Summary

• Server reorder uses the shared reorderStoredChatResources (same as the client projection), so a chat that stores one tab both unscoped and workspace-addressed (one key under the chat-workspace fallback) can be reordered instead of failing validation. Dropped or unknown resources are still rejected
• copiesBeyondWorkspaces parses the sandbox copy body with v2CopyFileItemsContract under V2_PARSE_DEFAULTS, the same contract and body cap as the copy route, instead of an uncapped request.clone().json(). Oversized or invalid bodies stay on the workspace route and get its normal 413/400
• Project-owned file stream events are no longer dropped in organization chats: the workspace guard exempts Project owners, and workspace-scoped invalidation/workflow registry calls only run with a workspace. Non-Project resources behave as before
• The first and third only matter once projects is on; the copy-body cap applies to every sandbox copy callback

Type of Change

• Bug fix

Testing

• New store.test.ts (twin-tab reorder; dropped/unknown still rejected), streamed 20MB copy body in sandbox-resource-transport tests (413 at the cap, not a full read), org-chat Project upsert in handle-resource-event.test.ts; each failed on the previous code
• 17 related test files (200 tests) pass; check:comment-hygiene, check:source-conventions, check:explicit-any, check:test-patterns, check:api-validation:strict, check:boundaries

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)