feat: pin sessions to workspace revisions

backend/src/routes/sessions.ts

@@ -207,29 +207,34 @@ export function sessionRoutes(
     let s: Settings;
     try { s = await d.getSettings(principal); } catch { return storageFailure(reply); }
     const runner = runnerFor(principal);
-    let workspaceConfigPath = s.workspace;
+    const requestedWorkspaceId = b.workspaceId ?? s.workspace;
+    if (!requestedWorkspaceId) {
+      return reply.code(409).send({
+        error: WORKSPACE_REVISION_UNAVAILABLE_MESSAGE,
+        code: "workspace_revision_unavailable",
+      });
+    }
+    let workspaceConfigPath: string | undefined;
     let workspaceId: string | undefined;
     let workspaceRevision: string | undefined;
     let allowedModels: readonly string[] | undefined;
-    if (b.workspaceId) {
-      try {
-        const resolved = await d.workspaceRegistry.read(b.workspaceId);
-        if (resolved.revision.state !== "operational") {
-          return reply.code(409).send({
-            error: WORKSPACE_REVISION_UNAVAILABLE_MESSAGE,
-            code: "workspace_revision_unavailable",
-          });
-        }
-        workspaceConfigPath = resolved.revision.snapshotPath;
-        workspaceId = resolved.revision.id;
-        workspaceRevision = resolved.revision.commit;
-        allowedModels = resolved.workspace.llm_policy.allowed;
-      } catch {
+    try {
+      const resolved = await d.workspaceRegistry.read(requestedWorkspaceId);
+      if (resolved.revision.state !== "operational") {
         return reply.code(409).send({
           error: WORKSPACE_REVISION_UNAVAILABLE_MESSAGE,
           code: "workspace_revision_unavailable",
         });
       }
+      workspaceConfigPath = resolved.revision.snapshotPath;
+      workspaceId = resolved.revision.id;
+      workspaceRevision = resolved.revision.commit;
+      allowedModels = resolved.workspace.llm_policy.allowed;
+    } catch {
+      return reply.code(409).send({
+        error: WORKSPACE_REVISION_UNAVAILABLE_MESSAGE,
+        code: "workspace_revision_unavailable",
+      });
     }
     const provider = b.provider ?? s.provider;
     const model = b.model ?? s.model;
@@ -378,6 +383,11 @@ export function sessionRoutes(
       } catch { return storageFailure(reply); }
       if (!manifest) return reply.code(404).send({ error: "session not found" });
       const runner = runnerFor(principal);
+      // Read-only contract FIRST: finalized or archived sessions never attempt compatibility
+      // resolution, even when their historical snapshot was subsequently pruned.
+      if (manifest?.status === "finalized" || manifest?.archived) {
+        return reply.code(409).send({ error: "sessione in sola lettura (finalizzata o archiviata)" });
+      }
       const saved = manifest as {
         provider?: string; model?: string; thinking?: string;
         workspace_id?: string; workspace_revision?: string;
@@ -397,11 +407,6 @@ export function sessionRoutes(
           });
         }
       }
-      // Read-only contract FIRST: a finalized/archived session must refuse resume even
-      // when a lingering runtime still looks active — the manifest is the truth.
-      if (manifest?.status === "finalized" || manifest?.archived) {
-        return reply.code(409).send({ error: "sessione in sola lettura (finalizzata o archiviata)" });
-      }
       // This check belongs inside the per-session lock: a preceding cold Resume may have
       // installed a running runtime while this request was waiting.
       const existing = d.mgr.get(id);

backend/src/routes/settings.ts

@@ -9,7 +9,7 @@ import type { PrincipalContext } from "../auth/principal.js";
 export function effectiveSettings(cfg: AppConfig, stored: Settings): Settings {
   const workspaces = listWorkspaces(cfg.harnessDir);
   return {
-    workspace: workspaces[0]?.name ?? stored.workspace,
+    workspace: stored.workspace ?? workspaces[0]?.name,
     provider: cfg.defaults.provider ?? stored.provider,
     model: cfg.defaults.model ?? stored.model,
     thinking: cfg.defaults.thinking ?? stored.thinking,