Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/app/api/zero/query/route.ts`:
- Around line 127-132: Replace the raw-ID console.warn in the denied-workspace
branch (the if (deniedWorkspaceIds.length > 0) block referencing userId,
requestedWorkspaceIds, deniedWorkspaceIds) so it no longer logs identifiable
values; instead log non-identifiable metadata such as deniedWorkspaceIds.length
and requestedWorkspaceIds.length plus a request or correlation ID (or store and
log hashed/redacted versions of the IDs) and update the log call accordingly to
avoid persisting raw user/workspace identifiers.
- Around line 56-68: The current auth logic relies on heuristically inspecting
args via extractWorkspaceId(args) which lets any new workspace-scoped query with
a different arg shape bypass authorization; change to fail-closed by keying
workspace authorization off query identity/metadata instead: introduce a
canonical registry or switch (e.g., map of queryName => requiresWorkspace
boolean) used by the request handler to decide whether to require a workspace
id, update extractWorkspaceId to be a targeted helper (or add a new
getWorkspaceIdForQuery(queryName, args) that knows per-query shapes) and make
the handler reject requests for queries marked as workspace-scoped when no
workspace id can be extracted, and apply the same change where
extractWorkspaceId is used elsewhere (the other usage around lines 137-145) so
unknown queries default to denied.

In `@src/components/chat/ChatPanel.tsx`:
- Around line 39-46: The useEffect currently calls onReady when isLoading is
false and state is truthy, which can run before a workspaceId exists; update the
effect (the useEffect that references useWorkspaceItems,
useWorkspaceItemsLoading and onReady) to also require workspaceId be truthy
before invoking onReady so it won't fire while ChatPanelSkeleton is rendered;
ensure the dependency array includes workspaceId.

In `@src/components/workspace-canvas/WorkspaceSearchDialog.tsx`:
- Around line 36-38: The current check sets isLoadingWorkspace only for
view.kind === "loading" but the empty-state UI also treats a missing
currentWorkspaceId as "Loading...", which can mislabel
denied/error/unauthenticated cases; update WorkspaceSearchDialog to (1) keep
isLoadingWorkspace = view.kind === "loading", (2) change the
empty-state/placeholder logic to inspect view.kind and view.currentWorkspaceId
explicitly and render different messages for "denied", "unauthenticated",
"error" vs true loading or missing workspace id, and (3) reference
useWorkspaceView, view.kind, view.currentWorkspaceId and isLoadingWorkspace when
implementing these conditional branches so each state shows the correct message.

In `@src/components/workspace-canvas/WorkspaceSection.tsx`:
- Around line 419-443: Guard the context menu callbacks so they no-op unless the
workspace view is in a ready state: wrap each callback passed into
renderWorkspaceMenuItems (the functions referencing addItem, handleCreatedItems,
handleUploadMenuItemClick, openAudioDialog, setShowYouTubeDialog,
setShowWebsiteDialog, setShowFlashcardsDialog, setShowQuizDialog) with a check
against the workspace-ready flag (e.g., isWorkspaceReady or workspaceView ===
'ready') and return early if not ready; alternatively disable rendering of
ContextMenuContent/ContextMenuItem when the workspace is not ready so none of
those mutating callbacks can be invoked from
loading/unauthenticated/denied/error states. Ensure the guard lives next to the
ContextMenuContent render logic so the behavior is consistent across all menu
entries.

In `@src/contexts/WorkspaceContext.tsx`:
- Line 103: The fetch URL is built using the raw currentSlug which can contain
reserved URL characters; update the fetch call that uses currentSlug to encode
it (use encodeURIComponent on currentSlug) before interpolation so the request
targets the correct endpoint (replace `/api/workspaces/slug/${currentSlug}` with
a version that interpolates the encoded slug), ensuring any function or block
that calls this fetch (the code referencing currentSlug in WorkspaceContext.tsx)
uses the encoded value.

In `@src/hooks/workspace/use-workspace-upload.ts`:
- Around line 58-61: prepareWorkspaceUploadSelection is still applying the
default max-size filter so oversized files get rejected even when
enforceSizeLimit is false; update the call in useWorkspaceUpload (the block
around prepareWorkspaceUploadSelection(candidates)) to pass the enforceSizeLimit
flag (or extend prepareWorkspaceUploadSelection to accept an options object with
enforceSizeLimit) and update prepareWorkspaceUploadSelection implementation to
skip size filtering when that flag is false, ensuring acceptedFiles retains
oversized files only when enforceSizeLimit === true; reference
prepareWorkspaceUploadSelection and the enforceSizeLimit variable in
use-workspace-upload.ts to locate and change both the call site and the selector
function.
- Around line 42-44: In use-workspace-upload (the callback that checks
operations and currentWorkspaceId), replace the throw new Error("Workspace not
available") with a user-facing toast/error notification and an early return to
avoid an unhandled rejection; specifically, import/use your toast utility, call
something like toast.error("Workspace not available") (or show an equivalent UI
message) and then return (or return Promise.resolve/void) from the handler
instead of throwing, keeping the checks around operations and currentWorkspaceId
intact.

In `@src/lib/zero/client.ts`:
- Around line 42-43: The code calls destroyZero() without awaiting, causing a
race between Zero.close() and creating a new instance; update destroyZero() to
return the Promise from Zero.close() (ensure it propagates the async result) and
change the caller check (the block referencing zeroInstance, zeroUserId and
params.userId) to await destroyZero() when switching users so the previous Zero
session fully closes before creating a new instance.

---

Outside diff comments:
In `@src/app/api/workspaces/slug/`[slug]/route.ts:
- Around line 50-63: The current collaborator lookup uses .limit(1) without
ordering so results are nondeterministic; update the query that selects from
workspaceCollaborators (the db.select(...) call using candidateIds and userId)
to add a deterministic .orderBy(...) clause so the same collaborator row is
chosen consistently (for example order by workspaceCollaborators.workspaceId
ascending and then workspaceCollaborators.permissionLevel descending as a
tiebreaker) before calling .limit(1).

In `@src/hooks/ui/use-navigate-to-item.ts`:
- Around line 19-26: The guard in use-navigate-to-item.ts currently checks
workspaceState (which is always truthy) so the "Workspace not loaded" branch is
unreachable; instead use the loading/status from useWorkspaceItems() to decide
whether to show "Workspace not loaded" vs "Item no longer exists". Update the
logic in the function that references workspaceState and itemId to check the
workspace-items hook's loading or status flag (e.g., isLoading or status) before
attempting workspaceState.find(...), return false and toast.error("Workspace not
loaded") when loading, and only then perform the item lookup and
toast.error("Item no longer exists") if the item is missing; keep respect for
options?.silent when showing toasts.

---

Nitpick comments:
In `@src/components/layout/WorkspaceLayout.tsx`:
- Around line 125-134: The ChatProvider in WorkspaceLayout doesn't remount when
switching workspaces, so add a key prop tied to the workspace id to force
remount: update the JSX that renders <ChatProvider
workspaceId={currentWorkspaceId}> (within WorkspaceLayout) to include
key={currentWorkspaceId} so the ChatProvider (and its children like
ComposerProvider) are recreated whenever currentWorkspaceId changes, resetting
any workspace-specific internal state.

In `@src/components/workspace-canvas/WorkspaceSection.tsx`:
- Around line 383-413: In the ready branch (where view.kind === "ready") replace
uses of the local derived state as the canonical item list with view.items: pass
view.items instead of state into WorkspaceContent (e.g., the
viewState/collection prop or wherever items are provided) and use view.items for
MarqueeSelector.cardIds (map item.id from view.items) so the UI uses view.items
as the single source of truth and avoids dual data sources causing drift.

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/components/layout/SessionHandler.tsx">

<violation number="1" location="src/components/layout/SessionHandler.tsx:22">
P2: `inFlight` is never cleared after a successful anonymous sign-in, so a later `session -> null` transition can skip re-auth and leave the loader stuck.</violation>
</file>

<file name="src/hooks/workspace/use-workspace-upload.ts">

<violation number="1" location="src/hooks/workspace/use-workspace-upload.ts:58">
P2: `enforceSizeLimit: false` is ineffective because `prepareWorkspaceUploadSelection` is still called with its default 50MB filter, so large files are silently dropped.</violation>
</file>

<file name="src/hooks/workspace/use-workspace-view.ts">

<violation number="1" location="src/hooks/workspace/use-workspace-view.ts:35">
P2: Transient/non-404 workspace fetch failures are incorrectly surfaced as `denied` instead of an error state with retry.</violation>
</file>