[SparkofSpike]

Summary

On Windows, when the Codewhale state directory is reached through a junction —
the standard way to keep %USERPROFILE%\.codewhale on another volume — every
session-artifact write fails with:

Fleet artifact path must stay within the workspace

/compact fails outright, because it persists a pre-compaction checkpoint as
its first step (compact_messages_safe propagates that write's error with ?).
Spillover saving, background-shell evidence, tool-media storage and the
workflow journal degrade on the same path, and the Runtime API cannot read an
artifact back.

Cause

The strict opener in crates/tui/src/fleet/files.rs (Windows) walks every
component of the root path and refuses any reparse point — including the
components of the state root itself. resolve_state_dir("sessions")
returns %USERPROFILE%\.codewhale\sessions in the original spelling; when
.codewhale is a junction, WindowsDirectory::open_inner refuses that very
component and invalid_path() reports the Fleet-artifact message.

v0.10.0 resolved the root first (workspace.canonicalize()), and the Unix
opener still does; the v0.10.1 Windows rewrite dropped that resolution for
every caller. The state root is the application's own directory, not a
caller-supplied workspace: a user who relocates it behind a link is placing
their state, not widening a trust boundary.

Changes

• WorkspaceFile::open_resolved_root (new): resolves the root once
  (canonicalize) and then runs the existing link-refusing walk. It exists for
  the application's own state directory, which the user may have relocated
  behind a link; a caller-supplied workspace root must keep using open. The
  doc comment says so on every platform. On Unix it forwards to open, whose
  confined opener already resolves the root — no second resolve and no new
  blocking-call site.
• crates/tui/src/artifacts.rs: open_session_relative opens through
  open_resolved_root.
• crates/tui/src/runtime_api/: workspace.rs gains
  open_confined_file_resolved, and the two session-artifact read routes
  (resolve_session_artifact, image_evidence_summary) move to it. Without
  this the writer succeeded and the reader still failed on a relocated root:
  the compact checkpoint was written and could not be read back through
  GET /sessions/<id>/artifacts/<artifact_id> or the turn-ref route that
  shares the same resolver. The two remaining open_confined_file callers
  keep the strict opener on purpose — their roots are
  canonical_workspace(thread_workspace) and the caller's workspace, neither
  of which is the application's state directory.
• Nothing below the root is relaxed: the walk still refuses any link inside
  the state directory, and open — used by Fleet workspaces, delivery files,
  the LSP root and the Runtime API workspace reads — is unchanged.
• session_artifact_absolute_path documents what it is: the recorded
  spelling for receipts and display, not a path to open, because it keeps the
  state root as spelled.
• scripts/check-blocking-calls-budget.json: crates/tui/src/fleet/files.rs
  moves from one path_canonicalize site to two, with the reason below. The
  Unix variant adds no site.

Evidence

Reproduced before the fix on 0.10.1 (Windows). A component-by-component probe
of both spellings shows the exact split:

[ok]      C:\Users\<user>
[REPARSE! C:\Users\<user>\.codewhale        <- refused here
[ok]      C:\Users\<user>\.codewhale\sessions
[ok]      D:\CodeWhaleData\sessions          <- same directory, no link on the chain

New Windows regression test
(fleet::files::windows_root_link_tests::linked_state_root_resolves_once_and_keeps_the_inner_rule)
creates a real junction and pins both directions: the strict opener must keep
refusing a linked root, open_resolved_root must write through to the real
target, and a link below the resolved root must still be refused.

Not run here: the repository's own gates. The change is Windows-only in
effect; the pushed branch is the design under review, and CI is the gate.

Blocking-call budget

The file's recorded path_canonicalize budget is raised from one to two. This
is a synchronous, confined file-I/O layer whose callers already accept the
file's blocking work, and the new site sits beside the five std_fs sites the
budget already records. An adversarial review of the change independently
re-verified the count with the checker's own logic: base has one site, the new
method adds one, and the inline test module contributes none.

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Related Issues

No-Issue: observed in an operator session on 0.10.1 (Windows); the state
directory relocated behind a junction makes every session-artifact write fail.

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.