Make the workspace registry guard actually fail startup fast

WorkspaceHostedService.StartAsync now resolves IWorkspaceRegistry itself,
outside any try/catch, before scheduling any heal work. Previously the
registry's constructor guard against an unprovided channel capability was
only ever triggered lazily from inside broad catches (the startup heal
and each event-loop consumer), so a host composing AddWorkspace() without
the module owning a capability would start cleanly and only fault quietly
on the first reconcile, contradicting the guard's own comment.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: HandyS11

src/RustPlusBot.Features.Workspace/Hosting/WorkspaceHostedService.cs

@@ -4,6 +4,7 @@
 using Microsoft.Extensions.Logging;
 using RustPlusBot.Abstractions.Events;
 using RustPlusBot.Features.Workspace.Reconciler;
+using RustPlusBot.Features.Workspace.Registry;
 using RustPlusBot.Persistence.Workspace;
 
 namespace RustPlusBot.Features.Workspace.Hosting;
@@ -32,6 +33,17 @@ internal sealed class WorkspaceHostedService(
     /// <inheritdoc />
     public Task StartAsync(CancellationToken cancellationToken)
     {
+        // Force the workspace registry's construction now, synchronously, before any heal work is
+        // queued. Its constructor throws when a channel spec names a capability with no registered
+        // provider. Every other place below resolves it lazily inside a broad catch, so a misconfigured
+        // host would otherwise start cleanly and only fault quietly on the first reconcile. Resolving it
+        // here, outside any try or catch, lets that exception propagate out of this method so the host
+        // genuinely fails to start instead.
+        using (var scope = scopeFactory.CreateScope())
+        {
+            scope.ServiceProvider.GetRequiredService<IWorkspaceRegistry>();
+        }
+
         client.Ready += OnReadyAsync;
         client.ChannelDestroyed += OnChannelDestroyedAsync;
         _serverRegisteredLoop = Task.Run(() => ConsumeServerRegisteredAsync(_cts.Token), CancellationToken.None);

tests/RustPlusBot.Features.Workspace.Tests/Hosting/WorkspaceConnectionStatusTests.cs

@@ -5,6 +5,7 @@
 using RustPlusBot.Abstractions.Events;
 using RustPlusBot.Features.Workspace.Hosting;
 using RustPlusBot.Features.Workspace.Reconciler;
+using RustPlusBot.Features.Workspace.Registry;
 
 namespace RustPlusBot.Features.Workspace.Tests.Hosting;
 
@@ -16,6 +17,9 @@ public async Task ConnectionStatusChanged_ReconcilesThatServer()
         var reconciler = Substitute.For<IWorkspaceReconciler>();
         var services = new ServiceCollection();
         services.AddScoped(_ => reconciler);
+        // StartAsync now resolves IWorkspaceRegistry up front (see the startup guard test); this
+        // minimal container needs a stand-in so that resolution succeeds.
+        services.AddSingleton(Substitute.For<IWorkspaceRegistry>());
         await using var provider = services.BuildServiceProvider();
 
         var bus = new InMemoryEventBus();
@@ -48,6 +52,9 @@ public async Task ServerCredentialsChanged_ReconcilesThatServer()
         var reconciler = Substitute.For<IWorkspaceReconciler>();
         var services = new ServiceCollection();
         services.AddScoped(_ => reconciler);
+        // StartAsync now resolves IWorkspaceRegistry up front (see the startup guard test); this
+        // minimal container needs a stand-in so that resolution succeeds.
+        services.AddSingleton(Substitute.For<IWorkspaceRegistry>());
         await using var provider = services.BuildServiceProvider();
 
         var bus = new InMemoryEventBus();

tests/RustPlusBot.Features.Workspace.Tests/Hosting/WorkspaceHostedServiceStartupGuardTests.cs

@@ -0,0 +1,46 @@
+using Discord.WebSocket;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+using NSubstitute;
+using RustPlusBot.Abstractions.Connections;
+using RustPlusBot.Abstractions.Events;
+using RustPlusBot.Abstractions.Time;
+using RustPlusBot.Features.Workspace.Hosting;
+using RustPlusBot.Persistence;
+
+namespace RustPlusBot.Features.Workspace.Tests.Hosting;
+
+public sealed class WorkspaceHostedServiceStartupGuardTests
+{
+    [Fact]
+    public async Task StartAsync_throws_when_a_gated_capability_has_no_provider()
+    {
+        // Mirrors a host that composes AddWorkspace() without the module (e.g. AddClans()) that owns
+        // the "clan" capability. WorkspaceRegistry's constructor guards against this because the
+        // reconciler would otherwise treat the gated channels as unavailable and delete them; this test
+        // proves the host now fails fast at StartAsync instead of starting and faulting quietly later.
+        var services = new ServiceCollection();
+        services.AddSingleton<IClock, SystemClock>();
+        services.AddSingleton<IEventBus, InMemoryEventBus>();
+        services.AddSingleton(Substitute.For<IRustServerQuery>());
+        services.AddLogging();
+        services.AddBotPersistence("DataSource=:memory:");
+        services.AddWorkspace();
+        // Deliberately no IWorkspaceCapabilityProvider registered for "clan".
+
+        await using var provider = services.BuildServiceProvider(new ServiceProviderOptions
+        {
+            ValidateScopes = true
+        });
+
+        var client = new DiscordSocketClient();
+        var hostedService = new WorkspaceHostedService(
+            client,
+            provider.GetRequiredService<IEventBus>(),
+            provider.GetRequiredService<IServiceScopeFactory>(),
+            NullLogger<WorkspaceHostedService>.Instance);
+
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(() => hostedService.StartAsync(default));
+        Assert.Contains("clan", ex.Message, StringComparison.OrdinalIgnoreCase);
+    }
+}