Aug 27 - Updated web dashboard card, inspection ownership

CLAUDE.md

@@ -895,15 +895,14 @@ A follow-up used to belong implicitly to whoever performed the original inspecti
 **The assignee takes over.** Only the owner is notified, and only the owner sees it — the original inspector's list no longer shows a follow-up that was handed to someone else. In the API that means the two arms must be mutually exclusive:
 
 ```python
-db.or_(
-    Inspection.follow_up_assigned_to == user.id,
-    db.and_(Inspection.follow_up_assigned_to.is_(None),
-            Inspection.inspector_id == user.id),
-)
+Inspection.follow_up_owned_by(user.id)      # models/inspection.py
+# → follow_up_assigned_to == uid  OR  (follow_up_assigned_to IS NULL AND inspector_id == uid)
 ```
 
 Without the `is_(None)` on the second arm the original inspector keeps seeing it and two people turn up to do the same re-inspection.
 
+**Ownership is stated twice and both live in the model** — `follow_up_owner` for a loaded row, `follow_up_owned_by(user_id)` for a query. Three surfaces scope follow-ups: the mobile list filter, the web dashboard card, and the iPad stats KPI. They each wrote their own version at first and the two dashboards tested AUTHORSHIP, so an assignee saw the work in their list while both cards read 0 — the stats KPI disagreeing with the Follow-up Requests list directly beneath it. All three now call the predicate.
+
 **The generic "inspectors see only their own inspections" filter has to be deferred** when `follow_up_required=true` is requested — an assigned follow-up lives on an inspection somebody *else* performed, so applying authorship first hides exactly the rows the assignee needs.
 
 **Read access follows the LIST, not authorship (Aug 2026).** `index()` scopes an inspector by FACILITY (rule 58 — their scope covers all data in their contracted facilities), but `view()` and `export_pdf()` scoped by authorship, so the list offered rows that answered "Access denied" on click. It also blocked the assignee from opening the parent inspection they had just been asked to re-inspect — the button they needed was on a page they could not reach. Both reads now use `_inspector_may_read()` (facility scope). **Writes stay owner-only**: `execute`, `save_draft_ajax`, `upload_photo_ajax` and `flag_issue` keep the authorship check.