In the dashboard, the Ask tab takes a plain-English question, grounds it in the live schema, generates DuckDB SQL, and runs it read-only — but only after it clears a layered validation pipeline (L1–L7 ...