feat(#494): direct Dashboard/Panel row actions, replacing the ⋯ overflow menus (phase 4)

[BorisTyshkevich]

What & why

Part of #494 (revised #429 phase 4), and the four post-merge review findings on #495.

The Dashboard tree's rows act directly now

Dashboard and Panel rows expose their operations as real buttons instead of hiding them
behind a ⋯ menu, following the Library Query row's pencil/trash vocabulary. No
production row renders an overflow menu any more, so DashboardTreeMenuItem,
buildMenuButton and the menu CSS are deleted rather than left as an unused abstraction.

• Model. menu, deletable and renamable — three expressions of one idea — collapse
  into actions: DashboardTreeAction[]: accessible name, tooltip, a fully-resolved target
  (stable ids only), an unavailable reason, and the confirmation sentence for the
  destructive ones. Availability is the Separate Library queries from dashboard-owned query copies #427 exactly-one-owner rule, answered once here
  through buildQueryOwnershipIndex; the view never re-derives it. OwnershipWorkspace.queries
  narrows to { id } so the tree's loosened projection types can be indexed by that same rule.
• Pure transforms (dashboard/application/dashboard-removal.ts). removeDashboardPanel
  removes a tile and exactly the dedicated query it owns — proving ownership first, composing
  removeTileMembership for layout normalization and grid-fallback regeneration, bumping the
  revision exactly once. removeDashboardDocument removes a document plus the queries its own
  tiles own, keeping any query another Dashboard also references. An orphaned variableConfigs
  entry deliberately survives a panel delete (Dashboard tree: replace overflow menus with direct Panel focus, edit and delete actions (#429 phase 4) #494 non-goal).
• Commits. Both deletes and the panel pencil re-resolve their target inside the queued
  read-latest transform, so a dialog or confirmation that went stale while it was open
  commits nothing and says so. The panel pencil edits the tile's owned query through
  renameSaved — inheriting its linked-tab reconciliation — with a new dequeue-time guard
  on patchSavedSpec proving the tile still owns it.
• View. One buildActionButton per model action. An unavailable control still renders,
  aria-disabled and inert, with the reason as its tooltip — a row's vocabulary must not
  shrink when its data is malformed. Destructive actions confirm through the same anchored-menu
  primitive Replace curated Dashboard filters with inferred Variables and batched option queries #447 used, and the confirmation opens on Cancel. Deleting a panel moves keyboard
  focus to the next sibling, else the previous, else the Panels group.

Deferred: the Open-in-Dashboard focus button. It dispatches
focus: { kind: 'tile' }, which #438 proves is a no-op on flow-layout KPI tiles, and #494
forbids shipping a known no-op focus action. The capability is not lost — double-click and
Shift-click still focus a tile — only its promotion to a button waits. Owner decision taken at
the start of this phase; #494 stays open for it.

The four #495 review findings

1. Enter on a nested action button ran the ROW's command. The tree's keydown handler is on
   the list and its Enter arm runs the focused row's action, so Enter on the pencil opened the
   Dashboard — and could swallow the button's own activation on the way out. The ⋯ and the
   orphan-variable trash shared the bug. Fixed in two independent layers, each separately tested.
2. Rename failures closed the dialog and discarded the edit. The dialog now awaits the write
   and keeps the card open with the typed text on every unsuccessful outcome, showing one
   targeted diagnostic inline; the same mutation cannot be submitted twice.
3. Dashboard creation had two commands with divergent failure behaviour.
   application/dashboard-create.ts is the single one; both entry points report identically and
   keep their own reveal policy. The placeholder previously said nothing on a rejected commit.
4. The modal had no dialog semantics — role="dialog", aria-modal, aria-labelledby added.

Review pass

Two independent read-only reviews (correctness + accessibility) ran over the branch. Everything
they surfaced is fixed in the last commit — a real focus regression (a successful commit repaints
the tree, detaching the trigger the dialog captured), a Dashboard delete that stranded focus, a
confirmation that opened on its destructive item, an unavailable delete that stopped looking like
one — plus four assertions that could not fail (the same-row cancelFor, the glyph mapping, two
not.toBe('') checks, and the e2e post-delete focus check). Each fix is sabotage-checked.

Verification

npm test          6035 passed / 184 files, per-file gate held
npx tsc --noEmit  clean
npm run build     clean
npm run test:e2e  484 passed, 0 failed (chromium + webkit + firefox, --workers=1)

Also driven in the real served app against local ClickHouse 26.6: created a Dashboard from the
File menu (one toast, from the unified command), assigned a Library query, opened the Dashboard,
renamed the panel from the tree pencil — the rendered tile heading and the tree row both followed —
then deleted the panel from the tree while its Dashboard was on screen: the tile disappeared from the
rendered Dashboard, the row went with it, focus fell back to the Panels group, the Library source
query stayed untouched, and the console stayed clean.

Checklist

• npm test passes (the per-file coverage gate is non-negotiable)
• Tests added/updated in the same change as the code
• npm run build succeeds (single-file dist/sql.html)
• Layers kept honest: pure logic in src/core/, network in src/net/ (injected fetch), DOM in src/ui/
• No new runtime dependency
• README / CHANGELOG.md ([Unreleased]) updated if behavior or the deployed surface changed
• Reconciled affected tracked work — Dashboard tree: replace overflow menus with direct Panel focus, edit and delete actions (#429 phase 4) #494's acceptance criteria ticked and its deferred scope recorded in the body; the Dashboard tree management: direct Dashboard and Panel actions #429 ship log updated

[BorisTyshkevich]

Review round 3 — verification notes

Five findings raised. Each was checked against the code before acting; the fixes are in fd6341f, and reverting all five together fails twelve tests.

Confirmed and reproduced:

#	Claim	Reproduced
1a	The delete discards the confirmed queryId and removes whatever the tile points at by dequeue time	Yes — tile re-pointed qa→qb, transform returned ok deleted=qb. Both states are individually valid, so nothing else notices
1b	A duplicated tile id removes both tiles	Yes — 2 tiles in, tilesLeft=0, the second tile's query orphaned
3	Deleting the only search match strands focus	Yes — rows=[], activeElement=BODY, keyboardRowKey=null
4	Closing a stale dialog whose row is gone loses focus	Yes — activeElement=BODY
5	Repeated activation mounts duplicate modals	Yes — 3 activations → 3 backdrops and 3 #dash-rename-name elements

One correction to the framing. The malformed inputs behind 1b, 1c and 2 cannot reach the transform from storage. dashboard-duplicate-tile-id, workspace-duplicate-query-id, dashboard-setup-reference and dashboard-tile-role-incompatible are all error-severity diagnostics (emit → diagnostic() hardcodes severity: 'error'), and both decodeStoredWorkspaceJson on load and encodeStoredWorkspaceJson on commit reject a workspace carrying any diagnostic — verified by running the validator on each shape (a healthy control returns []). So those are defence-in-depth gaps against states the persistence layer forbids, not live data-loss paths. They are cheap to close and #494 asks for fail-closed, so they are closed — but the "risk 97, destructive" framing overstates 1b/1c/2. 1a is the real one, because a re-pointed tile is valid data on both sides of the change.

All five are fixed — see the commit message for the mechanics. Also worth recording: the tree's unit fixture never projected or repainted what it committed, so several post-delete assertions were being made against rows the write should have removed. It does both now, which is what made findings 3 and 5 reproducible at the unit level at all.

Gate after the fixes: npm test 6048 passed, per-file coverage held · tsc --noEmit clean · npm run build clean · npm run test:e2e 484 passed, 0 failed (chromium + webkit + firefox).