@@ -299,6 +299,12 @@ export async function lastSuccessfulSyncAt(
     // longer describes what is on disk.
     const code = (err as NodeJS.ErrnoException)?.code
     if (code === "ENOENT" || code === "ENOTDIR") return null
+    // Any other read failure (EACCES, a truncated read) with a binding to
+    // answer for: the in-memory stamp carries no workspace identity, so
+    // falling back to it reported the previous binding's age under the
+    // current one. The map is only an answer where the caller asked no
+    // identity question.
+    if (binding) return null
     return lastSyncedAt.get(path.resolve(directory)) ?? null
   }
 }
@@ -736,6 +742,9 @@ export async function syncSkills(directory: string): Promise<{ changed: boolean
     }
   }
   let changed = false
+  /** The manifest an unchanged run validated, so its marker describes that
+   * snapshot rather than whatever is live when the stamp is written. */
+  let validated: Manifest | null = null
   let failed = false
   // Set once the workspace's list has actually been read. Only then has this
   // project been "checked", and only then should the poll interval start.
@@ -849,7 +858,14 @@ export async function syncSkills(directory: string): Promise<{ changed: boolean
     sawRemote = true
     syncedFor.set(canon, accountKeyOf(creds.altimateInstanceName, creds.altimateUrl))
 
-    if (!foreign && (await upToDate(canon, manifest, remote))) return
+    if (!foreign && (await upToDate(canon, manifest, remote))) {
+      // Remembered for the stamp below, which runs after this block settles.
+      // Re-reading the manifest there instead would stamp whatever tree is
+      // live by then — another process can swap a partial snapshot in
+      // between, and the marker would vouch for a sync this run never made.
+      validated = manifest
+      return
+    }
 
     if (remote.length === 0) {
       await removeManaged(canon)
@@ -1074,11 +1090,13 @@ export async function syncSkills(directory: string): Promise<{ changed: boolean
       // nothing: the manifest on disk is unchanged, so stamping beside it
       // cannot pair it with another workspace. Only where a snapshot exists —
       // a clean run against an empty workspace removed the root.
-      if (!changed) {
-        const current = await readManifest(canon)
-        if (current)
-          await fs.writeFile(path.join(managedRoot(canon), SYNCED_MARKER), markerFor(current, now)).catch(() => {})
-      }
+      // Written for the snapshot this run CHECKED, not for whatever is on
+      // disk now. If another process swapped a different workspace's tree in
+      // meanwhile, the marker names the one that was validated and
+      // `lastSuccessfulSyncAt` rejects it for the new binding — no age is
+      // better than an age vouching for a sync that did not happen.
+      if (!changed && validated)
+        await fs.writeFile(path.join(managedRoot(canon), SYNCED_MARKER), markerFor(validated, now)).catch(() => {})
     }
     return { changed }
   })()
 
@@ -158,7 +158,14 @@ function View(props: { api: TuiPluginApi }) {
       // manage base and the status each take a credentials read of their own,
       // and a switch during either would otherwise pair one account's binding
       // with another's URL or counts.
-      const stillThisScope = async () => (await currentScope()) === scope
+      // Three answers, not two: a null read is "unknown this instant", and an
+      // unknown must neither commit (it could pair the wrong account) nor
+      // clear (the tile is not known to be wrong). Only a scope that reads as
+      // another one clears.
+      const scopeNow = async (): Promise<"same" | "changed" | "unknown"> => {
+        const now = await currentScope()
+        return now === null ? "unknown" : now === scope ? "same" : "changed"
+      }
       if (outcome.status === "bound") {
         // Counts and the manage URL belong to a SPECIFIC workspace. On a rebind
         // they would otherwise keep describing the old one until the new status
@@ -186,8 +193,9 @@ function View(props: { api: TuiPluginApi }) {
       // cleared the manage URL, or never set one.
       if (!b) return
       const base = await resolveManageBase()
-      if (!(await stillThisScope())) {
-        clearRendered()
+      const afterBase = await scopeNow()
+      if (afterBase !== "same") {
+        if (afterBase === "changed") clearRendered()
         return
       }
       setManageUrl(base ? buildManageUrl(base, b.datamateId) : null)
@@ -203,8 +211,9 @@ function View(props: { api: TuiPluginApi }) {
       // again — during an outage neither answer is memoized, and that was two
       // requests where one was already too many.
       const detail = await Manage.status(dir, { poll: true, binding: b }).catch(() => null)
-      if (!(await stillThisScope())) {
-        clearRendered()
+      const afterStatus = await scopeNow()
+      if (afterStatus !== "same") {
+        if (afterStatus === "changed") clearRendered()
         return
       }
       setDetail(detail)
 
@@ -594,6 +594,38 @@ describe("workspace skill sync", () => {
     expect((await lastSuccessfulSyncAt(project)) as number).toBeGreaterThan(first as number)
   })
 
+  test("the unchanged run's marker names the snapshot it checked", async () => {
+    // Tied to the validated manifest, not to whatever tree is live when the
+    // stamp is written: another process can swap a partial snapshot in
+    // between, and a marker read from that tree would vouch for a sync this
+    // run never made.
+    serve({ "pub-1": { "SKILL.md": "one" } })
+    await syncSkills(project)
+    const manifest = JSON.parse(readFileSync(path.join(project, MANAGED, ".manifest.json"), "utf8"))
+    await new Promise((r) => setTimeout(r, 5))
+    await syncSkills(project) // unchanged: publishes nothing, stamps only
+
+    const marker = JSON.parse(readFileSync(path.join(project, MANAGED, ".synced-at"), "utf8"))
+    expect(marker.datamateId).toBe(manifest.datamateId)
+    expect(marker.tenant).toBe(manifest.tenant)
+    expect(marker.apiUrl).toBe(manifest.apiUrl)
+  })
+
+  test("an unreadable marker is unknown, never the previous binding's age", async () => {
+    // The in-memory stamp carries no workspace identity. Falling back to it
+    // on a read failure reported workspace A's age under B.
+    serve({ "pub-1": { "SKILL.md": "one" } })
+    await syncSkills(project)
+    const marker = path.join(project, MANAGED, ".synced-at")
+    rmSync(marker)
+    mkdirSync(marker) // a directory where the file should be: EISDIR, not ENOENT
+
+    const asked = { datamateId: 99, tenant: TENANT, apiUrl: API_URL }
+    expect(await lastSuccessfulSyncAt(project, asked)).toBeNull()
+    // With no identity asked for, the process's own stamp is still an answer.
+    expect(await lastSuccessfulSyncAt(project)).not.toBeNull()
+  })
+
   test("a removed snapshot has no last sync, whatever the process remembers", async () => {
     // The in-memory stamp survives the purge; the answer must not. After an
     // unlink or a rebind the root is gone, and "synced 2m ago" would describe