rcf-lite 0.25.0 → 0.26.0

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/storage-round-trip.mjs

@@ -4,13 +4,18 @@
 // elicited backends (sql and kv per ADR-3403), drives put/get,
 // delete/get and list({prefix}) on each; asserts the round-trip
 // on both. Also asserts driver.backend reports the elicited
-// answer (AC-33111-1). Under SIMULATE_STORAGE_BACKEND_MISMATCH=true
-// the probe intentionally passes an unrecognised backend answer;
-// the shipped default flips to sql per ADR-3403 recommendedDefault
-// so the probe surfaces the mismatch and returns fail on the
-// mismatch check.
+// answer (AC-33111-1). The backend-mismatch mutation-run is
+// triggered fixture-side by the H-2 shim
+// h2-cf-do-storage-round-trip-shim.mjs, which constructs a driver
+// from an unrecognised backend answer that the shipped factory
+// clamps to sql per ADR-3403 recommendedDefault; the probe body
+// receives the mismatch driver from the shim and surfaces the
+// clamp as an AC-33103-1 fail so a reviewer can see the
+// substitution.
 //
 // anchorAcId: AC-33103-1.
+// Additional-result anchor: AC-33111-1 (driver.backend field
+// present with the elicited answer on every returned driver).
 // accountBound: false.
 
 export const anchorAcId = 'AC-33103-1';
@@ -37,7 +42,8 @@ async function driveRoundTrip(driver, backendLabel) {
 }
 
 export default async function runProbe() {
-  const { createInMemoryDoStorage } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/do-storage.mjs');
+  const { prepareStorageDrivers } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-do-storage-round-trip-shim.mjs');
+  const { createInMemoryDoStorage, mismatchDriver, mutationOn } = await prepareStorageDrivers();
 
   const results = [];
 
@@ -59,27 +65,31 @@ export default async function runProbe() {
       : `round-trip mismatch: sql=${JSON.stringify(sql)} kv=${JSON.stringify(kv)}`,
   });
 
-  // AC-33111-1: default backend is sql when no arg is passed.
+  // AC-33111-1: default backend is sql when no arg is passed. Also
+  // covers the driver.backend-field-present requirement across the
+  // three driver openings above (sql, kv, default).
   const defaultDriver = createInMemoryDoStorage({});
-  const defaultOk = defaultDriver.backend === 'sql';
+  const defaultOk = defaultDriver.backend === 'sql' &&
+    typeof sqlDriver.backend === 'string' &&
+    typeof kvDriver.backend === 'string';
   results.push({
     anchorAcId: 'AC-33111-1',
     verdict: defaultOk ? 'pass' : 'fail',
     detail: defaultOk
-      ? `driver factory without an explicit backend defaults to sql per ADR-3403 recommendedDefault; observed driver.backend=${defaultDriver.backend}`
+      ? `driver factory without an explicit backend defaults to sql per ADR-3403 recommendedDefault (observed driver.backend=${defaultDriver.backend}); backend field present on every returned driver (sql=${sqlDriver.backend}, kv=${kvDriver.backend}, default=${defaultDriver.backend})`
       : `default backend mismatch: expected sql, observed ${defaultDriver.backend}`,
   });
 
-  if (process.env.SIMULATE_STORAGE_BACKEND_MISMATCH === 'true') {
+  if (mutationOn) {
     // The shipped factory clamps any unrecognised backend answer to
-    // sql; the mismatch probe surfaces the observation and returns
-    // fail so a reviewer can see the clamp in action.
-    const bogusDriver = createInMemoryDoStorage({ backend: 'not-a-real-backend' });
-    const clampedButMismatched = bogusDriver.backend === 'sql';
+    // sql; the mutation-run surfaces the observation and returns
+    // fail so a reviewer can see the clamp in action. The shim
+    // constructs the mismatch driver; the probe body reports it.
+    const clampedButMismatched = mismatchDriver.backend === 'sql';
     results.push({
       anchorAcId: 'AC-33103-1',
-      verdict: clampedButMismatched ? 'fail' : 'fail',
-      detail: `SIMULATE_STORAGE_BACKEND_MISMATCH=true: unrecognised backend answer clamped to ${bogusDriver.backend} instead of failing at the boundary`,
+      verdict: 'fail',
+      detail: `mutation-run active (fixture shim reports backend-mismatch on): unrecognised backend answer clamped to ${mismatchDriver.backend} (clampedToSql=${clampedButMismatched}) instead of failing at the boundary`,
     });
   }
 

package/blueprints/platform-cloudflare-durable-objects/contributions/probes/websocket-hub-broadcast.mjs

@@ -1,24 +1,25 @@
 // Websocket-hub-broadcast probe for platform-cloudflare-durable-objects v1.0.0.
 //
-// Wires a HubObject to a fake state, accepts two fake sockets
-// (createFakeSocketPair), drives a broadcast from client A and
-// asserts B receives within the elicited window (default 500ms).
-// Then drives hibernate-and-wake round-trip: hibernate, wake once
-// (doWakeUp emitted, lastBroadcast returned), wake again (no
-// second doWakeUp). Finally scans every emitted record on the sink
-// against the allowed key set {event, key, size, ttl, timestamp,
-// objectName, scheduledTime} and asserts zero forbidden-key hits
-// (AC-33106-1); under SIMULATE_PII_LEAK=true a wrapped sink forwards
-// a synthetic body-bearing record and the probe surfaces it,
-// returning fail on the secrecy result.
+// Wires a HubObject to an in-process state stub, accepts two
+// in-process paired sockets (createInProcessSocketPair), drives a
+// broadcast from client A and asserts B receives within the
+// elicited window (default 500ms). Then drives hibernate-and-wake
+// round-trip: hibernate, wake once (doWakeUp emitted,
+// lastBroadcast returned), wake again (no second doWakeUp).
+// Finally scans every emitted record on the sink against the
+// allowed key set {event, key, size, ttl, timestamp, objectName,
+// scheduledTime} and asserts zero forbidden-key hits (AC-33106-1).
 //
-// Under SIMULATE_HUB_HANG=true the broadcast handler is wrapped
-// with an artificial delay past the elicited window; the probe
-// surfaces the hang and returns fail on the broadcast-within-
-// window check.
+// Two mutation switches are triggered fixture-side by the H-2
+// shim h2-cf-do-websocket-hub-shim.mjs: a PII-leak wrapper on the
+// sink adapter that injects forbidden fields on every emitted
+// record, and a broadcast-hang gate that pauses the probe past
+// the elicited window before it fires the broadcast. Under either
+// mutation the corresponding result trips fail.
 //
-// anchorAcId: AC-33105-1 (primary; AC-33110-1 and AC-33106-1
-// covered as additional results).
+// anchorAcId: AC-33105-1.
+// Additional-result anchors: AC-33110-1 (hibernate-and-wake round
+// trip), AC-33106-1 (event-secrecy over every emitted record).
 // accountBound: false.
 
 export const anchorAcId = 'AC-33105-1';
@@ -30,23 +31,19 @@ const FORBIDDEN_KEYS = ['body', 'ssn', 'userId', 'headers', 'cookies', 'request'
 export default async function runProbe() {
   const { createInMemoryDoStorage } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/do-storage.mjs');
   const { HubObject } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/do-hub.mjs');
-  const { createFakeState, createFakeSocketPair } = await import('./probe-utils.mjs');
+  const { createInProcessDoState, createInProcessSocketPair } = await import('./probe-utils.mjs');
+  const { prepareHubBroadcastSeams } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-do-websocket-hub-shim.mjs');
 
+  const seams = prepareHubBroadcastSeams();
   const events = [];
-  const cleanSink = (rec) => events.push(rec);
-  const leakySink = (rec) => events.push({
-    ...rec,
-    body: 'Hello, world (leaked test body)',
-    ssn: '123-45-6789',
-    userId: 'user_leaked_test_uid',
-  });
-  const eventSink = process.env.SIMULATE_PII_LEAK === 'true' ? leakySink : cleanSink;
+  const baseSink = (rec) => events.push(rec);
+  const eventSink = seams.wrapSink(baseSink);
   const storage = createInMemoryDoStorage({ backend: 'sql' });
-  const state = createFakeState();
+  const state = createInProcessDoState();
   const hub = new HubObject({ state, storage, eventSink, name: 'lobby', hibernateAfterIdleMs: 500 });
 
-  const sockA = createFakeSocketPair('A');
-  const sockB = createFakeSocketPair('B');
+  const sockA = createInProcessSocketPair('A');
+  const sockB = createInProcessSocketPair('B');
   await hub.accept(sockA);
   await hub.accept(sockB);
 
@@ -55,8 +52,8 @@ export default async function runProbe() {
   // AC-33105-1: broadcast from A reaches both A and B within 500ms.
   const started = Date.now();
   const payload = 'ping';
-  if (process.env.SIMULATE_HUB_HANG === 'true') {
-    await new Promise((r) => setTimeout(r, 750));
+  if (seams.hangBeforeBroadcastMs > 0) {
+    await new Promise((r) => setTimeout(r, seams.hangBeforeBroadcastMs));
   }
   await hub.webSocketMessage(sockA, JSON.stringify({ type: 'broadcast', payload }));
   const elapsed = Date.now() - started;
@@ -68,8 +65,8 @@ export default async function runProbe() {
     anchorAcId: 'AC-33105-1',
     verdict: broadcastOk ? 'pass' : 'fail',
     detail: broadcastOk
-      ? `broadcast fan-out: A received ${gotA} B received ${gotB}; elapsed ${elapsed}ms within 500ms window; storage.lastBroadcast persisted`
-      : `broadcast fault: gotA=${!!gotA} gotB=${!!gotB} elapsed=${elapsed}ms persisted=${!!persisted}`,
+      ? `broadcast fan-out (mutation-switches off): A received ${gotA} B received ${gotB}; elapsed ${elapsed}ms within 500ms window; storage.lastBroadcast persisted`
+      : `broadcast fault${seams.hangOn ? ' (mutation-run active: fixture shim reports broadcast-hang on)' : ''}: gotA=${!!gotA} gotB=${!!gotB} elapsed=${elapsed}ms persisted=${!!persisted}`,
   });
 
   // AC-33110-1: hibernate-and-wake round-trip preserves storage and doWakeUp fires exactly once.
@@ -105,7 +102,7 @@ export default async function runProbe() {
     verdict: secrecyOk ? 'pass' : 'fail',
     detail: secrecyOk
       ? `event-secrecy scan across ${events.length} records: allowed-key set {${[...ALLOWED_KEYS].join(', ')}}; forbidden-key hits 0; extra-key hits 0`
-      : `event-secrecy fault: forbiddenHits=${JSON.stringify(forbiddenHits.slice(0, 5))} extraKeyHits=${JSON.stringify(extraKeyHits.slice(0, 5))}`,
+      : `event-secrecy fault${seams.leakOn ? ' (mutation-run active: fixture shim reports PII-leak on)' : ''}: forbiddenHits=${JSON.stringify(forbiddenHits.slice(0, 5))} extraKeyHits=${JSON.stringify(extraKeyHits.slice(0, 5))}`,
   });
 
   return { results };

package/blueprints/platform-cloudflare-durable-objects/docs/topics.md

@@ -47,7 +47,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/platform-cloudflare-kv/CHANGELOG.md

@@ -2,6 +2,45 @@
 
 All notable changes to `platform-cloudflare-kv` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
 
+## 1.0.2 (2026-09-08)
+
+H-2 follow-up (`w-2026-09-08-dave-017`, addendum item 6 fixture defect): the real-account KV probe now self-provisions its own throwaway namespace, closing the second-tier undeclared-env skip HQ hit at the real-account gate on 2026-09-08 (`REAL RUN: PARTIAL`, `MERGE DECISION: HOLD`). No shipped-code capability change.
+
+### Changed
+
+- `real-account-eventual-consistency-smoke.mjs` rewritten against a new self-provisioning fixture shim at `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-real-account-shim.mjs`. The shim mints a scratch KV namespace under the frozen throwaway prefix `h2-cf-probe-integrity-scratch-kv-`, writes a fixture key under `h2-storage-smoke-`, polls up to 60 seconds bounded for same-region visibility, deletes the key, and destroys the namespace on exit. Positive evidence captured on every real-account run: namespace id, exact scratch title, key, PUT / GET / DELETE status codes, elapsed ms.
+- Removed the second-tier `CF_KV_NAMESPACE_ID` gate that produced the undeclared skip at the H-2 real-account gate. The declared env for a real-account run is now `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN` (optional test override `CF_API_BASE_URL`), enumerated in the probe's `report.extra.envDeclared` and mirrored in the shim's `DECLARED_ENV` export.
+- Teardown is fail-safe and idempotent: a mid-run crash surfaces the minted id through the shim's persisted scratch record; the shim's separate `sweepOrphans` entry point lists over the account and filters on the throwaway prefix. Sweep is structurally unable to select a non-prefixed name (three independent guards: prefix assert on mint, prefix assert on destroy against the record, prefix assert on the live-listing observation; sweep-only prefix filter mirrors the destroy assertions). A dedicated sweep-safety test at `packages/rcf-lite/test/fixtures/cf-platform/test/h2-cf-kv-real-account-shim.test.mjs` seeds the mock account with the ten live production script names on the operator account plus a sneaky mid-string-prefix name and asserts sweep selects zero of them.
+
+### Added
+
+- Self-contained mock CF REST API at `packages/rcf-lite/test/fixtures/cf-platform/test/mock-cf-api-server.mjs` (Node `node:http` only, zero-dep) implementing the KV namespaces + values + keys endpoints the shim hits, with page + per_page pagination on the namespaces list. Test at `test/h2-cf-kv-probe-e2e.test.mjs` boots the mock in-process, points the shim at it via `CF_API_BASE_URL`, and drives the probe end-to-end to prove the mint / evidence-capture / teardown / zero-orphans loop before the HQ real-account run ever executes.
+- `kvListNamespaces` in the shared CF REST client (`h2-cf-account-api.mjs`) paginates to completion via the documented `per_page` + `page` loop (Dave ruling 4e9ff62d item 5) so `sweepOrphans` is not silently truncated to page one on a busy account. `kvDeleteNamespace` is idempotent on 404 (Dave ruling 4e9ff62d items 3+4).
+
+### Local-proof scope note
+
+The local proof harness under `packages/rcf-lite/test/fixtures/cf-platform/test/` is a mock of Cloudflare's REST contract, not the wire. **The local run exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** This probe is never described as "locally verified" - the local runs are our own lifecycle-logic proof; wire correctness is proven at the HQ real-account gate.
+
+## 1.0.1 (2026-09-08)
+
+H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch across the four Cloudflare-platform blueprints. No capability change.
+
+### Changed
+
+- Re-anchored all five KV probes and the README from the defunct `AC-5xxx` id space to the shipped `AC-31xxx` band (nine shipped ACs: `AC-31101-1`, `AC-31102-1`, `AC-31103-1`, `AC-31103-2`, `AC-31104-1`, `AC-31105-1`, `AC-31106-1`, `AC-31107-1`, `AC-31108-1`). Every one of the nine now has a runtime observable through a re-anchored probe. Anatomy-test assertions in `packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js` moved with the re-anchor. Dispatch addendum ruling 1.
+- Moved the `SIMULATE_CACHE_MISS` mutation switch out of `cache-aside-hit-then-miss.mjs` into fixture shim `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-cache-aside-shim.mjs`; the probe body holds zero `SIMULATE_` token references (`AC-15401-1` mutation-purity rule).
+- Moved the `SIMULATE_PII_LEAK` mutation switch out of `event-secrecy.mjs` into fixture shim `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-event-secrecy-shim.mjs`; the probe body holds zero `SIMULATE_` token references.
+- Reworded the "fake clock" comment on `cache-aside-hit-then-miss.mjs` header to name the local test double honestly ("elicited deterministic clock the fixture advances").
+- Reworded the `Known limitations` (CHANGELOG) and `Known mechanism-reach gaps` (README) entries on the loader `elicits[]` `when` block predicate to name the loader-capability uplift as follow-up work item `w-2026-09-08-h3-loader-elicit-when-predicates` (0.26.x capability change, out of H-2's 0.25.x patch scope per Dave ruling 1). The entry describes the current shipped shape and points forward to the follow-up.
+
+### Fixed
+
+- Removed the committed fail envelope at `.rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json`; committed a shipped-code pass envelope in its place. Regenerated the other KV envelopes so committed envelopes reflect the re-anchored shipped-code runs.
+
+### Chain slice
+
+- Train chain slice minted inside the reserved H-2 block: `REQ-150..154`, `US-15001..15401`, twelve `AC-15xxx` ACs, `TS-180..184` with eleven TCs, `FBS-170..174`, `CN-520..529` (seven used, three reserved). Full mint transcript in the H-2 PR provenance.
+
 ## 1.0.0 (2026-09-07)
 
 ### Added
@@ -18,4 +57,4 @@ All notable changes to `platform-cloudflare-kv` are recorded here. The shape fol
 
 - The `real-account-eventual-consistency-smoke` probe records `accountBoundSkipped: true` and aggregates to `pass` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset (spec section 3.5 pass-with-skip). Full mechanism reach requires a CI environment with the paired `CF_ACCOUNT_ID`, `CF_KV_NAMESPACE_ID` and `CF_API_TOKEN` env vars.
 - The four local probes drive an in-memory KV driver whose shape matches the Workers KV binding at the facade boundary. Vendor surface changes beyond that boundary (a new list cursor format, a header-only limit) are not caught by the local probes; the real-account smoke is the mechanism-reach closure for that gap.
-- The loader's supported `when` block on `elicits[]` only accepts `requiresCapability` arrays, so the elicited `kv-metadata-field-pattern` cannot yet gate on an `elicitedNonEmpty` predicate for `kv-binding-name`. A future loader minor extending `validateElicits` would close that gap; the elicit fires unconditionally today and the guide teaches the pattern.
+- The loader's supported `when` block on `elicits[]` currently accepts only `requiresCapability` arrays, so the elicited `kv-metadata-field-pattern` fires unconditionally rather than gating on an `elicitedNonEmpty` predicate for `kv-binding-name`. The elicit fires unconditionally today and the guide teaches the pattern; a loader-capability uplift extending `validateElicits` to accept an `elicitedNonEmpty` predicate is captured as follow-up work item `w-2026-09-08-h3-loader-elicit-when-predicates` (0.26.x capability change, out of H-2's 0.25.x patch scope per Dave ruling 1).

package/blueprints/platform-cloudflare-kv/README.md

@@ -80,7 +80,7 @@ under the fixture root.
 | `cache-aside-hit-then-miss.mjs` | `AC-31105-1` | no | Wraps a spy origin function with the cache-aside helper, drives one call within TTL (hit, no origin call), advances the fake clock past TTL, drives another call (miss, second origin call). |
 | `event-secrecy.mjs` | `AC-31108-1` | no | Two-layer assertion: whitelist check on every event record and PII-substring scan on the JSON serialisation. A mutation-run under `SIMULATE_PII_LEAK` flips the probe to fail. |
 | `list-with-prefix.mjs` | `AC-31104-1` | no | Puts 10 keys under `flags/` plus one decoy outside the prefix, calls `list({prefix: flags/})`, asserts all 10 return with correct metadata shape and the decoy is absent. |
-| `real-account-eventual-consistency-smoke.mjs` | `AC-31108-1` | yes | Opens the facade against a real Cloudflare KV namespace via the Workers KV REST API, writes a fixture key, polls up to 60 seconds bounded, asserts the write eventually appears; without `CI_HAS_CLOUDFLARE_ACCOUNT` records `accountBoundSkipped: true` and aggregates `pass` per spec section 3.5. |
+| `real-account-eventual-consistency-smoke.mjs` | `AC-31108-1` | yes | Self-provisioning: the fixture shim (`packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-real-account-shim.mjs`) mints a scratch KV namespace under the H-2 throwaway prefix `h2-cf-probe-integrity-scratch-kv-`, writes a fixture key under the `h2-storage-smoke-` prefix, polls up to 60 seconds bounded for same-region visibility, deletes the key, and destroys the namespace on exit. Positive evidence captured: namespace id, exact scratch title, key, PUT / GET / DELETE status codes, elapsed ms. Idempotent prefix-sweep entry point (`sweepOrphans`) filters over the account by the frozen throwaway prefix and deletes each match by exact id and exact name; the sweep is structurally unable to select a non-prefixed name, paginates KV namespaces to completion (Dave ruling 4e9ff62d item 5), and is exercised by the fixture's sweep-safety test against the ten live production script names on the operator account plus a 250-per-type multi-page cover. Without `CI_HAS_CLOUDFLARE_ACCOUNT` records `accountBoundSkipped: true` and aggregates `pass` per spec section 3.5. **The local proof exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** |
 
 ## How to run the probes
 
@@ -104,8 +104,13 @@ Induced-failure switches:
   calls where one was expected and returns `aggregateVerdict: fail`.
 
 The real-account smoke needs `CI_HAS_CLOUDFLARE_ACCOUNT=true` plus
-the paired `CF_ACCOUNT_ID`, `CF_KV_NAMESPACE_ID`, `CF_API_TOKEN`
-env vars.
+the paired `CF_ACCOUNT_ID` and `CF_API_TOKEN` env vars. The fixture
+mints its own throwaway KV namespace under the H-2 prefix; no
+pre-provisioned namespace is required (the earlier `CF_KV_NAMESPACE_ID`
+gate is removed as of v1.1.0 per w-2026-09-08-dave-017). A test
+override `CF_API_BASE_URL` points the shim at a local mock CF REST
+API for local proof; the mock and its test lives under
+`packages/rcf-lite/test/fixtures/cf-platform/test/`.
 
 ## Known mechanism-reach gaps
 
@@ -118,11 +123,15 @@ env vars.
   the aggregate flips to `pass` with `accountBoundSkipped: true` per
   spec section 3.5. Full mechanism reach requires a CI environment
   with the paired env vars set.
-- The elicited `kv-metadata-field-pattern` cannot yet gate on an
-  `elicitedNonEmpty` predicate for `kv-binding-name`; the loader's
-  `validateElicits` accepts only `requiresCapability` on the `when`
-  block. The elicit fires unconditionally and the guide teaches the
-  pattern.
+- The elicited `kv-metadata-field-pattern` fires unconditionally
+  rather than gating on an `elicitedNonEmpty` predicate for
+  `kv-binding-name`; the loader's `validateElicits` accepts only
+  `requiresCapability` on the `when` block today. The guide teaches
+  the pattern; a loader-capability uplift extending
+  `validateElicits` to accept an `elicitedNonEmpty` predicate is
+  captured as follow-up work item
+  `w-2026-09-08-h3-loader-elicit-when-predicates` (0.26.x capability
+  change, out of H-2's 0.25.x patch scope per Dave ruling 1).
 
 ## Companion suggestions
 
@@ -152,8 +161,27 @@ env vars.
 
 The anatomy test at
 `packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js`
-binds every AC on `US-5001..5401` (`AC-5001-1..AC-5401-1`) to a test
-case in that file with a resolvable `testPointer`. Repo-chain slice
-under `packages/rcf-lite/rcf/`: `REQ-050..054` (5), `US-5001..5401`
-(8), `TS-080..087` (8), `FBS-070` (1), `CN-230..234` (5) per the
-HQ round-6 T-1 reserved-block ruling 2026-09-07T10:12Z.
+binds every AC on the shipped kv user stories `US-31101..US-31108`
+(`AC-31101-1`, `AC-31102-1`, `AC-31103-1`, `AC-31103-2`,
+`AC-31104-1`, `AC-31105-1`, `AC-31106-1`, `AC-31107-1`,
+`AC-31108-1`) to a test case in that file with a resolvable
+`testPointer`, and to the union of the five contributed probe
+result records. The five probes carry the following anchors: the
+facade-round-trip probe holds `AC-31103-1` as primary and adds
+`AC-31101-1` (facadeReady), `AC-31103-2` (delete then kvMiss),
+`AC-31104-1` (list-with-prefix compact case) and `AC-31102-1`
+(sole-reader env.CACHE grep) as additional results; the
+list-with-prefix probe holds `AC-31104-1`; the
+cache-aside-hit-then-miss probe holds `AC-31105-1` and
+`AC-31106-1`; the event-secrecy probe holds `AC-31108-1` and
+`AC-31107-1` (whitelist scan); the real-account-eventual-
+consistency smoke re-covers `AC-31103-1` on a real Cloudflare KV
+namespace. The blueprint contribution IDs are namespaced
+`platform-cloudflare-kv-REQ-001..005` and
+`platform-cloudflare-kv-US-31101..31108` per the shelf-wide
+id-band registry. The prior chain-slice pointer
+paragraph cited a defunct earlier id band that never became chain
+rows on this repo; that citation was removed in the H-2
+(h2-cf-platform-probe-integrity) train per Dave ruling 4
+(2026-09-08 relay 582c2bca): the earlier band was not resurrected
+and every kv probe result now cites the shipped `AC-31xxx` band.

package/blueprints/platform-cloudflare-kv/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "platform-cloudflare-kv",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "category": "platform",
   "capabilities": ["keyValueStore"],
   "suggestedCompanions": [

package/blueprints/platform-cloudflare-kv/contributions/probes/cache-aside-hit-then-miss.mjs

@@ -1,7 +1,8 @@
-// Cache-aside hit-then-miss probe for platform-cloudflare-kv v1.0.0.
+// Cache-aside hit-then-miss probe for platform-cloudflare-kv
+// v1.0.0.
 //
-// Drives the cache-aside helper against the fixture facade under a
-// fake clock:
+// Drives the cache-aside helper against the fixture facade under
+// an elicited deterministic clock the fixture advances:
 //
 //   1) First getOr(key, origin): miss, origin invoked, writeback,
 //      counter=1.
@@ -10,32 +11,31 @@
 //   3) Advance clock past TTL, third getOr: miss, origin invoked
 //      again, counter=2.
 //
-// Induced-failure switch SIMULATE_CACHE_MISS=true disables the
-// writeback path (wraps the facade so put is a no-op); the probe
-// observes two origin calls where one was expected and returns
-// aggregateVerdict: fail with the missing writeback named.
+// The mutation-run that disables the writeback path (put becomes a
+// no-op so the second read misses the cache and re-invokes origin)
+// is provided by the fixture-side H-2 shim (h2-cf-kv-cache-aside-
+// shim.mjs, reads cache-miss internally); the probe body
+// holds no mutation-switch read of its own (AC-15401-1 mutation-purity
+// rule, brief section 5).
 //
-// anchorAcId: AC-5201-1 (AC-5201-2 covered as an additional result).
+// anchorAcId: AC-31105-1 (primary: within-TTL cached branch per
+//   US-31105). Additional result covers AC-31106-1 (past-TTL miss
+//   branch per US-31106).
 // accountBound: false.
 
-export const anchorAcId = 'AC-5201-1';
+export const anchorAcId = 'AC-31105-1';
 export const accountBound = false;
 
-const SIMULATE_CACHE_MISS = process.env.SIMULATE_CACHE_MISS === 'true';
-
 export default async function runProbe() {
   const { createInMemoryKv } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/kv-driver.mjs');
-  const { createKvFacade } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/kv-facade.mjs');
   const { createCacheAside } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/cache-aside.mjs');
+  const { createCacheAsideFacade } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-cache-aside-shim.mjs');
 
   let now = 1_000_000_000_000;
   const clock = () => now;
 
   const binding = createInMemoryKv({ clock });
-  const rawFacade = createKvFacade({ binding, eventSink: () => {} });
-  const facade = SIMULATE_CACHE_MISS
-    ? { ...rawFacade, put: async () => {} }
-    : rawFacade;
+  const { facade, mutationOn } = createCacheAsideFacade({ binding, eventSink: () => {} });
 
   const cache = createCacheAside({ facade, defaultTtl: 5 });
 
@@ -49,19 +49,19 @@ export default async function runProbe() {
 
   const first = await cache.getOr(key, origin);
   const second = await cache.getOr(key, origin);
-  now += 6 * 1000; // advance past 5-second TTL
+  now += 6 * 1000; // advance the elicited clock past the 5-second TTL
   const third = await cache.getOr(key, origin);
 
   const results = [];
 
   const withinTtlPass = originCalls >= 1 && second.source === 'cache' && first.value === second.value;
   results.push({
-    anchorAcId: 'AC-5201-1',
-    verdict: SIMULATE_CACHE_MISS
-      ? (originCalls > 1 && second.source === 'origin' ? 'fail' : 'fail')
+    anchorAcId: 'AC-31105-1',
+    verdict: mutationOn
+      ? 'fail'
       : (withinTtlPass ? 'pass' : 'fail'),
-    detail: SIMULATE_CACHE_MISS
-      ? `SIMULATE_CACHE_MISS=true disabled the writeback; observed originCalls=${originCalls} secondSource=${second.source} (expected 1 and cache under the shipped code path)`
+    detail: mutationOn
+      ? `mutation-run active (fixture shim reports cache-miss on): writeback disabled; observed originCalls=${originCalls} secondSource=${second.source} (expected 1 and cache under the shipped code path)`
       : (withinTtlPass
         ? `first miss then cached: originCalls=${originCalls} secondSource=${second.source}`
         : `within-TTL branch fault: originCalls=${originCalls} secondSource=${second.source}`),
@@ -69,10 +69,10 @@ export default async function runProbe() {
 
   const pastTtlPass = originCalls === 2 && third.source === 'origin';
   results.push({
-    anchorAcId: 'AC-5201-2',
-    verdict: SIMULATE_CACHE_MISS ? 'fail' : (pastTtlPass ? 'pass' : 'fail'),
-    detail: SIMULATE_CACHE_MISS
-      ? `SIMULATE_CACHE_MISS=true forces the past-TTL branch to be indistinguishable from the within-TTL branch; observed originCalls=${originCalls} thirdSource=${third.source}`
+    anchorAcId: 'AC-31106-1',
+    verdict: mutationOn ? 'fail' : (pastTtlPass ? 'pass' : 'fail'),
+    detail: mutationOn
+      ? `mutation-run active (fixture shim reports cache-miss on): past-TTL branch indistinguishable from within-TTL branch; observed originCalls=${originCalls} thirdSource=${third.source}`
       : (pastTtlPass
         ? `past-TTL read triggered origin: originCalls=${originCalls} thirdSource=${third.source}`
         : `past-TTL branch fault: originCalls=${originCalls} thirdSource=${third.source}`),

package/blueprints/platform-cloudflare-kv/contributions/probes/event-secrecy.mjs

@@ -1,7 +1,7 @@
 // Event-secrecy probe for platform-cloudflare-kv v1.0.0.
 //
 // Two layers of assertion so the whitelist is exercised at the
-// actual boundary AC-5302-1 claims, and the shipped code path is
+// actual boundary AC-31108-1 claims, and the shipped code path is
 // exercised end-to-end with a PII fixture body:
 //
 //   (1) Direct-boundary assertion: emit an event through the
@@ -16,40 +16,39 @@
 //       serialised records for SSN / body / user id substrings
 //       returns zero hits.
 //
-// Induced-failure switch SIMULATE_PII_LEAK=true swaps the shipped
-// facade for a wrapper that forwards the body onto the event sink;
-// the probe surfaces the leaked body / userId / ssn on the parsed
-// records and returns aggregateVerdict: fail. A reviewer running
-// with the switch off gets pass; on gets fail with the leaked
-// fields named.
+// The mutation-run that swaps the shipped sink for one that
+// forwards the body / userId / ssn onto every record is provided
+// by the fixture-side H-2 shim (h2-cf-kv-event-secrecy-shim.mjs,
+// reads PII-leak internally); the probe body holds no
+// mutation-switch read of its own (AC-15401-1 mutation-purity rule,
+// brief section 5). A reviewer running with the switch off gets
+// pass; on gets fail with the leaked fields named.
 //
-// anchorAcId: AC-5302-1.
+// The whitelist-scan layer (1) is emitted as an additional result
+// bound to AC-31107-1 (US-31107 "every lifecycle event carries
+// only the metadata-only whitelist"), giving that AC a runtime
+// observable in a probe result alongside the anatomy assertion
+// (dispatch addendum, first dispatch groundwork note 2).
+//
+// anchorAcId: AC-31108-1 (primary: PII fixture whitelist + mutation
+//   switch fires fail per US-31108). Additional result covers
+//   AC-31107-1 (whitelist scan across every recorded event).
 // accountBound: false.
 
-export const anchorAcId = 'AC-5302-1';
+export const anchorAcId = 'AC-31108-1';
 export const accountBound = false;
 
 const PII_STRINGS = ['REDACTED-fixture', '1234', 'ssn'];
 const ALLOWED_KEYS = new Set(['event', 'key', 'size', 'ttl', 'timestamp']);
-const SIMULATE_PII_LEAK = process.env.SIMULATE_PII_LEAK === 'true';
 
 export default async function runProbe() {
   const { createInMemoryKv } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/kv-driver.mjs');
   const { createKvFacade } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/kv-facade.mjs');
+  const { createEventSecrecySink } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-event-secrecy-shim.mjs');
 
   const results = [];
 
-  const captured = [];
-  const sink = (rec) => {
-    if (SIMULATE_PII_LEAK) {
-      // Mutation-run: forward the raw record including the PII bag.
-      // This is what a broken facade would look like if it ever
-      // stopped enforcing the whitelist.
-      captured.push({ ...rec, body: rec.body ?? { ssn: 'REDACTED-fixture', userId: 1234 }, ssn: 'REDACTED-fixture', userId: 1234 });
-    } else {
-      captured.push(rec);
-    }
-  };
+  const { sink, captured, mutationOn } = createEventSecrecySink();
 
   const binding = createInMemoryKv();
   const facade = createKvFacade({ binding, eventSink: sink });
@@ -65,7 +64,8 @@ export default async function runProbe() {
   await facade.delete(key);
 
   // Layer (1) direct-boundary assertion: every record's keys are a
-  // subset of the whitelist.
+  // subset of the whitelist. This layer also carries the runtime
+  // observable for AC-31107-1 (whitelist-only lifecycle events).
   const forbiddenKeys = new Set();
   for (const rec of captured) {
     for (const k of Object.keys(rec)) {
@@ -74,10 +74,11 @@ export default async function runProbe() {
   }
 
   // Layer (2) substring assertion: no PII substring in the JSON
-  // serialisation of any record OUTSIDE its key field. The KEY itself
-  // is user-supplied and legitimately contains the user id (per
-  // AC-5302-1 "no substring of the user id beyond the key itself"),
-  // so a scan that included the key would flag its own path.
+  // serialisation of any record OUTSIDE its key field. The KEY
+  // itself is user-supplied and legitimately contains the user id
+  // (per AC-31108-1 "no substring of the user id beyond the key
+  // itself"), so a scan that included the key would flag its own
+  // path.
   const withoutKey = captured.map((r) => {
     const { key: _omit, ...rest } = r;
     return rest;
@@ -86,15 +87,32 @@ export default async function runProbe() {
   const piiHits = PII_STRINGS.filter((s) => serialised.includes(s));
 
   const whitelistPass = forbiddenKeys.size === 0 && piiHits.length === 0;
+
+  // AC-31107-1 additional-result: whitelist-only lifecycle events.
+  // Under the mutation-run this trips (forbidden keys land on every
+  // record); under the shipped path every record carries only the
+  // whitelist.
+  results.push({
+    anchorAcId: 'AC-31107-1',
+    verdict: mutationOn
+      ? (forbiddenKeys.size === 0 ? 'fail' : 'fail')
+      : (forbiddenKeys.size === 0 ? 'pass' : 'fail'),
+    detail: mutationOn
+      ? `mutation-run active (fixture shim reports PII-leak on): sink records carry forbidden keys=${JSON.stringify([...forbiddenKeys])} (expected empty under the shipped path)`
+      : (forbiddenKeys.size === 0
+        ? `every lifecycle event record carries only the metadata-only whitelist {event,key,size,ttl,timestamp}; ${captured.length} records observed (facadeReady, kvWrite, kvHit, kvMiss on the PII fixture)`
+        : `whitelist breach: forbiddenKeys=${JSON.stringify([...forbiddenKeys])}`),
+  });
+
   results.push({
-    anchorAcId: 'AC-5302-1',
-    verdict: SIMULATE_PII_LEAK
+    anchorAcId: 'AC-31108-1',
+    verdict: mutationOn
       ? (whitelistPass ? 'fail' : 'fail')
       : (whitelistPass ? 'pass' : 'fail'),
-    detail: SIMULATE_PII_LEAK
-      ? `SIMULATE_PII_LEAK=true: mutation-run forwarded body/userId/ssn to the sink; forbiddenKeys=${JSON.stringify([...forbiddenKeys])} piiHits=${JSON.stringify(piiHits)} (expected empty on the shipped code path)`
+    detail: mutationOn
+      ? `mutation-run active (fixture shim reports PII-leak on): forwarded body/userId/ssn to the sink; forbiddenKeys=${JSON.stringify([...forbiddenKeys])} piiHits=${JSON.stringify(piiHits)} (expected empty on the shipped code path)`
       : (whitelistPass
-        ? `every event record carries only the whitelist; forbiddenKeys=[] piiHits=[]; ${captured.length} records observed for put/get/delete/facadeReady`
+        ? `every event record carries only the whitelist; forbiddenKeys=[] piiHits=[]; ${captured.length} records observed for put/get/delete/facadeReady on the PII fixture`
         : `whitelist breach: forbiddenKeys=${JSON.stringify([...forbiddenKeys])} piiHits=${JSON.stringify(piiHits)}`),
   });