fix: render registry workspaces for harness

backend/test/routes-sql-meta.test.ts

@@ -85,6 +85,43 @@ test("POST /sessions/:id/sql/preview returns 500 when thtRunner throws", async (
   expect(res.json()).toMatchObject({ error: /boom/ });
 });
 
+test("registry-backed SQL preview resolves and uses the session's pinned runtime revision", async () => {
+  const activePath = `/registry/snapshots/${"a".repeat(40)}/psd-clinical.yaml`;
+  const pinnedPath = `/registry/snapshots/${"b".repeat(40)}/psd-clinical.yaml`;
+  const calls: string[] = [];
+  const runner = {
+    sessionShow: async (_id: string, workspace: string) => {
+      calls.push(`show:${workspace}`);
+      if (workspace === activePath) return {
+        id: "s1", workspace_id: "psd-clinical", workspace_revision: "b".repeat(40),
+      };
+      throw new Error("session not found");
+    },
+    sqlPreview: async (_id: string, _page: unknown, workspace: string) => {
+      calls.push(`preview:${workspace}`);
+      return { columns: [], rows: [], execution_ms: 0, truncated: false };
+    },
+  };
+  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
+    thtRunner: { ...runner, withPrincipal: () => runner } as any,
+    getSettings: () => ({ workspace: "legacy-default" }) as any,
+    workspaceRegistry: {
+      list: async () => [{
+        id: "psd-clinical", commit: "a".repeat(40), blob: "c".repeat(40),
+        snapshotPath: activePath, state: "operational",
+      }],
+      readPinned: async () => ({ workspace: {}, workspaceConfigPath: pinnedPath }),
+    } as any,
+  });
+
+  const response = await app.inject({
+    method: "POST", url: "/sessions/s1/sql/preview", payload: { limit: 10 },
+  });
+
+  expect(response.statusCode).toBe(200);
+  expect(calls).toEqual([`show:${activePath}`, `preview:${pinnedPath}`]);
+});
+
 // Workspace registry route coverage lives in routes-workspaces.test.ts. `/workspaces` no longer
 // reads legacy harness files: the Git registry is the single shared source of truth.