fix: close internal semantic review gaps

backend/src/routes/workspaces.ts

@@ -19,6 +19,7 @@ import {
   parseWorkspaceYaml,
   serializeWorkspaceYaml,
   validateCanonicalWorkspace,
+  validateOperationalWorkspace,
   type CanonicalWorkspace,
   type WorkspaceDescriptor,
 } from "../workspaces/schema.js";
@@ -327,9 +328,22 @@ export function workspaceRoutes(app: FastifyInstance, deps: WorkspaceRoutesDeps)
   app.post("/workspaces/:id/test", async (request, reply) => {
     try {
       const { id } = z.object({ id: workspaceId }).parse(request.params);
-      const { workspace } = await deps.registry.read(id);
-      const bindings = resolveRuntimeBindings(workspace, process.env, deps.config.secretRoots);
-      return await deps.diagnose(workspace, bindings, { writeProbe: false });
+      const { workspace, revision } = await deps.registry.read(id);
+      if (revision.state !== "operational") {
+        throw new WorkspaceRegistryError(
+          "workspace_not_activatable", "Workspace requires explicit migration",
+        );
+      }
+      let operational: CanonicalWorkspace;
+      try {
+        operational = validateOperationalWorkspace(workspace);
+      } catch {
+        throw new WorkspaceRegistryError(
+          "workspace_not_activatable", "Workspace requires explicit migration",
+        );
+      }
+      const bindings = resolveRuntimeBindings(operational, process.env, deps.config.secretRoots);
+      return await deps.diagnose(operational, bindings, { writeProbe: false });
     } catch (error) {
       return errorReply(reply, error);
     }