fix(browse): keep a disabled or stale table-menu item from acting

[dawsontoth]

⊙ Problem

Two Browse menu items could act when they shouldn’t. Disabled Cleanup Orphan Blobs still asked to start cleanup on scripted or assistive technology clicks. Drop Table stayed available for a table the map no longer held.

Browse also looked databases and tables up by name in plain objects. A table named constructor counted as present, and a schema database named __proto__ wrote onto Object.prototype.

🤔 Should the by-name reads ride along with the menu fixes?

They came out of the Drop Table check and touch nine Browse files. They would split cleanly into their own PR.

💡 Solution

• Cleanup Orphan Blobs runs from onSelect, which Radix skips for a disabled item.
• Drop Table waits for the map to hold the table.
• Browse reads both maps by name only through own-key helpers.
• The schema-relationship map is built without prototypes.

⚖️ Alternatives

Three I didn’t take

• Fix the maps once, where they’re fetched, with null-prototype levels in a select on describe_all. TanStack’s structural sharing copies a changed level into a plain {}, including select results. That requires disabling sharing for a map the roles editor and the chat tools read too. The helpers keep the change inside Browse.
• A structuralSharing function for the schema-relationship query that keeps the old map when nothing changed. With sharing off, a refetch (on mount, or focus after a minute) recomputes the table view’s relationship memos. Its column header is rebuilt on every render anyway, so I kept false.
• The same Drop Table check in the table view. Its only mounting site renders <Navigate> when the map loses the table (resolveDatabasesRedirect, run during render in index.tsx), so the check could never fire. DESIGN.md records that the view relies on the redirect.

🔧 Changes

• DatabaseTableView.tsx: Cleanup Orphan Blobs runs from onSelect; Drop Table counts described tables.
• TableContextMenuItems.tsx: Drop Table waits for the described table.
• describedTable.ts: the own-key readers. They replace the bracket reads in the redirect (database, fallback, table), Import Data (target), the action modals, the overview, the tree, relationship attributes and export.
• schemaRelationships.ts: sharing off, null-prototype levels.
• DESIGN.md: the Drop Table, own-key and onSelect rules.

✅ Verification

• Component tests click and press Enter on the disabled cleanup item in the real Radix menu, and render the table menus over a map that lacks the table or loses it while open. Unit tests cover the helpers, the redirect, the tree, Import Data and the schema parser for constructor, toString and __proto__, including a changed map written over the old one in a real QueryClient.
• The new menu assertions fail on the base branch. Reverting each of the 12 guards alone turns a test red.
• Checks on this commit: vitest run (553 files, 5,508 passed), tsc -b, oxlint, dprint check and commitlint, all exit 0.

_{🤖 Generated with Claude Code by Anthropic Claude Opus 5.5; posted via @dawsontoth.}

Related PRs: #1961 overlaps (the base this PR stacks on), #1953 independent (merged; this extends its described-table rule to Drop Table), #1958 independent (both edit DatabaseTableView.tsx, in different hunks), #1955 independent (both edit the databases DESIGN.md, in different sections)
Complexity: medium

_{Review-Coverage: authored=claude; ran=gemini,cursor-composer,codex,cursor-muse,cursor-grok; adjudicated=domain; declined=cursor-kimi,muse; rounds=11; full=2 @ 7dacf92}

_{Review-Attention: study ~11m (critical: schemaRelationships.ts; decisions: relationship-map-sharing-off, drop-table-gate-asymmetry, do-less-alternative) @ 7dacf92}

[gemini-code-assist]

Code Review

This pull request introduces safe database and table lookup utilities to prevent prototype pollution and incorrect lookups when database or table names match Object.prototype properties (such as constructor, toString, or __proto__). It replaces direct property access with these safe lookup functions across various components, modals, and hooks. Additionally, it updates the schema relationship parsing to use prototype-free objects (Object.create(null)) and disables structural sharing for these queries. Finally, it fixes an issue where disabled Radix menu items could still trigger actions by switching from onClick to onSelect. Since there are no review comments, no further feedback is provided.