fix(ops): make server diagnostics release-safe

backend/src/operator-command.ts

@@ -16,6 +16,8 @@ import { loadSettings } from "./settings/settings-store.js";
 import { ThtRunner, type SessionRow } from "./tht/tht-runner.js";
 import { WorkspaceRegistry } from "./workspaces/registry.js";
 import { WorkspaceSecretStore } from "./workspaces/secret-store.js";
+import { createCatalogRepository } from "./catalog/repository.js";
+import type { CatalogRepository } from "./catalog/types.js";
 
 type OperatorAction = "maintenance-activate" | "maintenance-deactivate" | "maintenance-status"
   | "session-inventory" | "workflow-doctor" | "workspace-integrity"
@@ -30,7 +32,7 @@ const lifecyclePrincipal: PrincipalContext = {
   isAdmin: true,
 };
 
-function operatorRunner(config: AppConfig): ThtRunner {
+function operatorRunner(config: AppConfig, catalogRepository: CatalogRepository): ThtRunner {
   const workspaceSecretStore = new WorkspaceSecretStore({
     root: config.workspaceSecretStoreRoot,
     runtimeRoot: config.workspaceSecretRuntimeRoot,
@@ -46,6 +48,7 @@ function operatorRunner(config: AppConfig): ThtRunner {
     secretsFile: config.secretsFile,
     secretFiles: config.secretFiles,
     workspaceSecretStore,
+    catalogRepository,
     semanticRuntime: {
       internalQdrantUrl: config.internalQdrantUrl,
       internalEmbeddingUrl: config.internalEmbeddingUrl,
@@ -55,36 +58,50 @@ function operatorRunner(config: AppConfig): ThtRunner {
   }).withPrincipal(lifecyclePrincipal);
 }
 
+async function withOperatorRunner<T>(
+  config: AppConfig,
+  operation: (runner: ThtRunner) => Promise<T>,
+): Promise<T> {
+  const catalogRepository = createCatalogRepository(config.catalogDatabase);
+  try {
+    return await operation(operatorRunner(config, catalogRepository));
+  } finally {
+    await catalogRepository.close?.();
+  }
+}
+
 async function sessionInventory(config: AppConfig): Promise<Array<Pick<SessionRow, "status" | "archived">>> {
   const registry = new WorkspaceRegistry(config.workspaceRegistry);
   const revisions = await registry.listRetainedSnapshots();
-  const runner = operatorRunner(config);
-  const sessions = new Map<string, SessionRow>();
-  for (const revision of revisions) {
-    for (const session of await runner.sessionList(revision.snapshotPath)) sessions.set(session.id, session);
-  }
-  return [...sessions.values()].map(({ status, archived }) => ({ status, archived: archived === true }));
+  return await withOperatorRunner(config, async (runner) => {
+    const sessions = new Map<string, SessionRow>();
+    for (const revision of revisions) {
+      for (const session of await runner.sessionList(revision.snapshotPath)) sessions.set(session.id, session);
+    }
+    return [...sessions.values()].map(({ status, archived }) => ({ status, archived: archived === true }));
+  });
 }
 
 async function workflowDiagnostics(config: AppConfig): Promise<{ ready: true; workspaces: number }> {
   const registry = new WorkspaceRegistry(config.workspaceRegistry);
   const revisions = await registry.listRetainedSnapshots();
   if (revisions.length === 0) throw new Error("workflow diagnostics unavailable");
-  const runner = operatorRunner(config);
-  for (const revision of revisions) {
-    const result = await runner.run(["doctor", "--json"], revision.snapshotPath);
-    let payload: unknown;
-    try {
-      payload = JSON.parse(result.stdout);
-    } catch {
-      throw new Error("workflow diagnostics failed");
+  return await withOperatorRunner(config, async (runner) => {
+    for (const revision of revisions) {
+      const result = await runner.run(["doctor", "--json"], revision.snapshotPath);
+      let payload: unknown;
+      try {
+        payload = JSON.parse(result.stdout);
+      } catch {
+        throw new Error("workflow diagnostics failed");
+      }
+      if (
+        result.code !== 0 || !payload || typeof payload !== "object"
+        || (payload as { ok?: unknown }).ok !== true
+      ) throw new Error("workflow diagnostics failed");
     }
-    if (
-      result.code !== 0 || !payload || typeof payload !== "object"
-      || (payload as { ok?: unknown }).ok !== true
-    ) throw new Error("workflow diagnostics failed");
-  }
-  return { ready: true, workspaces: revisions.length };
+    return { ready: true, workspaces: revisions.length };
+  });
 }
 
 async function workspaceIntegrity(config: AppConfig): Promise<{

backend/test/operator-command.test.ts

@@ -0,0 +1,82 @@
+import { beforeEach, expect, test, vi } from "vitest";
+import type { AppConfig } from "../src/config.js";
+
+const fakes = vi.hoisted(() => ({
+  catalogRepository: { close: vi.fn(async () => {}) },
+  createCatalogRepository: vi.fn(),
+  runnerConfig: undefined as Record<string, unknown> | undefined,
+  run: vi.fn(async () => ({
+    code: 0,
+    stdout: JSON.stringify({ ok: true }),
+    stderr: "",
+  })),
+}));
+
+vi.mock("../src/catalog/repository.js", () => ({
+  createCatalogRepository: fakes.createCatalogRepository,
+}));
+
+vi.mock("../src/tht/tht-runner.js", () => ({
+  ThtRunner: class {
+    constructor(config: Record<string, unknown>) {
+      fakes.runnerConfig = config;
+    }
+
+    run = fakes.run;
+
+    withPrincipal() {
+      return this;
+    }
+  },
+}));
+
+vi.mock("../src/workspaces/registry.js", () => ({
+  WorkspaceRegistry: class {
+    async listRetainedSnapshots() {
+      return [{ snapshotPath: "/data/workspace-registry/snapshots/revision/workspace.yaml" }];
+    }
+  },
+}));
+
+vi.mock("../src/workspaces/secret-store.js", () => ({
+  WorkspaceSecretStore: class {},
+}));
+
+import { runOperatorAction } from "../src/operator-command.js";
+
+const config = {
+  catalogDatabase: { host: "catalog-db" },
+  workspaceSecretStoreRoot: "/data/workspace-secrets",
+  workspaceSecretRuntimeRoot: "/tmp/workspace-secrets",
+  workspaceRegistry: {
+    installationId: "test",
+    root: "/data/workspace-registry",
+    secretRoots: ["/run/secrets"],
+  },
+  thtBin: "/opt/venv/bin/tht",
+  harnessDir: "/app/harness",
+  dataRoot: "/data",
+  internalQdrantUrl: "http://qdrant:6333",
+  internalEmbeddingUrl: "http://embedding:11434",
+  internalEmbeddingModel: "qwen3-embedding:0.6b",
+  internalEmbeddingDimensions: 1024,
+} as AppConfig;
+
+beforeEach(() => {
+  fakes.catalogRepository.close.mockClear();
+  fakes.createCatalogRepository.mockReset();
+  fakes.createCatalogRepository.mockReturnValue(fakes.catalogRepository);
+  fakes.run.mockClear();
+  fakes.runnerConfig = undefined;
+});
+
+test("workflow doctor gives schema-v4 runtime rendering a live Catalog repository", async () => {
+  await expect(runOperatorAction("workflow-doctor", config)).resolves.toEqual({
+    ready: true,
+    workspaces: 1,
+  });
+
+  expect(fakes.createCatalogRepository).toHaveBeenCalledWith(config.catalogDatabase);
+  expect(fakes.runnerConfig?.catalogRepository).toBe(fakes.catalogRepository);
+  expect(fakes.catalogRepository.close).toHaveBeenCalledOnce();
+});