fix: wait for workspace policy before creation

frontend/src/shell/SteerInput.test.tsx

@@ -21,10 +21,12 @@ test("new sessions send the browser-selected workspace, model, provider, and thi
   localStorage.setItem("thothii.workspace-registry.v1.preferences", JSON.stringify({
     workspaceId: "psd-clinical", provider: "zai", model: "glm-5.2", thinking: "high",
   }));
-  server.use(http.post("http://localhost:8787/sessions", async ({ request }) => {
-    body = await request.json();
-    return HttpResponse.json({ id: "s1" });
-  }));
+  server.use(
+    http.post("http://localhost:8787/sessions", async ({ request }) => {
+      body = await request.json();
+      return HttpResponse.json({ id: "s1" });
+    }),
+  );
   render(<SteerInput sessionId={null} />);
 
   await userEvent.type(screen.getByRole("textbox", { name: /new question/i }), "q");
@@ -231,6 +233,62 @@ test("switching workspaces replaces an out-of-policy model before session creati
   }));
 });
 
+test("immediate submit waits for a switched workspace policy before creating a session", async () => {
+  let body: unknown;
+  let releasePolicy!: () => void;
+  let policyRequestStarted = false;
+  const policyMayFinish = new Promise<void>((resolve) => { releasePolicy = resolve; });
+  localStorage.setItem("thothii.workspace-registry.v1.preferences", JSON.stringify({
+    workspaceId: "research", provider: "deepseek", model: "deepseek-v4-pro", thinking: "medium",
+  }));
+  const revision = (id: string) => ({
+    id, commit: "a".repeat(40), blob: "b".repeat(40), snapshotPath: "/snapshot", state: "operational" as const,
+  });
+  server.use(
+    http.get("http://localhost:8787/settings", () => HttpResponse.json({ workspace: "research" })),
+    http.get("http://localhost:8787/workspaces", () => HttpResponse.json([
+      { id: "research", name: "research", file: "research.yaml", displayName: "Research", revision: revision("research") },
+      { id: "psd-clinical", name: "psd-clinical", file: "psd-clinical.yaml", displayName: "PSD Clinical", revision: revision("psd-clinical") },
+    ])),
+    http.get("http://localhost:8787/workspaces/research", () => HttpResponse.json({
+      workspace: { llm_policy: { allowed: ["deepseek/deepseek-v4-pro"] } }, revision: revision("research"),
+    })),
+    http.get("http://localhost:8787/workspaces/psd-clinical", async () => {
+      policyRequestStarted = true;
+      await policyMayFinish;
+      return HttpResponse.json({
+        workspace: { llm_policy: { default: "zai/glm-5.2", allowed: ["zai/glm-5.2"] } },
+        revision: revision("psd-clinical"),
+      });
+    }),
+    http.get("http://localhost:8787/models", () => HttpResponse.json({ models: [
+      { provider: "zai", id: "glm-5.2", name: "GLM-5.2", reasoning: true },
+      { provider: "deepseek", id: "deepseek-v4-pro", name: "DeepSeek V4 Pro", reasoning: true },
+    ] })),
+    http.post("http://localhost:8787/sessions", async ({ request }) => {
+      body = await request.json();
+      return HttpResponse.json({ id: "s1" });
+    }),
+  );
+  const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  render(<QueryClientProvider client={client}><ComposerFooter /><SteerInput sessionId={null} /></QueryClientProvider>);
+
+  const workspaceSelector = await screen.findByRole("combobox", { name: "Workspace" });
+  await waitFor(() => expect(workspaceSelector).toHaveTextContent("psd-clinical"));
+  await userEvent.selectOptions(workspaceSelector, "psd-clinical");
+  await waitFor(() => expect(policyRequestStarted).toBe(true));
+  await userEvent.type(screen.getByRole("textbox", { name: /new question/i }), "q");
+  await userEvent.click(screen.getByRole("button", { name: /send/i }));
+
+  expect(body).toBeUndefined();
+  expect(screen.getByRole("button", { name: /send/i })).toBeDisabled();
+  releasePolicy();
+
+  await waitFor(() => expect(body).toEqual({
+    question: "q", workspaceId: "psd-clinical", provider: "zai", model: "glm-5.2", thinking: "medium",
+  }));
+});
+
 test("pulses the stop dot only while the harness is working", () => {
   const { rerender } = render(<SteerInput sessionId="s1" working />);
   const dot = () =>