@tldraw/sync-core 5.5.0-next.f9308d324e1c → 5.6.0-canary.5bfc37740468

package/src/lib/diff.test.ts

@@ -39,6 +39,52 @@ describe('computing diffs (D)', () => {
 			expect(patch).toEqual({ c: [ValueOpType.Put, 3] })
 			expect(applyObjectDiff(a, patch!)).toEqual(b)
 		})
+
+		it('[D2] treats a key whose value is undefined as absent', () => {
+			// undefined does not survive JSON, so `['put', undefined]` would arrive as
+			// `['put', null]` and fail validators that only accept the key being missing
+			const present = { a: 1, props: { foo: 'x' } }
+			const explicitlyUndefined = { a: 1, props: { foo: undefined } }
+			const absent = { a: 1, props: {} }
+
+			expect(diffRecord(present, explicitlyUndefined)).toEqual({
+				props: [ValueOpType.Patch, { foo: [ValueOpType.Delete] }],
+			})
+			expect(diffRecord(explicitlyUndefined, present)).toEqual({
+				props: [ValueOpType.Patch, { foo: [ValueOpType.Put, 'x'] }],
+			})
+			expect(diffRecord(absent, explicitlyUndefined)).toBeNull()
+			expect(diffRecord(explicitlyUndefined, absent)).toBeNull()
+			expect(diffRecord({ a: undefined }, { a: undefined })).toBeNull()
+		})
+
+		it('[D2] only considers own keys, not Object.prototype members', () => {
+			const withCtor = { meta: { constructor: 1, toString: 2 } }
+			const without = { meta: {} }
+
+			expect(diffRecord(withCtor, without)).toEqual({
+				meta: [
+					ValueOpType.Patch,
+					{ constructor: [ValueOpType.Delete], toString: [ValueOpType.Delete] },
+				],
+			})
+			expect(diffRecord(without, withCtor)).toEqual({
+				meta: [
+					ValueOpType.Patch,
+					{ constructor: [ValueOpType.Put, 1], toString: [ValueOpType.Put, 2] },
+				],
+			})
+		})
+
+		it('[D2] ignores __proto__ keys, which applyObjectDiff would drop (AD8)', () => {
+			// JSON.parse creates '__proto__' as an own key; diffing it would store it on the server
+			// while peers receive an op they drop
+			const polluted = JSON.parse('{"__proto__":{"evil":1},"meta":{"__proto__":{"evil":1}}}')
+			const clean = { meta: {} }
+
+			expect(diffRecord(clean, polluted)).toBeNull()
+			expect(diffRecord(polluted, clean)).toBeNull()
+		})
 	})
 
 	describe('top-level keys vs props/meta (D3)', () => {
@@ -102,7 +148,8 @@ describe('computing diffs (D)', () => {
 
 			const diff = diffRecord(prev, next)
 			expect(diff).toBeTruthy()
-			expect(diff!.optional).toEqual([ValueOpType.Put, undefined])
+			// undefined is not representable on the wire, so it reads as the key being absent (D2)
+			expect(diff!.optional).toEqual([ValueOpType.Delete])
 			expect(diff!.nullable).toEqual([ValueOpType.Put, 'value'])
 		})
 	})
@@ -378,6 +425,25 @@ describe('computing diffs (D)', () => {
 				arr: [ValueOpType.Patch, { '0': [ValueOpType.Put, null] }],
 			})
 		})
+
+		it('[D6] puts a changed index when an item switches between array and object', () => {
+			// index deletes and named puts don't apply cleanly across shapes, so a patch would
+			// leave the receiver with a sparse array / an object where an array is expected
+			const arrayItem = { meta: { items: [[1, 2]] } }
+			const objectItem = { meta: { items: [{ x: 1 }] } }
+
+			const toObject = diffRecord(arrayItem, objectItem)!
+			expect(toObject).toEqual({
+				meta: [
+					ValueOpType.Patch,
+					{ items: [ValueOpType.Patch, { '0': [ValueOpType.Put, { x: 1 }] }] },
+				],
+			})
+			expect(applyObjectDiff(arrayItem, toObject)).toEqual(objectItem)
+
+			const toArray = diffRecord(objectItem, arrayItem)!
+			expect(applyObjectDiff(objectItem, toArray)).toEqual(arrayItem)
+		})
 	})
 
 	describe('different-length arrays (D7)', () => {
@@ -747,6 +813,30 @@ describe('applying diffs (AD)', () => {
 
 			expect(applyObjectDiff(obj, diff)).toBe(obj)
 		})
+
+		it('[AD5] deleting an inherited key has no effect', () => {
+			const obj = { a: 1 }
+			// `toString` collides with Object.prototype's own member in the literal's type, hence the cast
+			const diff = { toString: [ValueOpType.Delete] } as unknown as ObjectDiff
+
+			expect(applyObjectDiff(obj, diff)).toBe(obj)
+		})
+	})
+
+	describe('untrusted keys (AD8)', () => {
+		it('[AD8] ignores __proto__ keys instead of changing the prototype', () => {
+			// JSON.parse produces '__proto__' as an own key, so a peer can put it in a diff
+			const obj = { a: 1, props: { b: 2 } }
+			const diff: ObjectDiff = JSON.parse(
+				'{"__proto__":["put",{"isAdmin":true}],"props":["patch",{"__proto__":["put",{"polluted":1}]}]}'
+			)
+
+			const result: any = applyObjectDiff(obj, diff)
+			expect(result).toBe(obj)
+			expect(Object.getPrototypeOf(result)).toBe(Object.prototype)
+			expect(result.isAdmin).toBeUndefined()
+			expect(result.props.polluted).toBeUndefined()
+		})
 	})
 
 	describe('patching non-objects (AD6)', () => {

package/src/lib/diff.ts

@@ -1,5 +1,5 @@
 import { RecordsDiff, UnknownRecord } from '@tldraw/store'
-import { isEqual, objectMapEntries, objectMapValues } from '@tldraw/utils'
+import { hasOwnProperty, isEqual, objectMapEntries, objectMapValues } from '@tldraw/utils'
 
 /**
  * Constants representing the types of operations that can be applied to records in network diffs.
@@ -200,15 +200,21 @@ function diffObject(
 		return null
 	}
 	let result: ObjectDiff | null = null
+	// Own-property checks throughout: `in` would see Object.prototype members, so a user key named
+	// e.g. 'constructor' would never diff as an add or delete. And a key whose value is `undefined`
+	// is treated as absent: `undefined` doesn't survive JSON, so `['put', undefined]` would arrive
+	// as `['put', null]` and fail validators that accept only the missing key.
 	for (const key of Object.keys(prev)) {
-		// if key is not in next then it was deleted
-		if (!(key in next)) {
+		// `result['__proto__'] = op` would set the diff's prototype, and applyObjectDiff drops the key (AD8)
+		if (key === '__proto__') continue
+		const prevValue = (prev as any)[key]
+		if (prevValue === undefined) continue
+		const nextValue = hasOwnProperty(next, key) ? (next as any)[key] : undefined
+		if (nextValue === undefined) {
 			if (!result) result = {}
 			result[key] = [ValueOpType.Delete]
 			continue
 		}
-		const prevValue = (prev as any)[key]
-		const nextValue = (next as any)[key]
 		if (
 			nestedKeys?.has(key) ||
 			(Array.isArray(prevValue) && Array.isArray(nextValue)) ||
@@ -226,10 +232,13 @@ function diffObject(
 		}
 	}
 	for (const key of Object.keys(next)) {
+		if (key === '__proto__') continue
+		const nextValue = (next as any)[key]
+		if (nextValue === undefined) continue
 		// if key is in next but not in prev then it was added
-		if (!(key in prev)) {
+		if (!hasOwnProperty(prev, key) || (prev as any)[key] === undefined) {
 			if (!result) result = {}
-			result[key] = [ValueOpType.Put, (next as any)[key]]
+			result[key] = [ValueOpType.Put, nextValue]
 		}
 	}
 	return result
@@ -245,7 +254,15 @@ function diffValue(valueA: unknown, valueB: unknown, legacyAppendMode: boolean):
 			return [ValueOpType.Append, appendedText, valueA.length]
 		}
 		return [ValueOpType.Put, valueB]
-	} else if (!valueA || !valueB || typeof valueA !== 'object' || typeof valueB !== 'object') {
+	} else if (
+		!valueA ||
+		!valueB ||
+		typeof valueA !== 'object' ||
+		typeof valueB !== 'object' ||
+		// an array on one side and a plain object on the other can't be expressed as a patch:
+		// index deletes and named puts don't apply cleanly to either shape
+		Array.isArray(valueA) !== Array.isArray(valueB)
+	) {
 		return isEqual(valueA, valueB) ? null : [ValueOpType.Put, valueB]
 	} else {
 		const diff = diffObject(valueA, valueB, undefined, legacyAppendMode)
@@ -348,6 +365,10 @@ export function applyObjectDiff<T extends object>(object: T, objectDiff: ObjectD
 		}
 	}
 	for (const [key, op] of Object.entries(objectDiff)) {
+		// Diffs come off the wire from untrusted peers. `newObject['__proto__'] = v` would set the
+		// record's prototype (JSON.parse creates '__proto__' as an own key), so a client could give
+		// server-held records attacker-controlled inherited fields; skip such keys outright.
+		if (key === '__proto__') continue
 		switch (op[0]) {
 			case ValueOpType.Put: {
 				const value = op[1]
@@ -383,7 +404,7 @@ export function applyObjectDiff<T extends object>(object: T, objectDiff: ObjectD
 				break
 			}
 			case ValueOpType.Delete: {
-				if (key in object) {
+				if (hasOwnProperty(object, key)) {
 					if (!newObject) {
 						if (isArray) {
 							console.error("Can't delete array item yet (this should never happen)")

package/src/test/TLSocketRoom.test.ts

@@ -21,6 +21,7 @@ import {
 	ZERO_INDEX_KEY,
 } from 'tldraw'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { MAX_ASSEMBLED_MESSAGE_CHARS } from '../lib/chunk'
 import { RecordOpType } from '../lib/diff'
 import { DEFAULT_INITIAL_SNAPSHOT, InMemorySyncStorage } from '../lib/InMemorySyncStorage'
 import { getTlsyncProtocolVersion } from '../lib/protocol'
@@ -210,6 +211,45 @@ describe('28. TLSocketRoom (SR)', () => {
 			consoleSpy.mockRestore()
 		})
 
+		it('[SR3] the default logger also reaches TLSyncRoom, so authorizer failures are reported', () => {
+			const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+			try {
+				const room = new TLSocketRoom({
+					authorizeRecord: {
+						page: () => {
+							throw new Error('authorizer exploded')
+						},
+					},
+				})
+				const socket = createMockSocket()
+				connectSession(room, 'test-session', socket)
+
+				const pageId = PageRecordType.createId('new-page')
+				room.handleSocketMessage(
+					'test-session',
+					JSON.stringify({
+						type: 'push',
+						clientClock: 1,
+						diff: {
+							[pageId]: [
+								RecordOpType.Put,
+								PageRecordType.create({ id: pageId, name: 'New Page', index: 'a2' as any }),
+							],
+						},
+					})
+				)
+
+				// the authorizer threw, and the host heard about it without passing a logger
+				expect(room.getRecord(pageId)).toBeUndefined()
+				expect(consoleSpy).toHaveBeenCalledWith(
+					'record authorizer threw; rejecting the write',
+					expect.objectContaining({ message: 'authorizer exploded' })
+				)
+			} finally {
+				consoleSpy.mockRestore()
+			}
+		})
+
 		it('[SR3] uses custom logger when provided', () => {
 			const mockLog: TLSyncLog = {
 				warn: vi.fn(),
@@ -353,6 +393,29 @@ describe('28. TLSocketRoom (SR)', () => {
 			expect(room.getSessions()[0].isConnected).toBe(false)
 		})
 
+		it('[SR5] rejects the session when an assembly exceeds the size cap', () => {
+			const log: TLSyncLog = { warn: vi.fn(), error: vi.fn() }
+			const room = new TLSocketRoom({ log })
+			const socket = createMockSocket()
+			connectSession(room, 'test-session', socket)
+
+			// A chunk stream that never sends its last chunk. Unlike the other assembly errors
+			// this one is fatal: a reconnecting client would re-send the same oversized message.
+			const body = 'x'.repeat(1024 * 1024)
+			const chunksNeeded = Math.ceil(MAX_ASSEMBLED_MESSAGE_CHARS / body.length) + 1
+			for (let i = 0; i < chunksNeeded; i++) {
+				room.handleSocketMessage('test-session', `${chunksNeeded - i}_${body}`)
+				if ((log.error as any).mock.calls.length) break
+			}
+
+			expect(log.error).toHaveBeenCalledWith('Error assembling message', expect.anything())
+			expect(socket.close).toHaveBeenCalledWith(
+				TLSyncErrorCloseEventCode,
+				TLSyncErrorCloseEventReason.MESSAGE_TOO_LARGE
+			)
+			expect(room.getSessions()).toHaveLength(0)
+		})
+
 		it('[SR5] rejects the session with UNKNOWN_ERROR when message handling throws', () => {
 			const log: TLSyncLog = { warn: vi.fn(), error: vi.fn() }
 			const room = new TLSocketRoom({ log })

package/src/test/TLSyncRoom.test.ts

@@ -1019,6 +1019,52 @@ describe('23. Connect handshake (HS)', () => {
 		expect(room.sessions.get('current-client-session')?.state).toBe(RoomSessionState.Connected)
 		expect(socket.__lastMessage?.type).toBe('connect')
 	})
+
+	it('[RC5][HS6] a wipeAll during a handshake closes connected sessions but hydrates the connecting one', async () => {
+		const { room, storage } = makeRoom()
+		const socketA = connectSession(room, 'a')
+		const removed = vi.fn()
+		room.events.on('session_removed', removed)
+
+		// 'b' has opened its socket but not yet sent its connect message
+		const socketB = makeSocket()
+		room.handleNewSession({ sessionId: 'b', socket: socketB, meta: undefined, isReadonly: false })
+
+		// the room hasn't seen this change yet because the storage notifies on a microtask
+		const newPage = makePage('wipe_page', 'Wipe Page')
+		storage.transaction((txn) => {
+			txn.set(newPage.id, newPage)
+		})
+		storage.tombstoneHistoryStartsAtClock.set(storage.getClock())
+
+		// the handshake's own transaction runs broadcastChanges first and hits the wipeAll
+		room.handleMessage('b', {
+			type: 'connect',
+			connectRequestId: 'connect-b',
+			lastServerClock: 0,
+			protocolVersion: getTlsyncProtocolVersion(),
+			schema: room.serializedSchema,
+		} satisfies TLConnectRequest)
+
+		expect(socketA.close).toHaveBeenCalled()
+		expect(room.sessions.has('a')).toBe(false)
+
+		expect(socketB.close).not.toHaveBeenCalled()
+		expect(room.sessions.get('b')?.state).toBe(RoomSessionState.Connected)
+		expect(socketB.__messages).toHaveLength(1)
+		const connectMessage = socketB.__lastMessage as Extract<
+			TLSocketServerSentEvent<any>,
+			{ type: 'connect' }
+		>
+		expect(connectMessage.type).toBe('connect')
+		expect(connectMessage.hydrationType).toBe('wipe_all')
+		expect(connectMessage.diff[newPage.id]).toEqual(['put', newPage])
+
+		await Promise.resolve()
+		await Promise.resolve()
+		expect(removed.mock.calls.map(([e]) => e.sessionId)).toEqual(['a'])
+		expect(room.sessions.has('b')).toBe(true)
+	})
 })
 
 describe('24. Push handling (RP)', () => {
@@ -1949,6 +1995,111 @@ describe('25. Messaging and broadcast (RB)', () => {
 		expect(socketB.sendMessage).not.toHaveBeenCalled()
 	})
 
+	it('[RB3] a debounced flush into a socket that closed meanwhile cancels the session instead of sending', () => {
+		vi.useFakeTimers()
+		const { room, socketB } = setupTwoSessions()
+		const newPage = makePage('page_3', 'v1')
+
+		room.handleMessage('a', {
+			type: 'push',
+			clientClock: 1,
+			diff: { [newPage.id]: ['put', newPage] },
+		} as TLPushRequest<TLRecord>)
+		room.handleMessage('a', {
+			type: 'push',
+			clientClock: 2,
+			diff: { [newPage.id]: ['patch', { name: ['put', 'v2'] }] },
+		} as TLPushRequest<TLRecord>)
+		expect(socketB.sendMessage).toHaveBeenCalledTimes(1)
+
+		// the socket closes while the second message sits in the debounce buffer
+		socketB.isOpen = false
+		vi.advanceTimersByTime(DATA_MESSAGE_DEBOUNCE_INTERVAL + 1)
+
+		expect(socketB.sendMessage).toHaveBeenCalledTimes(1)
+		expect(room.sessions.get('b')?.state).toBe(RoomSessionState.AwaitingRemoval)
+	})
+
+	it('[RC7] close() drops pending debounced flushes so nothing is sent into closed sockets afterwards', () => {
+		vi.useFakeTimers()
+		const { room, socketB } = setupTwoSessions()
+		const newPage = makePage('page_3', 'v1')
+
+		room.handleMessage('a', {
+			type: 'push',
+			clientClock: 1,
+			diff: { [newPage.id]: ['put', newPage] },
+		} as TLPushRequest<TLRecord>)
+		room.handleMessage('a', {
+			type: 'push',
+			clientClock: 2,
+			diff: { [newPage.id]: ['patch', { name: ['put', 'v2'] }] },
+		} as TLPushRequest<TLRecord>)
+		expect(socketB.sendMessage).toHaveBeenCalledTimes(1)
+
+		room.close()
+		expect(room.isClosed()).toBe(true)
+		vi.advanceTimersByTime(DATA_MESSAGE_DEBOUNCE_INTERVAL + 1)
+
+		expect(socketB.sendMessage).toHaveBeenCalledTimes(1)
+		expect(socketB.close).toHaveBeenCalled()
+	})
+
+	it('[RC7] close() closes every socket even when one of them throws on close', () => {
+		const { room, socketA, socketB } = setupTwoSessions()
+		socketA.close.mockImplementationOnce(() => {
+			throw new Error('already closing')
+		})
+
+		expect(() => room.close()).not.toThrow()
+		expect(room.isClosed()).toBe(true)
+		expect(socketB.close).toHaveBeenCalled()
+	})
+
+	it('[RC7] close() forgets its sessions, and late socket close events emit no lifecycle events', () => {
+		vi.useFakeTimers()
+		const { room, socketA } = setupTwoSessions()
+		const removed = vi.fn()
+		const becameEmpty = vi.fn()
+		room.events.on('session_removed', removed)
+		room.events.on('room_became_empty', becameEmpty)
+
+		// b's socket closes before close(), a's closes after: both must stay silent
+		room.handleClose('b')
+		room.close()
+		expect(room.sessions.size).toBe(0)
+		room.handleClose('a')
+
+		vi.advanceTimersByTime(SESSION_REMOVAL_WAIT_TIME + 2001)
+		expect(removed).not.toHaveBeenCalled()
+		expect(becameEmpty).not.toHaveBeenCalled()
+		expect(socketA.sendMessage).not.toHaveBeenCalled()
+	})
+
+	it('[RC7] sessions added after close() are rejected and their sockets closed', () => {
+		const { room } = makeRoom()
+		room.close()
+
+		const late = makeSocket()
+		room.handleNewSession({ sessionId: 'late', socket: late, meta: undefined, isReadonly: false })
+		expect(late.close).toHaveBeenCalled()
+
+		const resumed = makeSocket()
+		room.handleResumedSession({
+			sessionId: 'resumed',
+			socket: resumed,
+			meta: undefined,
+			isReadonly: false,
+			serializedSchema: room.serializedSchema,
+			presenceId: null,
+			presenceRecord: null,
+			requiresLegacyRejection: false,
+			supportsStringAppend: true,
+		})
+		expect(resumed.close).toHaveBeenCalled()
+		expect(room.sessions.size).toBe(0)
+	})
+
 	it('[RB4] a per-session migration failure during broadcast rejects only the affected session', () => {
 		const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
 		try {
@@ -2235,6 +2386,31 @@ describe('26. Session lifecycle (SES)', () => {
 		expect(room.sessions.size).toBe(0)
 	})
 
+	it('[SES4] a reason longer than 123 UTF-8 bytes is truncated on a code-point boundary with a dropped-bytes suffix', () => {
+		const { room } = makeRoom()
+
+		const exact = connectSession(room, 'exact')
+		room.rejectSession('exact', 'x'.repeat(123))
+		expect(exact.close).toHaveBeenCalledWith(TLSyncErrorCloseEventCode, 'x'.repeat(123))
+
+		// '... (+200 bytes)' reserves 16 bytes, leaving 107 for the reason
+		const ascii = connectSession(room, 'ascii')
+		room.rejectSession('ascii', 'x'.repeat(200))
+		expect(ascii.close).toHaveBeenCalledWith(
+			TLSyncErrorCloseEventCode,
+			'x'.repeat(107) + '... (+93 bytes)'
+		)
+
+		// 161 bytes in, 107 to fill: 1 + 26 × 4 = 105, and a 27th 4-byte character is dropped whole
+		const emoji = connectSession(room, 'emoji')
+		room.rejectSession('emoji', 'x' + '\u{1F600}'.repeat(40))
+		expect(emoji.close).toHaveBeenCalledWith(
+			TLSyncErrorCloseEventCode,
+			'x' + '\u{1F600}'.repeat(26) + '... (+56 bytes)'
+		)
+		expect(room.sessions.size).toBe(0)
+	})
+
 	it('[HS2][SES5] sets supportsStringAppend to false for protocol version 7', () => {
 		const { room } = makeRoom()
 		connectSession(room, 'v7-session', { protocolVersion: 7 })
@@ -2306,6 +2482,130 @@ describe('26. Session lifecycle (SES)', () => {
 		expect(socket.__lastMessage).toEqual({ type: 'pong' })
 	})
 
+	it('[SES5] no session receives string-append ops while a client without append support is connected', () => {
+		vi.useFakeTimers()
+		const { room } = makeRoom()
+		const v8 = connectSession(room, 'v8', { protocolVersion: getTlsyncProtocolVersion() })
+		const v7 = connectSession(room, 'v7', { protocolVersion: 7 })
+		expect(room.getCanEmitStringAppend()).toBe(false)
+
+		const hasAppend = (msg: any) => JSON.stringify(msg).includes('"append"')
+
+		// a full put over an existing record whose only change is a string append
+		room.handleMessage('v8', {
+			type: 'push',
+			clientClock: 1,
+			diff: { [pageRecord.id]: ['put', { ...pageRecord, name: pageRecord.name + ' more' }] },
+		} as TLPushRequest<TLRecord>)
+		vi.advanceTimersByTime(DATA_MESSAGE_DEBOUNCE_INTERVAL + 1)
+		expect(sentDataMessages(v7)).toEqual([
+			{
+				type: 'patch',
+				diff: { [pageRecord.id]: ['patch', { name: ['put', pageRecord.name + ' more'] }] },
+				serverClock: 1,
+			},
+		])
+		expect(sentDataMessages(v8).some(hasAppend)).toBe(false)
+		clearSocket(v7)
+		clearSocket(v8)
+
+		// a patch whose recomputed broadcast would otherwise be an append
+		room.handleMessage('v8', {
+			type: 'push',
+			clientClock: 2,
+			diff: { [pageRecord.id]: ['patch', { name: ['put', pageRecord.name + ' more and more'] }] },
+		} as TLPushRequest<TLRecord>)
+		vi.advanceTimersByTime(DATA_MESSAGE_DEBOUNCE_INTERVAL + 1)
+		expect(sentDataMessages(v7)).toEqual([
+			{
+				type: 'patch',
+				diff: {
+					[pageRecord.id]: ['patch', { name: ['put', pageRecord.name + ' more and more'] }],
+				},
+				serverClock: 2,
+			},
+		])
+		expect(sentDataMessages(v8)).toEqual([
+			{ type: 'push_result', clientClock: 2, serverClock: 2, action: 'commit' },
+		])
+	})
+
+	it('[SES6] handleResumedSession rejects a session whose schema the server can no longer reconcile', () => {
+		const { room } = makeRoom()
+		const socket = makeSocket()
+		const newerSchema: SerializedSchemaV2 = {
+			schemaVersion: 2,
+			sequences: {
+				...(room.serializedSchema as SerializedSchemaV2).sequences,
+				'com.tldraw.store': 999,
+			},
+		}
+
+		room.handleResumedSession({
+			sessionId: 'resumed',
+			socket,
+			meta: undefined,
+			isReadonly: false,
+			serializedSchema: newerSchema,
+			presenceId: null,
+			presenceRecord: null,
+			requiresLegacyRejection: false,
+			supportsStringAppend: true,
+		})
+
+		expect(room.sessions.has('resumed')).toBe(false)
+		expect(socket.close).toHaveBeenCalledWith(
+			TLSyncErrorCloseEventCode,
+			TLSyncErrorCloseEventReason.SERVER_TOO_OLD
+		)
+	})
+
+	it('[SES6] rejecting a resumed session removes its restored presence for other sessions', () => {
+		vi.useFakeTimers()
+		const { room } = makeRoom()
+		const makePresence = (name: string) =>
+			InstancePresenceRecordType.create({
+				id: InstancePresenceRecordType.createId(name),
+				currentPageId: pageRecord.id,
+				userId: createUserId(name),
+				userName: name,
+			})
+		const resume = (sessionId: string, serializedSchema: SerializedSchema) => {
+			const socket = makeSocket()
+			const presenceRecord = makePresence(sessionId)
+			room.handleResumedSession({
+				sessionId,
+				socket,
+				meta: undefined,
+				isReadonly: false,
+				serializedSchema,
+				presenceId: presenceRecord.id,
+				presenceRecord,
+				requiresLegacyRejection: false,
+				supportsStringAppend: true,
+			})
+			return { socket, presenceId: presenceRecord.id }
+		}
+
+		const other = resume('other', room.serializedSchema)
+		const rejected = resume('rejected', {
+			schemaVersion: 2,
+			sequences: {
+				...(room.serializedSchema as SerializedSchemaV2).sequences,
+				'com.tldraw.store': 999,
+			},
+		})
+		vi.advanceTimersByTime(DATA_MESSAGE_DEBOUNCE_INTERVAL * 2)
+
+		expect(room.sessions.has('rejected')).toBe(false)
+		expect(room.presenceStore.get(rejected.presenceId)).toBeUndefined()
+		// other clients still hold this presence from before the socket slept
+		expect(sentDataMessages(other.socket).at(-1)).toMatchObject({
+			type: 'patch',
+			diff: { [rejected.presenceId]: [RecordOpType.Remove] },
+		})
+	})
+
 	it('[SES7] a message from an unknown session id logs a warning and is ignored', () => {
 		const warn = vi.fn()
 		const { room } = makeRoom({ log: { warn } })

package/src/test/objectStore.test.ts

@@ -8,6 +8,7 @@ import {
 	TLSocketServerSentEvent,
 	getTlsyncProtocolVersion,
 } from '../lib/protocol'
+import { TLSocketRoom } from '../lib/TLSocketRoom'
 import { TLSyncErrorCloseEventCode, TLSyncErrorCloseEventReason } from '../lib/TLSyncClient'
 import { RoomSnapshot, TLRoomSocket, TLSyncRoom } from '../lib/TLSyncRoom'
 
@@ -354,6 +355,40 @@ describe('object store lane', () => {
 			const connectMsg = late.__messages.find((m: any) => m.type === 'connect') as any
 			expect(Object.keys(connectMsg.diff).sort()).toEqual([doc.id, note.id].sort())
 		})
+
+		it('[US1][US3] updateStore sees and can delete object-lane records', async () => {
+			// eslint-disable-next-line @typescript-eslint/no-deprecated
+			const socketRoom = new TLSocketRoom<R, void>({
+				schema,
+				storage: new InMemorySyncStorage<R>({
+					snapshot: { documents: [], clock: 0, documentClock: 0, schema: schema.serialize() },
+					objectTypes: ['note'],
+				}),
+				objectTypes: ['note'],
+			})
+			disposables.push(() => socketRoom.close())
+			const doc = Doc.create({ title: 'canvas' })
+			const note = Note.create({ text: 'annotation' })
+			socketRoom.storage.transaction((txn) => {
+				txn.set(doc.id, doc)
+				txn.set(note.id, note)
+			})
+
+			// the update context reads both lanes, not just the document snapshot
+			// eslint-disable-next-line @typescript-eslint/no-deprecated
+			await socketRoom.updateStore((store) => {
+				expect(store.get(note.id)).toEqual(note)
+				expect(
+					store
+						.getAll()
+						.map((r) => r.id)
+						.sort()
+				).toEqual([doc.id, note.id].sort())
+				store.delete(note.id)
+			})
+			expect(socketRoom.getRecord(note.id)).toBeUndefined()
+			expect(socketRoom.getRecord(doc.id)).toEqual(doc)
+		})
 	})
 
 	describe('connect message', () => {

package/src/test/upgradeDowngrade.test.ts

@@ -413,6 +413,27 @@ it('[HS3] out-of-date clients will receive incompatibility errors', () => {
 	expect(socket.close).toHaveBeenCalledWith(4099, TLSyncErrorCloseEventReason.CLIENT_TOO_OLD)
 })
 
+it.each([
+	['a v2 schema without sequences', { schemaVersion: 2 }],
+	['a v2 schema with null sequences', { schemaVersion: 2, sequences: null }],
+	['a null schema', null],
+])('[HS3] clients sending %s are rejected as too old', (_, schema) => {
+	const server = new TestServer(schemaV3)
+	const id = 'test_malformed_schema'
+	const socket = mockSocket()
+
+	server.room.handleNewSession({ sessionId: id, socket, meta: undefined, isReadonly: false })
+	server.room.handleMessage(id, {
+		type: 'connect',
+		connectRequestId: 'test',
+		lastServerClock: 0,
+		protocolVersion: getTlsyncProtocolVersion(),
+		schema: schema as any,
+	})
+
+	expect(socket.close).toHaveBeenCalledWith(4099, TLSyncErrorCloseEventReason.CLIENT_TOO_OLD)
+})
+
 it('[HS2] clients using an out-of-date protocol will receive compatibility errors', () => {
 	const actualVersion = getTlsyncProtocolVersion()
 	mockGetTlsyncProtocolVersion.mockReturnValue(actualVersion + 1)