rcf-lite 0.27.0 → 0.28.0

package/blueprints/persistence-data-d1/contributions/probes/real-account-d1-round-trip.mjs

@@ -0,0 +1,133 @@
+// Real-account D1 round-trip probe for persistence-data-d1.
+//
+// Live branch: creates a scratch D1 database via the Cloudflare REST
+// API, exercises CREATE TABLE + INSERT + SELECT + DELETE, then
+// deletes the database and inventories to confirm absence. This
+// observes vendor-side reachability and API contract but does NOT
+// observe AC-13101-1's "the facade module is the sole reader of the
+// D1 binding" import-graph property (the probe calls raw REST, not
+// through a project facade). Every live row is de-claimed
+// (conformanceOnly, anchorAcId=null) with the limitation naming
+// AC-13101-1. The retained observation is the live create/insert/
+// query/delete/inventory round-trip against real Cloudflare D1.
+//
+// Skip contract: CI_HAS_CLOUDFLARE_ACCOUNT unset -> one skip row;
+// then CF_ACCOUNT_ID and CF_API_TOKEN checked one variable per row.
+// Auth failure with credentials PRESENT is FAIL, never a passing skip.
+export const anchorAcId = 'AC-13101-1';
+export const accountBound = true;
+const LIM_13101_1 = `AC-13101-1: requires exactly one source-tree module to read the D1 binding from the Worker env. Raw Cloudflare REST CRUD from a probe is a vendor-reachability observation, not evidence of the source-tree sole-reader property.`;
+
+const API = 'https://api.cloudflare.com/client/v4';
+const NAME_PREFIX = 'qa-e-d1-';
+function shortId() { return Math.random().toString(36).slice(2, 8); }
+function skipRow(reason, detail) { return { anchorAcId: null, accountBoundSkipped: true, reason, verdict: 'pass', detail, evidence: { reason, declared: 'gate variable' } }; }
+function commonExtra(base = {}) { return { envDeclared: ['CI_HAS_CLOUDFLARE_ACCOUNT', 'CF_ACCOUNT_ID', 'CF_API_TOKEN'], vendorFact: { url: 'https://developers.cloudflare.com/api/operations/cloudflare-d1-list-databases', verifiedOn: '2026-09-11' }, namePrefix: NAME_PREFIX, ...base }; }
+async function cf(path, opts = {}) {
+  const res = await fetch(`${API}${path}`, { ...opts, headers: { Authorization: `Bearer ${process.env.CF_API_TOKEN}`, 'Content-Type': 'application/json', ...(opts.headers ?? {}) } });
+  const body = await res.json().catch(() => ({}));
+  return { status: res.status, requestId: res.headers.get('cf-ray') || res.headers.get('x-request-id'), body };
+}
+function isAuthFailure(status, body) {
+  if (status === 401 || status === 403) return true;
+  const errs = body?.errors;
+  if (Array.isArray(errs)) return errs.some((e) => e.code === 10000 || e.code === 9109 || e.code === 6003);
+  return false;
+}
+
+export default async function runProbe() {
+  if (process.env.CI_HAS_CLOUDFLARE_ACCOUNT !== 'true') {
+    return { results: [skipRow('CI_HAS_CLOUDFLARE_ACCOUNT', `accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT not set to true; the probe did not make any live call.`)], extra: commonExtra({ accountBoundSkipped: true, reason: 'CI_HAS_CLOUDFLARE_ACCOUNT' }) };
+  }
+  const skipRows = [];
+  if (!process.env.CF_ACCOUNT_ID) skipRows.push(skipRow('CF_ACCOUNT_ID', `accountBoundSkipped: CF_ACCOUNT_ID unset.`));
+  if (!process.env.CF_API_TOKEN) skipRows.push(skipRow('CF_API_TOKEN', `accountBoundSkipped: CF_API_TOKEN unset.`));
+  if (skipRows.length) return { results: skipRows, extra: commonExtra({ accountBoundSkipped: true }) };
+
+  const accountId = process.env.CF_ACCOUNT_ID;
+  const name = NAME_PREFIX + shortId();
+  const results = [];
+  const evidence = { namePrefix: NAME_PREFIX, mintedName: name };
+
+  const create = await cf(`/accounts/${accountId}/d1/database`, { method: 'POST', body: JSON.stringify({ name }) });
+  evidence.createStatus = create.status;
+  evidence.createRequestId = create.requestId;
+  evidence.createErrors = create.body?.errors ?? null;
+  if (isAuthFailure(create.status, create.body)) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_13101_1,
+      verdict: 'fail',
+      detail: `observed D1 create refused as auth failure with credentials PRESENT: status=${create.status} errors=${JSON.stringify(create.body?.errors)}. Gate CI_HAS_CLOUDFLARE_ACCOUNT is set; auth failure is not a legal skip.`,
+      evidence: { createStatus: create.status, createRequestId: create.requestId, createErrors: create.body?.errors ?? null, bodyExcerpt: `authFail status=${create.status}` },
+    });
+    return { results, extra: commonExtra(evidence) };
+  }
+  if (!create.body?.success) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_13101_1,
+      verdict: 'fail',
+      detail: `observed D1 create failed status=${create.status} errors=${JSON.stringify(create.body?.errors)}.`,
+      evidence: { createStatus: create.status, createRequestId: create.requestId, createErrors: create.body?.errors ?? null, bodyExcerpt: `createFail status=${create.status}` },
+    });
+    return { results, extra: commonExtra(evidence) };
+  }
+  const dbId = create.body.result.uuid;
+  evidence.databaseUuid = dbId;
+  // Row records only what the create call proves: database with uuid,
+  // status, request id. The `presentAfterDelete` field is set only by
+  // the teardown row after delete + inventory.
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_13101_1,
+    verdict: 'pass',
+    detail: `observed real D1 database created uuid=${dbId} name=${name} createStatus=${create.status} requestId=${create.requestId} via POST /accounts/{id}/d1/database.`,
+    evidence: { databaseUuid: dbId, createStatus: create.status, createRequestId: create.requestId, bodyExcerpt: `create uuid=${dbId} status=${create.status}` },
+  });
+
+  let queryResp;
+  try {
+    await cf(`/accounts/${accountId}/d1/database/${dbId}/query`, { method: 'POST', body: JSON.stringify({ sql: 'CREATE TABLE probe_items (id INTEGER PRIMARY KEY, name TEXT NOT NULL)' }) });
+    await cf(`/accounts/${accountId}/d1/database/${dbId}/query`, { method: 'POST', body: JSON.stringify({ sql: `INSERT INTO probe_items (name) VALUES ('probe-${dbId.slice(0, 6)}')` }) });
+    queryResp = await cf(`/accounts/${accountId}/d1/database/${dbId}/query`, { method: 'POST', body: JSON.stringify({ sql: 'SELECT COUNT(*) AS n FROM probe_items' }) });
+    const count = queryResp.body?.result?.[0]?.results?.[0]?.n;
+    evidence.queryStatus = queryResp.status;
+    evidence.queryRequestId = queryResp.requestId;
+    evidence.selectCount = count;
+    evidence.queryBodyExcerpt = JSON.stringify(queryResp.body).slice(0, 400);
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_13101_1,
+      verdict: queryResp.status === 200 && count === 1 ? 'pass' : 'fail',
+      detail: `observed CREATE TABLE + INSERT + SELECT round-trip on real D1 uuid=${dbId}; query status=${queryResp.status} requestId=${queryResp.requestId} count=${count} via POST /accounts/{id}/d1/database/{uuid}/query.`,
+      evidence: { databaseUuid: dbId, queryStatus: queryResp.status, requestId: queryResp.requestId, queryRequestId: queryResp.requestId, selectedCount: count, bodyExcerpt: JSON.stringify(queryResp.body).slice(0, 400), queryBodyExcerpt: JSON.stringify(queryResp.body).slice(0, 400) },
+    });
+  } finally {
+    const del = await cf(`/accounts/${accountId}/d1/database/${dbId}`, { method: 'DELETE' });
+    evidence.deleteStatus = del.status;
+    evidence.deleteRequestId = del.requestId;
+    const list = await cf(`/accounts/${accountId}/d1/database?per_page=1000`);
+    evidence.inventoryStatus = list.status;
+    evidence.inventoryRequestId = list.requestId;
+    const inventoryRows = Array.isArray(list.body?.result) ? list.body.result : [];
+    evidence.inventoryCount = inventoryRows.length;
+    evidence.inventoryUuidsExcerpt = inventoryRows.slice(0, 10).map((db) => db.uuid);
+    const stillPresent = inventoryRows.some((db) => db.uuid === dbId);
+    evidence.presentAfterDelete = stillPresent;
+    evidence.absentFromInventory = list.status === 200 && !stillPresent;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_13101_1,
+      verdict: del.status === 200 && list.status === 200 && !stillPresent ? 'pass' : 'fail',
+      detail: `observed DELETE uuid=${dbId} -> ${del.status}; inventory GET -> ${list.status}; presentAfterDelete=${stillPresent} (absence-in-inventory diff shape confirms the create was real).`,
+      evidence: { databaseUuid: dbId, deleteStatus: del.status, deleteRequestId: del.requestId, inventoryStatus: list.status, inventoryRequestId: list.requestId, inventoryCount: inventoryRows.length, presentAfterDelete: stillPresent, bodyExcerpt: `delete status=${del.status} inventory count=${inventoryRows.length} presentAfterDelete=${stillPresent}` },
+    });
+  }
+  return { results, extra: commonExtra(evidence) };
+}

package/blueprints/persistence-data-d1/contributions/probes/run-facade-round-trip.mjs

@@ -0,0 +1,3 @@
+import runProbe from './facade-round-trip.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('facade-round-trip', { kind: 'd1', driver: 'sqlite-backed D1 binding mock (node:sqlite)', healthy: true }, runProbe);

package/blueprints/persistence-data-d1/contributions/probes/run-migrations-forward-only.mjs

@@ -0,0 +1,3 @@
+import runProbe from './migrations-forward-only.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('migrations-forward-only', { kind: 'd1', driver: 'sqlite-backed D1 binding mock (node:sqlite)', healthy: true }, runProbe);

package/blueprints/persistence-data-d1/contributions/probes/run-real-account-d1-round-trip.mjs

@@ -0,0 +1,3 @@
+import runProbe from './real-account-d1-round-trip.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('real-account-d1-round-trip', { kind: 'd1', driver: 'Cloudflare D1 REST API (live)', healthy: true }, runProbe);

package/blueprints/persistence-data-d1/docs/topics.md

@@ -17,7 +17,7 @@ Rules for new topics (inherited from the application-spa, application-api-rest,
 
 ## Id number bands (registry bootstrap)
 
-AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is ratified policy (2026-08-19); this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
+AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is policy; this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
 
 This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
 
@@ -62,8 +62,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 13101-13107 sit at the LOW end of the 13101-13899 band on purpose. A project-side story that mechanically derives from a persistence-data-d1 REQ id into the number `13107` would collide against persistence-data-d1-US-13107 in this package; the band leaves headroom at the HIGH end (US 13181-13899) so a project's own stories anchored to persistence-data-d1 REQs can allocate without conflict. The watchpost run4 lesson applies here too.
-
+US 13101-13107 sit at the LOW end of the 13101-13899 band on purpose. A project-side story that mechanically derives from a persistence-data-d1 REQ id into the number `13107` would collide against persistence-data-d1-US-13107 in this package; the band leaves headroom at the HIGH end (US 13181-13899) so a project's own stories anchored to persistence-data-d1 REQs can allocate without conflict.
 ADR and TAC suffixes for this blueprint use the 1401-1499 block, continuing the four-digit widening opened by security-auth-clerk at 1001-1099 (security-auth-clerk topics.md notes that the three-digit space fills at 9xx and forthcoming blueprints continue widening at 1101, 1201, 1301, and now 1401). Sibling round-2 blueprints (deploy-cloudflare-workers at 1301-1399, observability-probe-endpoints at 1501-1599) allocate on the same widening.
 
 ## Shared expectations for future composing blueprints

package/blueprints/persistence-data-postgres/CHANGELOG.md

@@ -1,5 +1,85 @@
 # Changelog
 
+## 1.1.10 - 2026-09-12
+
+Retired development-only password literal removed from the CHANGELOG prose (no credential value in shipped source), the `docker run` invocation for the restore container switched to the pass-through `-e POSTGRES_PASSWORD` form so the value is taken from the spawned process environment and never enters argv, and the anatomy header comment now names the `STRICT_ID_KEYS` scalar-string witness rule the predicate actually enforces instead of the earlier witness list. Anatomy pin bumped to 1.1.10.
+
+- fix: `blueprints/persistence-data-postgres/CHANGELOG.md` 1.1.9 entry rewritten to describe the retired development-only password without naming its value; grep of the added-line diff finds zero credential-shaped literals.
+- fix: `blueprints/persistence-data-postgres/contributions/probes/recovery-restore-round-trip.mjs` `docker run` argument for the restore container uses the pass-through `-e POSTGRES_PASSWORD` form (variable name only); the value is taken from the spawned process environment and never appears in argv.
+- prose: `packages/rcf-lite/test/blueprint/persistence-data-postgres-anatomy.test.js` (a) block comment now names `STRICT_ID_KEYS` scalar-string witnesses as the only accepted id shape and requires `idWitness` and `derivedWitness` under DIFFERENT keys, consistent with the predicate.
+
+## 1.1.9 - 2026-09-12
+
+Password literal removed from shipped probe source, anatomy comment aligned with in-memory validation, `STRICT_ID_KEYS` tightened to engine-returned scalars only. Anatomy pin bumped to 1.1.9.
+
+- fix: `blueprints/persistence-data-postgres/contributions/probes/recovery-restore-round-trip.mjs` connection URL to the restore container now reads the password from the declared POSTGRES_PASSWORD variable only; the retired development-only password literal has been removed from shipped source. The `docker run` invocation uses the pass-through `-e POSTGRES_PASSWORD` form so the value is taken from the spawned process environment and never enters argv.
+- fix: `packages/rcf-lite/test/blueprint/persistence-data-postgres-anatomy.test.js` STRICT_ID_KEYS removed the plural / probe-selected keys (`requestIds`, `vendorRequestIds`, `metadataRequestId`, `httpRequestId`, `observedUploadId`, `dlqTransportMessageIds`, `primaryTransportMessageId`, `jobIds`, `dlqPayloadJobIds`, `expectedPayloadJobId`) so only engine-returned scalar identifiers qualify as id-witnesses.
+- prose: anatomy header comment corrected to describe the in-memory validation the anatomy performs (probes invoked directly; no `.rcf/reports` record read on this seam).
+
+
+## 1.1.8 - 2026-09-11
+
+Engine-returned identifiers only. A counting row's identifier is a value the ENGINE RETURNED for that operation (Postgres `pg_backend_pid()`, `txid_current()` and the migration version the migrations table reports; row ids or serials the database returned). Scratch names the probe chose, database names, migration filenames, checksums the probe computed and any array are NOT identifiers. `STRICT_ID_KEYS` on the anatomy retains engine-returned scalars only; the anatomy also enforces that a counting row's identifier and derived witnesses land under DIFFERENT keys (so a checksum can never satisfy both the id and the derived witness). Every persistence-data-postgres counting row records `backendPid` (and where relevant `transactionId` / `migrationVersion`) alongside its existing derived witnesses. Anatomy pin bumped to 1.1.8.
+
+- fix: `packages/rcf-lite/test/blueprint/persistence-data-postgres-anatomy.test.js` STRICT_ID_KEYS retains only engine-returned scalar keys (`requestId`, `eTag`, `versionId`, `uploadId`, `queueId`, `messageId`, `jobId`, `rowId`, `insertedId`, `backendPid`, `transactionId`, `migrationVersion` and their labelled siblings). `bucketName`, `scratchBucket`, `queueName`, `databaseName`, `migrationFile*`, `appliedFilesList`, `stderrFailingFilename` and the checksum keys were removed.
+- fix: same-file strict-AND now asserts idWitness and derivedWitness sit under DIFFERENT keys; `srcChecksumMd5` was accepted as both id (via STRICT_ID_KEYS) and derived (via `/Md5$/i`) under the pre-8 rule.
+- fix: `facade-round-trip`, `migration-apply` (all three phase-1 rows plus the induced-failure atomicity row), `transaction-atomicity`, `pool-posture-smoke`, `recovery-restore-round-trip` (backup + row-count + checksum rows) each capture `pg_backend_pid()` and `txid_current()` from the same pool that observed the row and stamp them as `backendPid` / `transactionId`. Migration-apply also records `migrationVersion` as the count of committed schema_version rows.
+- prose: run-notes reworded to state engine-returned-only identifiers; the earlier `appliedFilesList` / `checksum` prose was removed.
+
+
+
+## 1.1.7 - 2026-09-11
+
+Lazy engine-client load discipline. Under a CI condition where the fixture's `node_modules` has not been installed and `POSTGRES_HOST` is unset, the probe module surface must load without touching the `pg` driver: an anatomy or tooling walk imports the probe, the probe calls `connectionUrlFromEnv`, catches `MissingPostgresHostError`, and returns the exact one-variable `accountBoundSkipped` row. The prior module-level `import pg from 'pg'` in the fixture facades (`store.mjs` and `migrate.mjs`) resolved `pg` on module load and failed the anatomy TC-070-fixture-and-switches test with `ERR_MODULE_NOT_FOUND` in CI. The engine client is now loaded LAZILY inside `createStore` and `applyAll`, and both fixture helpers are async; every probe now `await`s the facade calls. Anatomy pin bumped to 1.1.7.
+
+- fix: `packages/rcf-lite/test/fixtures/infra-postgres/src/store.mjs` no longer carries a module-level `import pg from 'pg'`. `createStore` is now async and calls a `loadPool()` helper that dynamically imports `pg` on the run path, after `POSTGRES_HOST` is present and the caller has invoked `createStore`.
+- fix: `packages/rcf-lite/test/fixtures/infra-postgres/src/migrate.mjs` no longer carries a module-level `import pg from 'pg'`. `applyAll` calls a `loadClient()` helper that dynamically imports `pg` on the run path.
+- fix: every probe that instantiates the facade (`facade-round-trip`, `migration-apply`, `pool-posture-smoke`, `transaction-atomicity`, `recovery-restore-round-trip`) prefixes `createStore` with `await`; behaviour on both the run path and the skip path is unchanged.
+- fix: `migration-apply` rows 1, 2 and 3 carry `migrationFileApplied` (a string first-applied filename) so every counting row satisfies the strict AND-witness rule alongside the array `appliedFilesList` derived witness (the strict identifier predicate refuses array-valued id keys).
+- fix: `recovery-restore-round-trip` teardown-row limitation string rewrites "AC-observing rows" to "AC observing rows" so the broad `AC-[A-Za-z0-9-]+` limitation-token sweep no longer extracts an invented AC id from the phrase.
+
+
+## 1.1.6 - 2026-09-11
+
+The probe owns its skip and the anatomy invokes every probe unconditionally. The persistence-data-postgres anatomy test now removes the outer POSTGRES_HOST gate, invokes each probe directly, and validates whatever comes back: a skip row for exact one-variable shape, or a counting row against the strict AND-witness rule with a NON-EMPTY STRING identifier under an engine-minted id key (booleans, numbers, arrays and objects never qualify) and a derived-value witness. The limitation-token check now sweeps every `AC-[A-Za-z0-9-]+` token so an invented token alongside a real one is refused. Anatomy pin bumped to 1.1.6.
+
+- fix: identifier predicate on the anatomy STRICT_ID_KEYS check is string-only and non-empty; booleans, numbers, arrays and objects never satisfy an engine-minted id key.
+- fix: limitation-token regex broadened to `AC-[A-Za-z0-9-]+` so every AC token is checked for membership in the shipped user-story AC set.
+- prose: the 1.1.8 changelog paragraph refers to the endpoint-host default without naming the retired literal; supporting prose keeps the same terminology.
+- prose: fixture README no longer names the retired endpoint-host literal on the "How to run" line.
+
+
+## 1.1.5 - 2026-09-11
+
+Endpoint-host discipline and honest CRUD-row anchoring on the facade-round-trip probe. The fixture helper `connectionUrlFromEnv` in `packages/rcf-lite/test/fixtures/infra-postgres/src/store.mjs` no longer carries a literal endpoint-host default: when `POSTGRES_HOST` is unset the helper throws a typed `MissingPostgresHostError` and each consumer probe returns the exact one-variable `accountBoundSkipped` row rather than reaching a hard-coded endpoint. The endpoint-host literal on the recovery-restore-round-trip probe's restore-container connection string is replaced by `process.env.POSTGRES_HOST`, matching the docker host the restore container publishes its port on. The fixture README declares the new behaviour and stops claiming the pack is entirely locally hosted. Anatomy pin bumped to 1.1.5.
+
+- fix: facade-round-trip row 2 (the CRUD round-trip) is now `conformanceOnly` against AC-27101-1 - the AC states pool opening and the facadeReady event, which row 1 observes; the CRUD observation cites AC-27101-1 as the nearest shipped AC and names the unobserved clause ("a facadeReady event fires on the injected event sink carrying the database name"). Row 1 stays anchored to AC-27101-1 and remains the source of the pool-opening / facadeReady evidence.
+- fix: every probe that calls `connectionUrlFromEnv` declares `POSTGRES_HOST` on its `DECLARED_ENV` list and converts `MissingPostgresHostError` into the exact one-variable `accountBoundSkipped` row per authoring-standard section 7d. The anatomy asserts the honest skip shape in the unset path and validates each row against the strict AND-witness rule in the set path.
+- fix: recovery-restore-round-trip's restore-container URL uses `process.env.POSTGRES_HOST`; no literal endpoint host remains in the shipped probe pack or fixture code.
+- fix: migration-apply row 1 and row 3 each carry `appliedFilesList` as their strict id witness alongside the `applied` derived witness. Pool-posture-smoke and transaction-atomicity add `databaseName` (captured from `store.ready()`) so every counting row satisfies the strict AND-witness rule when POSTGRES_HOST is set.
+
+
+
+Strict-anatomy rewrite of the 7d witness rules. The anatomy test now REQUIRES an AC-id-membership check on every limitation string and every notObservableHere.ac (must exist in the shipped user-story set), REQUIRES both an id-shape witness AND a derived-value witness on every non-declaimed row (strict AND, never OR), invokes every probe directly and validates each returned row in-memory, and requires accountBoundSkipped rows to name exactly one env var declared on the probe DECLARED_ENV list. Anatomy pin bumped to 1.1.4. Probes minimally enriched so every counting row carries BOTH witness shapes.
+
+- fix: facade-round-trip row 0 now carries `databaseName` and `poolReadyOk` alongside the `facadeReadyEvent` id witness.
+- fix: migration-apply row 1 now carries `appliedFilesList` alongside the `migrationsAppliedEvent` id witness.
+- fix: pool-posture-smoke row now carries `poolPostureStatus` and `poolConfigurationMetadata` alongside the `checkedOut`/`elapsedMs` derived witnesses.
+- fix: recovery-restore-round-trip checksum row now carries `checksumMatchStatus` alongside the `srcChecksumMd5`/`dstChecksumMd5` derived witnesses.
+- fix: transaction-atomicity row 1 carries `rolledBackTimestamp` and `rolledBackVerificationOk` alongside `transactionRolledBackEvent`; row 2 carries `postRollbackVerificationOk` alongside `postRollbackUserCount`.
+- register: neutral wording on the 1.0.0 entry (no capability change).
+
+## 1.1.3 - 2026-09-11
+
+Positive-evidence conformance work on the probe pack (authoring standard section 7d). The recovery-restore-round-trip probe reads `POSTGRES_SOURCE_CONTAINER`, `POSTGRES_RESTORE_CONTAINER` and `POSTGRES_RESTORE_PORT` from env so a runner on a non-default docker-compose container name or port can execute it without patching probe source. The infra-postgres fixture README gains a Declared env vars table naming every environment variable a probe or the fixture reads (POSTGRES_* connection quintet, the three container/port overrides, SIMULATE_MIGRATION_FAILURE, SIMULATE_CONSTRAINT_VIOLATION); an off-table read is refused at gate. Anatomy pin extended to include the Declared env vars section. All six probes execute against a locally-hosted postgres:17-alpine, with the recovery probe standing up and tearing down its own throwaway restore container.
+
+- fix: recovery-restore-round-trip drives the shipped `exportDatabase` runner (`src/recovery.mjs`) via a `runPgDump` callback so `backupExported` fires and is asserted; the probe now exercises the shipped recovery runner rather than bypassing it. Every teardown step (source TRUNCATE, source pool close, restore `docker rm -f -v`, `docker inspect` absence check, artefact directory removal) is recorded on the report with per-step exit status; a teardown FAIL fails the verdict.
+- fix: recovery-restore-round-trip pre-run cleanup positively asserts the intended pre-state (destination directory absent after removal, restore container absent after `docker inspect`); an inspect error the probe does not recognise fails the row instead of being treated as success. The teardown row is conformance-only (`anchorAcId: null`, `limitation` names AC-27105-1 by full text and states that AC-27105-1's rowset property does not state scratch-resource teardown).
+- fix: migration-apply anchors the induced-failure row to AC-27109-1 by spawning the shipped migration runner AS A CHILD PROCESS (`node packages/rcf-lite/test/fixtures/infra-postgres/src/migrate.mjs`) with `SIMULATE_MIGRATION_FAILURE=true`. The child's OS exit code (`childExitCode`), its stderr (which carries `migration failed at 002_add_email_unique.sql: <pg error>`), and the parent's post-run DB inspection (001 committed with users + schema_version row; 002 rolled back with no UNIQUE constraint and no schema_version row) are all on the same row so AC-27109-1's process-exit clause is observed at process level, not from a field the runner returns.
+- fix: prepared-statement-scan drops the AST-walk claim (fixture declares no JS parser dependency and adding one is out of scope for this patch bump). Row 1 is conformance-only (`anchorAcId: null`, `limitation` names AC-27103-1 by full text and states that the row's per-call-site tokeniser inventory is not the AST walk the AC requires); the row records positive per-call-site observations under the facade dir (per-site `firstArgKind`, extracted literal preview, `$N` placeholder list, and per-site notes on the two known-safe wrapper patterns). Row 2 is `notObservableHere: { ac: 'AC-27103-1', reason: <parser-scope limitation, not account-bound> }` (the previous `accountBoundSkipped` shape was the wrong disposition - fixture-scope parser gap, not an unset account variable).
+- fix: pool-posture-smoke observes the peak concurrent in-use count on each pool at the time of maximum contention (via the shipped pool's `totalCount` / `idleCount` deltas sampled during the checked-out-N-tasks race); the row records `observedPeakInUse` and asserts it equals the configured `max`. The prior row that asserted only the configured `max` is dropped.
+- fix: every result row on every probe carries its own `evidence` object; the shared `aggregate([])` helper returns `fail` with `no checks ran` instead of the previous default-pass on an empty results array.
+
 ## 1.1.2 - 2026-09-10
 
 Dimension-d single-definition-ownership cleanup on REQ-004: REQ description now references the transaction-helper interface owned on TAC-2803.interfaces.withTransaction rather than restating the driver control literals for begin, commit and rollback. Chain-consistency lint zero on pass 1 and pass 2.
@@ -16,13 +96,13 @@ Adds the elicits block (connection-url, migrations-directory, migration-runner-t
 
 ## 1.0.0 - 2026-09-06
 
-Initial release. Contract for Postgres as the project's primary durable relational store on a server-tier deployment (Node process, container, non-Workers serverless), accessed through a store facade module that is the sole reader of the `pg` client. Landed via the infra round 5 spec (ratified 2026-09-06).
+Initial release. Contract for Postgres as the project's primary durable relational store on a server-tier deployment (Node process, container, non-Workers serverless), accessed through a store facade module that is the sole reader of the `pg` client.
 
 - 26 contributions: 7 REQs on facade / migrations / prepared statements / transactions / recovery / pool posture / advisory-lock helper; 10 USs at 27101-27110; 4 TACs (2801 facade, 2802 migration runner, 2803 transaction helper, 2804 recovery runner); 5 ADRs (2801 driver with scope global on `persistenceStore`, 2802 migration shape with scope global on `migrationDiscipline`, 2803 runner mode, 2804 recovery, 2805 connection-pool posture).
-- Six Node-only probes under `contributions/probes/` proven against a live `postgres:17-alpine` container: `facade-round-trip`, `migration-apply`, `prepared-statement-scan`, `transaction-atomicity`, `recovery-restore-round-trip`, `pool-posture-smoke`. None account-bound; Postgres is local-first per maintainer decision.
+- Six Node-only probes under `contributions/probes/` proven against a live `postgres:17-alpine` container: `facade-round-trip`, `migration-apply`, `prepared-statement-scan`, `transaction-atomicity`, `recovery-restore-round-trip`, `pool-posture-smoke`. None account-bound; Postgres is local-first per policy.
 - Sample-app fixture at `packages/rcf-lite/test/fixtures/infra-postgres/` boots `postgres:17-alpine` via docker compose, applies three toy forward-only `.sql` migrations, exposes the facade over `pg`, and hosts `SIMULATE_MIGRATION_FAILURE` and `SIMULATE_CONSTRAINT_VIOLATION` switches for the negative-run probe paths.
 - Declares `capabilities: ["relationalStore"]`, `suggestedCompanions: [{role: "logging"}, {role: "errorHandling"}]`, `providesRoles` absent, `requiresAppliedCapabilities` absent.
 - Reserves the round-6 Hyperdrive v1.1.0 adapter slot at ADR-2801 by keeping the driver reference opaque at the facade boundary.
-- Advisory-lock helper (REQ-007) ships in v1.0.0 as elicited with default `off` per the ratified Q1 answer on infra round 5 spec section 10.
+- Advisory-lock helper (REQ-007) ships in v1.0.0 as elicited with default `off`.
 
-Review-fix (2026-09-09): Adds eleven option-binding ACs to close section 7c on the elicits catalogue - migration-runner-tool (AC-27102-4/5/6/7), runner-mode (AC-27102-8/9), recovery-cadence (AC-27105-3/4/5), pitr-provider (AC-27110-3/4). Adds deliveredBy on REQ-001, REQ-002, REQ-004 (three of seven mandatory REQs).
+Adds eleven option-binding ACs to close section 7c on the elicits catalogue - migration-runner-tool (AC-27102-4/5/6/7), runner-mode (AC-27102-8/9), recovery-cadence (AC-27105-3/4/5), pitr-provider (AC-27110-3/4). Adds deliveredBy on REQ-001, REQ-002, REQ-004 (three of seven mandatory REQs).

package/blueprints/persistence-data-postgres/README.md

@@ -63,7 +63,7 @@ Each probe is a Node module under `contributions/probes/` exporting the round-5
 | `recovery-restore-round-trip` | AC-27105-1 | `pg_dump` artefact primes a fresh Postgres; row-count and checksum equality |
 | `pool-posture-smoke` | AC-27106-1 | Two facades at pool size 5 handle twenty concurrent queries with no timeout |
 
-None of the six probes carries `accountBound: true`; Postgres is local-first per infra round 5 spec maintainer decision.
+None of the six probes carries `accountBound: true`; Postgres is `accountBound: false` and local-first (sibling reservation).
 
 ## How to run the probes locally
 
@@ -88,7 +88,7 @@ Each shim exits 0 on aggregate pass and 1 otherwise; every report file carries `
 
 ## Known mechanism-reach gaps
 
-- **Prepared-statement discipline (REQ-003)** is enforced by a build-time AST scan; a project author who bypasses the facade for a project-side raw `pg.query` call site outside the facade directory is not caught by this probe. Mitigation: the facade sole-reader AC on REQ-001 pins the discipline at author-side review; the prepared-statement-scan probe walks only the facade directory by design.
+- **Prepared-statement discipline (REQ-003)** is enforced by a build-time AST scan; a project author who bypasses the facade for a project-side raw `pg.query` call site outside the facade directory is not caught by this probe. Mitigation: the facade sole-reader AC on REQ-001 pins the discipline at the author-side check; the prepared-statement-scan probe walks only the facade directory by design.
 - **Advisory-lock semantics (REQ-007)** is elicited off by default per the ratified Q1 answer. When enabled, session-level locks survive rolled-back transactions per https://www.postgresql.org/docs/current/explicit-locking.html; use `transaction` for the common case and pick `session` only when cross-transaction locking is the intent.
 - **Pool posture per deploy target (REQ-006)** ships defaults matching pg's own; the `pool-posture-smoke` probe drives twenty concurrent queries at pool size 5 and does not impose a sizing formula. Operators sizing for their workload override via the elicited pool-config fields.
 

package/blueprints/persistence-data-postgres/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "persistence-data-postgres",
-  "version": "1.1.2",
+  "version": "1.1.10",
   "category": "persistence",
   "capabilities": [
     "relationalStore"
@@ -254,5 +254,6 @@
       ],
       "default": "off"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-12T00:41:50Z"
 }

package/blueprints/persistence-data-postgres/contributions/adrs/adr-2801-persistence-data-postgres-driver.json

@@ -22,7 +22,7 @@
     {
       "name": "Hyperdrive as the shipped v1.0.0 driver",
       "summary": "Ship Hyperdrive-wrapped pg as the v1.0.0 default.",
-      "reasonNotChosen": "Hyperdrive is a Cloudflare-account-bound service and the round-5 spec ruling 5 (maintainer decision) places Postgres as the local-first blueprint. Making Hyperdrive the default would force every project to bind to a Cloudflare account before applying the blueprint. Round 6 lands Hyperdrive as a v1.1.0 minor adapter behind an elicit, keeping local-first at v1.0.0."
+      "reasonNotChosen": "Hyperdrive is a Cloudflare-account-bound service and the sibling reservation places Postgres as the local-first blueprint. Making Hyperdrive the default would force every project to bind to a Cloudflare account before applying the blueprint, sacrificing local-first."
     }
   ],
   "createdAt": "2026-09-06T15:47:00.000Z",

package/blueprints/persistence-data-postgres/contributions/probes/facade-round-trip.mjs

@@ -7,17 +7,60 @@
  * round-trip returns the row written.
  *
  * Anchors AC-27101-1 (facade opens on boot and facadeReady fires with
- * the database name).
+ * the database name). The CRUD round-trip row is `conformanceOnly`
+ * against AC-27101-1: its clause "a facadeReady event fires on the
+ * injected event sink carrying the database name" is not observed on
+ * that row (row 1 observes it on its own); the CRUD observation
+ * records the named-domain-verb round-trip evidence and cites
+ * AC-27101-1 as the nearest shipped AC (no shipped AC states the
+ * end-to-end CRUD round-trip through the facade).
+ *
+ * POSTGRES_HOST is a required declared variable: when it is unset
+ * the probe returns the exact
+ * one-variable accountBoundSkipped row rather than throwing.
  *
  * Cleans up: TRUNCATE users on exit; closes the pool.
  */
 
-import { createStore, connectionUrlFromEnv } from '../../../../packages/rcf-lite/test/fixtures/infra-postgres/src/store.mjs';
+import { createStore, connectionUrlFromEnv, MissingPostgresHostError } from '../../../../packages/rcf-lite/test/fixtures/infra-postgres/src/store.mjs';
+
+export const DECLARED_ENV = Object.freeze([
+  'POSTGRES_HOST',
+  'POSTGRES_PORT',
+  'POSTGRES_USER',
+  'POSTGRES_PASSWORD',
+  'POSTGRES_DB',
+]);
+
+function skipRow(variable) {
+  return {
+    anchorAcId: null,
+    verdict: 'pass',
+    detail: `On process boot, the facade opens a pg.Pool - accountBound: skipped (${variable} unset)`,
+    accountBoundSkipped: true,
+    reason: `${variable} unset`,
+    evidence: { skip: true, reason: `${variable} unset`, envDeclared: [...DECLARED_ENV] },
+  };
+}
 
 export default async function runProbe() {
+  let url;
+  try {
+    url = connectionUrlFromEnv();
+  } catch (err) {
+    if (err instanceof MissingPostgresHostError) {
+      return {
+        results: [skipRow(err.variable)],
+        accountBoundSkipped: true,
+        reason: `${err.variable} unset`,
+        envDeclared: [...DECLARED_ENV],
+      };
+    }
+    throw err;
+  }
   const events = [];
-  const store = createStore({
-    connectionUrl: connectionUrlFromEnv(),
+  const store = await createStore({
+    connectionUrl: url,
     onEvent: (e) => events.push(e),
   });
   const results = [];
@@ -29,28 +72,60 @@ export default async function runProbe() {
     await pool.query('TRUNCATE users');
     const facadeReadyFired = events.some((e) => e.event === 'facadeReady');
     const facadeReadyDbName = facadeReadyFired ? events.find((e) => e.event === 'facadeReady').databaseName : null;
+    const facadeReadyEvent = facadeReadyFired ? events.find((e) => e.event === 'facadeReady') : null;
+    const pidR = await pool.query('SELECT pg_backend_pid() AS pid, txid_current() AS txid');
+    const backendPid = String(pidR.rows[0].pid);
+    const transactionId = String(pidR.rows[0].txid);
     results.push({
       anchorAcId: 'AC-27101-1',
       verdict: facadeReadyFired && facadeReadyDbName === 'rcf_test' ? 'pass' : 'fail',
       detail: facadeReadyFired
-        ? `facadeReady fired with databaseName=${facadeReadyDbName}`
-        : 'facadeReady did not fire before first query',
+        ? `On process boot, the facade opens a pg.Pool - facadeReady fired with databaseName=${facadeReadyDbName}`
+        : 'On process boot, the facade opens a pg.Pool - facadeReady did not fire before first query',
+      evidence: { backendPid, transactionId, facadeReadyEvent, allEvents: events, databaseName: facadeReadyDbName, poolReadyOk: !!facadeReadyEvent },
     });
     const id = await store.createUser('probe-facade-round-trip', 'facade-round-trip@rcf.test');
     const row = await store.getUserById(id);
     const roundTripPass = row && row.id === id && row.name === 'probe-facade-round-trip';
+    // AC-27101-1 states pool opening + facadeReady firing with the
+    // database name; no shipped AC states the end-to-end CRUD
+    // round-trip through the facade. This row is conformanceOnly
+    // against AC-27101-1 with the unobserved clause named.
     results.push({
-      anchorAcId: 'AC-27101-1',
+      anchorAcId: null,
       verdict: roundTripPass ? 'pass' : 'fail',
+      conformanceOnly: true,
+      limitation: 'AC-27101-1: the clause "a facadeReady event fires on the injected event sink carrying the database name" is not observed on this row (row 1 observes it); this row records the CRUD round-trip through the facade\'s named domain verbs (createUser, getUserById) as positive evidence for the named-domain-verb clause only.',
       detail: roundTripPass
-        ? `round-trip put id=${id} and got name=${row.name}`
-        : `round-trip failed: id=${id}, row=${JSON.stringify(row)}`,
+        ? `CRUD round-trip through named domain verbs - put id=${id} and got name=${row.name}`
+        : `CRUD round-trip through named domain verbs - failed: id=${id}, row=${JSON.stringify(row)}`,
+      evidence: { insertedId: id, retrievedRow: row },
     });
   } finally {
+    // Teardown - record every step so a failure surfaces as a row and
+    // fails the aggregate per authoring-standard rule 5.
+    const teardown = [];
     try {
       await store.getPool().query('TRUNCATE users');
-    } catch { /* ignore */ }
-    await store.close();
+      teardown.push({ step: 'TRUNCATE users on close', ok: true });
+    } catch (err) {
+      teardown.push({ step: 'TRUNCATE users on close', ok: false, error: err && err.message });
+    }
+    try {
+      await store.close();
+      teardown.push({ step: 'close pool', ok: true });
+    } catch (err) {
+      teardown.push({ step: 'close pool', ok: false, error: err && err.message });
+    }
+    const failed = teardown.filter((t) => !t.ok);
+    if (failed.length > 0) {
+      results.push({
+        anchorReqId: 'persistence-data-postgres-REQ-001',
+        verdict: 'fail',
+        detail: `The facade module is the sole reader - teardown FAILED: ${failed.map((t) => `${t.step} -> ${t.error}`).join('; ')}`,
+        evidence: { teardown },
+      });
+    }
   }
-  return results;
+  return { results };
 }