security(chat): the ownership gate still claims a session whose owner record is unreadable — #14033's contract is not honoured by SessionOwnershipValidator #17481

Found in review on #17426 (#17422), by CodeRabbit, and verified against current main.

Problem

#14033 gave ChatHistoryManager.get_session_owner an honest error contract: an unreadable session file raises SessionOwnerUnreadable (autobot-backend/chat_history/session.py, raise SessionOwnerUnreadable(session_id) from e) instead of returning None. api/conversation_files.py, api/ws_security.py and services/conversation_export.py catch it and treat it as unknown.

The chat ownership gate does not. SessionOwnershipValidator._durable_owner (autobot-backend/security/session_ownership.py) catches every exception and returns None:

except Exception as exc:
    logger.warning("Could not read the durable owner of session %s...: %s", session_id[:8], exc)
    return None

_owner_when_cache_is_empty then reads that None as "no owner anywhere" and writes the caller as owner (set_session_owner(session_id, username, ...)), returning legacy_migration. So a caller who reaches a conversation while its file is unreadable (decrypt failure, corruption, IO error) with no Redis record is granted ownership of it, and the grant persists in Redis.

The docstring calls this fail-open deliberate. It also contradicts #14033's acceptance criterion "an unreadable session file does not result in a claim", and #14033 is closed as completed.

Blast radius

Every route guarded by validate_ownership. The grant is also an input elsewhere: services/agent_terminal/conversation_owner.py falls back to it. #17426 hardens the agent-terminal claim path so that an unreadable owner refuses instead of trusting the grant. That PR does not fix the gate itself.

Not measured

• How often an unreadable-but-existing session file occurs in practice.
• Whether any caller depends on the fail-open. The docstring points to "the PR" for the reasoning; I did not locate it.

Suggested approach

_durable_owner distinguishes SessionOwnerUnreadable from None. On unreadable, _owner_when_cache_is_empty denies (or defers) instead of claiming, and never calls set_session_owner.

Acceptance criteria

• An unreadable session file with no Redis record does not produce a claim and does not write an owner. The test asserts the exact status code.
• A genuinely ownerless (readable) session still takes legacy_migration as today.
• Mutation: restoring the return None makes the unreadable-file test fail.

Related

• security(chat): get_session_owner cannot distinguish 'no owner' from 'unreadable', and callers now WRITE on that answer #14033: introduced SessionOwnerUnreadable; this is the caller it missed.
• security(chat): session ownership expires after 24h and is then claimed by whoever accesses it next #14018: made the file record authoritative.
• security(agent-terminal): a caller-supplied conversation_id is never checked against the caller — #17053's fix bypasses its own owner resolution (CWE-639) #17422 / fix(agent-terminal): refuse binding a conversation the creator does not own (#17422) #17426: agent-terminal claim path, hardened against this grant.
• security(chat): ownership enforcement fails OPEN — an unavailable feature-flag service disables every check platform-wide #14010: enforcement fails open when feature flags are unavailable.