rcf-lite 0.26.0 → 0.28.0

package/blueprints/platform-cloudflare-durable-objects/CHANGELOG.md

@@ -2,10 +2,46 @@
 
 All notable changes to `platform-cloudflare-durable-objects` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
 
-## 1.0.1 (2026-09-08)
+## 1.1.3 - 2026-09-10
+
+Positive-evidence rule alignment on the probe pack skip path (authoring standard section 7d), plus a register patch.
+
+- Probes: the account-bound skip returns on `contributions/probes/real-account-storage-smoke.mjs` now carry a `reason` field naming the exact env var(s) that were unset (`CI_HAS_CLOUDFLARE_ACCOUNT` on the standard skip path; `CF_DO_WORKER_URL` on the second-tier declared skip when the account env is set). Skip-path probe report regenerated so the shipped shape carries the new field.
+- Neutral register in ADR-3401 consequences (F-2), README (F-3) and guide prose (F-4).
+
+## 1.1.2 - 2026-09-10
+
+Owner reference for the DO event-record whitelist.
+
+- Rewrote REQ-006 description to reference the owning TAC field (`TAC-3405-platform-cloudflare-durable-objects-event-sink.purpose`) for the DO event-record whitelist, rather than restating the shape verbatim.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+
+## 1.1.0 (2026-09-09)
 
-H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch. No capability change.
+### Changed
+
+- Family ruling (2026-09-09): Per the Cloudflare Durable Objects migrations page verified 2026-09-09, key-value backed namespaces can no longer be created; only new_sqlite_classes mints a fresh namespace. Every surface owned by this blueprint that named the deprecated `new_classes` migration keyword moves to `new_sqlite_classes`: the guide (blocks around lines 110-124 and 206), `AC-33108-1` on US-33108, `AC-33113-1` on US-33113, the README probe row for `wrangler-seam`, the anatomy test at `packages/rcf-lite/test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js`, the test fixture `packages/rcf-lite/test/fixtures/cf-platform/wrangler.toml`, and the probe literal at `contributions/probes/wrangler-seam.mjs` (the probe now refuses a wrangler.toml that still carries the deprecated `new_classes` keyword). The committed `.rcf/reports` envelope and `packages/rcf-lite/test/view/fixtures/phase-3-6-static.html` also bind the old literal and are not touched by this pass; they are named under NOT VERIFIED on the accompanying evidence summary.
+- `platform-cloudflare-durable-objects-REQ-005` extended to name the elicited `do-hub-broadcast-window-ms` delivery window and the elicited `do-hub-hibernate-after-idle-ms` window; closes criterion a on the previously unbacked elicits (F-1, F-2).
+- `AC-33113-1` reworded to call the injected facade parameter `sink` (no longer restates `eventSink` owned by TAC-3405's interface); no behavioural change in the shipped code path. `AC-33104-1`, `AC-33106-1` and `AC-33113-1` carry `ownerRef`; every existing AC carries `disposition`. Every REQ carries `deliveredBy` (eight links, seven TAC-scoped and one ADR-scoped).
+- Guide casing correction: `SINGLE-CELL` -> `single-cell` (contract-drift against TAC-3402.purpose per pass-1 lint).
+- `rcf define blueprint lint-consistency` reports zero pass-1 and pass-2 findings.
+
+### Added
+
+- Every story on this blueprint now reaches the section 7a AC-set-sufficiency floor. 50 new hand-authored ACs cover the documented failure paths named in the guide and TAC records, per-story range 4-6: US-33101 gains five failure-path ACs (env.CELL unbound closing the namespace gap, env.HUB unbound, invalid sink, repeat-boot idempotency, sole-reader boundary); US-33102 gains four ACs (N=10 concurrent, mixed +1/-1 deltas, zero-delta, single-caller identity); US-33103 gains five ACs (SQL query surface exists, KV batch refuses KV, driver write failure with kind DO_STORAGE_WRITE_FAILED closing the write gap, empty/populated list boundaries, 128 KiB vendor-cited value cap with vendor URL); US-33104 gains four ACs (setAlarm(-1) refuses closing the alarm gap, re-schedule overwrites, handler-throw isolates with DO_ALARM_HANDLER_FAILED, deleteAlarm before fire); US-33105 gains five ACs (malformed message closing the hub gap, empty-hub persistence, slow-socket isolation, N=10 concurrent broadcasts, unknown message type); US-33106 gains three ACs (allow-list mutation, no fixture-state carry between cases, empty-payload boundary); US-33107 gains three ACs (comment-only mention, nested-directory recursion, extension filter); US-33108 gains four ACs (rename-as-new-migration-tag, silent-rename refuses, missing migrations block, stale new_classes keyword vendor-cited); US-33109 gains three ACs (read has no witness, reset has no witness, N=100 concurrent); US-33110 gains four ACs (cold-start reconstruction, wake-on-message closing the second gap half, hibernate-before-broadcast, repeated cycles idempotency); US-33111 gains three ACs (SQL query verbs SQL, KV refusal kind, unknown backend refuses); US-33112 gains three ACs (bounded-wait timeout, partial env-vars, non-2xx API response); US-33113 gains four ACs (wrangler-not-installed warn, bind-timeout warn, workerd-handler-throws fail, teardown discipline). Every new AC carries `disposition`, most carry `ownerRef` into the owning TAC, and vendor-fact ACs carry `vendorCitation` (migrations page, DO overview, DO limits, DO alarms, DO websockets).
+
+### Fixed
+
+- `AC-33108-1` gains `vendorCitation` to the Cloudflare Durable Objects migrations page so the vendor-fact leader carries a citation alongside `AC-33108-2..4`.
+- `AC-33108-5` states what the cited vendor page carries: key-value backed namespaces can no longer be created; only `new_sqlite_classes` mints a fresh namespace.
+
+## 1.0.1 (2026-09-08)
 
+Probe-integrity patch (`h2-cf-platform-probe-integrity`). No capability change.
 ### Changed
 
 - Replaced the credential-readiness pass-stub in `real-account-storage-smoke.mjs` with a real HTTP PUT-then-GET storage round-trip driver against a deployed Worker route (`/cell/:id/storage/:key`) that opens the DO facade, writes a fixture key, reads it back, and asserts byte equality. Activated when `CI_HAS_CLOUDFLARE_ACCOUNT` is set with `CF_DO_WORKER_URL`, `CF_ACCOUNT_ID`, `CF_DO_NAMESPACE_ID` and `CF_API_TOKEN`. Locally proven against `wrangler dev --local` (64-byte round-trip byte-equal). A pass is no longer reachable from credential presence alone.
@@ -26,8 +62,8 @@ H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch. N
 - 8 Node-only probes under `contributions/probes/`: `namespace-facade-ready` (facade opens and emits namespaceReady with metadata-only payload), `single-cell-concurrent-increment` (two concurrent increments serialise FIFO; also folds AC-33109-1 witness field), `storage-round-trip` (both sql and kv backends; also folds AC-33111-1 default backend), `alarm-fires-once` (once-per-schedule contract with drained storage), `websocket-hub-broadcast` (fan-out within window; folds AC-33110-1 hibernate-and-wake and AC-33106-1 event-secrecy on the shipped path with SIMULATE_PII_LEAK=true mutation), `sole-reader-scan` (source-tree scan of the applied source root with comment-stripping; folds SIMULATE_NON_FACADE_IMPORT=true mutation), `real-account-storage-smoke` (`accountBound: true`; records `accountBoundSkipped` in CI without `CI_HAS_CLOUDFLARE_ACCOUNT` per spec section 3.5), and `wrangler-seam` (drives `wrangler dev --local` on the fixture; two concurrent POST /cell/<id>/increment requests through the DO facade reaching env.CELL observe per-instance serialisation; one WebSocket upgrade against /hub/<id>/connect through the facade reaching env.HUB receives one broadcast frame; additional AC-33108-1 result on the same run greps wrangler.toml for both binding pairs and the migrations tag/new_classes; warn semantics per section 3.1 pass-with-skip if wrangler is missing or fails to bind).
 - 7 elicited parameters on `blueprint.json`: `do-cell-binding` (default `CELL`), `do-hub-binding` (default `HUB`), `do-cell-class-name` (default `SingleCellObject`), `do-hub-class-name` (default `HubObject`), `do-storage-backend` (default `sql` per ADR-3403), `do-hub-broadcast-window-ms` (default `500`), `do-hub-hibernate-after-idle-ms` (default `30000` per ADR-3405).
 - `suggestedCompanions`: `logging` (for the lifecycle-event sink) and `errorHandling` (for the handler-failure boundary).
-- Extends the shared `cf-platform` sample-app fixture with the `[[durable_objects.bindings]]` blocks (one binding named `CELL` with `class_name` `SingleCellObject`, one binding named `HUB` with `class_name` `HubObject`), the paired `[[migrations]]` block with `tag = "v1"` and `new_classes = ["SingleCellObject", "HubObject"]`, the sole-reader DO facade (`src/do-facade.mjs`), the single-cell class (`src/do-single-cell.mjs`), the hub class (`src/do-hub.mjs`), and the in-memory DO storage driver (`src/do-storage.mjs`) realising both sql and kv backends. The T-0 `[assets]`, T-1 `[[kv_namespaces]]` and T-2 `[triggers]` crons blocks are preserved verbatim; the facade does NOT dereference `env.CACHE` (KV binding stays owned by the T-1 KV facade).
-- Anatomy test at `packages/rcf-lite/test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js` covers `TS-100..109` on the T-3 chain slice plus the wrangler-seam probe module shape (TC-wrangler-seam-shape) that binds AC-33113-1 to the shipped probe file (blueprint shape, contributions cross-check, probe module contracts, fixture files, ADR bodies and clauses, guide sections and URLs, two-mint-topic scope entries).
+- Extends the shared `cf-platform` sample-app fixture with the `[[durable_objects.bindings]]` blocks (one binding named `CELL` with `class_name` `SingleCellObject`, one binding named `HUB` with `class_name` `HubObject`), the paired `[[migrations]]` block with `tag = "v1"` and `new_classes = ["SingleCellObject", "HubObject"]`, the sole-reader DO facade (`src/do-facade.mjs`), the single-cell class (`src/do-single-cell.mjs`), the hub class (`src/do-hub.mjs`), and the in-memory DO storage driver (`src/do-storage.mjs`) realising both sql and kv backends. The `[assets]`, `[[kv_namespaces]]` and `[triggers]` crons blocks are preserved verbatim; the facade does NOT dereference `env.CACHE` (KV binding stays owned by the KV facade).
+- Anatomy test at `packages/rcf-lite/test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js` covers `TS-100..109` on the chain slice plus the wrangler-seam probe module shape (TC-wrangler-seam-shape) that binds AC-33113-1 to the shipped probe file (blueprint shape, contributions cross-check, probe module contracts, fixture files, ADR bodies and clauses, guide sections and URLs, two-mint-topic scope entries).
 
 ### Known limitations
 

package/blueprints/platform-cloudflare-durable-objects/README.md

@@ -23,7 +23,7 @@ scope-global ADRs on new topics.
 - Coordinated multiplayer websocket connections in one authoritative
   hub (rooms, live cursors, presence): the hub shape.
 
-The sibling `platform-cloudflare-kv` (round 6 T-1) is the shipped
+The sibling `platform-cloudflare-kv` is the shipped
 answer for eventually-consistent low-latency reads. The guide's
 decision tree pairs them.
 
@@ -36,7 +36,7 @@ decision tree pairs them.
 - Do you need cache-shaped read-hot reads with no strong-consistency
   contract? Reach for `platform-cloudflare-kv` instead.
 - Do you need durable multi-step workflows with retries and state
-  across steps? Reach for the round-6 Workflows adapter on
+  across steps? Reach for the Workflows adapter on
   `jobs-background` v1.1.0 instead.
 
 ## The eight REQs
@@ -115,7 +115,7 @@ under the fixture root.
 | `websocket-hub-broadcast.mjs` | `AC-33105-1` | false | Broadcast from A reaches A and B within 500 ms; storage persists `lastBroadcast`. Also covers `AC-33110-1` (hibernate-and-wake) and `AC-33106-1` (event-secrecy on the shipped path). |
 | `sole-reader-scan.mjs` | `AC-33107-1` | false | Every `.mjs`/`.js`/`.ts` file under the fixture applied source root is scanned; only `src/do-facade.mjs` may dereference `env.CELL` or `env.HUB` in live source. |
 | `real-account-storage-smoke.mjs` | `AC-33112-1` | true | Facade round-trip against a real Cloudflare DO namespace when `CI_HAS_CLOUDFLARE_ACCOUNT=true`; otherwise records `accountBoundSkipped` and passes per spec section 3.5. |
-| `wrangler-seam.mjs` | `AC-33113-1` | false | Spawns `wrangler dev --local` on the fixture and drives two concurrent `POST /cell/<id>/increment` requests through the DO facade against `env.CELL`, asserting per-instance serialisation (counters `[1, 2]`, witnesses `[0, 1]`); opens one WebSocket upgrade against `/hub/<id>/connect` through the facade against `env.HUB`, asserting one broadcast frame arrives on connect. Also carries an additional `AC-33108-1` result that greps `wrangler.toml` for both binding pairs and the migrations tag/new_classes. Warn semantics per section 3.1 pass-with-skip if wrangler is not installed or fails to bind. |
+| `wrangler-seam.mjs` | `AC-33113-1` | false | Spawns `wrangler dev --local` on the fixture and drives two concurrent `POST /cell/<id>/increment` requests through the DO facade against `env.CELL`, asserting per-instance serialisation (counters `[1, 2]`, witnesses `[0, 1]`); opens one WebSocket upgrade against `/hub/<id>/connect` through the facade against `env.HUB`, asserting one broadcast frame arrives on connect. Also carries an additional `AC-33108-1` result that greps `wrangler.toml` for both binding pairs and the migrations tag/new_sqlite_classes. Warn semantics per section 3.1 pass-with-skip if wrangler is not installed or fails to bind. |
 
 ## Two-line gate-reviewer boot
 
@@ -137,7 +137,7 @@ records `accountBoundSkipped: true` without the CI env var per
 spec section 3.5.
 
 The wrangler-dev boot (documented in the fixture README
-under the T-3 sections) is required for the eighth probe
+under the sections) is required for the eighth probe
 (`wrangler-seam.mjs`), which spawns `wrangler dev --local` on
 the fixture to drive the shipped DO facade + SingleCellObject +
 HubObject code path against a real workerd runtime. The six
@@ -176,7 +176,7 @@ future v1.1.0 grows the mechanism inside the same blueprint.
 
 If your project needs eventually-consistent low-latency reads on
 a read-hot path (feature flags, session cache, config cache),
-reach for `platform-cloudflare-kv` (round 6 T-1) instead. Durable
+reach for `platform-cloudflare-kv` instead. Durable
 Objects owns the strong-consistency slot on the shelf; KV owns
 the cache-shaped eventually-consistent slot. Both compose on the
 same Worker.
@@ -193,7 +193,7 @@ same Worker.
   this topic.
 
 Both topics are `scope: global` on the ADR contribution entries in
-`blueprint.json`; the round-2 conflict pattern applies.
+`blueprint.json`; the standard conflict pattern applies.
 
 ## References
 

package/blueprints/platform-cloudflare-durable-objects/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "platform-cloudflare-durable-objects",
-  "version": "1.0.1",
+  "version": "1.1.3",
   "category": "platform",
   "capabilities": [
     "strongConsistencyCell",
@@ -239,5 +239,6 @@
       "elicited": true,
       "standardsTraceClause": "generic enterprise practice"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-10T00:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/adrs/adr-3401-platform-cloudflare-durable-objects-single-cell-contract.json

@@ -7,7 +7,7 @@
   "title": "Single-cell contract: Cloudflare Durable Objects authoritative-cell shape (scope global, new topic strongConsistencyCellContract)",
   "context": "An applying Workers project has one native strong-consistency answer today: Cloudflare Durable Objects. The DO runtime serialises invocations against a named instance per https://developers.cloudflare.com/durable-objects/, providing the authoritative-cell shape a counter, session store or lock needs. Two shapes ship in this blueprint (single-cell and websocket-hub) per spec section 5.3; both share the DO namespace mechanic. The single-cell shape is the one project-wide answer to strongConsistencyCellContract; a future non-Cloudflare adapter (a Postgres advisory-lock singleton, a Redis single-master pattern) would conflict on the same topic.",
   "decision": "The shipped v1.0.0 default is a Cloudflare Durable Object named instance behind the DO facade (env.CELL), realising the single-cell shape per REQ-002 and TAC-3402. The strongConsistencyCellContract topic scope is global on this blueprint; the topic string is strongConsistencyCellContract (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause). A future non-Cloudflare adapter would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR.",
-  "consequences": "The applying project inherits Cloudflare's documented DO consistency model, the platform-assigned per-object limits (https://developers.cloudflare.com/durable-objects/), and the migration-safe class-export contract (REQ-008). Standards trace clause: Cloudflare Durable Objects documented consistency model (per https://developers.cloudflare.com/durable-objects/). Consumers needing weaker-consistency low-latency reads reach for the sibling platform-cloudflare-kv blueprint (round 6 T-1) instead; the guide names the decision.",
+  "consequences": "The applying project inherits Cloudflare's documented DO consistency model, the platform-assigned per-object limits (https://developers.cloudflare.com/durable-objects/), and the migration-safe class-export contract (REQ-008). Standards trace clause: Cloudflare Durable Objects documented consistency model (per https://developers.cloudflare.com/durable-objects/). Consumers needing weaker-consistency low-latency reads reach for the sibling platform-cloudflare-kv blueprint instead; the guide names the decision.",
   "alternativesConsidered": [],
   "createdAt": "2026-09-07T14:00:00.000Z",
   "updatedAt": "2026-09-07T14:00:00.000Z"

package/blueprints/platform-cloudflare-durable-objects/contributions/adrs/adr-3402-platform-cloudflare-durable-objects-websocket-hub-contract.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Websocket hub contract: Cloudflare Durable Objects hibernatable WebSockets shape (scope global, new topic websocketHubContract)",
-  "context": "A named DO instance can host many websocket clients via state.acceptWebSocket per the hibernatable WebSockets shape (https://developers.cloudflare.com/durable-objects/). The runtime hibernates the object when idle and wakes it on the next message; the wake handler runs from cold and reads the same storage. This is the shipped answer for the coordinated-multiplayer shape the WSD lane consumers reach for. A future non-Cloudflare hub adapter (a Redis pub-sub broker, a bespoke websocket server) would conflict on the same topic; the guide names the trade.",
+  "context": "A named DO instance can host many websocket clients via state.acceptWebSocket per the hibernatable WebSockets shape (https://developers.cloudflare.com/durable-objects/). The runtime hibernates the object when idle and wakes it on the next message; the wake handler runs from cold and reads the same storage. This is the shipped answer for the coordinated-multiplayer shape consumers reach for. A future non-Cloudflare hub adapter (a Redis pub-sub broker, a bespoke websocket server) would conflict on the same topic; the guide names the trade.",
   "decision": "The shipped v1.0.0 default is a Cloudflare Durable Object hub instance behind the DO facade (env.HUB), realising the hibernatable-WebSocket hub shape per REQ-005 and TAC-3404. The websocketHubContract topic scope is global on this blueprint; the topic string is websocketHubContract. A future non-Cloudflare adapter would contribute the same topic string, forcing a DELIBERATE conflict the operator resolves with a project-level ADR.",
   "consequences": "The applying project inherits Cloudflare's documented hibernatable-WebSockets contract, the hibernate-after-idle window (elicited per ADR-3405) and the idempotent wake-handler shape. Standards trace clause: Cloudflare Durable Objects hibernatable WebSockets shape (per https://developers.cloudflare.com/durable-objects/). The hub shape shares the DO namespace mechanic with the single-cell shape; a future non-Cloudflare websocket-hub sibling mints on demand and the two-blueprint split conversation resurfaces then.",
   "alternativesConsidered": [],

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/probe-utils.mjs

@@ -11,7 +11,7 @@
 // pass per spec section 3.5.
 //
 // The wrangler dev seam is documented in the fixture README under
-// the "T-3 wrangler dev optional boot" section; the shipped
+// the " wrangler dev optional boot" section; the shipped
 // in-process probes do NOT require a wrangler dev process to
 // drive their assertions.
 
@@ -111,7 +111,7 @@ export function createInProcessDoState() {
 }
 
 // Backwards-compatible aliases. The rename to createInProcess* was
-// driven by the honest-labelling sweep in H-2 (finding rows
+// driven by the honest-labelling sweep (finding rows
 // f-2026-09-08-stage2-218 and f-2026-09-08-stage2-219); the
 // aliases below let any existing anatomy assertion or downstream
 // probe still resolve the older names during the same train.

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/real-account-storage-smoke.mjs

@@ -6,23 +6,37 @@
 // storage, reads the same key back, and asserts the returned
 // bytes are byte-equal to the written value (AC-33112-1).
 //
+// Probe env-var contract (honest to what the probe actually
+// consumes): the round-trip only reads CF_DO_WORKER_URL. The CF
+// account id, DO namespace id and API token are wrangler-side
+// deploy config bound to the deployed Worker; the probe drives
+// HTTP against the Worker origin and does not call the CF API
+// directly, so those keys are not on the probe's gate. A future
+// pre-flight that resolves the DO namespace id via the CF API
+// would re-introduce them; until such a pre-flight exists, keeping
+// them on the gate would be dishonest (the probe would refuse to
+// run on the absence of variables it never uses).
+//
 // Activation:
 //
 //   - CI_HAS_CLOUDFLARE_ACCOUNT unset: pass-with-skip per spec
 //     section 3.5 (Clerk pattern); a pass is never reachable from
 //     credential presence alone.
-//   - CI_HAS_CLOUDFLARE_ACCOUNT set: the probe requires
-//     CF_DO_WORKER_URL (the deployed-Worker origin the round trip
-//     runs against) plus at least one of CF_ACCOUNT_ID +
-//     CF_DO_NAMESPACE_ID + CF_API_TOKEN so a partial credential
-//     set surfaces as a fail with the missing list, and the
-//     no-URL case surfaces as a fail naming the missing env.
-//     Locally proven against wrangler dev --local on the
-//     cf-platform fixture; a run without CI_HAS_CLOUDFLARE_ACCOUNT
-//     but with CF_DO_WORKER_URL set exercises the same driver
-//     against the local wrangler binding, so the driver logic
-//     itself is verifiable offline (recorded in the H-2 provenance
-//     transcript, not committed as an envelope).
+//   - CI_HAS_CLOUDFLARE_ACCOUNT set, CF_DO_WORKER_URL unset:
+//     declared skip on CF_DO_WORKER_URL (the deployed-Worker origin
+//     the round trip runs against). This fixture does not yet
+//     self-provision the DO Worker (follow-up work item); until it
+//     does, an account-set-but-no-CF_DO_WORKER_URL run records a
+//     pass-with-skip naming the env var.
+//   - CI_HAS_CLOUDFLARE_ACCOUNT set, CF_DO_WORKER_URL set: the
+//     probe drives the HTTP round-trip against the deployed Worker.
+//
+// Locally proven against wrangler dev --local on the cf-platform
+// fixture; a run without CI_HAS_CLOUDFLARE_ACCOUNT but with
+// CF_DO_WORKER_URL set exercises the same driver against the local
+// wrangler binding, so the driver logic itself is verifiable offline
+// (recorded in the provenance transcript, not committed as an
+// envelope).
 //
 // anchorAcId: AC-33112-1.
 // accountBound: true.
@@ -32,7 +46,6 @@ import { randomBytes } from 'node:crypto';
 export const anchorAcId = 'AC-33112-1';
 export const accountBound = true;
 
-const REQUIRED_ACCOUNT_ENV = ['CF_ACCOUNT_ID', 'CF_DO_NAMESPACE_ID', 'CF_API_TOKEN'];
 const ROUND_TRIP_TIMEOUT_MS = 30000;
 
 function timeoutSignal(ms) {
@@ -51,41 +64,34 @@ export default async function runProbe() {
   const results = [];
   const enabled = process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true' || process.env.CI_HAS_CLOUDFLARE_ACCOUNT === '1';
 
+  // Discrete skip shape on every missing-environment branch: missing
+  // required configuration is a skip (the probe did not execute),
+  // named exactly by the unset variable(s) in `reason`.
   if (!enabled) {
     results.push({
       anchorAcId: 'AC-33112-1',
       verdict: 'pass',
-      detail: 'CI_HAS_CLOUDFLARE_ACCOUNT is not set; probe recorded accountBoundSkipped and aggregated to pass per spec section 3.5. Full mechanism reach requires CI_HAS_CLOUDFLARE_ACCOUNT=true plus CF_DO_WORKER_URL (deployed Worker origin) and the paired CF_ACCOUNT_ID + CF_DO_NAMESPACE_ID + CF_API_TOKEN identifiers so the round-trip drives a live DO storage put and get.',
+      accountBoundSkipped: true,
+      reason: 'CI_HAS_CLOUDFLARE_ACCOUNT',
+      detail: 'accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT is not set to true; probe recorded accountBoundSkipped and aggregated to pass per spec section 3.5.',
     });
-    return { results, extra: { accountBoundSkipped: true } };
+    return { results, extra: { accountBoundSkipped: true, reason: 'CI_HAS_CLOUDFLARE_ACCOUNT' } };
   }
 
   const workerUrl = process.env.CF_DO_WORKER_URL;
   if (!workerUrl) {
-    // Second-tier declared skip (H-2 real-account gate 2026-09-09
-    // finding 3; positive-evidence rule ratified 2026-09-08 in PR
-    // #182): the DO round-trip needs a deployed Worker origin URL,
-    // and this fixture does not yet self-provision that Worker
-    // (follow-up work item w-2026-09-09-dave-005). Until it does,
-    // an account-set-but-no-CF_DO_WORKER_URL run records a
-    // pass-with-skip naming the env var, rather than failing hard
-    // and returning without evidence.
+    // The round-trip needs a deployed Worker origin URL and this
+    // fixture does not yet self-provision that Worker (follow-up
+    // work item). Skip with the exact unset variable named in
+    // `reason`; the probe did not execute against a real Worker.
     results.push({
       anchorAcId: 'AC-33112-1',
       verdict: 'pass',
-      detail: 'accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT=true but CF_DO_WORKER_URL is unset; the round-trip driver needs the deployed-Worker origin (e.g. https://cf-platform.<subdomain>.workers.dev). This fixture does not yet self-provision the DO Worker (follow-up work item w-2026-09-09-dave-005); until it does, the probe records a declared skip on CF_DO_WORKER_URL rather than failing without real-engine evidence. Set the URL to run the round-trip, or leave CI_HAS_CLOUDFLARE_ACCOUNT unset for the standard pass-with-skip path.',
-    });
-    return { results, extra: { accountBoundSkipped: true, reason: 'CF_DO_WORKER_URL unset (second-tier env var)', missing: ['CF_DO_WORKER_URL'] } };
-  }
-
-  const missingIdent = REQUIRED_ACCOUNT_ENV.filter((k) => !process.env[k]);
-  if (missingIdent.length) {
-    results.push({
-      anchorAcId: 'AC-33112-1',
-      verdict: 'fail',
-      detail: `CI_HAS_CLOUDFLARE_ACCOUNT=true and CF_DO_WORKER_URL=${workerUrl} but missing paired identifier env vars: ${missingIdent.join(', ')}. Set the missing keys and re-run.`,
+      accountBoundSkipped: true,
+      reason: 'CF_DO_WORKER_URL',
+      detail: 'accountBoundSkipped: CF_DO_WORKER_URL unset; the round-trip driver needs the deployed-Worker origin (e.g. https://cf-platform.<subdomain>.workers.dev). Set the URL to run the round-trip.',
     });
-    return { results, extra: { accountBoundSkipped: false, missing: missingIdent } };
+    return { results, extra: { accountBoundSkipped: true, reason: 'CF_DO_WORKER_URL', missing: ['CF_DO_WORKER_URL'] } };
   }
 
   const cellId = `h2-storage-smoke-${Date.now()}-${process.pid}`;

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/sole-reader-scan.mjs

@@ -7,7 +7,7 @@
 // and `env.HUB` against the file path. The clean-fixture pass
 // asserts src/do-facade.mjs is the ONLY file whose live (non-
 // commented) source matches; every other file records zero. The
-// mutation-run is triggered fixture-side by the H-2 shim
+// mutation-run is triggered fixture-side by the shim
 // h2-cf-do-sole-reader-shim.mjs, which seeds a synthetic non-
 // facade consumer into a scratch tree outside the applied source
 // root; the probe body sees the augmented file list, the scan

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/storage-round-trip.mjs

@@ -5,7 +5,7 @@
 // delete/get and list({prefix}) on each; asserts the round-trip
 // on both. Also asserts driver.backend reports the elicited
 // answer (AC-33111-1). The backend-mismatch mutation-run is
-// triggered fixture-side by the H-2 shim
+// triggered fixture-side by the shim
 // h2-cf-do-storage-round-trip-shim.mjs, which constructs a driver
 // from an unrecognised backend answer that the shipped factory
 // clamps to sql per ADR-3403 recommendedDefault; the probe body

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/websocket-hub-broadcast.mjs

@@ -10,7 +10,7 @@
 // allowed key set {event, key, size, ttl, timestamp, objectName,
 // scheduledTime} and asserts zero forbidden-key hits (AC-33106-1).
 //
-// Two mutation switches are triggered fixture-side by the H-2
+// Two mutation switches are triggered fixture-side by the
 // shim h2-cf-do-websocket-hub-shim.mjs: a PII-leak wrapper on the
 // sink adapter that injects forbidden fields on every emitted
 // record, and a broadcast-hang gate that pauses the probe past

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/wrangler-seam.mjs

@@ -24,7 +24,7 @@
 // The probe also carries an additional AC-33108-1 result that
 // greps the fixture wrangler.toml for the two `[[durable_objects.bindings]]`
 // binding pairs (name/class_name) and the `[[migrations]]` block
-// (tag `"v1"` plus new_classes for both classes). That result is
+// (tag `"v1"` plus new_sqlite_classes for both classes). That result is
 // deterministic and does not require wrangler.
 //
 // Warn semantics per section 3.1 pass-with-skip: if the wrangler
@@ -73,10 +73,16 @@ async function greppedWranglerToml() {
   const hubNameHit = /name = "HUB"/.test(toml);
   const hubClassHit = /class_name = "HubObject"/.test(toml);
   const tagHit = /tag = "v1"/.test(toml);
-  const newClassesHit = /new_classes = \["SingleCellObject", "HubObject"\]/.test(toml);
+  const newClassesHit = /new_sqlite_classes = \["SingleCellObject", "HubObject"\]/.test(toml);
+  // Per the Cloudflare Durable Objects migrations page, key-value backed
+  // namespaces can no longer be created; only new_sqlite_classes mints one.
+  // The probe refuses a wrangler.toml that still asserts the deprecated keyword,
+  // so a re-shipped blueprint cannot silently regress to the old shape.
+  // Vendor: https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/
+  const deprecatedNewClassesRefused = !/(^|\n)\s*new_classes\s*=/.test(toml);
   return {
-    ok: cellNameHit && cellClassHit && hubNameHit && hubClassHit && tagHit && newClassesHit,
-    hits: { cellNameHit, cellClassHit, hubNameHit, hubClassHit, tagHit, newClassesHit },
+    ok: cellNameHit && cellClassHit && hubNameHit && hubClassHit && tagHit && newClassesHit && deprecatedNewClassesRefused,
+    hits: { cellNameHit, cellClassHit, hubNameHit, hubClassHit, tagHit, newClassesHit, deprecatedNewClassesRefused },
   };
 }
 
@@ -156,7 +162,7 @@ export default async function runProbe() {
     anchorAcId: 'AC-33108-1',
     verdict: toml.ok ? 'pass' : 'fail',
     detail: toml.ok
-      ? `wrangler.toml carries name="CELL" + class_name="SingleCellObject", name="HUB" + class_name="HubObject", and [[migrations]] tag "v1" with new_classes ["SingleCellObject","HubObject"]`
+      ? `wrangler.toml carries name="CELL" + class_name="SingleCellObject", name="HUB" + class_name="HubObject", and [[migrations]] tag "v1" with new_sqlite_classes ["SingleCellObject","HubObject"]`
       : `wrangler.toml grep miss: ${JSON.stringify(toml.hits)}`,
   });
 

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-001.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+    "field": "responsibilities.namespaceReady"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-002.json

@@ -2,7 +2,7 @@
   "reqId": "platform-cloudflare-durable-objects-REQ-002",
   "prdId": "PRD-001",
   "title": "The single-cell shape exposes typed domain verbs and serialises concurrent invocations per instance",
-  "description": "A named single-cell object exposes typed domain verbs (increment, read, reset). Cloudflare's documented Durable Objects consistency model serialises invocations against the same instance per https://developers.cloudflare.com/durable-objects/; the shipped SingleCellObject class realises that contract so a concurrent-increment probe observes the counter sum and one increment observed the other via a written witness.",
+  "description": "A named single-cell object exposes typed domain verbs (increment, read, reset). Cloudflare's documented Durable Objects consistency model serialises invocations against the same instance per https://developers.cloudflare.com/durable-objects/; the shipped SingleCellObject class realises that contract so a concurrent-increment probe observes the counter sum and one increment observed the other via a written witness. The single-cell shape realises the strongConsistencyCell capability token: every consumer that selects strongConsistencyCell inherits the per-instance FIFO serialisation and the typed domain-verb boundary this REQ describes.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T20:35:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+    "field": "responsibilities.serialise"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-003.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+    "field": "responsibilities.storage"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-004.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3403-platform-cloudflare-durable-objects-alarm-handler",
+    "field": "responsibilities.doAlarmFired"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-005.json

@@ -2,7 +2,7 @@
   "reqId": "platform-cloudflare-durable-objects-REQ-005",
   "prdId": "PRD-001",
   "title": "The hibernatable WebSocket hub accepts clients via state.acceptWebSocket and the wake handler runs from cold reading the same storage",
-  "description": "A named hub object accepts websocket clients via state.acceptWebSocket per Cloudflare's hibernatable WebSockets shape (https://developers.cloudflare.com/durable-objects/), routes each message to per-message handlers by JSON type field, and broadcasts to all connected sockets. On hibernate-and-wake the wake handler runs from a cold start and reads the same storage; the shipped hub class re-emits doWakeUp on the injected event sink on the first message after hibernation.",
+  "description": "A named hub object accepts websocket clients via state.acceptWebSocket per Cloudflare's hibernatable WebSockets shape (https://developers.cloudflare.com/durable-objects/), routes each message to per-message handlers by JSON type field, and broadcasts to all connected sockets. On hibernate-and-wake the wake handler runs from a cold start and reads the same storage; the shipped hub class re-emits doWakeUp on the injected event sink on the first message after hibernation. The applying project elicits the broadcast delivery window in milliseconds (do-hub-broadcast-window-ms; recommended default 500): every fan-out from a hub broadcast MUST (must) settle to every connected client, or record a partial delivery on the sink, within the elicited window. The applying project also elicits the hibernate-after-idle window per ADR-3405 (do-hub-hibernate-after-idle-ms; recommended default 30000): every hub instance MUST (must) enter the hibernated state after the elicited idle window elapses with no client activity, and MUST (must) wake from cold on the first post-hibernation message without losing lastBroadcast state. The hub shape realises the hibernatableWebSocket capability token: every consumer that selects hibernatableWebSocket inherits the accept-hibernate-wake cycle this REQ describes.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T20:35:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+    "field": "responsibilities.doWakeUp"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-006.json

@@ -2,7 +2,7 @@
   "reqId": "platform-cloudflare-durable-objects-REQ-006",
   "prdId": "PRD-001",
   "title": "Lifecycle events fire at namespace and object level with metadata-only payloads",
-  "description": "The facade and the objects emit lifecycle events on the injected event sink: namespaceReady (facade), doAccept, doAlarmFired, doWakeUp, doHibernate (object). Every payload is metadata-only ({event, key, size, ttl, timestamp, ?objectName, ?scheduledTime}); no message payloads, no request bodies, no PII cross the sink boundary. A logging companion renders records directly without a per-blueprint scrub pass.",
+  "description": "The facade and the objects emit lifecycle events on the injected event sink: namespaceReady (facade), doAccept, doAlarmFired, doWakeUp, doHibernate (object). Every payload is the metadata-only shape named on `TAC-3405-platform-cloudflare-durable-objects-event-sink.purpose` (event-record whitelist); no message payloads, no request bodies, no PII cross the sink boundary. A logging companion renders records directly without a per-blueprint scrub pass.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3405-platform-cloudflare-durable-objects-event-sink",
+    "field": "responsibilities.allowed"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-007.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+    "field": "responsibilities.env"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/requirements/platform-cloudflare-durable-objects-req-008.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "adrId": "ADR-3404-platform-cloudflare-durable-objects-migrations-shape",
+    "field": "decision.migrations"
+  }
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33101.json

@@ -16,12 +16,83 @@
       "when": "the process boots and the facade ready() call resolves",
       "then": "a namespaceReady event fires on the injected event sink with the metadata-only payload; no other module dereferences env.CELL or env.HUB",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33101-2",
+      "description": "F-4 namespace-unbound: createDoFacade({env:{HUB:{}}, sink}) with env.CELL absent throws a named error kind DO_NAMESPACE_UNBOUND naming the missing binding \"CELL\" before any sink event fires. No namespaceReady record lands on the sink; the throw is synchronous at factory time so the applying agent sees the failure at boot rather than at first call.",
+      "given": "a createDoFacade call whose env object lacks the CELL property",
+      "when": "the factory is invoked",
+      "then": "the factory throws DO_NAMESPACE_UNBOUND naming \"CELL\" and no namespaceReady event fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33101-3",
+      "description": "F-4 namespace-unbound (hub): createDoFacade({env:{CELL:{}}, sink}) with env.HUB absent throws DO_NAMESPACE_UNBOUND naming the missing binding \"HUB\" before any sink event fires. The two bindings are checked in a stable order (CELL then HUB) so the error names the first missing binding when both are absent.",
+      "given": "a createDoFacade call whose env object lacks the HUB property",
+      "when": "the factory is invoked",
+      "then": "the factory throws DO_NAMESPACE_UNBOUND naming \"HUB\" and no namespaceReady event fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33101-4",
+      "description": "Invalid sink at boot: the DO facade factory (per TAC-3401.interfaces.createDoFacade) called with a sink argument that is not a function throws DO_FACADE_INVALID_SINK before any binding is dereferenced. Same for the sink omitted or a non-function value; no ready-check runs.",
+      "given": "a createDoFacade call whose sink is not a function",
+      "when": "the factory is invoked",
+      "then": "the factory throws DO_FACADE_INVALID_SINK and no namespaceReady event fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33101-5",
+      "description": "Repeat-boot idempotency: two independent createDoFacade({env, sink}).ready() calls on the same env emit two namespaceReady records on the sink, both with identical payload shape {event:\"namespaceReady\", key:null, size:0, ttl:null, timestamp:<number>}; each record has its own timestamp. No accumulator drift across boots; no cellHandle or hubHandle state leaks between instances.",
+      "given": "two independent createDoFacade instances constructed with the same env and sink",
+      "when": "ready() is called on each in turn",
+      "then": "the sink receives two namespaceReady records with identical shape and independent timestamps",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33101-6",
+      "description": "Sole-reader boundary at boot: the src/do-facade.mjs module is the only module in the cf-platform fixture src/ tree that carries the literal substrings \"env.CELL\" or \"env.HUB\" outside comments. The wrangler-seam probe (US-33113) routes fetch requests through src/index.mjs which calls createDoFacade({env}) once, and that call site is the only \"env\" reference on src/index.mjs; the boundary check greps src/*.mjs and asserts the sole-reader claim before boot.",
+      "given": "the cf-platform fixture src/ tree at boot time",
+      "when": "a recursive scan strips comments and matches \"env.CELL\" and \"env.HUB\" against every .mjs file",
+      "then": "only src/do-facade.mjs contains the matches; src/index.mjs contains only the createDoFacade({env}) constructor call and no direct env.CELL / env.HUB dereference",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.solereader"
+      }
     }
   ],
   "tacIds": [
     "TAC-3401-platform-cloudflare-durable-objects-namespace-facade"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }