fix(auth): validate stopped workspace restore

backend/test/workspace-registry.test.ts

@@ -338,6 +338,41 @@ function persistedState(root: string, commit: string): { active: any; manifest:
   };
 }
 
+test("verifies a never-initialized registry without contacting its remote", async () => {
+  const root = mkdtempSync(join(tmpdir(), "thoth-workspace-registry-uninitialized-"));
+  temporaryRoots.push(root);
+  const registryRoot = join(root, "registry");
+  const registry = new WorkspaceRegistry(config(
+    registryRoot,
+    join(root, "missing-remote.git"),
+  ));
+
+  await expect(registry.verifyStoredState()).resolves.toEqual({
+    state: "uninitialized",
+    workspaces: 0,
+  });
+  expect(existsSync(join(registryRoot, "repo"))).toBe(false);
+  expect(readdirSync(join(registryRoot, "state"))).toEqual([]);
+});
+
+test("verifies initialized snapshots and rejects partial or malformed persisted state", async () => {
+  const remote = await fixture();
+  const registryRoot = join(remote.root, "registry");
+  const registry = new WorkspaceRegistry(config(registryRoot, remote.remote));
+  await registry.bootstrap();
+
+  await expect(registry.verifyStoredState()).resolves.toEqual({
+    state: "active",
+    workspaces: 1,
+  });
+
+  rmSync(join(registryRoot, "state", "active.json"));
+  await expect(registry.verifyStoredState()).rejects.toMatchObject({ code: "workspace_invalid" });
+
+  writeFileSync(join(registryRoot, "state", "active.json"), "{malformed");
+  await expect(registry.verifyStoredState()).rejects.toMatchObject({ code: "workspace_invalid" });
+});
+
 test("rejects a catalog entry without a descriptor instead of creating a bootstrap slot", async () => {
   const remote = await contentOnlyFixture();
   const registry = new WorkspaceRegistry(config(join(remote.root, "registry"), remote.remote));