Make new thread workspace intent explicit

[yaacovcorcos]

Outcome

Ordinary New Thread actions now use the project's configured default workspace instead of silently inheriting the branch or worktree of the thread being viewed. Users who intentionally want that checkout get an explicit context-menu action:

• New thread on branch (...)
• New thread in worktree (...)

This keeps the safe default and the expert continuation workflow together.

Scient-native adaptation

• Adds typed workspace intents: project-default, local-container, existing-local, and existing-worktree.
• Routes global, provider, editor, terminal, Studio/container, sidebar, App Snap, recent-view, /clear, and pull-request entry points through one ownership/supersession coordinator.
• Preserves prompts and attachments until the intended destination actually commits.
• Validates exact branch/worktree context after navigation ownership and fails closed if it moved or disappeared.
• Serializes non-cancellable pull-request preparation before later presentation changes.
• Uses a supported global TanStack history blocker for push/replace/Back/Forward, with per-renderer tokens safe across reloads and long histories.
• Separates route commitment from slower post-navigation work. A committed terminal destination remains valid browser history while native terminal promotion is pending.
• Keeps Studio/container creation intentionally local for both fresh and reuse-eligible flows.
• Preserves Scient identity, provider/session behavior, credentials, permissions, updater/release controls, and Git mutation boundaries.

Concurrency and data-loss fixes

The final candidate closes all issues found during review:

1. Stored/route draft reuse and fresh creation share one ordered coordinator; an older request cannot replace a newer mapping or delete its prompt/attachments.
2. Global browser navigation supersedes in-flight new-thread work through the actual history destination seam.
3. Route tokens use a random renderer-session namespace and track only genuinely uncommitted destinations; reloads and histories beyond 128 entries remain valid.
4. Stored and fresh owned routes preflight exact ownership before bypassing the approved history blocker.
5. Once a route commits, markRouteCommitted() releases its token before slow terminal promotion. Deterministic unit and real-router Back tests keep promotion pending and prove the committed destination restores correctly.
6. Terminal project-default fallback is truthful local mode when no concrete worktree exists.
7. Reuse-eligible Studio/container creation cannot fall back to an unrelated project worktree.

Mainline composition

• Final base: cfc702a
• Final candidate: a96d3c6
• Branch: agent/safer-new-thread-workspace-20260724

Current main was merged normally, without rebase or force-push. The earlier Sidebar conflict was resolved by preserving both #111's truthful automation/status/shortcut behavior and this PR's explicit workspace-intent menu. Main changes from #114, #103, #120, and #115 are included. The #115 Add Project drag/drop implementation is byte-identical to current main after composition, preserving its document-level file-drop guard and popup behavior.

Donor provenance and disposition

• T3 Code reference: 2f41c073a2f846e9a96082e76cd1b2c3a7e44c18, “Stop new threads inheriting checkout/branch from viewed thread.”
• Disposition: Adapt/Reimplement the safety and interaction concept on Scient-owned seams.
• No donor code was copied or cherry-picked.
• T3-specific sidebar versions, command-palette architecture, persistence assumptions, and broad thread-action refactors were not adopted.
• This PR does not advance the parent T3 review boundary or claim review of the complete intervening donor range.

Exact verification

At exact final head a96d3c6:

• bun run scient:upstream-check --intake — passed:
  • Scient brand/identity
  • full format verification
  • lint: 0 errors
  • all package typechecks
  • complete bun run test matrix, including web 3,087/3,087
  • desktop/web builds
  • release smoke
  • clean-worktree certification
• Focused affected unit tests — 53/53 passed.
• Real-router navigation tests — 3/3 passed, including Back during delayed terminal promotion.
• Stable browser matrix — 345 passed, 19 skipped.
• Geometry matrix — 19 passed, 345 skipped by geometry configuration.
• Real Electron overlay lifecycle — passed:
  • heldOccludedMs: 31250
  • openMode: suppress
  • closeMode: send
  • recovered width: 700
• git diff --check — passed.
• Verification left no tracked or untracked artifacts.

The stable browser runner emitted its known nonfatal ResizeObserver-loop console noise while every process exited successfully. Electron emitted a nonfatal Mojo diagnostic while lifecycle acceptance passed.

Independent final review

Exactly three fresh, independent, read-only reviews examined base ca615ee to exact candidate 35dfc78 after final verification:

1. Correctness/reliability/concurrency/performance: P0 0, P1 0, P2 0, P3 0.
2. Security/privacy/data loss/release safety: P0 0, P1 0, P2 0, P3 0.
3. Architecture/maintainability/product design/accessibility/lineage: P0 0, P1 0, P2 0; one P3 evidence recommendation only.

There are no unresolved P0, P1, or P2 findings.

Manual and UI evidence

Earlier isolated native-app validation confirmed:

• the context menu displayed New thread on branch (agent/safer-new-thread-workspace-20260724);
• activation produced a Local draft with the exact selected branch;
• the exercised flow had no browser warnings or errors;
• the responsive state was inspected at 768 px.

The visible wording and action are unchanged in the final head. A retained native-menu screenshot/recording and explicit keyboard/assistive-technology capture remain a P3 evidence recommendation, not a code blocker. Screen-reader and zoom testing were not performed; no new custom control or visual system was introduced.

Risk, rollback, and release boundary

• Primary risk is new-thread routing and draft ownership under rapid or interleaved navigation; deterministic regression coverage exercises the identified interleavings.
• No feature-owned server migration, credential, permission, updater, signing, packaging, or publication behavior is introduced.
• Rollback after integration: revert the PR merge. Stored workspace-origin decoding remains backward-compatible.
• This PR remains draft. Do not merge, mark ready, or include in a release until hosted checks for the exact head are green and the merge steward explicitly approves it.