chore: обновить паузу занятия от main

# Conflicts:
#	backend/app/scoring/dispatcher.py
#	backend/app/session/store.py

backend/app/api/auth.py

@@ -51,6 +51,8 @@ _INSTANCE = hashlib.sha256(
 ).hexdigest()
 _generations: dict[str, int] = {}
 _active_sockets: dict[str, weakref.WeakKeyDictionary] = {}
+# Logins already revoked because their users row disappeared.
+_vanished: set[str] = set()
 AUTH_GENERATION_SYNC_SECONDS = 1.0
 AUTH_GENERATION_MAX_AGE_SECONDS = 2.0
 _generations_synced_at: float | None = None
@@ -121,10 +123,13 @@ async def sync_generations() -> None:
     # The local-only dev-token principal is synthetic, never stored in users;
     # a DB watcher must not revoke its in-memory generation during test/demo
     # flows that deliberately exercise account invalidation.
+    # The revoked generation stays cached: dropping it would make the next
+    # lookup fall back to 0 and re-accept cookies issued before the revocation.
     synthetic = {"dev"} if get_settings().dev_auth_bypass else set()
-    for login in _generations.keys() - current.keys() - synthetic:
+    _vanished.intersection_update(_generations.keys() - current.keys())
+    for login in _generations.keys() - current.keys() - synthetic - _vanished:
         invalidate_login(login)
-        _generations.pop(login, None)
+        _vanished.add(login)
     global _generations_synced_at
     _generations_synced_at = time.monotonic()
 

backend/app/api/http/ekp.py

@@ -48,3 +48,14 @@ async def signs(prefix: list[str] = Query(default=[]), group: int | None = None)
             else None
         ),
     }
+
+
+@router.get("/services")
+async def services() -> dict:
+    """Каталог служб для ручного добавления в карточку — как окно «Добавьте службы».
+
+    Каталог — справочник боевого АРМ, а не содержимое вызова: отдавать его
+    курсанту так же безопасно, как группы происшествий.
+    """
+    data = ekp.catalog()
+    return {"source": data.source, "services": [item.model_dump() for item in data.services]}

backend/app/api/http/sessions.py

@@ -23,14 +23,26 @@ from app.db import repo
 from app.db.base import get_session
 from app.db.models import Group, Score, Session, Trainee
 from app.domain.events import Exercise, SessionMode, SessionReport
+from app.domain.taxonomy import (
+    ERRORS,
+    ErrorCode,
+    Finding,
+    FindingDecision,
+    FindingReview,
+    FindingSource,
+)
 from app.domain.roles import Role
 from app.domain.statuses import SERVICE_STATUS_LABELS, DdsQueueCard, StationSnapshot, current
 from app.domain.timers import TimerCode, TimerState
 from app.scoring.export import to_csv, to_pdf
 from app.scoring.report import build as build_report
+from app.scoring.review import has_finding
+from app.scoring.taxonomy import METRIC_MAP
 from app.session.access import can_access
 from app.session.checkpoint import load_state
-from app.session.finish import override_score
+from app.session.finish import change_findings, override_score
+from app.session.store import FindingAdded, FindingReviewed
+from app.session.timers import now_utc
 from app.session.score import scoring_scenario
 from app.session.hub import hub
 from app.session.state import SessionState
@@ -656,6 +668,157 @@ async def override(
     return SessionReport.model_validate(report["full_report"])
 
 
+def _required_text(value: str) -> str:
+    cleaned = value.strip()
+    if not cleaned:
+        raise ValueError("поле обязательно")
+    return cleaned
+
+
+class FindingReviewIn(BaseModel):
+    """Решение по отметке: причина обязательна и остаётся в разборе."""
+
+    decision: FindingDecision
+    reason: str = Field(min_length=1, max_length=1000)
+
+    _reason = field_validator("reason")(_required_text)
+
+
+class FindingIn(BaseModel):
+    """Отметка преподавателя: код, факт и норма — то же обоснование, что у автоматической."""
+
+    code: ErrorCode
+    fact: str = Field(min_length=1, max_length=1000)
+    norm: str = Field(min_length=1, max_length=1000)
+    #: Номер карточки очереди ДДС (с 1); без него отметка относится к занятию.
+    card: int | None = Field(default=None, ge=1)
+    #: Ключ идемпотентности с клиента: повтор запроса не добавит отметку второй раз.
+    client_id: UUID | None = None
+
+    _fact = field_validator("fact")(_required_text)
+    _norm = field_validator("norm")(_required_text)
+
+
+async def _change_findings(
+    session_id: UUID, who, db: AsyncSession | None, make,
+) -> SessionReport:
+    """Общий путь решений по отметкам — тот же, что у правки итога.
+
+    `make(who, score)` строит запись изменения по сохранённой оценке или
+    отвечает HTTP-ошибкой. Роль проверяет маршрут: администратору сюда нельзя,
+    как и к правке балла.
+    """
+    state = hub.get(session_id)
+    if state is not None:
+        _require_access(who, state)
+        if state.score is None:
+            raise HTTPException(status_code=409, detail="score_not_ready")
+        scenario = scoring_scenario(state)
+        if scenario is None:
+            raise HTTPException(status_code=409, detail="scenario_not_found")
+        change = make(who, state.score)
+        async with hub.operation(session_id):
+            if not _repeated(state.score, change):
+                change_findings(state, change)
+        return build_report(session_id, state, scenario)
+
+    if db is None:
+        raise HTTPException(status_code=404, detail="session_not_found")
+    session = await repo.get_session(db, session_id)
+    if session is None:
+        raise HTTPException(status_code=404, detail="session_not_found")
+    _require_access(who, session)
+    score = await db.scalar(select(Score).where(Score.session_id == session_id))
+    if score is None:
+        raise HTTPException(status_code=409, detail="score_not_ready")
+    if (score.report or {}).get("full_report") is None:
+        raise HTTPException(status_code=409, detail="report_not_archived")
+    current = dict(score.report)
+    change = make(who, current)
+    await db.rollback()  # чтение закончено; запись — одной транзакцией хранилища
+    if not _repeated(current, change):
+        await hub.store.commit_archived(session_id, [change])
+    # Ответ — по строке после commit: пересчёт шёл под блокировкой и мог учесть
+    # решение из соседней вкладки, которого не было в прочитанном выше отчёте.
+    score = await db.scalar(
+        select(Score).where(Score.session_id == session_id)
+        .execution_options(populate_existing=True)
+    )
+    report = SessionReport.model_validate(score.report["full_report"])
+    await db.rollback()
+    return report
+
+
+def _repeated(report: dict, change: FindingReviewed | FindingAdded) -> bool:
+    return isinstance(change, FindingAdded) and has_finding(report, change.finding.client_id)
+
+
+@router.post("/{session_id}/findings/{index}/review", response_model=SessionReport)
+async def review_finding(
+    session_id: UUID,
+    index: int,
+    body: FindingReviewIn,
+    request: Request,
+    db: AsyncSession | None = Depends(optional_session),
+) -> SessionReport:
+    """Подтвердить или снять отметку; снятая не штрафует свою метрику."""
+    who = require(request, Role.INSTRUCTOR)
+
+    def make(who, score: dict) -> FindingReviewed:
+        if not 0 <= index < len(score.get("findings", [])):
+            raise HTTPException(status_code=404, detail="finding_not_found")
+        return FindingReviewed(index=index, role=who.role.value, review=FindingReview(
+            decision=body.decision, reason=body.reason, author=who.login, at=now_utc(),
+        ))
+
+    return await _change_findings(session_id, who, db, make)
+
+
+@router.post("/{session_id}/findings", response_model=SessionReport)
+async def add_finding(
+    session_id: UUID,
+    body: FindingIn,
+    request: Request,
+    db: AsyncSession | None = Depends(optional_session),
+) -> SessionReport:
+    """Отметка преподавателя штрафует связанную метрику по той же методике."""
+    who = require(request, Role.INSTRUCTOR)
+
+    def make(who, score: dict) -> FindingAdded:
+        service = None
+        prefix = ""
+        exercise = (score.get("full_report") or {}).get("exercise")
+        # E1–E6 в связке 112 → ДДС — ошибки приёма вызова: их метрики у занятия,
+        # а не у карточки очереди. С номером карточки отметка не нашла бы свою
+        # метрику 112 и штрафовала бы отдельной метрикой преподавателя.
+        if (body.card is not None and body.code.value.startswith("E")
+                and exercise != Exercise.DDS.value):
+            raise HTTPException(status_code=422, detail="call_code_without_card")
+        if body.card is not None:
+            cards = score.get("card_results") or []
+            if body.card > len(cards):
+                raise HTTPException(status_code=422, detail="card_not_found")
+            service = cards[body.card - 1].get("managed_service")
+            prefix = f"Карточка {body.card}: " + (f"{service}: " if service else "")
+        competency = next((item for code, item in METRIC_MAP.values() if code is body.code), None)
+        return FindingAdded(role=who.role.value, finding=Finding(
+            code=body.code,
+            source=FindingSource.INSTRUCTOR,
+            summary=f"{prefix}{ERRORS[body.code].title}",
+            fact=body.fact,
+            norm=body.norm,
+            ref="отметка преподавателя на разборе",
+            competency=competency,
+            at=now_utc(),
+            card=body.card,
+            service=service,
+            author=who.login,
+            client_id=body.client_id,
+        ))
+
+    return await _change_findings(session_id, who, db, make)
+
+
 @router.get("", response_model=list[SessionOut])
 async def listing(
     request: Request,

backend/app/api/ws/control.py

@@ -112,6 +112,7 @@ def _build_state(session_id: UUID, event, who, scenario, scenarios,
         dds_service=identity.service or event.dds_service,
         attempt=identity.attempt,
         criteria=event.criteria,
+        socket_last_seen_at=now_utc(),
     )
     state.timers.limits[TimerCode.DDS_ACK] = event.criteria.decision_time_limit_seconds * 1000
     state.timers.limits[TimerCode.CARD_FILL] = event.criteria.card_fill_time_limit_seconds * 1000

backend/app/api/ws/station.py

@@ -17,7 +17,7 @@ from uuid import UUID
 from fastapi import APIRouter, WebSocket, WebSocketDisconnect
 from pydantic import TypeAdapter, ValidationError
 
-from app.api.ws.session import pump, run_command, session_socket
+from app.api.ws.session import close_fenced, pump, run_command, session_socket
 from app.domain.events import (
     CallEndReason,
     ErrorEvent,
@@ -62,9 +62,14 @@ async def station(ws: WebSocket, session_id: UUID, role: str = "dds") -> None:
     entered = await session_socket(ws, session_id, (Role.INSTRUCTOR, Role.TRAINEE))
     if entered is None:
         return
-    _who, state = entered
+    who, state = entered
 
-    with hub.station(session_id) as queue:
+    async with hub.trainee_socket(
+        session_id, station=True, trainee=who.role is Role.TRAINEE,
+    ) as queue:
+        if hub.is_lease_fenced(session_id):
+            await close_fenced(ws)
+            return
         sender = asyncio.create_task(pump(ws, queue))
         try:
             # Карточка, переданная до подключения станции, не теряется: