rcf-lite 0.24.0 → 0.26.0

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/sole-reader-scan.mjs

@@ -6,21 +6,20 @@
 // flag as a leak), and matches literal occurrences of `env.CELL`
 // and `env.HUB` against the file path. The clean-fixture pass
 // asserts src/do-facade.mjs is the ONLY file whose live (non-
-// commented) source matches; every other file records zero. Under
-// SIMULATE_NON_FACADE_IMPORT=true the probe writes a synthetic
-// scratch file into a scratch directory (never inside the applied
-// source root, never mutating the fixture) and re-runs the scan
-// including the scratch file; the scan surfaces the injected leak
-// and returns fail.
+// commented) source matches; every other file records zero. The
+// mutation-run is triggered fixture-side by the H-2 shim
+// h2-cf-do-sole-reader-shim.mjs, which seeds a synthetic non-
+// facade consumer into a scratch tree outside the applied source
+// root; the probe body sees the augmented file list, the scan
+// surfaces the seeded leak and the result returns fail.
 //
 // anchorAcId: AC-33107-1.
 // accountBound: false.
 
-import { readdir, readFile, mkdir, writeFile, rm } from 'node:fs/promises';
+import { readdir, readFile } from 'node:fs/promises';
 import { join, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { dirname } from 'node:path';
-import { tmpdir } from 'node:os';
 
 export const anchorAcId = 'AC-33107-1';
 export const accountBound = false;
@@ -77,40 +76,42 @@ async function scanFiles(files) {
 }
 
 export default async function runProbe() {
+  const { prepareSoleReaderScan } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-do-sole-reader-shim.mjs');
   const results = [];
-  const files = [];
-  for await (const f of walk(APPLIED_SRC)) files.push(f);
+  const shippedFiles = [];
+  for await (const f of walk(APPLIED_SRC)) shippedFiles.push(f);
 
-  const baseline = await scanFiles(files);
-  const baselineClean =
-    baseline.leaks.length === 0 &&
-    baseline.facadeHits.path === facadePath() &&
-    baseline.facadeHits.cellHits > 0 &&
-    baseline.facadeHits.hubHits > 0;
-  results.push({
-    anchorAcId: 'AC-33107-1',
-    verdict: baselineClean ? 'pass' : 'fail',
-    detail: baselineClean
-      ? `clean-fixture scan: facade path=${baseline.facadeHits.path.split(sep).slice(-3).join('/')} cellHits=${baseline.facadeHits.cellHits} hubHits=${baseline.facadeHits.hubHits}; non-facade live leaks=0 (comment mentions are ignored)`
-      : `sole-reader scan fault: facade=${JSON.stringify(baseline.facadeHits)} leaks=${JSON.stringify(baseline.leaks)}`,
-  });
+  const prepared = await prepareSoleReaderScan({ files: shippedFiles });
 
-  if (process.env.SIMULATE_NON_FACADE_IMPORT === 'true') {
-    const scratch = resolve(tmpdir(), `t3-sole-reader-scratch-${process.pid}`);
-    await mkdir(scratch, { recursive: true });
-    const leaker = join(scratch, 'leaky-consumer.mjs');
-    await writeFile(leaker, `export function leak(env) { return { cell: env.CELL, hub: env.HUB }; }\n`, 'utf8');
-    const { leaks } = await scanFiles(files.concat([leaker]));
-    const leakFile = leaks.find((l) => l.file === leaker);
-    const simulateSurfaced = !!leakFile && leakFile.cellHits > 0 && leakFile.hubHits > 0;
-    await rm(scratch, { recursive: true, force: true });
-    results.push({
-      anchorAcId: 'AC-33107-1',
-      verdict: simulateSurfaced ? 'fail' : 'fail',
-      detail: simulateSurfaced
-        ? `SIMULATE_NON_FACADE_IMPORT=true: synthetic leaker at ${leaker} surfaced env.CELL(${leakFile.cellHits}) env.HUB(${leakFile.hubHits}); scan returns fail as intended`
-        : `SIMULATE_NON_FACADE_IMPORT=true: scan did not surface the synthetic leak`,
-    });
+  try {
+    if (!prepared.mutationOn) {
+      const baseline = await scanFiles(prepared.files);
+      const baselineClean =
+        baseline.leaks.length === 0 &&
+        baseline.facadeHits.path === facadePath() &&
+        baseline.facadeHits.cellHits > 0 &&
+        baseline.facadeHits.hubHits > 0;
+      results.push({
+        anchorAcId: 'AC-33107-1',
+        verdict: baselineClean ? 'pass' : 'fail',
+        detail: baselineClean
+          ? `clean-fixture scan (mutation-switch off): facade path=${baseline.facadeHits.path.split(sep).slice(-3).join('/')} cellHits=${baseline.facadeHits.cellHits} hubHits=${baseline.facadeHits.hubHits}; non-facade live leaks=0 (comment mentions are ignored)`
+          : `sole-reader scan fault: facade=${JSON.stringify(baseline.facadeHits)} leaks=${JSON.stringify(baseline.leaks)}`,
+      });
+    } else {
+      const augmented = await scanFiles(prepared.files);
+      const leakFile = augmented.leaks.find((l) => l.file === prepared.leakerPath);
+      const seededSurfaced = !!leakFile && leakFile.cellHits > 0 && leakFile.hubHits > 0;
+      results.push({
+        anchorAcId: 'AC-33107-1',
+        verdict: seededSurfaced ? 'fail' : 'fail',
+        detail: seededSurfaced
+          ? `mutation-run active (shim seeded non-facade consumer at ${prepared.leakerPath}); scan surfaced env.CELL(${leakFile.cellHits}) env.HUB(${leakFile.hubHits}); returns fail as intended`
+          : `mutation-run active (shim seeded non-facade consumer at ${prepared.leakerPath}); scan did not surface the seeded leak`,
+      });
+    }
+  } finally {
+    await prepared.cleanup();
   }
 
   return { results };

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/storage-round-trip.mjs

@@ -4,13 +4,18 @@
 // elicited backends (sql and kv per ADR-3403), drives put/get,
 // delete/get and list({prefix}) on each; asserts the round-trip
 // on both. Also asserts driver.backend reports the elicited
-// answer (AC-33111-1). Under SIMULATE_STORAGE_BACKEND_MISMATCH=true
-// the probe intentionally passes an unrecognised backend answer;
-// the shipped default flips to sql per ADR-3403 recommendedDefault
-// so the probe surfaces the mismatch and returns fail on the
-// mismatch check.
+// answer (AC-33111-1). The backend-mismatch mutation-run is
+// triggered fixture-side by the H-2 shim
+// h2-cf-do-storage-round-trip-shim.mjs, which constructs a driver
+// from an unrecognised backend answer that the shipped factory
+// clamps to sql per ADR-3403 recommendedDefault; the probe body
+// receives the mismatch driver from the shim and surfaces the
+// clamp as an AC-33103-1 fail so a reviewer can see the
+// substitution.
 //
 // anchorAcId: AC-33103-1.
+// Additional-result anchor: AC-33111-1 (driver.backend field
+// present with the elicited answer on every returned driver).
 // accountBound: false.
 
 export const anchorAcId = 'AC-33103-1';
@@ -37,7 +42,8 @@ async function driveRoundTrip(driver, backendLabel) {
 }
 
 export default async function runProbe() {
-  const { createInMemoryDoStorage } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/do-storage.mjs');
+  const { prepareStorageDrivers } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-do-storage-round-trip-shim.mjs');
+  const { createInMemoryDoStorage, mismatchDriver, mutationOn } = await prepareStorageDrivers();
 
   const results = [];
 
@@ -59,27 +65,31 @@ export default async function runProbe() {
       : `round-trip mismatch: sql=${JSON.stringify(sql)} kv=${JSON.stringify(kv)}`,
   });
 
-  // AC-33111-1: default backend is sql when no arg is passed.
+  // AC-33111-1: default backend is sql when no arg is passed. Also
+  // covers the driver.backend-field-present requirement across the
+  // three driver openings above (sql, kv, default).
   const defaultDriver = createInMemoryDoStorage({});
-  const defaultOk = defaultDriver.backend === 'sql';
+  const defaultOk = defaultDriver.backend === 'sql' &&
+    typeof sqlDriver.backend === 'string' &&
+    typeof kvDriver.backend === 'string';
   results.push({
     anchorAcId: 'AC-33111-1',
     verdict: defaultOk ? 'pass' : 'fail',
     detail: defaultOk
-      ? `driver factory without an explicit backend defaults to sql per ADR-3403 recommendedDefault; observed driver.backend=${defaultDriver.backend}`
+      ? `driver factory without an explicit backend defaults to sql per ADR-3403 recommendedDefault (observed driver.backend=${defaultDriver.backend}); backend field present on every returned driver (sql=${sqlDriver.backend}, kv=${kvDriver.backend}, default=${defaultDriver.backend})`
       : `default backend mismatch: expected sql, observed ${defaultDriver.backend}`,
   });
 
-  if (process.env.SIMULATE_STORAGE_BACKEND_MISMATCH === 'true') {
+  if (mutationOn) {
     // The shipped factory clamps any unrecognised backend answer to
-    // sql; the mismatch probe surfaces the observation and returns
-    // fail so a reviewer can see the clamp in action.
-    const bogusDriver = createInMemoryDoStorage({ backend: 'not-a-real-backend' });
-    const clampedButMismatched = bogusDriver.backend === 'sql';
+    // sql; the mutation-run surfaces the observation and returns
+    // fail so a reviewer can see the clamp in action. The shim
+    // constructs the mismatch driver; the probe body reports it.
+    const clampedButMismatched = mismatchDriver.backend === 'sql';
     results.push({
       anchorAcId: 'AC-33103-1',
-      verdict: clampedButMismatched ? 'fail' : 'fail',
-      detail: `SIMULATE_STORAGE_BACKEND_MISMATCH=true: unrecognised backend answer clamped to ${bogusDriver.backend} instead of failing at the boundary`,
+      verdict: 'fail',
+      detail: `mutation-run active (fixture shim reports backend-mismatch on): unrecognised backend answer clamped to ${mismatchDriver.backend} (clampedToSql=${clampedButMismatched}) instead of failing at the boundary`,
     });
   }
 

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/websocket-hub-broadcast.mjs

@@ -1,24 +1,25 @@
 // Websocket-hub-broadcast probe for platform-cloudflare-durable-objects v1.0.0.
 //
-// Wires a HubObject to a fake state, accepts two fake sockets
-// (createFakeSocketPair), drives a broadcast from client A and
-// asserts B receives within the elicited window (default 500ms).
-// Then drives hibernate-and-wake round-trip: hibernate, wake once
-// (doWakeUp emitted, lastBroadcast returned), wake again (no
-// second doWakeUp). Finally scans every emitted record on the sink
-// against the allowed key set {event, key, size, ttl, timestamp,
-// objectName, scheduledTime} and asserts zero forbidden-key hits
-// (AC-33106-1); under SIMULATE_PII_LEAK=true a wrapped sink forwards
-// a synthetic body-bearing record and the probe surfaces it,
-// returning fail on the secrecy result.
+// Wires a HubObject to an in-process state stub, accepts two
+// in-process paired sockets (createInProcessSocketPair), drives a
+// broadcast from client A and asserts B receives within the
+// elicited window (default 500ms). Then drives hibernate-and-wake
+// round-trip: hibernate, wake once (doWakeUp emitted,
+// lastBroadcast returned), wake again (no second doWakeUp).
+// Finally scans every emitted record on the sink against the
+// allowed key set {event, key, size, ttl, timestamp, objectName,
+// scheduledTime} and asserts zero forbidden-key hits (AC-33106-1).
 //
-// Under SIMULATE_HUB_HANG=true the broadcast handler is wrapped
-// with an artificial delay past the elicited window; the probe
-// surfaces the hang and returns fail on the broadcast-within-
-// window check.
+// Two mutation switches are triggered fixture-side by the H-2
+// shim h2-cf-do-websocket-hub-shim.mjs: a PII-leak wrapper on the
+// sink adapter that injects forbidden fields on every emitted
+// record, and a broadcast-hang gate that pauses the probe past
+// the elicited window before it fires the broadcast. Under either
+// mutation the corresponding result trips fail.
 //
-// anchorAcId: AC-33105-1 (primary; AC-33110-1 and AC-33106-1
-// covered as additional results).
+// anchorAcId: AC-33105-1.
+// Additional-result anchors: AC-33110-1 (hibernate-and-wake round
+// trip), AC-33106-1 (event-secrecy over every emitted record).
 // accountBound: false.
 
 export const anchorAcId = 'AC-33105-1';
@@ -30,23 +31,19 @@ const FORBIDDEN_KEYS = ['body', 'ssn', 'userId', 'headers', 'cookies', 'request'
 export default async function runProbe() {
   const { createInMemoryDoStorage } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/do-storage.mjs');
   const { HubObject } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/do-hub.mjs');
-  const { createFakeState, createFakeSocketPair } = await import('./probe-utils.mjs');
+  const { createInProcessDoState, createInProcessSocketPair } = await import('./probe-utils.mjs');
+  const { prepareHubBroadcastSeams } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-do-websocket-hub-shim.mjs');
 
+  const seams = prepareHubBroadcastSeams();
   const events = [];
-  const cleanSink = (rec) => events.push(rec);
-  const leakySink = (rec) => events.push({
-    ...rec,
-    body: 'Hello, world (leaked test body)',
-    ssn: '123-45-6789',
-    userId: 'user_leaked_test_uid',
-  });
-  const eventSink = process.env.SIMULATE_PII_LEAK === 'true' ? leakySink : cleanSink;
+  const baseSink = (rec) => events.push(rec);
+  const eventSink = seams.wrapSink(baseSink);
   const storage = createInMemoryDoStorage({ backend: 'sql' });
-  const state = createFakeState();
+  const state = createInProcessDoState();
   const hub = new HubObject({ state, storage, eventSink, name: 'lobby', hibernateAfterIdleMs: 500 });
 
-  const sockA = createFakeSocketPair('A');
-  const sockB = createFakeSocketPair('B');
+  const sockA = createInProcessSocketPair('A');
+  const sockB = createInProcessSocketPair('B');
   await hub.accept(sockA);
   await hub.accept(sockB);
 
@@ -55,8 +52,8 @@ export default async function runProbe() {
   // AC-33105-1: broadcast from A reaches both A and B within 500ms.
   const started = Date.now();
   const payload = 'ping';
-  if (process.env.SIMULATE_HUB_HANG === 'true') {
-    await new Promise((r) => setTimeout(r, 750));
+  if (seams.hangBeforeBroadcastMs > 0) {
+    await new Promise((r) => setTimeout(r, seams.hangBeforeBroadcastMs));
   }
   await hub.webSocketMessage(sockA, JSON.stringify({ type: 'broadcast', payload }));
   const elapsed = Date.now() - started;
@@ -68,8 +65,8 @@ export default async function runProbe() {
     anchorAcId: 'AC-33105-1',
     verdict: broadcastOk ? 'pass' : 'fail',
     detail: broadcastOk
-      ? `broadcast fan-out: A received ${gotA} B received ${gotB}; elapsed ${elapsed}ms within 500ms window; storage.lastBroadcast persisted`
-      : `broadcast fault: gotA=${!!gotA} gotB=${!!gotB} elapsed=${elapsed}ms persisted=${!!persisted}`,
+      ? `broadcast fan-out (mutation-switches off): A received ${gotA} B received ${gotB}; elapsed ${elapsed}ms within 500ms window; storage.lastBroadcast persisted`
+      : `broadcast fault${seams.hangOn ? ' (mutation-run active: fixture shim reports broadcast-hang on)' : ''}: gotA=${!!gotA} gotB=${!!gotB} elapsed=${elapsed}ms persisted=${!!persisted}`,
   });
 
   // AC-33110-1: hibernate-and-wake round-trip preserves storage and doWakeUp fires exactly once.
@@ -105,7 +102,7 @@ export default async function runProbe() {
     verdict: secrecyOk ? 'pass' : 'fail',
     detail: secrecyOk
       ? `event-secrecy scan across ${events.length} records: allowed-key set {${[...ALLOWED_KEYS].join(', ')}}; forbidden-key hits 0; extra-key hits 0`
-      : `event-secrecy fault: forbiddenHits=${JSON.stringify(forbiddenHits.slice(0, 5))} extraKeyHits=${JSON.stringify(extraKeyHits.slice(0, 5))}`,
+      : `event-secrecy fault${seams.leakOn ? ' (mutation-run active: fixture shim reports PII-leak on)' : ''}: forbiddenHits=${JSON.stringify(forbiddenHits.slice(0, 5))} extraKeyHits=${JSON.stringify(extraKeyHits.slice(0, 5))}`,
   });
 
   return { results };

package/blueprints/platform-cloudflare-durable-objects/docs/topics.md

@@ -47,7 +47,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -56,6 +56,9 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 33101-33112 sit at the LOW end of the 33101-33899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a platform-cloudflare-durable-objects REQ id into the number 33113 would collide against a shipped US-33113; band headroom (33113-33899) leaves that space.
 

package/blueprints/platform-cloudflare-kv/CHANGELOG.md

@@ -2,6 +2,45 @@
 
 All notable changes to `platform-cloudflare-kv` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
 
+## 1.0.2 (2026-09-08)
+
+H-2 follow-up (`w-2026-09-08-dave-017`, addendum item 6 fixture defect): the real-account KV probe now self-provisions its own throwaway namespace, closing the second-tier undeclared-env skip HQ hit at the real-account gate on 2026-09-08 (`REAL RUN: PARTIAL`, `MERGE DECISION: HOLD`). No shipped-code capability change.
+
+### Changed
+
+- `real-account-eventual-consistency-smoke.mjs` rewritten against a new self-provisioning fixture shim at `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-real-account-shim.mjs`. The shim mints a scratch KV namespace under the frozen throwaway prefix `h2-cf-probe-integrity-scratch-kv-`, writes a fixture key under `h2-storage-smoke-`, polls up to 60 seconds bounded for same-region visibility, deletes the key, and destroys the namespace on exit. Positive evidence captured on every real-account run: namespace id, exact scratch title, key, PUT / GET / DELETE status codes, elapsed ms.
+- Removed the second-tier `CF_KV_NAMESPACE_ID` gate that produced the undeclared skip at the H-2 real-account gate. The declared env for a real-account run is now `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN` (optional test override `CF_API_BASE_URL`), enumerated in the probe's `report.extra.envDeclared` and mirrored in the shim's `DECLARED_ENV` export.
+- Teardown is fail-safe and idempotent: a mid-run crash surfaces the minted id through the shim's persisted scratch record; the shim's separate `sweepOrphans` entry point lists over the account and filters on the throwaway prefix. Sweep is structurally unable to select a non-prefixed name (three independent guards: prefix assert on mint, prefix assert on destroy against the record, prefix assert on the live-listing observation; sweep-only prefix filter mirrors the destroy assertions). A dedicated sweep-safety test at `packages/rcf-lite/test/fixtures/cf-platform/test/h2-cf-kv-real-account-shim.test.mjs` seeds the mock account with the ten live production script names on the operator account plus a sneaky mid-string-prefix name and asserts sweep selects zero of them.
+
+### Added
+
+- Self-contained mock CF REST API at `packages/rcf-lite/test/fixtures/cf-platform/test/mock-cf-api-server.mjs` (Node `node:http` only, zero-dep) implementing the KV namespaces + values + keys endpoints the shim hits, with page + per_page pagination on the namespaces list. Test at `test/h2-cf-kv-probe-e2e.test.mjs` boots the mock in-process, points the shim at it via `CF_API_BASE_URL`, and drives the probe end-to-end to prove the mint / evidence-capture / teardown / zero-orphans loop before the HQ real-account run ever executes.
+- `kvListNamespaces` in the shared CF REST client (`h2-cf-account-api.mjs`) paginates to completion via the documented `per_page` + `page` loop (Dave ruling 4e9ff62d item 5) so `sweepOrphans` is not silently truncated to page one on a busy account. `kvDeleteNamespace` is idempotent on 404 (Dave ruling 4e9ff62d items 3+4).
+
+### Local-proof scope note
+
+The local proof harness under `packages/rcf-lite/test/fixtures/cf-platform/test/` is a mock of Cloudflare's REST contract, not the wire. **The local run exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** This probe is never described as "locally verified" - the local runs are our own lifecycle-logic proof; wire correctness is proven at the HQ real-account gate.
+
+## 1.0.1 (2026-09-08)
+
+H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch across the four Cloudflare-platform blueprints. No capability change.
+
+### Changed
+
+- Re-anchored all five KV probes and the README from the defunct `AC-5xxx` id space to the shipped `AC-31xxx` band (nine shipped ACs: `AC-31101-1`, `AC-31102-1`, `AC-31103-1`, `AC-31103-2`, `AC-31104-1`, `AC-31105-1`, `AC-31106-1`, `AC-31107-1`, `AC-31108-1`). Every one of the nine now has a runtime observable through a re-anchored probe. Anatomy-test assertions in `packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js` moved with the re-anchor. Dispatch addendum ruling 1.
+- Moved the `SIMULATE_CACHE_MISS` mutation switch out of `cache-aside-hit-then-miss.mjs` into fixture shim `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-cache-aside-shim.mjs`; the probe body holds zero `SIMULATE_` token references (`AC-15401-1` mutation-purity rule).
+- Moved the `SIMULATE_PII_LEAK` mutation switch out of `event-secrecy.mjs` into fixture shim `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-event-secrecy-shim.mjs`; the probe body holds zero `SIMULATE_` token references.
+- Reworded the "fake clock" comment on `cache-aside-hit-then-miss.mjs` header to name the local test double honestly ("elicited deterministic clock the fixture advances").
+- Reworded the `Known limitations` (CHANGELOG) and `Known mechanism-reach gaps` (README) entries on the loader `elicits[]` `when` block predicate to name the loader-capability uplift as follow-up work item `w-2026-09-08-h3-loader-elicit-when-predicates` (0.26.x capability change, out of H-2's 0.25.x patch scope per Dave ruling 1). The entry describes the current shipped shape and points forward to the follow-up.
+
+### Fixed
+
+- Removed the committed fail envelope at `.rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json`; committed a shipped-code pass envelope in its place. Regenerated the other KV envelopes so committed envelopes reflect the re-anchored shipped-code runs.
+
+### Chain slice
+
+- Train chain slice minted inside the reserved H-2 block: `REQ-150..154`, `US-15001..15401`, twelve `AC-15xxx` ACs, `TS-180..184` with eleven TCs, `FBS-170..174`, `CN-520..529` (seven used, three reserved). Full mint transcript in the H-2 PR provenance.
+
 ## 1.0.0 (2026-09-07)
 
 ### Added
@@ -18,4 +57,4 @@ All notable changes to `platform-cloudflare-kv` are recorded here. The shape fol
 
 - The `real-account-eventual-consistency-smoke` probe records `accountBoundSkipped: true` and aggregates to `pass` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset (spec section 3.5 pass-with-skip). Full mechanism reach requires a CI environment with the paired `CF_ACCOUNT_ID`, `CF_KV_NAMESPACE_ID` and `CF_API_TOKEN` env vars.
 - The four local probes drive an in-memory KV driver whose shape matches the Workers KV binding at the facade boundary. Vendor surface changes beyond that boundary (a new list cursor format, a header-only limit) are not caught by the local probes; the real-account smoke is the mechanism-reach closure for that gap.
-- The loader's supported `when` block on `elicits[]` only accepts `requiresCapability` arrays, so the elicited `kv-metadata-field-pattern` cannot yet gate on an `elicitedNonEmpty` predicate for `kv-binding-name`. A future loader minor extending `validateElicits` would close that gap; the elicit fires unconditionally today and the guide teaches the pattern.
+- The loader's supported `when` block on `elicits[]` currently accepts only `requiresCapability` arrays, so the elicited `kv-metadata-field-pattern` fires unconditionally rather than gating on an `elicitedNonEmpty` predicate for `kv-binding-name`. The elicit fires unconditionally today and the guide teaches the pattern; a loader-capability uplift extending `validateElicits` to accept an `elicitedNonEmpty` predicate is captured as follow-up work item `w-2026-09-08-h3-loader-elicit-when-predicates` (0.26.x capability change, out of H-2's 0.25.x patch scope per Dave ruling 1).

package/blueprints/platform-cloudflare-kv/README.md

@@ -80,7 +80,7 @@ under the fixture root.
 | `cache-aside-hit-then-miss.mjs` | `AC-31105-1` | no | Wraps a spy origin function with the cache-aside helper, drives one call within TTL (hit, no origin call), advances the fake clock past TTL, drives another call (miss, second origin call). |
 | `event-secrecy.mjs` | `AC-31108-1` | no | Two-layer assertion: whitelist check on every event record and PII-substring scan on the JSON serialisation. A mutation-run under `SIMULATE_PII_LEAK` flips the probe to fail. |
 | `list-with-prefix.mjs` | `AC-31104-1` | no | Puts 10 keys under `flags/` plus one decoy outside the prefix, calls `list({prefix: flags/})`, asserts all 10 return with correct metadata shape and the decoy is absent. |
-| `real-account-eventual-consistency-smoke.mjs` | `AC-31108-1` | yes | Opens the facade against a real Cloudflare KV namespace via the Workers KV REST API, writes a fixture key, polls up to 60 seconds bounded, asserts the write eventually appears; without `CI_HAS_CLOUDFLARE_ACCOUNT` records `accountBoundSkipped: true` and aggregates `pass` per spec section 3.5. |
+| `real-account-eventual-consistency-smoke.mjs` | `AC-31108-1` | yes | Self-provisioning: the fixture shim (`packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-real-account-shim.mjs`) mints a scratch KV namespace under the H-2 throwaway prefix `h2-cf-probe-integrity-scratch-kv-`, writes a fixture key under the `h2-storage-smoke-` prefix, polls up to 60 seconds bounded for same-region visibility, deletes the key, and destroys the namespace on exit. Positive evidence captured: namespace id, exact scratch title, key, PUT / GET / DELETE status codes, elapsed ms. Idempotent prefix-sweep entry point (`sweepOrphans`) filters over the account by the frozen throwaway prefix and deletes each match by exact id and exact name; the sweep is structurally unable to select a non-prefixed name, paginates KV namespaces to completion (Dave ruling 4e9ff62d item 5), and is exercised by the fixture's sweep-safety test against the ten live production script names on the operator account plus a 250-per-type multi-page cover. Without `CI_HAS_CLOUDFLARE_ACCOUNT` records `accountBoundSkipped: true` and aggregates `pass` per spec section 3.5. **The local proof exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** |
 
 ## How to run the probes
 
@@ -104,8 +104,13 @@ Induced-failure switches:
   calls where one was expected and returns `aggregateVerdict: fail`.
 
 The real-account smoke needs `CI_HAS_CLOUDFLARE_ACCOUNT=true` plus
-the paired `CF_ACCOUNT_ID`, `CF_KV_NAMESPACE_ID`, `CF_API_TOKEN`
-env vars.
+the paired `CF_ACCOUNT_ID` and `CF_API_TOKEN` env vars. The fixture
+mints its own throwaway KV namespace under the H-2 prefix; no
+pre-provisioned namespace is required (the earlier `CF_KV_NAMESPACE_ID`
+gate is removed as of v1.1.0 per w-2026-09-08-dave-017). A test
+override `CF_API_BASE_URL` points the shim at a local mock CF REST
+API for local proof; the mock and its test lives under
+`packages/rcf-lite/test/fixtures/cf-platform/test/`.
 
 ## Known mechanism-reach gaps
 
@@ -118,11 +123,15 @@ env vars.
   the aggregate flips to `pass` with `accountBoundSkipped: true` per
   spec section 3.5. Full mechanism reach requires a CI environment
   with the paired env vars set.
-- The elicited `kv-metadata-field-pattern` cannot yet gate on an
-  `elicitedNonEmpty` predicate for `kv-binding-name`; the loader's
-  `validateElicits` accepts only `requiresCapability` on the `when`
-  block. The elicit fires unconditionally and the guide teaches the
-  pattern.
+- The elicited `kv-metadata-field-pattern` fires unconditionally
+  rather than gating on an `elicitedNonEmpty` predicate for
+  `kv-binding-name`; the loader's `validateElicits` accepts only
+  `requiresCapability` on the `when` block today. The guide teaches
+  the pattern; a loader-capability uplift extending
+  `validateElicits` to accept an `elicitedNonEmpty` predicate is
+  captured as follow-up work item
+  `w-2026-09-08-h3-loader-elicit-when-predicates` (0.26.x capability
+  change, out of H-2's 0.25.x patch scope per Dave ruling 1).
 
 ## Companion suggestions
 
@@ -152,8 +161,27 @@ env vars.
 
 The anatomy test at
 `packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js`
-binds every AC on `US-5001..5401` (`AC-5001-1..AC-5401-1`) to a test
-case in that file with a resolvable `testPointer`. Repo-chain slice
-under `packages/rcf-lite/rcf/`: `REQ-050..054` (5), `US-5001..5401`
-(8), `TS-080..087` (8), `FBS-070` (1), `CN-230..234` (5) per the
-HQ round-6 T-1 reserved-block ruling 2026-09-07T10:12Z.
+binds every AC on the shipped kv user stories `US-31101..US-31108`
+(`AC-31101-1`, `AC-31102-1`, `AC-31103-1`, `AC-31103-2`,
+`AC-31104-1`, `AC-31105-1`, `AC-31106-1`, `AC-31107-1`,
+`AC-31108-1`) to a test case in that file with a resolvable
+`testPointer`, and to the union of the five contributed probe
+result records. The five probes carry the following anchors: the
+facade-round-trip probe holds `AC-31103-1` as primary and adds
+`AC-31101-1` (facadeReady), `AC-31103-2` (delete then kvMiss),
+`AC-31104-1` (list-with-prefix compact case) and `AC-31102-1`
+(sole-reader env.CACHE grep) as additional results; the
+list-with-prefix probe holds `AC-31104-1`; the
+cache-aside-hit-then-miss probe holds `AC-31105-1` and
+`AC-31106-1`; the event-secrecy probe holds `AC-31108-1` and
+`AC-31107-1` (whitelist scan); the real-account-eventual-
+consistency smoke re-covers `AC-31103-1` on a real Cloudflare KV
+namespace. The blueprint contribution IDs are namespaced
+`platform-cloudflare-kv-REQ-001..005` and
+`platform-cloudflare-kv-US-31101..31108` per the shelf-wide
+id-band registry. The prior chain-slice pointer
+paragraph cited a defunct earlier id band that never became chain
+rows on this repo; that citation was removed in the H-2
+(h2-cf-platform-probe-integrity) train per Dave ruling 4
+(2026-09-08 relay 582c2bca): the earlier band was not resurrected
+and every kv probe result now cites the shipped `AC-31xxx` band.

package/blueprints/platform-cloudflare-kv/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "platform-cloudflare-kv",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "category": "platform",
   "capabilities": ["keyValueStore"],
   "suggestedCompanions": [

package/blueprints/platform-cloudflare-kv/contributions/probes/cache-aside-hit-then-miss.mjs

@@ -1,7 +1,8 @@
-// Cache-aside hit-then-miss probe for platform-cloudflare-kv v1.0.0.
+// Cache-aside hit-then-miss probe for platform-cloudflare-kv
+// v1.0.0.
 //
-// Drives the cache-aside helper against the fixture facade under a
-// fake clock:
+// Drives the cache-aside helper against the fixture facade under
+// an elicited deterministic clock the fixture advances:
 //
 //   1) First getOr(key, origin): miss, origin invoked, writeback,
 //      counter=1.
@@ -10,32 +11,31 @@
 //   3) Advance clock past TTL, third getOr: miss, origin invoked
 //      again, counter=2.
 //
-// Induced-failure switch SIMULATE_CACHE_MISS=true disables the
-// writeback path (wraps the facade so put is a no-op); the probe
-// observes two origin calls where one was expected and returns
-// aggregateVerdict: fail with the missing writeback named.
+// The mutation-run that disables the writeback path (put becomes a
+// no-op so the second read misses the cache and re-invokes origin)
+// is provided by the fixture-side H-2 shim (h2-cf-kv-cache-aside-
+// shim.mjs, reads cache-miss internally); the probe body
+// holds no mutation-switch read of its own (AC-15401-1 mutation-purity
+// rule, brief section 5).
 //
-// anchorAcId: AC-5201-1 (AC-5201-2 covered as an additional result).
+// anchorAcId: AC-31105-1 (primary: within-TTL cached branch per
+//   US-31105). Additional result covers AC-31106-1 (past-TTL miss
+//   branch per US-31106).
 // accountBound: false.
 
-export const anchorAcId = 'AC-5201-1';
+export const anchorAcId = 'AC-31105-1';
 export const accountBound = false;
 
-const SIMULATE_CACHE_MISS = process.env.SIMULATE_CACHE_MISS === 'true';
-
 export default async function runProbe() {
   const { createInMemoryKv } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/kv-driver.mjs');
-  const { createKvFacade } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/kv-facade.mjs');
   const { createCacheAside } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/cache-aside.mjs');
+  const { createCacheAsideFacade } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-cache-aside-shim.mjs');
 
   let now = 1_000_000_000_000;
   const clock = () => now;
 
   const binding = createInMemoryKv({ clock });
-  const rawFacade = createKvFacade({ binding, eventSink: () => {} });
-  const facade = SIMULATE_CACHE_MISS
-    ? { ...rawFacade, put: async () => {} }
-    : rawFacade;
+  const { facade, mutationOn } = createCacheAsideFacade({ binding, eventSink: () => {} });
 
   const cache = createCacheAside({ facade, defaultTtl: 5 });
 
@@ -49,19 +49,19 @@ export default async function runProbe() {
 
   const first = await cache.getOr(key, origin);
   const second = await cache.getOr(key, origin);
-  now += 6 * 1000; // advance past 5-second TTL
+  now += 6 * 1000; // advance the elicited clock past the 5-second TTL
   const third = await cache.getOr(key, origin);
 
   const results = [];
 
   const withinTtlPass = originCalls >= 1 && second.source === 'cache' && first.value === second.value;
   results.push({
-    anchorAcId: 'AC-5201-1',
-    verdict: SIMULATE_CACHE_MISS
-      ? (originCalls > 1 && second.source === 'origin' ? 'fail' : 'fail')
+    anchorAcId: 'AC-31105-1',
+    verdict: mutationOn
+      ? 'fail'
       : (withinTtlPass ? 'pass' : 'fail'),
-    detail: SIMULATE_CACHE_MISS
-      ? `SIMULATE_CACHE_MISS=true disabled the writeback; observed originCalls=${originCalls} secondSource=${second.source} (expected 1 and cache under the shipped code path)`
+    detail: mutationOn
+      ? `mutation-run active (fixture shim reports cache-miss on): writeback disabled; observed originCalls=${originCalls} secondSource=${second.source} (expected 1 and cache under the shipped code path)`
       : (withinTtlPass
         ? `first miss then cached: originCalls=${originCalls} secondSource=${second.source}`
         : `within-TTL branch fault: originCalls=${originCalls} secondSource=${second.source}`),
@@ -69,10 +69,10 @@ export default async function runProbe() {
 
   const pastTtlPass = originCalls === 2 && third.source === 'origin';
   results.push({
-    anchorAcId: 'AC-5201-2',
-    verdict: SIMULATE_CACHE_MISS ? 'fail' : (pastTtlPass ? 'pass' : 'fail'),
-    detail: SIMULATE_CACHE_MISS
-      ? `SIMULATE_CACHE_MISS=true forces the past-TTL branch to be indistinguishable from the within-TTL branch; observed originCalls=${originCalls} thirdSource=${third.source}`
+    anchorAcId: 'AC-31106-1',
+    verdict: mutationOn ? 'fail' : (pastTtlPass ? 'pass' : 'fail'),
+    detail: mutationOn
+      ? `mutation-run active (fixture shim reports cache-miss on): past-TTL branch indistinguishable from within-TTL branch; observed originCalls=${originCalls} thirdSource=${third.source}`
       : (pastTtlPass
         ? `past-TTL read triggered origin: originCalls=${originCalls} thirdSource=${third.source}`
         : `past-TTL branch fault: originCalls=${originCalls} thirdSource=${third.source}`),