feat(workspace): identity in the prompt, and a /workspace menu for refresh, sync and unlink - #1278

Asking the agent which workspace a project is linked to could not be answered.
Nothing put the binding in the system prompt and no tool reported it, so on a
workspace with no integrations the model had never been told.

The cause was not a dropped field. `awareness.ts` is a routing directive, and it
is deliberately silent unless the workspace is really routing — `DISABLED_COPY`
maps `nothing-materialised` to `""`, and the tests assert an unbound project and
a declared-but-absent integration each render nothing. That silence is correct
for routing. It was wrong only because identity had been folded into it: the
workspace name is rendered by `assemble`, so it shipped only alongside at least
one served connection type.

Splits the two claims apart. `bindingSection` renders identity whenever the state
may name a binding; `routingSection` keeps its contract exactly as it was.

`NAMES_BINDING` decides which states may name, keyed on the union so a new
`disabledReason` is a compile error rather than a silent choice:

- `nothing-materialised` and every enabled state name the workspace. This is the
  freshly-created-workspace case, and the one where being told nothing is most
  confusing.
- The three unverified states stay unnamed, for the reason `UNVERIFIED_SECTION`
  already gives: nothing has confirmed the binding, and under `unattributed` the
  engine may belong to a different workspace than the link names.
- `pilot-off`, `unbound` and the escape hatch carry no name to print. A bound
  project with the hatch on is therefore still unnamed — a limitation of that
  `EMPTY` call site, not a decision made here.

This knowingly breaks the "byte-identical prompt" property `DISABLED_COPY` claims
for `nothing-materialised`; the regression guard is updated to say so rather than
silently relaxed.

The identity line is charged against `MAX_SECTION_CHARS` instead of being added
on top, so a long workspace name is paid for out of the routing lines and the
real ceiling does not quietly grow.

Tests: 30 pass in the suite, 1511 across `test/altimate/workspace` and
`test/session`. Mutation-checked — 9 mutations, 9 killed. Two initially survived
and both were real gaps: `JSON.stringify` alone was providing the line-break
protection, so the inertness test never exercised the sanitiser's length bound,
and nothing covered an enabled snapshot carrying no name.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Q51zFUmPg1WwtS5CrGJE6

cubic P1 on #1278, and the most serious of that review: unlink could delete a
directory outside the project.

`syncSkills` puts `pathsAreReal` in front of every one of its own `deactivate`
calls — three of them, each with a test proving a symlinked `.altimate-code` is
refused rather than traversed. `purgeManagedSnapshot`, which is the entry point
unlink uses, reached the same `deactivate` with no guard at all.

The delete ends in `fs.rm(managedRoot, { recursive: true, force: true })`, and
the ownership check ahead of it does not save you: `ownsManagedDir` calls
`readdir` on the managed root, which resolves THROUGH a symlinked
`.altimate-code`, and it answers "ours" for an empty directory. So a project
whose `.altimate-code` is a link to a tree the user owns for some other purpose
— an empty one especially — satisfied the check, and unlink removed the target.

Same guard as the sync paths now. The new test points the link at a real tree
with a manifest and asserts the tree survives, because a target with nothing in
it would pass for the wrong reason.

Tests: 487 pass, 1 new. Mutation-checked: drop the guard and it fails.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Q51zFUmPg1WwtS5CrGJE6

All three are the same family as the symlink guard before them: unlink is where
this feature's sharp edges are, because it is the one operation that has to
agree with the server about which row it is removing.

**It deleted on the wrong identifier when there was no cached row.** That is the
case unlink exists to repair, and detection alone is not enough for it:
`unbindProject` sends the remote whenever one is present, so a project the
server bound by PATH — linked before it had a remote, or from a checkout without
one — got a DELETE naming an identifier the server never stored. The 404 reads
as "nothing to remove", local state is cleared, and the live binding is
re-adopted on the next resolve. It now asks which arm the server actually
matches on and deletes on that one; `matchedBy` was added for exactly this
choice and this caller was not using it.

**A detached workspace's memory outlived the unlink.** `hydrate` is idempotent
for the life of a session, so a session that had already pulled the workspace's
memory kept answering out of it for every later prompt — from a workspace the
project is no longer bound to. Skills were already purged here; memory was not.

**Cleanup gave up entirely when credentials would not resolve.** Reads fail
closed without a key too, so nothing was stale WHILE they were missing — but the
row resurfaced the moment they came back, naming a workspace the project had
been unlinked from. It self-heals on the next revalidation, which is why this is
a narrowing rather than the durable tombstone the review proposed: drop the row
for this directory whatever tenant the file belongs to. The user asked to unlink
THIS project, and the worst case is a re-lookup.

Tests: 488 pass, 1 new. The new one initially passed for the wrong reason — the
sandbox project had no git remote, so there was no remote for the buggy path to
prefer, and the mutation survived. It now creates a real remote and asserts the
DELETE goes out on the path; mutation-checked.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Q51zFUmPg1WwtS5CrGJE6

Two more from the cubic review on #1278, both the same shape: a number or a flag
that describes something other than what `sync` would actually do.

`pendingCount` returned 0 for a disabled workspace but not for a MISSING binding.
With no binding it fell through to `partitionPending`, which only skips
project-scope blocks — there is nowhere to send them — while global-scope blocks
went into `pending` and were counted. So an unlinked project with global memory
reported "N not synced" while the sweep answered `gated` and sent nothing. That
number is documented as "a promise about what backfill would do", and this was
the one case where it was not; it mirrors `backfill`'s gate exactly now.

`sync` short-circuited an empty block list to `gated: false` without consulting
the workspace's memory setting. `SyncReport.gated` is documented as "true when
the sweep never ran at all — memory off, or no binding", so a bound project
whose workspace has memory switched off was told the sweep ran and found
nothing. The short-circuit is gone: `backfill` already returns the right answer
for an empty list, and letting it decide makes the two agree by construction
rather than by two places remembering the same rule.

Tests: 490 pass, 2 new. The first one was vacuous on the first attempt — routed
through `status`, where `memory` can be null for unrelated reasons and the
optional chain swallowed it, so the mutation survived. It asserts on
`pendingCount` directly now. Both mutation-checked.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Q51zFUmPg1WwtS5CrGJE6

All six are user-visible, all in the menu's honesty or one contract gap, and
each is a few lines. Taken in the reviewer's order.

**`status()` no longer waits on the network.** It is awaited before the
`/workspace` dialog can appear, and the enablement check behind `pendingCount`
was a GET with a 15s budget cached only on "yes" — on a slow or dead link the
menu looked like it did nothing, and an outage collapsed into "N memories" with
no unsynced count. `pendingCount` now takes `{ network: false }` and answers
from cache: a remembered "yes" or "no" (the "no" is a new 5-minute memo written
by `memoryStatus`, read ONLY by this path so the write path keeps re-asking), or
`null` for not-known. `unsynced` is `number | null` and the headline makes no
sync claim on null. `sync` still does the live check.

**`status()` goes through the resolver.** A fresh clone, or a new machine, whose
project is still bound server-side had no cached row, and reading only the cache
answered "this project is not linked" with a lone Done. The resolver adopts
server-side bindings and is bounded — a cached row is trusted for its
revalidation window, a confirmed miss is memoized — so this is not a request per
call.

**The unlink toast says when the skills were left behind.** `purgeManagedSnapshot`
answered `false` for both "nothing to remove" and "there IS a snapshot and it was
left on disk" — the symlink refusal, or a purge error. The toast read "Unlinked
from X" in both, and in the second that workspace's skills keep loading into
every later session of a project no longer bound to it. The purge is now
three-way (`removed` / `absent` / `refused`), `UnlinkReport` carries
`skillsLeftBehind`, and the toast warns and names the directory to remove.

**The sync toast names every not-sent count.** `sent === 0 && failed === 0`
printed "Everything is already in the workspace." with `declined > 0`; and
`push` returned `"skipped"` for deferrals — record set unreadable, truncated, or
a newer remote copy — which `runQueue` folded into `skipped`, so a sweep that
deferred everything read as a clean all-clear. `deferred` is its own
`PushOutcome`, counted separately through `runQueue`, `backfill` and
`SyncReport`, and the message (now `syncMessage`, tested on its own) says
refused and deferred by name. Only present-at-current-payload is the healthy
zero.

**The unlinked menu's hint can be followed.** It said "Link a project with
/altimate.workspace.link", but that command registers no slash name, so the
hint could not be typed. It names the palette entry by title.

**`refresh` threads its directory into the memory half.** `MemorySync.refresh`
resolved the binding from the ambient instance, dropping the directory the
caller passed. Nothing hit it today — the palette passes no session — but the
headless adapter this module exists for has no ambient instance to fall back
on. `currentBinding(directory)` already took one.

Also, from the non-blocking list: the overlay reset on unlink is unconditional
(`overlayBlocks()` is not gated on the flag, so a flag flipped mid-session left
the old overlay merged), and `purgeManagedSnapshot` now joins the sync's
in-flight gate so an in-progress sync cannot republish `_workspace` right after
unlink removed it.

Tests: 501 pass across workspace + plugin; 11 new. One existing test asserted a
truncated read counted as `skipped` — that was the conflation, and it now
asserts `deferred`. Mutation-checked: reading the cache instead of resolving,
asking the network for enablement, dropping the directory, never reporting
skills left behind, and counting deferred as all-clear each fail a test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Q51zFUmPg1WwtS5CrGJE6

… identity

Fourteen findings from the bot reviews on #1278, each with a test that fails
without its fix where one is observable.

Unlink:
- The which-arm pre-check no longer swallows transport errors. A lookup that
  could not be made fell back to the detected identifier — the wrong-arm
  DELETE the pre-check exists to avoid — and cleared local state behind the
  404. It now propagates, with nothing touched locally.
- The account scope is pinned before the server call and handed to the
  cleanup, so credentials switching mid-unlink cannot leave the removed
  binding on disk under the account that deleted it.
- The cleanup removes only the row unlink started from. A relink that landed
  while the DELETE was in flight keeps its row and gets no five-minute
  "unbound" memoized over it.
- The no-credentials cleanup memoizes the miss under the scope the cache
  file carries, so the next credentialed resolve does not re-adopt a binding
  whose delete is not yet visible; both cleanups also remove pre-canonical
  aliases of the directory.
- Detection — a blocking git call — runs only when there is no cached row.

Memory:
- `SyncReport.gatedBecause` names why a sweep never ran; the toast stops
  telling the user "memory is off" for a failed local read, a missing
  binding, or the build flag.
- A bind whose sweep deferred anything is not marked seeded.
- `resetOverlay()` clears the negative enablement memo too, so a refresh
  after memory was switched on does not keep reporting zero unsynced.

Identity line:
- A `nothing-materialised` snapshot carries the workspace id.
- A name that sanitises to nothing renders as `"(unnamed)" (id N)` rather
  than erasing the identity.

TUI:
- The refresh problems toast still names the memory invalidation that landed.
- The dialog header bounds the customer-authored workspace name.

Housekeeping: orphaned doc blocks in `skill-sync.ts` and `state.ts` restored
to their functions; the sync-message test's comment matches its value and
asserts the skipped count stays hidden; a positive control pins the unlink
purge's symlink fixture; the test harness awaits each bind's detached work.

Verified: `test/altimate/workspace` + `test/altimate/plugin` green, typecheck
clean. Mutation-checked: restoring the swallowed lookup, ignoring `expect`,
dropping `deferred` from the seed condition, keeping the disabled memo on
reset, dropping the id from `EMPTY`, removing the unnamed fallback, and
ignoring the gate reason each fail a test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Q51zFUmPg1WwtS5CrGJE6

…-neutral

Four follow-ups from the review of the previous batch.

- The unlink cleanup identifies the row it started from by workspace AND link
  time, so a relink to the same workspace during the DELETE is told apart
  from the original; and an unlink that started with no cached row treats
  any row present afterwards as written during the request. Both are kept,
  with no lookup miss memoized over them.
- When the cleanup keeps such a row, unlink stops there: the overlay and the
  skill snapshot now belong to the binding the relink recorded, and its own
  bind synced them.
- `inertWorkspaceName` moves to `workspace-name.ts`, a module with no imports
  and no state, so the TUI plugin can bound the dialog header without
  loading `precedence.ts` — server-side only, per its header — into the
  plugin realm. `precedence.ts` re-exports it for its existing callers.
- The relink tests assert the memo half of their claim: past the validation
  window (`expireValidationForTests`), the resolver still answers bound
  rather than reading a miss and dropping the row. They also seed a
  snapshot for the relinked binding and assert it survives.

Verified: 511 pass across `test/altimate/workspace` + `test/altimate/plugin`,
typecheck clean. Mutation-checked: treating "none" as a match, ignoring
`linkedAt`, memoizing on the kept path, and purging despite a kept row each
fail a test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Q51zFUmPg1WwtS5CrGJE6

…guard on the row reads win

Three more from the review of the relink guard.

- A relink that reached the server BEFORE the DELETE was removed by it —
  the DELETE names the project, not a row — so keeping the local row it
  wrote left the client bound to nothing. When the cleanup keeps a row,
  unlink now asks the server; if the project is no longer bound there, the
  row is cleared after all. A lookup that cannot be made keeps the row.
- When the row IS kept, the memory overlay is reset anyway. Hydration is
  idempotent per session, so a session that pulled the old workspace's
  memory would otherwise keep it, and the relink did not tell it.
- The guard compares the expected row against the canonical row (or the
  newest alias), not every alias. A stale pre-canonical alias beside the
  current row is not a concurrent relink, and read as one it stopped the
  cleanup entirely.

Verified: 513 pass across `test/altimate/workspace` + `test/altimate/plugin`,
typecheck clean. Mutation-checked: skipping the server confirmation, and
judging on every alias, each fail a test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Q51zFUmPg1WwtS5CrGJE6

…, and its cleanup stays guarded

- The check after a kept relink asks the server by the identifiers the
  relink recorded, not by re-detecting the checkout — a remote that changed
  during the request would otherwise miss a remote-only row and purge a
  binding the server still holds.
- The cleanup that follows a "no longer bound" answer is guarded on the row
  the check was about, so a further relink landing in between is kept.
- The stale-alias test selects this directory's row by its canonical key;
  taking the first entry of a file shared across the module picked another
  test's row and passed without exercising the guard.

Verified: 516 pass across the workspace + plugin suites, typecheck clean.
Mutation-checked: re-detecting instead of using the row, dropping the
guard on the second cleanup, and judging on every alias each fail a test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Q51zFUmPg1WwtS5CrGJE6