rcf-lite 0.26.0 → 0.28.0

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33110.json

@@ -16,12 +16,69 @@
       "when": "wake() is called once, then again",
       "then": "the first wake emits doWakeUp once and returns lastBroadcast; the second wake reports alreadyAwake without a second event",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33110-2",
+      "description": "F-5 cold-start reconstruction: after a broadcast has been processed and hibernate has fired, a fresh HubObject INSTANCE constructed against the same storage (simulating Cloudflare's wake-on-message: the pre-hibernate instance is discarded and a new one is minted from cold), when wake() is called, reads lastBroadcast from storage and returns {lastBroadcast: <same serialised payload>}; doWakeUp fires exactly once on the fresh instance's sink. The reconstruction happens over the same durable storage, not over transferred in-memory state.",
+      "given": "a fresh HubObject instance constructed against a storage that carries a persisted lastBroadcast",
+      "when": "wake() is called on the fresh instance",
+      "then": "wake returns lastBroadcast equal to the persisted value; doWakeUp emits once",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "responsibilities.hibernate"
+      }
+    },
+    {
+      "id": "AC-33110-3",
+      "description": "F-5 wake-on-message: a hibernated HubObject that receives a webSocketMessage during the hibernation window queues the message, wakes (doWakeUp emits once), reads the same storage, processes the queued message (e.g. a broadcast) and delivers to any connected sockets. The message is not dropped; the wake handler runs to completion before the message handler.",
+      "given": "a hibernated HubObject with the message arriving from a re-emerging client",
+      "when": "the driver delivers the webSocketMessage to the hibernated instance",
+      "then": "wake fires, storage is read, and the message is processed after wake completes",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "responsibilities.hibernate"
+      }
+    },
+    {
+      "id": "AC-33110-4",
+      "description": "Hibernate-before-broadcast: a HubObject that has hibernated without ever processing a broadcast persists no lastBroadcast key. wake() on the reconstructed instance returns {lastBroadcast: null} (not undefined; the field is present) and doWakeUp still emits exactly once.",
+      "given": "a HubObject that hibernated without any broadcast",
+      "when": "wake() is called on the reconstructed instance",
+      "then": "wake returns lastBroadcast:null with the field present; doWakeUp emits once",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "responsibilities.hibernate"
+      }
+    },
+    {
+      "id": "AC-33110-5",
+      "description": "Repeated hibernate-and-wake cycles: two hibernate + wake cycles on the same instance produce exactly two doHibernate and two doWakeUp records on the sink, alternating in strict order (hibernate1, wake1, hibernate2, wake2). No cycle produces duplicate records; the idempotent-by-contract guarantee (ADR-3405) holds per cycle.",
+      "given": "a HubObject driven through two hibernate + wake cycles",
+      "when": "the sink is inspected after the second wake",
+      "then": "the sink records exactly two doHibernate and two doWakeUp in strict order",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3404-platform-cloudflare-durable-objects-websocket-hub",
+        "field": "responsibilities.hibernate"
+      }
     }
   ],
   "tacIds": [
     "TAC-3404-platform-cloudflare-durable-objects-websocket-hub"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33111.json

@@ -16,12 +16,55 @@
       "when": "the returned drivers are inspected",
       "then": "each driver.backend reports the elicited answer or the default \"sql\"",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33111-2",
+      "description": "F-6 SQL exposes query verbs: createInMemoryDoStorage({backend:\"sql\"}) returns a driver where typeof driver.query === \"function\" and typeof driver.exec === \"function\". createInMemoryDoStorage({backend:\"kv\"}) returns a driver where those properties are undefined; the KV surface is put/get/delete/list only. The verb set observable on the driver instance reflects the elicited backend.",
+      "given": "a SQL driver and a KV driver from the factory",
+      "when": "their verb sets are inspected",
+      "then": "the SQL driver has .query and .exec as functions; the KV driver does not",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      }
+    },
+    {
+      "id": "AC-33111-3",
+      "description": "F-6 KV refusal error kind: calling .query() on a KV driver throws DO_STORAGE_UNSUPPORTED_ON_KV naming the verb \"query\"; calling .exec() throws with naming \"exec\". The error message identifies the driver.backend value (\"kv\") so the caller can distinguish which backend refused.",
+      "given": "a KV driver from the factory",
+      "when": ".query() or .exec() is called",
+      "then": "the call throws DO_STORAGE_UNSUPPORTED_ON_KV naming the verb and the backend",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      }
+    },
+    {
+      "id": "AC-33111-4",
+      "description": "Unknown backend refuses: createInMemoryDoStorage({backend:\"redis\"}) throws DO_STORAGE_UNKNOWN_BACKEND naming the offered value \"redis\"; the accepted values (\"sql\" and \"kv\") are listed in the message. No driver is returned.",
+      "given": "a factory call with backend \"redis\"",
+      "when": "the factory is invoked",
+      "then": "the factory throws DO_STORAGE_UNKNOWN_BACKEND naming \"redis\" and listing \"sql\" and \"kv\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape",
+        "field": "responsibilities.storage"
+      }
     }
   ],
   "tacIds": [
     "TAC-3402-platform-cloudflare-durable-objects-single-cell-shape"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33112.json

@@ -16,12 +16,63 @@
       "when": "the probe runs",
       "then": "with the account: the round-trip returns and the probe passes. Without the account: accountBoundSkipped:true and exit 0.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33112-2",
+      "description": "Bounded-wait: the real-account probe caps its round-trip attempts at 30 seconds. If the storage.put or storage.get calls do not settle within the cap, the probe returns aggregateVerdict:\"fail\" with reason CF_DO_ROUND_TRIP_TIMEOUT and the observed elapsed millis.",
+      "given": "a real-account probe whose CF API calls hang past 30 seconds",
+      "when": "the probe caps the wait",
+      "then": "aggregateVerdict is \"fail\" with reason CF_DO_ROUND_TRIP_TIMEOUT and elapsed millis",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-33112-3",
+      "description": "Partial env-var configuration: with CI_HAS_CLOUDFLARE_ACCOUNT=true but CF_API_TOKEN missing, the probe refuses before any API call with a named error kind CF_MISSING_TOKEN naming the missing variable. Same for CF_ACCOUNT_ID or CF_DO_NAMESPACE_ID.",
+      "given": "CI_HAS_CLOUDFLARE_ACCOUNT=true with CF_API_TOKEN unset",
+      "when": "the probe runs",
+      "then": "the probe refuses with CF_MISSING_TOKEN naming the missing variable",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33112-4",
+      "description": "Non-2xx API response: if the Cloudflare API returns a 401, 403 or 5xx during the round-trip, the probe surfaces the observed HTTP status and response body, and returns aggregateVerdict:\"fail\" with reason CF_DO_HTTP_ERROR. 4xx is not retried; 5xx retries once.",
+      "given": "a real-account probe where the DO API returns 403",
+      "when": "the probe attempts the round-trip",
+      "then": "aggregateVerdict is \"fail\" with reason CF_DO_HTTP_ERROR, HTTP status and body",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/platform/limits/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3401-platform-cloudflare-durable-objects-namespace-facade"
   ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T14:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/contributions/user-stories/platform-cloudflare-durable-objects-us-33113.json

@@ -11,15 +11,78 @@
   "acceptanceCriteria": [
     {
       "id": "AC-33113-1",
-      "description": "The wrangler-seam probe, when the fixture has been prepared with `pnpm install --ignore-workspace` so the wrangler devDependency is on the tree, spawns `wrangler dev --local --port 0` from the cf-platform fixture, waits bounded 45 seconds for the CLI to bind, then (a) issues two concurrent POST /cell/<id>/increment requests against a fetch route in src/index.mjs that calls createDoFacade({env, eventSink}).cellFetch(<id>, request), asserting the two responses observe per-instance serialisation (sorted counters == [1, 2], sorted witnesses == [0, 1], each request read the other's write) and (b) opens one WebSocket upgrade against /hub/<id>/connect via createDoFacade({env, eventSink}).hubFetch(<id>, request), asserting one broadcast frame arrives on connect with payload 'hello-from-hub'. The probe kills wrangler cleanly on exit. Warn semantics per section 3.1 pass-with-skip: if wrangler is not installed or fails to bind within the cap, the probe returns aggregateVerdict warn (never fail); a handler thrown at the workerd boundary is a genuine fail. The additional result on the same probe run covers AC-33108-1 by grepping the fixture wrangler.toml for the two [[durable_objects.bindings]] pairs and the [[migrations]] tag/new_classes pair; the grep result is deterministic and does not require wrangler.",
+      "description": "The wrangler-seam probe, when the fixture has been prepared with `pnpm install --ignore-workspace` so the wrangler devDependency is on the tree, spawns `wrangler dev --local --port 0` from the cf-platform fixture, waits bounded 45 seconds for the CLI to bind, then (a) issues two concurrent POST /cell/<id>/increment requests against a fetch route in src/index.mjs that calls createDoFacade({env, sink}).cellFetch(<id>, request), asserting the two responses observe per-instance serialisation (sorted counters == [1, 2], sorted witnesses == [0, 1], each request read the other's write) and (b) opens one WebSocket upgrade against /hub/<id>/connect via createDoFacade({env, sink}).hubFetch(<id>, request), asserting one broadcast frame arrives on connect with payload 'hello-from-hub'. The probe kills wrangler cleanly on exit. Warn semantics per section 3.1 pass-with-skip: if wrangler is not installed or fails to bind within the cap, the probe returns aggregateVerdict warn (never fail); a handler thrown at the workerd boundary is a genuine fail. The additional result on the same probe run covers AC-33108-1 by grepping the fixture wrangler.toml for the two [[durable_objects.bindings]] pairs and the [[migrations]] tag/new_sqlite_classes pair; the grep result is deterministic and does not require wrangler.",
       "given": "the cf-platform fixture with the wrangler devDependency installed and the shipped DO classes exported from src/index.mjs",
       "when": "the wrangler-seam probe runs",
-      "then": "wrangler dev binds; two concurrent increments through env.CELL observe per-instance serialisation; one WebSocket upgrade through env.HUB receives a broadcast frame; the wrangler.toml grep confirms both binding pairs and the migrations tag/new_classes; wrangler exits cleanly",
+      "then": "wrangler dev binds; two concurrent increments through env.CELL observe per-instance serialisation; one WebSocket upgrade through env.HUB receives a broadcast frame; the wrangler.toml grep confirms both binding pairs and the migrations tag/new_sqlite_classes; wrangler exits cleanly",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-33113-2",
+      "description": "Wrangler-not-installed warn: if pnpm install --ignore-workspace has not been run under the cf-platform fixture and the wrangler bin is not on the fixture's node_modules/.bin, the wrangler-seam probe returns aggregateVerdict:\"warn\" naming DO_WRANGLER_NOT_INSTALLED with the expected bin path. This is a genuine \"cannot verify\" state, not a runtime defect (warn semantics per section 3.1 pass-with-skip).",
+      "given": "a cf-platform fixture whose node_modules does not contain wrangler",
+      "when": "the wrangler-seam probe runs",
+      "then": "aggregateVerdict is \"warn\" with reason DO_WRANGLER_NOT_INSTALLED",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33113-3",
+      "description": "Bind-timeout warn: if wrangler dev --local --port 0 does not bind within the 45-second cap, the probe returns aggregateVerdict:\"warn\" naming DO_WRANGLER_BIND_TIMEOUT with the observed stderr quoted. The probe kills the wrangler child on the timeout.",
+      "given": "a probe run where wrangler cannot bind within 45 seconds (simulated by an environment that blocks its listen)",
+      "when": "the probe caps the wait at 45 seconds",
+      "then": "aggregateVerdict is \"warn\" naming DO_WRANGLER_BIND_TIMEOUT with the observed stderr",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33113-4",
+      "description": "Workerd handler thrown = fail (not warn): if wrangler binds but a request through env.CELL or env.HUB throws inside the workerd runtime (e.g. the DO handler rejects with an uncaught error), the probe returns aggregateVerdict:\"fail\" naming DO_WORKERD_HANDLER_THREW with the observed response body. A handler thrown is a genuine runtime defect, distinct from the warn cases above.",
+      "given": "a probe run where a POST /cell/<id>/increment triggers a handler that throws inside workerd",
+      "when": "the probe issues the concurrent requests",
+      "then": "aggregateVerdict is \"fail\" naming DO_WORKERD_HANDLER_THREW",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
+    },
+    {
+      "id": "AC-33113-5",
+      "description": "Probe teardown: the wrangler child is killed on probe exit (normal or exceptional) via SIGTERM followed by SIGKILL after a 5-second grace period. An interrupted probe still tears down within 6 seconds; no orphan wrangler process remains.",
+      "given": "a probe run interrupted by an assertion rejection after the CLI binds",
+      "when": "the probe teardown runs",
+      "then": "the wrangler child is terminated within 6 seconds; no orphan process remains",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3401-platform-cloudflare-durable-objects-namespace-facade",
+        "field": "interfaces.createDoFacade"
+      }
     }
   ],
-  "tacIds": ["TAC-3401-platform-cloudflare-durable-objects-namespace-facade"],
+  "tacIds": [
+    "TAC-3401-platform-cloudflare-durable-objects-namespace-facade"
+  ],
   "createdAt": "2026-09-07T14:00:00.000Z",
-  "updatedAt": "2026-09-07T16:10:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-durable-objects/docs/topics.md

@@ -60,7 +60,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 33101-33112 sit at the LOW end of the 33101-33899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a platform-cloudflare-durable-objects REQ id into the number 33113 would collide against a shipped US-33113; band headroom (33113-33899) leaves that space.
+US 33101-33112 sit at the LOW end of the 33101-33899 band on purpose. A project-side story mechanically derived from a platform-cloudflare-durable-objects REQ id into the number 33113 would collide against a shipped US-33113; band headroom (33113-33899) leaves that space.
 
 ADR/TAC suffixes for this blueprint use the 3401-3499 block, continuing the shelf pattern.
 
@@ -69,7 +69,7 @@ ADR/TAC suffixes for this blueprint use the 3401-3499 block, continuing the shel
 - Reuse `strongConsistencyCellContract` exactly as spelled here when your blueprint holds an opinion on the strong-consistency cell contract; contribute your own scope:global ADR on that string and let composition surface the pairing.
 - Reuse `websocketHubContract` exactly as spelled here when your blueprint holds an opinion on the websocket-hub contract; the same pattern applies.
 - A future non-Cloudflare adapter on either contract mints on demand; each claims the same topic string and conflicts by design.
-- Consumer blueprints reading the `strongConsistencyCell` or `hibernatableWebSocket` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the DO facade wiring at apply time via the T-5 visual-round capability-declaration mechanism.
+- Consumer blueprints reading the `strongConsistencyCell` or `hibernatableWebSocket` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the DO facade wiring at apply time via the visual-round capability-declaration mechanism.
 
 ## Deliberate-conflict statement
 

package/blueprints/platform-cloudflare-durable-objects/guide/platform-cloudflare-durable-objects.md

@@ -5,21 +5,21 @@
 You reach for `platform-cloudflare-durable-objects` when your
 Worker needs strongly consistent authoritative state, coordinated
 multiplayer websocket connections, or both on the same DO namespace
-mechanic. Two shapes ship in one blueprint: the SINGLE-CELL shape
+mechanic. Two shapes ship in one blueprint: the single-cell shape
 (counter, session store, lock, coordinator) and the WEBSOCKET-HUB
 shape (rooms, presence, live cursors).
 
 If you need eventually-consistent low-latency reads on a read-hot
 path (feature flags, session cache, config cache), reach for
-`platform-cloudflare-kv` (round 6 T-1) instead. If you need
+`platform-cloudflare-kv` instead. If you need
 durable multi-step workflows with retries and state across steps,
 reach for the follow-up Workflows adapter on `jobs-background`
-v1.1.0 (round-6 minor bump per spec section 5.7).
+v1.1.0.
 
 ## Decision tree
 
 - Strongly consistent authoritative cell (counter, session store,
-  lock, coordinator) -> SINGLE-CELL shape (this blueprint,
+  lock, coordinator) -> single-cell shape (this blueprint,
   `platform-cloudflare-durable-objects` v1.0.0).
 - Coordinated multiplayer websocket connections in one authoritative
   hub (rooms, live cursors, presence) -> WEBSOCKET-HUB shape (this
@@ -107,7 +107,7 @@ looser window trades latency for fan-out cost on a busy hub.
 
 The DO class names are stable strings committed to `wrangler.toml`.
 Both binding blocks name the class explicitly; the `[[migrations]]`
-block records the mint under `tag = "v1"` with `new_classes` naming
+block records the mint under `tag = "v1"` with `new_sqlite_classes` naming
 both classes. A copy-paste block for a fresh Worker project:
 
 ```
@@ -121,7 +121,7 @@ class_name = "HubObject"
 
 [[migrations]]
 tag = "v1"
-new_classes = ["SingleCellObject", "HubObject"]
+new_sqlite_classes = ["SingleCellObject", "HubObject"]
 ```
 
 A rename in a later release ships as a NEW `[[migrations]]` tag on
@@ -161,11 +161,11 @@ returns fail on the AC-33106-1 result.
 
 ## Composition
 
-- Consumes `deploy-cloudflare-workers` v1.2.0 (T-0). The DO bindings
+- Consumes `deploy-cloudflare-workers` v1.2.0. The DO bindings
   and migrations tag land in the same `wrangler.toml`.
 - Companions `logging` and `errorHandling` supply the sink factory
   and the internal-error record factory.
-- Complements `platform-cloudflare-kv` (round 6 T-1): DO owns the
+- Complements `platform-cloudflare-kv`: DO owns the
   strong-consistency slot; KV owns the cache-shaped eventually-
   consistent slot. Both compose on the same Worker.
 - A future non-Cloudflare adapter on `strongConsistencyCellContract`
@@ -203,7 +203,7 @@ workerd runtime:
 - An additional `AC-33108-1` result on the same run greps the
   fixture `wrangler.toml` for both `[[durable_objects.bindings]]`
   binding pairs and the `[[migrations]]` `tag = "v1"` with
-  `new_classes`; the grep is deterministic and does not require
+  `new_sqlite_classes`; the grep is deterministic and does not require
   wrangler.
 
 Warn semantics per section 3.1 pass-with-skip: if the wrangler

package/blueprints/platform-cloudflare-kv/CHANGELOG.md

@@ -2,36 +2,82 @@
 
 All notable changes to `platform-cloudflare-kv` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
 
+## 1.1.4 - 2026-09-12
+
+Event-secrecy anatomy runs the mutation-switch case in-process so the shipped report record stays untouched.
+
+- Anatomy: `test/blueprint/platform-cloudflare-kv-anatomy.test.js` toggles `SIMULATE_PII_LEAK` inside the test process and invokes the `event-secrecy` probe module a second time, then validates the returned result set against fail and forbiddenKeys in memory. The prior child-process spawn of `contributions/probes/run-event-secrecy.mjs` is removed; the probe body and the fixture-side shim are unchanged.
+- Reports: the tracked `event-secrecy` record under `.rcf/reports/blueprints/platform-cloudflare-kv/` is now byte-identical after a full `pnpm test` run and is regenerated only through a deliberate shim invocation.
+
+## 1.1.3 - 2026-09-10
+
+Positive-evidence rule alignment on the probe pack skip path (authoring standard section 7d), plus a register and citation patch.
+
+- Probes: the account-bound skip return on `contributions/probes/real-account-eventual-consistency-smoke.mjs` now carries a `reason` field naming the exact env var that was unset (`CI_HAS_CLOUDFLARE_ACCOUNT` on the standard skip path). Skip-path probe report regenerated so the shipped shape carries the new field.
+- AC-31103-1 gains a `vendorCitation` for the Workers KV read/write API page (F-2).
+- Neutral register in AC-31109-2 (F-3), ADR-3201 context and consequences (F-4), README (F-5) and guide prose (F-6).
+
+## 1.1.2 - 2026-09-10
+
+Owner reference for the KV event-record whitelist.
+
+- Rewrote REQ-004 description to reference the owning TAC field (`TAC-3203-platform-cloudflare-kv-event-sink.purpose`) for the KV event-record whitelist, rather than restating the shape verbatim.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+
+## 1.1.0 (2026-09-09)
+
+### Added
+
+- `platform-cloudflare-kv-REQ-006` (`must`): the elicited `kv-key-naming-convention` answer (`prefixed` or `flat`) flows through every facade verb; `prefixed` applies the elicited `keyPrefix` transparently, `flat` passes keys through untouched. Closes criterion a on the previously unbacked elicit (F-1).
+- `platform-cloudflare-kv-REQ-007` (`must`): pre-ready operations queue behind `facadeReady`; sink events emit in causal per-operation order. Closes the previously unbacked `TAC-3201` pre-ready responsibility and `TAC-3203` ordering responsibility (F-4).
+- `platform-cloudflare-kv-US-31109` (traces REQ-005 after prior gap F-2), `US-31110` (traces REQ-006), `US-31111` (traces REQ-007). Every AC carries `disposition` and `ownerRef`; the vendor-fact ACs carry `vendorCitation`.
+
+### Changed
+
+- `platform-cloudflare-kv-REQ-005` reworded to separate the applied cache-aside TTL (LOCAL expiry) from the KV eventual-consistency propagation window (vendor-owned, up to 60 seconds or more per the Cloudflare KV documentation). The v1.0.x wording that called the elicited TTL a "global staleness ceiling" is retired; the guide surfaces the two clocks separately and cross-references `platform-cloudflare-durable-objects` as the strong-consistency answer (F-3).
+- Every existing REQ carries a `deliveredBy` link into a TAC or ADR (five links). Every existing AC carries `disposition`. `rcf define blueprint lint-consistency` reports zero pass-1 and pass-2 findings.
+
+### Added
+
+- Every story on this blueprint now reaches the section 7a AC-set-sufficiency floor. 36 new hand-authored ACs cover the documented failure paths named in the guide and TAC records, per-story range 4-6: US-31101 gains four failure-path ACs (binding-unbound closing the write gap, invalid sink, repeat-boot idempotency, ready-check rejects with KV_FACADE_NOT_READY); US-31102 gains three ACs (non-facade leak, comment-only mention, nested-directory recursion); US-31103 gains four ACs (getWithMetadata, per-call TTL propagation, write-failed with KV_WRITE_FAILED, read-failed with KV_READ_FAILED); US-31104 gains four ACs (cursor pagination, empty prefix, no-match, list_complete indicator); US-31105 gains four ACs (TTL floor clamping, origin-throws, concurrent-miss single-flight, source classification); US-31106 gains three ACs (per-call TTL override, per-call TTL below floor clamps, TTL boundary strict less-than); US-31107 gains three ACs (additional-field mutation, causal ordering, closed vocabulary); US-31108 gains three ACs (metadata-blob never a body, substring scan across all kinds, layer separation); US-31109 gains three ACs (vendor propagation window in guide, DO as strong-consistency alternative in guide, no cross-region claim on any AC); US-31110 gains three ACs (unknown mode refuses, empty prefix behaves as flat, nested prefix); US-31111 gains two ACs (strict FIFO drain of 10 pre-ready calls, post-ready no-queue path). Every new AC carries `disposition`, most carry `ownerRef` into the owning TAC, and vendor-fact ACs carry `vendorCitation` (KV overview, KV API, KV how-KV-works, KV limits).
+
+### Fixed
+
+- `AC-31109-1` disposition flipped from `fixed` to `template`: the applying project sets the cache-aside TTL, so an AC that binds the local-expiry window to `elicitedTtlMs` is an elicit-branch AC per section 7b.
+
 ## 1.0.2 (2026-09-08)
 
-H-2 follow-up (`w-2026-09-08-dave-017`, addendum item 6 fixture defect): the real-account KV probe now self-provisions its own throwaway namespace, closing the second-tier undeclared-env skip HQ hit at the real-account gate on 2026-09-08 (`REAL RUN: PARTIAL`, `MERGE DECISION: HOLD`). No shipped-code capability change.
+The real-account KV probe self-provisions its own throwaway namespace, so a pre-declared namespace id is no longer required at the real-account gate. No shipped-code capability change.
 
 ### Changed
 
 - `real-account-eventual-consistency-smoke.mjs` rewritten against a new self-provisioning fixture shim at `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-real-account-shim.mjs`. The shim mints a scratch KV namespace under the frozen throwaway prefix `h2-cf-probe-integrity-scratch-kv-`, writes a fixture key under `h2-storage-smoke-`, polls up to 60 seconds bounded for same-region visibility, deletes the key, and destroys the namespace on exit. Positive evidence captured on every real-account run: namespace id, exact scratch title, key, PUT / GET / DELETE status codes, elapsed ms.
-- Removed the second-tier `CF_KV_NAMESPACE_ID` gate that produced the undeclared skip at the H-2 real-account gate. The declared env for a real-account run is now `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN` (optional test override `CF_API_BASE_URL`), enumerated in the probe's `report.extra.envDeclared` and mirrored in the shim's `DECLARED_ENV` export.
+- Removed the second-tier `CF_KV_NAMESPACE_ID` gate that produced the undeclared skip at the real-account gate. The declared env for a real-account run is now `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN` (optional test override `CF_API_BASE_URL`), enumerated in the probe's `report.extra.envDeclared` and mirrored in the shim's `DECLARED_ENV` export.
 - Teardown is fail-safe and idempotent: a mid-run crash surfaces the minted id through the shim's persisted scratch record; the shim's separate `sweepOrphans` entry point lists over the account and filters on the throwaway prefix. Sweep is structurally unable to select a non-prefixed name (three independent guards: prefix assert on mint, prefix assert on destroy against the record, prefix assert on the live-listing observation; sweep-only prefix filter mirrors the destroy assertions). A dedicated sweep-safety test at `packages/rcf-lite/test/fixtures/cf-platform/test/h2-cf-kv-real-account-shim.test.mjs` seeds the mock account with the ten live production script names on the operator account plus a sneaky mid-string-prefix name and asserts sweep selects zero of them.
 
 ### Added
 
-- Self-contained mock CF REST API at `packages/rcf-lite/test/fixtures/cf-platform/test/mock-cf-api-server.mjs` (Node `node:http` only, zero-dep) implementing the KV namespaces + values + keys endpoints the shim hits, with page + per_page pagination on the namespaces list. Test at `test/h2-cf-kv-probe-e2e.test.mjs` boots the mock in-process, points the shim at it via `CF_API_BASE_URL`, and drives the probe end-to-end to prove the mint / evidence-capture / teardown / zero-orphans loop before the HQ real-account run ever executes.
-- `kvListNamespaces` in the shared CF REST client (`h2-cf-account-api.mjs`) paginates to completion via the documented `per_page` + `page` loop (Dave ruling 4e9ff62d item 5) so `sweepOrphans` is not silently truncated to page one on a busy account. `kvDeleteNamespace` is idempotent on 404 (Dave ruling 4e9ff62d items 3+4).
+- Self-contained mock CF REST API at `packages/rcf-lite/test/fixtures/cf-platform/test/mock-cf-api-server.mjs` (Node `node:http` only, zero-dep) implementing the KV namespaces + values + keys endpoints the shim hits, with page + per_page pagination on the namespaces list. Test at `test/h2-cf-kv-probe-e2e.test.mjs` boots the mock in-process, points the shim at it via `CF_API_BASE_URL`, and drives the probe end-to-end to prove the mint / evidence-capture / teardown / zero-orphans loop before the real-account run ever executes.
+- `kvListNamespaces` in the shared CF REST client (`h2-cf-account-api.mjs`) paginates to completion via the documented `per_page` + `page` loop (operator ruling 4e9ff62d item 5) so `sweepOrphans` is not silently truncated to page one on a busy account. `kvDeleteNamespace` is idempotent on 404 (operator ruling 4e9ff62d items 3+4).
 
 ### Local-proof scope note
 
-The local proof harness under `packages/rcf-lite/test/fixtures/cf-platform/test/` is a mock of Cloudflare's REST contract, not the wire. **The local run exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** This probe is never described as "locally verified" - the local runs are our own lifecycle-logic proof; wire correctness is proven at the HQ real-account gate.
+The local proof harness under `packages/rcf-lite/test/fixtures/cf-platform/test/` is a mock of Cloudflare's REST contract, not the wire. **The local run exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** This probe is never described as "locally verified" - the local runs are our own lifecycle-logic proof; wire correctness is proven at the real-account gate.
 
 ## 1.0.1 (2026-09-08)
 
-H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch across the four Cloudflare-platform blueprints. No capability change.
-
+Probe-integrity patch (`h2-cf-platform-probe-integrity`) across the four Cloudflare-platform blueprints. No capability change.
 ### Changed
 
-- Re-anchored all five KV probes and the README from the defunct `AC-5xxx` id space to the shipped `AC-31xxx` band (nine shipped ACs: `AC-31101-1`, `AC-31102-1`, `AC-31103-1`, `AC-31103-2`, `AC-31104-1`, `AC-31105-1`, `AC-31106-1`, `AC-31107-1`, `AC-31108-1`). Every one of the nine now has a runtime observable through a re-anchored probe. Anatomy-test assertions in `packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js` moved with the re-anchor. Dispatch addendum ruling 1.
+- Re-anchored all five KV probes and the README from the defunct `AC-5xxx` id space to the shipped `AC-31xxx` band (nine shipped ACs: `AC-31101-1`, `AC-31102-1`, `AC-31103-1`, `AC-31103-2`, `AC-31104-1`, `AC-31105-1`, `AC-31106-1`, `AC-31107-1`, `AC-31108-1`). Every one of the nine now has a runtime observable through a re-anchored probe. Anatomy-test assertions in `packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js` moved with the re-anchor.
 - Moved the `SIMULATE_CACHE_MISS` mutation switch out of `cache-aside-hit-then-miss.mjs` into fixture shim `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-cache-aside-shim.mjs`; the probe body holds zero `SIMULATE_` token references (`AC-15401-1` mutation-purity rule).
 - Moved the `SIMULATE_PII_LEAK` mutation switch out of `event-secrecy.mjs` into fixture shim `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-event-secrecy-shim.mjs`; the probe body holds zero `SIMULATE_` token references.
 - Reworded the "fake clock" comment on `cache-aside-hit-then-miss.mjs` header to name the local test double honestly ("elicited deterministic clock the fixture advances").
-- Reworded the `Known limitations` (CHANGELOG) and `Known mechanism-reach gaps` (README) entries on the loader `elicits[]` `when` block predicate to name the loader-capability uplift as follow-up work item `w-2026-09-08-h3-loader-elicit-when-predicates` (0.26.x capability change, out of H-2's 0.25.x patch scope per Dave ruling 1). The entry describes the current shipped shape and points forward to the follow-up.
+- The `Known limitations` (CHANGELOG) and `Known mechanism-reach gaps` (README) entries name the loader `elicits[]` `when` block behaviour: only `requiresCapability` arrays are currently supported, so an `elicitedNonEmpty` predicate is not available and the elicit fires unconditionally. Supporting the predicate requires a loader-side capability extension.
 
 ### Fixed
 
@@ -39,7 +85,7 @@ H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch ac
 
 ### Chain slice
 
-- Train chain slice minted inside the reserved H-2 block: `REQ-150..154`, `US-15001..15401`, twelve `AC-15xxx` ACs, `TS-180..184` with eleven TCs, `FBS-170..174`, `CN-520..529` (seven used, three reserved). Full mint transcript in the H-2 PR provenance.
+- Train chain slice minted inside the reserved chain block: `REQ-150..154`, `US-15001..15401`, twelve `AC-15xxx` ACs, `TS-180..184` with eleven TCs, `FBS-170..174`, `CN-520..529` (seven used, three reserved). Full mint transcript in the hardening-pass PR provenance.
 
 ## 1.0.0 (2026-09-07)
 
@@ -51,10 +97,10 @@ H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch ac
 - Elicited parameters on `blueprint.json`: `kv-binding-name` (default `CACHE`), `kv-default-cache-ttl-seconds` (default `60`, floor `1`), `kv-metadata-field-pattern` (default `{v:1}`), `kv-key-naming-convention` (default `prefixed`).
 - `suggestedCompanions`: `logging` (for the event-sink boundary) and `errorHandling` (for the error record shape).
 - Extends the shared `cf-platform` sample-app fixture with the `[[kv_namespaces]]` binding block (name `CACHE`), the sole-reader KV facade module (`src/kv-facade.mjs`), the cache-aside helper (`src/cache-aside.mjs`), and the in-memory KV driver (`src/kv-driver.mjs`) that realises the Workers KV binding shape so the local probes drive without a live-KV dependency.
-- Anatomy test at `packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js` covers `TS-080..087` on the T-1 chain slice (blueprint shape, contributions cross-check, probe module contracts, fixture files, ADR bodies and clauses, guide sections and URLs, three-state probed verdicts).
+- Anatomy test at `packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js` covers `TS-080..087` on the chain slice (blueprint shape, contributions cross-check, probe module contracts, fixture files, ADR bodies and clauses, guide sections and URLs, three-state probed verdicts).
 
 ### Known limitations
 
 - The `real-account-eventual-consistency-smoke` probe records `accountBoundSkipped: true` and aggregates to `pass` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset (spec section 3.5 pass-with-skip). Full mechanism reach requires a CI environment with the paired `CF_ACCOUNT_ID`, `CF_KV_NAMESPACE_ID` and `CF_API_TOKEN` env vars.
 - The four local probes drive an in-memory KV driver whose shape matches the Workers KV binding at the facade boundary. Vendor surface changes beyond that boundary (a new list cursor format, a header-only limit) are not caught by the local probes; the real-account smoke is the mechanism-reach closure for that gap.
-- The loader's supported `when` block on `elicits[]` currently accepts only `requiresCapability` arrays, so the elicited `kv-metadata-field-pattern` fires unconditionally rather than gating on an `elicitedNonEmpty` predicate for `kv-binding-name`. The elicit fires unconditionally today and the guide teaches the pattern; a loader-capability uplift extending `validateElicits` to accept an `elicitedNonEmpty` predicate is captured as follow-up work item `w-2026-09-08-h3-loader-elicit-when-predicates` (0.26.x capability change, out of H-2's 0.25.x patch scope per Dave ruling 1).
+- The loader's supported `when` block on `elicits[]` currently accepts only `requiresCapability` arrays. An `elicitedNonEmpty` predicate for gating `kv-metadata-field-pattern` on `kv-binding-name` is not supported by the loader today, so the elicit fires unconditionally; the guide teaches the intended pattern.

package/blueprints/platform-cloudflare-kv/README.md

@@ -23,7 +23,7 @@ can render without ever writing a body byte.
   timestamp}` and nothing else. Two-layer secrecy assertion in the
   event-secrecy probe.
 - A decision-tree cross-reference in the guide to
-  `platform-cloudflare-durable-objects` (round-6 T-3) for cases that
+ `platform-cloudflare-durable-objects` for cases that
   need strong-consistency semantics.
 
 ## The five REQs
@@ -80,7 +80,7 @@ under the fixture root.
 | `cache-aside-hit-then-miss.mjs` | `AC-31105-1` | no | Wraps a spy origin function with the cache-aside helper, drives one call within TTL (hit, no origin call), advances the fake clock past TTL, drives another call (miss, second origin call). |
 | `event-secrecy.mjs` | `AC-31108-1` | no | Two-layer assertion: whitelist check on every event record and PII-substring scan on the JSON serialisation. A mutation-run under `SIMULATE_PII_LEAK` flips the probe to fail. |
 | `list-with-prefix.mjs` | `AC-31104-1` | no | Puts 10 keys under `flags/` plus one decoy outside the prefix, calls `list({prefix: flags/})`, asserts all 10 return with correct metadata shape and the decoy is absent. |
-| `real-account-eventual-consistency-smoke.mjs` | `AC-31108-1` | yes | Self-provisioning: the fixture shim (`packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-real-account-shim.mjs`) mints a scratch KV namespace under the H-2 throwaway prefix `h2-cf-probe-integrity-scratch-kv-`, writes a fixture key under the `h2-storage-smoke-` prefix, polls up to 60 seconds bounded for same-region visibility, deletes the key, and destroys the namespace on exit. Positive evidence captured: namespace id, exact scratch title, key, PUT / GET / DELETE status codes, elapsed ms. Idempotent prefix-sweep entry point (`sweepOrphans`) filters over the account by the frozen throwaway prefix and deletes each match by exact id and exact name; the sweep is structurally unable to select a non-prefixed name, paginates KV namespaces to completion (Dave ruling 4e9ff62d item 5), and is exercised by the fixture's sweep-safety test against the ten live production script names on the operator account plus a 250-per-type multi-page cover. Without `CI_HAS_CLOUDFLARE_ACCOUNT` records `accountBoundSkipped: true` and aggregates `pass` per spec section 3.5. **The local proof exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** |
+| `real-account-eventual-consistency-smoke.mjs` | `AC-31108-1` | yes | Self-provisioning: the fixture shim (`packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-real-account-shim.mjs`) mints a scratch KV namespace under the throwaway prefix `h2-cf-probe-integrity-scratch-kv-`, writes a fixture key under the `h2-storage-smoke-` prefix, polls up to 60 seconds bounded for same-region visibility, deletes the key, and destroys the namespace on exit. Positive evidence captured: namespace id, exact scratch title, key, PUT / GET / DELETE status codes, elapsed ms. Idempotent prefix-sweep entry point (`sweepOrphans`) filters over the account by the frozen throwaway prefix and deletes each match by exact id and exact name; the sweep is structurally unable to select a non-prefixed name, paginates KV namespaces to completion, and is exercised by the fixture's sweep-safety test against the ten live production script names on the operator account plus a 250-per-type multi-page cover. Without `CI_HAS_CLOUDFLARE_ACCOUNT` records `accountBoundSkipped: true` and aggregates `pass` per spec section 3.5. **The local proof exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** |
 
 ## How to run the probes
 
@@ -105,9 +105,9 @@ Induced-failure switches:
 
 The real-account smoke needs `CI_HAS_CLOUDFLARE_ACCOUNT=true` plus
 the paired `CF_ACCOUNT_ID` and `CF_API_TOKEN` env vars. The fixture
-mints its own throwaway KV namespace under the H-2 prefix; no
+mints its own throwaway KV namespace under the throwaway prefix; no
 pre-provisioned namespace is required (the earlier `CF_KV_NAMESPACE_ID`
-gate is removed as of v1.1.0 per w-2026-09-08-dave-017). A test
+gate is removed as of v1.1.0). A test
 override `CF_API_BASE_URL` points the shim at a local mock CF REST
 API for local proof; the mock and its test lives under
 `packages/rcf-lite/test/fixtures/cf-platform/test/`.
@@ -127,11 +127,8 @@ API for local proof; the mock and its test lives under
   rather than gating on an `elicitedNonEmpty` predicate for
   `kv-binding-name`; the loader's `validateElicits` accepts only
   `requiresCapability` on the `when` block today. The guide teaches
-  the pattern; a loader-capability uplift extending
-  `validateElicits` to accept an `elicitedNonEmpty` predicate is
-  captured as follow-up work item
-  `w-2026-09-08-h3-loader-elicit-when-predicates` (0.26.x capability
-  change, out of H-2's 0.25.x patch scope per Dave ruling 1).
+  the pattern; supporting the predicate requires the loader to
+  accept an `elicitedNonEmpty` clause on the `when` block.
 
 ## Companion suggestions
 
@@ -181,7 +178,6 @@ namespace. The blueprint contribution IDs are namespaced
 `platform-cloudflare-kv-US-31101..31108` per the shelf-wide
 id-band registry. The prior chain-slice pointer
 paragraph cited a defunct earlier id band that never became chain
-rows on this repo; that citation was removed in the H-2
-(h2-cf-platform-probe-integrity) train per Dave ruling 4
+rows on this repo; that citation was removed in the probe-integrity pass
 (2026-09-08 relay 582c2bca): the earlier band was not resurrected
 and every kv probe result now cites the shipped `AC-31xxx` band.