fix(evidence): validate ownership before all searches

harness/tht/search/evidence.py

@@ -1,5 +1,7 @@
 """Runtime Evidence lookup bound to the atomically active corpus generation."""
 
+import re
+
 from tht.corpus.store import CorpusStore
 
 
@@ -21,12 +23,27 @@ class ActiveEvidenceSearcher:
         }
         include_evidence = "evidence" in requested
         other_kinds = sorted(requested - {"evidence"})
-        if not include_evidence:
-            kwargs = {"top_n": top_n, "kinds": kinds}
-            if metadata_filter is not None:
-                kwargs["metadata_filter"] = metadata_filter
-            return self.delegate.search(embedding, **kwargs)
         with self.corpus.writer_lock():
+            manifest = self.corpus.active_manifest()
+            persisted_workspace = manifest.metadata.get("workspace_id") if manifest else None
+            if manifest is not None and (
+                not isinstance(persisted_workspace, str)
+                or re.fullmatch(r"[a-z][a-z0-9_-]{0,63}", persisted_workspace) is None
+            ):
+                raise CorpusWorkspaceMismatchError(
+                    "corpus workspace ownership is missing or invalid; use a new corpus root or rebuild"
+                )
+            if manifest is not None and self.expected_workspace_id is not None and (
+                persisted_workspace != self.expected_workspace_id
+            ):
+                raise CorpusWorkspaceMismatchError(
+                    "corpus belongs to a different workspace; use a new corpus root or rebuild"
+                )
+            if not include_evidence:
+                kwargs = {"top_n": top_n, "kinds": kinds}
+                if metadata_filter is not None:
+                    kwargs["metadata_filter"] = metadata_filter
+                return self.delegate.search(embedding, **kwargs)
             hits = []
             if other_kinds:
                 kwargs = {"top_n": top_n, "kinds": other_kinds}
@@ -34,14 +51,7 @@ class ActiveEvidenceSearcher:
                     kwargs["metadata_filter"] = metadata_filter
                 hits.extend(self.delegate.search(embedding, **kwargs))
             if include_evidence:
-                manifest = self.corpus.active_manifest()
                 workspace_id = manifest.metadata.get("workspace_id") if manifest else None
-                if manifest is not None and self.expected_workspace_id is not None and (
-                    workspace_id != self.expected_workspace_id
-                ):
-                    raise CorpusWorkspaceMismatchError(
-                        "corpus belongs to a different workspace; use a new corpus root or rebuild"
-                    )
                 if manifest is not None and isinstance(workspace_id, str):
                     by_generation: dict[str, list[str]] = {}
                     mapping = dict(manifest.metadata.get("document_generations", {}))