fix(auth): validate stopped workspace restore

backend/src/operator-command.ts

@@ -18,7 +18,8 @@ import { WorkspaceRegistry } from "./workspaces/registry.js";
 import { WorkspaceSecretStore } from "./workspaces/secret-store.js";
 
 type OperatorAction = "maintenance-activate" | "maintenance-deactivate" | "maintenance-status"
-  | "session-inventory" | "workflow-doctor" | "pi-options" | "pi-test" | "effective-settings";
+  | "session-inventory" | "workflow-doctor" | "workspace-integrity"
+  | "pi-options" | "pi-test" | "effective-settings";
 
 const lifecyclePrincipal: PrincipalContext = {
   issuer: "tht-operator-command",
@@ -86,6 +87,15 @@ async function workflowDiagnostics(config: AppConfig): Promise<{ ready: true; wo
   return { ready: true, workspaces: revisions.length };
 }
 
+async function workspaceIntegrity(config: AppConfig): Promise<{
+  ready: true;
+  state: "uninitialized" | "active";
+  workspaces: number;
+}> {
+  const integrity = await new WorkspaceRegistry(config.workspaceRegistry).verifyStoredState();
+  return { ready: true, ...integrity };
+}
+
 export async function runOperatorAction(
   action: OperatorAction,
   config: AppConfig,
@@ -98,6 +108,7 @@ export async function runOperatorAction(
   }
   if (action === "session-inventory") return await sessionInventory(config);
   if (action === "workflow-doctor") return await workflowDiagnostics(config);
+  if (action === "workspace-integrity") return await workspaceIntegrity(config);
   if (action === "effective-settings") return effectiveSettings(config, loadSettings(config));
   const service = createPiManagement(config, { listModels: createPiModelLister(config) });
   if (action === "pi-options") return await service.options();
@@ -109,7 +120,7 @@ async function main(): Promise<void> {
   const action = process.argv[2] as OperatorAction | undefined;
   if (!action || ![
     "maintenance-activate", "maintenance-deactivate", "maintenance-status", "session-inventory",
-    "workflow-doctor", "pi-options", "pi-test", "effective-settings",
+    "workflow-doctor", "workspace-integrity", "pi-options", "pi-test", "effective-settings",
   ].includes(action)) throw new Error("invalid operator action");
   const result = await runOperatorAction(action, loadConfig(process.env));
   process.stdout.write(`${JSON.stringify(result)}\n`);