The re-review found several remedies that existed but were not
reachable; this closes them:
- online answers /api/auth/status with the verified identity
projection (login/logout stay 404), so the account-switch epoch
actually fires; first identification reloads the account's settings
partition, identity reset also tears down the id allocator, and an
Active projection whose namespace disagrees rebuilds it
- finish_local_edit reports Committed/NoChange/Rejected/Failed and a
real runtime rejection answers 409 version-conflict with the
authoritative version — the one shape the browser's recovery parses
- the REST scope gate runs ahead of every dispatch path including
share, AI, figma, and SSE (/mcp keeps its stronger per-tool check)
- shutdown drains connections (bounded) before the flush, the tenant
store probes create/write/rename/delete at startup and fails closed
naming the container uid, and worker-thread spawn failures abort
startup instead of silently never persisting
- ACL flushes hold the same guard as updates, and the 257th grant is
refused rather than silently truncated on the next write
- the conflict stash lost its call site in an earlier split and is
invoked again before accept; SSE subscribe prunes dead slots; an
uninstalled document push drops its pending thumbnail seed
1507911199