rcf-lite 0.26.0 → 0.28.0

package/blueprints/platform-cloudflare-kv/blueprint.json

@@ -1,8 +1,10 @@
 {
   "slug": "platform-cloudflare-kv",
-  "version": "1.0.2",
+  "version": "1.1.4",
   "category": "platform",
-  "capabilities": ["keyValueStore"],
+  "capabilities": [
+    "keyValueStore"
+  ],
   "suggestedCompanions": [
     {
       "role": "logging",
@@ -36,27 +38,119 @@
       "id": "kv-key-naming-convention",
       "prompt": "Key naming convention: prefixed (domain prefix like users/, flags/) or flat (per ADR-3203; recommended default prefixed)",
       "kind": "enum",
-      "options": ["prefixed", "flat"],
+      "options": [
+        "prefixed",
+        "flat"
+      ],
       "default": "prefixed"
     }
   ],
   "contributions": [
-    { "id": "platform-cloudflare-kv-REQ-001", "kind": "req", "path": "requirements/platform-cloudflare-kv-req-001.json" },
-    { "id": "platform-cloudflare-kv-REQ-002", "kind": "req", "path": "requirements/platform-cloudflare-kv-req-002.json" },
-    { "id": "platform-cloudflare-kv-REQ-003", "kind": "req", "path": "requirements/platform-cloudflare-kv-req-003.json" },
-    { "id": "platform-cloudflare-kv-REQ-004", "kind": "req", "path": "requirements/platform-cloudflare-kv-req-004.json" },
-    { "id": "platform-cloudflare-kv-REQ-005", "kind": "req", "path": "requirements/platform-cloudflare-kv-req-005.json" },
-    { "id": "platform-cloudflare-kv-US-31101", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31101.json" },
-    { "id": "platform-cloudflare-kv-US-31102", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31102.json" },
-    { "id": "platform-cloudflare-kv-US-31103", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31103.json" },
-    { "id": "platform-cloudflare-kv-US-31104", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31104.json" },
-    { "id": "platform-cloudflare-kv-US-31105", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31105.json" },
-    { "id": "platform-cloudflare-kv-US-31106", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31106.json" },
-    { "id": "platform-cloudflare-kv-US-31107", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31107.json" },
-    { "id": "platform-cloudflare-kv-US-31108", "kind": "us", "path": "user-stories/platform-cloudflare-kv-us-31108.json" },
-    { "id": "TAC-3201-platform-cloudflare-kv-facade", "kind": "tac", "path": "tacs/tac-3201-platform-cloudflare-kv-facade.json" },
-    { "id": "TAC-3202-platform-cloudflare-kv-cache-aside", "kind": "tac", "path": "tacs/tac-3202-platform-cloudflare-kv-cache-aside.json" },
-    { "id": "TAC-3203-platform-cloudflare-kv-event-sink", "kind": "tac", "path": "tacs/tac-3203-platform-cloudflare-kv-event-sink.json" },
+    {
+      "id": "platform-cloudflare-kv-REQ-001",
+      "kind": "req",
+      "path": "requirements/platform-cloudflare-kv-req-001.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-REQ-002",
+      "kind": "req",
+      "path": "requirements/platform-cloudflare-kv-req-002.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-REQ-003",
+      "kind": "req",
+      "path": "requirements/platform-cloudflare-kv-req-003.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-REQ-004",
+      "kind": "req",
+      "path": "requirements/platform-cloudflare-kv-req-004.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-REQ-005",
+      "kind": "req",
+      "path": "requirements/platform-cloudflare-kv-req-005.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-REQ-006",
+      "kind": "req",
+      "path": "requirements/platform-cloudflare-kv-req-006.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-REQ-007",
+      "kind": "req",
+      "path": "requirements/platform-cloudflare-kv-req-007.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31101",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31101.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31102",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31102.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31103",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31103.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31104",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31104.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31105",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31105.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31106",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31106.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31107",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31107.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31108",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31108.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31109",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31109.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31110",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31110.json"
+    },
+    {
+      "id": "platform-cloudflare-kv-US-31111",
+      "kind": "us",
+      "path": "user-stories/platform-cloudflare-kv-us-31111.json"
+    },
+    {
+      "id": "TAC-3201-platform-cloudflare-kv-facade",
+      "kind": "tac",
+      "path": "tacs/tac-3201-platform-cloudflare-kv-facade.json"
+    },
+    {
+      "id": "TAC-3202-platform-cloudflare-kv-cache-aside",
+      "kind": "tac",
+      "path": "tacs/tac-3202-platform-cloudflare-kv-cache-aside.json"
+    },
+    {
+      "id": "TAC-3203-platform-cloudflare-kv-event-sink",
+      "kind": "tac",
+      "path": "tacs/tac-3203-platform-cloudflare-kv-event-sink.json"
+    },
     {
       "id": "ADR-3201-platform-cloudflare-kv-key-value-store-contract",
       "kind": "adr",
@@ -83,5 +177,6 @@
       "elicited": true,
       "standardsTraceClause": "generic enterprise practice"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-12T00:00:00.000Z"
 }

package/blueprints/platform-cloudflare-kv/contributions/adrs/adr-3201-platform-cloudflare-kv-key-value-store-contract.json

@@ -5,10 +5,10 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Key-value store contract: Cloudflare Workers KV as the shipped shape (scope global, new topic keyValueStoreContract)",
-  "context": "An applying Workers project has one native key-value store answer today: Cloudflare Workers KV. The binding is declared through wrangler configuration ([[kv_namespaces]] with binding, id and preview_id) and the shipped runtime binds env.<binding> to an object with get, getWithMetadata, put, delete and list per https://developers.cloudflare.com/kv/api/. KV is eventually consistent: a write may not appear on a global read within the same request, and changes may take up to 60 seconds or more to be visible in other network locations as their cached versions time out (https://developers.cloudflare.com/kv/concepts/how-kv-works/). The v1.0.0 facade must hold the adapter reference opaque at the facade boundary so a future non-Cloudflare adapter or an in-memory adapter for tests slots in without a facade re-shape, and so the round-6 Durable Objects sibling (T-3) is the shipped answer for strong-consistency needs.",
+  "context": "An applying Workers project has one native key-value store answer today: Cloudflare Workers KV. The binding is declared through wrangler configuration ([[kv_namespaces]] with binding, id and preview_id) and the shipped runtime binds env.<binding> to an object with get, getWithMetadata, put, delete and list per https://developers.cloudflare.com/kv/api/. KV is eventually consistent: a write may not appear on a global read within the same request, and changes may take up to 60 seconds or more to be visible in other network locations as their cached versions time out (https://developers.cloudflare.com/kv/concepts/how-kv-works/). The v1.0.0 facade must hold the adapter reference opaque at the facade boundary so a future non-Cloudflare adapter or an in-memory adapter for tests slots in without a facade re-shape, and so the Durable Objects sibling is the shipped answer for strong-consistency needs.",
   "decision": "The shipped v1.0.0 default is Cloudflare Workers KV, wired through wrangler config ([[kv_namespaces]] with binding, id and preview_id) per https://developers.cloudflare.com/kv/. The facade module (TAC-3201) is the sole holder of the KV binding reference per REQ-001. The keyValueStoreContract topic scope is global on this blueprint; the topic string is keyValueStoreContract (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). A future non-KV adapter (a Redis-shape store, a strong-consistency DO cell for a single-owner use case) would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR per the round-2 conflict pattern.",
-  "consequences": "The applying project inherits Workers KV wire-format, the platform-assigned per-namespace limits (https://developers.cloudflare.com/kv/platform/limits/) and the documented eventual-consistency semantics. Standards trace clause: Cloudflare Workers KV documented consistency model (per https://developers.cloudflare.com/kv/concepts/how-kv-works/). Consumer code needing strong-consistency semantics reaches for the round-6 T-3 platform-cloudflare-durable-objects sibling instead; the guide carries the decision-tree cross-reference.",
+  "consequences": "The applying project inherits Workers KV wire-format, the platform-assigned per-namespace limits (https://developers.cloudflare.com/kv/platform/limits/) and the documented eventual-consistency semantics. Standards trace clause: Cloudflare Workers KV documented consistency model (per https://developers.cloudflare.com/kv/concepts/how-kv-works/). Consumer code needing strong-consistency semantics reaches for the platform-cloudflare-durable-objects sibling instead; the guide carries the decision-tree cross-reference.",
   "alternativesConsidered": [],
   "createdAt": "2026-09-07T10:28:32.000Z",
-  "updatedAt": "2026-09-07T10:28:32.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z"
 }

package/blueprints/platform-cloudflare-kv/contributions/probes/cache-aside-hit-then-miss.mjs

@@ -13,7 +13,7 @@
 //
 // The mutation-run that disables the writeback path (put becomes a
 // no-op so the second read misses the cache and re-invokes origin)
-// is provided by the fixture-side H-2 shim (h2-cf-kv-cache-aside-
+// is provided by the fixture-side shim (h2-cf-kv-cache-aside-
 // shim.mjs, reads cache-miss internally); the probe body
 // holds no mutation-switch read of its own (AC-15401-1 mutation-purity
 // rule, brief section 5).

package/blueprints/platform-cloudflare-kv/contributions/probes/event-secrecy.mjs

@@ -18,7 +18,7 @@
 //
 // The mutation-run that swaps the shipped sink for one that
 // forwards the body / userId / ssn onto every record is provided
-// by the fixture-side H-2 shim (h2-cf-kv-event-secrecy-shim.mjs,
+// by the fixture-side shim (h2-cf-kv-event-secrecy-shim.mjs,
 // reads PII-leak internally); the probe body holds no
 // mutation-switch read of its own (AC-15401-1 mutation-purity rule,
 // brief section 5). A reviewer running with the switch off gets

package/blueprints/platform-cloudflare-kv/contributions/probes/real-account-eventual-consistency-smoke.mjs

@@ -7,8 +7,8 @@
 // 60 seconds bounded (poll every 2s) for the same-region read to see
 // the write, then deletes the key AND destroys the scratch namespace.
 // Positive evidence captured: the CF-assigned namespace id, the exact
-// scratch title used (H-2 prefix "h2-cf-probe-integrity-scratch-kv-"),
-// the scratch key (H-2 prefix "h2-storage-smoke-"), elapsed milli-
+// scratch title used (throwaway prefix "h2-cf-probe-integrity-scratch-kv-"),
+// the scratch key (throwaway prefix "h2-storage-smoke-"), elapsed milli-
 // seconds to first same-region visibility, and the PUT status code.
 // The teardown is fail-safe: a mid-run crash surfaces the scratch id
 // through the shim's persisted record; the shim's sweepOrphans entry
@@ -32,14 +32,14 @@
 // re-covering AC-31103-1 (facade put then get returns the same bytes
 // with paired kvWrite / kvHit events on the shipped binding contract).
 //
-// Local-proof scope (Dave ruling 376b4f30): the local test harness
+// Local-proof scope: the local test harness
 // under packages/rcf-lite/test/fixtures/cf-platform/test/ is a mock
 // of Cloudflare's REST contract, not the wire. The local run
 // exercises OUR lifecycle logic against a mock of Cloudflare's
 // contract; the real-account gate is the only surface that proves
 // the wire format. This probe is never described as "locally
 // verified" - the local runs are our own lifecycle-logic proof;
-// wire correctness is proven at the HQ real-account gate.
+// wire correctness is proven at the real-account gate.
 
 import {
   mintScratchNamespace, destroyScratchNamespace,
@@ -53,16 +53,18 @@ export const accountBound = true;
 const CAP_MS = 60_000;
 const POLL_INTERVAL_MS = 2_000;
 
-function skipResult(detail) {
+function skipResult(detail, reason) {
   return {
     results: [{
       anchorAcId: 'AC-31103-1',
       verdict: 'pass',
       detail,
       accountBoundSkipped: true,
+      reason,
     }],
     extra: {
       accountBoundSkipped: true,
+      reason,
       envDeclared: Array.from(DECLARED_ENV),
       throwawayPrefixes: { namespaceTitle: NAMESPACE_PREFIX, kvKey: KEY_PREFIX },
     },
@@ -70,17 +72,35 @@ function skipResult(detail) {
 }
 
 export default async function runProbe() {
+  // Positive-evidence rule (authoring standard section 7d): the skip
+  // record names the exact env var(s) that were unset in `reason`, so
+  // a `pass` verdict on the skip path is legal without positive
+  // evidence.
   if (process.env.CI_HAS_CLOUDFLARE_ACCOUNT !== 'true') {
-    return skipResult('accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT is not set to true; spec section 3.5 pass-with-skip. Declared env for a live run: CI_HAS_CLOUDFLARE_ACCOUNT + CF_ACCOUNT_ID + CF_API_TOKEN (CF_API_BASE_URL optional test override).');
+    return skipResult(
+      'accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT is not set to true; spec section 3.5 pass-with-skip.',
+      'CI_HAS_CLOUDFLARE_ACCOUNT',
+    );
   }
+  // Discrete skip shape on every missing-environment branch: missing
+  // required configuration is a skip (the probe did not execute),
+  // named exactly by the unset variables in `reason`.
   if (!process.env.CF_ACCOUNT_ID || !process.env.CF_API_TOKEN) {
+    const unset = [];
+    if (!process.env.CF_ACCOUNT_ID) unset.push('CF_ACCOUNT_ID');
+    if (!process.env.CF_API_TOKEN) unset.push('CF_API_TOKEN');
+    const reason = unset.join(', ');
     return {
       results: [{
         anchorAcId: 'AC-31103-1',
-        verdict: 'fail',
-        detail: `CI_HAS_CLOUDFLARE_ACCOUNT=true but one of CF_ACCOUNT_ID / CF_API_TOKEN is missing: accountIdPresent=${!!process.env.CF_ACCOUNT_ID} tokenPresent=${!!process.env.CF_API_TOKEN}.`,
+        verdict: 'pass',
+        accountBoundSkipped: true,
+        reason,
+        detail: `accountBoundSkipped: ${reason} unset; the probe did not execute against a real KV namespace. Set the missing keys and re-run.`,
       }],
       extra: {
+        accountBoundSkipped: true,
+        reason,
         envDeclared: Array.from(DECLARED_ENV),
         throwawayPrefixes: { namespaceTitle: NAMESPACE_PREFIX, kvKey: KEY_PREFIX },
       },
@@ -114,6 +134,10 @@ export default async function runProbe() {
   evidence.key = key;
   evidence.valueSample = value;
 
+  // Result row is mutable through finally so teardown failures can
+  // flip the verdict; a live run that leaves an orphan must not pass.
+  const resultRow = { anchorAcId: 'AC-31103-1', verdict: 'fail', detail: '' };
+  let keyOrphaned = false;
   try {
     const put = await putScratchKey({ namespaceId: namespace.id, key, value });
     evidence.putStatus = put.status;
@@ -141,26 +165,37 @@ export default async function runProbe() {
       evidence.deleteStatus = del.status;
     } catch (err) {
       evidence.deleteError = err.message;
+      keyOrphaned = true;
     }
 
     const pass = observed === value;
-    return {
-      results: [{
-        anchorAcId: 'AC-31103-1',
-        verdict: pass ? 'pass' : 'fail',
-        detail: pass
-          ? `real-account KV eventual-consistency: mint namespace ${namespace.id} (${namespace.title}); PUT key ${key} (status ${evidence.putStatus}); write eventually appeared on same-region GET within elapsed=${elapsed}ms (CAP=${CAP_MS}ms); DELETE key (status ${evidence.deleteStatus ?? 'unset'}); namespace destroyed on teardown.`
-          : `real-account KV eventual-consistency: mint namespace ${namespace.id} (${namespace.title}); PUT key ${key} (status ${evidence.putStatus}); write did NOT appear within CAP=${CAP_MS}ms; elapsed=${elapsed}ms.`,
-      }],
-      extra: evidence,
-    };
+    resultRow.verdict = pass ? 'pass' : 'fail';
+    resultRow.detail = pass
+      ? `real-account KV eventual-consistency: mint namespace ${namespace.id} (${namespace.title}); PUT key ${key} (status ${evidence.putStatus}); write eventually appeared on same-region GET within elapsed=${elapsed}ms (CAP=${CAP_MS}ms); DELETE key (status ${evidence.deleteStatus ?? 'unset'}).`
+      : `real-account KV eventual-consistency: mint namespace ${namespace.id} (${namespace.title}); PUT key ${key} (status ${evidence.putStatus}); write did NOT appear within CAP=${CAP_MS}ms; elapsed=${elapsed}ms.`;
   } finally {
     try {
       const teardown = await destroyScratchNamespace(namespace);
       evidence.namespaceDestroyed = teardown.destroyed;
     } catch (err) {
       evidence.teardownError = err.message;
+      evidence.orphanNamespaceId = namespace && namespace.id;
+      evidence.orphanNamespaceTitle = namespace && namespace.title;
       process.stderr.write(`h2-cf-kv probe: teardown failed for namespace ${namespace && namespace.id}: ${err.message}; sweepOrphans will collect on next run.\n`);
+      // Teardown discipline: an orphaned namespace flips the verdict
+      // to fail-with-orphan, regardless of whether the round-trip
+      // itself passed.
+      resultRow.verdict = 'fail';
+      const previous = resultRow.detail ? resultRow.detail + ' ' : '';
+      resultRow.detail = `${previous}TEARDOWN FAILED leaving orphan namespace ${namespace && namespace.id} (${namespace && namespace.title}): ${err.message}. sweepOrphans will collect on next run; this run is FAIL-WITH-ORPHAN.`;
     }
   }
+  // Key-orphan escalation: if the per-key DELETE failed but the
+  // namespace teardown succeeded, the key is gone with the namespace
+  // and there is no residual orphan. If the namespace teardown also
+  // failed, the block above already flipped the verdict. So the
+  // key-only orphan surfaces only when the namespace destroy also
+  // threw; keep the flag on evidence for the reader.
+  evidence.keyOrphanedInsideNamespace = keyOrphaned;
+  return { results: [resultRow], extra: evidence };
 }

package/blueprints/platform-cloudflare-kv/contributions/requirements/platform-cloudflare-kv-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "platform-cloudflare-kv-REQ-001",
   "prdId": "PRD-001",
   "title": "The KV facade module is the sole reader of the KV binding and opens on boot with facadeReady",
-  "description": "The applying project reaches Cloudflare Workers KV through a single facade module in the project source tree that is the ONLY module holding a reference to env.<binding> (env.CACHE in the cf-platform fixture; the elicited binding name in a real project). Every other module that touches KV imports the facade and calls its typed domain verbs (get, getWithMetadata, put, delete, list); no other module dereferences the raw KV binding. On process boot, the facade opens against the bound namespace via a bounded list(limit:1) ready-check and, once ready, emits a facadeReady lifecycle event on the injected event sink. The binding name is elicited at apply time and the elicited answer is written into wrangler.toml under [[kv_namespaces]] binding = \"<name>\" per https://developers.cloudflare.com/kv/api/.",
+  "description": "The applying project reaches Cloudflare Workers KV through a single facade module in the project source tree that is the ONLY module holding a reference to env.<binding> (env.CACHE in the cf-platform fixture; the elicited binding name in a real project). Every other module that touches KV imports the facade and calls its typed domain verbs (get, getWithMetadata, put, delete, list); no other module dereferences the raw KV binding. On process boot, the facade opens against the bound namespace via a bounded list(limit:1) ready-check and, once ready, emits a facadeReady lifecycle event on the injected event sink. The binding name is elicited at apply time and the elicited answer is written into wrangler.toml under [[kv_namespaces]] binding = \"<name>\" per https://developers.cloudflare.com/kv/api/. The blueprint declares the keyValueStore capability token: a consumer blueprint that reads the applied capability set MUST (must) find the facade wired here as the sole KV binding reader before selecting keyValueStore.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T10:26:28.000Z",
-  "updatedAt": "2026-09-07T10:26:28.000Z"
+  "updatedAt": "2026-09-09T20:35:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+    "field": "responsibilities.facadeReady"
+  }
 }

package/blueprints/platform-cloudflare-kv/contributions/requirements/platform-cloudflare-kv-req-002.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T10:26:28.000Z",
-  "updatedAt": "2026-09-07T10:26:28.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+    "field": "responsibilities.verbs"
+  }
 }

package/blueprints/platform-cloudflare-kv/contributions/requirements/platform-cloudflare-kv-req-003.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T10:26:28.000Z",
-  "updatedAt": "2026-09-07T10:26:28.000Z"
+  "updatedAt": "2026-09-09T20:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3202-platform-cloudflare-kv-cache-aside",
+    "field": "responsibilities.ttl"
+  }
 }

package/blueprints/platform-cloudflare-kv/contributions/requirements/platform-cloudflare-kv-req-004.json

@@ -2,7 +2,7 @@
   "reqId": "platform-cloudflare-kv-REQ-004",
   "prdId": "PRD-001",
   "title": "Lifecycle events facadeReady kvHit kvMiss kvWrite carry metadata-only fields key size ttl timestamp",
-  "description": "The facade emits four lifecycle events on the injected sink: facadeReady once on the first ready-check resolving; kvHit on a get returning a non-null value; kvMiss on a get returning null; kvWrite on put and on delete. Every event record carries EXACTLY the whitelist {event, key, size, ttl, timestamp} and NOTHING else: no body bytes, no metadata pass-through, no user id beyond the key itself. The event-secrecy probe drives this at mechanism reach with a PII fixture body and asserts the whitelist under both the shipped code path and a mutation-run.",
+  "description": "The facade emits four lifecycle events on the injected sink: facadeReady once on the first ready-check resolving; kvHit on a get returning a non-null value; kvMiss on a get returning null; kvWrite on put and on delete. Every event record carries EXACTLY the metadata-only whitelist named on `TAC-3203-platform-cloudflare-kv-event-sink.purpose` (event-record whitelist) and NOTHING else: no body bytes, no metadata pass-through, no user id beyond the key the TAC owner names. The event-secrecy probe drives this at mechanism reach with a PII fixture body and asserts the whitelist under both the shipped code path and a mutation-run.",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T10:26:28.000Z",
-  "updatedAt": "2026-09-07T10:26:28.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3203-platform-cloudflare-kv-event-sink",
+    "field": "responsibilities.whitelist"
+  }
 }

package/blueprints/platform-cloudflare-kv/contributions/requirements/platform-cloudflare-kv-req-005.json

@@ -1,8 +1,8 @@
 {
   "reqId": "platform-cloudflare-kv-REQ-005",
   "prdId": "PRD-001",
-  "title": "Eventual-consistency note in the guide: a write may not appear on a global read within the same request and the elicited TTL sets the staleness ceiling",
-  "description": "Workers KV is eventually consistent per https://developers.cloudflare.com/kv/concepts/how-kv-works/. The guide surfaces the note (a write may not appear on a global read within the same request; changes may take up to 60 seconds or more to be visible in other network locations as cached versions time out) and states that the elicited cache-aside TTL (default 60 seconds per Cloudflare-documented cache TTL default) sets the staleness ceiling readers observe. The guide also carries a decision-tree cross-reference to platform-cloudflare-durable-objects (round-6 T-3) for cases needing stronger-consistency semantics; DO is the shipped answer when a key must have exactly one owner and every read must reflect the most recent write.",
+  "title": "The applied cache-aside TTL bounds LOCAL read staleness; Workers KV eventual consistency is a separate clock the guide names",
+  "description": "Workers KV is eventually consistent per https://developers.cloudflare.com/kv/concepts/how-kv-works/: a write may not appear on a global read within the same request and changes may take up to 60 seconds or more to be visible in other network locations as cached versions time out. That vendor-owned propagation window is a separate clock from the applied cache-aside TTL. The elicited cache-aside TTL (default 60 seconds per ADR-3202) bounds the LOCAL cache-aside layer only: a fresh origin fetch replaces the local entry, and the local entry expires after the TTL. It does NOT set a global staleness ceiling readers on other network locations observe. The guide surfaces the two clocks separately and carries a decision-tree cross-reference to platform-cloudflare-durable-objects for cases needing strong-consistency semantics (a key with one owner where every read must reflect the most recent write).",
   "category": "functional",
   "domain": "platform",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T10:26:28.000Z",
-  "updatedAt": "2026-09-07T10:26:28.000Z"
+  "updatedAt": "2026-09-09T20:20:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3202-platform-cloudflare-kv-cache-aside",
+    "field": "responsibilities.ttl"
+  }
 }

package/blueprints/platform-cloudflare-kv/contributions/requirements/platform-cloudflare-kv-req-006.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "platform-cloudflare-kv-REQ-006",
+  "prdId": "PRD-001",
+  "title": "The applied key naming convention is either prefixed (per-domain prefix like users/ or flags/) or flat; the elicited answer flows through the facade",
+  "description": "The applied project elicits a key naming convention per ADR-3203: prefixed (every key carries a per-domain prefix such as users/ or flags/ before the domain identifier) or flat (every key is written as authored, with no facade-side prefix step). Recommended default is prefixed. When prefixed, the facade transparently applies the elicited keyPrefix on every read and write so domain code sees prefix-free keys and the storage layer sees fully qualified keys; when flat, the facade passes keys through untouched. The elicited answer is recorded in rcf/blueprints/platform-cloudflare-kv.applied.json and the applied fixture must (must) route every put/get/delete/list call through the elicited branch.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Closes criterion a (section 7c) on the kv-key-naming-convention elicit; refuses the previously silent prefixed/flat option.",
+  "tags": [
+    "blueprint:platform-cloudflare-kv",
+    "category:006-key-naming"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T20:20:00.000Z",
+  "updatedAt": "2026-09-09T20:20:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+    "field": "responsibilities.keyPrefix"
+  }
+}

package/blueprints/platform-cloudflare-kv/contributions/requirements/platform-cloudflare-kv-req-007.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "platform-cloudflare-kv-REQ-007",
+  "prdId": "PRD-001",
+  "title": "Pre-ready operations serialise behind facadeReady; sink events emit in causal order",
+  "description": "Every facade verb call issued before facadeReady has fired MUST (must) serialise behind the ready-check: the facade queues the call and executes it only after ready() resolves, so no vendor put/get lands on an unbound binding. Every sink record emitted per operation (kvHit, kvMiss, kvWrite) MUST (must) reach the sink in the same order the facade emitted them, so a downstream logging companion observes causal ordering per key. A pre-ready call whose ready-check subsequently fails is rejected with a named error kind and no record reaches the sink.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "rationale": "Backs pre-ready operation serialisation (TAC-3201.responsibilities) and causal event ordering (TAC-3203.responsibilities), previously requirement-free (F-4).",
+  "tags": [
+    "blueprint:platform-cloudflare-kv",
+    "category:007-pre-ready-and-ordering"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T20:20:00.000Z",
+  "updatedAt": "2026-09-09T20:20:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+    "field": "responsibilities.facadeReady"
+  }
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31101.json

@@ -16,12 +16,69 @@
       "when": "the process boots and the facade ready() call resolves",
       "then": "a facadeReady event fires on the injected event sink with the metadata-only payload; the facade exposes named domain verbs only; the raw binding is not re-exported",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-31101-2",
+      "description": "F-7 binding-unbound at boot: createKvFacade({binding: undefined, sink}) throws a named error kind KV_BINDING_UNBOUND naming the missing binding argument before any operation runs; no facadeReady record lands on the sink. Same for binding omitted or explicitly null.",
+      "given": "a createKvFacade call whose binding argument is undefined",
+      "when": "the factory is invoked",
+      "then": "the factory throws KV_BINDING_UNBOUND naming the missing binding; no facadeReady emits",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "interfaces.default export"
+      }
+    },
+    {
+      "id": "AC-31101-3",
+      "description": "Invalid sink at boot: createKvFacade({binding, sink: null}) throws KV_FACADE_INVALID_SINK before the ready-check runs. Same for sink omitted or not a function.",
+      "given": "a createKvFacade call whose sink is not a function",
+      "when": "the factory is invoked",
+      "then": "the factory throws KV_FACADE_INVALID_SINK; no ready-check runs",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "interfaces.default export"
+      }
+    },
+    {
+      "id": "AC-31101-4",
+      "description": "Repeat-boot idempotency: two independent createKvFacade({binding, sink}).ready() calls against the same binding emit two facadeReady records on the sink, each with identical shape {event:\"facadeReady\", key:null, size:0, ttl:null, timestamp:<number>} and independent timestamps. No queue state leaks between facade instances.",
+      "given": "two independent createKvFacade instances against the same binding",
+      "when": "ready() is called on each",
+      "then": "the sink receives two facadeReady records with identical shape and independent timestamps",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "interfaces.default export"
+      }
+    },
+    {
+      "id": "AC-31101-5",
+      "description": "F-7 ready-check rejects: createKvFacade({binding, sink}) whose bounded ready-check (a list(limit:1) call against the binding) rejects rejects the returned ready() promise with a named error kind KV_FACADE_NOT_READY carrying the wrapped underlying error message. No facadeReady record lands on the sink; the facade instance is unusable (subsequent get/put reject with KV_FACADE_NOT_READY per US-31111 AC-31111-2).",
+      "given": "a createKvFacade call whose binding.list(limit:1) rejects",
+      "when": "ready() is awaited",
+      "then": "ready() rejects with KV_FACADE_NOT_READY wrapping the underlying error; no facadeReady record emits",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "interfaces.default export"
+      }
     }
   ],
   "tacIds": [
     "TAC-3201-platform-cloudflare-kv-facade"
   ],
   "createdAt": "2026-09-07T10:27:19.000Z",
-  "updatedAt": "2026-09-07T10:27:19.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31102.json

@@ -16,12 +16,55 @@
       "when": "grep -rn env.CACHE walks the src/ tree",
       "then": "the search returns one file src/kv-facade.mjs and no other match",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-31102-2",
+      "description": "Non-facade module leaks: SIMULATE_NON_FACADE_KV_LEAK=true adds a scratch src/leak.mjs that dereferences env.CACHE directly (bypassing the facade). The grep-based scan surfaces the leak with the full relative path \"src/leak.mjs\" and returns aggregateVerdict:\"fail\" naming the leak.",
+      "given": "the cf-platform fixture with SIMULATE_NON_FACADE_KV_LEAK=true and a scratch src/leak.mjs",
+      "when": "the sole-reader scan walks the tree",
+      "then": "the scan reports src/leak.mjs as a leak; aggregateVerdict is \"fail\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "responsibilities.solereader"
+      }
+    },
+    {
+      "id": "AC-31102-3",
+      "description": "Comment-only mention: a JSDoc block or a line comment on any non-facade module that mentions env.CACHE (for documentation) does not trip the scan. The probe strips /* ... */ and // ... comments before matching. A synthetic file with only a commented mention returns zero leaks.",
+      "given": "a scratch src/notes.mjs whose only env.CACHE mention is inside a JSDoc block",
+      "when": "the sole-reader scan walks the tree",
+      "then": "the file is not reported as a leak",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "responsibilities.solereader"
+      }
+    },
+    {
+      "id": "AC-31102-4",
+      "description": "Nested-directory recursion: a leak at a nested path (src/deep/inner/kv-leak.mjs) with a real env.CACHE dereference is caught. The scan walks recursively and reports the full relative path.",
+      "given": "a scratch src/deep/inner/kv-leak.mjs carrying env.CACHE.get(...)",
+      "when": "the sole-reader scan walks the tree",
+      "then": "the scan reports src/deep/inner/kv-leak.mjs and returns aggregateVerdict \"fail\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3201-platform-cloudflare-kv-facade",
+        "field": "responsibilities.solereader"
+      }
     }
   ],
   "tacIds": [
     "TAC-3201-platform-cloudflare-kv-facade"
   ],
   "createdAt": "2026-09-07T10:27:19.000Z",
-  "updatedAt": "2026-09-07T10:27:19.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }