refactor(harness): remove retired server graph composition (SAP-3091) - #910

Primary change type

• Bug fix
• Documentation
• Feature
• Tests
• Dependency update
• Maintenance or refactor

Problem and motivation

The server still instantiated the retired project graph builder, store, providers and watcher lifecycle after supported browser callers had been removed.

Summary and scope

Remove legacy route registration, graph instances/events, active-scope ownership, prerequisites, refresh bookkeeping and teardown. Keep accepted discovery evidence, synchronous pre-connect invalidation, publication freshness fences, shared watcher leases and per-agent Canvas. Add a generic authenticated JSON API 404 before the SPA fallback for all unknown /api paths, including the removed graph endpoints. Reconcile both retirement changesets to this final response contract. This layer disconnects the implementation; the final layer deletes it.

Related work

Related issue or discussion: SAP-3091. Part of the authorized cleanup stack above #892 and #893, targeting main. The seven layers are intended to merge and ship together. Updated layers require maintainer approval before merge.

Validation

Review-fix verification on cumulative source 5bfed981, including current main (8679d745). Server and browser typechecks also passed on each of the seven isolated PR heads.

pnpm --filter '@sapiom/harness...' build — passed
pnpm --filter @sapiom/harness typecheck — passed
pnpm --filter @sapiom/harness lint — passed
pnpm --filter @sapiom/harness exec vitest run --maxWorkers=2 — 3,845 passed, 2 skipped
pnpm --filter @sapiom/harness test:perf — 10 passed
pnpm --filter @sapiom/harness exec playwright test --config <local Chrome override> --workers=2 — 634 passed
pnpm --filter @sapiom/harness exec playwright test --config <Canvas Chrome override> --workers=2 — 15 passed
pnpm terminology:check — passed
pnpm provider-copy:check — passed

The browser override selects the installed Google Chrome, temporary output paths and pnpm exec vite; it preserves the checked-in tests and assertions. All 16 focused map/style/project-tab cases passed, including light/dark computed styles, project/agent viewport restoration, offscreen recovery, automatic fitting, auth isolation and layout recovery. The viewport and metadata regressions failed before their fixes. The new viewport and project-altitude tests also passed on #907's own intermediate tree (10 cases).

An initial three-worker Harness run failed one archive-wiring case; the affected file passed unchanged 8/8, followed by the complete passing two-worker run above. The main integration passed 263 focused cases, and #892's resolved auth mock passed 4/4 on its own tree. No tests or admission guards were weakened.

All PR heads include main's deliberate removal of the duplicate Claude workflow in #886. The reviewed commits remain in history; the stack update uses ordinary fast-forward pushes. Fresh build hashes and the earlier package/smoke evidence are recorded in the retirement record. Signed macOS installer/upgrade validation remains SAP-3086.

Tests and documentation

Retained discovery freshness, rescan, shared watch leases and Studio wiring tests. Both retirement changesets now describe the final authenticated JSON 404; the release note also explains that every unknown /api path uses this fallback.

Compatibility and release impact

• Breaking or externally visible changes: Authenticated calls to all unknown /api paths, including the three retired graph endpoints, return generic JSON API 404. The combined release notes describe this final contract consistently. The boot token remains required. Current durable-map APIs and ordinary sessions are unchanged; clients and servers must ship together.
• Changeset: Added .changeset/quiet-retired-server-graphs.md for a Harness breaking minor, combined with the SAP-3089 minor retirement changeset.

Security

• I have not included secrets, credentials, private data, or unsanitized logs.
• This pull request does not publicly disclose a suspected vulnerability. I will follow the Security Policy for private reporting.

AI assistance

• I did not use AI assistance for this change.
• I used AI assistance and have described it below.

Codex implemented the cleanup and test/doc migrations, traced retained callers, and checked the resulting diffs. Automated checks above and independent read-only review provide implementation evidence; maintainer review is still required.

Checklist

• I read CONTRIBUTING.md, and this contribution follows the direct-PR or issue-first policy.
• This pull request addresses one focused problem and contains no unrelated cleanup.
• I added or updated tests, or explained above why tests are not applicable.
• I ran the relevant build, typecheck, lint, and test commands, or explained any N/A checks above.
• I updated documentation for user-facing changes, or marked it N/A above.
• I added a Changeset for a published-package change, or explained why it is not applicable.
• I can explain and maintain every submitted change, including any AI-assisted work.