fix(1478): graph_load reports the workflow identity it loaded into

[artokun]

Refs comfyui-mcp#1478 (defect 1). Draft. The earlier hold reasoning was wrong on a point of fact; this describes what is now established and what still is not.

What is implemented

graph_load's reply carries workflow_uuid — the field the orchestrator's own docblock asks for, as #762/#800 did for workflow_new / workflow_save — on both of its return paths, so refreshFenceFromOwnReply can consume a value instead of the orchestrator appending a conditional note it cannot substantiate.

The identity is read through one shared gate (loadLandedWorkflowUuid): it names a workflow only when the live one is the very object that load targeted — object identity, captured before the load, immune to a tab switch during the await. Shape-gated to a canonical instance uuid (#716). When nothing is provable (a blank-canvas load mints an object this code holds no reference to), the field is omitted and the orchestrator keeps its existing fallback. The read is the last thing before each reply, so nothing can run between the check and the value it blesses.

What this round corrected

The field was on the wrong branch. graph_load has two returns. The identity landed only on the UI-format tail, but the reporter's call returned {loaded:true, format:"api", node_count:59} — the API-format branch, which returns early and never reached the new code. The previous body claimed the opposite: that the field lets the orchestrator "stop emitting a false-alarm note on every API load". It published nothing there.

The mechanism was backwards. The earlier investigation measured afterIsSameObject: true on an API load and concluded the instance identity never moves. Object sameness is not identity sameness, and the panel's own creation-boundary wrapper is precisely what separates them:

• loadApiJson reaches the wrapper without __cmcpKeepInstance, so the KEEP branch is unreachable and shouldForkInPlaceReload({cachedUuid, incomingUuid}) decides.
• API/prompt JSON carries no extra, so incomingUuid is undefined, which differs from the fenced cachedUuid.
• The wrapper therefore deletes the object's cached uuid and mints a fresh one onto the same object.

The workflow object is preserved while its identity moves. That is why the mismatch was deterministic, and why "the object did not change" was never evidence the fence survived — the fence keys on the uuid, not the object.

The in-place UI path is the contrast that proves it: it passes __cmcpKeepInstance, so the instance is deliberately preserved (#570 P0b) and the reported uuid simply matches the fence. On that path the field is proof that nothing moved.

A race the branch's own test caught. The API reply needs readPackImportFailures, so placing the identity read at the natural spot — right after loadApiJson — left a live await between the check and the reply: the comparison passes for A, the event loop lets the user switch to B, and the reply, already blessed, ships A's uuid for what is now B's canvas. The read now happens last on both paths. That test was adapted to the refactor rather than dropped, and now covers both return paths where before it could only see one.

What IS established

• The fork mechanism above, from the code, and pinned behaviourally against the real shouldForkInPlaceReload predicate rather than asserted in prose — a fenced workflow plus API JSON carrying no embedded uuid re-mints; the same uuid arriving back does not.
• The field is safe on every path: additive, fail-closed, and never published unless the pre-load object is still live.

What this does NOT establish

• No live reproduction. The chain is read from source, not observed on a running rig. The one unverified link is that ComfyUI's loadApiJson dispatches through the panel-patched app.loadGraphData (it calls this.loadGraphData, so it should) rather than a captured reference. Confirming that on a live ComfyUI is what would turn "explains the report" into "reproduces it".
• This alone does not close #1478 defect 1. The field is inert until the orchestrator side consumes it for graph_load — that is a change in the other repo. The panel half is what is here.
• Defect 2 is untouched. The read-only panel_get_errors refusal under the dirty-mutation guard is a separate fix.

So #1478 stays open, but the reason is now "the other half is not written", not "we cannot explain it".

Verification

npm run test:unit: 4409 tests, 4408 pass, 0 fail, 1 todo (the todo is pre-existing). The check-panel-scope gate runs first and passes.

8 mutations, applied against a checked-GREEN committed baseline, all 8 killed:

#	Mutation	Result
1	drop workflow_uuid from the API-format reply	killed
2	drop workflow_uuid from the UI-format reply	killed
3	capture the API target after loadApiJson instead of before	killed
4	drop the object-identity gate (publish whatever is active now)	killed
5	drop the shape gate (publish a non-canonical value)	killed
6	rethrow from the guard instead of omitting the field	killed
7	neuter shouldForkInPlaceReload so an API load does not re-mint	killed
8	move the API read back before the import-failure await	killed

Mutation 7 is the one that matters most: it recreates the world the earlier investigation believed it was in, and the root-cause test goes red.

Two neighbouring tests were unpinned from fixed character windows

Both asserted real wiring through a fixed-width slice of the API branch (2200 and 900 characters), and both failed because a comment was added inside that branch — not because the wiring changed. The 900-char one had roughly forty characters of headroom left on main. Both now bound on the end of the branch, so they measure code rather than the length of the prose around it.

One unrelated pre-existing flake

#671 verifyInstalled … when the queue never drains is a wall-clock budget test in the ComfyUI-Manager area. It passes in isolation and on a clean main checkout, and fails only when the full suite runs it under load. Untouched by this branch.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.