Complete training workflow and acceptance hardening

backend/app/api/ws/call.py

@@ -7,38 +7,46 @@
 import asyncio
 import json
 import logging
-from uuid import UUID
+import re
+from types import SimpleNamespace
+from uuid import UUID, uuid4
 
 from fastapi import APIRouter, WebSocket, WebSocketDisconnect
 from pydantic import TypeAdapter, ValidationError
 
+from app.api.auth import principal_of, websocket_origin_allowed
 from app.domain.events import (
-    StationState,
-    CallIncoming,
+    BgStart,
     CallEnded,
     CallEndReason,
+    CallIncoming,
     CallStarted,
+    CallerUtterance,
     ErrorEvent,
     ErrorKind,
     Exercise,
     HintShown,
-    KioState,
     KioPatchOut,
+    KioState,
     PatchSource,
     ScoreReady,
     SessionEnded,
     SessionMode,
+    StationState,
     TimerTick,
+    TextTurnAccepted,
+    Speaker,
+    TranscriptAppend,
     TraineeToServer,
 )
-from app.domain.events import BgStart
-from app.scenarios import store
-from app.session.finish import finish, refresh_archived_report, release_score
-from app.api.auth import principal_of
-from app.domain.roles import Role
-from app.session.hub import hub
-from app.session.state import now_utc
 from app.domain.kio import ResponseStatus
+from app.dialog.slots import TurnResult
+from app.domain.roles import Role
+from app.scenarios import store
+from app.session.dds import prepare_handoff_queue
+from app.session.finish import finish, refresh_archived_report, release_score
+from app.session.hub import LEASE_FENCED_MESSAGE, hub
+from app.session.state import now_utc
 from app.voice.models import TTS_RATE, get_voice_models
 from app.voice.pipeline import VoiceSession
 from app.voice.recording import start_recording
@@ -53,6 +61,89 @@ FRAMES_PER_LOG = 250  # раз в пять секунд звука
 _adapter = TypeAdapter(TraineeToServer)
 
 
+class _TextSlotView:
+    """Grounded facts for the text exercise when the optional embedder is absent."""
+    def __init__(self, state):
+        self.scenario = state.scenario
+        self.state = state
+
+    def revealed_facts(self):
+        return [SimpleNamespace(id=fact.id, value=self.state.text_revealed_facts[fact.id])
+                for fact in self.scenario.facts if fact.id in self.state.text_revealed_facts]
+
+
+def _text_turn(state, text: str):
+    """Match typed questions to approved checklist prompts; never let the model
+    decide which hidden scenario fact becomes available."""
+    turn = None
+    if state.slots is not None:
+        turn = state.slots.hear(text)
+        for fact in state.slots.revealed_facts():
+            state.text_revealed_facts[fact.id] = fact.value
+        if turn.refined:
+            return turn
+
+    # The lexical offline matcher misses natural follow-ups such as “а точнее,
+    # ближайший дом?”. Once the caller has disclosed a fact with a refinement,
+    # allow an explicit request for precision to reveal only that refined value.
+    # This remains a deterministic slot rule: the model never chooses the fact.
+    normalized = text.casefold().replace("ё", "е")
+    asks_for_precision = bool(re.search(
+        r"\b(точн\w*|конкретн\w*|ближ\w*|номер\w*|уточн\w*)\b", normalized
+    ))
+    if asks_for_precision:
+        for fact in state.scenario.facts:
+            if (fact.id in state.text_revealed_facts and fact.refine_on and fact.refined):
+                state.text_revealed_facts[fact.id] = fact.refined
+                if state.slots is not None:
+                    if fact.id not in state.slots.refined:
+                        state.slots.refined.append(fact.id)
+                    if fact.id not in state.slots.revealed:
+                        state.slots.revealed.append(fact.id)
+                    if fact.refine_on not in state.slots.asked:
+                        state.slots.asked.append(fact.refine_on)
+                return TurnResult(text=text, matched=[fact.refine_on], refined=[fact.id])
+
+    if turn is not None and turn.matched:
+        return turn
+
+    words = set(re.findall(r"[а-яё]{3,}", text.casefold().replace("ё", "е")))
+    stop = {"что", "как", "где", "когда", "сколько", "есть", "это", "или", "вас", "вам", "пожалуйста"}
+    words -= stop
+    best = None
+    best_score = 0.0
+    for item in state.scenario.checklist:
+        if not item.question:
+            continue
+        for phrase in [item.question, *item.examples]:
+            prompt_words = set(re.findall(r"[а-яё]{3,}", phrase.casefold().replace("ё", "е"))) - stop
+            score = len(words & prompt_words) / max(1, len(prompt_words))
+            if score > best_score:
+                best, best_score = item, score
+    turn = TurnResult(text=text)
+    if best is None or best_score < 0.25:
+        return turn
+    turn.matched.append(best.id)
+    fact_ids = [fact.id for fact in state.scenario.facts
+                if fact.reveal_on and fact.reveal_on.question == best.id]
+    if best.fact and best.fact not in fact_ids:
+        fact_ids.append(best.fact)
+    for fact in state.scenario.facts:
+        if fact.refine_on == best.id and fact.refined:
+            state.text_revealed_facts[fact.id] = fact.refined
+            turn.refined.append(fact.id)
+    for fact_id in fact_ids:
+        fact = next((item for item in state.scenario.facts if item.id == fact_id), None)
+        if fact is None:
+            continue
+        if fact_id in state.text_revealed_facts:
+            turn.repeated.append(fact_id)
+        else:
+            state.text_revealed_facts[fact_id] = fact.value
+            turn.revealed.append(fact_id)
+    return turn
+
+
 def _on_audio(session_id: UUID, state, frame: bytes) -> None:
     """Приём аудиокадра: в голосовой контур, а без него — только счёт."""
     if len(frame) != FRAME_BYTES:
@@ -96,8 +187,8 @@ async def _handle(session_id: UUID, state, event) -> None:
             code=ErrorKind.UNSUPPORTED_EVENT, message="Занятие уже завершено",
         ))
         return
-    if state.exercise is Exercise.DDS or (
-        state.exercise is Exercise.CARD and event.type not in {"kio.patch", "card.submit"}
+    if (event.type == "text.turn" and state.exercise is not Exercise.CARD) or state.exercise is Exercise.DDS or (
+        state.exercise is Exercise.CARD and event.type not in {"kio.patch", "card.submit", "text.turn"}
     ) or (state.exercise is Exercise.CALL and event.type == "card.submit"):
         hub.to_trainee(session_id, ErrorEvent(
             code=ErrorKind.UNSUPPORTED_EVENT, message="Действие недоступно в этом упражнении",
@@ -110,13 +201,53 @@ async def _handle(session_id: UUID, state, event) -> None:
         ))
         return
     match event.type:
+        case "text.turn":
+            if state.caller is None or state.persona is None or state.scenario is None:
+                hub.to_trainee(session_id, ErrorEvent(
+                    code=ErrorKind.MODELS_WARMING_UP,
+                    message="Текстовый диалог пока не готов. Обновите занятие или заполните карточку по вводной.",
+                ))
+                return
+            turn = _text_turn(state, event.text)
+            operator_entry = state.append(Speaker.OPERATOR, event.text)
+            accepted = TextTurnAccepted(text=event.text, at=operator_entry.at)
+            hub.to_trainee(session_id, accepted)
+            hub.to_observers(session_id, TranscriptAppend(entry=operator_entry))
+            if hub.journal:
+                await hub.journal.utterance(session_id, operator_entry)
+            try:
+                slots = state.slots if state.slots is not None else _TextSlotView(state)
+                line = await state.caller.reply(turn, state.persona, slots)
+            except Exception as exc:  # noqa: BLE001
+                # The model/provider exception can contain the prompt and incident facts.
+                log.error("text dialogue failed for session %s (%s)",
+                          session_id, type(exc).__name__)
+                hub.to_trainee(session_id, ErrorEvent(
+                    code=ErrorKind.INTERNAL, message="Не удалось получить ответ заявителя. Попробуйте ещё раз.",
+                ))
+                return
+            caller_entry = state.append(Speaker.CALLER, line.text, line.mood)
+            hub.to_trainee(session_id, CallerUtterance(
+                utterance_id=uuid4(), text=line.text,
+                at=caller_entry.at, mood=line.mood, source=line.source,
+            ))
+            hub.to_observers(session_id, TranscriptAppend(entry=caller_entry))
+            if hub.journal:
+                await hub.journal.utterance(session_id, caller_entry)
         case "card.submit":
+            state.on_event("card.submit")
             state.kio.registered_at = state.started_at or now_utc()
             state.kio.response_status = ResponseStatus.TRANSFERRED
             state.dispatched_card = state.kio.model_copy(deep=True)
             state.dispatched_at = now_utc()
             if state.handoff_to_dds:
-                state.on_event("dds.dispatch")
+                prepare_handoff_queue(
+                    state,
+                    state.pending_dds_scenarios,
+                    arrival_interval_seconds=state.dds_arrival_interval_seconds,
+                    max_waiting=state.dds_max_waiting,
+                )
+                state.pending_dds_scenarios = []
             else:
                 state.ended_at = state.dispatched_at
                 state.end_reason = CallEndReason.COMPLETE
@@ -135,15 +266,17 @@ async def _handle(session_id: UUID, state, event) -> None:
                     )
                 await finish(session_id, state)
         case "call.answer":
-            state.on_event("call.answer")
-            state.started_at = now_utc()
+            first_answer = state.started_at is None
+            if first_answer:
+                state.on_event("call.answer")
+                state.started_at = now_utc()
+                if hub.journal:
+                    await hub.journal.session_started(session_id, state.started_at)
             hub.to_trainee(session_id, CallStarted(started_at=state.started_at))
             hub.to_observers(session_id, state.snapshot())
-            if hub.journal:
-                await hub.journal.session_started(session_id, state.started_at)
             if state.recorder is None:
                 state.recorder = start_recording(session_id)
-            _start_voice(session_id, state)
+            _start_voice(session_id, state, initial_statement=first_answer)
 
         case "kio.patch":
             old_code, old_notify = state.kio.incident_code, list(state.kio.notify)
@@ -219,12 +352,16 @@ async def _handle(session_id: UUID, state, event) -> None:
             state.on_event("callback.dial")
 
         case "self_assessment.submit":
+            if hub.journal and not await hub.journal.self_assessment(
+                session_id, event.missed, event.comment, now_utc()
+            ):
+                hub.to_trainee(session_id, ErrorEvent(
+                    code=ErrorKind.INTERNAL,
+                    message="Не удалось сохранить самооценку и аудит; итог пока не выдан.",
+                ))
+                return
             state.self_assessed = True
             state.self_assessment = {"missed": event.missed, "comment": event.comment}
-            if hub.journal:
-                await hub.journal.self_assessment(
-                    session_id, event.missed, event.comment, now_utc()
-                )
             await refresh_archived_report(session_id, state)
             # Оценка могла быть готова раньше самооценки — теперь её можно отдать.
             await release_score(session_id, state)
@@ -246,7 +383,7 @@ async def _handle(session_id: UUID, state, event) -> None:
     await hub.checkpoint(session_id)
 
 
-def _start_voice(session_id: UUID, state) -> None:
+def _start_voice(session_id: UUID, state, *, initial_statement: bool = True) -> None:
     """Голос включается, когда курсант снял трубку: звонящий сразу кричит первую реплику."""
     models = get_voice_models()
     scenario = store.get(state.scenario_id)
@@ -269,7 +406,8 @@ def _start_voice(session_id: UUID, state) -> None:
     if scenario.background:
         event = BgStart(loop=scenario.background.loop, gain_db=scenario.background.gain_db)
         hub.broadcast(session_id, event)
-    state.voice.speak(scenario.first_line, state.persona.mood)
+    if initial_statement:
+        state.voice.speak(scenario.first_line, state.persona.mood)
 
 
 async def _pump(ws: WebSocket, queue: asyncio.Queue) -> None:
@@ -280,6 +418,10 @@ async def _pump(ws: WebSocket, queue: asyncio.Queue) -> None:
             await ws.send_bytes(item)
         else:
             await ws.send_text(item.model_dump_json())
+            if (isinstance(item, ErrorEvent) and item.code is ErrorKind.INTERNAL
+                    and item.message == LEASE_FENCED_MESSAGE):
+                await ws.close(code=1012)
+                return
 
 
 async def _reject(ws: WebSocket, message: str) -> None:
@@ -292,6 +434,12 @@ async def _reject(ws: WebSocket, message: str) -> None:
 
 @router.websocket("/ws/call/{session_id}")
 async def call(ws: WebSocket, session_id: UUID) -> None:
+    if not websocket_origin_allowed(ws):
+        await ws.close(code=1008)
+        return
+    if hub.is_lease_fenced(session_id):
+        await ws.close(code=1012)
+        return
     await ws.accept()
 
     # АРМ курсанта. Преподаватель допущен, чтобы показать приём вызова группе.
@@ -309,6 +457,14 @@ async def call(ws: WebSocket, session_id: UUID) -> None:
         )
         await ws.close()
         return
+    if who.role is Role.INSTRUCTOR and state.owner_login != who.login:
+        await ws.send_text(
+            ErrorEvent(
+                code=ErrorKind.SESSION_NOT_FOUND, message="Занятие ещё не запущено преподавателем"
+            ).model_dump_json()
+        )
+        await ws.close()
+        return
     if who.role is Role.TRAINEE and (
         state.trainee_id is None or state.trainee_id != who.trainee_id
     ):
@@ -343,6 +499,12 @@ async def call(ws: WebSocket, session_id: UUID) -> None:
             if state.score is not None and state.self_assessed:
                 hub.to_trainee(session_id, ScoreReady(session_id=session_id))
             hub.to_trainee(session_id, TimerTick(timers=state.timers.snapshot()))
+            if state.started_at is not None and not state.ended and state.voice is None:
+                # Rebuild non-serializable audio services after backend recovery;
+                # the audio journal rehydrates the existing recording timeline.
+                if state.recorder is None:
+                    state.recorder = start_recording(session_id)
+                _start_voice(session_id, state, initial_statement=False)
         writer = asyncio.create_task(_pump(ws, queue))
         try:
             while True:
@@ -376,7 +538,8 @@ async def call(ws: WebSocket, session_id: UUID) -> None:
                         ErrorEvent(code=ErrorKind.UNSUPPORTED_EVENT, message=str(payload)[:200]),
                     )
                     continue
-                await _handle(session_id, state, event)
+                async with hub.durable_transition(session_id):
+                    await _handle(session_id, state, event)
         except WebSocketDisconnect:
             return
         finally:

backend/app/api/ws/control.py

@@ -11,18 +11,23 @@
 import asyncio
 import logging
 import math
+import secrets
 from uuid import UUID
 
 from fastapi import APIRouter, WebSocket, WebSocketDisconnect
 from pydantic import TypeAdapter, ValidationError
 
-from app.api.auth import audit, principal_of
+from app.api.auth import audit, principal_of, websocket_origin_allowed
+from app.config import get_settings
+from app.db.base import get_sessionmaker
+from app.db.repo import SessionNodeConflict
 from app.dialog.director import apply as apply_directive
 from app.dialog.director import mood_of
 from app.dialog.factory import build_caller
 from app.dialog.persona import PersonaState
 from app.dialog.runtime import get_embedder
 from app.dialog.slots import SlotMachine
+from app.domain.classifiers import Outcome
 from app.domain.events import (
     CallEnded,
     CallEndReason,
@@ -43,7 +48,7 @@ from app.domain.roles import Role
 from app.domain.timers import TimerCode
 from app.scenarios import store
 from app.session.dds import prepare_queue
-from app.session.hub import hub
+from app.session.hub import LEASE_FENCED_MESSAGE, hub
 from app.session.state import SessionState, now_utc
 from app.voice.models import get_voice_models
 from app.voice.pipeline import FILLERS, prefetch
@@ -54,21 +59,16 @@ router = APIRouter()
 _adapter = TypeAdapter(InstructorToServer)
 
 
-def card_briefing(state: SessionState) -> CardBriefing:
-    """Учебная текстовая вводная — исходные реплики, а не эталон карточки.
+def _dds_ineligible_scenarios(scenarios):
+    """Консультация и передача региона не являются готовыми карточками ДДС."""
+    return [scenario for scenario in scenarios if scenario.outcome is not Outcome.CARD]
 
-    В отсутствие диалога факты раскрываются сразу. Если факт уточняется,
-    показываем и уточнение: иначе правильно заполнить карточку невозможно.
-    """
+
+def card_briefing(state: SessionState) -> CardBriefing:
+    """Первую реплику показывает курсант; факты раскрываются только в ответах."""
     scenario = state.scenario
-    lines = ["Учебная текстовая вводная: сведения заявителя приведены ниже.",
-             scenario.first_line]
-    for fact in scenario.facts:
-        lines.append(f"• {fact.value}")
-        if fact.refined:
-            lines.append(f"  Уточнено: {fact.refined}")
     return CardBriefing(
-        scenario_id=scenario.id, mode=state.mode, text="\n".join(lines),
+        scenario_id=scenario.id, mode=state.mode, text=scenario.first_line,
         required_fields=([field for field in state.required_fields if field != "dds"]
                          if scenario.ground_truth.incident_code else list(state.required_fields)),
         card=state.kio,
@@ -83,40 +83,151 @@ async def _start(session_id: UUID, event, who=None) -> None:
             message="Передача в ДДС доступна только для текстовой карточки 112",
         ))
         return
-    scenario = store.get(event.scenario_id)
+    scenario_ids = list(dict.fromkeys([
+        event.scenario_id, *(event.scenario_ids or []), *(event.random_scenario_ids or []),
+    ]))
+    if get_settings().demo_no_db or hub.journal is None:
+        catalog = {
+            scenario_id: scenario for scenario_id in scenario_ids
+            if (scenario := store.get(scenario_id)) is not None
+        }
+        hidden_scenario_ids = (
+            await store.scenario_ids_owned_by_other(None, who.login)
+            if who is not None else set()
+        )
+    else:
+        try:
+            async with get_sessionmaker()() as db:
+                catalog, hidden_scenario_ids = await store.published_catalog(
+                    db, scenario_ids, who.login if who is not None else None,
+                )
+        except Exception as exc:
+            # Avoid serializing scenario facts or SQL bind values into application logs.
+            log.error("не удалось разрешить сценарий из общей библиотеки (%s)", type(exc).__name__)
+            hub.to_observers(session_id, ErrorEvent(
+                code=ErrorKind.INTERNAL,
+                message="Не удалось проверить сценарий в общей библиотеке; запуск отменён.",
+            ))
+            return
+    scenario = catalog.get(event.scenario_id)
     if scenario is None:
         hub.to_observers(
             session_id,
             ErrorEvent(code=ErrorKind.SCENARIO_INVALID, message=f"Нет сценария {event.scenario_id}"),
         )
         return
+    if scenario.id in hidden_scenario_ids:
+        hub.to_observers(session_id, ErrorEvent(
+            code=ErrorKind.SCENARIO_INVALID,
+            message="Сценарий не найден или недоступен этому преподавателю",
+        ))
+        return
+
+    if event.random_scenario_ids:
+        if len(event.random_scenario_ids) > 96:
+            hub.to_observers(session_id, ErrorEvent(
+                code=ErrorKind.SCENARIO_INVALID,
+                message="Случайный отбор ограничен 96 карточками",
+            ))
+            return
+        pool_ids = list(dict.fromkeys(event.random_scenario_ids))
+        pool = [catalog.get(scenario_id) for scenario_id in pool_ids]
+        if any(item is None for item in pool):
+            hub.to_observers(session_id, ErrorEvent(
+                code=ErrorKind.SCENARIO_INVALID,
+                message="В случайном отборе есть неизвестный сценарий",
+            ))
+            return
+        if hidden_scenario_ids.intersection(pool_ids):
+            hub.to_observers(session_id, ErrorEvent(
+                code=ErrorKind.SCENARIO_INVALID,
+                message="Сценарий не найден или недоступен этому преподавателю",
+            ))
+            return
+        ineligible_pool = _dds_ineligible_scenarios(pool)
+        if ineligible_pool:
+            hub.to_observers(session_id, ErrorEvent(
+                code=ErrorKind.SCENARIO_INVALID,
+                message="Случайный отбор должен содержать только готовые карточки ДДС",
+            ))
+            return
+        scenario = secrets.choice(pool)
 
     scenario_ids = event.scenario_ids or [event.scenario_id]
-    if event.exercise is Exercise.DDS:
-        if not scenario_ids or scenario_ids[0] != event.scenario_id or len(scenario_ids) > 96:
+    if event.exercise is Exercise.DDS or event.handoff_to_dds:
+        if (not scenario_ids or scenario_ids[0] != event.scenario_id
+                or len(scenario_ids) > 96):
             hub.to_observers(session_id, ErrorEvent(
                 code=ErrorKind.SCENARIO_INVALID,
                 message="Очередь ДДС должна начинаться с scenario_id и содержать не более 96 карточек",
             ))
             return
-        scenarios = [store.get(scenario_id) for scenario_id in scenario_ids]
+        if event.random_scenario_ids:
+            extra_ids = list(dict.fromkeys(
+                item for item in scenario_ids[1:] if item != scenario.id
+            ))
+            extras = [catalog.get(item) for item in extra_ids]
+            remaining_random = [item for item in pool if item.id != scenario.id
+                                and item.id not in extra_ids]
+            randomized_tail = secrets.SystemRandom().sample(
+                remaining_random, k=len(remaining_random)
+            )
+            scenarios = [scenario, *extras, *randomized_tail]
+        else:
+            scenarios = [catalog.get(scenario_id) for scenario_id in scenario_ids]
+        if len(scenarios) > 96:
+            hub.to_observers(session_id, ErrorEvent(
+                code=ErrorKind.SCENARIO_INVALID,
+                message="Очередь ДДС не может содержать более 96 карточек",
+            ))
+            return
         if any(item is None for item in scenarios):
             hub.to_observers(session_id, ErrorEvent(
                 code=ErrorKind.SCENARIO_INVALID, message="В очереди ДДС есть неизвестный сценарий",
             ))
             return
+        if any(item.id in hidden_scenario_ids for item in scenarios):
+            hub.to_observers(session_id, ErrorEvent(
+                code=ErrorKind.SCENARIO_INVALID,
+                message="Сценарий не найден или недоступен этому преподавателю",
+            ))
+            return
+        ineligible = _dds_ineligible_scenarios(scenarios)
+        if ineligible:
+            titles = ", ".join(item.title for item in ineligible)
+            hub.to_observers(session_id, ErrorEvent(
+                code=ErrorKind.SCENARIO_INVALID,
+                message=("В очередь ДДС можно добавить только готовые карточки с исходом "
+                         f"«карточка и передача в ДДС». Исключите: {titles}"),
+            ))
+            return
     else:
         scenarios = []
 
     attempt = 1
     recorded_trainee_id = event.trainee_id
     recorded_service = None
+    fencing_epoch = 0
     if hub.journal:
         try:
-            attempt, recorded_trainee_id, recorded_service = await hub.journal.start_lesson(
+            persisted = await hub.journal.start_lesson(
                 session_id, scenario.id, event.mode.value, event.trainee, event.trainee_id,
                 owner_login=who.login if who is not None else None,
+                backend_node_id=get_settings().backend_node_id,
             )
+            if persisted is None:
+                hub.to_observers(session_id, ErrorEvent(
+                    code=ErrorKind.INTERNAL,
+                    message="Не удалось записать занятие и аудит; запуск отменён.",
+                ))
+                return
+            attempt, recorded_trainee_id, recorded_service, fencing_epoch = persisted
+        except SessionNodeConflict:
+            hub.to_observers(session_id, ErrorEvent(
+                code=ErrorKind.FORBIDDEN,
+                message="Сессия закреплена за другим backend-узлом; проверьте маршрутизацию proxy",
+            ))
+            return
         except PermissionError:
             hub.to_observers(session_id, ErrorEvent(
                 code=ErrorKind.FORBIDDEN,
@@ -134,6 +245,7 @@ async def _start(session_id: UUID, event, who=None) -> None:
         level=scenario.level.value,
         mode=event.mode,
         owner_login=who.login if who is not None else None,
+        backend_fencing_epoch=fencing_epoch,
         exercise=event.exercise,
         handoff_to_dds=event.handoff_to_dds,
         scenario=scenario.model_copy(deep=True),
@@ -145,6 +257,8 @@ async def _start(session_id: UUID, event, who=None) -> None:
         criteria=event.criteria,
     )
     state.timers.limits[TimerCode.DDS_ACK] = event.criteria.decision_time_limit_seconds * 1000
+    state.timers.limits[TimerCode.CARD_FILL] = event.criteria.card_fill_time_limit_seconds * 1000
+    state.timers.limits[TimerCode.DDS_WORK] = event.criteria.dds_card_work_time_limit_seconds * 1000
     if event.exercise is Exercise.CALL:
         embedder = get_embedder()
         if embedder is not None:
@@ -165,6 +279,19 @@ async def _start(session_id: UUID, event, who=None) -> None:
         state.started_at = state.dispatched_at
     else:
         state.started_at = now_utc()
+        if event.exercise is Exercise.CARD:
+            embedder = get_embedder()
+            if embedder is not None:
+                state.slots = SlotMachine(state.scenario, embedder)
+            state.persona = PersonaState(state.scenario.persona)
+            state.caller = build_caller(
+                scenario.id, use_pregenerated=scenario.tree.pregenerated,
+            )
+            state.on_event("card.start")
+        if event.handoff_to_dds:
+            state.pending_dds_scenarios = [item.model_copy(deep=True) for item in scenarios[1:]]
+            state.dds_arrival_interval_seconds = event.dds_arrival_interval_seconds
+            state.dds_max_waiting = event.dds_max_waiting
     hub.register(state)
     if event.exercise is not Exercise.CALL and hub.journal and state.started_at is not None:
         await hub.journal.session_started(session_id, state.started_at)
@@ -178,19 +305,6 @@ async def _start(session_id: UUID, event, who=None) -> None:
         state.on_event("call.incoming")
     await hub.checkpoint(session_id)
     hub.start_ticker(session_id)
-    if who is not None:
-        # Запуск занятия меняет чужой результат — значит попадает в журнал
-        # аудита (ТЗ, хранение не менее шести месяцев).
-        # Сохраняем до продолжения сценария, чтобы завершение процесса не
-        # потеряло событие. ФИО курсанта в долгоживущий журнал не дублируем.
-        await audit(
-            who.login,
-            who.role.value,
-            "lesson.start",
-            str(session_id),
-            f"{scenario.id}, режим {event.mode.value}",
-        )
-
     if event.exercise is Exercise.CALL:
         hub.to_trainee(
             session_id,
@@ -217,6 +331,8 @@ async def _stop(session_id: UUID) -> None:
     if state is None or state.ended:
         return
     state.ended_at = now_utc()
+    if state.exercise is Exercise.CARD and state.dispatched_card is None:
+        state.on_event("card.end")
     state.end_reason = CallEndReason.INSTRUCTOR
     if state.voice is not None:
         await state.voice.close()
@@ -248,6 +364,12 @@ async def _reject(ws: WebSocket, message: str) -> None:
 
 @router.websocket("/ws/control/{session_id}")
 async def control(ws: WebSocket, session_id: UUID) -> None:
+    if not websocket_origin_allowed(ws):
+        await ws.close(code=1008)
+        return
+    if hub.is_lease_fenced(session_id):
+        await ws.close(code=1012)
+        return
     await ws.accept()
 
     # Пульт преподавателя: управление занятием доступно только ему.
@@ -255,9 +377,19 @@ async def control(ws: WebSocket, session_id: UUID) -> None:
     if who is None or who.role not in (Role.INSTRUCTOR,):
         await _reject(ws, "Недостаточно прав для этого экрана")
         return
+    event_stream = hub.begin_event_stream(session_id)
     try:
         while True:
-            payload = await ws.receive_json()
+            try:
+                payload = await asyncio.wait_for(ws.receive_json(), timeout=1)
+            except TimeoutError:
+                if hub.is_lease_fenced(session_id):
+                    await ws.send_text(ErrorEvent(
+                        code=ErrorKind.INTERNAL, message=LEASE_FENCED_MESSAGE
+                    ).model_dump_json())
+                    await ws.close(code=1012)
+                    return
+                continue
             try:
                 event = _adapter.validate_python(payload)
             except ValidationError:
@@ -331,6 +463,23 @@ async def control(ws: WebSocket, session_id: UUID) -> None:
                                 message="Оценка должна быть числом от 0 до 100",
                             ))
                             continue
+                        if hub.journal is not None:
+                            saved = await hub.journal.score_override(
+                                session_id, verdict, who.login, event.comment
+                            )
+                            if not saved:
+                                hub.to_observers(session_id, ErrorEvent(
+                                    code=ErrorKind.INTERNAL,
+                                    message="Не удалось сохранить оценку и запись аудита; изменение отменено",
+                                ))
+                                continue
+                        else:
+                            # Explicit in-memory demo mode has no Score table.
+                            await audit(
+                                who.login, who.role.value, "score.override", str(session_id),
+                                f"{state.score.get('score_auto')} → {verdict}; "
+                                f"comment_chars={len(event.comment)}",
+                            )
                         # Автооценка остаётся рядом: видно, что скорректировано и кем.
                         state.score = {
                             **state.score,
@@ -338,14 +487,6 @@ async def control(ws: WebSocket, session_id: UUID) -> None:
                             "overridden_by": who.login,
                             "override_comment": event.comment,
                         }
-                        if hub.journal:
-                            await hub.journal.score_override(
-                                session_id, verdict, who.login, event.comment
-                            )
-                        await audit(
-                            who.login, who.role.value, "score.override", str(session_id),
-                            f"{state.score.get('score_auto')} → {verdict}: {event.comment}",
-                        )
                         hub.to_observers(session_id, ScoreReady(session_id=session_id))
                 case "director.inject":
                     state = hub.get(session_id)
@@ -384,6 +525,20 @@ async def control(ws: WebSocket, session_id: UUID) -> None:
                             message=f"{event.type} ещё не реализовано",
                         ),
                     )
-            await hub.checkpoint(session_id)
+            try:
+                await hub.checkpoint(session_id)
+            except Exception:
+                if hub.is_lease_fenced(session_id):
+                    await ws.send_text(ErrorEvent(
+                        code=ErrorKind.INTERNAL, message=LEASE_FENCED_MESSAGE
+                    ).model_dump_json())
+                    await ws.close(code=1012)
+                    return
+                raise
+            if hub.is_lease_fenced(session_id):
+                await ws.close(code=1012)
+                return
     except WebSocketDisconnect:
         return
+    finally:
+        await hub.end_event_stream(event_stream)

backend/app/api/ws/observe.py

@@ -16,9 +16,9 @@ from uuid import UUID
 from fastapi import APIRouter, WebSocket, WebSocketDisconnect
 
 from app.domain.events import ErrorEvent, ErrorKind
-from app.api.auth import principal_of
+from app.api.auth import principal_of, websocket_origin_allowed
 from app.domain.roles import Role
-from app.session.hub import hub
+from app.session.hub import LEASE_FENCED_MESSAGE, hub
 
 router = APIRouter()
 
@@ -27,6 +27,10 @@ async def _pump(ws: WebSocket, queue: asyncio.Queue) -> None:
     while True:
         event = await queue.get()
         await ws.send_text(event.model_dump_json())
+        if (isinstance(event, ErrorEvent) and event.code is ErrorKind.INTERNAL
+                and event.message == LEASE_FENCED_MESSAGE):
+            await ws.close(code=1012)
+            return
 
 
 async def _wait_for_disconnect(ws: WebSocket) -> None:
@@ -48,6 +52,12 @@ async def _reject(ws: WebSocket, message: str) -> None:
 
 @router.websocket("/ws/observe/{session_id}")
 async def observe(ws: WebSocket, session_id: UUID) -> None:
+    if not websocket_origin_allowed(ws):
+        await ws.close(code=1008)
+        return
+    if hub.is_lease_fenced(session_id):
+        await ws.close(code=1012)
+        return
     await ws.accept()
 
     # Наблюдение за чужим занятием — не для обучающегося.
@@ -64,6 +74,16 @@ async def observe(ws: WebSocket, session_id: UUID) -> None:
         await ws.close()
         return
 
+    # Live state is process-local, so authorize against the owner snapshot on
+    # the state itself. Instructors may observe only their own sessions;
+    # administrators retain the cross-owner diagnostic view.
+    if who.role is Role.INSTRUCTOR and state.owner_login != who.login:
+        await ws.send_text(
+            ErrorEvent(code=ErrorKind.SESSION_NOT_FOUND, message="Занятие не запущено").model_dump_json()
+        )
+        await ws.close()
+        return
+
     # Снимок при подключении обязателен: монитор в классе включают посреди
     # занятия, и он должен показать текущее состояние, а не ждать событий.
     await ws.send_text(state.snapshot().model_dump_json())

backend/app/api/ws/station.py

@@ -16,9 +16,10 @@ from uuid import UUID
 from fastapi import APIRouter, WebSocket, WebSocketDisconnect
 from pydantic import TypeAdapter, ValidationError
 
-from app.api.auth import principal_of
+from app.api.auth import principal_of, websocket_origin_allowed
 from app.domain.events import (
     CallEndReason,
+    CommandAck,
     ErrorEvent,
     ErrorKind,
     Exercise,
@@ -40,10 +41,12 @@ from app.domain.statuses import (
     StatusError,
     current,
 )
+from app.domain.timers import TimerCode
+from app.scoring.address import address_matches
 from app.scoring.grammar import assess
 from app.session.dds import deliver_due_cards
 from app.session.finish import finish, score_current_dds
-from app.session.hub import hub
+from app.session.hub import LEASE_FENCED_MESSAGE, hub
 from app.session.state import now_utc
 
 log = logging.getLogger(__name__)
@@ -51,6 +54,13 @@ router = APIRouter()
 
 _adapter = TypeAdapter(StationToServer)
 
+
+def _start_dds_work_timer(state) -> None:
+    """Start the three-minute work clock once, when the card is opened."""
+    timer = state.timers.timers.get(TimerCode.DDS_WORK)
+    if timer is None or timer.started_at is None:
+        state.on_event("dds.open")
+
 REPORT_PHASES = ("dispatched", "arrived", "working", "completed")
 REQUIRED_STATUS = {
     "dispatched": ServiceStatus.ACCEPTED,
@@ -82,14 +92,7 @@ def _line(session_id: UUID, state, speaker: str, text: str) -> None:
 
 def _address_matches(expected: str | None, supplied: str) -> bool:
     """Не даём сообщить бригаде другой номер дома/другую улицу."""
-    if not expected:
-        return bool(supplied.strip())
-    numbers = re.findall(r"\d+", expected)
-    spoken_numbers = re.findall(r"\d+", supplied)
-    words = re.findall(r"[а-яё]{4,}", expected.casefold())
-    spoken_words = re.findall(r"[а-яё]{4,}", supplied.casefold())
-    return (all(number in spoken_numbers for number in numbers)
-            and any(word[:4] == spoken[:4] for word in words for spoken in spoken_words))
+    return address_matches(expected, supplied)
 
 
 def _incident_matches(state, supplied: str) -> bool:
@@ -134,6 +137,11 @@ def _finish_phone_call(session_id: UUID, state) -> None:
 async def _finish_dds(session_id: UUID, state) -> None:
     state.ended_at = now_utc()
     state.end_reason = CallEndReason.COMPLETE
+    state.capture_active_dds()
+    for card in state.dds_live_cards:
+        timer = card.timers.timers.get(TimerCode.DDS_WORK)
+        if timer is not None and timer.started_at is not None:
+            card.timers.on_event("dds.finish")
     hub.stop_ticker(session_id)
     hub.to_station(session_id, SessionEnded(reason=CallEndReason.COMPLETE))
     hub.to_observers(session_id, SessionEnded(reason=CallEndReason.COMPLETE))
@@ -152,18 +160,27 @@ async def _handle(session_id: UUID, state, event) -> None:
             # Подтверждение приёма — это статус «Принята» у главной службы.
             # Кнопка осталась ради живой цепочки 112 → ДДС (lct-20), где
             # диспетчер один и выбирать службу не из чего.
+            if not event.comment.strip():
+                _error(session_id, "Для подтверждения приёма добавьте комментарий с основанием")
+                return
+            if any(action == "card.ack" for action, _at, _detail in state.dds_log):
+                return
             state.on_event("card.ack")
             state.dds_log.append(("card.ack", now_utc(), None))
             services = state.managed_services()
             if services:
+                _start_dds_work_timer(state)
                 try:
-                    state.set_service_status(services[0], ServiceStatus.ACCEPTED)
+                    state.set_service_status(
+                        services[0], ServiceStatus.ACCEPTED, event.comment, author="диспетчер"
+                    )
                 except StatusError:
                     pass  # статус уже стоит: повторное нажатие ничего не меняет
         case "card.status":
             if event.service not in state.managed_services():
                 _error(session_id, "Можно менять статусы только своей ДДС")
                 return
+            _start_dds_work_timer(state)
             try:
                 state.set_service_status(
                     event.service, event.status, event.comment, author="диспетчер"
@@ -177,6 +194,10 @@ async def _handle(session_id: UUID, state, event) -> None:
             # Первичный статус останавливает норматив 30 секунд.
             if event.status in PRIMARY:
                 state.on_event("card.ack")
+            if event.status in {
+                ServiceStatus.COMPLETED, ServiceStatus.DECLINED, ServiceStatus.REFUSED,
+            }:
+                state.on_event("dds.complete")
         case "crew.select":
             if event.crew not in state.crew_options():
                 _error(session_id, "Выберите бригаду из списка доступных")
@@ -191,6 +212,8 @@ async def _handle(session_id: UUID, state, event) -> None:
             if state.phone_pending is not None:
                 _error(session_id, "Завершите текущий разговор перед сменой бригады")
                 return
+            if state.crew_selected == event.crew and assigned == event.crew:
+                return
             state.crew_selected = event.crew
             state.crew_assignments[service] = event.crew
             state.dds_log.append(("crew.select", now_utc(), event.crew))
@@ -261,13 +284,20 @@ async def _handle(session_id: UUID, state, event) -> None:
             ):
                 _error(session_id, "Ответ относится не к текущей карточке")
                 return
+            # A browser may lose the acknowledgement after the server has
+            # committed this replace-style value. Reconnect retries are safe:
+            # don't create another journal row (or rerun grammar assessment)
+            # when the current card already contains exactly this text.
+            if state.reply_text == event.text:
+                return
             state.reply_text = event.text
             state.reply_grammar = await assess(event.text)
             state.reply_log.append((now_utc(), event.text))
         case "card.open":
-            if state.exercise is not Exercise.DDS or not state.activate_dds_card(event.card_id):
+            if (state.exercise is not Exercise.DDS and not state.handoff_to_dds) or not state.activate_dds_card(event.card_id):
                 _error(session_id, "Карточка отсутствует в текущей очереди")
                 return
+            _start_dds_work_timer(state)
             hub.to_station(session_id, state.card_received_event())
             # CardReceived carries the contents, while StationState carries
             # the status journal and current queue. Send both on every switch
@@ -275,7 +305,7 @@ async def _handle(session_id: UUID, state, event) -> None:
             # card's status snapshot until the next periodic tick.
             hub.to_station(session_id, StationState(snapshot=state.station_snapshot()))
         case "card.next":
-            if state.exercise is not Exercise.DDS or not state.dispatched_card or (
+            if (state.exercise is not Exercise.DDS and not state.handoff_to_dds) or not state.dispatched_card or (
                 event.card_id != state.dispatched_card.card_id
             ):
                 _error(session_id, "Следующая карточка недоступна: ID текущей не совпадает")
@@ -323,8 +353,18 @@ async def _handle(session_id: UUID, state, event) -> None:
             )
             return
         case "zone.decision":
+            previous = next(
+                (detail for action, _at, detail in reversed(state.dds_log)
+                 if action == "zone.decision"),
+                None,
+            )
+            decision = "в зоне" if event.in_zone else "не в зоне"
+            if previous is not None:
+                if previous != decision:
+                    _error(session_id, "Решение по зоне уже записано для этой карточки")
+                return
             state.on_event("zone.decision")
-            state.dds_log.append(("zone.decision", now_utc(), "в зоне" if event.in_zone else "не в зоне"))
+            state.dds_log.append(("zone.decision", now_utc(), decision))
         case "crew.dispatched":
             state.kio = state.kio.model_copy(update={"dispatch_order_at": event.at})
             state.dds_log.append(("crew.dispatched", now_utc(), None))
@@ -342,6 +382,10 @@ async def _pump(ws: WebSocket, queue: asyncio.Queue) -> None:
     while True:
         event = await queue.get()
         await ws.send_text(event.model_dump_json())
+        if (isinstance(event, ErrorEvent) and event.code is ErrorKind.INTERNAL
+                and event.message == LEASE_FENCED_MESSAGE):
+            await ws.close(code=1012)
+            return
 
 
 async def _reject(ws: WebSocket, message: str) -> None:
@@ -354,6 +398,12 @@ async def _reject(ws: WebSocket, message: str) -> None:
 
 @router.websocket("/ws/station/{session_id}")
 async def station(ws: WebSocket, session_id: UUID, role: str = "dds") -> None:
+    if not websocket_origin_allowed(ws):
+        await ws.close(code=1008)
+        return
+    if hub.is_lease_fenced(session_id):
+        await ws.close(code=1012)
+        return
     await ws.accept()
 
     # За АРМ ДДС садится обучающийся, преподаватель смотрит и подменяет.
@@ -369,6 +419,12 @@ async def station(ws: WebSocket, session_id: UUID, role: str = "dds") -> None:
         )
         await ws.close()
         return
+    if who.role is Role.INSTRUCTOR and state.owner_login != who.login:
+        await ws.send_text(
+            ErrorEvent(code=ErrorKind.SESSION_NOT_FOUND, message="Занятие не запущено").model_dump_json()
+        )
+        await ws.close()
+        return
     if who.role is Role.TRAINEE and (
         state.trainee_id is None or state.trainee_id != who.trainee_id
     ):
@@ -393,8 +449,47 @@ async def station(ws: WebSocket, session_id: UUID, role: str = "dds") -> None:
                         ErrorEvent(code=ErrorKind.UNSUPPORTED_EVENT, message=str(payload)[:200]),
                     )
                     continue
-                await _handle(session_id, state, event)
+                raw_command_id = payload.get("_command_id") if isinstance(payload, dict) else None
+                try:
+                    command_id = UUID(raw_command_id) if raw_command_id is not None else None
+                except (ValueError, TypeError, AttributeError):
+                    hub.to_station(
+                        session_id,
+                        ErrorEvent(code=ErrorKind.UNSUPPORTED_EVENT,
+                                   message="Некорректный идентификатор команды"),
+                    )
+                    continue
+                if command_id is not None and str(command_id) in state.processed_station_commands:
+                    # The checkpoint already proves this exact command committed.
+                    # Re-ack it without rerunning its business transition.
+                    hub.to_station(session_id, CommandAck(command_id=command_id))
+                    continue
+                async with hub.durable_transition(session_id):
+                    await _handle(session_id, state, event)
+                    if command_id is not None:
+                        state.processed_station_commands.append(str(command_id))
+                        del state.processed_station_commands[:-512]
+                        # Commit the state+dedupe ID before acknowledging. The
+                        # transition context can have already flushed other
+                        # events; an explicit checkpoint here makes the
+                        # command/ACK boundary independent of that batch state.
+                        await hub.checkpoint(session_id)
+                        # The hub stages non-error events until the checkpoint
+                        # transaction has committed, including this ack.
+                        hub.to_station(session_id, CommandAck(command_id=command_id))
         except WebSocketDisconnect:
             return
+        except Exception:  # noqa: BLE001 — failed durable transition may fence the owner
+            if not state.lease_fenced:
+                raise
+            log.info(
+                "закрытие станционного WebSocket после fencing занятия %s",
+                session_id,
+            )
+            # `hub.checkpoint` broadcasts a structured fence event before
+            # propagating the failed database write. Let the sender deliver
+            # that event and close with 1012 instead of an opaque 1006.
+            await asyncio.gather(sender, return_exceptions=True)
+            return
         finally:
             sender.cancel()