borgmcp 2.0.2 → 2.0.4

package/src/remote-client.ts

@@ -47,7 +47,6 @@ import {
 } from './local-server-cursor.js';
 import { readBoundedResponseBody } from './server-response.js';
 import { resolveLocalLogRecipients } from './local-log-routing.js';
-import { ensureLocalSessionFresh, recoverExpiredLocalSession } from './session-continuity.js';
 
 export interface RemoteConnection {
   apiUrl: string;
@@ -229,15 +228,12 @@ async function localServerRequest<T>(
   method: 'GET' | 'POST' | 'PUT' | 'PATCH',
   payload?: Record<string, unknown>,
 ): Promise<T | null> {
-  let current = active.localSessionCredentialRef && active.localSessionExpiresAt
-    ? await ensureLocalSessionFresh(active)
-    : active;
-  const request = (candidate: ActiveCube) => decodeLocalProtocolResponse<T>((signal) => authedFetch(path, {
+  return decodeLocalProtocolResponse<T>((signal) => authedFetch(path, {
       method,
       signal,
-      droneSession: candidate.sessionToken,
-      apiUrl: candidate.apiUrl,
-      serverTrustIdentity: candidate.serverTrustIdentity,
+      droneSession: active.sessionToken,
+      apiUrl: active.apiUrl,
+      serverTrustIdentity: active.serverTrustIdentity,
       redirect: 'error',
       ...(payload === undefined
         ? { headers: { Accept: 'application/json' } }
@@ -246,14 +242,6 @@ async function localServerRequest<T>(
           body: JSON.stringify(createProtocolEnvelope(randomUUID(), payload)),
         }),
     }), true);
-  try {
-    return await request(current);
-  } catch (error) {
-    if (!(error instanceof BorgServerError) || error.code !== 'AUTH_EXPIRED') throw error;
-    if (current.sessionToken !== active.sessionToken) throw error;
-    current = await recoverExpiredLocalSession(current);
-    return request(current);
-  }
 }
 
 export interface LocalManageOperation {
@@ -621,16 +609,16 @@ async function authedFetch(
     } catch {
       rejectedCode = undefined;
     }
-    if (droneSession !== undefined && rejectedCode === ErrorCode.AUTH_EXPIRED) {
+    if (droneSession !== undefined && rejectedCode === ErrorCode.SESSION_REJECTED) {
       throw new BorgServerError(
-        'AUTH_EXPIRED',
-        'the selected Borg server session expired',
+        'SESSION_REJECTED',
+        'the selected Borg server superseded this worktree session with a newer enrollment',
       );
     }
-    if (droneSession !== undefined && rejectedCode === ErrorCode.SESSION_REJECTED) {
+    if (droneSession !== undefined && rejectedCode === ErrorCode.SESSION_REVOKED) {
       throw new BorgServerError(
-        'SESSION_REJECTED',
-        'the selected Borg server rejected this worktree session (revoked or taken over)',
+        'SESSION_REVOKED',
+        'the selected Borg server revoked this worktree session',
       );
     }
     throw new BorgServerError(

package/src/seat-probe.ts

@@ -19,9 +19,9 @@ import {
  * preserved (CR #6 / CR5 — the probe must NOT collapse them). Each verdict is
  * derived from the actual error TYPE/CODE, never from a mutable error-text regex:
  *   evicted            ← 410 DRONE_EVICTED (terminal; the SOLE delete authority — gh#882 S1)
- *   rejected           ← pin-matched drone-SESSION 401 carrying the EXACT typed
- *                        SESSION_REJECTED code (revoked / taken over; recover via
- *                        the offline `borg reset-local-seat` — never here)
+ *   revoked            ← pin-matched drone-SESSION 401 carrying SESSION_REVOKED
+ *   rejected           ← pin-matched drone-SESSION 401 carrying SESSION_REJECTED
+ *                        (superseded by a newer enrollment)
  *   credential-rejected← any OTHER 401 on the drone session (bare/untyped or a
  *                        non-SESSION typed code): the saved credential is no longer
  *                        accepted, but this is NON-DESTRUCTIVE — re-enroll, NEVER a
@@ -40,6 +40,7 @@ import {
  */
 export type SeatStatus =
   | 'evicted'
+  | 'revoked'
   | 'rejected'
   | 'live'
   | 'credential-rejected'
@@ -99,6 +100,7 @@ export async function defaultProbeSeat(
     // the error TYPE, never from message text (the security boundary).
     if (err instanceof BorgServerTrustError) return 'trust-mismatch';
     if (err instanceof BorgServerError) {
+      if (err.code === 'SESSION_REVOKED') return 'revoked';
       if (err.code === 'SESSION_REJECTED') return 'rejected';
       // Every non-SESSION 401 (bare/untyped or a different typed code) is a
       // credential rejection — non-destructive, distinct from a takeover.

package/src/seat-store.ts

@@ -13,7 +13,9 @@
  *   2. ATOMIC RENAME — temp in the SAME dir/fs, created 0600, fsync THEN rename;
  *      a crash never leaves a torn/readable partial, and the temp is cleaned up
  *      on any write failure.
- *   3. PARENT DIR 0700 — created with mode 0700.
+ *   3. PARENT DIR — private stores require 0700. The canonical ~/.borg parent
+ *      may explicitly use the owner-controlled policy (0755 accepted, 0022
+ *      forbidden) without rewriting its established mode.
  *   4. flock DISCIPLINE — a single advisory lock (O_EXCL lockfile), RULED option
  *      (b) (Coordinator cca6957a): NO automatic reclaim, EVER. Acquire is an atomic
  *      `open(lockPath,'wx',0o600)`; the whole read-compare-write runs inside ONE
@@ -29,8 +31,9 @@
  * callers keeps the raw bearer from leaving the store owner.
  */
 
-import { open, link, mkdir, readFile, rename, stat, unlink } from 'node:fs/promises';
-import { dirname } from 'node:path';
+import { constants } from 'node:fs';
+import { open, link, lstat, mkdir, readFile, realpath, rename, stat, unlink } from 'node:fs/promises';
+import { dirname, isAbsolute, resolve } from 'node:path';
 import { randomBytes } from 'node:crypto';
 
 const LOCK_WAIT_MS = 10;
@@ -42,6 +45,78 @@ interface LockPayload {
   startTime: string;
 }
 
+export interface SecureStoreOptions {
+  secureRoot?: string;
+  rootMode?: 'private' | 'owner-controlled';
+}
+
+function expectedUid(): number | null {
+  return typeof process.getuid === 'function' ? process.getuid() : null;
+}
+
+async function assertSecureRoot(
+  root: string,
+  rootMode: SecureStoreOptions['rootMode'] = 'private',
+): Promise<void> {
+  if (!isAbsolute(root) || resolve(root) !== root) {
+    throw new Error(`Borg credential store path ${root} is not canonical`);
+  }
+  let metadata: Awaited<ReturnType<typeof lstat>>;
+  try {
+    metadata = await lstat(root);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    metadata = await lstat(root);
+  }
+  if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+    throw new Error(`Borg credential store root ${root} must be a real directory, not a symlink`);
+  }
+  const mode = metadata.mode & 0o777;
+  if (rootMode === 'private' ? mode !== 0o700 : (mode & 0o022) !== 0) {
+    throw new Error(
+      `Borg credential store root ${root} has insecure permissions; ` +
+      (rootMode === 'private' ? 'expected 0700' : 'group/world write access is forbidden'),
+    );
+  }
+  const uid = expectedUid();
+  if (uid !== null && metadata.uid !== uid) {
+    throw new Error(`Borg credential store root ${root} is not owned by the current user`);
+  }
+  if (await realpath(root) !== root) {
+    throw new Error(`Borg credential store root ${root} is not canonical or contains a symlink`);
+  }
+}
+
+async function assertSecureFile(filePath: string): Promise<Awaited<ReturnType<typeof lstat>> | null> {
+  let metadata: Awaited<ReturnType<typeof lstat>>;
+  try {
+    metadata = await lstat(filePath);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null;
+    throw error;
+  }
+  if (metadata.isSymbolicLink() || !metadata.isFile()) {
+    throw new Error(`Borg credential store file ${filePath} must be a regular file, not a symlink`);
+  }
+  if ((metadata.mode & 0o777) !== 0o600) {
+    throw new Error(`Borg credential store file ${filePath} has insecure permissions; expected 0600`);
+  }
+  const uid = expectedUid();
+  if (uid !== null && metadata.uid !== uid) {
+    throw new Error(`Borg credential store file ${filePath} is not owned by the current user`);
+  }
+  return metadata;
+}
+
+async function assertSecurePath(filePath: string, options: SecureStoreOptions): Promise<void> {
+  const secureRoot = options.secureRoot!;
+  if (!isAbsolute(filePath) || resolve(filePath) !== filePath || dirname(filePath) !== secureRoot) {
+    throw new Error(`Borg credential store file path ${filePath} is not canonical`);
+  }
+  await assertSecureRoot(secureRoot, options.rootMode);
+}
+
 /**
  * Liveness check for the alive/dead branch (RULED option b). `process.kill(pid, 0)`
  * sends no signal but validates the target: ESRCH ⇒ no such process (DEAD → fail
@@ -103,20 +178,30 @@ function staleLockError(lockPath: string, held: LockPayload | null): Error {
  * beneath it.
  */
 async function ensureParentDir(filePath: string): Promise<void> {
+  if (!isAbsolute(filePath) || resolve(filePath) !== filePath) {
+    throw new Error(`Borg store file path ${filePath} is not canonical`);
+  }
   const dir = dirname(filePath);
-  let existing: Awaited<ReturnType<typeof stat>> | null = null;
+  let existing: Awaited<ReturnType<typeof lstat>> | null = null;
   try {
-    existing = await stat(dir);
+    existing = await lstat(dir);
   } catch (err) {
     if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err;
   }
   if (existing) {
+    if (existing.isSymbolicLink() || !existing.isDirectory()) {
+      throw new Error(`Borg store directory ${dir} must be a real directory, not a symlink`);
+    }
     if ((existing.mode & 0o777) !== 0o700) {
       throw new Error(
         `Borg store directory ${dir} has insecure permissions ` +
           `(0${(existing.mode & 0o777).toString(8)}, expected 0700); refusing to write a credential under it`,
       );
     }
+    const uid = expectedUid();
+    if (uid !== null && existing.uid !== uid) {
+      throw new Error(`Borg store directory ${dir} is not owned by the current user`);
+    }
     return;
   }
   await mkdir(dir, { recursive: true, mode: 0o700 });
@@ -128,8 +213,14 @@ async function ensureParentDir(filePath: string): Promise<void> {
  * rename over the target (atomic; the mode carries across). A failed write
  * cleans up the temp so no leftover file ever holds the secret.
  */
-export async function atomicWrite0600(filePath: string, data: string): Promise<void> {
-  await ensureParentDir(filePath);
+export async function atomicWrite0600(
+  filePath: string,
+  data: string,
+  options: SecureStoreOptions = {},
+): Promise<void> {
+  if (options.secureRoot) await assertSecurePath(filePath, options);
+  else await ensureParentDir(filePath);
+  if (options.secureRoot) await assertSecureFile(filePath);
   const tmp = `${filePath}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
   const handle = await open(tmp, 'wx', 0o600);
   try {
@@ -142,6 +233,10 @@ export async function atomicWrite0600(filePath: string, data: string): Promise<v
   }
   await handle.close();
   try {
+    if (options.secureRoot) {
+      await assertSecurePath(filePath, options);
+      await assertSecureFile(filePath);
+    }
     await rename(tmp, filePath);
   } catch (err) {
     await unlink(tmp).catch(() => {});
@@ -187,14 +282,53 @@ async function assertSecureStorePerms(
  * perms are enforced BEFORE the bytes are read (CR#2) — a loosely-permissioned
  * secret fails closed and is never read.
  */
-export async function readStoreFile(filePath: string): Promise<string | null> {
-  let fileStat: Awaited<ReturnType<typeof stat>>;
+export async function readStoreFile(
+  filePath: string,
+  options: SecureStoreOptions = {},
+): Promise<string | null> {
+  if (!isAbsolute(filePath) || resolve(filePath) !== filePath) {
+    throw new Error(`Borg store file path ${filePath} is not canonical`);
+  }
+  if (options.secureRoot) await assertSecurePath(filePath, options);
+  if (options.secureRoot) {
+    const before = await assertSecureFile(filePath);
+    if (!before) return null;
+    let handle;
+    try {
+      handle = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null;
+      throw error;
+    }
+    try {
+      const opened = await handle.stat();
+      if (opened.dev !== before.dev || opened.ino !== before.ino) {
+        throw new Error('Borg credential store file changed while it was being opened');
+      }
+      const raw = await handle.readFile('utf8');
+      const after = await handle.stat();
+      if (after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size) {
+        throw new Error('Borg credential store file changed while it was being read');
+      }
+      return raw;
+    } finally {
+      await handle.close();
+    }
+  }
+  let fileStat: Awaited<ReturnType<typeof lstat>>;
   try {
-    fileStat = await stat(filePath);
+    fileStat = await lstat(filePath);
   } catch (err) {
     if ((err as NodeJS.ErrnoException).code === 'ENOENT') return null;
     throw err;
   }
+  if (fileStat.isSymbolicLink() || !fileStat.isFile()) {
+    throw new Error(`Borg store file ${filePath} must be a regular file, not a symlink`);
+  }
+  const uid = expectedUid();
+  if (uid !== null && fileStat.uid !== uid) {
+    throw new Error(`Borg store file ${filePath} is not owned by the current user`);
+  }
   await assertSecureStorePerms(filePath, fileStat.mode);
   try {
     return await readFile(filePath, 'utf8');
@@ -220,11 +354,12 @@ export async function readStoreFile(filePath: string): Promise<string | null> {
 export async function withStoreLock<T>(
   lockPath: string,
   op: () => Promise<T>,
-  opts: { attempts?: number; waitMs?: number } = {},
+  opts: { attempts?: number; waitMs?: number } & SecureStoreOptions = {},
 ): Promise<T> {
   const attempts = opts.attempts ?? LOCK_ATTEMPTS;
   const waitMs = opts.waitMs ?? LOCK_WAIT_MS;
-  await mkdir(dirname(lockPath), { recursive: true, mode: 0o700 });
+  if (opts.secureRoot) await assertSecurePath(lockPath, opts);
+  else await mkdir(dirname(lockPath), { recursive: true, mode: 0o700 });
   const myPayload = JSON.stringify({ pid: process.pid, startTime: processStartTime() });
   // Stage the FULLY-WRITTEN payload in a same-dir temp, then acquire by atomically
   // hard-linking it into place. `link` is atomic (EEXIST when the lock is held), and
@@ -248,7 +383,14 @@ export async function withStoreLock<T>(
         // The lock is held. Inspect the holder — but NEVER reclaim/steal it.
         let raw: string;
         try {
-          raw = await readFile(lockPath, 'utf8');
+          const stored = await readStoreFile(
+            lockPath,
+            opts.secureRoot
+              ? { secureRoot: opts.secureRoot, rootMode: opts.rootMode }
+              : {},
+          );
+          if (stored === null) continue;
+          raw = stored;
         } catch (readErr) {
           if ((readErr as NodeJS.ErrnoException).code === 'ENOENT') continue; // released — retry
           throw readErr;
@@ -298,9 +440,10 @@ export async function withStore<S, T>(
   emptyState: () => S,
   parse: (raw: string) => S | null,
   op: (txn: StoreTxn<S>) => Promise<T>,
+  options: SecureStoreOptions = {},
 ): Promise<T> {
   return withStoreLock(`${storePath}.lock`, async () => {
-    const raw = await readStoreFile(storePath);
+    const raw = await readStoreFile(storePath, options);
     // CR4 fail-closed: ONLY a missing file (ENOENT → readStoreFile returns null)
     // may initialize an empty state. A present-but-malformed / wrong-version /
     // schema-invalid store must NEVER be silently mapped to empty and then
@@ -326,8 +469,8 @@ export async function withStore<S, T>(
     }
     const txn: StoreTxn<S> = {
       data,
-      commit: () => atomicWrite0600(storePath, JSON.stringify(data, null, 2) + '\n'),
+      commit: () => atomicWrite0600(storePath, JSON.stringify(data, null, 2) + '\n', options),
     };
     return op(txn);
-  });
+  }, options);
 }

package/src/seats.ts

@@ -21,6 +21,7 @@ import os from 'os';
 import path from 'path';
 import { createHash } from 'node:crypto';
 import { readStoreFile, withStore } from './seat-store.js';
+import { LegacySessionCredentialCollisionError } from './server-errors.js';
 
 export const SEATS_FILE = path.join(os.homedir(), '.config', 'borgmcp', 'seats.json');
 const SEATS_VERSION = 1 as const;
@@ -47,7 +48,6 @@ export interface SeatRecord {
   // server metadata (active only)
   droneId?: string;
   sessionId?: string;
-  expiresAt?: string;
   // binding + display (set atomically at FINALIZE; absent while pending)
   worktree?: string;
   name?: string;
@@ -55,9 +55,6 @@ export interface SeatRecord {
   roleName?: string;
   roleClass?: 'queen' | 'worker';
   isHumanSeat?: boolean;
-  // One crash-safe replacement may coexist with an ACTIVE session until the
-  // server confirms the same-seat restore. It is never hydratable or bound.
-  replacement?: { credential: string };
 }
 
 interface SeatsFile {
@@ -122,8 +119,8 @@ function isValidOperation(value: unknown): value is SeatOperation {
  * checked — the ref is well-formed and self-consistent (the map key equals the
  * record's derived ref), state ∈ {pending,active}, the credential is a non-empty
  * string, the operation is well-shaped, an ACTIVE record carries ALL its required
- * server + binding fields, and a PENDING record carries NO active-only fields
- * (session id / expiry). A single invalid entry ⇒ the whole store is rejected
+ * server + binding fields, and a PENDING record carries NO active-only session
+ * id. A single invalid entry ⇒ the whole store is rejected
  * (fail closed at the caller, bytes preserved) — never a silent cast.
  */
 function isValidSeatRecord(ref: string, value: unknown): value is SeatRecord {
@@ -151,32 +148,12 @@ function isValidSeatRecord(ref: string, value: unknown): value is SeatRecord {
   if (r.worktree !== undefined && typeof r.worktree !== 'string') return false;
   if (r.droneId !== undefined && (typeof r.droneId !== 'string' || !UUID_RE.test(r.droneId))) return false;
   if (r.sessionId !== undefined && (typeof r.sessionId !== 'string' || !UUID_RE.test(r.sessionId))) return false;
-  if (
-    r.expiresAt !== undefined &&
-    (typeof r.expiresAt !== 'string' || !Number.isFinite(Date.parse(r.expiresAt)))
-  ) {
-    return false;
-  }
-  if (r.replacement !== undefined) {
-    if (
-      r.state !== 'active' ||
-      r.replacement === null ||
-      typeof r.replacement !== 'object' ||
-      Array.isArray(r.replacement) ||
-      Object.keys(r.replacement as object).length !== 1 ||
-      typeof (r.replacement as { credential?: unknown }).credential !== 'string' ||
-      !/^[A-Za-z0-9_-]{43}$/.test((r.replacement as { credential: string }).credential)
-    ) {
-      return false;
-    }
-  }
   // State-consistency invariants (no inconsistent active|pending).
   if (r.state === 'active') {
     // An ACTIVE record MUST carry its full server session + worktree binding.
     if (
       typeof r.droneId !== 'string' ||
       typeof r.sessionId !== 'string' ||
-      typeof r.expiresAt !== 'string' ||
       typeof r.worktree !== 'string' ||
       typeof r.name !== 'string' ||
       typeof r.droneLabel !== 'string'
@@ -185,7 +162,7 @@ function isValidSeatRecord(ref: string, value: unknown): value is SeatRecord {
     }
   } else {
     // A PENDING record must NOT carry active-only server session fields.
-    if (r.sessionId !== undefined || r.expiresAt !== undefined) return false;
+    if (r.sessionId !== undefined) return false;
   }
   // The map key must equal the record's derived ref (no cross-key aliasing).
   return seatRef(value as SeatRecord) === ref;
@@ -214,6 +191,37 @@ function parseStore(raw: string): SeatsFile | null {
     ) {
       const seats = candidate.seats as Record<string, unknown>;
       for (const [ref, record] of Object.entries(seats)) {
+        if (
+          record !== null &&
+          typeof record === 'object' &&
+          !Array.isArray(record) &&
+          Object.prototype.hasOwnProperty.call(record, 'replacement')
+        ) {
+          const { replacement, ...withoutReplacement } = record as Record<string, unknown>;
+          const exactReplacement =
+            replacement !== null &&
+            typeof replacement === 'object' &&
+            !Array.isArray(replacement) &&
+            Object.keys(replacement).length === 1 &&
+            typeof (replacement as { credential?: unknown }).credential === 'string' &&
+            /^[A-Za-z0-9_-]{43}$/.test((replacement as { credential: string }).credential);
+          let canonicalOrigin = false;
+          try {
+            const origin = new URL(String(withoutReplacement.origin));
+            canonicalOrigin = origin.protocol === 'https:' && origin.origin === withoutReplacement.origin;
+          } catch {
+            canonicalOrigin = false;
+          }
+          if (
+            withoutReplacement.state === 'active' &&
+            exactReplacement &&
+            canonicalOrigin &&
+            isValidSeatRecord(ref, withoutReplacement)
+          ) {
+            throw new LegacySessionCredentialCollisionError(withoutReplacement.origin as string);
+          }
+          return null;
+        }
         if (!isValidSeatRecord(ref, record)) return null;
       }
       return { version: SEATS_VERSION, seats: seats as Record<string, SeatRecord> };
@@ -297,17 +305,6 @@ export async function getActiveSeatCredential(
   return record.credential;
 }
 
-/** Exact ACTIVE record for the internal continuity coordinator. */
-export async function getActiveSeat(
-  ref: string,
-  binding: { origin: string; trustIdentity: string; cubeId: string },
-): Promise<SeatRecord | null> {
-  if (!REF_RE.test(ref)) return null;
-  const store = await readStore();
-  const record = store.seats[ref];
-  return recordMatches(record, ref, binding) && record.state === 'active' ? record : null;
-}
-
 // ─── PREPARE / mint (no worktree yet) ────────────────────────────────────────
 
 /**
@@ -471,7 +468,6 @@ export async function activateAndBindSeat(input: {
   operation: SeatOperation;
   droneId: string;
   sessionId: string;
-  expiresAt: string;
   expectedPendingDigest: string;
   worktree: string;
   name: string;
@@ -483,9 +479,6 @@ export async function activateAndBindSeat(input: {
   if (!UUID_RE.test(input.droneId) || !UUID_RE.test(input.sessionId)) {
     throw new Error('invalid Borg server session identity');
   }
-  if (typeof input.expiresAt !== 'string' || !Number.isFinite(Date.parse(input.expiresAt))) {
-    throw new Error('invalid Borg server session expiry');
-  }
   const ref = seatRef(input);
   const binding = { origin: input.origin, trustIdentity: input.trustIdentity, cubeId: input.cubeId };
   return withStore<SeatsFile, ActivateSeatOutcome>(SEATS_FILE, emptyStore, parseStore, async (txn) => {
@@ -497,7 +490,6 @@ export async function activateAndBindSeat(input: {
       state: 'active',
       droneId: input.droneId,
       sessionId: input.sessionId,
-      expiresAt: input.expiresAt,
       worktree: input.worktree,
       name: input.name,
       droneLabel: input.droneLabel,
@@ -510,149 +502,6 @@ export async function activateAndBindSeat(input: {
   });
 }
 
-export type PrepareSeatReplacementOutcome =
-  | { ok: true; credential: string; digest: string }
-  | { ok: false; reason: 'expectation-mismatch' };
-
-/**
- * Preserve the exact ACTIVE seat while preparing one durable replacement bearer.
- * A lost response or process restart reuses the stored replacement; a changed
- * authority, drone, or active bearer fails before any mutation.
- */
-export async function prepareSeatReplacement(input: {
-  ref: string;
-  binding: { origin: string; trustIdentity: string; cubeId: string };
-  expectedDroneId: string;
-  expectedActiveDigest: string;
-  replacementCredential: string;
-}): Promise<PrepareSeatReplacementOutcome> {
-  if (!REF_RE.test(input.ref) || !/^[A-Za-z0-9_-]{43}$/.test(input.replacementCredential)) {
-    return { ok: false, reason: 'expectation-mismatch' };
-  }
-  return withStore<SeatsFile, PrepareSeatReplacementOutcome>(SEATS_FILE, emptyStore, parseStore, async (txn) => {
-    const record = txn.data.seats[input.ref];
-    if (
-      !recordMatches(record, input.ref, input.binding) ||
-      record.state !== 'active' ||
-      record.droneId !== input.expectedDroneId ||
-      digestOf(record.credential) !== input.expectedActiveDigest
-    ) {
-      return { ok: false as const, reason: 'expectation-mismatch' as const };
-    }
-    if (record.replacement) {
-      return {
-        ok: true as const,
-        credential: record.replacement.credential,
-        digest: digestOf(record.replacement.credential),
-      };
-    }
-    record.replacement = { credential: input.replacementCredential };
-    await txn.commit();
-    return {
-      ok: true as const,
-      credential: input.replacementCredential,
-      digest: digestOf(input.replacementCredential),
-    };
-  });
-}
-
-export type PromoteSeatReplacementOutcome = 'promoted' | 'missing' | 'replaced';
-
-/** Update only the committed expiry for an exact same-bearer session renewal. */
-export async function refreshActiveSeatSession(input: {
-  ref: string;
-  binding: { origin: string; trustIdentity: string; cubeId: string };
-  expectedDroneId: string;
-  expectedActiveDigest: string;
-  expectedSessionId: string;
-  expiresAt: string;
-}): Promise<boolean> {
-  if (!UUID_RE.test(input.expectedDroneId) || !UUID_RE.test(input.expectedSessionId)) {
-    throw new Error('invalid Borg server session identity');
-  }
-  if (!Number.isFinite(Date.parse(input.expiresAt))) {
-    throw new Error('invalid Borg server session expiry');
-  }
-  return withStore<SeatsFile, boolean>(SEATS_FILE, emptyStore, parseStore, async (txn) => {
-    const record = txn.data.seats[input.ref];
-    if (
-      !recordMatches(record, input.ref, input.binding) ||
-      record.state !== 'active' ||
-      record.droneId !== input.expectedDroneId ||
-      record.sessionId !== input.expectedSessionId ||
-      digestOf(record.credential) !== input.expectedActiveDigest
-    ) {
-      return false;
-    }
-    record.expiresAt = input.expiresAt;
-    await txn.commit();
-    return true;
-  });
-}
-
-/** Atomically promote only the response-bound replacement onto the same ACTIVE seat. */
-export async function promoteSeatReplacement(input: {
-  ref: string;
-  binding: { origin: string; trustIdentity: string; cubeId: string };
-  expectedDroneId: string;
-  expectedActiveDigest: string;
-  expectedReplacementDigest: string;
-  sessionId: string;
-  expiresAt: string;
-}): Promise<PromoteSeatReplacementOutcome> {
-  if (!UUID_RE.test(input.expectedDroneId) || !UUID_RE.test(input.sessionId)) {
-    throw new Error('invalid Borg server session identity');
-  }
-  if (!Number.isFinite(Date.parse(input.expiresAt))) {
-    throw new Error('invalid Borg server session expiry');
-  }
-  return withStore<SeatsFile, PromoteSeatReplacementOutcome>(SEATS_FILE, emptyStore, parseStore, async (txn) => {
-    const record = txn.data.seats[input.ref];
-    if (!recordMatches(record, input.ref, input.binding) || record.state !== 'active') return 'missing';
-    if (
-      record.droneId !== input.expectedDroneId ||
-      digestOf(record.credential) !== input.expectedActiveDigest ||
-      !record.replacement ||
-      digestOf(record.replacement.credential) !== input.expectedReplacementDigest
-    ) {
-      return 'replaced';
-    }
-    const { replacement, ...active } = record;
-    txn.data.seats[input.ref] = {
-      ...active,
-      credential: replacement.credential,
-      sessionId: input.sessionId,
-      expiresAt: input.expiresAt,
-    };
-    await txn.commit();
-    return 'promoted';
-  });
-}
-
-/** Remove only the caller's exact pending replacement, never the ACTIVE seat. */
-export async function scrubSeatReplacement(input: {
-  ref: string;
-  binding: { origin: string; trustIdentity: string; cubeId: string };
-  expectedActiveDigest: string;
-  expectedReplacementDigest: string;
-}): Promise<boolean> {
-  return withStore<SeatsFile, boolean>(SEATS_FILE, emptyStore, parseStore, async (txn) => {
-    const record = txn.data.seats[input.ref];
-    if (
-      !recordMatches(record, input.ref, input.binding) ||
-      record.state !== 'active' ||
-      digestOf(record.credential) !== input.expectedActiveDigest ||
-      !record.replacement ||
-      digestOf(record.replacement.credential) !== input.expectedReplacementDigest
-    ) {
-      return false;
-    }
-    delete record.replacement;
-    await txn.commit();
-    return true;
-  });
-}
-
 // ─── CR#2: bind a PENDING record to a preserved worktree (no activation) ─────
 
 export type BindPendingSeatOutcome = 'bound' | 'missing' | 'replaced';