fix: harden residual route and restore checks

src/lib/server/restore-marker.ts

@@ -1,4 +1,5 @@
 export const RESTORE_MARKER_CONFIRMATION = 'DISPOSABLE_LOOPBACK_ONLY';
+export const SYNTHETIC_CHARACTER_ID_MIN = 4_000_000_000;
 const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);
 
 export type RestoreMarkerPhase = 'verify' | 'write' | 'expect-invalidated';

src/routes/api/chat/+server.ts

@@ -10,8 +10,9 @@ import { capabilityDisabledReason, capabilityEnabled } from '$lib/server/release
 const schema = z.object({ message: z.string().trim().min(1).max(2000), requestId: z.uuid() });
 export const POST: RequestHandler = async (event) => {
   const config = configuration();
-  // Keep disabled routes from touching Convex/session/provider state. The
-  // normal user-keyed limiter is restored after session resolution below.
+  // Bound origin/session work by the existing anonymous IP bucket first. The
+  // normal authenticated user-keyed limiter is restored after resolution.
+  protectMutation(event, `chat:${event.getClientAddress()}`);
   if (!capabilityEnabled('assistant_dispatch', config.capabilityAllowlist)) {
     return json({ error: capabilityDisabledReason('assistant_dispatch') }, { status: 503 });
   }

src/routes/api/sync/+server.ts

@@ -6,6 +6,9 @@ import { capabilityDisabledReason, capabilityEnabled } from '$lib/server/release
 import { configuration } from '$lib/server/config';
 export const POST: RequestHandler = async (event) => {
   const config = configuration();
+  // Bound origin/session work by the existing anonymous IP bucket first. The
+  // normal authenticated user-keyed limiter is restored after resolution.
+  protectMutation(event, `sync:${event.getClientAddress()}`, 6);
   if (!capabilityEnabled('asset_sync', config.capabilityAllowlist)) {
     return json({ error: capabilityDisabledReason('asset_sync') }, { status: 503 });
   }