rcf-lite 0.26.0 → 0.27.0

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13103.json

@@ -16,7 +16,12 @@
       "when": "the deploy job's step list is inspected for each environment",
       "then": "the migrations-apply step appears before the deploy step in that job, and any parallelism configuration is such that the deploy cannot start until the apply has exited zero",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/d1/reference/migrations/",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-13103-2",
@@ -25,7 +30,8 @@
       "when": "the pipeline runs",
       "then": "the migrations-apply step exits non-zero, the deploy step does not execute, the deploy job is reported as failed, and no new Worker version has been published to the target environment",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13103-3",
@@ -34,7 +40,8 @@
       "when": "the store event log for that CI run is inspected",
       "then": "the log contains exactly one migrationsApplied event whose metadata fields match the run and whose payload contains no value read from a domain table",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -42,5 +49,5 @@
     "TAC-1402-persistence-data-d1-migration-catalog"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13104.json

@@ -6,17 +6,18 @@
   "status": "approved",
   "title": "Every facade query is a parameterised prepared statement",
   "asA": "developer who needs the persistence boundary to leave no SQL-injection surface for consumer arguments",
-  "iWant": "every facade query to be a static SQL literal issued via `db.prepare(...).bind(...)`, with no string-concatenated SQL and no `exec(<consumer string>)` on any path",
+  "iWant": "every facade query to go through the prepared-statement discipline owned on TAC-1401-persistence-data-d1-facade.responsibilities[2] (no string-concatenated SQL and no non-literal `exec` on any path)",
   "soThat": "consumer arguments never traverse the SQL parser and the vendor's parameter-binding layer is the only place values reach the engine",
   "acceptanceCriteria": [
     {
       "id": "AC-13104-1",
-      "description": "Every call site in the facade module that reaches the D1 binding is a `db.prepare(<static SQL literal>).bind(...)` chain terminating in `.first()`, `.all()`, `.run()`, or `.raw()`. No call site inside the facade calls `db.exec(...)` with any string other than a static SQL literal authored inside the facade module.",
+      "description": "Every call site in the facade module that reaches the D1 binding matches the prepared-statement chain owned on TAC-1401-persistence-data-d1-facade.responsibilities[2]; no call site invokes the raw `exec` surface, which is refused on the facade's exposed handle per ADR-1404-persistence-data-d1-store-boundary.",
       "given": "the facade module source",
       "when": "every call to the D1 binding is inspected for its SQL argument shape",
       "then": "every `prepare` argument is a static string literal (not a template with an interpolation for a value, not a `+`-concatenation with any consumer argument, not a function-returned string) and no `exec` call takes a non-literal string; a targeted grep for `\\.exec(`, `\\.prepare(` template-literal interpolations, and `\\+` inside prepared-statement arguments returns only the known-safe literal-static occurrences the facade documents",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13104-2",
@@ -25,7 +26,8 @@
       "when": "the surface is inspected",
       "then": "no exported function's typed parameter list includes a SQL-string parameter (a parameter named `sql`, `query`, `statement`, or typed as an arbitrary string that reaches `db.prepare` or `db.exec` inside the facade body); the boundary refuses raw-query passthrough by construction",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-13104-3",
@@ -34,12 +36,17 @@
       "when": "the verb is invoked with the probe value against a local D1 database",
       "then": "the invocation completes without side-effect against tables other than the one the verb legitimately touches, and a follow-up `SELECT COUNT(*) FROM domainTable` returns the same count as before the invocation (no DROP), and the probe value round-trips as an ordinary string wherever the verb persisted or returned it",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/d1/worker-api/prepared-statements/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-1401-persistence-data-d1-facade"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13105.json

@@ -16,7 +16,8 @@
       "when": "every verb whose responsibility involves writing to two or more rows across two or more statements is inspected",
       "then": "each such verb issues its statements as one `db.batch([...])` call whose array contains every statement the atomicity claim covers, and no such verb chains sequential independent facade calls to fake atomicity",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-13105-2",
@@ -25,7 +26,12 @@
       "when": "the verb is invoked and the batch fails",
       "then": "the caller receives an error, and a follow-up read against table A shows no row corresponding to the first statement of the failed batch (D1 rolled the batch back)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/d1/worker-api/d1-database/#batch",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-13105-3",
@@ -34,12 +40,13 @@
       "when": "the surface is inspected for begin/commit primitives, transaction-block wrappers, or documentation promising cross-call atomicity",
       "then": "no such surface exists on the facade, and every atomicity claim in facade documentation is scoped to a single verb whose implementation uses `db.batch([...])`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-1401-persistence-data-d1-facade"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13106.json

@@ -16,7 +16,8 @@
       "when": "the operator invokes `wrangler d1 time-travel restore <database> --timestamp=<pre-drop-timestamp>` and a fresh Worker request reads through the facade",
       "then": "the facade reads return the pre-drop row set, the destructive write is not present, and the store event log records exactly one `timeTravelRestored` event whose fields carry the target database identifier, the restore timestamp or bookmark, and the ISO-8601 completion timestamp",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13106-2",
@@ -25,7 +26,8 @@
       "when": "the export step runs against the source database, and the artifact is loaded into a fresh D1 database via `wrangler d1 execute --file <artifact-path>` (with any BEGIN TRANSACTION or COMMIT statements stripped per the vendor's import guidance) and a fresh Worker request reads through the facade",
       "then": "the artifact file exists at the requested path, the fresh database reports the same schema shape and row count for every domain table as the source at export completion, and the store event log records one `backupExported` event whose fields carry the source database identifier, the artifact path, and the ISO-8601 completion timestamp",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13106-3",
@@ -34,7 +36,8 @@
       "when": "the source tree the Worker deploys from is inspected for diff against the deployed build",
       "then": "no Worker source change is required to invoke either recovery path (the recovery runner is a project-side ops surface, not a facade verb), and both invocations produced their event log entry without a Worker redeploy",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -42,5 +45,5 @@
     "TAC-1401-persistence-data-d1-facade"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13107.json

@@ -16,7 +16,8 @@
       "when": "every event record captured on the sink is inspected",
       "then": "every field on every record matches one of the metadata field types listed above, and no field's value equals a value read from any domain table",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13107-2",
@@ -25,7 +26,26 @@
       "when": "the grep is executed",
       "then": "matches appear only inside CRUD verb bodies (facade) or inside statements the recovery runner or deploy gate does not read for event-record construction, and never inside onEvent call arguments or event-record construction sites",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1401-persistence-data-d1-facade",
+        "field": "interfaces.onEvent"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-13107-3",
+      "description": "Repeat-emission secrecy under maximum event volume. Given the facade exercised through a load run that fires facadeReady, migrationsApplied, backupExported, timeTravelRestored and queryFailed events N times, when the event stream is inspected, then every one of the N event records carries only the metadata field types on AC-13107-1 and no run of N leaks a domain-row value; a mutation SIMULATE_DOMAIN_ROW_IN_EVENT=true injects a domain value into one event and the sink observer FAILS the run.",
+      "given": "the facade run under load that fires each of the five lifecycle events N times",
+      "when": "the event stream is inspected across the whole run",
+      "then": "every one of the N records carries only the metadata field types on AC-13107-1; the injection mutation FAILS",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1401-persistence-data-d1-facade",
+        "field": "interfaces.onEvent"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -34,5 +54,5 @@
     "TAC-1403-persistence-data-d1-deploy-gate"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-postgres/CHANGELOG.md

@@ -1,12 +1,28 @@
+# Changelog
+
+## 1.1.2 - 2026-09-10
+
+Dimension-d single-definition-ownership cleanup on REQ-004: REQ description now references the transaction-helper interface owned on TAC-2803.interfaces.withTransaction rather than restating the driver control literals for begin, commit and rollback. Chain-consistency lint zero on pass 1 and pass 2.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+Adds the elicits block (connection-url, migrations-directory, migration-runner-tool, runner-mode, pool-size, idle-timeout-ms, connection-timeout-ms, recovery-destination, recovery-cadence, pitr-provider, advisory-lock-helper) that the REQs and guide were already describing in prose; each option is named in the description of the must-priority REQ that governs its runtime clause. Adds a runtime clause naming the relationalStore applied capability on REQ-001. Adds deliveredBy on REQ-003, REQ-005 and REQ-007. Adds ownerRef on AC-27104-1 (withTransaction). Adds disposition to every AC.
+
 # persistence-data-postgres changelog
 
 ## 1.0.0 - 2026-09-06
 
-Initial release. Contract for Postgres as the project's primary durable relational store on a server-tier deployment (Node process, container, non-Workers serverless), accessed through a store facade module that is the sole reader of the `pg` client. Landed via the infra round 5 spec (ratified 2026-09-06) as track T-1.
+Initial release. Contract for Postgres as the project's primary durable relational store on a server-tier deployment (Node process, container, non-Workers serverless), accessed through a store facade module that is the sole reader of the `pg` client. Landed via the infra round 5 spec (ratified 2026-09-06).
 
 - 26 contributions: 7 REQs on facade / migrations / prepared statements / transactions / recovery / pool posture / advisory-lock helper; 10 USs at 27101-27110; 4 TACs (2801 facade, 2802 migration runner, 2803 transaction helper, 2804 recovery runner); 5 ADRs (2801 driver with scope global on `persistenceStore`, 2802 migration shape with scope global on `migrationDiscipline`, 2803 runner mode, 2804 recovery, 2805 connection-pool posture).
-- Six Node-only probes under `contributions/probes/` proven against a live `postgres:17-alpine` container: `facade-round-trip`, `migration-apply`, `prepared-statement-scan`, `transaction-atomicity`, `recovery-restore-round-trip`, `pool-posture-smoke`. None account-bound; Postgres is local-first per Baz decision 8.
+- Six Node-only probes under `contributions/probes/` proven against a live `postgres:17-alpine` container: `facade-round-trip`, `migration-apply`, `prepared-statement-scan`, `transaction-atomicity`, `recovery-restore-round-trip`, `pool-posture-smoke`. None account-bound; Postgres is local-first per maintainer decision.
 - Sample-app fixture at `packages/rcf-lite/test/fixtures/infra-postgres/` boots `postgres:17-alpine` via docker compose, applies three toy forward-only `.sql` migrations, exposes the facade over `pg`, and hosts `SIMULATE_MIGRATION_FAILURE` and `SIMULATE_CONSTRAINT_VIOLATION` switches for the negative-run probe paths.
 - Declares `capabilities: ["relationalStore"]`, `suggestedCompanions: [{role: "logging"}, {role: "errorHandling"}]`, `providesRoles` absent, `requiresAppliedCapabilities` absent.
 - Reserves the round-6 Hyperdrive v1.1.0 adapter slot at ADR-2801 by keeping the driver reference opaque at the facade boundary.
 - Advisory-lock helper (REQ-007) ships in v1.0.0 as elicited with default `off` per the ratified Q1 answer on infra round 5 spec section 10.
+
+Review-fix (2026-09-09): Adds eleven option-binding ACs to close section 7c on the elicits catalogue - migration-runner-tool (AC-27102-4/5/6/7), runner-mode (AC-27102-8/9), recovery-cadence (AC-27105-3/4/5), pitr-provider (AC-27110-3/4). Adds deliveredBy on REQ-001, REQ-002, REQ-004 (three of seven mandatory REQs).

package/blueprints/persistence-data-postgres/README.md

@@ -63,7 +63,7 @@ Each probe is a Node module under `contributions/probes/` exporting the round-5
 | `recovery-restore-round-trip` | AC-27105-1 | `pg_dump` artefact primes a fresh Postgres; row-count and checksum equality |
 | `pool-posture-smoke` | AC-27106-1 | Two facades at pool size 5 handle twenty concurrent queries with no timeout |
 
-None of the six probes carries `accountBound: true`; Postgres is local-first per infra round 5 spec Baz decision 8.
+None of the six probes carries `accountBound: true`; Postgres is local-first per infra round 5 spec maintainer decision.
 
 ## How to run the probes locally
 

package/blueprints/persistence-data-postgres/blueprint.json

@@ -1,8 +1,10 @@
 {
   "slug": "persistence-data-postgres",
-  "version": "1.0.0",
+  "version": "1.1.2",
   "category": "persistence",
-  "capabilities": ["relationalStore"],
+  "capabilities": [
+    "relationalStore"
+  ],
   "suggestedCompanions": [
     {
       "role": "logging",
@@ -14,27 +16,111 @@
     }
   ],
   "contributions": [
-    { "id": "persistence-data-postgres-REQ-001", "kind": "req", "path": "requirements/persistence-data-postgres-req-001.json" },
-    { "id": "persistence-data-postgres-REQ-002", "kind": "req", "path": "requirements/persistence-data-postgres-req-002.json" },
-    { "id": "persistence-data-postgres-REQ-003", "kind": "req", "path": "requirements/persistence-data-postgres-req-003.json" },
-    { "id": "persistence-data-postgres-REQ-004", "kind": "req", "path": "requirements/persistence-data-postgres-req-004.json" },
-    { "id": "persistence-data-postgres-REQ-005", "kind": "req", "path": "requirements/persistence-data-postgres-req-005.json" },
-    { "id": "persistence-data-postgres-REQ-006", "kind": "req", "path": "requirements/persistence-data-postgres-req-006.json" },
-    { "id": "persistence-data-postgres-REQ-007", "kind": "req", "path": "requirements/persistence-data-postgres-req-007.json" },
-    { "id": "persistence-data-postgres-US-27101", "kind": "us", "path": "user-stories/persistence-data-postgres-us-27101.json" },
-    { "id": "persistence-data-postgres-US-27102", "kind": "us", "path": "user-stories/persistence-data-postgres-us-27102.json" },
-    { "id": "persistence-data-postgres-US-27103", "kind": "us", "path": "user-stories/persistence-data-postgres-us-27103.json" },
-    { "id": "persistence-data-postgres-US-27104", "kind": "us", "path": "user-stories/persistence-data-postgres-us-27104.json" },
-    { "id": "persistence-data-postgres-US-27105", "kind": "us", "path": "user-stories/persistence-data-postgres-us-27105.json" },
-    { "id": "persistence-data-postgres-US-27106", "kind": "us", "path": "user-stories/persistence-data-postgres-us-27106.json" },
-    { "id": "persistence-data-postgres-US-27107", "kind": "us", "path": "user-stories/persistence-data-postgres-us-27107.json" },
-    { "id": "persistence-data-postgres-US-27108", "kind": "us", "path": "user-stories/persistence-data-postgres-us-27108.json" },
-    { "id": "persistence-data-postgres-US-27109", "kind": "us", "path": "user-stories/persistence-data-postgres-us-27109.json" },
-    { "id": "persistence-data-postgres-US-27110", "kind": "us", "path": "user-stories/persistence-data-postgres-us-27110.json" },
-    { "id": "TAC-2801-persistence-data-postgres-facade", "kind": "tac", "path": "tacs/tac-2801-persistence-data-postgres-facade.json" },
-    { "id": "TAC-2802-persistence-data-postgres-migration-runner", "kind": "tac", "path": "tacs/tac-2802-persistence-data-postgres-migration-runner.json" },
-    { "id": "TAC-2803-persistence-data-postgres-transaction-helper", "kind": "tac", "path": "tacs/tac-2803-persistence-data-postgres-transaction-helper.json" },
-    { "id": "TAC-2804-persistence-data-postgres-recovery-runner", "kind": "tac", "path": "tacs/tac-2804-persistence-data-postgres-recovery-runner.json" },
+    {
+      "id": "persistence-data-postgres-REQ-001",
+      "kind": "req",
+      "path": "requirements/persistence-data-postgres-req-001.json"
+    },
+    {
+      "id": "persistence-data-postgres-REQ-002",
+      "kind": "req",
+      "path": "requirements/persistence-data-postgres-req-002.json"
+    },
+    {
+      "id": "persistence-data-postgres-REQ-003",
+      "kind": "req",
+      "path": "requirements/persistence-data-postgres-req-003.json"
+    },
+    {
+      "id": "persistence-data-postgres-REQ-004",
+      "kind": "req",
+      "path": "requirements/persistence-data-postgres-req-004.json"
+    },
+    {
+      "id": "persistence-data-postgres-REQ-005",
+      "kind": "req",
+      "path": "requirements/persistence-data-postgres-req-005.json"
+    },
+    {
+      "id": "persistence-data-postgres-REQ-006",
+      "kind": "req",
+      "path": "requirements/persistence-data-postgres-req-006.json"
+    },
+    {
+      "id": "persistence-data-postgres-REQ-007",
+      "kind": "req",
+      "path": "requirements/persistence-data-postgres-req-007.json"
+    },
+    {
+      "id": "persistence-data-postgres-US-27101",
+      "kind": "us",
+      "path": "user-stories/persistence-data-postgres-us-27101.json"
+    },
+    {
+      "id": "persistence-data-postgres-US-27102",
+      "kind": "us",
+      "path": "user-stories/persistence-data-postgres-us-27102.json"
+    },
+    {
+      "id": "persistence-data-postgres-US-27103",
+      "kind": "us",
+      "path": "user-stories/persistence-data-postgres-us-27103.json"
+    },
+    {
+      "id": "persistence-data-postgres-US-27104",
+      "kind": "us",
+      "path": "user-stories/persistence-data-postgres-us-27104.json"
+    },
+    {
+      "id": "persistence-data-postgres-US-27105",
+      "kind": "us",
+      "path": "user-stories/persistence-data-postgres-us-27105.json"
+    },
+    {
+      "id": "persistence-data-postgres-US-27106",
+      "kind": "us",
+      "path": "user-stories/persistence-data-postgres-us-27106.json"
+    },
+    {
+      "id": "persistence-data-postgres-US-27107",
+      "kind": "us",
+      "path": "user-stories/persistence-data-postgres-us-27107.json"
+    },
+    {
+      "id": "persistence-data-postgres-US-27108",
+      "kind": "us",
+      "path": "user-stories/persistence-data-postgres-us-27108.json"
+    },
+    {
+      "id": "persistence-data-postgres-US-27109",
+      "kind": "us",
+      "path": "user-stories/persistence-data-postgres-us-27109.json"
+    },
+    {
+      "id": "persistence-data-postgres-US-27110",
+      "kind": "us",
+      "path": "user-stories/persistence-data-postgres-us-27110.json"
+    },
+    {
+      "id": "TAC-2801-persistence-data-postgres-facade",
+      "kind": "tac",
+      "path": "tacs/tac-2801-persistence-data-postgres-facade.json"
+    },
+    {
+      "id": "TAC-2802-persistence-data-postgres-migration-runner",
+      "kind": "tac",
+      "path": "tacs/tac-2802-persistence-data-postgres-migration-runner.json"
+    },
+    {
+      "id": "TAC-2803-persistence-data-postgres-transaction-helper",
+      "kind": "tac",
+      "path": "tacs/tac-2803-persistence-data-postgres-transaction-helper.json"
+    },
+    {
+      "id": "TAC-2804-persistence-data-postgres-recovery-runner",
+      "kind": "tac",
+      "path": "tacs/tac-2804-persistence-data-postgres-recovery-runner.json"
+    },
     {
       "id": "ADR-2801-persistence-data-postgres-driver",
       "kind": "adr",
@@ -76,5 +162,97 @@
       "elicited": true,
       "standardsTraceClause": "generic enterprise practice"
     }
+  ],
+  "elicits": [
+    {
+      "id": "connection-url",
+      "prompt": "Connection URL for the pg client (project-config value; a security-secrets-management-applied project passes a secretRef instead of the literal URL). The facade dereferences this at boot and holds no other reference to it.",
+      "kind": "string",
+      "default": "postgres://localhost:5432/app"
+    },
+    {
+      "id": "migrations-directory",
+      "prompt": "Migrations directory: numbered forward-only .sql files, one file one transaction. Default db/migrations under the applying project root.",
+      "kind": "string",
+      "default": "db/migrations"
+    },
+    {
+      "id": "migration-runner-tool",
+      "prompt": "Migration runner tool per ADR-2802. node-pg-migrate wraps the pg driver; sqitch is a standalone Perl runner; flyway is the JVM-based runner; custom is a bespoke Node runner over pg. The discipline (numbered forward-only, one file one transaction) is fixed; the tool is elicited.",
+      "kind": "enum",
+      "options": [
+        "node-pg-migrate",
+        "sqitch",
+        "flyway",
+        "custom"
+      ],
+      "default": "node-pg-migrate"
+    },
+    {
+      "id": "runner-mode",
+      "prompt": "Migration runner mode per ADR-2803. atBoot runs migrations on process boot before the facade opens (right for a long-lived Node target). ciStep runs migrations as a discrete CI step before the deploy (right for Workers-adjacent or container-scheduled targets where the runtime lifecycle is not the migration lifecycle).",
+      "kind": "enum",
+      "options": [
+        "atBoot",
+        "ciStep"
+      ],
+      "default": "atBoot"
+    },
+    {
+      "id": "pool-size",
+      "prompt": "Connection pool size per node-postgres defaults. The shipped default is 10 on Node targets; a container target with a short-lived request scope may use a lower value.",
+      "kind": "string",
+      "default": "10"
+    },
+    {
+      "id": "idle-timeout-ms",
+      "prompt": "Idle-timeout milliseconds per node-postgres. Default 30000. A container target may set 0 to disable idle culling and rely on the request-scoped pool.",
+      "kind": "string",
+      "default": "30000"
+    },
+    {
+      "id": "connection-timeout-ms",
+      "prompt": "Connection-timeout milliseconds per node-postgres. Default 5000. The facade refuses to boot when the timeout expires without a successful ready-check.",
+      "kind": "string",
+      "default": "5000"
+    },
+    {
+      "id": "recovery-destination",
+      "prompt": "Destination path for the scheduled pg_dump artefact. A filesystem path, an S3 URL, or an operator-owned path. The recovery runner writes here and emits backupExported carrying the artefact path.",
+      "kind": "string",
+      "default": "backups/pg"
+    },
+    {
+      "id": "recovery-cadence",
+      "prompt": "Cadence for the scheduled pg_dump artefact. daily is the shipped default; hourly and weekly are alternatives per ADR-2804. off is not legal at v1.0.0 because the two-path recovery model requires the export path.",
+      "kind": "enum",
+      "options": [
+        "daily",
+        "hourly",
+        "weekly"
+      ],
+      "default": "daily"
+    },
+    {
+      "id": "pitr-provider",
+      "prompt": "Vendor point-in-time recovery provider. hosted (RDS, Cloud SQL, Neon, Supabase, etc., where the vendor exposes PITR) or self-managed (WAL archiving to a durable object store, restored via pg_basebackup). Both paths are required at v1.0.0.",
+      "kind": "enum",
+      "options": [
+        "hosted",
+        "self-managed"
+      ],
+      "default": "hosted"
+    },
+    {
+      "id": "advisory-lock-helper",
+      "prompt": "Advisory-lock helper mode per Postgres explicit-locking reference. off omits the helper entirely (Q1 ratified default). session takes pg_advisory_lock at session scope; transaction takes pg_advisory_xact_lock at transaction scope.",
+      "kind": "enum",
+      "options": [
+        "off",
+        "session",
+        "transaction"
+      ],
+      "default": "off"
+    }
   ]
 }

package/blueprints/persistence-data-postgres/contributions/adrs/adr-2801-persistence-data-postgres-driver.json

@@ -22,7 +22,7 @@
     {
       "name": "Hyperdrive as the shipped v1.0.0 driver",
       "summary": "Ship Hyperdrive-wrapped pg as the v1.0.0 default.",
-      "reasonNotChosen": "Hyperdrive is a Cloudflare-account-bound service and the round-5 spec ruling 5 (Baz decision 8) places Postgres as the local-first blueprint. Making Hyperdrive the default would force every project to bind to a Cloudflare account before applying the blueprint. Round 6 lands Hyperdrive as a v1.1.0 minor adapter behind an elicit, keeping local-first at v1.0.0."
+      "reasonNotChosen": "Hyperdrive is a Cloudflare-account-bound service and the round-5 spec ruling 5 (maintainer decision) places Postgres as the local-first blueprint. Making Hyperdrive the default would force every project to bind to a Cloudflare account before applying the blueprint. Round 6 lands Hyperdrive as a v1.1.0 minor adapter behind an elicit, keeping local-first at v1.0.0."
     }
   ],
   "createdAt": "2026-09-06T15:47:00.000Z",

package/blueprints/persistence-data-postgres/contributions/adrs/adr-2805-persistence-data-postgres-connection-pool-posture.json

@@ -17,7 +17,7 @@
     {
       "name": "Delegate every pool to Hyperdrive from v1.0.0",
       "summary": "Ship Hyperdrive as the pool manager for every target.",
-      "reasonNotChosen": "Hyperdrive is a Cloudflare-account-bound service; forcing every project to bind to Cloudflare before applying the blueprint conflicts with the local-first posture (round-5 spec ruling 5, Baz decision 8). Round 6 lands Hyperdrive as an elicit for the operator who wants it."
+      "reasonNotChosen": "Hyperdrive is a Cloudflare-account-bound service; forcing every project to bind to Cloudflare before applying the blueprint conflicts with the local-first posture (round-5 spec ruling 5, maintainer decision). Round 6 lands Hyperdrive as an elicit for the operator who wants it."
     }
   ],
   "createdAt": "2026-09-06T15:47:00.000Z",

package/blueprints/persistence-data-postgres/contributions/requirements/persistence-data-postgres-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "persistence-data-postgres-REQ-001",
   "prdId": "PRD-001",
   "title": "One facade module is the sole reader of the pg client and opens on boot",
-  "description": "The application accesses Postgres through a single facade module in the project's source tree that is the ONLY module in the tree that imports and reads the pg (node-postgres) client. Every other module that touches persistence imports the facade and calls its named domain verbs; no other module holds the raw pg client, a pg.Pool reference, or a pg.PoolClient reference. On process boot, the facade opens a pg.Pool against the elicited connection URL and, once the first successful ready-check completes, emits a facadeReady lifecycle event carrying the database name. The connection URL is elicited (project-config file by default; a security-secrets-management-applied project passes a secretRef).",
+  "description": "The application accesses Postgres through a single facade module in the project's source tree that is the ONLY module in the tree that imports and reads the pg (node-postgres) client. Every other module that touches persistence imports the facade and calls its named domain verbs; no other module holds the raw pg client, a pg.Pool reference, or a pg.PoolClient reference. On process boot, the facade opens a pg.Pool against the elicited connection URL and, once the first successful ready-check completes, emits a facadeReady lifecycle event carrying the database name. The connection URL is elicited (project-config file by default; a security-secrets-management-applied project passes a secretRef). This blueprint declares the relationalStore applied capability against a project through this facade: any downstream blueprint whose requiresAppliedCapabilities lists relationalStore is satisfied by an applied persistence-data-postgres pinning the facade module to its Pool client and the elicited connection URL.",
   "category": "functional",
   "domain": "persistence",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T15:47:00.000Z",
-  "updatedAt": "2026-09-06T15:47:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2801-persistence-data-postgres-facade",
+    "field": "responsibilities.facadeReady"
+  }
 }

package/blueprints/persistence-data-postgres/contributions/requirements/persistence-data-postgres-req-002.json

@@ -2,7 +2,7 @@
   "reqId": "persistence-data-postgres-REQ-002",
   "prdId": "PRD-001",
   "title": "Schema evolution ships as numbered forward-only .sql migrations applied one file one transaction",
-  "description": "Schema evolution is expressed as a directory of numbered .sql migration files under the elicited migrations directory (default ./migrations/). Each filename begins with a monotonically increasing integer that is unique across the directory; the file body is engine-native SQL. An in-tree migration runner applies each file inside its own transaction (BEGIN, run the file body, COMMIT on success or ROLLBACK on error); the runner tracks applied filenames in a schema_version bookkeeping table it maintains inside the same database. There are no down migrations. Which runner tool the project reaches for is elicited (a node-pg-migrate wrap, a sqitch invocation, a flyway process, or a bespoke Node runner over pg); the discipline is what is fixed here, not the tool.",
+  "description": "Schema evolution is expressed as a directory of numbered .sql migration files under the elicited migrations directory (default ./migrations/). Each filename begins with a monotonically increasing integer that is unique across the directory; the file body is engine-native SQL. An in-tree migration runner applies each file inside its own transaction (BEGIN, run the file body, COMMIT on success or ROLLBACK on error); the runner tracks applied filenames in a schema_version bookkeeping table it maintains inside the same database. There are no down migrations. Which runner tool the project reaches for is elicited (a node-pg-migrate wrap, a sqitch invocation, a flyway process, or a bespoke Node runner over pg); the discipline is what is fixed here, not the tool. The migration-runner-tool is elicited between node-pg-migrate, sqitch, flyway and a custom Node runner; the discipline (numbered forward-only, one file one transaction) is fixed, the tool is not.",
   "category": "technical",
   "domain": "persistence",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T15:47:00.000Z",
-  "updatedAt": "2026-09-06T15:47:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2802-persistence-data-postgres-migration-runner",
+    "field": "responsibilities.migrations"
+  }
 }

package/blueprints/persistence-data-postgres/contributions/requirements/persistence-data-postgres-req-003.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T15:47:00.000Z",
-  "updatedAt": "2026-09-06T15:47:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2801-persistence-data-postgres-facade",
+    "field": "responsibilities.parameter"
+  }
 }

package/blueprints/persistence-data-postgres/contributions/requirements/persistence-data-postgres-req-004.json

@@ -2,7 +2,7 @@
   "reqId": "persistence-data-postgres-REQ-004",
   "prdId": "PRD-001",
   "title": "Transactional atomicity: multi-statement writes through a transaction helper roll back on any error",
-  "description": "Multi-statement writes that require atomicity are issued through the facade's transaction helper, which wraps client.query('BEGIN') around a callback, awaits the callback's statements (each issued through pg.query with the prepared-statement discipline in REQ-003), and issues client.query('COMMIT') on the callback's successful completion. If any statement inside the callback throws (including a constraint violation the driver surfaces as an error), the helper issues client.query('ROLLBACK'), releases the client back to the pool, and emits a transactionRolledBack lifecycle event carrying the failing statement's zero-based index inside the callback. The helper does not swallow the underlying error; it re-throws after the rollback so the caller observes the failure and the facade's own error boundary constructs the internal error record.",
+  "description": "Multi-statement writes that require atomicity are issued through the facade's transaction helper owned on TAC-2803-persistence-data-postgres-transaction-helper.interfaces.withTransaction. The helper wraps the transaction-control primitives named there around a consumer callback, awaits the callback's statements (each issued through the prepared-statement discipline in REQ-003), commits on the callback's successful completion, and rolls back with a transactionRolledBack lifecycle event on any statement failure inside the callback (including a constraint violation the driver surfaces as an error). The lifecycle event carries the failing statement's zero-based index inside the callback. The helper does not swallow the underlying error; it re-throws after the rollback so the caller observes the failure and the facade's own error boundary constructs the internal error record.",
   "category": "functional",
   "domain": "persistence",
   "priority": "must",
@@ -11,8 +11,12 @@
     "blueprint:persistence-data-postgres",
     "category:04-transaction-helper"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-06T15:47:00.000Z",
-  "updatedAt": "2026-09-06T15:47:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2803-persistence-data-postgres-transaction-helper",
+    "field": "responsibilities.transactionAtomicity"
+  }
 }