@@ -1032,15 +1032,20 @@ export async function syncSkills(directory: string): Promise<SyncResult> {
     // to an account with no binding here left the previous tenant's skills on
     // disk and loading into prompts, with every retry hitting the same return.
     const credsForPurge = await AltimateApi.getCredentials().catch(() => null)
-    if (credsForPurge) {
+    // A credential with no key names no account, so nothing here can be judged
+    // foreign — and the sync below will fail for the same reason, so there is
+    // no replacement coming. Purging on it deleted a good snapshot and put
+    // nothing back. Unknown never destroys a snapshot, the same rule the
+    // disconnect and lookup-failure branches follow. (review)
+    const purgeAccount = credsForPurge?.altimateApiKey
+      ? credentialDigest(
+          credsForPurge.altimateUrl,
+          credsForPurge.altimateInstanceName,
+          credsForPurge.altimateApiKey,
+        )
+      : null
+    if (credsForPurge && purgeAccount) {
       const priorManifest = await readManifest(canon)
-      const purgeAccount = credsForPurge.altimateApiKey
-        ? credentialDigest(
-            credsForPurge.altimateUrl,
-            credsForPurge.altimateInstanceName,
-            credsForPurge.altimateApiKey,
-          )
-        : null
       // Ours but unattributable — a v1 tree, which recorded no account — is
       // dropped too. It could have been fetched by anyone, so being in this
       // directory is not grounds to serve it.
@@ -1062,9 +1067,10 @@ export async function syncSkills(directory: string): Promise<SyncResult> {
     // machine, cleared state) would otherwise never get its workspace's skills.
     const outcome = await resolveBindingOutcome(canon)
     if (outcome.status !== "bound") {
-      // A CONFIRMED unbind must take the snapshot out of service — discovery
-      // does not consult the manifest, so leaving it keeps serving a workspace
-      // this project is no longer attached to. "Unknown" must not: a lookup
+      // A CONFIRMED unbind must take the snapshot out of service. Discovery's
+      // account gate does not help here: the snapshot is still this account's,
+      // it is the project that is no longer attached, so leaving it keeps
+      // serving a workspace this project has left. "Unknown" must not: a lookup
       // failure is not evidence of anything, and deleting on it would wipe a
       // snapshot on a network blip.
       if (outcome.status === "unbound") {
 
@@ -309,16 +309,34 @@ export function snapshotProjectOf(real: string): string | null {
  * the manifest or the credentials cannot be read the snapshot is withheld,
  * which costs a poll interval, where serving it cannot be taken back. */
 const withoutForeignSnapshots = Effect.fnUntraced(function* (matches: string[]) {
+  // `null` means "could not be resolved", and it is withheld rather than
+  // served. Falling back to the matched path would answer "ordinary skill" for
+  // an alias whose target merely happened to be unreadable at this instant,
+  // such as during a concurrent snapshot swap — and if the target became
+  // readable again before `add` ran, its content loaded with no account check
+  // at all. A path that cannot be resolved cannot be attributed. (review)
   const real = yield* Effect.promise(() =>
-    Promise.all(matches.map((match) => fsp.realpath(match).catch(() => match))),
+    Promise.all(
+      matches.map((match) =>
+        fsp.realpath(match).then(
+          (resolved) => resolved as string | null,
+          () => null,
+        ),
+      ),
+    ),
   )
 
+  const unresolved = matches.filter((_, i) => real[i] === null || real[i] === undefined)
+  if (unresolved.length > 0)
+    yield* Effect.logWarning("withholding skills whose paths could not be resolved", { paths: unresolved })
+
   const projects = new Set<string>()
   for (const candidate of real) {
+    if (!candidate) continue
     const project = snapshotProjectOf(candidate)
     if (project !== null) projects.add(project)
   }
-  if (projects.size === 0) return matches
+  if (projects.size === 0 && unresolved.length === 0) return matches
 
   const ours = new Map<string, boolean>()
   for (const project of projects) {
@@ -335,7 +353,9 @@ const withoutForeignSnapshots = Effect.fnUntraced(function* (matches: string[])
   }
 
   return matches.filter((_, i) => {
-    const project = snapshotProjectOf(real[i]!)
+    const candidate = real[i]
+    if (!candidate) return false
+    const project = snapshotProjectOf(candidate)
     return project === null || ours.get(project) === true
   })
 })
 
@@ -1957,6 +1957,12 @@ describe("workspace skill sync", () => {
 
     expect(existsSync(path.join(managed, "old-skill", "SKILL.md"))).toBe(false)
     expect(existsSync(skillFile("pub-1", "SKILL.md"))).toBe(true)
+    // And the replacement is attributable, which is the property this change
+    // exists for: asserting only that the tree was rebuilt would still pass if
+    // the v2 write omitted or mangled `account`. (review)
+    const rewritten = JSON.parse(readFileSync(path.join(managed, ".manifest.json"), "utf8"))
+    expect(rewritten.version).toBe(2)
+    expect(rewritten.account).toBe(FIXTURE_ACCOUNT)
   })
 
   test("a purge re-syncs immediately instead of waiting out the poll interval", async () => {
@@ -1972,6 +1978,29 @@ describe("workspace skill sync", () => {
     expect(await recentlySynced(project)).toBe(false)
   })
 
+  test("a credential with no key purges nothing", async () => {
+    // The purge compared the manifest's account against a digest that is null
+    // when no key resolves, so every valid snapshot looked foreign — and the
+    // sync below then failed for the same missing key, so nothing replaced it.
+    // Unknown never destroys a snapshot. (review)
+    serve({ "pub-1": { "SKILL.md": "one" } })
+    await syncSkills(project)
+    expect(existsSync(skillFile("pub-1", "SKILL.md"))).toBe(true)
+
+    const credsFile = path.join(SANDBOX, "home", ".altimate", "altimate.json")
+    const saved = readFileSync(credsFile, "utf8")
+    try {
+      writeFileSync(
+        credsFile,
+        JSON.stringify({ altimateUrl: API_URL, altimateInstanceName: TENANT, altimateApiKey: "" }),
+      )
+      await syncSkills(project)
+      expect(existsSync(skillFile("pub-1", "SKILL.md"))).toBe(true)
+    } finally {
+      writeFileSync(credsFile, saved)
+    }
+  })
+
   test("an accountless v2 manifest is not ours to delete", async () => {
     // Raised in review. v1 leniency is the migration path; a v2 manifest with
     // no account can only be damaged or hand-written, and claiming it would
 
@@ -11,10 +11,15 @@ import { mkdirSync, rmSync, writeFileSync } from "node:fs"
 import path from "node:path"
 import os from "node:os"
 
-const ORIGINAL_XDG_STATE_HOME = process.env.XDG_STATE_HOME
+// `OPENCODE_TEST_STATE_HOME`, not `XDG_STATE_HOME`. `Global.Path.state` is a
+// getter that reads this on every access, so it holds however the module graph
+// was loaded. `XDG_STATE_HOME` is folded into a module-load-time const, so it
+// only works if this file happens to import Global first — and test files share
+// a worker, so that is not something a file can arrange. (review)
+const ORIGINAL_STATE_HOME = process.env.OPENCODE_TEST_STATE_HOME
 const SANDBOX = path.join(os.tmpdir(), `altimate-state-account-${process.pid}-${Date.now()}`)
 mkdirSync(path.join(SANDBOX, "state"), { recursive: true })
-process.env.XDG_STATE_HOME = path.join(SANDBOX, "state")
+process.env.OPENCODE_TEST_STATE_HOME = path.join(SANDBOX, "state")
 
 const { recordApprovedBinding, readLocalBinding, clearLocalBinding, cachePath, credentialDigest } =
   await import("../../../src/altimate/workspace/state")
@@ -56,12 +61,19 @@ afterEach(() => {
 })
 
 afterAll(() => {
-  if (ORIGINAL_XDG_STATE_HOME === undefined) delete process.env.XDG_STATE_HOME
-  else process.env.XDG_STATE_HOME = ORIGINAL_XDG_STATE_HOME
+  if (ORIGINAL_STATE_HOME === undefined) delete process.env.OPENCODE_TEST_STATE_HOME
+  else process.env.OPENCODE_TEST_STATE_HOME = ORIGINAL_STATE_HOME
   rmSync(SANDBOX, { recursive: true, force: true })
 })
 
 describe("binding cache is scoped to the account, not the tenant", () => {
+  test("the sandbox redirect is in effect", () => {
+    // Guards the guard: if `Global.Path.state` were not redirected, every test
+    // below would still pass while reading and writing the real developer's
+    // state directory. (review)
+    expect(cachePath().startsWith(SANDBOX)).toBe(true)
+  })
+
   test("a second user on the same tenant does not inherit the first user's workspace", async () => {
     // The reported bug: A links this project to their private workspace, the
     // credentials are switched to B on the same tenant, and B's session read
 
@@ -337,14 +337,18 @@ describe("v0.12.0 adversarial: lastSuccessfulSyncAt against a hand-edited marker
     }
   })
 
-  test("a valid marker for a different workspace, tenant or API host is not this binding's", async () => {
+  test("a valid marker for a different workspace, tenant, API host or account is not this binding's", async () => {
     const at = 1700000000000
     const good = { at, ...binding }
     expect(await lastSuccessfulSyncAt(withMarker(JSON.stringify(good)), binding)).toBe(at)
     for (const other of [
       { ...good, datamateId: 8 },
       { ...good, tenant: "ACME" },
       { ...good, apiUrl: "https://api.example/" },
+      // Two accounts granted the SAME workspace on the same host: everything
+      // else matches, so the account is the only thing that can tell the first
+      // user's sync age from the second's. (review)
+      { ...good, account: "acct-8" },
     ]) {
       expect(await lastSuccessfulSyncAt(withMarker(JSON.stringify(other)), binding)).toBeNull()
     }
 
@@ -809,6 +809,38 @@ description: A skill in the .opencode/skills directory.
     ),
   )
 
+  // A path that cannot be resolved cannot be attributed, so it is withheld.
+  // Falling back to the matched path answered "ordinary skill" for a broken or
+  // momentarily unreadable alias — and one whose target became readable again
+  // before the file was read would have loaded with no account check. (review)
+  it.live("a skill whose path cannot be resolved is withheld, not assumed innocent", () =>
+    provideTmpdirInstance(
+      (dir) =>
+        withHome(
+          dir,
+          Effect.gen(function* () {
+            yield* Effect.promise(() => writeSnapshot(dir, FIXTURE_ACCOUNT))
+            // A dangling link where a skill would be. `realpath` cannot resolve
+            // it, and the glob still matches it because the leaf name does.
+            yield* Effect.promise(async () => {
+              await fs.mkdir(path.join(dir, ".opencode", "skill", "ghost"), { recursive: true })
+              await fs.symlink(
+                path.join(dir, "nowhere", "SKILL.md"),
+                path.join(dir, ".opencode", "skill", "ghost", "SKILL.md"),
+              )
+            })
+
+            const skill = yield* Skill.Service
+            const all = yield* skill.all()
+            // The real snapshot is unaffected: withholding is per path.
+            expect(all.find((s) => s.name === "workspace-synced")).toBeDefined()
+            expect((yield* skill.dirs()).some((d) => d.endsWith("ghost"))).toBe(false)
+          }),
+        ),
+      { git: true },
+    ),
+  )
+
   // A snapshot from before the manifest carried an account cannot be
   // attributed to anyone, so it is withheld rather than served to whoever
   // happens to be logged in. The sync drops and re-fetches it.