Local repos: display the checked-out branch, drop the branch axis

[thalida]

Closes #92

What & why

For a local source, branch is display-only, never an input axis. A local repo scans whatever is checked out on disk, so a stored branch is a lie: it must not namespace the cache, the deep-link URL, or recents. Previously a local source was treated as a (src, branch) identity, which broke in a few places (most visibly: switching a local repo's checkout spawned a second recents row).

Design: normalize once at the commit boundary

The rule "a local source has no branch" is decided in exactly one place — when a source is committed — and everything downstream trusts it:

• identityBranch(src, branch) (undefined for local, branch for remote) is applied only at the commit boundary: loadSource (fetch URL, overlay, error prefill) and setCurrentSource (CURRENT_SOURCE + the stored recent). So CURRENT_SOURCE and every recent are branch-less for local by construction.
• sourceIdentity(src, branch) is the canonical identity string (src\0branch) — the one place the join + empty-branch coercion lives. sourceKey hashes it; recents dedupe and the active-row match compare it. No per-read source-kind switch.
• Recents dedupe by identity, so two opens of the same local path (different checkouts, both committed branch-less) collapse to one row, with no @branch pill.
• Active-row match compares each recent against CURRENT_SOURCE (the canonical applied source) rather than SOURCE_INFO (which carries the manifest's live checkout for display). Active is an identity question, so this is both correct and lets a branch-less local recent match exactly.
• Storage bump recents → recents.v2: pre-fix local entries stored a checkout branch; orphaning the old slot once is cheaper than migrating an MRU list, and removes the only stale-data case, so no defensive read-path normalization is needed.

Displaying the checked-out branch (read-only)

The header branch pill shows the live checkout: SOURCE_INFO.branch falls back to manifest.repo.branch via resolveBranch when no branch was explicitly chosen. The backend already populates repo.branch from HEAD for every scan (_collect_repo_info, gated by the existing CODECITY_ALLOW_LOCAL_REPOS + path validation), so no backend change was needed. On reopen after a checkout switch, the scan signature (which includes the branch) changes → cache miss → fresh rescan → the header shows the new branch.

Audit of the "breaks for local" surface

Swept every place that assumed a (src, branch) identity and confirmed it degrades sanely branch-less:

Surface	Result
Recents dedupe / row key / active badge	Fixed: one row per local path, matched against CURRENT_SOURCE
@branch pill on a recent row	Absent for local (recent is branch-less)
Header pill	Shows live checkout via manifest.repo.branch
sourceKey cache namespace	Branch-less for local (committed branch-less)
Deep-link URL round-trip	Branch omitted; stale ?branch= cleaned on load
Live-update poll	Uses branch-less CURRENT_SOURCE; checkout change updates the signature
Source-picker prefill / re-open	Prefill is branch-less for local; srcNeedsBranch already false
New-project form	Already local-only-no-picker (unchanged)

Testing

TDD'd the source-key + recents logic. The branch-less-for-local guarantee is tested at the setCurrentSource write boundary (incl. "same local path, two checkouts → one recent"); the primitives (sourceKey / pushRecent / removeRecent) are branch-faithful. just test-app (2588 tests) and just lint pass.

Manual check

Open the same local repo, switch its checked-out branch, reopen: should be one recents row, and the header should show the live checked-out branch.

🤖 Generated with Claude Code