diff --git a/Cargo.lock b/Cargo.lock
index 53e223f7..3cdea451 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -207,7 +207,7 @@ dependencies = [
  "objc2-foundation",
  "parking_lot",
  "percent-encoding",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
  "x11rb",
 ]
 
@@ -883,7 +883,7 @@ version = "3.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "519bd3116aeeb42d5372c29d982d16d0170d3d4a5ed85fc7dd91642ffff3c67c"
 dependencies = [
- "darling 0.23.0",
+ "darling 0.20.11",
  "ident_case",
  "prettyplease",
  "proc-macro2",
@@ -1161,7 +1161,7 @@ checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
 [[package]]
 name = "client"
-version = "0.8.41"
+version = "0.8.46"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1282,7 +1282,7 @@ dependencies = [
 
 [[package]]
 name = "common"
-version = "0.8.41"
+version = "0.8.46"
 dependencies = [
  "prost",
  "prost-build",
@@ -2735,7 +2735,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5755,7 +5755,7 @@ version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "03da047801ff44bb6a4d407d4860c05fd70bb81714e6b2f3812603d5b145b042"
 dependencies = [
- "heck 0.5.0",
+ "heck 0.4.1",
  "itertools 0.14.0",
  "log",
  "multimap",
@@ -5906,7 +5906,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -6590,7 +6590,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -6647,7 +6647,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -6754,7 +6754,7 @@ checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
 
 [[package]]
 name = "search"
-version = "0.8.41"
+version = "0.8.46"
 dependencies = [
  "anyhow",
  "common",
@@ -6942,7 +6942,7 @@ dependencies = [
 
 [[package]]
 name = "server"
-version = "0.8.41"
+version = "0.8.46"
 dependencies = [
  "anyhow",
  "bcrypt",
@@ -7205,7 +7205,7 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f103c50866b8743da9429b8a581d81a27c2d3a9c4ac7df8f8571c1dd7896eda"
 dependencies = [
- "heck 0.5.0",
+ "heck 0.4.1",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -7929,7 +7929,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -8532,7 +8532,7 @@ checksum = "e78122066b0cb818b8afd08f7ed22f7fdbc3e90815035726f0840d0d26c0747a"
 
 [[package]]
 name = "tui-canvas"
-version = "0.8.41"
+version = "0.8.46"
 dependencies = [
  "anyhow",
  "arboard",
@@ -8563,7 +8563,7 @@ dependencies = [
 
 [[package]]
 name = "tui-canvas-validation-core"
-version = "0.8.41"
+version = "0.8.46"
 dependencies = [
  "regex",
  "serde",
@@ -8573,7 +8573,7 @@ dependencies = [
 
 [[package]]
 name = "tui-pages"
-version = "0.8.41"
+version = "0.8.46"
 dependencies = [
  "criterion",
  "crossterm",
@@ -9284,7 +9284,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 94ec1b9a..524bb89d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ resolver = "3"
 [workspace.package]
 # TODO: idk how to do the name, fix later
 # name = "komp_ac"
-version = "0.8.41"
+version = "0.8.46"
 edition = "2024"
 license = "GPL-3.0-or-later"
 authors = ["Filip Priečinský <filippriec@gmail.com>"]
diff --git a/client b/client
index b87d463f..421b27e0 160000
--- a/client
+++ b/client
@@ -1 +1 @@
-Subproject commit b87d463f78d87e476c671a804129e644e3d9261f
+Subproject commit 421b27e06999420f7db6a0e984cfa7699723f594
diff --git a/common/proto/table_definition.proto b/common/proto/table_definition.proto
index 10dc0ea5..d31bbba5 100644
--- a/common/proto/table_definition.proto
+++ b/common/proto/table_definition.proto
@@ -289,6 +289,12 @@ message ProfileTreeResponse {
 
     // True when this table is shared by every profile.
     bool global = 6;
+
+    // Profile (schema) the table is actually stored in. A global table is
+    // listed under every profile it is visible from, so this names the one it
+    // belongs to rather than the one it was reached through, and callers can
+    // use it as the table's identity without deciding anything themselves.
+    string profile_name = 7;
   }
 
   // Profile (schema) entry.
@@ -377,6 +383,11 @@ message TableDetail {
   bool global = 9;
   // Revision of this table definition for optimistic concurrency control.
   int64 row_version = 10;
+
+  // Profile (schema) the table is actually stored in, which is not the
+  // requested profile when a global table is being listed. See
+  // ProfileTreeResponse.Table.profile_name.
+  string profile_name = 11;
 }
 
 // Server-owned behavior for one logical column returned in table details.
diff --git a/common/src/proto/descriptor.bin b/common/src/proto/descriptor.bin
index 13a93b58..a65fe88d 100644
Binary files a/common/src/proto/descriptor.bin and b/common/src/proto/descriptor.bin differ
diff --git a/common/src/proto/komp_ac.table_definition.rs b/common/src/proto/komp_ac.table_definition.rs
index b798fc69..8d503e60 100644
--- a/common/src/proto/komp_ac.table_definition.rs
+++ b/common/src/proto/komp_ac.table_definition.rs
@@ -263,6 +263,12 @@ pub mod profile_tree_response {
         /// True when this table is shared by every profile.
         #[prost(bool, tag = "6")]
         pub global: bool,
+        /// Profile (schema) the table is actually stored in. A global table is
+        /// listed under every profile it is visible from, so this names the one it
+        /// belongs to rather than the one it was reached through, and callers can
+        /// use it as the table's identity without deciding anything themselves.
+        #[prost(string, tag = "7")]
+        pub profile_name: ::prost::alloc::string::String,
     }
     /// Profile (schema) entry.
     #[derive(Clone, PartialEq, ::prost::Message)]
@@ -388,6 +394,11 @@ pub struct TableDetail {
     /// Revision of this table definition for optimistic concurrency control.
     #[prost(int64, tag = "10")]
     pub row_version: i64,
+    /// Profile (schema) the table is actually stored in, which is not the
+    /// requested profile when a global table is being listed. See
+    /// ProfileTreeResponse.Table.profile_name.
+    #[prost(string, tag = "11")]
+    pub profile_name: ::prost::alloc::string::String,
 }
 /// Server-owned behavior for one logical column returned in table details.
 #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
diff --git a/server b/server
index 08ab3c2e..efcd4b9e 160000
--- a/server
+++ b/server
@@ -1 +1 @@
-Subproject commit 08ab3c2e49acd74b87f1c4904d2dd3cb404f581e
+Subproject commit efcd4b9ed04370cf9459bf79dd0360b26eb38d83
diff --git a/tui-canvas b/tui-canvas
index b1761279..622be162 160000
--- a/tui-canvas
+++ b/tui-canvas
@@ -1 +1 @@
-Subproject commit b1761279ff760cae62d7bf33f04311d444e5ea83
+Subproject commit 622be162ef631cf336d2cbed112bacd49029a345
diff --git a/tui-pages b/tui-pages
index 0ae4b6d9..6d152e6b 160000
--- a/tui-pages
+++ b/tui-pages
@@ -1 +1 @@
-Subproject commit 0ae4b6d9a2b1d8dbcf96e80c8b263092415d2f3e
+Subproject commit 6d152e6b4ce438f2cdbf0a3cb16eed2575eaa10a
diff --git a/web/CHANGELOG.md b/web/CHANGELOG.md
index 8090317d..72ee4d78 100644
--- a/web/CHANGELOG.md
+++ b/web/CHANGELOG.md
@@ -12,7 +12,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ---
 
-## [Unreleased]
+## [v0.8.46] — 2026-08-16
 
 ### Added
 
@@ -56,9 +56,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   so inherited `superadmin` authorization works and data roles are no longer
   treated as administrators. Login redirects structural users to the admin
   workspace and data users to analytics.
-- **Analytics and import/export use the caller's visible data** — profile-tree
-  discovery is authenticated, export is limited to readable tables, and
-  import is limited to tables for which the snapshot carries `insert`.
+- **Import and export are their own grant actions** — the import page requires
+  the caller's `import` grant and the export page the caller's `export` grant,
+  on top of the underlying row action each transfer performs (`insert` for
+  import, `read` for export). A table is offered only when the caller holds
+  both, so the menu never leads to a transfer the backend would refuse halfway
+  through. Profile-tree discovery for these pages is authenticated.
+- **CSV transfer system columns and header normalizing** — the import page
+  gained a "File includes system columns" checkbox (so `deleted` loads back as
+  it left) and a "Normalize headers" action that rewrites header rows into the
+  backend's column spellings before anything is posted; the export page gained
+  an "Include system columns" checkbox that adds `id`, `deleted`, and
+  `row_revision`. No new gRPC endpoint is consumed — these reuse
+  `PostTableDataBulk`, `GetTableDataByPosition`, and `GetTableDataCount`.
 - **Permission mutations keep the browser session** — grants, role changes and
   assignments now reload the live authorization state without replacing the
   identity-only JWT. The permissions workspace reloads in place and shows the
diff --git a/web/src/pages/table_scope.rs b/web/src/pages/table_scope.rs
index ad8fec38..bd48c772 100644
--- a/web/src/pages/table_scope.rs
+++ b/web/src/pages/table_scope.rs
@@ -63,6 +63,7 @@ pub(crate) fn linkable_tables(
 #[cfg(test)]
 pub(crate) mod tests {
     use super::*;
+    use crate::pages::GLOBAL_SCOPE;
 
     pub(crate) fn table(name: &str, global: bool) -> Table {
         Table {
@@ -72,6 +73,11 @@ pub(crate) mod tests {
             row_display_columns: Vec::new(),
             table_kind: "dynamic".to_string(),
             global,
+            profile_name: if global {
+                GLOBAL_SCOPE.to_string()
+            } else {
+                "test_profile".to_string()
+            },
         }
     }