fix(files): cancel resumed runs across replicas, unify anchored file edits, and harden workspace, integration, and presence paths - #9035

Summary

Execution

• Stop during an active resume did not reach the running attempt when the Stop landed on another replica: the engine listened for cancellation on the durable run id while Stop signalled the attempt id. The resume attempt now subscribes to cancellation on its own id for its lifetime; a subscription failure is treated like an unavailable run buffer, so the pause stays retryable.
• Evaluation models were accepted as Agent fallbacks at authoring time, and a saved one failed every run with a retryable error. The validator now rejects them, and the runtime refusal is non-retryable.
• The Agent fallback loop now skips a cross-provider candidate that needs its own family credentials, through the same helper Router and Evaluator use.
• Removed the Agent block's fallback normalization from its params mapping, which the Agent handler never runs.
• Uncached deployment comparison materialization no longer deep-clones freshly read state.

Files

• Anchored delete_between/replace_between failed when the end anchor also appeared before the start. occurrence selects the start anchor; the end anchor is the first match after it, and the v2 contract, File block, and tool descriptions now say so. An end anchor found only before the start now returns not_found (404) instead of a validation error (400). Copilot's edit tool and its streaming preview use the shared implementation instead of two inline copies. Behavior changes for those two callers: a trailing newline in inserted content no longer adds a blank line, and whitespace-only anchors are refused like the File block already refuses them.
• Anchored edits preserve each line's own line ending instead of rewriting a mixed file to one ending, and build their line arrays without spreading inserted lines into one call, so very large inserts no longer overflow the call stack.
• Resolving one named file inside a folder scope listed up to 5000 files and failed for larger folders; it now uses an exact-name scoped query with the same ambiguity and not-found errors.
• Root plus subfolders is treated as unscoped instead of binding every folder id; the two duplicate folder-scope predicates are one helper.
• The context-processing failure log records the context kind instead of the whole context (which can hold selected file text).
• The untitled-file rename from the leading heading fires when the cursor leaves the heading, on an in-page blur, or on unmount, instead of after an idle pause, and only after a local edit that changed the document, so opening and leaving a file never renames it. The handler receives the file id explicitly.
• useResourceFolders memoizes on stable query fields.

Projects and workspaces

• Fork creation takes the Project lock shared; every holder it must exclude (archive, split, transfer, departure) takes it exclusively.
• Banning a user archives every owned workspace and reports failures together instead of stopping at the first.
• Removed dead guards on the non-null workspace.project_id; operator errors name release v0.9.18 instead of a PR number; the membership migration logs each repaired workspace's workflow ids after the repair commits.
• Added indexes on chat.user_id and the legacy workspace_file.uploaded_by (migration 0429, concurrent) for member-removal ownership lookups.
• Creator handoff loads file version heads in one query.
• Admin cross-org workspace move preflight now reports source-org custom blocks used by the moving workspace but bound elsewhere, which stop resolving after the move. Replays report the recorded impact; the move flow drops dead code and contradictory comments.
• RevokeWorkspaceAccessResult drops an unreachable variant; unresolvedWorkflows is renamed unresolvedWorkspaceIds.
• Fork sync's per-param visibility map is one shared helper.

Integrations

• Zoho Desk permanent webhook registration failures were retried until max attempts; they now fail terminally via WebhookDeploymentConfigurationError, classified in one helper in deploy.ts.
• Zoho Desk, SailPoint, and Outlook calendar ids in URL paths go through safeUrlPathSegment, so ./.. can't redirect a request to another endpoint.
• Outlook list-events page tokens must continue a calendarView, not just any Graph URL.
• SailPoint token cache uses LRUCache with per-entry TTLs, keeping the cap of 100 concurrent token exchanges (an evicted exchange still counts until it settles); limits come from the schema constants.
• Zoho Desk host helpers are shared; JWKS cache uses LRUCache. Ashby shares one error extractor. Profile-validation logs record keys only.

Realtime

• File-editor presence no longer retries a fetch that timed out, keeps a roster change that arrived during a failed read (with a fresh retry allowance), and emits each snapshot before re-checking. Presence clearing is one helper and the relay registers once at startup.

Tables, logs, knowledge

• workflow_input appears under Built-in Tools in the agent tool picker (picker split by base type).
• Table query guidance states boolean columns reject range operators and builds operator lists from FILTER_OPS.
• Logs keep archived workflows' names but do not open them; only a hard-deleted workflow reads as deleted.
• Disabled-image removal keeps walking past a page that removed nothing; docs state the image cap is per sync run and each member-accounts continuation run can read up to it.

File accounting and retention

• Bulk file-folder archive, restore, and delete-by-path take the Project lock, the workspace row, then the directory lock, the order uploads and registrations use; the two orders could deadlock in one workspace.
• Workspace accounting locks only the workspace row while preparing and the payer row only when a non-zero delta is applied, so zero-delta and collab-state saves do not serialize on the organization row or fail without a payer stats row. Content commits drop a repeated Project lock; a folder-id upload target is a point query; the file list keeps one file-id filter.
• Without cleanup budgets, one failing workspace file-folder cleanup or Project retention pass is logged and the rest of the run (knowledge bases, resource targets, orphan bindings, chat cleanup) continues. Folder cleanup locks only workspaces with an expired file folder; Project version and folder retention no longer lock the payer; the free-plan version cap is one constant.
• An inline live-doc reconcile exception logs at warn again (the outbox retries it).
• Outlook event and calendar ids containing / are encoded (%2F) instead of rejected; empty and dot-segment ids are still refused.

Type of Change

• Bug fix

Testing

• Regression tests that fail on the pre-fix code: resume Stop from another replica, evaluation-model fallback validation and non-retryable refusal, Agent cross-family skip, anchored end-after-start and mixed line endings, scoped name resolution past a large folder, root-with-subfolders scope, untitled rename on heading exit, Zoho config failure classification, Outlook page-token collection and path ids, SailPoint failed-exchange, 401 refresh, and concurrent-exchange cap, presence roster change during a failed read and non-retried adapter timeout, large anchored inserts, emptied replace_between line ending, resume cancellation-subscription failure, untitled file opened without edits, disabled-image removal past an empty page, archived workflow in logs (not openable, keeps its name).
• New integration checks: upload and registration commit alongside a bulk archive queued first on the directory lock; an unbudgeted file-folder failure rolls back while the rest of the purge runs.
• New integration suites: two-replica file-editor presence over the Redis adapter, admin cross-org workspace move, shared Project lock for file writers and fork creation.
• Targeted unit suites for every changed area; check:migrations, offline drizzle-kit generate, artifact regeneration (tool metadata, docs manifest, agent stream docs, integration docs). Full lint, audits, type-check, and integration suites run in CI.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)