storage-cors-3: prune tombstoned service snapshots and persisted feed cache

docs/testing/storage-cors-3-integrity.md

@@ -38,3 +38,44 @@ Restored mutants: unconditional deletion fails all3 ordering scenarios; omitted
 An initial focused command named nonexistent `tests/video-event-buffer.test.mjs` and failed before tests. Corrected to existing `tests/nostr/videoEventBuffer.test.mjs`; no registration/assertion changes.
 
 No browser/full/build/live signer/cloud/relay qualification. Coordinator stale-render remains open, read-only and outside this change.
+
+## Service snapshot/persistence boundary
+
+```yaml
+test_integrity_note:
+  change_type: ["new_tests"]
+  scenarios:
+    - id: SCN-storage3-service-prune
+      given: "multiple cached versions and unrelated content"
+      when: "different-ID deletion marker and late older version arrive through actual subscription"
+      then: "service map, callback, emitter and persisted snapshot contain only unrelated content"
+    - id: SCN-storage3-service-empty
+      given: "single live version or an all-ineligible persisted cache"
+      when: "deletion empties feed or empty active cache loads"
+      then: "empty persistence replaces stale cache and replacement consumer sees no resurrected entry"
+    - id: SCN-storage3-service-persistent
+      given: "deleted and invalid persisted objects for public or author viewer"
+      when: "optimistic load filters the cache"
+      then: "only live content is notified, cached and persisted before author bypass"
+    - id: SCN-storage3-service-known-tombstone
+      given: "stale nondeleted persisted copy covered by authoritative client tombstone"
+      when: "reload or direct cache API encounters stale copy"
+      then: "stale copy stays absent while newer valid and unrelated entries survive"
+    - id: SCN-storage3-service-author
+      given: "legacy synthesized roots sharing d-tag across distinct authors"
+      when: "one author deletion then newer live content and replayed older deletion arrive"
+      then: "unrelated author and strictly newer content remain in every service snapshot"
+  observable_outcomes:
+    - "actual service map, callback, videos:updated and filtered localStorage snapshots"
+  determinism_controls:
+    - "same actual subscription/client fixture as buffer cases, explicit EOSE and zero real network attempts"
+  anti_cheat_rationale:
+    prevents: ["ID-only removal", "flag-only filtering", "author bypass of deleted state", "empty-persistence skip", "overbroad author cleanup", "over-mocking ingest"]
+  relaxation:
+    did_relax_any_assertion: false
+    if_true_explain_spec_basis: ""
+```
+
+New service tests: old service baseline 0pass/8fail; fixed8/8. Eight restored mutants all fail: old-service8; allow-deleted4; allow-invalid4; ignore-known-tombstone2; skip-map-prune5; skip-empty-persist1; skip-direct-cache-guard1; skip-optimistic-persist2. Every retained scenario rejects the old service and at least one selective mutant. Mutator `/tmp/storage3-service-mutants.py` restores product source in finally; logs `/tmp/storage3-service-mutant-results.log` and uniquely named `/tmp/storage3-<mutant>.log`.
+
+Existing live-feed regression exposed that an update may carry the original event ID and a separate deleted object rather than a shared client object. Preserve explicit deletion-ID removal alongside authoritative client tombstone cleanup; the regression was not modified. No new root/address matching implementation: service calls client `isOlderThanTombstone`, including its existing legacy/author key derivation. Existing access/privacy/NSFW/consumer/subscription behavior is covered by unchanged focused suites.