@syncular/server 0.15.44 → 0.15.45

package/README.md

@@ -8,7 +8,7 @@ pruning (§4.6), and signed-URL token issuance (§5.4). `SPEC.md` is
 normative for everything on the wire; this README covers the **host
 surface** — in particular the ops seam and the pruning runbook.
 
-## Deployment matrix (runtime adapters, TODO §4.2)
+## Deployment matrix (runtime adapters)
 
 The server core is **runtime-neutral TypeScript** — `handleSyncRequest` and
 the realtime session speak only Web `Request`/`Response`/`fetch`/Web-Crypto,

package/dist/admin.d.ts

@@ -1,6 +1,6 @@
 /**
- * `SyncularAdmin` — the operator-facing read surface over the server core
- * (TODO §2.5). A read-only, partition-scoped, JSON-able query layer over
+ * `SyncularAdmin` is the operator-facing read surface over the server core.
+ * It is a read-only, partition-scoped, JSON-able query layer over
  * `ServerStorage`, the optional segment/blob store stats, and an in-memory
  * event ring. It delivers the 80% operator value (who's connected, what's
  * flowing, horizon health, the event tail) as a handful of queries in the

package/dist/admin.js

@@ -16,7 +16,7 @@ function percentile(sample, q) {
 }
 function required(value, what) {
     if (value === undefined) {
-        throw new Error(`SyncularAdmin: the configured ${what} does not implement this read (TODO §2.5 optional method missing)`);
+        throw new Error(`SyncularAdmin: the configured ${what} does not implement this optional read`);
     }
     return value;
 }

package/dist/blob-store.d.ts

@@ -20,7 +20,7 @@ export interface BlobRecord {
     readonly createdAtMs: number;
 }
 /**
- * Coarse blob-store counters for the admin/console read surface (TODO
+ * Coarse blob-store counters for the admin/console read surface (work item
  * §2.5), partition-scoped. Optional. `count`/`bytes` are total stored
  * blobs; a store that omits `stats()` cannot report them.
  */
@@ -53,7 +53,7 @@ export interface BlobStore {
      * Returns the deleted blobIds.
      */
     sweepOrphans(partition: string, olderThanMs: number, referencedBlobIds: ReadonlySet<string>): Promise<string[]>;
-    /** Admin/console counters (TODO §2.5) — ADDITIVE, optional. */
+    /** Admin/console counters (work item §2.5) — ADDITIVE, optional. */
     stats?(partition: string): Promise<BlobStoreStats>;
 }
 /** `"sha256:" + hex` of the bytes — the content address (§5.9.1). */

package/dist/context.d.ts

@@ -1,5 +1,5 @@
 /**
- * The host context for `handleSyncRequest` (REVISE B2): storage, the
+ * The host context for `handleSyncRequest`: storage, the
  * `resolveScopes` host callback (runs in the host process — the moat),
  * clock, and a segment store. Framework-free; adapters supply `partition`
  * and `actorId` from host authentication (§1.1).
@@ -136,7 +136,7 @@ export interface SyncServerConfig {
      */
     readonly blobUploadUrls?: BlobUploadPresignConfig;
     /**
-     * §5.3 sqlite-image builder (TODO §4.2), injected so the pull path never
+     * §5.3 sqlite-image builder, injected so the pull path never
      * statically imports `bun:sqlite`. Absent ⇒ the sqlite-image lane is off
      * (bit-2 clients are served the rows lane) — the Workers/edge posture. A
      * Bun/Node host wires `buildSqliteImage` from `@syncular/server`.

package/dist/d1-storage.js

@@ -1,6 +1,6 @@
 var _a;
 /**
- * Cloudflare D1 server storage (TODO §4.2 — the Workers deployment rung).
+ * Cloudflare D1 server storage for Workers deployments.
  *
  * D1 *is* SQLite exposed over an async, statement-at-a-time API
  * (`prepare(sql).bind(...).all()` / `.first()` / `.run()`, plus `batch([…])`
@@ -448,7 +448,7 @@ export class D1ServerStorage {
         for (const table of schema.tables.values()) {
             const bindCount = tableColumnNames(table).length;
             if (bindCount > D1_MAX_BIND_PARAMS) {
-                throw new Error(`table ${JSON.stringify(table.name)} needs ${bindCount} bound parameters per upsert — D1 caps statements at ${D1_MAX_BIND_PARAMS} (DESIGN "D1 bind-parameter limit")`);
+                throw new Error(`table ${JSON.stringify(table.name)} needs ${bindCount} bound parameters per upsert; D1 caps statements at ${D1_MAX_BIND_PARAMS}`);
             }
         }
         await this.#db.exec(`${SCHEMA_META_DDL_SQLITE.replace(/\s+/g, ' ')};`);
@@ -757,7 +757,7 @@ export class D1ServerStorage {
             .all();
         return results.map((r) => r.blob_id);
     }
-    // -- admin/console read surface (TODO §2.5) --------------------------------
+    // -- admin/console read surface --------------------------------------------
     async listClientRecords(partition) {
         const { results } = await this.#db
             .prepare('SELECT client_id, actor_id, cursor, subscriptions, updated_at_ms FROM sync_clients WHERE partition=? ORDER BY updated_at_ms DESC')

package/dist/events-ring.d.ts

@@ -1,5 +1,5 @@
 /**
- * Event ring buffer + sink composition (TODO §2.5) — the "event stream"
+ * Event ring buffer + sink composition: the "event stream"
  * without any infrastructure dependency.
  *
  * `RingBufferEvents` is a `SyncularServerEvents` sink that retains the last

package/dist/events-ring.js

@@ -1,5 +1,5 @@
 /**
- * Event ring buffer + sink composition (TODO §2.5) — the "event stream"
+ * Event ring buffer + sink composition: the "event stream"
  * without any infrastructure dependency.
  *
  * `RingBufferEvents` is a `SyncularServerEvents` sink that retains the last

package/dist/handler.js

@@ -1,5 +1,5 @@
 /**
- * `handleSyncRequest(bytes, ctx) → bytes` (SPEC.md §1, REVISE B2).
+ * `handleSyncRequest(bytes, ctx) → bytes` (SPEC.md §1).
  *
  * Internally streaming-friendly (§1.4): `createSyncResponseStream` returns
  * an async iterable of encoded chunks — one per frame — after performing
@@ -455,7 +455,7 @@ async function createStreamCore(bytes, ctx, events, startedAtMs = 0) {
         throw error;
     }
     const schema = compileSchema(ctx.schema);
-    // Relational row tables (DESIGN-relational-server-storage.md): create/
+    // Relational row tables: create/
     // migrate on first contact; memoized per storage instance thereafter.
     await ctx.storage.ensureSchema(schema);
     const plan = await planRequest(request, ctx, schema);

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 /**
  * @syncular/server — framework-free embeddable SSP2 protocol library
- * (SPEC.md is normative; REVISE.md B2 is the architectural mandate).
+ * (SPEC.md is normative).
  *
  * Core surface: `handleSyncRequest(bytes, ctx) → bytes` over host-provided
  * storage / scope-resolution / segment-store interfaces, plus a

package/dist/index.js

@@ -1,6 +1,6 @@
 /**
  * @syncular/server — framework-free embeddable SSP2 protocol library
- * (SPEC.md is normative; REVISE.md B2 is the architectural mandate).
+ * (SPEC.md is normative).
  *
  * Core surface: `handleSyncRequest(bytes, ctx) → bytes` over host-provided
  * storage / scope-resolution / segment-store interfaces, plus a

package/dist/pg-executor.d.ts

@@ -1,5 +1,5 @@
 /**
- * The minimal Postgres executor seam (REVISE B2: zero runtime deps).
+ * The minimal Postgres executor seam has zero runtime dependencies.
  *
  * `PostgresServerStorage` is written entirely against this interface so the
  * server library never imports a specific driver. Production wires one of:

package/dist/pg-executor.js

@@ -1,5 +1,5 @@
 /**
- * The minimal Postgres executor seam (REVISE B2: zero runtime deps).
+ * The minimal Postgres executor seam has zero runtime dependencies.
  *
  * `PostgresServerStorage` is written entirely against this interface so the
  * server library never imports a specific driver. Production wires one of:

package/dist/postgres-fanout.d.ts

@@ -1,5 +1,5 @@
 /**
- * LISTEN/NOTIFY multi-instance fanout (TODO §4.1) — the primitive that lets
+ * LISTEN/NOTIFY multi-instance fanout lets
  * N server instances behind a load balancer wake each other's realtime
  * sessions when a commit lands on any one of them.
  *

package/dist/postgres-storage.js

@@ -191,8 +191,8 @@ function toStoredChange(record) {
     };
 }
 /**
- * Migration rewrite (DESIGN "optional materialization"): keyset-paged walk
- * of a row table inside the migration transaction; when `oldLayout` is
+ * Migration rewrite: keyset-paged walk of a row table inside the migration
+ * transaction. When `oldLayout` is
  * given every payload re-encodes under the current columns, and the
  * projection (when materialized) refreshes from the payload either way.
  */
@@ -818,7 +818,7 @@ export class PostgresServerStorage {
         const { rows } = await this.#exec.query('SELECT DISTINCT blob_id FROM sync_blob_refs WHERE partition=$1', [partition]);
         return rows.map((r) => r.blob_id);
     }
-    // -- admin/console read surface (TODO §2.5) --------------------------------
+    // -- admin/console read surface --------------------------------------------
     async listClientRecords(partition) {
         const { rows } = await this.#exec.query('SELECT client_id, actor_id, cursor, subscriptions, updated_at_ms FROM sync_clients WHERE partition=$1 ORDER BY updated_at_ms DESC', [partition]);
         return rows.map((r) => ({

package/dist/pull.js

@@ -170,7 +170,7 @@ async function* sqliteImageSegment(ctx, schema, limits, plan, asOf, digest, trac
     // builder through `sqliteImageBuilder`; when omitted we default to the
     // in-tree `buildSqliteImage` ONLY on a Bun runtime, reached by a *dynamic*
     // import so `bun:sqlite` is never a static dependency of the pull path
-    // (TODO §4.2 neutrality — enforced by test/runtime-neutrality.test.ts). On
+    // (runtime neutrality is enforced by test/runtime-neutrality.test.ts). On
     // Workers/edge (no `Bun`) this yields the rows lane for a bit-2 client — a
     // support floor, not a fallback (§5.3: sqlite is an *accept*, not a demand).
     const buildImage = await resolveImageBuilder(ctx);

package/dist/relational-rows.d.ts

@@ -1,5 +1,5 @@
 /**
- * Relational current-row storage (DESIGN-relational-server-storage.md).
+ * Relational current-row storage.
  *
  * Every synced table is a REAL table in the server database — the app's
  * columns with proper type affinities, queryable with plain SQL/joins/BI —
@@ -54,7 +54,7 @@ export declare const SYNC_SCOPES_COLUMN = "_sync_scopes";
 export declare const SYNC_PAYLOAD_COLUMN = "_sync_payload";
 /** SQL-standard identifier quoting (both dialects). */
 export declare function quoteIdent(name: string): string;
-/** §5.3-style type affinities, per dialect (DESIGN type-mapping table). */
+/** §5.3-style type affinities, per dialect. */
 export declare function columnSqlType(column: RowColumn, dialect: RelationalDialect): string;
 /**
  * The full column list of a relational row table, in INSERT order:
@@ -86,11 +86,11 @@ export declare const SYNC_INDEX_PREFIX = "sync_ix_";
  */
 export declare function physicalIndexName(declaredName: string): string;
 /**
- * CREATE INDEX IF NOT EXISTS for the table's user-declared indexes
- * (DESIGN "user indexes" — the same declared names/columns the client
- * materializes; cross-table index-name uniqueness is the user's schema
- * concern, exactly as it is client-side). Server-side the physical name
- * carries the {@link SYNC_INDEX_PREFIX} ownership marker.
+ * CREATE INDEX IF NOT EXISTS for the table's user-declared indexes. These use
+ * the same declared names and columns the client materializes. Cross-table
+ * index-name uniqueness is the user's schema concern, as it is client-side.
+ * Server-side the physical name carries the {@link SYNC_INDEX_PREFIX}
+ * ownership marker.
  */
 export declare function createIndexDdl(table: CompiledTable): string[];
 /** Idempotent removal of one Syncular-owned relational projection index. */
@@ -182,8 +182,8 @@ export declare function selectRowScopesSql(table: CompiledTable, dialect: Relati
 /** DELETE one stored row. Params: [partition, rowId]. */
 export declare function deleteRowSql(table: CompiledTable, dialect: RelationalDialect): string;
 /**
- * The schema-version marker table gating DDL work (DESIGN "server-side
- * schema migration"): `ensureSchema` compares the stored version and skips
+ * The schema-version marker table gates DDL work. `ensureSchema` compares the
+ * stored version and skips
  * all introspection/DDL when it matches — one cheap read per storage
  * instance (relevant for D1's per-request instantiation).
  *

package/dist/relational-rows.js

@@ -1,5 +1,5 @@
 /**
- * Relational current-row storage (DESIGN-relational-server-storage.md).
+ * Relational current-row storage.
  *
  * Every synced table is a REAL table in the server database — the app's
  * columns with proper type affinities, queryable with plain SQL/joins/BI —
@@ -53,7 +53,7 @@ export const SYNC_PAYLOAD_COLUMN = '_sync_payload';
 export function quoteIdent(name) {
     return `"${name.replaceAll('"', '""')}"`;
 }
-/** §5.3-style type affinities, per dialect (DESIGN type-mapping table). */
+/** §5.3-style type affinities, per dialect. */
 export function columnSqlType(column, dialect) {
     if (dialect === 'postgres') {
         switch (column.type) {
@@ -176,11 +176,11 @@ export function physicalIndexName(declaredName) {
     return `${SYNC_INDEX_PREFIX}${fnv1a64Hex(declaredName)}`;
 }
 /**
- * CREATE INDEX IF NOT EXISTS for the table's user-declared indexes
- * (DESIGN "user indexes" — the same declared names/columns the client
- * materializes; cross-table index-name uniqueness is the user's schema
- * concern, exactly as it is client-side). Server-side the physical name
- * carries the {@link SYNC_INDEX_PREFIX} ownership marker.
+ * CREATE INDEX IF NOT EXISTS for the table's user-declared indexes. These use
+ * the same declared names and columns the client materializes. Cross-table
+ * index-name uniqueness is the user's schema concern, as it is client-side.
+ * Server-side the physical name carries the {@link SYNC_INDEX_PREFIX}
+ * ownership marker.
  */
 export function createIndexDdl(table) {
     // User indexes name app columns — nothing to index without the projection.
@@ -402,8 +402,8 @@ export function deleteRowSql(table, dialect) {
     return `DELETE FROM ${quoteIdent(table.name)} WHERE ${quoteIdent(SYNC_PARTITION_COLUMN)}=${p[0]} AND ${quoteIdent(SYNC_ROW_ID_COLUMN)}=${p[1]}`;
 }
 /**
- * The schema-version marker table gating DDL work (DESIGN "server-side
- * schema migration"): `ensureSchema` compares the stored version and skips
+ * The schema-version marker table gates DDL work. `ensureSchema` compares the
+ * stored version and skips
  * all introspection/DDL when it matches — one cheap read per storage
  * instance (relevant for D1's per-request instantiation).
  *

package/dist/s3-blob-store.js

@@ -23,7 +23,7 @@ function parseStatsJson(json) {
         bytes: Number(parsed.bytes ?? 0),
     };
 }
-// Runtime-neutral base64url (TODO §4.2): `Buffer` is not present on
+// Runtime-neutral base64url: `Buffer` is not present on
 // Cloudflare Workers without `nodejs_compat`, so the metadata header is
 // (de)coded with `btoa`/`atob`, available in every runtime.
 function utf8ToBase64url(text) {

package/dist/s3-segment-store.js

@@ -32,7 +32,7 @@ function parseStatsJson(json) {
         sqliteSegments: Number(parsed.sqliteSegments ?? 0),
     };
 }
-// Runtime-neutral base64url (TODO §4.2): `Buffer` is not present on
+// Runtime-neutral base64url: `Buffer` is not present on
 // Cloudflare Workers without `nodejs_compat`, so the object-metadata record
 // header is (de)coded with `btoa`/`atob`, available in every runtime.
 function utf8ToBase64url(text) {

package/dist/schema.d.ts

@@ -3,7 +3,7 @@
  *
  * The server is configured with a schema IR: tables, columns with the six
  * §2.4 column types, scope patterns per §3.1, and a schema version. Codegen
- * (B5) will emit this shape later; tests hand-write it.
+ * Typegen emits this shape; tests hand-write it.
  */
 import { type RowColumn } from '@syncular/core';
 /** `'prefix:{variable}'` shorthand (column name = variable) or explicit. */
@@ -12,9 +12,8 @@ export type ScopePatternSpec = string | {
     column: string;
 };
 /**
- * A user-declared index (the migration subset's CREATE INDEX). With
- * relational server storage these apply server-side too (DESIGN
- * "user indexes") — the same declaration the client materializes.
+ * A user-declared index (the migration subset's CREATE INDEX). Relational
+ * server storage applies the same declaration the client materializes.
  */
 export interface IndexSchema {
     readonly name: string;
@@ -32,7 +31,7 @@ export interface TableSchema {
     /** User indexes (optional) — created on the server's relational tables. */
     readonly indexes?: readonly IndexSchema[];
     /**
-     * Server-side column materialization (DESIGN-relational-server-storage.md
+     * Server-side column materialization
      * "optional materialization"). When `true` (the usual default) the server's
      * row table carries the app's typed columns as a queryable projection;
      * when `false` it carries only the `_sync_*` meta columns — same storage

package/dist/schema.js

@@ -3,7 +3,7 @@
  *
  * The server is configured with a schema IR: tables, columns with the six
  * §2.4 column types, scope patterns per §3.1, and a schema version. Codegen
- * (B5) will emit this shape later; tests hand-write it.
+ * Typegen emits this shape; tests hand-write it.
  */
 import { validatePortableRelationalIdentifier, } from '@syncular/core';
 const PATTERN_RE = /^([^{}]+):\{([^{}:]+)\}$/;
@@ -37,8 +37,8 @@ export function compileSchema(schema) {
         if (tables.has(table.name)) {
             throw new Error(`duplicate table ${JSON.stringify(table.name)}`);
         }
-        // Identifier rules (DESIGN "current-row tables") live in core's
-        // validatePortableRelationalIdentifier, shared with typegen: app tables
+        // Identifier rules live in core's validatePortableRelationalIdentifier,
+        // shared with typegen: app tables
         // share a namespace with the sync infrastructure tables (`sync_*`) and
         // carry `_sync_*` meta columns, so both prefixes are reserved, and
         // Postgres silently truncates identifiers over 63 bytes.

package/dist/seed.js

@@ -1,5 +1,5 @@
 /**
- * The public seeding helper (RFC 0002 §2.5): push app-shaped mutations
+ * The public seeding helper: push app-shaped mutations
  * through the REAL push path — one `handleSyncRequest` round built from the
  * server schema — so demos, dev servers, and ops scripts seed data with one
  * supported call. This is the same §6 pipeline every client write takes

package/dist/segment-store.d.ts

@@ -30,8 +30,8 @@ export interface SegmentFindKey {
     readonly asOfCommitSeq: number;
 }
 /**
- * Coarse store-level counters for the admin/console read surface (TODO
- * §2.5). Optional — a store that omits `stats()` simply cannot report them.
+ * Coarse store-level counters for the admin/console read surface. Optional:
+ * a store that omits `stats()` simply cannot report them.
  * All counts include expired-but-not-yet-evicted entries (the store's own
  * bytes on disk), split by media type.
  */
@@ -62,7 +62,7 @@ export interface SegmentStore {
      * rebuilding sqlite images while one exists (§5.3).
      */
     find(key: SegmentFindKey, nowMs: number): Promise<SegmentRecord | undefined>;
-    /** Admin/console counters (TODO §2.5) — ADDITIVE, optional. */
+    /** Admin/console counters: ADDITIVE, optional. */
     stats?(): Promise<SegmentStoreStats>;
 }
 export declare function segmentIdFor(bytes: Uint8Array): Promise<string>;

package/dist/signed-url.js

@@ -60,8 +60,8 @@ export async function issueBlobUploadUrl(config, args) {
     return config.presign({ ...args, ttlSeconds });
 }
 const encoder = new TextEncoder();
-// Runtime-neutral base64url (no `Buffer` — Workers/Deno/browser safe; TODO
-// §4.2): `btoa`/`atob` operate on binary strings, present in every runtime.
+// Runtime-neutral base64url: `btoa`/`atob` operate on binary strings and are
+// present in every supported runtime.
 function base64url(bytes) {
     let binary = '';
     for (const byte of bytes)

package/dist/sigv4.d.ts

@@ -1,10 +1,10 @@
 /**
  * Minimal AWS Signature Version 4 — exactly the subset the S3 segment
  * store needs (header-signed requests and presigned GET URLs), hand-rolled
- * per the dependency-light doctrine (REVISE): SigV4 is small and
+ * per the dependency-light doctrine: SigV4 is small and
  * well-specified, so no SDK.
  *
- * Runtime-neutral (TODO §4.2): the crypto primitives are Web Crypto
+ * Runtime-neutral: the crypto primitives are Web Crypto
  * (`crypto.subtle`), not `node:crypto`, so this module runs unchanged on
  * Cloudflare Workers / Deno / browsers as well as Bun/Node. `crypto.subtle`
  * is async, so signing is async throughout; the `S3SegmentStore` consumers
@@ -36,8 +36,6 @@ export declare function amzTimestamps(nowMs: number): {
     amzDate: string;
     dateStamp: string;
 };
-/** Sorted, fully re-encoded canonical query string from *decoded* pairs. */
-export declare function canonicalQuery(params: Iterable<readonly [string, string]>): string;
 export interface CanonicalRequestArgs {
     readonly method: string;
     /** The URI-encoded absolute path exactly as sent on the request line. */

package/dist/sigv4.js

@@ -1,10 +1,10 @@
 /**
  * Minimal AWS Signature Version 4 — exactly the subset the S3 segment
  * store needs (header-signed requests and presigned GET URLs), hand-rolled
- * per the dependency-light doctrine (REVISE): SigV4 is small and
+ * per the dependency-light doctrine: SigV4 is small and
  * well-specified, so no SDK.
  *
- * Runtime-neutral (TODO §4.2): the crypto primitives are Web Crypto
+ * Runtime-neutral: the crypto primitives are Web Crypto
  * (`crypto.subtle`), not `node:crypto`, so this module runs unchanged on
  * Cloudflare Workers / Deno / browsers as well as Bun/Node. `crypto.subtle`
  * is async, so signing is async throughout; the `S3SegmentStore` consumers
@@ -57,7 +57,7 @@ export function amzTimestamps(nowMs) {
     return { amzDate, dateStamp: amzDate.slice(0, 8) };
 }
 /** Sorted, fully re-encoded canonical query string from *decoded* pairs. */
-export function canonicalQuery(params) {
+function canonicalQuery(params) {
     return [...params]
         .map(([k, v]) => [uriEncode(k, true), uriEncode(v, true)])
         .sort(([ak, av], [bk, bv]) => ak < bk ? -1 : ak > bk ? 1 : av < bv ? -1 : av > bv ? 1 : 0)

package/dist/sqlite-blob-store.d.ts

@@ -3,7 +3,7 @@
  * dependency-free). Bun-specific by design (top-level `bun:sqlite` import),
  * so it lives in its own module — the runtime-neutral `BlobStore` interface,
  * `MemoryBlobStore`, `blobIdFor`, and `isBlobId` stay in `blob-store.ts` for
- * the Workers/edge core (TODO §4.2 neutrality discipline; enforced by
+ * the Workers/edge core (runtime neutrality is enforced by
  * `test/runtime-neutrality.test.ts`).
  */
 import { Database } from 'bun:sqlite';

package/dist/sqlite-blob-store.js

@@ -3,7 +3,7 @@
  * dependency-free). Bun-specific by design (top-level `bun:sqlite` import),
  * so it lives in its own module — the runtime-neutral `BlobStore` interface,
  * `MemoryBlobStore`, `blobIdFor`, and `isBlobId` stay in `blob-store.ts` for
- * the Workers/edge core (TODO §4.2 neutrality discipline; enforced by
+ * the Workers/edge core (runtime neutrality is enforced by
  * `test/runtime-neutrality.test.ts`).
  */
 import { Database } from 'bun:sqlite';

package/dist/sqlite-dialect.d.ts

@@ -11,8 +11,7 @@
  * db.prepare(sql).bind(...).all()`); a shared execution layer would have to
  * pick one calling convention and adapt the other, which is uglier than two
  * thin storage classes that each speak their driver's native shape while
- * importing the same SQL text and codecs from here (TODO §4.2 judgment
- * call — "clean parallel implementation against the storage contract").
+ * importing the same SQL text and codecs from here.
  * Both classes run the identical `test/storage-contract.ts`, so the
  * behavior is held key-for-key regardless.
  */
@@ -28,7 +27,7 @@ import type { StoredChange, StoredCommit, StoredPushResult, StoredRow } from './
  * The inverted scope index carries the ordered column (`commit_seq` /
  * `row_id`) last in the PRIMARY KEY, so the candidate scan is an index
  * range that returns already-ordered rows — the same covering-index shape
- * the Postgres storage documents (§3.1, REVISE B2 performance-by-
+ * the Postgres storage documents (§3.1, performance-by-
  * construction).
  */
 export declare const SQLITE_DDL = "\nCREATE TABLE IF NOT EXISTS sync_partitions(\n  partition TEXT PRIMARY KEY,\n  max_commit_seq INTEGER NOT NULL DEFAULT 0,\n  horizon_seq INTEGER NOT NULL DEFAULT 0\n);\nCREATE TABLE IF NOT EXISTS sync_row_scopes(\n  partition TEXT NOT NULL, tbl TEXT NOT NULL,\n  var TEXT NOT NULL, value TEXT NOT NULL, row_id TEXT NOT NULL,\n  PRIMARY KEY(partition, tbl, var, value, row_id)\n);\nCREATE TABLE IF NOT EXISTS sync_commits(\n  partition TEXT NOT NULL, commit_seq INTEGER NOT NULL,\n  client_id TEXT NOT NULL, client_commit_id TEXT NOT NULL,\n  actor_id TEXT NOT NULL, created_at_ms INTEGER NOT NULL,\n  PRIMARY KEY(partition, commit_seq)\n);\nCREATE INDEX IF NOT EXISTS sync_commits_by_time\n  ON sync_commits(partition, created_at_ms);\nCREATE TABLE IF NOT EXISTS sync_changes(\n  partition TEXT NOT NULL, commit_seq INTEGER NOT NULL, idx INTEGER NOT NULL,\n  tbl TEXT NOT NULL, row_id TEXT NOT NULL, op INTEGER NOT NULL,\n  row_version INTEGER, scopes TEXT NOT NULL, payload BLOB,\n  PRIMARY KEY(partition, commit_seq, idx)\n);\nCREATE INDEX IF NOT EXISTS sync_changes_by_table\n  ON sync_changes(partition, commit_seq, tbl, idx);\nCREATE TABLE IF NOT EXISTS sync_change_scopes(\n  partition TEXT NOT NULL, tbl TEXT NOT NULL,\n  var TEXT NOT NULL, value TEXT NOT NULL, commit_seq INTEGER NOT NULL,\n  PRIMARY KEY(partition, tbl, var, value, commit_seq)\n);\nCREATE TABLE IF NOT EXISTS sync_push_results(\n  partition TEXT NOT NULL, client_id TEXT NOT NULL,\n  client_commit_id TEXT NOT NULL, result TEXT NOT NULL,\n  PRIMARY KEY(partition, client_id, client_commit_id)\n);\nCREATE TABLE IF NOT EXISTS sync_clients(\n  partition TEXT NOT NULL, client_id TEXT NOT NULL, actor_id TEXT NOT NULL,\n  cursor INTEGER NOT NULL, subscriptions TEXT NOT NULL,\n  updated_at_ms INTEGER NOT NULL,\n  PRIMARY KEY(partition, client_id)\n);\nCREATE TABLE IF NOT EXISTS sync_blob_refs(\n  partition TEXT NOT NULL, tbl TEXT NOT NULL, row_id TEXT NOT NULL,\n  blob_id TEXT NOT NULL,\n  PRIMARY KEY(partition, tbl, row_id, blob_id)\n);\nCREATE INDEX IF NOT EXISTS sync_blob_refs_by_blob\n  ON sync_blob_refs(partition, blob_id);\n";

package/dist/sqlite-dialect.js

@@ -9,7 +9,7 @@ import { matchesEffective } from './scopes.js';
  * The inverted scope index carries the ordered column (`commit_seq` /
  * `row_id`) last in the PRIMARY KEY, so the candidate scan is an index
  * range that returns already-ordered rows — the same covering-index shape
- * the Postgres storage documents (§3.1, REVISE B2 performance-by-
+ * the Postgres storage documents (§3.1, performance-by-
  * construction).
  */
 export const SQLITE_DDL = `

package/dist/sqlite-image.d.ts

@@ -13,7 +13,7 @@ export interface SqliteImageInput {
 }
 /**
  * The §5.3 image-builder capability, injected through
- * `SyncServerConfig.sqliteImageBuilder` (TODO §4.2). Building an image needs
+ * `SyncServerConfig.sqliteImageBuilder`. Building an image needs
  * a real SQLite engine (`bun:sqlite` here), which is not available on every
  * runtime — Cloudflare Workers has none. So the core takes the builder as an
  * optional capability rather than importing `bun:sqlite` on the pull path:

package/dist/sqlite-lease-store.d.ts

@@ -3,7 +3,7 @@
  * dependency-free). Bun-specific by design (top-level `bun:sqlite` import),
  * so it lives in its own module — the runtime-neutral `LeaseStore` interface,
  * `LeaseRecord`, and `MemoryLeaseStore` stay in `lease-store.ts` for the
- * Workers/edge core (TODO §4.2 neutrality discipline; enforced by
+ * Workers/edge core (runtime neutrality is enforced by
  * `test/runtime-neutrality.test.ts`).
  */
 import { Database } from 'bun:sqlite';

package/dist/sqlite-lease-store.js

@@ -3,7 +3,7 @@
  * dependency-free). Bun-specific by design (top-level `bun:sqlite` import),
  * so it lives in its own module — the runtime-neutral `LeaseStore` interface,
  * `LeaseRecord`, and `MemoryLeaseStore` stay in `lease-store.ts` for the
- * Workers/edge core (TODO §4.2 neutrality discipline; enforced by
+ * Workers/edge core (runtime neutrality is enforced by
  * `test/runtime-neutrality.test.ts`).
  */
 import { Database } from 'bun:sqlite';

package/dist/sqlite-segment-store.d.ts

@@ -4,8 +4,8 @@
  * top level, so it lives in its own module — importing it opts into the Bun
  * runtime. The runtime-neutral `SegmentStore` interface, `MemorySegmentStore`,
  * and `segmentIdFor` stay in `segment-store.ts` so the Workers/edge core can
- * import them without pulling in `bun:sqlite` (TODO §4.2 neutrality
- * discipline; enforced by `test/runtime-neutrality.test.ts`).
+ * import them without pulling in `bun:sqlite` (runtime neutrality is enforced
+ * by `test/runtime-neutrality.test.ts`).
  */
 import { Database } from 'bun:sqlite';
 import { type SegmentFindKey, type SegmentMetadata, type SegmentRecord, type SegmentStore, type SegmentStoreStats } from './segment-store.js';

package/dist/sqlite-segment-store.js

@@ -4,8 +4,8 @@
  * top level, so it lives in its own module — importing it opts into the Bun
  * runtime. The runtime-neutral `SegmentStore` interface, `MemorySegmentStore`,
  * and `segmentIdFor` stay in `segment-store.ts` so the Workers/edge core can
- * import them without pulling in `bun:sqlite` (TODO §4.2 neutrality
- * discipline; enforced by `test/runtime-neutrality.test.ts`).
+ * import them without pulling in `bun:sqlite` (runtime neutrality is enforced
+ * by `test/runtime-neutrality.test.ts`).
  */
 import { Database } from 'bun:sqlite';
 import { DEFAULT_SEGMENT_TTL_MS, segmentIdFor, } from './segment-store.js';

package/dist/sqlite-storage.d.ts

@@ -1,7 +1,7 @@
 /**
  * SQLite storage via `bun:sqlite` (dev-speed, dependency-free).
  *
- * Scope fanout is index-first (REVISE B2): both the commit log and the
+ * Scope fanout is index-first: both the commit log and the
  * current-row table carry a (table, variable, value) inverted index; reads
  * select candidates from the index and verify the full multi-variable
  * match against the stored scope map — never a log scan.

package/dist/sqlite-storage.js

@@ -1,7 +1,7 @@
 /**
  * SQLite storage via `bun:sqlite` (dev-speed, dependency-free).
  *
- * Scope fanout is index-first (REVISE B2): both the commit log and the
+ * Scope fanout is index-first: both the commit log and the
  * current-row table carry a (table, variable, value) inverted index; reads
  * select candidates from the index and verify the full multi-variable
  * match against the stored scope map — never a log scan.
@@ -240,8 +240,8 @@ export class SqliteServerStorage {
         this.#schemaVersion = schema.version;
     }
     /**
-     * Migration rewrite (DESIGN "optional materialization"): keyset-paged walk
-     * of a row table; when `oldLayout` is given every payload re-encodes under
+     * Migration rewrite: keyset-paged walk of a row table. When `oldLayout` is
+     * given every payload re-encodes under
      * the current columns, and the projection (when materialized) refreshes
      * from the payload either way.
      */
@@ -498,7 +498,7 @@ export class SqliteServerStorage {
             .all(partition);
         return rows.map((r) => r.blob_id);
     }
-    // -- admin/console read surface (TODO §2.5) --------------------------------
+    // -- admin/console read surface --------------------------------------------
     async listClientRecords(partition) {
         const records = this.db
             .query('SELECT client_id, actor_id, cursor, subscriptions, updated_at_ms FROM sync_clients WHERE partition=? ORDER BY updated_at_ms DESC')

package/dist/storage.d.ts

@@ -3,7 +3,7 @@
  *
  * Requirements it encodes:
  * - commit log with per-partition `commitSeq` (§2.1) and a commit→scope
- *   inverted index designed in from day one (§3.1, REVISE B2): pulls filter
+ *   inverted index (§3.1): pulls filter
  *   by scope via the index, never by scanning the log;
  * - idempotency results per §2.3 persisted in the same transaction as the
  *   commit's writes (§6.4);
@@ -241,7 +241,7 @@ export interface StorageTransaction {
 export interface ServerStorage {
     /**
      * Create/migrate the relational per-app row tables for `schema`
-     * (DESIGN-relational-server-storage.md). Idempotent and cheap when the
+     * Idempotent and cheap when the
      * stored schema version already matches (one marker read, memoized per
      * instance); on first use it creates the tables, on a version bump it
      * applies the migration subset (CREATE TABLE / ADD COLUMN / CREATE
@@ -305,7 +305,7 @@ export interface ServerStorage {
     listRowsReferencingBlob?(partition: string, blobId: string): Promise<BlobReferencingRow[]>;
     listReferencedBlobIds?(partition: string): Promise<string[]>;
     /**
-     * Admin/console read surface (`SyncularAdmin`, TODO §2.5) — ADDITIVE,
+     * Admin/console read surface (`SyncularAdmin`): ADDITIVE,
      * optional. All read-only, partition-scoped, and JSON-able. A backend
      * that omits these simply cannot serve the console; the sync path never
      * calls them.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@syncular/server",
-  "version": "0.15.44",
+  "version": "0.15.45",
   "description": "Syncular server: handleSyncRequest + storage/auth interfaces for the sync protocol",
   "license": "Apache-2.0",
   "author": "Benjamin Kniffler",
@@ -53,7 +53,7 @@
     "!dist/**/*.test.d.ts"
   ],
   "dependencies": {
-    "@syncular/core": "0.15.44"
+    "@syncular/core": "0.15.45"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.5.4"

package/src/admin.ts

@@ -1,6 +1,6 @@
 /**
- * `SyncularAdmin` — the operator-facing read surface over the server core
- * (TODO §2.5). A read-only, partition-scoped, JSON-able query layer over
+ * `SyncularAdmin` is the operator-facing read surface over the server core.
+ * It is a read-only, partition-scoped, JSON-able query layer over
  * `ServerStorage`, the optional segment/blob store stats, and an in-memory
  * event ring. It delivers the 80% operator value (who's connected, what's
  * flowing, horizon health, the event tail) as a handful of queries in the
@@ -179,7 +179,7 @@ function percentile(sample: readonly number[], q: number): number {
 function required<T>(value: T | undefined, what: string): T {
   if (value === undefined) {
     throw new Error(
-      `SyncularAdmin: the configured ${what} does not implement this read (TODO §2.5 optional method missing)`,
+      `SyncularAdmin: the configured ${what} does not implement this optional read`,
     );
   }
   return value;

package/src/context.ts

@@ -1,5 +1,5 @@
 /**
- * The host context for `handleSyncRequest` (REVISE B2): storage, the
+ * The host context for `handleSyncRequest`: storage, the
  * `resolveScopes` host callback (runs in the host process — the moat),
  * clock, and a segment store. Framework-free; adapters supply `partition`
  * and `actorId` from host authentication (§1.1).
@@ -154,7 +154,7 @@ export interface SyncServerConfig {
    */
   readonly blobUploadUrls?: BlobUploadPresignConfig;
   /**
-   * §5.3 sqlite-image builder (TODO §4.2), injected so the pull path never
+   * §5.3 sqlite-image builder, injected so the pull path never
    * statically imports `bun:sqlite`. Absent ⇒ the sqlite-image lane is off
    * (bit-2 clients are served the rows lane) — the Workers/edge posture. A
    * Bun/Node host wires `buildSqliteImage` from `@syncular/server`.

package/src/d1-storage.ts

@@ -1,5 +1,5 @@
 /**
- * Cloudflare D1 server storage (TODO §4.2 — the Workers deployment rung).
+ * Cloudflare D1 server storage for Workers deployments.
  *
  * D1 *is* SQLite exposed over an async, statement-at-a-time API
  * (`prepare(sql).bind(...).all()` / `.first()` / `.run()`, plus `batch([…])`
@@ -687,7 +687,7 @@ export class D1ServerStorage implements ServerStorage {
       const bindCount = tableColumnNames(table).length;
       if (bindCount > D1_MAX_BIND_PARAMS) {
         throw new Error(
-          `table ${JSON.stringify(table.name)} needs ${bindCount} bound parameters per upsert — D1 caps statements at ${D1_MAX_BIND_PARAMS} (DESIGN "D1 bind-parameter limit")`,
+          `table ${JSON.stringify(table.name)} needs ${bindCount} bound parameters per upsert; D1 caps statements at ${D1_MAX_BIND_PARAMS}`,
         );
       }
     }
@@ -1137,7 +1137,7 @@ export class D1ServerStorage implements ServerStorage {
     return results.map((r) => r.blob_id);
   }
 
-  // -- admin/console read surface (TODO §2.5) --------------------------------
+  // -- admin/console read surface --------------------------------------------
 
   async listClientRecords(partition: string): Promise<ClientRecord[]> {
     const { results } = await this.#db

package/src/events-ring.ts

@@ -1,5 +1,5 @@
 /**
- * Event ring buffer + sink composition (TODO §2.5) — the "event stream"
+ * Event ring buffer + sink composition: the "event stream"
  * without any infrastructure dependency.
  *
  * `RingBufferEvents` is a `SyncularServerEvents` sink that retains the last

package/src/handler.ts

@@ -1,5 +1,5 @@
 /**
- * `handleSyncRequest(bytes, ctx) → bytes` (SPEC.md §1, REVISE B2).
+ * `handleSyncRequest(bytes, ctx) → bytes` (SPEC.md §1).
  *
  * Internally streaming-friendly (§1.4): `createSyncResponseStream` returns
  * an async iterable of encoded chunks — one per frame — after performing
@@ -629,7 +629,7 @@ async function createStreamCore(
     throw error;
   }
   const schema = compileSchema(ctx.schema);
-  // Relational row tables (DESIGN-relational-server-storage.md): create/
+  // Relational row tables: create/
   // migrate on first contact; memoized per storage instance thereafter.
   await ctx.storage.ensureSchema(schema);
   const plan = await planRequest(request, ctx, schema);

package/src/index.ts

@@ -1,6 +1,6 @@
 /**
  * @syncular/server — framework-free embeddable SSP2 protocol library
- * (SPEC.md is normative; REVISE.md B2 is the architectural mandate).
+ * (SPEC.md is normative).
  *
  * Core surface: `handleSyncRequest(bytes, ctx) → bytes` over host-provided
  * storage / scope-resolution / segment-store interfaces, plus a

package/src/pg-executor.ts

@@ -1,5 +1,5 @@
 /**
- * The minimal Postgres executor seam (REVISE B2: zero runtime deps).
+ * The minimal Postgres executor seam has zero runtime dependencies.
  *
  * `PostgresServerStorage` is written entirely against this interface so the
  * server library never imports a specific driver. Production wires one of:

package/src/postgres-fanout.ts

@@ -1,5 +1,5 @@
 /**
- * LISTEN/NOTIFY multi-instance fanout (TODO §4.1) — the primitive that lets
+ * LISTEN/NOTIFY multi-instance fanout lets
  * N server instances behind a load balancer wake each other's realtime
  * sessions when a commit lands on any one of them.
  *

package/src/postgres-storage.ts

@@ -1,5 +1,5 @@
 /**
- * Postgres server storage — the production database path (TODO §4.1).
+ * Postgres server storage: the production database path.
  *
  * Semantics mirror `SqliteServerStorage` exactly (both run the shared
  * storage contract in `test/storage-contract.ts`); the difference is that
@@ -336,8 +336,8 @@ function toStoredChange(record: ChangeRecord): StoredChange {
 }
 
 /**
- * Migration rewrite (DESIGN "optional materialization"): keyset-paged walk
- * of a row table inside the migration transaction; when `oldLayout` is
+ * Migration rewrite: keyset-paged walk of a row table inside the migration
+ * transaction. When `oldLayout` is
  * given every payload re-encodes under the current columns, and the
  * projection (when materialized) refreshes from the payload either way.
  */
@@ -1251,7 +1251,7 @@ export class PostgresServerStorage implements ServerStorage {
     return rows.map((r) => r.blob_id);
   }
 
-  // -- admin/console read surface (TODO §2.5) --------------------------------
+  // -- admin/console read surface --------------------------------------------
 
   async listClientRecords(partition: string): Promise<ClientRecord[]> {
     const { rows } = await this.#exec.query<{

package/src/pull.ts

@@ -253,7 +253,7 @@ async function* sqliteImageSegment(
   // builder through `sqliteImageBuilder`; when omitted we default to the
   // in-tree `buildSqliteImage` ONLY on a Bun runtime, reached by a *dynamic*
   // import so `bun:sqlite` is never a static dependency of the pull path
-  // (TODO §4.2 neutrality — enforced by test/runtime-neutrality.test.ts). On
+  // (runtime neutrality is enforced by test/runtime-neutrality.test.ts). On
   // Workers/edge (no `Bun`) this yields the rows lane for a bit-2 client — a
   // support floor, not a fallback (§5.3: sqlite is an *accept*, not a demand).
   const buildImage = await resolveImageBuilder(ctx);

package/src/relational-rows.ts

@@ -1,5 +1,5 @@
 /**
- * Relational current-row storage (DESIGN-relational-server-storage.md).
+ * Relational current-row storage.
  *
  * Every synced table is a REAL table in the server database — the app's
  * columns with proper type affinities, queryable with plain SQL/joins/BI —
@@ -65,7 +65,7 @@ export function quoteIdent(name: string): string {
   return `"${name.replaceAll('"', '""')}"`;
 }
 
-/** §5.3-style type affinities, per dialect (DESIGN type-mapping table). */
+/** §5.3-style type affinities, per dialect. */
 export function columnSqlType(
   column: RowColumn,
   dialect: RelationalDialect,
@@ -204,11 +204,11 @@ export function physicalIndexName(declaredName: string): string {
 }
 
 /**
- * CREATE INDEX IF NOT EXISTS for the table's user-declared indexes
- * (DESIGN "user indexes" — the same declared names/columns the client
- * materializes; cross-table index-name uniqueness is the user's schema
- * concern, exactly as it is client-side). Server-side the physical name
- * carries the {@link SYNC_INDEX_PREFIX} ownership marker.
+ * CREATE INDEX IF NOT EXISTS for the table's user-declared indexes. These use
+ * the same declared names and columns the client materializes. Cross-table
+ * index-name uniqueness is the user's schema concern, as it is client-side.
+ * Server-side the physical name carries the {@link SYNC_INDEX_PREFIX}
+ * ownership marker.
  */
 export function createIndexDdl(table: CompiledTable): string[] {
   // User indexes name app columns — nothing to index without the projection.
@@ -478,8 +478,8 @@ export function deleteRowSql(
 }
 
 /**
- * The schema-version marker table gating DDL work (DESIGN "server-side
- * schema migration"): `ensureSchema` compares the stored version and skips
+ * The schema-version marker table gates DDL work. `ensureSchema` compares the
+ * stored version and skips
  * all introspection/DDL when it matches — one cheap read per storage
  * instance (relevant for D1's per-request instantiation).
  *

package/src/s3-blob-store.ts

@@ -98,7 +98,7 @@ function parseStatsJson(json: string): StatsAccumulator {
   };
 }
 
-// Runtime-neutral base64url (TODO §4.2): `Buffer` is not present on
+// Runtime-neutral base64url: `Buffer` is not present on
 // Cloudflare Workers without `nodejs_compat`, so the metadata header is
 // (de)coded with `btoa`/`atob`, available in every runtime.
 function utf8ToBase64url(text: string): string {

package/src/s3-segment-store.ts

@@ -112,7 +112,7 @@ function parseStatsJson(json: string): StatsAccumulator {
   };
 }
 
-// Runtime-neutral base64url (TODO §4.2): `Buffer` is not present on
+// Runtime-neutral base64url: `Buffer` is not present on
 // Cloudflare Workers without `nodejs_compat`, so the object-metadata record
 // header is (de)coded with `btoa`/`atob`, available in every runtime.
 function utf8ToBase64url(text: string): string {

package/src/schema.ts

@@ -3,7 +3,7 @@
  *
  * The server is configured with a schema IR: tables, columns with the six
  * §2.4 column types, scope patterns per §3.1, and a schema version. Codegen
- * (B5) will emit this shape later; tests hand-write it.
+ * Typegen emits this shape; tests hand-write it.
  */
 import {
   type RowColumn,
@@ -14,9 +14,8 @@ import {
 export type ScopePatternSpec = string | { pattern: string; column: string };
 
 /**
- * A user-declared index (the migration subset's CREATE INDEX). With
- * relational server storage these apply server-side too (DESIGN
- * "user indexes") — the same declaration the client materializes.
+ * A user-declared index (the migration subset's CREATE INDEX). Relational
+ * server storage applies the same declaration the client materializes.
  */
 export interface IndexSchema {
   readonly name: string;
@@ -35,7 +34,7 @@ export interface TableSchema {
   /** User indexes (optional) — created on the server's relational tables. */
   readonly indexes?: readonly IndexSchema[];
   /**
-   * Server-side column materialization (DESIGN-relational-server-storage.md
+   * Server-side column materialization
    * "optional materialization"). When `true` (the usual default) the server's
    * row table carries the app's typed columns as a queryable projection;
    * when `false` it carries only the `_sync_*` meta columns — same storage
@@ -142,8 +141,8 @@ export function compileSchema(schema: ServerSchema): CompiledSchema {
     if (tables.has(table.name)) {
       throw new Error(`duplicate table ${JSON.stringify(table.name)}`);
     }
-    // Identifier rules (DESIGN "current-row tables") live in core's
-    // validatePortableRelationalIdentifier, shared with typegen: app tables
+    // Identifier rules live in core's validatePortableRelationalIdentifier,
+    // shared with typegen: app tables
     // share a namespace with the sync infrastructure tables (`sync_*`) and
     // carry `_sync_*` meta columns, so both prefixes are reserved, and
     // Postgres silently truncates identifiers over 63 bytes.

package/src/seed.ts

@@ -1,5 +1,5 @@
 /**
- * The public seeding helper (RFC 0002 §2.5): push app-shaped mutations
+ * The public seeding helper: push app-shaped mutations
  * through the REAL push path — one `handleSyncRequest` round built from the
  * server schema — so demos, dev servers, and ops scripts seed data with one
  * supported call. This is the same §6 pipeline every client write takes

package/src/segment-store.ts

@@ -44,8 +44,8 @@ export interface SegmentFindKey {
 }
 
 /**
- * Coarse store-level counters for the admin/console read surface (TODO
- * §2.5). Optional — a store that omits `stats()` simply cannot report them.
+ * Coarse store-level counters for the admin/console read surface. Optional:
+ * a store that omits `stats()` simply cannot report them.
  * All counts include expired-but-not-yet-evicted entries (the store's own
  * bytes on disk), split by media type.
  */
@@ -80,7 +80,7 @@ export interface SegmentStore {
    * rebuilding sqlite images while one exists (§5.3).
    */
   find(key: SegmentFindKey, nowMs: number): Promise<SegmentRecord | undefined>;
-  /** Admin/console counters (TODO §2.5) — ADDITIVE, optional. */
+  /** Admin/console counters: ADDITIVE, optional. */
   stats?(): Promise<SegmentStoreStats>;
 }
 

package/src/signed-url.ts

@@ -198,8 +198,8 @@ export interface SegmentTokenClaims {
 
 const encoder = new TextEncoder();
 
-// Runtime-neutral base64url (no `Buffer` — Workers/Deno/browser safe; TODO
-// §4.2): `btoa`/`atob` operate on binary strings, present in every runtime.
+// Runtime-neutral base64url: `btoa`/`atob` operate on binary strings and are
+// present in every supported runtime.
 function base64url(bytes: Uint8Array): string {
   let binary = '';
   for (const byte of bytes) binary += String.fromCharCode(byte);

package/src/sigv4.ts

@@ -1,10 +1,10 @@
 /**
  * Minimal AWS Signature Version 4 — exactly the subset the S3 segment
  * store needs (header-signed requests and presigned GET URLs), hand-rolled
- * per the dependency-light doctrine (REVISE): SigV4 is small and
+ * per the dependency-light doctrine: SigV4 is small and
  * well-specified, so no SDK.
  *
- * Runtime-neutral (TODO §4.2): the crypto primitives are Web Crypto
+ * Runtime-neutral: the crypto primitives are Web Crypto
  * (`crypto.subtle`), not `node:crypto`, so this module runs unchanged on
  * Cloudflare Workers / Deno / browsers as well as Bun/Node. `crypto.subtle`
  * is async, so signing is async throughout; the `S3SegmentStore` consumers
@@ -94,9 +94,7 @@ export function amzTimestamps(nowMs: number): {
 }
 
 /** Sorted, fully re-encoded canonical query string from *decoded* pairs. */
-export function canonicalQuery(
-  params: Iterable<readonly [string, string]>,
-): string {
+function canonicalQuery(params: Iterable<readonly [string, string]>): string {
   return [...params]
     .map(([k, v]) => [uriEncode(k, true), uriEncode(v, true)] as const)
     .sort(([ak, av], [bk, bv]) =>

package/src/sqlite-blob-store.ts

@@ -3,7 +3,7 @@
  * dependency-free). Bun-specific by design (top-level `bun:sqlite` import),
  * so it lives in its own module — the runtime-neutral `BlobStore` interface,
  * `MemoryBlobStore`, `blobIdFor`, and `isBlobId` stay in `blob-store.ts` for
- * the Workers/edge core (TODO §4.2 neutrality discipline; enforced by
+ * the Workers/edge core (runtime neutrality is enforced by
  * `test/runtime-neutrality.test.ts`).
  */
 import { Database } from 'bun:sqlite';

package/src/sqlite-dialect.ts

@@ -11,8 +11,7 @@
  * db.prepare(sql).bind(...).all()`); a shared execution layer would have to
  * pick one calling convention and adapt the other, which is uglier than two
  * thin storage classes that each speak their driver's native shape while
- * importing the same SQL text and codecs from here (TODO §4.2 judgment
- * call — "clean parallel implementation against the storage contract").
+ * importing the same SQL text and codecs from here.
  * Both classes run the identical `test/storage-contract.ts`, so the
  * behavior is held key-for-key regardless.
  */
@@ -35,7 +34,7 @@ import type {
  * The inverted scope index carries the ordered column (`commit_seq` /
  * `row_id`) last in the PRIMARY KEY, so the candidate scan is an index
  * range that returns already-ordered rows — the same covering-index shape
- * the Postgres storage documents (§3.1, REVISE B2 performance-by-
+ * the Postgres storage documents (§3.1, performance-by-
  * construction).
  */
 export const SQLITE_DDL = `

package/src/sqlite-image.ts

@@ -62,7 +62,7 @@ export interface SqliteImageInput {
 
 /**
  * The §5.3 image-builder capability, injected through
- * `SyncServerConfig.sqliteImageBuilder` (TODO §4.2). Building an image needs
+ * `SyncServerConfig.sqliteImageBuilder`. Building an image needs
  * a real SQLite engine (`bun:sqlite` here), which is not available on every
  * runtime — Cloudflare Workers has none. So the core takes the builder as an
  * optional capability rather than importing `bun:sqlite` on the pull path:

package/src/sqlite-lease-store.ts

@@ -3,7 +3,7 @@
  * dependency-free). Bun-specific by design (top-level `bun:sqlite` import),
  * so it lives in its own module — the runtime-neutral `LeaseStore` interface,
  * `LeaseRecord`, and `MemoryLeaseStore` stay in `lease-store.ts` for the
- * Workers/edge core (TODO §4.2 neutrality discipline; enforced by
+ * Workers/edge core (runtime neutrality is enforced by
  * `test/runtime-neutrality.test.ts`).
  */
 import { Database } from 'bun:sqlite';

package/src/sqlite-segment-store.ts

@@ -4,8 +4,8 @@
  * top level, so it lives in its own module — importing it opts into the Bun
  * runtime. The runtime-neutral `SegmentStore` interface, `MemorySegmentStore`,
  * and `segmentIdFor` stay in `segment-store.ts` so the Workers/edge core can
- * import them without pulling in `bun:sqlite` (TODO §4.2 neutrality
- * discipline; enforced by `test/runtime-neutrality.test.ts`).
+ * import them without pulling in `bun:sqlite` (runtime neutrality is enforced
+ * by `test/runtime-neutrality.test.ts`).
  */
 import { Database } from 'bun:sqlite';
 import {

package/src/sqlite-storage.ts

@@ -1,7 +1,7 @@
 /**
  * SQLite storage via `bun:sqlite` (dev-speed, dependency-free).
  *
- * Scope fanout is index-first (REVISE B2): both the commit log and the
+ * Scope fanout is index-first: both the commit log and the
  * current-row table carry a (table, variable, value) inverted index; reads
  * select candidates from the index and verify the full multi-variable
  * match against the stored scope map — never a log scan.
@@ -396,8 +396,8 @@ export class SqliteServerStorage implements ServerStorage {
   }
 
   /**
-   * Migration rewrite (DESIGN "optional materialization"): keyset-paged walk
-   * of a row table; when `oldLayout` is given every payload re-encodes under
+   * Migration rewrite: keyset-paged walk of a row table. When `oldLayout` is
+   * given every payload re-encodes under
    * the current columns, and the projection (when materialized) refreshes
    * from the payload either way.
    */
@@ -808,7 +808,7 @@ export class SqliteServerStorage implements ServerStorage {
     return rows.map((r) => r.blob_id);
   }
 
-  // -- admin/console read surface (TODO §2.5) --------------------------------
+  // -- admin/console read surface --------------------------------------------
 
   async listClientRecords(partition: string): Promise<ClientRecord[]> {
     const records = this.db

package/src/storage.ts

@@ -3,7 +3,7 @@
  *
  * Requirements it encodes:
  * - commit log with per-partition `commitSeq` (§2.1) and a commit→scope
- *   inverted index designed in from day one (§3.1, REVISE B2): pulls filter
+ *   inverted index (§3.1): pulls filter
  *   by scope via the index, never by scanning the log;
  * - idempotency results per §2.3 persisted in the same transaction as the
  *   commit's writes (§6.4);
@@ -276,7 +276,7 @@ export interface StorageTransaction {
 export interface ServerStorage {
   /**
    * Create/migrate the relational per-app row tables for `schema`
-   * (DESIGN-relational-server-storage.md). Idempotent and cheap when the
+   * Idempotent and cheap when the
    * stored schema version already matches (one marker read, memoized per
    * instance); on first use it creates the tables, on a version bump it
    * applies the migration subset (CREATE TABLE / ADD COLUMN / CREATE
@@ -373,7 +373,7 @@ export interface ServerStorage {
   listReferencedBlobIds?(partition: string): Promise<string[]>;
 
   /**
-   * Admin/console read surface (`SyncularAdmin`, TODO §2.5) — ADDITIVE,
+   * Admin/console read surface (`SyncularAdmin`): ADDITIVE,
    * optional. All read-only, partition-scoped, and JSON-able. A backend
    * that omits these simply cannot serve the console; the sync path never
    * calls them.