Story-1677 pramaan-admin verification pass

The live admin lists stay URL-addressable without nuqs

This pass verifies the final list-state convergence after the removal sequence: firms, staff, and support-access keep server-backed pagination, shallow URL mirroring, TanStack Table, and one React state source for table requests.

Surface verdicts

Firms

FirmsPage parses the initial URL into buildFirmListRequest plus initialScope, then FirmTable hydrates pagination, sorting, and filters through initialState.

Client changes rebuild useAdminListFirms from table.getState() and scope state. URL writes use replaceState; scope remains a direct side param.

Staff

StaffPage parses q, role, status, grants, page, and page size on the server, then StaffTable hydrates those values into the table initial state.

The generated staff hook refetches from buildStaffListRequestFromTableState. The existing e2e proves page, status, and search updates hit /api/internal/staff without document navigation.

Support access

SupportAccessPage parses q, firm, staff, limit, before, sort, and expiringWithin before prefetch. The table hydrates request filters and cursor-side state.

The new e2e proves deep-link filtering, generated active-grant refetch, shallow replaceState URL writes, no document navigation, and cursor paging through before.

Regression checks

src/hooks/use-data-table.ts still imports and calls useReactTable, with manualPagination, manualSorting, and manualFiltering all set to true.
The three live list components derive generated query params from table.getState() and list-specific side state, not from a second client URL reader.
List-related useSearchParams usage is absent; the remaining hits are auth and trace UI, outside list request ownership.
grep -rn "nuqs" src returns no output. The dependency is absent from package.json and pnpm-lock.yaml.
Matter types and filing types remain out of scope because Story #1675 deleted those admin routes.

New e2e

tests/e2e/support-access.test.ts adds the missing routed browser coverage for support access. The e2e bridge now serves /admin/support_grants/active with generated-contract camelCase rows, backend-like filtering, limit, and before cursors.

The new spec covers a deep link filter with no browser refetch after hydration, a client search that updates the URL through replaceState and refetches /api/internal/support_grants/active, and cursor pagination that moves to older grants without server navigation.

Scope guardrails

No production list logic changed. src/hooks/use-data-table.ts, live list components, generated contracts, OpenAPI snapshots, pramaan-functions, pramaan-app, and i18n remain untouched.

Observability: verification and additive tests only; instrumentation-exempt under pramaan-docs ADR-124.

Verification commands

Passed in this pass: pnpm lint, pnpm exec tsc --noEmit, pnpm test, PLAYWRIGHT_REUSE_EXISTING_SERVER=0 pnpm exec playwright test tests/e2e/support-access.test.ts, NEXT_PUBLIC_ENV=local pnpm build, pnpm build-storybook, git diff --check, and grep -rn "nuqs" src.

Full-suite note: PLAYWRIGHT_REUSE_EXISTING_SERVER=0 pnpm exec playwright test was attempted. The new support-access tests passed in that run, but the suite still failed on existing unrelated /team redirect expectations and the pre-existing firms empty-state e2e contract-stub path. Those are outside Story-1677's additive list-state test scope.