WithinScope compared targets against root+separator, which produced "//" when the scope resolved to "/". No path matched, so every write was rejected with os.ErrPermission (HTTP 403), breaking saves and uploads for root-scoped installs. Skip the appended separator when root already ends in one.