Project-aware TUI apps

- rebase (visit 1): pass, then wait-rebased: exit 0
- wait-rebased (visit 1): pass, then rebased-green: held after 13 checks
- rebased-green (visit 1): pass, then land: exit 0
- land (visit 1): pass, then wait-landed: exit 0
- wait-landed (visit 1): pass, then landed-green: held after 14 checks
- landed-green (visit 1): pass, then rebase-merge: exit 0
- rebase-merge (visit 1): pass, then wait-rebased-merge: exit 0
- wait-rebased-merge (visit 1): pass, then rebased-merge-green: held after 1 checks
- rebased-merge-green (visit 1): pass, then merge: exit 0
- merge (visit 1): pass, then wait-main: exit 0
- wait-main (visit 1): pass, then main-green: held after 1 checks
- main-green (visit 1): pass, then close-out: exit 0
- close-out (visit 1): pass, then ship: exit 0
- ship (visit 1): pass, then deploy-check: exit 0
- deploy-check (visit 1): pass, then end: exit 0

## Leaves

- tui-current-project (step build/build): passed: attempt 2: verifier passed
  - attempt 1 builder, session d71b1aa0-20dc-4866-8023-01a1b35c0665: pass (said done)
  - attempt 1 verifier, session 546ba79a-0288-4767-818d-01a1b35f948d: fail (verifier found 2 problem(s))
  - attempt 2 builder, session 42f4bcb0-394c-447f-8f3c-01a1b366f24c: pass (said done)
  - attempt 2 verifier, session dcc9e971-8d56-4596-b08e-01a1b36ac388: pass (Evidence written by the verifier)
  - attempt 1 finding f1: The header overflows the window by one row, so it (or the app's last line) is clipped whenever the pane is shorter than the app's natural size. Shell.Update and headed.Update pass the full tea.WindowSizeMsg height to the hosted component, which fills that height (ui.List visibleRows uses l.h), and the header is then prepended as an extra row. Reproduced in a scratch copy of a22f7c63 (not the repo): New(List(ui.NewList(theme.Dark(), prof, 40 rows))).WithHeader("Project: alpha"), Update(tea.WindowSizeMsg{Width:60,Height:12}) gives View().Content of 13 lines; without the header it gives 12. Fix: give the component Height-1 when a header is set (in Shell.Update and headed.Update), and add a test that a headed shell's view fits the WindowSizeMsg height.
  - attempt 1 finding f2: The acceptance asks for TUI app tests opened in a project folder, in a sibling worktree and at the root. The commit tests projectctx.Header(dir) and modalshell's WithHeader on their own, but no test opens an app (`rhiza tui app <name>`, i.e. cmd/rhiza tuiApp) in those directories and checks that its header names the project or says No project. The wiring in cmd/rhiza/tui.go (os.Getwd -> projectctx.Header -> WithHeader/RunHeaded for inbox, runs, autonomy, daemon and request) is untested. Fix: add an app-level test, such as an exported header-resolution helper in cmd/rhiza tested per app in each of the three locations, or a testscript that opens an app's model in a root/project/sibling-worktree layout.
- tui-starts-in-project (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session 9037418e-f3c9-44a4-ad21-01a1b35fdef3: pass (said done)
  - attempt 1 verifier, session 9bcf62bd-e320-4c32-a5ec-01a1b361b9b6: pass (Evidence written by the verifier)
- tui-project-switch (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session e8b5478a-6447-4d4b-b5f5-01a1b3620c72: pass (said done)
  - attempt 1 verifier, session 177617ec-717c-49b0-8750-01a1b36682b5: pass (Evidence written by the verifier)
- tui-merged-inbox (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session abcef27a-e82a-4af9-a6b4-01a1b36b0a61: pass (said done)
  - attempt 1 verifier, session d5cac357-6ba3-4656-aaa8-01a1b36d3c24: pass (Evidence written by the verifier)
- tui-runs-daemon-across-projects (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session 62bfe11f-9260-4f9a-a491-01a1b36d7dc5: pass (said done)
  - attempt 1 verifier, session a13da17e-ee7b-43e0-8fe0-01a1b36f6a04: pass (Evidence written by the verifier)

## Checks

- compliance (step review/review): passed after 1 cycle
  - cycle 1: passed, check session b973f160-f90b-4806-b831-01a1b3716154 pass (said done)
  - round 1 (cycle 1): 3 findings, 0 confirmed
    - f1 minor at internal/tui/inboxapp/inboxapp_test.go:990 on tui-merged-inbox: Acceptance asks that answering an item from project B, opened from project A, writes into B. TestMergedAnswerWritesIntoItemsProject retries B's failed run rather than answering it, and NewMergedModel has no opened-from project, so 'opened from A' appears only in a comment. The question-answer routing is tested only for alpha's own item. The routing code path (act() with the item's project) is the same, so the intent is covered, but not as written.
    - f2 minor at internal/tui/modalshell/switcher_test.go:66 on tui-project-switch: The switch test drives a synthetic list app inside modalshell.Switcher with a fake Chdir/Header, not one of Rhiza's TUI apps opened over two registered projects; no cmd/rhiza test switches a real app (e.g. via appSwitcher) from A to B and checks its listed data.
    - f3 nit at internal/tui/requestapp/requestapp_test.go:149 on tui-starts-in-project: The Request tests pass the current project 'B' to NewIn and check the fake runner's project label; they do not open the app in B's folder (appSwitcher derives it from the working directory) or find the request queued in B's model. Covered by composition with TestTUIAppHeaders, not end to end.
- quality (step review/review): passed after 1 cycle
  - cycle 1: passed, check session 7937e761-4d38-42d0-8533-01a1b371948d pass (said done)
  - round 1 (cycle 1): 9 findings, 0 confirmed
    - f1 minor at internal/tui/inboxapp/inboxapp.go:152 on tui-merged-inbox: A merged inbox skips a project whose inbox cannot be read and records it only in Failed(), which nothing calls: the owner gets no sign that a project's questions or gates are missing. The runs app drops unreadable projects silently in the same way (runsapp.go loadMerged).
    - f2 minor at internal/tui/modalshell/switcher.go:150 on tui-project-switch: When Chdir fails during a switch, the error goes into s.err, but only Err() reads it and no caller uses Err(): the picker closes and the app stays in the old project with no message.
    - f3 minor at internal/tui/modalshell/switcher.go:110 on tui-project-switch: The app rebuilt after a switch never gets a WindowSizeMsg, and resizes while the picker is open go only to the picker. The new app falls back to its natural size (inbox m.w/m.h stay 0) instead of the pane's size.
    - f4 minor at cmd/rhiza/tui.go:150 on tui-merged-inbox: The merged inbox and runs move between projects with os.Chdir, but newCtx resolves the repo from RHIZA_ROOT when it is set. A pane with RHIZA_ROOT set then reads one project's items under every project's tag, and acts on them there.
    - f5 minor at cmd/rhiza/tui.go:82 on tui-merged-inbox: With --once, the inbox and runs apps still build the single-project models, so their JSON is the current project's only, while the interactive apps show every project's items.
    - f6 minor at internal/tui/daemonapp/daemonapp.go:178 on tui-runs-daemon-across-projects: The project run-limit field skips an empty value (v != ""), so once a project max is set it cannot be cleared from the Daemon app.
    - f7 nit at cmd/rhiza/tui.go:69: tuiApp aliases apps.inbox/runs/autonomy for no reason, and keeps an `if once` check plus a trailing `return 0` after `if !once` has already returned.
    - f8 nit at cmd/rhiza/tui.go:290: For the daemon app, appSwitcher calls Build once to probe for an error, and NewSwitcher then builds it again, so daemon.settings is read twice when the app opens.
    - f9 nit at internal/tui/requestapp/requestapp.go:124 on tui-starts-in-project: At the root, after the Request app's own picker chooses a project, the switcher header still says 'No project' while the request form is in the picked project.
- qa (step review/review): passed after 1 cycle
  - cycle 1: passed, check session fa5e0f3c-8252-4204-84c3-01a1b371dd17 pass (said done)
  - round 1 (cycle 1): 2 findings, 0 confirmed
    - f1 minor at internal/tui/modalshell/switcher.go:149 on tui-project-switch: After a switch the picker and the rebuilt app never get a WindowSizeMsg, so in a fixed-size terminal (tmux 100x30) the new frame draws at its natural height below the old one: the old 'Project: alpha' frame stays on screen above the 'Project: beta' frame. The switcher could keep the last WindowSizeMsg and pass it to the picker and to the new model after reload. A Rex pane sized to NaturalSize may hide this.
    - f2 minor at cmd/rhiza/tui.go:271 on tui-starts-in-project: In the Request app opened at the root, picking alpha in the form's Project picker leaves the header at 'No project' while the request is then filed in alpha; decision m29-tui-project-from-pane says the header names the project.
- scope (step review/review): passed after 1 cycle
  - cycle 1: passed, check session f295f97d-c18e-466a-9209-01a1b3723927 pass (said done)
  - round 1 (cycle 1): no findings
- model (step review/review): passed after 1 cycle
  - cycle 1: passed, check session 8ec3992e-8c82-4197-a475-01a1b372cfaf pass (said done)
  - round 1 (cycle 1): 1 finding, 0 confirmed
    - f1 minor at internal/tui/requestapp/requestapp.go:84 on tui-starts-in-project: The capability says everything a TUI app starts (a milestone, a change set, a plan or a request) is started in the current project, but the only TUI app that starts anything is the Request app (feature, bug or milestone requests); no app starts a change set or a plan. The statement describes apps that do not exist yet; it could name the Request app, or the gap could be left to the app overhaul.

## Code checks

- step review/code: pass

## Sign-offs

- signoff (visit 1): approved by rule autonomous

## Sessions

- build/build, session d71b1aa0-20dc-4866-8023-01a1b35c0665: tokens input 30, output 8737, cache creation 52233, cache read 958722; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 546ba79a-0288-4767-818d-01a1b35f948d: tokens input 32, output 6637, cache creation 44312, cache read 1000585; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 9037418e-f3c9-44a4-ad21-01a1b35fdef3: tokens input 20, output 5206, cache creation 43114, cache read 573295; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 9bcf62bd-e320-4c32-a5ec-01a1b361b9b6: tokens input 40, output 8250, cache creation 40069, cache read 1198473; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session e8b5478a-6447-4d4b-b5f5-01a1b3620c72: tokens input 28, output 10860, cache creation 49435, cache read 898286; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 177617ec-717c-49b0-8750-01a1b36682b5: tokens input 20, output 4204, cache creation 37667, cache read 566206; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 42f4bcb0-394c-447f-8f3c-01a1b366f24c: tokens input 34, output 10394, cache creation 52792, cache read 1150036; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session dcc9e971-8d56-4596-b08e-01a1b36ac388: tokens input 16, output 2231, cache creation 33893, cache read 433705; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session abcef27a-e82a-4af9-a6b4-01a1b36b0a61: tokens input 28, output 10990, cache creation 55854, cache read 956949; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session d5cac357-6ba3-4656-aaa8-01a1b36d3c24: tokens input 20, output 3655, cache creation 35743, cache read 561004; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 62bfe11f-9260-4f9a-a491-01a1b36d7dc5: tokens input 30, output 10196, cache creation 66790, cache read 1089539; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session a13da17e-ee7b-43e0-8fe0-01a1b36f6a04: tokens input 16, output 3753, cache creation 35071, cache read 435829; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session b973f160-f90b-4806-b831-01a1b3716154: tokens input 16, output 3904, cache creation 49688, cache read 497310; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 7937e761-4d38-42d0-8533-01a1b371948d: tokens input 28, output 8772, cache creation 63540, cache read 1044415; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session fa5e0f3c-8252-4204-84c3-01a1b371dd17: tokens input 92, output 20623, cache creation 74939, cache read 3690554; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session f295f97d-c18e-466a-9209-01a1b3723927: tokens input 14, output 1943, cache creation 45279, cache read 405051; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 8ec3992e-8c82-4197-a475-01a1b372cfaf: tokens input 14, output 3440, cache creation 52555, cache read 427326; helper tokens input 0, output 0, cache creation 0, cache read 0

Totals: tokens input 478, output 123795, cache creation 832974, cache read 15887285; helper tokens input 0, output 0, cache creation 0, cache read 0