test: verify portable workspace registry end to end

backend/src/routes/sessions.ts

@@ -399,6 +399,16 @@ export function sessionRoutes(
         .filter((revision) => revision.state === "operational")
         .map((revision) => runner.sessionList(revision.snapshotPath) as Promise<SessionRow[]>));
       const list = lists.flat();
+      // Only an administrator-visible complete list (or the single local principal) is safe
+      // input for retention. A remote per-user view can never discard another principal's pin.
+      const reconcileSnapshotRetention = (d.workspaceRegistry as Partial<WorkspaceRegistry>).reconcileSnapshotRetention;
+      const hasCompleteRetentionView = (scope === "all" && principal.isAdmin) || principal.issuer === "local";
+      if (hasCompleteRetentionView && typeof reconcileSnapshotRetention === "function") {
+        const retained = [...new Set(list
+          .filter((row) => row.status !== "finalized" && !row.archived && typeof row.workspace_revision === "string")
+          .map((row) => row.workspace_revision!))];
+        await reconcileSnapshotRetention.call(d.workspaceRegistry, retained);
+      }
       // Annotate each row with whether a live Pi runtime is currently bound. The client
       // opens an `active` session straight into its live view (reconnecting to its pending
       // gate), while a cold session keeps its explicit Resume affordance — so a mere click