fix(sidebar): KbWatcher onCreated hardcoded setupDone=true — pill flipped to ready on Enable

Root cause survived the previous isAxmeInitialized fix: that function
was only used at activate time. The kb-watcher's onCreated callback
(fires when .axme-code/ first appears) bypassed it entirely:

  this.push({ setupDone: true, ... })   // unconditional

So when Enable semantic search ran 'axme-code config set context.mode
search', the CLI created .axme-code/config.yaml as side effect → root
watcher detected .axme-code/ creation → onCreated fired → pushed
setupDone=true blindly. Pill flipped to 'ready' even though no oracle,
no decisions, no memories existed.

Fix: every code path that pushes setupDone now reads via
isAxmeInitialized(workspaceRoot). Four sites updated:
  - KbWatcher onChange (poll) — recompute setupDone every tick so when
    the agent's first save creates oracle, pill flips immediately
  - KbWatcher onCreated — replaced hardcode with isAxmeInitialized()
  - refreshAll() — also pushes setupDone
  - resolveWebviewView initial push — re-reads instead of trusting
    initialState (which can be stale by the time webview resolves)

Exported isAxmeInitialized to accept optional path so sidebar's bound
workspaceRoot is canonical (was reading the global workspaceFolders[0]).

Walkthrough context key axme.workspaceInitialized uses same signal —
fixes Step 2 auto-completing on Enable side-effects.

Author: George-iam

extension/src/setup-controller.ts

@@ -24,8 +24,8 @@ function workspaceRoot(): string | undefined {
   return folders[0].uri.fsPath;
 }
 
-export function isAxmeInitialized(): boolean {
-  const root = workspaceRoot();
+export function isAxmeInitialized(rootOverride?: string): boolean {
+  const root = rootOverride ?? workspaceRoot();
   if (!root) return false;
   // The directory alone is NOT a setup-complete signal: enabling
   // semantic search runs `axme-code config set context.mode search`

extension/src/sidebar-webview.ts

@@ -24,6 +24,7 @@ import { readHealth, HealthSnapshot } from "./health-reader.js";
 import { detectCurrentMode } from "./auditor-auth.js";
 import { hooksAreInstalled } from "./hooks-state.js";
 import { readContextMode, indexedCount, ContextMode } from "./search-mode.js";
+import { isAxmeInitialized } from "./setup-controller.js";
 import { log } from "./log.js";
 
 /**
@@ -115,28 +116,46 @@ export class AxmeSidebarProvider implements vscode.WebviewViewProvider {
           // mode changes (a saved memory means a session is in-flight,
           // a reindex bumps indexedEntries), so we refresh all live
           // signals together on the watcher tick — saves wiring extra
-          // polling timers.
+          // polling timers. setupDone is re-checked here too because
+          // the agent's first save during cooperative setup creates
+          // oracle/stack.md, which is exactly the moment the pill
+          // should flip from "setup required" to "ready".
+          const setupDone = isAxmeInitialized(workspaceRoot);
           this.push({
             counts,
             backlog: readBacklog(workspaceRoot).slice(0, 5),
             health: readHealth(workspaceRoot),
             contextMode: readContextMode(workspaceRoot),
             indexedEntries: indexedCount(workspaceRoot),
+            setupDone,
           });
+          void vscode.commands.executeCommand(
+            "setContext",
+            "axme.workspaceInitialized",
+            setupDone,
+          );
         },
         () => {
+          // .axme-code/ just appeared on disk. This is NOT the same as
+          // "setup completed" — `axme-code config set context.mode search`
+          // creates .axme-code/ as a side effect of writing config.yaml
+          // even without any setup. Re-check the canonical signal
+          // (isAxmeInitialized → oracle/stack.md or any D-NNN-*.md) and
+          // flip setupDone + the walkthrough context key only when it's
+          // really true.
+          const setupDone = isAxmeInitialized(workspaceRoot);
           this.push({
-            setupDone: true,
+            setupDone,
             health: readHealth(workspaceRoot),
             contextMode: readContextMode(workspaceRoot),
             indexedEntries: indexedCount(workspaceRoot),
           });
           void vscode.commands.executeCommand(
             "setContext",
             "axme.workspaceInitialized",
-            true,
+            setupDone,
           );
-          log("KbWatcher: .axme-code/ created — sidebar + walkthrough updated.");
+          log(`KbWatcher: .axme-code/ appeared — setupDone=${setupDone}.`);
         },
       );
     }
@@ -173,6 +192,7 @@ export class AxmeSidebarProvider implements vscode.WebviewViewProvider {
       contextMode: readContextMode(this.workspaceRoot),
       indexedEntries: indexedCount(this.workspaceRoot),
       hooksOk: hooksAreInstalled(),
+      setupDone: isAxmeInitialized(this.workspaceRoot),
     });
   }
 
@@ -194,13 +214,20 @@ export class AxmeSidebarProvider implements vscode.WebviewViewProvider {
     const health = this.workspaceRoot ? readHealth(this.workspaceRoot) : { pendingAudits: 0 };
     const contextMode = this.workspaceRoot ? readContextMode(this.workspaceRoot) : "full";
     const indexedEntries = this.workspaceRoot ? indexedCount(this.workspaceRoot) : 0;
+    // setupDone overrides whatever was passed in via initialState. The
+    // initial value was computed at activate time; by the time the
+    // webview first resolves, the user may have flipped state via
+    // Enable semantic search (which creates .axme-code/ without doing
+    // setup) — re-check on disk so the pill reflects truth.
+    const setupDone = this.workspaceRoot ? isAxmeInitialized(this.workspaceRoot) : false;
     this.push({
       ...this.initialState,
       counts,
       backlog,
       health,
       contextMode,
       indexedEntries,
+      setupDone,
       hooksOk: hooksAreInstalled(),
       ...this.pendingState,
     });