refactor(#276): Phase 5 — composition cleanup, session teardown, architecture docs (closes #276)

[BorisTyshkevich]

What & why

Closes #276 — Phase 5, the final PR of the refactor (after #278, #279, #281, #282, #289, #290). Six commits:

1. conn/catalog delegate deletion — consumers read app.conn.*/app.catalog.* through narrow Picks (BootstrapApp nests a conn slice; loadConfig's one real caller renamed to conn.resolveConfig); ~150 test sites re-pointed; the CM6 adapter's reference seam re-pointed with its defensive shape preserved.
2. params/queryDoc/prefs delegate deletion — eleven more forwards gone; app.saveVarRecent is the one documented survivor (a mutable test seam the parameter session reads live). fake-app shrank to derive from session stubs — which exposed and fixed a latent cross-test mock-bleed (module-level singleton vi.fn()s accumulated call counts across tests).
3. ui/workbench/workbench-shell.ts — renderApp's entire body (DOM + every effect, subscription sets byte-identical) behind a narrow WorkbenchShellDeps; renderApp is now a thin composition call. dashboard.ts narrowed to DashboardApp. application/ch-session-params.ts is the session_id helpers' final home (one implementation shared by workbench + export wiring — resolving the deferred Phase-4 decision). Boundary rules extended: neither shell may import src/ui/app.ts (verified live with temp violations).
4. Session teardown wired into signOut — a real behavior fix: an in-flight run is now aborted and server-KILLed, exports and lineage fetches cancel, and the schema/reference caches invalidate before the login screen renders (previously stale work could land after sign-out, and caches survived account switches). First production callers for destroy()/invalidate() — the honest wiring point; there is no route-remount to hook. New integration test drives the full cycle including re-auth + a successful streamed run after re-render (the workbench session is reusable post-destroy).
5. docs/ARCHITECTURE.md rewritten — it still documented the pre-refactor god object as the intended design; it now describes the modular monolith (layer diagram with src/application + route session/shell pairs, mechanically-enforced boundaries with the two documented pre-existing exceptions, per-service ownership, lifecycle wiring, the App object's composition-surface role).
6. e2e fixture fix — the raw-harness editor.html builds __app by hand and needed the new catalog seam shape; caught by the end-of-PR chromium+webkit run (8 real failures → 80/80 after).

Final review pass: zero findings — signOut ordering verified race-free (the fire-and-forget KILL captures origin/token synchronously at call time, before conn.signOut() mutates them), the shell extraction diffed byte-faithful against main, delegate deletion verified complete repo-wide, all narrowed interfaces structurally verified, all ARCHITECTURE.md claims checked against code.

Verification: full gate green (115 files / 3,232 tests + tsc + check:arch, 14 files / 4 rules), build green, e2e chromium+webkit 80/80.

#276 acceptance criteria — final audit

Every box in the issue checks: services constructible without App/AppState/DOM ✅ · shared execution service across workbench/dashboard/detached reads ✅ · auth lifecycle in ConnectionSession without rendering ✅ · separate route sessions with owned cancellation + proven destroy() ✅ · ExportService with injectable sink ✅ · catalog/parameter/document/saved-query/schema-graph extractions ✅ · src/application/** free of ui imports (enforced) ✅ · route sessions mutually non-importing (enforced) ✅ · behavior/persisted formats/build compatibility preserved throughout ✅ · temporary adapters deleted (one documented survivor with its rationale in code) ✅ · app.ts is composition/bootstrap (1,453 lines, from 2,964; the remaining bulk is the actions registry, popover/menu DOM, and render-module glue — no business workflows) ✅ · docs/ARCHITECTURE.md updated ✅.

Definition-of-done metrics: app.ts is no longer the largest implementation file for workflow reasons; a unit test executes a query, runs a dashboard tile, validates parameters, and exports to an in-memory sink without DOM (see the service specs); a future MCP command can depend on app.exec/app.conn/app.saved typed services without importing app.ts.

Checklist

• npm test passes (the per-file coverage gate is non-negotiable)
• Tests added/updated in the same change as the code
• npm run build succeeds (single-file dist/sql.html)
• Layers kept honest: pure logic in src/core/, network in src/net/ (injected fetch), DOM in src/ui/
• No new runtime dependency (or it's a deliberate, justified addition — see CONTRIBUTING)
• README / CHANGELOG.md ([Unreleased]) updated if behavior or the deployed surface changed
• Reconciled affected tracked work (roadmap Roadmap to 1.0.0 #68, the issue body, ADR/CHANGELOG) if this change reshaped it

🤖 Generated with Claude Code