rcf-lite 0.25.0 → 0.27.0

package/blueprints/persistence-data-d1/blueprint.json

@@ -1,26 +1,98 @@
 {
   "slug": "persistence-data-d1",
-  "version": "1.0.0",
+  "version": "1.1.2",
   "category": "persistence",
   "contributions": [
-    { "id": "persistence-data-d1-REQ-001", "kind": "req", "path": "requirements/persistence-data-d1-req-001.json" },
-    { "id": "persistence-data-d1-REQ-002", "kind": "req", "path": "requirements/persistence-data-d1-req-002.json" },
-    { "id": "persistence-data-d1-REQ-003", "kind": "req", "path": "requirements/persistence-data-d1-req-003.json" },
-    { "id": "persistence-data-d1-REQ-004", "kind": "req", "path": "requirements/persistence-data-d1-req-004.json" },
-    { "id": "persistence-data-d1-REQ-005", "kind": "req", "path": "requirements/persistence-data-d1-req-005.json" },
-    { "id": "persistence-data-d1-REQ-006", "kind": "req", "path": "requirements/persistence-data-d1-req-006.json" },
-    { "id": "persistence-data-d1-REQ-007", "kind": "req", "path": "requirements/persistence-data-d1-req-007.json" },
-    { "id": "persistence-data-d1-US-13101", "kind": "us", "path": "user-stories/persistence-data-d1-us-13101.json" },
-    { "id": "persistence-data-d1-US-13102", "kind": "us", "path": "user-stories/persistence-data-d1-us-13102.json" },
-    { "id": "persistence-data-d1-US-13103", "kind": "us", "path": "user-stories/persistence-data-d1-us-13103.json" },
-    { "id": "persistence-data-d1-US-13104", "kind": "us", "path": "user-stories/persistence-data-d1-us-13104.json" },
-    { "id": "persistence-data-d1-US-13105", "kind": "us", "path": "user-stories/persistence-data-d1-us-13105.json" },
-    { "id": "persistence-data-d1-US-13106", "kind": "us", "path": "user-stories/persistence-data-d1-us-13106.json" },
-    { "id": "persistence-data-d1-US-13107", "kind": "us", "path": "user-stories/persistence-data-d1-us-13107.json" },
-    { "id": "TAC-1401-persistence-data-d1-facade", "kind": "tac", "path": "tacs/tac-1401-persistence-data-d1-facade.json" },
-    { "id": "TAC-1402-persistence-data-d1-migration-catalog", "kind": "tac", "path": "tacs/tac-1402-persistence-data-d1-migration-catalog.json" },
-    { "id": "TAC-1403-persistence-data-d1-deploy-gate", "kind": "tac", "path": "tacs/tac-1403-persistence-data-d1-deploy-gate.json" },
-    { "id": "TAC-1404-persistence-data-d1-recovery-runner", "kind": "tac", "path": "tacs/tac-1404-persistence-data-d1-recovery-runner.json" },
+    {
+      "id": "persistence-data-d1-REQ-001",
+      "kind": "req",
+      "path": "requirements/persistence-data-d1-req-001.json"
+    },
+    {
+      "id": "persistence-data-d1-REQ-002",
+      "kind": "req",
+      "path": "requirements/persistence-data-d1-req-002.json"
+    },
+    {
+      "id": "persistence-data-d1-REQ-003",
+      "kind": "req",
+      "path": "requirements/persistence-data-d1-req-003.json"
+    },
+    {
+      "id": "persistence-data-d1-REQ-004",
+      "kind": "req",
+      "path": "requirements/persistence-data-d1-req-004.json"
+    },
+    {
+      "id": "persistence-data-d1-REQ-005",
+      "kind": "req",
+      "path": "requirements/persistence-data-d1-req-005.json"
+    },
+    {
+      "id": "persistence-data-d1-REQ-006",
+      "kind": "req",
+      "path": "requirements/persistence-data-d1-req-006.json"
+    },
+    {
+      "id": "persistence-data-d1-REQ-007",
+      "kind": "req",
+      "path": "requirements/persistence-data-d1-req-007.json"
+    },
+    {
+      "id": "persistence-data-d1-US-13101",
+      "kind": "us",
+      "path": "user-stories/persistence-data-d1-us-13101.json"
+    },
+    {
+      "id": "persistence-data-d1-US-13102",
+      "kind": "us",
+      "path": "user-stories/persistence-data-d1-us-13102.json"
+    },
+    {
+      "id": "persistence-data-d1-US-13103",
+      "kind": "us",
+      "path": "user-stories/persistence-data-d1-us-13103.json"
+    },
+    {
+      "id": "persistence-data-d1-US-13104",
+      "kind": "us",
+      "path": "user-stories/persistence-data-d1-us-13104.json"
+    },
+    {
+      "id": "persistence-data-d1-US-13105",
+      "kind": "us",
+      "path": "user-stories/persistence-data-d1-us-13105.json"
+    },
+    {
+      "id": "persistence-data-d1-US-13106",
+      "kind": "us",
+      "path": "user-stories/persistence-data-d1-us-13106.json"
+    },
+    {
+      "id": "persistence-data-d1-US-13107",
+      "kind": "us",
+      "path": "user-stories/persistence-data-d1-us-13107.json"
+    },
+    {
+      "id": "TAC-1401-persistence-data-d1-facade",
+      "kind": "tac",
+      "path": "tacs/tac-1401-persistence-data-d1-facade.json"
+    },
+    {
+      "id": "TAC-1402-persistence-data-d1-migration-catalog",
+      "kind": "tac",
+      "path": "tacs/tac-1402-persistence-data-d1-migration-catalog.json"
+    },
+    {
+      "id": "TAC-1403-persistence-data-d1-deploy-gate",
+      "kind": "tac",
+      "path": "tacs/tac-1403-persistence-data-d1-deploy-gate.json"
+    },
+    {
+      "id": "TAC-1404-persistence-data-d1-recovery-runner",
+      "kind": "tac",
+      "path": "tacs/tac-1404-persistence-data-d1-recovery-runner.json"
+    },
     {
       "id": "ADR-1401-persistence-data-d1-store-model",
       "kind": "adr",
@@ -35,8 +107,20 @@
       "scope": "global",
       "topic": "migrationDiscipline"
     },
-    { "id": "ADR-1403-persistence-data-d1-event-secrecy", "kind": "adr", "path": "adrs/adr-1403-persistence-data-d1-event-secrecy.json" },
-    { "id": "ADR-1404-persistence-data-d1-store-boundary", "kind": "adr", "path": "adrs/adr-1404-persistence-data-d1-store-boundary.json" },
-    { "id": "ADR-1405-persistence-data-d1-recovery-model", "kind": "adr", "path": "adrs/adr-1405-persistence-data-d1-recovery-model.json" }
+    {
+      "id": "ADR-1403-persistence-data-d1-event-secrecy",
+      "kind": "adr",
+      "path": "adrs/adr-1403-persistence-data-d1-event-secrecy.json"
+    },
+    {
+      "id": "ADR-1404-persistence-data-d1-store-boundary",
+      "kind": "adr",
+      "path": "adrs/adr-1404-persistence-data-d1-store-boundary.json"
+    },
+    {
+      "id": "ADR-1405-persistence-data-d1-recovery-model",
+      "kind": "adr",
+      "path": "adrs/adr-1405-persistence-data-d1-recovery-model.json"
+    }
   ]
 }

package/blueprints/persistence-data-d1/contributions/adrs/adr-1404-persistence-data-d1-store-boundary.json

@@ -2,11 +2,11 @@
   "adrId": "ADR-1404-persistence-data-d1-store-boundary",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "The D1 store facade is the only module that reads the D1 binding; consumers use named domain verbs, and every statement is a parameterised prepared statement",
-  "context": "A persistence boundary that leaks (the domain code reads the D1 binding from `env` directly, or the facade exposes a general-purpose raw-SQL passthrough) is a boundary the swap-out story does not work through, the test-double story does not work through, the reasoning-about-persistence-code-paths story does not work through, and (worse for D1 than for a local-file engine) the SQL-injection story does not work through: consumer-supplied string concatenation into a prepared-statement argument is functionally equivalent to a `db.exec(<consumer string>)` call, and the vendor's `prepare().bind()` chain is only safe when it stays a static SQL literal.",
-  "decision": "One module (the D1 store facade, TAC-1401) reads the D1 binding from the Worker `env`. Every other module in the source tree that touches persistence imports the facade and calls its named verbs. The facade's public surface exposes named domain verbs with typed parameters; it does not export the D1 binding, and it does not expose a general-purpose query method whose parameter is a SQL string or a prepared-statement object supplied by a consumer. Every statement the facade issues is a `db.prepare(<static SQL literal>).bind(<parameters>).first() | .all() | .run() | .raw()` chain; `db.exec(...)` is never called with a non-literal string; SQL is never constructed by string concatenation with consumer arguments. Multi-statement writes that require atomicity go through `db.batch([...])`; the facade never fakes atomicity by chaining sequential independent calls under an application-side try-catch.",
+  "context": "A persistence boundary that leaks (the domain code reads the D1 binding from `env` directly, or the facade exposes a general-purpose raw-SQL passthrough) is a boundary the swap-out story does not work through, the test-double story does not work through, the reasoning-about-persistence-code-paths story does not work through, and (worse for D1 than for a local-file engine) the SQL-injection story does not work through: any consumer-supplied SQL fragment that reaches the vendor surface bypasses the prepared-statement discipline owned on TAC-1401-persistence-data-d1-facade.responsibilities[2], and the discipline is only load-bearing when it holds at every call site the facade exposes.",
+  "decision": "One module (the D1 store facade, TAC-1401-persistence-data-d1-facade) reads the D1 binding from the Worker `env`. Every other module in the source tree that touches persistence imports the facade and calls its named verbs. The facade's public surface exposes named domain verbs with typed parameters; it does not export the D1 binding, and it does not expose a general-purpose query method whose parameter is a SQL string or a prepared-statement object supplied by a consumer. Every statement the facade issues follows the prepared-statement chain owned on TAC-1401-persistence-data-d1-facade.responsibilities[2]; the raw `exec` surface is never invoked with a non-literal string, and SQL is never constructed by string concatenation with consumer arguments. Multi-statement writes that require atomicity go through the batch call owned on TAC-1401-persistence-data-d1-facade.responsibilities[3]; the facade never fakes atomicity by chaining sequential independent calls under an application-side try-catch. Allowed query surface (ratified): only the prepared-statement chain above; no `exec` on consumer-supplied strings; the raw `exec` surface is permitted ONLY inside the migration runner (out of consumer-code reach) for the vendor-required schema-DDL pass, never on the facade's public verbs. Consumer code that calls the raw `exec` surface on the facade's exposed handle is refused by the source-scan probe.",
   "consequences": "The engine choice is swappable because there is exactly one place that reads the binding. Domain tests run against an in-memory double that implements the same verb surface, without any reference to D1 at any point in the test's call path. Every persistence code path is discoverable by grepping for the facade's exports. Consumer arguments never traverse the SQL parser; the vendor's parameter-binding layer is the only place values reach the engine, and SQL injection is closed by construction rather than by discipline-at-call-site. Consumers pay a small cost when they need a new query shape (a facade edit and a consumer edit, in one commit); the size of that cost is the mechanism enforcing the boundary. Composing blueprints that contribute persistence-adjacent components (a cache, an outbox, a projection) contribute their own facade modules on the same discipline; every one of them imports the D1 store facade for its persistence needs, not the D1 binding.",
   "alternativesConsidered": [
     {
@@ -21,5 +21,5 @@
     }
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/requirements/persistence-data-d1-req-001.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1401-persistence-data-d1-facade",
+    "field": "responsibilities.facade"
+  }
 }

package/blueprints/persistence-data-d1/contributions/requirements/persistence-data-d1-req-002.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1402-persistence-data-d1-migration-catalog",
+    "field": "responsibilities.migrations"
+  }
 }

package/blueprints/persistence-data-d1/contributions/requirements/persistence-data-d1-req-003.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1403-persistence-data-d1-deploy-gate",
+    "field": "responsibilities.gate"
+  }
 }

package/blueprints/persistence-data-d1/contributions/requirements/persistence-data-d1-req-004.json

@@ -2,7 +2,7 @@
   "reqId": "persistence-data-d1-REQ-004",
   "prdId": "PRD-001",
   "title": "Every statement the facade issues against D1 is a parameterised prepared statement; no consumer-supplied SQL reaches the binding",
-  "description": "The facade module issues every read or write against D1 through the prepared-statement surface: `db.prepare(<static SQL literal>).bind(<parameters>).first()`, `.all()`, or `.run()`. The static SQL literal is authored inside the facade module and does not embed values from consumer arguments through string concatenation, template interpolation, or any other join that produces a call-site-specific SQL fragment. The facade does not export a general-purpose query method whose parameter is a SQL string supplied by a consumer, and it does not use `db.exec(<consumer string>)` on any path.",
+  "description": "The facade module routes every read and write against D1 through the prepared-statement discipline owned on TAC-1401-persistence-data-d1-facade.responsibilities[2]. Static SQL literals are authored inside the facade module and never embed values from consumer arguments through string concatenation, template interpolation, or any other join that produces a call-site-specific SQL fragment. The facade exports no general-purpose query method whose parameter is a SQL string supplied by a consumer, and it reaches no non-literal statement through the vendor raw execute path on any code path. The allowed query surface is ratified on ADR-1404.",
   "category": "security",
   "domain": "persistence",
   "priority": "must",
@@ -11,8 +11,12 @@
     "blueprint:persistence-data-d1",
     "category:04-prepared-statements"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1401-persistence-data-d1-facade",
+    "field": "responsibilities.prepare"
+  }
 }

package/blueprints/persistence-data-d1/contributions/requirements/persistence-data-d1-req-005.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1401-persistence-data-d1-facade",
+    "field": "responsibilities.batchAtomicity"
+  }
 }

package/blueprints/persistence-data-d1/contributions/requirements/persistence-data-d1-req-006.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1404-persistence-data-d1-recovery-runner",
+    "field": "responsibilities.timeTravel"
+  }
 }

package/blueprints/persistence-data-d1/contributions/requirements/persistence-data-d1-req-007.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1403-persistence-data-d1-event-secrecy",
+    "field": "decision.metadataOnly"
+  }
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13101.json

@@ -16,7 +16,8 @@
       "when": "the import graph and source tree are inspected for the D1 binding reference (`env.<BINDING_NAME>` where BINDING_NAME is the value configured on `d1_databases[].binding` in the project's wrangler config)",
       "then": "the reference appears in exactly one file (the facade module) and no other file in the source tree contains the reference, verified by an import-graph query or a targeted grep against the configured binding name",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13101-2",
@@ -25,7 +26,8 @@
       "when": "the surface is inspected",
       "then": "every exported symbol is either a named domain verb with typed parameters or an event-sink registration; no exported symbol is the D1 binding itself, and no exported function accepts a raw SQL string as a call argument from consumer code",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13101-3",
@@ -34,12 +36,41 @@
       "when": "the domain code runs against the double in place of the facade",
       "then": "the domain code executes to completion with no reference to the D1 binding on its call path, and its behaviour is unchanged from a facade-backed run for the operations under test",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-13101-4",
+      "description": "Dependency not ready: D1 binding absent from the Worker env. Given a Worker whose wrangler manifest omits the configured d1_databases binding name (or whose deployed environment has not provisioned the binding), when the facade opens on isolate boot and reads env[<bindingName>], then the read returns undefined, the facade refuses with a named error kind d1BindingMissing carrying the expected binding name (never carrying the account id or API token), and no facadeReady fires on the sink.",
+      "given": "the Worker env has no property under the configured D1 binding name",
+      "when": "the facade opens on isolate boot",
+      "then": "the facade refuses with d1BindingMissing naming the expected binding; no credentials leak; no facadeReady fires",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1401-persistence-data-d1-facade",
+        "field": "responsibilities.readBinding"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-13101-5",
+      "description": "Rate limit from D1: the vendor 429 surfaces as queryFailed with retryAfterMs. Given the D1 vendor returns a 429 rate-limit response on a prepare-and-bind or batch call (simulated in the fixture via SIMULATE_D1_RATE_LIMIT=true), when the facade issues the query, then the facade catches the vendor error, surfaces a queryFailed event on the sink carrying { errorKind: 'rateLimited', retryAfterMs: <parsed from vendor headers or a default>, verb: <domain verb name> } and re-throws a d1RateLimited error the consumer catches; a probe FAILS if the event's errorKind is anything other than rateLimited.",
+      "given": "the D1 vendor returns 429 on a facade query (SIMULATE_D1_RATE_LIMIT=true)",
+      "when": "the facade issues the query",
+      "then": "queryFailed fires with { errorKind: 'rateLimited', retryAfterMs, verb }; the facade re-throws d1RateLimited; the probe FAILS on any other errorKind",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1401-persistence-data-d1-facade",
+        "field": "responsibilities.queryFailedRateLimit"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-1401-persistence-data-d1-facade"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13102.json

@@ -16,7 +16,8 @@
       "when": "the migrations directory is listed and each filename's leading integer is extracted",
       "then": "the sequence of leading integers is strictly increasing with no duplicates, every file has a non-empty SQL body, and no file in the directory falls outside the wrangler-configured pattern",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13102-2",
@@ -25,7 +26,8 @@
       "when": "the `list` then `apply` then `list` sequence runs against the local database",
       "then": "the first `list` prints every migration file as unapplied, the `apply` exits zero, and the second `list` prints zero unapplied migrations",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13102-3",
@@ -34,12 +36,31 @@
       "when": "the bookkeeping table is read via `wrangler d1 execute <database> --local --command \"SELECT * FROM d1_migrations\"` (or the configured `migrations_table` name)",
       "then": "the returned row count equals the number of migration files in the directory, and the recorded identifiers match the migration filenames or their leading integers",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-13102-4",
+      "description": "Quota exhausted on D1 database write. Given the D1 database is at or above the plan's per-database size ceiling (10 GB on Paid, 500 MB on Free per the vendor page) and a migration would add rows exceeding the remaining headroom, when the deploy-gate's wrangler d1 migrations apply invocation runs, then the vendor returns a quota-exhausted error, the deploy-gate exits non-zero, no migrationsApplied fires, and the wrangler deploy step is not reached (deploy is gated per REQ-003).",
+      "given": "the D1 database is at or above the plan's size ceiling and a migration would exceed the headroom",
+      "when": "the deploy-gate runs wrangler d1 migrations apply",
+      "then": "the vendor returns quota exhausted; the deploy-gate exits non-zero; no migrationsApplied fires; wrangler deploy is not reached",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1403-persistence-data-d1-deploy-gate",
+        "field": "responsibilities.gate"
+      },
+      "disposition": "template",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/d1/platform/limits/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-1402-persistence-data-d1-migration-catalog"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13103.json

@@ -16,7 +16,12 @@
       "when": "the deploy job's step list is inspected for each environment",
       "then": "the migrations-apply step appears before the deploy step in that job, and any parallelism configuration is such that the deploy cannot start until the apply has exited zero",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/d1/reference/migrations/",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-13103-2",
@@ -25,7 +30,8 @@
       "when": "the pipeline runs",
       "then": "the migrations-apply step exits non-zero, the deploy step does not execute, the deploy job is reported as failed, and no new Worker version has been published to the target environment",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13103-3",
@@ -34,7 +40,8 @@
       "when": "the store event log for that CI run is inspected",
       "then": "the log contains exactly one migrationsApplied event whose metadata fields match the run and whose payload contains no value read from a domain table",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -42,5 +49,5 @@
     "TAC-1402-persistence-data-d1-migration-catalog"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13104.json

@@ -6,17 +6,18 @@
   "status": "approved",
   "title": "Every facade query is a parameterised prepared statement",
   "asA": "developer who needs the persistence boundary to leave no SQL-injection surface for consumer arguments",
-  "iWant": "every facade query to be a static SQL literal issued via `db.prepare(...).bind(...)`, with no string-concatenated SQL and no `exec(<consumer string>)` on any path",
+  "iWant": "every facade query to go through the prepared-statement discipline owned on TAC-1401-persistence-data-d1-facade.responsibilities[2] (no string-concatenated SQL and no non-literal `exec` on any path)",
   "soThat": "consumer arguments never traverse the SQL parser and the vendor's parameter-binding layer is the only place values reach the engine",
   "acceptanceCriteria": [
     {
       "id": "AC-13104-1",
-      "description": "Every call site in the facade module that reaches the D1 binding is a `db.prepare(<static SQL literal>).bind(...)` chain terminating in `.first()`, `.all()`, `.run()`, or `.raw()`. No call site inside the facade calls `db.exec(...)` with any string other than a static SQL literal authored inside the facade module.",
+      "description": "Every call site in the facade module that reaches the D1 binding matches the prepared-statement chain owned on TAC-1401-persistence-data-d1-facade.responsibilities[2]; no call site invokes the raw `exec` surface, which is refused on the facade's exposed handle per ADR-1404-persistence-data-d1-store-boundary.",
       "given": "the facade module source",
       "when": "every call to the D1 binding is inspected for its SQL argument shape",
       "then": "every `prepare` argument is a static string literal (not a template with an interpolation for a value, not a `+`-concatenation with any consumer argument, not a function-returned string) and no `exec` call takes a non-literal string; a targeted grep for `\\.exec(`, `\\.prepare(` template-literal interpolations, and `\\+` inside prepared-statement arguments returns only the known-safe literal-static occurrences the facade documents",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13104-2",
@@ -25,7 +26,8 @@
       "when": "the surface is inspected",
       "then": "no exported function's typed parameter list includes a SQL-string parameter (a parameter named `sql`, `query`, `statement`, or typed as an arbitrary string that reaches `db.prepare` or `db.exec` inside the facade body); the boundary refuses raw-query passthrough by construction",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-13104-3",
@@ -34,12 +36,17 @@
       "when": "the verb is invoked with the probe value against a local D1 database",
       "then": "the invocation completes without side-effect against tables other than the one the verb legitimately touches, and a follow-up `SELECT COUNT(*) FROM domainTable` returns the same count as before the invocation (no DROP), and the probe value round-trips as an ordinary string wherever the verb persisted or returned it",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/d1/worker-api/prepared-statements/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-1401-persistence-data-d1-facade"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13105.json

@@ -16,7 +16,8 @@
       "when": "every verb whose responsibility involves writing to two or more rows across two or more statements is inspected",
       "then": "each such verb issues its statements as one `db.batch([...])` call whose array contains every statement the atomicity claim covers, and no such verb chains sequential independent facade calls to fake atomicity",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-13105-2",
@@ -25,7 +26,12 @@
       "when": "the verb is invoked and the batch fails",
       "then": "the caller receives an error, and a follow-up read against table A shows no row corresponding to the first statement of the failed batch (D1 rolled the batch back)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/d1/worker-api/d1-database/#batch",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-13105-3",
@@ -34,12 +40,13 @@
       "when": "the surface is inspected for begin/commit primitives, transaction-block wrappers, or documentation promising cross-call atomicity",
       "then": "no such surface exists on the facade, and every atomicity claim in facade documentation is scoped to a single verb whose implementation uses `db.batch([...])`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-1401-persistence-data-d1-facade"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13106.json

@@ -16,7 +16,8 @@
       "when": "the operator invokes `wrangler d1 time-travel restore <database> --timestamp=<pre-drop-timestamp>` and a fresh Worker request reads through the facade",
       "then": "the facade reads return the pre-drop row set, the destructive write is not present, and the store event log records exactly one `timeTravelRestored` event whose fields carry the target database identifier, the restore timestamp or bookmark, and the ISO-8601 completion timestamp",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13106-2",
@@ -25,7 +26,8 @@
       "when": "the export step runs against the source database, and the artifact is loaded into a fresh D1 database via `wrangler d1 execute --file <artifact-path>` (with any BEGIN TRANSACTION or COMMIT statements stripped per the vendor's import guidance) and a fresh Worker request reads through the facade",
       "then": "the artifact file exists at the requested path, the fresh database reports the same schema shape and row count for every domain table as the source at export completion, and the store event log records one `backupExported` event whose fields carry the source database identifier, the artifact path, and the ISO-8601 completion timestamp",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13106-3",
@@ -34,7 +36,8 @@
       "when": "the source tree the Worker deploys from is inspected for diff against the deployed build",
       "then": "no Worker source change is required to invoke either recovery path (the recovery runner is a project-side ops surface, not a facade verb), and both invocations produced their event log entry without a Worker redeploy",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -42,5 +45,5 @@
     "TAC-1401-persistence-data-d1-facade"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13107.json

@@ -16,7 +16,8 @@
       "when": "every event record captured on the sink is inspected",
       "then": "every field on every record matches one of the metadata field types listed above, and no field's value equals a value read from any domain table",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13107-2",
@@ -25,7 +26,26 @@
       "when": "the grep is executed",
       "then": "matches appear only inside CRUD verb bodies (facade) or inside statements the recovery runner or deploy gate does not read for event-record construction, and never inside onEvent call arguments or event-record construction sites",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1401-persistence-data-d1-facade",
+        "field": "interfaces.onEvent"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-13107-3",
+      "description": "Repeat-emission secrecy under maximum event volume. Given the facade exercised through a load run that fires facadeReady, migrationsApplied, backupExported, timeTravelRestored and queryFailed events N times, when the event stream is inspected, then every one of the N event records carries only the metadata field types on AC-13107-1 and no run of N leaks a domain-row value; a mutation SIMULATE_DOMAIN_ROW_IN_EVENT=true injects a domain value into one event and the sink observer FAILS the run.",
+      "given": "the facade run under load that fires each of the five lifecycle events N times",
+      "when": "the event stream is inspected across the whole run",
+      "then": "every one of the N records carries only the metadata field types on AC-13107-1; the injection mutation FAILS",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1401-persistence-data-d1-facade",
+        "field": "interfaces.onEvent"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -34,5 +54,5 @@
     "TAC-1403-persistence-data-d1-deploy-gate"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/docs/topics.md

@@ -49,7 +49,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |