feat: revision-qualified annotations root for pinned runtimes (P5)

backend/src/workspaces/runtime-config-lease.ts

@@ -240,7 +240,7 @@ function readSnapshotWorkspace(snapshotPath: string): {
   }
 }
 
-function runtimePaths(dataRoot: string, workspaceId: string): RuntimePaths {
+function runtimePaths(dataRoot: string, workspaceId: string, workspaceRevision?: string): RuntimePaths {
   if (!isAbsolute(dataRoot)) throw new Error("registry workspace runtime requires an absolute data root");
   const root = join(dataRoot, "sessions", workspaceId);
   return {
@@ -248,6 +248,9 @@ function runtimePaths(dataRoot: string, workspaceId: string): RuntimePaths {
     artifacts: join(root, "artifacts"),
     indexes: join(root, "indexes"),
     memory: join(root, "memory"),
+    ...(workspaceRevision === undefined
+      ? {}
+      : { annotations_root: join(dataRoot, "sessions", workspaceId, "revisions", workspaceRevision, "artifacts") }),
   };
 }
 
@@ -308,7 +311,7 @@ function renderWorkspaceRuntimeFromWorkspace(options: {
     workspaceId: options.workspaceId,
     workspaceRevision: options.workspaceRevision,
     revisionContentRoot: options.revisionContentRoot,
-    runtimePaths: runtimePaths(options.dataRoot, options.workspaceId),
+    runtimePaths: runtimePaths(options.dataRoot, options.workspaceId, options.workspaceRevision),
     installationOverlay: overlay,
     bindings,
     bindingDigest: stableBindingDigest(bindings),
@@ -316,7 +319,7 @@ function renderWorkspaceRuntimeFromWorkspace(options: {
     renderedConfig: renderRuntimeConfig(
       options.workspace,
       bindings,
-      runtimePaths(options.dataRoot, options.workspaceId),
+      runtimePaths(options.dataRoot, options.workspaceId, options.workspaceRevision),
       context,
       overlay,
       options.semanticRuntime,

backend/src/workspaces/runtime-renderer.ts

@@ -10,6 +10,8 @@ export interface RuntimePaths {
   artifacts: string;
   indexes: string;
   memory: string;
+  /** Revision-qualified root for curated FK annotations (P5); optional for legacy callers. */
+  annotations_root?: string;
 }
 
 export interface RuntimeIdentity {

backend/test/workspace-runtime-config-lease.test.ts

@@ -170,6 +170,27 @@ test("active workspace rendering is byte-identical to direct snapshot rendering"
   expect(active.catalogBlob).toMatch(/^sha256:[0-9a-f]{64}$/);
 });
 
+test("renders a revision-qualified annotations root for the active revision", async () => {
+  const f = await fixture();
+  const active = await renderActiveWorkspaceRuntime({
+    workspaceId: "psd-clinical",
+    registry: f.registry,
+    registryConfig: f.registryConfig,
+    harnessDir: f.harnessDir,
+    configPath: "config/tht.yaml",
+    dataRoot: f.dataRoot,
+    secretRoots: f.registryConfig.secretRoots,
+    semanticRuntime,
+  });
+  const rendered = parse(active.renderedConfig) as Record<string, any>;
+
+  expect(rendered.paths.annotations_root).toBe(
+    join(f.dataRoot, "sessions", "psd-clinical", "revisions", f.revision.commit, "artifacts"),
+  );
+  expect(rendered.roots.annotations_root).toBe(rendered.paths.annotations_root);
+  expect(rendered.paths.artifacts).toBe(join(f.dataRoot, "sessions", "psd-clinical", "artifacts"));
+});
+
 test("deterministic operator leases are keyed by logical identity and stable across calls", async () => {
   const f = await fixture();
   const first = await publishDeterministicRuntimeConfigLease({