refactor(resources): one canonical view per resource, mounted on source/grants/host - #6279

- cloud-review-tools.test.ts: the merge kept the branch's import line (which
  had dropped `symlink` along with the test that used it) while taking
  staging's reinstated test body, so the symlink-escape assertion would have
  thrown ReferenceError on CI. tsconfig excludes *.test.ts, so type-check
  could not catch it. Restored the import and the workflow's ripgrep install
  step, which the branch removed alongside the same test.

- createByteRangeResponse defaulted to `public, max-age=31536000` while its
  sibling createFileResponse defaults to `private, no-cache` and says in a
  comment why. resolveServeCacheControl returns undefined for any unversioned
  non-`workspace` context, so those access-verified media responses landed on
  the public default — storable by a shared cache and re-servable cross-user,
  where staging sent `private, no-cache`. Defaults now match.

- ReadOnlyTextPreview: restored staging's `flex … flex-col` on the rich
  preview wrapper. Every PreviewPanel renderer sizes itself as a flex item, so
  in a block parent HtmlPreview measures a zero-height box, never mounts its
  iframe, and nothing ever grows the container to un-wedge it — shared .html
  and .svg rendered blank.

The branch's workflow listed only the non-strict variant; staging replaced the
hand-written step list with a runner that derives every zero-arg check:*. Merging
the two ran the 1359-line resource scanner twice. Excluded the same way, and for
the same reason, as check:api-validation.

…ated

A canonical unit is mounted by anonymous surfaces, so an import of the
authenticated route tree from inside one pulls the workspace bundle into the
public chunk and re-creates exactly the coupling the axes exist to delete. The
migration introduced two, and R3b's inherited 37-file budget was wide enough to
hide both.

- The collaborative socket provider moves to `components/socket-provider`. It
  has consumers on both sides of the route tree — the workspace editor mounts
  it, and the file view's collaboration hook reads it from inside a unit — so
  `app/workspace/providers/**` was never its home. Same fix, and same reasoning,
  as the earlier `ActionRow` / `AnchoredContextMenu` moves.

- `DELETED_WORKFLOW_LABEL` moves to `lib/workflows/labels.ts`. It is a workflow
  concept, not a log one: four of its five consumers are workflow-editor
  surfaces, and sourcing it from the log-view barrel made `lib/workflows/
  subblocks/display.ts` — reachable from server routes — drag a 762-line
  'use client' module behind it.

- The log view's frozen-canvas modal keeps its `Preview` import, annotated. That
  component reads useParams<{ workspaceId }>() and pulls in the editor's
  subblock and edge components; it IS editor UI, and hoisting it would drag half
  the editor into components/. It is safe only because `log`'s share seed is
  `never`.

Adds R3c to check:resources, held at 0: the same edge R3b counts, narrowed to
canonical units, where there is no budget. Verified it fails by removing the
annotation and watching the audit go red.

…it finished"

headObject now answers local storage from `stat` instead of reporting every
object as missing. That is the honest answer and the byte-range paths need it,
but it also brought ten existing callers to life on self-hosted and dev
deployments — including three that read "the object is there" as "the copy
finished" and skip the work: the workspace fork copier, the KB document copier,
and the table snapshot cache.

Those guards were written against cloud backends, where an interrupted PUT
leaves no object at all. The local path was a bare `writeFile`, which truncates
before it writes, so a crash mid-write would have left a prefix under a key
those callers now treat as complete — a fork retry marking a torn file copied.

Writes now land on a sibling `.partial` path and are renamed onto the target;
`rename` within a directory is atomic on POSIX and replaces in one step, so the
key names either the previous bytes or the whole new ones. A failed write or
rename removes the temp file and rethrows. Local multipart accumulates and
commits through this same path, so snapshots are covered too.

Reviewed the other seven callers: all strictly improve. materialize-file now
charges quota against the real on-disk size rather than trusting the row, the
CSV import progress bar is no longer permanently indeterminate on local, and
the TikTok size probe skips its counting pass. Their comments claimed local
returns null; refreshed.

Tests assert the call sequence rather than an observed torn read — a timing
test passes against a plain `writeFile` too, since even a multi-megabyte write
resolves inside one macrotask, so it would be a test that cannot fail.
Confirmed all four go red when the temp-and-rename is reverted.

Each of these is a side-effect of a deliberate change reaching further than the
change needed. The features stay; what they touched by accident is put back.

- Config files download again. Resolving unknown extensions through the
  canonical MIME table is what makes byte-range serving work, but it also
  promoted .env/.log/.conf/.ini/.cfg from "unknown bytes" to text/plain, which
  is on the inline allowlist — a shared .env started rendering in the tab
  instead of downloading. Those five join FORCE_ATTACHMENT_EXTENSIONS, so the
  MIME resolution stays honest and the disposition stays what it was. Verified
  these are the only five of the 47 newly-typed extensions that flipped.

- The aggregate per-share ceiling is charged once per read, not once per seek.
  It is shared by every visitor to a link, so counting each range request let
  one person scrubbing a shared video 429 everyone else. The audit row beside it
  already deduped seeks; both now use one `isReadStart` predicate rather than
  two copies of the same string test that can drift apart.

- MediaPreview clears a decode failure when the bytes change. It is keyed on
  `file.id`, which is stable across content edits, so one transient error wedged
  the player until the viewer opened a different file. Adjusted during render,
  the same pattern the markdown image node view uses.

- The chat-trigger attachment guard accepts `dataUrl`, the preferred inline
  field, not just the legacy `data`. `processChatFiles` reads `dataUrl || data`,
  so testing only `data` skipped the upload for every current client and dropped
  its attachments silently — the exact failure the guard was added to prevent.

- The navbar sticks below the macOS traffic-light lane instead of the viewport.
  Every shell mounting it wears `.desktop-title-bar-page`, which reserves the
  lane with padding, but sticky positions against the scroll port — so the bar
  slid under the traffic lights on scroll. The variable is 0px off-desktop.

- The wordmark opens in a new tab on the deployed chat and the public file page.
  Reusing the landing navbar turned those two from `sim.ai` in a new tab into
  same-origin `/` in the same tab, so clicking the logo mid-conversation
  navigated away and destroyed it. `/` is the better href — self-hosters get
  their own landing — so only the target moves back, behind one `brandInNewTab`
  prop for surfaces hosting something the viewer would lose.

… have

An audit of all four units against each other found one real divergence and a
pile of small ones, all in table-view. file-view, log-view and knowledge-view
are already uniform: `<unit>.tsx` + `index.ts` + `components/<child>/` + `utils/`
(+ `hooks/`), absolute imports, tests colocated with what they test. table-view
was flat — fifteen entries at the unit root, `cells/` and `headers/` as sibling
groups rather than children of `components/`, three test files at the root, and
relative imports throughout, which the repo bans everywhere else.

Nothing about that was load-bearing. This moves the files and rewrites the
specifiers; the only non-import lines in the diff are five type-only import
members biome reflowed. Behaviour is unchanged by construction, and page and
panel keep mounting the same components they did.

  cells/, headers/            -> components/
  data-row, select-pill, ...  -> components/<name>/<name>.tsx + index.ts
  utils.ts, values.ts,        -> utils/selection.ts, utils/values.ts,
  constants.ts                   utils/constants.ts
  *.test.ts                   -> beside their subject

What this does NOT fix, and deliberately: table-view still has no `TableView`.
It exports 72 symbols and no view, because a table has no read-only surface yet
— everything that draws a grid today also writes one, and the shell that does
both reads useRouter and the permission context. Splitting it is a real
refactor, not a move, and it is the one thing standing between `table` and the
same axes the other three are mounted against. The barrel and the rule now say
so plainly instead of implying uniformity that was not there.

Also corrects three docs that claimed `knowledge` and `log` had no canonical
view. They both do; only `table` does not.

Step 5. Two `router.push` calls, both to the tables list, both hand-building
`/workspace/${workspaceId}/tables`.

The table now builds its own `workspaceSource` and asks it for the target —
`source.hrefFor({ to: 'list' })`, the member added for exactly this — and hands
the result to an `onNavigate` prop. The route table stays in one file, and a
host that owns no router simply omits the prop, which makes navigation inert by
construction rather than by a check at each call site.

The source is built inside the table rather than taken as a prop because
`page.tsx` is a Server Component and a source carries closures, which cannot
cross the RSC boundary. That is why the axes reach the table through its client
shell in the first place.

Both hosts supply `onNavigate`: the route shell as `router.push`, the panel
reusing the `navigate` callback its file and log branches already pass.

Step 6. The table borrowed the logs page's `LogDetails` shell to show a run.
That shell reads `useParams`, `useRouter`, `useQueryState` and the permission
context — four route couplings a table has no use for — and it hard-codes
`host='page'`.

The `useQueryState` is the interesting one: it deep-links the log's active tab
unconditionally, so opening a run from the *tables* page wrote `?tab=trace` onto
the tables URL, and onto the host page's URL from the chat panel. A second
instance of the same bug step 3 fixed, in a component nobody thought of as
URL-owning.

`ExecutionSlideout` reproduces only the chrome the table actually uses — frame,
resize handle, close button — and mounts the canonical `LogView` itself. It omits
`tab`/`onTabChange`, so the view keeps the tab local, which is correct for a
panel that was never addressable. The logs page's prev/next and retry controls
are dropped deliberately: they navigate a list this surface does not have, and
the table only ever passed three of that shell's ten props.

`showExecutionInternals` becomes a required prop on the table, forwarded from
both hosts. Not read from `usePermissionConfig` inside the table — although R6
would allow it — because passing R6 by an accident of regex coverage is not the
same as being right, and a permission-group restriction should fail to compile
when a host forgets it rather than default to revealing payloads.

Cross-route edges out of the tables tree: 3 left, and only one of them is real.

Step 7. The table implementation moves out of the route tree and into
`components/resources/table-view/`, joining the layout the unit already had:
`table-view.tsx`, `index.ts`, `components/<child>/`, `hooks/`, `utils/`,
`types.ts`. What stays behind is four route files — `page.tsx`, `loading.tsx`,
`error.tsx`, and the ~50-line client shell that resolves the axes.

`Table` becomes `TableView` and takes `source: ResourceSource<'table'>` instead
of `workspaceId` + `tableId`. Both are banned prop names, and registering the
view in `CANONICAL_UNITS` turns R4a/R4b on to say so — the gate found them
immediately. The subtree below still takes plain ids, so the source is narrowed
once at the top through `tableWorkspaceId`/`tableResourceId`, which is the
helper deleted earlier for having no caller, restored now that it has one.

The four preceding steps are what made this a move rather than a rewrite: with
the router, the params and the permission context already severed, R6 was
already 0 before a single file changed directory. 61 files, ~160 lines of
non-import churn.

One edge stays and is annotated: the workflow-column sidebar renders the
editor's read-only canvas, which reads `useParams` and pulls in the editor's
node and edge components. Safe for the same reason the log view's frozen canvas
is — `ResourceSeedMap['table']` is `never`, so no anonymous surface can mount
this unit — and `CROSS_TREE_ALLOWLIST` now names two files pointing at one
component, which is the signal that `Preview` itself wants to move to
`components/`. That is a separate change.

Every rule back at baseline with the view registered: R2 0, R3c 0, R4a 0, R4b 0,
R6 0.

The rules, CLAUDE.md and the migration doc all still described `table` as the
holdout and the table unit as "view layer only". Corrects the status table, and
two claims that are now wrong in a way that would mislead:

- "A view is read-only; the shell writes." That was a staging point during the
  migration, never a rule — `FileView` edited from the start, and `TableView`
  does now. What a view must not hold is route context, not mutations.
- "`table-grid.tsx` never moved, and did not need to." True of the first pass.
  It moved in the second, intact, and the ordering is the lesson worth keeping:
  the context reads were severed *in place* first, so R6 was already 0 before a
  single file changed directory. The 61-file move then carried no semantic risk.
  Reversed, four behavioural edits would have been buried inside a rename diff.

Also drops the "mothership still mounts the whole editing page" note from the
open list — it mounts `TableView` against a source now, like files and logs.

…nits use

Two deviations this migration introduced, found by diffing all four views'
prop surfaces against each other rather than reading them one at a time.

- The axes did not lead the interface. `source` had replaced `workspaceId` +
  `tableId` in the slot those occupied at the bottom, so the view declared
  `host, grants, … source`. Every other unit reads `source, grants, host` first.

- Two loose optional feature booleans. The rule says collapse into one object
  and never add a loose prop, and the optional default was load-bearing in the
  wrong direction: nobody decided the embedded table has no lock settings —
  `tableLocksEnabled?: boolean` decided it by omission. `features:
  TableViewFeatures` is required, so the panel now states that answer in a
  comment instead of inheriting it from a default. Both fields disappear
  together when the flags GA, which is the other reason they travel as one
  object rather than spread.

Behaviour is unchanged: the panel passes `locks: false`, which is what the
absent prop already resolved to.

Same ordering that made the table move safe: the behavioural edits land first,
as a diff against files that have not moved.

- `useParams` -> `knowledgeWorkspaceId(source)`. The shell took `workspaceId?`
  optionally and fell back to route params, which the page relied on — so the
  fallback was load-bearing, and it is what stopped this surface existing more
  than once per page.
- `useRouter` -> `onNavigate`. Three pushes: the document detail route, the
  post-delete redirect, and the breadcrumb root. The latter two already went
  through `hrefFor({ to: 'list' })`; the first now goes through a new
  `knowledgeDocumentHref`, which lives in a per-kind module because a document
  is not a `ResourceKind` — it has no view, no grants and no share surface, so
  it cannot be spelled through `hrefFor({ to: 'resource' })`.
- `useUserPermissionsContext` -> `grants`. 13 reads, including two of the form
  `canEdit || isLoading` that gate whether a breadcrumb dropdown renders at all.
  Those become `grants.write || !grants.settled` — the exact pattern `settled`
  was added for, and without it the caret would have popped in after load
  instead of rendering disabled.

Three supporting relocations, all pure moves:
- `knowledge/components/icons` deleted — byte-identical to
  `@/components/icons/document-icons`, confirmed with `diff`.
- `use-knowledge-upload` -> `@/hooks/kb/`.
- `useContextMenu` -> `components/anchored-context-menu/`, beside the component
  every one of its 13 consumers pairs it with.

Also makes table-view's internal imports absolute. They arrived relative with
the move and I did not rewrite them; log-view and knowledge-view have zero
relative imports, so table-view was the outlier against the rule this PR
documents. (file-view has 83 and is left alone — pre-existing, and not worth
83 files of churn here.)

The panel now mounts `KnowledgeView` and imports nothing from the workspace
route tree. That was the last of the four kinds.

The shape of this one differs from tables, and the difference is the useful
part: the route shell owned the *whole* surface — header, breadcrumbs, ten
modals, bulk operations, the context menu — while the extracted `KnowledgeView`
was only the document list. So the shell became the view, and the previous view
became its `DocumentList` child. Promoting the read-only half and leaving the
mutations behind would have left the panel importing the route tree forever.

Dropped `id` from the props: `source` already carries it (`knowledgeResourceId`),
and two spellings of the same identity is exactly what the axes replace.
`knowledgeBaseName` stays, documented as a title hint rather than identity — it
is what keeps both hosts from flashing a placeholder header before load.

Four boundary violations surfaced by `check:resources` once the files were
inside a unit, each fixed at the cause rather than annotated:

- `AddDocumentsModal` read `useParams()` for the workspace id. Inside the panel
  there is no `[workspaceId]` segment, so this was already returning undefined
  there — the modal is reachable from `/home`. Now a required prop.
- `use-connector-config-fields` was route-tree-resident but is unit-internal;
  moved to `@/hooks/kb/`.
- `BreadcrumbItem`/`ResourceAction` came from the route barrel that merely
  re-exports `@/components/resource`. Retargeted to the source.
- The knowledge list page and the document route imported past the unit barrel.
  They render the same tag editor and selection bar against the same data, so
  the barrel exports those three children — and the rule now says when that is
  allowed, because "saves an import hop" must not qualify.

`ConnectOAuthModal` and `WorkspaceHostProvider` looked like they pinned the
connector modals to the route tree. Neither is route-specific: both moved to
`components/` (with `WorkspaceAccessDenied`, which the provider renders), 22
importers repointed. Deleting the blocker beat splitting the surface around it.

nuqs stays outside the unit — R6 has no escape hatch — so
`use-knowledge-list-state` moved to `@/hooks/kb/` and its parsers to
`@/lib/knowledge/detail-search-params`, mirroring the table.

Suite: 20917 passed, unchanged from before the move. R6 and R3c both 0.

Six conflicts, all one cause: staging's unbolding sweep (#6400) landed on code
this branch had moved out of the route tree.

Resolved by keeping this branch's structure and replaying every one of staging's
21 `font-medium` removals at the element's new home — 16 applied, the rest
already absorbed by the auto-merge. Verified none of the strings staging
unbolded is still bold anywhere in the tree.

One deliberate deviation: staging rewrote the file-preview fallback as
`text-[14px]`, which the styling rule forbids (font-size only, inherits the
wrong line-height). Took staging's intent — dropping `font-medium` — and kept
the named `text-sm`, which is the same 14px.

`base.tsx` and `file-viewer.tsx` came back as delete/modify conflicts because
they no longer exist here; their changes were ported into `document-list.tsx`
and the file-view unit rather than dropped.

Suite: 20951 passed. R6/R3c 0, 23 audits green.

Cursor caught a real regression, and it was mine. The execution slideout
forwarded the table's `host` into `LogView` while deliberately passing no
`tab`/`onTabChange` — so on the tables page `hostOwnsUrl` was true, `activeTab`
was pinned to `tab ?? 'overview'`, and `setActiveTab` called an undefined
callback. The Trace tab was unreachable when opening a run from the tables page.
The panel host was unaffected, which is why the suite stayed green.

The slideout's own TSDoc already claimed the tab stayed local. The doc described
the intent; forwarding `host` contradicted it.

Fixed at both levels:

- The slideout mounts the log as `host='panel'` outright and no longer takes a
  `host` prop. A run slid in beside a table is embedded no matter where that
  table renders — it has no address on either surface, so the tab is local state
  by definition, not by inheritance from whatever the table happens to be.
- `LogView` treats the tab as URL-owned only when the host actually wired the
  controlled pair (`hostOwnsUrl(host) && onTabChange !== undefined`). A host that
  owns its URL but supplies no setter is embedding this view somewhere
  unaddressable; degrading to local state keeps the tabs working. Dead tabs are
  strictly worse than a tab that does not persist.

The guard rather than a discriminated union on `host`, because the table passes
`host` as a variable — a type-level union would not have fired at that mount.

Suite: 20951 passed.