Review — PR #819 (round 1)

1. Studio-derived workspace scopes are published with keys the graph resolver cannot resolve

packages/harness/src/server/index.ts:2495-2512

listWorkspaceScopesAndRetain now returns studioProjectCatalog.reconcile(studioWorkspaceScopeCatalog.list()) merged with the legacy list. Two things downstream still key off the legacy catalog only:

• createSystemGraphRouter({ scopeResolver: workspaceScopeCatalog }) (index.ts:3116) resolves workspaceKey from recentDirs ∪ session cwds. Any root the new derivation contributes that is not in that set has no resolvable key → 404 "Workspace not found" (server/system-graph.ts:48).
• retained (index.ts:2497) is built from scopes, the legacy list, before the merge. Studio-only roots are therefore never leased by systemGraphWatcher/systemGraphStore, and activeSystemGraphScopes deletes them on every refresh (index.ts:2500-2503).

The new roots are not an edge case — they are the headline of this PR:

• a live session at /proj/sub whose durable binding is /proj, where /proj is not in recentDirs (the closure maps it to the root at index.ts:1252-1266);
• retainedProjectSessionRoots, which exists specifically to re-add roots evicted from recentDirs (index.ts:1296-1310);
• promoted parents from holdingProjectFor, which are by construction neither a recentDir nor a session cwd.

Before this change the input to reconcile was the same list retain/resolve used, so every published key resolved. Fix is one source of truth: either point scopeResolver/retained at studioWorkspaceScopeCatalog, or compute retained from the merged result.

2. Tightened root uniqueness bricks an existing Windows catalog — no migration

packages/harness/src/core/studio-project-catalog.ts:204, 252-266

Root-binding uniqueness moved from byte-exact localRootRef to pathComparisonKey, which lowercases Windows drive/UNC paths. canonicalGraphPath is path.resolve-based and does not case-fold, so a catalog written by 0.14.x on Windows can legitimately hold C:\Work\Proj and c:\work\proj as two bindings. Under this diff those collapse to one key, parseCatalog throws malformed_state, and load() (:357-388) has no quarantine or repair path — it rethrows on every call, forever. The whole Agent Map catalog goes permanently unavailable and the user silently falls back to the legacy rail (index.ts:2513 catch). Tightening a persisted invariant needs a load-time dedupe/merge, not a hard reject.

3. No changeset for behavior changes in a published package

@sapiom/harness is on npm; CONTRIBUTING.md:195 requires a changeset when a change "affects a published package's behavior". This one does, regardless of stack staging — path comparison becomes case-insensitive for Windows drive/UNC paths for every consumer of these helpers, and the workspace-scope list the SPA renders is composed differently. The PR base is main, so merging ships those changes with no CHANGELOG line. A patch changeset naming the Windows case-folding is the minimum; the "N/A because the stack is unmerged" rationale does not hold while the base is main.

4. The new server wiring has no test

The 121 new lines in server/index.ts — the projectSessionRoot mapping, the pinnedRoots handoff, the retainedProjectSessionRoots fallback, the merge in listWorkspaceScopesAndRetain — carry no new test. src/server/studio-workspace-wiring.test.ts, the only server suite the PR body cites, is unchanged and predates this PR (added in #766). The 231-line project-roots.test.ts covers the pure module well; the finding in §1 lives entirely in the untested half. A wiring test that starts the server with a session cwd below a durable root not present in recentDirs, then fetches the published workspaceKey, would catch it.

5. Internal prose now ships in the npm tarball

packages/harness/src/shared/project-roots.ts:242-246, 254-256

These comment blocks moved from web/src/lib/project-tree.ts — where Vite strips them — into src/, which tsc emits with comments preserved (removeComments is unset in tsconfig.json, and files ships dist). So dist/shared/project-roots.js now publishes, verbatim and unretractably, a description of a captured internal dogfood install (org-dogfood.json in the design prototype: 75 agents, 8 recentDirs, 41 distinct session cwds) and "Three agents were on screen twice this way on one real machine." No company is named, so this is not a leak of the first order, but it is internal operating detail addressed to an anonymous npm consumer. Reword to the generic shape ("a large real install: ~75 agents across 41 session cwds") and drop the fixture filename. Bare SAP-#### refs are an existing repo norm (57 in src/) and are not in scope here.

Verdict: Request changes — §1 is a live correctness regression in the path this PR exists to unify, and §2 has no recovery once it fires.

Review — PR #819 (round 2, follow-up)

Delta reviewed: 4cbb298b..34177a98 (1 commit, 6 files).

New finding

1. The scope merge is keyed by resolve(), not the comparison key this PR introduces — one root can still publish twice

packages/harness/src/server/index.ts:2500-2502

byRoot keys both sides on resolve(scope.cwd), a raw lexical resolve. Every other join in this PR keys on pathComparisonKey(canonicalGraphPath(...)), and LocalWorkspaceScopeCatalog derives workspaceKey from canonicalGraphPath — which calls realpathSync.native, so it resolves symlinks and, on Windows/macOS, on-disk casing.

So when the durable binding's localRootRef (stored canonical) and the recentDirs spelling differ only by a symlink hop or by case — /tmp/x vs /private/tmp/x, c:\work\proj vs C:\Work\Proj — the two entries hash to different byRoot keys and both survive the merge, while workspaceKeyForRoot gives them the same workspaceKey. state.workspaceScopes then carries two rows for one project, one with projectId and one without, and the SPA renders two sidebar groups: the exact duplicate-identity failure the PR description says it removes. Key the map with pathComparisonKey(canonicalGraphPath(scope.cwd)).

Earlier findings

All five are addressed:

• §1 — retained is now computed after the merge and scopeResolver resolves from the same published list. Resolved.
• §2 — parseCatalog reverts the byte-exact invariant and collapses case aliases in-place, persisted under the write lock; cross-project ambiguity now falls through to unassignedScopes instead of throwing malformed_state. Resolved; the trade-off (an ambiguous root stays without a projectId until a user merges the projects) is documented in the code.
• §3 — .changeset/durable-project-root-compatibility.md, patch, names the Windows case-folding. Resolved.
• §4 — studio-workspace-wiring.test.ts now covers the descendant-session-after-eviction path end to end, including the retain sets and a 200 from the graph route. Resolved.
• §5 — the dogfood install figures and fixture filename are gone from shared/project-roots.ts. Resolved.

Nothing the earlier round got wrong.

Verdict: Request changes — one line, finding 1.