fix: harden workspace activation and snapshot retention

backend/src/workspaces/diagnostics.ts

@@ -535,7 +535,9 @@ function diagnosticError(code: WorkspaceErrorCode, field?: string): Diagnostic {
       ? "Installation binding is missing or invalid."
       : code === "semantic_index_incompatible"
         ? "Semantic index metadata is incompatible with this workspace."
-        : "Connector diagnostic failed.",
+        : code === "workspace_not_activatable"
+          ? "This transport can be tested, but it is not available to runtime sessions."
+          : "Connector diagnostic failed.",
   };
 }
 
@@ -851,6 +853,16 @@ export function createWorkspaceDiagnoser(
       }
     }
 
+    // The concrete SSH adapter deliberately owns only a bounded diagnostic tunnel and closes it
+    // in `finally`. Until a session runtime owns an equivalent long-lived tunnel, a successful
+    // probe is connectivity evidence only and must never be advertised as activatable.
+    if (
+      (bindings.dwh.transport === "ssh_tunnel" || bindings.vector.transport === "ssh_tunnel")
+      && !diagnostics.some((diagnostic) => diagnostic.level === "error")
+    ) {
+      diagnostics.push(diagnosticError("workspace_not_activatable"));
+    }
+
     return {
       activatable: !diagnostics.some((diagnostic) => diagnostic.level === "error"),
       diagnostics,