fix: harden resume and SSE replay

backend/test/routes-sessions.test.ts

@@ -185,7 +185,7 @@ test.each(["idle", "failed"])(
     });
     const response = await app.inject({ method: "POST", url: "/sessions/s1/resume" });
     await new Promise((resolve) => setImmediate(resolve));
-    expect(response.json()).toEqual({ id: "s1" });
+    expect(response.json()).toEqual({ id: "s1", alreadyActive: false });
     expect(order).toEqual(["teardown:s1", "clear:s1", "reopen", "create", "start"]);
   },
 );
@@ -223,7 +223,7 @@ test("POST resume without a runtime clears stale SSE state before cold start", a
   const response = await app.inject({ method: "POST", url: "/sessions/crashed/resume" });
   await new Promise((resolve) => setImmediate(resolve));
 
-  expect(response.json()).toEqual({ id: "crashed" });
+  expect(response.json()).toEqual({ id: "crashed", alreadyActive: false });
   expect(order).toEqual(["clear:crashed", "reopen", "create", "start"]);
   expect(createOptions).toMatchObject({
     provider: "local-qwen", model: "qwen3.6-35b-a3b", thinking: "low", mode: "resume",
@@ -359,11 +359,13 @@ test("POST resume on an archived session is refused with 409", async () => {
   expect(res.statusCode).toBe(409);
 });
 
-test("POST /sessions refuses with 503 when ollamaEnsure fails (no session created)", async () => {
+test("POST /sessions readiness failure returns one fixed public message without raw diagnostics", async () => {
   let createdCalled = false;
+  const rawFailure =
+    "connect https://secret.invalid/ready?token=DO_NOT_LEAK using /srv/private/model-key";
   const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
     thtRunner: {
-      ollamaEnsure: async () => ({ ok: false, stage: "model", error: "modello non installato" }),
+      ollamaEnsure: async () => ({ ok: false, stage: "model", error: rawFailure }),
       searchPack: async () => {},
       sessionNew: async () => { createdCalled = true; return { id: "s1" }; },
     } as any,
@@ -372,7 +374,10 @@ test("POST /sessions refuses with 503 when ollamaEnsure fails (no session create
   });
   const res = await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
   expect(res.statusCode).toBe(503);
-  expect(res.json().error).toContain("non installato");
+  expect(res.json()).toEqual({
+    error: "Session services are not ready. Check configuration and connectivity, then try again.",
+  });
+  expect(res.body).not.toMatch(/secret\.invalid|DO_NOT_LEAK|\/srv\/private\/model-key/);
   expect(createdCalled).toBe(false);
 });
 
@@ -403,10 +408,12 @@ test("POST /sessions/:id/resume returns 409 for a read-only session without call
   expect(ensureCalled).toBe(false);
 });
 
-test("POST /sessions/:id/resume refuses with 503 when ollamaEnsure fails", async () => {
+test("POST /sessions/:id/resume readiness failure returns the same fixed public message", async () => {
+  const rawFailure =
+    "stderr https://secret.invalid/resume?api_key=DO_NOT_LEAK /srv/private/resume-key";
   const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
     thtRunner: {
-      ollamaEnsure: async () => ({ ok: false, error: "Ollama down" }),
+      ollamaEnsure: async () => ({ ok: false, error: rawFailure }),
       sessionShow: async () => ({ status: "open", archived: false }),
     } as any,
     getSettings: () => ({ workspace: "psd" }) as any,
@@ -414,6 +421,10 @@ test("POST /sessions/:id/resume refuses with 503 when ollamaEnsure fails", async
   });
   const res = await app.inject({ method: "POST", url: "/sessions/s1/resume" });
   expect(res.statusCode).toBe(503);
+  expect(res.json()).toEqual({
+    error: "Session services are not ready. Check configuration and connectivity, then try again.",
+  });
+  expect(res.body).not.toMatch(/secret\.invalid|DO_NOT_LEAK|\/srv\/private\/resume-key/);
 });
 
 test("POST /runtime/prewarm returns 202 without awaiting readiness", async () => {