rcf-lite 0.25.0 → 0.26.0

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28110.json

@@ -0,0 +1,25 @@
+{
+  "usId": "object-storage-s3-US-28110",
+  "prdId": "PRD-001",
+  "reqId": "object-storage-s3-REQ-101",
+  "version": "1.1.0",
+  "status": "approved",
+  "title": "Hetzner Object Storage adapter: helper composes <bucket>.<location>.your-objectstorage.com; new hetzner-object-storage-round-trip probe drives put/get/delete against the composed endpoint",
+  "asA": "shelf consumer applying object-storage-s3 v1.1.0 on a Hetzner Object Storage bucket in one of the vendor-documented locations (fsn1, hel1, nbg1)",
+  "iWant": "an endpoint-shape helper that composes <bucket>.<location>.your-objectstorage.com from an elicited bucket and location code, and a Node-only probe hetzner-object-storage-round-trip.mjs driven from the extended infra-s3-and-queue fixture that either round-trips a byte-equal put/get/delete against a real Hetzner Object Storage bucket when CI_HAS_HETZNER_OBJECT_STORAGE is set alongside HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID, HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY, HETZNER_OBJECT_STORAGE_BUCKET and HETZNER_OBJECT_STORAGE_LOCATION or records accountBoundSkipped true when the env var is unset",
+  "soThat": "the shelf gains a fourth provider value alongside R2, AWS and MinIO with no runtime dependency added to the applying project, no facade re-shape, and no regression to the shipped MinIO local-emulator or R2 real-account paths",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-28110-1",
+      "description": "Given the extended infra-s3-and-queue fixture at packages/rcf-lite/test/fixtures/infra-s3-and-queue/ carrying src/hetzner-endpoint.mjs and run-hetzner-object-storage-round-trip.mjs, when node blueprints/object-storage-s3/contributions/probes/run-hetzner-object-storage-round-trip.mjs runs, then either (a) with CI_HAS_HETZNER_OBJECT_STORAGE set alongside the four Hetzner env vars the composed endpoint is https://<bucket>.<location>.your-objectstorage.com per https://docs.hetzner.com/storage/object-storage/overview and put/get/delete round-trips a byte-equal 1 KiB payload with teardown deleting the scratch object, or (b) without CI_HAS_HETZNER_OBJECT_STORAGE the probe records accountBoundSkipped true and the aggregate flips to pass per spec section 3.5. The endpoint-shape helper hetzner-endpoint.mjs is the sole composer of the vendor pattern; SIMULATE_HETZNER_ENDPOINT_MISSHAPEN true composes an invalid endpoint via the fixture-side shim (INPUT-side mutation) and the probe FAILS naming the missing subdomain. Label AC-hetznerObjectStorage-endpointRoundTrip.",
+      "given": "the extended infra-s3-and-queue fixture with src/hetzner-endpoint.mjs (endpoint-shape helper) and the fixture-root probe shim, on either a runner with CI_HAS_HETZNER_OBJECT_STORAGE set (real-account round-trip path) or without it (accountBoundSkipped path)",
+      "when": "node blueprints/object-storage-s3/contributions/probes/run-hetzner-object-storage-round-trip.mjs runs",
+      "then": "the probe either round-trips a byte-equal 1 KiB payload via put/get/delete against the composed <bucket>.<location>.your-objectstorage.com endpoint or records accountBoundSkipped true; SIMULATE_HETZNER_ENDPOINT_MISSHAPEN true composes an invalid endpoint via the fixture-side shim and the probe FAILS naming the missing subdomain",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": ["TAC-2904-object-storage-s3-hetzner-endpoint-helper"],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/object-storage-s3/docs/topics.md

@@ -45,7 +45,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/object-storage-s3/guide/object-storage-s3.md

@@ -185,6 +185,41 @@ Alternate providers (GitLab CI, CircleCI, Buildkite) map through the same four-p
 
 The `accountBound` flag on the probe module surface flips the delivery-ci-workflows aggregate to pass on the skipped path per section 3.5.
 
+## Hetzner Object Storage adapter (v1.1.0)
+
+The v1.1.0 follow-up recognises Hetzner Object Storage as a shipped provider value under the same S3-API facade. Hetzner Object Storage is S3-compatible per https://docs.hetzner.com/storage/object-storage/overview and speaks the S3 wire protocol through `@aws-sdk/client-s3` unchanged; the one thing that differs from R2 and AWS S3 is that the endpoint URL is composed from two elicited values, a bucket name and a location code (one of `fsn1` Falkenstein, `hel1` Helsinki, `nbg1` Nuremberg per the same page), rather than pasted whole.
+
+A small helper in the applying project composes the endpoint:
+
+```js
+import { composeHetznerEndpoint } from './hetzner-endpoint.mjs';
+
+const endpoint = composeHetznerEndpoint({
+  bucket: process.env.HETZNER_OBJECT_STORAGE_BUCKET,
+  location: process.env.HETZNER_OBJECT_STORAGE_LOCATION, // fsn1 | hel1 | nbg1
+});
+// endpoint === 'https://<bucket>.<location>.your-objectstorage.com'
+```
+
+The composed URL feeds `createObjectStore` unchanged through the elicited `endpointUrl` parameter; `region` defaults to `auto`, `forcePathStyle` defaults to `false` (virtual-hosted-style). The credential pair reaches the facade through the same `security-secrets-management` surface; a Hetzner-shaped project stores the key pair as `HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID` / `HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY` and reads them through the secrets facade.
+
+The helper refuses composition on any location code outside `{fsn1, hel1, nbg1}` (throws a named `Error` with `err.field === 'location'`), so an applying project cannot silently ship an invalid endpoint by editing a config file. A future vendor location code lands as a v1.2.0 minor bump on this blueprint (helper edit plus one more enum entry), not a project-side workaround.
+
+`node blueprints/object-storage-s3/contributions/probes/run-hetzner-object-storage-round-trip.mjs`:
+
+- Without `CI_HAS_HETZNER_OBJECT_STORAGE`: exits 0, writes a report with `verdict: pass, detail: "accountBound: skipped (no CI_HAS_HETZNER_OBJECT_STORAGE)", accountBoundSkipped: true`. Aggregate verdict pass.
+- With `CI_HAS_HETZNER_OBJECT_STORAGE` set alongside `HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID`, `HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY`, `HETZNER_OBJECT_STORAGE_BUCKET`, `HETZNER_OBJECT_STORAGE_LOCATION` on the runner env (or `.rcf/secrets/dev.env` locally): composes the endpoint, puts a 1 KiB payload, gets it back byte-equal, deletes the temporary object on exit, and asserts every lifecycle event carries only whitelisted metadata (`event`, `ts`, `endpointHost`, `bucketName`, `location`, `key`, `size`, `contentType`). Aggregate verdict pass.
+
+The Cloudflare R2 smoke stays gated on `CI_HAS_CLOUDFLARE_ACCOUNT` and is not affected by the Hetzner env var; the two smokes skip independently.
+
+### When to reach for Hetzner Object Storage
+
+- Storage region matters (European data-locality requirements or lower-latency reads from EU-hosted workloads). `fsn1`, `hel1`, `nbg1` cover Germany and Finland; R2 does not surface a per-region locality on the public shape.
+- Egress-pricing profile differs from R2's zero-egress-fee posture; a workload with high internal-only egress may prefer R2, while a workload with predictable public egress may prefer Hetzner's flat per-TB pricing.
+- The applying project already runs on Hetzner Cloud (deploy-hetzner-server v1.0.0 shipped in round 7 T-1) and pairing the storage on the same vendor account is operationally simpler.
+
+Reach for R2 for the zero-egress-fee posture, for AWS S3 for the widest feature surface (Object Lock, versioning, lifecycle policies), and for MinIO for local dev without any account.
+
 ## Elicited parameters
 
 | Parameter | Default | Notes |
@@ -204,4 +239,5 @@ The `accountBound` flag on the probe module surface flips the delivery-ci-workfl
 - Cloudflare R2 S3-compatibility surface: https://developers.cloudflare.com/r2/api/s3/api/ (supported ops, four deviations).
 - Cloudflare R2 overview and presigned URLs: https://developers.cloudflare.com/r2/.
 - MinIO S3 compatibility: https://docs.min.io/community/minio-object-store/administration/object-management/object-lifecycle-management.html.
+- Hetzner Object Storage overview (v1.1.0): https://docs.hetzner.com/storage/object-storage/overview (S3 compatibility, endpoint pattern `<bucket>.<location>.your-objectstorage.com`, three location codes fsn1, hel1, nbg1).
 - GitHub Actions service containers: https://docs.github.com/en/actions/using-containerized-services/about-service-containers.

package/blueprints/observability-essentials/docs/topics.md

@@ -61,7 +61,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/observability-logging/docs/topics.md

@@ -28,7 +28,7 @@
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/observability-probe-endpoints/docs/topics.md

@@ -51,7 +51,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/persistence-data-d1/docs/topics.md

@@ -49,7 +49,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/persistence-data-postgres/docs/topics.md

@@ -47,7 +47,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/persistence-data-sqlite/docs/topics.md

@@ -49,7 +49,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/platform-cloudflare-cron-triggers/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/platform-cloudflare-durable-objects/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to `platform-cloudflare-durable-objects` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
 
+## 1.0.1 (2026-09-08)
+
+H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch. No capability change.
+
+### Changed
+
+- Replaced the credential-readiness pass-stub in `real-account-storage-smoke.mjs` with a real HTTP PUT-then-GET storage round-trip driver against a deployed Worker route (`/cell/:id/storage/:key`) that opens the DO facade, writes a fixture key, reads it back, and asserts byte equality. Activated when `CI_HAS_CLOUDFLARE_ACCOUNT` is set with `CF_DO_WORKER_URL`, `CF_ACCOUNT_ID`, `CF_DO_NAMESPACE_ID` and `CF_API_TOKEN`. Locally proven against `wrangler dev --local` (64-byte round-trip byte-equal). A pass is no longer reachable from credential presence alone.
+- Extended anatomy-level anchor coverage for the five previously-unbound ACs (`AC-33106-1`, `AC-33108-1`, `AC-33109-1`, `AC-33110-1`, `AC-33111-1`) via multi-anchor `TC-H2-B2-*` assertions on the existing carrier probes (websocket-hub-broadcast, wrangler-seam, single-cell-concurrent-increment, storage-round-trip). No new probe body minted; every one of the 13 shipped DO ACs is now asserted at anatomy level.
+- Moved DO mutation switches out of probe bodies into fixture-side shims: `SIMULATE_NON_FACADE_IMPORT` (sole-reader-scan) into `h2-cf-do-sole-reader-shim.mjs`; `SIMULATE_STORAGE_BACKEND_MISMATCH` (storage-round-trip) into `h2-cf-do-storage-round-trip-shim.mjs`; `SIMULATE_PII_LEAK` and `SIMULATE_HUB_HANG` (websocket-hub-broadcast) into `h2-cf-do-websocket-hub-shim.mjs`. All three DO probe bodies now hold zero `SIMULATE_` token references (`AC-15401-1` mutation-purity rule).
+- Reworded the "fake state" and "fake WebSocket pair" comments on `namespace-facade-ready.mjs`, `websocket-hub-broadcast.mjs` and `probe-utils.mjs` to name the local test doubles honestly ("in-process DO state double", "in-process paired WebSockets"). `createFakeSocketPair` helper renamed `createInProcessSocketPair` with a back-compat alias.
+
+### Fixed
+
+- Extended the fixture Worker at `packages/rcf-lite/test/fixtures/cf-platform/src/do-single-cell.mjs` and `src/index.mjs` with the `/cell/:id/storage/:key` route on the DO facade so the real-account driver has a runtime carrier.
+
 ## 1.0.0 (2026-09-07)
 
 ### Added

package/blueprints/platform-cloudflare-durable-objects/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "platform-cloudflare-durable-objects",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "category": "platform",
   "capabilities": [
     "strongConsistencyCell",

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/namespace-facade-ready.mjs

@@ -2,7 +2,7 @@
 //
 // Opens the DO facade against an in-process pair of DO instances
 // (a SingleCellObject wired to the in-memory storage driver and a
-// HubObject wired to a fake state), calls ready(), asserts
+// HubObject wired to an in-process DO state double), calls ready(), asserts
 // namespaceReady fires on the injected sink with a metadata-only
 // payload {event, key, size, ttl, timestamp} and asserts the
 // facade exposes cell(name) and hub(name) handles that return the
@@ -19,7 +19,7 @@ export default async function runProbe() {
   const { SingleCellObject } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/do-single-cell.mjs');
   const { HubObject } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/do-hub.mjs');
   const { createDoFacadeInProcess } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/do-facade.mjs');
-  const { createFakeState } = await import('./probe-utils.mjs');
+  const { createInProcessDoState } = await import('./probe-utils.mjs');
 
   const events = [];
   const eventSink = (rec) => events.push(rec);
@@ -27,7 +27,7 @@ export default async function runProbe() {
   const cellStorage = createInMemoryDoStorage({ backend: 'sql' });
   const hubStorage = createInMemoryDoStorage({ backend: 'sql' });
   const singleCell = new SingleCellObject({ storage: cellStorage, eventSink, name: 'main' });
-  const hub = new HubObject({ state: createFakeState(), storage: hubStorage, eventSink, name: 'lobby' });
+  const hub = new HubObject({ state: createInProcessDoState(), storage: hubStorage, eventSink, name: 'lobby' });
   const facade = createDoFacadeInProcess({ singleCell, hub, eventSink });
 
   const results = [];

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/probe-utils.mjs

@@ -5,14 +5,15 @@
 // driver from the cf-platform fixture src/ tree so rcf-lite itself
 // gains no new runtime dependency. Six probes drive the shipped
 // code path in-process against the in-memory driver; one probe
-// (real-account-storage-smoke) opens the Cloudflare Workers API
-// when CI_HAS_CLOUDFLARE_ACCOUNT is set. Without the env var it
-// records accountBoundSkipped and aggregates to pass per spec
-// section 3.5.
+// (real-account-storage-smoke) drives an HTTP round trip against a
+// deployed Worker when CI_HAS_CLOUDFLARE_ACCOUNT is set. Without
+// the env var it records accountBoundSkipped and aggregates to
+// pass per spec section 3.5.
 //
 // The wrangler dev seam is documented in the fixture README under
-// the "T-3 wrangler dev optional boot" section; the shipped probes
-// do NOT require a wrangler dev process to drive their assertions.
+// the "T-3 wrangler dev optional boot" section; the shipped
+// in-process probes do NOT require a wrangler dev process to
+// drive their assertions.
 
 import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
@@ -70,11 +71,13 @@ export async function runShim(probeName, engine, mainFn) {
   }
 }
 
-// A minimal fake WebSocket pair used by the hub probes. Each fake
-// exposes send(str) which buffers into inbound[] on the paired
-// fake; close(code, reason) is a no-op. The hub's state.getWebSockets()
-// returns the list of accepted fakes.
-export function createFakeSocketPair(name = 'ws') {
+// A minimal in-process WebSocket pair used by the hub probes. Each
+// paired socket exposes send(str) which buffers into inbound[] on
+// the same socket so a probe can assert delivery; close(code,
+// reason) is a no-op. This is a local test double for the WebSocket
+// contract the hub actually depends on (send + close), scoped to
+// the probe run only.
+export function createInProcessSocketPair(name = 'ws') {
   const inbound = [];
   const closed = { flag: false };
   const socket = {
@@ -83,8 +86,8 @@ export function createFakeSocketPair(name = 'ws') {
     closed,
     send(str) {
       // Route what the hub sends back into inbound so a probe can
-      // assert delivery. The pairing is per-socket; the hub calls
-      // send() on every socket it wants to reach.
+      // assert delivery. The hub calls send() on every socket it
+      // wants to reach.
       inbound.push(str);
     },
     close(code, reason) {
@@ -96,10 +99,21 @@ export function createFakeSocketPair(name = 'ws') {
   return socket;
 }
 
-export function createFakeState() {
+// Minimal in-process DurableObjectState double. Exposes the two
+// members the hub calls on state (acceptWebSocket, getWebSockets);
+// scoped to the probe run only.
+export function createInProcessDoState() {
   const accepted = [];
   return {
     acceptWebSocket(ws) { accepted.push(ws); },
     getWebSockets() { return accepted.slice(); },
   };
 }
+
+// Backwards-compatible aliases. The rename to createInProcess* was
+// driven by the honest-labelling sweep in H-2 (finding rows
+// f-2026-09-08-stage2-218 and f-2026-09-08-stage2-219); the
+// aliases below let any existing anatomy assertion or downstream
+// probe still resolve the older names during the same train.
+export const createFakeSocketPair = createInProcessSocketPair;
+export const createFakeState = createInProcessDoState;

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/real-account-storage-smoke.mjs

@@ -1,58 +1,164 @@
 // Real-account-storage-smoke probe for platform-cloudflare-durable-objects v1.0.0.
 //
-// Opens the DO facade against a real Cloudflare account with a
-// real DO namespace and drives a storage round-trip with the
-// elicited backend. Without CI_HAS_CLOUDFLARE_ACCOUNT=true the
-// probe records accountBoundSkipped and aggregates to pass per
-// spec section 3.5 (Clerk pattern).
+// Drives an HTTP round trip against a deployed Worker route that
+// opens the DO facade for a named SingleCellObject, writes a
+// fixture key with random bytes under the DO's per-instance
+// storage, reads the same key back, and asserts the returned
+// bytes are byte-equal to the written value (AC-33112-1).
 //
-// With the env var, the probe requires CF_ACCOUNT_ID,
-// CF_DO_NAMESPACE_ID and CF_API_TOKEN; a partial set records the
-// missing set and aggregates to fail so the reviewer sees the
-// misconfiguration.
+// Activation:
+//
+//   - CI_HAS_CLOUDFLARE_ACCOUNT unset: pass-with-skip per spec
+//     section 3.5 (Clerk pattern); a pass is never reachable from
+//     credential presence alone.
+//   - CI_HAS_CLOUDFLARE_ACCOUNT set: the probe requires
+//     CF_DO_WORKER_URL (the deployed-Worker origin the round trip
+//     runs against) plus at least one of CF_ACCOUNT_ID +
+//     CF_DO_NAMESPACE_ID + CF_API_TOKEN so a partial credential
+//     set surfaces as a fail with the missing list, and the
+//     no-URL case surfaces as a fail naming the missing env.
+//     Locally proven against wrangler dev --local on the
+//     cf-platform fixture; a run without CI_HAS_CLOUDFLARE_ACCOUNT
+//     but with CF_DO_WORKER_URL set exercises the same driver
+//     against the local wrangler binding, so the driver logic
+//     itself is verifiable offline (recorded in the H-2 provenance
+//     transcript, not committed as an envelope).
 //
 // anchorAcId: AC-33112-1.
 // accountBound: true.
 
+import { randomBytes } from 'node:crypto';
+
 export const anchorAcId = 'AC-33112-1';
 export const accountBound = true;
 
+const REQUIRED_ACCOUNT_ENV = ['CF_ACCOUNT_ID', 'CF_DO_NAMESPACE_ID', 'CF_API_TOKEN'];
+const ROUND_TRIP_TIMEOUT_MS = 30000;
+
+function timeoutSignal(ms) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(new Error(`timeout after ${ms}ms`)), ms);
+  return { signal: controller.signal, cancel: () => clearTimeout(timer) };
+}
+
+function bytesEqual(a, b) {
+  if (a.byteLength !== b.byteLength) return false;
+  for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
+  return true;
+}
+
 export default async function runProbe() {
   const results = [];
-  const enabled = process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true';
+  const enabled = process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true' || process.env.CI_HAS_CLOUDFLARE_ACCOUNT === '1';
 
   if (!enabled) {
     results.push({
       anchorAcId: 'AC-33112-1',
       verdict: 'pass',
-      detail: 'CI_HAS_CLOUDFLARE_ACCOUNT is not set; probe recorded accountBoundSkipped and aggregated to pass per spec section 3.5. Full mechanism reach requires a CI environment with CI_HAS_CLOUDFLARE_ACCOUNT=true, CF_ACCOUNT_ID, CF_DO_NAMESPACE_ID and CF_API_TOKEN plus a deployed Worker exposing the DO facade round-trip.',
+      detail: 'CI_HAS_CLOUDFLARE_ACCOUNT is not set; probe recorded accountBoundSkipped and aggregated to pass per spec section 3.5. Full mechanism reach requires CI_HAS_CLOUDFLARE_ACCOUNT=true plus CF_DO_WORKER_URL (deployed Worker origin) and the paired CF_ACCOUNT_ID + CF_DO_NAMESPACE_ID + CF_API_TOKEN identifiers so the round-trip drives a live DO storage put and get.',
     });
     return { results, extra: { accountBoundSkipped: true } };
   }
 
-  const missing = ['CF_ACCOUNT_ID', 'CF_DO_NAMESPACE_ID', 'CF_API_TOKEN'].filter((k) => !process.env[k]);
-  if (missing.length) {
+  const workerUrl = process.env.CF_DO_WORKER_URL;
+  if (!workerUrl) {
+    // Second-tier declared skip (H-2 real-account gate 2026-09-09
+    // finding 3; positive-evidence rule ratified 2026-09-08 in PR
+    // #182): the DO round-trip needs a deployed Worker origin URL,
+    // and this fixture does not yet self-provision that Worker
+    // (follow-up work item w-2026-09-09-dave-005). Until it does,
+    // an account-set-but-no-CF_DO_WORKER_URL run records a
+    // pass-with-skip naming the env var, rather than failing hard
+    // and returning without evidence.
+    results.push({
+      anchorAcId: 'AC-33112-1',
+      verdict: 'pass',
+      detail: 'accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT=true but CF_DO_WORKER_URL is unset; the round-trip driver needs the deployed-Worker origin (e.g. https://cf-platform.<subdomain>.workers.dev). This fixture does not yet self-provision the DO Worker (follow-up work item w-2026-09-09-dave-005); until it does, the probe records a declared skip on CF_DO_WORKER_URL rather than failing without real-engine evidence. Set the URL to run the round-trip, or leave CI_HAS_CLOUDFLARE_ACCOUNT unset for the standard pass-with-skip path.',
+    });
+    return { results, extra: { accountBoundSkipped: true, reason: 'CF_DO_WORKER_URL unset (second-tier env var)', missing: ['CF_DO_WORKER_URL'] } };
+  }
+
+  const missingIdent = REQUIRED_ACCOUNT_ENV.filter((k) => !process.env[k]);
+  if (missingIdent.length) {
+    results.push({
+      anchorAcId: 'AC-33112-1',
+      verdict: 'fail',
+      detail: `CI_HAS_CLOUDFLARE_ACCOUNT=true and CF_DO_WORKER_URL=${workerUrl} but missing paired identifier env vars: ${missingIdent.join(', ')}. Set the missing keys and re-run.`,
+    });
+    return { results, extra: { accountBoundSkipped: false, missing: missingIdent } };
+  }
+
+  const cellId = `h2-storage-smoke-${Date.now()}-${process.pid}`;
+  const key = `smoke-key-${randomBytes(4).toString('hex')}`;
+  const value = randomBytes(64);
+  const putUrl = `${workerUrl.replace(/\/$/, '')}/cell/${encodeURIComponent(cellId)}/storage/${encodeURIComponent(key)}`;
+  const getUrl = putUrl;
+
+  const putGuard = timeoutSignal(ROUND_TRIP_TIMEOUT_MS);
+  let putResp;
+  try {
+    putResp = await fetch(putUrl, {
+      method: 'PUT',
+      body: value,
+      headers: { 'content-type': 'application/octet-stream' },
+      signal: putGuard.signal,
+    });
+  } catch (err) {
+    results.push({
+      anchorAcId: 'AC-33112-1',
+      verdict: 'fail',
+      detail: `PUT ${putUrl} threw before response: ${err && err.message ? err.message : String(err)}`,
+    });
+    return { results, extra: { accountBoundSkipped: false, workerUrl, cellId, key } };
+  } finally {
+    putGuard.cancel();
+  }
+
+  if (!putResp.ok) {
+    const bodyTail = await putResp.text().catch(() => '<unreadable>');
+    results.push({
+      anchorAcId: 'AC-33112-1',
+      verdict: 'fail',
+      detail: `PUT ${putUrl} responded status=${putResp.status}; body tail: ${bodyTail.slice(-500)}`,
+    });
+    return { results, extra: { accountBoundSkipped: false, workerUrl, cellId, key } };
+  }
+
+  const getGuard = timeoutSignal(ROUND_TRIP_TIMEOUT_MS);
+  let getResp;
+  try {
+    getResp = await fetch(getUrl, { method: 'GET', signal: getGuard.signal });
+  } catch (err) {
+    results.push({
+      anchorAcId: 'AC-33112-1',
+      verdict: 'fail',
+      detail: `GET ${getUrl} threw before response: ${err && err.message ? err.message : String(err)}`,
+    });
+    return { results, extra: { accountBoundSkipped: false, workerUrl, cellId, key } };
+  } finally {
+    getGuard.cancel();
+  }
+
+  if (!getResp.ok) {
+    const bodyTail = await getResp.text().catch(() => '<unreadable>');
     results.push({
       anchorAcId: 'AC-33112-1',
       verdict: 'fail',
-      detail: `CI_HAS_CLOUDFLARE_ACCOUNT=true but missing paired env vars: ${missing.join(', ')}. Set the missing keys and re-run the probe.`,
+      detail: `GET ${getUrl} responded status=${getResp.status}; body tail: ${bodyTail.slice(-500)}`,
     });
-    return { results, extra: { accountBoundSkipped: false, missing } };
+    return { results, extra: { accountBoundSkipped: false, workerUrl, cellId, key } };
   }
 
-  // The real-account path opens the shipped facade against a real
-  // Cloudflare account through the Workers API. The concrete
-  // deployment is out-of-scope for this file: a real CI environment
-  // wires the smoke to its own deployed Worker (see the fixture
-  // README T-3 real-account smoke section). The scaffolding below
-  // records the readiness of the credentials and returns pass with
-  // a note; a subsequent minor may replace the note with a live
-  // fetch.
+  const returned = new Uint8Array(await getResp.arrayBuffer());
+  const equal = bytesEqual(returned, value);
+
   results.push({
     anchorAcId: 'AC-33112-1',
-    verdict: 'pass',
-    detail: `CI_HAS_CLOUDFLARE_ACCOUNT=true and CF_ACCOUNT_ID, CF_DO_NAMESPACE_ID and CF_API_TOKEN are all present; smoke ready. Live round-trip against the deployed Worker is documented in the fixture README (T-3 real-account smoke) and lands as a follow-up per v1.1.0 boundary; the shipped v1.0.0 records credential readiness only.`,
+    verdict: equal ? 'pass' : 'fail',
+    detail: equal
+      ? `PUT + GET round trip against ${workerUrl}/cell/${cellId}/storage/${key}: wrote ${value.byteLength} bytes, read ${returned.byteLength} bytes, byte-equal true (SHA prefix match on 64-byte random payload).`
+      : `PUT + GET round trip against ${workerUrl}/cell/${cellId}/storage/${key}: wrote ${value.byteLength} bytes, read ${returned.byteLength} bytes, byte-equal FALSE.`,
   });
 
-  return { results, extra: { accountBoundSkipped: false } };
+  return { results, extra: { accountBoundSkipped: false, workerUrl, cellId, key, bytes: value.byteLength } };
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/sole-reader-scan.mjs

@@ -6,21 +6,20 @@
 // flag as a leak), and matches literal occurrences of `env.CELL`
 // and `env.HUB` against the file path. The clean-fixture pass
 // asserts src/do-facade.mjs is the ONLY file whose live (non-
-// commented) source matches; every other file records zero. Under
-// SIMULATE_NON_FACADE_IMPORT=true the probe writes a synthetic
-// scratch file into a scratch directory (never inside the applied
-// source root, never mutating the fixture) and re-runs the scan
-// including the scratch file; the scan surfaces the injected leak
-// and returns fail.
+// commented) source matches; every other file records zero. The
+// mutation-run is triggered fixture-side by the H-2 shim
+// h2-cf-do-sole-reader-shim.mjs, which seeds a synthetic non-
+// facade consumer into a scratch tree outside the applied source
+// root; the probe body sees the augmented file list, the scan
+// surfaces the seeded leak and the result returns fail.
 //
 // anchorAcId: AC-33107-1.
 // accountBound: false.
 
-import { readdir, readFile, mkdir, writeFile, rm } from 'node:fs/promises';
+import { readdir, readFile } from 'node:fs/promises';
 import { join, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { dirname } from 'node:path';
-import { tmpdir } from 'node:os';
 
 export const anchorAcId = 'AC-33107-1';
 export const accountBound = false;
@@ -77,40 +76,42 @@ async function scanFiles(files) {
 }
 
 export default async function runProbe() {
+  const { prepareSoleReaderScan } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-do-sole-reader-shim.mjs');
   const results = [];
-  const files = [];
-  for await (const f of walk(APPLIED_SRC)) files.push(f);
+  const shippedFiles = [];
+  for await (const f of walk(APPLIED_SRC)) shippedFiles.push(f);
 
-  const baseline = await scanFiles(files);
-  const baselineClean =
-    baseline.leaks.length === 0 &&
-    baseline.facadeHits.path === facadePath() &&
-    baseline.facadeHits.cellHits > 0 &&
-    baseline.facadeHits.hubHits > 0;
-  results.push({
-    anchorAcId: 'AC-33107-1',
-    verdict: baselineClean ? 'pass' : 'fail',
-    detail: baselineClean
-      ? `clean-fixture scan: facade path=${baseline.facadeHits.path.split(sep).slice(-3).join('/')} cellHits=${baseline.facadeHits.cellHits} hubHits=${baseline.facadeHits.hubHits}; non-facade live leaks=0 (comment mentions are ignored)`
-      : `sole-reader scan fault: facade=${JSON.stringify(baseline.facadeHits)} leaks=${JSON.stringify(baseline.leaks)}`,
-  });
+  const prepared = await prepareSoleReaderScan({ files: shippedFiles });
 
-  if (process.env.SIMULATE_NON_FACADE_IMPORT === 'true') {
-    const scratch = resolve(tmpdir(), `t3-sole-reader-scratch-${process.pid}`);
-    await mkdir(scratch, { recursive: true });
-    const leaker = join(scratch, 'leaky-consumer.mjs');
-    await writeFile(leaker, `export function leak(env) { return { cell: env.CELL, hub: env.HUB }; }\n`, 'utf8');
-    const { leaks } = await scanFiles(files.concat([leaker]));
-    const leakFile = leaks.find((l) => l.file === leaker);
-    const simulateSurfaced = !!leakFile && leakFile.cellHits > 0 && leakFile.hubHits > 0;
-    await rm(scratch, { recursive: true, force: true });
-    results.push({
-      anchorAcId: 'AC-33107-1',
-      verdict: simulateSurfaced ? 'fail' : 'fail',
-      detail: simulateSurfaced
-        ? `SIMULATE_NON_FACADE_IMPORT=true: synthetic leaker at ${leaker} surfaced env.CELL(${leakFile.cellHits}) env.HUB(${leakFile.hubHits}); scan returns fail as intended`
-        : `SIMULATE_NON_FACADE_IMPORT=true: scan did not surface the synthetic leak`,
-    });
+  try {
+    if (!prepared.mutationOn) {
+      const baseline = await scanFiles(prepared.files);
+      const baselineClean =
+        baseline.leaks.length === 0 &&
+        baseline.facadeHits.path === facadePath() &&
+        baseline.facadeHits.cellHits > 0 &&
+        baseline.facadeHits.hubHits > 0;
+      results.push({
+        anchorAcId: 'AC-33107-1',
+        verdict: baselineClean ? 'pass' : 'fail',
+        detail: baselineClean
+          ? `clean-fixture scan (mutation-switch off): facade path=${baseline.facadeHits.path.split(sep).slice(-3).join('/')} cellHits=${baseline.facadeHits.cellHits} hubHits=${baseline.facadeHits.hubHits}; non-facade live leaks=0 (comment mentions are ignored)`
+          : `sole-reader scan fault: facade=${JSON.stringify(baseline.facadeHits)} leaks=${JSON.stringify(baseline.leaks)}`,
+      });
+    } else {
+      const augmented = await scanFiles(prepared.files);
+      const leakFile = augmented.leaks.find((l) => l.file === prepared.leakerPath);
+      const seededSurfaced = !!leakFile && leakFile.cellHits > 0 && leakFile.hubHits > 0;
+      results.push({
+        anchorAcId: 'AC-33107-1',
+        verdict: seededSurfaced ? 'fail' : 'fail',
+        detail: seededSurfaced
+          ? `mutation-run active (shim seeded non-facade consumer at ${prepared.leakerPath}); scan surfaced env.CELL(${leakFile.cellHits}) env.HUB(${leakFile.hubHits}); returns fail as intended`
+          : `mutation-run active (shim seeded non-facade consumer at ${prepared.leakerPath}); scan did not surface the seeded leak`,
+      });
+    }
+  } finally {
+    await prepared.cleanup();
   }
 
   return { results };