refactor(storage): Phase 4.5 — move storage-owned layout inside the boundary

[Yuge Zhang (ultmaster)]

Note

Runs before #92 (Phase 5, SQLite). That branch will need a real rebase
onto this, not a replay — see Effect on #92 below.

Why

§12.2.2 moved paths.ts, canvas-dirs.ts, and naming.ts out of storage/
into modules/workspace/disk/, on the grounds that they serve "non-storage
domains". That reason is inverted: a storage detail with consumers outside
storage/ is describing a leak, not earning a home outside the boundary.

The result was a module named disk — sitting outside the storage boundary —
that held the Disk record layout, the blob layout, an index built by parsing
space.json, and pure string rules, all at once. Six production files outside
storage/ read a storage-owned symbol from it. Fixing that after a second
backend exists would mean migrating the same consumers twice.

The rule this restores: outside storage/, nothing knows how Spaces are
stored. A domain may know a Space is materialized somewhere — that is a
declared capability with real consumers — but not that its record is
space.json, nor that its events are a JSONL file.

The test that decided each move

A symbol belongs outside storage/ only if it is still useful, unchanged,
once the structured backend keeps Spaces in tables. Applied per symbol rather
than per file, it sorts cleanly:

Outcome under a SQLite structured profile	Members	Landed in
Meaningless — the state became a table	SPACE_JSON_FILENAME, canvasJsonPath, nodesDir, nodeFilePath, historyDir, chatDir, changesPath, tasksPath, eventsPath, deltaLogPath, WORLD_CANVAS_DIR_NAME	storage/backends/disk/layout.ts
Still useful — belongs to the other axis	ARTIFACTS_DIR_NAME, artifactsDir, artifactPath	same file (blob half)
Concept survives, body does not	canvasRoot	re-founded as spaceDirectory()
Still useful, untouched	settingDir, userSkillsDir, workspaceMemoryPath	modules/workspace/paths.ts

Two results worth calling out because a looser reading gets them wrong:

• canvas-dirs.ts had zero consumers outside storage/ already. It builds
  its index by reading space.json from every directory — Disk
  structured-backend state that happened to be filed in the workspace module.
  It is also why a SQLite profile would silently fall back to id-named artifact
  directories, since canvasDirName() hits its ?? canvasId fallback when no
  space.json exists.
• space-dir-handles.ts looks substrate-generic but is Disk's. It exists so
  Windows can rename a Space directory; under SQLite there is no such rename.

What changed

• Pure naming rules → utils/naming.ts; workspace/disk/naming.ts deleted
  outright rather than shimmed, since all 15 call sites moved in the same commit.
• Disk record + blob layout, canvas-dirs.ts, name-index.ts,
  space-dir-handles.ts, and world-canvas.ts → storage/backends/disk/.
• modules/workspace/ is now flat — paths.ts and migrations/, no
  substrate segment.
• spaceDirectory() added to the composition root: the Space-level
  counterpart to BlobScope.materialize(), for consumers that genuinely need a
  real directory (ACP working dirs, the external watcher, RFS). Declared, not
  ambient — a profile that does not materialize Spaces refuses here rather than
  handing back a path that does not exist.
• The two Disk capabilities the application still needs — directory-handle
  release and World bootstrap — are re-exported from the facade, so app code
  asks for a capability instead of naming a backend.

Two findings from the consumer sweep

The memory analyzer's chat digest was dead, and is removed. readChatDigest
scanned .history/chat/*.json for a { messages: [] } shape that two
migrations retired — turns moved to .turns.jsonl, then into the Agenetes
Tier-2 store under chat_v2/. The only live .json writer left there is the
change-review sidecar, whose payload is an array with no messages key, so
every file failed the guard. It had returned nothing in any migrated workspace,
and its test pointed chatDir at a directory that does not exist, so nothing
caught it.

Serving it with a SpaceChats port would have handed storage authority over
data it does not own — threads and turns belong to the agent runtime, as
legacy/canvas-store.ts states outright — and obliged every future backend to
model Agenetes' turn log. Whether the memory agent should see turns at all is
filed as a follow-up against agenetes.history(), the call canvas-search
already uses. latestChatTs and its cursor stay: they are the resume point a
reinstated digest would need.

A rejected port design, recorded because the reasoning generalizes. The
first fix for import-node-src.ts added BlobScope.owns(absolutePath).
That was wrong in the same way this phase exists to correct: materialize()
runs port → filesystem, and any backend satisfies it by spooling a temp copy;
owns() ran the other way, handing the port a path only a local backend can
interpret. The false a remote backend would return is not a neutral
implementation but an admission that the question is meaningless there.

Test for the next such proposal: a port method must be answerable by every
backend in the port's own vocabulary. If one backend's honest implementation
is a constant, the method is describing that backend, not the port.

The caller never needed storage. toPhysicalRel already maps the virtual
artifacts/ prefix onto its hidden directory, so "is this ref already an
artifact?" is a question about the ref — answered by isArtifactsRel in
fs-sandbox.ts, which owns that mapping.

Guards

Three new assertions in module-boundaries.test.ts pin the outcome: the
workspace module has no substrate segment, imports no backend, and
names no Disk layout symbol — the last catching a reintroduction even when
the import path looks innocent.

The reach-into-backends/ rule now exempts tests, matching the exemption the
composition-root rule already made and for its stated reason: a production file
naming an adapter has bound the application to a backend; a test naming one is
choosing its subject.

The storage/paths.js shim list shrank by fourteen — most consumers wanted
workspace-owned paths and now say so directly.

Scope

• 69 files, +826 / −437 against main
• Confined to apps/server/src/{modules,prompt,utils} and the storage proposal
• No web, shared-protocol, UI, SQLite, migration/import, Postgres, Azure,
  Agenetes, or RFS-contract changes
• Behavior-preserving: every path resolves to the byte-identical location, and
  no Disk test expectation was altered

Deliberately not done. Four storage-owned reads remain outside the boundary
(nodesDir, SPACE_JSON_FILENAME ×2, chatDir), each recorded in §12.5.1 with
its resolution rather than hidden. world-target-access.ts onto
SpaceRepository.list() is a sync→async signature change with callers, and two
of the others are not storage leaks at all — canvas.route.ts joins the
filename onto an import staging directory (bundle format), and
external-watcher.ts watches a directory tree, which is inherently a
materialization feature.

Effect on #92

Phase 5 needs a rebase, not a replay: it carries its own utils/naming.ts
extraction (now redundant), a workspace/disk/naming.ts shim pointing at a
deleted directory, and import lines in space-title.ts / space-repository.ts
that will conflict. The utils/naming.ts file here is byte-identical to the one
that branch produces, so that half resolves to a no-op.

Validation

Run on b3ec20a3:

• pnpm run check — passed
  • server 952 passed / 2 todo · web 969 passed · shared 361 passed
  • lint, format, typecheck, i18n parity, agent-team skills, license headers clean
• Each of the seven commits was left green independently.