rcf-lite 0.26.0 → 0.28.0

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33102.json

@@ -16,12 +16,69 @@
       "when": "two increment(1) invocations fire concurrently and a read follows",
       "then": "the two increments resolve with counters {1, 2} in FIFO order, witnesses {0, 1}, and the final read returns 2",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33102-2",
+      "description": "N=10 concurrent increment(1) invocations against a named single-cell instance at initial counter 0 resolve to 10 {counter, witness} pairs whose counter values sorted equal [1,2,3,4,5,6,7,8,9,10] and whose witness values sorted equal [0,1,2,3,4,5,6,7,8,9]. Read after the batch returns counter 10. Per-instance FIFO holds across the whole batch: no witness or counter appears twice and no value is skipped.",
+      "given": "a SingleCellObject at counter 0 with the in-memory storage driver",
+      "when": "10 concurrent increment(1) calls fire and read() follows",
+      "then": "the 10 sorted counters equal [1..10]; the 10 sorted witnesses equal [0..9]; read returns 10",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.serialise"
+      }
+    },
+    {
+      "id": "AC-33102-3",
+      "description": "Mixed positive and negative deltas: two concurrent calls increment(+1) and increment(-1) against counter 5 resolve to counters in FIFO order (either [6, 5] or [4, 5]) with witnesses [5, 6] or [5, 4] respectively; the final read returns 5. The per-instance FIFO ordering means the second caller ALWAYS observes the first caller's write as its own witness, regardless of sign.",
+      "given": "a SingleCellObject at counter 5",
+      "when": "increment(+1) and increment(-1) fire concurrently and read follows",
+      "then": "the second-caller witness equals the first-caller counter; read returns 5",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.serialise"
+      }
+    },
+    {
+      "id": "AC-33102-4",
+      "description": "Zero-delta serialisation: an increment(0) against counter 3 resolves to {counter:3, witness:3}: the FIFO turn observes the current value as witness, the counter is unchanged. Concurrent increment(0) calls each observe the same witness AND the same counter, but each still occupies its own serialised turn (the FIFO promise queue advances by one per call).",
+      "given": "a SingleCellObject at counter 3",
+      "when": "two concurrent increment(0) calls fire",
+      "then": "both resolve with counter 3 and witness 3; the FIFO promise queue advances by two turns",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.serialise"
+      }
+    },
+    {
+      "id": "AC-33102-5",
+      "description": "Single caller identity: one increment(1) against counter 0 resolves to {counter:1, witness:0}, identical to the FIFO-first pair from AC-33102-1. A concurrent-of-one produces the same result as a sequential-of-one; the FIFO queue does not accumulate spurious state on a single-caller path.",
+      "given": "a SingleCellObject at counter 0",
+      "when": "one increment(1) call fires alone",
+      "then": "it resolves to {counter:1, witness:0}",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.serialise"
+      }
     }
   ],
   "tacIds": [
     "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33103.json

@@ -16,12 +16,87 @@
       "when": "put/get/delete/list operations are driven on each driver in turn",
       "then": "both round-trip identically and driver.backend reports \"sql\" and \"kv\" respectively",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-33103-2",
+      "description": "F-6 SQL-specific: a storage driver with {backend:\"sql\"} exposes a .query(sql, ...args) verb that runs a typed SQL statement against the DO SQLite backend; a driver with {backend:\"kv\"} has no .query verb (typeof driver.query === \"undefined\"). This aligns with the ADR-3403 backend-swap contract: SQL supports typed columns and query, KV is put/get/delete/list only.",
+      "given": "two storage drivers, one with backend \"sql\" and one with backend \"kv\"",
+      "when": "the .query property is inspected on each driver",
+      "then": "the SQL driver exposes .query as a function; the KV driver has no .query property",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      }
+    },
+    {
+      "id": "AC-33103-3",
+      "description": "F-6 KV-specific: a storage driver with {backend:\"kv\"} refuses a batch-write call driver.batch([...]) with a named error kind DO_STORAGE_UNSUPPORTED_ON_KV naming the operation. A driver with {backend:\"sql\"} accepts driver.batch([...]) and returns the batched writes. The refusal is a first-class boundary of the KV backend rather than a silent unavailability.",
+      "given": "a storage driver with backend \"kv\"",
+      "when": "driver.batch([{put:...}, {put:...}]) is called",
+      "then": "the driver throws DO_STORAGE_UNSUPPORTED_ON_KV naming \"batch\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      }
+    },
+    {
+      "id": "AC-33103-4",
+      "description": "F-7 write failure boundary: a driver.put(\"k\",\"v\") whose underlying backing store throws (simulated by a stubbed backing that rejects on put) surfaces the error unwrapped to the caller with a stable error kind DO_STORAGE_WRITE_FAILED whose message includes the key \"k\". No partial write persists (a subsequent get(\"k\") returns undefined). The write-failed event does not land on the DO event sink because the storage layer is under the single-cell, not the facade.",
+      "given": "a storage driver whose backing store put rejects synthetically",
+      "when": "driver.put(\"k\",\"v\") is called",
+      "then": "the call rejects with DO_STORAGE_WRITE_FAILED naming \"k\"; a subsequent get returns undefined",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      }
+    },
+    {
+      "id": "AC-33103-5",
+      "description": "Empty and maximal collection boundaries: driver.list({prefix:\"\"}) on an empty store returns an empty Map (size 0); driver.list({prefix:\"\"}) on a store with 100 keys returns a Map of size 100 with every key preserved. The list result is a Map, not an array, so key insertion order does not affect the assertion.",
+      "given": "a storage driver on an empty store and, separately, on a store with 100 keys",
+      "when": "driver.list({prefix:\"\"}) is called on each",
+      "then": "the empty store returns a Map of size 0; the populated store returns a Map of size 100",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      }
+    },
+    {
+      "id": "AC-33103-6",
+      "description": "Value-size boundary (vendor-cited): a put(\"k\", value) with value at 131072 bytes (the documented Cloudflare DO storage per-value cap of 128 KiB) succeeds and round-trips through get; a put(\"k\", value) with value at 131073 bytes refuses with DO_STORAGE_VALUE_TOO_LARGE naming the observed byte count and the vendor limit URL. On the KV backend the equivalent cap is 25 MiB per the Workers KV limit page; the driver reports the cap it enforces.",
+      "given": "a storage driver on the SQL backend with a 131072-byte value and, separately, a 131073-byte value",
+      "when": "put is called on each",
+      "then": "the 128 KiB value round-trips; the 131073-byte value refuses with DO_STORAGE_VALUE_TOO_LARGE naming the cap",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/platform/limits/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33104.json

@@ -11,17 +11,86 @@
   "acceptanceCriteria": [
     {
       "id": "AC-33104-1",
-      "description": "A SingleCellObject with setAlarm(offsetMs=100) fires alarm() when driven at the scheduled time. The alarm() handler runs exactly once, deletes the persisted alarm from storage (getAlarm() returns null after the fire) and emits a doAlarmFired event on the injected sink with {event, key, size, ttl, timestamp, objectName, scheduledTime} where objectName is the object's name and scheduledTime matches the setAlarm scheduled millis. A second call to alarm() on the drained storage does NOT emit a second doAlarmFired for the same schedule (the storage.getAlarm() returns null so the second fire records scheduledTime null).",
-      "given": "a SingleCellObject with setAlarm(100)",
-      "when": "alarm() is driven once and then again after the fire",
-      "then": "the first fire emits doAlarmFired with the scheduledTime; the second fire records scheduledTime null; storage.getAlarm() returns null after the first fire",
+      "description": "A SingleCellObject with setAlarm(offsetMs=100) fires alarm() when driven at the scheduled time. The alarm() handler runs exactly once, deletes the persisted alarm from storage (getAlarm() returns null after the fire) and emits EXACTLY ONE doAlarmFired event on the injected sink with {event, key, size, ttl, timestamp, objectName, scheduledTime} where objectName is the object's name and scheduledTime matches the setAlarm scheduled millis. A subsequent second call to alarm() on the drained storage is a no-op: getAlarm() returns null, the handler observes no schedule and returns without emitting a second doAlarmFired event. The drained-alarm contract is single-valued: one setAlarm invocation implies one alarm() fire implies one doAlarmFired record; a bare alarm() call with no persisted schedule emits nothing.",
+      "given": "a SingleCellObject wired with an in-process storage driver whose alarm() handler is driven manually",
+      "when": "setAlarm(offsetMs=100) is called, the clock advances 100ms, alarm() runs, then a second alarm() call runs against the drained storage",
+      "then": "the sink observes exactly one doAlarmFired record with the setAlarm scheduled millis; the second alarm() call emits nothing and getAlarm() returns null throughout",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3403-platform-cloudflare-durable-objects-alarm-handler",
+        "field": "interfaces.alarm"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33104-2",
+      "description": "F-4 alarm-invalid-offset: setAlarm(offsetMs=-1) refuses with a named error kind DO_ALARM_INVALID_OFFSET naming the offered value; no schedule persists; getAlarm() returns null. Same for offsetMs === 0 (a \"fire immediately\" schedule that would race the current invocation) refused with DO_ALARM_INVALID_OFFSET.",
+      "given": "a SingleCellObject with the in-memory storage driver",
+      "when": "setAlarm(-1) or setAlarm(0) is called",
+      "then": "the call throws DO_ALARM_INVALID_OFFSET; getAlarm returns null",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3403-platform-cloudflare-durable-objects-alarm-handler",
+        "field": "interfaces.SingleCellObject.setAlarm"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/api/alarms/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-33104-3",
+      "description": "F-4 alarm re-schedule: setAlarm(100) then setAlarm(200) before the first alarm fires overwrites the persisted schedule. The alarm() handler fires exactly once at the LATER scheduled time (200ms after original setAlarm(100)), the doAlarmFired record carries scheduledTime equal to the later scheduled millis, and no alarm fires at the earlier 100ms mark (the observer never sees a first fire).",
+      "given": "a SingleCellObject with the in-memory storage driver whose clock is fake",
+      "when": "setAlarm(100) then setAlarm(200) run, the clock advances 200ms, and the alarm handler drains",
+      "then": "exactly one doAlarmFired record carries the later scheduledTime; no earlier fire is observed",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3403-platform-cloudflare-durable-objects-alarm-handler",
+        "field": "interfaces.SingleCellObject.setAlarm"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/api/alarms/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-33104-4",
+      "description": "F-4 alarm-handler-failure: an alarm() invocation whose bound handler throws surfaces the error with a stable kind DO_ALARM_HANDLER_FAILED naming the wrapped error message; NO doAlarmFired record emits on the sink for that failed fire (the sink emits only on successful drain); a subsequent setAlarm(100)/alarm() cycle behaves normally, proving the failure isolates to the one fire and does not poison the alarm slot.",
+      "given": "a SingleCellObject whose alarm handler rejects on the first call",
+      "when": "setAlarm(100) fires and alarm() runs",
+      "then": "the call rejects with DO_ALARM_HANDLER_FAILED; the sink records zero doAlarmFired for this fire; a subsequent cycle emits doAlarmFired normally",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3403-platform-cloudflare-durable-objects-alarm-handler",
+        "field": "interfaces.SingleCellObject.alarm"
+      }
+    },
+    {
+      "id": "AC-33104-5",
+      "description": "deleteAlarm before fire: setAlarm(100) then deleteAlarm() drains the persisted schedule; getAlarm() returns null immediately; a subsequent alarm() invocation on the drained storage records no doAlarmFired and returns without side effect (per the drained-storage contract in AC-33104-1).",
+      "given": "a SingleCellObject with a scheduled alarm",
+      "when": "deleteAlarm() runs before the scheduled time and alarm() then runs",
+      "then": "getAlarm returns null; no doAlarmFired record emits; alarm returns without side effect",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3403-platform-cloudflare-durable-objects-alarm-handler",
+        "field": "interfaces.SingleCellObject.setAlarm"
+      }
     }
   ],
   "tacIds": [
     "TAC-3403-platform-cloudflare-durable-objects-alarm-handler"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33105.json

@@ -16,12 +16,83 @@
       "when": "a broadcast message is sent from A",
       "then": "both A and B receive the same broadcast within 500ms and storage.get(\"lastBroadcast\") returns the serialised payload",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33105-2",
+      "description": "F-4 broadcast-malformed: webSocketMessage(A, \"not-json-at-all\") on a HubObject with two accepted sockets does NOT fan out anything; the hub replies to A with an error frame carrying {type:\"error\", kind:\"HUB_MALFORMED_MESSAGE\"} and B receives nothing. storage.get(\"lastBroadcast\") stays at its prior value (or remains undefined on a fresh hub); no doBroadcast record emits.",
+      "given": "a HubObject with two accepted fake sockets A and B",
+      "when": "webSocketMessage(A, \"not-json-at-all\") is driven",
+      "then": "the hub sends A an error frame with kind HUB_MALFORMED_MESSAGE; B receives no message; lastBroadcast is unchanged",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "interfaces.HubObject"
+      }
+    },
+    {
+      "id": "AC-33105-3",
+      "description": "Empty-hub broadcast (zero connected clients): a HubObject with zero accepted sockets, when driven with an out-of-band broadcast API (state.broadcast) or an incoming HTTP fetch that carries a broadcast payload, still persists storage.lastBroadcast so a subsequent socket connect can catch up. No client message is emitted (nobody is listening); the persistence side effect is the only observable.",
+      "given": "a HubObject with zero accepted sockets",
+      "when": "a broadcast is driven through the hub API",
+      "then": "no client message emits; storage.get(\"lastBroadcast\") returns the serialised payload",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "responsibilities.lastBroadcast"
+      }
+    },
+    {
+      "id": "AC-33105-4",
+      "description": "Slow-socket isolation: a HubObject with three accepted sockets A, B and C where B's send() blocks (simulated by a promise that never settles), when driven with a broadcast from A, still delivers the broadcast to C within the elicited 500ms window. The hub does not await B; the slow socket is dropped from the broadcast fan-out for that message and a doBroadcastSocketSlow record emits naming the slow socket id.",
+      "given": "a HubObject with three sockets where B blocks",
+      "when": "A broadcasts",
+      "then": "C receives the broadcast within 500ms; a doBroadcastSocketSlow record names B's socket id",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "responsibilities.broadcast"
+      }
+    },
+    {
+      "id": "AC-33105-5",
+      "description": "N=10 concurrent broadcasts: a HubObject with two accepted sockets A and B, driven with 10 concurrent broadcasts from A, delivers 10 messages to B in the same order A issued them. Per-connection ordering is preserved (10 messages in A-issue-order); storage.get(\"lastBroadcast\") after the batch returns the 10th payload.",
+      "given": "a HubObject with two accepted sockets",
+      "when": "10 concurrent broadcasts from A fire",
+      "then": "B receives 10 messages in issue order; lastBroadcast returns the 10th payload",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "responsibilities.broadcast"
+      }
+    },
+    {
+      "id": "AC-33105-6",
+      "description": "F-4 hub-unknown-type: webSocketMessage(A, JSON.stringify({type:\"nonsense\"})) on a HubObject does NOT change storage; the hub replies to A with an error frame carrying {type:\"error\", kind:\"HUB_UNKNOWN_MESSAGE_TYPE\"} naming the unknown type; B receives nothing; storage.get(\"lastBroadcast\") is unchanged.",
+      "given": "a HubObject with two accepted sockets",
+      "when": "A sends a message whose type is not broadcast|set-state|get-state",
+      "then": "A receives an HUB_UNKNOWN_MESSAGE_TYPE error frame; B receives nothing; storage is unchanged",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "interfaces.HubObject"
+      }
     }
   ],
   "tacIds": [
     "TAC-3404-platform-cloudflare-durable-objects-websocket-hub"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33106.json

@@ -16,12 +16,59 @@
       "when": "the event-secrecy probe runs on the shipped code path",
       "then": "every record contains only allowed keys; the forbidden-key scan finds zero hits; SIMULATE_PII_LEAK=true surfaces the injected fields",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33106-2",
+      "description": "Allow-list mutation: a wrapper sink that adds a top-level \"requestId\" key onto every record trips the layer-1 forbidden-key scan (requestId is not in the allow-list). The event-secrecy probe surfaces the key by name and returns aggregateVerdict:\"fail\". Under SIMULATE_PII_LEAK=false (the shipped path) no wrapper is in play and the scan returns zero forbidden hits.",
+      "given": "the event-secrecy probe under SIMULATE_PII_LEAK=true with a wrapper adding \"requestId\" onto every record",
+      "when": "the layer-1 scan runs on the accumulated records",
+      "then": "the scan surfaces \"requestId\" as a forbidden key; aggregateVerdict is \"fail\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3405-platform-cloudflare-durable-objects-event-sink",
+        "field": "responsibilities.allowList"
+      }
+    },
+    {
+      "id": "AC-33106-3",
+      "description": "Closure-over-fixture: a hub handler that captures a PII fixture ({userId:12345, ssn:\"REDACTED-fixture\"}) via a JavaScript closure and mutates a scratch object each call still produces sink records whose JSON serialisation contains no \"12345\" and no \"REDACTED-fixture\" substring. Layer-2 substring scan returns zero hits on the shipped path (SIMULATE_PII_LEAK=false).",
+      "given": "a hub handler closing over a PII fixture on the shipped path",
+      "when": "the event-secrecy probe runs a broadcast that triggers the handler",
+      "then": "the layer-2 substring scan on the emitted records returns zero hits for the PII substrings",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3405-platform-cloudflare-durable-objects-event-sink",
+        "field": "responsibilities.allowList"
+      }
+    },
+    {
+      "id": "AC-33106-4",
+      "description": "Empty-payload boundary: a broadcast with an empty body ({type:\"broadcast\", payload:\"\"}) still emits doBroadcast records on the sink carrying the required allow-list keys (event, key, size:0, ttl:null, timestamp:<number>, objectName:<hub id>). No allow-list key is silently omitted when the payload is empty; size reports 0 rather than undefined.",
+      "given": "a HubObject broadcasting an empty payload",
+      "when": "the sink is inspected after the broadcast",
+      "then": "the doBroadcast record carries every required allow-list key with size:0 (never undefined)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3405-platform-cloudflare-durable-objects-event-sink",
+        "field": "responsibilities.allowList"
+      }
     }
   ],
   "tacIds": [
     "TAC-3405-platform-cloudflare-durable-objects-event-sink"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33107.json

@@ -16,12 +16,55 @@
       "when": "the sole-reader-scan probe runs",
       "then": "the clean-fixture pass reports zero non-facade leaks; the simulate pass surfaces the injected leak and returns fail",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33107-2",
+      "description": "Comment-only mention: a JSDoc block or line comment on any non-facade module that mentions \"env.CELL\" or \"env.HUB\" (for documentation or a cross-reference) does NOT trip the scan. The probe strips block comments (/* ... */) and line comments (// ...) before matching literals; a synthetic scratch file with only a commented mention returns zero leaks.",
+      "given": "a scratch fixture module carrying only a commented mention of env.CELL",
+      "when": "the sole-reader-scan probe walks the fixture",
+      "then": "the file is not reported as a leak; the leak count is zero",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.solereader"
+      }
+    },
+    {
+      "id": "AC-33107-3",
+      "description": "Nested-directory recursion: a leak in a nested path (e.g. src/handlers/deep/leak.mjs) with a real env.CELL dereference is caught by the probe. The scan walks the src/ tree recursively and reports the full relative path of every leaking file.",
+      "given": "a synthetic src/handlers/deep/leak.mjs carrying a real env.CELL dereference",
+      "when": "the sole-reader-scan probe walks the tree",
+      "then": "the probe reports src/handlers/deep/leak.mjs as a leak and returns aggregateVerdict \"fail\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.solereader"
+      }
+    },
+    {
+      "id": "AC-33107-4",
+      "description": "Extension filter: the scan matches only .mjs, .js and .ts files. A .txt or .md file with a literal env.CELL substring (a README example, a config sample) is NOT scanned and does not flag; a .json fixture with an env.CELL string value is also not scanned.",
+      "given": "a scratch tree with env.CELL literals in .txt, .md and .json files",
+      "when": "the sole-reader-scan probe walks the tree",
+      "then": "no leak is reported; the extension filter excludes non-source files",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.solereader"
+      }
     }
   ],
   "tacIds": [
     "TAC-3401-platform-cloudflare-durable-objects-namespace-facade"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33108.json

@@ -11,17 +11,98 @@
   "acceptanceCriteria": [
     {
       "id": "AC-33108-1",
-      "description": "The fixture wrangler.toml carries at least two [[durable_objects.bindings]] blocks (one binding named CELL with class_name SingleCellObject; one binding named HUB with class_name HubObject) and at least one [[migrations]] block with tag \"v1\" and new_classes = [\"SingleCellObject\", \"HubObject\"]. An anatomy assertion greps the toml for each of the four literal strings (name = \"CELL\", class_name = \"SingleCellObject\", name = \"HUB\", class_name = \"HubObject\") and the tag/new_classes pair. A rename in a real project ships as a new migrations tag entry, never a silent edit of the class name.",
+      "description": "The fixture wrangler.toml carries at least two [[durable_objects.bindings]] blocks (one binding named CELL with class_name SingleCellObject; one binding named HUB with class_name HubObject) and at least one [[migrations]] block with tag \"v1\" and new_sqlite_classes = [\"SingleCellObject\", \"HubObject\"]. An anatomy assertion greps the toml for each of the four literal strings (name = \"CELL\", class_name = \"SingleCellObject\", name = \"HUB\", class_name = \"HubObject\") and the tag/new_sqlite_classes pair. A rename in a real project ships as a new migrations tag entry, never a silent edit of the class name.",
       "given": "the cf-platform fixture wrangler.toml",
       "when": "the anatomy assertion greps for the four literal strings and the migrations pair",
       "then": "every string is present and the migrations tag \"v1\" carries the two class names",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/",
+        "verifiedOn": "2026-09-09"
+      },
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.migrationsTag"
+      }
+    },
+    {
+      "id": "AC-33108-2",
+      "description": "Rename-as-new-migration-tag: a wrangler.toml carrying a second [[migrations]] block with tag=\"v2\" and renamed_classes=[{from:\"SingleCellObject\", to:\"CellObjectV2\"}], with the [[durable_objects.bindings]] class_name updated to CellObjectV2, is a valid rename. The anatomy assertion accepts: it greps for tag=\"v2\" and renamed_classes, and asserts the v1 migration still records the original class name for history.",
+      "given": "a wrangler.toml with two migrations tags (v1 with new_sqlite_classes, v2 with renamed_classes) and updated binding class_name",
+      "when": "the anatomy assertion parses the toml",
+      "then": "both tags are present, renamed_classes points from the v1 class to the v2 class, and the binding class_name matches the v2 target",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.migrationsTag"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-33108-3",
+      "description": "Silent class rename refuses: a wrangler.toml where the [[durable_objects.bindings]] class_name has changed from \"SingleCellObject\" to \"CellObjectV2\" but no new [[migrations]] tag records the rename is a defect. The anatomy assertion detects the mismatch (a class named on a binding that does not appear in any migration record) and refuses with DO_MIGRATION_RENAME_UNRECORDED naming the class name.",
+      "given": "a wrangler.toml whose binding class_name is not recorded in any migrations tag",
+      "when": "the anatomy assertion runs",
+      "then": "the assertion refuses with DO_MIGRATION_RENAME_UNRECORDED naming the class",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.migrationsTag"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-33108-4",
+      "description": "Missing migrations block: a wrangler.toml with [[durable_objects.bindings]] blocks but no [[migrations]] block refuses at the anatomy assertion with DO_MIGRATION_BLOCK_MISSING; the deploy would fail at Cloudflare mint time (a namespace cannot exist without a migration recording the class).",
+      "given": "a wrangler.toml with binding blocks and no migrations block",
+      "when": "the anatomy assertion runs",
+      "then": "the assertion refuses with DO_MIGRATION_BLOCK_MISSING",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.migrationsTag"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-33108-5",
+      "description": "Stale keyword refuses: a wrangler.toml whose [[migrations]] tag uses new_classes = [...] instead of new_sqlite_classes = [...] refuses at the anatomy assertion with DO_MIGRATION_KEYWORD_STALE naming the deprecated keyword and the vendor URL. Per the cited Cloudflare migrations page, key-value backed namespaces can no longer be created; only new_sqlite_classes mints a fresh namespace.",
+      "given": "a wrangler.toml whose migrations tag uses the deprecated new_classes keyword",
+      "when": "the anatomy assertion runs",
+      "then": "the assertion refuses with DO_MIGRATION_KEYWORD_STALE naming the vendor page and today's verifiedOn date",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "responsibilities.migrationsTag"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3401-platform-cloudflare-durable-objects-namespace-facade"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T23:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33109.json

@@ -16,12 +16,55 @@
       "when": "two concurrent increments fire",
       "then": "the FIFO-first increment returns witness 0, the second returns witness 1, and read returns 2",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33109-2",
+      "description": "read() has no witness field: a SingleCellObject at counter 3 driven with read() resolves to a bare number 3, not an object; there is no witness field on a read result. The witness is a per-increment observable, tied to serialisation, and does not apply to a pure read that does not advance the FIFO queue.",
+      "given": "a SingleCellObject at counter 3",
+      "when": "read() is called",
+      "then": "the result is the primitive number 3 (no witness field, no object wrapping)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.serialise"
+      }
+    },
+    {
+      "id": "AC-33109-3",
+      "description": "reset() has no witness field: a reset() call against a SingleCellObject at counter 5 resolves to the primitive number 0 (the reset value); no witness field. reset advances the FIFO turn but its return contract mirrors read, not increment.",
+      "given": "a SingleCellObject at counter 5",
+      "when": "reset() is called",
+      "then": "the result is the primitive number 0 (no witness field)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.serialise"
+      }
+    },
+    {
+      "id": "AC-33109-4",
+      "description": "N=100 concurrent increments: 100 concurrent increment(1) calls at initial counter 0 resolve to 100 {counter, witness} pairs. Sorted witnesses equal [0..99] exactly (no gaps, no duplicates); sorted counters equal [1..100]. read() after the batch returns 100. The FIFO queue holds under high concurrency.",
+      "given": "a SingleCellObject at counter 0",
+      "when": "100 concurrent increment(1) calls fire and read follows",
+      "then": "sorted witnesses equal [0..99]; sorted counters equal [1..100]; read returns 100",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.serialise"
+      }
     }
   ],
   "tacIds": [
     "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }