme, sizing, link interception): `web/mcp-apps/run-report/host-bridge.ts`
+- Data sources: `web/lib/runs/view-data-source.ts`, `web/lib/runs/rest-report-data-source.ts`, `web/mcp-apps/run-report/mcp-data-source.ts`
diff --git a/web/lib/mcp/resources.ts b/web/lib/mcp/resources.ts
index 3510512a..a9a012e5 100644
--- a/web/lib/mcp/resources.ts
+++ b/web/lib/mcp/resources.ts
@@ -11,7 +11,7 @@ import {
   MCP_APP_MIME_TYPE,
   RUN_REPORT_UI_RESOURCE_URI,
 } from "@/lib/mcp/ui-apps";
-import { runReportUiMeta, runReportUiMetaSnapshot } from "@/lib/mcp/ui-csp";
+import { runReportUiMeta } from "@/lib/mcp/ui-csp";
 import {
   glossaryResource,
   instrumentFilterOptionsResource,
@@ -203,14 +203,13 @@ export function registerResources(server: McpServer) {
     }
   );
 
-  void runReportUiMeta();
   server.registerResource(
     runReportUiResource.name,
     runReportUiResource.uri,
     {
       description: runReportUiResource.description,
       mimeType: runReportUiResource.mimeType,
-      _meta: runReportUiMetaSnapshot(),
+      _meta: runReportUiMeta(),
     },
     async () => ({
       contents: [
@@ -218,7 +217,7 @@ export function registerResources(server: McpServer) {
           uri: RUN_REPORT_UI_RESOURCE_URI,
           mimeType: MCP_APP_MIME_TYPE,
           text: loadRunReportHtml(),
-          _meta: await runReportUiMeta(),
+          _meta: runReportUiMeta(),
         },
       ],
     })
diff --git a/web/lib/mcp/ui-csp.ts b/web/lib/mcp/ui-csp.ts
index ba8625a2..36bc2477 100644
--- a/web/lib/mcp/ui-csp.ts
+++ b/web/lib/mcp/ui-csp.ts
@@ -1,9 +1,6 @@
 import { authBaseURL } from "@/lib/auth";
-import { toAbsoluteDownloadUrl } from "@/lib/mcp/absolute-url";
-import { getPresignedDownloadUrl } from "@/lib/s3";
-
-let cachedDomains: string[] | undefined;
-let inflight: Promise<string[]> | undefined;
+import { s3BucketOrigin } from "@/lib/s3";
+import { getLocalMirrorRoot } from "@/lib/s3-local-mirror";
 
 function localDevOrigins(): string[] {
   if (process.env.NODE_ENV === "production") {
@@ -12,75 +9,42 @@ function localDevOrigins(): string[] {
   return [authBaseURL, "http://localhost:3000", "http://127.0.0.1:3000"];
 }
 
-function cspFromDomains(domains: string[]) {
+function runReportUiCspDomains(): string[] {
+  const origins = new Set<string>();
+  // The local mirror serves file bytes from the app's own origin, which
+  // `localDevOrigins` already covers, so the S3 hosts are dead weight there.
+  if (!getLocalMirrorRoot()) {
+    for (const bucket of [
+      process.env.S3_RAW_DATA_BUCKET,
+      process.env.S3_ARCHIVES_BUCKET,
+    ]) {
+      if (bucket) {
+        origins.add(s3BucketOrigin(bucket));
+      }
+    }
+  }
+  for (const origin of localDevOrigins()) {
+    origins.add(origin);
+  }
+  return [...origins];
+}
+
+// Synchronous on purpose. `registerResource` needs this for `resources/list`
+// before it can await anything, so an async source would advertise an empty
+// policy on the first request to a cold instance and the real one afterwards.
+export function runReportUiMeta() {
+  const domains = runReportUiCspDomains();
   return {
     ui: {
       csp: {
         resourceDomains: domains,
         frameDomains: domains,
-        // The View loads images, video, and nested PDF frames from these
-        // origins. Tool calls go through the host, so `connect-src` is
-        // unused — keep it empty so a declared `csp` key does not grant
-        // a cross-origin `fetch`.
+        // Tool calls travel through the host, so the View never issues a
+        // cross-origin `fetch`. Declared and empty so that having a `csp`
+        // object at all cannot grant one.
         connectDomains: [] as string[],
       },
       prefersBorder: true,
     },
   };
 }
-
-async function probeBucketOrigin(bucket: string): Promise<string | undefined> {
-  try {
-    // Sign a throwaway key so the origin matches whatever style
-    // `getPresignedDownloadUrl` actually emits (virtual-hosted, path-style,
-    // custom endpoint, or the local-mirror path).
-    const url = await getPresignedDownloadUrl(bucket, "__mcp-app-csp-probe__");
-    return new URL(toAbsoluteDownloadUrl(url)).origin;
-  } catch {
-    return;
-  }
-}
-
-export function runReportUiCspDomains(): Promise<string[]> {
-  if (cachedDomains) {
-    return Promise.resolve(cachedDomains);
-  }
-  if (!inflight) {
-    inflight = (async () => {
-      const origins = new Set<string>();
-      for (const bucket of [
-        process.env.S3_RAW_DATA_BUCKET,
-        process.env.S3_ARCHIVES_BUCKET,
-      ]) {
-        if (!bucket) {
-          continue;
-        }
-        const origin = await probeBucketOrigin(bucket);
-        if (origin) {
-          origins.add(origin);
-        }
-      }
-      for (const origin of localDevOrigins()) {
-        origins.add(origin);
-      }
-      const list = [...origins];
-      cachedDomains = list;
-      return list;
-    })();
-  }
-  return inflight;
-}
-
-export function resetRunReportUiCspCache(): void {
-  cachedDomains = undefined;
-  inflight = undefined;
-}
-
-export function runReportUiMetaSnapshot() {
-  return cspFromDomains(cachedDomains ?? localDevOrigins());
-}
-
-export async function runReportUiMeta() {
-  const domains = await runReportUiCspDomains();
-  return cspFromDomains(domains);
-}
diff --git a/web/lib/s3.ts b/web/lib/s3.ts
index 5717de19..58abdab5 100644
--- a/web/lib/s3.ts
+++ b/web/lib/s3.ts
@@ -27,16 +27,29 @@ import {
 export const PRESIGNED_DOWNLOAD_URL_EXPIRY_SECONDS = 15 * 60;
 const DEFAULT_UPLOAD_EXPIRY_SECONDS = 60 * 60; // 1 hour — generous for large lab files over slow networks
 
+function s3Region(): string {
+  return process.env.AWS_REGION ?? "us-west-1";
+}
+
 // Singleton client — reused across requests within the same function instance.
 // On Vercel, AWS_ROLE_ARN triggers OIDC federation for short-lived credentials.
 // Locally / in tests, the SDK falls back to the default credential chain.
 const s3 = new S3Client({
-  region: process.env.AWS_REGION ?? "us-west-1",
+  region: s3Region(),
   credentials: process.env.AWS_ROLE_ARN
     ? awsCredentialsProvider({ roleArn: process.env.AWS_ROLE_ARN })
     : undefined,
 });
 
+// Origin `getPresignedDownloadUrl` signs against, for callers that must name
+// it up front — the MCP Apps content security policy has to list every origin
+// the View loads bytes from. Kept beside the client so adding `endpoint` or
+// `forcePathStyle` above forces an update here. A bucket name containing dots
+// would get path style from the SDK instead; Data Hub's are dash-separated.
+export function s3BucketOrigin(bucket: string): string {
+  return `https://${bucket}.s3.${s3Region()}.amazonaws.com`;
+}
+
 export function getS3RawDataBucket(): string {
   const bucket = process.env.S3_RAW_DATA_BUCKET;
   if (!bucket) {
diff --git a/web/tests/mcp/mcp-protocol.test.ts b/web/tests/mcp/mcp-protocol.test.ts
index e46112cd..4675c171 100644
--- a/web/tests/mcp/mcp-protocol.test.ts
+++ b/web/tests/mcp/mcp-protocol.test.ts
@@ -611,6 +611,8 @@ vi.mock("@/lib/s3", () => ({
   // `undefined`. Tests that read `expiresInSeconds` off a tool result
   // assert `> 0`, so any positive number works here.
   PRESIGNED_DOWNLOAD_URL_EXPIRY_SECONDS: 15 * 60,
+  s3BucketOrigin: (bucket: string) =>
+    `https://${bucket}.s3.us-west-1.amazonaws.com`,
 }));
 
 // ---------------------------------------------------------------------------
diff --git a/web/tests/unit/mcp-ui-csp.test.ts b/web/tests/unit/mcp-ui-csp.test.ts
index 33e7214a..e95e2746 100644
--- a/web/tests/unit/mcp-ui-csp.test.ts
+++ b/web/tests/unit/mcp-ui-csp.test.ts
@@ -4,44 +4,58 @@ vi.mock("@/lib/auth", () => ({
   authBaseURL: "http://localhost:3000",
 }));
 
-vi.mock("@/lib/s3", () => ({
-  getPresignedDownloadUrl: vi.fn(),
-}));
-
-import {
-  resetRunReportUiCspCache,
-  runReportUiMeta,
-  runReportUiMetaSnapshot,
-} from "@/lib/mcp/ui-csp";
-import { getPresignedDownloadUrl } from "@/lib/s3";
+import { runReportUiMeta } from "@/lib/mcp/ui-csp";
 
 describe("runReportUiMeta", () => {
   afterEach(() => {
-    resetRunReportUiCspCache();
     vi.unstubAllEnvs();
-    vi.mocked(getPresignedDownloadUrl).mockReset();
   });
 
-  it("derives the S3 origin from a signed URL and leaves connectDomains empty", async () => {
-    vi.stubEnv("S3_RAW_DATA_BUCKET", "dotted.bucket.name");
-    vi.mocked(getPresignedDownloadUrl).mockResolvedValue(
-      "https://s3.us-west-1.amazonaws.com/dotted.bucket.name/__mcp-app-csp-probe__"
-    );
+  it("names both bucket origins and leaves connectDomains empty", () => {
+    vi.stubEnv("NODE_ENV", "production");
+    vi.stubEnv("LOCAL_S3_MIRROR", "");
+    vi.stubEnv("AWS_REGION", "us-west-1");
+    vi.stubEnv("S3_RAW_DATA_BUCKET", "raw-bucket");
+    vi.stubEnv("S3_ARCHIVES_BUCKET", "archives-bucket");
 
-    const meta = await runReportUiMeta();
-    expect(meta.ui.csp.resourceDomains).toEqual(
-      expect.arrayContaining(["https://s3.us-west-1.amazonaws.com"])
-    );
+    const meta = runReportUiMeta();
+    expect(meta.ui.csp.resourceDomains).toEqual([
+      "https://raw-bucket.s3.us-west-1.amazonaws.com",
+      "https://archives-bucket.s3.us-west-1.amazonaws.com",
+    ]);
     expect(meta.ui.csp.frameDomains).toEqual(meta.ui.csp.resourceDomains);
     expect(meta.ui.csp.connectDomains).toEqual([]);
     expect(meta.ui.prefersBorder).toBe(true);
   });
 
-  it("snapshots local origins before the probe finishes", () => {
-    const snapshot = runReportUiMetaSnapshot();
-    expect(snapshot.ui.csp.resourceDomains).toEqual(
-      expect.arrayContaining(["http://localhost:3000"])
+  it("adds local origins outside production", () => {
+    vi.stubEnv("NODE_ENV", "development");
+    vi.stubEnv("LOCAL_S3_MIRROR", "");
+
+    expect(runReportUiMeta().ui.csp.resourceDomains).toEqual(
+      expect.arrayContaining(["http://localhost:3000", "http://127.0.0.1:3000"])
+    );
+  });
+
+  it("skips the S3 hosts when the local mirror is serving bytes", () => {
+    vi.stubEnv("NODE_ENV", "development");
+    vi.stubEnv("LOCAL_S3_MIRROR", "../lambda/.local-s3");
+    vi.stubEnv("S3_RAW_DATA_BUCKET", "raw-bucket");
+
+    const domains = runReportUiMeta().ui.csp.resourceDomains;
+    expect(domains).not.toContain(
+      "https://raw-bucket.s3.us-west-1.amazonaws.com"
     );
-    expect(snapshot.ui.csp.connectDomains).toEqual([]);
+    expect(domains).toContain("http://localhost:3000");
+  });
+
+  // The listing and the body are built from the same synchronous call, so a
+  // cold instance cannot advertise one policy and then serve another.
+  it("returns the same policy on every call", () => {
+    vi.stubEnv("NODE_ENV", "production");
+    vi.stubEnv("LOCAL_S3_MIRROR", "");
+    vi.stubEnv("S3_RAW_DATA_BUCKET", "raw-bucket");
+
+    expect(runReportUiMeta()).toEqual(runReportUiMeta());
   });
 });

From 8a8a3520c2c9df925c68a60e6e608e3938ba72ce Mon Sep 17 00:00:00 2001
From: Wasim Amiri <7220175+wasimxyz@users.noreply.github.com>
Date: Sat, 29 Aug 2026 20:37:03 -0700
Subject: [PATCH 4/6] Read report file bytes from S3 in the view, not through
 the server.

`report_view_table` and `report_view_artifact` streamed CSVs and JSON
artifacts into the function, parsed them, and returned rows. The web app has
always read the same files straight from S3 through the download redirect, so
one `report_view_file_url` now replaces both and returns a signed URL that the
view fetches and parses in the iframe. That removes the 50,000-row scan cap,
the `truncated` flag three of four callers discarded, and the double
serialization into `structuredContent` and pretty-printed text. Resolving an
uncached file id drops from four tool calls to one. Tools go from 35 to 34.

The content security policy listed only the raw and archives buckets, but
processed artifacts sit in their own bucket and are most of what the report
renders, so images, video, and CSVs would have been blocked in production. It
now lists raw plus processed through a new `S3_PROCESSED_BUCKET`, drops
archives, and repeats those origins in `connectDomains`. Both buckets move to
a `*` GET CORS rule because the sandbox origin is chosen by the host and
cannot be allowlisted ahead of time.

Also trims the comment blocks in `template.yaml` to two lines each.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 developer-docs/first-time-deployment.md       |   2 +-
 developer-docs/getting-started.md             |   1 +
 developer-docs/mcp-apps.md                    |  57 +++--
 infra/template.yaml                           | 102 +++------
 .../runs/aunty/aunty-well-dialog.tsx          |   3 +-
 web/components/runs/colony-data-table.tsx     |   3 +-
 web/components/runs/raman-spectrum-viewer.tsx |   3 +-
 web/lib/mcp/tools/report-views.defs.ts        |  62 ++---
 web/lib/mcp/tools/report-views.output.ts      |  13 +-
 web/lib/mcp/tools/report-views.ts             | 139 ++----------
 web/lib/mcp/ui-apps.ts                        |   8 -
 web/lib/mcp/ui-csp.ts                         |  15 +-
 web/lib/runs/parse-csv-page.ts                |  60 -----
 web/lib/runs/report-table.ts                  |  47 ----
 web/lib/runs/rest-report-data-source.ts       |  66 +++---
 web/lib/runs/view-data-source.ts              |  25 +-
 web/mcp-apps/run-report/instrument-report.tsx |  54 ++---
 web/mcp-apps/run-report/mcp-data-source.ts    | 146 +++++-------
 web/tests/integration/mcp.test.ts             |   2 +-
 web/tests/mcp/mcp-catalog.test.ts             |   2 +-
 web/tests/mcp/mcp-protocol.test.ts            |  34 ++-
 web/tests/unit/mcp-data-source.test.ts        | 145 +++++++-----
 web/tests/unit/mcp-parse-csv-page.test.ts     |  38 ----
 web/tests/unit/mcp-report-views.test.ts       | 214 +++++++-----------
 web/tests/unit/mcp-ui-csp.test.ts             |  30 ++-
 .../unit/rest-report-data-source.test.ts      |  84 ++-----
 26 files changed, 473 insertions(+), 882 deletions(-)
 delete mode 100644 web/lib/runs/parse-csv-page.ts
 delete mode 100644 web/lib/runs/report-table.ts
 delete mode 100644 web/tests/unit/mcp-parse-csv-page.test.ts

diff --git a/developer-docs/first-time-deployment.md b/developer-docs/first-time-deployment.md
index 0ff112c2..c76cf493 100644
--- a/developer-docs/first-time-deployment.md
+++ b/developer-docs/first-time-deployment.md
@@ -196,7 +196,7 @@ The AWS stack you just deployed exposes the outputs the web app needs to reach i
 | `AWS_ROLE_ARN` | `WebAppRoleArn` stack output | Lets the web app generate presigned S3 URLs and SigV4-sign Lambda Function URL invocations via OIDC federation. |
 | `LAMBDA_FUNCTION_URL` | `DataHubFunctionUrl` stack output | The Lambda Function URL for manual reprocessing and archive builds. |
 
-The S3 bucket names default to `arcadia-data-hub-raw-<env>` and `arcadia-data-hub-archives-<env>`; override `S3_RAW_DATA_BUCKET` and `S3_ARCHIVES_BUCKET` in Vercel only if your stack uses different names. Redeploy the web app (or push a commit) so it picks up the new variables.
+The S3 bucket names default to `arcadia-data-hub-raw-<env>` and `arcadia-data-hub-archives-<env>`; override `S3_RAW_DATA_BUCKET` and `S3_ARCHIVES_BUCKET` in Vercel only if your stack uses different names. Also set `S3_PROCESSED_BUCKET` to `arcadia-data-hub-processed-<env>`: presigned download URLs come from each file row's own bucket, so nothing else needs it, but the MCP Apps run report has to name every origin in its content security policy and processed artifacts are most of what it renders. Redeploy the web app (or push a commit) so it picks up the new variables.
 
 > **Note:** Slack channel notifications are configured after deploy, not via an environment variable. A workspace admin pastes the incoming webhook URL under Settings > Notifications > Slack channel (stored in the `slack_channel_config` table). Personal Slack DMs use the optional `SLACK_BOT_TOKEN` / `SLACK_CLIENT_ID` / `SLACK_CLIENT_SECRET` variables instead — see [Environment variables](getting-started.md#environment-variables).
 
diff --git a/developer-docs/getting-started.md b/developer-docs/getting-started.md
index cc54a8b7..951b8c14 100644
--- a/developer-docs/getting-started.md
+++ b/developer-docs/getting-started.md
@@ -54,6 +54,7 @@ vercel env pull
 | `AWS_REGION` | No | AWS region for S3 presigned URLs and Lambda Function URL SigV4 signing (defaults to `us-west-1`) |
 | `AWS_ROLE_ARN` | No | IAM role ARN for Vercel OIDC federation. Used to presign S3 URLs and SigV4-sign Lambda Function URL invocations (only needed on Vercel) |
 | `S3_RAW_DATA_BUCKET` | No | S3 bucket for raw data uploads (defaults to `arcadia-data-hub-raw-staging`) |
+| `S3_PROCESSED_BUCKET` | No | S3 bucket the Lambda writes processed artifacts to. Only read to build the MCP Apps content security policy — download URLs come from `files.s3_bucket`. Leave it unset and the run report View cannot load processed images, video, or CSVs. See [MCP Apps](mcp-apps.md#content-security-policy) |
 | `LAMBDA_FUNCTION_URL` | No | Lambda Function URL. Required for file reprocessing and run-archive downloads. |
 | `STALLED_PROCESSING_AFTER_MINUTES` | No | Minutes a file may stay in `processing` before it is treated as stalled and becomes reprocessable (defaults to 20). Empty, zero, negative, or non-numeric values keep the default. |
 | `CRON_SECRET` | No | Shared secret for Vercel Cron jobs. The upload-queue sweep (`web/vercel.json`) rejects invocations without it |
diff --git a/developer-docs/mcp-apps.md b/developer-docs/mcp-apps.md
index 3a0c4a07..aada421e 100644
--- a/developer-docs/mcp-apps.md
+++ b/developer-docs/mcp-apps.md
@@ -10,9 +10,9 @@ The same React components render both surfaces. The web app feeds them over REST
 
 - `ui://data-hub/run-report` is a resource whose body is one self-contained HTML file, served with the media type `text/html;profile=mcp-app`.
 - `get_run_report` carries a pointer to that resource, so a host knows to render the page when the model calls the tool.
-- `report_view_items`, `report_view_table`, and `report_view_artifact` are three read-only tools the View calls to fetch its own data.
+- `report_view_items` and `report_view_file_url` are two read-only tools the View calls to locate its own data. Both return short-lived S3 URLs; neither returns file contents.
 
-Adding those three took the tool count from 32 to 35. Two tests pin that number so the change shows up in review: `web/tests/mcp/mcp-catalog.test.ts` and `web/tests/integration/mcp.test.ts`.
+Adding those two took the tool count from 32 to 34. Two tests pin that number so the change shows up in review: `web/tests/mcp/mcp-catalog.test.ts` and `web/tests/integration/mcp.test.ts`.
 
 ### Tool metadata
 
@@ -25,7 +25,7 @@ Adding those three took the tool count from 32 to 35. Two tests pin that number
 }
 ```
 
-The nested `ui.resourceUri` is what the current spec asks for. The flat `ui/resourceUri` key is deprecated and is kept because some hosts still read it. `visibility` is `["model", "app"]` on `get_run_report` and `["app"]` on the three view tools.
+The nested `ui.resourceUri` is what the current spec asks for. The flat `ui/resourceUri` key is deprecated and is kept because some hosts still read it. `visibility` is `["model", "app"]` on `get_run_report` and `["app"]` on the two view tools.
 
 ## How a host renders a run report
 
@@ -42,43 +42,38 @@ Steps 5 and 6 happen inside `useApp` from `@modelcontextprotocol/ext-apps`. `web
 
 ## How the View fetches data
 
+No file bytes pass through the server. Every tool returns a presigned S3 URL and the View reads the object itself, the same way the web app has always read them through the `/api/v1/files/:id/download` redirect. The server only ever runs the permission check and signs.
+
 ### Report items — images, PDFs, spectra, and videos
 
 1. The View calls `report_view_items` with the instrument, run, item kind, and a window offset.
 2. The server looks up the run by its instrument ID and run ID, then asks `getReportItemsPage` for one window of matching files.
 3. The server signs a download URL for every file in that window and returns those URLs alongside the file IDs and filenames.
 4. The View stores each URL in an in-memory cache keyed by file ID.
-5. The carousel renders the selected item from that cache without another tool call.
+5. The carousel points an `<img>`, `<iframe>`, or `<video>` straight at the cached URL.
 
 Windows are 50 items by default and 200 at most. The signed URLs deliberately leave out the filename so S3 does not add a `Content-Disposition: attachment` header, which would stop a PDF from rendering inside a nested iframe.
 
 ### CSV tables
 
-1. The View calls `report_view_table` with `full: true` the first time it needs a file.
-2. The server streams the CSV out of S3 and parses it, stopping after 50,000 rows.
-3. The server returns the column names, the rows, the number of rows it scanned, and a `truncated` flag that is true when it hit that ceiling.
-4. The View caches the parsed rows and answers every later page request by slicing the cache.
+1. A component asks the data source for every row of a file, by file ID.
+2. The View resolves a URL for that ID, from cache or with one `report_view_file_url` call.
+3. The View `fetch`es the URL, so the bytes go from S3 to the iframe without touching the server.
+4. The View parses the text with `csv-parse` and caches the rows under the file ID.
 
-One tool call per file replaces one HTTP request per visible page, so paging through a 20,000-row table does not become 100 round trips.
+This is the same code path the web app uses, so there is no row ceiling and no truncation to report. Raman spectra, Aunty curves, the colony table, and the plate-reader map all go through it.
 
 ### JSON artifacts
 
-1. The View calls `report_view_artifact` with a filename suffix such as `_aunty_plate.json`.
-2. The server finds the one active file on that run whose filename ends with the suffix.
-3. The server reads the object from S3, parses the JSON, and returns the parsed value.
+1. The View calls `report_view_file_url` with a filename suffix such as `_aunty_plate.json`.
+2. The server finds the one active file on that run whose filename ends with the suffix and returns its ID, filename, and a signed URL.
+3. The View `fetch`es the URL and parses the JSON.
 
-Aunty plate data takes a separate branch inside the same tool. The server rebuilds it with `getAuntyPlateData`, which pairs the plate JSON with the file ID of the curves CSV so the View can load the curves as a table later.
+Aunty needs two of these. `loadAuntyPlate` resolves `_aunty_plate.json`, reads it, and normalizes it with the shared `parseAuntyPlateJson`; then it resolves `_aunty_curves.csv` purely for the file ID, which it hands to the plate report so the well dialog can load curves as a table. A run with no curves file (an isothermal export) resolves to `null` and the dialog renders without a chart.
 
 ### Download URLs for files that never came through a window
 
-`RunReportSection` renders files listed by `get_run_report`, which does not include download URLs. Those components ask the data source to resolve a URL by file ID:
-
-1. The View checks the URL cache for that file ID and returns the cached URL if it is still fresh.
-2. On a miss, the View calls `report_view_items` once for each of the four item kinds with `anchor` set to the file ID and `limit` set to 1.
-3. Whichever call matches puts a freshly signed URL into the cache.
-4. The View reads the cache again and returns the URL, or throws if no kind matched.
-
-The item kind is a required argument and filters the window, so there is no way to ask for one file without naming its kind. Four calls per uncached file is the cost of that.
+`RunReportSection` renders files listed by `get_run_report`, which does not include download URLs. Those components ask the data source to resolve a URL by file ID, and `report_view_file_url` answers it in one call.
 
 ## One set of components, two data sources
 
@@ -89,15 +84,17 @@ The seven instrument renderers used to call `fetch("/api/v1/…")` directly, whi
 | Method | What it does |
 | --- | --- |
 | `fetchReportItems` | Returns one window of report items for a kind. |
-| `fetchTable` | Returns a page of parsed CSV rows for a file. |
-| `fetchArtifact` | Returns a parsed JSON artifact by filename suffix. |
+| `fetchTableRows` | Returns every parsed row of a CSV, cached per file ID. |
 | `resolveFileUrl` | Returns a URL for a file's bytes, possibly asynchronously. |
 | `peekFileUrl` | Returns a URL synchronously if one is already known, so a component can paint during render. |
+| `resolveFileBySuffix` | Finds one file by filename suffix. View only. |
 
 Two implementations exist:
 
-- `web/lib/runs/rest-report-data-source.ts` backs the web app. `resolveFileUrl` and `peekFileUrl` both return `/api/v1/files/{id}/download`, which 302-redirects the browser to S3, so file bytes still never pass through Vercel.
-- `web/mcp-apps/run-report/mcp-data-source.ts` backs the View. Every method is a tool call through the host, and it keeps the URL and table caches described above.
+- `web/lib/runs/rest-report-data-source.ts` backs the web app. `resolveFileUrl` and `peekFileUrl` both return `/api/v1/files/{id}/download`, which 302-redirects the browser to S3. It does not implement `resolveFileBySuffix`, because the web app resolves artifacts on the server and passes them into the page as props.
+- `web/mcp-apps/run-report/mcp-data-source.ts` backs the View. It calls tools to locate files and `fetch`es the bytes itself, keeping the same URL and row caches.
+
+`fetchTableRows` returns the whole file rather than a page because every caller charts or indexes all of it, and both sources cache per file ID, so paging would only add round trips.
 
 `peekFileUrl` exists because the MCP source is asynchronous. Calling `resolveFileUrl` during render would allocate a new Promise on every render, and using that Promise as an effect dependency caused a render loop during development. Only the effect in `useResolvedFileUrl`, keyed on the file ID, is allowed to call `resolveFileUrl`.
 
@@ -126,7 +123,7 @@ cd web
 npm run mcp-apps:build
 ```
 
-`vite-plugin-singlefile` inlines all JavaScript and CSS into the HTML, so the output is one file with no external requests. It currently measures 1,278,570 bytes, or 345,760 bytes gzipped. Recharts and the shadcn component tree account for most of that.
+`vite-plugin-singlefile` inlines all JavaScript and CSS into the HTML, so the output is one file with no external requests. It currently measures 1,307,852 bytes, or 352,722 bytes gzipped. Recharts and the shadcn component tree account for most of that.
 
 Tailwind cannot see the shared components from the Vite root on its own, so `web/mcp-apps/run-report.css` names them explicitly:
 
@@ -153,7 +150,9 @@ Browser-based hosts reach `/mcp/v1` from a different origin, so `web/lib/mcp/cor
 
 The host builds the sandbox iframe's policy out of what the server declares on the resource, so the server has to name every origin the View loads bytes from. An origin it leaves out is an image, video, or PDF the View cannot display.
 
-`runReportUiMeta` in `web/lib/mcp/ui-csp.ts` puts the raw-data and archives bucket origins in both `resourceDomains` (images and video) and `frameDomains` (the nested PDF preview), and adds `authBaseURL`, `http://localhost:3000`, and `http://127.0.0.1:3000` outside production. It leaves the S3 hosts out entirely when `LOCAL_S3_MIRROR` is set, because the mirror serves bytes from the app's own origin. `connectDomains` stays empty: every tool call travels through the host over `postMessage`, so the View never issues a cross-origin `fetch`, and the field is declared rather than omitted so that having a `csp` object cannot grant one.
+`runReportUiMeta` in `web/lib/mcp/ui-csp.ts` puts the same origin list in all three fields: `resourceDomains` for images and video, `frameDomains` for the nested PDF preview, and `connectDomains` for the `fetch` calls that read CSV and JSON bodies. The list is the raw-data and processed bucket origins, plus `authBaseURL`, `http://localhost:3000`, and `http://127.0.0.1:3000` outside production. It drops the S3 hosts entirely when `LOCAL_S3_MIRROR` is set, because the mirror serves bytes from the app's own origin.
+
+Both buckets matter: a run's files live in the raw bucket or the processed one depending on the row's `s3_bucket`, and processed artifacts are most of what the report renders. That is why the deploy needs `S3_PROCESSED_BUCKET` set even though download URLs never read it. Archives are zips the View never renders, so they stay out. The `fetch` calls also need bucket-side CORS, which `infra/template.yaml` grants with a `*` GET rule — the sandbox origin is chosen by the host and cannot be allowlisted ahead of time.
 
 The bucket origin comes from `s3BucketOrigin` in `web/lib/s3.ts`, which sits beside the `S3Client` so that setting `endpoint` or `forcePathStyle` on the client forces an update in the same file. Composing it as a string keeps `runReportUiMeta` synchronous, and that matters: `registerResource` attaches the policy to the `resources/list` entry and the `resources/read` body from the same call, and it cannot await anything before the listing.
 
@@ -166,15 +165,13 @@ The bucket origin comes from `s3BucketOrigin` in `web/lib/s3.ts`, which sits bes
 - **App-only tools stay in `tools/list` for every client.** Hiding tools whose `visibility` excludes `"model"` is the host's job under the spec. `mcp-handler` builds a fresh server for each request and registers tools before `initialize`, so this server cannot vary its tool list per client.
 - **Signed URLs expire after 15 minutes.** The View treats a cached URL as stale after 12 minutes, which is 80% of that window. Nothing schedules a timer, so the refresh happens on the next render rather than on a clock. A `<video preload="none">` that a user first plays more than 15 minutes after load will request an expired URL and fail without retrying.
 - **A file whose URL cannot be resolved shows "Loading…" indefinitely.** `useResolvedFileUrl` sets its state to `null` on failure, and if it was already `null` React skips the re-render, so the effect never runs again. Files still awaiting upload land here, because `getReportItemsPage` excludes rows with no S3 key.
-- **`truncated` is only surfaced for the plate reader.** `fetchAllTableRows` returns the flag, but the Aunty curves dialog, the Raman spectrum viewer, and the colony table all discard it, so a CSV over the 50,000-row scan cap renders as though it were complete.
 - **Production hosts need a second hostname for the sandbox iframe.** That is configured on the host side, not here.
 - **Hosts may prefetch and cache the HTML.** Do not treat a single `resources/read` as the only time the View is fetched.
 
 ## Why this design
 
 - **One HTML file with everything inlined.** A page split across separate JavaScript and CSS files would need those origins in `resourceDomains` and would add round trips inside a sandbox the host controls. Inlining trades a larger single response for a page that cannot fail halfway.
-- **Tool calls instead of direct HTTP from the View.** The sandbox has no session cookie and no token, so a `fetch` back to `/api/v1` would be unauthenticated. Routing every request through the host reuses the token the host already holds and keeps `connectDomains` empty.
-- **`report_view_table` returns a whole file at once.** The alternative is one S3 GET per visible page, and the View pages through tables that instrument software writes in long format with tens of thousands of rows. The 50,000-row ceiling bounds the work; see the limitation above about the flag not reaching every caller.
+- **Tools return URLs, never file contents.** The sandbox has no session cookie and no token, so a `fetch` back to `/api/v1` would be unauthenticated — the permission check has to happen in a tool call the host authenticates. Signing a URL there and letting the iframe read S3 directly keeps that check while leaving the bytes off the server. Returning parsed rows instead would put an unbounded CSV through the function twice, once as `structuredContent` and once as pretty-printed text, and would cost Fast Origin Transfer the web app has never paid.
 - **A data source interface rather than props.** A data source is a set of functions, and functions cannot cross the server-to-client boundary as props in the App Router. `RestReportDataSourceProvider` therefore builds the REST source inside a client component instead of receiving it from the server page.
 
 ## Related code
diff --git a/infra/template.yaml b/infra/template.yaml
index ed96301d..795aef0c 100644
--- a/infra/template.yaml
+++ b/infra/template.yaml
@@ -42,10 +42,8 @@ Parameters:
 
 Globals:
   Function:
-    # Large files (e.g. 3-4 GB Hina microscope ND2s) force us near Lambda's
-    # hard limits: 10 GB RAM to hold the decoded image array, 900 s to
-    # download + process, and 10 GB of /tmp (set per-function below) to
-    # land the raw file plus the generated JPG.
+    # Sized for 3-4 GB Hina microscope ND2s: RAM holds the decoded image and
+    # 900 s covers download plus processing. /tmp is set per function below.
     Timeout: 900
     MemorySize: 10240
 
@@ -61,26 +59,18 @@ Resources:
       BucketName: !Sub "arcadia-data-hub-raw-${Environment}"
       VersioningConfiguration:
         Status: Enabled
-      # Block Public Access is left to the S3 account default (all on) rather
-      # than pinned here: the CI deploy role can't call
-      # `s3:PutBucketPublicAccessBlock`, so managing it in-stack breaks
-      # automated deploys. Nothing here is ever public — access is via
-      # presigned URLs.
-      # Allow the web app to fetch raw files from the browser via the
-      # `/api/v1/files/:id/download` 302-redirect to a presigned S3 URL.
-      # Image/PDF previews bypass CORS via `<img>`/`<iframe>`, but client-side
-      # `fetch()` (used e.g. for InstantRaman spectrum CSVs) requires the
-      # origin to be allowlisted so the browser exposes the response body.
+      # Block Public Access follows the S3 account default: the CI deploy role
+      # can't call `s3:PutBucketPublicAccessBlock`, so pinning it breaks deploys.
+
+      # Browsers `fetch()` CSVs here, and the MCP Apps sandbox origin is chosen
+      # by the host, so `*`. Objects stay private behind presigned URLs.
       CorsConfiguration:
         CorsRules:
           - AllowedMethods:
               - GET
               - HEAD
-            # Modify this to include your web app domain.
             AllowedOrigins:
-              - "https://datahub.arcadiascience.com"
-              - "https://*.vercel.app"
-              - "http://localhost:3000"
+              - "*"
             AllowedHeaders:
               - "*"
             ExposedHeaders:
@@ -88,10 +78,8 @@ Resources:
               - Content-Length
             MaxAge: 3600
       NotificationConfiguration:
-        # Catch-all: the Lambda handler resolves instrument_type via the API
-        # and applies per-processor filename gates. Deploy the type-dispatch
-        # handler before (or with) this notification change — an older
-        # ID-dispatched handler would process every ObjectCreated event.
+        # Catch-all: the handler resolves instrument_type itself. Deploy the
+        # type-dispatch handler first or an older one processes every event.
         LambdaConfigurations:
           - Event: s3:ObjectCreated:*
             Function: !GetAtt DataHubFunction.Arn
@@ -107,19 +95,15 @@ Resources:
       BucketName: !Sub "arcadia-data-hub-processed-${Environment}"
       VersioningConfiguration:
         Status: Enabled
-      # See RawDataBucket — BPA left to the S3 account default so CI can deploy.
-      # See RawDataBucket for the CORS rationale — both buckets back the same
-      # `/api/v1/files/:id/download` endpoint so they need parity.
+      # See RawDataBucket for the Block Public Access and CORS rationale. This
+      # bucket holds processed artifacts, most of what the run report renders.
       CorsConfiguration:
         CorsRules:
           - AllowedMethods:
               - GET
               - HEAD
-            # Modify this to include your web app domain.
             AllowedOrigins:
-              - "https://datahub.arcadiascience.com"
-              - "https://*.vercel.app"
-              - "http://localhost:3000"
+              - "*"
             AllowedHeaders:
               - "*"
             ExposedHeaders:
@@ -130,11 +114,8 @@ Resources:
         - Key: project
           Value: arcadia-data-hub
 
-  # Cache bucket for run-archive zips built by the Lambda. Objects expire
-  # automatically so the bucket stays cheap; users (or the web app) can always
-  # rebuild on demand. Public access is blocked — the web app issues short-lived
-  # presigned URLs and 302-redirects browsers directly to S3, bypassing Vercel's
-  # Fast Origin Transfer entirely.
+  # Cache for run-archive zips built by the Lambda. Objects expire after a week
+  # and rebuild on demand; browsers are 302'd to S3, never served through Vercel.
   ArchivesBucket:
     Type: AWS::S3::Bucket
     DeletionPolicy: Retain
@@ -160,10 +141,8 @@ Resources:
           Value: arcadia-data-hub
 
   # ---- S3 bucket policies: deny object writes from unapproved principals ----
-  # The account grants all users full S3 access, so the identity policies above
-  # can't actually stop writes — only an explicit Deny (which beats every Allow)
-  # can. Each bucket exempts just its legitimate writer, plus root as break-glass.
-  # `s3:PutBucketPolicy` is intentionally not denied, to avoid self-lockout.
+  # The account grants everyone full S3 access, so only an explicit Deny stops
+  # writes. Each bucket exempts its writer; PutBucketPolicy stays allowed.
 
   RawDataBucketPolicy:
     Type: AWS::S3::BucketPolicy
@@ -251,9 +230,8 @@ Resources:
         Size: 10240
       Role: !GetAtt LambdaExecutionRole.Arn
       FunctionUrlConfig:
-        # IAM auth: callers (the Vercel web app) must SigV4-sign requests
-        # with credentials that hold lambda:InvokeFunctionUrl on this
-        # function ARN. Replaces the previous shared-bearer-token scheme.
+        # Callers must SigV4-sign with credentials holding
+        # lambda:InvokeFunctionUrl on this function ARN.
         AuthType: AWS_IAM
       Environment:
         Variables:
@@ -264,8 +242,7 @@ Resources:
           DATA_HUB_API_KEY: !Ref DataHubApiKey
 
   # ---- S3 → Lambda event wiring ----
-  # Defined as explicit resources rather than SAM Events to avoid the circular
-  # dependency that occurs when the bucket and function are in the same template.
+  # Explicit resources, not SAM Events: a same-template bucket and function cycle.
 
   S3InvokeLambdaPermission:
     Type: AWS::Lambda::Permission
@@ -311,10 +288,8 @@ Resources:
                 Resource:
                   - !Sub "arn:aws:s3:::arcadia-data-hub-processed-${Environment}"
                   - !Sub "arn:aws:s3:::arcadia-data-hub-processed-${Environment}/*"
-              # Lambda is the only writer for the archives bucket: it builds
-              # run zips via S3 multipart uploads streamed directly out of the
-              # raw bucket. AbortMultipartUpload is required so failed builds
-              # don't leak storage.
+              # Lambda is the only archives writer. AbortMultipartUpload keeps
+              # failed builds from leaking storage.
               - Effect: Allow
                 Action:
                   - s3:PutObject
@@ -326,11 +301,8 @@ Resources:
                   - !Sub "arn:aws:s3:::arcadia-data-hub-archives-${Environment}/*"
 
   # ---- IAM: GitHub Actions deploy role ----
-  # Scoped for routine image-update deploys plus in-place updates to the
-  # existing data buckets' S3 event notifications (so new instrument triggers
-  # roll out via CI). Initial stack creation and structural changes — adding
-  # new buckets or Lambda functions — still require broader permissions and
-  # must be run from an admin session.
+  # Routine image updates and in-place bucket config only. New buckets or
+  # Lambda functions still need an admin session.
 
   GitHubActionsDeployRole:
     Type: AWS::IAM::Role
@@ -405,10 +377,8 @@ Resources:
                 Resource:
                   - !Sub "arn:aws:s3:::aws-sam-cli-managed-default-samclisourcebucket-*"
                   - !Sub "arn:aws:s3:::aws-sam-cli-managed-default-samclisourcebucket-*/*"
-              # Updating S3 event notifications (e.g., adding a new instrument
-              # trigger to RawDataBucket) requires Get/PutBucketNotification on
-              # the bucket itself. Scoped to the three data buckets this stack
-              # owns so CI can roll out new triggers without an admin deploy.
+              # Adding an instrument trigger needs these on the bucket itself,
+              # so CI can roll one out without an admin deploy.
               - Effect: Allow
                 Action:
                   - s3:GetBucketNotification
@@ -443,8 +413,7 @@ Resources:
                   - !Sub "arn:aws:iam::${AWS::AccountId}:role/data-hub-*-${Environment}"
 
   # ---- IAM: Vercel web app role (OIDC federation) ----
-  # Allows the Vercel-hosted Next.js app to generate presigned S3 URLs for
-  # watcher file uploads/downloads without long-lived AWS credentials.
+  # Lets the Next.js app presign S3 URLs without long-lived AWS credentials.
 
   WebAppS3Role:
     Type: AWS::IAM::Role
@@ -480,15 +449,8 @@ Resources:
                   - s3:GetObject
                 Resource:
                   - !Sub "arn:aws:s3:::arcadia-data-hub-processed-${Environment}/*"
-              # Read-only access to the archives bucket so the web app can
-              # HeadObject (cache-hit check) and presign GETs. Lambda is the
-              # only writer.
-              #
-              # `s3:ListBucket` is required on the bucket-level ARN: without
-              # it, HeadObject on a missing key returns 403 instead of 404
-              # (S3 won't reveal key existence to a caller that can't list).
-              # That breaks the cache-miss path, since the route relies on
-              # 404 to fall through to a fresh Lambda build.
+              # Read-only for the cache check and presigned GETs. ListBucket is
+              # required or a missing key 403s instead of the 404 the cache needs.
               - Effect: Allow
                 Action:
                   - s3:GetObject
@@ -496,10 +458,8 @@ Resources:
                 Resource:
                   - !Sub "arn:aws:s3:::arcadia-data-hub-archives-${Environment}"
                   - !Sub "arn:aws:s3:::arcadia-data-hub-archives-${Environment}/*"
-        # Permission for the web app to invoke the Lambda Function URL via
-        # SigV4. Scoped to the single function ARN this stack owns and
-        # gated on AuthType=AWS_IAM so it can't accidentally apply if the
-        # function URL is later flipped back to AuthType=NONE.
+        # Scoped to this stack's function ARN and gated on AuthType=AWS_IAM so
+        # it cannot apply if the URL is flipped back to AuthType=NONE.
         - PolicyName: LambdaFunctionUrlInvoke
           PolicyDocument:
             Version: "2012-10-17"
diff --git a/web/components/runs/aunty/aunty-well-dialog.tsx b/web/components/runs/aunty/aunty-well-dialog.tsx
index b1e673a8..562ee10a 100644
--- a/web/components/runs/aunty/aunty-well-dialog.tsx
+++ b/web/components/runs/aunty/aunty-well-dialog.tsx
@@ -28,7 +28,6 @@ import {
   parseAuntyCurvesCsv,
   presentWellValues,
 } from "@/lib/runs/aunty";
-import { fetchAllTableRows } from "@/lib/runs/report-table";
 import type { ReportDataSource } from "@/lib/runs/view-data-source";
 
 const WELL_SEEKER_LABELS = {
@@ -53,7 +52,7 @@ async function downloadCurves(
   dataSource: ReportDataSource,
   fileId: number
 ): Promise<Map<string, AuntyPoint[]>> {
-  const { rows } = await fetchAllTableRows(dataSource, fileId);
+  const { rows } = await dataSource.fetchTableRows(fileId);
   return indexAuntyCurves(parseAuntyCurvesCsv(rows));
 }
 
diff --git a/web/components/runs/colony-data-table.tsx b/web/components/runs/colony-data-table.tsx
index a6a17287..7dd13bc1 100644
--- a/web/components/runs/colony-data-table.tsx
+++ b/web/components/runs/colony-data-table.tsx
@@ -19,7 +19,6 @@ import {
   TableRow,
 } from "@/components/ui/table";
 import { useResolvedFileUrl } from "@/hooks/use-resolved-file-url";
-import { fetchAllTableRows } from "@/lib/runs/report-table";
 import type { ReportDataSource } from "@/lib/runs/view-data-source";
 import { cn } from "@/lib/utils";
 
@@ -36,7 +35,7 @@ async function fetchCsvRows(
   dataSource: ReportDataSource,
   fileId: number
 ): Promise<CsvRow[]> {
-  const { rows } = await fetchAllTableRows(dataSource, fileId);
+  const { rows } = await dataSource.fetchTableRows(fileId);
   return rows;
 }
 
diff --git a/web/components/runs/raman-spectrum-viewer.tsx b/web/components/runs/raman-spectrum-viewer.tsx
index 26600325..690f0ea8 100644
--- a/web/components/runs/raman-spectrum-viewer.tsx
+++ b/web/components/runs/raman-spectrum-viewer.tsx
@@ -14,7 +14,6 @@ import {
 } from "@/components/ui/chart";
 import { Skeleton } from "@/components/ui/skeleton";
 import { ToggleGroup, ToggleGroupItem } from "@/components/ui/toggle-group";
-import { fetchAllTableRows } from "@/lib/runs/report-table";
 import type { ReportDataSource } from "@/lib/runs/view-data-source";
 
 interface SpectrumPoint {
@@ -49,7 +48,7 @@ async function fetchSpectrum(
   dataSource: ReportDataSource,
   fileId: number
 ): Promise<SpectrumPoint[]> {
-  const { rows } = await fetchAllTableRows(dataSource, fileId);
+  const { rows } = await dataSource.fetchTableRows(fileId);
 
   if (rows.length === 0) {
     throw new Error("Spectrum CSV is empty");
diff --git a/web/lib/mcp/tools/report-views.defs.ts b/web/lib/mcp/tools/report-views.defs.ts
index 97a9cab2..32b6c3c1 100644
--- a/web/lib/mcp/tools/report-views.defs.ts
+++ b/web/lib/mcp/tools/report-views.defs.ts
@@ -1,19 +1,14 @@
 import { z } from "zod";
 import type { McpToolDef } from "@/lib/mcp/catalog/types";
-import {
-  REPORT_VIEW_TABLE_DEFAULT_LIMIT,
-  REPORT_VIEW_TABLE_MAX_LIMIT,
-  runReportToolUiMeta,
-} from "@/lib/mcp/ui-apps";
+import { runReportToolUiMeta } from "@/lib/mcp/ui-apps";
 import {
   REPORT_ITEMS_MAX_LIMIT,
   REPORT_ITEMS_WINDOW,
 } from "@/lib/runs/report-items";
 import {
-  reportViewArtifactOutputSchema,
+  reportViewFileUrlOutputSchema,
   reportViewItemKindSchema,
   reportViewItemsOutputSchema,
-  reportViewTableOutputSchema,
 } from "./report-views.output";
 
 const APP_ONLY_META = runReportToolUiMeta(["app"]);
@@ -59,66 +54,35 @@ export const reportViewItemsTool = {
   _meta: APP_ONLY_META,
 } as const satisfies McpToolDef;
 
-export const reportViewTableTool = {
-  name: "report_view_table",
+export const reportViewFileUrlTool = {
+  name: "report_view_file_url",
   group: "runs",
   scope: "files:read",
-  title: "Report View Table",
+  title: "Report View File URL",
   description:
-    "Return parsed CSV columns and rows for a run file. Pass `full` to load the whole file up to the scan cap in one call. Used by the Data Hub run report view. Call `get_run_report` instead.",
-  outputSchema: reportViewTableOutputSchema,
+    "Return a short-lived download URL for one file on a run, found by numeric id or by filename suffix. The view reads CSV and JSON bodies from that URL itself. Used by the Data Hub run report view. Call `get_run_report` instead.",
+  outputSchema: reportViewFileUrlOutputSchema,
   inputSchema: {
     instrumentId: z.string().describe("Instrument identifier"),
     runId: z.string().describe("Run identifier within the instrument"),
-    fileId: z.number().int().describe("Numeric file ID of the CSV"),
-    offset: z
+    fileId: z
       .number()
       .int()
-      .min(0)
       .optional()
-      .describe("Row offset (default: 0)"),
-    limit: z
-      .number()
-      .int()
+      .describe("Numeric file ID. Takes precedence over `suffix`"),
+    suffix: z
+      .string()
       .min(1)
-      .max(REPORT_VIEW_TABLE_MAX_LIMIT)
-      .optional()
-      .describe(
-        `Rows to return (default: ${REPORT_VIEW_TABLE_DEFAULT_LIMIT}, max: ${REPORT_VIEW_TABLE_MAX_LIMIT})`
-      ),
-    full: z
-      .boolean()
       .optional()
       .describe(
-        "When true, ignore offset/limit and return the whole file up to the scan cap"
+        "Filename suffix to match instead of an id, e.g. _aunty_plate.json"
       ),
   },
   annotations: { readOnlyHint: true },
   _meta: APP_ONLY_META,
 } as const satisfies McpToolDef;
 
-export const reportViewArtifactTool = {
-  name: "report_view_artifact",
-  group: "runs",
-  scope: "files:read",
-  title: "Report View Artifact",
-  description:
-    "Return a JSON artifact from a run by filename suffix. Aunty plate data is assembled from the plate file plus curves file id. Used by the Data Hub run report view. Call `get_run_report` instead.",
-  outputSchema: reportViewArtifactOutputSchema,
-  inputSchema: {
-    instrumentId: z.string().describe("Instrument identifier"),
-    runId: z.string().describe("Run identifier within the instrument"),
-    suffix: z
-      .string()
-      .min(1)
-      .describe("Filename suffix of the JSON artifact, e.g. _aunty_plate.json"),
-  },
-  annotations: { readOnlyHint: true },
-  _meta: APP_ONLY_META,
-} as const satisfies McpToolDef;
-
 export const REPORT_VIEW_TOOL_DEFS = [
   reportViewItemsTool,
-  reportViewTableTool,
-  reportViewArtifactTool,
+  reportViewFileUrlTool,
 ] as const;
diff --git a/web/lib/mcp/tools/report-views.output.ts b/web/lib/mcp/tools/report-views.output.ts
index e2c0b2f7..5460d484 100644
--- a/web/lib/mcp/tools/report-views.output.ts
+++ b/web/lib/mcp/tools/report-views.output.ts
@@ -17,17 +17,10 @@ export const reportViewItemsOutputSchema = z.object({
   }),
 });
 
-export const reportViewTableOutputSchema = z.object({
-  columns: z.array(z.string()),
-  rows: z.array(z.record(z.string(), z.string())),
-  total: z.number().int(),
-  truncated: z.boolean().optional(),
-});
-
-export const reportViewArtifactOutputSchema = z.object({
-  suffix: z.string(),
+export const reportViewFileUrlOutputSchema = z.object({
+  id: z.number().int(),
   filename: z.string(),
-  artifact: z.unknown(),
+  url: z.string(),
 });
 
 export const reportViewItemKindSchema = z.enum(REPORT_ITEM_KINDS);
diff --git a/web/lib/mcp/tools/report-views.ts b/web/lib/mcp/tools/report-views.ts
index 025fa8c2..a2884856 100644
--- a/web/lib/mcp/tools/report-views.ts
+++ b/web/lib/mcp/tools/report-views.ts
@@ -3,13 +3,8 @@ import {
   findActiveFileBySuffix,
   getActiveFileById,
   getActiveFilesByIds,
-  lookupFileForDownload,
 } from "@/lib/api/files";
-import {
-  getAuntyPlateData,
-  getRunReportFiles,
-  lookupRunByNaturalKey,
-} from "@/lib/api/instrument-runs";
+import { lookupRunByNaturalKey } from "@/lib/api/instrument-runs";
 import { getReportItemsPage } from "@/lib/api/report-items";
 import { toAbsoluteDownloadUrl } from "@/lib/mcp/absolute-url";
 import { toolRegistrationConfig } from "@/lib/mcp/catalog/register";
@@ -18,18 +13,11 @@ import {
   getMcpUserId,
   structuredResult,
 } from "@/lib/mcp/tools/helpers";
-import {
-  REPORT_VIEW_TABLE_DEFAULT_LIMIT,
-  REPORT_VIEW_TABLE_MAX_LIMIT,
-  REPORT_VIEW_TABLE_SCAN_CAP,
-} from "@/lib/mcp/ui-apps";
-import { parseCsvPage } from "@/lib/runs/parse-csv-page";
 import { REPORT_ITEMS_WINDOW } from "@/lib/runs/report-items";
-import { getPresignedDownloadUrl, getS3ObjectStream } from "@/lib/s3";
+import { getPresignedDownloadUrl } from "@/lib/s3";
 import {
-  reportViewArtifactTool,
+  reportViewFileUrlTool,
   reportViewItemsTool,
-  reportViewTableTool,
 } from "./report-views.defs";
 
 function requireMcpUser(authInfo: Parameters<typeof getMcpUserId>[0]) {
@@ -43,16 +31,6 @@ function requireMcpUser(authInfo: Parameters<typeof getMcpUserId>[0]) {
   return { ok: true as const, userId };
 }
 
-async function streamToBuffer(
-  stream: import("node:stream").Readable
-): Promise<Buffer> {
-  const chunks: Buffer[] = [];
-  for await (const chunk of stream) {
-    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-  }
-  return Buffer.concat(chunks);
-}
-
 export function registerReportViewTools(server: McpServer) {
   server.registerTool(
     reportViewItemsTool.name,
@@ -101,67 +79,16 @@ export function registerReportViewTools(server: McpServer) {
   );
 
   server.registerTool(
-    reportViewTableTool.name,
-    toolRegistrationConfig(reportViewTableTool),
+    reportViewFileUrlTool.name,
+    toolRegistrationConfig(reportViewFileUrlTool),
     async (args, ctx) => {
       const auth = requireMcpUser(ctx.http?.authInfo);
       if (!auth.ok) {
         return auth.error;
       }
 
-      const run = await lookupRunByNaturalKey(args.instrumentId, args.runId);
-      if (!run) {
-        return errorResult(
-          `Run '${args.runId}' not found for instrument '${args.instrumentId}'.`
-        );
-      }
-
-      const file = await getActiveFileById(args.fileId);
-      if (!file || file.instrumentRunId !== run.id) {
-        return errorResult(
-          `File '${args.fileId}' not found on run '${args.runId}'.`
-        );
-      }
-      const download = await lookupFileForDownload(args.fileId);
-      if (!download.ok) {
-        return errorResult(
-          download.reason === "not_uploaded"
-            ? `File '${args.fileId}' has not been uploaded yet.`
-            : `File '${args.fileId}' not found on run '${args.runId}'.`
-        );
-      }
-
-      const full = args.full === true;
-      const limit = full
-        ? REPORT_VIEW_TABLE_SCAN_CAP
-        : Math.min(
-            args.limit ?? REPORT_VIEW_TABLE_DEFAULT_LIMIT,
-            REPORT_VIEW_TABLE_MAX_LIMIT
-          );
-      const offset = full ? 0 : Math.max(args.offset ?? 0, 0);
-
-      try {
-        const table = await parseCsvPage(
-          download.s3Bucket,
-          download.s3Key,
-          offset,
-          limit
-        );
-        return structuredResult(table);
-      } catch (err) {
-        console.error(`Failed to parse CSV for file ${file.id}:`, err);
-        return errorResult(`Failed to parse CSV for file '${args.fileId}'.`);
-      }
-    }
-  );
-
-  server.registerTool(
-    reportViewArtifactTool.name,
-    toolRegistrationConfig(reportViewArtifactTool),
-    async (args, ctx) => {
-      const auth = requireMcpUser(ctx.http?.authInfo);
-      if (!auth.ok) {
-        return auth.error;
+      if (args.fileId === undefined && !args.suffix) {
+        return errorResult("Pass either `fileId` or `suffix`.");
       }
 
       const run = await lookupRunByNaturalKey(args.instrumentId, args.runId);
@@ -171,48 +98,32 @@ export function registerReportViewTools(server: McpServer) {
         );
       }
 
-      if (args.suffix.endsWith("_aunty_plate.json")) {
-        const runFiles = await getRunReportFiles(run.id);
-        const plate = await getAuntyPlateData(runFiles);
-        if (!plate) {
-          return errorResult(
-            `No artifact ending with '${args.suffix}' on run '${args.runId}'.`
-          );
-        }
-        const plateFile = runFiles.find(
-          (file) =>
-            file.filename.endsWith("_aunty_plate.json") &&
-            file.deletedAt === null
-        );
-        return structuredResult({
-          suffix: args.suffix,
-          filename: plateFile?.filename ?? `${args.runId}_aunty_plate.json`,
-          artifact: plate,
-        });
-      }
+      const file =
+        args.fileId === undefined
+          ? await findActiveFileBySuffix(run.id, args.suffix ?? "")
+          : await getActiveFileById(args.fileId);
 
-      const file = await findActiveFileBySuffix(run.id, args.suffix);
-      if (!(file?.s3Bucket && file.s3Key)) {
+      // The id lookup is not run-scoped, so check before signing anything.
+      if (!file || file.instrumentRunId !== run.id) {
         return errorResult(
-          `No artifact ending with '${args.suffix}' on run '${args.runId}'.`
+          args.fileId === undefined
+            ? `No file ending with '${args.suffix}' on run '${args.runId}'.`
+            : `File '${args.fileId}' not found on run '${args.runId}'.`
         );
       }
 
-      try {
-        const stream = await getS3ObjectStream(file.s3Bucket, file.s3Key);
-        const buf = await streamToBuffer(stream);
-        const artifact: unknown = JSON.parse(buf.toString("utf8"));
-        return structuredResult({
-          suffix: args.suffix,
-          filename: file.filename,
-          artifact,
-        });
-      } catch (err) {
-        console.error(`Failed to parse artifact ${file.s3Key}:`, err);
+      if (!(file.s3Bucket && file.s3Key)) {
         return errorResult(
-          `Failed to parse JSON artifact ending with '${args.suffix}'.`
+          `File '${file.filename}' has not been uploaded yet.`
         );
       }
+
+      const url = await getPresignedDownloadUrl(file.s3Bucket, file.s3Key);
+      return structuredResult({
+        id: file.id,
+        filename: file.filename,
+        url: toAbsoluteDownloadUrl(url),
+      });
     }
   );
 }
diff --git a/web/lib/mcp/ui-apps.ts b/web/lib/mcp/ui-apps.ts
index 052cb227..89cccff6 100644
--- a/web/lib/mcp/ui-apps.ts
+++ b/web/lib/mcp/ui-apps.ts
@@ -2,14 +2,6 @@ export const RUN_REPORT_UI_RESOURCE_URI = "ui://data-hub/run-report";
 
 export const MCP_APP_MIME_TYPE = "text/html;profile=mcp-app";
 
-export const REPORT_VIEW_TABLE_DEFAULT_LIMIT = 50;
-
-export const REPORT_VIEW_TABLE_MAX_LIMIT = 200;
-
-// Stop counting after this many CSV rows so a pathological file cannot
-// pin the MCP request. `total` is then a floor, not an exact count.
-export const REPORT_VIEW_TABLE_SCAN_CAP = 50_000;
-
 export type McpUiToolVisibility = "model" | "app";
 
 export interface McpUiToolMeta {
diff --git a/web/lib/mcp/ui-csp.ts b/web/lib/mcp/ui-csp.ts
index 36bc2477..e2878347 100644
--- a/web/lib/mcp/ui-csp.ts
+++ b/web/lib/mcp/ui-csp.ts
@@ -14,9 +14,13 @@ function runReportUiCspDomains(): string[] {
   // The local mirror serves file bytes from the app's own origin, which
   // `localDevOrigins` already covers, so the S3 hosts are dead weight there.
   if (!getLocalMirrorRoot()) {
+    // A run's files sit in the raw bucket (instrument output) or the
+    // processed bucket (Lambda artifacts) — `files.s3_bucket` decides per
+    // row, so both origins have to be listed or half the report fails to
+    // load. Archives are zips the View never renders, so they stay out.
     for (const bucket of [
       process.env.S3_RAW_DATA_BUCKET,
-      process.env.S3_ARCHIVES_BUCKET,
+      process.env.S3_PROCESSED_BUCKET,
     ]) {
       if (bucket) {
         origins.add(s3BucketOrigin(bucket));
@@ -39,10 +43,11 @@ export function runReportUiMeta() {
       csp: {
         resourceDomains: domains,
         frameDomains: domains,
-        // Tool calls travel through the host, so the View never issues a
-        // cross-origin `fetch`. Declared and empty so that having a `csp`
-        // object at all cannot grant one.
-        connectDomains: [] as string[],
+        // The View reads CSV and JSON bodies straight from S3 rather than
+        // having the server parse them and return rows, so it needs the same
+        // origins for `fetch`. The buckets allow this with a `*` CORS rule;
+        // see `RawDataBucket` in `infra/template.yaml`.
+        connectDomains: domains,
       },
       prefersBorder: true,
     },
diff --git a/web/lib/runs/parse-csv-page.ts b/web/lib/runs/parse-csv-page.ts
deleted file mode 100644
index 6ff113a8..00000000
--- a/web/lib/runs/parse-csv-page.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-import type { Readable } from "node:stream";
-import { parse } from "csv-parse";
-import { REPORT_VIEW_TABLE_SCAN_CAP } from "@/lib/mcp/ui-apps";
-import { getS3ObjectStream } from "@/lib/s3";
-
-export interface ParsedCsvPage {
-  columns: string[];
-  rows: Record<string, string>[];
-  total: number;
-  truncated: boolean;
-}
-
-export async function parseCsvPageFromStream(
-  stream: Readable,
-  offset: number,
-  limit: number,
-  scanCap = REPORT_VIEW_TABLE_SCAN_CAP
-): Promise<ParsedCsvPage> {
-  const parser = stream.pipe(
-    parse({ columns: true, skip_empty_lines: true, trim: true })
-  );
-
-  let index = 0;
-  const rows: Record<string, string>[] = [];
-  let columns: string[] = [];
-  let truncated = false;
-
-  try {
-    for await (const record of parser) {
-      const row = record as Record<string, string>;
-      if (index === 0) {
-        columns = Object.keys(row);
-      }
-      if (index >= offset && rows.length < limit) {
-        rows.push(row);
-      }
-      index += 1;
-      if (index >= scanCap) {
-        truncated = true;
-        break;
-      }
-    }
-  } finally {
-    parser.destroy();
-    stream.destroy();
-  }
-
-  return { columns, rows, total: index, truncated };
-}
-
-export async function parseCsvPage(
-  bucket: string,
-  key: string,
-  offset: number,
-  limit: number,
-  scanCap = REPORT_VIEW_TABLE_SCAN_CAP
-): Promise<ParsedCsvPage> {
-  const stream = await getS3ObjectStream(bucket, key);
-  return parseCsvPageFromStream(stream, offset, limit, scanCap);
-}
diff --git a/web/lib/runs/report-table.ts b/web/lib/runs/report-table.ts
deleted file mode 100644
index ad105bff..00000000
--- a/web/lib/runs/report-table.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-import type { ReportDataSource } from "@/lib/runs/view-data-source";
-
-// Must stay at or below `REPORT_VIEW_TABLE_MAX_LIMIT`; the MCP tool rejects larger pages.
-const DEFAULT_TABLE_PAGE = 200;
-
-// Raman, Aunty curves, and the colony table all need every row. `fetchTable`
-// is paginated for the View's MCP envelope, so callers that chart or index
-// the full file walk pages here. The MCP source answers the first page
-// with the whole file (one S3 GET) and slices later pages from memory.
-export async function fetchAllTableRows(
-  dataSource: ReportDataSource,
-  fileId: number,
-  pageSize = DEFAULT_TABLE_PAGE
-): Promise<{
-  columns: string[];
-  rows: Record<string, string>[];
-  truncated: boolean;
-}> {
-  const first = await dataSource.fetchTable({
-    fileId,
-    offset: 0,
-    limit: pageSize,
-  });
-  let truncated = first.truncated === true;
-  if (first.rows.length >= first.total) {
-    return { columns: first.columns, rows: first.rows, truncated };
-  }
-  const rows = first.rows.slice();
-  while (rows.length < first.total) {
-    const page = await dataSource.fetchTable({
-      fileId,
-      offset: rows.length,
-      limit: pageSize,
-    });
-    if (page.truncated) {
-      truncated = true;
-    }
-    if (page.rows.length === 0) {
-      break;
-    }
-    rows.push(...page.rows);
-  }
-  if (rows.length < first.total) {
-    truncated = true;
-  }
-  return { columns: first.columns, rows, truncated };
-}
diff --git a/web/lib/runs/rest-report-data-source.ts b/web/lib/runs/rest-report-data-source.ts
index ea1a2b4d..01fa8438 100644
--- a/web/lib/runs/rest-report-data-source.ts
+++ b/web/lib/runs/rest-report-data-source.ts
@@ -1,22 +1,22 @@
 import { parse } from "csv-parse/browser/esm/sync";
 import { type ReportItemsPage, reportItemsUrl } from "@/lib/runs/report-items";
-import type { ReportDataSource } from "@/lib/runs/view-data-source";
+import type {
+  ReportDataSource,
+  ReportTableRows,
+} from "@/lib/runs/view-data-source";
 
 function restFileUrl(fileId: number): string {
   return `/api/v1/files/${fileId}/download`;
 }
 
 // Browser-side source for the Next.js run page. Closures hold the natural-key
-// route ids; `fetchArtifact` is unused here because plate JSON is loaded on
-// the server and passed in as props.
+// route ids; `resolveFileBySuffix` is unimplemented here because artifacts are
+// loaded on the server and passed into the page as props.
 export function createRestReportDataSource(args: {
   instrumentId: string;
   runId: string;
 }): ReportDataSource {
-  const tableCache = new Map<
-    number,
-    { columns: string[]; rows: Record<string, string>[] }
-  >();
+  const tableCache = new Map<number, ReportTableRows>();
 
   return {
     async fetchReportItems({ kind, offset, limit, search, anchor }) {
@@ -35,39 +35,29 @@ export function createRestReportDataSource(args: {
       return (await response.json()) as ReportItemsPage;
     },
 
-    async fetchTable({ fileId, offset, limit }) {
-      let parsed = tableCache.get(fileId);
-      if (!parsed) {
-        // Same 302-to-S3 download the viewers used to issue themselves, so
-        // the web app still makes one GET per file and then slices in memory.
-        const res = await fetch(restFileUrl(fileId));
-        if (!res.ok) {
-          throw new Error(`Failed to load table (HTTP ${res.status})`);
-        }
-        const rows = parse(await res.text(), {
-          columns: true,
-          skip_empty_lines: true,
-          trim: true,
-        }) as Record<string, string>[];
-        parsed = {
-          columns: rows.length === 0 ? [] : Object.keys(rows[0]),
-          rows,
-        };
-        tableCache.set(fileId, parsed);
+    async fetchTableRows(fileId) {
+      const cached = tableCache.get(fileId);
+      if (cached) {
+        return cached;
       }
-      return {
-        columns: parsed.columns,
-        rows: parsed.rows.slice(offset, offset + limit),
-        total: parsed.rows.length,
+      // The download endpoint 302-redirects to a short-lived presigned S3
+      // URL, so the CSV bytes flow straight from S3 to the browser with zero
+      // Vercel Fast Origin Transfer.
+      const res = await fetch(restFileUrl(fileId));
+      if (!res.ok) {
+        throw new Error(`Failed to load table (HTTP ${res.status})`);
+      }
+      const rows = parse(await res.text(), {
+        columns: true,
+        skip_empty_lines: true,
+        trim: true,
+      }) as Record<string, string>[];
+      const parsed: ReportTableRows = {
+        columns: rows.length === 0 ? [] : Object.keys(rows[0]),
+        rows,
       };
-    },
-
-    fetchArtifact() {
-      return Promise.reject(
-        new Error(
-          "fetchArtifact is not available over REST; the web app loads artifacts on the server"
-        )
-      );
+      tableCache.set(fileId, parsed);
+      return parsed;
     },
 
     peekFileUrl: restFileUrl,
diff --git a/web/lib/runs/view-data-source.ts b/web/lib/runs/view-data-source.ts
index c384c159..cd448826 100644
--- a/web/lib/runs/view-data-source.ts
+++ b/web/lib/runs/view-data-source.ts
@@ -1,14 +1,19 @@
 import type { ReportItemKind, ReportItemsPage } from "@/lib/runs/report-items";
 
-export interface ReportTablePage {
+export interface ReportTableRows {
   columns: string[];
   rows: Record<string, string>[];
-  total: number;
-  truncated?: boolean;
+}
+
+export interface ReportFileRef {
+  filename: string;
+  id: number;
+  url: string;
 }
 
 // Contract shared by the Next.js run page (REST) and the MCP Apps View.
-// The View agent implements the MCP-backed side against this exact shape.
+// Both fetch file bytes straight from S3 and parse them in the browser, so
+// neither one streams a CSV or a JSON artifact through the server.
 // biome-ignore assist/source/useSortedInterfaceMembers: keep the published method order
 export interface ReportDataSource {
   fetchReportItems(args: {
@@ -18,15 +23,15 @@ export interface ReportDataSource {
     search?: string;
     anchor?: number;
   }): Promise<ReportItemsPage>;
-  fetchTable(args: {
-    fileId: number;
-    offset: number;
-    limit: number;
-  }): Promise<ReportTablePage>;
-  fetchArtifact(args: { suffix: string }): Promise<unknown>;
+  // Whole file, parsed. Callers chart or index every row, and both sources
+  // cache per file id, so there is nothing to gain from paging here.
+  fetchTableRows(fileId: number): Promise<ReportTableRows>;
   resolveFileUrl(fileId: number): Promise<string> | string;
   // Synchronous cache/path lookup for render. The MCP source is async, so
   // calling `resolveFileUrl` during render would allocate a Promise every
   // time. REST implements this as the download path.
   peekFileUrl?(fileId: number): string | null;
+  // Find one file on the run by filename suffix. Only the View implements
+  // this; the web app resolves artifacts on the server and passes them in.
+  resolveFileBySuffix?(suffix: string): Promise<ReportFileRef>;
 }
diff --git a/web/mcp-apps/run-report/instrument-report.tsx b/web/mcp-apps/run-report/instrument-report.tsx
index 76339351..ea34a4db 100644
--- a/web/mcp-apps/run-report/instrument-report.tsx
+++ b/web/mcp-apps/run-report/instrument-report.tsx
@@ -18,7 +18,7 @@ import { RunSectionCard } from "@/components/runs/run-section-card";
 import { VideoCarouselReport } from "@/components/runs/video-carousel-report";
 import type { RawWellRow } from "@/lib/api/instrument-runs";
 import type { InstrumentType } from "@/lib/db/schema";
-import type { AuntyPlateData } from "@/lib/runs/aunty";
+import { type AuntyPlateData, parseAuntyPlateJson } from "@/lib/runs/aunty";
 import { extractPlateMaps } from "@/lib/runs/extract-plate-maps";
 import {
   emptyReportItemsPage,
@@ -27,8 +27,8 @@ import {
   type ReportItemsPage,
   reportItemKindForInstrument,
 } from "@/lib/runs/report-items";
-import { fetchAllTableRows } from "@/lib/runs/report-table";
 import { isCsvFile } from "@/lib/runs/run-file-types";
+import type { ReportDataSource } from "@/lib/runs/view-data-source";
 import { readPersistedFileId } from "./host-bridge";
 
 interface ReportFileRef {
@@ -71,11 +71,27 @@ function firstProcessedCsv(files: ReportFileRef[]): ReportFileRef | undefined {
   return files.find((file) => file.category === "processed" && isCsvFile(file));
 }
 
-function isAuntyPlateData(value: unknown): value is AuntyPlateData {
-  if (typeof value !== "object" || value === null) {
-    return false;
+// Mirrors `getAuntyPlateData`, which the web app runs on the server. Here the
+// plate JSON and the curves file are two `report_view_file_url` lookups and
+// the body is read straight from S3, so the bytes skip the server entirely.
+async function loadAuntyPlate(
+  dataSource: ReportDataSource
+): Promise<AuntyPlateData> {
+  const resolveBySuffix = dataSource.resolveFileBySuffix;
+  if (!resolveBySuffix) {
+    throw new Error("This data source cannot resolve files by suffix.");
   }
-  return "plate" in value;
+  const plateRef = await resolveBySuffix("_aunty_plate.json");
+  const response = await fetch(plateRef.url);
+  if (!response.ok) {
+    throw new Error(`Failed to load plate JSON (HTTP ${response.status})`);
+  }
+  const plate = parseAuntyPlateJson(await response.json());
+
+  // Optional: an isothermal export has no curves file, and the dialog just
+  // renders without a chart in that case.
+  const curves = await resolveBySuffix("_aunty_curves.csv").catch(() => null);
+  return { plate, curvesFileId: curves?.id ?? null };
 }
 
 export function InstrumentReport({
@@ -179,15 +195,8 @@ function AuntyReport() {
   const [error, setError] = useState<string | null>(null);
 
   useEffect(() => {
-    void dataSource
-      .fetchArtifact({ suffix: "_aunty_plate.json" })
-      .then((artifact) => {
-        if (isAuntyPlateData(artifact)) {
-          setPlate(artifact);
-          return;
-        }
-        setError("Aunty plate artifact had an unexpected shape.");
-      })
+    void loadAuntyPlate(dataSource)
+      .then(setPlate)
       .catch((err: unknown) => {
         setError(err instanceof Error ? err.message : "Failed to load plate");
       });
@@ -207,7 +216,6 @@ function AuntyReport() {
 function PlateReaderReport({ result }: { result: RunReportToolResult }) {
   const dataSource = useReportDataSource();
   const [rows, setRows] = useState<RawWellRow[] | null>(null);
-  const [truncated, setTruncated] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const csv = firstProcessedCsv(result.reportFiles);
 
@@ -216,11 +224,9 @@ function PlateReaderReport({ result }: { result: RunReportToolResult }) {
       setRows([]);
       return;
     }
-    void fetchAllTableRows(dataSource, csv.id)
-      .then((table) => {
-        setRows(table.rows ?? []);
-        setTruncated(table.truncated);
-      })
+    void dataSource
+      .fetchTableRows(csv.id)
+      .then((table) => setRows(table.rows))
       .catch((err: unknown) => {
         setError(err instanceof Error ? err.message : "Failed to load wells");
         setRows([]);
@@ -274,12 +280,6 @@ function PlateReaderReport({ result }: { result: RunReportToolResult }) {
       count={groups.length}
       title="Plate Maps"
     >
-      {truncated ? (
-        <p className="text-muted-foreground text-xs">
-          This file is larger than the report can load. The maps use the first
-          rows only.
-        </p>
-      ) : null}
       <div className="flex min-w-0 flex-col gap-10">
         {groups.map((group, index) =>
           group.mode === "kinetic" ? (
diff --git a/web/mcp-apps/run-report/mcp-data-source.ts b/web/mcp-apps/run-report/mcp-data-source.ts
index 303a6035..43dda777 100644
--- a/web/mcp-apps/run-report/mcp-data-source.ts
+++ b/web/mcp-apps/run-report/mcp-data-source.ts
@@ -1,36 +1,18 @@
 import type { App } from "@modelcontextprotocol/ext-apps";
 import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
-import { REPORT_VIEW_TABLE_MAX_LIMIT } from "@/lib/mcp/ui-apps";
-import {
-  REPORT_ITEM_KINDS,
-  type ReportItemsPage,
-} from "@/lib/runs/report-items";
-import type { ReportDataSource } from "@/lib/runs/view-data-source";
-
-interface ToolEnvelope<T> {
-  artifact?: unknown;
-  columns?: string[];
-  data?: T;
-  filename?: string;
-  pagination?: ReportItemsPage["pagination"];
-  rows?: Record<string, string>[];
-  suffix?: string;
-  total?: number;
-  truncated?: boolean;
-}
+import { parse } from "csv-parse/browser/esm/sync";
+import type { ReportItemsPage } from "@/lib/runs/report-items";
+import type {
+  ReportDataSource,
+  ReportFileRef,
+  ReportTableRows,
+} from "@/lib/runs/view-data-source";
 
 interface CachedUrl {
   expiresAt: number;
   url: string;
 }
 
-interface CachedTable {
-  columns: string[];
-  rows: Record<string, string>[];
-  total: number;
-  truncated: boolean;
-}
-
 // Keep in lockstep with `PRESIGNED_DOWNLOAD_URL_EXPIRY_SECONDS` in
 // `lib/s3.ts`. Do not import that module — it pulls the AWS SDK into
 // the View bundle. Refresh at 80% of the 15-minute lifetime.
@@ -76,13 +58,40 @@ function writeCachedUrl(
   cache.set(fileId, { url, expiresAt: Date.now() + URL_CACHE_TTL_MS });
 }
 
+async function fetchText(url: string, what: string): Promise<string> {
+  // Reaches S3 directly. The resource's `connectDomains` names those origins
+  // and the buckets carry a `*` CORS rule, so the body is readable here and
+  // the bytes never pass through the server.
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`Failed to load ${what} (HTTP ${response.status})`);
+  }
+  return await response.text();
+}
+
 export function createMcpReportDataSource(args: {
   app: App;
   instrumentId: string;
   runId: string;
 }): ReportDataSource {
   const urlCache = new Map<number, CachedUrl>();
-  const tableCache = new Map<number, CachedTable>();
+  const tableCache = new Map<number, ReportTableRows>();
+
+  async function callFileUrl(
+    params: { fileId: number } | { suffix: string }
+  ): Promise<ReportFileRef> {
+    const result = await args.app.callServerTool({
+      name: "report_view_file_url",
+      arguments: {
+        instrumentId: args.instrumentId,
+        runId: args.runId,
+        ...params,
+      },
+    });
+    const ref = structuredPayload<ReportFileRef>(result);
+    writeCachedUrl(urlCache, ref.id, ref.url);
+    return ref;
+  }
 
   const source: ReportDataSource = {
     async fetchReportItems({ kind, offset, limit, search, anchor }) {
@@ -108,56 +117,23 @@ export function createMcpReportDataSource(args: {
       return payload;
     },
 
-    async fetchTable({ fileId, offset, limit }) {
-      let parsed = tableCache.get(fileId);
-      if (!parsed) {
-        // One tool call returns the whole file up to the scan cap. Paging
-        // after that is in-memory so a 20k-row CSV is not 100 S3 GETs.
-        const result = await args.app.callServerTool({
-          name: "report_view_table",
-          arguments: {
-            instrumentId: args.instrumentId,
-            runId: args.runId,
-            fileId,
-            full: true,
-          },
-        });
-        const payload = structuredPayload<{
-          columns: string[];
-          rows: Record<string, string>[];
-          total: number;
-          truncated?: boolean;
-        }>(result);
-        parsed = {
-          columns: payload.columns,
-          rows: payload.rows,
-          total: payload.total,
-          truncated: payload.truncated === true,
-        };
-        tableCache.set(fileId, parsed);
+    async fetchTableRows(fileId) {
+      const cached = tableCache.get(fileId);
+      if (cached) {
+        return cached;
       }
-      return {
-        columns: parsed.columns,
-        rows: parsed.rows.slice(
-          offset,
-          offset + Math.min(limit, REPORT_VIEW_TABLE_MAX_LIMIT)
-        ),
-        total: parsed.total,
-        truncated: parsed.truncated,
+      const url = await source.resolveFileUrl(fileId);
+      const rows = parse(await fetchText(url, `file ${fileId}`), {
+        columns: true,
+        skip_empty_lines: true,
+        trim: true,
+      }) as Record<string, string>[];
+      const parsed: ReportTableRows = {
+        columns: rows.length === 0 ? [] : Object.keys(rows[0]),
+        rows,
       };
-    },
-
-    async fetchArtifact({ suffix }) {
-      const result = await args.app.callServerTool({
-        name: "report_view_artifact",
-        arguments: {
-          instrumentId: args.instrumentId,
-          runId: args.runId,
-          suffix,
-        },
-      });
-      const payload = structuredPayload<ToolEnvelope<unknown>>(result);
-      return payload.artifact ?? payload;
+      tableCache.set(fileId, parsed);
+      return parsed;
     },
 
     peekFileUrl(fileId: number) {
@@ -169,23 +145,11 @@ export function createMcpReportDataSource(args: {
       if (cached) {
         return cached;
       }
-      // Kind is required and filters the window, so try every kind. A hit
-      // also warms the cache for neighbouring files of that kind.
-      await Promise.allSettled(
-        REPORT_ITEM_KINDS.map((kind) =>
-          source.fetchReportItems({
-            kind,
-            offset: 0,
-            limit: 1,
-            anchor: fileId,
-          })
-        )
-      );
-      const resolved = readCachedUrl(urlCache, fileId);
-      if (resolved) {
-        return resolved;
-      }
-      throw new Error(`No download URL for file ${fileId}`);
+      return (await callFileUrl({ fileId })).url;
+    },
+
+    resolveFileBySuffix(suffix: string) {
+      return callFileUrl({ suffix });
     },
   };
 
diff --git a/web/tests/integration/mcp.test.ts b/web/tests/integration/mcp.test.ts
index dc6a4cec..5074f6f4 100644
--- a/web/tests/integration/mcp.test.ts
+++ b/web/tests/integration/mcp.test.ts
@@ -11,7 +11,7 @@ import {
 } from "@/tests/integration/helpers";
 
 /** Bump when adding/removing an MCP tool so the change shows up in review. */
-const EXPECTED_MCP_TOOL_COUNT = 35;
+const EXPECTED_MCP_TOOL_COUNT = 34;
 
 function jsonRpc(method: string, params: unknown = {}, id = 1) {
   return {
diff --git a/web/tests/mcp/mcp-catalog.test.ts b/web/tests/mcp/mcp-catalog.test.ts
index ee6e6835..95a57075 100644
--- a/web/tests/mcp/mcp-catalog.test.ts
+++ b/web/tests/mcp/mcp-catalog.test.ts
@@ -33,7 +33,7 @@ describe("MCP catalog document", () => {
 
   it("publishes outputSchema for every tool", () => {
     const doc = buildMcpCatalogDocument();
-    expect(MCP_TOOL_DEFS).toHaveLength(35);
+    expect(MCP_TOOL_DEFS).toHaveLength(34);
     for (const def of MCP_TOOL_DEFS) {
       expect(def.outputSchema, `${def.name} missing outputSchema`).toBeTruthy();
       const tool = doc.tools.find((t) => t.name === def.name);
diff --git a/web/tests/mcp/mcp-protocol.test.ts b/web/tests/mcp/mcp-protocol.test.ts
index 4675c171..0fd5e5ed 100644
--- a/web/tests/mcp/mcp-protocol.test.ts
+++ b/web/tests/mcp/mcp-protocol.test.ts
@@ -827,7 +827,7 @@ describe("MCP Protocol (in-memory)", () => {
 
   it("every registered tool advertises outputSchema", async () => {
     const { tools } = await client.listTools();
-    expect(tools).toHaveLength(35);
+    expect(tools).toHaveLength(34);
     for (const tool of tools) {
       const schema = tool.outputSchema as
         | { type?: string; oneOf?: unknown; anyOf?: unknown }
@@ -1344,11 +1344,7 @@ describe("MCP Protocol (in-memory)", () => {
 
   it("report_view tools are app-visible and require an authenticated user", async () => {
     const { tools } = await client.listTools();
-    for (const name of [
-      "report_view_items",
-      "report_view_table",
-      "report_view_artifact",
-    ] as const) {
+    for (const name of ["report_view_items", "report_view_file_url"] as const) {
       const tool = tools.find((t) => t.name === name);
       expect(tool?._meta).toEqual({
         ui: {
@@ -1360,23 +1356,17 @@ describe("MCP Protocol (in-memory)", () => {
       const result = await client.callTool({
         name,
         arguments:
-          name === "report_view_artifact"
+          name === "report_view_file_url"
             ? {
                 instrumentId: "test-plate-reader",
                 runId: "run-1",
-                suffix: "_aunty_plate.json",
+                fileId: 42,
               }
-            : name === "report_view_table"
-              ? {
-                  instrumentId: "test-plate-reader",
-                  runId: "run-1",
-                  fileId: 42,
-                }
-              : {
-                  instrumentId: "test-plate-reader",
-                  runId: "run-1",
-                  kind: "image",
-                },
+            : {
+                instrumentId: "test-plate-reader",
+                runId: "run-1",
+                kind: "image",
+              },
       });
       expect(result.isError).toBe(true);
       const text = (result.content as Array<{ type: string; text: string }>)[0]
@@ -1732,7 +1722,11 @@ describe("MCP Protocol (in-memory)", () => {
     expect(readMeta?.ui?.csp?.frameDomains).toEqual(
       expect.arrayContaining(["http://localhost:3000"])
     );
-    expect(readMeta?.ui?.csp?.connectDomains).toEqual([]);
+    // The View reads CSV and JSON bodies straight from S3, so `connect-src`
+    // carries the same origins rather than being empty.
+    expect(readMeta?.ui?.csp?.connectDomains).toEqual(
+      readMeta?.ui?.csp?.frameDomains
+    );
   });
 
   it("reads the glossary resource", async () => {
diff --git a/web/tests/unit/mcp-data-source.test.ts b/web/tests/unit/mcp-data-source.test.ts
index 1b41c403..6cc92d26 100644
--- a/web/tests/unit/mcp-data-source.test.ts
+++ b/web/tests/unit/mcp-data-source.test.ts
@@ -20,12 +20,21 @@ function errorResult(message: string): CallToolResult {
   } as CallToolResult;
 }
 
+function makeSource(callServerTool: unknown) {
+  return createMcpReportDataSource({
+    app: { callServerTool } as unknown as App,
+    instrumentId: "inst",
+    runId: "run",
+  });
+}
+
 describe("createMcpReportDataSource", () => {
   afterEach(() => {
     vi.useRealTimers();
+    vi.unstubAllGlobals();
   });
 
-  it("peeks a cached URL and refreshes after the TTL", async () => {
+  it("peeks a cached URL and drops it after the TTL", async () => {
     vi.useFakeTimers();
     vi.setSystemTime(new Date("2026-01-01T00:00:00Z"));
     const callServerTool = vi.fn().mockResolvedValue(
@@ -36,17 +45,9 @@ describe("createMcpReportDataSource", () => {
         pagination: { limit: 1, offset: 0, total: 1 },
       })
     );
-    const source = createMcpReportDataSource({
-      app: { callServerTool } as unknown as App,
-      instrumentId: "inst",
-      runId: "run",
-    });
+    const source = makeSource(callServerTool);
 
-    await source.fetchReportItems({
-      kind: "image",
-      offset: 0,
-      limit: 1,
-    });
+    await source.fetchReportItems({ kind: "image", offset: 0, limit: 1 });
     expect(source.peekFileUrl?.(7)).toBe("https://s3.example/a");
     expect(await source.resolveFileUrl(7)).toBe("https://s3.example/a");
     expect(callServerTool).toHaveBeenCalledTimes(1);
@@ -55,64 +56,92 @@ describe("createMcpReportDataSource", () => {
     expect(source.peekFileUrl?.(7)).toBeNull();
   });
 
-  it("loads a CSV once with full:true and pages from memory", async () => {
-    const rows = Array.from({ length: 5 }, (_, i) => ({ n: String(i) }));
+  // One call, not one per item kind: the tool takes a file id directly.
+  it("resolves an uncached file id with a single tool call", async () => {
+    const callServerTool = vi
+      .fn()
+      .mockResolvedValue(
+        okResult({ id: 3, filename: "wells.csv", url: "https://s3.example/w" })
+      );
+    const source = makeSource(callServerTool);
+
+    expect(await source.resolveFileUrl(3)).toBe("https://s3.example/w");
+    expect(callServerTool).toHaveBeenCalledTimes(1);
+    expect(callServerTool.mock.calls[0][0]).toMatchObject({
+      name: "report_view_file_url",
+      arguments: { instrumentId: "inst", runId: "run", fileId: 3 },
+    });
+
+    // Second read is served from the cache.
+    expect(await source.resolveFileUrl(3)).toBe("https://s3.example/w");
+    expect(callServerTool).toHaveBeenCalledTimes(1);
+  });
+
+  it("reads CSV bytes from S3 rather than through a tool", async () => {
+    const callServerTool = vi
+      .fn()
+      .mockResolvedValue(
+        okResult({ id: 9, filename: "wells.csv", url: "https://s3.example/w" })
+      );
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      text: async () => "n\n0\n1\n2\n",
+    });
+    vi.stubGlobal("fetch", fetchMock);
+    const source = makeSource(callServerTool);
+
+    const first = await source.fetchTableRows(9);
+    const second = await source.fetchTableRows(9);
+
+    expect(fetchMock).toHaveBeenCalledWith("https://s3.example/w");
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(callServerTool).toHaveBeenCalledTimes(1);
+    expect(first.columns).toEqual(["n"]);
+    expect(first.rows).toEqual([{ n: "0" }, { n: "1" }, { n: "2" }]);
+    expect(second).toBe(first);
+  });
+
+  it("resolves a file by suffix and caches its URL under the returned id", async () => {
     const callServerTool = vi.fn().mockResolvedValue(
       okResult({
-        columns: ["n"],
-        rows,
-        total: 5,
-        truncated: false,
+        id: 11,
+        filename: "r_aunty_curves.csv",
+        url: "https://s3.example/c",
       })
     );
-    const source = createMcpReportDataSource({
-      app: { callServerTool } as unknown as App,
-      instrumentId: "inst",
-      runId: "run",
-    });
+    const source = makeSource(callServerTool);
 
-    const first = await source.fetchTable({ fileId: 9, offset: 0, limit: 2 });
-    const second = await source.fetchTable({ fileId: 9, offset: 2, limit: 2 });
-
-    expect(callServerTool).toHaveBeenCalledTimes(1);
+    const ref = await source.resolveFileBySuffix?.("_aunty_curves.csv");
+    expect(ref).toEqual({
+      id: 11,
+      filename: "r_aunty_curves.csv",
+      url: "https://s3.example/c",
+    });
     expect(callServerTool.mock.calls[0][0]).toMatchObject({
-      name: "report_view_table",
-      arguments: { fileId: 9, full: true },
+      arguments: { suffix: "_aunty_curves.csv" },
     });
-    expect(first.rows).toEqual([{ n: "0" }, { n: "1" }]);
-    expect(second.rows).toEqual([{ n: "2" }, { n: "3" }]);
-    expect(first.truncated).toBe(false);
+    expect(source.peekFileUrl?.(11)).toBe("https://s3.example/c");
   });
 
-  it("keeps a successful URL when another kind lookup fails", async () => {
-    const callServerTool = vi.fn(
-      ({
-        name,
-        arguments: args,
-      }: {
-        name: string;
-        arguments: { kind?: string };
-      }) => {
-        if (name === "report_view_items" && args.kind === "image") {
-          return okResult({
-            data: [
-              { id: 3, filename: "a.png", downloadUrl: "https://s3.example/a" },
-            ],
-            pagination: { limit: 1, offset: 0, total: 1 },
-          });
-        }
-        return errorResult("boom");
-      }
+  it("surfaces the tool's error text", async () => {
+    const source = makeSource(
+      vi.fn().mockResolvedValue(errorResult("File '3' not found on run 'run'."))
     );
-    const source = createMcpReportDataSource({
-      app: { callServerTool } as unknown as App,
-      instrumentId: "inst",
-      runId: "run",
-    });
+    await expect(source.resolveFileUrl(3)).rejects.toThrow(/not found on run/);
+  });
 
-    await expect(source.resolveFileUrl(3)).resolves.toBe(
-      "https://s3.example/a"
+  it("surfaces a failed S3 read", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue({ ok: false, status: 403 })
+    );
+    const source = makeSource(
+      vi
+        .fn()
+        .mockResolvedValue(
+          okResult({ id: 9, filename: "w.csv", url: "https://s3.example/w" })
+        )
     );
-    expect(callServerTool).toHaveBeenCalledTimes(4);
+    await expect(source.fetchTableRows(9)).rejects.toThrow(/HTTP 403/);
   });
 });
diff --git a/web/tests/unit/mcp-parse-csv-page.test.ts b/web/tests/unit/mcp-parse-csv-page.test.ts
deleted file mode 100644
index 6507cc02..00000000
--- a/web/tests/unit/mcp-parse-csv-page.test.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-import { Readable } from "node:stream";
-import { describe, expect, it } from "vitest";
-import { parseCsvPageFromStream } from "@/lib/runs/parse-csv-page";
-
-function csvStream(text: string): Readable {
-  return Readable.from([Buffer.from(text)]);
-}
-
-describe("parseCsvPageFromStream", () => {
-  const csv = "col_a,col_b\n1,2\n3,4\n5,6\n7,8\n";
-
-  it("pages from an offset and reports the scanned total", async () => {
-    const page = await parseCsvPageFromStream(csvStream(csv), 1, 2);
-    expect(page.columns).toEqual(["col_a", "col_b"]);
-    expect(page.rows).toEqual([
-      { col_a: "3", col_b: "4" },
-      { col_a: "5", col_b: "6" },
-    ]);
-    expect(page.total).toBe(4);
-    expect(page.truncated).toBe(false);
-  });
-
-  it("clamps the returned rows to limit", async () => {
-    const page = await parseCsvPageFromStream(csvStream(csv), 0, 1);
-    expect(page.rows).toEqual([{ col_a: "1", col_b: "2" }]);
-    expect(page.total).toBe(4);
-  });
-
-  it("stops at the scan cap and sets truncated", async () => {
-    const page = await parseCsvPageFromStream(csvStream(csv), 0, 50, 2);
-    expect(page.rows).toEqual([
-      { col_a: "1", col_b: "2" },
-      { col_a: "3", col_b: "4" },
-    ]);
-    expect(page.total).toBe(2);
-    expect(page.truncated).toBe(true);
-  });
-});
diff --git a/web/tests/unit/mcp-report-views.test.ts b/web/tests/unit/mcp-report-views.test.ts
index a3671194..fc2e8c22 100644
--- a/web/tests/unit/mcp-report-views.test.ts
+++ b/web/tests/unit/mcp-report-views.test.ts
@@ -3,6 +3,7 @@ import { InMemoryTransport, McpServer } from "@modelcontextprotocol/server";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 const MOCK_RUN_UUID = "11111111-1111-4111-a111-111111111111";
+const OTHER_RUN_UUID = "22222222-2222-4222-b222-222222222222";
 
 vi.mock("@/lib/auth", () => ({
   authBaseURL: "http://localhost:3000",
@@ -23,8 +24,6 @@ vi.mock("@/lib/api/instrument-runs", () => ({
       ? { id: MOCK_RUN_UUID, instrumentId: "test-plate-reader", runId: "run-1" }
       : null
   ),
-  getRunReportFiles: vi.fn(),
-  getAuntyPlateData: vi.fn(),
 }));
 
 vi.mock("@/lib/api/report-items", () => ({
@@ -34,7 +33,6 @@ vi.mock("@/lib/api/report-items", () => ({
 vi.mock("@/lib/api/files", () => ({
   getActiveFileById: vi.fn(),
   getActiveFilesByIds: vi.fn(),
-  lookupFileForDownload: vi.fn(),
   findActiveFileBySuffix: vi.fn(),
 }));
 
@@ -42,27 +40,16 @@ vi.mock("@/lib/s3", () => ({
   getPresignedDownloadUrl: vi
     .fn()
     .mockResolvedValue("https://s3.example.com/signed"),
-  getS3ObjectStream: vi.fn(),
-}));
-
-vi.mock("@/lib/runs/parse-csv-page", () => ({
-  parseCsvPage: vi.fn(),
 }));
 
 import {
   findActiveFileBySuffix,
   getActiveFileById,
   getActiveFilesByIds,
-  lookupFileForDownload,
 } from "@/lib/api/files";
-import {
-  getAuntyPlateData,
-  getRunReportFiles,
-} from "@/lib/api/instrument-runs";
 import { getReportItemsPage } from "@/lib/api/report-items";
 import { registerReportViewTools } from "@/lib/mcp/tools/report-views";
-import { parseCsvPage } from "@/lib/runs/parse-csv-page";
-import { getS3ObjectStream } from "@/lib/s3";
+import { getPresignedDownloadUrl } from "@/lib/s3";
 
 function parseStructured(result: {
   structuredContent?: unknown;
@@ -80,6 +67,15 @@ function parseStructured(result: {
   return JSON.parse(block?.text ?? "{}") as Record<string, unknown>;
 }
 
+function errorText(result: { content: unknown }): string {
+  const block = (result.content as Array<{ type: string; text?: string }>).find(
+    (item) => item.type === "text"
+  );
+  return block?.text ?? "";
+}
+
+const RUN_ARGS = { instrumentId: "test-plate-reader", runId: "run-1" };
+
 describe("report_view tools (authenticated)", () => {
   let client: Client;
   let server: McpServer;
@@ -111,24 +107,16 @@ describe("report_view tools (authenticated)", () => {
       pagination: { limit: 50, offset: 0, total: 1 },
     });
     vi.mocked(getActiveFilesByIds).mockResolvedValue([
-      {
-        id: 42,
-        s3Bucket: "raw",
-        s3Key: "gel.png",
-      } as never,
+      { id: 42, s3Bucket: "raw", s3Key: "gel.png" } as never,
     ]);
 
     const result = await client.callTool({
       name: "report_view_items",
-      arguments: {
-        instrumentId: "test-plate-reader",
-        runId: "run-1",
-        kind: "image",
-      },
+      arguments: { ...RUN_ARGS, kind: "image" },
     });
+
     expect(result.isError).toBeFalsy();
-    const parsed = parseStructured(result);
-    expect(parsed.data).toEqual([
+    expect(parseStructured(result).data).toEqual([
       {
         id: 42,
         filename: "gel.png",
@@ -137,136 +125,110 @@ describe("report_view tools (authenticated)", () => {
     ]);
   });
 
-  it("report_view_table clamps limit and forwards offset", async () => {
+  it("report_view_file_url signs a file looked up by id", async () => {
     vi.mocked(getActiveFileById).mockResolvedValue({
       id: 42,
+      filename: "wells.csv",
       instrumentRunId: MOCK_RUN_UUID,
+      s3Bucket: "processed",
+      s3Key: "wells.csv",
     } as never);
-    vi.mocked(lookupFileForDownload).mockResolvedValue({
-      ok: true,
-      filename: "data.csv",
-      s3Bucket: "raw",
-      s3Key: "data.csv",
+
+    const result = await client.callTool({
+      name: "report_view_file_url",
+      arguments: { ...RUN_ARGS, fileId: 42 },
     });
-    vi.mocked(parseCsvPage).mockResolvedValue({
-      columns: ["n"],
-      rows: [{ n: "1" }],
-      total: 3,
-      truncated: false,
+
+    expect(result.isError).toBeFalsy();
+    expect(parseStructured(result)).toEqual({
+      id: 42,
+      filename: "wells.csv",
+      url: "https://s3.example.com/signed",
     });
+    expect(getPresignedDownloadUrl).toHaveBeenCalledWith(
+      "processed",
+      "wells.csv"
+    );
+  });
+
+  it("report_view_file_url signs a file looked up by suffix", async () => {
+    vi.mocked(findActiveFileBySuffix).mockResolvedValue({
+      id: 7,
+      filename: "run_aunty_plate.json",
+      instrumentRunId: MOCK_RUN_UUID,
+      s3Bucket: "processed",
+      s3Key: "run_aunty_plate.json",
+    } as never);
 
     const result = await client.callTool({
-      name: "report_view_table",
-      arguments: {
-        instrumentId: "test-plate-reader",
-        runId: "run-1",
-        fileId: 42,
-        offset: 2,
-        limit: 200,
-      },
+      name: "report_view_file_url",
+      arguments: { ...RUN_ARGS, suffix: "_aunty_plate.json" },
     });
+
     expect(result.isError).toBeFalsy();
-    expect(parseCsvPage).toHaveBeenCalledWith("raw", "data.csv", 2, 200);
+    expect(parseStructured(result).id).toBe(7);
+    expect(findActiveFileBySuffix).toHaveBeenCalledWith(
+      MOCK_RUN_UUID,
+      "_aunty_plate.json"
+    );
   });
 
-  it("report_view_table rejects a limit above the schema max", async () => {
+  // The id lookup is not run-scoped, so the handler has to check the run
+  // itself or a caller could read any file by guessing ids.
+  it("report_view_file_url refuses a file belonging to another run", async () => {
+    vi.mocked(getActiveFileById).mockResolvedValue({
+      id: 42,
+      filename: "secret.csv",
+      instrumentRunId: OTHER_RUN_UUID,
+      s3Bucket: "raw",
+      s3Key: "secret.csv",
+    } as never);
+
     const result = await client.callTool({
-      name: "report_view_table",
-      arguments: {
-        instrumentId: "test-plate-reader",
-        runId: "run-1",
-        fileId: 42,
-        limit: 201,
-      },
+      name: "report_view_file_url",
+      arguments: { ...RUN_ARGS, fileId: 42 },
     });
+
     expect(result.isError).toBe(true);
-    expect(parseCsvPage).not.toHaveBeenCalled();
+    expect(errorText(result)).toContain("not found on run");
+    expect(getPresignedDownloadUrl).not.toHaveBeenCalled();
   });
 
-  it("report_view_table full=true reads from row 0 up to the scan cap", async () => {
+  it("report_view_file_url reports a file with no bytes yet", async () => {
     vi.mocked(getActiveFileById).mockResolvedValue({
       id: 42,
+      filename: "pending.csv",
       instrumentRunId: MOCK_RUN_UUID,
+      s3Bucket: null,
+      s3Key: null,
     } as never);
-    vi.mocked(lookupFileForDownload).mockResolvedValue({
-      ok: true,
-      filename: "data.csv",
-      s3Bucket: "raw",
-      s3Key: "data.csv",
-    });
-    vi.mocked(parseCsvPage).mockResolvedValue({
-      columns: ["n"],
-      rows: [{ n: "1" }],
-      total: 50_000,
-      truncated: true,
-    });
 
     const result = await client.callTool({
-      name: "report_view_table",
-      arguments: {
-        instrumentId: "test-plate-reader",
-        runId: "run-1",
-        fileId: 42,
-        full: true,
-        offset: 99,
-        limit: 10,
-      },
+      name: "report_view_file_url",
+      arguments: { ...RUN_ARGS, fileId: 42 },
     });
-    expect(result.isError).toBeFalsy();
-    expect(parseCsvPage).toHaveBeenCalledWith("raw", "data.csv", 0, 50_000);
-    expect(parseStructured(result).truncated).toBe(true);
-  });
 
-  it("report_view_artifact returns Aunty plate data", async () => {
-    const plate = { plate: { wells: [] }, curvesFileId: 9 };
-    vi.mocked(getRunReportFiles).mockResolvedValue([
-      {
-        filename: "run-1_aunty_plate.json",
-        deletedAt: null,
-      } as never,
-    ]);
-    vi.mocked(getAuntyPlateData).mockResolvedValue(plate as never);
+    expect(result.isError).toBe(true);
+    expect(errorText(result)).toContain("has not been uploaded yet");
+  });
 
+  it("report_view_file_url requires an id or a suffix", async () => {
     const result = await client.callTool({
-      name: "report_view_artifact",
-      arguments: {
-        instrumentId: "test-plate-reader",
-        runId: "run-1",
-        suffix: "_aunty_plate.json",
-      },
-    });
-    expect(result.isError).toBeFalsy();
-    expect(parseStructured(result)).toMatchObject({
-      suffix: "_aunty_plate.json",
-      filename: "run-1_aunty_plate.json",
-      artifact: plate,
+      name: "report_view_file_url",
+      arguments: RUN_ARGS,
     });
-  });
 
-  it("report_view_artifact parses a JSON suffix file", async () => {
-    vi.mocked(findActiveFileBySuffix).mockResolvedValue({
-      filename: "run-1_meta.json",
-      s3Bucket: "raw",
-      s3Key: "run-1_meta.json",
-    } as never);
-    const { Readable } = await import("node:stream");
-    vi.mocked(getS3ObjectStream).mockResolvedValue(
-      Readable.from([Buffer.from('{"ok":true}')]) as never
-    );
+    expect(result.isError).toBe(true);
+    expect(errorText(result)).toContain("Pass either");
+  });
 
+  it("report_view_file_url reports an unknown run", async () => {
     const result = await client.callTool({
-      name: "report_view_artifact",
-      arguments: {
-        instrumentId: "test-plate-reader",
-        runId: "run-1",
-        suffix: "_meta.json",
-      },
-    });
-    expect(result.isError).toBeFalsy();
-    expect(parseStructured(result)).toMatchObject({
-      suffix: "_meta.json",
-      filename: "run-1_meta.json",
-      artifact: { ok: true },
+      name: "report_view_file_url",
+      arguments: { ...RUN_ARGS, runId: "nope", fileId: 42 },
     });
+
+    expect(result.isError).toBe(true);
+    expect(errorText(result)).toContain("not found for instrument");
   });
 });
diff --git a/web/tests/unit/mcp-ui-csp.test.ts b/web/tests/unit/mcp-ui-csp.test.ts
index e95e2746..6020aae6 100644
--- a/web/tests/unit/mcp-ui-csp.test.ts
+++ b/web/tests/unit/mcp-ui-csp.test.ts
@@ -11,21 +11,35 @@ describe("runReportUiMeta", () => {
     vi.unstubAllEnvs();
   });
 
-  it("names both bucket origins and leaves connectDomains empty", () => {
+  // A run's files split across both buckets, so leaving either one out breaks
+  // half the report.
+  it("names the raw and processed bucket origins", () => {
     vi.stubEnv("NODE_ENV", "production");
     vi.stubEnv("LOCAL_S3_MIRROR", "");
     vi.stubEnv("AWS_REGION", "us-west-1");
     vi.stubEnv("S3_RAW_DATA_BUCKET", "raw-bucket");
-    vi.stubEnv("S3_ARCHIVES_BUCKET", "archives-bucket");
+    vi.stubEnv("S3_PROCESSED_BUCKET", "processed-bucket");
 
-    const meta = runReportUiMeta();
-    expect(meta.ui.csp.resourceDomains).toEqual([
+    const csp = runReportUiMeta().ui.csp;
+    expect(csp.resourceDomains).toEqual([
       "https://raw-bucket.s3.us-west-1.amazonaws.com",
-      "https://archives-bucket.s3.us-west-1.amazonaws.com",
+      "https://processed-bucket.s3.us-west-1.amazonaws.com",
     ]);
-    expect(meta.ui.csp.frameDomains).toEqual(meta.ui.csp.resourceDomains);
-    expect(meta.ui.csp.connectDomains).toEqual([]);
-    expect(meta.ui.prefersBorder).toBe(true);
+    expect(csp.frameDomains).toEqual(csp.resourceDomains);
+    // The View reads CSV and JSON bodies from S3 itself.
+    expect(csp.connectDomains).toEqual(csp.resourceDomains);
+    expect(runReportUiMeta().ui.prefersBorder).toBe(true);
+  });
+
+  it("leaves the archives bucket out", () => {
+    vi.stubEnv("NODE_ENV", "production");
+    vi.stubEnv("LOCAL_S3_MIRROR", "");
+    vi.stubEnv("S3_RAW_DATA_BUCKET", "raw-bucket");
+    vi.stubEnv("S3_ARCHIVES_BUCKET", "archives-bucket");
+
+    expect(runReportUiMeta().ui.csp.resourceDomains).not.toContain(
+      "https://archives-bucket.s3.us-west-1.amazonaws.com"
+    );
   });
 
   it("adds local origins outside production", () => {
diff --git a/web/tests/unit/rest-report-data-source.test.ts b/web/tests/unit/rest-report-data-source.test.ts
index 77d8269c..f8592021 100644
--- a/web/tests/unit/rest-report-data-source.test.ts
+++ b/web/tests/unit/rest-report-data-source.test.ts
@@ -1,7 +1,5 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { fetchAllTableRows } from "@/lib/runs/report-table";
 import { createRestReportDataSource } from "@/lib/runs/rest-report-data-source";
-import type { ReportDataSource } from "@/lib/runs/view-data-source";
 
 describe("createRestReportDataSource", () => {
   afterEach(() => {
@@ -37,7 +35,7 @@ describe("createRestReportDataSource", () => {
     expect(source.peekFileUrl?.(42)).toBe("/api/v1/files/42/download");
   });
 
-  it("parses a CSV once, then serves paginated slices from cache", async () => {
+  it("parses a CSV once and caches every row", async () => {
     const fetchMock = vi.fn().mockResolvedValue({
       ok: true,
       text: async () => "col_a,col_b\n1,2\n3,4\n5,6\n",
@@ -49,9 +47,10 @@ describe("createRestReportDataSource", () => {
       runId: "run-1",
     });
 
-    const first = await source.fetchTable({ fileId: 9, offset: 0, limit: 2 });
-    const second = await source.fetchTable({ fileId: 9, offset: 2, limit: 2 });
+    const first = await source.fetchTableRows(9);
+    const second = await source.fetchTableRows(9);
 
+    // Bytes come straight from S3 via the 302, and only once per file.
     expect(fetchMock).toHaveBeenCalledTimes(1);
     expect(fetchMock).toHaveBeenCalledWith("/api/v1/files/9/download");
     expect(first).toEqual({
@@ -59,74 +58,33 @@ describe("createRestReportDataSource", () => {
       rows: [
         { col_a: "1", col_b: "2" },
         { col_a: "3", col_b: "4" },
+        { col_a: "5", col_b: "6" },
       ],
-      total: 3,
     });
-    expect(second.rows).toEqual([{ col_a: "5", col_b: "6" }]);
-    expect(second.total).toBe(3);
+    expect(second).toBe(first);
   });
 
-  it("rejects fetchArtifact because no browser REST route exists", async () => {
+  it("reports an empty CSV as no columns and no rows", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue({ ok: true, text: async () => "" })
+    );
+
     const source = createRestReportDataSource({
       instrumentId: "inst-1",
       runId: "run-1",
     });
-    await expect(
-      source.fetchArtifact({ suffix: "_aunty_plate.json" })
-    ).rejects.toThrow(/not available over REST/);
-  });
-});
-
-describe("fetchAllTableRows", () => {
-  it("walks paginated fetchTable until every row is collected", async () => {
-    const pages = [
-      {
-        columns: ["n"],
-        rows: [{ n: "1" }, { n: "2" }],
-        total: 3,
-      },
-      {
-        columns: ["n"],
-        rows: [{ n: "3" }],
-        total: 3,
-      },
-    ];
-    const dataSource: Pick<ReportDataSource, "fetchTable"> = {
-      fetchTable: vi.fn(({ offset }) =>
-        Promise.resolve(pages[offset === 0 ? 0 : 1])
-      ),
-    };
-
-    const result = await fetchAllTableRows(
-      dataSource as ReportDataSource,
-      7,
-      2
-    );
 
-    expect(result.rows.map((r) => r.n)).toEqual(["1", "2", "3"]);
-    expect(result.truncated).toBe(false);
-    expect(dataSource.fetchTable).toHaveBeenCalledTimes(2);
+    expect(await source.fetchTableRows(9)).toEqual({ columns: [], rows: [] });
   });
 
-  it("marks the table truncated when paging stops short of total", async () => {
-    const dataSource: Pick<ReportDataSource, "fetchTable"> = {
-      fetchTable: vi.fn(({ offset }) =>
-        Promise.resolve({
-          columns: ["n"],
-          rows: offset === 0 ? [{ n: "1" }] : [],
-          total: 5,
-          truncated: true,
-        })
-      ),
-    };
-
-    const result = await fetchAllTableRows(
-      dataSource as ReportDataSource,
-      7,
-      1
-    );
-
-    expect(result.rows).toEqual([{ n: "1" }]);
-    expect(result.truncated).toBe(true);
+  // The web app resolves artifacts on the server and passes them into the
+  // page, so only the View implements the suffix lookup.
+  it("does not implement resolveFileBySuffix", () => {
+    const source = createRestReportDataSource({
+      instrumentId: "inst-1",
+      runId: "run-1",
+    });
+    expect(source.resolveFileBySuffix).toBeUndefined();
   });
 });

From b01ab2e3697fd9ca581713efc146a0ba98f564a1 Mon Sep 17 00:00:00 2001
From: Wasim Amiri <7220175+wasimxyz@users.noreply.github.com>
Date: Sat, 29 Aug 2026 21:17:27 -0700
Subject: [PATCH 5/6] Fix local CORS and layout so the run-report View can show
 full-width plate maps.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 developer-docs/mcp-apps.md                    |   2 +-
 .../api/local-s3/[bucket]/[...key]/route.ts   |  82 ++++++++------
 .../runs/aunty/aunty-plate-grid.tsx           |   4 +-
 web/components/runs/plate-map-grid.tsx        | 102 +++++++++++-------
 web/components/runs/run-section-card.tsx      |   8 +-
 web/components/runs/run-section-heading.tsx   |  43 +++++++-
 .../runs/variants/plate-reader-run-detail.tsx |   2 +-
 web/lib/mcp/run-report-html.ts                |  12 ++-
 web/lib/s3-local-mirror-cors.ts               |  28 +++++
 web/mcp-apps/run-report.css                   |   5 +-
 web/mcp-apps/run-report/app.tsx               |  59 +++++-----
 web/mcp-apps/run-report/host-bridge.ts        |  20 ++--
 web/mcp-apps/run-report/instrument-report.tsx |  54 ++++++++--
 .../unit/mcp-container-dimensions.test.ts     |   9 ++
 web/tests/unit/mcp-run-report-html.test.ts    |  21 ++++
 web/tests/unit/s3-local-mirror-cors.test.ts   |  31 ++++++
 16 files changed, 346 insertions(+), 136 deletions(-)
 create mode 100644 web/lib/s3-local-mirror-cors.ts
 create mode 100644 web/tests/unit/s3-local-mirror-cors.test.ts

diff --git a/developer-docs/mcp-apps.md b/developer-docs/mcp-apps.md
index aada421e..bd02f6e5 100644
--- a/developer-docs/mcp-apps.md
+++ b/developer-docs/mcp-apps.md
@@ -144,7 +144,7 @@ The built file is gitignored. Self-hosters and CI must run that step (or `npm ru
 
 Browser-based hosts reach `/mcp/v1` from a different origin, so `web/lib/mcp/cors.ts` sends `Access-Control-Allow-Origin: *` on that route and answers preflight requests. The route authenticates with a Bearer token only and never sets `Access-Control-Allow-Credentials`, so a browser will not attach a session cookie to those requests.
 
-`web/proxy.ts` also lets `/api/local-s3` through without a session, because the View loads file bytes from a cross-origin sandbox that has no cookie. That route returns 404 whenever `NODE_ENV` is `production` or `LOCAL_S3_MIRROR` is unset, so it cannot expose anything on a real deploy.
+`web/proxy.ts` also lets `/api/local-s3` through without a session, because the View loads file bytes from a cross-origin sandbox that has no cookie. That route returns 404 whenever `NODE_ENV` is `production` or `LOCAL_S3_MIRROR` is unset, so it cannot expose anything on a real deploy. GET and HEAD send the same `*` CORS headers as the S3 buckets; without them a `fetch` of a plate-reader CSV or Aunty JSON fails with "Failed to fetch" even though the file is public.
 
 ## Content security policy
 
diff --git a/web/app/api/local-s3/[bucket]/[...key]/route.ts b/web/app/api/local-s3/[bucket]/[...key]/route.ts
index 22935309..a162fea8 100644
--- a/web/app/api/local-s3/[bucket]/[...key]/route.ts
+++ b/web/app/api/local-s3/[bucket]/[...key]/route.ts
@@ -3,6 +3,9 @@
 // bytes there on PUT. The matching dispatch lives in `web/lib/s3-local-mirror.ts`,
 // which `web/lib/s3.ts` calls into when the env var is set.
 //
+// GET/HEAD (and 404s) carry `*` CORS so the MCP Apps sandbox can `fetch`
+// CSV/JSON the same way it reads the real buckets. PUT stays same-origin.
+//
 // Gating: `getLocalMirrorRoot()` returns `null` whenever
 // `NODE_ENV === "production"` OR `LOCAL_S3_MIRROR` is unset. All
 // handlers short-circuit to a 404 in that case, so a production
@@ -26,12 +29,21 @@ import {
   parseByteRange,
   resolveMirrorPath,
 } from "@/lib/s3-local-mirror";
+import {
+  localS3CorsPreflight,
+  withLocalS3Cors,
+} from "@/lib/s3-local-mirror-cors";
 
 interface RouteContext {
   params: Promise<{ bucket: string; key: string[] }>;
 }
 
-const NOT_FOUND_RESPONSE = () => new Response("Not Found", { status: 404 });
+const NOT_FOUND_RESPONSE = () =>
+  withLocalS3Cors(new Response("Not Found", { status: 404 }));
+
+export function OPTIONS() {
+  return localS3CorsPreflight();
+}
 
 async function locateMirrorFile(
   params: RouteContext["params"],
@@ -80,14 +92,16 @@ export async function GET(request: NextRequest, { params }: RouteContext) {
   const length = range.kind === "unsatisfiable" ? 0 : end - start + 1;
 
   if (range.kind === "unsatisfiable") {
-    return new Response("Range Not Satisfiable", {
-      status: 416,
-      headers: {
-        "Content-Range": `bytes */${fileSize}`,
-        "Accept-Ranges": "bytes",
-        "Cache-Control": "no-store",
-      },
-    });
+    return withLocalS3Cors(
+      new Response("Range Not Satisfiable", {
+        status: 416,
+        headers: {
+          "Content-Range": `bytes */${fileSize}`,
+          "Accept-Ranges": "bytes",
+          "Cache-Control": "no-store",
+        },
+      })
+    );
   }
 
   // `Readable.toWeb` returns the `node:stream/web` `ReadableStream` type,
@@ -98,19 +112,21 @@ export async function GET(request: NextRequest, { params }: RouteContext) {
     createReadStream(filePath, range.kind === "partial" ? { start, end } : {})
   ) as unknown as ReadableStream;
 
-  return new Response(body, {
-    status: range.kind === "partial" ? 206 : 200,
-    headers: {
-      "Content-Type": mimeFor(filePath),
-      "Content-Length": String(range.kind === "partial" ? length : fileSize),
-      "Accept-Ranges": "bytes",
-      ...(range.kind === "partial" && {
-        "Content-Range": `bytes ${start}-${end}/${fileSize}`,
-      }),
-      ...(disposition && { "Content-Disposition": disposition }),
-      "Cache-Control": "no-store",
-    },
-  });
+  return withLocalS3Cors(
+    new Response(body, {
+      status: range.kind === "partial" ? 206 : 200,
+      headers: {
+        "Content-Type": mimeFor(filePath),
+        "Content-Length": String(range.kind === "partial" ? length : fileSize),
+        "Accept-Ranges": "bytes",
+        ...(range.kind === "partial" && {
+          "Content-Range": `bytes ${start}-${end}/${fileSize}`,
+        }),
+        ...(disposition && { "Content-Disposition": disposition }),
+        "Cache-Control": "no-store",
+      },
+    })
+  );
 }
 
 // Safari (and some Chrome probes) send HEAD before Range GET. Mirror S3:
@@ -123,16 +139,18 @@ export async function HEAD(request: NextRequest, { params }: RouteContext) {
   const { filePath, fileSize } = located;
   const disposition = new URL(request.url).searchParams.get("disposition");
 
-  return new Response(null, {
-    status: 200,
-    headers: {
-      "Content-Type": mimeFor(filePath),
-      "Content-Length": String(fileSize),
-      "Accept-Ranges": "bytes",
-      ...(disposition && { "Content-Disposition": disposition }),
-      "Cache-Control": "no-store",
-    },
-  });
+  return withLocalS3Cors(
+    new Response(null, {
+      status: 200,
+      headers: {
+        "Content-Type": mimeFor(filePath),
+        "Content-Length": String(fileSize),
+        "Accept-Ranges": "bytes",
+        ...(disposition && { "Content-Disposition": disposition }),
+        "Cache-Control": "no-store",
+      },
+    })
+  );
 }
 
 export async function PUT(request: NextRequest, { params }: RouteContext) {
diff --git a/web/components/runs/aunty/aunty-plate-grid.tsx b/web/components/runs/aunty/aunty-plate-grid.tsx
index bb3c7f2b..f9c7bd3a 100644
--- a/web/components/runs/aunty/aunty-plate-grid.tsx
+++ b/web/components/runs/aunty/aunty-plate-grid.tsx
@@ -140,12 +140,12 @@ export const AuntyPlateGrid = memo(function AuntyPlateGrid({
   const wellTrack = wide ? "4rem" : "minmax(0, 1fr)";
 
   return (
-    <div className="flex min-w-0 flex-col gap-3">
+    <div className="flex w-full min-w-0 flex-col gap-3">
       {layout.byPos.size > 0 && (
         <div
           aria-label={`${experiment.fileName} plate`}
           className={cn(
-            "min-w-0 overflow-x-auto overscroll-x-contain",
+            "w-full min-w-0 overflow-x-auto overscroll-x-contain",
             wide &&
               "rounded-md outline-none focus-visible:ring-3 focus-visible:ring-ring/50"
           )}
diff --git a/web/components/runs/plate-map-grid.tsx b/web/components/runs/plate-map-grid.tsx
index 22e25739..a0482730 100644
--- a/web/components/runs/plate-map-grid.tsx
+++ b/web/components/runs/plate-map-grid.tsx
@@ -31,16 +31,15 @@ const COMPACT_PLATE_MAX_COLS = 12;
 /** Floor so 24-column plates stay readable instead of shrinking to fit. */
 const WIDE_PLATE_WELL_TRACK = "4rem";
 
-function plateColumnCount(wells: PlateWellData[]): number {
-  let maxCol = 0;
-  for (const w of wells) {
-    const pos = parseWell(w.well);
-    if (pos && pos.col > maxCol) {
-      maxCol = pos.col;
-    }
-  }
-  return maxCol + 1;
-}
+// `cqw` follows the plate box, not the viewport — the same map sits in a
+// wide run page and a narrow MCP iframe. Well text uses the plate, not the
+// cell: a cell container makes `cqw` cyclic with `aspect-square` tracks.
+const PLATE_META_TEXT = "text-[length:clamp(0.75rem,2.2cqw,0.875rem)]";
+const PLATE_AXIS_TEXT = "text-[length:clamp(0.5rem,1.8cqw,0.875rem)]";
+const PLATE_SCALE_TEXT = "text-[length:clamp(0.4375rem,1.6cqw,0.75rem)]";
+const PLATE_SLIDER_TEXT = "text-[length:clamp(0.625rem,1.8cqw,0.75rem)]";
+const WELL_VALUE_TEXT =
+  "text-[length:clamp(0.5rem,1.6cqw,0.75rem)] leading-none";
 
 function formatCellValue(value: unknown): string {
   if (value === null || value === undefined) {
@@ -179,19 +178,25 @@ export function PlateMapGrid({
 
   return (
     <div
-      className={cn(
-        "flex min-w-0 flex-col gap-3",
-        wide ? "w-full" : "w-3/4",
-        className
-      )}
+      className={cn("@container flex w-full min-w-0 flex-col gap-3", className)}
     >
       {(plateName || wavelength) && (
         <div className="flex min-w-0 items-baseline justify-between gap-4">
-          <h4 className="min-w-0 text-pretty font-medium font-mono text-foreground text-sm leading-snug">
+          <h4
+            className={cn(
+              "min-w-0 text-pretty font-medium font-mono text-foreground leading-snug",
+              PLATE_META_TEXT
+            )}
+          >
             {plateName}
           </h4>
           {wavelength && (
-            <span className="shrink-0 font-mono text-muted-foreground text-sm">
+            <span
+              className={cn(
+                "shrink-0 font-mono text-muted-foreground",
+                PLATE_META_TEXT
+              )}
+            >
               {wavelength} nm
             </span>
           )}
@@ -200,7 +205,7 @@ export function PlateMapGrid({
       <div
         aria-label={plateName ? `${plateName} plate map` : "Plate map"}
         className={cn(
-          "min-w-0 overflow-x-auto overscroll-x-contain",
+          "w-full min-w-0 overflow-x-auto overscroll-x-contain",
           wide &&
             "rounded-md outline-none focus-visible:ring-3 focus-visible:ring-ring/50"
         )}
@@ -223,7 +228,10 @@ export function PlateMapGrid({
           {/* Column headers */}
           {colLabels.map((c, ci) => (
             <div
-              className="py-1 font-medium text-muted-foreground text-sm"
+              className={cn(
+                "py-1 font-medium text-muted-foreground",
+                PLATE_AXIS_TEXT
+              )}
               key={c}
               style={{ gridRow: 1, gridColumn: ci + 2 }}
             >
@@ -235,7 +243,10 @@ export function PlateMapGrid({
           {rowLabels.map((rowLabel, ri) => (
             <Fragment key={rowLabel}>
               <div
-                className="flex items-center justify-center font-medium text-muted-foreground text-sm"
+                className={cn(
+                  "flex items-center justify-center font-medium text-muted-foreground",
+                  PLATE_AXIS_TEXT
+                )}
                 style={{ gridRow: ri + 2, gridColumn: 1 }}
               >
                 {rowLabel}
@@ -257,15 +268,15 @@ export function PlateMapGrid({
                   <Tooltip key={`${ri}-${ci}`}>
                     <TooltipTrigger asChild>
                       <div
-                        className={
+                        className={cn(
+                          "flex aspect-square w-full min-w-0 items-center justify-center overflow-hidden rounded font-mono tabular-nums",
+                          WELL_VALUE_TEXT,
                           useHeatmap
-                            ? "flex aspect-square items-center justify-center overflow-hidden rounded font-mono text-xs tabular-nums transition-colors"
-                            : `flex aspect-square items-center justify-center overflow-hidden rounded border font-mono text-sm tabular-nums ${
-                                hasValue
-                                  ? "border-border bg-muted/50"
-                                  : "border-transparent"
-                              }`
-                        }
+                            ? "transition-colors"
+                            : hasValue
+                              ? "border border-border bg-muted/50"
+                              : "border border-transparent"
+                        )}
                         style={{
                           gridRow: ri + 2,
                           gridColumn: ci + 2,
@@ -298,7 +309,10 @@ export function PlateMapGrid({
           {heatmap && hasRange && (
             <>
               <div
-                className="ml-4 flex items-end justify-center pb-0.5 text-muted-foreground text-xs"
+                className={cn(
+                  "ml-4 flex items-end justify-center pb-0.5 text-muted-foreground",
+                  PLATE_SCALE_TEXT
+                )}
                 style={{ gridRow: 1, gridColumn: cols + 3 }}
               >
                 <span className="font-mono tabular-nums">
@@ -315,7 +329,10 @@ export function PlateMapGrid({
                 }}
               />
               <div
-                className="ml-4 flex items-start justify-center pt-0.5 text-muted-foreground text-xs"
+                className={cn(
+                  "ml-4 flex items-start justify-center pt-0.5 text-muted-foreground",
+                  PLATE_SCALE_TEXT
+                )}
                 style={{ gridRow: rows + 2, gridColumn: cols + 3 }}
               >
                 <span className="font-mono tabular-nums">
@@ -395,12 +412,8 @@ export function PlateMapWithIndexSlider({
       ? (frameLabels[selectedIndex] ?? wavelength)
       : wavelength;
 
-  const wide = plateColumnCount(frames[0] ?? []) > COMPACT_PLATE_MAX_COLS;
-
   return (
-    <div
-      className={cn("flex min-w-0 flex-col gap-3", wide ? "w-full" : "w-3/4")}
-    >
+    <div className="@container flex w-full min-w-0 flex-col gap-3">
       <PlateMapGrid
         className="w-full"
         data={frames[selectedIndex]}
@@ -411,13 +424,21 @@ export function PlateMapWithIndexSlider({
       />
       {frames.length > 1 && (
         <div className="mt-3 flex items-center gap-2">
-          <span className="shrink-0 font-mono text-muted-foreground text-xs tabular-nums">
+          <span
+            className={cn(
+              "shrink-0 font-mono text-muted-foreground tabular-nums",
+              PLATE_SLIDER_TEXT
+            )}
+          >
             {frameLabels[0]}
           </span>
           <div className="relative min-w-0 flex-1">
             <div
               aria-hidden
-              className="pointer-events-none absolute bottom-full z-10 mb-1 -translate-x-1/2 whitespace-nowrap rounded-md bg-foreground px-1.5 py-0.5 font-mono text-background text-xs tabular-nums"
+              className={cn(
+                "pointer-events-none absolute bottom-full z-10 mb-1 -translate-x-1/2 whitespace-nowrap rounded-md bg-foreground px-1.5 py-0.5 font-mono text-background tabular-nums",
+                PLATE_SLIDER_TEXT
+              )}
               style={{ left: `${thumbPercent}%` }}
             >
               {frameLabels[selectedIndex] ?? "—"}
@@ -436,7 +457,12 @@ export function PlateMapWithIndexSlider({
               value={[selectedIndex]}
             />
           </div>
-          <span className="shrink-0 font-mono text-muted-foreground text-xs tabular-nums">
+          <span
+            className={cn(
+              "shrink-0 font-mono text-muted-foreground tabular-nums",
+              PLATE_SLIDER_TEXT
+            )}
+          >
             {frameLabels[maxIdx]}
           </span>
         </div>
diff --git a/web/components/runs/run-section-card.tsx b/web/components/runs/run-section-card.tsx
index 2d811ac4..1d4885f5 100644
--- a/web/components/runs/run-section-card.tsx
+++ b/web/components/runs/run-section-card.tsx
@@ -19,10 +19,12 @@ export function RunSectionCard({
   title: string;
 }) {
   return (
-    <div className={cn("flex flex-col gap-2", className)}>
+    <div className={cn("flex w-full min-w-0 flex-col gap-2", className)}>
       <RunSectionHeading countLabel={count} title={title} />
-      <Card size="sm">
-        <CardContent className={cn("flex flex-col gap-6", contentClassName)}>
+      <Card className="w-full min-w-0" size="sm">
+        <CardContent
+          className={cn("flex w-full min-w-0 flex-col gap-6", contentClassName)}
+        >
           {children}
         </CardContent>
       </Card>
diff --git a/web/components/runs/run-section-heading.tsx b/web/components/runs/run-section-heading.tsx
index e2ebdabf..6dca6c1b 100644
--- a/web/components/runs/run-section-heading.tsx
+++ b/web/components/runs/run-section-heading.tsx
@@ -1,13 +1,48 @@
+"use client";
+
+import { createContext, type ReactNode, use } from "react";
+
+const RunSectionActionsContext = createContext<ReactNode>(null);
+
+// The MCP View injects "Open in Data Hub" here so every instrument
+// renderer gets the link without an extra prop.
+export function RunSectionActionsProvider({
+  actions,
+  children,
+}: {
+  actions: ReactNode;
+  children: ReactNode;
+}) {
+  return (
+    <RunSectionActionsContext.Provider value={actions}>
+      {children}
+    </RunSectionActionsContext.Provider>
+  );
+}
+
 export function RunSectionHeading({
-  title,
+  actions,
   countLabel,
+  title,
 }: {
-  title: string;
+  actions?: ReactNode;
   countLabel?: string | number;
+  title: string;
 }) {
-  return (
-    <h2 className="font-semibold text-sm">
+  const injected = use(RunSectionActionsContext);
+  const resolved = actions ?? injected;
+  const heading = (
+    <h2 className="min-w-0 font-semibold text-sm">
       {countLabel == null ? title : `${title} (${countLabel})`}
     </h2>
   );
+  if (!resolved) {
+    return heading;
+  }
+  return (
+    <div className="flex w-full min-w-0 items-center justify-between gap-3">
+      {heading}
+      <div className="shrink-0">{resolved}</div>
+    </div>
+  );
 }
diff --git a/web/components/runs/variants/plate-reader-run-detail.tsx b/web/components/runs/variants/plate-reader-run-detail.tsx
index d2d0c93c..5b4ac5ef 100644
--- a/web/components/runs/variants/plate-reader-run-detail.tsx
+++ b/web/components/runs/variants/plate-reader-run-detail.tsx
@@ -49,7 +49,7 @@ function PlateMapSection({
       count={groups.length}
       title="Plate Maps"
     >
-      <div className="flex min-w-0 flex-col gap-10">
+      <div className="flex w-full min-w-0 flex-col gap-10">
         {groups.map((g, i) =>
           g.mode === "kinetic" ? (
             <PlateMapWithIndexSlider
diff --git a/web/lib/mcp/run-report-html.ts b/web/lib/mcp/run-report-html.ts
index a63d97a0..8793402a 100644
--- a/web/lib/mcp/run-report-html.ts
+++ b/web/lib/mcp/run-report-html.ts
@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
 import { authBaseURL } from "@/lib/auth";
 
@@ -64,6 +64,7 @@ export const HELLO_WORLD_RUN_REPORT_HTML = `<!DOCTYPE html>
 `;
 
 interface HtmlCache {
+  mtimeMs: number;
   origin: string;
   rendered: string;
 }
@@ -74,13 +75,18 @@ function withOrigin(html: string, origin: string): string {
   return html.replaceAll(DATA_HUB_ORIGIN_PLACEHOLDER, origin);
 }
 
+function artifactMtimeMs(): number {
+  return existsSync(BUILT_HTML_PATH) ? statSync(BUILT_HTML_PATH).mtimeMs : 0;
+}
+
 export function resetRunReportHtmlCache(): void {
   cached = null;
 }
 
 export function loadRunReportHtml(): string {
   const origin = authBaseURL.replace(/\/$/, "");
-  if (cached && cached.origin === origin) {
+  const mtimeMs = artifactMtimeMs();
+  if (cached && cached.origin === origin && cached.mtimeMs === mtimeMs) {
     return cached.rendered;
   }
 
@@ -97,6 +103,6 @@ export function loadRunReportHtml(): string {
   }
 
   const rendered = withOrigin(readFileSync(BUILT_HTML_PATH, "utf8"), origin);
-  cached = { origin, rendered };
+  cached = { origin, mtimeMs, rendered };
   return rendered;
 }
diff --git a/web/lib/s3-local-mirror-cors.ts b/web/lib/s3-local-mirror-cors.ts
new file mode 100644
index 00000000..cf6a6095
--- /dev/null
+++ b/web/lib/s3-local-mirror-cors.ts
@@ -0,0 +1,28 @@
+// Same `*` GET CORS the real buckets declare in `infra/template.yaml`.
+// The MCP Apps View `fetch`es CSV and JSON from `/api/local-s3` inside a
+// host-chosen sandbox origin, so the origin cannot be allowlisted.
+
+export const LOCAL_S3_CORS_HEADERS: Record<string, string> = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS",
+  "Access-Control-Allow-Headers": "*",
+  "Access-Control-Expose-Headers":
+    "ETag, Content-Length, Content-Range, Accept-Ranges",
+  "Access-Control-Max-Age": "3600",
+};
+
+export function localS3CorsPreflight(): Response {
+  return new Response(null, { status: 204, headers: LOCAL_S3_CORS_HEADERS });
+}
+
+export function withLocalS3Cors(response: Response): Response {
+  const headers = new Headers(response.headers);
+  for (const [key, value] of Object.entries(LOCAL_S3_CORS_HEADERS)) {
+    headers.set(key, value);
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
diff --git a/web/mcp-apps/run-report.css b/web/mcp-apps/run-report.css
index 4c848d6e..4f2c933d 100644
--- a/web/mcp-apps/run-report.css
+++ b/web/mcp-apps/run-report.css
@@ -35,10 +35,13 @@
 
 /* Do not set min-height: 100% here. The SDK measures html with
    height: max-content; stretching to the host-set iframe height made
-   that measurement follow the iframe and loop on size-changed. */
+   that measurement follow the iframe and loop on size-changed. Width
+   is safe: size-changed reports `window.innerWidth`, not content width. */
 html,
 body,
 #root {
+  width: 100%;
+  max-width: 100%;
   margin: 0;
   color: var(--foreground);
   background: var(--background);
diff --git a/web/mcp-apps/run-report/app.tsx b/web/mcp-apps/run-report/app.tsx
index e38d6920..987186ed 100644
--- a/web/mcp-apps/run-report/app.tsx
+++ b/web/mcp-apps/run-report/app.tsx
@@ -1,8 +1,10 @@
 import type { App } from "@modelcontextprotocol/ext-apps";
 import { useApp, useHostStyles } from "@modelcontextprotocol/ext-apps/react";
 import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import { ExternalLink } from "lucide-react";
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { ReportDataSourceProvider } from "@/components/runs/report-data-source-provider";
+import { RunSectionActionsProvider } from "@/components/runs/run-section-heading";
 import { runDetailUrl } from "./data-hub-origin";
 import {
   persistKey,
@@ -115,22 +117,6 @@ function ConnectedReport({
     };
   }, [app]);
 
-  const openRun = useCallback(async () => {
-    const url = runDetailUrl(result.instrumentId, result.runId);
-    if (app.getHostCapabilities()?.openLinks) {
-      try {
-        const response = await app.openLink({ url });
-        if (response.isError) {
-          setLinkFallback(url);
-        }
-      } catch {
-        setLinkFallback(url);
-      }
-      return;
-    }
-    setLinkFallback(url);
-  }, [app, result.instrumentId, result.runId]);
-
   const toggleFullscreen = useCallback(async () => {
     const hostModes = app.getHostContext()?.availableDisplayModes ?? [];
     const next = displayMode === "inline" ? "fullscreen" : "inline";
@@ -149,21 +135,22 @@ function ConnectedReport({
     app.getHostContext()?.availableDisplayModes ?? []
   ).includes(displayMode === "inline" ? "fullscreen" : "inline");
 
+  const openInDataHub = (
+    <a
+      className="inline-flex items-center gap-1.5 font-semibold text-sm hover:underline"
+      href={runDetailUrl(result.instrumentId, result.runId)}
+      rel="noopener noreferrer"
+      target="_blank"
+    >
+      Open in Data Hub
+      <ExternalLink aria-hidden="true" className="size-3.5" />
+    </a>
+  );
+
   return (
-    <div className="flex flex-col gap-3 p-3">
-      <div className="flex flex-wrap items-center gap-2">
-        <button
-          className="rounded-md border px-2 py-1 text-sm"
-          onClick={() => {
-            void openRun().catch(() => {
-              setLinkFallback(runDetailUrl(result.instrumentId, result.runId));
-            });
-          }}
-          type="button"
-        >
-          Open in Data Hub
-        </button>
-        {canToggle ? (
+    <div className="flex w-full min-w-0 flex-col gap-3 p-3">
+      {canToggle ? (
+        <div className="flex flex-wrap items-center justify-end gap-2">
           <button
             className="rounded-md border px-2 py-1 text-sm"
             onClick={() => {
@@ -175,16 +162,18 @@ function ConnectedReport({
           >
             {displayMode === "fullscreen" ? "Exit fullscreen" : "Fullscreen"}
           </button>
-        ) : null}
-      </div>
+        </div>
+      ) : null}
       {linkFallback ? (
         <p className="break-all text-muted-foreground text-xs">
           {linkFallback}
         </p>
       ) : null}
-      <ReportDataSourceProvider dataSource={dataSource}>
-        <InstrumentReport persistKey={storageKey} result={result} />
-      </ReportDataSourceProvider>
+      <RunSectionActionsProvider actions={openInDataHub}>
+        <ReportDataSourceProvider dataSource={dataSource}>
+          <InstrumentReport persistKey={storageKey} result={result} />
+        </ReportDataSourceProvider>
+      </RunSectionActionsProvider>
     </div>
   );
 }
diff --git a/web/mcp-apps/run-report/host-bridge.ts b/web/mcp-apps/run-report/host-bridge.ts
index e85c2dbe..4e8b1d57 100644
--- a/web/mcp-apps/run-report/host-bridge.ts
+++ b/web/mcp-apps/run-report/host-bridge.ts
@@ -48,16 +48,18 @@ export function documentStylesForContainerDimensions(
     styles.overflow = "auto";
   }
 
-  if ("width" in dimensions && typeof dimensions.width === "number") {
-    // Fill the host-controlled iframe. `100vw` includes the scrollbar gutter
-    // and can start a horizontal overflow loop with `overflow: auto`.
-    styles.width = "100%";
-  } else if (
-    "maxWidth" in dimensions &&
-    typeof dimensions.maxWidth === "number" &&
-    dimensions.maxWidth > 0
+  // The host already sized the iframe. `maxWidth` is a hint about that
+  // container, not a box we should paint inside a wider frame — applying it
+  // left a gap around plate maps in Cursor's inline View.
+  if (
+    ("width" in dimensions && typeof dimensions.width === "number") ||
+    ("maxWidth" in dimensions &&
+      typeof dimensions.maxWidth === "number" &&
+      dimensions.maxWidth > 0)
   ) {
-    styles.maxWidth = `${dimensions.maxWidth}px`;
+    // `100vw` includes the scrollbar gutter and can start a horizontal
+    // overflow loop with `overflow: auto`.
+    styles.width = "100%";
   }
 
   return styles;
diff --git a/web/mcp-apps/run-report/instrument-report.tsx b/web/mcp-apps/run-report/instrument-report.tsx
index ea34a4db..328feaa5 100644
--- a/web/mcp-apps/run-report/instrument-report.tsx
+++ b/web/mcp-apps/run-report/instrument-report.tsx
@@ -15,6 +15,7 @@ import {
 import type { ReportSectionFile } from "@/components/runs/run-report-section";
 import { RunReportSection } from "@/components/runs/run-report-section";
 import { RunSectionCard } from "@/components/runs/run-section-card";
+import { RunSectionHeading } from "@/components/runs/run-section-heading";
 import { VideoCarouselReport } from "@/components/runs/video-carousel-report";
 import type { RawWellRow } from "@/lib/api/instrument-runs";
 import type { InstrumentType } from "@/lib/db/schema";
@@ -175,10 +176,18 @@ function CarouselKindReport({
   }, [dataSource, kind, persistKey]);
 
   if (error) {
-    return <p className="text-destructive text-sm">{error}</p>;
+    return (
+      <ReportHeadingStatus>
+        <p className="text-destructive text-sm">{error}</p>
+      </ReportHeadingStatus>
+    );
   }
   if (!page) {
-    return <p className="text-muted-foreground text-sm">Loading…</p>;
+    return (
+      <ReportHeadingStatus>
+        <p className="text-muted-foreground text-sm">Loading…</p>
+      </ReportHeadingStatus>
+    );
   }
   return (
     <ReportPersistKeyProvider persistKey={persistKey}>
@@ -203,10 +212,18 @@ function AuntyReport() {
   }, [dataSource]);
 
   if (error) {
-    return <p className="text-destructive text-sm">{error}</p>;
+    return (
+      <ReportHeadingStatus>
+        <p className="text-destructive text-sm">{error}</p>
+      </ReportHeadingStatus>
+    );
   }
   if (!plate) {
-    return <p className="text-muted-foreground text-sm">Loading…</p>;
+    return (
+      <ReportHeadingStatus>
+        <p className="text-muted-foreground text-sm">Loading…</p>
+      </ReportHeadingStatus>
+    );
   }
   return (
     <AuntyPlateReport curvesFileId={plate.curvesFileId} plate={plate.plate} />
@@ -258,10 +275,18 @@ function PlateReaderReport({ result }: { result: RunReportToolResult }) {
   );
 
   if (error) {
-    return <p className="text-destructive text-sm">{error}</p>;
+    return (
+      <ReportHeadingStatus title="Plate Maps">
+        <p className="text-destructive text-sm">{error}</p>
+      </ReportHeadingStatus>
+    );
   }
   if (rows === null) {
-    return <p className="text-muted-foreground text-sm">Loading…</p>;
+    return (
+      <ReportHeadingStatus title="Plate Maps">
+        <p className="text-muted-foreground text-sm">Loading…</p>
+      </ReportHeadingStatus>
+    );
   }
   if (rows.length === 0 || groups.length === 0) {
     return (
@@ -280,7 +305,7 @@ function PlateReaderReport({ result }: { result: RunReportToolResult }) {
       count={groups.length}
       title="Plate Maps"
     >
-      <div className="flex min-w-0 flex-col gap-10">
+      <div className="flex w-full min-w-0 flex-col gap-10">
         {groups.map((group, index) =>
           group.mode === "kinetic" ? (
             <PlateMapWithIndexSlider
@@ -306,3 +331,18 @@ function PlateReaderReport({ result }: { result: RunReportToolResult }) {
     </RunSectionCard>
   );
 }
+
+function ReportHeadingStatus({
+  children,
+  title = "Report Data",
+}: {
+  children: ReactNode;
+  title?: string;
+}) {
+  return (
+    <div className="flex w-full min-w-0 flex-col gap-2">
+      <RunSectionHeading title={title} />
+      {children}
+    </div>
+  );
+}
diff --git a/web/tests/unit/mcp-container-dimensions.test.ts b/web/tests/unit/mcp-container-dimensions.test.ts
index c07dd397..0bc10124 100644
--- a/web/tests/unit/mcp-container-dimensions.test.ts
+++ b/web/tests/unit/mcp-container-dimensions.test.ts
@@ -41,4 +41,13 @@ describe("documentStylesForContainerDimensions", () => {
       overflow: "",
     });
   });
+
+  it("fills the iframe when the host only sends maxWidth", () => {
+    expect(
+      documentStylesForContainerDimensions({ maxWidth: 800 })
+    ).toMatchObject({
+      width: "100%",
+      maxWidth: "",
+    });
+  });
 });
diff --git a/web/tests/unit/mcp-run-report-html.test.ts b/web/tests/unit/mcp-run-report-html.test.ts
index 1b7e8b7d..56627289 100644
--- a/web/tests/unit/mcp-run-report-html.test.ts
+++ b/web/tests/unit/mcp-run-report-html.test.ts
@@ -1,3 +1,4 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { afterEach, describe, expect, it, vi } from "vitest";
 
 vi.mock("node:fs", async (importOriginal) => {
@@ -6,6 +7,7 @@ vi.mock("node:fs", async (importOriginal) => {
     ...actual,
     existsSync: vi.fn(() => false),
     readFileSync: vi.fn(),
+    statSync: vi.fn(actual.statSync),
   };
 });
 
@@ -23,6 +25,9 @@ describe("loadRunReportHtml", () => {
   afterEach(() => {
     resetRunReportHtmlCache();
     vi.unstubAllEnvs();
+    vi.mocked(existsSync).mockReset().mockReturnValue(false);
+    vi.mocked(readFileSync).mockReset();
+    vi.mocked(statSync).mockReset();
   });
 
   it("serves the placeholder in non-production when the artifact is missing", () => {
@@ -39,4 +44,20 @@ describe("loadRunReportHtml", () => {
     resetRunReportHtmlCache();
     expect(() => loadRunReportHtml()).toThrow(/mcp-apps:build/);
   });
+
+  it("re-reads the artifact after a rebuild", () => {
+    vi.mocked(existsSync).mockReturnValue(true);
+    vi.mocked(statSync)
+      .mockReturnValueOnce({ mtimeMs: 1 } as import("node:fs").Stats)
+      .mockReturnValueOnce({ mtimeMs: 1 } as import("node:fs").Stats)
+      .mockReturnValue({ mtimeMs: 2 } as import("node:fs").Stats);
+    vi.mocked(readFileSync)
+      .mockReturnValueOnce("<html>v1 %%DATA_HUB_ORIGIN%%</html>")
+      .mockReturnValue("<html>v2 %%DATA_HUB_ORIGIN%%</html>");
+
+    expect(loadRunReportHtml()).toContain("v1");
+    expect(loadRunReportHtml()).toContain("v1");
+    expect(loadRunReportHtml()).toContain("v2");
+    expect(readFileSync).toHaveBeenCalledTimes(2);
+  });
 });
diff --git a/web/tests/unit/s3-local-mirror-cors.test.ts b/web/tests/unit/s3-local-mirror-cors.test.ts
new file mode 100644
index 00000000..c99a6323
--- /dev/null
+++ b/web/tests/unit/s3-local-mirror-cors.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it } from "vitest";
+import {
+  localS3CorsPreflight,
+  withLocalS3Cors,
+} from "@/lib/s3-local-mirror-cors";
+
+describe("local S3 CORS", () => {
+  it("answers preflight for GET without allowing PUT", () => {
+    const response = localS3CorsPreflight();
+    expect(response.status).toBe(204);
+    expect(response.headers.get("Access-Control-Allow-Origin")).toBe("*");
+    expect(response.headers.get("Access-Control-Allow-Methods")).toBe(
+      "GET, HEAD, OPTIONS"
+    );
+    expect(response.headers.get("Access-Control-Allow-Methods")).not.toMatch(
+      /PUT/
+    );
+  });
+
+  it("copies CORS onto an existing response", async () => {
+    const inner = new Response("ok", {
+      status: 200,
+      headers: { "Content-Type": "text/csv" },
+    });
+    const wrapped = withLocalS3Cors(inner);
+    expect(wrapped.status).toBe(200);
+    expect(wrapped.headers.get("Content-Type")).toBe("text/csv");
+    expect(wrapped.headers.get("Access-Control-Allow-Origin")).toBe("*");
+    expect(await wrapped.text()).toBe("ok");
+  });
+});

From 586446c982ed9b3573eb318ed6b33f5a67633901 Mon Sep 17 00:00:00 2001
From: Wasim Amiri <7220175+wasimxyz@users.noreply.github.com>
Date: Sat, 29 Aug 2026 21:31:44 -0700
Subject: [PATCH 6/6] Cancel superseded report-item requests and warn on an
 unset bucket.

`fetchReportItems` now takes an optional `AbortSignal`. The controllers in
`useReportItems` were only gating `setState`, so a debounced search or a
held-down paging button left every superseded request running to completion.
The REST source hands the signal to `fetch`; the View hands it to
`callServerTool`, which tells the host to drop the in-flight `tools/call`.
The post-resolve `aborted` checks stay, because the signal is optional and an
implementation may ignore it.

`clearSearch` built a controller that nothing ever aborted, so its guards could
never fire and unmounting mid-request still wrote to dead state. It now shares
the controller `extend` uses: both load one window for the current query, so
the later action cancels the earlier one.

An unset `S3_RAW_DATA_BUCKET` or `S3_PROCESSED_BUCKET` silently produced a
content security policy that blocks that bucket's files, and the only symptom
was blank images in someone else's chat client. It now warns once per process,
naming the variable. It deliberately does not throw: `mcp-handler` rebuilds the
server on every request, so throwing would fail every tool rather than just the
run report View.

Also folds in comment edits across the View, CSP, and infra files that were
already sitting in the working tree.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 developer-docs/mcp-apps.md                    |  6 +-
 infra/template.yaml                           |  9 +--
 .../api/local-s3/[bucket]/[...key]/route.ts   | 20 +-----
 web/components/runs/plate-map-grid.tsx        |  5 +-
 .../runs/report-data-source-provider.tsx      |  4 +-
 web/hooks/use-report-items.ts                 | 31 ++++++---
 web/hooks/use-resolved-file-url.ts            |  7 +-
 web/lib/mcp/absolute-url.ts                   |  5 +-
 web/lib/mcp/catalog/types.ts                  |  5 +-
 web/lib/mcp/ui-csp.ts                         | 52 +++++++++-----
 web/lib/runs/rest-report-data-source.ts       | 15 ++--
 web/lib/runs/view-data-source.ts              | 19 +++---
 web/lib/s3-local-mirror-cors.ts               |  5 +-
 web/lib/s3.ts                                 |  7 +-
 web/mcp-apps/run-report/host-bridge.ts        | 10 ++-
 web/mcp-apps/run-report/instrument-report.tsx |  8 +--
 web/mcp-apps/run-report/mcp-data-source.ts    | 39 ++++++-----
 web/mcp-apps/run-report/parse-tool-result.ts  |  5 +-
 web/proxy.ts                                  |  7 +-
 web/tests/unit/mcp-data-source.test.ts        | 23 +++++++
 web/tests/unit/mcp-ui-csp.test.ts             | 68 ++++++++++++++++++-
 .../unit/rest-report-data-source.test.ts      | 31 ++++++++-
 22 files changed, 247 insertions(+), 134 deletions(-)

diff --git a/developer-docs/mcp-apps.md b/developer-docs/mcp-apps.md
index bd02f6e5..5ee48671 100644
--- a/developer-docs/mcp-apps.md
+++ b/developer-docs/mcp-apps.md
@@ -83,7 +83,7 @@ The seven instrument renderers used to call `fetch("/api/v1/…")` directly, whi
 
 | Method | What it does |
 | --- | --- |
-| `fetchReportItems` | Returns one window of report items for a kind. |
+| `fetchReportItems` | Returns one window of report items for a kind. Takes an optional `AbortSignal`. |
 | `fetchTableRows` | Returns every parsed row of a CSV, cached per file ID. |
 | `resolveFileUrl` | Returns a URL for a file's bytes, possibly asynchronously. |
 | `peekFileUrl` | Returns a URL synchronously if one is already known, so a component can paint during render. |
@@ -96,6 +96,8 @@ Two implementations exist:
 
 `fetchTableRows` returns the whole file rather than a page because every caller charts or indexes all of it, and both sources cache per file ID, so paging would only add round trips.
 
+`fetchReportItems` takes an `AbortSignal` because the seeker's search box refires on a 300 ms debounce and its paging buttons can be held down. The REST source hands the signal to `fetch`; the View hands it to `callServerTool`, which tells the host to drop the in-flight `tools/call`. The signal is optional, so `useReportItems` still checks `signal.aborted` after a page resolves rather than trusting that a cancelled request never lands.
+
 `peekFileUrl` exists because the MCP source is asynchronous. Calling `resolveFileUrl` during render would allocate a new Promise on every render, and using that Promise as an effect dependency caused a render loop during development. Only the effect in `useResolvedFileUrl`, keyed on the file ID, is allowed to call `resolveFileUrl`.
 
 ## What each instrument renders in the View
@@ -152,7 +154,7 @@ The host builds the sandbox iframe's policy out of what the server declares on t
 
 `runReportUiMeta` in `web/lib/mcp/ui-csp.ts` puts the same origin list in all three fields: `resourceDomains` for images and video, `frameDomains` for the nested PDF preview, and `connectDomains` for the `fetch` calls that read CSV and JSON bodies. The list is the raw-data and processed bucket origins, plus `authBaseURL`, `http://localhost:3000`, and `http://127.0.0.1:3000` outside production. It drops the S3 hosts entirely when `LOCAL_S3_MIRROR` is set, because the mirror serves bytes from the app's own origin.
 
-Both buckets matter: a run's files live in the raw bucket or the processed one depending on the row's `s3_bucket`, and processed artifacts are most of what the report renders. That is why the deploy needs `S3_PROCESSED_BUCKET` set even though download URLs never read it. Archives are zips the View never renders, so they stay out. The `fetch` calls also need bucket-side CORS, which `infra/template.yaml` grants with a `*` GET rule — the sandbox origin is chosen by the host and cannot be allowlisted ahead of time.
+Both buckets matter: a run's files live in the raw bucket or the processed one depending on the row's `s3_bucket`, and processed artifacts are most of what the report renders. That is why the deploy needs `S3_PROCESSED_BUCKET` set even though download URLs never read it. An unset bucket logs a warning naming the variable, once per process, because the only other symptom is blank images in someone else's chat client. It does not throw: `mcp-handler` rebuilds the server on every request, so throwing here would take down every tool rather than just the View. Archives are zips the View never renders, so they stay out. The `fetch` calls also need bucket-side CORS, which `infra/template.yaml` grants with a `*` GET rule — the sandbox origin is chosen by the host and cannot be allowlisted ahead of time.
 
 The bucket origin comes from `s3BucketOrigin` in `web/lib/s3.ts`, which sits beside the `S3Client` so that setting `endpoint` or `forcePathStyle` on the client forces an update in the same file. Composing it as a string keeps `runReportUiMeta` synchronous, and that matters: `registerResource` attaches the policy to the `resources/list` entry and the `resources/read` body from the same call, and it cannot await anything before the listing.
 
diff --git a/infra/template.yaml b/infra/template.yaml
index 795aef0c..79434544 100644
--- a/infra/template.yaml
+++ b/infra/template.yaml
@@ -62,8 +62,8 @@ Resources:
       # Block Public Access follows the S3 account default: the CI deploy role
       # can't call `s3:PutBucketPublicAccessBlock`, so pinning it breaks deploys.
 
-      # Browsers `fetch()` CSVs here, and the MCP Apps sandbox origin is chosen
-      # by the host, so `*`. Objects stay private behind presigned URLs.
+      # Browsers fetch CSVs here from a sandbox origin the MCP host picks, so
+      # it has to be `*`. Objects stay private behind presigned URLs.
       CorsConfiguration:
         CorsRules:
           - AllowedMethods:
@@ -115,7 +115,7 @@ Resources:
           Value: arcadia-data-hub
 
   # Cache for run-archive zips built by the Lambda. Objects expire after a week
-  # and rebuild on demand; browsers are 302'd to S3, never served through Vercel.
+  # and rebuild on demand; browsers are redirected to S3, never through Vercel.
   ArchivesBucket:
     Type: AWS::S3::Bucket
     DeletionPolicy: Retain
@@ -242,7 +242,8 @@ Resources:
           DATA_HUB_API_KEY: !Ref DataHubApiKey
 
   # ---- S3 → Lambda event wiring ----
-  # Explicit resources, not SAM Events: a same-template bucket and function cycle.
+  # Wired explicitly rather than with SAM Events, which would make the bucket
+  # and the function in this template depend on each other in a loop.
 
   S3InvokeLambdaPermission:
     Type: AWS::Lambda::Permission
diff --git a/web/app/api/local-s3/[bucket]/[...key]/route.ts b/web/app/api/local-s3/[bucket]/[...key]/route.ts
index a162fea8..e170dbd2 100644
--- a/web/app/api/local-s3/[bucket]/[...key]/route.ts
+++ b/web/app/api/local-s3/[bucket]/[...key]/route.ts
@@ -1,20 +1,6 @@
-// Local-only S3 mirror endpoint. Serves bytes from
-// `<LOCAL_S3_MIRROR>/<bucket>/<key>` on GET, metadata on HEAD, and writes
-// bytes there on PUT. The matching dispatch lives in `web/lib/s3-local-mirror.ts`,
-// which `web/lib/s3.ts` calls into when the env var is set.
-//
-// GET/HEAD (and 404s) carry `*` CORS so the MCP Apps sandbox can `fetch`
-// CSV/JSON the same way it reads the real buckets. PUT stays same-origin.
-//
-// Gating: `getLocalMirrorRoot()` returns `null` whenever
-// `NODE_ENV === "production"` OR `LOCAL_S3_MIRROR` is unset. All
-// handlers short-circuit to a 404 in that case, so a production
-// build can never expose the filesystem even if the file is somehow
-// included in the bundle.
-//
-// Runtime: stays on the default Node.js runtime — `fs` is unavailable
-// on the Edge runtime and there's no production deployment story for
-// this route anyway.
+// Local-only S3 mirror: reads and writes `<LOCAL_S3_MIRROR>/<bucket>/<key>`,
+// with `*` CORS on GET/HEAD so the MCP Apps sandbox can fetch the files. Every
+// handler 404s in production, so a real build can never read the filesystem.
 
 import { createReadStream, createWriteStream } from "node:fs";
 import { mkdir, stat } from "node:fs/promises";
diff --git a/web/components/runs/plate-map-grid.tsx b/web/components/runs/plate-map-grid.tsx
index a0482730..d8b9c140 100644
--- a/web/components/runs/plate-map-grid.tsx
+++ b/web/components/runs/plate-map-grid.tsx
@@ -31,9 +31,8 @@ const COMPACT_PLATE_MAX_COLS = 12;
 /** Floor so 24-column plates stay readable instead of shrinking to fit. */
 const WIDE_PLATE_WELL_TRACK = "4rem";
 
-// `cqw` follows the plate box, not the viewport — the same map sits in a
-// wide run page and a narrow MCP iframe. Well text uses the plate, not the
-// cell: a cell container makes `cqw` cyclic with `aspect-square` tracks.
+// Sized against the plate box, not the viewport, because the same map renders
+// in a wide run page and a narrow MCP iframe. Per-cell sizing would be cyclic.
 const PLATE_META_TEXT = "text-[length:clamp(0.75rem,2.2cqw,0.875rem)]";
 const PLATE_AXIS_TEXT = "text-[length:clamp(0.5rem,1.8cqw,0.875rem)]";
 const PLATE_SCALE_TEXT = "text-[length:clamp(0.4375rem,1.6cqw,0.75rem)]";
diff --git a/web/components/runs/report-data-source-provider.tsx b/web/components/runs/report-data-source-provider.tsx
index ea2b8023..6e4929d3 100644
--- a/web/components/runs/report-data-source-provider.tsx
+++ b/web/components/runs/report-data-source-provider.tsx
@@ -20,8 +20,8 @@ export function ReportDataSourceProvider({
   );
 }
 
-// Created here rather than on the server page because the source is a bag of
-// functions and cannot cross the server/client boundary as a prop.
+// Built here, not on the server page, because the source is made of functions
+// and functions cannot be passed from a server component as a prop.
 export function RestReportDataSourceProvider({
   children,
   instrumentId,
diff --git a/web/hooks/use-report-items.ts b/web/hooks/use-report-items.ts
index 6e999de1..aabff121 100644
--- a/web/hooks/use-report-items.ts
+++ b/web/hooks/use-report-items.ts
@@ -76,17 +76,21 @@ export function useReportItems({
   const selectedItem = items[selectedIndex - offset] ?? null;
 
   const fetchWindow = useCallback(
-    (params: {
-      anchor?: number;
-      offset: number;
-      search: string;
-    }): Promise<ReportItemsPage> =>
+    (
+      params: {
+        anchor?: number;
+        offset: number;
+        search: string;
+      },
+      signal: AbortSignal
+    ): Promise<ReportItemsPage> =>
       fetchReportItems({
         kind,
         offset: params.offset,
         limit: REPORT_ITEMS_WINDOW,
         search: params.search || undefined,
         anchor: params.anchor,
+        signal,
       }),
     [fetchReportItems, kind]
   );
@@ -105,7 +109,7 @@ export function useReportItems({
       return;
     }
     const controller = new AbortController();
-    fetchWindow({ offset: 0, search: query })
+    fetchWindow({ offset: 0, search: query }, controller.signal)
       .then((page) => {
         if (controller.signal.aborted) {
           return;
@@ -148,10 +152,10 @@ export function useReportItems({
         const nextOffset = isForward
           ? offset + items.length
           : Math.max(0, offset - REPORT_ITEMS_WINDOW);
-        const page = await fetchWindow({
-          offset: nextOffset,
-          search: query,
-        });
+        const page = await fetchWindow(
+          { offset: nextOffset, search: query },
+          controller.signal
+        );
         if (controller.signal.aborted) {
           return entry;
         }
@@ -247,8 +251,13 @@ export function useReportItems({
         return;
       }
 
+      // Shares the extend controller: both load one window for the current
+      // query, so the later action should cancel the earlier one, and unmount
+      // cancels whichever is outstanding.
+      busyControllerRef.current?.abort();
       const controller = new AbortController();
-      void fetchWindow({ anchor, offset: 0, search: "" })
+      busyControllerRef.current = controller;
+      void fetchWindow({ anchor, offset: 0, search: "" }, controller.signal)
         .then((page) => {
           if (controller.signal.aborted) {
             return;
diff --git a/web/hooks/use-resolved-file-url.ts b/web/hooks/use-resolved-file-url.ts
index 0da83b00..28c55aaf 100644
--- a/web/hooks/use-resolved-file-url.ts
+++ b/web/hooks/use-resolved-file-url.ts
@@ -11,11 +11,8 @@ export function peekSyncFileUrl(
   return dataSource.peekFileUrl?.(fileId) ?? undefined;
 }
 
-// REST exposes `peekFileUrl` so the carousel can paint the path during
-// render. The View's MCP source is async — calling it during render
-// would allocate a new Promise every time and loop if that Promise
-// were an effect dependency. Only the effect, keyed on `fileId`,
-// may call `resolveFileUrl`.
+// Only the effect may call `resolveFileUrl`: the View's MCP source is async,
+// so calling it during render allocates a new Promise every pass and loops.
 export function useResolvedFileUrl(
   fileId: number | null | undefined
 ): string | null {
diff --git a/web/lib/mcp/absolute-url.ts b/web/lib/mcp/absolute-url.ts
index 0ebd6925..6d19fd49 100644
--- a/web/lib/mcp/absolute-url.ts
+++ b/web/lib/mcp/absolute-url.ts
@@ -1,8 +1,7 @@
 import { authBaseURL } from "@/lib/auth";
 
-// Local-mirror helpers return a path like `/api/local-s3/...`. Inside a
-// cross-origin View iframe that resolves against the sandbox origin, so MCP
-// app-visible tools must prefix the app origin.
+// Local-mirror helpers return a bare path like `/api/local-s3/...`, which a
+// cross-origin View iframe would resolve against the sandbox origin instead.
 export function toAbsoluteDownloadUrl(url: string): string {
   if (/^https?:\/\//i.test(url)) {
     return url;
diff --git a/web/lib/mcp/catalog/types.ts b/web/lib/mcp/catalog/types.ts
index 99b9a2a5..6464ac59 100644
--- a/web/lib/mcp/catalog/types.ts
+++ b/web/lib/mcp/catalog/types.ts
@@ -20,10 +20,7 @@ export interface McpToolAnnotations {
 }
 
 export interface McpToolDef {
-  /**
-   * MCP Apps (SEP-1865) tool metadata. Passed through to `registerTool`.
-   * Hosts that do not implement Apps ignore the key.
-   */
+  /** MCP Apps (SEP-1865) metadata. Hosts without Apps support ignore it. */
   _meta?: McpToolUiMeta;
   annotations?: McpToolAnnotations;
   description: string;
diff --git a/web/lib/mcp/ui-csp.ts b/web/lib/mcp/ui-csp.ts
index e2878347..491fde40 100644
--- a/web/lib/mcp/ui-csp.ts
+++ b/web/lib/mcp/ui-csp.ts
@@ -9,21 +9,42 @@ function localDevOrigins(): string[] {
   return [authBaseURL, "http://localhost:3000", "http://127.0.0.1:3000"];
 }
 
+// A run's files split across these two, so leaving either one out breaks half
+// the report. Archives are never rendered.
+const BUCKET_ENV_VARS = ["S3_RAW_DATA_BUCKET", "S3_PROCESSED_BUCKET"] as const;
+
+const warnedEnvVars = new Set<string>();
+
+// An unset bucket produces a policy that blocks its files, and the only
+// symptom is blank images in someone else's chat client. This cannot throw:
+// `mcp-handler` rebuilds the server per request, so a throw here would take
+// down every tool, not just the View. Warn instead, once per process rather
+// than once per request.
+function warnMissingBucket(envVar: string): void {
+  if (warnedEnvVars.has(envVar)) {
+    return;
+  }
+  warnedEnvVars.add(envVar);
+  console.warn(
+    `${envVar} is not set, so the MCP run report View is not allowed to load files from that bucket. See developer-docs/mcp-apps.md#content-security-policy.`
+  );
+}
+
+export function resetRunReportUiCspWarnings(): void {
+  warnedEnvVars.clear();
+}
+
 function runReportUiCspDomains(): string[] {
   const origins = new Set<string>();
-  // The local mirror serves file bytes from the app's own origin, which
-  // `localDevOrigins` already covers, so the S3 hosts are dead weight there.
+  // The local mirror serves bytes from the app's own origin, already in
+  // `localDevOrigins`, so the S3 hosts are dead weight there.
   if (!getLocalMirrorRoot()) {
-    // A run's files sit in the raw bucket (instrument output) or the
-    // processed bucket (Lambda artifacts) — `files.s3_bucket` decides per
-    // row, so both origins have to be listed or half the report fails to
-    // load. Archives are zips the View never renders, so they stay out.
-    for (const bucket of [
-      process.env.S3_RAW_DATA_BUCKET,
-      process.env.S3_PROCESSED_BUCKET,
-    ]) {
+    for (const envVar of BUCKET_ENV_VARS) {
+      const bucket = process.env[envVar];
       if (bucket) {
         origins.add(s3BucketOrigin(bucket));
+      } else {
+        warnMissingBucket(envVar);
       }
     }
   }
@@ -33,9 +54,8 @@ function runReportUiCspDomains(): string[] {
   return [...origins];
 }
 
-// Synchronous on purpose. `registerResource` needs this for `resources/list`
-// before it can await anything, so an async source would advertise an empty
-// policy on the first request to a cold instance and the real one afterwards.
+// Synchronous on purpose: `registerResource` needs this before it can await
+// anything, so an async version would list an empty policy on a cold start.
 export function runReportUiMeta() {
   const domains = runReportUiCspDomains();
   return {
@@ -43,10 +63,8 @@ export function runReportUiMeta() {
       csp: {
         resourceDomains: domains,
         frameDomains: domains,
-        // The View reads CSV and JSON bodies straight from S3 rather than
-        // having the server parse them and return rows, so it needs the same
-        // origins for `fetch`. The buckets allow this with a `*` CORS rule;
-        // see `RawDataBucket` in `infra/template.yaml`.
+        // The View reads CSV and JSON straight from S3, so `fetch` needs the
+        // same origins. See `RawDataBucket` CORS in `infra/template.yaml`.
         connectDomains: domains,
       },
       prefersBorder: true,
diff --git a/web/lib/runs/rest-report-data-source.ts b/web/lib/runs/rest-report-data-source.ts
index 01fa8438..aa5d7451 100644
--- a/web/lib/runs/rest-report-data-source.ts
+++ b/web/lib/runs/rest-report-data-source.ts
@@ -9,9 +9,8 @@ function restFileUrl(fileId: number): string {
   return `/api/v1/files/${fileId}/download`;
 }
 
-// Browser-side source for the Next.js run page. Closures hold the natural-key
-// route ids; `resolveFileBySuffix` is unimplemented here because artifacts are
-// loaded on the server and passed into the page as props.
+// Browser-side source for the Next.js run page. `resolveFileBySuffix` is left
+// out because the server resolves artifacts and passes them in as props.
 export function createRestReportDataSource(args: {
   instrumentId: string;
   runId: string;
@@ -19,7 +18,7 @@ export function createRestReportDataSource(args: {
   const tableCache = new Map<number, ReportTableRows>();
 
   return {
-    async fetchReportItems({ kind, offset, limit, search, anchor }) {
+    async fetchReportItems({ kind, offset, limit, search, anchor, signal }) {
       const response = await fetch(
         reportItemsUrl(args.instrumentId, args.runId, {
           kind,
@@ -27,7 +26,8 @@ export function createRestReportDataSource(args: {
           limit,
           search: search ?? "",
           anchor,
-        })
+        }),
+        { signal }
       );
       if (!response.ok) {
         throw new Error(`Failed to load report items (${response.status})`);
@@ -40,9 +40,8 @@ export function createRestReportDataSource(args: {
       if (cached) {
         return cached;
       }
-      // The download endpoint 302-redirects to a short-lived presigned S3
-      // URL, so the CSV bytes flow straight from S3 to the browser with zero
-      // Vercel Fast Origin Transfer.
+      // This endpoint redirects to a presigned S3 URL, so the CSV bytes go
+      // straight from S3 to the browser and skip Vercel's transfer bill.
       const res = await fetch(restFileUrl(fileId));
       if (!res.ok) {
         throw new Error(`Failed to load table (HTTP ${res.status})`);
diff --git a/web/lib/runs/view-data-source.ts b/web/lib/runs/view-data-source.ts
index cd448826..a7967d92 100644
--- a/web/lib/runs/view-data-source.ts
+++ b/web/lib/runs/view-data-source.ts
@@ -11,27 +11,26 @@ export interface ReportFileRef {
   url: string;
 }
 
-// Contract shared by the Next.js run page (REST) and the MCP Apps View.
-// Both fetch file bytes straight from S3 and parse them in the browser, so
-// neither one streams a CSV or a JSON artifact through the server.
+// Shared by the Next.js run page (REST) and the MCP Apps View. Both read file
+// bytes straight from S3 and parse them in the browser, never via the server.
 // biome-ignore assist/source/useSortedInterfaceMembers: keep the published method order
 export interface ReportDataSource {
+  // `signal` is optional so an implementation may ignore it; callers must
+  // still discard a resolved page they no longer want.
   fetchReportItems(args: {
     kind: ReportItemKind;
     offset: number;
     limit: number;
     search?: string;
     anchor?: number;
+    signal?: AbortSignal;
   }): Promise<ReportItemsPage>;
-  // Whole file, parsed. Callers chart or index every row, and both sources
-  // cache per file id, so there is nothing to gain from paging here.
+  // Whole file, parsed. Callers read every row and both sources cache per
+  // file id, so paging would buy nothing.
   fetchTableRows(fileId: number): Promise<ReportTableRows>;
   resolveFileUrl(fileId: number): Promise<string> | string;
-  // Synchronous cache/path lookup for render. The MCP source is async, so
-  // calling `resolveFileUrl` during render would allocate a Promise every
-  // time. REST implements this as the download path.
+  // Safe to call during render, unlike the async `resolveFileUrl`.
   peekFileUrl?(fileId: number): string | null;
-  // Find one file on the run by filename suffix. Only the View implements
-  // this; the web app resolves artifacts on the server and passes them in.
+  // View only. The web app resolves artifacts on the server instead.
   resolveFileBySuffix?(suffix: string): Promise<ReportFileRef>;
 }
diff --git a/web/lib/s3-local-mirror-cors.ts b/web/lib/s3-local-mirror-cors.ts
index cf6a6095..f9ee69a7 100644
--- a/web/lib/s3-local-mirror-cors.ts
+++ b/web/lib/s3-local-mirror-cors.ts
@@ -1,6 +1,5 @@
-// Same `*` GET CORS the real buckets declare in `infra/template.yaml`.
-// The MCP Apps View `fetch`es CSV and JSON from `/api/local-s3` inside a
-// host-chosen sandbox origin, so the origin cannot be allowlisted.
+// Same `*` GET CORS the real buckets declare in `infra/template.yaml`. The
+// View's sandbox origin is picked by the host, so it cannot be allowlisted.
 
 export const LOCAL_S3_CORS_HEADERS: Record<string, string> = {
   "Access-Control-Allow-Origin": "*",
diff --git a/web/lib/s3.ts b/web/lib/s3.ts
index 58abdab5..f7137b3e 100644
--- a/web/lib/s3.ts
+++ b/web/lib/s3.ts
@@ -41,11 +41,8 @@ const s3 = new S3Client({
     : undefined,
 });
 
-// Origin `getPresignedDownloadUrl` signs against, for callers that must name
-// it up front — the MCP Apps content security policy has to list every origin
-// the View loads bytes from. Kept beside the client so adding `endpoint` or
-// `forcePathStyle` above forces an update here. A bucket name containing dots
-// would get path style from the SDK instead; Data Hub's are dash-separated.
+// Origin `getPresignedDownloadUrl` signs against, named up front for the MCP
+// Apps policy. Adding `endpoint` or `forcePathStyle` above means changing this.
 export function s3BucketOrigin(bucket: string): string {
   return `https://${bucket}.s3.${s3Region()}.amazonaws.com`;
 }
diff --git a/web/mcp-apps/run-report/host-bridge.ts b/web/mcp-apps/run-report/host-bridge.ts
index 4e8b1d57..3404bab1 100644
--- a/web/mcp-apps/run-report/host-bridge.ts
+++ b/web/mcp-apps/run-report/host-bridge.ts
@@ -24,9 +24,8 @@ const EMPTY_SIZE_STYLES: DocumentSizeStyles = {
   maxWidth: "",
 };
 
-// The spec's View Behavior snippet sets height/maxHeight/width/maxWidth on
-// `document.documentElement`. Overflow is not in that snippet, but without it
-// a capped View paints past the box and the host iframe clips the rest.
+// The spec's View Behavior snippet omits `overflow`, but without it a capped
+// View paints past the box and the host iframe clips the rest.
 export function documentStylesForContainerDimensions(
   dimensions: HostContainerDimensions | undefined
 ): DocumentSizeStyles {
@@ -48,9 +47,8 @@ export function documentStylesForContainerDimensions(
     styles.overflow = "auto";
   }
 
-  // The host already sized the iframe. `maxWidth` is a hint about that
-  // container, not a box we should paint inside a wider frame — applying it
-  // left a gap around plate maps in Cursor's inline View.
+  // `maxWidth` describes the host's container, not a box to paint inside.
+  // Applying it left a gap around plate maps in Cursor's inline View.
   if (
     ("width" in dimensions && typeof dimensions.width === "number") ||
     ("maxWidth" in dimensions &&
diff --git a/web/mcp-apps/run-report/instrument-report.tsx b/web/mcp-apps/run-report/instrument-report.tsx
index 328feaa5..ccde7855 100644
--- a/web/mcp-apps/run-report/instrument-report.tsx
+++ b/web/mcp-apps/run-report/instrument-report.tsx
@@ -72,9 +72,8 @@ function firstProcessedCsv(files: ReportFileRef[]): ReportFileRef | undefined {
   return files.find((file) => file.category === "processed" && isCsvFile(file));
 }
 
-// Mirrors `getAuntyPlateData`, which the web app runs on the server. Here the
-// plate JSON and the curves file are two `report_view_file_url` lookups and
-// the body is read straight from S3, so the bytes skip the server entirely.
+// Browser-side twin of `getAuntyPlateData`, which the web app runs on the
+// server. Here the file bodies are read from S3 and skip the server entirely.
 async function loadAuntyPlate(
   dataSource: ReportDataSource
 ): Promise<AuntyPlateData> {
@@ -89,8 +88,7 @@ async function loadAuntyPlate(
   }
   const plate = parseAuntyPlateJson(await response.json());
 
-  // Optional: an isothermal export has no curves file, and the dialog just
-  // renders without a chart in that case.
+  // An isothermal export has no curves file; the dialog then omits the chart.
   const curves = await resolveBySuffix("_aunty_curves.csv").catch(() => null);
   return { plate, curvesFileId: curves?.id ?? null };
 }
diff --git a/web/mcp-apps/run-report/mcp-data-source.ts b/web/mcp-apps/run-report/mcp-data-source.ts
index 43dda777..ed555bfd 100644
--- a/web/mcp-apps/run-report/mcp-data-source.ts
+++ b/web/mcp-apps/run-report/mcp-data-source.ts
@@ -13,9 +13,8 @@ interface CachedUrl {
   url: string;
 }
 
-// Keep in lockstep with `PRESIGNED_DOWNLOAD_URL_EXPIRY_SECONDS` in
-// `lib/s3.ts`. Do not import that module — it pulls the AWS SDK into
-// the View bundle. Refresh at 80% of the 15-minute lifetime.
+// 80% of `PRESIGNED_DOWNLOAD_URL_EXPIRY_SECONDS` in `lib/s3.ts`, copied rather
+// than imported because that module pulls the AWS SDK into the View bundle.
 export const URL_CACHE_TTL_MS = 15 * 60 * 1000 * 0.8;
 
 function structuredPayload<T>(result: CallToolResult): T {
@@ -59,9 +58,8 @@ function writeCachedUrl(
 }
 
 async function fetchText(url: string, what: string): Promise<string> {
-  // Reaches S3 directly. The resource's `connectDomains` names those origins
-  // and the buckets carry a `*` CORS rule, so the body is readable here and
-  // the bytes never pass through the server.
+  // Reaches S3 directly, so the bytes never pass through the server. The
+  // resource's `connectDomains` and the buckets' `*` CORS rule allow it.
   const response = await fetch(url);
   if (!response.ok) {
     throw new Error(`Failed to load ${what} (HTTP ${response.status})`);
@@ -94,19 +92,24 @@ export function createMcpReportDataSource(args: {
   }
 
   const source: ReportDataSource = {
-    async fetchReportItems({ kind, offset, limit, search, anchor }) {
-      const result = await args.app.callServerTool({
-        name: "report_view_items",
-        arguments: {
-          instrumentId: args.instrumentId,
-          runId: args.runId,
-          kind,
-          offset,
-          limit,
-          search,
-          anchor,
+    async fetchReportItems({ kind, offset, limit, search, anchor, signal }) {
+      // Aborting makes the SDK notify the host so it can drop the in-flight
+      // `tools/call` instead of waiting on a window nobody will read.
+      const result = await args.app.callServerTool(
+        {
+          name: "report_view_items",
+          arguments: {
+            instrumentId: args.instrumentId,
+            runId: args.runId,
+            kind,
+            offset,
+            limit,
+            search,
+            anchor,
+          },
         },
-      });
+        { signal }
+      );
       const payload = structuredPayload<ReportItemsPage>(result);
       for (const item of payload.data) {
         const withUrl = item as { id: number; downloadUrl?: string };
diff --git a/web/mcp-apps/run-report/parse-tool-result.ts b/web/mcp-apps/run-report/parse-tool-result.ts
index 80c7c82e..7ba013f1 100644
--- a/web/mcp-apps/run-report/parse-tool-result.ts
+++ b/web/mcp-apps/run-report/parse-tool-result.ts
@@ -18,9 +18,8 @@ function asRunReport(payload: unknown): RunReportToolResult | null {
   };
 }
 
-// Single pass over structured content, then one JSON parse of the text
-// block. A recursive fallback would stack-overflow when the text parses
-// but still lacks identifiers.
+// Deliberately not recursive: a self-call would never stop when the text
+// block parses cleanly but still has no run identifiers in it.
 export function parseRunReportToolResult(
   result: CallToolResult
 ): RunReportToolResult | null {
diff --git a/web/proxy.ts b/web/proxy.ts
index 195ec2e3..df939da0 100644
--- a/web/proxy.ts
+++ b/web/proxy.ts
@@ -17,11 +17,8 @@ const publicPrefixes = [
   "/consent",
   "/api/auth",
   "/api/v1",
-  // Local S3 mirror. GET/HEAD must stay public: the MCP Apps View loads
-  // bytes from a cross-origin sandbox with no session cookie. PUT is
-  // public too because local presigned uploads (watcher, fixture
-  // processing) have no session. The route 404s when the mirror is
-  // unset or `NODE_ENV` is production, so this never writes in prod.
+  // Local S3 mirror. Neither caller has a session (the View fetches from a
+  // sandbox, the watcher PUTs), and the route 404s in production anyway.
   "/api/local-s3",
   // MCP authenticates via OAuth (or flagged PAT fallback), never a
   // session cookie — a redirect to `/login` would surface as opaque HTML
diff --git a/web/tests/unit/mcp-data-source.test.ts b/web/tests/unit/mcp-data-source.test.ts
index 6cc92d26..4e5ba35b 100644
--- a/web/tests/unit/mcp-data-source.test.ts
+++ b/web/tests/unit/mcp-data-source.test.ts
@@ -56,6 +56,29 @@ describe("createMcpReportDataSource", () => {
     expect(source.peekFileUrl?.(7)).toBeNull();
   });
 
+  // The host can drop a superseded `tools/call` only if the signal reaches it.
+  it("passes the caller's abort signal to the tool call", async () => {
+    const callServerTool = vi.fn().mockResolvedValue(
+      okResult({
+        data: [],
+        pagination: { limit: 50, offset: 0, total: 0 },
+      })
+    );
+    const source = makeSource(callServerTool);
+    const controller = new AbortController();
+
+    await source.fetchReportItems({
+      kind: "image",
+      offset: 0,
+      limit: 50,
+      signal: controller.signal,
+    });
+
+    expect(callServerTool.mock.calls[0][1]).toEqual({
+      signal: controller.signal,
+    });
+  });
+
   // One call, not one per item kind: the tool takes a file id directly.
   it("resolves an uncached file id with a single tool call", async () => {
     const callServerTool = vi
diff --git a/web/tests/unit/mcp-ui-csp.test.ts b/web/tests/unit/mcp-ui-csp.test.ts
index 6020aae6..3f77e1c4 100644
--- a/web/tests/unit/mcp-ui-csp.test.ts
+++ b/web/tests/unit/mcp-ui-csp.test.ts
@@ -1,14 +1,26 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 vi.mock("@/lib/auth", () => ({
   authBaseURL: "http://localhost:3000",
 }));
 
-import { runReportUiMeta } from "@/lib/mcp/ui-csp";
+import { resetRunReportUiCspWarnings, runReportUiMeta } from "@/lib/mcp/ui-csp";
 
 describe("runReportUiMeta", () => {
+  let warn: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    // The warned-var set is module state, so a leaked entry would make the
+    // "warns once" test pass for the wrong reason.
+    resetRunReportUiCspWarnings();
+    warn = vi.spyOn(console, "warn").mockImplementation(() => {
+      // Silence expected warnings; individual tests assert on the spy.
+    });
+  });
+
   afterEach(() => {
     vi.unstubAllEnvs();
+    vi.restoreAllMocks();
   });
 
   // A run's files split across both buckets, so leaving either one out breaks
@@ -72,4 +84,56 @@ describe("runReportUiMeta", () => {
 
     expect(runReportUiMeta()).toEqual(runReportUiMeta());
   });
+
+  // Without this an unset bucket is invisible: the policy just omits the
+  // origin and files from it fail to load inside someone else's chat client.
+  it("warns for a bucket that has no environment variable", () => {
+    vi.stubEnv("NODE_ENV", "production");
+    vi.stubEnv("LOCAL_S3_MIRROR", "");
+    vi.stubEnv("S3_RAW_DATA_BUCKET", "raw-bucket");
+    vi.stubEnv("S3_PROCESSED_BUCKET", "");
+
+    runReportUiMeta();
+
+    expect(warn).toHaveBeenCalledTimes(1);
+    expect(warn.mock.calls[0][0]).toContain("S3_PROCESSED_BUCKET is not set");
+  });
+
+  // This runs once per MCP request, so warning every time would bury it.
+  it("warns once per process, not once per call", () => {
+    vi.stubEnv("NODE_ENV", "production");
+    vi.stubEnv("LOCAL_S3_MIRROR", "");
+    vi.stubEnv("S3_RAW_DATA_BUCKET", "");
+    vi.stubEnv("S3_PROCESSED_BUCKET", "");
+
+    runReportUiMeta();
+    runReportUiMeta();
+    runReportUiMeta();
+
+    // One per variable, not one per call.
+    expect(warn).toHaveBeenCalledTimes(2);
+  });
+
+  it("stays quiet when both buckets are set", () => {
+    vi.stubEnv("NODE_ENV", "production");
+    vi.stubEnv("LOCAL_S3_MIRROR", "");
+    vi.stubEnv("S3_RAW_DATA_BUCKET", "raw-bucket");
+    vi.stubEnv("S3_PROCESSED_BUCKET", "processed-bucket");
+
+    runReportUiMeta();
+
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  // The mirror replaces both buckets, so the variables are genuinely unused.
+  it("stays quiet when the local mirror is serving bytes", () => {
+    vi.stubEnv("NODE_ENV", "development");
+    vi.stubEnv("LOCAL_S3_MIRROR", "../lambda/.local-s3");
+    vi.stubEnv("S3_RAW_DATA_BUCKET", "");
+    vi.stubEnv("S3_PROCESSED_BUCKET", "");
+
+    runReportUiMeta();
+
+    expect(warn).not.toHaveBeenCalled();
+  });
 });
diff --git a/web/tests/unit/rest-report-data-source.test.ts b/web/tests/unit/rest-report-data-source.test.ts
index f8592021..2a10c590 100644
--- a/web/tests/unit/rest-report-data-source.test.ts
+++ b/web/tests/unit/rest-report-data-source.test.ts
@@ -29,12 +29,41 @@ describe("createRestReportDataSource", () => {
     });
 
     expect(fetchMock).toHaveBeenCalledWith(
-      "/api/v1/instruments/inst-1/runs/run-1/report-items?kind=image&offset=0&limit=50&search=gel"
+      "/api/v1/instruments/inst-1/runs/run-1/report-items?kind=image&offset=0&limit=50&search=gel",
+      { signal: undefined }
     );
     expect(source.resolveFileUrl(42)).toBe("/api/v1/files/42/download");
     expect(source.peekFileUrl?.(42)).toBe("/api/v1/files/42/download");
   });
 
+  // Without this the seeker's debounced search leaves one full request per
+  // keystroke running to completion.
+  it("passes the caller's abort signal to fetch", async () => {
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        data: [],
+        pagination: { limit: 50, offset: 0, total: 0 },
+      }),
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const source = createRestReportDataSource({
+      instrumentId: "inst-1",
+      runId: "run-1",
+    });
+    const controller = new AbortController();
+
+    await source.fetchReportItems({
+      kind: "image",
+      offset: 0,
+      limit: 50,
+      signal: controller.signal,
+    });
+
+    expect(fetchMock.mock.calls[0][1]).toEqual({ signal: controller.signal });
+  });
+
   it("parses a CSV once and caches every row", async () => {
     const fetchMock = vi.fn().mockResolvedValue({
       ok: true,