@pyric/cli 0.1.0-alpha.30.2 → 0.1.0-alpha.31

package/dist/serve/site-ui/docs/storage-compat/index.html

@@ -68,8 +68,8 @@ html{scrollbar-gutter:stable}
 <div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/service.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>unit:service.test.ts</code></a> ("rejects an object that was not produced by a factory")</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
-<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getStorage(app, bucketUrl?)<code> / </code>getStorageSandbox(target, options?)</code><span class="compat-sub"><span class="compat-behavior"><code>getStorage(app, bucketUrl?)</code> accepts Firebase's bucket argument; the sandbox remains bound to its configured single bucket</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Package resolution owns production selection. The sandbox accepts the canonical argument but does not model production multi-bucket routing; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/service.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>unit:service.test.ts</code></a> pins the configured <code>pyric-default</code> bucket.</div></div>
+<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getStorage(app, bucketUrl?)<code> / </code>getStorageSandbox(target, options?)</code><span class="compat-sub"><span class="compat-behavior"><code>getStorage(app, bucketUrl?)</code> opens the bucket the URL names, with its own objects and the rules deployed to it; the app's default bucket is stored under the key <code>pyric-default</code></span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">Package resolution owns production selection. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/service.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>unit:service.test.ts</code></a> pins a bucket URL other than the app's <code>storageBucket</code> opening its own bucket, and the default bucket's store key <code>pyric-default</code>; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/per-bucket-rules.test.ts#L11" target="_blank" rel="noopener noreferrer"><code>unit:storage/per-bucket-rules.test.ts</code></a> pins each bucket's objects and rules apart. The in-page plane still reports the default bucket as <code>pyric-default</code> in metadata and references (#1519).</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getStorage(app, bucketUrl?)<code> / </code>getStorageSandbox(target, options?)</code><span class="compat-sub"><span class="compat-behavior">Pyric documents that carry Storage bytes inline as base64 in one JSON string (the in-process <code>storage.json</code>, a <code>--persist</code> state file, a fixture export, an inline state capture, and branch files) refuse a total past <code>MAX_INLINE_STORAGE_BYTES</code> with <code>storage/quota-exceeded</code>, naming the limit, the total, and the by-reference alternative, before any byte is encoded or written</span></span></span></summary>
@@ -143,8 +143,8 @@ html{scrollbar-gutter:stable}
 <div class="compat-evidence"><div class="compat-probe">Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/client-storage-ref-urls.json" target="_blank" rel="noopener noreferrer"><code>client-storage-ref-urls</code></a> (firebase 12.13.0) records <code>pyricHostUrl</code> (<code>storage/invalid-url</code>). The Node host's <code>getDownloadURL</code> issues this form, so an app that keeps a download URL and later calls <code>deleteObject(ref(storage, url))</code> needs <code>ref()</code> to read it. The storage oracle suite replays it against the engine's <code>ref()</code>, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-ref-urls.test.ts#L3" target="_blank" rel="noopener noreferrer"><code>storage-ref-urls.test.ts</code></a> against the served page client's <code>ref()</code>: both pin production's code beside the sandbox's reference, whose <code>fullPath</code> and <code>name</code> equal those production gives for <code>firebaseDownloadUrl</code>. The web byte route fixture in <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/hosted-sqlite.test.ts#L13" target="_blank" rel="noopener noreferrer"><code>hosted-sqlite.test.ts</code></a> keeps a download URL from the Node host and deletes the object by <code>ref(storage, url)</code>, and hosted smoke test 9 does the same from a Chromium page against the built CLI's Node host. Production never issues this URL, so no production app depends on the error. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L89" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
-<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">ref(storage, url).bucket</code><span class="compat-sub"><span class="compat-behavior">Production gives a reference on the URL's bucket, including a bucket other than the app's default. The sandbox serves one bucket, so the reference is on that bucket, at the URL's path</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/client-storage-ref-urls.json" target="_blank" rel="noopener noreferrer"><code>client-storage-ref-urls</code></a> (firebase 12.13.0) records <code>gsOtherBucket</code> and <code>firebaseDownloadUrlOtherBucket</code> (<code>bucket: 'other-bucket'</code>) and <code>gsDefaultBucket</code> (<code>bucket: 'b'</code>, the configured bucket). The sandbox serves one bucket, as <code>getStorage(app, bucketUrl?)</code> does (storage#11): an object an app wrote through another bucket's handle is in that one bucket, so a URL naming another bucket reads it there. The storage oracle suite replays it against the engine's <code>ref()</code>, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-ref-urls.test.ts#L3" target="_blank" rel="noopener noreferrer"><code>storage-ref-urls.test.ts</code></a> against the served page client's <code>ref()</code>: both pin production's <code>other-bucket</code> beside the sandbox's bucket and the URL's <code>fullPath</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L89" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
+<summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">ref(storage, url).bucket</code><span class="compat-sub"><span class="compat-behavior">Production gives a reference on the URL's bucket, including a bucket other than the app's default. The sandbox's <code>ref()</code> keeps the handle's bucket, at the URL's path; <code>getStorage(app, bucketUrl)</code> reaches another bucket</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe">Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/client-storage-ref-urls.json" target="_blank" rel="noopener noreferrer"><code>client-storage-ref-urls</code></a> (firebase 12.13.0) records <code>gsOtherBucket</code> and <code>firebaseDownloadUrlOtherBucket</code> (<code>bucket: 'other-bucket'</code>) and <code>gsDefaultBucket</code> (<code>bucket: 'b'</code>, the configured bucket). <code>ref()</code> keeps the handle's bucket: a URL naming another bucket reads that path in the handle's bucket. To reach another bucket, an app opens it with <code>getStorage(app, bucketUrl)</code> (storage#11). The storage oracle suite replays it against the engine's <code>ref()</code>, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-ref-urls.test.ts#L3" target="_blank" rel="noopener noreferrer"><code>storage-ref-urls.test.ts</code></a> against the served page client's <code>ref()</code>: both pin production's <code>other-bucket</code> beside the sandbox's bucket and the URL's <code>fullPath</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L89" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">ref(storage, 'data:...')</code><span class="compat-sub"><span class="compat-behavior">Production reads a string without <code>://</code>, such as a <code>data:</code> URI, as an object path. The sandbox throws <code>storage/invalid-url</code> for a <code>data:</code> URI</span></span></span></summary>
@@ -235,7 +235,7 @@ html{scrollbar-gutter:stable}
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">uploadString(ref, value, format?, metadata?)</code><span class="compat-sub"><span class="compat-behavior">Sandbox: <code>format='base64url'</code> (or any unknown format) rejected with <code>storage/invalid-format</code> naming the bad format. Prod: <code>base64url</code> is ACCEPTED (upload succeeds); a genuinely-unrecognized format throws <code>storage/unknown</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">divergence, both halves oracle-locked by <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-uploadstring-unknown-format.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/storage/storage-uploadstring-unknown-format.json</code></a>: prod accepts <code>base64url</code> (<code>base64urlOk: true</code>) and throws <code>storage/unknown</code> for an unrecognized format — not <code>storage/invalid-format</code>. The v1 sandbox ships only <code>raw</code>/<code>base64</code>/<code>data_url</code> (matches <code>StringFormat</code>) and throws <code>storage/invalid-format</code> for anything else (ST-B3 replaced the old mis-parse-as-data_url behavior). Both sides pinned in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L161" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>; sandbox code path documented in <code>upload.ts</code>'s <code>decodeString</code>. Implementing base64url decoding is still one line in <code>decodeString</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/error-codes.test.ts#L25" target="_blank" rel="noopener noreferrer"><code>error-codes.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">divergence, both halves oracle-locked by <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-uploadstring-unknown-format.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/storage/storage-uploadstring-unknown-format.json</code></a>: prod accepts <code>base64url</code> (<code>base64urlOk: true</code>) and throws <code>storage/unknown</code> for an unrecognized format — not <code>storage/invalid-format</code>. The v1 sandbox ships only <code>raw</code>/<code>base64</code>/<code>data_url</code> (matches <code>StringFormat</code>) and throws <code>storage/invalid-format</code> for anything else (ST-B3 replaced the old mis-parse-as-data_url behavior). Both sides pinned in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L197" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>; sandbox code path documented in <code>upload.ts</code>'s <code>decodeString</code>. Implementing base64url decoding is still one line in <code>decodeString</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/error-codes.test.ts#L25" target="_blank" rel="noopener noreferrer"><code>error-codes.test.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">uploadString(ref, value, format?, metadata?)</code><span class="compat-sub"><span class="compat-behavior"><code>format='data_url'</code>: parses <code>data:&#x3C;mime>;base64,&#x3C;payload></code>, infers <code>contentType</code> from prefix</span></span></span></summary>
@@ -255,7 +255,7 @@ html{scrollbar-gutter:stable}
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">uploadString(ref, value, format?, metadata?)</code><span class="compat-sub"><span class="compat-behavior"><code>uploadString(ref, value, 'base64')</code> round-trips via <code>getDownloadURL</code> + fetch across in-page sandbox and SharedWorker mode</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">oracle: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-uploadstring-base64-roundtrip.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/storage/storage-uploadstring-base64-roundtrip.json</code></a> (<code>'aGVsbG8='</code> → <code>'hello'</code> against blockingfun, fb-js-sdk 12.13.0; <code>textMatches: true</code>). Sandbox oracle replay matches production behavior in-page, and client↔host integration proves SharedWorker mode decodes and transfers string payloads faithfully over the worker port. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L220" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/integration.test.ts#L424" target="_blank" rel="noopener noreferrer"><code>integration.test.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">oracle: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-uploadstring-base64-roundtrip.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/storage/storage-uploadstring-base64-roundtrip.json</code></a> (<code>'aGVsbG8='</code> → <code>'hello'</code> against blockingfun, fb-js-sdk 12.13.0; <code>textMatches: true</code>). Sandbox oracle replay matches production behavior in-page, and client↔host integration proves SharedWorker mode decodes and transfers string payloads faithfully over the worker port. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L256" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/integration.test.ts#L424" target="_blank" rel="noopener noreferrer"><code>integration.test.ts</code></a>)</div></div>
 </details>
 </div>
 <h2 id="uploadbytesresumableref-data-metadata--resumable-upload--task-observers"><code>uploadBytesResumable(ref, data, metadata?)</code> — resumable upload + task observers</h2>
@@ -274,14 +274,14 @@ html{scrollbar-gutter:stable}
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">uploadBytesResumable(ref, data, metadata?)</code><span class="compat-sub"><span class="compat-behavior"><code>task.cancel()</code> rejects the upload with <code>storage/canceled</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/resumable-upload.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>unit:resumable-upload.test.ts</code></a> confirms cancellation rejects with <code>storage/canceled</code>. A commit already sent cannot be recalled, so a cancel that races it rolls it back, then rejects and tells observers. Production never stores a canceled upload, so its rules never see the rollback: the commit takes a token bound to the client, the generation it stored, and the object it replaced, and the host, without the rules, puts that object back or deletes the new one in one generation-checked write, keeping any later write (#1157, #1159). <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-upload-rollback.test.ts#L416" target="_blank" rel="noopener noreferrer"><code>storage-upload-rollback.test.ts</code></a> pins the token's binding, the restore, and a cancel under rules that deny every delete; <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-ops.test.ts#L407" target="_blank" rel="noopener noreferrer"><code>storage-ops.test.ts</code></a> pins a commit settling after the cancel and one held while paused. The web byte route fixture in <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/hosted-sqlite.test.ts#L35" target="_blank" rel="noopener noreferrer"><code>hosted-sqlite.test.ts</code></a> and <code>test/apps/client-sdk-under-register</code> cancel under <code>node --import @pyric/cli/register</code> and read no object, or the earlier one after an overwrite; on main (8e1ee9cb4) the object stayed (#1137). A failed rollback rejects with its own code. The in-page task does the same (#1161), and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-cancel-parity.test.ts#L17" target="_blank" rel="noopener noreferrer"><code>storage-cancel-parity.test.ts</code></a> compares the two. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/resumable-cancel-rollback.test.ts#L20" target="_blank" rel="noopener noreferrer"><code>resumable-cancel-rollback.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L14" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/inpage-storage-cancel-rollback/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/resumable-upload.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>unit:resumable-upload.test.ts</code></a> confirms cancellation rejects with <code>storage/canceled</code>. A commit already sent cannot be recalled, so a cancel that races it rolls it back, then rejects and tells observers. Production never stores a canceled upload, so its rules never see the rollback: the commit takes a token bound to the client, the generation it stored, and the object it replaced, and the host, without the rules, puts that object back or deletes the new one in one generation-checked write, keeping any later write (#1157, #1159). <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-upload-rollback.test.ts#L416" target="_blank" rel="noopener noreferrer"><code>storage-upload-rollback.test.ts</code></a> pins the token's binding, the restore, and a cancel under rules that deny every delete; <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-ops.test.ts#L407" target="_blank" rel="noopener noreferrer"><code>storage-ops.test.ts</code></a> pins a commit settling after the cancel and one held while paused. The web byte route fixture in <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/hosted-sqlite.test.ts#L35" target="_blank" rel="noopener noreferrer"><code>hosted-sqlite.test.ts</code></a> and <code>test/apps/client-sdk-under-register</code> cancel under <code>node --import @pyric/cli/register</code> and read no object, or the earlier one after an overwrite; on main (8e1ee9cb4) the object stayed (#1137). A failed rollback rejects with its own code. The in-page task does the same (#1161), and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-cancel-parity.test.ts#L17" target="_blank" rel="noopener noreferrer"><code>storage-cancel-parity.test.ts</code></a> compares the two. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/resumable-cancel-rollback.test.ts#L20" target="_blank" rel="noopener noreferrer"><code>resumable-cancel-rollback.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L21" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/inpage-storage-cancel-rollback/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div>
 </details>
 </div>
 <h2 id="getdownloadurlref--read-url"><code>getDownloadURL(ref)</code> — read URL</h2>
 <div class="compat-list">
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getDownloadURL(ref)</code><span class="compat-sub"><span class="compat-behavior">Exported by <code>firebase/storage</code>; returns a token-signed HTTPS URL that fetches the blob</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-upload-bytes-roundtrip.json" target="_blank" rel="noopener noreferrer"><code>storage-upload-bytes-roundtrip</code></a> records <code>urlIsHttps: true</code> and a byte-identical fetch. The URL form depends on where the sandbox runs. On the Node host, <code>getDownloadURL</code> returns <code>http://&#x3C;host>/__pyric/storage/v0/b/&#x3C;bucket>/o/&#x3C;path>?alt=media&#x26;token=&#x3C;token></code>: production's <code>/v0/b/&#x3C;bucket>/o/&#x3C;path></code> path and <code>alt=media</code> query, under the host's own origin. The token is kept in the object's <code>downloadTokens</code> metadata, later calls return the same URL, it does not expire, and removing it from the metadata revokes the URL. A <code>GET</code> on the URL needs no header and serves <code>Range</code>. The hosted replay of the observation calls <code>getDownloadURL</code> and <code>fetch</code> through the web client against the host and its byte route, and matches <code>downloadOk</code>, <code>bodyLen</code>, and <code>bytesMatch</code>. The web byte route fixture pins token persistence and revocation, and hosted smoke test 8 streams and seeks an <code>&#x3C;audio></code> element by the URL in Chromium. In process and in a SharedWorker there is no HTTP origin to serve from, so <code>getDownloadURL</code> returns a <code>data:&#x3C;contentType>;base64,...</code> URI that carries the object's bytes. The oracle replay proves its byte-identical fetch and asserts the <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L202" target="_blank" rel="noopener noreferrer"><code>data:</code></a> prefix, and the client↔host integration proves SharedWorker mode returns the same form. The divergence is URL identity. The hosted URL is <code>http</code> on the local host's origin, under <code>/__pyric/storage</code>, where production's is <code>https</code> on Google Cloud Storage's host, so it is fetchable only where that host is reachable. The <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/integration.test.ts#L409" target="_blank" rel="noopener noreferrer"><code>data:</code></a> form has no token, no revocation, and no stable short string. Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-admin/admin-storage-metadata-download-url.json" target="_blank" rel="noopener noreferrer"><code>admin-storage-metadata-download-url</code></a> records the token itself: the Firebase metadata endpoint reports it as <code>downloadTokens</code>, firebase-admin sees it as the <code>firebaseStorageDownloadTokens</code> custom key, removing it makes the URL answer 403, and the URL answers <code>Range</code> with 206. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/hosted-sqlite.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>hosted-sqlite.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/e2e/hosted/smoke.pw.ts#L20" target="_blank" rel="noopener noreferrer"><code>smoke.pw.ts</code></a>)</div></div>
+<div class="compat-evidence"><div class="compat-probe">Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-upload-bytes-roundtrip.json" target="_blank" rel="noopener noreferrer"><code>storage-upload-bytes-roundtrip</code></a> records <code>urlIsHttps: true</code> and a byte-identical fetch. The URL form depends on where the sandbox runs. On the Node host, <code>getDownloadURL</code> returns <code>http://&#x3C;host>/__pyric/storage/v0/b/&#x3C;bucket>/o/&#x3C;path>?alt=media&#x26;token=&#x3C;token></code>: production's <code>/v0/b/&#x3C;bucket>/o/&#x3C;path></code> path and <code>alt=media</code> query, under the host's own origin. The token is kept in the object's <code>downloadTokens</code> metadata, later calls return the same URL, it does not expire, and removing it from the metadata revokes the URL. A <code>GET</code> on the URL needs no header and serves <code>Range</code>. The hosted replay of the observation calls <code>getDownloadURL</code> and <code>fetch</code> through the web client against the host and its byte route, and matches <code>downloadOk</code>, <code>bodyLen</code>, and <code>bytesMatch</code>. The web byte route fixture pins token persistence and revocation, and hosted smoke test 8 streams and seeks an <code>&#x3C;audio></code> element by the URL in Chromium. In process and in a SharedWorker there is no HTTP origin to serve from, so <code>getDownloadURL</code> returns a <code>data:&#x3C;contentType>;base64,...</code> URI that carries the object's bytes. The oracle replay proves its byte-identical fetch and asserts the <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L238" target="_blank" rel="noopener noreferrer"><code>data:</code></a> prefix, and the client↔host integration proves SharedWorker mode returns the same form. The divergence is URL identity. The hosted URL is <code>http</code> on the local host's origin, under <code>/__pyric/storage</code>, where production's is <code>https</code> on Google Cloud Storage's host, so it is fetchable only where that host is reachable. The <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/integration.test.ts#L409" target="_blank" rel="noopener noreferrer"><code>data:</code></a> form has no token, no revocation, and no stable short string. Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-admin/admin-storage-metadata-download-url.json" target="_blank" rel="noopener noreferrer"><code>admin-storage-metadata-download-url</code></a> records the token itself: the Firebase metadata endpoint reports it as <code>downloadTokens</code>, firebase-admin sees it as the <code>firebaseStorageDownloadTokens</code> custom key, removing it makes the URL answer 403, and the URL answers <code>Range</code> with 206. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/hosted-sqlite.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>hosted-sqlite.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/e2e/hosted/smoke.pw.ts#L20" target="_blank" rel="noopener noreferrer"><code>smoke.pw.ts</code></a>)</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">getDownloadURL(ref)</code><span class="compat-sub"><span class="compat-behavior">Throws <code>storage/object-not-found</code> for missing objects</span></span></span></summary>
@@ -469,7 +469,7 @@ html{scrollbar-gutter:stable}
 </details>
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getMetadata(ref)<code> / </code>updateMetadata(ref, metadata)</code><span class="compat-sub"><span class="compat-behavior"><code>FullMetadata.md5Hash</code> populated on uploads</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">divergence: sandbox does NOT compute <code>md5Hash</code>. Oracle-locked: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-upload-then-getmetadata.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/storage/storage-upload-then-getmetadata.json</code></a> confirms prod sets <code>md5Hash</code> (<code>hasMd5Hash: true</code> after a vanilla <code>uploadBytes</code>). Both sides pinned in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L231" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>. Aligning the sandbox is a one-spot fix in <code>upload.ts</code>'s <code>buildStoredMetadata</code>.</div></div>
+<div class="compat-evidence"><div class="compat-probe">divergence: sandbox does NOT compute <code>md5Hash</code>. Oracle-locked: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-upload-then-getmetadata.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/storage/storage-upload-then-getmetadata.json</code></a> confirms prod sets <code>md5Hash</code> (<code>hasMd5Hash: true</code> after a vanilla <code>uploadBytes</code>). Both sides pinned in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L267" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>. Aligning the sandbox is a one-spot fix in <code>upload.ts</code>'s <code>buildStoredMetadata</code>.</div></div>
 </details>
 <details class="compat-row" data-status="unsupported">
 <summary class="compat-line"><span class="compat-dot" data-status="unsupported" role="img" aria-label="Not implemented yet" title="Not implemented yet"></span><span class="compat-main"><code class="compat-api">getMetadata(ref)<code> / </code>updateMetadata(ref, metadata)</code><span class="compat-sub"><span class="compat-behavior"><code>FullMetadata.ref</code> lazy population (prod populates lazily)</span></span></span></summary>
@@ -491,7 +491,7 @@ API) moved to the native <code>storage-rules</code> surface (<code>docs/rules/CO
 <div class="compat-list">
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules enforcement</code><span class="compat-sub"><span class="compat-behavior">Op-level enforcement: <code>uploadBytes</code> against a denied path throws <code>storage/unauthorized</code> on sandbox / <code>storage/unauthorized</code> on prod, <code>.code</code> exposed on both</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">ST-B1 fixed: sandbox now throws a <code>StorageError</code> (see <code>src/storage/errors.ts</code>) whose <code>.code === 'storage/unauthorized'</code> — matching prod's <code>FirebaseError.code</code>. Probe: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/error-codes.test.ts#L15" target="_blank" rel="noopener noreferrer"><code>unit:error-codes.test.ts</code></a> ("unauthorized when rules deny the operation"). Residual divergence (documented, not a <code>.code</code> gap): the sandbox <code>StorageError.name</code> is <code>'StorageError'</code> (plain <code>Error</code> subclass, same shape as Firestore's <code>SandboxError</code>) where prod reports <code>name: 'FirebaseError'</code> / <code>isFirebaseError: true</code>, and the message wording differs (sandbox embeds the matched-rule reason chain). Oracle-locked: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-rules-denied-error-code.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/storage/storage-rules-denied-error-code.json</code></a> (against blockingfun, fb-js-sdk 12.13.0: <code>code: 'storage/unauthorized'</code>, message <code>"Firebase Storage: User does not have permission to access '&#x3C;path>'."</code>, <code>name: 'FirebaseError'</code>, <code>isFirebaseError: true</code>).</div></div>
+<div class="compat-evidence"><div class="compat-probe">ST-B1 fixed: sandbox now throws a <code>StorageError</code> (see <code>src/storage/errors.ts</code>) whose <code>.code === 'storage/unauthorized'</code> — matching prod's <code>FirebaseError.code</code>. Probe: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/error-codes.test.ts#L15" target="_blank" rel="noopener noreferrer"><code>unit:error-codes.test.ts</code></a> ("unauthorized when rules deny the operation"). Residual divergence (documented, not a <code>.code</code> gap): the sandbox <code>StorageError.name</code> is <code>'StorageError'</code> (plain <code>Error</code> subclass, same shape as Firestore's <code>SandboxError</code>) where prod reports <code>name: 'FirebaseError'</code> / <code>isFirebaseError: true</code>, and the message wording differs (sandbox embeds the matched-rule reason chain). Oracle-locked: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-rules-denied-error-code.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/storage/storage-rules-denied-error-code.json</code></a> (against blockingfun, fb-js-sdk 12.13.0: <code>code: 'storage/unauthorized'</code>, message <code>"Firebase Storage: User does not have permission to access '&#x3C;path>'."</code>, <code>name: 'FirebaseError'</code>, <code>isFirebaseError: true</code>). Extended 2026-10-27: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-rules-denied-signed-out-error-code.json" target="_blank" rel="noopener noreferrer"><code>storage-rules-denied-signed-out-error-code</code></a> (digame-mas, fb-js-sdk 12.13.0) records that with no signed-in user an upload under <code>allow read, write: if request.auth != null</code> and one outside any grant both throw <code>storage/unauthorized</code> with HTTP 403, never <code>storage/unauthenticated</code>; the sandbox gives the same code, pinned by <code>unit:storage/oracle-conformance.test.ts</code>.</div></div>
 </details>
 <details class="compat-row" data-status="ok">
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">Rules enforcement</code><span class="compat-sub"><span class="compat-behavior"><code>getMetadata</code> against a denied path throws <code>storage/unauthorized</code></span></span></span></summary>
@@ -564,7 +564,7 @@ API) moved to the native <code>storage-rules</code> surface (<code>docs/rules/CO
 <div class="compat-list">
 <details class="compat-row" data-status="diverged">
 <summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getStorage(app) in a registered server process</code><span class="compat-sub"><span class="compat-behavior">Under a remote register activation on the Node host, <code>firebase/storage</code> in a server process uploads and reads the host's objects under its rules, over the host's byte route. An upload issued before the process's connection has attached waits for the attachment, keeps its place in the call order, and never sends its bytes as frames to a host that takes them only over the route; it fails as a held call does if the connection is not restored within 10 seconds. A finished upload does not keep the process up. When the host is not the Node host, every call fails with <code>failed-precondition</code> and a message naming the Node host (<code>pyric sandbox --hosted</code> or <code>pyric({ hosted: true })</code>); when no host is found, with the discovery error <code>pyric-admin</code> gets. No call falls back to an in-process sandbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-probe">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts an upload issued as the process's first call that firebase-admin downloads, its HTTP download URL, and that a finished upload does not hold the process. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-byte-route-settled.test.ts#L11" target="_blank" rel="noopener noreferrer"><code>storage-byte-route-settled.test.ts</code></a> pins the wait, the call order and the deadline. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L80" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L596" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div>
+<div class="compat-evidence"><div class="compat-probe">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts an upload issued as the process's first call that firebase-admin downloads, its HTTP download URL, and that a finished upload does not hold the process. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-byte-route-settled.test.ts#L11" target="_blank" rel="noopener noreferrer"><code>storage-byte-route-settled.test.ts</code></a> pins the wait, the call order and the deadline. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L78" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L665" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div>
 <div class="compat-note">a resumable upload issued before the connection attaches reports its progress in one step on a byte-route host</div></div>
 </details>
 </div>
@@ -581,16 +581,16 @@ API) moved to the native <code>storage-rules</code> surface (<code>docs/rules/CO
 <h3 id="documented-divergences">Documented divergences</h3>
 <p>Known differences between Pyric and production Firebase. Each remains tracked as a non-conforming row.</p>
 <div class="compat-list">
-<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getStorage(app, bucketUrl?)` / `getStorageSandbox(target, options?)</code><span class="compat-sub"><span class="compat-behavior"><code>getStorage(app, bucketUrl?)</code> accepts Firebase's bucket argument; the sandbox remains bound to its configured single bucket</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">Package resolution owns production selection. The sandbox accepts the canonical argument but does not model production multi-bucket routing; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/service.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>unit:service.test.ts</code></a> pins the configured <code>pyric-default</code> bucket.</div></div></details>
+<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getStorage(app, bucketUrl?)` / `getStorageSandbox(target, options?)</code><span class="compat-sub"><span class="compat-behavior"><code>getStorage(app, bucketUrl?)</code> opens the bucket the URL names, with its own objects and the rules deployed to it; the app's default bucket is stored under the key <code>pyric-default</code></span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">Package resolution owns production selection. <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/service.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>unit:service.test.ts</code></a> pins a bucket URL other than the app's <code>storageBucket</code> opening its own bucket, and the default bucket's store key <code>pyric-default</code>; <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/per-bucket-rules.test.ts#L11" target="_blank" rel="noopener noreferrer"><code>unit:storage/per-bucket-rules.test.ts</code></a> pins each bucket's objects and rules apart. The in-page plane still reports the default bucket as <code>pyric-default</code> in metadata and references (#1519).</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">ref(storage, '&#x3C;origin>/__pyric/storage/v0/b/&#x3C;bucket>/o/&#x3C;path>')</code><span class="compat-sub"><span class="compat-behavior">Production throws <code>storage/invalid-url</code> for a URL on the Node host's <code>/__pyric/storage/v0/</code> route, as for any host it does not serve from. The sandbox reads the percent-decoded object path from <code>&#x3C;origin>/__pyric/storage/v0/b/&#x3C;bucket>/o/&#x3C;path></code> on any origin, as production does from its own download URL</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/client-storage-ref-urls.json" target="_blank" rel="noopener noreferrer"><code>client-storage-ref-urls</code></a> (firebase 12.13.0) records <code>pyricHostUrl</code> (<code>storage/invalid-url</code>). The Node host's <code>getDownloadURL</code> issues this form, so an app that keeps a download URL and later calls <code>deleteObject(ref(storage, url))</code> needs <code>ref()</code> to read it. The storage oracle suite replays it against the engine's <code>ref()</code>, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-ref-urls.test.ts#L3" target="_blank" rel="noopener noreferrer"><code>storage-ref-urls.test.ts</code></a> against the served page client's <code>ref()</code>: both pin production's code beside the sandbox's reference, whose <code>fullPath</code> and <code>name</code> equal those production gives for <code>firebaseDownloadUrl</code>. The web byte route fixture in <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/hosted-sqlite.test.ts#L13" target="_blank" rel="noopener noreferrer"><code>hosted-sqlite.test.ts</code></a> keeps a download URL from the Node host and deletes the object by <code>ref(storage, url)</code>, and hosted smoke test 9 does the same from a Chromium page against the built CLI's Node host. Production never issues this URL, so no production app depends on the error. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L89" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
-<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">ref(storage, url).bucket</code><span class="compat-sub"><span class="compat-behavior">Production gives a reference on the URL's bucket, including a bucket other than the app's default. The sandbox serves one bucket, so the reference is on that bucket, at the URL's path</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/client-storage-ref-urls.json" target="_blank" rel="noopener noreferrer"><code>client-storage-ref-urls</code></a> (firebase 12.13.0) records <code>gsOtherBucket</code> and <code>firebaseDownloadUrlOtherBucket</code> (<code>bucket: 'other-bucket'</code>) and <code>gsDefaultBucket</code> (<code>bucket: 'b'</code>, the configured bucket). The sandbox serves one bucket, as <code>getStorage(app, bucketUrl?)</code> does (storage#11): an object an app wrote through another bucket's handle is in that one bucket, so a URL naming another bucket reads it there. The storage oracle suite replays it against the engine's <code>ref()</code>, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-ref-urls.test.ts#L3" target="_blank" rel="noopener noreferrer"><code>storage-ref-urls.test.ts</code></a> against the served page client's <code>ref()</code>: both pin production's <code>other-bucket</code> beside the sandbox's bucket and the URL's <code>fullPath</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L89" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
+<details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">ref(storage, url).bucket</code><span class="compat-sub"><span class="compat-behavior">Production gives a reference on the URL's bucket, including a bucket other than the app's default. The sandbox's <code>ref()</code> keeps the handle's bucket, at the URL's path; <code>getStorage(app, bucketUrl)</code> reaches another bucket</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-note">Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/client-storage-ref-urls.json" target="_blank" rel="noopener noreferrer"><code>client-storage-ref-urls</code></a> (firebase 12.13.0) records <code>gsOtherBucket</code> and <code>firebaseDownloadUrlOtherBucket</code> (<code>bucket: 'other-bucket'</code>) and <code>gsDefaultBucket</code> (<code>bucket: 'b'</code>, the configured bucket). <code>ref()</code> keeps the handle's bucket: a URL naming another bucket reads that path in the handle's bucket. To reach another bucket, an app opens it with <code>getStorage(app, bucketUrl)</code> (storage#11). The storage oracle suite replays it against the engine's <code>ref()</code>, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-ref-urls.test.ts#L3" target="_blank" rel="noopener noreferrer"><code>storage-ref-urls.test.ts</code></a> against the served page client's <code>ref()</code>: both pin production's <code>other-bucket</code> beside the sandbox's bucket and the URL's <code>fullPath</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L89" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">ref(storage, 'data:...')</code><span class="compat-sub"><span class="compat-behavior">Production reads a string without <code>://</code>, such as a <code>data:</code> URI, as an object path. The sandbox throws <code>storage/invalid-url</code> for a <code>data:</code> URI</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/client-storage-ref-urls.json" target="_blank" rel="noopener noreferrer"><code>client-storage-ref-urls</code></a> (firebase 12.13.0) records <code>dataUri</code> (<code>fullPath: 'data:audio/wav;base64,UklGRg=='</code>, <code>name: 'wav;base64,UklGRg=='</code>). In process and on a SharedWorker host, <code>getDownloadURL</code> returns a <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L89" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URI (storage#51), and no object exists at that literal path, so reading it as a path would make <code>deleteObject(ref(storage, url))</code> resolve and delete nothing. The storage oracle suite replays it against the engine's <code>ref()</code>, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-ref-urls.test.ts#L3" target="_blank" rel="noopener noreferrer"><code>storage-ref-urls.test.ts</code></a> against the served page client's <code>ref()</code>: both pin production's path beside the sandbox's <code>storage/invalid-url</code>, and the storage oracle suite shows a reference to a <code>data:</code> download URL throws while the object stays.</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">uploadString(ref, value, format?, metadata?)</code><span class="compat-sub"><span class="compat-behavior">Sandbox: <code>format='base64url'</code> (or any unknown format) rejected with <code>storage/invalid-format</code> naming the bad format. Prod: <code>base64url</code> is ACCEPTED (upload succeeds); a genuinely-unrecognized format throws <code>storage/unknown</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">divergence, both halves oracle-locked by <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-uploadstring-unknown-format.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/storage/storage-uploadstring-unknown-format.json</code></a>: prod accepts <code>base64url</code> (<code>base64urlOk: true</code>) and throws <code>storage/unknown</code> for an unrecognized format — not <code>storage/invalid-format</code>. The v1 sandbox ships only <code>raw</code>/<code>base64</code>/<code>data_url</code> (matches <code>StringFormat</code>) and throws <code>storage/invalid-format</code> for anything else (ST-B3 replaced the old mis-parse-as-data_url behavior). Both sides pinned in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L161" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>; sandbox code path documented in <code>upload.ts</code>'s <code>decodeString</code>. Implementing base64url decoding is still one line in <code>decodeString</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/error-codes.test.ts#L25" target="_blank" rel="noopener noreferrer"><code>error-codes.test.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">divergence, both halves oracle-locked by <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-uploadstring-unknown-format.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/storage/storage-uploadstring-unknown-format.json</code></a>: prod accepts <code>base64url</code> (<code>base64urlOk: true</code>) and throws <code>storage/unknown</code> for an unrecognized format — not <code>storage/invalid-format</code>. The v1 sandbox ships only <code>raw</code>/<code>base64</code>/<code>data_url</code> (matches <code>StringFormat</code>) and throws <code>storage/invalid-format</code> for anything else (ST-B3 replaced the old mis-parse-as-data_url behavior). Both sides pinned in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L197" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>; sandbox code path documented in <code>upload.ts</code>'s <code>decodeString</code>. Implementing base64url decoding is still one line in <code>decodeString</code>. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/error-codes.test.ts#L25" target="_blank" rel="noopener noreferrer"><code>error-codes.test.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">uploadBytesResumable(ref, data, metadata?)</code><span class="compat-sub"><span class="compat-behavior">Exported by <code>firebase/storage</code>; returns an <code>UploadTask</code> with <code>pause()</code> / <code>resume()</code> / <code>cancel()</code></span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/resumable-upload.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>unit:resumable-upload.test.ts</code></a> confirms <code>uploadBytesResumable(ref, data)</code> returns an <code>UploadTask</code> supporting <code>pause()</code>, <code>resume()</code>, and <code>cancel()</code> over synthetic microtask steps.</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">uploadBytesResumable(ref, data, metadata?)</code><span class="compat-sub"><span class="compat-behavior"><code>task.on('state_changed', next, error, complete)</code> fires <code>next</code> with <code>{bytesTransferred, totalBytes, state}</code> snapshots</span></span></span></summary>
@@ -598,15 +598,15 @@ API) moved to the native <code>storage-rules</code> surface (<code>docs/rules/CO
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">uploadBytesResumable(ref, data, metadata?)</code><span class="compat-sub"><span class="compat-behavior"><code>task.pause()</code> flips <code>state</code> to <code>'paused'</code>; <code>task.resume()</code> continues</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/resumable-upload.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>unit:resumable-upload.test.ts</code></a> confirms calling <code>task.pause()</code> and <code>task.resume()</code> transitions through <code>'paused'</code> and <code>'running'</code> states deterministically.</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">uploadBytesResumable(ref, data, metadata?)</code><span class="compat-sub"><span class="compat-behavior"><code>task.cancel()</code> rejects the upload with <code>storage/canceled</code></span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/resumable-upload.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>unit:resumable-upload.test.ts</code></a> confirms cancellation rejects with <code>storage/canceled</code>. A commit already sent cannot be recalled, so a cancel that races it rolls it back, then rejects and tells observers. Production never stores a canceled upload, so its rules never see the rollback: the commit takes a token bound to the client, the generation it stored, and the object it replaced, and the host, without the rules, puts that object back or deletes the new one in one generation-checked write, keeping any later write (#1157, #1159). <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-upload-rollback.test.ts#L416" target="_blank" rel="noopener noreferrer"><code>storage-upload-rollback.test.ts</code></a> pins the token's binding, the restore, and a cancel under rules that deny every delete; <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-ops.test.ts#L407" target="_blank" rel="noopener noreferrer"><code>storage-ops.test.ts</code></a> pins a commit settling after the cancel and one held while paused. The web byte route fixture in <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/hosted-sqlite.test.ts#L35" target="_blank" rel="noopener noreferrer"><code>hosted-sqlite.test.ts</code></a> and <code>test/apps/client-sdk-under-register</code> cancel under <code>node --import @pyric/cli/register</code> and read no object, or the earlier one after an overwrite; on main (8e1ee9cb4) the object stayed (#1137). A failed rollback rejects with its own code. The in-page task does the same (#1161), and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-cancel-parity.test.ts#L17" target="_blank" rel="noopener noreferrer"><code>storage-cancel-parity.test.ts</code></a> compares the two. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/resumable-cancel-rollback.test.ts#L20" target="_blank" rel="noopener noreferrer"><code>resumable-cancel-rollback.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L14" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/inpage-storage-cancel-rollback/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note"><a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/resumable-upload.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>unit:resumable-upload.test.ts</code></a> confirms cancellation rejects with <code>storage/canceled</code>. A commit already sent cannot be recalled, so a cancel that races it rolls it back, then rejects and tells observers. Production never stores a canceled upload, so its rules never see the rollback: the commit takes a token bound to the client, the generation it stored, and the object it replaced, and the host, without the rules, puts that object back or deletes the new one in one generation-checked write, keeping any later write (#1157, #1159). <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-upload-rollback.test.ts#L416" target="_blank" rel="noopener noreferrer"><code>storage-upload-rollback.test.ts</code></a> pins the token's binding, the restore, and a cancel under rules that deny every delete; <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-ops.test.ts#L407" target="_blank" rel="noopener noreferrer"><code>storage-ops.test.ts</code></a> pins a commit settling after the cancel and one held while paused. The web byte route fixture in <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/hosted-sqlite.test.ts#L35" target="_blank" rel="noopener noreferrer"><code>hosted-sqlite.test.ts</code></a> and <code>test/apps/client-sdk-under-register</code> cancel under <code>node --import @pyric/cli/register</code> and read no object, or the earlier one after an overwrite; on main (8e1ee9cb4) the object stayed (#1137). A failed rollback rejects with its own code. The in-page task does the same (#1161), and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-cancel-parity.test.ts#L17" target="_blank" rel="noopener noreferrer"><code>storage-cancel-parity.test.ts</code></a> compares the two. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/resumable-cancel-rollback.test.ts#L20" target="_blank" rel="noopener noreferrer"><code>resumable-cancel-rollback.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L21" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/test/apps/inpage-storage-cancel-rollback/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getDownloadURL(ref)</code><span class="compat-sub"><span class="compat-behavior">Exported by <code>firebase/storage</code>; returns a token-signed HTTPS URL that fetches the blob</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-upload-bytes-roundtrip.json" target="_blank" rel="noopener noreferrer"><code>storage-upload-bytes-roundtrip</code></a> records <code>urlIsHttps: true</code> and a byte-identical fetch. The URL form depends on where the sandbox runs. On the Node host, <code>getDownloadURL</code> returns <code>http://&#x3C;host>/__pyric/storage/v0/b/&#x3C;bucket>/o/&#x3C;path>?alt=media&#x26;token=&#x3C;token></code>: production's <code>/v0/b/&#x3C;bucket>/o/&#x3C;path></code> path and <code>alt=media</code> query, under the host's own origin. The token is kept in the object's <code>downloadTokens</code> metadata, later calls return the same URL, it does not expire, and removing it from the metadata revokes the URL. A <code>GET</code> on the URL needs no header and serves <code>Range</code>. The hosted replay of the observation calls <code>getDownloadURL</code> and <code>fetch</code> through the web client against the host and its byte route, and matches <code>downloadOk</code>, <code>bodyLen</code>, and <code>bytesMatch</code>. The web byte route fixture pins token persistence and revocation, and hosted smoke test 8 streams and seeks an <code>&#x3C;audio></code> element by the URL in Chromium. In process and in a SharedWorker there is no HTTP origin to serve from, so <code>getDownloadURL</code> returns a <code>data:&#x3C;contentType>;base64,...</code> URI that carries the object's bytes. The oracle replay proves its byte-identical fetch and asserts the <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L202" target="_blank" rel="noopener noreferrer"><code>data:</code></a> prefix, and the client↔host integration proves SharedWorker mode returns the same form. The divergence is URL identity. The hosted URL is <code>http</code> on the local host's origin, under <code>/__pyric/storage</code>, where production's is <code>https</code> on Google Cloud Storage's host, so it is fetchable only where that host is reachable. The <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/integration.test.ts#L409" target="_blank" rel="noopener noreferrer"><code>data:</code></a> form has no token, no revocation, and no stable short string. Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-admin/admin-storage-metadata-download-url.json" target="_blank" rel="noopener noreferrer"><code>admin-storage-metadata-download-url</code></a> records the token itself: the Firebase metadata endpoint reports it as <code>downloadTokens</code>, firebase-admin sees it as the <code>firebaseStorageDownloadTokens</code> custom key, removing it makes the URL answer 403, and the URL answers <code>Range</code> with 206. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/hosted-sqlite.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>hosted-sqlite.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/e2e/hosted/smoke.pw.ts#L20" target="_blank" rel="noopener noreferrer"><code>smoke.pw.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-upload-bytes-roundtrip.json" target="_blank" rel="noopener noreferrer"><code>storage-upload-bytes-roundtrip</code></a> records <code>urlIsHttps: true</code> and a byte-identical fetch. The URL form depends on where the sandbox runs. On the Node host, <code>getDownloadURL</code> returns <code>http://&#x3C;host>/__pyric/storage/v0/b/&#x3C;bucket>/o/&#x3C;path>?alt=media&#x26;token=&#x3C;token></code>: production's <code>/v0/b/&#x3C;bucket>/o/&#x3C;path></code> path and <code>alt=media</code> query, under the host's own origin. The token is kept in the object's <code>downloadTokens</code> metadata, later calls return the same URL, it does not expire, and removing it from the metadata revokes the URL. A <code>GET</code> on the URL needs no header and serves <code>Range</code>. The hosted replay of the observation calls <code>getDownloadURL</code> and <code>fetch</code> through the web client against the host and its byte route, and matches <code>downloadOk</code>, <code>bodyLen</code>, and <code>bytesMatch</code>. The web byte route fixture pins token persistence and revocation, and hosted smoke test 8 streams and seeks an <code>&#x3C;audio></code> element by the URL in Chromium. In process and in a SharedWorker there is no HTTP origin to serve from, so <code>getDownloadURL</code> returns a <code>data:&#x3C;contentType>;base64,...</code> URI that carries the object's bytes. The oracle replay proves its byte-identical fetch and asserts the <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L238" target="_blank" rel="noopener noreferrer"><code>data:</code></a> prefix, and the client↔host integration proves SharedWorker mode returns the same form. The divergence is URL identity. The hosted URL is <code>http</code> on the local host's origin, under <code>/__pyric/storage</code>, where production's is <code>https</code> on Google Cloud Storage's host, so it is fetchable only where that host is reachable. The <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/integration.test.ts#L409" target="_blank" rel="noopener noreferrer"><code>data:</code></a> form has no token, no revocation, and no stable short string. Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-admin/admin-storage-metadata-download-url.json" target="_blank" rel="noopener noreferrer"><code>admin-storage-metadata-download-url</code></a> records the token itself: the Firebase metadata endpoint reports it as <code>downloadTokens</code>, firebase-admin sees it as the <code>firebaseStorageDownloadTokens</code> custom key, removing it makes the URL answer 403, and the URL answers <code>Range</code> with 206. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/hosted-sqlite.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>hosted-sqlite.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/e2e/hosted/smoke.pw.ts#L20" target="_blank" rel="noopener noreferrer"><code>smoke.pw.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">deleteObject(ref)</code><span class="compat-sub"><span class="compat-behavior">Sandbox: no-op on missing path (does NOT throw)</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">divergence: sandbox is no-op via <code>persistence.ts</code>'s <code>delete</code>. Prod's <code>deleteObject</code> on a missing path throws <code>storage/object-not-found</code>. Oracle-locked: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-delete-missing-throws.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/storage/storage-delete-missing-throws.json</code></a> (<code>code: 'storage/object-not-found'</code>, <code>name: 'FirebaseError'</code> against blockingfun, fb-js-sdk 12.13.0). Both sides pinned in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L123" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>; documented in <code>download.ts</code>.</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getMetadata(ref)` / `updateMetadata(ref, metadata)</code><span class="compat-sub"><span class="compat-behavior"><code>updateMetadata</code> with <code>undefined</code> field values preserves the prior value (does NOT clear it)</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">divergence: prod accepts <code>null</code> to explicitly clear a field. Sandbox doesn't model <code>null</code>-clear (per <code>metadata.ts</code> doc comment). Documented; not probe-locked.</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getMetadata(ref)` / `updateMetadata(ref, metadata)</code><span class="compat-sub"><span class="compat-behavior"><code>FullMetadata.md5Hash</code> populated on uploads</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">divergence: sandbox does NOT compute <code>md5Hash</code>. Oracle-locked: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-upload-then-getmetadata.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/storage/storage-upload-then-getmetadata.json</code></a> confirms prod sets <code>md5Hash</code> (<code>hasMd5Hash: true</code> after a vanilla <code>uploadBytes</code>). Both sides pinned in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L231" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>. Aligning the sandbox is a one-spot fix in <code>upload.ts</code>'s <code>buildStoredMetadata</code>.</div></div></details>
+<div class="compat-evidence"><div class="compat-note">divergence: sandbox does NOT compute <code>md5Hash</code>. Oracle-locked: <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage/storage-upload-then-getmetadata.json" target="_blank" rel="noopener noreferrer"><code>packages/conformance/observations/storage/storage-upload-then-getmetadata.json</code></a> confirms prod sets <code>md5Hash</code> (<code>hasMd5Hash: true</code> after a vanilla <code>uploadBytes</code>). Both sides pinned in <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/storage/oracle-conformance.test.ts#L267" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>. Aligning the sandbox is a one-spot fix in <code>upload.ts</code>'s <code>buildStoredMetadata</code>.</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getDownloadURL(file)</code><span class="compat-sub"><span class="compat-behavior">Returns <code>https://firebasestorage.googleapis.com/v0/b/&#x3C;bucket>/o/&#x3C;encoded path>?alt=media&#x26;token=&#x3C;token></code>, whose token is the file's <code>firebaseStorageDownloadTokens</code> custom metadata. The Firebase metadata endpoint, which client SDKs read, reports the same token as <code>downloadTokens</code> and leaves it out of <code>metadata</code></span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Production observation <a href="https://github.com/davideast/pyric/blob/main/packages/conformance/observations/storage-admin/admin-storage-metadata-download-url.json" target="_blank" rel="noopener noreferrer"><code>admin-storage-metadata-download-url</code></a> records <code>https://firebasestorage.googleapis.com/v0/b/&#x3C;bucket>/o/&#x3C;encoded path>?alt=media&#x26;token=&#x3C;token></code>, the token equal to <code>firebaseStorageDownloadTokens</code>, and the Firebase metadata endpoint reporting it as <code>downloadTokens</code> outside <code>metadata</code>. On the Node host the hosted replay matches the path after the <code>/__pyric/storage</code> prefix, <code>alt=media</code>, the query keys, the token, and the client view's <code>downloadTokens</code>; the origin is the host's own <code>http</code> origin. In process and on a SharedWorker host there is no HTTP origin, so the URL is a <code>data:&#x3C;contentType>;base64,...</code> URI that carries the bytes; the pyric-admin conformance suite pins it beside the production form. It diverges because only the Node host serves bytes over HTTP. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric-admin/test/storage/oracle-conformance.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>oracle-conformance.test.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/hosted-sqlite.test.ts#L75" target="_blank" rel="noopener noreferrer"><code>hosted-sqlite.test.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">file.setMetadata({ metadata: { firebaseStorageDownloadTokens: null } })</code><span class="compat-sub"><span class="compat-behavior">Removing <code>firebaseStorageDownloadTokens</code> revokes the download URL: a <code>GET</code> of it answers 403, and the next <code>getDownloadURL</code> mints a new token whose URL answers 200</span></span></span></summary>
@@ -616,7 +616,7 @@ API) moved to the native <code>storage-rules</code> surface (<code>docs/rules/CO
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">Operations in flight at a hosted connection drop (web hosted client)</code><span class="compat-sub"><span class="compat-behavior">A Storage operation (<code>getMetadata</code>, <code>deleteObject</code>, <code>list</code>, or an upload step) the web hosted client's socket had taken when it dropped fails once with <code>unavailable</code> and the message "The hosted sandbox connection was lost. Requests already sent may have completed; check state before retrying." It is not sent again. In production the Storage Web SDK retries a request that fails on the network with exponential backoff, for up to 2 minutes for an operation and 10 minutes for an upload, and then fails it with <code>storage/retry-limit-exceeded</code>.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">Production behavior read from <code>@firebase/storage</code> 0.14.3 <code>dist/index.esm.js</code>: <code>DEFAULT_MAX_OPERATION_RETRY_TIME</code> (2 minutes), <code>DEFAULT_MAX_UPLOAD_RETRY_TIME</code> (10 minutes), and <code>retryLimitExceeded()</code> in the request retry loop. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/hosted-reconnect-hold.test.ts#L412" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/serve/worker/hosted-reconnect-hold.test.ts</code></a> drops a real loopback socket with <code>storage.getMetadata</code> and <code>storage.deleteObject</code> in flight and asserts each fails once with that message and reaches the host once.</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getStorage(app) in a registered server process</code><span class="compat-sub"><span class="compat-behavior">Under a remote register activation on the Node host, <code>firebase/storage</code> in a server process uploads and reads the host's objects under its rules, over the host's byte route. An upload issued before the process's connection has attached waits for the attachment, keeps its place in the call order, and never sends its bytes as frames to a host that takes them only over the route; it fails as a held call does if the connection is not restored within 10 seconds. A finished upload does not keep the process up. When the host is not the Node host, every call fails with <code>failed-precondition</code> and a message naming the Node host (<code>pyric sandbox --hosted</code> or <code>pyric({ hosted: true })</code>); when no host is found, with the discovery error <code>pyric-admin</code> gets. No call falls back to an in-process sandbox.</span></span></span></summary>
-<div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts an upload issued as the process's first call that firebase-admin downloads, its HTTP download URL, and that a finished upload does not hold the process. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-byte-route-settled.test.ts#L11" target="_blank" rel="noopener noreferrer"><code>storage-byte-route-settled.test.ts</code></a> pins the wait, the call order and the deadline. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L80" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L596" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div></div></details>
+<div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/client-sdk-under-register</code> runs the client SDKs under <code>node --import @pyric/cli/register</code> against a hosted Vite dev server, reads back with <code>firebase-admin</code> and a page, and asserts an upload issued as the process's first call that firebase-admin downloads, its HTTP download URL, and that a finished upload does not hold the process. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/storage-byte-route-settled.test.ts#L11" target="_blank" rel="noopener noreferrer"><code>storage-byte-route-settled.test.ts</code></a> pins the wait, the call order and the deadline. On main (942cb175) it failed: the calls ran against a private in-process sandbox, so an upload returned a <a href="https://github.com/davideast/pyric/blob/main/test/apps/client-sdk-under-register/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>data:</code></a> URL and firebase-admin read nothing they wrote. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/node-origin.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/register/node-origin.test.ts</code></a> runs the served surfaces under a Node origin whose host is not the Node host, or cannot be found, and asserts every call fails, <code>useWorker</code> stays true, the served app entry's placeholder sandbox stays empty, and a <code>pyric/*</code> mirror resolved from the app refuses. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/mapping.test.ts#L78" target="_blank" rel="noopener noreferrer"><code>mapping.test.ts</code></a> pins the mapping per activation value.. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/register/register-child.test.ts#L665" target="_blank" rel="noopener noreferrer"><code>register-child.test.ts</code></a>)</div></div></details>
 <details class="compat-row" data-status="diverged"><summary class="compat-line"><span class="compat-dot" data-status="diverged" role="img" aria-label="Diverged (documented)" title="Diverged (documented)"></span><span class="compat-main"><code class="compat-api">getStorage(app) in a server-rendered module under vite dev</code><span class="compat-sub"><span class="compat-behavior">On a hosted dev server, <code>firebase/storage</code> in a server-rendered module uploads and reads the host's objects under its rules as the SSR session's user, over the host's byte route: an upload to another user's path fails with <code>storage/unauthorized</code>, and a download URL names the host's byte route. On a SharedWorker dev server every call fails with <code>failed-precondition</code> and a message naming <code>pyric({ hosted: true })</code>. No call reaches production or an in-process sandbox.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-note">App scenario <code>test/apps/vite-ssr-client-sdk</code> uploads to the SSR user's own path, reads its download URL, is denied another user's path, and downloads the object with <code>firebase-admin</code> in a process on the host. On main (ba2c0bf0a) the scenario failed: SSR sign-in rejected with <code>auth/network-request-failed</code> from the network guard, and the RTDB, Firestore and Storage writes did not settle, because the imports loaded the real SDK. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-module-swap.test.ts#L4" target="_blank" rel="noopener noreferrer"><code>vite-module-swap.test.ts</code></a> pins the routing per specifier, AI mode and environment (Vite 5's <code>ssr</code> option, a runnable environment, a non-runnable one), <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-ssr-activation.test.ts#L1" target="_blank" rel="noopener noreferrer"><code>vite-ssr-activation.test.ts</code></a> the host, the restart hand-over and the SharedWorker refusal, and <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/vite-plugin-firestore.test.ts#L14" target="_blank" rel="noopener noreferrer"><code>vite-plugin-firestore.test.ts</code></a> runs Vite with <code>firebase</code> installed, so it takes the externalized path. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/test/apps/vite-ssr-client-sdk/scenario.ts#L1" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>)</div></div></details>
 </div>