Keep managed source paths canonical across outer workbench aliases (#713)

src/capability-language/authoring-converge.ts

@@ -4,6 +4,7 @@ import { execFile as callback } from "node:child_process";
 import { promisify } from "node:util";
 import { randomUUID } from "node:crypto";
 import { authoringContext } from "./authoring-context.js";
+import { managedResourcePath } from "./managed-source-path.js";
 import { snapshotCommit } from "./checked-build.js";
 import { profile } from "./profile.js";
 import {
@@ -85,6 +86,11 @@ export async function convergeAuthoring(start: string, target = "root") {
   const context = await authoringContext(start);
   const graphFile = path.join(context.workbench, ".quixos/resource-graph.json");
   const graphBefore = await readFile(graphFile, "utf8");
+  const graph = JSON.parse(graphBefore);
+  // Discovery resolves outer guest aliases. Persist those same physical
+  // selections, without accepting symlinks within the managed workbench.
+  for (const resource of graph.resources)
+    resource.directory = await managedResourcePath(context.workbench, resource.directory);
   const blockers: AuthoringBlocker[] = [];
   const nodes = new Map<string, { directory: string; kind: string; source: GitSource; dependencies: string[] }>();
   const selected = new Map<string, string>();
@@ -247,9 +253,6 @@ export async function convergeAuthoring(start: string, target = "root") {
   profile("capture-recheck", recheckStarted, { repositories: complete.size });
   // Persist successful selections even if another repository is still broken.
   // Recovery must not depend on all parents succeeding in the same invocation.
-  const graph = JSON.parse(graphBefore);
-  for (const resource of graph.resources)
-    resource.directory = path.relative(context.workbench, path.resolve(context.workbench, resource.directory));
   const replacements = new Map<string, string>();
   for (const resource of graph.resources) {
     const source = complete.get(resource.directory);