rcf-lite 0.25.0 → 0.27.0

package/blueprints/persistence-data-postgres/contributions/user-stories/persistence-data-postgres-us-27102.json

@@ -16,10 +16,125 @@
       "when": "the migration runner applies the directory against the database",
       "then": "each file runs inside a BEGIN/COMMIT pair; after all three succeed a migrationsApplied event fires with the filename list ['001_*.sql', '002_*.sql', '003_*.sql'] and the schema_version table (or the runner's configured bookkeeping table name) carries a row per applied filename",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27102-2",
+      "description": "Malformed migration filename. Given a file under the elicited migrations directory whose name does not match the numbered forward-only pattern (for example a file without the numeric prefix, or a duplicate number), when the migration runner walks the directory, then the runner refuses with a named error kind (malformedMigrationName), the run exits non-zero, and schema_version does not advance.",
+      "given": "a file in the elicited migrations directory that does not match the numbered forward-only pattern",
+      "when": "the migration runner walks the directory",
+      "then": "the runner refuses with malformedMigrationName; the run exits non-zero; schema_version does not advance",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2802-persistence-data-postgres-migration-runner",
+        "field": "interfaces.applyAll"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27102-3",
+      "description": "Repeat-apply idempotency. Given the migrations set already applied to the target database, when the runner is invoked a second time against the same set, then no migration file re-runs, schema_version is unchanged and the run exits zero.",
+      "given": "the migrations set already applied to the target database",
+      "when": "the runner is invoked again",
+      "then": "no migration re-runs; schema_version unchanged; run exits zero",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2802-persistence-data-postgres-migration-runner",
+        "field": "interfaces.applyAll"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27102-4",
+      "description": "Migration runner tool node-pg-migrate. Given the elicited migration-runner-tool answers node-pg-migrate, when the sidecar records the answer and the CI or boot step invokes the runner, then the invocation shape is `node-pg-migrate up --database-url-var DATABASE_URL --migrations-dir <migrations-directory>` and the schema_version bookkeeping table advances once per applied .sql file recorded by node-pg-migrate's own pgmigrations table.",
+      "given": "migration-runner-tool = node-pg-migrate",
+      "when": "the sidecar records the answer and the runner is invoked",
+      "then": "the invocation is `node-pg-migrate up --database-url-var DATABASE_URL --migrations-dir <migrations-directory>` and pgmigrations records one row per applied file",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-2802-persistence-data-postgres-migration-shape",
+        "field": "decision"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27102-5",
+      "description": "Migration runner tool sqitch. Given the elicited migration-runner-tool answers sqitch, when the sidecar records the answer and the CI or boot step invokes the runner, then the invocation shape is `sqitch deploy <target>` reading the elicited migrations-directory as the sqitch plan root, and the sqitch changes table advances one row per deployed change.",
+      "given": "migration-runner-tool = sqitch",
+      "when": "the sidecar records the answer and the runner is invoked",
+      "then": "the invocation is `sqitch deploy <target>` and the sqitch changes table advances one row per deployed change",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-2802-persistence-data-postgres-migration-shape",
+        "field": "decision"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27102-6",
+      "description": "Migration runner tool flyway. Given the elicited migration-runner-tool answers flyway, when the sidecar records the answer and the CI or boot step invokes the runner, then the invocation shape is `flyway -url=<jdbc:postgresql://...> -locations=filesystem:<migrations-directory> migrate` and the flyway_schema_history table advances one row per applied .sql file.",
+      "given": "migration-runner-tool = flyway",
+      "when": "the sidecar records the answer and the runner is invoked",
+      "then": "the invocation is `flyway -url=<jdbc> -locations=filesystem:<migrations-directory> migrate` and flyway_schema_history advances one row per file",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-2802-persistence-data-postgres-migration-shape",
+        "field": "decision"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27102-7",
+      "description": "Migration runner tool custom. Given the elicited migration-runner-tool answers custom, when the sidecar records the answer and the CI or boot step invokes the runner, then the invocation shape is the bespoke Node runner shipped in the fixture (`node ./scripts/migrate.mjs` reading the elicited migrations-directory) and the schema_version bookkeeping table it owns advances one row per applied filename inside the same transaction as the file body.",
+      "given": "migration-runner-tool = custom",
+      "when": "the sidecar records the answer and the runner is invoked",
+      "then": "the invocation is `node ./scripts/migrate.mjs` and schema_version advances one row per applied filename inside the same transaction as the file body",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2802-persistence-data-postgres-migration-runner",
+        "field": "interfaces.applyAll"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27102-8",
+      "description": "Runner mode atBoot. Given the elicited runner-mode answers atBoot, when the facade opens on process boot, then the runner's applyAll executes before the facade emits facadeReady; a fake migration that adds one row observably completes before the first domain-verb call returns; migrationsApplied fires exactly once with the applied filename list per boot.",
+      "given": "runner-mode = atBoot and one pending migration",
+      "when": "the facade opens on boot",
+      "then": "the runner applies before facadeReady fires; migrationsApplied fires exactly once per boot before the first domain-verb call returns",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2802-persistence-data-postgres-migration-runner",
+        "field": "interfaces.applyAll"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27102-9",
+      "description": "Runner mode ciStep. Given the elicited runner-mode answers ciStep, when the facade opens on process boot, then the facade does NOT invoke the runner and no migrationsApplied fires on boot; the CI pipeline's discrete migrate step (invoked before the artefact promotes) runs the same runner against the target's own connection URL and emits migrationsApplied out-of-process; a facade boot with schema_version behind the CI-applied set exits with schemaVersionBehind and refuses facadeReady.",
+      "given": "runner-mode = ciStep",
+      "when": "the facade opens on boot after or before the CI migrate step",
+      "then": "the facade does not invoke the runner on boot; migrationsApplied fires from the CI step, not the boot; a boot with schema_version behind the CI-applied set refuses facadeReady with schemaVersionBehind",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-2803-persistence-data-postgres-runner-mode",
+        "field": "decision"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2802-persistence-data-postgres-migration-runner"],
+  "tacIds": [
+    "TAC-2802-persistence-data-postgres-migration-runner"
+  ],
   "createdAt": "2026-09-06T15:47:00.000Z",
-  "updatedAt": "2026-09-06T15:47:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-postgres/contributions/user-stories/persistence-data-postgres-us-27103.json

@@ -16,10 +16,27 @@
       "when": "a Node built-in AST parser walks every call expression whose callee is 'pg.query' or resolves to a method named 'query' on a pg.Client, pg.Pool, or pg.PoolClient reference",
       "then": "every first-argument node is a Literal with typeof value === 'string'; no first-argument node is a TemplateLiteral or a string-concatenation expression",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27103-2",
+      "description": "Consumer-supplied SQL rejected at the facade edge. Given a facade verb whose parameter is a raw SQL string (or a general query object), when the verb is called from consumer code, then the facade refuses at the boundary with a named error kind (rejectedRawSql) and no pg.query call issues; a source-tree grep finds no pg.query first argument outside a static string literal in the facade module.",
+      "given": "a facade verb called with a raw SQL string as its parameter",
+      "when": "the verb runs",
+      "then": "the facade refuses at the boundary with rejectedRawSql; no pg.query issues; the source-tree grep is clean",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2801-persistence-data-postgres-facade",
+        "field": "interfaces.store.verbs"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2801-persistence-data-postgres-facade"],
+  "tacIds": [
+    "TAC-2801-persistence-data-postgres-facade"
+  ],
   "createdAt": "2026-09-06T15:47:00.000Z",
-  "updatedAt": "2026-09-06T15:47:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-postgres/contributions/user-stories/persistence-data-postgres-us-27104.json

@@ -11,15 +11,36 @@
   "acceptanceCriteria": [
     {
       "id": "AC-27104-1",
-      "description": "Given the transaction helper wrapping a callback that issues two INSERTs where the second violates a UNIQUE constraint, when the helper runs, then client.query('BEGIN') is issued, the first INSERT lands on the transaction, the second INSERT throws a constraint error the helper catches, client.query('ROLLBACK') is issued, a transactionRolledBack event fires with statementIndex 1, the client is released back to the pool, and the underlying error is re-thrown to the caller. The database after rollback carries neither row from the aborted transaction.",
+      "description": "Given the transaction helper wrapping a callback that issues two INSERTs where the second violates a UNIQUE constraint, when the helper runs, then the transaction-control primitives owned on TAC-2803-persistence-data-postgres-transaction-helper.interfaces.withTransaction fire in order (BEGIN before the first INSERT, ROLLBACK after the failing INSERT), a transactionRolledBack event fires with statementIndex 1, the client is released back to the pool, and the underlying error is re-thrown to the caller. The database after rollback carries neither row from the aborted transaction.",
       "given": "the facade's withTransaction helper, a table with a UNIQUE constraint on a column, and a callback issuing two INSERTs with the same value for that column",
       "when": "await withTransaction(callback) runs",
-      "then": "BEGIN is issued, the first INSERT lands inside the transaction, the second INSERT throws, ROLLBACK is issued, transactionRolledBack fires on the event sink with { statementIndex: 1, code: '<pg error code>' }, the client is released, the promise rejects with the underlying error, and a subsequent SELECT against the table returns no rows from the aborted transaction",
+      "then": "the BEGIN primitive owned on TAC-2803-persistence-data-postgres-transaction-helper.interfaces.withTransaction is issued, the first INSERT lands inside the transaction, the second INSERT throws, the ROLLBACK primitive owned on the same interface is issued, transactionRolledBack fires on the event sink with { statementIndex: 1, code: '<pg error code>' }, the client is released, the promise rejects with the underlying error, and a subsequent SELECT against the table returns no rows from the aborted transaction",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2803-persistence-data-postgres-transaction-helper",
+        "field": "interfaces.withTransaction"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-27104-2",
+      "description": "Mid-transaction error rolls back. Given a two-statement withTransaction callback where the second statement throws, when the helper catches the throw, then the ROLLBACK primitive owned on TAC-2803-persistence-data-postgres-transaction-helper.interfaces.withTransaction fires before the client is released, transactionRolledBack fires with the failing statement index on the event sink, and a subsequent SELECT on the transaction's target rows shows the pre-transaction state.",
+      "given": "a two-statement withTransaction callback whose second statement throws",
+      "when": "the helper catches the throw",
+      "then": "the ROLLBACK primitive owned on TAC-2803-persistence-data-postgres-transaction-helper.interfaces.withTransaction runs; transactionRolledBack fires with failing statement index; target rows show pre-transaction state",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2803-persistence-data-postgres-transaction-helper",
+        "field": "interfaces.withTransaction"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2803-persistence-data-postgres-transaction-helper"],
+  "tacIds": [
+    "TAC-2803-persistence-data-postgres-transaction-helper"
+  ],
   "createdAt": "2026-09-06T15:47:00.000Z",
-  "updatedAt": "2026-09-06T15:47:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-postgres/contributions/user-stories/persistence-data-postgres-us-27105.json

@@ -16,10 +16,69 @@
       "when": "the recovery runner runs pg_dump against the source and a second Postgres is primed from the artefact",
       "then": "the runner exits 0, backupExported fires with the artefact path and completion timestamp, the artefact file exists at the elicited destination, and a query against the restored Postgres returns the same row count and same checksum of the fixture rowset as the source",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27105-2",
+      "description": "pg_dump upstream failure. Given the pg_dump process exits non-zero (for example the elicited connection-url is unreachable or the destination path is not writable), when the recovery runner runs, then the runner refuses with the pg_dump exit code and a named error kind (recoveryExportFailed), no partial artefact is left at the destination path, and backupExported does not fire on the event sink.",
+      "given": "pg_dump exits non-zero",
+      "when": "the recovery runner runs",
+      "then": "the runner refuses with recoveryExportFailed carrying the pg_dump exit code; no partial artefact remains; backupExported does not fire",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2804-persistence-data-postgres-recovery-runner",
+        "field": "interfaces.exportDatabase"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27105-3",
+      "description": "Recovery cadence daily. Given the elicited recovery-cadence answers daily, when the sidecar records the answer, then the recorded schedule descriptor the project-side scheduler consumes is `0 3 * * *` (a cron string firing once per day at 03:00 in the elicited timezone) and one backupExported event fires per day on the sink carrying { artefactPath, completedAt } inside the daily window.",
+      "given": "recovery-cadence = daily",
+      "when": "the sidecar records the answer and the scheduler ticks over a 24-hour window",
+      "then": "the recorded schedule is `0 3 * * *` and exactly one backupExported fires per 24-hour window",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-2804-persistence-data-postgres-recovery",
+        "field": "decision"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27105-4",
+      "description": "Recovery cadence hourly. Given the elicited recovery-cadence answers hourly, when the sidecar records the answer, then the recorded schedule descriptor is `0 * * * *` (a cron string firing at minute zero of every hour) and backupExported fires 24 times per 24-hour window on the sink, each carrying a distinct completedAt inside its hour.",
+      "given": "recovery-cadence = hourly",
+      "when": "the sidecar records the answer and the scheduler ticks over a 24-hour window",
+      "then": "the recorded schedule is `0 * * * *` and 24 backupExported events fire per 24-hour window",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-2804-persistence-data-postgres-recovery",
+        "field": "decision"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27105-5",
+      "description": "Recovery cadence weekly. Given the elicited recovery-cadence answers weekly, when the sidecar records the answer, then the recorded schedule descriptor is `0 3 * * 0` (a cron string firing at 03:00 every Sunday) and exactly one backupExported fires per seven-day window on the sink carrying { artefactPath, completedAt } inside that window.",
+      "given": "recovery-cadence = weekly",
+      "when": "the sidecar records the answer and the scheduler ticks over a seven-day window",
+      "then": "the recorded schedule is `0 3 * * 0` and exactly one backupExported fires per seven-day window",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-2804-persistence-data-postgres-recovery",
+        "field": "decision"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2804-persistence-data-postgres-recovery-runner"],
+  "tacIds": [
+    "TAC-2804-persistence-data-postgres-recovery-runner"
+  ],
   "createdAt": "2026-09-06T15:47:00.000Z",
-  "updatedAt": "2026-09-06T15:47:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-postgres/contributions/user-stories/persistence-data-postgres-us-27106.json

@@ -16,10 +16,27 @@
       "when": "twenty SELECT queries are dispatched concurrently across the two facades via Promise.all",
       "then": "all twenty promises resolve inside the connectionTimeoutMillis budget; no query throws; the observed maximum concurrent in-use pool connections on either facade is at most the configured pool size (5)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-27106-2",
+      "description": "Pool exhaustion is bounded. Given two facades at elicited pool-size 5 and thirty concurrent query calls, when the twenty-first through thirtieth calls contend for a client, then each call either acquires within the elicited connection-timeout-ms or refuses with a named error kind (poolAcquireTimeout); no call hangs indefinitely; the observability sink records connectionTimeout events with the elapsed time.",
+      "given": "two facades at pool-size 5 and 30 concurrent query calls",
+      "when": "the 21st through 30th calls contend for a client",
+      "then": "each call acquires within connection-timeout-ms or refuses with poolAcquireTimeout; no call hangs; the sink records connectionTimeout with elapsed time",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2801-persistence-data-postgres-facade",
+        "field": "interfaces.createStore"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2801-persistence-data-postgres-facade"],
+  "tacIds": [
+    "TAC-2801-persistence-data-postgres-facade"
+  ],
   "createdAt": "2026-09-06T15:47:00.000Z",
-  "updatedAt": "2026-09-06T15:47:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-postgres/contributions/user-stories/persistence-data-postgres-us-27107.json

@@ -16,10 +16,27 @@
       "when": "the surface is inspected and the helper is invoked with a valid integer key on a supported answer",
       "then": "the surface exposes withAdvisoryLock only when the answer is session or transaction; the helper acquires the correct lock verb per the answer, runs the callback, and releases (session) or lets COMMIT release (transaction); the sidecar records the elicited answer for later validation",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27107-2",
+      "description": "Off default: helper genuinely absent. Given the elicited advisory-lock-helper answer off, when the facade opens, then no advisory-lock helper is exposed on the facade's public surface (a call site that attempts to reach for it fails at the module surface, not at a lock acquisition); a source-tree grep finds no pg_advisory_lock or pg_advisory_xact_lock call outside a helper module gated by the elicited enabled value.",
+      "given": "advisory-lock-helper = off",
+      "when": "the facade opens",
+      "then": "no advisory-lock helper appears on the facade surface; grep finds no pg_advisory_lock outside a gated helper",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2801-persistence-data-postgres-facade",
+        "field": "interfaces.store.verbs"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2801-persistence-data-postgres-facade"],
+  "tacIds": [
+    "TAC-2801-persistence-data-postgres-facade"
+  ],
   "createdAt": "2026-09-06T15:47:00.000Z",
-  "updatedAt": "2026-09-06T15:47:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-postgres/contributions/user-stories/persistence-data-postgres-us-27108.json

@@ -16,10 +16,27 @@
       "when": "the pool completes its first ready-check",
       "then": "all five calls resolve successfully; facadeReady fires exactly once on the event sink; no unhandled rejection is raised",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-27108-2",
+      "description": "First-connect race: no double emission. Given two concurrent boot paths racing to open the facade at the same time (an atypical but reachable init ordering), when both paths call createStore, then only one facadeReady fires on the event sink and both paths observe the same facade reference; a mutation SIMULATE_DOUBLE_BOOT=true forces a second createStore call within the boot window and the sink observer FAILS on a second facadeReady.",
+      "given": "two concurrent boot paths racing to open the facade",
+      "when": "both paths call createStore",
+      "then": "only one facadeReady fires; both paths observe the same facade reference; the double-boot mutation FAILS the run",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2801-persistence-data-postgres-facade",
+        "field": "responsibilities.pool"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2801-persistence-data-postgres-facade"],
+  "tacIds": [
+    "TAC-2801-persistence-data-postgres-facade"
+  ],
   "createdAt": "2026-09-06T15:47:00.000Z",
-  "updatedAt": "2026-09-06T15:47:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-postgres/contributions/user-stories/persistence-data-postgres-us-27109.json

@@ -16,10 +16,27 @@
       "when": "the migration runner applies the directory with SIMULATE_MIGRATION_FAILURE=true",
       "then": "the first file's transaction commits and its row lands in the bookkeeping table; the second file's transaction rolls back; the runner exits non-zero with the failing filename in its stderr; the third file is not attempted; the bookkeeping table shows exactly one applied row",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27109-2",
+      "description": "On-disk store unchanged after a failing migration. Given a two-migration set where the second migration's body raises a Postgres error mid-statement, when the runner applies the set, then the second migration's transaction rolls back completely (schema_version reflects the first migration only), the runner exits non-zero with the pg error code named in stderr, and a subsequent '\\d' schema inspection shows no partial artefact from the failing migration.",
+      "given": "a two-migration set whose second migration raises mid-statement",
+      "when": "the runner applies the set",
+      "then": "the second migration rolls back; schema_version reflects the first only; run exits non-zero with the pg error code; schema shows no partial artefact",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2802-persistence-data-postgres-migration-runner",
+        "field": "interfaces.applyAll"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2802-persistence-data-postgres-migration-runner"],
+  "tacIds": [
+    "TAC-2802-persistence-data-postgres-migration-runner"
+  ],
   "createdAt": "2026-09-06T15:47:00.000Z",
-  "updatedAt": "2026-09-06T15:47:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-postgres/contributions/user-stories/persistence-data-postgres-us-27110.json

@@ -16,10 +16,55 @@
       "when": "the drill primes a fresh Postgres from the artefact and runs SELECT count(*) and a checksum aggregate on the fixture table against both databases",
       "then": "the two counts are equal; the two checksums are equal; recoveryDrillPassed fires on the event sink with { count, checksum }; the fresh Postgres and its artefact primer are torn down on exit",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27110-2",
+      "description": "Recovery drill upstream failure. Given the pg_dump artefact is corrupt (or the target restore database is not empty), when the recovery-drill verb runs, then the drill refuses with a named error kind (recoveryDrillFailed) carrying the psql restore exit code and a sample of the first failing statement; recoveryDrillCompleted does not fire; the corrupt input is not silently accepted.",
+      "given": "a corrupt pg_dump artefact or a non-empty restore target",
+      "when": "the recovery-drill verb runs",
+      "then": "the drill refuses with recoveryDrillFailed carrying psql exit code and first failing statement sample; recoveryDrillCompleted does not fire",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2804-persistence-data-postgres-recovery-runner",
+        "field": "interfaces.recoveryDrill"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27110-3",
+      "description": "PITR provider hosted. Given the elicited pitr-provider answers hosted, when the recovery-drill verb completes, then the drill report carries pitrArtefactCitation of shape { provider: 'hosted', vendorPitrWindowHours: <number>, vendorConsoleUrl: <string> } naming the managed cluster's own PITR window setting; the drill refuses if the vendor PITR window is not set on the cluster (vendorPitrDisabled error kind).",
+      "given": "pitr-provider = hosted against a live managed cluster",
+      "when": "the recovery-drill verb runs",
+      "then": "the drill report carries pitrArtefactCitation.provider='hosted' with vendorPitrWindowHours and vendorConsoleUrl; a cluster with PITR unset refuses with vendorPitrDisabled",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-2804-persistence-data-postgres-recovery",
+        "field": "decision"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-27110-4",
+      "description": "PITR provider self-managed. Given the elicited pitr-provider answers self-managed, when the recovery-drill verb completes, then the drill report carries pitrArtefactCitation of shape { provider: 'self-managed', walArchivePath: <string>, basebackupPath: <string>, retainedHours: <number> } naming the WAL-archive destination and the pg_basebackup artefact the drill primed from; the drill refuses if either walArchivePath or basebackupPath is missing (walArchiveUnavailable error kind).",
+      "given": "pitr-provider = self-managed with a WAL archive configured",
+      "when": "the recovery-drill verb runs",
+      "then": "the drill report carries pitrArtefactCitation.provider='self-managed' with walArchivePath, basebackupPath, retainedHours; a missing WAL archive refuses with walArchiveUnavailable",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-2804-persistence-data-postgres-recovery",
+        "field": "decision"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2804-persistence-data-postgres-recovery-runner"],
+  "tacIds": [
+    "TAC-2804-persistence-data-postgres-recovery-runner"
+  ],
   "createdAt": "2026-09-06T15:47:00.000Z",
-  "updatedAt": "2026-09-06T15:47:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-postgres/docs/topics.md

@@ -47,7 +47,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/persistence-data-sqlite/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+Adds deliveredBy on REQ-001. Adds ownerRef on AC-5106-1 and AC-5110-2 (onEvent). Closes chain-contradiction specimen F-1: US-5109 AC-5109-3 now recovers a defective committed migration via a new numbered forward-only file (never editing the committed file in place), aligning with TAC-603 and the migration catalog's forward-only rule. Adds disposition to every AC.
+
+
+
+Review-fix (2026-09-09): Version bumped from 1.0.1 to 1.1.0 to reflect the net-added AC contributions on existing stories (permission-denied and concurrent-WAL failure paths added under US-5101; disk-full mid-migration added under US-5104). Prior 1.0.1 entry reclassified as prose-only; this bump covers the AC additions per section 8.
+
+Adds deliveredBy on REQ-002 through REQ-011 (ten of eleven mandatory REQs).