From a4b6665bd76a23b75fbebee5535a7cc1a420dd9f Mon Sep 17 00:00:00 2001
From: Jarvis <jarvis@mosaicstack.dev>
Date: Sun, 12 Jul 2026 18:48:04 -0500
Subject: [PATCH] test(#707): preserve approval boundary during session GC

---
 .../src/commands/command-executor-tess-security.spec.ts    | 7 +++++--
 apps/gateway/src/gc/session-gc.service.spec.ts             | 7 +++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/apps/gateway/src/commands/command-executor-tess-security.spec.ts b/apps/gateway/src/commands/command-executor-tess-security.spec.ts
index 2fe5550..8356ead 100644
--- a/apps/gateway/src/commands/command-executor-tess-security.spec.ts
+++ b/apps/gateway/src/commands/command-executor-tess-security.spec.ts
@@ -103,7 +103,10 @@ describe('TESS-M1-SEC-001 command authorization abuse cases', () => {
     expect(denied.success).toBe(false);
     expect(denied.message).toContain('approval');
     expect(approval).not.toBeNull();
-    expect(approved.success).toBe(true);
-    expect(sessionGc.sweepOrphans).toHaveBeenCalledOnce();
+    // A valid durable approval is consumed, but cannot authorize an unimplemented
+    // global retention operation. Session-scoped cleanup remains lifecycle-only.
+    expect(approved.success).toBe(false);
+    expect(approved.message).toContain('Global GC is disabled');
+    expect(sessionGc.sweepOrphans).not.toHaveBeenCalled();
   });
 });
diff --git a/apps/gateway/src/gc/session-gc.service.spec.ts b/apps/gateway/src/gc/session-gc.service.spec.ts
index 10da7cb..4a24acc 100644
--- a/apps/gateway/src/gc/session-gc.service.spec.ts
+++ b/apps/gateway/src/gc/session-gc.service.spec.ts
@@ -65,6 +65,13 @@ describe('SessionGCService', () => {
     expect(result.cleaned.valkeyKeys).toBeUndefined();
   });
 
+  it('collect() only scans its session namespace and cannot reach durable approvals', async () => {
+    await service.collect('abc');
+
+    expect(mockRedis.scan).toHaveBeenCalledWith('0', 'MATCH', 'mosaic:session:abc:*', 'COUNT', 100);
+    expect(mockRedis.del).not.toHaveBeenCalledWith(expect.stringContaining('command-approval'));
+  });
+
   it('collect() returns sessionId in result', async () => {
     const result = await service.collect('test-session-id');
     expect(result.sessionId).toBe('test-session-id');