fix(tables): revalidate sync imports under the advisory lock, explain every blocked key

- The sync append/replace paths asserted only the request-start snapshot, so a
  lock committed while the CSV was parsed still let the write through. Both now
  re-read under the schema advisory lock at the top of their own transaction,
  taken before acquireRowOrderLock so the order stays advisory -> rows_pos ->
  definitions
- Delete/Backspace, Cmd+D, typeahead and cut raised no notice on an
  update-locked table; they now explain the lock, and stay silent for users
  without write access
- The multipart import fetch threw a plain Error, dropping the 423 status, so
  the lock self-heal never ran and the stale detail cache survived. It throws
  ApiClientError now and both import-into-table hooks call
  handleTableLockRejection
- Force append at submit when the delete lock landed while the dialog was open
  with Replace already selected

Author: TheodoreSpeaks

apps/sim/app/workspace/[workspaceId]/tables/[tableId]/components/table-grid/table-grid.tsx

@@ -2269,7 +2269,12 @@ export function TableGrid({
         !rowSelectionIsEmpty(rowSelectionRef.current)
       ) {
         if (editingCellRef.current) return
-        if (!canEditCellRef.current) return
+        if (!canEditCellRef.current) {
+          // Explain the lock rather than no-op, but only for users who
+          // could otherwise edit — for the rest it is a permission limit.
+          if (canEditRef.current) onBlockedActionRef.current('edit-cell')
+          return
+        }
         e.preventDefault()
         const rowSel = rowSelectionRef.current
         void (async () => {
@@ -2479,7 +2484,12 @@ export function TableGrid({
 
       if ((e.metaKey || e.ctrlKey) && e.key === 'd') {
         e.preventDefault()
-        if (!canEditCellRef.current) return
+        if (!canEditCellRef.current) {
+          // Explain the lock rather than no-op, but only for users who
+          // could otherwise edit — for the rest it is a permission limit.
+          if (canEditRef.current) onBlockedActionRef.current('edit-cell')
+          return
+        }
         const sel = computeNormalizedSelection(anchor, selectionFocusRef.current)
         if (!sel || sel.startRow === sel.endRow) return
         const sourceRow = currentRows[sel.startRow]
@@ -2513,7 +2523,12 @@ export function TableGrid({
       }
 
       if (e.key === 'Delete' || e.key === 'Backspace') {
-        if (!canEditCellRef.current) return
+        if (!canEditCellRef.current) {
+          // Explain the lock rather than no-op, but only for users who
+          // could otherwise edit — for the rest it is a permission limit.
+          if (canEditRef.current) onBlockedActionRef.current('edit-cell')
+          return
+        }
         e.preventDefault()
         const sel = computeNormalizedSelection(anchor, selectionFocusRef.current)
         if (!sel) return
@@ -2574,7 +2589,12 @@ export function TableGrid({
       }
 
       if (e.key.length === 1 && !e.metaKey && !e.ctrlKey && !e.altKey) {
-        if (!canEditCellRef.current) return
+        if (!canEditCellRef.current) {
+          // Explain the lock rather than no-op, but only for users who
+          // could otherwise edit — for the rest it is a permission limit.
+          if (canEditRef.current) onBlockedActionRef.current('edit-cell')
+          return
+        }
         const col = cols[anchor.colIndex]
         // Workflow-output cells are editable: the user can override the
         // workflow's value if they want. Booleans toggle on space/click —
@@ -2777,7 +2797,12 @@ export function TableGrid({
       const tag = (e.target as HTMLElement).tagName
       if (tag === 'INPUT' || tag === 'TEXTAREA') return
       if (editingCellRef.current) return
-      if (!canEditCellRef.current) return
+      if (!canEditCellRef.current) {
+        // Explain the lock rather than no-op, but only for users who
+        // could otherwise edit — for the rest it is a permission limit.
+        if (canEditRef.current) onBlockedActionRef.current('edit-cell')
+        return
+      }
 
       const rowSel = rowSelectionRef.current
       const cols = columnsRef.current

apps/sim/app/workspace/[workspaceId]/tables/components/import-csv-dialog/import-csv-dialog.tsx

@@ -314,6 +314,9 @@ export function ImportCsvDialog({
   async function handleSubmit() {
     if (!parsed || !canSubmit) return
     setSubmitError(null)
+    // Hiding the Replace control doesn't clear an already-selected `mode`, so a
+    // delete lock landing while the dialog is open would still submit replace.
+    const effectiveMode: CsvImportMode = canReplace ? mode : 'append'
     const createColumns =
       canCreateColumns && createHeaders.size > 0 ? [...createHeaders] : undefined
 
@@ -334,7 +337,7 @@ export function ImportCsvDialog({
           workspaceId,
           tableId: table.id,
           file: parsed.file,
-          mode,
+          mode: effectiveMode,
           mapping,
           createColumns,
           onProgress: (percent) => {
@@ -365,12 +368,12 @@ export function ImportCsvDialog({
         workspaceId,
         tableId: table.id,
         file: parsed.file,
-        mode,
+        mode: effectiveMode,
         mapping,
         createColumns,
       })
       const data = result.data
-      if (mode === 'append') {
+      if (effectiveMode === 'append') {
         toast.success(`Imported ${data?.insertedCount ?? 0} rows into "${table.name}"`)
       } else {
         toast.success(

apps/sim/hooks/queries/tables.ts

@@ -17,6 +17,7 @@ import {
 } from '@tanstack/react-query'
 import { useRouter } from 'next/navigation'
 import {
+  ApiClientError,
   extractValidationIssues,
   isApiClientError,
   isValidationError,
@@ -1578,7 +1579,13 @@ export function useUploadCsvToTable() {
 
       if (!response.ok) {
         const data = await response.json().catch(() => ({}))
-        throw new Error(data.error || 'CSV import failed')
+        // Carry the status: a plain Error drops it, and the 423 self-heal below
+        // keys off `error.status`.
+        throw new ApiClientError({
+          status: response.status,
+          body: data,
+          message: data.error || 'CSV import failed',
+        })
       }
 
       return response.json()
@@ -1714,7 +1721,8 @@ export function useImportCsvIntoTableAsync() {
       })
       return response.data
     },
-    onError: (error) => {
+    onError: (error, variables) => {
+      if (handleTableLockRejection(error, queryClient, variables.tableId)) return
       logger.error('Failed to start async CSV import:', error)
       toast.error(error.message, { duration: 5000 })
     },
@@ -1793,7 +1801,8 @@ export function useImportCsvIntoTable() {
 
       return response.json()
     },
-    onError: (error) => {
+    onError: (error, variables) => {
+      if (handleTableLockRejection(error, queryClient, variables.tableId)) return
       logger.error('Failed to import CSV into table:', error)
       toast.error(error.message, { duration: 5000 })
     },

apps/sim/lib/table/import-data.ts

@@ -13,13 +13,14 @@ import { assertRowCapacity, notifyTableRowUsage } from '@/lib/table/billing'
 import { CSV_MAX_BATCH_SIZE } from '@/lib/table/import'
 import { assertRowDelete, assertRowInsert, assertSchemaMutable } from '@/lib/table/mutation-locks'
 import { nKeysBetween } from '@/lib/table/order-key'
+import type { DbTransaction } from '@/lib/table/planner'
 import {
   acquireRowOrderLock,
   guardBatch,
   type MutationRevalidator,
 } from '@/lib/table/rows/ordering'
 import { batchInsertRowsWithTx, replaceTableRowsWithTx } from '@/lib/table/rows/service'
-import { addTableColumnsWithTx, auditTableColumnsAdded } from '@/lib/table/service'
+import { addTableColumnsWithTx, auditTableColumnsAdded, getTableById } from '@/lib/table/service'
 import type {
   ReplaceRowsResult,
   RowData,
@@ -187,6 +188,28 @@ export async function setTableSchemaForImport(
   })
 }
 
+/**
+ * Re-reads the table under its schema advisory lock inside the caller's
+ * transaction. The sync import paths own their transaction rather than taking a
+ * revalidator, so they refresh here: a lock committed while the CSV was being
+ * parsed must be visible to the asserts in `addTableColumnsWithTx` /
+ * `batchInsertRowsWithTx` / `replaceTableRowsWithTx`, which all read the
+ * definition they are handed.
+ *
+ * Taken before `acquireRowOrderLock` so the order stays advisory → rows_pos →
+ * definitions, matching every other advisory-lock holder.
+ */
+async function refreshUnderLock(
+  trx: DbTransaction,
+  table: TableDefinition
+): Promise<TableDefinition> {
+  const fresh = await guardBatch(trx, table.id, async (tx) => {
+    const latest = await getTableById(table.id, { tx, includeArchived: true })
+    return latest ?? undefined
+  })
+  return fresh ?? table
+}
+
 /**
  * Owns the append-import transaction so the API route never holds a `trx`:
  * optionally creates the new columns, then inserts every row in CSV-sized
@@ -206,15 +229,15 @@ export async function importAppendRows(
     addedRows: rows.length,
   })
   const result = await db.transaction(async (trx) => {
-    let working = table
+    let working = await refreshUnderLock(trx, table)
     if (additions.length > 0) {
       // Take the row-order lock before creating columns so this path uses the
       // same rows_pos → user_table_definitions order as plain inserts. Creating
       // columns first would lock the definition row before rows_pos, inverting
       // the order and deadlocking concurrent inserts on this table. The lock is
       // re-entrant, so the per-batch acquire below is a no-op.
       await acquireRowOrderLock(trx, table.id)
-      working = await addTableColumnsWithTx(trx, table, additions, ctx.requestId)
+      working = await addTableColumnsWithTx(trx, working, additions, ctx.requestId)
     }
     const inserted: TableRow[] = []
     for (let i = 0; i < rows.length; i += CSV_MAX_BATCH_SIZE) {
@@ -264,10 +287,10 @@ export async function importReplaceRows(
     addedRows: data.rows.length,
   })
   const result = await db.transaction(async (trx) => {
-    let working = table
+    let working = await refreshUnderLock(trx, table)
     if (additions.length > 0) {
       await acquireRowOrderLock(trx, table.id)
-      working = await addTableColumnsWithTx(trx, table, additions, requestId)
+      working = await addTableColumnsWithTx(trx, working, additions, requestId)
     }
     return replaceTableRowsWithTx(
       trx,