Device-local tabs + spaces as a searchable sidebar filter

[wingleeio]

Restructures the shell around wing's proposal: tabs stop being synced session state, spaces stop being a navigation spine.

What changed

Tabs are now device-local. A tab is a local viewport onto a synced session (ui-settings.json → openTabs; the vec is the drag order). Closing a tab is local-only — the session keeps running on its host and stays in the sidebar; clicking a sidebar row (re)opens it as a tab. Archiving is a separate, explicit action in the session row's context menu (unchanged — it was already there). The strip is cross-space and gets a context menu: close, close others, close to the right, close to the left (rows that would close nothing are omitted). Existing installs migrate by seeding openTabs from the last selected space's sessions, so nobody's tabs vanish on upgrade.

Spaces are a searchable dropdown (same recipe as the ref picker: ranked substring search, keyboard nav) that filters only the sidebar session list. "All spaces" is the first row; "Add space…" (the existing ⌘K palette) is the last; rename/remove live on row context menus inside the dropdown.

New sessions. + opens the canvas defaulting to the sidebar's filter space — or the last selected space under "All". The composer gains a space chip on the canvas only; picking a space re-keys the ref selector, worktree plan, and harness/model catalogs through the existing selected_space observer (no new invalidation paths).

The synced Loro doc schema is untouched — this is purely a view-layer restructure.

Screenshots

Cross-space tab strip; sidebar sessions with the dropdown trigger on top:

The spaces dropdown — searchable, "All spaces", device tags, "Add space…":

Filtered to soccertcg — note the two comet-space tabs stay open (the filter never touches the strip):

New-session canvas defaults to the filter space, with the new space chip:

The canvas space picker, and the ref footer re-keying after switching to a git space (Current checkout / main appears because comet has git; soccertcg didn't):

Tab context menu (last tab → no "close to the right"):

Demo video

Filter → open-from-sidebar → + with space pick → send (mock harness streams) → close the streaming tab locally (session keeps running in the sidebar) → reopen with transcript intact → close others:

MP4 version · assets live on the assets/tabs-spaces branch, not in this diff.

Verification

• cargo test --workspace green (settings round-trip covers the new fields; tab-neighbor logic keeps its unit tests).
• Exercised end-to-end against a seeded mock engine on a headless compositor — every capture above is the real app.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[wingleeio]

Follow-up from wing's review: the filter trigger's caret now sits at the right edge of the row, and long space names truncate against it (label flexes; caret is flex_none).

(The dropdown rows and session-row sublines already truncated against their @ device tags — verified in the same pass.)

[wingleeio]

Dropdown now opens below the trigger instead of covering it (new anchored_menu_below popover primitive pinning to the trigger's bottom edge):

[wingleeio]

Check glyph removed from the space-filter dropdown — the selected row's wash carries the selection signal:

[wingleeio]

Wash-only selection is now consistent across all menus — removed the check glyph from the ref, checkout, and model pickers, the canvas space picker, and the account device menu (popover::menu_check deleted with its last caller). The current/worktree/@ device tags get the row end to themselves: