Bad code: split command witness storage out of text authority

[flyingrobots]

Problem

PR #169 intentionally keeps the #168 hardening small by storing pendingCommandEvent and lastCommandEvent on WorkspaceTextAuthorityOpened. That is acceptable for the narrow slice, but it makes text authority carry command-witness state alongside host materialization, pending intent, receipt, obstruction, and cache posture.

That coupling should not become the permanent home for command provenance.

Why It Matters

Text authority should describe the Echo/materialization posture of the opened buffer. Command provenance is a witnessed command stream keyed by request/client sequence and receipt identity. As :why, Echo History, historical preview, and agent witnesses grow, command events need their own buffer-scoped store or witness log rather than accumulating on authority as ad hoc fields.

Desired Direction

Introduce a focused command witness/provenance store, likely buffer-scoped, that owns:

• planned command events keyed by request id;
• settlement enrichment by receipt/admission evidence;
• last meaningful command lookup for :why;
• history drawer summaries and later detail views;
• honest unavailable/obstructed posture for unsupported commands.

WorkspaceTextAuthorityOpened should keep only the minimal references it needs, such as pending request id and receipt/materialization posture.

Acceptance Sketch

• Command events are stored outside WorkspaceTextAuthorityOpened.
• :why, footer, Echo History, and witness CLI read through the command witness store.
• Non-Vim and stale editor state cannot mutate or impersonate stored command events.
• Buffer switching preserves command witnesses with the buffer record.
• Tests cover request-id lookup, receipt enrichment, and last meaningful command selection.

Scope Guard

This is not a request to expand command coverage or build a new UI. It is a storage-boundary cleanup after #169.

Related: #168, #131, PR #169.

[coderabbitai]

🔗 Related PRs

#12 - test(stack): move fixture basis behind optic session [merged]
#23 - feat(echo): add Echo release gate witness [merged]
#127 - Fix command file completion previews [merged]
#135 - Docs: lock Jim causal roadmap [merged]
#152 - Add editor trust and strand worldline UX [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[flyingrobots]

Still valid. Measured the current spread so the extraction can be scoped rather than guessed.

pendingCommandEvent / lastCommandEvent appear in 27 references across 6 files:

15  src/app/workspace/workspace-text-authority.ts
 5  src/app/workspace/command-provenance.ts
 2  src/app/workspace/jedit-command-event-observation.ts
 2  src/app/workspace/viewer-key.ts
 2  src/app/workspace/workspace-source-projection.ts
 1  src/app/workspace/workspace-text-runtime-state.ts

The concentration in workspace-text-authority.ts is the issue exactly as filed: witness storage living on WorkspaceTextAuthorityOpened rather than beside the provenance code that reads it. Four of the six consumers are outside the authority, so the coupling is real and not incidental.

Scope this implies: a witness store with its own type, the authority losing two fields, and five call sites rebound. Mechanical, but wide enough that it wants its own change rather than riding along with unrelated work — every one of those files is on the Echo text path, where #304 and BEARING both warn against widening the transitional surface.

Worth doing before the authority grows a third witness field, not after.

No code change; measurement only.