fix: gate workspace diagnostic migration

backend/test/workspaces-bindings.test.ts

@@ -6,7 +6,7 @@ import { resolveBinding } from "../src/workspaces/bindings.js";
 import { parseWorkspaceYaml } from "../src/workspaces/schema.js";
 
 const workspace = parseWorkspaceYaml(`workspace:
-  schema_version: 1
+  schema_version: 2
   id: psd-clinical
   name: Policlinico San Donato
   language: it
@@ -121,3 +121,20 @@ test("rejects a selected transport that the canonical workspace does not support
     missing: ["THT_WS_PSD_CLINICAL_DWH_TRANSPORT"],
   });
 });
+
+test("never treats a vector reader credential as the optional writer binding", () => {
+  const readerKey = secretPath("vector-reader-key");
+  const writerWorkspace = {
+    ...workspace,
+    semantic_index: { ...workspace.semantic_index, vector_writer: {} },
+  };
+  const resolveWriter = () => resolveBinding(writerWorkspace, "VECTOR_WRITER" as never, {
+    THT_WS_PSD_CLINICAL_VECTOR_API_KEY_FILE: readerKey.path,
+  }, [readerKey.root]);
+
+  expect(resolveWriter).not.toThrow();
+  expect(resolveWriter()).toMatchObject({
+    missing: ["THT_WS_PSD_CLINICAL_VECTOR_WRITER_API_KEY_FILE"],
+    values: {},
+  });
+});