fix: close internal semantic review gaps

backend/test/workspace-runtime-handoff.test.ts

@@ -42,6 +42,18 @@ llm_policy:
   allowed: [zai/glm-5.2]
 `;
 
+const migrationRequiredWorkspace = canonicalWorkspace
+  .replace("schema_version: 3", "schema_version: 2")
+  .replace(
+    "    engine: qdrant\n    collection: psd-clinical",
+    "    engine: pgvector\n    database: analytics\n    schema: vectors\n    collection: documents",
+  )
+  .replace("    dimensions: 1024", "    dimensions: 768")
+  .replace("    distance: cosine", "    distance: cosine\n    supported_transports: [rest_api]")
+  .replace("    provider: ollama_internal", "    provider: ollama_compatible")
+  .replace("    model: qwen3-embedding:0.6b", "    model: nomic-embed-text")
+  .replace("    dimensions: 1024", "    dimensions: 768");
+
 afterEach(() => {
   vi.unstubAllEnvs();
   roots.splice(0).forEach((root) => rmSync(root, { recursive: true, force: true }));
@@ -51,7 +63,7 @@ async function git(cwd: string, args: string[]): Promise<string> {
   return (await runFile("git", args, { cwd })).stdout.trim();
 }
 
-async function fixture() {
+async function fixture(workspaceSource = canonicalWorkspace) {
   const root = mkdtempSync(join(tmpdir(), "tht-runtime-handoff-"));
   roots.push(root);
   const remote = join(root, "remote.git");
@@ -65,7 +77,7 @@ async function fixture() {
   await git(source, ["config", "user.name", "Runtime Handoff Test"]);
   await git(source, ["config", "user.email", "runtime-handoff@example.invalid"]);
   mkdirSync(join(source, "workspaces"));
-  writeFileSync(join(source, "workspaces", "psd-clinical.yaml"), canonicalWorkspace);
+  writeFileSync(join(source, "workspaces", "psd-clinical.yaml"), workspaceSource);
   await git(source, ["add", "workspaces/psd-clinical.yaml"]);
   await git(source, ["commit", "-m", "Canonical workspace"]);
   await git(source, ["remote", "add", "origin", remote]);
@@ -160,6 +172,15 @@ test("separate runtime leases hand off one stable logical workspace identity", a
   }
 });
 
+test("ThtRunner refuses to render a migration-required registry snapshot", async () => {
+  const f = await fixture(migrationRequiredWorkspace);
+  const runner = runnerFor(f);
+
+  expect(() => runner.acquireWorkspaceRuntime(f.revision.snapshotPath)).toThrow(
+    "Workspace descriptor requires explicit migration to schema version 3",
+  );
+});
+
 test("local GET sessions mine uses the real canonical handoff and returns an empty inventory", async () => {
   const f = await fixture();
   const app = buildApp(loadConfig({