cursedbelt-server 4.11.1 → 4.13.0

package/src/server/incidents/index.ts

@@ -53,14 +53,14 @@ export {
 	type IncidentChannel,
 	type SendEmail,
 	type TextChannelOptions,
-} from "./channels";
+} from "./channels.js";
 export {
 	type CheckOutcome,
 	type IncidentCheck,
 	runIncidentSweep,
 	type SweepResult,
-} from "./checks";
-export { INCIDENT_MIGRATIONS, INCIDENTS_TABLE } from "./migrations";
+} from "./checks.js";
+export { INCIDENT_MIGRATIONS, INCIDENTS_TABLE } from "./migrations.js";
 export {
 	type AnnounceResult,
 	composeOpened,
@@ -68,23 +68,23 @@ export {
 	type CreateNotifierOptions,
 	createIncidentNotifier,
 	type IncidentNotifier,
-} from "./notifier";
+} from "./notifier.js";
 export {
 	createIncidentReporter,
 	type IncidentReporter,
 	type IncidentReporterOptions,
-} from "./reporter";
+} from "./reporter.js";
 export {
 	type IncidentRoutesOptions,
 	mountIncidentMachineRoutes,
 	mountIncidentOwnerRoutes,
-} from "./routes";
+} from "./routes.js";
 export {
 	assertNoContent,
 	createIncidentStore,
 	type IncidentStore,
 	type ReconcileOptions,
-} from "./store";
+} from "./store.js";
 export {
 	fingerprint,
 	type Incident,
@@ -93,4 +93,4 @@ export {
 	type IncidentSeverity,
 	type IncidentState,
 	type IncidentTransitions,
-} from "./types";
+} from "./types.js";

package/src/server/incidents/migrations.ts

@@ -1,5 +1,5 @@
 import type { Database } from "bun:sqlite";
-import type { Migration } from "../migration/types";
+import type { Migration } from "../migration/types.js";
 
 /** The one table this primitive owns. */
 export const INCIDENTS_TABLE = "incidents";

package/src/server/incidents/notifier.ts

@@ -28,9 +28,9 @@
  * the store (`assertNoContent`). A text message is the least private surface
  * this fleet has and several of its apps are private by construction.
  */
-import type { ChannelMessage, ChannelResult, IncidentChannel } from "./channels";
-import type { IncidentStore } from "./store";
-import type { Incident, IncidentTransitions } from "./types";
+import type { ChannelMessage, ChannelResult, IncidentChannel } from "./channels.js";
+import type { IncidentStore } from "./store.js";
+import type { Incident, IncidentTransitions } from "./types.js";
 
 export interface IncidentNotifier {
 	/** Send for every transition in `t`. Returns one result per message sent. */

package/src/server/incidents/reporter.ts

@@ -28,7 +28,7 @@
  * than one with no alerting. Every failure here is logged and swallowed, and the
  * console notices the silence by other means (the service's own health probe).
  */
-import type { IncidentReport } from "./types";
+import type { IncidentReport } from "./types.js";
 
 export interface IncidentReporterOptions {
 	/** e.g. `http://127.0.0.1:3024/api/station/incidents/report`. */

package/src/server/incidents/routes.ts

@@ -35,11 +35,11 @@
  * correct.
  */
 import type { Hono } from "hono";
-import type { IncidentChannel } from "./channels";
-import type { IncidentNotifier } from "./notifier";
-import { assertNoContent, type IncidentStore } from "./store";
-import type { IncidentReport, IncidentSeverity } from "./types";
-import type { SweepResult } from "./checks";
+import type { IncidentChannel } from "./channels.js";
+import type { IncidentNotifier } from "./notifier.js";
+import { assertNoContent, type IncidentStore } from "./store.js";
+import type { IncidentReport, IncidentSeverity } from "./types.js";
+import type { SweepResult } from "./checks.js";
 
 const noStore = { "cache-control": "no-store" } as const;
 

package/src/server/incidents/store.ts

@@ -28,15 +28,15 @@
  * of all across the restart a deploy of the console itself performs.
  */
 import type { Database } from "bun:sqlite";
-import { runMigrations } from "../migration/runner";
-import { INCIDENT_MIGRATIONS, INCIDENTS_TABLE } from "./migrations";
+import { runMigrations } from "../migration/runner.js";
+import { INCIDENT_MIGRATIONS, INCIDENTS_TABLE } from "./migrations.js";
 import {
 	fingerprint,
 	type Incident,
 	type IncidentFact,
 	type IncidentReport,
 	type IncidentTransitions,
-} from "./types";
+} from "./types.js";
 
 interface Row {
 	fingerprint: string;

package/src/server/index.ts

@@ -19,7 +19,7 @@ export {
   type UploadedFile,
 } from 'cursedbelt-core/ctgr';
 // ── HTTP app ────────────────────────────────────────────────────────────────
-export { type CreateAppOpts, createApp, type ServeBunOpts, serveBun } from './app';
+export { type CreateAppOpts, createApp, type ServeBunOpts, serveBun } from './app.js';
 // ── Auth toolkit (task 26): jose JWT, cookies, CSRF, getOnly, session store, ──
 //    login throttle, argon2id passwords, TOTP, vault crypto, the composed middleware.
 export {
@@ -65,11 +65,11 @@ export {
   verifyRecoveryCode,
   verifyToken,
   verifyTotpCode,
-} from './auth';
-export type { CursedbeltEnv, CursedbeltVariables } from './context';
-export { buildRoutes, CTGR_ROUTE_PATTERN, getCtgrDecoded, unGETify } from './ctgr';
+} from './auth/index.js';
+export type { CursedbeltEnv, CursedbeltVariables } from './context.js';
+export { buildRoutes, CTGR_ROUTE_PATTERN, getCtgrDecoded, unGETify } from './ctgr.js';
 // ── Kysely-typed plumbing tables ────────────────────────────────────────────
-export { createKysely, type PlumbingDb } from './db/kysely';
+export { createKysely, type PlumbingDb } from './db/kysely.js';
 export type {
   AppConfigRow,
   AuthSessionRow,
@@ -81,7 +81,7 @@ export type {
   PlumbingSchema,
   RequestMetricRow,
   SystemSampleRow,
-} from './db/plumbingTypes';
+} from './db/plumbingTypes.js';
 // ── Errors ──────────────────────────────────────────────────────────────────
 export {
   ApiError,
@@ -93,7 +93,7 @@ export {
   VALIDATION_ERROR_CODE,
   type ValidationIssue,
   validationEnvelope,
-} from './errors';
+} from './errors.js';
 // ── Jobs & scheduler (task 29): plainjob-backed cron runner + restart-aware ───
 //    pollers + the due-row fire queue. App job *definitions* stay business.
 export {
@@ -114,7 +114,7 @@ export {
   JobTimeoutError,
   type PollingJob,
   type PollingJobOpts,
-} from './jobs';
+} from './jobs/index.js';
 // ── Media adapter (task 19): image rendering via sharp (lazy/optional peer) + ──
 //    video trim / probe / thumbnail via native ffmpeg. Also at the dedicated
 //    media-bun entry below; sharp is imported lazily inside renderImage,
@@ -135,15 +135,15 @@ export {
   trimVideo,
   type VideoCodecPlan,
   videoCodecPlan,
-} from './media-bun';
+} from './media-bun/index.js';
 // ── Metrics ───────────────────────────────────────────────────────────────────
 export {
   createMetricsBuffer,
   type MetricRow,
   type MetricsBuffer,
   type MetricsBufferOptions,
-} from './metrics/metricsBuffer';
-export { normalizeRoute } from './metrics/normalizeRoute';
+} from './metrics/metricsBuffer.js';
+export { normalizeRoute } from './metrics/normalizeRoute.js';
 export {
   type AnalyticsEngineDataset,
   createTelemetrySink,
@@ -152,26 +152,26 @@ export {
   type TelemetrySink,
   type TelemetrySinkOptions,
   toDataPoint,
-} from './metrics/telemetrySink';
+} from './metrics/telemetrySink.js';
 // ── Middleware ────────────────────────────────────────────────────────────────
-export { correlationId } from './middleware/correlationId';
-export { type CorsOpts, corsAllowlist, corsOptsFromEnv } from './middleware/corsAllowlist';
-export { errorEnvelope } from './middleware/errorEnvelope';
-export { crossOriginRefusal } from './middleware/localOrigin';
-export { clientIp, createRateLimiter, type RateLimitOpts } from './middleware/rateLimit';
-export { type RequestLoggerOpts, requestLogger } from './middleware/requestLogger';
+export { correlationId } from './middleware/correlationId.js';
+export { type CorsOpts, corsAllowlist, corsOptsFromEnv } from './middleware/corsAllowlist.js';
+export { errorEnvelope } from './middleware/errorEnvelope.js';
+export { crossOriginRefusal } from './middleware/localOrigin.js';
+export { clientIp, createRateLimiter, type RateLimitOpts } from './middleware/rateLimit.js';
+export { type RequestLoggerOpts, requestLogger } from './middleware/requestLogger.js';
 export {
   type CspDirectives,
   type SecurityHeadersOpts,
   securityHeaders,
-} from './middleware/securityHeaders';
+} from './middleware/securityHeaders.js';
 // ── zod validation toolkit ────────────────────────────────────────────────────
 //    (the `validationEnvelope`/`toValidationIssues`/`ValidationIssue` builders now
 //     live with the canonical envelope in `./errors`, re-exported above.)
-export { type ZValidatorTarget, zValidator } from './middleware/zValidator';
+export { type ZValidatorTarget, zValidator } from './middleware/zValidator.js';
 // ── Migration runner ──────────────────────────────────────────────────────────
-export { addColumnIfMissing, applyRecommendedPragmas, columnExists, runMigrations } from './migration/runner';
-export type { Migration } from './migration/types';
+export { addColumnIfMissing, applyRecommendedPragmas, columnExists, runMigrations } from './migration/runner.js';
+export type { Migration } from './migration/types.js';
 // ── Audit log: the SQLite-backed AuditSink cursedshell's service dispatch ─────
 //    writes to (see `cwip/audit` for the storage-agnostic contract + the
 //    zero-config in-memory default).
@@ -181,7 +181,7 @@ export {
   auditStateAtVersion,
   auditStep,
   createSqliteAuditSink,
-} from './audit';
+} from './audit/index.js';
 // ── SQLite toolkit extras (task 30): FTS5 ranked search + DDL generator, the ───
 //    read-only DB viewer middleware, the VACUUM-INTO backup service, DB health probes.
 export {
@@ -232,7 +232,7 @@ export {
   type TableExportFormat,
   type TableStat,
   UnknownTableError,
-} from './sqlite';
+} from './sqlite/index.js';
 // ── WebSocket hub (task 28): Bun-native upgrade, channel registry, heartbeat, ──
 //    presence-as-a-view, room helpers, and the push-only event-bus subset (ru).
 export {
@@ -254,9 +254,9 @@ export {
   type WsHub,
   type WsHubOpts,
   type WsMessage,
-} from './ws';
+} from './ws/index.js';
 
 // The app-data root resolver. Exported at the root (2026-09-15, task 148) because
 // `cursedbelt-cc`'s localHost needs it and it answers a question about the HOST, not
 // about any one subsystem — so no subpath barrel is its natural home.
-export { resolveAppDataHome } from './paths/appDataHome';
+export { resolveAppDataHome } from './paths/appDataHome.js';

package/src/server/jobs/fireQueue.spec.ts

@@ -1,6 +1,6 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { createFireQueue } from './fireQueue';
+import { createFireQueue } from './fireQueue.js';
 
 const JOB_STATE_DDL = `CREATE TABLE job_state (name TEXT PRIMARY KEY, last_run_at TEXT, meta TEXT)`;
 const sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms));

package/src/server/jobs/fireQueue.ts

@@ -1,6 +1,6 @@
-import { defaultJobLogger } from './logger';
-import { createPollingJob } from './polling';
-import { DEFAULT_FIRE_INTERVAL_MS, type FireQueue, type FireQueueOpts } from './types';
+import { defaultJobLogger } from './logger.js';
+import { createPollingJob } from './polling.js';
+import { DEFAULT_FIRE_INTERVAL_MS, type FireQueue, type FireQueueOpts } from './types.js';
 
 /**
  * The "select due rows → deliver each → mark sent" pattern, as a {@link PollingJob}.

package/src/server/jobs/index.ts

@@ -3,12 +3,12 @@
 // restart-aware pollers, the due-row fire queue, run auditing); app job
 // *definitions* stay business and consume these primitives.
 
-export { createFireQueue } from './fireQueue';
-export { defaultJobLogger } from './logger';
-export { createPlainjobConnection } from './plainjobAdapter';
-export { createPollingJob } from './polling';
-export { createJobRunner } from './runner';
-export { JobTimeoutError } from './timeout';
+export { createFireQueue } from './fireQueue.js';
+export { defaultJobLogger } from './logger.js';
+export { createPlainjobConnection } from './plainjobAdapter.js';
+export { createPollingJob } from './polling.js';
+export { createJobRunner } from './runner.js';
+export { JobTimeoutError } from './timeout.js';
 export {
   type CreateJobRunnerOptions,
   DEFAULT_FIRE_INTERVAL_MS,
@@ -24,4 +24,4 @@ export {
   type JobRunRecord,
   type PollingJob,
   type PollingJobOpts,
-} from './types';
+} from './types.js';

package/src/server/jobs/logger.ts

@@ -1,4 +1,4 @@
-import type { JobLogger } from './types';
+import type { JobLogger } from './types.js';
 
 /**
  * The default job logger: warn/info/error go to the console, `debug` is a no-op.

package/src/server/jobs/plainjobAdapter.spec.ts

@@ -1,6 +1,6 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { createPlainjobConnection } from './plainjobAdapter';
+import { createPlainjobConnection } from './plainjobAdapter.js';
 
 describe('createPlainjobConnection', () => {
   let db: Database;

package/src/server/jobs/polling.spec.ts

@@ -1,6 +1,6 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { createPollingJob } from './polling';
+import { createPollingJob } from './polling.js';
 
 const JOB_STATE_DDL = `CREATE TABLE job_state (
   name TEXT PRIMARY KEY,

package/src/server/jobs/polling.ts

@@ -1,5 +1,5 @@
-import { defaultJobLogger } from './logger';
-import type { JobContext, PollingJob, PollingJobOpts } from './types';
+import { defaultJobLogger } from './logger.js';
+import type { JobContext, PollingJob, PollingJobOpts } from './types.js';
 
 /**
  * A periodic, restart-aware poller — the engine behind ca's `setInterval`

package/src/server/jobs/runner.spec.ts

@@ -1,8 +1,8 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { ApiError } from '../errors';
-import { createJobRunner } from './runner';
-import { JobTimeoutError } from './timeout';
+import { ApiError } from '../errors.js';
+import { createJobRunner } from './runner.js';
+import { JobTimeoutError } from './timeout.js';
 
 const JOB_RUNS_DDL = `CREATE TABLE job_runs (
   id TEXT PRIMARY KEY,

package/src/server/jobs/runner.ts

@@ -1,9 +1,9 @@
 import type { Database } from 'bun:sqlite';
 import { defineQueue, defineWorker, type Queue, type Worker } from 'plainjob';
-import { ApiError } from '../errors';
-import { defaultJobLogger } from './logger';
-import { createPlainjobConnection } from './plainjobAdapter';
-import { withTimeout } from './timeout';
+import { ApiError } from '../errors.js';
+import { defaultJobLogger } from './logger.js';
+import { createPlainjobConnection } from './plainjobAdapter.js';
+import { withTimeout } from './timeout.js';
 import {
   type CreateJobRunnerOptions,
   DEFAULT_JOB_RETENTION,
@@ -13,7 +13,7 @@ import {
   type JobLogger,
   type JobRunner,
   type JobRunRecord,
-} from './types';
+} from './types.js';
 
 /**
  * Create the durable cron job runner — a thin facade over **plainjob** (MIT,

package/src/server/jobs/timeout.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'bun:test';
-import { JobTimeoutError, withTimeout } from './timeout';
+import { JobTimeoutError, withTimeout } from './timeout.js';
 
 const sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms));
 

package/src/server/master-lock/accounts.spec.ts

@@ -20,8 +20,8 @@ import {
 	type MasterLockKdfParams,
 	deriveMasterLockVerifier,
 } from "cursedbelt-core/master-lock";
-import { FIRST_ACCOUNT_ID, MasterLock, readRecord } from "./masterLock";
-import { createMemoryMasterLockStore } from "./store";
+import { FIRST_ACCOUNT_ID, MasterLock, readRecord } from "./masterLock.js";
+import { createMemoryMasterLockStore } from "./store.js";
 
 /** `iter: 1` — the ROUND COUNT is pinned in `cursedbelt-core`'s `kdf.spec.ts`; 600k × N
  *  argon2 verifies here would be minutes of gate for nothing this file is testing. */

package/src/server/master-lock/accountsPage.spec.ts

@@ -22,10 +22,10 @@ import {
 	MASTER_LOCK_ACCOUNTS_SCRIPT,
 	MASTER_LOCK_ACCOUNTS_STYLE,
 	accountsPageHtml,
-} from "./accountsPage";
-import { createMasterLockGuard } from "./guard";
-import { MasterLock } from "./masterLock";
-import { createMemoryMasterLockStore } from "./store";
+} from "./accountsPage.js";
+import { createMasterLockGuard } from "./guard.js";
+import { MasterLock } from "./masterLock.js";
+import { createMemoryMasterLockStore } from "./store.js";
 
 const KDF: MasterLockKdfParams = {
 	v: 1,

package/src/server/master-lock/accountsPage.ts

@@ -33,7 +33,7 @@
  * only be watching one of them.
  */
 import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_DERIVE_SOURCE, type LockPageOptions } from "./lockPage";
+import { MASTER_LOCK_DERIVE_SOURCE, type LockPageOptions } from "./lockPage.js";
 
 /**
  * The page's own two assets.

package/src/server/master-lock/beaconNeverReachesTheWall.spec.ts

@@ -12,10 +12,10 @@ import {
 	foreignScriptSources,
 	htmlCarriesWebAnalytics,
 	scriptsRefusedByCsp,
-} from "../analytics";
-import { MASTER_LOCK_CSP, createMasterLockGuard } from "./guard";
-import { MasterLock } from "./masterLock";
-import { createMemoryMasterLockStore } from "./store";
+} from "../analytics/index.js";
+import { MASTER_LOCK_CSP, createMasterLockGuard } from "./guard.js";
+import { MasterLock } from "./masterLock.js";
+import { createMemoryMasterLockStore } from "./store.js";
 
 /**
  * 🔴 **The wall never carries the beacon, and the public shells always do.** Both halves, in

package/src/server/master-lock/guard.spec.ts

@@ -13,9 +13,9 @@ import {
 	deriveMasterLockVerifier,
 	newMasterLockKdfParams,
 } from "cursedbelt-core/master-lock";
-import { createMasterLockGuard } from "./guard";
-import { MasterLock } from "./masterLock";
-import { createMemoryMasterLockStore } from "./store";
+import { createMasterLockGuard } from "./guard.js";
+import { MasterLock } from "./masterLock.js";
+import { createMemoryMasterLockStore } from "./store.js";
 
 const KDF: MasterLockKdfParams = {
 	v: 1,

package/src/server/master-lock/guard.ts

@@ -22,9 +22,9 @@ import {
 	MASTER_LOCK_ACCOUNTS_SCRIPT,
 	MASTER_LOCK_ACCOUNTS_STYLE,
 	accountsPageHtml,
-} from "./accountsPage";
-import { LOCK_SCRIPT, LOCK_STYLE, type LockPageOptions, lockPageHtml } from "./lockPage";
-import type { MasterLock } from "./masterLock";
+} from "./accountsPage.js";
+import { LOCK_SCRIPT, LOCK_STYLE, type LockPageOptions, lockPageHtml } from "./lockPage.js";
+import type { MasterLock } from "./masterLock.js";
 
 export interface MasterLockGuardOptions extends LockPageOptions {
 	/**

package/src/server/master-lock/index.ts

@@ -26,26 +26,26 @@ export {
 	MASTER_LOCK_ACCOUNTS_STYLE,
 	MASTER_LOCK_MIN_PASSWORD_LENGTH,
 	accountsPageHtml,
-} from "./accountsPage";
+} from "./accountsPage.js";
 export {
 	MASTER_LOCK_CSP,
 	type MasterLockGuard,
 	type MasterLockGuardOptions,
 	createMasterLockGuard,
-} from "./guard";
+} from "./guard.js";
 export {
 	LOCK_SCRIPT,
 	LOCK_STYLE,
 	MASTER_LOCK_DERIVE_SOURCE,
 	type LockPageOptions,
 	lockPageHtml,
-} from "./lockPage";
+} from "./lockPage.js";
 export {
 	MASTER_LOCK_PRINCIPAL_KEY_PREFIX,
 	MasterLockDirectory,
 	type MasterLockDirectoryOptions,
 	masterLockPrincipalKey,
-} from "./principals";
+} from "./principals.js";
 export {
 	FIRST_ACCOUNT_ID,
 	MasterLock,
@@ -57,16 +57,17 @@ export {
 	type MasterLockStore,
 	type MasterLockUnlockResult,
 	readRecord,
-} from "./masterLock";
+} from "./masterLock.js";
 export {
 	DEFAULT_SEED_IDLE_MS,
 	generateStagePassword,
 	type MintMasterLockSeedOptions,
 	mintMasterLockSeed,
 	serializeMasterLockSeed,
-} from "./seed";
+} from "./seed.js";
 export {
 	MASTER_LOCK_SETTING_KEY,
+	MASTER_LOCK_STATE_KEY,
 	createKvMasterLockStore,
 	createMemoryMasterLockStore,
-} from "./store";
+} from "./store.js";

package/src/server/master-lock/lockPage.spec.ts

@@ -13,8 +13,8 @@
  */
 import { describe, expect, test } from "bun:test";
 import { MASTER_LOCK_PATHS, type MasterLockKdfParams, deriveMasterLockVerifier } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_ACCOUNTS_SCRIPT } from "./accountsPage";
-import { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, lockPageHtml } from "./lockPage";
+import { MASTER_LOCK_ACCOUNTS_SCRIPT } from "./accountsPage.js";
+import { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, lockPageHtml } from "./lockPage.js";
 
 const KDF: MasterLockKdfParams = {
 	v: 1,

package/src/server/master-lock/masterLock.spec.ts

@@ -13,8 +13,8 @@ import {
 	deriveMasterLockVerifier,
 	newMasterLockKdfParams,
 } from "cursedbelt-core/master-lock";
-import { MasterLock, readRecord } from "./masterLock";
-import { createMemoryMasterLockStore } from "./store";
+import { MasterLock, readRecord } from "./masterLock.js";
+import { createMemoryMasterLockStore } from "./store.js";
 
 const KDF: MasterLockKdfParams = {
 	v: 1,
@@ -369,3 +369,60 @@ describe("readRecord", () => {
 		expect(readRecord(JSON.stringify({ ...base, idleMs: -5 }))?.idleMs).toBe(MIN_IDLE_MS);
 	});
 });
+
+describe("the live state, when the instance does not outlive a request (a Worker)", () => {
+	/** One record store and one state store, and a fresh MasterLock per "request" over both. */
+	function perRequest(now: () => number = Date.now) {
+		const store = createMemoryMasterLockStore(null);
+		const state = createMemoryMasterLockStore(null);
+		const fresh = () => new MasterLock({ store, state, seedJson: SEED, now });
+		return { fresh, state };
+	}
+
+	test("🔴 an unlock made in one instance opens the NEXT one — the collections-stage defect", async () => {
+		const { fresh } = perRequest();
+		const result = await fresh().unlock(VERIFIER);
+		if (!result.ok) throw new Error("expected an unlock");
+		const next = fresh();
+		expect(next.presents(req(result.token))).toBe(true);
+		expect(next.unlocked).toBe(true);
+	});
+
+	test("the defect it replaced: with no state store, the next instance has forgotten", async () => {
+		const store = createMemoryMasterLockStore(null);
+		const result = await new MasterLock({ store, seedJson: SEED }).unlock(VERIFIER);
+		if (!result.ok) throw new Error("expected an unlock");
+		expect(new MasterLock({ store, seedJson: SEED }).presents(req(result.token))).toBe(false);
+	});
+
+	test("🔴 the throttle holds ACROSS instances — a fresh counter per request throttled nothing", async () => {
+		const now = 1_000_000;
+		const { fresh } = perRequest(() => now);
+		for (let i = 0; i < 6; i += 1) await fresh().unlock("wrong");
+		expect(fresh().status().retryAfterMs).toBe(30_000);
+		expect((await fresh().unlock(VERIFIER)).ok).toBe(false);
+	}, KDF_BULK_MS);
+
+	test("a lock in one instance closes every other — the manual lock reaches every device", async () => {
+		const { fresh } = perRequest();
+		const result = await fresh().unlock(VERIFIER);
+		if (!result.ok) throw new Error("expected an unlock");
+		fresh().lock();
+		expect(fresh().presents(req(result.token))).toBe(false);
+	});
+
+	test("🔴 the persisted state holds no token — a leaked row opens nothing", async () => {
+		const { fresh, state } = perRequest();
+		const result = await fresh().unlock(VERIFIER);
+		if (!result.ok) throw new Error("expected an unlock");
+		const stored = state.read() ?? "";
+		expect(stored).toContain("sessions");
+		expect(stored).not.toContain(result.token);
+	});
+
+	test("unreadable state is LOCKED state", () => {
+		const store = createMemoryMasterLockStore(null);
+		const lock = new MasterLock({ store, state: createMemoryMasterLockStore("{not json"), seedJson: SEED });
+		expect(lock.unlocked).toBe(false);
+	});
+});