Relay authorization hardening — held back from the security release

[nyblnet]

Tracking issue for the collaboration relay authorization work, which is deliberately held back from the security release covering the renderer, export and host fixes.

Deliberately light on detail. This repo is public and the work is unfinished, so the specifics live in a private security advisory rather than here. This issue tracks the engineering, not the exposure.

Why it is held

Three reasons, any one of which would be enough:

1. A relay deploy cannot be taken back by an update. Every other fix in this batch reaches users through the signed update channel. A bad relay deploy breaks live collaboration for every file already in the world, including files that will never update.
2. The current branch has an unresolved regression. blobCreds() returns null in the window between socket open and the ticket arriving, which kills blob reads, not just writes. A client newer than the relay never receives the ticket at all, so blobs stay dead for the whole session — which is exactly the self-hoster and bento-sync-url case.
3. dash/src/sync/online.ts was never brought along. Dash shares this relay. Shipping the slides half alone leaves the two apps disagreeing about the wire.

Work to finish

• Resolve the blobCreds() read regression, and decide the deploy-order story for a client newer than the relay
• Proof of possession before a socket is treated as a writer — a public-key hash match is not proof
• Replace the echoed signature with an opaque verified mark, so nothing replayable leaves the relay
• Clamp the client-chosen snapshot sequence so a replay cannot prune the op log
• Reconsider the per-room latch: in a public-invite room (the guestbook) every visitor is a proven writer, so the latch is anonymously triggerable and never clears
• Bring dash/src/sync/online.ts to the same contract
• Extend scripts/test-relay-auth.ts to cover the client half — it currently has no coverage of blobCreds()
• Reconcile docs/collab-design.md, which still documents the round-one wire that was deliberately replaced

Deployment order, when it does go

The relay must be deployed before any client that depends on it — the same lesson as the keepalive change (docs/DECISIONS.md). A client that expects a relay behaviour the deployed relay lacks fails in the field, not in CI.

Current state

Changes exist in a working tree and are not committed. server/sync-worker/src/worker.js, slides/src/sync/online.ts and scripts/test-relay-auth.ts.