@@ -40,6 +40,7 @@ altimate --agent analyst
 | `import`    | Import session data            |
 | `session`   | Session management             |
 | `link`      | Link this project to an Altimate workspace (pilot, requires `ALTIMATE_WORKSPACE=1`) |
+| `workspace` | Show, refresh, sync or unlink this project's workspace from a shell (pilot, requires `ALTIMATE_WORKSPACE=1`) |
 | `trace`     | List and view session traces (recordings of agent sessions) |
 | `github`    | GitHub integration             |
 | `pr`        | Pull request tools             |
@@ -52,6 +53,11 @@ altimate --agent analyst
 Workspace features are off unless `ALTIMATE_WORKSPACE=1` is set. With it:
 
 - `altimate-code link` links the current project to a workspace (or creates one). The sidebar then names the workspace and shows how many memories are not yet synced and when skills last synced.
+- From a shell, script or CI job, without the TUI:
+    - `altimate-code link --workspace <name|id>` links to an existing workspace (an id is matched before a name), and `altimate-code link --create [name]` creates one (named after the repo by default) and links to it. Neither prompts. If the project is already linked to a different workspace they refuse unless `--yes` is passed. Running `--create` again when the project is already linked to a workspace of that name creates nothing, so it is safe in a devcontainer's setup command; if another workspace already has that name it refuses and names its id, unless `--allow-duplicate` is passed. Linking to the workspace the project is already linked to confirms that link on this machine, which a fresh clone needs before `workspace sync` sends its memory.
+    - `altimate-code workspace status [--json]` shows the linked workspace and, when known, how many saved memories have not reached it and when skills last synced.
+    - `altimate-code workspace refresh` pulls the workspace's skills (memory is loaded by the next session started in the project); `altimate-code workspace sync` sends memory the workspace has not received; `altimate-code workspace unlink [--yes]` detaches the project (`--yes` is required without a terminal).
+    - These commands accept `--directory`. Exit codes: `0` done, `1` failed (including when the workspace service could not be reached), `2` a request to change (not signed in, a re-link or unlink without `--yes` and no terminal to confirm on, or a `sync` to a link not yet confirmed on this machine), `3` the project is not linked. With `--json`, `ok` is `true` exactly when the exit code is `0`.
 - `/workspace` in the TUI opens a menu: **Refresh** pulls the workspace's skills and memory into this project, **Sync** re-sends local memory the workspace never received, **Open in browser** (when a web URL is available) shows the workspace on the web, **Switch workspace** relinks the project, **Unlink** detaches it. In a project that is not linked yet, it offers **Link to a workspace** instead.
 - `altimate-code skill publish <name>` uploads a project skill to the linked workspace; see [Skills](../configure/skills.md#cli-commands).
 - In an ordinary session the agent is told every turn which workspace the project is linked to — or that none is, or that the link could not be verified just now. In an extension-pinned session it is told the pinned workspace instead, and that it differs from the project's own link. Either way "which workspace am I in?" has an answer, and the agent is told not to confuse it with a Databricks workspace or an IDE workspace folder.
 
@@ -378,9 +378,9 @@ export { req as altimateRequest }
 
 export namespace WorkspaceApi {
   /** Server-authoritative pre-check by git remote. Returns null on 404. */
-  export async function getBindingForRemote(remote: string): Promise<GetBindingResponse | null> {
+  export async function getBindingForRemote(remote: string, actAs?: ActAs): Promise<GetBindingResponse | null> {
     try {
-      return await req<GetBindingResponse>("GET", "/by-remote", { query: { repo_remote: remote } })
+      return await req<GetBindingResponse>("GET", "/by-remote", { query: { repo_remote: remote }, ...(actAs ? { actAs } : {}) })
     } catch (err) {
       if (err instanceof NotFoundError) return null
       throw err
@@ -389,9 +389,9 @@ export namespace WorkspaceApi {
 
   /** Symmetric pre-check by absolute project directory path (for projects
    * without a git remote). Returns null on 404. */
-  export async function getBindingForPath(projectPath: string): Promise<GetBindingResponse | null> {
+  export async function getBindingForPath(projectPath: string, actAs?: ActAs): Promise<GetBindingResponse | null> {
     try {
-      return await req<GetBindingResponse>("GET", "/by-path", { query: { project_path: projectPath } })
+      return await req<GetBindingResponse>("GET", "/by-path", { query: { project_path: projectPath }, ...(actAs ? { actAs } : {}) })
     } catch (err) {
       if (err instanceof NotFoundError) return null
       throw err
@@ -403,13 +403,13 @@ export namespace WorkspaceApi {
    * picks the right endpoint even if the current identifier's remote has
    * changed since the binding was created (M3). Both fields on the
    * identifier are optional but at least one must be present. */
-  export async function getBindingForProject(id: ProjectIdentifier): Promise<ProjectBindingLookup | null> {
+  export async function getBindingForProject(id: ProjectIdentifier, actAs?: ActAs): Promise<ProjectBindingLookup | null> {
     if (id.repoRemote) {
-      const hit = await getBindingForRemote(id.repoRemote)
+      const hit = await getBindingForRemote(id.repoRemote, actAs)
       if (hit) return { ...hit, matchedBy: "remote" }
     }
     if (id.projectPath) {
-      const hit = await getBindingForPath(id.projectPath)
+      const hit = await getBindingForPath(id.projectPath, actAs)
       if (hit) return { ...hit, matchedBy: "path" }
     }
     return null
 
@@ -50,6 +50,9 @@ export interface StatusReport {
    * sidebar, when the service could not be reached. Rendering that as
    * 0 would tell the user their memory is current when nobody knows. */
   memory: { local: number; unsynced: number | null } | null
+  /** Set when memory is on but the local store or its index could not be read: `memory` is then null, which
+   * alone would read as "off". */
+  memoryUnreadable?: true
   skillsEnabled: boolean
   /** When workspace skills last synced successfully, or null if they have not in
    * this process. Null is genuinely "unknown", not "never" — the store is
@@ -85,7 +88,14 @@ export interface SyncReport {
    * and only one of them is the workspace's memory toggle; a toast that said
    * "memory is off" for a failed local read sent the user to a setting that was
    * fine. */
-  gatedBecause?: "flag-off" | "no-binding" | "pin-unresolved" | "memory-off" | "read-failed" | "setting-unavailable"
+  gatedBecause?:
+    | "flag-off"
+    | "no-binding"
+    | "pin-unresolved"
+    | "memory-off"
+    | "read-failed"
+    | "setting-unavailable"
+    | "not-approved"
   sent: number
   failed: number
   /** Already present in the workspace at their current payload. */
@@ -139,9 +149,11 @@ export async function status(
         ? await resolveBinding(directory).catch(() => null)
         : ((await readLocalBinding(directory).catch(() => null)) ??
           (await resolveBinding(directory).catch(() => null)))
+  const memory = await memoryCounts(directory, binding, opts.poll === true)
   return {
     binding,
-    memory: await memoryCounts(directory, binding, opts.poll === true),
+    memory: memory === "unreadable" ? null : memory,
+    ...(memory === "unreadable" ? { memoryUnreadable: true as const } : {}),
     skillsEnabled: SkillSync.isEnabled(),
     skillsSyncedAt: await skillsSyncedAt(directory, binding),
   }
@@ -223,7 +235,13 @@ export async function refresh(directory: string, sessionID?: string): Promise<Re
  * `backfill` is throttled and resumable — blocks already present at their current
  * payload are skipped — so running this when there is nothing to do costs an index
  * read, not uploads. */
-export async function sync(directory: string): Promise<SyncReport> {
+export async function sync(
+  directory: string,
+  /** A binding the caller has already verified. Used as given rather than re-read from the shared cache, which another
+   * process can replace between the caller's check and the sweep; one never approved on this machine is refused here,
+   * where the memory is actually sent. */
+  opts: { binding?: CachedBinding } = {},
+): Promise<SyncReport> {
   const gated = (why: NonNullable<SyncReport["gatedBecause"]>): SyncReport => ({
     gated: true,
     gatedBecause: why,
@@ -240,9 +258,15 @@ export async function sync(directory: string): Promise<SyncReport> {
   // unpinned session keeps the cache-only read, and a pin that cannot be honoured stays gated —
   // under its own reason, since "nothing is linked" would misdescribe a workspace that exists —
   // rather than falling through to the project's link.
-  const pinned = await resolvePinnedBindingForRouting(directory).catch(() => ({ status: "unknown" as const }))
-  if (pinned && pinned.status !== "bound") return gated("pin-unresolved")
-  const binding = pinned ? pinned.binding : await readLocalBinding(directory).catch(() => null)
+  let binding: CachedBinding | null
+  if (opts.binding) {
+    if (opts.binding.adopted) return gated("not-approved")
+    binding = opts.binding
+  } else {
+    const pinned = await resolvePinnedBindingForRouting(directory).catch(() => ({ status: "unknown" as const }))
+    if (pinned && pinned.status !== "bound") return gated("pin-unresolved")
+    binding = pinned ? pinned.binding : await readLocalBinding(directory).catch(() => null)
+  }
   if (!binding) return gated("no-binding")
 
   const blocks = await MemoryStore.listAll({ directory }).catch((err) => {
@@ -300,7 +324,7 @@ async function memoryCounts(
   directory: string,
   binding: CachedBinding | null,
   poll: boolean,
-): Promise<{ local: number; unsynced: number | null } | null> {
+): Promise<{ local: number; unsynced: number | null } | null | "unreadable"> {
   if (!MemorySync.isEnabled()) return null
   try {
     const blocks = await MemoryStore.listAll({ directory })
@@ -317,7 +341,7 @@ async function memoryCounts(
     return { local: blocks.length, unsynced: await MemorySync.pendingCount(blocks, binding, { network: false }) }
   } catch (err) {
     log.warn("could not count local memory for the workspace status", { err: String(err) })
-    return null
+    return "unreadable"
   }
 }
 
 
@@ -916,6 +916,21 @@ export function peekRowUnscoped(directory: string): UnscopedRow | null {
   }
 }
 
+/** Whether this directory holds the approved (not adopted) row a `recordApprovedBinding` call wrote: `datamateId`
+ * under `account`, stamped with the `linkedAt` that call passed, so an approval recorded earlier does not count.
+ * `recordApprovedBinding` returns "account-changed" both before its write and after it (at the memory seed);
+ * this tells the caller which one happened. */
+export function isApprovedRow(directory: string, account: string, datamateId: number, linkedAt: number): boolean {
+  try {
+    const cache = readCache()
+    if (!cache || cache.account !== account) return false
+    const row = primaryRow(cache, directory)
+    return row?.datamateId === datamateId && row.linkedAt === linkedAt && !row.adopted
+  } catch {
+    return false
+  }
+}
+
 /** The row reads win for a directory: the canonical key, or failing that the
  * newest alias. */
 function primaryRow(cache: CacheFile, directory: string): CachedBinding | undefined {