rcf-lite 0.26.0 → 0.28.0

package/blueprints/persistence-data-d1/contributions/requirements/persistence-data-d1-req-004.json

@@ -2,7 +2,7 @@
   "reqId": "persistence-data-d1-REQ-004",
   "prdId": "PRD-001",
   "title": "Every statement the facade issues against D1 is a parameterised prepared statement; no consumer-supplied SQL reaches the binding",
-  "description": "The facade module issues every read or write against D1 through the prepared-statement surface: `db.prepare(<static SQL literal>).bind(<parameters>).first()`, `.all()`, or `.run()`. The static SQL literal is authored inside the facade module and does not embed values from consumer arguments through string concatenation, template interpolation, or any other join that produces a call-site-specific SQL fragment. The facade does not export a general-purpose query method whose parameter is a SQL string supplied by a consumer, and it does not use `db.exec(<consumer string>)` on any path.",
+  "description": "The facade module routes every read and write against D1 through the prepared-statement discipline owned on TAC-1401-persistence-data-d1-facade.responsibilities[2]. Static SQL literals are authored inside the facade module and never embed values from consumer arguments through string concatenation, template interpolation, or any other join that produces a call-site-specific SQL fragment. The facade exports no general-purpose query method whose parameter is a SQL string supplied by a consumer, and it reaches no non-literal statement through the vendor raw execute path on any code path. The allowed query surface is ratified on ADR-1404.",
   "category": "security",
   "domain": "persistence",
   "priority": "must",
@@ -11,8 +11,12 @@
     "blueprint:persistence-data-d1",
     "category:04-prepared-statements"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1401-persistence-data-d1-facade",
+    "field": "responsibilities.prepare"
+  }
 }

package/blueprints/persistence-data-d1/contributions/requirements/persistence-data-d1-req-005.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1401-persistence-data-d1-facade",
+    "field": "responsibilities.batchAtomicity"
+  }
 }

package/blueprints/persistence-data-d1/contributions/requirements/persistence-data-d1-req-006.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1404-persistence-data-d1-recovery-runner",
+    "field": "responsibilities.timeTravel"
+  }
 }

package/blueprints/persistence-data-d1/contributions/requirements/persistence-data-d1-req-007.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1403-persistence-data-d1-event-secrecy",
+    "field": "decision.metadataOnly"
+  }
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13101.json

@@ -16,7 +16,8 @@
       "when": "the import graph and source tree are inspected for the D1 binding reference (`env.<BINDING_NAME>` where BINDING_NAME is the value configured on `d1_databases[].binding` in the project's wrangler config)",
       "then": "the reference appears in exactly one file (the facade module) and no other file in the source tree contains the reference, verified by an import-graph query or a targeted grep against the configured binding name",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13101-2",
@@ -25,7 +26,8 @@
       "when": "the surface is inspected",
       "then": "every exported symbol is either a named domain verb with typed parameters or an event-sink registration; no exported symbol is the D1 binding itself, and no exported function accepts a raw SQL string as a call argument from consumer code",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13101-3",
@@ -34,12 +36,41 @@
       "when": "the domain code runs against the double in place of the facade",
       "then": "the domain code executes to completion with no reference to the D1 binding on its call path, and its behaviour is unchanged from a facade-backed run for the operations under test",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-13101-4",
+      "description": "Dependency not ready: D1 binding absent from the Worker env. Given a Worker whose wrangler manifest omits the configured d1_databases binding name (or whose deployed environment has not provisioned the binding), when the facade opens on isolate boot and reads env[<bindingName>], then the read returns undefined, the facade refuses with a named error kind d1BindingMissing carrying the expected binding name (never carrying the account id or API token), and no facadeReady fires on the sink.",
+      "given": "the Worker env has no property under the configured D1 binding name",
+      "when": "the facade opens on isolate boot",
+      "then": "the facade refuses with d1BindingMissing naming the expected binding; no credentials leak; no facadeReady fires",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1401-persistence-data-d1-facade",
+        "field": "responsibilities.readBinding"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-13101-5",
+      "description": "Rate limit from D1: the vendor 429 surfaces as queryFailed with retryAfterMs. Given the D1 vendor returns a 429 rate-limit response on a prepare-and-bind or batch call (simulated in the fixture via SIMULATE_D1_RATE_LIMIT=true), when the facade issues the query, then the facade catches the vendor error, surfaces a queryFailed event on the sink carrying { errorKind: 'rateLimited', retryAfterMs: <parsed from vendor headers or a default>, verb: <domain verb name> } and re-throws a d1RateLimited error the consumer catches; a probe FAILS if the event's errorKind is anything other than rateLimited.",
+      "given": "the D1 vendor returns 429 on a facade query (SIMULATE_D1_RATE_LIMIT=true)",
+      "when": "the facade issues the query",
+      "then": "queryFailed fires with { errorKind: 'rateLimited', retryAfterMs, verb }; the facade re-throws d1RateLimited; the probe FAILS on any other errorKind",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1401-persistence-data-d1-facade",
+        "field": "responsibilities.queryFailedRateLimit"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-1401-persistence-data-d1-facade"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13102.json

@@ -16,7 +16,8 @@
       "when": "the migrations directory is listed and each filename's leading integer is extracted",
       "then": "the sequence of leading integers is strictly increasing with no duplicates, every file has a non-empty SQL body, and no file in the directory falls outside the wrangler-configured pattern",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13102-2",
@@ -25,7 +26,8 @@
       "when": "the `list` then `apply` then `list` sequence runs against the local database",
       "then": "the first `list` prints every migration file as unapplied, the `apply` exits zero, and the second `list` prints zero unapplied migrations",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13102-3",
@@ -34,12 +36,31 @@
       "when": "the bookkeeping table is read via `wrangler d1 execute <database> --local --command \"SELECT * FROM d1_migrations\"` (or the configured `migrations_table` name)",
       "then": "the returned row count equals the number of migration files in the directory, and the recorded identifiers match the migration filenames or their leading integers",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-13102-4",
+      "description": "Quota exhausted on D1 database write. Given the D1 database is at or above the plan's per-database size ceiling (10 GB on Paid, 500 MB on Free per the vendor page) and a migration would add rows exceeding the remaining headroom, when the deploy-gate's wrangler d1 migrations apply invocation runs, then the vendor returns a quota-exhausted error, the deploy-gate exits non-zero, no migrationsApplied fires, and the wrangler deploy step is not reached (deploy is gated per REQ-003).",
+      "given": "the D1 database is at or above the plan's size ceiling and a migration would exceed the headroom",
+      "when": "the deploy-gate runs wrangler d1 migrations apply",
+      "then": "the vendor returns quota exhausted; the deploy-gate exits non-zero; no migrationsApplied fires; wrangler deploy is not reached",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1403-persistence-data-d1-deploy-gate",
+        "field": "responsibilities.gate"
+      },
+      "disposition": "template",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/d1/platform/limits/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-1402-persistence-data-d1-migration-catalog"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13103.json

@@ -16,7 +16,12 @@
       "when": "the deploy job's step list is inspected for each environment",
       "then": "the migrations-apply step appears before the deploy step in that job, and any parallelism configuration is such that the deploy cannot start until the apply has exited zero",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/d1/reference/migrations/",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-13103-2",
@@ -25,7 +30,8 @@
       "when": "the pipeline runs",
       "then": "the migrations-apply step exits non-zero, the deploy step does not execute, the deploy job is reported as failed, and no new Worker version has been published to the target environment",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13103-3",
@@ -34,7 +40,8 @@
       "when": "the store event log for that CI run is inspected",
       "then": "the log contains exactly one migrationsApplied event whose metadata fields match the run and whose payload contains no value read from a domain table",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -42,5 +49,5 @@
     "TAC-1402-persistence-data-d1-migration-catalog"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13104.json

@@ -6,17 +6,18 @@
   "status": "approved",
   "title": "Every facade query is a parameterised prepared statement",
   "asA": "developer who needs the persistence boundary to leave no SQL-injection surface for consumer arguments",
-  "iWant": "every facade query to be a static SQL literal issued via `db.prepare(...).bind(...)`, with no string-concatenated SQL and no `exec(<consumer string>)` on any path",
+  "iWant": "every facade query to go through the prepared-statement discipline owned on TAC-1401-persistence-data-d1-facade.responsibilities[2] (no string-concatenated SQL and no non-literal `exec` on any path)",
   "soThat": "consumer arguments never traverse the SQL parser and the vendor's parameter-binding layer is the only place values reach the engine",
   "acceptanceCriteria": [
     {
       "id": "AC-13104-1",
-      "description": "Every call site in the facade module that reaches the D1 binding is a `db.prepare(<static SQL literal>).bind(...)` chain terminating in `.first()`, `.all()`, `.run()`, or `.raw()`. No call site inside the facade calls `db.exec(...)` with any string other than a static SQL literal authored inside the facade module.",
+      "description": "Every call site in the facade module that reaches the D1 binding matches the prepared-statement chain owned on TAC-1401-persistence-data-d1-facade.responsibilities[2]; no call site invokes the raw `exec` surface, which is refused on the facade's exposed handle per ADR-1404-persistence-data-d1-store-boundary.",
       "given": "the facade module source",
       "when": "every call to the D1 binding is inspected for its SQL argument shape",
       "then": "every `prepare` argument is a static string literal (not a template with an interpolation for a value, not a `+`-concatenation with any consumer argument, not a function-returned string) and no `exec` call takes a non-literal string; a targeted grep for `\\.exec(`, `\\.prepare(` template-literal interpolations, and `\\+` inside prepared-statement arguments returns only the known-safe literal-static occurrences the facade documents",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13104-2",
@@ -25,7 +26,8 @@
       "when": "the surface is inspected",
       "then": "no exported function's typed parameter list includes a SQL-string parameter (a parameter named `sql`, `query`, `statement`, or typed as an arbitrary string that reaches `db.prepare` or `db.exec` inside the facade body); the boundary refuses raw-query passthrough by construction",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-13104-3",
@@ -34,12 +36,17 @@
       "when": "the verb is invoked with the probe value against a local D1 database",
       "then": "the invocation completes without side-effect against tables other than the one the verb legitimately touches, and a follow-up `SELECT COUNT(*) FROM domainTable` returns the same count as before the invocation (no DROP), and the probe value round-trips as an ordinary string wherever the verb persisted or returned it",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/d1/worker-api/prepared-statements/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-1401-persistence-data-d1-facade"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13105.json

@@ -16,7 +16,8 @@
       "when": "every verb whose responsibility involves writing to two or more rows across two or more statements is inspected",
       "then": "each such verb issues its statements as one `db.batch([...])` call whose array contains every statement the atomicity claim covers, and no such verb chains sequential independent facade calls to fake atomicity",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-13105-2",
@@ -25,7 +26,12 @@
       "when": "the verb is invoked and the batch fails",
       "then": "the caller receives an error, and a follow-up read against table A shows no row corresponding to the first statement of the failed batch (D1 rolled the batch back)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/d1/worker-api/d1-database/#batch",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-13105-3",
@@ -34,12 +40,13 @@
       "when": "the surface is inspected for begin/commit primitives, transaction-block wrappers, or documentation promising cross-call atomicity",
       "then": "no such surface exists on the facade, and every atomicity claim in facade documentation is scoped to a single verb whose implementation uses `db.batch([...])`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-1401-persistence-data-d1-facade"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13106.json

@@ -16,7 +16,8 @@
       "when": "the operator invokes `wrangler d1 time-travel restore <database> --timestamp=<pre-drop-timestamp>` and a fresh Worker request reads through the facade",
       "then": "the facade reads return the pre-drop row set, the destructive write is not present, and the store event log records exactly one `timeTravelRestored` event whose fields carry the target database identifier, the restore timestamp or bookmark, and the ISO-8601 completion timestamp",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13106-2",
@@ -25,7 +26,8 @@
       "when": "the export step runs against the source database, and the artifact is loaded into a fresh D1 database via `wrangler d1 execute --file <artifact-path>` (with any BEGIN TRANSACTION or COMMIT statements stripped per the vendor's import guidance) and a fresh Worker request reads through the facade",
       "then": "the artifact file exists at the requested path, the fresh database reports the same schema shape and row count for every domain table as the source at export completion, and the store event log records one `backupExported` event whose fields carry the source database identifier, the artifact path, and the ISO-8601 completion timestamp",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13106-3",
@@ -34,7 +36,8 @@
       "when": "the source tree the Worker deploys from is inspected for diff against the deployed build",
       "then": "no Worker source change is required to invoke either recovery path (the recovery runner is a project-side ops surface, not a facade verb), and both invocations produced their event log entry without a Worker redeploy",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -42,5 +45,5 @@
     "TAC-1401-persistence-data-d1-facade"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/contributions/user-stories/persistence-data-d1-us-13107.json

@@ -16,7 +16,8 @@
       "when": "every event record captured on the sink is inspected",
       "then": "every field on every record matches one of the metadata field types listed above, and no field's value equals a value read from any domain table",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-13107-2",
@@ -25,7 +26,26 @@
       "when": "the grep is executed",
       "then": "matches appear only inside CRUD verb bodies (facade) or inside statements the recovery runner or deploy gate does not read for event-record construction, and never inside onEvent call arguments or event-record construction sites",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1401-persistence-data-d1-facade",
+        "field": "interfaces.onEvent"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-13107-3",
+      "description": "Repeat-emission secrecy under maximum event volume. Given the facade exercised through a load run that fires facadeReady, migrationsApplied, backupExported, timeTravelRestored and queryFailed events N times, when the event stream is inspected, then every one of the N event records carries only the metadata field types on AC-13107-1 and no run of N leaks a domain-row value; a mutation SIMULATE_DOMAIN_ROW_IN_EVENT=true injects a domain value into one event and the sink observer FAILS the run.",
+      "given": "the facade run under load that fires each of the five lifecycle events N times",
+      "when": "the event stream is inspected across the whole run",
+      "then": "every one of the N records carries only the metadata field types on AC-13107-1; the injection mutation FAILS",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1401-persistence-data-d1-facade",
+        "field": "interfaces.onEvent"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -34,5 +54,5 @@
     "TAC-1403-persistence-data-d1-deploy-gate"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/persistence-data-d1/docs/topics.md

@@ -17,7 +17,7 @@ Rules for new topics (inherited from the application-spa, application-api-rest,
 
 ## Id number bands (registry bootstrap)
 
-AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is ratified policy (2026-08-19); this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
+AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is policy; this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
 
 This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
 
@@ -62,8 +62,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 13101-13107 sit at the LOW end of the 13101-13899 band on purpose. A project-side story that mechanically derives from a persistence-data-d1 REQ id into the number `13107` would collide against persistence-data-d1-US-13107 in this package; the band leaves headroom at the HIGH end (US 13181-13899) so a project's own stories anchored to persistence-data-d1 REQs can allocate without conflict. The watchpost run4 lesson applies here too.
-
+US 13101-13107 sit at the LOW end of the 13101-13899 band on purpose. A project-side story that mechanically derives from a persistence-data-d1 REQ id into the number `13107` would collide against persistence-data-d1-US-13107 in this package; the band leaves headroom at the HIGH end (US 13181-13899) so a project's own stories anchored to persistence-data-d1 REQs can allocate without conflict.
 ADR and TAC suffixes for this blueprint use the 1401-1499 block, continuing the four-digit widening opened by security-auth-clerk at 1001-1099 (security-auth-clerk topics.md notes that the three-digit space fills at 9xx and forthcoming blueprints continue widening at 1101, 1201, 1301, and now 1401). Sibling round-2 blueprints (deploy-cloudflare-workers at 1301-1399, observability-probe-endpoints at 1501-1599) allocate on the same widening.
 
 ## Shared expectations for future composing blueprints

package/blueprints/persistence-data-postgres/CHANGELOG.md

@@ -1,12 +1,108 @@
+# Changelog
+
+## 1.1.10 - 2026-09-12
+
+Retired development-only password literal removed from the CHANGELOG prose (no credential value in shipped source), the `docker run` invocation for the restore container switched to the pass-through `-e POSTGRES_PASSWORD` form so the value is taken from the spawned process environment and never enters argv, and the anatomy header comment now names the `STRICT_ID_KEYS` scalar-string witness rule the predicate actually enforces instead of the earlier witness list. Anatomy pin bumped to 1.1.10.
+
+- fix: `blueprints/persistence-data-postgres/CHANGELOG.md` 1.1.9 entry rewritten to describe the retired development-only password without naming its value; grep of the added-line diff finds zero credential-shaped literals.
+- fix: `blueprints/persistence-data-postgres/contributions/probes/recovery-restore-round-trip.mjs` `docker run` argument for the restore container uses the pass-through `-e POSTGRES_PASSWORD` form (variable name only); the value is taken from the spawned process environment and never appears in argv.
+- prose: `packages/rcf-lite/test/blueprint/persistence-data-postgres-anatomy.test.js` (a) block comment now names `STRICT_ID_KEYS` scalar-string witnesses as the only accepted id shape and requires `idWitness` and `derivedWitness` under DIFFERENT keys, consistent with the predicate.
+
+## 1.1.9 - 2026-09-12
+
+Password literal removed from shipped probe source, anatomy comment aligned with in-memory validation, `STRICT_ID_KEYS` tightened to engine-returned scalars only. Anatomy pin bumped to 1.1.9.
+
+- fix: `blueprints/persistence-data-postgres/contributions/probes/recovery-restore-round-trip.mjs` connection URL to the restore container now reads the password from the declared POSTGRES_PASSWORD variable only; the retired development-only password literal has been removed from shipped source. The `docker run` invocation uses the pass-through `-e POSTGRES_PASSWORD` form so the value is taken from the spawned process environment and never enters argv.
+- fix: `packages/rcf-lite/test/blueprint/persistence-data-postgres-anatomy.test.js` STRICT_ID_KEYS removed the plural / probe-selected keys (`requestIds`, `vendorRequestIds`, `metadataRequestId`, `httpRequestId`, `observedUploadId`, `dlqTransportMessageIds`, `primaryTransportMessageId`, `jobIds`, `dlqPayloadJobIds`, `expectedPayloadJobId`) so only engine-returned scalar identifiers qualify as id-witnesses.
+- prose: anatomy header comment corrected to describe the in-memory validation the anatomy performs (probes invoked directly; no `.rcf/reports` record read on this seam).
+
+
+## 1.1.8 - 2026-09-11
+
+Engine-returned identifiers only. A counting row's identifier is a value the ENGINE RETURNED for that operation (Postgres `pg_backend_pid()`, `txid_current()` and the migration version the migrations table reports; row ids or serials the database returned). Scratch names the probe chose, database names, migration filenames, checksums the probe computed and any array are NOT identifiers. `STRICT_ID_KEYS` on the anatomy retains engine-returned scalars only; the anatomy also enforces that a counting row's identifier and derived witnesses land under DIFFERENT keys (so a checksum can never satisfy both the id and the derived witness). Every persistence-data-postgres counting row records `backendPid` (and where relevant `transactionId` / `migrationVersion`) alongside its existing derived witnesses. Anatomy pin bumped to 1.1.8.
+
+- fix: `packages/rcf-lite/test/blueprint/persistence-data-postgres-anatomy.test.js` STRICT_ID_KEYS retains only engine-returned scalar keys (`requestId`, `eTag`, `versionId`, `uploadId`, `queueId`, `messageId`, `jobId`, `rowId`, `insertedId`, `backendPid`, `transactionId`, `migrationVersion` and their labelled siblings). `bucketName`, `scratchBucket`, `queueName`, `databaseName`, `migrationFile*`, `appliedFilesList`, `stderrFailingFilename` and the checksum keys were removed.
+- fix: same-file strict-AND now asserts idWitness and derivedWitness sit under DIFFERENT keys; `srcChecksumMd5` was accepted as both id (via STRICT_ID_KEYS) and derived (via `/Md5$/i`) under the pre-8 rule.
+- fix: `facade-round-trip`, `migration-apply` (all three phase-1 rows plus the induced-failure atomicity row), `transaction-atomicity`, `pool-posture-smoke`, `recovery-restore-round-trip` (backup + row-count + checksum rows) each capture `pg_backend_pid()` and `txid_current()` from the same pool that observed the row and stamp them as `backendPid` / `transactionId`. Migration-apply also records `migrationVersion` as the count of committed schema_version rows.
+- prose: run-notes reworded to state engine-returned-only identifiers; the earlier `appliedFilesList` / `checksum` prose was removed.
+
+
+
+## 1.1.7 - 2026-09-11
+
+Lazy engine-client load discipline. Under a CI condition where the fixture's `node_modules` has not been installed and `POSTGRES_HOST` is unset, the probe module surface must load without touching the `pg` driver: an anatomy or tooling walk imports the probe, the probe calls `connectionUrlFromEnv`, catches `MissingPostgresHostError`, and returns the exact one-variable `accountBoundSkipped` row. The prior module-level `import pg from 'pg'` in the fixture facades (`store.mjs` and `migrate.mjs`) resolved `pg` on module load and failed the anatomy TC-070-fixture-and-switches test with `ERR_MODULE_NOT_FOUND` in CI. The engine client is now loaded LAZILY inside `createStore` and `applyAll`, and both fixture helpers are async; every probe now `await`s the facade calls. Anatomy pin bumped to 1.1.7.
+
+- fix: `packages/rcf-lite/test/fixtures/infra-postgres/src/store.mjs` no longer carries a module-level `import pg from 'pg'`. `createStore` is now async and calls a `loadPool()` helper that dynamically imports `pg` on the run path, after `POSTGRES_HOST` is present and the caller has invoked `createStore`.
+- fix: `packages/rcf-lite/test/fixtures/infra-postgres/src/migrate.mjs` no longer carries a module-level `import pg from 'pg'`. `applyAll` calls a `loadClient()` helper that dynamically imports `pg` on the run path.
+- fix: every probe that instantiates the facade (`facade-round-trip`, `migration-apply`, `pool-posture-smoke`, `transaction-atomicity`, `recovery-restore-round-trip`) prefixes `createStore` with `await`; behaviour on both the run path and the skip path is unchanged.
+- fix: `migration-apply` rows 1, 2 and 3 carry `migrationFileApplied` (a string first-applied filename) so every counting row satisfies the strict AND-witness rule alongside the array `appliedFilesList` derived witness (the strict identifier predicate refuses array-valued id keys).
+- fix: `recovery-restore-round-trip` teardown-row limitation string rewrites "AC-observing rows" to "AC observing rows" so the broad `AC-[A-Za-z0-9-]+` limitation-token sweep no longer extracts an invented AC id from the phrase.
+
+
+## 1.1.6 - 2026-09-11
+
+The probe owns its skip and the anatomy invokes every probe unconditionally. The persistence-data-postgres anatomy test now removes the outer POSTGRES_HOST gate, invokes each probe directly, and validates whatever comes back: a skip row for exact one-variable shape, or a counting row against the strict AND-witness rule with a NON-EMPTY STRING identifier under an engine-minted id key (booleans, numbers, arrays and objects never qualify) and a derived-value witness. The limitation-token check now sweeps every `AC-[A-Za-z0-9-]+` token so an invented token alongside a real one is refused. Anatomy pin bumped to 1.1.6.
+
+- fix: identifier predicate on the anatomy STRICT_ID_KEYS check is string-only and non-empty; booleans, numbers, arrays and objects never satisfy an engine-minted id key.
+- fix: limitation-token regex broadened to `AC-[A-Za-z0-9-]+` so every AC token is checked for membership in the shipped user-story AC set.
+- prose: the 1.1.8 changelog paragraph refers to the endpoint-host default without naming the retired literal; supporting prose keeps the same terminology.
+- prose: fixture README no longer names the retired endpoint-host literal on the "How to run" line.
+
+
+## 1.1.5 - 2026-09-11
+
+Endpoint-host discipline and honest CRUD-row anchoring on the facade-round-trip probe. The fixture helper `connectionUrlFromEnv` in `packages/rcf-lite/test/fixtures/infra-postgres/src/store.mjs` no longer carries a literal endpoint-host default: when `POSTGRES_HOST` is unset the helper throws a typed `MissingPostgresHostError` and each consumer probe returns the exact one-variable `accountBoundSkipped` row rather than reaching a hard-coded endpoint. The endpoint-host literal on the recovery-restore-round-trip probe's restore-container connection string is replaced by `process.env.POSTGRES_HOST`, matching the docker host the restore container publishes its port on. The fixture README declares the new behaviour and stops claiming the pack is entirely locally hosted. Anatomy pin bumped to 1.1.5.
+
+- fix: facade-round-trip row 2 (the CRUD round-trip) is now `conformanceOnly` against AC-27101-1 - the AC states pool opening and the facadeReady event, which row 1 observes; the CRUD observation cites AC-27101-1 as the nearest shipped AC and names the unobserved clause ("a facadeReady event fires on the injected event sink carrying the database name"). Row 1 stays anchored to AC-27101-1 and remains the source of the pool-opening / facadeReady evidence.
+- fix: every probe that calls `connectionUrlFromEnv` declares `POSTGRES_HOST` on its `DECLARED_ENV` list and converts `MissingPostgresHostError` into the exact one-variable `accountBoundSkipped` row per authoring-standard section 7d. The anatomy asserts the honest skip shape in the unset path and validates each row against the strict AND-witness rule in the set path.
+- fix: recovery-restore-round-trip's restore-container URL uses `process.env.POSTGRES_HOST`; no literal endpoint host remains in the shipped probe pack or fixture code.
+- fix: migration-apply row 1 and row 3 each carry `appliedFilesList` as their strict id witness alongside the `applied` derived witness. Pool-posture-smoke and transaction-atomicity add `databaseName` (captured from `store.ready()`) so every counting row satisfies the strict AND-witness rule when POSTGRES_HOST is set.
+
+
+
+Strict-anatomy rewrite of the 7d witness rules. The anatomy test now REQUIRES an AC-id-membership check on every limitation string and every notObservableHere.ac (must exist in the shipped user-story set), REQUIRES both an id-shape witness AND a derived-value witness on every non-declaimed row (strict AND, never OR), invokes every probe directly and validates each returned row in-memory, and requires accountBoundSkipped rows to name exactly one env var declared on the probe DECLARED_ENV list. Anatomy pin bumped to 1.1.4. Probes minimally enriched so every counting row carries BOTH witness shapes.
+
+- fix: facade-round-trip row 0 now carries `databaseName` and `poolReadyOk` alongside the `facadeReadyEvent` id witness.
+- fix: migration-apply row 1 now carries `appliedFilesList` alongside the `migrationsAppliedEvent` id witness.
+- fix: pool-posture-smoke row now carries `poolPostureStatus` and `poolConfigurationMetadata` alongside the `checkedOut`/`elapsedMs` derived witnesses.
+- fix: recovery-restore-round-trip checksum row now carries `checksumMatchStatus` alongside the `srcChecksumMd5`/`dstChecksumMd5` derived witnesses.
+- fix: transaction-atomicity row 1 carries `rolledBackTimestamp` and `rolledBackVerificationOk` alongside `transactionRolledBackEvent`; row 2 carries `postRollbackVerificationOk` alongside `postRollbackUserCount`.
+- register: neutral wording on the 1.0.0 entry (no capability change).
+
+## 1.1.3 - 2026-09-11
+
+Positive-evidence conformance work on the probe pack (authoring standard section 7d). The recovery-restore-round-trip probe reads `POSTGRES_SOURCE_CONTAINER`, `POSTGRES_RESTORE_CONTAINER` and `POSTGRES_RESTORE_PORT` from env so a runner on a non-default docker-compose container name or port can execute it without patching probe source. The infra-postgres fixture README gains a Declared env vars table naming every environment variable a probe or the fixture reads (POSTGRES_* connection quintet, the three container/port overrides, SIMULATE_MIGRATION_FAILURE, SIMULATE_CONSTRAINT_VIOLATION); an off-table read is refused at gate. Anatomy pin extended to include the Declared env vars section. All six probes execute against a locally-hosted postgres:17-alpine, with the recovery probe standing up and tearing down its own throwaway restore container.
+
+- fix: recovery-restore-round-trip drives the shipped `exportDatabase` runner (`src/recovery.mjs`) via a `runPgDump` callback so `backupExported` fires and is asserted; the probe now exercises the shipped recovery runner rather than bypassing it. Every teardown step (source TRUNCATE, source pool close, restore `docker rm -f -v`, `docker inspect` absence check, artefact directory removal) is recorded on the report with per-step exit status; a teardown FAIL fails the verdict.
+- fix: recovery-restore-round-trip pre-run cleanup positively asserts the intended pre-state (destination directory absent after removal, restore container absent after `docker inspect`); an inspect error the probe does not recognise fails the row instead of being treated as success. The teardown row is conformance-only (`anchorAcId: null`, `limitation` names AC-27105-1 by full text and states that AC-27105-1's rowset property does not state scratch-resource teardown).
+- fix: migration-apply anchors the induced-failure row to AC-27109-1 by spawning the shipped migration runner AS A CHILD PROCESS (`node packages/rcf-lite/test/fixtures/infra-postgres/src/migrate.mjs`) with `SIMULATE_MIGRATION_FAILURE=true`. The child's OS exit code (`childExitCode`), its stderr (which carries `migration failed at 002_add_email_unique.sql: <pg error>`), and the parent's post-run DB inspection (001 committed with users + schema_version row; 002 rolled back with no UNIQUE constraint and no schema_version row) are all on the same row so AC-27109-1's process-exit clause is observed at process level, not from a field the runner returns.
+- fix: prepared-statement-scan drops the AST-walk claim (fixture declares no JS parser dependency and adding one is out of scope for this patch bump). Row 1 is conformance-only (`anchorAcId: null`, `limitation` names AC-27103-1 by full text and states that the row's per-call-site tokeniser inventory is not the AST walk the AC requires); the row records positive per-call-site observations under the facade dir (per-site `firstArgKind`, extracted literal preview, `$N` placeholder list, and per-site notes on the two known-safe wrapper patterns). Row 2 is `notObservableHere: { ac: 'AC-27103-1', reason: <parser-scope limitation, not account-bound> }` (the previous `accountBoundSkipped` shape was the wrong disposition - fixture-scope parser gap, not an unset account variable).
+- fix: pool-posture-smoke observes the peak concurrent in-use count on each pool at the time of maximum contention (via the shipped pool's `totalCount` / `idleCount` deltas sampled during the checked-out-N-tasks race); the row records `observedPeakInUse` and asserts it equals the configured `max`. The prior row that asserted only the configured `max` is dropped.
+- fix: every result row on every probe carries its own `evidence` object; the shared `aggregate([])` helper returns `fail` with `no checks ran` instead of the previous default-pass on an empty results array.
+
+## 1.1.2 - 2026-09-10
+
+Dimension-d single-definition-ownership cleanup on REQ-004: REQ description now references the transaction-helper interface owned on TAC-2803.interfaces.withTransaction rather than restating the driver control literals for begin, commit and rollback. Chain-consistency lint zero on pass 1 and pass 2.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+Adds the elicits block (connection-url, migrations-directory, migration-runner-tool, runner-mode, pool-size, idle-timeout-ms, connection-timeout-ms, recovery-destination, recovery-cadence, pitr-provider, advisory-lock-helper) that the REQs and guide were already describing in prose; each option is named in the description of the must-priority REQ that governs its runtime clause. Adds a runtime clause naming the relationalStore applied capability on REQ-001. Adds deliveredBy on REQ-003, REQ-005 and REQ-007. Adds ownerRef on AC-27104-1 (withTransaction). Adds disposition to every AC.
+
 # persistence-data-postgres changelog
 
 ## 1.0.0 - 2026-09-06
 
-Initial release. Contract for Postgres as the project's primary durable relational store on a server-tier deployment (Node process, container, non-Workers serverless), accessed through a store facade module that is the sole reader of the `pg` client. Landed via the infra round 5 spec (ratified 2026-09-06) as track T-1.
+Initial release. Contract for Postgres as the project's primary durable relational store on a server-tier deployment (Node process, container, non-Workers serverless), accessed through a store facade module that is the sole reader of the `pg` client.
 
 - 26 contributions: 7 REQs on facade / migrations / prepared statements / transactions / recovery / pool posture / advisory-lock helper; 10 USs at 27101-27110; 4 TACs (2801 facade, 2802 migration runner, 2803 transaction helper, 2804 recovery runner); 5 ADRs (2801 driver with scope global on `persistenceStore`, 2802 migration shape with scope global on `migrationDiscipline`, 2803 runner mode, 2804 recovery, 2805 connection-pool posture).
-- Six Node-only probes under `contributions/probes/` proven against a live `postgres:17-alpine` container: `facade-round-trip`, `migration-apply`, `prepared-statement-scan`, `transaction-atomicity`, `recovery-restore-round-trip`, `pool-posture-smoke`. None account-bound; Postgres is local-first per Baz decision 8.
+- Six Node-only probes under `contributions/probes/` proven against a live `postgres:17-alpine` container: `facade-round-trip`, `migration-apply`, `prepared-statement-scan`, `transaction-atomicity`, `recovery-restore-round-trip`, `pool-posture-smoke`. None account-bound; Postgres is local-first per policy.
 - Sample-app fixture at `packages/rcf-lite/test/fixtures/infra-postgres/` boots `postgres:17-alpine` via docker compose, applies three toy forward-only `.sql` migrations, exposes the facade over `pg`, and hosts `SIMULATE_MIGRATION_FAILURE` and `SIMULATE_CONSTRAINT_VIOLATION` switches for the negative-run probe paths.
 - Declares `capabilities: ["relationalStore"]`, `suggestedCompanions: [{role: "logging"}, {role: "errorHandling"}]`, `providesRoles` absent, `requiresAppliedCapabilities` absent.
 - Reserves the round-6 Hyperdrive v1.1.0 adapter slot at ADR-2801 by keeping the driver reference opaque at the facade boundary.
-- Advisory-lock helper (REQ-007) ships in v1.0.0 as elicited with default `off` per the ratified Q1 answer on infra round 5 spec section 10.
+- Advisory-lock helper (REQ-007) ships in v1.0.0 as elicited with default `off`.
+
+Adds eleven option-binding ACs to close section 7c on the elicits catalogue - migration-runner-tool (AC-27102-4/5/6/7), runner-mode (AC-27102-8/9), recovery-cadence (AC-27105-3/4/5), pitr-provider (AC-27110-3/4). Adds deliveredBy on REQ-001, REQ-002, REQ-004 (three of seven mandatory REQs).

package/blueprints/persistence-data-postgres/README.md

@@ -63,7 +63,7 @@ Each probe is a Node module under `contributions/probes/` exporting the round-5
 | `recovery-restore-round-trip` | AC-27105-1 | `pg_dump` artefact primes a fresh Postgres; row-count and checksum equality |
 | `pool-posture-smoke` | AC-27106-1 | Two facades at pool size 5 handle twenty concurrent queries with no timeout |
 
-None of the six probes carries `accountBound: true`; Postgres is local-first per infra round 5 spec Baz decision 8.
+None of the six probes carries `accountBound: true`; Postgres is `accountBound: false` and local-first (sibling reservation).
 
 ## How to run the probes locally
 
@@ -88,7 +88,7 @@ Each shim exits 0 on aggregate pass and 1 otherwise; every report file carries `
 
 ## Known mechanism-reach gaps
 
-- **Prepared-statement discipline (REQ-003)** is enforced by a build-time AST scan; a project author who bypasses the facade for a project-side raw `pg.query` call site outside the facade directory is not caught by this probe. Mitigation: the facade sole-reader AC on REQ-001 pins the discipline at author-side review; the prepared-statement-scan probe walks only the facade directory by design.
+- **Prepared-statement discipline (REQ-003)** is enforced by a build-time AST scan; a project author who bypasses the facade for a project-side raw `pg.query` call site outside the facade directory is not caught by this probe. Mitigation: the facade sole-reader AC on REQ-001 pins the discipline at the author-side check; the prepared-statement-scan probe walks only the facade directory by design.
 - **Advisory-lock semantics (REQ-007)** is elicited off by default per the ratified Q1 answer. When enabled, session-level locks survive rolled-back transactions per https://www.postgresql.org/docs/current/explicit-locking.html; use `transaction` for the common case and pick `session` only when cross-transaction locking is the intent.
 - **Pool posture per deploy target (REQ-006)** ships defaults matching pg's own; the `pool-posture-smoke` probe drives twenty concurrent queries at pool size 5 and does not impose a sizing formula. Operators sizing for their workload override via the elicited pool-config fields.