feat: reserve one qdrant collection per workspace

backend/src/workspaces/registry.ts

@@ -211,6 +211,9 @@ export class WorkspaceRegistry {
       const state = await this.activeState();
       const revision = state.revisions.find((candidate) => candidate.id === id);
       if (!revision) throw new WorkspaceRegistryError("workspace_invalid", "Workspace is unavailable");
+      if (revision.state !== "operational") {
+        throw new WorkspaceRegistryError("workspace_invalid", "Workspace is unavailable");
+      }
       let workspace: WorkspaceDescriptor;
       try {
         workspace = parseWorkspaceYaml(await readFile(revision.snapshotPath, "utf8"));
@@ -477,6 +480,7 @@ export class WorkspaceRegistry {
       blob: string;
       state: WorkspaceRevision["state"];
     }> = [];
+    const collectionOwners = new Map<string, string>();
     try {
       for (const path of files) {
         const id = path.slice("workspaces/".length, -".yaml".length);
@@ -490,6 +494,12 @@ export class WorkspaceRegistry {
           ? "operational"
           : "migration_required";
         if (isCanonicalWorkspace(workspace)) {
+          const collection = workspace.semantic_index.vector_store.collection;
+          const owner = collectionOwners.get(collection);
+          if (owner !== undefined) {
+            throw new Error(`duplicate qdrant collection ownership: ${collection} (${owner}, ${id})`);
+          }
+          collectionOwners.set(collection, id);
           buildInstallationContract(workspace);
           renderWorkspaceDocs(workspace);
           snapshotSource = serializeWorkspaceYaml(workspace);