fix: skip non-event persistence records and enforce body-size limit in bytes

[jonbaldie]

Two confirmed bugs found via a coverage-guided property/fuzz campaign against the public HTTP and --persist seams. Each has a minimized, reproducible counterexample and a regression test.

Bug 1 — Startup crash on a null persistence record (src/persist.ts)

FileStore.loadState() parsed every non-empty line as JSON and replayed it unconditionally. A single valid-JSON null line reached Manager.applyLoadedEvent, which dereferenced null.enqueue and threw a TypeError that aborted server startup before it could listen.

• Repro: persist.dat containing the four bytes null → main.ts --persist exits with code 1 and no listener.
• Root cause: no event-shape validation at the persistence decode boundary.
• Fix: an isQueueEvent() type guard rejects non-conforming records (non-objects, wrong field types, or enqueue == dequeue) so they are skipped like malformed JSON.
• Regression test: starts a real main.ts --persist process against null and asserts /health and /queues still respond.

Bug 2 — Multi-byte UTF-8 body evades the 1 MiB size limit (src/handler.ts)

readRequestBody's backstop checked body.length after request.text(), which counts UTF-16 code units, not wire bytes. A chunked (no Content-Length) UTF-8 body of 1.2 MiB bytes but 400K code units bypassed the byte limit and was enqueued with 200 instead of 413. String bodies were unaffected because Deno sets Content-Length to the byte length, so only chunked requests evaded the check.

• Repro: streaming fetch body of {"payload":"一".repeat(400000)} (1,200,014 bytes, 400,014 code units), no Content-Length → 200.
• Root cause: the limit was measured in code units, not bytes.
• Fix: re-measure via LOG_ENCODER.encode(body).length (bytes), reusing the existing module-level TextEncoder so no new coupling is introduced.
• Regression test: sends a streaming multi-byte body with no Content-Length and asserts 413.

Diagnosis

Followed /diagnosing-bugs: tight red-capable loop -> minimized repro -> ranked falsifiable hypotheses -> confirmed root cause -> fix + regression test -> original repro no longer reproduces.

CI verification (local)

• deno test --allow-read --allow-write --allow-net --allow-env --allow-run: 374 passed
• Mutasaurus: 99% overall, all files >=80% (handler 100%, persist 100%)
• Stryker: all files >=80% (handler 89%, persist 84%), stryker_check exit 0
• Production quality gate: exit 0, no new warnings
• deno compile main.ts: exit 0

🤖 Generated with Claude Code