feat(kb): show ingestion history and serving state

Author: rschlaefli

.agents/skills/klicker-frontend-ui/SKILL.md

@@ -31,4 +31,6 @@ Conventions (design system, Tailwind v4, Apollo, i18n, CSP): [docs/frontend-conv
 - `frontend-manage` (lecturer), `frontend-pwa` (student; also has a localforage offline side-channel for live-quiz answers — don't bypass `storageHelpers.ts`), `frontend-control` (mobile controller), `auth` (login flows — auth changes also need [docs/auth-model.md](../../../docs/auth-model.md)).
 - Knowledge-base management is a reusable package mounted by `frontend-manage`: edit `packages/kb-management`, not duplicate app-local components. Verify `/resources/knowledgeBases` plus the detail route at desktop and mobile widths, both locales, and every changed empty/active/success/failure state.
 - The knowledge-resource Ingest action accepts only the resource identifier. Do not expose transport tuning in the UI unless the GraphQL and ingestion-platform contracts add a real user-controlled setting.
+- Keep full KB attempt history out of the two-second detail poll. Load the bounded, owner-checked history query only when a lecturer expands a resource, while the parent query carries only the latest run needed for operation status.
+- Localize KB failure detail from stable status/error codes. Do not render raw ingestion-platform status text into the EN/DE lecturer UI.
 - **`apps/chat` is out of scope here** — app router, zustand, assistant-ui; read [docs/chat-platform.md](../../../docs/chat-platform.md) and follow its local conventions instead.

.agents/skills/klicker-graphql-api/SKILL.md

@@ -42,7 +42,7 @@ Facts (auth ladder, layering, error conventions): [docs/graphql-api-layer.md](..
 7. **Frontend wiring** — `import { <Name>Document } from '@klicker-uzh/graphql/dist/ops'`; `useQuery`/`useMutation` (+ `refetchQueries`) per [docs/frontend-conventions.md](../../../docs/frontend-conventions.md).
 8. **Tests** — graphql vitest for service logic (`pnpm --filter @klicker-uzh/graphql test:local`; see the heavy pattern in `38c92d035`); route further via `klicker-testing-verification`.
 
-Nested history fields must be bounded in their resolver. The KB resource contract exposes only the five newest owner-scoped ingestion runs; do not return an unbounded attempt ledger through a parent list.
+Do not nest full history under a frequently polled parent list. The KB detail query loads only each resource's latest run; the separate owner-checked history query returns at most the five newest runs and is called on expansion.
 
 ## Subscriptions (extra steps)
 

.agents/skills/klicker-testing-verification/SKILL.md

@@ -18,7 +18,7 @@ Facts about the test landscape: [docs/testing.md](../../../docs/testing.md). Thi
 
 Never run root `pnpm run test:run` blind — its turbo fan-out includes Cypress, which needs a running seeded stack.
 
-The focused `knowledgeIngestion.test.ts` and `knowledgeWebhooks.test.ts` suites use real PostgreSQL but deliberately stub or avoid Hatchet, so they can verify KB attempt-ledger and serving-state transitions without a client token. Keep the full GraphQL suite on `test:local`.
+The focused `knowledge.test.ts`, `knowledgeIngestion.test.ts`, and `knowledgeWebhooks.test.ts` suites use real PostgreSQL but deliberately stub or avoid Hatchet, so they can verify owner-scoped history plus attempt-ledger and serving-state transitions without a client token. Keep the full GraphQL suite on `test:local`.
 
 Direct checks for `auth`, `chat`, `frontend-control`, `frontend-manage`, and `frontend-pwa` generate ignored Next route types first through each app's `check` script. Do not hand-edit or commit `next-env.d.ts`; keep it ignored and included by `tsconfig.json`. The three PWA apps use `tsconfig.check.json` to exclude `.next/dev/types` from raw `tsc`; otherwise stale dev and fresh production Pages Router validators duplicate global declarations.
 

apps/frontend-manage/src/pages/resources/knowledgeBases/[id].tsx

@@ -1,5 +1,5 @@
 import { KnowledgeBaseDetail } from '@klicker-uzh/kb-management'
-import { GetStaticPropsContext } from 'next'
+import { GetServerSidePropsContext } from 'next'
 import { useTranslations } from 'next-intl'
 import Layout from '../../../components/Layout'
 
@@ -13,10 +13,10 @@ function KnowledgeBasePage({ kbId }: { kbId: string }) {
   )
 }
 
-export async function getStaticProps({
+export async function getServerSideProps({
   locale,
   params,
-}: GetStaticPropsContext) {
+}: GetServerSidePropsContext) {
   return {
     props: {
       messages: (await import(`@klicker-uzh/i18n/messages/${locale}`)).default,
@@ -25,11 +25,4 @@ export async function getStaticProps({
   }
 }
 
-export function getStaticPaths() {
-  return {
-    paths: [],
-    fallback: 'blocking',
-  }
-}
-
 export default KnowledgeBasePage

docs/frontend-conventions.md

@@ -2,7 +2,7 @@
 type: Frontend Conventions
 title: Frontend Conventions
 description: Shared conventions for manage, pwa, control, and auth — design system, Apollo with generated ops, i18n, Formik, data-cy, and CSP rules.
-timestamp: '2026-07-26'
+timestamp: '2026-07-27'
 tags:
   - frontend
 ---
@@ -44,9 +44,9 @@ Apollo Client with **generated documents only** — `import { UserProfileDocumen
 
 ## Knowledge-base management
 
-The lecturer routes `apps/frontend-manage/src/pages/resources/knowledgeBases.tsx:KnowledgeBasesPage` and `apps/frontend-manage/src/pages/resources/knowledgeBases/[id].tsx:KnowledgeBasePage` mount the buildless `@klicker-uzh/kb-management` package inside the authenticated manage layout. Keep reusable KB UI in that package rather than duplicating it in the host app.
+The lecturer routes `apps/frontend-manage/src/pages/resources/knowledgeBases.tsx:KnowledgeBasesPage` and `apps/frontend-manage/src/pages/resources/knowledgeBases/[id].tsx:KnowledgeBasePage` mount the buildless `@klicker-uzh/kb-management` package inside the authenticated manage layout. The dynamic detail route uses `getServerSideProps`; its arbitrary database ids are resolved per request rather than through empty build-time paths. Keep reusable KB UI in that package rather than duplicating it in the host app.
 
-`packages/kb-management/src/components/KnowledgeBaseResourceList.tsx:KnowledgeBaseResourceList` owns per-resource status polling presentation, the identifier-only Ingest action, and guarded deletion. Transport tuning is not user-controlled. Changes must preserve EN/DE messages, `data-cy` hooks, and browser evidence for desktop plus mobile states, including empty, active (`QUEUED`/`PROCESSING`), ready, and failed feedback where affected.
+`packages/kb-management/src/components/KnowledgeBaseResourceList.tsx:KnowledgeBaseResourceList` owns per-resource status polling, contextual Ingest/Retry/Re-ingest actions, separate latest-operation and active-serving presentation, lazy loading of the five newest attempts, and guarded deletion. Full attempt history must stay outside the two-second detail poll. Lecturer-facing failure detail is localized from stable status/error codes; raw platform messages are not rendered. Transport tuning is not user-controlled. Changes must preserve EN/DE messages, `data-cy` hooks, and browser evidence for desktop plus mobile states, including empty, active (`QUEUED`/`PROCESSING`), ready, failed, and replacement-cutover feedback where affected.
 
 ## i18n (next-intl)
 

docs/graphql-api-layer.md

@@ -2,7 +2,7 @@
 type: API Layer
 title: GraphQL API Layer
 description: Pothos code-first schema, the three-layer authorization pattern, service contract, operation naming, and the codegen ritual.
-timestamp: '2026-07-07'
+timestamp: '2026-07-27'
 tags:
   - backend
   - graphql
@@ -45,7 +45,7 @@ pnpm --filter @klicker-uzh/graphql generate
 
 and **commit the regenerated outputs** (`src/ops.ts`, `src/ops.schema.json`, `src/public/schema.graphql`, `src/public/client.json`, `src/public/server.json`) in the same change. They are git-tracked and load-bearing: frontends import typed documents from `@klicker-uzh/graphql/dist/ops`, and outside dev/test the backend only executes hashes present in `server.json` (see [Architecture Overview](./architecture-overview.md)). Stale artifacts fail in two distinct ways: typecheck errors (missing document) or runtime persisted-query rejection (unknown hash).
 
-Knowledge-base detail queries expose at most the five newest `KBIngestionRun` records per owned resource. Keep attempt history resource-scoped and bounded at the schema field; do not expose the unbounded ledger or bypass the parent KB/resource ownership checks.
+Knowledge-base detail polling exposes only each resource's latest ingestion run, loaded with the resource list in `packages/graphql/src/services/knowledge.ts:getKb`. Full attempt history is a separate `getKbResourceIngestionRuns` query: it checks resource ownership, returns at most the five newest runs, and is requested only when the lecturer expands that resource. Do not nest full history under the polled parent list or expose the unbounded ledger.
 
 ## Subscriptions
 

docs/log.md

@@ -2,6 +2,8 @@
 
 ## 2026-07-27
 
+- **Update**: [frontend-conventions](./frontend-conventions.md), [graphql-api-layer](./graphql-api-layer.md), and [testing](./testing.md) document the request-time KB detail route, separate latest-operation/active-serving presentation, contextual ingestion actions, lazy bounded attempt history, and browser plus PostgreSQL verification.
+
 - **Update**: [domain-model](./domain-model.md), [async-and-workers](./async-and-workers.md), [graphql-api-layer](./graphql-api-layer.md), and [testing](./testing.md) document the resource-scoped ingestion ledger, separate operation/serving state, atomic transitions, bounded owner-facing history, and token-independent focused KB integration suites.
 
 ## 2026-07-26

docs/testing.md

@@ -2,7 +2,7 @@
 type: Testing Guide
 title: Testing
 description: Which test level to use when, what runs safely without services, the two e2e stacks and their seeds, and the CI test matrix.
-timestamp: '2026-07-18'
+timestamp: '2026-07-27'
 tags:
   - testing
   - ci
@@ -20,7 +20,7 @@ tags:
 | GraphQL services/resolvers                                           | `packages/graphql` vitest — needs REAL Postgres + Redis + Hatchet + `HATCHET_CLIENT_TOKEN` | `pnpm --filter @klicker-uzh/graphql test:local` (one-command bootstrap: `test/run-tests-local.sh`) |
 | UI / user flows                                                      | Playwright e2e (new specs); Cypress only for legacy maintenance                            | see routing below                                                                                  |
 
-The focused KB ingestion and signed-webhook suites deliberately avoid a real Hatchet client: ingestion uses a test-only `runNoWait` task stub, and webhook tests use Prisma directly. They still run against real PostgreSQL and cover atomic resource/run transitions, retry races, serving cutover, and terminal-event ordering.
+The focused KB CRUD, ingestion, and signed-webhook suites deliberately avoid a real Hatchet client: CRUD and ingestion use test-only task stubs, and webhook tests use Prisma directly. They still run against real PostgreSQL and cover owner-scoped bounded history, atomic resource/run transitions, retry races, serving cutover, and terminal-event ordering.
 
 **Never run root `pnpm run test:run` blind** — the turbo fan-out includes Cypress, which needs a running, seeded stack. The graphql vitest config forces `pool: forks, singleFork: true` (serialized specs sharing DB state) — don't parallelize it.
 

packages/graphql/src/graphql/ops/QGetKb.graphql

@@ -12,23 +12,13 @@ query GetKb($id: ID!) {
       mimeType
       sizeBytes
       status
-      statusMessage
       ingestedAt
       resourceVersion
       activeResourceVersion
-      activeContentSha256
-      errorCode
-      ingestionRuns {
+      latestIngestionRun {
         id
         status
-        resourceVersion
-        contentSha256
-        statusMessage
         errorCode
-        startedAt
-        finishedAt
-        createdAt
-        updatedAt
       }
       createdAt
       updatedAt

packages/graphql/src/graphql/ops/QGetKbResourceIngestionRuns.graphql

@@ -0,0 +1,9 @@
+query GetKbResourceIngestionRuns($resourceId: ID!) {
+  getKbResourceIngestionRuns(resourceId: $resourceId) {
+    id
+    status
+    resourceVersion
+    errorCode
+    createdAt
+  }
+}