@preventive/triage 1.0.0-alpha.3 → 1.0.0-alpha.30

package/{server → server-e2e}/objstore/rest.ts

@@ -41,7 +41,9 @@ import {
 } from './store.ts'
 import type { LiveReader } from './blob.ts'
 import { type TokenSecret, extractBearer, verifyToken } from './tokens.ts'
-import { errStack } from '../util.ts'
+import { deny, denyConflict } from './rest-deny.ts'
+import { handleRestMint } from './rest-mint.ts'
+import { debugId, debugTag, errMsg, errStack } from '../util.ts'
 
 // Server-side fault codes that should surface as 500 `io-error`
 // rather than 400 `aborted`. `pipeline(req, ws)` rejects with the
@@ -66,6 +68,18 @@ export type ObjstoreRestDeps = {
   // workspace_object for the full metadata (version, hash, length,
   // signature). SQLite mode passes a no-op.
   publishObjPut: (tag: string, resourceTag: string) => void
+  // Cross-instance pub/sub for objstore-deleted — fired alongside the local
+  // `broadcast` after a successful REST delete mint, so peers on OTHER
+  // instances drop the resource in real time. Carries (tag, resourceTag,
+  // version, incarnation) inline (the row is gone post-delete). SQLite mode passes a no-op.
+  publishObjDeleted: (tag: string, resourceTag: string, version: number, incarnation: string) => void
+  // New-workspace operator gate for the REST put-begin mint — the
+  // connection-independent analog of the WS path's `authGate`. Returns
+  // `true` to DENY (a password is configured AND the workspace is
+  // never-before-seen), which routes the client to its in-band WS
+  // put-begin fallback (REST has no socket auth state to consult).
+  // No-config default is open (never deny), matching the WS authGate.
+  restPutGate: (workspaceTag: string) => Promise<boolean>
   debug: boolean
 }
 
@@ -91,7 +105,7 @@ export type ObjstoreRestDeps = {
 // concurrent same-token PUT is rejected (409) before it can open a
 // second writer. The slot is held only across body + commit, released
 // in a `finally`, and bounded by the REST idle-body timeout in
-// server/http.ts so a slow-loris can't pin it. NOT a commit lock —
+// server-e2e/http.ts so a slow-loris can't pin it. NOT a commit lock —
 // commits stay lock-free on the version-CAS above. Per-process: the
 // Vercel multi-replica path leans on `allowOverwrite: true` + the
 // commit CAS + content-addressing for cross-replica correctness (a
@@ -116,34 +130,21 @@ export function matchRoute(url: string | undefined): RouteMatch | null {
   return { tag: tag!, resourceTag: resourceTag! }
 }
 
-function deny(res: ServerResponse, status: number, body: string): void {
-  // Uniform `{ error: <reason> }` JSON envelope for every failure so
-  // clients parse one shape. Status + reason are NOT intentionally
-  // indistinguishable across causes — 401/404/405/410/411/500 each map
-  // to a documented reason in server/README.md and the client decides
-  // recovery from the code. Probe-distinguishing defense isn't a goal:
-  // every reason is reachable only after the route + bearer-token check
-  // passes (or as 401/404 from the public surface), so a probe gains no
-  // signal it couldn't otherwise enumerate.
-  res.writeHead(status, { 'content-type': 'application/json' })
-  res.end(JSON.stringify({ error: body }))
-}
-
-// Variant of `deny` that augments the JSON envelope with the live
-// row's `currentVersion` + `currentIncarnation` so a REST PUT 409 lets
-// the caller rebase onto the right precondition token. Without this the
-// client only learns the slot is occupied — not at what (version,
-// incarnation) — and retries blindly against a non-empty slot, looping
-// indefinitely against a live row. Symmetric with the WS plane's
-// `objstore-conflict` envelope.
-function denyConflict(res: ServerResponse, currentVersion: number | null, currentIncarnation: string | null): void {
-  res.writeHead(409, { 'content-type': 'application/json' })
-  res.end(JSON.stringify({ error: 'conflict', currentVersion, currentIncarnation }))
-}
-
 export async function handleRest(deps: ObjstoreRestDeps, req: IncomingMessage, res: ServerResponse): Promise<void> {
   const route = matchRoute(req.url)
   if (!route) { deny(res, 404, 'not-found'); return }
+  // POST = REST mint (fetch or put-begin, by body `op`; signature-authed
+  // via the JSON body, no bearer token). Dispatched before the bearer-token
+  // gate below, which guards the token-authed GET/PUT byte transfers.
+  if (req.method === 'POST') {
+    try { await handleRestMint(deps, req, res, route) }
+    catch (err: unknown) {
+      if (deps.debug) console.warn('objstore POST error:', errStack(err))
+      if (res.headersSent) res.destroy()
+      else deny(res, 500, 'internal')
+    }
+    return
+  }
   const token = extractBearer(req.headers['authorization'])
   if (!token) { deny(res, 401, 'unauthorized'); return }
   const payload = verifyToken(deps.secret, token)
@@ -431,7 +432,10 @@ async function runUploadAndCommit(
 type GetOpened =
   | { reason: 'ok'; reader: LiveReader }
   | { reason: 'not-found' }
-  | { reason: 'unavailable' }
+  // `detail` is a short non-sensitive cause tag (backend sub-reason +
+  // content-hash prefix) the GET handler logs so a 503 is diagnosable —
+  // every byte-side failure collapses to the same wire 503 otherwise.
+  | { reason: 'unavailable'; detail: string }
 
 async function openLiveSnapshot(
   deps: ObjstoreRestDeps, route: RouteMatch, payload: { ver: number; inc: string },
@@ -448,17 +452,27 @@ async function openLiveSnapshot(
   // returns a pinned fd; for the Vercel backend a fetch-backed stream.)
   const live = await deps.handle.selectLiveOne.get(route.tag, route.resourceTag)
   if (!live || live.version !== payload.ver || live.incarnation !== payload.inc) return { reason: 'not-found' }
+  // Tag the content hash into every `unavailable` detail so an operator
+  // can go check the byte store directly for THIS blob (gone → reaper /
+  // deletion; present → transient read fault).
+  const hashTag = `hash=${debugId(live.content_hash)}`
   let opened
   try { opened = await deps.handle.blob.openLiveReader(route.tag, live.content_hash) }
-  catch { return { reason: 'unavailable' } }
-  if (!opened.ok) return { reason: opened.reason }
+  // Length-cap the thrown error text: today a non-BlobNotFound SDK throw
+  // (BlobServiceNotAvailable / store-not-found) carries no credential
+  // (the RW token rides the Authorization header, never `.message`), but
+  // a future SDK could embed a signed URL / token fragment — bound the
+  // log line so it can't dump one verbatim. Mirrors the `.slice(0, 200)`
+  // cap used on SDK error text in blob-vercel.ts.
+  catch (err) { return { reason: 'unavailable', detail: `open-threw ${hashTag} ${String(errMsg(err)).slice(0, 200)}` } }
+  if (!opened.ok) return { reason: 'unavailable', detail: `${opened.detail ?? 'backend'} ${hashTag}` }
   // Size mismatch between the live row and the on-storage bytes
   // is a transient inconsistency — reaper will reconcile. Close
   // the reader before returning so we don't leak the fd / fetch
   // reader. PR #4 review H8.
   if (opened.reader.size !== live.content_length) {
     await opened.reader.close().catch(() => {})
-    return { reason: 'unavailable' }
+    return { reason: 'unavailable', detail: `size-mismatch row=${live.content_length} blob=${opened.reader.size} ${hashTag}` }
   }
   return { reason: 'ok', reader: opened.reader }
 }
@@ -478,8 +492,19 @@ async function handleRestGet(
   // If the live row is there but the bytes are missing / wrong size,
   // it's a transient inconsistency the reaper will sort out — 503
   // (vs 404) tells the client this is a server-side state, not a
-  // "the resource truly isn't there" answer.
-  if (opened.reason === 'unavailable') { deny(res, 503, 'unavailable'); return }
+  // "the resource truly isn't there" answer. Log the cause
+  // UNCONDITIONALLY (not behind `debug`): a 503 means a live row whose
+  // bytes can't be served, and the wire response can't distinguish a
+  // permanent loss (reaper GC'd referenced bytes) from a transient read
+  // fault. `detail` carries the backend sub-reason + content-hash prefix
+  // so an operator can tell which — the only server-side breadcrumb for
+  // the "all data turned into 503" failure. (Volume is bounded: a 503 is
+  // an error path; a workspace-wide outage is exactly when these are
+  // wanted.)
+  if (opened.reason === 'unavailable') {
+    console.warn(`objstore-get: 503 unavailable ${debugTag(route.tag)}/${route.resourceTag.slice(0, 8)}… v${payload.ver} ${opened.detail}`)
+    deny(res, 503, 'unavailable'); return
+  }
   res.writeHead(200, {
     'content-type': 'application/octet-stream',
     'content-length': String(opened.reader.size),

package/{server → server-e2e}/objstore/sign.ts

@@ -10,6 +10,18 @@ import { isValidIncarnation } from './store.ts'
 const OBJSTORE_PUT_DOMAIN = 'deepview-objstore.v1.put'
 const OBJSTORE_DELETE_DOMAIN = 'deepview-objstore.v1.delete'
 const OBJSTORE_FETCH_DOMAIN = 'deepview-objstore.v1.fetch'
+// REST fetch-mint domain — MUST match the client's FETCH_REST_DOMAIN
+// (client/sync/objstore-crypto.ts). Distinct from OBJSTORE_FETCH_DOMAIN so
+// a WS-fetch signature can't be replayed against the REST mint endpoint.
+const OBJSTORE_FETCH_REST_DOMAIN = 'deepview-objstore.v1.fetch-rest'
+// REST put-begin domain — MUST match the client's PUT_REST_DOMAIN. Distinct
+// from OBJSTORE_PUT_DOMAIN so a WS put-begin signature can't be replayed
+// against the REST mint endpoint.
+const OBJSTORE_PUT_REST_DOMAIN = 'deepview-objstore.v1.put-rest'
+// REST delete domain — MUST match the client's DELETE_REST_DOMAIN. Distinct
+// from OBJSTORE_DELETE_DOMAIN so a WS delete signature can't be replayed
+// against the REST mint endpoint.
+const OBJSTORE_DELETE_REST_DOMAIN = 'deepview-objstore.v1.delete-rest'
 
 // Wire shapes the verifiers accept. Fields land here post-
 // `JSON.parse`, so every value starts life as `unknown` — strict
@@ -95,6 +107,38 @@ function canonicalObjstoreFetch(msg: ObjstoreFetchMsg, connectionNonce: string):
   ].join('\n'))
 }
 
+// REST fetch-mint canonical. Binds a client epoch-ms timestamp (string-
+// encoded to match the client) in place of the connection nonce; the REST
+// handler enforces the freshness window + replay dedup.
+function canonicalObjstoreFetchRest(workspaceTag: string, resourceTag: string, ts: number): Uint8Array<ArrayBuffer> {
+  return encodeUtf8([
+    OBJSTORE_FETCH_REST_DOMAIN,
+    workspaceTag,
+    resourceTag,
+    String(ts),
+  ].join('\n'))
+}
+
+// REST put-begin canonical — the WS `canonicalObjstorePut` fields in the
+// same order/coercion (intOrEmpty / strOrEmpty), under the put-rest domain
+// and binding the client `ts` in place of the connection nonce.
+function canonicalObjstorePutRest(
+  workspaceTag: string, resourceTag: string,
+  prevVersion: number | null, prevIncarnation: string | null,
+  contentHash: string, expectedLength: number, ts: number,
+): Uint8Array<ArrayBuffer> {
+  return encodeUtf8([
+    OBJSTORE_PUT_REST_DOMAIN,
+    workspaceTag,
+    resourceTag,
+    intOrEmpty(prevVersion),
+    strOrEmpty(prevIncarnation),
+    contentHash,
+    String(expectedLength),
+    String(ts),
+  ].join('\n'))
+}
+
 // `Number.isSafeInteger` rather than `Number.isInteger`: JSON numbers
 // are IEEE-754 and integers above 2^53-1 aren't precisely
 // representable. Accepting non-safe integers would let a signed
@@ -162,3 +206,64 @@ export function verifyObjstoreFetchSig(msg: ObjstoreFetchMsg, connectionNonce: u
   if (typeof msg.resourceTag !== 'string') return Promise.resolve(false)
   return verifyObjstoreSig(msg, connectionNonce, (nonce) => canonicalObjstoreFetch(msg, nonce))
 }
+
+// Verify a REST fetch-mint signature. Unlike the WS verifiers this takes
+// the already-validated fields directly (the REST handler parsed +
+// range-checked `ts` and `signature`) rather than a wire `msg` + socket
+// nonce. The workspaceTag IS the Ed25519 public key, so verification is
+// fully self-contained — no session or stored key needed. A throw from
+// the canonical build (lone surrogate, etc.) is treated as a verify
+// failure, never an escaping exception.
+export function verifyObjstoreFetchRestSig(
+  workspaceTag: string, resourceTag: string, ts: number, signature: string,
+): Promise<boolean> {
+  let payload: Uint8Array<ArrayBuffer>
+  try { payload = canonicalObjstoreFetchRest(workspaceTag, resourceTag, ts) }
+  catch { return Promise.resolve(false) }
+  return verifyEd25519(workspaceTag, payload, signature)
+}
+
+// Verify a REST put-begin signature. Same self-contained shape as
+// `verifyObjstoreFetchRestSig` — the caller (rest.ts) has already
+// range-checked the put fields + `ts`. The workspaceTag IS the pubkey.
+export function verifyObjstorePutBeginRestSig(
+  fields: { workspaceTag: string; resourceTag: string; prevVersion: number | null; prevIncarnation: string | null; contentHash: string; expectedLength: number },
+  ts: number, signature: string,
+): Promise<boolean> {
+  let payload: Uint8Array<ArrayBuffer>
+  try {
+    payload = canonicalObjstorePutRest(
+      fields.workspaceTag, fields.resourceTag, fields.prevVersion, fields.prevIncarnation,
+      fields.contentHash, fields.expectedLength, ts,
+    )
+  } catch { return Promise.resolve(false) }
+  return verifyEd25519(fields.workspaceTag, payload, signature)
+}
+
+// REST delete-mint canonical. WS `canonicalObjstoreDelete` fields, under the
+// delete-rest domain, binding the client `ts` in place of the nonce.
+function canonicalObjstoreDeleteRest(
+  workspaceTag: string, resourceTag: string,
+  prevVersion: number | null, prevIncarnation: string | null, ts: number,
+): Uint8Array<ArrayBuffer> {
+  return encodeUtf8([
+    OBJSTORE_DELETE_REST_DOMAIN,
+    workspaceTag,
+    resourceTag,
+    intOrEmpty(prevVersion),
+    strOrEmpty(prevIncarnation),
+    String(ts),
+  ].join('\n'))
+}
+
+// Verify a REST delete-mint signature. Self-contained (workspaceTag IS the
+// pubkey); the caller (rest.ts) has range-checked `ts` + the prev pair.
+export function verifyObjstoreDeleteRestSig(
+  fields: { workspaceTag: string; resourceTag: string; prevVersion: number | null; prevIncarnation: string | null },
+  ts: number, signature: string,
+): Promise<boolean> {
+  let payload: Uint8Array<ArrayBuffer>
+  try { payload = canonicalObjstoreDeleteRest(fields.workspaceTag, fields.resourceTag, fields.prevVersion, fields.prevIncarnation, ts) }
+  catch { return Promise.resolve(false) }
+  return verifyEd25519(fields.workspaceTag, payload, signature)
+}

package/{server → server-e2e}/objstore/store-neon.ts

@@ -4,7 +4,7 @@
 // dialect on the wire.
 //
 // `@neondatabase/serverless` is an OPTIONAL peer dep — selected by
-// the `DATABASE_URL` branch in `server/index.ts`. The peer dep
+// the configured database URL branch in `server-e2e/index.ts`. The peer dep
 // itself is loaded lazily inside `openNeonObjstore` below. A single
 // Neon project / database holds both `workspace_revision` and the
 // two objstore tables; each plane opens its own stateless
@@ -13,14 +13,10 @@
 // release.
 //
 // Byte plane: passed in as a `BlobBackend` (./blob.ts). The
-// supported pairings selected by server/index.ts are:
-//   - Neon + Vercel Blob Private Storage (multi-replica, the only
-//     pairing that survives a replica restart without local-disk
-//     coordination). Activated by setting BLOB_READ_WRITE_TOKEN
-//     alongside DATABASE_URL.
-//   - Neon + local FS (development / operator escape hatch — bytes
-//     still need to live on a shared filesystem if you run more
-//     than one replica).
+// supported Neon pairing selected by server-e2e/index.ts is Vercel
+// Blob Private Storage. DATABASE_URL or E2E_DATABASE_URL plus BLOB_READ_WRITE_TOKEN
+// is required; the launcher never selects Neon + local FS. Tests
+// can inject a local-FS backend directly through this adapter.
 
 import type { BlobBackend } from './blob.ts'
 import type { AllStmt, GetStmt, RunStmt } from '../db-stmt.ts'
@@ -309,7 +305,7 @@ export async function openNeonObjstore(connectionString: string, blob: BlobBacke
   // local `../neon-driver.ts` re-export wrapper so the peer dep stays
   // optional AND tests can mock the driver (a local path is always
   // resolvable; the bare specifier isn't when the dep is absent). See
-  // `server/neon-driver.ts`. Cast through `unknown` because the
+  // `server-e2e/neon-driver.ts`. Cast through `unknown` because the
   // wrapper's `export *` re-exports a `@ts-ignore`'d module.
   const mod = (await import('../neon-driver.ts')) as unknown as { neon: (url: string) => NeonSql }
   const sql: NeonSql = mod.neon(connectionString)

package/{server → server-e2e}/objstore/store.ts

@@ -1,5 +1,5 @@
 // SQLite + filesystem-backed object store for the v1.objstore
-// protocol extension. Sibling of `server/db.ts`; shares the
+// protocol extension. Sibling of `server-e2e/db.ts`; shares the
 // underlying DatabaseSync handle but keeps its own tables.
 //
 //   workspace_object         — one row per LIVE resource (no
@@ -150,7 +150,7 @@ export type DeleteResult =
   | { ok: true; deletedVersion: number }
   | { ok: false; reason: 'not-found' | 'conflict'; conflict?: ObjectRow }
 
-// Async statement shapes are shared with server/db.ts via
+// Async statement shapes are shared with server-e2e/db.ts via
 // ../db-stmt.ts — same `.get/.all/.run` → Promise contract across
 // both planes.
 
@@ -186,7 +186,7 @@ export type Handle = {
   db?: DatabaseSync
   // Byte-plane backend (local FS or Vercel Blob). All bytes-side
   // operations go through this — there is no direct fs.* call in
-  // store / rest / reaper. Selected at boot in server/index.ts.
+  // store / rest / reaper. Selected at boot in server-e2e/index.ts.
   blob: BlobBackend
   // Storage root for the FS backend — set only when `blob` was
   // constructed from `openFsBlobBackend(dir)`. Production code
@@ -247,7 +247,7 @@ export type Handle = {
   // returned. The reaper passes `Date.now() - stagingTtlMs` so the
   // index `workspace_object_staging_begun_at_idx` is used and the
   // sweep is O(stale-rows) instead of O(in-flight-uploads-cluster-
-  // wide). DB-layout audit `server/objstore/store.ts:312`.
+  // wide). DB-layout audit `server-e2e/objstore/store.ts:312`.
   listAllStaging: AllStmt<[number], { workspace_tag: string; resource_tag: string; staging_id: string; begun_at: number }>
   listLiveTags: AllStmt<[], { workspace_tag: string }>
   countLive: GetStmt<[string], { c: number }>
@@ -255,7 +255,7 @@ export type Handle = {
 
 // Narrowing alias for the SQLite-backed Handle: `db` is guaranteed
 // to be set. `openObjstore` returns this so call sites (production
-// shutdown plumbing in `server/index.ts` + the entire SQLite-only
+// shutdown plumbing in `server-e2e/index.ts` + the entire SQLite-only
 // test suite in `tests/server-objstore.test.js`) can reach
 // `handle.db.prepare(...)` without an optional-chain or non-null
 // assertion. A Neon-backed Handle (`openNeonObjstore`) keeps the
@@ -352,7 +352,7 @@ export function openObjstore(db: DatabaseSync, dir: string): SqliteHandle {
   mkdirSync(dir, { recursive: true })
   db.exec(SCHEMA)
   // Fail-loud on a pre-existing non-STRICT table — same rationale as
-  // server/db.ts: `CREATE TABLE IF NOT EXISTS … STRICT` doesn't
+  // server-e2e/db.ts: `CREATE TABLE IF NOT EXISTS … STRICT` doesn't
   // upgrade an existing non-STRICT table, and dropping strict type
   // affinity opens an operator-attack path. PR #4 review F3.
   for (const name of ['workspace_object', 'workspace_object_staging']) {
@@ -362,7 +362,7 @@ export function openObjstore(db: DatabaseSync, dir: string): SqliteHandle {
   const blob = openFsBlobBackend(dir)
   // No `close` method on the returned Handle: the underlying
   // `DatabaseSync` is owned by the caller (in production, the
-  // workspace_revision handle in `server/db.ts`, closed from
+  // workspace_revision handle in `server-e2e/db.ts`, closed from
   // `shutdown()`; tests close their own DB). A `close()` here would
   // mislead — it could only no-op or leak, never close the caller-
   // owned connection.

package/{server → server-e2e}/objstore/tokens.ts

@@ -119,7 +119,7 @@ function isValidPayload(v: unknown): v is TokenPayload {
   // different actual value, or — for `exp` — claim a
   // `Number.MAX_SAFE_INTEGER + 1` expiry that compares ambiguously near
   // the IEEE-754 boundary. Matches the codebase's other safe-int gates
-  // (server/objstore/sign.ts, rest.ts, handlers.ts).
+  // (server-e2e/objstore/sign.ts, rest.ts, handlers.ts).
   if (!Number.isSafeInteger(o['exp']) || (o['exp'] as number) < 0) return false
   if (o['op'] === 'put') {
     return typeof o['sid'] === 'string'

package/{server → server-e2e}/pubsub.ts

@@ -1,5 +1,5 @@
 // Cross-instance pub/sub for real-time WS broadcasts. The triage-sync
-// fan-out is an in-memory subscriber map (server/hub.ts) by design — it
+// fan-out is an in-memory subscriber map (server-e2e/hub.ts) by design — it
 // routes a commit only to peers on the SAME instance. A multi-instance
 // deployment behind a load balancer needs commit-landed-on-A to reach
 // peers-on-B with the same latency the hub gives same-instance peers.
@@ -57,15 +57,15 @@ function newSenderId(): string {
 //   - 'objput': objstore-put broadcast. `res` is the resource tag; the
 //     receiver SELECTs the live row by (tag, res) for the rest of the
 //     metadata fields.
-//   - 'objdel': objstore-deleted broadcast. `ver` is the deleted version
-//     — inline because the row is gone from workspace_object after the
-//     delete commit.
+//   - 'objdel': objstore-deleted broadcast. `ver` and `incarnation` identify
+//     the deleted row, which is gone from workspace_object after commit.
+//     Incarnation is optional only for messages from older relay instances.
 export type BusMessage =
   | { kind: 'rev'; tag: string; id: string }
   | { kind: 'objput'; tag: string; res: string }
-  | { kind: 'objdel'; tag: string; res: string; ver: number }
+  | { kind: 'objdel'; tag: string; res: string; ver: number; incarnation?: string }
 
-// Receiver wired up by the hub layer (see server/index.ts). Each handler
+// Receiver wired up by the hub layer (see server-e2e/index.ts). Each handler
 // runs once per remote message; failures are logged but don't crash the
 // LISTEN loop — a missed broadcast surfaces to clients on reconnect
 // (chain re-pull). Async because the workspace-revision handler does a
@@ -164,7 +164,7 @@ type NeonState = {
   // In-flight bus-message handler promises. `dispatchNotification`
   // fires handlers fire-and-forget, but `stop()` awaits this set before
   // returning so the lifecycle's `handle.close()` (which runs after
-  // `pubsub.stop()` — see closeDb in server/index.ts) can't race a
+  // `pubsub.stop()` — see closeDb in server-e2e/index.ts) can't race a
   // handler mid-`handle.revisionById.get` / `getLive`.
   pendingHandlers: Set<Promise<void>>
 }
@@ -333,7 +333,7 @@ export function createNeonPubSub(deps: NeonPubSubDeps): PubSub {
       if (state.connectAttempt) { try { await state.connectAttempt } catch {} }
       // Drain in-flight bus-message handlers BEFORE returning. The
       // lifecycle teardown runs `pubsub.stop()` and THEN
-      // `handle.close()` (see closeDb in server/index.ts); a handler
+      // `handle.close()` (see closeDb in server-e2e/index.ts); a handler
       // still in `handle.revisionById.get` / `getLive` would otherwise
       // throw against a closed DB. `allSettled` so one handler's
       // rejection doesn't abort the drain.
@@ -388,7 +388,10 @@ function parseBusMessage(raw: Record<string, unknown>): BusMessage | null {
     const ver = raw['ver']
     if (typeof res !== 'string') return null
     if (typeof ver !== 'number' || !Number.isSafeInteger(ver)) return null
-    return { kind: 'objdel', tag, res, ver }
+    const incarnation = raw['incarnation']
+    if (incarnation === undefined) return { kind: 'objdel', tag, res, ver }
+    if (typeof incarnation !== 'string' || incarnation.length === 0) return null
+    return { kind: 'objdel', tag, res, ver, incarnation }
   }
   return null
 }

package/{server → server-e2e}/sign.ts

@@ -92,7 +92,7 @@ export function canonicalSave(
   // confusing diff in the canonical bytes rather than a clean drop.
   // Mirrors the `isSafeNonNegativeInt` rigor that the objstore
   // canonical builders apply. Input-validation audit
-  // `server/sign.ts:88`.
+  // `server-e2e/sign.ts:88`.
   if (typeof workspaceTag !== 'string') throw new TypeError('canonicalSave: workspaceTag must be string')
   if (typeof nonce !== 'string') throw new TypeError('canonicalSave: nonce must be string')
   if (typeof ciphertext !== 'string') throw new TypeError('canonicalSave: ciphertext must be string')
@@ -122,7 +122,7 @@ function canonicalSubscribe(
   return encodeUtf8([SUBSCRIBE_DOMAIN, workspaceTag as string, fromStr, connectionNonce].join('\n'))
 }
 
-// Exported because the v1.objstore signing module (server/objstore/sign.ts)
+// Exported because the v1.objstore signing module (server-e2e/objstore/sign.ts)
 // reuses it for its four verifiers — same workspaceTag-as-pubkey contract,
 // same domain-separated canonical bytes. Keeping the WebCrypto plumbing
 // in one place avoids drift between the triage-sync and objstore verify
@@ -157,7 +157,7 @@ export async function verifyEd25519(
 // `{ ok: false, canonical: null }` on bad shape / bad sig;
 // `{ ok: true, canonical: <bytes> }` on success.
 //
-// NOT used by `server/index.ts handleSave`. Production composes
+// NOT used by `server-e2e/index.ts handleSave`. Production composes
 // the smaller helpers (`canonicalSave`, `computeRevisionIdFromCanonical`,
 // `verifyEd25519`) separately so the dup-precheck via
 // `revisionExists` can fire BEFORE Ed25519-verify and skip the
@@ -204,7 +204,7 @@ export async function computeRevisionIdFromCanonical(canonical: Uint8Array<Array
 
 // `connectionNonce` is the per-socket challenge the server issued
 // to the originating connection (see `Peer.challenge` in
-// server/peer.ts). The client signs a canonical that includes the
+// server-e2e/peer.ts). The client signs a canonical that includes the
 // nonce; verifying against the SAME nonce here is what blocks
 // cross-connection replay of a captured subscribe frame. Audit
 // round-9 H2.