chore: align local-first control plane and editor fixes

- wire SQLite control-plane access/session paths into Rust web local-folder routes

- preserve local Markdown attachment semantics across upload, reload, and secondary-pane resource tabs

- refresh design governance docs, Reasonix task templates, and bug records

- retire root .mcp.json local MCP config

rust/crates/control-plane/src/sqlite.rs

@@ -63,6 +63,14 @@ fn capabilities_json(capabilities: &[String]) -> Result<String, ControlPlaneErro
     serde_json::to_string(capabilities).map_err(ControlPlaneError::from)
 }
 
+fn file_uri_to_legacy_path(value: &str) -> String {
+    value
+        .trim()
+        .strip_prefix("file://")
+        .unwrap_or("")
+        .to_string()
+}
+
 fn row_to_user(row: &rusqlite::Row<'_>) -> rusqlite::Result<UserRecord> {
     Ok(UserRecord {
         id: row.get(0)?,
@@ -793,13 +801,21 @@ impl ControlPlaneStore for SqliteControlPlaneStore {
         root_uri: &str,
     ) -> Result<ResolvedAccess, ControlPlaneError> {
         let conn = self.conn.lock().unwrap();
+        let root_path = file_uri_to_legacy_path(root_uri);
         let mut stmt = conn.prepare(
             "SELECT id, user_id, workspace_id, root_uri, root_path, permission, recursive, capabilities_json, source, status, created_by, created_at, updated_at, revision
              FROM directory_grants
-             WHERE user_id = ?1 AND status = 'active' AND (?2 = root_uri OR (recursive = 1 AND ?2 LIKE root_uri || '%'))",
+             WHERE user_id = ?1
+               AND status = 'active'
+               AND (
+                 ?2 = root_uri
+                 OR (recursive = 1 AND ?2 LIKE root_uri || '%')
+                 OR (?3 != '' AND ?3 = root_path)
+                 OR (?3 != '' AND recursive = 1 AND ?3 LIKE root_path || '/%')
+               )",
         )?;
         let grants = stmt
-            .query_map(params![actor_id, root_uri], row_to_grant)?
+            .query_map(params![actor_id, root_uri, root_path], row_to_grant)?
             .collect::<Result<Vec<_>, _>>()?;
         let mut permission = "none".to_string();
         for grant in &grants {
@@ -1800,6 +1816,31 @@ mod tests {
         assert_eq!(access.permission, "none");
     }
 
+    #[test]
+    fn resolve_access_supports_legacy_directory_grants_with_plain_path_root_uri() {
+        let store = store();
+        create_user(&store, "legacy_reader");
+        store
+            .grant_directory_access(DirectoryGrantInput {
+                user_id: "legacy_reader".to_string(),
+                workspace_id: None,
+                root_uri: "/tmp/shared".to_string(),
+                root_path: "/tmp/shared".to_string(),
+                permission: "read".to_string(),
+                recursive: true,
+                capabilities: vec![],
+                source: "legacy".to_string(),
+                created_by: None,
+            })
+            .expect("legacy grant");
+
+        let access = store
+            .resolve_access("legacy_reader", "file:///tmp/shared/page.md")
+            .expect("resolve access");
+        assert_eq!(access.permission, "read");
+        assert_eq!(access.grant_ids.len(), 1);
+    }
+
     #[test]
     fn share_link_token_is_hashed_and_revocable() {
         let store = store();