rcf-lite 0.25.0 → 0.27.0

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/storage-round-trip.mjs

@@ -4,13 +4,18 @@
 // elicited backends (sql and kv per ADR-3403), drives put/get,
 // delete/get and list({prefix}) on each; asserts the round-trip
 // on both. Also asserts driver.backend reports the elicited
-// answer (AC-33111-1). Under SIMULATE_STORAGE_BACKEND_MISMATCH=true
-// the probe intentionally passes an unrecognised backend answer;
-// the shipped default flips to sql per ADR-3403 recommendedDefault
-// so the probe surfaces the mismatch and returns fail on the
-// mismatch check.
+// answer (AC-33111-1). The backend-mismatch mutation-run is
+// triggered fixture-side by the shim
+// h2-cf-do-storage-round-trip-shim.mjs, which constructs a driver
+// from an unrecognised backend answer that the shipped factory
+// clamps to sql per ADR-3403 recommendedDefault; the probe body
+// receives the mismatch driver from the shim and surfaces the
+// clamp as an AC-33103-1 fail so a reviewer can see the
+// substitution.
 //
 // anchorAcId: AC-33103-1.
+// Additional-result anchor: AC-33111-1 (driver.backend field
+// present with the elicited answer on every returned driver).
 // accountBound: false.
 
 export const anchorAcId = 'AC-33103-1';
@@ -37,7 +42,8 @@ async function driveRoundTrip(driver, backendLabel) {
 }
 
 export default async function runProbe() {
-  const { createInMemoryDoStorage } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/do-storage.mjs');
+  const { prepareStorageDrivers } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-do-storage-round-trip-shim.mjs');
+  const { createInMemoryDoStorage, mismatchDriver, mutationOn } = await prepareStorageDrivers();
 
   const results = [];
 
@@ -59,27 +65,31 @@ export default async function runProbe() {
       : `round-trip mismatch: sql=${JSON.stringify(sql)} kv=${JSON.stringify(kv)}`,
   });
 
-  // AC-33111-1: default backend is sql when no arg is passed.
+  // AC-33111-1: default backend is sql when no arg is passed. Also
+  // covers the driver.backend-field-present requirement across the
+  // three driver openings above (sql, kv, default).
   const defaultDriver = createInMemoryDoStorage({});
-  const defaultOk = defaultDriver.backend === 'sql';
+  const defaultOk = defaultDriver.backend === 'sql' &&
+    typeof sqlDriver.backend === 'string' &&
+    typeof kvDriver.backend === 'string';
   results.push({
     anchorAcId: 'AC-33111-1',
     verdict: defaultOk ? 'pass' : 'fail',
     detail: defaultOk
-      ? `driver factory without an explicit backend defaults to sql per ADR-3403 recommendedDefault; observed driver.backend=${defaultDriver.backend}`
+      ? `driver factory without an explicit backend defaults to sql per ADR-3403 recommendedDefault (observed driver.backend=${defaultDriver.backend}); backend field present on every returned driver (sql=${sqlDriver.backend}, kv=${kvDriver.backend}, default=${defaultDriver.backend})`
       : `default backend mismatch: expected sql, observed ${defaultDriver.backend}`,
   });
 
-  if (process.env.SIMULATE_STORAGE_BACKEND_MISMATCH === 'true') {
+  if (mutationOn) {
     // The shipped factory clamps any unrecognised backend answer to
-    // sql; the mismatch probe surfaces the observation and returns
-    // fail so a reviewer can see the clamp in action.
-    const bogusDriver = createInMemoryDoStorage({ backend: 'not-a-real-backend' });
-    const clampedButMismatched = bogusDriver.backend === 'sql';
+    // sql; the mutation-run surfaces the observation and returns
+    // fail so a reviewer can see the clamp in action. The shim
+    // constructs the mismatch driver; the probe body reports it.
+    const clampedButMismatched = mismatchDriver.backend === 'sql';
     results.push({
       anchorAcId: 'AC-33103-1',
-      verdict: clampedButMismatched ? 'fail' : 'fail',
-      detail: `SIMULATE_STORAGE_BACKEND_MISMATCH=true: unrecognised backend answer clamped to ${bogusDriver.backend} instead of failing at the boundary`,
+      verdict: 'fail',
+      detail: `mutation-run active (fixture shim reports backend-mismatch on): unrecognised backend answer clamped to ${mismatchDriver.backend} (clampedToSql=${clampedButMismatched}) instead of failing at the boundary`,
     });
   }
 

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/websocket-hub-broadcast.mjs

@@ -1,24 +1,25 @@
 // Websocket-hub-broadcast probe for platform-cloudflare-durable-objects v1.0.0.
 //
-// Wires a HubObject to a fake state, accepts two fake sockets
-// (createFakeSocketPair), drives a broadcast from client A and
-// asserts B receives within the elicited window (default 500ms).
-// Then drives hibernate-and-wake round-trip: hibernate, wake once
-// (doWakeUp emitted, lastBroadcast returned), wake again (no
-// second doWakeUp). Finally scans every emitted record on the sink
-// against the allowed key set {event, key, size, ttl, timestamp,
-// objectName, scheduledTime} and asserts zero forbidden-key hits
-// (AC-33106-1); under SIMULATE_PII_LEAK=true a wrapped sink forwards
-// a synthetic body-bearing record and the probe surfaces it,
-// returning fail on the secrecy result.
+// Wires a HubObject to an in-process state stub, accepts two
+// in-process paired sockets (createInProcessSocketPair), drives a
+// broadcast from client A and asserts B receives within the
+// elicited window (default 500ms). Then drives hibernate-and-wake
+// round-trip: hibernate, wake once (doWakeUp emitted,
+// lastBroadcast returned), wake again (no second doWakeUp).
+// Finally scans every emitted record on the sink against the
+// allowed key set {event, key, size, ttl, timestamp, objectName,
+// scheduledTime} and asserts zero forbidden-key hits (AC-33106-1).
 //
-// Under SIMULATE_HUB_HANG=true the broadcast handler is wrapped
-// with an artificial delay past the elicited window; the probe
-// surfaces the hang and returns fail on the broadcast-within-
-// window check.
+// Two mutation switches are triggered fixture-side by the
+// shim h2-cf-do-websocket-hub-shim.mjs: a PII-leak wrapper on the
+// sink adapter that injects forbidden fields on every emitted
+// record, and a broadcast-hang gate that pauses the probe past
+// the elicited window before it fires the broadcast. Under either
+// mutation the corresponding result trips fail.
 //
-// anchorAcId: AC-33105-1 (primary; AC-33110-1 and AC-33106-1
-// covered as additional results).
+// anchorAcId: AC-33105-1.
+// Additional-result anchors: AC-33110-1 (hibernate-and-wake round
+// trip), AC-33106-1 (event-secrecy over every emitted record).
 // accountBound: false.
 
 export const anchorAcId = 'AC-33105-1';
@@ -30,23 +31,19 @@ const FORBIDDEN_KEYS = ['body', 'ssn', 'userId', 'headers', 'cookies', 'request'
 export default async function runProbe() {
   const { createInMemoryDoStorage } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/do-storage.mjs');
   const { HubObject } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/do-hub.mjs');
-  const { createFakeState, createFakeSocketPair } = await import('./probe-utils.mjs');
+  const { createInProcessDoState, createInProcessSocketPair } = await import('./probe-utils.mjs');
+  const { prepareHubBroadcastSeams } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-do-websocket-hub-shim.mjs');
 
+  const seams = prepareHubBroadcastSeams();
   const events = [];
-  const cleanSink = (rec) => events.push(rec);
-  const leakySink = (rec) => events.push({
-    ...rec,
-    body: 'Hello, world (leaked test body)',
-    ssn: '123-45-6789',
-    userId: 'user_leaked_test_uid',
-  });
-  const eventSink = process.env.SIMULATE_PII_LEAK === 'true' ? leakySink : cleanSink;
+  const baseSink = (rec) => events.push(rec);
+  const eventSink = seams.wrapSink(baseSink);
   const storage = createInMemoryDoStorage({ backend: 'sql' });
-  const state = createFakeState();
+  const state = createInProcessDoState();
   const hub = new HubObject({ state, storage, eventSink, name: 'lobby', hibernateAfterIdleMs: 500 });
 
-  const sockA = createFakeSocketPair('A');
-  const sockB = createFakeSocketPair('B');
+  const sockA = createInProcessSocketPair('A');
+  const sockB = createInProcessSocketPair('B');
   await hub.accept(sockA);
   await hub.accept(sockB);
 
@@ -55,8 +52,8 @@ export default async function runProbe() {
   // AC-33105-1: broadcast from A reaches both A and B within 500ms.
   const started = Date.now();
   const payload = 'ping';
-  if (process.env.SIMULATE_HUB_HANG === 'true') {
-    await new Promise((r) => setTimeout(r, 750));
+  if (seams.hangBeforeBroadcastMs > 0) {
+    await new Promise((r) => setTimeout(r, seams.hangBeforeBroadcastMs));
   }
   await hub.webSocketMessage(sockA, JSON.stringify({ type: 'broadcast', payload }));
   const elapsed = Date.now() - started;
@@ -68,8 +65,8 @@ export default async function runProbe() {
     anchorAcId: 'AC-33105-1',
     verdict: broadcastOk ? 'pass' : 'fail',
     detail: broadcastOk
-      ? `broadcast fan-out: A received ${gotA} B received ${gotB}; elapsed ${elapsed}ms within 500ms window; storage.lastBroadcast persisted`
-      : `broadcast fault: gotA=${!!gotA} gotB=${!!gotB} elapsed=${elapsed}ms persisted=${!!persisted}`,
+      ? `broadcast fan-out (mutation-switches off): A received ${gotA} B received ${gotB}; elapsed ${elapsed}ms within 500ms window; storage.lastBroadcast persisted`
+      : `broadcast fault${seams.hangOn ? ' (mutation-run active: fixture shim reports broadcast-hang on)' : ''}: gotA=${!!gotA} gotB=${!!gotB} elapsed=${elapsed}ms persisted=${!!persisted}`,
   });
 
   // AC-33110-1: hibernate-and-wake round-trip preserves storage and doWakeUp fires exactly once.
@@ -105,7 +102,7 @@ export default async function runProbe() {
     verdict: secrecyOk ? 'pass' : 'fail',
     detail: secrecyOk
       ? `event-secrecy scan across ${events.length} records: allowed-key set {${[...ALLOWED_KEYS].join(', ')}}; forbidden-key hits 0; extra-key hits 0`
-      : `event-secrecy fault: forbiddenHits=${JSON.stringify(forbiddenHits.slice(0, 5))} extraKeyHits=${JSON.stringify(extraKeyHits.slice(0, 5))}`,
+      : `event-secrecy fault${seams.leakOn ? ' (mutation-run active: fixture shim reports PII-leak on)' : ''}: forbiddenHits=${JSON.stringify(forbiddenHits.slice(0, 5))} extraKeyHits=${JSON.stringify(extraKeyHits.slice(0, 5))}`,
   });
 
   return { results };

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/wrangler-seam.mjs

@@ -24,7 +24,7 @@
 // The probe also carries an additional AC-33108-1 result that
 // greps the fixture wrangler.toml for the two `[[durable_objects.bindings]]`
 // binding pairs (name/class_name) and the `[[migrations]]` block
-// (tag `"v1"` plus new_classes for both classes). That result is
+// (tag `"v1"` plus new_sqlite_classes for both classes). That result is
 // deterministic and does not require wrangler.
 //
 // Warn semantics per section 3.1 pass-with-skip: if the wrangler
@@ -73,10 +73,16 @@ async function greppedWranglerToml() {
   const hubNameHit = /name = "HUB"/.test(toml);
   const hubClassHit = /class_name = "HubObject"/.test(toml);
   const tagHit = /tag = "v1"/.test(toml);
-  const newClassesHit = /new_classes = \["SingleCellObject", "HubObject"\]/.test(toml);
+  const newClassesHit = /new_sqlite_classes = \["SingleCellObject", "HubObject"\]/.test(toml);
+  // Per the Cloudflare Durable Objects migrations page, key-value backed
+  // namespaces can no longer be created; only new_sqlite_classes mints one.
+  // The probe refuses a wrangler.toml that still asserts the deprecated keyword,
+  // so a re-shipped blueprint cannot silently regress to the old shape.
+  // Vendor: https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/
+  const deprecatedNewClassesRefused = !/(^|\n)\s*new_classes\s*=/.test(toml);
   return {
-    ok: cellNameHit && cellClassHit && hubNameHit && hubClassHit && tagHit && newClassesHit,
-    hits: { cellNameHit, cellClassHit, hubNameHit, hubClassHit, tagHit, newClassesHit },
+    ok: cellNameHit && cellClassHit && hubNameHit && hubClassHit && tagHit && newClassesHit && deprecatedNewClassesRefused,
+    hits: { cellNameHit, cellClassHit, hubNameHit, hubClassHit, tagHit, newClassesHit, deprecatedNewClassesRefused },
   };
 }
 
@@ -156,7 +162,7 @@ export default async function runProbe() {
     anchorAcId: 'AC-33108-1',
     verdict: toml.ok ? 'pass' : 'fail',
     detail: toml.ok
-      ? `wrangler.toml carries name="CELL" + class_name="SingleCellObject", name="HUB" + class_name="HubObject", and [[migrations]] tag "v1" with new_classes ["SingleCellObject","HubObject"]`
+      ? `wrangler.toml carries name="CELL" + class_name="SingleCellObject", name="HUB" + class_name="HubObject", and [[migrations]] tag "v1" with new_sqlite_classes ["SingleCellObject","HubObject"]`
       : `wrangler.toml grep miss: ${JSON.stringify(toml.hits)}`,
   });
 

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-001.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+    "field": "responsibilities.namespaceReady"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-002.json

@@ -2,7 +2,7 @@
   "reqId": "platform-cloudflare-durable-objects-REQ-002",
   "prdId": "PRD-001",
   "title": "The single-cell shape exposes typed domain verbs and serialises concurrent invocations per instance",
-  "description": "A named single-cell object exposes typed domain verbs (increment, read, reset). Cloudflare's documented Durable Objects consistency model serialises invocations against the same instance per https://developers.cloudflare.com/durable-objects/; the shipped SingleCellObject class realises that contract so a concurrent-increment probe observes the counter sum and one increment observed the other via a written witness.",
+  "description": "A named single-cell object exposes typed domain verbs (increment, read, reset). Cloudflare's documented Durable Objects consistency model serialises invocations against the same instance per https://developers.cloudflare.com/durable-objects/; the shipped SingleCellObject class realises that contract so a concurrent-increment probe observes the counter sum and one increment observed the other via a written witness. The single-cell shape realises the strongConsistencyCell capability token: every consumer that selects strongConsistencyCell inherits the per-instance FIFO serialisation and the typed domain-verb boundary this REQ describes.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T20:35:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+    "field": "responsibilities.serialise"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-003.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+    "field": "responsibilities.storage"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-004.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3403-platform-cloudflare-durable-objects-alarm-handler",
+    "field": "responsibilities.doAlarmFired"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-005.json

@@ -2,7 +2,7 @@
   "reqId": "platform-cloudflare-durable-objects-REQ-005",
   "prdId": "PRD-001",
   "title": "The hibernatable WebSocket hub accepts clients via state.acceptWebSocket and the wake handler runs from cold reading the same storage",
-  "description": "A named hub object accepts websocket clients via state.acceptWebSocket per Cloudflare's hibernatable WebSockets shape (https://developers.cloudflare.com/durable-objects/), routes each message to per-message handlers by JSON type field, and broadcasts to all connected sockets. On hibernate-and-wake the wake handler runs from a cold start and reads the same storage; the shipped hub class re-emits doWakeUp on the injected event sink on the first message after hibernation.",
+  "description": "A named hub object accepts websocket clients via state.acceptWebSocket per Cloudflare's hibernatable WebSockets shape (https://developers.cloudflare.com/durable-objects/), routes each message to per-message handlers by JSON type field, and broadcasts to all connected sockets. On hibernate-and-wake the wake handler runs from a cold start and reads the same storage; the shipped hub class re-emits doWakeUp on the injected event sink on the first message after hibernation. The applying project elicits the broadcast delivery window in milliseconds (do-hub-broadcast-window-ms; recommended default 500): every fan-out from a hub broadcast MUST (must) settle to every connected client, or record a partial delivery on the sink, within the elicited window. The applying project also elicits the hibernate-after-idle window per ADR-3405 (do-hub-hibernate-after-idle-ms; recommended default 30000): every hub instance MUST (must) enter the hibernated state after the elicited idle window elapses with no client activity, and MUST (must) wake from cold on the first post-hibernation message without losing lastBroadcast state. The hub shape realises the hibernatableWebSocket capability token: every consumer that selects hibernatableWebSocket inherits the accept-hibernate-wake cycle this REQ describes.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T20:35:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+    "field": "responsibilities.doWakeUp"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-006.json

@@ -2,7 +2,7 @@
   "reqId": "platform-cloudflare-durable-objects-REQ-006",
   "prdId": "PRD-001",
   "title": "Lifecycle events fire at namespace and object level with metadata-only payloads",
-  "description": "The facade and the objects emit lifecycle events on the injected event sink: namespaceReady (facade), doAccept, doAlarmFired, doWakeUp, doHibernate (object). Every payload is metadata-only ({event, key, size, ttl, timestamp, ?objectName, ?scheduledTime}); no message payloads, no request bodies, no PII cross the sink boundary. A logging companion renders records directly without a per-blueprint scrub pass.",
+  "description": "The facade and the objects emit lifecycle events on the injected event sink: namespaceReady (facade), doAccept, doAlarmFired, doWakeUp, doHibernate (object). Every payload is the metadata-only shape named on `TAC-3405-platform-cloudflare-durable-objects-event-sink.purpose` (event-record whitelist); no message payloads, no request bodies, no PII cross the sink boundary. A logging companion renders records directly without a per-blueprint scrub pass.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3405-platform-cloudflare-durable-objects-event-sink",
+    "field": "responsibilities.allowed"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-007.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+    "field": "responsibilities.env"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-008.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "adrId": "ADR-3404-platform-cloudflare-durable-objects-migrations-shape",
+    "field": "decision.migrations"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33101.json

@@ -16,12 +16,83 @@
       "when": "the process boots and the facade ready() call resolves",
       "then": "a namespaceReady event fires on the injected event sink with the metadata-only payload; no other module dereferences env.CELL or env.HUB",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33101-2",
+      "description": "F-4 namespace-unbound: createDoFacade({env:{HUB:{}}, sink}) with env.CELL absent throws a named error kind DO_NAMESPACE_UNBOUND naming the missing binding \"CELL\" before any sink event fires. No namespaceReady record lands on the sink; the throw is synchronous at factory time so the applying agent sees the failure at boot rather than at first call.",
+      "given": "a createDoFacade call whose env object lacks the CELL property",
+      "when": "the factory is invoked",
+      "then": "the factory throws DO_NAMESPACE_UNBOUND naming \"CELL\" and no namespaceReady event fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33101-3",
+      "description": "F-4 namespace-unbound (hub): createDoFacade({env:{CELL:{}}, sink}) with env.HUB absent throws DO_NAMESPACE_UNBOUND naming the missing binding \"HUB\" before any sink event fires. The two bindings are checked in a stable order (CELL then HUB) so the error names the first missing binding when both are absent.",
+      "given": "a createDoFacade call whose env object lacks the HUB property",
+      "when": "the factory is invoked",
+      "then": "the factory throws DO_NAMESPACE_UNBOUND naming \"HUB\" and no namespaceReady event fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33101-4",
+      "description": "Invalid sink at boot: the DO facade factory (per TAC-3401.interfaces.createDoFacade) called with a sink argument that is not a function throws DO_FACADE_INVALID_SINK before any binding is dereferenced. Same for the sink omitted or a non-function value; no ready-check runs.",
+      "given": "a createDoFacade call whose sink is not a function",
+      "when": "the factory is invoked",
+      "then": "the factory throws DO_FACADE_INVALID_SINK and no namespaceReady event fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33101-5",
+      "description": "Repeat-boot idempotency: two independent createDoFacade({env, sink}).ready() calls on the same env emit two namespaceReady records on the sink, both with identical payload shape {event:\"namespaceReady\", key:null, size:0, ttl:null, timestamp:<number>}; each record has its own timestamp. No accumulator drift across boots; no cellHandle or hubHandle state leaks between instances.",
+      "given": "two independent createDoFacade instances constructed with the same env and sink",
+      "when": "ready() is called on each in turn",
+      "then": "the sink receives two namespaceReady records with identical shape and independent timestamps",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33101-6",
+      "description": "Sole-reader boundary at boot: the src/do-facade.mjs module is the only module in the cf-platform fixture src/ tree that carries the literal substrings \"env.CELL\" or \"env.HUB\" outside comments. The wrangler-seam probe (US-33113) routes fetch requests through src/index.mjs which calls createDoFacade({env}) once, and that call site is the only \"env\" reference on src/index.mjs; the boundary check greps src/*.mjs and asserts the sole-reader claim before boot.",
+      "given": "the cf-platform fixture src/ tree at boot time",
+      "when": "a recursive scan strips comments and matches \"env.CELL\" and \"env.HUB\" against every .mjs file",
+      "then": "only src/do-facade.mjs contains the matches; src/index.mjs contains only the createDoFacade({env}) constructor call and no direct env.CELL / env.HUB dereference",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.solereader"
+      }
     }
   ],
   "tacIds": [
     "TAC-3401-platform-cloudflare-durable-objects-namespace-facade"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33102.json

@@ -16,12 +16,69 @@
       "when": "two increment(1) invocations fire concurrently and a read follows",
       "then": "the two increments resolve with counters {1, 2} in FIFO order, witnesses {0, 1}, and the final read returns 2",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33102-2",
+      "description": "N=10 concurrent increment(1) invocations against a named single-cell instance at initial counter 0 resolve to 10 {counter, witness} pairs whose counter values sorted equal [1,2,3,4,5,6,7,8,9,10] and whose witness values sorted equal [0,1,2,3,4,5,6,7,8,9]. Read after the batch returns counter 10. Per-instance FIFO holds across the whole batch: no witness or counter appears twice and no value is skipped.",
+      "given": "a SingleCellObject at counter 0 with the in-memory storage driver",
+      "when": "10 concurrent increment(1) calls fire and read() follows",
+      "then": "the 10 sorted counters equal [1..10]; the 10 sorted witnesses equal [0..9]; read returns 10",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.serialise"
+      }
+    },
+    {
+      "id": "AC-33102-3",
+      "description": "Mixed positive and negative deltas: two concurrent calls increment(+1) and increment(-1) against counter 5 resolve to counters in FIFO order (either [6, 5] or [4, 5]) with witnesses [5, 6] or [5, 4] respectively; the final read returns 5. The per-instance FIFO ordering means the second caller ALWAYS observes the first caller's write as its own witness, regardless of sign.",
+      "given": "a SingleCellObject at counter 5",
+      "when": "increment(+1) and increment(-1) fire concurrently and read follows",
+      "then": "the second-caller witness equals the first-caller counter; read returns 5",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.serialise"
+      }
+    },
+    {
+      "id": "AC-33102-4",
+      "description": "Zero-delta serialisation: an increment(0) against counter 3 resolves to {counter:3, witness:3}: the FIFO turn observes the current value as witness, the counter is unchanged. Concurrent increment(0) calls each observe the same witness AND the same counter, but each still occupies its own serialised turn (the FIFO promise queue advances by one per call).",
+      "given": "a SingleCellObject at counter 3",
+      "when": "two concurrent increment(0) calls fire",
+      "then": "both resolve with counter 3 and witness 3; the FIFO promise queue advances by two turns",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.serialise"
+      }
+    },
+    {
+      "id": "AC-33102-5",
+      "description": "Single caller identity: one increment(1) against counter 0 resolves to {counter:1, witness:0}, identical to the FIFO-first pair from AC-33102-1. A concurrent-of-one produces the same result as a sequential-of-one; the FIFO queue does not accumulate spurious state on a single-caller path.",
+      "given": "a SingleCellObject at counter 0",
+      "when": "one increment(1) call fires alone",
+      "then": "it resolves to {counter:1, witness:0}",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.serialise"
+      }
     }
   ],
   "tacIds": [
     "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33103.json

@@ -16,12 +16,87 @@
       "when": "put/get/delete/list operations are driven on each driver in turn",
       "then": "both round-trip identically and driver.backend reports \"sql\" and \"kv\" respectively",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-33103-2",
+      "description": "F-6 SQL-specific: a storage driver with {backend:\"sql\"} exposes a .query(sql, ...args) verb that runs a typed SQL statement against the DO SQLite backend; a driver with {backend:\"kv\"} has no .query verb (typeof driver.query === \"undefined\"). This aligns with the ADR-3403 backend-swap contract: SQL supports typed columns and query, KV is put/get/delete/list only.",
+      "given": "two storage drivers, one with backend \"sql\" and one with backend \"kv\"",
+      "when": "the .query property is inspected on each driver",
+      "then": "the SQL driver exposes .query as a function; the KV driver has no .query property",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      }
+    },
+    {
+      "id": "AC-33103-3",
+      "description": "F-6 KV-specific: a storage driver with {backend:\"kv\"} refuses a batch-write call driver.batch([...]) with a named error kind DO_STORAGE_UNSUPPORTED_ON_KV naming the operation. A driver with {backend:\"sql\"} accepts driver.batch([...]) and returns the batched writes. The refusal is a first-class boundary of the KV backend rather than a silent unavailability.",
+      "given": "a storage driver with backend \"kv\"",
+      "when": "driver.batch([{put:...}, {put:...}]) is called",
+      "then": "the driver throws DO_STORAGE_UNSUPPORTED_ON_KV naming \"batch\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      }
+    },
+    {
+      "id": "AC-33103-4",
+      "description": "F-7 write failure boundary: a driver.put(\"k\",\"v\") whose underlying backing store throws (simulated by a stubbed backing that rejects on put) surfaces the error unwrapped to the caller with a stable error kind DO_STORAGE_WRITE_FAILED whose message includes the key \"k\". No partial write persists (a subsequent get(\"k\") returns undefined). The write-failed event does not land on the DO event sink because the storage layer is under the single-cell, not the facade.",
+      "given": "a storage driver whose backing store put rejects synthetically",
+      "when": "driver.put(\"k\",\"v\") is called",
+      "then": "the call rejects with DO_STORAGE_WRITE_FAILED naming \"k\"; a subsequent get returns undefined",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      }
+    },
+    {
+      "id": "AC-33103-5",
+      "description": "Empty and maximal collection boundaries: driver.list({prefix:\"\"}) on an empty store returns an empty Map (size 0); driver.list({prefix:\"\"}) on a store with 100 keys returns a Map of size 100 with every key preserved. The list result is a Map, not an array, so key insertion order does not affect the assertion.",
+      "given": "a storage driver on an empty store and, separately, on a store with 100 keys",
+      "when": "driver.list({prefix:\"\"}) is called on each",
+      "then": "the empty store returns a Map of size 0; the populated store returns a Map of size 100",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      }
+    },
+    {
+      "id": "AC-33103-6",
+      "description": "Value-size boundary (vendor-cited): a put(\"k\", value) with value at 131072 bytes (the documented Cloudflare DO storage per-value cap of 128 KiB) succeeds and round-trips through get; a put(\"k\", value) with value at 131073 bytes refuses with DO_STORAGE_VALUE_TOO_LARGE naming the observed byte count and the vendor limit URL. On the KV backend the equivalent cap is 25 MiB per the Workers KV limit page; the driver reports the cap it enforces.",
+      "given": "a storage driver on the SQL backend with a 131072-byte value and, separately, a 131073-byte value",
+      "when": "put is called on each",
+      "then": "the 128 KiB value round-trips; the 131073-byte value refuses with DO_STORAGE_VALUE_TOO_LARGE naming the cap",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/platform/limits/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }