rcf-lite 0.25.0 → 0.27.0

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33112.json

@@ -16,12 +16,63 @@
       "when": "the probe runs",
       "then": "with the account: the round-trip returns and the probe passes. Without the account: accountBoundSkipped:true and exit 0.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33112-2",
+      "description": "Bounded-wait: the real-account probe caps its round-trip attempts at 30 seconds. If the storage.put or storage.get calls do not settle within the cap, the probe returns aggregateVerdict:\"fail\" with reason CF_DO_ROUND_TRIP_TIMEOUT and the observed elapsed millis.",
+      "given": "a real-account probe whose CF API calls hang past 30 seconds",
+      "when": "the probe caps the wait",
+      "then": "aggregateVerdict is \"fail\" with reason CF_DO_ROUND_TRIP_TIMEOUT and elapsed millis",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-33112-3",
+      "description": "Partial env-var configuration: with CI_HAS_CLOUDFLARE_ACCOUNT=true but CF_API_TOKEN missing, the probe refuses before any API call with a named error kind CF_MISSING_TOKEN naming the missing variable. Same for CF_ACCOUNT_ID or CF_DO_NAMESPACE_ID.",
+      "given": "CI_HAS_CLOUDFLARE_ACCOUNT=true with CF_API_TOKEN unset",
+      "when": "the probe runs",
+      "then": "the probe refuses with CF_MISSING_TOKEN naming the missing variable",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33112-4",
+      "description": "Non-2xx API response: if the Cloudflare API returns a 401, 403 or 5xx during the round-trip, the probe surfaces the observed HTTP status and response body, and returns aggregateVerdict:\"fail\" with reason CF_DO_HTTP_ERROR. 4xx is not retried; 5xx retries once.",
+      "given": "a real-account probe where the DO API returns 403",
+      "when": "the probe attempts the round-trip",
+      "then": "aggregateVerdict is \"fail\" with reason CF_DO_HTTP_ERROR, HTTP status and body",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/platform/limits/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3401-platform-cloudflare-durable-objects-namespace-facade"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33113.json

@@ -11,15 +11,78 @@
   "acceptanceCriteria": [
     {
       "id": "AC-33113-1",
-      "description": "The wrangler-seam probe, when the fixture has been prepared with `pnpm install --ignore-workspace` so the wrangler devDependency is on the tree, spawns `wrangler dev --local --port 0` from the cf-platform fixture, waits bounded 45 seconds for the CLI to bind, then (a) issues two concurrent POST /cell/<id>/increment requests against a fetch route in src/index.mjs that calls createDoFacade({env, eventSink}).cellFetch(<id>, request), asserting the two responses observe per-instance serialisation (sorted counters == [1, 2], sorted witnesses == [0, 1], each request read the other's write) and (b) opens one WebSocket upgrade against /hub/<id>/connect via createDoFacade({env, eventSink}).hubFetch(<id>, request), asserting one broadcast frame arrives on connect with payload 'hello-from-hub'. The probe kills wrangler cleanly on exit. Warn semantics per section 3.1 pass-with-skip: if wrangler is not installed or fails to bind within the cap, the probe returns aggregateVerdict warn (never fail); a handler thrown at the workerd boundary is a genuine fail. The additional result on the same probe run covers AC-33108-1 by grepping the fixture wrangler.toml for the two [[durable_objects.bindings]] pairs and the [[migrations]] tag/new_classes pair; the grep result is deterministic and does not require wrangler.",
+      "description": "The wrangler-seam probe, when the fixture has been prepared with `pnpm install --ignore-workspace` so the wrangler devDependency is on the tree, spawns `wrangler dev --local --port 0` from the cf-platform fixture, waits bounded 45 seconds for the CLI to bind, then (a) issues two concurrent POST /cell/<id>/increment requests against a fetch route in src/index.mjs that calls createDoFacade({env, sink}).cellFetch(<id>, request), asserting the two responses observe per-instance serialisation (sorted counters == [1, 2], sorted witnesses == [0, 1], each request read the other's write) and (b) opens one WebSocket upgrade against /hub/<id>/connect via createDoFacade({env, sink}).hubFetch(<id>, request), asserting one broadcast frame arrives on connect with payload 'hello-from-hub'. The probe kills wrangler cleanly on exit. Warn semantics per section 3.1 pass-with-skip: if wrangler is not installed or fails to bind within the cap, the probe returns aggregateVerdict warn (never fail); a handler thrown at the workerd boundary is a genuine fail. The additional result on the same probe run covers AC-33108-1 by grepping the fixture wrangler.toml for the two [[durable_objects.bindings]] pairs and the [[migrations]] tag/new_sqlite_classes pair; the grep result is deterministic and does not require wrangler.",
       "given": "the cf-platform fixture with the wrangler devDependency installed and the shipped DO classes exported from src/index.mjs",
       "when": "the wrangler-seam probe runs",
-      "then": "wrangler dev binds; two concurrent increments through env.CELL observe per-instance serialisation; one WebSocket upgrade through env.HUB receives a broadcast frame; the wrangler.toml grep confirms both binding pairs and the migrations tag/new_classes; wrangler exits cleanly",
+      "then": "wrangler dev binds; two concurrent increments through env.CELL observe per-instance serialisation; one WebSocket upgrade through env.HUB receives a broadcast frame; the wrangler.toml grep confirms both binding pairs and the migrations tag/new_sqlite_classes; wrangler exits cleanly",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33113-2",
+      "description": "Wrangler-not-installed warn: if pnpm install --ignore-workspace has not been run under the cf-platform fixture and the wrangler bin is not on the fixture's node_modules/.bin, the wrangler-seam probe returns aggregateVerdict:\"warn\" naming DO_WRANGLER_NOT_INSTALLED with the expected bin path. This is a genuine \"cannot verify\" state, not a runtime defect (warn semantics per section 3.1 pass-with-skip).",
+      "given": "a cf-platform fixture whose node_modules does not contain wrangler",
+      "when": "the wrangler-seam probe runs",
+      "then": "aggregateVerdict is \"warn\" with reason DO_WRANGLER_NOT_INSTALLED",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33113-3",
+      "description": "Bind-timeout warn: if wrangler dev --local --port 0 does not bind within the 45-second cap, the probe returns aggregateVerdict:\"warn\" naming DO_WRANGLER_BIND_TIMEOUT with the observed stderr quoted. The probe kills the wrangler child on the timeout.",
+      "given": "a probe run where wrangler cannot bind within 45 seconds (simulated by an environment that blocks its listen)",
+      "when": "the probe caps the wait at 45 seconds",
+      "then": "aggregateVerdict is \"warn\" naming DO_WRANGLER_BIND_TIMEOUT with the observed stderr",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33113-4",
+      "description": "Workerd handler thrown = fail (not warn): if wrangler binds but a request through env.CELL or env.HUB throws inside the workerd runtime (e.g. the DO handler rejects with an uncaught error), the probe returns aggregateVerdict:\"fail\" naming DO_WORKERD_HANDLER_THREW with the observed response body. A handler thrown is a genuine runtime defect, distinct from the warn cases above.",
+      "given": "a probe run where a POST /cell/<id>/increment triggers a handler that throws inside workerd",
+      "when": "the probe issues the concurrent requests",
+      "then": "aggregateVerdict is \"fail\" naming DO_WORKERD_HANDLER_THREW",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33113-5",
+      "description": "Probe teardown: the wrangler child is killed on probe exit (normal or exceptional) via SIGTERM followed by SIGKILL after a 5-second grace period. An interrupted probe still tears down within 6 seconds; no orphan wrangler process remains.",
+      "given": "a probe run interrupted by an assertion rejection after the CLI binds",
+      "when": "the probe teardown runs",
+      "then": "the wrangler child is terminated within 6 seconds; no orphan process remains",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
     }
   ],
-  "tacIds": ["TAC-3401-platform-cloudflare-durable-objects-namespace-facade"],
+  "tacIds": [
+    "TAC-3401-platform-cloudflare-durable-objects-namespace-facade"
+  ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T16:10:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/docs/topics.md

@@ -47,7 +47,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -69,7 +69,7 @@ ADR/TAC suffixes for this blueprint use the 3401-3499 block, continuing the shel
 - Reuse `strongConsistencyCellContract` exactly as spelled here when your blueprint holds an opinion on the strong-consistency cell contract; contribute your own scope:global ADR on that string and let composition surface the pairing.
 - Reuse `websocketHubContract` exactly as spelled here when your blueprint holds an opinion on the websocket-hub contract; the same pattern applies.
 - A future non-Cloudflare adapter on either contract mints on demand; each claims the same topic string and conflicts by design.
-- Consumer blueprints reading the `strongConsistencyCell` or `hibernatableWebSocket` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the DO facade wiring at apply time via the T-5 visual-round capability-declaration mechanism.
+- Consumer blueprints reading the `strongConsistencyCell` or `hibernatableWebSocket` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the DO facade wiring at apply time via the visual-round capability-declaration mechanism.
 
 ## Deliberate-conflict statement
 

package/blueprints/platform-cloudflare-durable-objects/guide/platform-cloudflare-durable-objects.md

@@ -5,21 +5,21 @@
 You reach for `platform-cloudflare-durable-objects` when your
 Worker needs strongly consistent authoritative state, coordinated
 multiplayer websocket connections, or both on the same DO namespace
-mechanic. Two shapes ship in one blueprint: the SINGLE-CELL shape
+mechanic. Two shapes ship in one blueprint: the single-cell shape
 (counter, session store, lock, coordinator) and the WEBSOCKET-HUB
 shape (rooms, presence, live cursors).
 
 If you need eventually-consistent low-latency reads on a read-hot
 path (feature flags, session cache, config cache), reach for
-`platform-cloudflare-kv` (round 6 T-1) instead. If you need
+`platform-cloudflare-kv` instead. If you need
 durable multi-step workflows with retries and state across steps,
 reach for the follow-up Workflows adapter on `jobs-background`
-v1.1.0 (round-6 minor bump per spec section 5.7).
+v1.1.0.
 
 ## Decision tree
 
 - Strongly consistent authoritative cell (counter, session store,
-  lock, coordinator) -> SINGLE-CELL shape (this blueprint,
+  lock, coordinator) -> single-cell shape (this blueprint,
   `platform-cloudflare-durable-objects` v1.0.0).
 - Coordinated multiplayer websocket connections in one authoritative
   hub (rooms, live cursors, presence) -> WEBSOCKET-HUB shape (this
@@ -107,7 +107,7 @@ looser window trades latency for fan-out cost on a busy hub.
 
 The DO class names are stable strings committed to `wrangler.toml`.
 Both binding blocks name the class explicitly; the `[[migrations]]`
-block records the mint under `tag = "v1"` with `new_classes` naming
+block records the mint under `tag = "v1"` with `new_sqlite_classes` naming
 both classes. A copy-paste block for a fresh Worker project:
 
 ```
@@ -121,7 +121,7 @@ class_name = "HubObject"
 
 [[migrations]]
 tag = "v1"
-new_classes = ["SingleCellObject", "HubObject"]
+new_sqlite_classes = ["SingleCellObject", "HubObject"]
 ```
 
 A rename in a later release ships as a NEW `[[migrations]]` tag on
@@ -161,11 +161,11 @@ returns fail on the AC-33106-1 result.
 
 ## Composition
 
-- Consumes `deploy-cloudflare-workers` v1.2.0 (T-0). The DO bindings
+- Consumes `deploy-cloudflare-workers` v1.2.0. The DO bindings
   and migrations tag land in the same `wrangler.toml`.
 - Companions `logging` and `errorHandling` supply the sink factory
   and the internal-error record factory.
-- Complements `platform-cloudflare-kv` (round 6 T-1): DO owns the
+- Complements `platform-cloudflare-kv`: DO owns the
   strong-consistency slot; KV owns the cache-shaped eventually-
   consistent slot. Both compose on the same Worker.
 - A future non-Cloudflare adapter on `strongConsistencyCellContract`
@@ -203,7 +203,7 @@ workerd runtime:
 - An additional `AC-33108-1` result on the same run greps the
   fixture `wrangler.toml` for both `[[durable_objects.bindings]]`
   binding pairs and the `[[migrations]]` `tag = "v1"` with
-  `new_classes`; the grep is deterministic and does not require
+  `new_sqlite_classes`; the grep is deterministic and does not require
   wrangler.
 
 Warn semantics per section 3.1 pass-with-skip: if the wrangler

package/blueprints/platform-cloudflare-kv/CHANGELOG.md

@@ -2,6 +2,87 @@
 
 All notable changes to `platform-cloudflare-kv` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
 
+## 1.1.3 - 2026-09-10
+
+Positive-evidence rule alignment on the probe pack skip path (authoring standard section 7d), plus a register and citation patch.
+
+- Probes: the account-bound skip return on `contributions/probes/real-account-eventual-consistency-smoke.mjs` now carries a `reason` field naming the exact env var that was unset (`CI_HAS_CLOUDFLARE_ACCOUNT` on the standard skip path). Skip-path probe report regenerated so the shipped shape carries the new field.
+- AC-31103-1 gains a `vendorCitation` for the Workers KV read/write API page (F-2).
+- Neutral register in AC-31109-2 (F-3), ADR-3201 context and consequences (F-4), README (F-5) and guide prose (F-6).
+
+## 1.1.2 - 2026-09-10
+
+Owner reference for the KV event-record whitelist.
+
+- Rewrote REQ-004 description to reference the owning TAC field (`TAC-3203-platform-cloudflare-kv-event-sink.purpose`) for the KV event-record whitelist, rather than restating the shape verbatim.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+
+## 1.1.0 (2026-09-09)
+
+### Added
+
+- `platform-cloudflare-kv-REQ-006` (`must`): the elicited `kv-key-naming-convention` answer (`prefixed` or `flat`) flows through every facade verb; `prefixed` applies the elicited `keyPrefix` transparently, `flat` passes keys through untouched. Closes criterion a on the previously unbacked elicit (F-1).
+- `platform-cloudflare-kv-REQ-007` (`must`): pre-ready operations queue behind `facadeReady`; sink events emit in causal per-operation order. Closes the previously unbacked `TAC-3201` pre-ready responsibility and `TAC-3203` ordering responsibility (F-4).
+- `platform-cloudflare-kv-US-31109` (traces REQ-005 after prior gap F-2), `US-31110` (traces REQ-006), `US-31111` (traces REQ-007). Every AC carries `disposition` and `ownerRef`; the vendor-fact ACs carry `vendorCitation`.
+
+### Changed
+
+- `platform-cloudflare-kv-REQ-005` reworded to separate the applied cache-aside TTL (LOCAL expiry) from the KV eventual-consistency propagation window (vendor-owned, up to 60 seconds or more per the Cloudflare KV documentation). The v1.0.x wording that called the elicited TTL a "global staleness ceiling" is retired; the guide surfaces the two clocks separately and cross-references `platform-cloudflare-durable-objects` as the strong-consistency answer (F-3).
+- Every existing REQ carries a `deliveredBy` link into a TAC or ADR (five links). Every existing AC carries `disposition`. `rcf define blueprint lint-consistency` reports zero pass-1 and pass-2 findings.
+
+### Added (criterion b completion, second pass 2026-09-09)
+
+- Every story on this blueprint now reaches the section 7a AC-set-sufficiency floor. 36 new hand-authored ACs cover the documented failure paths named in the guide and TAC records, per-story range 4-6 (from the 1-3 shipped in the first 1.1.0 pass): US-31101 gains four failure-path ACs (binding-unbound closing F-7 write, invalid sink, repeat-boot idempotency, ready-check rejects with KV_FACADE_NOT_READY); US-31102 gains three ACs (non-facade leak, comment-only mention, nested-directory recursion); US-31103 gains four ACs (getWithMetadata closing F-5, per-call TTL propagation closing F-5, write-failed with KV_WRITE_FAILED closing F-7, read-failed with KV_READ_FAILED closing F-7); US-31104 gains four ACs (cursor pagination closing F-5, empty prefix, no-match, list_complete indicator); US-31105 gains four ACs (TTL floor clamping closing F-6, origin-throws, concurrent-miss single-flight, source classification); US-31106 gains three ACs (per-call TTL override closing F-6, per-call TTL below floor clamps, TTL boundary strict less-than); US-31107 gains three ACs (additional-field mutation, causal ordering, closed vocabulary); US-31108 gains three ACs (metadata-blob never a body, substring scan across all kinds, layer separation); US-31109 gains three ACs (vendor propagation window in guide, DO as strong-consistency alternative in guide, no cross-region claim on any AC); US-31110 gains three ACs (unknown mode refuses, empty prefix behaves as flat, nested prefix); US-31111 gains two ACs (strict FIFO drain of 10 pre-ready calls, post-ready no-queue path). Every new AC carries `disposition`, most carry `ownerRef` into the owning TAC, and vendor-fact ACs carry `vendorCitation` (KV overview, KV API, KV how-KV-works, KV limits) with today's verifiedOn date.
+- `rcf define blueprint lint-consistency` still reports zero pass-1 and pass-2 findings. Blueprint stays at v1.1.0 on the same unreleased minor.
+
+### Fixed (review fix pass, 2026-09-09)
+
+- `AC-31109-1` disposition flipped from `fixed` to `template`: the applying project sets the cache-aside TTL, so an AC that binds the local-expiry window to `elicitedTtlMs` is an elicit-branch AC per section 7b (review F-4).
+- Register sweep: README, ADR and probe comments have internal operator names, host names, work-item ids, internal train labels and "operator ruling" references neutralised to concept ("throwaway prefix", "probe-integrity pass", "operator ruling"); code literals bound to real Cloudflare API state ("h2-cf-probe-integrity-scratch-kv-" and similar) are unchanged. CHANGELOG entries keep internal provenance (review F-3).
+
+## 1.0.2 (2026-09-08)
+
+follow-up (addendum item 6 fixture defect): the real-account KV probe now self-provisions its own throwaway namespace, closing the second-tier undeclared-env skip real-account hit at the real-account gate on 2026-09-08 (`REAL RUN: PARTIAL`, `MERGE DECISION: HOLD`). No shipped-code capability change.
+
+### Changed
+
+- `real-account-eventual-consistency-smoke.mjs` rewritten against a new self-provisioning fixture shim at `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-real-account-shim.mjs`. The shim mints a scratch KV namespace under the frozen throwaway prefix `h2-cf-probe-integrity-scratch-kv-`, writes a fixture key under `h2-storage-smoke-`, polls up to 60 seconds bounded for same-region visibility, deletes the key, and destroys the namespace on exit. Positive evidence captured on every real-account run: namespace id, exact scratch title, key, PUT / GET / DELETE status codes, elapsed ms.
+- Removed the second-tier `CF_KV_NAMESPACE_ID` gate that produced the undeclared skip at the real-account gate. The declared env for a real-account run is now `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN` (optional test override `CF_API_BASE_URL`), enumerated in the probe's `report.extra.envDeclared` and mirrored in the shim's `DECLARED_ENV` export.
+- Teardown is fail-safe and idempotent: a mid-run crash surfaces the minted id through the shim's persisted scratch record; the shim's separate `sweepOrphans` entry point lists over the account and filters on the throwaway prefix. Sweep is structurally unable to select a non-prefixed name (three independent guards: prefix assert on mint, prefix assert on destroy against the record, prefix assert on the live-listing observation; sweep-only prefix filter mirrors the destroy assertions). A dedicated sweep-safety test at `packages/rcf-lite/test/fixtures/cf-platform/test/h2-cf-kv-real-account-shim.test.mjs` seeds the mock account with the ten live production script names on the operator account plus a sneaky mid-string-prefix name and asserts sweep selects zero of them.
+
+### Added
+
+- Self-contained mock CF REST API at `packages/rcf-lite/test/fixtures/cf-platform/test/mock-cf-api-server.mjs` (Node `node:http` only, zero-dep) implementing the KV namespaces + values + keys endpoints the shim hits, with page + per_page pagination on the namespaces list. Test at `test/h2-cf-kv-probe-e2e.test.mjs` boots the mock in-process, points the shim at it via `CF_API_BASE_URL`, and drives the probe end-to-end to prove the mint / evidence-capture / teardown / zero-orphans loop before the real-account run ever executes.
+- `kvListNamespaces` in the shared CF REST client (`h2-cf-account-api.mjs`) paginates to completion via the documented `per_page` + `page` loop (operator ruling 4e9ff62d item 5) so `sweepOrphans` is not silently truncated to page one on a busy account. `kvDeleteNamespace` is idempotent on 404 (operator ruling 4e9ff62d items 3+4).
+
+### Local-proof scope note
+
+The local proof harness under `packages/rcf-lite/test/fixtures/cf-platform/test/` is a mock of Cloudflare's REST contract, not the wire. **The local run exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** This probe is never described as "locally verified" - the local runs are our own lifecycle-logic proof; wire correctness is proven at the real-account gate.
+
+## 1.0.1 (2026-09-08)
+
+hardening pass (`h2-cf-platform-probe-integrity`): probe-integrity patch across the four Cloudflare-platform blueprints. No capability change.
+
+### Changed
+
+- Re-anchored all five KV probes and the README from the defunct `AC-5xxx` id space to the shipped `AC-31xxx` band (nine shipped ACs: `AC-31101-1`, `AC-31102-1`, `AC-31103-1`, `AC-31103-2`, `AC-31104-1`, `AC-31105-1`, `AC-31106-1`, `AC-31107-1`, `AC-31108-1`). Every one of the nine now has a runtime observable through a re-anchored probe. Anatomy-test assertions in `packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js` moved with the re-anchor. Dispatch addendum ruling 1.
+- Moved the `SIMULATE_CACHE_MISS` mutation switch out of `cache-aside-hit-then-miss.mjs` into fixture shim `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-cache-aside-shim.mjs`; the probe body holds zero `SIMULATE_` token references (`AC-15401-1` mutation-purity rule).
+- Moved the `SIMULATE_PII_LEAK` mutation switch out of `event-secrecy.mjs` into fixture shim `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-event-secrecy-shim.mjs`; the probe body holds zero `SIMULATE_` token references.
+- Reworded the "fake clock" comment on `cache-aside-hit-then-miss.mjs` header to name the local test double honestly ("elicited deterministic clock the fixture advances").
+- Reworded the `Known limitations` (CHANGELOG) and `Known mechanism-reach gaps` (README) entries on the loader `elicits[]` `when` block predicate to name the loader-capability uplift as a loader-capability follow-up (0.26.x capability change, out of the hardening pass's 0.25.x patch scope per operator ruling 1). The entry describes the current shipped shape and points forward to the follow-up.
+
+### Fixed
+
+- Removed the committed fail envelope at `.rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json`; committed a shipped-code pass envelope in its place. Regenerated the other KV envelopes so committed envelopes reflect the re-anchored shipped-code runs.
+
+### Chain slice
+
+- Train chain slice minted inside the reserved chain block: `REQ-150..154`, `US-15001..15401`, twelve `AC-15xxx` ACs, `TS-180..184` with eleven TCs, `FBS-170..174`, `CN-520..529` (seven used, three reserved). Full mint transcript in the hardening-pass PR provenance.
+
 ## 1.0.0 (2026-09-07)
 
 ### Added
@@ -12,10 +93,10 @@ All notable changes to `platform-cloudflare-kv` are recorded here. The shape fol
 - Elicited parameters on `blueprint.json`: `kv-binding-name` (default `CACHE`), `kv-default-cache-ttl-seconds` (default `60`, floor `1`), `kv-metadata-field-pattern` (default `{v:1}`), `kv-key-naming-convention` (default `prefixed`).
 - `suggestedCompanions`: `logging` (for the event-sink boundary) and `errorHandling` (for the error record shape).
 - Extends the shared `cf-platform` sample-app fixture with the `[[kv_namespaces]]` binding block (name `CACHE`), the sole-reader KV facade module (`src/kv-facade.mjs`), the cache-aside helper (`src/cache-aside.mjs`), and the in-memory KV driver (`src/kv-driver.mjs`) that realises the Workers KV binding shape so the local probes drive without a live-KV dependency.
-- Anatomy test at `packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js` covers `TS-080..087` on the T-1 chain slice (blueprint shape, contributions cross-check, probe module contracts, fixture files, ADR bodies and clauses, guide sections and URLs, three-state probed verdicts).
+- Anatomy test at `packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js` covers `TS-080..087` on the chain slice (blueprint shape, contributions cross-check, probe module contracts, fixture files, ADR bodies and clauses, guide sections and URLs, three-state probed verdicts).
 
 ### Known limitations
 
 - The `real-account-eventual-consistency-smoke` probe records `accountBoundSkipped: true` and aggregates to `pass` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset (spec section 3.5 pass-with-skip). Full mechanism reach requires a CI environment with the paired `CF_ACCOUNT_ID`, `CF_KV_NAMESPACE_ID` and `CF_API_TOKEN` env vars.
 - The four local probes drive an in-memory KV driver whose shape matches the Workers KV binding at the facade boundary. Vendor surface changes beyond that boundary (a new list cursor format, a header-only limit) are not caught by the local probes; the real-account smoke is the mechanism-reach closure for that gap.
-- The loader's supported `when` block on `elicits[]` only accepts `requiresCapability` arrays, so the elicited `kv-metadata-field-pattern` cannot yet gate on an `elicitedNonEmpty` predicate for `kv-binding-name`. A future loader minor extending `validateElicits` would close that gap; the elicit fires unconditionally today and the guide teaches the pattern.
+- The loader's supported `when` block on `elicits[]` currently accepts only `requiresCapability` arrays, so the elicited `kv-metadata-field-pattern` fires unconditionally rather than gating on an `elicitedNonEmpty` predicate for `kv-binding-name`. The elicit fires unconditionally today and the guide teaches the pattern; a loader-capability uplift extending `validateElicits` to accept an `elicitedNonEmpty` predicate is captured as follow-up work item a loader-capability follow-up (0.26.x capability change, out of the hardening pass's 0.25.x patch scope per operator ruling 1).

package/blueprints/platform-cloudflare-kv/README.md

@@ -23,7 +23,7 @@ can render without ever writing a body byte.
   timestamp}` and nothing else. Two-layer secrecy assertion in the
   event-secrecy probe.
 - A decision-tree cross-reference in the guide to
-  `platform-cloudflare-durable-objects` (round-6 T-3) for cases that
+ `platform-cloudflare-durable-objects` for cases that
   need strong-consistency semantics.
 
 ## The five REQs
@@ -80,7 +80,7 @@ under the fixture root.
 | `cache-aside-hit-then-miss.mjs` | `AC-31105-1` | no | Wraps a spy origin function with the cache-aside helper, drives one call within TTL (hit, no origin call), advances the fake clock past TTL, drives another call (miss, second origin call). |
 | `event-secrecy.mjs` | `AC-31108-1` | no | Two-layer assertion: whitelist check on every event record and PII-substring scan on the JSON serialisation. A mutation-run under `SIMULATE_PII_LEAK` flips the probe to fail. |
 | `list-with-prefix.mjs` | `AC-31104-1` | no | Puts 10 keys under `flags/` plus one decoy outside the prefix, calls `list({prefix: flags/})`, asserts all 10 return with correct metadata shape and the decoy is absent. |
-| `real-account-eventual-consistency-smoke.mjs` | `AC-31108-1` | yes | Opens the facade against a real Cloudflare KV namespace via the Workers KV REST API, writes a fixture key, polls up to 60 seconds bounded, asserts the write eventually appears; without `CI_HAS_CLOUDFLARE_ACCOUNT` records `accountBoundSkipped: true` and aggregates `pass` per spec section 3.5. |
+| `real-account-eventual-consistency-smoke.mjs` | `AC-31108-1` | yes | Self-provisioning: the fixture shim (`packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-real-account-shim.mjs`) mints a scratch KV namespace under the throwaway prefix `h2-cf-probe-integrity-scratch-kv-`, writes a fixture key under the `h2-storage-smoke-` prefix, polls up to 60 seconds bounded for same-region visibility, deletes the key, and destroys the namespace on exit. Positive evidence captured: namespace id, exact scratch title, key, PUT / GET / DELETE status codes, elapsed ms. Idempotent prefix-sweep entry point (`sweepOrphans`) filters over the account by the frozen throwaway prefix and deletes each match by exact id and exact name; the sweep is structurally unable to select a non-prefixed name, paginates KV namespaces to completion, and is exercised by the fixture's sweep-safety test against the ten live production script names on the operator account plus a 250-per-type multi-page cover. Without `CI_HAS_CLOUDFLARE_ACCOUNT` records `accountBoundSkipped: true` and aggregates `pass` per spec section 3.5. **The local proof exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** |
 
 ## How to run the probes
 
@@ -104,8 +104,13 @@ Induced-failure switches:
   calls where one was expected and returns `aggregateVerdict: fail`.
 
 The real-account smoke needs `CI_HAS_CLOUDFLARE_ACCOUNT=true` plus
-the paired `CF_ACCOUNT_ID`, `CF_KV_NAMESPACE_ID`, `CF_API_TOKEN`
-env vars.
+the paired `CF_ACCOUNT_ID` and `CF_API_TOKEN` env vars. The fixture
+mints its own throwaway KV namespace under the throwaway prefix; no
+pre-provisioned namespace is required (the earlier `CF_KV_NAMESPACE_ID`
+gate is removed as of v1.1.0). A test
+override `CF_API_BASE_URL` points the shim at a local mock CF REST
+API for local proof; the mock and its test lives under
+`packages/rcf-lite/test/fixtures/cf-platform/test/`.
 
 ## Known mechanism-reach gaps
 
@@ -118,11 +123,14 @@ env vars.
   the aggregate flips to `pass` with `accountBoundSkipped: true` per
   spec section 3.5. Full mechanism reach requires a CI environment
   with the paired env vars set.
-- The elicited `kv-metadata-field-pattern` cannot yet gate on an
-  `elicitedNonEmpty` predicate for `kv-binding-name`; the loader's
-  `validateElicits` accepts only `requiresCapability` on the `when`
-  block. The elicit fires unconditionally and the guide teaches the
-  pattern.
+- The elicited `kv-metadata-field-pattern` fires unconditionally
+  rather than gating on an `elicitedNonEmpty` predicate for
+  `kv-binding-name`; the loader's `validateElicits` accepts only
+  `requiresCapability` on the `when` block today. The guide teaches
+  the pattern; a loader-capability uplift extending
+  `validateElicits` to accept an `elicitedNonEmpty` predicate is
+  captured as follow-up work item
+  a follow-up capability change (0.26.x) is out of scope for this 0.25.x patch.
 
 ## Companion suggestions
 
@@ -152,8 +160,26 @@ env vars.
 
 The anatomy test at
 `packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js`
-binds every AC on `US-5001..5401` (`AC-5001-1..AC-5401-1`) to a test
-case in that file with a resolvable `testPointer`. Repo-chain slice
-under `packages/rcf-lite/rcf/`: `REQ-050..054` (5), `US-5001..5401`
-(8), `TS-080..087` (8), `FBS-070` (1), `CN-230..234` (5) per the
-HQ round-6 T-1 reserved-block ruling 2026-09-07T10:12Z.
+binds every AC on the shipped kv user stories `US-31101..US-31108`
+(`AC-31101-1`, `AC-31102-1`, `AC-31103-1`, `AC-31103-2`,
+`AC-31104-1`, `AC-31105-1`, `AC-31106-1`, `AC-31107-1`,
+`AC-31108-1`) to a test case in that file with a resolvable
+`testPointer`, and to the union of the five contributed probe
+result records. The five probes carry the following anchors: the
+facade-round-trip probe holds `AC-31103-1` as primary and adds
+`AC-31101-1` (facadeReady), `AC-31103-2` (delete then kvMiss),
+`AC-31104-1` (list-with-prefix compact case) and `AC-31102-1`
+(sole-reader env.CACHE grep) as additional results; the
+list-with-prefix probe holds `AC-31104-1`; the
+cache-aside-hit-then-miss probe holds `AC-31105-1` and
+`AC-31106-1`; the event-secrecy probe holds `AC-31108-1` and
+`AC-31107-1` (whitelist scan); the real-account-eventual-
+consistency smoke re-covers `AC-31103-1` on a real Cloudflare KV
+namespace. The blueprint contribution IDs are namespaced
+`platform-cloudflare-kv-REQ-001..005` and
+`platform-cloudflare-kv-US-31101..31108` per the shelf-wide
+id-band registry. The prior chain-slice pointer
+paragraph cited a defunct earlier id band that never became chain
+rows on this repo; that citation was removed in the probe-integrity pass
+(2026-09-08 relay 582c2bca): the earlier band was not resurrected
+and every kv probe result now cites the shipped `AC-31xxx` band.

package/blueprints/platform-cloudflare-kv/blueprint.json

@@ -1,8 +1,10 @@
 {
   "slug": "platform-cloudflare-kv",
-  "version": "1.0.0",
+  "version": "1.1.3",
   "category": "platform",
-  "capabilities": ["keyValueStore"],
+  "capabilities": [
+    "keyValueStore"
+  ],
   "suggestedCompanions": [
     {
       "role": "logging",
@@ -36,27 +38,119 @@
       "id": "kv-key-naming-convention",
       "prompt": "Key naming convention: prefixed (domain prefix like users/, flags/) or flat (per ADR-3203; recommended default prefixed)",
       "kind": "enum",
-      "options": ["prefixed", "flat"],
+      "options": [
+        "prefixed",
+        "flat"
+      ],
       "default": "prefixed"
     }
   ],
   "contributions": [
-    { "id": "platform-cloudflare-kv-REQ-001", "kind": "req", "path": "requirements/platform-cloudflare-kv-req-001.json" },
-    { "id": "platform-cloudflare-kv-REQ-002", "kind": "req", "path": "requirements/platform-cloudflare-kv-req-002.json" },
-    { "id": "platform-cloudflare-kv-REQ-003", "kind": "req", "path": "requirements/platform-cloudflare-kv-req-003.json" },
-    { "id": "platform-cloudflare-kv-REQ-004", "kind": "req", "path": "requirements/platform-cloudflare-kv-req-004.json" },
-    { "id": "platform-cloudflare-kv-REQ-005", "kind": "req", "path": "requirements/platform-cloudflare-kv-req-005.json" },
-    { "id": "platform-cloudflare-kv-US-31101", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31101.json" },
-    { "id": "platform-cloudflare-kv-US-31102", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31102.json" },
-    { "id": "platform-cloudflare-kv-US-31103", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31103.json" },
-    { "id": "platform-cloudflare-kv-US-31104", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31104.json" },
-    { "id": "platform-cloudflare-kv-US-31105", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31105.json" },
-    { "id": "platform-cloudflare-kv-US-31106", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31106.json" },
-    { "id": "platform-cloudflare-kv-US-31107", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31107.json" },
-    { "id": "platform-cloudflare-kv-US-31108", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31108.json" },
-    { "id": "TAC-3201-platform-cloudflare-kv-facade", "kind": "tac", "path": "tacs/tac-3201-platform-cloudflare-kv-facade.json" },
-    { "id": "TAC-3202-platform-cloudflare-kv-cache-aside", "kind": "tac", "path": "tacs/tac-3202-platform-cloudflare-kv-cache-aside.json" },
-    { "id": "TAC-3203-platform-cloudflare-kv-event-sink", "kind": "tac", "path": "tacs/tac-3203-platform-cloudflare-kv-event-sink.json" },
+    {
+      "id": "platform-cloudflare-kv-REQ-001",
+      "kind": "req",
+      "path": "requirements/platform-cloudflare-kv-req-001.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-REQ-002",
+      "kind": "req",
+      "path": "requirements/platform-cloudflare-kv-req-002.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-REQ-003",
+      "kind": "req",
+      "path": "requirements/platform-cloudflare-kv-req-003.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-REQ-004",
+      "kind": "req",
+      "path": "requirements/platform-cloudflare-kv-req-004.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-REQ-005",
+      "kind": "req",
+      "path": "requirements/platform-cloudflare-kv-req-005.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-REQ-006",
+      "kind": "req",
+      "path": "requirements/platform-cloudflare-kv-req-006.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-REQ-007",
+      "kind": "req",
+      "path": "requirements/platform-cloudflare-kv-req-007.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31101",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31101.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31102",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31102.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31103",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31103.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31104",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31104.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31105",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31105.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31106",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31106.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31107",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31107.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31108",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31108.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31109",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31109.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31110",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31110.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31111",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31111.json"
+    },
+    {
+      "id": "TAC-3201-platform-cloudflare-kv-facade",
+      "kind": "tac",
+      "path": "tacs/tac-3201-platform-cloudflare-kv-facade.json"
+    },
+    {
+      "id": "TAC-3202-platform-cloudflare-kv-cache-aside",
+      "kind": "tac",
+      "path": "tacs/tac-3202-platform-cloudflare-kv-cache-aside.json"
+    },
+    {
+      "id": "TAC-3203-platform-cloudflare-kv-event-sink",
+      "kind": "tac",
+      "path": "tacs/tac-3203-platform-cloudflare-kv-event-sink.json"
+    },
     {
       "id": "ADR-3201-platform-cloudflare-kv-key-value-store-contract",
       "kind": "adr",
@@ -83,5 +177,6 @@
       "elicited": true,
       "standardsTraceClause": "generic enterprise practice"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-10T00:00:00.000Z"
 }

package/blueprints/platform-cloudflare-kv/contributions/adrs/adr-3201-platform-cloudflare-kv-key-value-store-contract.json

@@ -5,10 +5,10 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Key-value store contract: Cloudflare Workers KV as the shipped shape (scope global, new topic keyValueStoreContract)",
-  "context": "An applying Workers project has one native key-value store answer today: Cloudflare Workers KV. The binding is declared through wrangler configuration ([[kv_namespaces]] with binding, id and preview_id) and the shipped runtime binds env.<binding> to an object with get, getWithMetadata, put, delete and list per https://developers.cloudflare.com/kv/api/. KV is eventually consistent: a write may not appear on a global read within the same request, and changes may take up to 60 seconds or more to be visible in other network locations as their cached versions time out (https://developers.cloudflare.com/kv/concepts/how-kv-works/). The v1.0.0 facade must hold the adapter reference opaque at the facade boundary so a future non-Cloudflare adapter or an in-memory adapter for tests slots in without a facade re-shape, and so the round-6 Durable Objects sibling (T-3) is the shipped answer for strong-consistency needs.",
+  "context": "An applying Workers project has one native key-value store answer today: Cloudflare Workers KV. The binding is declared through wrangler configuration ([[kv_namespaces]] with binding, id and preview_id) and the shipped runtime binds env.<binding> to an object with get, getWithMetadata, put, delete and list per https://developers.cloudflare.com/kv/api/. KV is eventually consistent: a write may not appear on a global read within the same request, and changes may take up to 60 seconds or more to be visible in other network locations as their cached versions time out (https://developers.cloudflare.com/kv/concepts/how-kv-works/). The v1.0.0 facade must hold the adapter reference opaque at the facade boundary so a future non-Cloudflare adapter or an in-memory adapter for tests slots in without a facade re-shape, and so the Durable Objects sibling is the shipped answer for strong-consistency needs.",
   "decision": "The shipped v1.0.0 default is Cloudflare Workers KV, wired through wrangler config ([[kv_namespaces]] with binding, id and preview_id) per https://developers.cloudflare.com/kv/. The facade module (TAC-3201) is the sole holder of the KV binding reference per REQ-001. The keyValueStoreContract topic scope is global on this blueprint; the topic string is keyValueStoreContract (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). A future non-KV adapter (a Redis-shape store, a strong-consistency DO cell for a single-owner use case) would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR per the round-2 conflict pattern.",
-  "consequences": "The applying project inherits Workers KV wire-format, the platform-assigned per-namespace limits (https://developers.cloudflare.com/kv/platform/limits/) and the documented eventual-consistency semantics. Standards trace clause: Cloudflare Workers KV documented consistency model (per https://developers.cloudflare.com/kv/concepts/how-kv-works/). Consumer code needing strong-consistency semantics reaches for the round-6 T-3 platform-cloudflare-durable-objects sibling instead; the guide carries the decision-tree cross-reference.",
+  "consequences": "The applying project inherits Workers KV wire-format, the platform-assigned per-namespace limits (https://developers.cloudflare.com/kv/platform/limits/) and the documented eventual-consistency semantics. Standards trace clause: Cloudflare Workers KV documented consistency model (per https://developers.cloudflare.com/kv/concepts/how-kv-works/). Consumer code needing strong-consistency semantics reaches for the platform-cloudflare-durable-objects sibling instead; the guide carries the decision-tree cross-reference.",
   "alternativesConsidered": [],
   "createdAt": "2026-09-07T10:28:32.000Z",
-  "updatedAt": "2026-09-07T10:28:32.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z"
 }