fix: stabilize runtime workspace identity

backend/src/workspaces/runtime-renderer.ts

@@ -129,6 +129,7 @@ export function renderRuntimeConfig(
       runtime_identity: {
         workspace_id: identity.workspaceId,
         workspace_revision: identity.workspaceRevision,
+        source_identity: `workspace://${identity.workspaceId}`,
       },
     } : {}),
     ...(installation.session_storage === undefined

backend/test/workspace-runtime-handoff.test.ts

@@ -1,9 +1,12 @@
 import { execFile } from "node:child_process";
-import { chmodSync, existsSync, mkdtempSync, mkdirSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import {
+  chmodSync, existsSync, mkdtempSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { promisify } from "node:util";
 import { afterEach, expect, test, vi } from "vitest";
+import { parse } from "yaml";
 import { buildApp } from "../src/app.js";
 import { loadConfig } from "../src/config.js";
 import { ThtRunner } from "../src/tht/tht-runner.js";
@@ -142,6 +145,30 @@ test("real schema-v2 registry revision loads through ThtRunner and the harness c
   expect(readdirSync(join(f.registryConfig.root, "snapshots", "runtime"))).toEqual([]);
 });
 
+test("separate runtime leases hand off one stable logical workspace identity", async () => {
+  const f = await fixture();
+  const runner = runnerFor(f);
+  const first = runner.acquireWorkspaceRuntime(f.revision.snapshotPath);
+  const second = runner.acquireWorkspaceRuntime(f.revision.snapshotPath);
+
+  try {
+    expect(first.path).not.toBe(second.path);
+    expect(parse(readFileSync(first.path, "utf8")).runtime_identity).toEqual({
+      workspace_id: "psd-clinical",
+      workspace_revision: f.revision.commit,
+      source_identity: "workspace://psd-clinical",
+    });
+    expect(parse(readFileSync(second.path, "utf8")).runtime_identity).toEqual({
+      workspace_id: "psd-clinical",
+      workspace_revision: f.revision.commit,
+      source_identity: "workspace://psd-clinical",
+    });
+  } finally {
+    first.release();
+    second.release();
+  }
+});
+
 test("local GET sessions mine uses the real canonical handoff and returns an empty inventory", async () => {
   const f = await fixture();
   const app = buildApp(loadConfig({

backend/test/workspace-runtime-renderer.test.ts

@@ -104,10 +104,18 @@ test("runtime support stays fail-closed for either SSH connector", () => {
 });
 
 test("renders a direct PostgreSQL binding to the legacy harness shape", () => {
-  const yaml = renderRuntimeConfig(workspace, directBindings, paths);
+  const yaml = renderRuntimeConfig(workspace, directBindings, paths, {
+    workspaceId: "psd-clinical",
+    workspaceRevision: "a".repeat(40),
+  });
   const rendered = parse(yaml);
 
   expect(rendered).toMatchObject({
+    runtime_identity: {
+      workspace_id: "psd-clinical",
+      workspace_revision: "a".repeat(40),
+      source_identity: "workspace://psd-clinical",
+    },
     language: "it",
     database: {
       host: "dwh.internal",