test(workspace): add direct regression tests for scoped_to_user rebinding (#1652)

[reidliu41]

Summary

• Verify primary user_id switches correctly and original workspace is unchanged
• Verify private memory layers rescope to new user while shared layers stay intact
• Verify secondary read scopes are preserved exactly and old primary is removed with no duplicates
• Verify identity reads via both read_primary() and read() pin to new primary, not old or shared scopes
• Verify non-identity reads still span preserved shared scopes after old primary removal
• Verify bootstrap flags (pending + completed) preserve on same-user rebind and reset on different-user rebind
• Establish precondition probes to ensure bootstrap reset tests validate true→false, not default false

Change Type

• Bug fix
• New feature
• Refactor
• Documentation
• CI/Infrastructure
• Security
• Dependencies

Linked Issue

Closes #1652

Validation

• cargo fmt --all -- --check
• cargo clippy --all --benches --tests --examples --all-features -- -D warnings
• cargo build
• Relevant tests pass:
• cargo test --features integration if database-backed or integration behavior changed
• Manual testing:
• If a coding agent was used and supports it, review-pr or pr-shepherd --fix was run before requesting review

Security Impact

None.

Database Impact

None.

Blast Radius

• New file only: tests/workspace_scoped_rebind.rs
• Zero production code changes
• No impact on existing tests or behavior

Rollback Plan

Delete tests/workspace_scoped_rebind.rs.

Review Follow-Through

• Tests are gated behind #![cfg(feature = "libsql")] — cargo test alone will not run them
• If new rebinding invariants are added to scoped_to_user(), this file should be extended

---

Review track:

A

[gemini-code-assist]

Code Review

This pull request adds a comprehensive suite of regression tests in tests/workspace_scoped_rebind.rs to verify the behavior of Workspace::scoped_to_user(). The tests cover primary user ID changes, layer rescoping, read scope preservation, and bootstrap flag management. A review comment identifies a brittle implementation reference in a code comment and suggests a more descriptive alternative for better maintainability.

[gemini-code-assist]

Referencing a specific line number in another file (mod.rs:665) makes this comment brittle and hard to maintain. If src/workspace/mod.rs changes, this reference will become outdated and misleading. It's better to describe the behavior itself rather than pointing to a specific line of implementation.

Suggested change

	// read — identity paths get special primary-only treatment (mod.rs:665).
	// read — identity paths are specially handled to read from the primary scope only.

[zmanian]

Well-structured regression tests for scoped_to_user rebinding. 7 focused tests covering user ID change, layer rescoping, identity pinning, and bootstrap flag behavior. Test-only, zero production changes. Good.

[reidliu41]

can it merge?

[claude]

Code review

Found 2 issues:

1. [LOW:100] Line 46: Assertion message uses literal string {scopes:?} instead of format interpolation — when the assertion fails, the error message will show the literal string instead of the actual scope list, reducing debugging value.

https://github.com/nearai/ironclaw/blob/437d7373a6df2c924a4b5162715ed59ff67d7170/tests/workspace_scoped_rebind.rs#L44-L48

43: fn assert_no_duplicates(scopes: &[String]) {
44: let set: HashSet<&String> = scopes.iter().collect();
45: assert_eq!(
46: set.len(),
47: scopes.len(),
48: "read_user_ids contains duplicates: {scopes:?}"
49: );
50: }

2. [LOW:85] Line 180: Test comment references mod.rs:665 but the actual identity file read handling logic is at line 766 in src/workspace/mod.rs. This is a documentation accuracy issue only — the test behavior is correct.

https://github.com/nearai/ironclaw/blob/437d7373a6df2c924a4b5162715ed59ff67d7170/tests/workspace_scoped_rebind.rs#L177-L182

177: // read — identity paths get special primary-only treatment (mod.rs:665).
178: let doc2 = rebound
179: .read(paths::IDENTITY)
180: .await
181: .expect("read should succeed");

Assessment: This is a well-structured regression test suite for scoped_to_user() rebinding. The tests correctly validate:

• Primary user ID switching with independent workspace instances
• Private layer rescoping while preserving shared layers
• Bootstrap flag behavior (preserved on same-user rebind, reset on different-user)
• Identity file pinning to the new primary
• Shared scope preservation after old primary removal

Zero production code changes, no security issues, no blocking logic errors. The reported issues are cosmetic — an uninformative error message and a stale comment reference.