The sync server is in production, and its whole job is to order events and move bytes.
The server described in the threat model now runs at sync.scienti.st: an append-only log of sealed records per account, a key-wrap store, a device registry, a drop box. Two simulated devices created an account against it, linked, recovered from the code, rebuilt from a snapshot and revoked each other before anyone was allowed to call it live.
Two decisions were taken on the way and are worth stating. First, the wake-up socket a client keeps open is authenticated by a subprotocol header, never by a token in the URL, because a URL is what ends up in access logs and browser history. The server refuses the query-string form outright. Second, a sealed archive now carries its own identifiers in a short clear header: the account, the archive, the key version. Without them a file could be verified but never reopened, which we found by trying to reopen one. Nothing inside the envelope moved, so the format is unchanged; the archives written before the fix cannot be opened and are said to be unopenable rather than quietly discarded.
The exit test for this phase was that scenario against the deployed server, and it passed. The development-only routes, the ones that can destroy or restore an account, do not exist on the production Worker at all.