rcf-lite 0.25.0 → 0.27.0

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33104.json

@@ -11,17 +11,86 @@
   "acceptanceCriteria": [
     {
       "id": "AC-33104-1",
-      "description": "A SingleCellObject with setAlarm(offsetMs=100) fires alarm() when driven at the scheduled time. The alarm() handler runs exactly once, deletes the persisted alarm from storage (getAlarm() returns null after the fire) and emits a doAlarmFired event on the injected sink with {event, key, size, ttl, timestamp, objectName, scheduledTime} where objectName is the object's name and scheduledTime matches the setAlarm scheduled millis. A second call to alarm() on the drained storage does NOT emit a second doAlarmFired for the same schedule (the storage.getAlarm() returns null so the second fire records scheduledTime null).",
-      "given": "a SingleCellObject with setAlarm(100)",
-      "when": "alarm() is driven once and then again after the fire",
-      "then": "the first fire emits doAlarmFired with the scheduledTime; the second fire records scheduledTime null; storage.getAlarm() returns null after the first fire",
+      "description": "A SingleCellObject with setAlarm(offsetMs=100) fires alarm() when driven at the scheduled time. The alarm() handler runs exactly once, deletes the persisted alarm from storage (getAlarm() returns null after the fire) and emits EXACTLY ONE doAlarmFired event on the injected sink with {event, key, size, ttl, timestamp, objectName, scheduledTime} where objectName is the object's name and scheduledTime matches the setAlarm scheduled millis. A subsequent second call to alarm() on the drained storage is a no-op: getAlarm() returns null, the handler observes no schedule and returns without emitting a second doAlarmFired event. The drained-alarm contract is single-valued: one setAlarm invocation implies one alarm() fire implies one doAlarmFired record; a bare alarm() call with no persisted schedule emits nothing.",
+      "given": "a SingleCellObject wired with an in-process storage driver whose alarm() handler is driven manually",
+      "when": "setAlarm(offsetMs=100) is called, the clock advances 100ms, alarm() runs, then a second alarm() call runs against the drained storage",
+      "then": "the sink observes exactly one doAlarmFired record with the setAlarm scheduled millis; the second alarm() call emits nothing and getAlarm() returns null throughout",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3403-platform-cloudflare-durable-objects-alarm-handler",
+        "field": "interfaces.alarm"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33104-2",
+      "description": "F-4 alarm-invalid-offset: setAlarm(offsetMs=-1) refuses with a named error kind DO_ALARM_INVALID_OFFSET naming the offered value; no schedule persists; getAlarm() returns null. Same for offsetMs === 0 (a \"fire immediately\" schedule that would race the current invocation) refused with DO_ALARM_INVALID_OFFSET.",
+      "given": "a SingleCellObject with the in-memory storage driver",
+      "when": "setAlarm(-1) or setAlarm(0) is called",
+      "then": "the call throws DO_ALARM_INVALID_OFFSET; getAlarm returns null",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3403-platform-cloudflare-durable-objects-alarm-handler",
+        "field": "interfaces.SingleCellObject.setAlarm"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/api/alarms/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-33104-3",
+      "description": "F-4 alarm re-schedule: setAlarm(100) then setAlarm(200) before the first alarm fires overwrites the persisted schedule. The alarm() handler fires exactly once at the LATER scheduled time (200ms after original setAlarm(100)), the doAlarmFired record carries scheduledTime equal to the later scheduled millis, and no alarm fires at the earlier 100ms mark (the observer never sees a first fire).",
+      "given": "a SingleCellObject with the in-memory storage driver whose clock is fake",
+      "when": "setAlarm(100) then setAlarm(200) run, the clock advances 200ms, and the alarm handler drains",
+      "then": "exactly one doAlarmFired record carries the later scheduledTime; no earlier fire is observed",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3403-platform-cloudflare-durable-objects-alarm-handler",
+        "field": "interfaces.SingleCellObject.setAlarm"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/api/alarms/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-33104-4",
+      "description": "F-4 alarm-handler-failure: an alarm() invocation whose bound handler throws surfaces the error with a stable kind DO_ALARM_HANDLER_FAILED naming the wrapped error message; NO doAlarmFired record emits on the sink for that failed fire (the sink emits only on successful drain); a subsequent setAlarm(100)/alarm() cycle behaves normally, proving the failure isolates to the one fire and does not poison the alarm slot.",
+      "given": "a SingleCellObject whose alarm handler rejects on the first call",
+      "when": "setAlarm(100) fires and alarm() runs",
+      "then": "the call rejects with DO_ALARM_HANDLER_FAILED; the sink records zero doAlarmFired for this fire; a subsequent cycle emits doAlarmFired normally",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3403-platform-cloudflare-durable-objects-alarm-handler",
+        "field": "interfaces.SingleCellObject.alarm"
+      }
+    },
+    {
+      "id": "AC-33104-5",
+      "description": "deleteAlarm before fire: setAlarm(100) then deleteAlarm() drains the persisted schedule; getAlarm() returns null immediately; a subsequent alarm() invocation on the drained storage records no doAlarmFired and returns without side effect (per the drained-storage contract in AC-33104-1).",
+      "given": "a SingleCellObject with a scheduled alarm",
+      "when": "deleteAlarm() runs before the scheduled time and alarm() then runs",
+      "then": "getAlarm returns null; no doAlarmFired record emits; alarm returns without side effect",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3403-platform-cloudflare-durable-objects-alarm-handler",
+        "field": "interfaces.SingleCellObject.setAlarm"
+      }
     }
   ],
   "tacIds": [
     "TAC-3403-platform-cloudflare-durable-objects-alarm-handler"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33105.json

@@ -16,12 +16,83 @@
       "when": "a broadcast message is sent from A",
       "then": "both A and B receive the same broadcast within 500ms and storage.get(\"lastBroadcast\") returns the serialised payload",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33105-2",
+      "description": "F-4 broadcast-malformed: webSocketMessage(A, \"not-json-at-all\") on a HubObject with two accepted sockets does NOT fan out anything; the hub replies to A with an error frame carrying {type:\"error\", kind:\"HUB_MALFORMED_MESSAGE\"} and B receives nothing. storage.get(\"lastBroadcast\") stays at its prior value (or remains undefined on a fresh hub); no doBroadcast record emits.",
+      "given": "a HubObject with two accepted fake sockets A and B",
+      "when": "webSocketMessage(A, \"not-json-at-all\") is driven",
+      "then": "the hub sends A an error frame with kind HUB_MALFORMED_MESSAGE; B receives no message; lastBroadcast is unchanged",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "interfaces.HubObject"
+      }
+    },
+    {
+      "id": "AC-33105-3",
+      "description": "Empty-hub broadcast (zero connected clients): a HubObject with zero accepted sockets, when driven with an out-of-band broadcast API (state.broadcast) or an incoming HTTP fetch that carries a broadcast payload, still persists storage.lastBroadcast so a subsequent socket connect can catch up. No client message is emitted (nobody is listening); the persistence side effect is the only observable.",
+      "given": "a HubObject with zero accepted sockets",
+      "when": "a broadcast is driven through the hub API",
+      "then": "no client message emits; storage.get(\"lastBroadcast\") returns the serialised payload",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "responsibilities.lastBroadcast"
+      }
+    },
+    {
+      "id": "AC-33105-4",
+      "description": "Slow-socket isolation: a HubObject with three accepted sockets A, B and C where B's send() blocks (simulated by a promise that never settles), when driven with a broadcast from A, still delivers the broadcast to C within the elicited 500ms window. The hub does not await B; the slow socket is dropped from the broadcast fan-out for that message and a doBroadcastSocketSlow record emits naming the slow socket id.",
+      "given": "a HubObject with three sockets where B blocks",
+      "when": "A broadcasts",
+      "then": "C receives the broadcast within 500ms; a doBroadcastSocketSlow record names B's socket id",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "responsibilities.broadcast"
+      }
+    },
+    {
+      "id": "AC-33105-5",
+      "description": "N=10 concurrent broadcasts: a HubObject with two accepted sockets A and B, driven with 10 concurrent broadcasts from A, delivers 10 messages to B in the same order A issued them. Per-connection ordering is preserved (10 messages in A-issue-order); storage.get(\"lastBroadcast\") after the batch returns the 10th payload.",
+      "given": "a HubObject with two accepted sockets",
+      "when": "10 concurrent broadcasts from A fire",
+      "then": "B receives 10 messages in issue order; lastBroadcast returns the 10th payload",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "responsibilities.broadcast"
+      }
+    },
+    {
+      "id": "AC-33105-6",
+      "description": "F-4 hub-unknown-type: webSocketMessage(A, JSON.stringify({type:\"nonsense\"})) on a HubObject does NOT change storage; the hub replies to A with an error frame carrying {type:\"error\", kind:\"HUB_UNKNOWN_MESSAGE_TYPE\"} naming the unknown type; B receives nothing; storage.get(\"lastBroadcast\") is unchanged.",
+      "given": "a HubObject with two accepted sockets",
+      "when": "A sends a message whose type is not broadcast|set-state|get-state",
+      "then": "A receives an HUB_UNKNOWN_MESSAGE_TYPE error frame; B receives nothing; storage is unchanged",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "interfaces.HubObject"
+      }
     }
   ],
   "tacIds": [
     "TAC-3404-platform-cloudflare-durable-objects-websocket-hub"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33106.json

@@ -16,12 +16,59 @@
       "when": "the event-secrecy probe runs on the shipped code path",
       "then": "every record contains only allowed keys; the forbidden-key scan finds zero hits; SIMULATE_PII_LEAK=true surfaces the injected fields",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33106-2",
+      "description": "Allow-list mutation: a wrapper sink that adds a top-level \"requestId\" key onto every record trips the layer-1 forbidden-key scan (requestId is not in the allow-list). The event-secrecy probe surfaces the key by name and returns aggregateVerdict:\"fail\". Under SIMULATE_PII_LEAK=false (the shipped path) no wrapper is in play and the scan returns zero forbidden hits.",
+      "given": "the event-secrecy probe under SIMULATE_PII_LEAK=true with a wrapper adding \"requestId\" onto every record",
+      "when": "the layer-1 scan runs on the accumulated records",
+      "then": "the scan surfaces \"requestId\" as a forbidden key; aggregateVerdict is \"fail\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3405-platform-cloudflare-durable-objects-event-sink",
+        "field": "responsibilities.allowList"
+      }
+    },
+    {
+      "id": "AC-33106-3",
+      "description": "Closure-over-fixture: a hub handler that captures a PII fixture ({userId:12345, ssn:\"REDACTED-fixture\"}) via a JavaScript closure and mutates a scratch object each call still produces sink records whose JSON serialisation contains no \"12345\" and no \"REDACTED-fixture\" substring. Layer-2 substring scan returns zero hits on the shipped path (SIMULATE_PII_LEAK=false).",
+      "given": "a hub handler closing over a PII fixture on the shipped path",
+      "when": "the event-secrecy probe runs a broadcast that triggers the handler",
+      "then": "the layer-2 substring scan on the emitted records returns zero hits for the PII substrings",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3405-platform-cloudflare-durable-objects-event-sink",
+        "field": "responsibilities.allowList"
+      }
+    },
+    {
+      "id": "AC-33106-4",
+      "description": "Empty-payload boundary: a broadcast with an empty body ({type:\"broadcast\", payload:\"\"}) still emits doBroadcast records on the sink carrying the required allow-list keys (event, key, size:0, ttl:null, timestamp:<number>, objectName:<hub id>). No allow-list key is silently omitted when the payload is empty; size reports 0 rather than undefined.",
+      "given": "a HubObject broadcasting an empty payload",
+      "when": "the sink is inspected after the broadcast",
+      "then": "the doBroadcast record carries every required allow-list key with size:0 (never undefined)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3405-platform-cloudflare-durable-objects-event-sink",
+        "field": "responsibilities.allowList"
+      }
     }
   ],
   "tacIds": [
     "TAC-3405-platform-cloudflare-durable-objects-event-sink"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33107.json

@@ -16,12 +16,55 @@
       "when": "the sole-reader-scan probe runs",
       "then": "the clean-fixture pass reports zero non-facade leaks; the simulate pass surfaces the injected leak and returns fail",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33107-2",
+      "description": "Comment-only mention: a JSDoc block or line comment on any non-facade module that mentions \"env.CELL\" or \"env.HUB\" (for documentation or a cross-reference) does NOT trip the scan. The probe strips block comments (/* ... */) and line comments (// ...) before matching literals; a synthetic scratch file with only a commented mention returns zero leaks.",
+      "given": "a scratch fixture module carrying only a commented mention of env.CELL",
+      "when": "the sole-reader-scan probe walks the fixture",
+      "then": "the file is not reported as a leak; the leak count is zero",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.solereader"
+      }
+    },
+    {
+      "id": "AC-33107-3",
+      "description": "Nested-directory recursion: a leak in a nested path (e.g. src/handlers/deep/leak.mjs) with a real env.CELL dereference is caught by the probe. The scan walks the src/ tree recursively and reports the full relative path of every leaking file.",
+      "given": "a synthetic src/handlers/deep/leak.mjs carrying a real env.CELL dereference",
+      "when": "the sole-reader-scan probe walks the tree",
+      "then": "the probe reports src/handlers/deep/leak.mjs as a leak and returns aggregateVerdict \"fail\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.solereader"
+      }
+    },
+    {
+      "id": "AC-33107-4",
+      "description": "Extension filter: the scan matches only .mjs, .js and .ts files. A .txt or .md file with a literal env.CELL substring (a README example, a config sample) is NOT scanned and does not flag; a .json fixture with an env.CELL string value is also not scanned.",
+      "given": "a scratch tree with env.CELL literals in .txt, .md and .json files",
+      "when": "the sole-reader-scan probe walks the tree",
+      "then": "no leak is reported; the extension filter excludes non-source files",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.solereader"
+      }
     }
   ],
   "tacIds": [
     "TAC-3401-platform-cloudflare-durable-objects-namespace-facade"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33108.json

@@ -11,17 +11,98 @@
   "acceptanceCriteria": [
     {
       "id": "AC-33108-1",
-      "description": "The fixture wrangler.toml carries at least two [[durable_objects.bindings]] blocks (one binding named CELL with class_name SingleCellObject; one binding named HUB with class_name HubObject) and at least one [[migrations]] block with tag \"v1\" and new_classes = [\"SingleCellObject\", \"HubObject\"]. An anatomy assertion greps the toml for each of the four literal strings (name = \"CELL\", class_name = \"SingleCellObject\", name = \"HUB\", class_name = \"HubObject\") and the tag/new_classes pair. A rename in a real project ships as a new migrations tag entry, never a silent edit of the class name.",
+      "description": "The fixture wrangler.toml carries at least two [[durable_objects.bindings]] blocks (one binding named CELL with class_name SingleCellObject; one binding named HUB with class_name HubObject) and at least one [[migrations]] block with tag \"v1\" and new_sqlite_classes = [\"SingleCellObject\", \"HubObject\"]. An anatomy assertion greps the toml for each of the four literal strings (name = \"CELL\", class_name = \"SingleCellObject\", name = \"HUB\", class_name = \"HubObject\") and the tag/new_sqlite_classes pair. A rename in a real project ships as a new migrations tag entry, never a silent edit of the class name.",
       "given": "the cf-platform fixture wrangler.toml",
       "when": "the anatomy assertion greps for the four literal strings and the migrations pair",
       "then": "every string is present and the migrations tag \"v1\" carries the two class names",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/",
+        "verifiedOn": "2026-09-09"
+      },
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.migrationsTag"
+      }
+    },
+    {
+      "id": "AC-33108-2",
+      "description": "Rename-as-new-migration-tag: a wrangler.toml carrying a second [[migrations]] block with tag=\"v2\" and renamed_classes=[{from:\"SingleCellObject\", to:\"CellObjectV2\"}], with the [[durable_objects.bindings]] class_name updated to CellObjectV2, is a valid rename. The anatomy assertion accepts: it greps for tag=\"v2\" and renamed_classes, and asserts the v1 migration still records the original class name for history.",
+      "given": "a wrangler.toml with two migrations tags (v1 with new_sqlite_classes, v2 with renamed_classes) and updated binding class_name",
+      "when": "the anatomy assertion parses the toml",
+      "then": "both tags are present, renamed_classes points from the v1 class to the v2 class, and the binding class_name matches the v2 target",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.migrationsTag"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-33108-3",
+      "description": "Silent class rename refuses: a wrangler.toml where the [[durable_objects.bindings]] class_name has changed from \"SingleCellObject\" to \"CellObjectV2\" but no new [[migrations]] tag records the rename is a defect. The anatomy assertion detects the mismatch (a class named on a binding that does not appear in any migration record) and refuses with DO_MIGRATION_RENAME_UNRECORDED naming the class name.",
+      "given": "a wrangler.toml whose binding class_name is not recorded in any migrations tag",
+      "when": "the anatomy assertion runs",
+      "then": "the assertion refuses with DO_MIGRATION_RENAME_UNRECORDED naming the class",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.migrationsTag"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-33108-4",
+      "description": "Missing migrations block: a wrangler.toml with [[durable_objects.bindings]] blocks but no [[migrations]] block refuses at the anatomy assertion with DO_MIGRATION_BLOCK_MISSING; the deploy would fail at Cloudflare mint time (a namespace cannot exist without a migration recording the class).",
+      "given": "a wrangler.toml with binding blocks and no migrations block",
+      "when": "the anatomy assertion runs",
+      "then": "the assertion refuses with DO_MIGRATION_BLOCK_MISSING",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.migrationsTag"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-33108-5",
+      "description": "Stale keyword refuses: a wrangler.toml whose [[migrations]] tag uses new_classes = [...] instead of new_sqlite_classes = [...] refuses at the anatomy assertion with DO_MIGRATION_KEYWORD_STALE naming the deprecated keyword and the vendor URL. Per the cited Cloudflare migrations page, key-value backed namespaces can no longer be created; only new_sqlite_classes mints a fresh namespace.",
+      "given": "a wrangler.toml whose migrations tag uses the deprecated new_classes keyword",
+      "when": "the anatomy assertion runs",
+      "then": "the assertion refuses with DO_MIGRATION_KEYWORD_STALE naming the vendor page and today's verifiedOn date",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.migrationsTag"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3401-platform-cloudflare-durable-objects-namespace-facade"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T23:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33109.json

@@ -16,12 +16,55 @@
       "when": "two concurrent increments fire",
       "then": "the FIFO-first increment returns witness 0, the second returns witness 1, and read returns 2",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33109-2",
+      "description": "read() has no witness field: a SingleCellObject at counter 3 driven with read() resolves to a bare number 3, not an object; there is no witness field on a read result. The witness is a per-increment observable, tied to serialisation, and does not apply to a pure read that does not advance the FIFO queue.",
+      "given": "a SingleCellObject at counter 3",
+      "when": "read() is called",
+      "then": "the result is the primitive number 3 (no witness field, no object wrapping)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.serialise"
+      }
+    },
+    {
+      "id": "AC-33109-3",
+      "description": "reset() has no witness field: a reset() call against a SingleCellObject at counter 5 resolves to the primitive number 0 (the reset value); no witness field. reset advances the FIFO turn but its return contract mirrors read, not increment.",
+      "given": "a SingleCellObject at counter 5",
+      "when": "reset() is called",
+      "then": "the result is the primitive number 0 (no witness field)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.serialise"
+      }
+    },
+    {
+      "id": "AC-33109-4",
+      "description": "N=100 concurrent increments: 100 concurrent increment(1) calls at initial counter 0 resolve to 100 {counter, witness} pairs. Sorted witnesses equal [0..99] exactly (no gaps, no duplicates); sorted counters equal [1..100]. read() after the batch returns 100. The FIFO queue holds under high concurrency.",
+      "given": "a SingleCellObject at counter 0",
+      "when": "100 concurrent increment(1) calls fire and read follows",
+      "then": "sorted witnesses equal [0..99]; sorted counters equal [1..100]; read returns 100",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.serialise"
+      }
     }
   ],
   "tacIds": [
     "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33110.json

@@ -16,12 +16,69 @@
       "when": "wake() is called once, then again",
       "then": "the first wake emits doWakeUp once and returns lastBroadcast; the second wake reports alreadyAwake without a second event",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33110-2",
+      "description": "F-5 cold-start reconstruction: after a broadcast has been processed and hibernate has fired, a fresh HubObject INSTANCE constructed against the same storage (simulating Cloudflare's wake-on-message: the pre-hibernate instance is discarded and a new one is minted from cold), when wake() is called, reads lastBroadcast from storage and returns {lastBroadcast: <same serialised payload>}; doWakeUp fires exactly once on the fresh instance's sink. The reconstruction happens over the same durable storage, not over transferred in-memory state.",
+      "given": "a fresh HubObject instance constructed against a storage that carries a persisted lastBroadcast",
+      "when": "wake() is called on the fresh instance",
+      "then": "wake returns lastBroadcast equal to the persisted value; doWakeUp emits once",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "responsibilities.hibernate"
+      }
+    },
+    {
+      "id": "AC-33110-3",
+      "description": "F-5 wake-on-message: a hibernated HubObject that receives a webSocketMessage during the hibernation window queues the message, wakes (doWakeUp emits once), reads the same storage, processes the queued message (e.g. a broadcast) and delivers to any connected sockets. The message is not dropped; the wake handler runs to completion before the message handler.",
+      "given": "a hibernated HubObject with the message arriving from a re-emerging client",
+      "when": "the driver delivers the webSocketMessage to the hibernated instance",
+      "then": "wake fires, storage is read, and the message is processed after wake completes",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "responsibilities.hibernate"
+      }
+    },
+    {
+      "id": "AC-33110-4",
+      "description": "Hibernate-before-broadcast: a HubObject that has hibernated without ever processing a broadcast persists no lastBroadcast key. wake() on the reconstructed instance returns {lastBroadcast: null} (not undefined; the field is present) and doWakeUp still emits exactly once.",
+      "given": "a HubObject that hibernated without any broadcast",
+      "when": "wake() is called on the reconstructed instance",
+      "then": "wake returns lastBroadcast:null with the field present; doWakeUp emits once",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "responsibilities.hibernate"
+      }
+    },
+    {
+      "id": "AC-33110-5",
+      "description": "Repeated hibernate-and-wake cycles: two hibernate + wake cycles on the same instance produce exactly two doHibernate and two doWakeUp records on the sink, alternating in strict order (hibernate1, wake1, hibernate2, wake2). No cycle produces duplicate records; the idempotent-by-contract guarantee (ADR-3405) holds per cycle.",
+      "given": "a HubObject driven through two hibernate + wake cycles",
+      "when": "the sink is inspected after the second wake",
+      "then": "the sink records exactly two doHibernate and two doWakeUp in strict order",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "responsibilities.hibernate"
+      }
     }
   ],
   "tacIds": [
     "TAC-3404-platform-cloudflare-durable-objects-websocket-hub"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33111.json

@@ -16,12 +16,55 @@
       "when": "the returned drivers are inspected",
       "then": "each driver.backend reports the elicited answer or the default \"sql\"",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33111-2",
+      "description": "F-6 SQL exposes query verbs: createInMemoryDoStorage({backend:\"sql\"}) returns a driver where typeof driver.query === \"function\" and typeof driver.exec === \"function\". createInMemoryDoStorage({backend:\"kv\"}) returns a driver where those properties are undefined; the KV surface is put/get/delete/list only. The verb set observable on the driver instance reflects the elicited backend.",
+      "given": "a SQL driver and a KV driver from the factory",
+      "when": "their verb sets are inspected",
+      "then": "the SQL driver has .query and .exec as functions; the KV driver does not",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      }
+    },
+    {
+      "id": "AC-33111-3",
+      "description": "F-6 KV refusal error kind: calling .query() on a KV driver throws DO_STORAGE_UNSUPPORTED_ON_KV naming the verb \"query\"; calling .exec() throws with naming \"exec\". The error message identifies the driver.backend value (\"kv\") so the caller can distinguish which backend refused.",
+      "given": "a KV driver from the factory",
+      "when": ".query() or .exec() is called",
+      "then": "the call throws DO_STORAGE_UNSUPPORTED_ON_KV naming the verb and the backend",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      }
+    },
+    {
+      "id": "AC-33111-4",
+      "description": "Unknown backend refuses: createInMemoryDoStorage({backend:\"redis\"}) throws DO_STORAGE_UNKNOWN_BACKEND naming the offered value \"redis\"; the accepted values (\"sql\" and \"kv\") are listed in the message. No driver is returned.",
+      "given": "a factory call with backend \"redis\"",
+      "when": "the factory is invoked",
+      "then": "the factory throws DO_STORAGE_UNKNOWN_BACKEND naming \"redis\" and listing \"sql\" and \"kv\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      }
     }
   ],
   "tacIds": [
     "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }