apps/gateway/src/commands/command-executor-tess-security.spec.ts

@@ -103,7 +103,10 @@ describe('TESS-M1-SEC-001 command authorization abuse cases', () => {
     expect(denied.success).toBe(false);
     expect(denied.message).toContain('approval');
     expect(approval).not.toBeNull();
-    expect(approved.success).toBe(true);
-    expect(sessionGc.sweepOrphans).toHaveBeenCalledOnce();
+    // A valid durable approval is consumed, but cannot authorize an unimplemented
+    // global retention operation. Session-scoped cleanup remains lifecycle-only.
+    expect(approved.success).toBe(false);
+    expect(approved.message).toContain('Global GC is disabled');
+    expect(sessionGc.sweepOrphans).not.toHaveBeenCalled();
   });
 });

apps/gateway/src/gc/session-gc.service.spec.ts

@@ -65,6 +65,13 @@ describe('SessionGCService', () => {
     expect(result.cleaned.valkeyKeys).toBeUndefined();
   });
 
+  it('collect() only scans its session namespace and cannot reach durable approvals', async () => {
+    await service.collect('abc');
+
+    expect(mockRedis.scan).toHaveBeenCalledWith('0', 'MATCH', 'mosaic:session:abc:*', 'COUNT', 100);
+    expect(mockRedis.del).not.toHaveBeenCalledWith(expect.stringContaining('command-approval'));
+  });
+
   it('collect() returns sessionId in result', async () => {
     const result = await service.collect('test-session-id');
     expect(result.sessionId).toBe('test-session-id');