refactor(#276): extract WorkbenchSession — phase 3a

[BorisTyshkevich]

What & why

Part of #276 — Phase 3a of the app.ts → services refactor (PRs #278 Phase 0–1, #279 Phase 2 merged). The issue's Phase 3 covers both route sessions; plan review split it into 3a (WorkbenchSession, this PR) and 3b (DashboardSession, next) — the two domains are mutually non-importing by requirement and independently revertable.

WorkbenchSession (src/ui/workbench/workbench-session.ts, 52-test spec at 100/98.7/100/100) is the route-scoped owner of the workbench running operation: run/runScript/runEntry/cancel moved verbatim (F6 wave-clock ordering, batch() discipline, finally teardown order, result.source-before-running-flip all preserved with their comments). Per issue rule 5, cancellation state now belongs to its owner: runT0/runQueryId/runTick and the in-flight AbortController are private session fields — the RunState cast and AppState.abortController are deleted.

• The session is the sole production writer of running; shared signals stay on AppState via a narrow WorkbenchStateSlice (structurally satisfied by AppState; never the App object — rule 1).
• DOM/render stays in the shell via injected hooks (renderResults, varGateBlocked (toast-owning), recordHistory, tickElapsed, onAuthFailed → chCtx.onSignedOut()); pure helpers are direct imports, not hooks (no god-bag). savedForTab/recordScriptHistory narrowed to Picks in state.ts (type-only).
• The three run-coupled renderApp effects now register via session.attachShell(...) with captured disposers — idempotent on re-render, which incidentally fixes a latent double-registration on the connect → renderApp path.
• destroy() disposes effects, clears the elapsed ticker, aborts + KILLs an in-flight operation — unit-proven per the acceptance criteria ("Both route sessions expose destroy() and tests prove cleanup"); no production caller until Phase 5's route shells (documented in the module header).
• build/check-boundaries.mjs generalized to a rule list: src/application ⇒ no ui/editor (Phase 0 rule); ui/workbench ⇔ ui/dashboard must not import each other; ui/dashboard must not import the editor (Phase 3 rules, active as the directories appear).

Call-site inventory (from plan review): actions.run/cancel plus the three additional run() callers (explainQuery/setExplainView/setResultRowLimit) delegate to the session; app.elapsedMs delegates; 4 app.test.ts tests rewritten from private-state pokes to observable behavior (fetch counts; the live query_id asserted on the KILL QUERY wire). app.ts sheds ~430 lines. dashboard.ts/results.ts/shortcuts.ts untouched.

Review: 4-angle pass — removed-behavior and cross-file angles clean (the latter re-ran the full gate itself); fixes applied: stale module header, WorkbenchResultView now derived from AppState['resultView']['value'] (no drifting hand-copy), two unnecessary test double-casts removed.

Verification: full gate green (105 files / 3,052 tests + tsc + check:arch), build green.

Acceptance criteria progress: Workbench route-scoped session with owned cancellation state ✅; destroy() with proven cleanup ✅ (workbench half); route-session import boundary enforced ✅.

Checklist

• npm test passes (the per-file coverage gate is non-negotiable)
• Tests added/updated in the same change as the code
• npm run build succeeds (single-file dist/sql.html)
• Layers kept honest: pure logic in src/core/, network in src/net/ (injected fetch), DOM in src/ui/
• No new runtime dependency (or it's a deliberate, justified addition — see CONTRIBUTING)
• README / CHANGELOG.md ([Unreleased]) updated if behavior or the deployed surface changed
• Reconciled affected tracked work (roadmap Roadmap to 1.0.0 #68, the issue body, ADR/CHANGELOG) if this change reshaped it

🤖 Generated with Claude Code