fix: fence runtime detail route state

web/workspace/tests/runtime-management-source.test.ts

@@ -110,6 +110,16 @@ Deno.test("Runtime detail keeps trust controls owner-only and conflict-safe", as
       "Revoke Workspace trust",
       "Workspace trust only; this does not delete the Runtime process, Workers, or Workdirs.",
       "RuntimeTrustConflictError",
+      "RuntimeTrustRouteFence",
+      "routeFence.enter(data.runtimeId)",
+      "showPublicKey = false",
+      "revealedPublicKey = null",
+      "publicKey = ''",
+      "fingerprintConfirmation = ''",
+      "revokeFingerprintConfirmation = ''",
+      "requestError = null",
+      "successMessage = null",
+      "isCurrentRoute(operation)",
       "revealRuntimeTrustKey",
       "revokeFingerprintConfirmation.trim() !== trust.fingerprint",
       "await reloadAuthority()",

web/workspace/tests/runtime-management.test.ts

@@ -11,6 +11,7 @@ import {
   putRuntimeTrustKey,
   revokeRuntimeTrustKey,
   RuntimeTrustConflictError,
+  RuntimeTrustRouteFence,
 } from "../src/lib/workspace/api/runtime-management.ts";
 
 function assert(condition: unknown, message: string): asserts condition {
@@ -207,6 +208,27 @@ Deno.test("mismatched revoke fingerprint never sends a request", async () => {
   assert(requests === 0, "mismatched fingerprint sent a revoke request");
 });
 
+Deno.test("Runtime route fence rejects a delayed reveal from the prior Runtime", async () => {
+  const fence = new RuntimeTrustRouteFence();
+  fence.enter("runtime-a");
+  const operation = fence.capture("runtime-a");
+  let renderedKey: string | null = null;
+  let resolveReveal!: (key: string) => void;
+  const delayedReveal = new Promise<string>((resolve) => {
+    resolveReveal = resolve;
+  }).then((key) => {
+    if (fence.isCurrent(operation, "runtime-b")) renderedKey = key;
+  });
+
+  fence.enter("runtime-b");
+  resolveReveal("runtime-a-public-key");
+  await delayedReveal;
+  assert(
+    renderedKey === null,
+    "Runtime A key rendered after navigating to Runtime B",
+  );
+});
+
 Deno.test("Runtime public key preview matches the Server fingerprint contract", async () => {
   const fingerprint = await previewRuntimePublicKeyFingerprint(
     "yoi-ed25519-pub:v1:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",