fix: close internal semantic review gaps

backend/src/routes/sessions.ts

@@ -8,7 +8,7 @@ import type { PrincipalContext } from "../auth/principal.js";
 import type { ReadinessManager } from "../runtime/readiness-manager.js";
 import type { ListModelsFn } from "./meta.js";
 import type { WorkspaceRegistry } from "../workspaces/registry.js";
-import type { WorkspaceDescriptor } from "../workspaces/schema.js";
+import { validateOperationalWorkspace, type WorkspaceDescriptor } from "../workspaces/schema.js";
 import type { MaintenanceBarrier } from "../runtime/maintenance-gate.js";
 
 const BOOTSTRAP_FAILURE_MESSAGE =
@@ -108,7 +108,11 @@ export function sessionRoutes(
   const isNotFound = (error: unknown) =>
     /not found|non trovata|inesistente|404/i.test(error instanceof Error ? error.message : String(error));
 
-  type LocatedSession = { manifest: any; workspaceConfigPath: string };
+  type LocatedSession = {
+    manifest: any;
+    workspaceConfigPath: string;
+    workspace?: WorkspaceDescriptor;
+  };
 
   const workspaceRevisionUnavailable = () => Object.assign(
     new Error("workspace revision unavailable"), { code: "workspace_revision_unavailable" },
@@ -168,7 +172,12 @@ export function sessionRoutes(
     if (!saved.workspace_id || !saved.workspace_revision) return located;
     try {
       const pinned = await d.workspaceRegistry.readPinned(saved.workspace_id, saved.workspace_revision);
-      return { ...located, workspaceConfigPath: pinned.workspaceConfigPath ?? (pinned as any).revision?.snapshotPath };
+      const workspace = validateOperationalWorkspace(pinned.workspace);
+      return {
+        ...located,
+        workspace,
+        workspaceConfigPath: pinned.workspaceConfigPath ?? (pinned as any).revision?.snapshotPath,
+      };
     } catch {
       throw workspaceRevisionUnavailable();
     }
@@ -319,6 +328,7 @@ export function sessionRoutes(
       let workspaceConfigPath: string | undefined;
       let workspaceId: string | undefined;
       let workspaceRevision: string | undefined;
+      let workspaceDescriptor: WorkspaceDescriptor | undefined;
       let allowedModels: readonly string[] | undefined;
       if (requestedWorkspaceId) {
         try {
@@ -344,6 +354,7 @@ export function sessionRoutes(
           workspaceConfigPath = resolved.revision.snapshotPath;
           workspaceId = resolved.revision.id;
           workspaceRevision = resolved.revision.commit;
+          workspaceDescriptor = resolved.workspace;
           allowedModels = resolved.workspace.llm_policy.allowed;
         } catch {
           return reply.code(409).send({
@@ -362,8 +373,13 @@ export function sessionRoutes(
       // runtime owned by this principal, while runtimes belonging to other users remain intact.
       // Optional chaining preserves the deliberately narrow manager stubs used by route tests.
       for (const id of d.mgr.teardownForPrincipal?.(principal) ?? []) boundRuntimes.delete(id);
-      const ensure = await d.readiness.ensure(workspaceConfigPath ?? "", principal);
-      if (!ensure.ok) return reply.code(503).send({ error: READINESS_FAILURE_MESSAGE });
+      const ensure = await d.readiness.ensure(
+        workspaceConfigPath ?? "", principal, workspaceDescriptor,
+      );
+      if (!ensure.ok) return reply.code(503).send({
+        error: READINESS_FAILURE_MESSAGE,
+        ...(ensure.code ? { code: ensure.code } : {}),
+      });
       // Local-only: verify the DWH is reachable BEFORE creating the session, so a dropped
       // VPN surfaces as an up-front alert instead of a session that spawns Pi and then dies
       // in bootstrap retrieval. `code` lets the client show a specific message.
@@ -546,7 +562,12 @@ export function sessionRoutes(
         workspace_id?: string; workspace_revision?: string;
       };
       let workspaceConfigPath: string;
-      try { workspaceConfigPath = (await resolveSessionWorkspace(located)).workspaceConfigPath; }
+      let workspaceDescriptor: WorkspaceDescriptor | undefined;
+      try {
+        const resolved = await resolveSessionWorkspace(located);
+        workspaceConfigPath = resolved.workspaceConfigPath;
+        workspaceDescriptor = resolved.workspace;
+      }
       catch { return unavailableWorkspaceReply(reply); }
       try { settings = await d.getSettings(principal); } catch { return storageFailure(reply); }
       // This check belongs inside the per-session lock: a preceding cold Resume may have
@@ -558,8 +579,13 @@ export function sessionRoutes(
           return reply.code(200).send({ id, alreadyActive: true });
         }
       }
-      const ensure = await d.readiness.ensure(workspaceConfigPath ?? "", principal);
-      if (!ensure.ok) return reply.code(503).send({ error: READINESS_FAILURE_MESSAGE });
+      const ensure = await d.readiness.ensure(
+        workspaceConfigPath ?? "", principal, workspaceDescriptor,
+      );
+      if (!ensure.ok) return reply.code(503).send({
+        error: READINESS_FAILURE_MESSAGE,
+        ...(ensure.code ? { code: ensure.code } : {}),
+      });
       const options = {
         provider: saved?.provider,
         model: saved?.model,