fix(workspace): close the sealed-switch privacy race, restore the parked filter

Two findings from the workspace persona review, both rated high:

* Switch race: the hub client re-pointed at a sealed area's hub
  before the workspace announced the sealed context, so the 2 s
  page pollers (runs, audit) could fetch and render that hub's
  data without the sealed marking. Switches now run inside an
  explicit switching window: opened before anything touches the
  connection, announced optimistically in the identity bar
  ("switching…" + spinner, leave button hidden), pollers and the
  shell health tick pause inside it, and pages drop replies whose
  context epoch changed mid-flight. The sealed context is
  announced only after the new hub answered healthy.

* Filter loss: entering a sealed area cleared the shared-hub
  project filter and returning restored only the endpoint. The
  filter is now parked on entry and restored on return; prefs
  keep the parked value throughout, so live state and prefs agree
  after the round trip (and after a mid-session relaunch).

Guard: workspace_switch_race_test pins both invariants
state-matrix-style against scripted hub + sealed-area fakes —
reconnects may only happen inside an open switch window, pollers
must stay silent inside it, and the filter must survive the round
trip. SealedAreaService gained a debugSetInstance seam so the
suite never scans a real ~/.chain.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/pages/approvals.dart

@@ -104,6 +104,9 @@ class _ApprovalsPageState extends State<ApprovalsPage> {
 
   void _refresh() {
     if (!mounted) return;
+    // Mid-switch the client points between contexts — hold off; the
+    // end-of-switch notify lands here again with a settled client.
+    if (Workspace.instance.switching) return;
     final project = Workspace.instance.activeSlug;
     setState(() {
       _pendingFuture = HubService.instance.listApprovalsRecords(

lib/pages/audit.dart

@@ -109,6 +109,9 @@ class _AuditPageState extends State<AuditPage> {
   /// query and the live stream have to be re-established.
   void _onWorkspaceChanged() {
     if (!mounted) return;
+    // Mid-switch the client points between contexts — hold off; the
+    // end-of-switch notify lands here again with a settled client.
+    if (Workspace.instance.switching) return;
     _refresh();
     _subscribeLive();
   }
@@ -132,7 +135,12 @@ class _AuditPageState extends State<AuditPage> {
           // suite caught this as a pending-timer flake).
           _reconnect?.cancel();
           _reconnect = Timer(const Duration(seconds: 3), () {
-            if (mounted && _eventSub == null) _subscribeLive();
+            // Not mid-switch: the end-of-switch notify resubscribes.
+            if (mounted &&
+                _eventSub == null &&
+                !Workspace.instance.switching) {
+              _subscribeLive();
+            }
           });
         }
       },
@@ -262,19 +270,25 @@ class _AuditPageState extends State<AuditPage> {
   // copy-affordance).
 
   Future<void> _refresh() async {
+    final ws = Workspace.instance;
+    // Paused during a sealed-area switch: the hub client may already
+    // point at the other hub while this page still renders the old
+    // context — fetching now would show data under the wrong marking.
+    if (ws.switching) return;
+    final epoch = ws.contextEpoch;
     try {
       final events = await HubService.instance.recentEvents(
         limit: 100,
         project: Workspace.instance.activeSlug,
       );
-      if (!mounted) return;
+      if (!mounted || epoch != ws.contextEpoch) return;
       setState(() {
         _events = events;
         _error = null;
         _initialLoaded = true;
       });
     } catch (e) {
-      if (!mounted) return;
+      if (!mounted || epoch != ws.contextEpoch) return;
       setState(() {
         _error = e;
         _initialLoaded = true;

lib/pages/runs.dart

@@ -226,11 +226,18 @@ class _RunsPageState extends State<RunsPage> {
   }
 
   Future<void> _refresh() async {
+    final ws = Workspace.instance;
+    // Paused during a sealed-area switch: the hub client may already
+    // point at the other hub while this page still renders the old
+    // context — fetching now would show data under the wrong marking.
+    // The end-of-switch notify re-runs this listener with fresh data.
+    if (ws.switching) return;
+    final epoch = ws.contextEpoch;
     try {
       final snapshot = await HubService.instance.listDetachedRuns(
         project: Workspace.instance.activeSlug,
       );
-      if (!mounted) return;
+      if (!mounted || epoch != ws.contextEpoch) return;
       setState(() {
         _runs = snapshot.runs;
         _detachedEnabled = snapshot.enabled;
@@ -238,7 +245,7 @@ class _RunsPageState extends State<RunsPage> {
         _loaded = true;
       });
     } catch (e) {
-      if (!mounted) return;
+      if (!mounted || epoch != ws.contextEpoch) return;
       setState(() {
         _error = e;
         _issue = classifyRunsLoadError(e);