@durable-streams/server-conformance-tests 0.1.5 → 0.1.7

package/src/index.ts

@@ -110,7 +110,7 @@ function parseSSEEvents(
   sseText: string
 ): Array<{ type: string; data: string }> {
   const events: Array<{ type: string; data: string }> = []
-  const normalized = sseText.replace(/\r\n/g, `\n`)
+  const normalized = sseText.replace(/\r\n/g, `\n`).replace(/\r/g, `\n`)
 
   // Split by double newlines (event boundaries)
   const eventBlocks = normalized.split(`\n\n`).filter((block) => block.trim())
@@ -479,7 +479,7 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
       })
-      expect([200, 204]).toContain(secondResponse.status)
+      expect(secondResponse.status).toBe(200)
     })
 
     test(`should return 409 on PUT with different config`, async () => {
@@ -516,7 +516,7 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
         body: `hello world`,
       })
 
-      expect([200, 204]).toContain(response.status)
+      expect(response.status).toBe(204)
       expect(response.headers.get(STREAM_OFFSET_HEADER)).toBeDefined()
     })
 
@@ -793,7 +793,7 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
         body: `second`,
       })
 
-      expect([200, 204]).toContain(response.status)
+      expect(response.status).toBe(204)
     })
 
     test(`should reject duplicate seq values`, async () => {
@@ -829,6 +829,218 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
     })
   })
 
+  // ============================================================================
+  // Browser Security Headers (Protocol Section 10.7)
+  // ============================================================================
+
+  describe(`Browser Security Headers`, () => {
+    test(`should include X-Content-Type-Options: nosniff on GET responses`, async () => {
+      const streamPath = `/v1/stream/security-get-nosniff-${Date.now()}`
+
+      // Create stream with data
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+        body: `test data`,
+      })
+
+      // Read data
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+      })
+
+      expect(response.status).toBe(200)
+      expect(response.headers.get(`x-content-type-options`)).toBe(`nosniff`)
+    })
+
+    test(`should include X-Content-Type-Options: nosniff on PUT responses`, async () => {
+      const streamPath = `/v1/stream/security-put-nosniff-${Date.now()}`
+
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      expect(response.status).toBe(201)
+      expect(response.headers.get(`x-content-type-options`)).toBe(`nosniff`)
+    })
+
+    test(`should include X-Content-Type-Options: nosniff on POST responses`, async () => {
+      const streamPath = `/v1/stream/security-post-nosniff-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Append data
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: { "Content-Type": `text/plain` },
+        body: `data`,
+      })
+
+      expect([200, 204]).toContain(response.status)
+      expect(response.headers.get(`x-content-type-options`)).toBe(`nosniff`)
+    })
+
+    test(`should include X-Content-Type-Options: nosniff on HEAD responses`, async () => {
+      const streamPath = `/v1/stream/security-head-nosniff-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // HEAD request
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `HEAD`,
+      })
+
+      expect(response.status).toBe(200)
+      expect(response.headers.get(`x-content-type-options`)).toBe(`nosniff`)
+    })
+
+    test(`should include Cross-Origin-Resource-Policy header on GET responses`, async () => {
+      const streamPath = `/v1/stream/security-corp-get-${Date.now()}`
+
+      // Create stream with data
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `application/octet-stream` },
+        body: new Uint8Array([1, 2, 3, 4]),
+      })
+
+      // Read data
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+      })
+
+      expect(response.status).toBe(200)
+      const corp = response.headers.get(`cross-origin-resource-policy`)
+      expect(corp).toBeDefined()
+      expect([`cross-origin`, `same-origin`, `same-site`]).toContain(corp)
+    })
+
+    test(`should include Cache-Control: no-store on HEAD responses`, async () => {
+      const streamPath = `/v1/stream/security-head-cache-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // HEAD request
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `HEAD`,
+      })
+
+      expect(response.status).toBe(200)
+      const cacheControl = response.headers.get(`cache-control`)
+      expect(cacheControl).toBeDefined()
+      expect(cacheControl).toContain(`no-store`)
+    })
+
+    test(`should include X-Content-Type-Options: nosniff on SSE responses`, async () => {
+      const streamPath = `/v1/stream/security-sse-nosniff-${Date.now()}`
+
+      // Create stream with data
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `application/json` },
+        body: JSON.stringify({ test: `data` }),
+      })
+
+      // Get offset
+      const headResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `HEAD`,
+      })
+      const offset = headResponse.headers.get(STREAM_OFFSET_HEADER) ?? `-1`
+
+      // SSE request with abort controller
+      const controller = new AbortController()
+      const timeoutId = setTimeout(() => controller.abort(), 500)
+
+      try {
+        const response = await fetch(
+          `${getBaseUrl()}${streamPath}?offset=${offset}&live=sse`,
+          {
+            method: `GET`,
+            signal: controller.signal,
+          }
+        )
+
+        expect(response.status).toBe(200)
+        expect(response.headers.get(`x-content-type-options`)).toBe(`nosniff`)
+      } catch (e) {
+        // AbortError is expected
+        if (!(e instanceof Error && e.name === `AbortError`)) {
+          throw e
+        }
+      } finally {
+        clearTimeout(timeoutId)
+      }
+    })
+
+    test(`should include X-Content-Type-Options: nosniff on long-poll responses`, async () => {
+      const streamPath = `/v1/stream/security-longpoll-nosniff-${Date.now()}`
+
+      // Create stream with data
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+        body: `initial data`,
+      })
+
+      // Get offset
+      const headResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `HEAD`,
+      })
+      const offset = headResponse.headers.get(STREAM_OFFSET_HEADER) ?? `-1`
+
+      // Long-poll request (will likely return 204 if no new data)
+      const controller = new AbortController()
+      const timeoutId = setTimeout(() => controller.abort(), 500)
+
+      try {
+        const response = await fetch(
+          `${getBaseUrl()}${streamPath}?offset=${offset}&live=long-poll`,
+          {
+            method: `GET`,
+            signal: controller.signal,
+          }
+        )
+
+        // Either 200 (data) or 204 (timeout) - both should have nosniff
+        expect([200, 204]).toContain(response.status)
+        expect(response.headers.get(`x-content-type-options`)).toBe(`nosniff`)
+      } catch (e) {
+        // AbortError is acceptable if request times out
+        if (!(e instanceof Error && e.name === `AbortError`)) {
+          throw e
+        }
+      } finally {
+        clearTimeout(timeoutId)
+      }
+    })
+
+    test(`should include security headers on error responses`, async () => {
+      const streamPath = `/v1/stream/security-error-headers-${Date.now()}`
+
+      // Try to read non-existent stream (404)
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+      })
+
+      expect(response.status).toBe(404)
+      // Security headers should be present even on error responses
+      expect(response.headers.get(`x-content-type-options`)).toBe(`nosniff`)
+    })
+  })
+
   // ============================================================================
   // TTL and Expiry Validation
   // ============================================================================
@@ -927,7 +1139,7 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
         body: `test`,
       })
 
-      expect([200, 204]).toContain(response.status)
+      expect(response.status).toBe(204)
     })
 
     test(`should allow idempotent create with different case content-type`, async () => {
@@ -945,7 +1157,7 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
         method: `PUT`,
         headers: { "Content-Type": `APPLICATION/JSON` },
       })
-      expect([200, 204]).toContain(response2.status)
+      expect(response2.status).toBe(200)
     })
 
     test(`should accept headers with different casing`, async () => {
@@ -967,7 +1179,7 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
         body: `test`,
       })
 
-      expect([200, 204]).toContain(response.status)
+      expect(response.status).toBe(204)
     })
   })
 
@@ -1011,7 +1223,7 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
         body: `{"test": true}`,
       })
 
-      expect([200, 204]).toContain(response.status)
+      expect(response.status).toBe(204)
     })
 
     test(`should return stream content-type on GET`, async () => {
@@ -1157,1264 +1369,1623 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
       expect(text1).toBe(`hello world`)
     })
 
-    test(`should reject malformed offset (contains comma)`, async () => {
-      const streamPath = `/v1/stream/offset-comma-test-${Date.now()}`
+    test(`should accept offset=now as sentinel for current tail position`, async () => {
+      const streamPath = `/v1/stream/offset-now-sentinel-test-${Date.now()}`
 
+      // Create stream with data
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
-        body: `test`,
+        body: `historical data`,
       })
 
-      const response = await fetch(`${getBaseUrl()}${streamPath}?offset=0,1`, {
+      // Using offset=now should return empty body with tail offset
+      const response = await fetch(`${getBaseUrl()}${streamPath}?offset=now`, {
         method: `GET`,
       })
 
-      expect(response.status).toBe(400)
+      expect(response.status).toBe(200)
+      const text = await response.text()
+      expect(text).toBe(``)
+      expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`)
+      expect(response.headers.get(STREAM_OFFSET_HEADER)).toBeDefined()
     })
 
-    test(`should reject offset with spaces`, async () => {
-      const streamPath = `/v1/stream/offset-spaces-test-${Date.now()}`
+    test(`should return correct tail offset for offset=now`, async () => {
+      const streamPath = `/v1/stream/offset-now-tail-test-${Date.now()}`
 
+      // Create stream with data
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
-        body: `test`,
+        body: `initial data`,
       })
 
-      const response = await fetch(`${getBaseUrl()}${streamPath}?offset=0 1`, {
+      // Get the tail offset via normal read
+      const readResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `GET`,
       })
+      const tailOffset = readResponse.headers.get(STREAM_OFFSET_HEADER)
+      expect(tailOffset).toBeDefined()
 
-      expect(response.status).toBe(400)
+      // offset=now should return the same tail offset
+      const nowResponse = await fetch(
+        `${getBaseUrl()}${streamPath}?offset=now`,
+        {
+          method: `GET`,
+        }
+      )
+      expect(nowResponse.headers.get(STREAM_OFFSET_HEADER)).toBe(tailOffset)
     })
 
-    test(`should support resumable reads (no duplicate data)`, async () => {
-      const streamPath = `/v1/stream/resumable-test-${Date.now()}`
+    test(`should be able to resume from offset=now result`, async () => {
+      const streamPath = `/v1/stream/offset-now-resume-test-${Date.now()}`
 
-      // Create stream
+      // Create stream with historical data
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
+        body: `old data`,
       })
 
-      // Append chunk 1
-      await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `POST`,
-        headers: { "Content-Type": `text/plain` },
-        body: `chunk1`,
-      })
-
-      // Read chunk 1
-      const response1 = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `GET`,
-      })
-      const text1 = await response1.text()
-      const offset1 = response1.headers.get(STREAM_OFFSET_HEADER)
-
-      expect(text1).toBe(`chunk1`)
-      expect(offset1).toBeDefined()
+      // Get tail position via offset=now
+      const nowResponse = await fetch(
+        `${getBaseUrl()}${streamPath}?offset=now`,
+        {
+          method: `GET`,
+        }
+      )
+      const nowOffset = nowResponse.headers.get(STREAM_OFFSET_HEADER)
+      expect(nowOffset).toBeDefined()
 
-      // Append chunk 2
+      // Append new data
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `POST`,
         headers: { "Content-Type": `text/plain` },
-        body: `chunk2`,
+        body: `new data`,
       })
 
-      // Read from offset1 - should only get chunk2
-      const response2 = await fetch(
-        `${getBaseUrl()}${streamPath}?offset=${offset1}`,
+      // Resume from the offset we got - should only get new data
+      const resumeResponse = await fetch(
+        `${getBaseUrl()}${streamPath}?offset=${nowOffset}`,
         {
           method: `GET`,
         }
       )
-      const text2 = await response2.text()
-
-      expect(text2).toBe(`chunk2`)
+      const resumeText = await resumeResponse.text()
+      expect(resumeText).toBe(`new data`)
     })
 
-    test(`should return empty response when reading from tail offset`, async () => {
-      const streamPath = `/v1/stream/tail-read-test-${Date.now()}`
+    test(`should work with offset=now on empty stream`, async () => {
+      const streamPath = `/v1/stream/offset-now-empty-test-${Date.now()}`
 
-      // Create stream with data
+      // Create empty stream
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
-        body: `test`,
       })
 
-      // Read all data
-      const response1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+      // offset=now on empty stream should still return empty with offset
+      const response = await fetch(`${getBaseUrl()}${streamPath}?offset=now`, {
         method: `GET`,
       })
-      const tailOffset = response1.headers.get(STREAM_OFFSET_HEADER)
-
-      // Read from tail offset - should return empty with up-to-date
-      const response2 = await fetch(
-        `${getBaseUrl()}${streamPath}?offset=${tailOffset}`,
-        {
-          method: `GET`,
-        }
-      )
 
-      expect(response2.status).toBe(200)
-      const text = await response2.text()
+      expect(response.status).toBe(200)
+      const text = await response.text()
       expect(text).toBe(``)
-      expect(response2.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`)
+      expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`)
+      expect(response.headers.get(STREAM_OFFSET_HEADER)).toBeDefined()
     })
-  })
-
-  // ============================================================================
-  // Protocol Edge Cases
-  // ============================================================================
 
-  describe(`Protocol Edge Cases`, () => {
-    test(`should reject empty POST body with 400`, async () => {
-      const streamPath = `/v1/stream/empty-append-test-${Date.now()}`
+    test(`should return empty JSON array for offset=now on JSON streams`, async () => {
+      const streamPath = `/v1/stream/offset-now-json-body-test-${Date.now()}`
 
-      // Create stream
+      // Create JSON stream with data
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: { "Content-Type": `text/plain` },
+        headers: { "Content-Type": `application/json` },
+        body: `[{"event": "historical"}]`,
       })
 
-      // Try to append empty body - should fail
-      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `POST`,
-        headers: { "Content-Type": `text/plain` },
-        body: ``,
+      // offset=now on JSON stream should return [] (empty array), not empty string
+      const response = await fetch(`${getBaseUrl()}${streamPath}?offset=now`, {
+        method: `GET`,
       })
 
-      expect(response.status).toBe(400)
+      expect(response.status).toBe(200)
+      expect(response.headers.get(`content-type`)).toBe(`application/json`)
+      expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`)
+      expect(response.headers.get(STREAM_OFFSET_HEADER)).toBeDefined()
+
+      // Body MUST be [] for JSON streams (valid empty JSON array)
+      const body = await response.text()
+      expect(body).toBe(`[]`)
     })
 
-    test(`should handle PUT with initial body correctly`, async () => {
-      const streamPath = `/v1/stream/put-initial-body-test-${Date.now()}`
-      const initialData = `initial stream content`
+    test(`should return empty body for offset=now on non-JSON streams`, async () => {
+      const streamPath = `/v1/stream/offset-now-text-body-test-${Date.now()}`
 
-      // Create stream with initial content
-      const putResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+      // Create text stream with data
+      await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
-        body: initialData,
+        body: `historical data`,
       })
 
-      expect(putResponse.status).toBe(201)
-      const nextOffset = putResponse.headers.get(STREAM_OFFSET_HEADER)
-      expect(nextOffset).toBeDefined()
-
-      // Verify we can read the initial content
-      const getResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+      // offset=now on text stream should return empty body (0 bytes)
+      const response = await fetch(`${getBaseUrl()}${streamPath}?offset=now`, {
         method: `GET`,
       })
 
-      const text = await getResponse.text()
-      expect(text).toBe(initialData)
-      expect(getResponse.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`)
+      expect(response.status).toBe(200)
+      expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`)
+      expect(response.headers.get(STREAM_OFFSET_HEADER)).toBeDefined()
+
+      // Body MUST be empty (0 bytes) for non-JSON streams
+      const body = await response.text()
+      expect(body).toBe(``)
     })
 
-    test(`should preserve data immutability by position`, async () => {
-      const streamPath = `/v1/stream/immutability-test-${Date.now()}`
+    test(`should support offset=now with long-poll mode (waits for data)`, async () => {
+      const streamPath = `/v1/stream/offset-now-longpoll-test-${Date.now()}`
 
-      // Create and append first chunk
+      // Create stream with data
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
-        body: `chunk1`,
-      })
-
-      // Read and save the offset after chunk1
-      const response1 = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `GET`,
-      })
-      const text1 = await response1.text()
-      const offset1 = response1.headers.get(STREAM_OFFSET_HEADER)
-      expect(text1).toBe(`chunk1`)
-
-      // Append more chunks
-      await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `POST`,
-        headers: { "Content-Type": `text/plain` },
-        body: `chunk2`,
+        body: `existing data`,
       })
 
-      await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `POST`,
-        headers: { "Content-Type": `text/plain` },
-        body: `chunk3`,
-      })
+      // Get tail offset first
+      const readRes = await fetch(`${getBaseUrl()}${streamPath}`)
+      const tailOffset = readRes.headers.get(STREAM_OFFSET_HEADER)
 
-      // Read from the saved offset - should still get chunk2 (position is immutable)
-      const response2 = await fetch(
-        `${getBaseUrl()}${streamPath}?offset=${offset1}`,
+      // offset=now with long-poll should immediately start waiting for new data
+      // Since we don't append anything, it should timeout with 204
+      const response = await fetch(
+        `${getBaseUrl()}${streamPath}?offset=now&live=long-poll`,
         {
           method: `GET`,
         }
       )
-      const text2 = await response2.text()
-      expect(text2).toBe(`chunk2chunk3`)
+
+      // Should get 204 timeout (server waited for data but none arrived)
+      expect(response.status).toBe(204)
+      expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`)
+      // Should return the tail offset
+      expect(response.headers.get(STREAM_OFFSET_HEADER)).toBe(tailOffset)
     })
 
-    test(`should generate unique, monotonically increasing offsets`, async () => {
-      const streamPath = `/v1/stream/monotonic-offset-test-${Date.now()}`
+    test(`should receive data with offset=now long-poll when appended`, async () => {
+      const streamPath = `/v1/stream/offset-now-longpoll-data-test-${Date.now()}`
 
-      // Create stream
+      // Create stream with historical data
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
+        body: `historical`,
       })
 
-      const offsets: Array<string> = []
+      // Start long-poll with offset=now (will wait for new data)
+      const longPollPromise = fetch(
+        `${getBaseUrl()}${streamPath}?offset=now&live=long-poll`,
+        { method: `GET` }
+      )
 
-      // Append multiple chunks and collect offsets
-      for (let i = 0; i < 5; i++) {
-        const response = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `POST`,
-          headers: { "Content-Type": `text/plain` },
-          body: `chunk${i}`,
-        })
+      // Give the long-poll a moment to start waiting
+      await new Promise((r) => setTimeout(r, 100))
 
-        const offset = response.headers.get(STREAM_OFFSET_HEADER)
-        expect(offset).toBeDefined()
-        offsets.push(offset!)
-      }
+      // Append new data while long-poll is waiting
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: { "Content-Type": `text/plain` },
+        body: `new data`,
+      })
 
-      // Verify offsets are unique and strictly increasing (lexicographically)
-      for (let i = 1; i < offsets.length; i++) {
-        expect(offsets[i]! > offsets[i - 1]!).toBe(true)
-      }
+      // Long-poll should return with the new data (not historical)
+      const response = await longPollPromise
+      expect(response.status).toBe(200)
+      const text = await response.text()
+      expect(text).toBe(`new data`)
+      expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`)
     })
 
-    test(`should reject empty offset parameter`, async () => {
-      const streamPath = `/v1/stream/empty-offset-test-${Date.now()}`
+    test(`should support offset=now with SSE mode`, async () => {
+      const streamPath = `/v1/stream/offset-now-sse-test-${Date.now()}`
 
+      // Create stream with data
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
-        body: `test`,
+        body: `existing data`,
       })
 
-      const response = await fetch(`${getBaseUrl()}${streamPath}?offset=`, {
+      // Get tail offset first
+      const readResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `GET`,
       })
+      const tailOffset = readResponse.headers.get(STREAM_OFFSET_HEADER)
 
-      expect(response.status).toBe(400)
+      // offset=now with SSE should work and provide correct offset in control event
+      const { response, received } = await fetchSSE(
+        `${getBaseUrl()}${streamPath}?offset=now&live=sse`,
+        { untilContent: `"upToDate"` }
+      )
+
+      expect(response.status).toBe(200)
+
+      // Should have control event with upToDate:true and streamNextOffset
+      const controlMatch = received.match(
+        /event: control\s*\n\s*data: ({[^}]+})/
+      )
+      expect(controlMatch).toBeDefined()
+      if (controlMatch && controlMatch[1]) {
+        const controlData = JSON.parse(controlMatch[1])
+        expect(controlData[`upToDate`]).toBe(true)
+        expect(controlData[`streamNextOffset`]).toBe(tailOffset)
+      }
     })
 
-    test(`should reject multiple offset parameters`, async () => {
-      const streamPath = `/v1/stream/multi-offset-test-${Date.now()}`
+    test(`should return 404 for offset=now on non-existent stream`, async () => {
+      const streamPath = `/v1/stream/offset-now-404-test-${Date.now()}`
 
-      await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `PUT`,
-        headers: { "Content-Type": `text/plain` },
-        body: `test`,
+      const response = await fetch(`${getBaseUrl()}${streamPath}?offset=now`, {
+        method: `GET`,
       })
 
+      expect(response.status).toBe(404)
+    })
+
+    test(`should return 404 for offset=now with long-poll on non-existent stream`, async () => {
+      const streamPath = `/v1/stream/offset-now-longpoll-404-test-${Date.now()}`
+
       const response = await fetch(
-        `${getBaseUrl()}${streamPath}?offset=a&offset=b`,
-        {
-          method: `GET`,
-        }
+        `${getBaseUrl()}${streamPath}?offset=now&live=long-poll`,
+        { method: `GET` }
       )
 
-      expect(response.status).toBe(400)
+      expect(response.status).toBe(404)
     })
 
-    test(`should enforce case-sensitive seq ordering`, async () => {
-      const streamPath = `/v1/stream/case-seq-test-${Date.now()}`
+    test(`should return 404 for offset=now with SSE on non-existent stream`, async () => {
+      const streamPath = `/v1/stream/offset-now-sse-404-test-${Date.now()}`
 
+      const response = await fetch(
+        `${getBaseUrl()}${streamPath}?offset=now&live=sse`,
+        { method: `GET` }
+      )
+
+      expect(response.status).toBe(404)
+    })
+
+    test(`should support offset=now with long-poll on empty stream`, async () => {
+      const streamPath = `/v1/stream/offset-now-empty-longpoll-test-${Date.now()}`
+
+      // Create empty stream
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
       })
 
-      // Append with seq "a" (lowercase)
-      await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `POST`,
-        headers: {
-          "Content-Type": `text/plain`,
-          [STREAM_SEQ_HEADER]: `a`,
-        },
-        body: `first`,
-      })
+      // offset=now with long-poll on empty stream should timeout with 204
+      const response = await fetch(
+        `${getBaseUrl()}${streamPath}?offset=now&live=long-poll`,
+        { method: `GET` }
+      )
 
-      // Try to append with seq "B" (uppercase) - should fail
-      // Lexicographically: "B" < "a" in byte order (uppercase comes before lowercase in ASCII)
-      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+      expect(response.status).toBe(204)
+      expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`)
+      // Should return a valid offset that can be used to resume
+      const offset = response.headers.get(STREAM_OFFSET_HEADER)
+      expect(offset).toBeDefined()
+
+      // Verify the offset works for future data
+      await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `POST`,
-        headers: {
-          "Content-Type": `text/plain`,
-          [STREAM_SEQ_HEADER]: `B`,
-        },
-        body: `second`,
+        headers: { "Content-Type": `text/plain` },
+        body: `first data`,
       })
 
-      expect(response.status).toBe(409)
+      const resumeResponse = await fetch(
+        `${getBaseUrl()}${streamPath}?offset=${offset}`,
+        { method: `GET` }
+      )
+      expect(resumeResponse.status).toBe(200)
+      const resumeText = await resumeResponse.text()
+      expect(resumeText).toBe(`first data`)
     })
 
-    test(`should handle binary data with integrity`, async () => {
-      const streamPath = `/v1/stream/binary-test-${Date.now()}`
-
-      // Create binary stream with various byte values including 0x00 and 0xFF
-      const binaryData = new Uint8Array([
-        0x00, 0x01, 0x02, 0x7f, 0x80, 0xfe, 0xff,
-      ])
+    test(`should support offset=now with SSE on empty stream`, async () => {
+      const streamPath = `/v1/stream/offset-now-empty-sse-test-${Date.now()}`
 
+      // Create empty stream
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: { "Content-Type": `application/octet-stream` },
-        body: binaryData,
+        headers: { "Content-Type": `text/plain` },
       })
 
-      // Read back and verify byte-for-byte
-      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `GET`,
-      })
+      // offset=now with SSE on empty stream should return upToDate:true with valid offset
+      const { response, received } = await fetchSSE(
+        `${getBaseUrl()}${streamPath}?offset=now&live=sse`,
+        { untilContent: `"upToDate"` }
+      )
 
-      const buffer = await response.arrayBuffer()
-      const result = new Uint8Array(buffer)
+      expect(response.status).toBe(200)
 
-      expect(result.length).toBe(binaryData.length)
-      for (let i = 0; i < binaryData.length; i++) {
-        expect(result[i]).toBe(binaryData[i])
+      // Should have control event with upToDate:true and streamNextOffset
+      const controlMatch = received.match(
+        /event: control\s*\n\s*data: ({[^}]+})/
+      )
+      expect(controlMatch).toBeDefined()
+      if (controlMatch && controlMatch[1]) {
+        const controlData = JSON.parse(controlMatch[1])
+        expect(controlData[`upToDate`]).toBe(true)
+        // Should have a valid offset even on empty stream
+        expect(controlData[`streamNextOffset`]).toBeDefined()
       }
     })
 
-    test(`should return Location header on 201`, async () => {
-      const streamPath = `/v1/stream/location-test-${Date.now()}`
+    test(`should reject malformed offset (contains comma)`, async () => {
+      const streamPath = `/v1/stream/offset-comma-test-${Date.now()}`
 
-      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+      await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
+        body: `test`,
       })
 
-      expect(response.status).toBe(201)
-      const location = response.headers.get(`location`)
-      expect(location).toBeDefined()
-      expect(location).toBe(`${getBaseUrl()}${streamPath}`)
+      const response = await fetch(`${getBaseUrl()}${streamPath}?offset=0,1`, {
+        method: `GET`,
+      })
+
+      expect(response.status).toBe(400)
     })
 
-    test(`should reject missing Content-Type on POST`, async () => {
-      const streamPath = `/v1/stream/missing-ct-post-test-${Date.now()}`
+    test(`should reject offset with spaces`, async () => {
+      const streamPath = `/v1/stream/offset-spaces-test-${Date.now()}`
 
-      // Create stream
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
+        body: `test`,
       })
 
-      // Try to append without Content-Type - should fail
-      // Note: fetch will try to detect the Content-Type based on the body.
-      // Blob with an explicit empty type results in the header being omitted.
-      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `POST`,
-        body: new Blob([`data`], { type: `` }),
+      const response = await fetch(`${getBaseUrl()}${streamPath}?offset=0 1`, {
+        method: `GET`,
       })
 
       expect(response.status).toBe(400)
     })
 
-    test(`should accept PUT without Content-Type (use default)`, async () => {
-      const streamPath = `/v1/stream/no-ct-put-test-${Date.now()}`
+    test(`should support resumable reads (no duplicate data)`, async () => {
+      const streamPath = `/v1/stream/resumable-test-${Date.now()}`
 
-      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
       })
 
-      expect([200, 201]).toContain(response.status)
-      const contentType = response.headers.get(`content-type`)
-      expect(contentType).toBeDefined()
-    })
+      // Append chunk 1
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: { "Content-Type": `text/plain` },
+        body: `chunk1`,
+      })
 
-    test(`should ignore unknown query parameters`, async () => {
-      const streamPath = `/v1/stream/unknown-param-test-${Date.now()}`
+      // Read chunk 1
+      const response1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+      })
+      const text1 = await response1.text()
+      const offset1 = response1.headers.get(STREAM_OFFSET_HEADER)
+
+      expect(text1).toBe(`chunk1`)
+      expect(offset1).toBeDefined()
 
+      // Append chunk 2
       await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `PUT`,
+        method: `POST`,
         headers: { "Content-Type": `text/plain` },
-        body: `test data`,
+        body: `chunk2`,
       })
 
-      // Should work fine with unknown params (use -1 to start from beginning)
-      const response = await fetch(
-        `${getBaseUrl()}${streamPath}?offset=-1&foo=bar&baz=qux`,
+      // Read from offset1 - should only get chunk2
+      const response2 = await fetch(
+        `${getBaseUrl()}${streamPath}?offset=${offset1}`,
         {
           method: `GET`,
         }
       )
+      const text2 = await response2.text()
 
-      expect(response.status).toBe(200)
-      const text = await response.text()
-      expect(text).toBe(`test data`)
+      expect(text2).toBe(`chunk2`)
     })
-  })
-
-  // ============================================================================
-  // Long-Poll Edge Cases
-  // ============================================================================
 
-  describe(`Long-Poll Edge Cases`, () => {
-    test(`should require offset parameter for long-poll`, async () => {
-      const streamPath = `/v1/stream/longpoll-no-offset-test-${Date.now()}`
+    test(`should return empty response when reading from tail offset`, async () => {
+      const streamPath = `/v1/stream/tail-read-test-${Date.now()}`
 
+      // Create stream with data
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
+        body: `test`,
       })
 
-      // Try long-poll without offset - protocol says offset MUST be provided
-      const response = await fetch(
-        `${getBaseUrl()}${streamPath}?live=long-poll`,
+      // Read all data
+      const response1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+      })
+      const tailOffset = response1.headers.get(STREAM_OFFSET_HEADER)
+
+      // Read from tail offset - should return empty with up-to-date
+      const response2 = await fetch(
+        `${getBaseUrl()}${streamPath}?offset=${tailOffset}`,
         {
           method: `GET`,
         }
       )
 
-      expect(response.status).toBe(400)
+      expect(response2.status).toBe(200)
+      const text = await response2.text()
+      expect(text).toBe(``)
+      expect(response2.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`)
     })
+  })
 
-    test(`should generate Stream-Cursor header on long-poll responses`, async () => {
-      const streamPath = `/v1/stream/longpoll-cursor-gen-test-${Date.now()}`
+  // ============================================================================
+  // Protocol Edge Cases
+  // ============================================================================
+
+  describe(`Protocol Edge Cases`, () => {
+    test(`should reject empty POST body with 400`, async () => {
+      const streamPath = `/v1/stream/empty-append-test-${Date.now()}`
 
+      // Create stream
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
-        body: `test data`,
       })
 
-      // Long-poll request without cursor - server MUST generate one
-      const response = await fetch(
-        `${getBaseUrl()}${streamPath}?offset=-1&live=long-poll`,
-        {
-          method: `GET`,
-        }
-      )
+      // Try to append empty body - should fail
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: { "Content-Type": `text/plain` },
+        body: ``,
+      })
 
-      expect(response.status).toBe(200)
+      expect(response.status).toBe(400)
+    })
 
-      // Server MUST return a Stream-Cursor header
-      const cursor = response.headers.get(`Stream-Cursor`)
-      expect(cursor).toBeDefined()
-      expect(cursor).not.toBeNull()
+    test(`should handle PUT with initial body correctly`, async () => {
+      const streamPath = `/v1/stream/put-initial-body-test-${Date.now()}`
+      const initialData = `initial stream content`
 
-      // Cursor must be a numeric string (interval number)
-      expect(/^\d+$/.test(cursor!)).toBe(true)
+      // Create stream with initial content
+      const putResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+        body: initialData,
+      })
+
+      expect(putResponse.status).toBe(201)
+      const nextOffset = putResponse.headers.get(STREAM_OFFSET_HEADER)
+      expect(nextOffset).toBeDefined()
+
+      // Verify we can read the initial content
+      const getResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+      })
+
+      const text = await getResponse.text()
+      expect(text).toBe(initialData)
+      expect(getResponse.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`)
     })
 
-    test(`should echo cursor and handle collision with jitter`, async () => {
-      const streamPath = `/v1/stream/longpoll-cursor-collision-test-${Date.now()}`
+    test(`should preserve data immutability by position`, async () => {
+      const streamPath = `/v1/stream/immutability-test-${Date.now()}`
 
+      // Create and append first chunk
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
-        body: `test data`,
+        body: `chunk1`,
       })
 
-      // First request to get current cursor
-      const response1 = await fetch(
-        `${getBaseUrl()}${streamPath}?offset=-1&live=long-poll`,
-        {
-          method: `GET`,
-        }
-      )
+      // Read and save the offset after chunk1
+      const response1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+      })
+      const text1 = await response1.text()
+      const offset1 = response1.headers.get(STREAM_OFFSET_HEADER)
+      expect(text1).toBe(`chunk1`)
 
-      expect(response1.status).toBe(200)
-      const cursor1 = response1.headers.get(`Stream-Cursor`)
-      expect(cursor1).toBeDefined()
+      // Append more chunks
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: { "Content-Type": `text/plain` },
+        body: `chunk2`,
+      })
 
-      // Immediate second request with same cursor - should get advanced cursor due to collision
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: { "Content-Type": `text/plain` },
+        body: `chunk3`,
+      })
+
+      // Read from the saved offset - should still get chunk2 (position is immutable)
       const response2 = await fetch(
-        `${getBaseUrl()}${streamPath}?offset=-1&live=long-poll&cursor=${cursor1}`,
+        `${getBaseUrl()}${streamPath}?offset=${offset1}`,
         {
           method: `GET`,
         }
       )
+      const text2 = await response2.text()
+      expect(text2).toBe(`chunk2chunk3`)
+    })
 
-      expect(response2.status).toBe(200)
-      const cursor2 = response2.headers.get(`Stream-Cursor`)
-      expect(cursor2).toBeDefined()
+    test(`should generate unique, monotonically increasing offsets`, async () => {
+      const streamPath = `/v1/stream/monotonic-offset-test-${Date.now()}`
 
-      // The returned cursor MUST be strictly greater than the one we sent
-      // (monotonic progression prevents cache cycles)
-      expect(parseInt(cursor2!, 10)).toBeGreaterThan(parseInt(cursor1!, 10))
-    })
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
 
-    test(
-      `should return Stream-Cursor, Stream-Up-To-Date and Stream-Next-Offset on 204 timeout`,
-      async () => {
-        const streamPath = `/v1/stream/longpoll-204-headers-test-${Date.now()}`
+      const offsets: Array<string> = []
 
-        await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `PUT`,
+      // Append multiple chunks and collect offsets
+      for (let i = 0; i < 5; i++) {
+        const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `POST`,
           headers: { "Content-Type": `text/plain` },
+          body: `chunk${i}`,
         })
 
-        // Get the current tail offset
-        const headResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `HEAD`,
-        })
-        const tailOffset = headResponse.headers.get(STREAM_OFFSET_HEADER)
-        expect(tailOffset).toBeDefined()
-
-        // Long-poll at tail offset with a short timeout
-        // We use AbortController to limit wait time on our side
-        const controller = new AbortController()
-        const timeoutId = setTimeout(() => controller.abort(), 5000)
-
-        try {
-          const response = await fetch(
-            `${getBaseUrl()}${streamPath}?offset=${tailOffset}&live=long-poll`,
-            {
-              method: `GET`,
-              signal: controller.signal,
-            }
-          )
-
-          clearTimeout(timeoutId)
-
-          // If we get a 204, verify headers
-          if (response.status === 204) {
-            expect(response.headers.get(STREAM_OFFSET_HEADER)).toBeDefined()
-            expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`)
-
-            // Server MUST return Stream-Cursor even on 204 timeout
-            const cursor = response.headers.get(`Stream-Cursor`)
-            expect(cursor).toBeDefined()
-            expect(/^\d+$/.test(cursor!)).toBe(true)
-          }
-          // If we get a 200 (data arrived somehow), that's also valid
-          expect([200, 204]).toContain(response.status)
-        } catch (e) {
-          clearTimeout(timeoutId)
-          // AbortError is expected if server timeout is longer than our 5s
-          if (e instanceof Error && e.name !== `AbortError`) {
-            throw e
-          }
-          // Test passes - server just has a longer timeout than our abort
-        }
-      },
-      getLongPollTestTimeoutMs()
-    )
-  })
+        const offset = response.headers.get(STREAM_OFFSET_HEADER)
+        expect(offset).toBeDefined()
+        offsets.push(offset!)
+      }
 
-  // ============================================================================
-  // TTL and Expiry Edge Cases
-  // ============================================================================
+      // Verify offsets are unique and strictly increasing (lexicographically)
+      for (let i = 1; i < offsets.length; i++) {
+        expect(offsets[i]! > offsets[i - 1]!).toBe(true)
+      }
+    })
 
-  describe(`TTL and Expiry Edge Cases`, () => {
-    test(`should reject TTL with leading zeros`, async () => {
-      const streamPath = `/v1/stream/ttl-leading-zeros-test-${Date.now()}`
+    test(`should reject empty offset parameter`, async () => {
+      const streamPath = `/v1/stream/empty-offset-test-${Date.now()}`
 
-      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+      await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: {
-          "Content-Type": `text/plain`,
-          "Stream-TTL": `00060`,
-        },
+        headers: { "Content-Type": `text/plain` },
+        body: `test`,
+      })
+
+      const response = await fetch(`${getBaseUrl()}${streamPath}?offset=`, {
+        method: `GET`,
       })
 
       expect(response.status).toBe(400)
     })
 
-    test(`should reject TTL with plus sign`, async () => {
-      const streamPath = `/v1/stream/ttl-plus-test-${Date.now()}`
+    test(`should reject multiple offset parameters`, async () => {
+      const streamPath = `/v1/stream/multi-offset-test-${Date.now()}`
 
-      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+      await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: {
-          "Content-Type": `text/plain`,
-          "Stream-TTL": `+60`,
-        },
+        headers: { "Content-Type": `text/plain` },
+        body: `test`,
       })
 
+      const response = await fetch(
+        `${getBaseUrl()}${streamPath}?offset=a&offset=b`,
+        {
+          method: `GET`,
+        }
+      )
+
       expect(response.status).toBe(400)
     })
 
-    test(`should reject TTL with float value`, async () => {
-      const streamPath = `/v1/stream/ttl-float-test-${Date.now()}`
+    test(`should enforce case-sensitive seq ordering`, async () => {
+      const streamPath = `/v1/stream/case-seq-test-${Date.now()}`
 
-      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+      await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Append with seq "a" (lowercase)
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
         headers: {
           "Content-Type": `text/plain`,
-          "Stream-TTL": `60.5`,
+          [STREAM_SEQ_HEADER]: `a`,
         },
+        body: `first`,
       })
 
-      expect(response.status).toBe(400)
-    })
-
-    test(`should reject TTL with scientific notation`, async () => {
-      const streamPath = `/v1/stream/ttl-scientific-test-${Date.now()}`
-
+      // Try to append with seq "B" (uppercase) - should fail
+      // Lexicographically: "B" < "a" in byte order (uppercase comes before lowercase in ASCII)
       const response = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `PUT`,
+        method: `POST`,
         headers: {
           "Content-Type": `text/plain`,
-          "Stream-TTL": `1e3`,
+          [STREAM_SEQ_HEADER]: `B`,
         },
+        body: `second`,
       })
 
-      expect(response.status).toBe(400)
+      expect(response.status).toBe(409)
     })
 
-    test(`should reject invalid Expires-At timestamp`, async () => {
-      const streamPath = `/v1/stream/expires-invalid-test-${Date.now()}`
+    test(`should handle binary data with integrity`, async () => {
+      const streamPath = `/v1/stream/binary-test-${Date.now()}`
 
-      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+      // Create binary stream with various byte values including 0x00 and 0xFF
+      const binaryData = new Uint8Array([
+        0x00, 0x01, 0x02, 0x7f, 0x80, 0xfe, 0xff,
+      ])
+
+      await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: {
-          "Content-Type": `text/plain`,
-          "Stream-Expires-At": `not-a-timestamp`,
-        },
+        headers: { "Content-Type": `application/octet-stream` },
+        body: binaryData,
       })
 
-      expect(response.status).toBe(400)
-    })
+      // Read back and verify byte-for-byte
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+      })
 
-    test(`should accept Expires-At with Z timezone`, async () => {
-      const streamPath = `/v1/stream/expires-z-test-${Date.now()}`
+      const buffer = await response.arrayBuffer()
+      const result = new Uint8Array(buffer)
 
-      const expiresAt = new Date(Date.now() + 3600000).toISOString()
+      expect(result.length).toBe(binaryData.length)
+      for (let i = 0; i < binaryData.length; i++) {
+        expect(result[i]).toBe(binaryData[i])
+      }
+    })
+
+    test(`should return Location header on 201`, async () => {
+      const streamPath = `/v1/stream/location-test-${Date.now()}`
 
       const response = await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: {
-          "Content-Type": `text/plain`,
-          "Stream-Expires-At": expiresAt,
-        },
+        headers: { "Content-Type": `text/plain` },
       })
 
-      expect([200, 201]).toContain(response.status)
+      expect(response.status).toBe(201)
+      const location = response.headers.get(`location`)
+      expect(location).toBeDefined()
+      // Check that Location contains the correct path (host may vary by server config)
+      expect(location!.endsWith(streamPath)).toBe(true)
+      // Verify it's a valid absolute URL
+      expect(() => new URL(location!)).not.toThrow()
     })
 
-    test(`should accept Expires-At with timezone offset`, async () => {
-      const streamPath = `/v1/stream/expires-offset-test-${Date.now()}`
+    test(`should reject missing Content-Type on POST`, async () => {
+      const streamPath = `/v1/stream/missing-ct-post-test-${Date.now()}`
 
-      // RFC3339 with timezone offset
-      const date = new Date(Date.now() + 3600000)
-      const expiresAt = date.toISOString().replace(`Z`, `+00:00`)
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
 
+      // Try to append without Content-Type - should fail
+      // Note: fetch will try to detect the Content-Type based on the body.
+      // Blob with an explicit empty type results in the header being omitted.
       const response = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `PUT`,
-        headers: {
-          "Content-Type": `text/plain`,
-          "Stream-Expires-At": expiresAt,
-        },
+        method: `POST`,
+        body: new Blob([`data`], { type: `` }),
       })
 
-      expect([200, 201]).toContain(response.status)
+      expect(response.status).toBe(400)
     })
 
-    test(`should handle idempotent PUT with same TTL`, async () => {
-      const streamPath = `/v1/stream/ttl-idempotent-test-${Date.now()}`
+    test(`should accept PUT without Content-Type (use default)`, async () => {
+      const streamPath = `/v1/stream/no-ct-put-test-${Date.now()}`
 
-      // Create with TTL
-      const response1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: {
-          "Content-Type": `text/plain`,
-          "Stream-TTL": `3600`,
-        },
       })
-      expect(response1.status).toBe(201)
 
-      // PUT again with same TTL - should be idempotent
-      const response2 = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `PUT`,
-        headers: {
-          "Content-Type": `text/plain`,
-          "Stream-TTL": `3600`,
-        },
-      })
-      expect([200, 204]).toContain(response2.status)
+      expect([200, 201]).toContain(response.status)
+      const contentType = response.headers.get(`content-type`)
+      expect(contentType).toBeDefined()
     })
 
-    test(`should reject idempotent PUT with different TTL`, async () => {
-      const streamPath = `/v1/stream/ttl-conflict-test-${Date.now()}`
+    test(`should ignore unknown query parameters`, async () => {
+      const streamPath = `/v1/stream/unknown-param-test-${Date.now()}`
 
-      // Create with TTL=3600
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: {
-          "Content-Type": `text/plain`,
-          "Stream-TTL": `3600`,
-        },
+        headers: { "Content-Type": `text/plain` },
+        body: `test data`,
       })
 
-      // PUT again with different TTL - should fail
-      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `PUT`,
-        headers: {
-          "Content-Type": `text/plain`,
-          "Stream-TTL": `7200`,
-        },
-      })
+      // Should work fine with unknown params (use -1 to start from beginning)
+      const response = await fetch(
+        `${getBaseUrl()}${streamPath}?offset=-1&foo=bar&baz=qux`,
+        {
+          method: `GET`,
+        }
+      )
 
-      expect(response.status).toBe(409)
+      expect(response.status).toBe(200)
+      const text = await response.text()
+      expect(text).toBe(`test data`)
     })
   })
 
   // ============================================================================
-  // HEAD Metadata Edge Cases
+  // Long-Poll Edge Cases
   // ============================================================================
 
-  describe(`HEAD Metadata Edge Cases`, () => {
-    test(`should return TTL metadata if configured`, async () => {
-      const streamPath = `/v1/stream/head-ttl-metadata-test-${Date.now()}`
+  describe(`Long-Poll Edge Cases`, () => {
+    test(`should require offset parameter for long-poll`, async () => {
+      const streamPath = `/v1/stream/longpoll-no-offset-test-${Date.now()}`
 
-      // Create with TTL
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: {
-          "Content-Type": `text/plain`,
-          "Stream-TTL": `3600`,
-        },
+        headers: { "Content-Type": `text/plain` },
       })
 
-      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `HEAD`,
-      })
+      // Try long-poll without offset - protocol says offset MUST be provided
+      const response = await fetch(
+        `${getBaseUrl()}${streamPath}?live=long-poll`,
+        {
+          method: `GET`,
+        }
+      )
 
-      // SHOULD return TTL metadata
-      const ttl = response.headers.get(`Stream-TTL`)
-      if (ttl) {
-        expect(parseInt(ttl)).toBeGreaterThan(0)
-        expect(parseInt(ttl)).toBeLessThanOrEqual(3600)
-      }
+      expect(response.status).toBe(400)
     })
 
-    test(`should return Expires-At metadata if configured`, async () => {
-      const streamPath = `/v1/stream/head-expires-metadata-test-${Date.now()}`
-
-      const expiresAt = new Date(Date.now() + 3600000).toISOString()
+    test(`should generate Stream-Cursor header on long-poll responses`, async () => {
+      const streamPath = `/v1/stream/longpoll-cursor-gen-test-${Date.now()}`
 
-      // Create with Expires-At
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: {
-          "Content-Type": `text/plain`,
-          "Stream-Expires-At": expiresAt,
-        },
-      })
-
-      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `HEAD`,
+        headers: { "Content-Type": `text/plain` },
+        body: `test data`,
       })
 
-      // SHOULD return Expires-At metadata
-      const expiresHeader = response.headers.get(`Stream-Expires-At`)
-      if (expiresHeader) {
-        expect(expiresHeader).toBeDefined()
-      }
-    })
-  })
-
-  // ============================================================================
-  // TTL Expiration Behavior Tests
-  // ============================================================================
-
-  describe(`TTL Expiration Behavior`, () => {
-    // Helper function to wait for a specified duration
-    const sleep = (ms: number) =>
-      new Promise((resolve) => setTimeout(resolve, ms))
-
-    // Helper to generate unique stream paths for concurrent tests
-    const uniquePath = (prefix: string) =>
-      `/v1/stream/${prefix}-${Date.now()}-${Math.random().toString(36).slice(2)}`
-
-    // Run tests concurrently to avoid 6x 1.5s wait time
-    test.concurrent(`should return 404 on HEAD after TTL expires`, async () => {
-      const streamPath = uniquePath(`ttl-expire-head`)
-
-      // Create stream with 1 second TTL
-      const createResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `PUT`,
-        headers: {
-          "Content-Type": `text/plain`,
-          "Stream-TTL": `1`,
-        },
-      })
-      expect(createResponse.status).toBe(201)
+      // Long-poll request without cursor - server MUST generate one
+      const response = await fetch(
+        `${getBaseUrl()}${streamPath}?offset=-1&live=long-poll`,
+        {
+          method: `GET`,
+        }
+      )
 
-      // Verify stream exists immediately
-      const headBefore = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `HEAD`,
-      })
-      expect(headBefore.status).toBe(200)
+      expect(response.status).toBe(200)
 
-      // Wait for TTL to expire (1 second + buffer)
-      await sleep(1500)
+      // Server MUST return a Stream-Cursor header
+      const cursor = response.headers.get(`Stream-Cursor`)
+      expect(cursor).toBeDefined()
+      expect(cursor).not.toBeNull()
 
-      // Stream should no longer exist
-      const headAfter = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `HEAD`,
-      })
-      expect(headAfter.status).toBe(404)
+      // Cursor must be a numeric string (interval number)
+      expect(/^\d+$/.test(cursor!)).toBe(true)
     })
 
-    test.concurrent(`should return 404 on GET after TTL expires`, async () => {
-      const streamPath = uniquePath(`ttl-expire-get`)
+    test(`should echo cursor and handle collision with jitter`, async () => {
+      const streamPath = `/v1/stream/longpoll-cursor-collision-test-${Date.now()}`
 
-      // Create stream with 1 second TTL and some data
-      const createResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+      await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: {
-          "Content-Type": `text/plain`,
-          "Stream-TTL": `1`,
-        },
+        headers: { "Content-Type": `text/plain` },
         body: `test data`,
       })
-      expect(createResponse.status).toBe(201)
 
-      // Verify stream is readable immediately
-      const getBefore = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `GET`,
-      })
-      expect(getBefore.status).toBe(200)
+      // First request to get current cursor
+      const response1 = await fetch(
+        `${getBaseUrl()}${streamPath}?offset=-1&live=long-poll`,
+        {
+          method: `GET`,
+        }
+      )
 
-      // Wait for TTL to expire
-      await sleep(1500)
+      expect(response1.status).toBe(200)
+      const cursor1 = response1.headers.get(`Stream-Cursor`)
+      expect(cursor1).toBeDefined()
 
-      // Stream should no longer exist
-      const getAfter = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `GET`,
-      })
-      expect(getAfter.status).toBe(404)
+      // Immediate second request with same cursor - should get advanced cursor due to collision
+      const response2 = await fetch(
+        `${getBaseUrl()}${streamPath}?offset=-1&live=long-poll&cursor=${cursor1}`,
+        {
+          method: `GET`,
+        }
+      )
+
+      expect(response2.status).toBe(200)
+      const cursor2 = response2.headers.get(`Stream-Cursor`)
+      expect(cursor2).toBeDefined()
+
+      // The returned cursor MUST be strictly greater than the one we sent
+      // (monotonic progression prevents cache cycles)
+      expect(parseInt(cursor2!, 10)).toBeGreaterThan(parseInt(cursor1!, 10))
     })
 
-    test.concurrent(
-      `should return 404 on POST append after TTL expires`,
+    test(
+      `should return Stream-Cursor, Stream-Up-To-Date and Stream-Next-Offset on 204 timeout`,
       async () => {
-        const streamPath = uniquePath(`ttl-expire-post`)
+        const streamPath = `/v1/stream/longpoll-204-headers-test-${Date.now()}`
 
-        // Create stream with 1 second TTL
-        const createResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+        await fetch(`${getBaseUrl()}${streamPath}`, {
           method: `PUT`,
-          headers: {
-            "Content-Type": `text/plain`,
-            "Stream-TTL": `1`,
-          },
-        })
-        expect(createResponse.status).toBe(201)
-
-        // Verify append works immediately
-        const postBefore = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `POST`,
           headers: { "Content-Type": `text/plain` },
-          body: `appended data`,
         })
-        expect([200, 204]).toContain(postBefore.status)
-
-        // Wait for TTL to expire
-        await sleep(1500)
 
-        // Append should fail - stream no longer exists
-        const postAfter = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `POST`,
-          headers: { "Content-Type": `text/plain` },
-          body: `more data`,
+        // Get the current tail offset
+        const headResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `HEAD`,
         })
-        expect(postAfter.status).toBe(404)
-      }
-    )
+        const tailOffset = headResponse.headers.get(STREAM_OFFSET_HEADER)
+        expect(tailOffset).toBeDefined()
 
-    test.concurrent(
-      `should return 404 on HEAD after Expires-At passes`,
-      async () => {
-        const streamPath = uniquePath(`expires-at-head`)
+        // Long-poll at tail offset with a short timeout
+        // We use AbortController to limit wait time on our side
+        const controller = new AbortController()
+        const timeoutId = setTimeout(() => controller.abort(), 5000)
 
-        // Create stream that expires in 1 second
-        const expiresAt = new Date(Date.now() + 1000).toISOString()
-        const createResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `PUT`,
-          headers: {
-            "Content-Type": `text/plain`,
-            "Stream-Expires-At": expiresAt,
-          },
-        })
-        expect(createResponse.status).toBe(201)
+        try {
+          const response = await fetch(
+            `${getBaseUrl()}${streamPath}?offset=${tailOffset}&live=long-poll`,
+            {
+              method: `GET`,
+              signal: controller.signal,
+            }
+          )
 
-        // Verify stream exists immediately
-        const headBefore = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `HEAD`,
-        })
-        expect(headBefore.status).toBe(200)
+          clearTimeout(timeoutId)
 
-        // Wait for expiry time to pass
-        await sleep(1500)
+          // If we get a 204, verify headers
+          if (response.status === 204) {
+            expect(response.headers.get(STREAM_OFFSET_HEADER)).toBeDefined()
+            expect(response.headers.get(STREAM_UP_TO_DATE_HEADER)).toBe(`true`)
 
-        // Stream should no longer exist
-        const headAfter = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `HEAD`,
-        })
-        expect(headAfter.status).toBe(404)
-      }
+            // Server MUST return Stream-Cursor even on 204 timeout
+            const cursor = response.headers.get(`Stream-Cursor`)
+            expect(cursor).toBeDefined()
+            expect(/^\d+$/.test(cursor!)).toBe(true)
+          }
+          // If we get a 200 (data arrived somehow), that's also valid
+          expect([200, 204]).toContain(response.status)
+        } catch (e) {
+          clearTimeout(timeoutId)
+          // AbortError is expected if server timeout is longer than our 5s
+          if (e instanceof Error && e.name !== `AbortError`) {
+            throw e
+          }
+          // Test passes - server just has a longer timeout than our abort
+        }
+      },
+      getLongPollTestTimeoutMs()
     )
+  })
 
-    test.concurrent(
-      `should return 404 on GET after Expires-At passes`,
-      async () => {
-        const streamPath = uniquePath(`expires-at-get`)
+  // ============================================================================
+  // TTL and Expiry Edge Cases
+  // ============================================================================
 
-        // Create stream that expires in 1 second
-        const expiresAt = new Date(Date.now() + 1000).toISOString()
-        const createResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `PUT`,
-          headers: {
-            "Content-Type": `text/plain`,
-            "Stream-Expires-At": expiresAt,
-          },
-          body: `test data`,
-        })
-        expect(createResponse.status).toBe(201)
+  describe(`TTL and Expiry Edge Cases`, () => {
+    test(`should reject TTL with leading zeros`, async () => {
+      const streamPath = `/v1/stream/ttl-leading-zeros-test-${Date.now()}`
 
-        // Verify stream is readable immediately
-        const getBefore = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `GET`,
-        })
-        expect(getBefore.status).toBe(200)
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: {
+          "Content-Type": `text/plain`,
+          "Stream-TTL": `00060`,
+        },
+      })
 
-        // Wait for expiry time to pass
-        await sleep(1500)
+      expect(response.status).toBe(400)
+    })
 
-        // Stream should no longer exist
-        const getAfter = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `GET`,
-        })
-        expect(getAfter.status).toBe(404)
-      }
-    )
+    test(`should reject TTL with plus sign`, async () => {
+      const streamPath = `/v1/stream/ttl-plus-test-${Date.now()}`
 
-    test.concurrent(
-      `should return 404 on POST append after Expires-At passes`,
-      async () => {
-        const streamPath = uniquePath(`expires-at-post`)
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: {
+          "Content-Type": `text/plain`,
+          "Stream-TTL": `+60`,
+        },
+      })
 
-        // Create stream that expires in 1 second
-        const expiresAt = new Date(Date.now() + 1000).toISOString()
-        const createResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `PUT`,
-          headers: {
-            "Content-Type": `text/plain`,
-            "Stream-Expires-At": expiresAt,
-          },
-        })
-        expect(createResponse.status).toBe(201)
+      expect(response.status).toBe(400)
+    })
 
-        // Verify append works immediately
-        const postBefore = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `POST`,
-          headers: { "Content-Type": `text/plain` },
-          body: `appended data`,
-        })
-        expect([200, 204]).toContain(postBefore.status)
+    test(`should reject TTL with float value`, async () => {
+      const streamPath = `/v1/stream/ttl-float-test-${Date.now()}`
 
-        // Wait for expiry time to pass
-        await sleep(1500)
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: {
+          "Content-Type": `text/plain`,
+          "Stream-TTL": `60.5`,
+        },
+      })
 
-        // Append should fail - stream no longer exists
-        const postAfter = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `POST`,
-          headers: { "Content-Type": `text/plain` },
-          body: `more data`,
-        })
-        expect(postAfter.status).toBe(404)
-      }
-    )
+      expect(response.status).toBe(400)
+    })
 
-    test.concurrent(
-      `should allow recreating stream after TTL expires`,
-      async () => {
-        const streamPath = uniquePath(`ttl-recreate`)
+    test(`should reject TTL with scientific notation`, async () => {
+      const streamPath = `/v1/stream/ttl-scientific-test-${Date.now()}`
 
-        // Create stream with 1 second TTL
-        const createResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `PUT`,
-          headers: {
-            "Content-Type": `text/plain`,
-            "Stream-TTL": `1`,
-          },
-          body: `original data`,
-        })
-        expect(createResponse.status).toBe(201)
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: {
+          "Content-Type": `text/plain`,
+          "Stream-TTL": `1e3`,
+        },
+      })
 
-        // Wait for TTL to expire
-        await sleep(1500)
+      expect(response.status).toBe(400)
+    })
 
-        // Recreate stream with different config - should succeed (201)
-        const recreateResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `PUT`,
-          headers: {
-            "Content-Type": `application/json`,
-            "Stream-TTL": `3600`,
-          },
-          body: `["new data"]`,
-        })
-        expect(recreateResponse.status).toBe(201)
+    test(`should reject invalid Expires-At timestamp`, async () => {
+      const streamPath = `/v1/stream/expires-invalid-test-${Date.now()}`
 
-        // Verify the new stream is accessible
-        const getResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `GET`,
-        })
-        expect(getResponse.status).toBe(200)
-        const body = await getResponse.text()
-        expect(body).toContain(`new data`)
-      }
-    )
-  })
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: {
+          "Content-Type": `text/plain`,
+          "Stream-Expires-At": `not-a-timestamp`,
+        },
+      })
 
-  // ============================================================================
-  // Caching and ETag Tests
-  // ============================================================================
+      expect(response.status).toBe(400)
+    })
 
-  describe(`Caching and ETag`, () => {
-    test(`should generate ETag on GET responses`, async () => {
-      const streamPath = `/v1/stream/etag-generate-test-${Date.now()}`
+    test(`should accept Expires-At with Z timezone`, async () => {
+      const streamPath = `/v1/stream/expires-z-test-${Date.now()}`
 
-      await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `PUT`,
-        headers: { "Content-Type": `text/plain` },
-        body: `test data`,
-      })
+      const expiresAt = new Date(Date.now() + 3600000).toISOString()
 
       const response = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `GET`,
+        method: `PUT`,
+        headers: {
+          "Content-Type": `text/plain`,
+          "Stream-Expires-At": expiresAt,
+        },
       })
 
-      expect(response.status).toBe(200)
-      const etag = response.headers.get(`etag`)
-      expect(etag).toBeDefined()
-      expect(etag!.length).toBeGreaterThan(0)
+      expect([200, 201]).toContain(response.status)
     })
 
-    test(`should return 304 Not Modified for matching If-None-Match`, async () => {
-      const streamPath = `/v1/stream/etag-304-test-${Date.now()}`
+    test(`should accept Expires-At with timezone offset`, async () => {
+      const streamPath = `/v1/stream/expires-offset-test-${Date.now()}`
 
-      await fetch(`${getBaseUrl()}${streamPath}`, {
+      // RFC3339 with timezone offset
+      const date = new Date(Date.now() + 3600000)
+      const expiresAt = date.toISOString().replace(`Z`, `+00:00`)
+
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: { "Content-Type": `text/plain` },
-        body: `test data`,
+        headers: {
+          "Content-Type": `text/plain`,
+          "Stream-Expires-At": expiresAt,
+        },
       })
 
-      // First request to get ETag
+      expect([200, 201]).toContain(response.status)
+    })
+
+    test(`should handle idempotent PUT with same TTL`, async () => {
+      const streamPath = `/v1/stream/ttl-idempotent-test-${Date.now()}`
+
+      // Create with TTL
       const response1 = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `GET`,
+        method: `PUT`,
+        headers: {
+          "Content-Type": `text/plain`,
+          "Stream-TTL": `3600`,
+        },
       })
+      expect(response1.status).toBe(201)
 
-      const etag = response1.headers.get(`etag`)
-      expect(etag).toBeDefined()
-
-      // Second request with If-None-Match - MUST return 304
+      // PUT again with same TTL - should be idempotent
       const response2 = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `GET`,
+        method: `PUT`,
         headers: {
-          "If-None-Match": etag!,
+          "Content-Type": `text/plain`,
+          "Stream-TTL": `3600`,
         },
       })
-
-      expect(response2.status).toBe(304)
-      // 304 should have empty body
-      const text = await response2.text()
-      expect(text).toBe(``)
+      expect(response2.status).toBe(200)
     })
 
-    test(`should return 200 for non-matching If-None-Match`, async () => {
-      const streamPath = `/v1/stream/etag-mismatch-test-${Date.now()}`
+    test(`should reject idempotent PUT with different TTL`, async () => {
+      const streamPath = `/v1/stream/ttl-conflict-test-${Date.now()}`
 
+      // Create with TTL=3600
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: { "Content-Type": `text/plain` },
-        body: `test data`,
+        headers: {
+          "Content-Type": `text/plain`,
+          "Stream-TTL": `3600`,
+        },
       })
 
-      // Request with wrong ETag - should return 200 with data
+      // PUT again with different TTL - should fail
       const response = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `GET`,
+        method: `PUT`,
         headers: {
-          "If-None-Match": `"wrong-etag"`,
+          "Content-Type": `text/plain`,
+          "Stream-TTL": `7200`,
         },
       })
 
-      expect(response.status).toBe(200)
-      const text = await response.text()
-      expect(text).toBe(`test data`)
+      expect(response.status).toBe(409)
     })
+  })
 
-    test(`should return new ETag after data changes`, async () => {
-      const streamPath = `/v1/stream/etag-change-test-${Date.now()}`
+  // ============================================================================
+  // HEAD Metadata Edge Cases
+  // ============================================================================
+
+  describe(`HEAD Metadata Edge Cases`, () => {
+    test(`should return TTL metadata if configured`, async () => {
+      const streamPath = `/v1/stream/head-ttl-metadata-test-${Date.now()}`
 
+      // Create with TTL
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: { "Content-Type": `text/plain` },
-        body: `initial`,
+        headers: {
+          "Content-Type": `text/plain`,
+          "Stream-TTL": `3600`,
+        },
       })
 
-      // Get initial ETag
-      const response1 = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `GET`,
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `HEAD`,
       })
-      const etag1 = response1.headers.get(`etag`)
 
-      // Append more data
-      await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `POST`,
-        headers: { "Content-Type": `text/plain` },
-        body: ` more`,
-      })
+      // SHOULD return TTL metadata
+      const ttl = response.headers.get(`Stream-TTL`)
+      if (ttl) {
+        expect(parseInt(ttl)).toBeGreaterThan(0)
+        expect(parseInt(ttl)).toBeLessThanOrEqual(3600)
+      }
+    })
 
-      // Get new ETag
-      const response2 = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `GET`,
-      })
-      const etag2 = response2.headers.get(`etag`)
+    test(`should return Expires-At metadata if configured`, async () => {
+      const streamPath = `/v1/stream/head-expires-metadata-test-${Date.now()}`
 
-      // ETags should be different
-      expect(etag1).not.toBe(etag2)
+      const expiresAt = new Date(Date.now() + 3600000).toISOString()
 
-      // Old ETag should now return 200 (not 304)
-      const response3 = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `GET`,
+      // Create with Expires-At
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
         headers: {
-          "If-None-Match": etag1!,
+          "Content-Type": `text/plain`,
+          "Stream-Expires-At": expiresAt,
         },
       })
-      expect(response3.status).toBe(200)
+
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `HEAD`,
+      })
+
+      // SHOULD return Expires-At metadata
+      const expiresHeader = response.headers.get(`Stream-Expires-At`)
+      if (expiresHeader) {
+        expect(expiresHeader).toBeDefined()
+      }
     })
   })
 
   // ============================================================================
-  // Chunking and Large Payloads
+  // TTL Expiration Behavior Tests
   // ============================================================================
 
-  describe(`Chunking and Large Payloads`, () => {
-    test(`should handle chunk-size pagination correctly`, async () => {
-      const streamPath = `/v1/stream/chunk-pagination-test-${Date.now()}`
+  describe(`TTL Expiration Behavior`, () => {
+    // Helper function to wait for a specified duration
+    const sleep = (ms: number) =>
+      new Promise((resolve) => setTimeout(resolve, ms))
 
-      await fetch(`${getBaseUrl()}${streamPath}`, {
+    // Helper to generate unique stream paths for concurrent tests
+    const uniquePath = (prefix: string) =>
+      `/v1/stream/${prefix}-${Date.now()}-${Math.random().toString(36).slice(2)}`
+
+    // Run tests concurrently to avoid 6x 1.5s wait time
+    test.concurrent(`should return 404 on HEAD after TTL expires`, async () => {
+      const streamPath = uniquePath(`ttl-expire-head`)
+
+      // Create stream with 1 second TTL
+      const createResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
-        headers: { "Content-Type": `application/octet-stream` },
+        headers: {
+          "Content-Type": `text/plain`,
+          "Stream-TTL": `1`,
+        },
       })
+      expect(createResponse.status).toBe(201)
 
-      // Append a large amount of data (100KB)
-      const largeData = new Uint8Array(100 * 1024)
-      for (let i = 0; i < largeData.length; i++) {
-        largeData[i] = i % 256
-      }
-
-      await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `POST`,
-        headers: { "Content-Type": `application/octet-stream` },
-        body: largeData,
+      // Verify stream exists immediately
+      const headBefore = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `HEAD`,
       })
+      expect(headBefore.status).toBe(200)
 
-      // Read back using pagination
-      const accumulated: Array<number> = []
-      let currentOffset: string | null = null
-      let previousOffset: string | null = null
-      let iterations = 0
-      const maxIterations = 1000
+      // Wait for TTL to expire (1 second + buffer)
+      await sleep(1500)
 
-      while (iterations < maxIterations) {
-        iterations++
+      // Stream should no longer exist
+      const headAfter = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `HEAD`,
+      })
+      expect(headAfter.status).toBe(404)
+    })
 
-        const url: string = currentOffset
-          ? `${getBaseUrl()}${streamPath}?offset=${encodeURIComponent(currentOffset)}`
-          : `${getBaseUrl()}${streamPath}`
+    test.concurrent(`should return 404 on GET after TTL expires`, async () => {
+      const streamPath = uniquePath(`ttl-expire-get`)
 
-        const response: Response = await fetch(url, { method: `GET` })
-        expect(response.status).toBe(200)
+      // Create stream with 1 second TTL and some data
+      const createResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: {
+          "Content-Type": `text/plain`,
+          "Stream-TTL": `1`,
+        },
+        body: `test data`,
+      })
+      expect(createResponse.status).toBe(201)
 
-        const buffer = await response.arrayBuffer()
-        const data = new Uint8Array(buffer)
+      // Verify stream is readable immediately
+      const getBefore = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+      })
+      expect(getBefore.status).toBe(200)
 
-        if (data.length > 0) {
-          accumulated.push(...Array.from(data))
-        }
+      // Wait for TTL to expire
+      await sleep(1500)
 
-        const nextOffset: string | null =
-          response.headers.get(STREAM_OFFSET_HEADER)
-        const upToDate = response.headers.get(STREAM_UP_TO_DATE_HEADER)
+      // Stream should no longer exist
+      const getAfter = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+      })
+      expect(getAfter.status).toBe(404)
+    })
 
-        if (upToDate === `true` && data.length === 0) {
-          break
-        }
+    test.concurrent(
+      `should return 404 on POST append after TTL expires`,
+      async () => {
+        const streamPath = uniquePath(`ttl-expire-post`)
 
-        expect(nextOffset).toBeDefined()
+        // Create stream with 1 second TTL
+        const createResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `PUT`,
+          headers: {
+            "Content-Type": `text/plain`,
+            "Stream-TTL": `1`,
+          },
+        })
+        expect(createResponse.status).toBe(201)
 
-        // Verify offset progresses
-        if (nextOffset === currentOffset && data.length === 0) {
-          break
-        }
+        // Verify append works immediately
+        const postBefore = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `POST`,
+          headers: { "Content-Type": `text/plain` },
+          body: `appended data`,
+        })
+        expect(postBefore.status).toBe(204)
 
-        // Verify monotonic progression
-        if (previousOffset && nextOffset) {
-          expect(nextOffset >= previousOffset).toBe(true)
-        }
+        // Wait for TTL to expire
+        await sleep(1500)
 
-        previousOffset = currentOffset
-        currentOffset = nextOffset
+        // Append should fail - stream no longer exists
+        const postAfter = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `POST`,
+          headers: { "Content-Type": `text/plain` },
+          body: `more data`,
+        })
+        expect(postAfter.status).toBe(404)
       }
+    )
 
-      // Verify we got all the data
-      const result = new Uint8Array(accumulated)
-      expect(result.length).toBe(largeData.length)
-      for (let i = 0; i < largeData.length; i++) {
-        expect(result[i]).toBe(largeData[i])
+    test.concurrent(
+      `should return 404 on HEAD after Expires-At passes`,
+      async () => {
+        const streamPath = uniquePath(`expires-at-head`)
+
+        // Create stream that expires in 1 second
+        const expiresAt = new Date(Date.now() + 1000).toISOString()
+        const createResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `PUT`,
+          headers: {
+            "Content-Type": `text/plain`,
+            "Stream-Expires-At": expiresAt,
+          },
+        })
+        expect(createResponse.status).toBe(201)
+
+        // Verify stream exists immediately
+        const headBefore = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `HEAD`,
+        })
+        expect(headBefore.status).toBe(200)
+
+        // Wait for expiry time to pass
+        await sleep(1500)
+
+        // Stream should no longer exist
+        const headAfter = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `HEAD`,
+        })
+        expect(headAfter.status).toBe(404)
       }
-    })
+    )
 
-    test(`should handle large payload appropriately`, async () => {
-      const streamPath = `/v1/stream/large-payload-test-${Date.now()}`
+    test.concurrent(
+      `should return 404 on GET after Expires-At passes`,
+      async () => {
+        const streamPath = uniquePath(`expires-at-get`)
 
-      await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `PUT`,
-        headers: { "Content-Type": `application/octet-stream` },
-      })
+        // Create stream that expires in 1 second
+        const expiresAt = new Date(Date.now() + 1000).toISOString()
+        const createResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `PUT`,
+          headers: {
+            "Content-Type": `text/plain`,
+            "Stream-Expires-At": expiresAt,
+          },
+          body: `test data`,
+        })
+        expect(createResponse.status).toBe(201)
 
-      // Try to append very large payload (10MB)
-      const largeData = new Uint8Array(10 * 1024 * 1024)
+        // Verify stream is readable immediately
+        const getBefore = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `GET`,
+        })
+        expect(getBefore.status).toBe(200)
 
-      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
-        method: `POST`,
-        headers: { "Content-Type": `application/octet-stream` },
-        body: largeData,
-      })
+        // Wait for expiry time to pass
+        await sleep(1500)
 
-      // Server may accept it (200/204) or reject with 413
-      expect([200, 204, 413]).toContain(response.status)
-    }, 30000)
+        // Stream should no longer exist
+        const getAfter = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `GET`,
+        })
+        expect(getAfter.status).toBe(404)
+      }
+    )
+
+    test.concurrent(
+      `should return 404 on POST append after Expires-At passes`,
+      async () => {
+        const streamPath = uniquePath(`expires-at-post`)
+
+        // Create stream that expires in 1 second
+        const expiresAt = new Date(Date.now() + 1000).toISOString()
+        const createResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `PUT`,
+          headers: {
+            "Content-Type": `text/plain`,
+            "Stream-Expires-At": expiresAt,
+          },
+        })
+        expect(createResponse.status).toBe(201)
+
+        // Verify append works immediately
+        const postBefore = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `POST`,
+          headers: { "Content-Type": `text/plain` },
+          body: `appended data`,
+        })
+        expect(postBefore.status).toBe(204)
+
+        // Wait for expiry time to pass
+        await sleep(1500)
+
+        // Append should fail - stream no longer exists
+        const postAfter = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `POST`,
+          headers: { "Content-Type": `text/plain` },
+          body: `more data`,
+        })
+        expect(postAfter.status).toBe(404)
+      }
+    )
+
+    test.concurrent(
+      `should allow recreating stream after TTL expires`,
+      async () => {
+        const streamPath = uniquePath(`ttl-recreate`)
+
+        // Create stream with 1 second TTL
+        const createResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `PUT`,
+          headers: {
+            "Content-Type": `text/plain`,
+            "Stream-TTL": `1`,
+          },
+          body: `original data`,
+        })
+        expect(createResponse.status).toBe(201)
+
+        // Wait for TTL to expire
+        await sleep(1500)
+
+        // Recreate stream with different config - should succeed (201)
+        const recreateResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `PUT`,
+          headers: {
+            "Content-Type": `application/json`,
+            "Stream-TTL": `3600`,
+          },
+          body: `["new data"]`,
+        })
+        expect(recreateResponse.status).toBe(201)
+
+        // Verify the new stream is accessible
+        const getResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `GET`,
+        })
+        expect(getResponse.status).toBe(200)
+        const body = await getResponse.text()
+        expect(body).toContain(`new data`)
+      }
+    )
   })
 
   // ============================================================================
-  // Read-Your-Writes Consistency
+  // Caching and ETag Tests
   // ============================================================================
 
-  describe(`Read-Your-Writes Consistency`, () => {
-    test(`should immediately read message after append`, async () => {
-      const streamPath = `/v1/stream/ryw-test-${Date.now()}`
+  describe(`Caching and ETag`, () => {
+    test(`should generate ETag on GET responses`, async () => {
+      const streamPath = `/v1/stream/etag-generate-test-${Date.now()}`
 
-      // Create stream and append
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
-        body: `initial`,
+        body: `test data`,
       })
 
-      // Immediately read - should see the data
       const response = await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `GET`,
       })
 
-      const text = await response.text()
-      expect(text).toBe(`initial`)
+      expect(response.status).toBe(200)
+      const etag = response.headers.get(`etag`)
+      expect(etag).toBeDefined()
+      expect(etag!.length).toBeGreaterThan(0)
     })
 
-    test(`should immediately read multiple appends`, async () => {
-      const streamPath = `/v1/stream/ryw-multi-test-${Date.now()}`
+    test(`should return 304 Not Modified for matching If-None-Match`, async () => {
+      const streamPath = `/v1/stream/etag-304-test-${Date.now()}`
 
-      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+        body: `test data`,
+      })
+
+      // First request to get ETag
+      const response1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+      })
+
+      const etag = response1.headers.get(`etag`)
+      expect(etag).toBeDefined()
+
+      // Second request with If-None-Match - MUST return 304
+      const response2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+        headers: {
+          "If-None-Match": etag!,
+        },
+      })
+
+      expect(response2.status).toBe(304)
+      // 304 should have empty body
+      const text = await response2.text()
+      expect(text).toBe(``)
+    })
+
+    test(`should return 200 for non-matching If-None-Match`, async () => {
+      const streamPath = `/v1/stream/etag-mismatch-test-${Date.now()}`
+
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+        body: `test data`,
+      })
+
+      // Request with wrong ETag - should return 200 with data
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+        headers: {
+          "If-None-Match": `"wrong-etag"`,
+        },
+      })
+
+      expect(response.status).toBe(200)
+      const text = await response.text()
+      expect(text).toBe(`test data`)
+    })
+
+    test(`should return new ETag after data changes`, async () => {
+      const streamPath = `/v1/stream/etag-change-test-${Date.now()}`
+
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+        body: `initial`,
+      })
+
+      // Get initial ETag
+      const response1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+      })
+      const etag1 = response1.headers.get(`etag`)
+
+      // Append more data
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: { "Content-Type": `text/plain` },
+        body: ` more`,
+      })
+
+      // Get new ETag
+      const response2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+      })
+      const etag2 = response2.headers.get(`etag`)
+
+      // ETags should be different
+      expect(etag1).not.toBe(etag2)
+
+      // Old ETag should now return 200 (not 304)
+      const response3 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+        headers: {
+          "If-None-Match": etag1!,
+        },
+      })
+      expect(response3.status).toBe(200)
+    })
+  })
+
+  // ============================================================================
+  // Chunking and Large Payloads
+  // ============================================================================
+
+  describe(`Chunking and Large Payloads`, () => {
+    test(`should handle chunk-size pagination correctly`, async () => {
+      const streamPath = `/v1/stream/chunk-pagination-test-${Date.now()}`
+
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `application/octet-stream` },
+      })
+
+      // Append a large amount of data (100KB)
+      const largeData = new Uint8Array(100 * 1024)
+      for (let i = 0; i < largeData.length; i++) {
+        largeData[i] = i % 256
+      }
+
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: { "Content-Type": `application/octet-stream` },
+        body: largeData,
+      })
+
+      // Read back using pagination
+      const accumulated: Array<number> = []
+      let currentOffset: string | null = null
+      let previousOffset: string | null = null
+      let iterations = 0
+      const maxIterations = 1000
+
+      while (iterations < maxIterations) {
+        iterations++
+
+        const url: string = currentOffset
+          ? `${getBaseUrl()}${streamPath}?offset=${encodeURIComponent(currentOffset)}`
+          : `${getBaseUrl()}${streamPath}`
+
+        const response: Response = await fetch(url, { method: `GET` })
+        expect(response.status).toBe(200)
+
+        const buffer = await response.arrayBuffer()
+        const data = new Uint8Array(buffer)
+
+        if (data.length > 0) {
+          accumulated.push(...Array.from(data))
+        }
+
+        const nextOffset: string | null =
+          response.headers.get(STREAM_OFFSET_HEADER)
+        const upToDate = response.headers.get(STREAM_UP_TO_DATE_HEADER)
+
+        if (upToDate === `true` && data.length === 0) {
+          break
+        }
+
+        expect(nextOffset).toBeDefined()
+
+        // Verify offset progresses
+        if (nextOffset === currentOffset && data.length === 0) {
+          break
+        }
+
+        // Verify monotonic progression
+        if (previousOffset && nextOffset) {
+          expect(nextOffset >= previousOffset).toBe(true)
+        }
+
+        previousOffset = currentOffset
+        currentOffset = nextOffset
+      }
+
+      // Verify we got all the data
+      const result = new Uint8Array(accumulated)
+      expect(result.length).toBe(largeData.length)
+      for (let i = 0; i < largeData.length; i++) {
+        expect(result[i]).toBe(largeData[i])
+      }
+    })
+
+    test(`should handle large payload appropriately`, async () => {
+      const streamPath = `/v1/stream/large-payload-test-${Date.now()}`
+
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `application/octet-stream` },
+      })
+
+      // Try to append very large payload (10MB)
+      const largeData = new Uint8Array(10 * 1024 * 1024)
+
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: { "Content-Type": `application/octet-stream` },
+        body: largeData,
+      })
+
+      // Server may accept it (200/204) or reject with 413
+      expect([200, 204, 413]).toContain(response.status)
+    }, 30000)
+  })
+
+  // ============================================================================
+  // Read-Your-Writes Consistency
+  // ============================================================================
+
+  describe(`Read-Your-Writes Consistency`, () => {
+    test(`should immediately read message after append`, async () => {
+      const streamPath = `/v1/stream/ryw-test-${Date.now()}`
+
+      // Create stream and append
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+        body: `initial`,
+      })
+
+      // Immediately read - should see the data
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `GET`,
+      })
+
+      const text = await response.text()
+      expect(text).toBe(`initial`)
+    })
+
+    test(`should immediately read multiple appends`, async () => {
+      const streamPath = `/v1/stream/ryw-multi-test-${Date.now()}`
+
+      // Create stream
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
@@ -2842,25 +3413,19 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
       expect(received).toContain(`data: line3`)
     })
 
-    test(`should generate unique, monotonically increasing offsets in SSE mode`, async () => {
-      const streamPath = `/v1/stream/sse-monotonic-offset-test-${Date.now()}`
+    test(`should prevent CRLF injection in payloads - embedded event boundaries become literal data`, async () => {
+      const streamPath = `/v1/stream/sse-crlf-injection-test-${Date.now()}`
+
+      // Payload attempts to inject a fake control event via CRLF sequences
+      // If vulnerable, this would terminate the current event and inject a new one
+      const maliciousPayload = `safe content\r\n\r\nevent: control\r\ndata: {"injected":true}\r\n\r\nmore safe content`
 
-      // Create stream
       await fetch(`${getBaseUrl()}${streamPath}`, {
         method: `PUT`,
         headers: { "Content-Type": `text/plain` },
+        body: maliciousPayload,
       })
 
-      // Append multiple messages
-      for (let i = 0; i < 5; i++) {
-        await fetch(`${getBaseUrl()}${streamPath}`, {
-          method: `POST`,
-          headers: { "Content-Type": `text/plain` },
-          body: `message ${i}`,
-        })
-      }
-
-      // Make SSE request
       const { response, received } = await fetchSSE(
         `${getBaseUrl()}${streamPath}?offset=-1&live=sse`,
         { untilContent: `event: control` }
@@ -2868,26 +3433,180 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
 
       expect(response.status).toBe(200)
 
-      // Extract all control event offsets
-      const controlLines = received
-        .split(`\n`)
-        .filter((l) => l.startsWith(`data: `) && l.includes(`streamNextOffset`))
+      // Parse all events from the response
+      const events = parseSSEEvents(received)
 
-      const offsets: Array<string> = []
-      for (const line of controlLines) {
-        const payload = line.slice(`data: `.length)
-        const data = JSON.parse(payload)
-        offsets.push(data[`streamNextOffset`])
-      }
+      // Should have exactly 1 data event and 1 control event (the real one from server)
+      const dataEvents = events.filter((e) => e.type === `data`)
+      const controlEvents = events.filter((e) => e.type === `control`)
 
-      // Verify offsets are unique and strictly increasing (lexicographically)
-      for (let i = 1; i < offsets.length; i++) {
-        expect(offsets[i]! > offsets[i - 1]!).toBe(true)
-      }
+      expect(dataEvents.length).toBe(1)
+      expect(controlEvents.length).toBe(1)
+
+      // The "injected" control event should NOT exist as a real event
+      // Instead, "event: control" should appear as literal text within the data
+      const dataContent = dataEvents[0]!.data
+      expect(dataContent).toContain(`event: control`)
+      expect(dataContent).toContain(`data: {"injected":true}`)
+
+      // The real control event should have server-generated fields, not injected ones
+      const controlContent = JSON.parse(controlEvents[0]!.data)
+      expect(controlContent.injected).toBeUndefined()
+      expect(controlContent.streamNextOffset).toBeDefined()
     })
 
-    test(`should support reconnection with last known offset`, async () => {
-      const streamPath = `/v1/stream/sse-reconnect-test-${Date.now()}`
+    test(`should prevent CRLF injection - LF-only attack vectors`, async () => {
+      const streamPath = `/v1/stream/sse-lf-injection-test-${Date.now()}`
+
+      // Attempt injection using Unix-style line endings only
+      const maliciousPayload = `start\n\nevent: data\ndata: fake-event\n\nend`
+
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+        body: maliciousPayload,
+      })
+
+      const { response, received } = await fetchSSE(
+        `${getBaseUrl()}${streamPath}?offset=-1&live=sse`,
+        { untilContent: `event: control` }
+      )
+
+      expect(response.status).toBe(200)
+
+      const events = parseSSEEvents(received)
+      const dataEvents = events.filter((e) => e.type === `data`)
+
+      // Should be exactly 1 data event (the injected one should be escaped)
+      expect(dataEvents.length).toBe(1)
+
+      // The payload should be preserved as literal content, including the
+      // "event: data" and "data: fake-event" as text, not parsed as SSE commands
+      const dataContent = dataEvents[0]!.data
+      expect(dataContent).toContain(`event: data`)
+      expect(dataContent).toContain(`data: fake-event`)
+    })
+
+    test(`should prevent CRLF injection - carriage return only attack vectors`, async () => {
+      const streamPath = `/v1/stream/sse-cr-injection-test-${Date.now()}`
+
+      // Attempt injection using CR-only line endings (per SSE spec, CR is a valid line terminator)
+      const maliciousPayload = `start\r\revent: control\rdata: {"cr_injected":true}\r\rend`
+
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+        body: maliciousPayload,
+      })
+
+      const { response, received } = await fetchSSE(
+        `${getBaseUrl()}${streamPath}?offset=-1&live=sse`,
+        { untilContent: `event: control` }
+      )
+
+      expect(response.status).toBe(200)
+
+      const events = parseSSEEvents(received)
+      const controlEvents = events.filter((e) => e.type === `control`)
+
+      // Should have exactly 1 control event (the real one from server)
+      expect(controlEvents.length).toBe(1)
+
+      // The real control event should not contain injected fields
+      const controlContent = JSON.parse(controlEvents[0]!.data)
+      expect(controlContent.cr_injected).toBeUndefined()
+      expect(controlContent.streamNextOffset).toBeDefined()
+    })
+
+    test(`should handle JSON payloads with embedded newlines safely`, async () => {
+      const streamPath = `/v1/stream/sse-json-newline-test-${Date.now()}`
+
+      // JSON content that contains literal newlines in string values
+      // These should be JSON-escaped, but we test that even if they're not,
+      // SSE encoding handles them safely
+      const jsonPayload = JSON.stringify({
+        message: `line1\nline2\nline3`,
+        attack: `try\r\n\r\nevent: control\r\ndata: {"bad":true}`,
+      })
+
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `application/json` },
+        body: jsonPayload,
+      })
+
+      const { response, received } = await fetchSSE(
+        `${getBaseUrl()}${streamPath}?offset=-1&live=sse`,
+        { untilContent: `event: control` }
+      )
+
+      expect(response.status).toBe(200)
+
+      const events = parseSSEEvents(received)
+      const dataEvents = events.filter((e) => e.type === `data`)
+      const controlEvents = events.filter((e) => e.type === `control`)
+
+      expect(dataEvents.length).toBe(1)
+      expect(controlEvents.length).toBe(1)
+
+      // Parse the data event - should be valid JSON array wrapping the original object
+      const parsedData = JSON.parse(dataEvents[0]!.data)
+      expect(Array.isArray(parsedData)).toBe(true)
+      expect(parsedData[0].message).toBe(`line1\nline2\nline3`)
+      expect(parsedData[0].attack).toContain(`event: control`)
+
+      // Control event should be the real server-generated one
+      const controlContent = JSON.parse(controlEvents[0]!.data)
+      expect(controlContent.bad).toBeUndefined()
+      expect(controlContent.streamNextOffset).toBeDefined()
+    })
+
+    test(`should generate unique, monotonically increasing offsets in SSE mode`, async () => {
+      const streamPath = `/v1/stream/sse-monotonic-offset-test-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Append multiple messages
+      for (let i = 0; i < 5; i++) {
+        await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `POST`,
+          headers: { "Content-Type": `text/plain` },
+          body: `message ${i}`,
+        })
+      }
+
+      // Make SSE request
+      const { response, received } = await fetchSSE(
+        `${getBaseUrl()}${streamPath}?offset=-1&live=sse`,
+        { untilContent: `event: control` }
+      )
+
+      expect(response.status).toBe(200)
+
+      // Extract all control event offsets
+      const controlLines = received
+        .split(`\n`)
+        .filter((l) => l.startsWith(`data: `) && l.includes(`streamNextOffset`))
+
+      const offsets: Array<string> = []
+      for (const line of controlLines) {
+        const payload = line.slice(`data: `.length)
+        const data = JSON.parse(payload)
+        offsets.push(data[`streamNextOffset`])
+      }
+
+      // Verify offsets are unique and strictly increasing (lexicographically)
+      for (let i = 1; i < offsets.length; i++) {
+        expect(offsets[i]! > offsets[i - 1]!).toBe(true)
+      }
+    })
+
+    test(`should support reconnection with last known offset`, async () => {
+      const streamPath = `/v1/stream/sse-reconnect-test-${Date.now()}`
 
       // Create stream with initial data
       await fetch(`${getBaseUrl()}${streamPath}`, {
@@ -3341,7 +4060,7 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
                   headers: { "Content-Type": `application/octet-stream` },
                   body: chunk,
                 })
-                expect([200, 204]).toContain(response.status)
+                expect(response.status).toBe(204)
               }
 
               // Calculate expected result
@@ -3492,7 +4211,7 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
                     headers: { "Content-Type": `application/octet-stream` },
                     body: op.data as BodyInit,
                   })
-                  expect([200, 204]).toContain(response.status)
+                  expect(response.status).toBe(204)
 
                   // Track what we appended
                   appendedData.push(...Array.from(op.data))
@@ -3619,7 +4338,7 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
           ),
           { numRuns: 25 }
         )
-      })
+      }, 15000)
 
       test(`read-your-writes: data is immediately visible after append`, async () => {
         await fc.assert(
@@ -3643,7 +4362,7 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
                   body: data,
                 }
               )
-              expect([200, 204]).toContain(appendResponse.status)
+              expect(appendResponse.status).toBe(204)
 
               // Immediately read back
               const readResponse = await fetch(`${getBaseUrl()}${streamPath}`)
@@ -3802,7 +4521,7 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
                   },
                   body: `data-${seq}`,
                 })
-                expect([200, 204]).toContain(response.status)
+                expect(response.status).toBe(204)
               }
 
               return true
@@ -3839,7 +4558,7 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
                 },
                 body: `first`,
               })
-              expect([200, 204]).toContain(response1.status)
+              expect(response1.status).toBe(204)
 
               // Second append with smaller seq should be rejected
               const response2 = await fetch(`${getBaseUrl()}${streamPath}`, {
@@ -3859,5 +4578,1523 @@ export function runConformanceTests(options: ConformanceTestOptions): void {
         )
       })
     })
+
+    describe(`Concurrent Writer Stress Tests`, () => {
+      test(`concurrent writers with sequence numbers - server handles gracefully`, async () => {
+        const streamPath = `/v1/stream/concurrent-seq-${Date.now()}-${Math.random().toString(36).slice(2)}`
+
+        // Create stream
+        await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `PUT`,
+          headers: { "Content-Type": `text/plain` },
+        })
+
+        // Try to write with same seq from multiple "writers" concurrently
+        const numWriters = 5
+        const seqValue = `seq-001`
+
+        const writePromises = Array.from({ length: numWriters }, (_, i) =>
+          fetch(`${getBaseUrl()}${streamPath}`, {
+            method: `POST`,
+            headers: {
+              "Content-Type": `text/plain`,
+              [STREAM_SEQ_HEADER]: seqValue,
+            },
+            body: `writer-${i}`,
+          })
+        )
+
+        const responses = await Promise.all(writePromises)
+        const statuses = responses.map((r) => r.status)
+
+        // Server should handle concurrent writes gracefully
+        // All responses should be valid (success or conflict)
+        for (const status of statuses) {
+          expect([200, 204, 409]).toContain(status)
+        }
+
+        // At least one should succeed
+        const successes = statuses.filter((s) => s === 200 || s === 204)
+        expect(successes.length).toBeGreaterThanOrEqual(1)
+
+        // Read back - should have exactly one write's data
+        const readResponse = await fetch(`${getBaseUrl()}${streamPath}`)
+        const content = await readResponse.text()
+
+        // Content should contain data from exactly one writer
+        const matchingWriters = Array.from({ length: numWriters }, (_, i) =>
+          content.includes(`writer-${i}`)
+        ).filter(Boolean)
+        expect(matchingWriters.length).toBeGreaterThanOrEqual(1)
+      })
+
+      test(`concurrent writers racing with incrementing seq values`, async () => {
+        await fc.assert(
+          fc.asyncProperty(
+            fc.integer({ min: 3, max: 8 }), // Number of writers
+            async (numWriters) => {
+              const streamPath = `/v1/stream/concurrent-race-${Date.now()}-${Math.random().toString(36).slice(2)}`
+
+              // Create stream
+              await fetch(`${getBaseUrl()}${streamPath}`, {
+                method: `PUT`,
+                headers: { "Content-Type": `text/plain` },
+              })
+
+              // Each writer gets a unique seq value (padded for lexicographic ordering)
+              const writePromises = Array.from({ length: numWriters }, (_, i) =>
+                fetch(`${getBaseUrl()}${streamPath}`, {
+                  method: `POST`,
+                  headers: {
+                    "Content-Type": `text/plain`,
+                    [STREAM_SEQ_HEADER]: String(i).padStart(4, `0`),
+                  },
+                  body: `data-${i}`,
+                })
+              )
+
+              const responses = await Promise.all(writePromises)
+
+              // With concurrent writes, some may succeed (200/204) and some may conflict (409)
+              // due to out-of-order arrival at the server. All responses should be valid.
+              const successIndices: Array<number> = []
+              for (let i = 0; i < responses.length; i++) {
+                expect([200, 204, 409]).toContain(responses[i]!.status)
+                if (
+                  responses[i]!.status === 200 ||
+                  responses[i]!.status === 204
+                ) {
+                  successIndices.push(i)
+                }
+              }
+
+              // At least one write should succeed
+              expect(successIndices.length).toBeGreaterThanOrEqual(1)
+
+              // Read back and verify successful writes are present
+              const readResponse = await fetch(`${getBaseUrl()}${streamPath}`)
+              const content = await readResponse.text()
+
+              // All successful writes should have their data in the stream
+              for (const i of successIndices) {
+                expect(content).toContain(`data-${i}`)
+              }
+
+              return true
+            }
+          ),
+          { numRuns: 10 }
+        )
+      })
+
+      test(`concurrent appends without seq - all data is persisted`, async () => {
+        const streamPath = `/v1/stream/concurrent-no-seq-${Date.now()}-${Math.random().toString(36).slice(2)}`
+
+        // Create stream
+        await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `PUT`,
+          headers: { "Content-Type": `text/plain` },
+        })
+
+        const numWriters = 10
+        const writePromises = Array.from({ length: numWriters }, (_, i) =>
+          fetch(`${getBaseUrl()}${streamPath}`, {
+            method: `POST`,
+            headers: { "Content-Type": `text/plain` },
+            body: `concurrent-${i}`,
+          })
+        )
+
+        const responses = await Promise.all(writePromises)
+
+        // All should succeed
+        for (const response of responses) {
+          expect([200, 204]).toContain(response.status)
+        }
+
+        // All offsets that are returned should be valid (non-null)
+        const offsets = responses.map((r) =>
+          r.headers.get(STREAM_OFFSET_HEADER)
+        )
+        for (const offset of offsets) {
+          expect(offset).not.toBeNull()
+        }
+
+        // Read back and verify all data is present (the key invariant)
+        const readResponse = await fetch(`${getBaseUrl()}${streamPath}`)
+        const content = await readResponse.text()
+
+        for (let i = 0; i < numWriters; i++) {
+          expect(content).toContain(`concurrent-${i}`)
+        }
+      })
+
+      test(`mixed readers and writers - readers see consistent state`, async () => {
+        const streamPath = `/v1/stream/concurrent-rw-${Date.now()}-${Math.random().toString(36).slice(2)}`
+
+        // Create stream with initial data
+        await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `PUT`,
+          headers: { "Content-Type": `text/plain` },
+        })
+
+        await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `POST`,
+          headers: { "Content-Type": `text/plain` },
+          body: `initial`,
+        })
+
+        // Launch concurrent readers and writers
+        const numOps = 20
+        const operations = Array.from({ length: numOps }, (_, i) => {
+          if (i % 2 === 0) {
+            // Writer
+            return fetch(`${getBaseUrl()}${streamPath}`, {
+              method: `POST`,
+              headers: { "Content-Type": `text/plain` },
+              body: `write-${i}`,
+            })
+          } else {
+            // Reader
+            return fetch(`${getBaseUrl()}${streamPath}`)
+          }
+        })
+
+        const responses = await Promise.all(operations)
+
+        // All operations should succeed
+        // Writers (even indices) return 200 or 204, readers (odd indices) return 200
+        responses.forEach((response, i) => {
+          if (i % 2 === 0) {
+            // Writer - POST append can return 200 or 204
+            expect([200, 204]).toContain(response.status)
+          } else {
+            // Reader - catch-up GET returns 200
+            expect(response.status).toBe(200)
+          }
+        })
+
+        // Final read should have all writes
+        const finalRead = await fetch(`${getBaseUrl()}${streamPath}`)
+        const content = await finalRead.text()
+
+        // Initial data should be present
+        expect(content).toContain(`initial`)
+
+        // All writes should be present
+        for (let i = 0; i < numOps; i += 2) {
+          expect(content).toContain(`write-${i}`)
+        }
+      })
+    })
+
+    describe(`State Hash Verification`, () => {
+      /**
+       * Simple hash function for content verification.
+       * Uses FNV-1a algorithm for deterministic hashing.
+       */
+      function hashContent(data: Uint8Array): string {
+        let hash = 2166136261 // FNV offset basis
+        for (const byte of data) {
+          hash ^= byte
+          hash = Math.imul(hash, 16777619) // FNV prime
+          hash = hash >>> 0 // Convert to unsigned 32-bit
+        }
+        return hash.toString(16).padStart(8, `0`)
+      }
+
+      test(`replay produces identical content hash`, async () => {
+        await fc.assert(
+          fc.asyncProperty(
+            // Generate a sequence of appends
+            fc.array(fc.uint8Array({ minLength: 1, maxLength: 100 }), {
+              minLength: 1,
+              maxLength: 10,
+            }),
+            async (chunks) => {
+              // Create first stream and append data
+              const streamPath1 = `/v1/stream/hash-verify-1-${Date.now()}-${Math.random().toString(36).slice(2)}`
+              await fetch(`${getBaseUrl()}${streamPath1}`, {
+                method: `PUT`,
+                headers: { "Content-Type": `application/octet-stream` },
+              })
+
+              for (const chunk of chunks) {
+                await fetch(`${getBaseUrl()}${streamPath1}`, {
+                  method: `POST`,
+                  headers: { "Content-Type": `application/octet-stream` },
+                  body: chunk,
+                })
+              }
+
+              // Read and hash first stream
+              const response1 = await fetch(`${getBaseUrl()}${streamPath1}`)
+              const data1 = new Uint8Array(await response1.arrayBuffer())
+              const hash1 = hashContent(data1)
+
+              // Create second stream and replay same operations
+              const streamPath2 = `/v1/stream/hash-verify-2-${Date.now()}-${Math.random().toString(36).slice(2)}`
+              await fetch(`${getBaseUrl()}${streamPath2}`, {
+                method: `PUT`,
+                headers: { "Content-Type": `application/octet-stream` },
+              })
+
+              for (const chunk of chunks) {
+                await fetch(`${getBaseUrl()}${streamPath2}`, {
+                  method: `POST`,
+                  headers: { "Content-Type": `application/octet-stream` },
+                  body: chunk,
+                })
+              }
+
+              // Read and hash second stream
+              const response2 = await fetch(`${getBaseUrl()}${streamPath2}`)
+              const data2 = new Uint8Array(await response2.arrayBuffer())
+              const hash2 = hashContent(data2)
+
+              // Hashes must match
+              expect(hash1).toBe(hash2)
+              expect(data1.length).toBe(data2.length)
+
+              return true
+            }
+          ),
+          { numRuns: 15 }
+        )
+      }, 15000)
+
+      test(`content hash changes with each append`, async () => {
+        const streamPath = `/v1/stream/hash-changes-${Date.now()}-${Math.random().toString(36).slice(2)}`
+
+        await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `PUT`,
+          headers: { "Content-Type": `application/octet-stream` },
+        })
+
+        const hashes: Array<string> = []
+
+        // Append 5 chunks and verify hash changes each time
+        for (let i = 0; i < 5; i++) {
+          await fetch(`${getBaseUrl()}${streamPath}`, {
+            method: `POST`,
+            headers: { "Content-Type": `application/octet-stream` },
+            body: new Uint8Array([i, i + 1, i + 2]),
+          })
+
+          const response = await fetch(`${getBaseUrl()}${streamPath}`)
+          const data = new Uint8Array(await response.arrayBuffer())
+          hashes.push(hashContent(data))
+        }
+
+        // All hashes should be unique
+        const uniqueHashes = new Set(hashes)
+        expect(uniqueHashes.size).toBe(5)
+      })
+
+      test(`empty stream has consistent hash`, async () => {
+        // Create two empty streams
+        const streamPath1 = `/v1/stream/empty-hash-1-${Date.now()}-${Math.random().toString(36).slice(2)}`
+        const streamPath2 = `/v1/stream/empty-hash-2-${Date.now()}-${Math.random().toString(36).slice(2)}`
+
+        await fetch(`${getBaseUrl()}${streamPath1}`, {
+          method: `PUT`,
+          headers: { "Content-Type": `application/octet-stream` },
+        })
+        await fetch(`${getBaseUrl()}${streamPath2}`, {
+          method: `PUT`,
+          headers: { "Content-Type": `application/octet-stream` },
+        })
+
+        // Read both
+        const response1 = await fetch(`${getBaseUrl()}${streamPath1}`)
+        const response2 = await fetch(`${getBaseUrl()}${streamPath2}`)
+
+        const data1 = new Uint8Array(await response1.arrayBuffer())
+        const data2 = new Uint8Array(await response2.arrayBuffer())
+
+        // Both should be empty and have same hash
+        expect(data1.length).toBe(0)
+        expect(data2.length).toBe(0)
+        expect(hashContent(data1)).toBe(hashContent(data2))
+      })
+
+      test(`deterministic ordering - same data in same order produces same hash`, async () => {
+        await fc.assert(
+          fc.asyncProperty(
+            fc.array(fc.uint8Array({ minLength: 1, maxLength: 50 }), {
+              minLength: 2,
+              maxLength: 5,
+            }),
+            async (chunks) => {
+              // Create two streams with same data in same order
+              const hashes: Array<string> = []
+
+              for (let run = 0; run < 2; run++) {
+                const streamPath = `/v1/stream/order-hash-${run}-${Date.now()}-${Math.random().toString(36).slice(2)}`
+
+                await fetch(`${getBaseUrl()}${streamPath}`, {
+                  method: `PUT`,
+                  headers: { "Content-Type": `application/octet-stream` },
+                })
+
+                // Append in order
+                for (const chunk of chunks) {
+                  await fetch(`${getBaseUrl()}${streamPath}`, {
+                    method: `POST`,
+                    headers: { "Content-Type": `application/octet-stream` },
+                    body: chunk,
+                  })
+                }
+
+                const response = await fetch(`${getBaseUrl()}${streamPath}`)
+                const data = new Uint8Array(await response.arrayBuffer())
+                hashes.push(hashContent(data))
+              }
+
+              expect(hashes[0]).toBe(hashes[1])
+
+              return true
+            }
+          ),
+          { numRuns: 10 }
+        )
+      })
+    })
+  })
+
+  // ============================================================================
+  // Idempotent Producer Tests
+  // ============================================================================
+
+  describe(`Idempotent Producer Operations`, () => {
+    const PRODUCER_ID_HEADER = `Producer-Id`
+    const PRODUCER_EPOCH_HEADER = `Producer-Epoch`
+    const PRODUCER_SEQ_HEADER = `Producer-Seq`
+    const PRODUCER_EXPECTED_SEQ_HEADER = `Producer-Expected-Seq`
+    const PRODUCER_RECEIVED_SEQ_HEADER = `Producer-Received-Seq`
+
+    test(`should accept first append with producer headers (epoch=0, seq=0)`, async () => {
+      const streamPath = `/v1/stream/producer-basic-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // First append with producer headers
+      const response = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `hello`,
+      })
+
+      expect(response.status).toBe(200)
+      expect(response.headers.get(STREAM_OFFSET_HEADER)).toBeTruthy()
+      expect(response.headers.get(PRODUCER_EPOCH_HEADER)).toBe(`0`)
+    })
+
+    test(`should accept sequential producer sequences`, async () => {
+      const streamPath = `/v1/stream/producer-seq-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Send seq=0
+      const r0 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `msg0`,
+      })
+      expect(r0.status).toBe(200)
+
+      // Send seq=1
+      const r1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `1`,
+        },
+        body: `msg1`,
+      })
+      expect(r1.status).toBe(200)
+
+      // Send seq=2
+      const r2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `2`,
+        },
+        body: `msg2`,
+      })
+      expect(r2.status).toBe(200)
+    })
+
+    test(`should return 204 for duplicate sequence (idempotent success)`, async () => {
+      const streamPath = `/v1/stream/producer-dup-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // First append
+      const r1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `hello`,
+      })
+      expect(r1.status).toBe(200)
+
+      // Duplicate append (same seq) - should return 204
+      const r2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `hello`,
+      })
+      expect(r2.status).toBe(204)
+    })
+
+    test(`should accept epoch upgrade (new epoch starts at seq=0)`, async () => {
+      const streamPath = `/v1/stream/producer-epoch-upgrade-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Establish epoch=0
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `epoch0-msg0`,
+      })
+
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `1`,
+        },
+        body: `epoch0-msg1`,
+      })
+
+      // Upgrade to epoch=1, seq=0
+      const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `1`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `epoch1-msg0`,
+      })
+      expect(r.status).toBe(200)
+      expect(r.headers.get(PRODUCER_EPOCH_HEADER)).toBe(`1`)
+    })
+
+    test(`should reject stale epoch with 403 (zombie fencing)`, async () => {
+      const streamPath = `/v1/stream/producer-stale-epoch-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Establish epoch=1
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `1`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `msg`,
+      })
+
+      // Try to write with epoch=0 (stale)
+      const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `zombie`,
+      })
+      expect(r.status).toBe(403)
+      expect(r.headers.get(PRODUCER_EPOCH_HEADER)).toBe(`1`)
+    })
+
+    test(`should reject sequence gap with 409`, async () => {
+      const streamPath = `/v1/stream/producer-seq-gap-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Send seq=0
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `msg0`,
+      })
+
+      // Skip seq=1, try to send seq=2 (gap)
+      const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `2`,
+        },
+        body: `msg2`,
+      })
+      expect(r.status).toBe(409)
+      expect(r.headers.get(PRODUCER_EXPECTED_SEQ_HEADER)).toBe(`1`)
+      expect(r.headers.get(PRODUCER_RECEIVED_SEQ_HEADER)).toBe(`2`)
+    })
+
+    test(`should reject epoch increase with seq != 0`, async () => {
+      const streamPath = `/v1/stream/producer-epoch-bad-seq-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Establish epoch=0
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `msg`,
+      })
+
+      // Try epoch=1 with seq=5 (invalid - new epoch must start at seq=0)
+      const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `1`,
+          [PRODUCER_SEQ_HEADER]: `5`,
+        },
+        body: `bad`,
+      })
+      expect(r.status).toBe(400)
+    })
+
+    test(`should require all producer headers together`, async () => {
+      const streamPath = `/v1/stream/producer-partial-headers-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Only Producer-Id
+      const r1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+        },
+        body: `msg`,
+      })
+      expect(r1.status).toBe(400)
+
+      // Only Producer-Epoch
+      const r2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+        },
+        body: `msg`,
+      })
+      expect(r2.status).toBe(400)
+
+      // Missing Producer-Seq
+      const r3 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+        },
+        body: `msg`,
+      })
+      expect(r3.status).toBe(400)
+    })
+
+    test(`should reject invalid integer formats in producer headers`, async () => {
+      const streamPath = `/v1/stream/producer-invalid-format-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Producer-Seq with trailing junk (e.g., "1abc")
+      const r1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `1abc`,
+        },
+        body: `msg`,
+      })
+      expect(r1.status).toBe(400)
+
+      // Producer-Epoch with trailing junk
+      const r2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0xyz`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `msg`,
+      })
+      expect(r2.status).toBe(400)
+
+      // Scientific notation should be rejected
+      const r3 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `1e3`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `msg`,
+      })
+      expect(r3.status).toBe(400)
+
+      // Negative values should be rejected
+      const r4 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `-1`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `msg`,
+      })
+      expect(r4.status).toBe(400)
+
+      // Valid integers should still work
+      const r5 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `msg`,
+      })
+      expect(r5.status).toBe(200)
+    })
+
+    test(`multiple producers should have independent state`, async () => {
+      const streamPath = `/v1/stream/producer-multi-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Producer A: seq=0
+      const rA0 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `producer-A`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `A0`,
+      })
+      expect(rA0.status).toBe(200)
+
+      // Producer B: seq=0 (should be independent)
+      const rB0 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `producer-B`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `B0`,
+      })
+      expect(rB0.status).toBe(200)
+
+      // Producer A: seq=1
+      const rA1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `producer-A`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `1`,
+        },
+        body: `A1`,
+      })
+      expect(rA1.status).toBe(200)
+
+      // Producer B: seq=1
+      const rB1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `producer-B`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `1`,
+        },
+        body: `B1`,
+      })
+      expect(rB1.status).toBe(200)
+    })
+
+    test(`duplicate of seq=0 should not corrupt state`, async () => {
+      const streamPath = `/v1/stream/producer-dup-seq0-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // First seq=0
+      const r1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `first`,
+      })
+      expect(r1.status).toBe(200)
+
+      // Retry seq=0 (simulating lost response)
+      const r2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `first`,
+      })
+      expect(r2.status).toBe(204) // Duplicate
+
+      // seq=1 should succeed (state not corrupted)
+      const r3 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `1`,
+        },
+        body: `second`,
+      })
+      expect(r3.status).toBe(200)
+    })
+
+    test(`duplicate response should return highest accepted seq, not request seq`, async () => {
+      const streamPath = `/v1/stream/producer-dup-highest-seq-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Send seq=0, 1, 2 successfully
+      for (let i = 0; i < 3; i++) {
+        const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `POST`,
+          headers: {
+            "Content-Type": `text/plain`,
+            [PRODUCER_ID_HEADER]: `test-producer`,
+            [PRODUCER_EPOCH_HEADER]: `0`,
+            [PRODUCER_SEQ_HEADER]: `${i}`,
+          },
+          body: `msg-${i}`,
+        })
+        expect(r.status).toBe(200)
+        expect(r.headers.get(PRODUCER_SEQ_HEADER)).toBe(`${i}`)
+      }
+
+      // Now retry seq=1 (an older duplicate)
+      // Per PROTOCOL.md: "the highest accepted sequence number for this (stream, producerId, epoch) tuple"
+      // Should return 2 (highest accepted), not 1 (the request seq)
+      const dupResponse = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `1`,
+        },
+        body: `msg-1`,
+      })
+      expect(dupResponse.status).toBe(204)
+      // The key assertion: should return highest (2), not request seq (1)
+      expect(dupResponse.headers.get(PRODUCER_SEQ_HEADER)).toBe(`2`)
+    })
+
+    test(`split-brain fencing scenario`, async () => {
+      const streamPath = `/v1/stream/producer-split-brain-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Producer A (original): epoch=0, seq=0
+      const rA0 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `shared-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `A0`,
+      })
+      expect(rA0.status).toBe(200)
+
+      // Producer B (new instance): claims with epoch=1
+      const rB0 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `shared-producer`,
+          [PRODUCER_EPOCH_HEADER]: `1`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `B0`,
+      })
+      expect(rB0.status).toBe(200)
+
+      // Producer A (zombie): tries epoch=0, seq=1 - should be fenced
+      const rA1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `shared-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `1`,
+        },
+        body: `A1`,
+      })
+      expect(rA1.status).toBe(403)
+      expect(rA1.headers.get(PRODUCER_EPOCH_HEADER)).toBe(`1`)
+    })
+
+    test(`epoch rollback should be rejected`, async () => {
+      const streamPath = `/v1/stream/producer-epoch-rollback-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Establish epoch=2
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `2`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `msg`,
+      })
+
+      // Try epoch=1 (rollback)
+      const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `1`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `rollback`,
+      })
+      expect(r.status).toBe(403)
+    })
+
+    test(`producer headers work with Stream-Seq header`, async () => {
+      const streamPath = `/v1/stream/producer-with-stream-seq-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Append with both producer and Stream-Seq headers
+      const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+          [STREAM_SEQ_HEADER]: `app-seq-001`,
+        },
+        body: `msg`,
+      })
+      expect(r.status).toBe(200)
+    })
+
+    test(`producer duplicate should return 204 even with Stream-Seq header`, async () => {
+      // This tests that producer dedupe is checked BEFORE Stream-Seq validation.
+      // A retry with the same producer headers should be deduplicated at the
+      // transport layer, returning 204, even if Stream-Seq would otherwise conflict.
+      const streamPath = `/v1/stream/producer-dedupe-before-stream-seq-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // First append with both producer and Stream-Seq headers
+      const r1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+          [STREAM_SEQ_HEADER]: `app-seq-001`,
+        },
+        body: `msg`,
+      })
+      expect(r1.status).toBe(200)
+
+      // Retry the SAME append (same producer headers AND same Stream-Seq)
+      // This should return 204 (duplicate) NOT 409 (Stream-Seq conflict)
+      // because producer dedupe must be checked before Stream-Seq validation.
+      const r2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+          [STREAM_SEQ_HEADER]: `app-seq-001`,
+        },
+        body: `msg`,
+      })
+      expect(r2.status).toBe(204)
+    })
+
+    // ========================================================================
+    // Data Integrity Tests - Read Back Verification
+    // ========================================================================
+
+    test(`should store and read back data correctly`, async () => {
+      const streamPath = `/v1/stream/producer-readback-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Append with producer headers
+      const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `hello world`,
+      })
+      expect(r.status).toBe(200)
+
+      // Read back and verify
+      const readResponse = await fetch(`${getBaseUrl()}${streamPath}`)
+      expect(readResponse.status).toBe(200)
+      const content = await readResponse.text()
+      expect(content).toBe(`hello world`)
+    })
+
+    test(`should preserve order of sequential producer writes`, async () => {
+      const streamPath = `/v1/stream/producer-order-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Append multiple messages in sequence
+      for (let i = 0; i < 5; i++) {
+        const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `POST`,
+          headers: {
+            "Content-Type": `text/plain`,
+            [PRODUCER_ID_HEADER]: `test-producer`,
+            [PRODUCER_EPOCH_HEADER]: `0`,
+            [PRODUCER_SEQ_HEADER]: `${i}`,
+          },
+          body: `msg-${i}`,
+        })
+        expect(r.status).toBe(200)
+      }
+
+      // Read back and verify order
+      const readResponse = await fetch(`${getBaseUrl()}${streamPath}`)
+      const content = await readResponse.text()
+      expect(content).toBe(`msg-0msg-1msg-2msg-3msg-4`)
+    })
+
+    test(`duplicate should not corrupt or duplicate data`, async () => {
+      const streamPath = `/v1/stream/producer-dup-integrity-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // First write
+      const r1 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `first`,
+      })
+      expect(r1.status).toBe(200)
+
+      // Duplicate (retry)
+      const r2 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `first`,
+      })
+      expect(r2.status).toBe(204)
+
+      // Continue with seq=1
+      const r3 = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `1`,
+        },
+        body: `second`,
+      })
+      expect(r3.status).toBe(200)
+
+      // Read back - should have exactly "firstsecond", not "firstfirstsecond"
+      const readResponse = await fetch(`${getBaseUrl()}${streamPath}`)
+      const content = await readResponse.text()
+      expect(content).toBe(`firstsecond`)
+    })
+
+    test(`multiple producers should interleave correctly`, async () => {
+      const streamPath = `/v1/stream/producer-interleave-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Interleave writes from two producers
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `producer-A`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `A0`,
+      })
+
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `producer-B`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `B0`,
+      })
+
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `producer-A`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `1`,
+        },
+        body: `A1`,
+      })
+
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `producer-B`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `1`,
+        },
+        body: `B1`,
+      })
+
+      // Read back - should have all data in order of arrival
+      const readResponse = await fetch(`${getBaseUrl()}${streamPath}`)
+      const content = await readResponse.text()
+      expect(content).toBe(`A0B0A1B1`)
+    })
+
+    // ========================================================================
+    // JSON Mode with Producer Headers
+    // ========================================================================
+
+    test(`should store and read back JSON object correctly`, async () => {
+      const streamPath = `/v1/stream/producer-json-obj-${Date.now()}`
+
+      // Create JSON stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `application/json` },
+      })
+
+      // Append JSON with producer headers
+      const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `application/json`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: JSON.stringify({ event: `test`, value: 42 }),
+      })
+      expect(r.status).toBe(200)
+
+      // Read back and verify
+      const readResponse = await fetch(`${getBaseUrl()}${streamPath}`)
+      const data = await readResponse.json()
+      expect(data).toEqual([{ event: `test`, value: 42 }])
+    })
+
+    test(`should preserve order of JSON appends with producer`, async () => {
+      const streamPath = `/v1/stream/producer-json-order-${Date.now()}`
+
+      // Create JSON stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `application/json` },
+      })
+
+      // Append multiple JSON messages
+      for (let i = 0; i < 5; i++) {
+        const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+          method: `POST`,
+          headers: {
+            "Content-Type": `application/json`,
+            [PRODUCER_ID_HEADER]: `test-producer`,
+            [PRODUCER_EPOCH_HEADER]: `0`,
+            [PRODUCER_SEQ_HEADER]: `${i}`,
+          },
+          body: JSON.stringify({ seq: i, data: `msg-${i}` }),
+        })
+        expect(r.status).toBe(200)
+      }
+
+      // Read back and verify order
+      const readResponse = await fetch(`${getBaseUrl()}${streamPath}`)
+      const data = await readResponse.json()
+      expect(data).toEqual([
+        { seq: 0, data: `msg-0` },
+        { seq: 1, data: `msg-1` },
+        { seq: 2, data: `msg-2` },
+        { seq: 3, data: `msg-3` },
+        { seq: 4, data: `msg-4` },
+      ])
+    })
+
+    test(`JSON duplicate should not corrupt data`, async () => {
+      const streamPath = `/v1/stream/producer-json-dup-${Date.now()}`
+
+      // Create JSON stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `application/json` },
+      })
+
+      // First write
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `application/json`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: JSON.stringify({ id: 1 }),
+      })
+
+      // Duplicate
+      const dup = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `application/json`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: JSON.stringify({ id: 1 }),
+      })
+      expect(dup.status).toBe(204)
+
+      // Continue
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `application/json`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `1`,
+        },
+        body: JSON.stringify({ id: 2 }),
+      })
+
+      // Read back - should have exactly [{id:1}, {id:2}]
+      const readResponse = await fetch(`${getBaseUrl()}${streamPath}`)
+      const data = await readResponse.json()
+      expect(data).toEqual([{ id: 1 }, { id: 2 }])
+    })
+
+    test(`should reject invalid JSON with producer headers`, async () => {
+      const streamPath = `/v1/stream/producer-json-invalid-${Date.now()}`
+
+      // Create JSON stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `application/json` },
+      })
+
+      // Try to append invalid JSON
+      const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `application/json`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `{ invalid json }`,
+      })
+      expect(r.status).toBe(400)
+    })
+
+    test(`should reject empty JSON array with producer headers`, async () => {
+      const streamPath = `/v1/stream/producer-json-empty-${Date.now()}`
+
+      // Create JSON stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `application/json` },
+      })
+
+      // Try to append empty array
+      const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `application/json`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `[]`,
+      })
+      expect(r.status).toBe(400)
+    })
+
+    // ========================================================================
+    // Error Cases
+    // ========================================================================
+
+    test(`should return 404 for non-existent stream`, async () => {
+      const streamPath = `/v1/stream/producer-404-${Date.now()}`
+
+      // Try to append to non-existent stream
+      const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `data`,
+      })
+      expect(r.status).toBe(404)
+    })
+
+    test(`should return 409 for content-type mismatch`, async () => {
+      const streamPath = `/v1/stream/producer-ct-mismatch-${Date.now()}`
+
+      // Create stream with text/plain
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Try to append with application/json
+      const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `application/json`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: JSON.stringify({ data: `test` }),
+      })
+      expect(r.status).toBe(409)
+    })
+
+    test(`should return 400 for empty body`, async () => {
+      const streamPath = `/v1/stream/producer-empty-body-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Try to append empty body
+      const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: `test-producer`,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: ``,
+      })
+      expect(r.status).toBe(400)
+    })
+
+    test(`should reject empty Producer-Id`, async () => {
+      const streamPath = `/v1/stream/producer-empty-id-${Date.now()}`
+
+      // Create stream
+      await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `PUT`,
+        headers: { "Content-Type": `text/plain` },
+      })
+
+      // Try with empty producer ID
+      const r = await fetch(`${getBaseUrl()}${streamPath}`, {
+        method: `POST`,
+        headers: {
+          "Content-Type": `text/plain`,
+          [PRODUCER_ID_HEADER]: ``,
+          [PRODUCER_EPOCH_HEADER]: `0`,
+          [PRODUCER_SEQ_HEADER]: `0`,
+        },
+        body: `data`,
+      })
+      expect(r.status).toBe(400)
+    })
   })
 }