rcf-lite 0.27.0 → 0.28.0

package/blueprints/persistence-data-sqlite/contributions/probes/boot-open-migrate.mjs

@@ -0,0 +1,90 @@
+// Boot-time open-and-migrate probe for persistence-data-sqlite.
+//
+// AC-5101-1 requires ONE named module export invoked exactly ONCE
+// before request handlers bind. A storeOpened event fired on the
+// sink is not proof of "invoked exactly once before handlers bind"
+// (there are no handlers). Row de-claimed (anchorAcId=null,
+// conformanceOnly true) with the limitation naming AC-5101-1.
+//
+// AC-5101-2 requires (a) the store to open with a path sourced from
+// application configuration AND (b) a grep of the source tree to
+// find the identifier resolved from configuration rather than
+// hard-coded. This row observes only clause (a) (path equality on
+// the opened event); a shelf probe cannot cheaply prove absence of
+// hard-coded paths across every consumer module in a downstream
+// project. Row de-claimed with the limitation naming AC-5101-2.
+//
+// AC-5101-3 (open returns only after migrations have run) IS
+// observable as schemaVersion === MAX_SCHEMA_VERSION after open and
+// is kept as a real AC anchor.
+//
+// The reopen row (no migrations applied on second open) is not
+// AC-5101-3 (that AC is about first open completing migrations); it
+// belongs to REQ-002 (idempotent reopen). Row de-claimed with the
+// limitation naming AC-5101-3.
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { openStore, MAX_SCHEMA_VERSION } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-persistence-data-sqlite/src/store.mjs';
+
+export const anchorAcId = 'AC-5101-3';
+export const accountBound = false;
+const AC3 = 'The open entry point returns only after migrations';
+const LIM_5101_1 = `AC-5101-1: requires a SINGLE named module export invoked exactly ONCE before request handlers bind on the running process. A storeOpened event on the fixture eventSink is not evidence of an application-level export invocation ordering against handler binding.`;
+const LIM_5101_2 = `AC-5101-2: requires (a) the store to open with a path sourced from application configuration AND (b) a grep of the source tree to find the identifier resolved from configuration rather than hard-coded. This row observes only clause (a); the shelf cannot cheaply prove absence of hard-coded paths across every consumer module of a downstream project.`;
+const LIM_5101_3_REOPEN = `AC-5101-3: asserts the open entry point returns only after migrations have RUN (first open). Reopen idempotency (a no-migration second open) is a related but distinct property not stated on AC-5101-3.`;
+
+export default async function runProbe() {
+  const dir = await mkdtemp(join(tmpdir(), 'rcf-sqlite-boot-'));
+  const path = process.env.RCF_FIXTURE_SQLITE_PATH || join(dir, 'store.sqlite');
+  const events = [];
+  const results = [];
+  let bootReport, reopenReport;
+  try {
+    const store = openStore({ path, eventSink: (r) => events.push(r) });
+    const opened = events.filter((e) => e.event === 'storeOpened');
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_5101_1,
+      verdict: opened.length === 1 ? 'pass' : 'fail',
+      detail: `observed storeOpened emitted ${opened.length} time(s) on the eventSink; path=${opened[0]?.path} timestamp=${opened[0]?.timestamp}. Not evidence of a named export invocation ordering against handler binding.`,
+      evidence: { event: opened[0], appliedMigrations: store.appliedMigrations, bodyExcerpt: `storeOpened count=${opened.length}` },
+    });
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_5101_2,
+      verdict: opened[0]?.path === path ? 'pass' : 'fail',
+      detail: `observed opened event path=${opened[0]?.path} matches the configuration input path=${path}. Absence of hard-coded paths across every consumer module of a downstream project not observed.`,
+      evidence: { pathFromConfig: path, pathOnEvent: opened[0]?.path, bodyExcerpt: `path=${opened[0]?.path}` },
+    });
+    const schemaAtOpen = store.schemaVersion();
+    // Seed put through the facade so the row carries a real integer
+    // rowId as its resource identifier (real returned engine row id).
+    const seed = store.put('probe-boot-open-migrate', String(Date.now()));
+    results.push({
+      anchorAcId: 'AC-5101-3',
+      verdict: schemaAtOpen === MAX_SCHEMA_VERSION && Number.isInteger(seed.rowId) && seed.rowId > 0 ? 'pass' : 'fail',
+      detail: `${AC3} have run  -  observed schema version after open=${schemaAtOpen} equals build max known=${MAX_SCHEMA_VERSION}; appliedMigrations=${JSON.stringify(store.appliedMigrations)}; a seed put through the facade returned real integer rowId=${seed.rowId}.`,
+      evidence: { rowId: seed.rowId, schemaVersion: schemaAtOpen, appliedMigrations: store.appliedMigrations, bodyExcerpt: `schema=${schemaAtOpen} applied=${JSON.stringify(store.appliedMigrations)} rowId=${seed.rowId}` },
+    });
+    bootReport = { appliedMigrations: [...store.appliedMigrations], schemaVersion: schemaAtOpen };
+    store.close();
+
+    const store2 = openStore({ path, eventSink: (r) => events.push(r) });
+    reopenReport = { appliedMigrations: [...store2.appliedMigrations], schemaVersion: store2.schemaVersion() };
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_5101_3_REOPEN,
+      verdict: store2.appliedMigrations.length === 0 && store2.schemaVersion() === MAX_SCHEMA_VERSION ? 'pass' : 'fail',
+      detail: `observed reopen appliedMigrations=${JSON.stringify(store2.appliedMigrations)}; schema=${store2.schemaVersion()} (idempotent reopen at max version; distinct property from AC-5101-3 first-open-completes-migrations).`,
+      evidence: { schemaVersion: reopenReport.schemaVersion, appliedMigrations: reopenReport.appliedMigrations, bodyExcerpt: `reopen applied=${JSON.stringify(reopenReport.appliedMigrations)}` },
+    });
+    store2.close();
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_SQLITE_PATH'], bootReport, reopenReport, eventCount: events.length } };
+}

package/blueprints/persistence-data-sqlite/contributions/probes/facade-round-trip.mjs

@@ -0,0 +1,82 @@
+// Facade round-trip probe for persistence-data-sqlite.
+//
+// The CRUD rows (put/get/delete via the fixture's store facade) do
+// NOT observe AC-5107-1's sole-importer property (an import-graph
+// scan over the project's source modules) and do not exhaustively
+// verify AC-5107-2's absence of a general-purpose query method
+// across the facade's public surface. Rows are de-claimed
+// (conformanceOnly, anchorAcId=null) with the limitation naming
+// AC-5107-2 (nearest shipped AC on the CRUD verb surface).
+//
+// The event row observes entryPut / entryRead / entryDeleted which
+// are NOT among the four defined lifecycle events on AC-5106-1
+// (opened, migrated, backupCheckpoint, closed). Row de-claimed
+// with the limitation naming AC-5106-1.
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { openStore } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-persistence-data-sqlite/src/store.mjs';
+
+export const anchorAcId = 'AC-5107-2';
+export const accountBound = false;
+
+const LIM_5107_2 = `AC-5107-2: requires the store facade to expose named verbs for every persistence operation the domain requires AND not to expose a general-purpose query method accepting raw engine-native queries. Runtime CRUD round-trips through the facade demonstrate that the facade's put/get/delete verbs WORK; a probe would still need an exhaustive scan of the facade's public surface to prove absence of a general-purpose query method. Row observes only the narrow-verb round-trip.`;
+const LIM_5106_1 = `AC-5106-1: defines the four lifecycle events (opened, migrated, backupCheckpoint, closed) the store facade must emit. The fixture-extended entryPut/entryRead/entryDeleted events are fixture-added observations, not any of the four defined events.`;
+
+export default async function runProbe() {
+  const dir = await mkdtemp(join(tmpdir(), 'rcf-sqlite-round-'));
+  const path = process.env.RCF_FIXTURE_SQLITE_PATH || join(dir, 'store.sqlite');
+  const events = [];
+  const results = [];
+  let rowId, value = 'hello-world-' + Date.now();
+  try {
+    const store = openStore({ path, eventSink: (r) => events.push(r) });
+    const putResult = store.put('probe/key', value);
+    rowId = putResult.rowId;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_5107_2,
+      verdict: Number.isInteger(rowId) && rowId > 0 && putResult.changes === 1 ? 'pass' : 'fail',
+      detail: `observed put returned real integer rowId=${rowId} changes=${putResult.changes} through the facade's narrow put verb (no raw SQL).`,
+      evidence: { rowId, changes: putResult.changes, bodyExcerpt: `put rowId=${rowId} changes=${putResult.changes}` },
+    });
+    const got = store.get('probe/key');
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_5107_2,
+      verdict: got && got.value === value && got.rowId === rowId ? 'pass' : 'fail',
+      detail: `observed get returned rowId=${got?.rowId} valueBytes=${got?.value?.length} match=${got?.value === value} through the facade's narrow get verb.`,
+      evidence: { rowIdOnRead: got?.rowId, valueExcerpt: got?.value?.slice(0, 32), bodyExcerpt: `get rowId=${got?.rowId}` },
+    });
+    const del = store.delete('probe/key');
+    const missed = store.get('probe/key');
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_5107_2,
+      verdict: del.changes === 1 && missed === null ? 'pass' : 'fail',
+      detail: `observed delete changes=${del.changes}; re-read after delete=${missed === null ? 'absent' : 'present'} through the facade's narrow delete then get verbs.`,
+      evidence: { rowIdCreatedThenDeleted: rowId, deleteChanges: del.changes, presentAfterDelete: missed !== null, bodyExcerpt: `delete changes=${del.changes} presentAfterDelete=${missed !== null}` },
+    });
+    const evPut = events.filter((e) => e.event === 'entryPut');
+    const evRead = events.filter((e) => e.event === 'entryRead');
+    const evDel = events.filter((e) => e.event === 'entryDeleted');
+    const eventOk = evPut.length === 1 && evRead.length === 2 && evDel.length === 1;
+    const allowedKeys = new Set(['event', 'key', 'size', 'hit', 'timestamp']);
+    const extraKeys = [...evPut, ...evRead, ...evDel].flatMap((e) => Object.keys(e)).filter((k) => !allowedKeys.has(k));
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_5106_1,
+      verdict: eventOk && extraKeys.length === 0 ? 'pass' : 'fail',
+      detail: `observed event counts put=${evPut.length} read=${evRead.length} delete=${evDel.length}; extraFields=${JSON.stringify(extraKeys)} on the eventSink; the fixture-extended entry* events carry only metadata fields.`,
+      evidence: { entryPut: evPut[0], entryReadHit: evRead[0], entryReadMiss: evRead[1], entryDeleted: evDel[0], bodyExcerpt: `entryPut=${evPut.length} entryRead=${evRead.length} entryDeleted=${evDel.length}` },
+    });
+    store.close();
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_SQLITE_PATH'], rowIdCreatedThenDeleted: rowId, valueBytes: value.length } };
+}

package/blueprints/persistence-data-sqlite/contributions/probes/probe-utils.mjs

@@ -0,0 +1,83 @@
+// Shared helpers for persistence-data-sqlite probes.
+//
+// Runtime posture: probes import the fixture's store facade at
+// packages/rcf-lite/test/fixtures/probe-pack-persistence-data-sqlite/src/store.mjs
+// which opens node:sqlite (Node 24 built-in). No probe uses a mock;
+// every probe runs against the real engine and records positive
+// evidence (a real integer row id, a real migration list, the real
+// WAL checkpoint counters).
+//
+// The blueprint has no account-bound branch, so the accountBoundSkipped
+// path is not exercised by this pack; the helper is retained for
+// symmetry with the shelf's probe-utils shape.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(
+  PROJECT_ROOT,
+  'packages/rcf-lite/test/fixtures/probe-pack-persistence-data-sqlite',
+);
+export const REPORT_DIR = resolve(
+  PROJECT_ROOT,
+  '.rcf/reports/blueprints/persistence-data-sqlite',
+);
+
+export const DECLARED_ENV = new Set([
+  'RCF_FIXTURE_SQLITE_PATH',
+]);
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+export function isSkipped(results) { return Array.isArray(results) && results.length > 0 && results.every((r) => r.accountBoundSkipped === true); }
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const normalised = (Array.isArray(results) && results.length > 0)
+    ? results
+    : [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: 'no checks ran', evidence: { reason: 'no checks ran', probeName, runAt: new Date().toISOString(), engine } }];
+  const raw = aggregate(normalised);
+  const aggregateVerdict = isSkipped(normalised) ? 'pass' : raw;
+  const report = {
+    slug: 'persistence-data-sqlite',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results: normalised,
+    aggregateVerdict,
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorAcId: null, harnessError: true,
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+      evidence: { thrown: true, message: err && err.message ? err.message : String(err), name: err && err.name ? err.name : 'Error', probeName, runAt: new Date().toISOString(), engine },
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}

package/blueprints/persistence-data-sqlite/contributions/probes/run-boot-open-migrate.mjs

@@ -0,0 +1,5 @@
+import runProbe from './boot-open-migrate.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'sqlite', driver: 'node:sqlite (Node 24 built-in)', healthy: true };
+runShim('boot-open-migrate', engine, runProbe);

package/blueprints/persistence-data-sqlite/contributions/probes/run-facade-round-trip.mjs

@@ -0,0 +1,5 @@
+import runProbe from './facade-round-trip.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'sqlite', driver: 'node:sqlite (Node 24 built-in)', healthy: true };
+runShim('facade-round-trip', engine, runProbe);

package/blueprints/persistence-data-sqlite/contributions/probes/run-wal-checkpoint.mjs

@@ -0,0 +1,5 @@
+import runProbe from './wal-checkpoint.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'sqlite', driver: 'node:sqlite (Node 24 built-in)', healthy: true, walMode: true };
+runShim('wal-checkpoint', engine, runProbe);

package/blueprints/persistence-data-sqlite/contributions/probes/wal-checkpoint.mjs

@@ -0,0 +1,137 @@
+// WAL checkpoint probe for persistence-data-sqlite.
+//
+// The FIRST row (AC-5105-3 anchor) observes the complete durability
+// posture the AC names: write-ahead log AND synchronous commit floor
+// AND the absence of consumer configuration. Concretely the row
+// asserts:
+//   - PRAGMA journal_mode returns 'wal' (facade-set at open)
+//   - PRAGMA synchronous returns >= NORMAL (facade-set at open)
+//   - a grep of consumer code (every probe file plus every fixture
+//     src file except the facade store.mjs itself) finds no direct
+//     PRAGMA journal_mode / PRAGMA synchronous statement.
+// A seed put through the facade provides a real integer rowId as the
+// row's resource identifier.
+//
+// The SECOND (wal_checkpoint TRUNCATE size transition) and THIRD
+// (walCheckpoint event) rows observe checkpoint mechanics and a
+// fixture-added event. Neither is one of the four defined lifecycle
+// events on AC-5106-1 {opened, migrated, backupCheckpoint, closed}
+// and neither observes crash recovery (AC-5105-1). Rows de-claimed
+// (conformanceOnly, anchorAcId=null) with limitations naming the
+// nearest shipped ACs.
+import { mkdtemp, readFile, readdir, rm, stat } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { openStore } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-persistence-data-sqlite/src/store.mjs';
+
+export const anchorAcId = 'AC-5105-3';
+export const accountBound = false;
+const AC_PREFIX = "The store's durability posture (write-ahead log";
+
+const LIM_5105_1 = `AC-5105-1: requires a write committed before SIGKILL to be present when a fresh process reopens the same store. Observing wal_checkpoint TRUNCATE size mechanics is engine housekeeping, not a crash-recovery observation.`;
+const LIM_5106_1 = `AC-5106-1: defines the four lifecycle events (opened, migrated, backupCheckpoint, closed). The fixture-extended 'walCheckpoint' event is a fixture-added observation, not one of the four defined events.`;
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const PROBES_DIR = HERE;
+const FIXTURE_SRC_DIR = join(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'probe-pack-persistence-data-sqlite', 'src');
+const FACADE_BASENAME = 'store.mjs';
+const PRAGMA_RE = /['"\`]PRAGMA\s+(journal_mode|synchronous)\b/i;
+
+async function safeSize(p) { try { return Number((await stat(p)).size); } catch { return null; } }
+
+async function listMjs(dir) {
+  const out = [];
+  async function walk(d) {
+    let entries = [];
+    try { entries = await readdir(d, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      const p = join(d, e.name);
+      if (e.isDirectory()) await walk(p);
+      else if (e.isFile() && p.endsWith('.mjs')) out.push(p);
+    }
+  }
+  await walk(dir);
+  return out;
+}
+
+// Consumer grep: every probe file + every fixture src file except the
+// facade store.mjs. A hit is a direct PRAGMA journal_mode / synchronous
+// statement outside the facade - which AC-5105-3 forbids.
+async function greppConsumerFilesForPragmaLeaks() {
+  const probeFiles = (await listMjs(PROBES_DIR)).filter((p) => !p.endsWith('probe-utils.mjs'));
+  const fixtureFilesAll = await listMjs(FIXTURE_SRC_DIR);
+  const fixtureFiles = fixtureFilesAll.filter((p) => !p.endsWith('/' + FACADE_BASENAME));
+  const consumerFiles = [...probeFiles, ...fixtureFiles];
+  const offenders = [];
+  for (const p of consumerFiles) {
+    let text = '';
+    try { text = await readFile(p, 'utf8'); } catch { continue; }
+    if (PRAGMA_RE.test(text)) offenders.push(p);
+  }
+  return { consumerFilesScanned: consumerFiles.map((p) => p.slice(p.indexOf('/rcf-lite') === -1 ? 0 : p.indexOf('/rcf-lite'))), consumerFilesWithPragma: offenders };
+}
+
+export default async function runProbe() {
+  const dir = await mkdtemp(join(tmpdir(), 'rcf-sqlite-wal-'));
+  const path = process.env.RCF_FIXTURE_SQLITE_PATH || join(dir, 'store.sqlite');
+  const events = [];
+  const results = [];
+  let checkpoint, mode, walBefore, walAfter, syncLevel, grep, seedRowId;
+  try {
+    const store = openStore({ path, eventSink: (r) => events.push(r) });
+    mode = store.journalModeNow();
+    syncLevel = store.synchronousNow();
+    grep = await greppConsumerFilesForPragmaLeaks();
+    // Seed put through the facade so the row carries a real integer
+    // rowId as its resource identifier.
+    const seed = store.put('probe-durability-posture', String(Date.now()));
+    seedRowId = seed.rowId;
+    const modeOk = mode === 'wal';
+    // NORMAL = 1, FULL = 2, EXTRA = 3. The AC names a floor, not a
+    // specific level; require >= NORMAL.
+    const syncOk = Number.isInteger(syncLevel) && syncLevel >= 1;
+    const noConsumerPragma = Array.isArray(grep.consumerFilesWithPragma) && grep.consumerFilesWithPragma.length === 0;
+    results.push({
+      anchorAcId: 'AC-5105-3',
+      verdict: modeOk && syncOk && noConsumerPragma && Number.isInteger(seedRowId) && seedRowId > 0 ? 'pass' : 'fail',
+      detail: `${AC_PREFIX} and synchronous commit floor)  -  observed the facade's PRAGMA journal_mode='${mode}' AND PRAGMA synchronous=${syncLevel} (>=1 required); consumer-source grep across ${grep.consumerFilesScanned.length} .mjs files finds ${grep.consumerFilesWithPragma.length} direct PRAGMA journal_mode/synchronous statements outside the facade store.mjs. Seed put returned rowId=${seedRowId} through the facade.`,
+      evidence: {
+        rowId: seedRowId,
+        pragmaJournalMode: mode,
+        pragmaSynchronous: `level=${syncLevel}`,
+        consumerFilesScannedCount: grep.consumerFilesScanned.length,
+        consumerFilesWithPragma: grep.consumerFilesWithPragma,
+        consumerConfiguresPragmas: !noConsumerPragma,
+        bodyExcerpt: `journal_mode=${mode} synchronous=${syncLevel} consumerPragmaHits=${grep.consumerFilesWithPragma.length} seedRowId=${seedRowId}`,
+      },
+    });
+    for (let i = 0; i < 200; i++) store.put(`k/${i}`, `v-${i}-${Date.now()}`);
+    walBefore = await safeSize(walPath(path));
+    checkpoint = store.walCheckpoint('TRUNCATE');
+    walAfter = await safeSize(walPath(path));
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_5105_1,
+      verdict: checkpoint.busy === 0 && Number.isInteger(checkpoint.pagesLog) && Number.isInteger(checkpoint.pagesCheckpointed) && typeof walBefore === 'number' && walBefore > 0 && walAfter === 0 ? 'pass' : 'fail',
+      detail: `observed wal_checkpoint(TRUNCATE) busy=${checkpoint.busy} pagesLog=${checkpoint.pagesLog} pagesCheckpointed=${checkpoint.pagesCheckpointed}; walSizeBytes before=${walBefore} after=${walAfter}.`,
+      evidence: { checkpoint, walSizeBefore: walBefore, walSizeAfter: walAfter, bodyExcerpt: `walSize ${walBefore} -> ${walAfter}` },
+    });
+    const ev = events.find((e) => e.event === 'walCheckpoint');
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_5106_1,
+      verdict: ev && ev.mode === 'TRUNCATE' ? 'pass' : 'fail',
+      detail: `observed the fixture-added walCheckpoint event mode=${ev?.mode} timestamp=${ev?.timestamp} on the eventSink after the TRUNCATE checkpoint (not one of the four defined events on AC-5106-1).`,
+      evidence: { event: ev ? { event: ev.event, mode: ev.mode, timestamp: ev.timestamp } : null, bodyExcerpt: `event=${ev?.event}` },
+    });
+    store.close();
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_SQLITE_PATH'], writtenRows: 200, journalMode: mode, synchronousLevel: syncLevel, seedRowId, checkpoint, walSize: { before: walBefore, after: walAfter }, consumerGrep: grep } };
+}
+
+function walPath(base) { return base + '-wal'; }

package/blueprints/persistence-data-sqlite/docs/topics.md

@@ -17,7 +17,7 @@ Rules for new topics (inherited from the application-spa and REST vocabularies,
 
 ## Id number bands (registry bootstrap)
 
-AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is ratified policy (2026-08-19); this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
+AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is policy; this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
 
 This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
 
@@ -62,8 +62,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 5101-5111 sit at the LOW end of the 5101-5899 band on purpose. A project-side story that mechanically derives from `persistence-data-sqlite-REQ-011` into the number `5111` would collide against persistence-data-sqlite-US-5111 in this package; the band leaves headroom at the HIGH end (US 5181-5899) so a project's own stories anchored to persistence-data-sqlite REQs can allocate without conflict. The watchpost run4 lesson applies here too.
-
+US 5101-5111 sit at the LOW end of the 5101-5899 band on purpose. A project-side story that mechanically derives from `persistence-data-sqlite-REQ-011` into the number `5111` would collide against persistence-data-sqlite-US-5111 in this package; the band leaves headroom at the HIGH end (US 5181-5899) so a project's own stories anchored to persistence-data-sqlite REQs can allocate without conflict.
 ## Shared expectations for future composing blueprints
 
 - Reuse `persistenceStore` exactly as spelled here when your blueprint holds an opinion on the project's primary durable store engine; contribute your own scope:global ADR on that string and let composition surface the pairing. A Postgres-first blueprint (see the persistence guide 'when it does not fit') will conflict here by design.

package/blueprints/platform-cloudflare-cron-triggers/CHANGELOG.md

@@ -30,15 +30,15 @@ Capability token named in the requirements layer; owner reference for the schedu
 - Close chain-contradiction specimen F-1: `AC-32101-1` and the fixture `src/scheduled.mjs` now emit `cronReady` with the cron-vocabulary metadata payload `{event, expression, scheduledTime, outcome, duration}` per TAC-3303's allow-list. The previous KV-shaped payload `{event, key, size, ttl, timestamp}` on the boot ready-check is retired; `TS-090` on the anatomy test asserts the new shape.
 - `AC-32102-1` reworded to describe the injected `sink` parameter (no longer restates the literal owned by TAC-3303's interface); no behavioural change in the shipped code path.
 
-### Added (criterion b completion, second pass 2026-09-09)
+### Added
 
-- Every story on this blueprint now reaches the section 7a AC-set-sufficiency floor. 26 new hand-authored ACs cover the documented failure paths named in the guide and TAC records, per-story range 4-6 (from the 1-2 shipped in the first 1.1.0 pass): US-32101 gains four failure-path ACs (empty routes, invalid sink, repeat-boot idempotency, sole-reader source-tree scan closing F-5); US-32102 gains four ACs (single-handler mode closing F-2, malformed event, duplicate expressions, empty routes at construction); US-32103 gains three ACs (exact-boundary at skewToleranceMs, one millisecond past, early-fire negative delta); US-32104 gains four ACs (handler-throw pre-budget closing F-3 first half, handler-throw post-budget closing F-3 second half, exact-boundary at softBudgetMs, single-cronStalled idempotency); US-32105 gains four ACs (CI gate on bind/fire failures closing F-4, bounded-wait timeout, mid-run crash, teardown discipline); US-32106 gains four ACs (allow-list forbidden-key mutation, empty-payload boundary, expression-literal-is-not-PII exclusion, closure-over-fixture); US-32107 gains three ACs (bounded-wait timeout, partial env-var configuration, non-2xx API response). Every new AC carries `disposition`, most carry `ownerRef` into the owning TAC, and vendor-fact ACs carry `vendorCitation` (scheduled handler, cron triggers, wrangler CLI, workers platform limits) with today's verifiedOn date.
+- Every story on this blueprint now reaches the section 7a AC-set-sufficiency floor. 26 new hand-authored ACs cover the documented failure paths named in the guide and TAC records, per-story range 4-6: US-32101 gains four failure-path ACs (empty routes, invalid sink, repeat-boot idempotency, sole-reader source-tree scan); US-32102 gains four ACs (single-handler mode, malformed event, duplicate expressions, empty routes at construction); US-32103 gains three ACs (exact-boundary at skewToleranceMs, one millisecond past, early-fire negative delta); US-32104 gains four ACs (handler-throw pre-budget, handler-throw post-budget, exact-boundary at softBudgetMs, single-cronStalled idempotency); US-32105 gains four ACs (CI gate on bind/fire failures, bounded-wait timeout, mid-run crash, teardown discipline); US-32106 gains four ACs (allow-list forbidden-key mutation, empty-payload boundary, expression-literal-is-not-PII exclusion, no fixture-state carry between cases); US-32107 gains three ACs (bounded-wait timeout, partial env-var configuration, non-2xx API response). Every new AC carries `disposition`, most carry `ownerRef` into the owning TAC, and vendor-fact ACs carry `vendorCitation` (scheduled handler, cron triggers, wrangler CLI, workers platform limits).
 - `rcf define blueprint lint-consistency` still reports zero pass-1 and pass-2 findings. Blueprint stays at v1.1.0 on the same unreleased minor.
 
-### Fixed (review fix pass, 2026-09-09)
+### Fixed
 
-- `AC-32105-1` reworded so the warn branch stays a describable probe outcome but no longer states the CI gate behaviour; `AC-32105-2` alone owns the harness gate on non-pass verdicts, resolving the two-AC single-definition-ownership contradiction on US-32105 (review F-1 blocker).
-- Enum-branch dispositions on the `cron-dispatcher-mode` elicit set correctly: `AC-32102-1` and `AC-32102-2` (expression-routed branch) and `AC-32102-3` (single-handler branch) flip from `fixed` to `template`; the applying project chooses the mode. Factory-invariant refusal ACs (`AC-32102-4/5/6`) stay `fixed` (review F-4).
+- `AC-32105-1` reworded so the warn branch stays a describable probe outcome but no longer states the CI gate behaviour; `AC-32105-2` alone owns the harness gate on non-pass verdicts, resolving the two-AC single-definition-ownership contradiction on US-32105.
+- Enum-branch dispositions on the `cron-dispatcher-mode` elicit set correctly: `AC-32102-1` and `AC-32102-2` (expression-routed branch) and `AC-32102-3` (single-handler branch) flip from `fixed` to `template`; the applying project chooses the mode. Factory-invariant refusal ACs (`AC-32102-4/5/6`) stay `fixed`.
 
 ## 1.0.0 (2026-09-07)
 

package/blueprints/platform-cloudflare-cron-triggers/README.md

@@ -27,9 +27,8 @@ logging companion can render without ever writing a body byte.
   `deltaMs`). Two-layer secrecy assertion in the event-secrecy
   probe.
 - A decision-tree cross-reference in the guide to `jobs-background`
-  (round 5) and to the follow-up Workflows adapter (round 6 jobs-
-  background 1.1.0 minor bump per spec section 5.7) for cases that
-  need durable, retried, workflow-shaped scheduled work.
+  and to the Workflows adapter for cases that need durable, retried,
+  workflow-shaped scheduled work.
 
 ## The four REQs
 

package/blueprints/platform-cloudflare-cron-triggers/docs/topics.md

@@ -59,7 +59,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 32101-32107 sit at the LOW end of the 32101-32899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a platform-cloudflare-cron-triggers REQ id into the number 32110 would collide against a shipped US-32110; band headroom (32108-32899) leaves that space.
+US 32101-32107 sit at the LOW end of the 32101-32899 band on purpose. A project-side story mechanically derived from a platform-cloudflare-cron-triggers REQ id into the number 32110 would collide against a shipped US-32110; band headroom (32108-32899) leaves that space.
 
 ADR/TAC suffixes for this blueprint use the 3301-3399 block, continuing the shelf pattern.
 

package/blueprints/platform-cloudflare-durable-objects/CHANGELOG.md

@@ -30,22 +30,18 @@ Owner reference for the DO event-record whitelist.
 - Guide casing correction: `SINGLE-CELL` -> `single-cell` (contract-drift against TAC-3402.purpose per pass-1 lint).
 - `rcf define blueprint lint-consistency` reports zero pass-1 and pass-2 findings.
 
-### Added (criterion b completion, second pass 2026-09-09)
+### Added
 
-- Every story on this blueprint now reaches the section 7a AC-set-sufficiency floor. 50 new hand-authored ACs cover the documented failure paths named in the guide and TAC records, per-story range 4-6 (from the 1 shipped on every story in the first 1.1.0 pass): US-33101 gains five failure-path ACs (env.CELL unbound closing F-4 namespace, env.HUB unbound, invalid sink, repeat-boot idempotency, sole-reader boundary); US-33102 gains four ACs (N=10 concurrent, mixed +1/-1 deltas, zero-delta, single-caller identity); US-33103 gains five ACs (SQL query surface exists, KV batch refuses closing F-6 KV, driver write failure with kind DO_STORAGE_WRITE_FAILED closing F-7 write, empty/populated list boundaries, 128 KiB vendor-cited value cap with vendor URL); US-33104 gains four ACs (setAlarm(-1) refuses closing F-4 alarm, re-schedule overwrites, handler-throw isolates with DO_ALARM_HANDLER_FAILED, deleteAlarm before fire); US-33105 gains five ACs (malformed message closing F-4 hub, empty-hub persistence, slow-socket isolation, N=10 concurrent broadcasts, unknown message type); US-33106 gains three ACs (allow-list mutation, closure-over-fixture, empty-payload boundary); US-33107 gains three ACs (comment-only mention, nested-directory recursion, extension filter); US-33108 gains four ACs (rename-as-new-migration-tag, silent-rename refuses, missing migrations block, stale new_classes keyword vendor-cited); US-33109 gains three ACs (read has no witness, reset has no witness, N=100 concurrent); US-33110 gains four ACs (cold-start reconstruction closing F-5, wake-on-message closing F-5 second half, hibernate-before-broadcast, repeated cycles idempotency); US-33111 gains three ACs (SQL query verbs closing F-6 SQL, KV refusal kind, unknown backend refuses); US-33112 gains three ACs (bounded-wait timeout, partial env-vars, non-2xx API response); US-33113 gains four ACs (wrangler-not-installed warn, bind-timeout warn, workerd-handler-throws fail, teardown discipline). Every new AC carries `disposition`, most carry `ownerRef` into the owning TAC, and vendor-fact ACs carry `vendorCitation` (migrations page, DO overview, DO limits, DO alarms, DO websockets) with today's verifiedOn date.
-- `rcf define blueprint lint-consistency` still reports zero pass-1 and pass-2 findings. Blueprint stays at v1.1.0 on the same unreleased minor.
+- Every story on this blueprint now reaches the section 7a AC-set-sufficiency floor. 50 new hand-authored ACs cover the documented failure paths named in the guide and TAC records, per-story range 4-6: US-33101 gains five failure-path ACs (env.CELL unbound closing the namespace gap, env.HUB unbound, invalid sink, repeat-boot idempotency, sole-reader boundary); US-33102 gains four ACs (N=10 concurrent, mixed +1/-1 deltas, zero-delta, single-caller identity); US-33103 gains five ACs (SQL query surface exists, KV batch refuses KV, driver write failure with kind DO_STORAGE_WRITE_FAILED closing the write gap, empty/populated list boundaries, 128 KiB vendor-cited value cap with vendor URL); US-33104 gains four ACs (setAlarm(-1) refuses closing the alarm gap, re-schedule overwrites, handler-throw isolates with DO_ALARM_HANDLER_FAILED, deleteAlarm before fire); US-33105 gains five ACs (malformed message closing the hub gap, empty-hub persistence, slow-socket isolation, N=10 concurrent broadcasts, unknown message type); US-33106 gains three ACs (allow-list mutation, no fixture-state carry between cases, empty-payload boundary); US-33107 gains three ACs (comment-only mention, nested-directory recursion, extension filter); US-33108 gains four ACs (rename-as-new-migration-tag, silent-rename refuses, missing migrations block, stale new_classes keyword vendor-cited); US-33109 gains three ACs (read has no witness, reset has no witness, N=100 concurrent); US-33110 gains four ACs (cold-start reconstruction, wake-on-message closing the second gap half, hibernate-before-broadcast, repeated cycles idempotency); US-33111 gains three ACs (SQL query verbs SQL, KV refusal kind, unknown backend refuses); US-33112 gains three ACs (bounded-wait timeout, partial env-vars, non-2xx API response); US-33113 gains four ACs (wrangler-not-installed warn, bind-timeout warn, workerd-handler-throws fail, teardown discipline). Every new AC carries `disposition`, most carry `ownerRef` into the owning TAC, and vendor-fact ACs carry `vendorCitation` (migrations page, DO overview, DO limits, DO alarms, DO websockets).
 
-### Fixed (review fix pass, 2026-09-09)
+### Fixed
 
-- `AC-33108-1` gains `vendorCitation` to the Cloudflare Durable Objects migrations page (verifiedOn 2026-09-09) so the vendor-fact leader carries a citation alongside `AC-33108-2..4` (review F-5).
-- `AC-33108-5` reworded to what the cited vendor page actually carries: "key-value backed namespaces can no longer be created; only new_sqlite_classes mints a fresh namespace". The prior prose specifics ("HTTP 403 code 10099", "2026-07-09") are dropped from AC and CHANGELOG surfaces because the cited page does not state them; the internal real-account probe evidence is not citable in customer content (review F-5).
-- Probe `wrangler-seam.mjs` comment reworded to align with the cited page (drops the internal cutover date and HTTP code claims); ADR-3402 context de-personified ("WSD lane" removed) (review F-3, F-5).
-- Register sweep: every guide, README, ADR, blueprint.json, US, AC, TAC and probe comment surface on the blueprint has internal operator names, host names, work-item and dispatch ids, and train labels neutralised to concept ("a follow-up", "the throwaway prefix", "the shipped default"). CHANGELOG entries keep internal provenance (review F-3).
+- `AC-33108-1` gains `vendorCitation` to the Cloudflare Durable Objects migrations page so the vendor-fact leader carries a citation alongside `AC-33108-2..4`.
+- `AC-33108-5` states what the cited vendor page carries: key-value backed namespaces can no longer be created; only `new_sqlite_classes` mints a fresh namespace.
 
 ## 1.0.1 (2026-09-08)
 
-hardening pass (`h2-cf-platform-probe-integrity`): probe-integrity patch. No capability change.
-
+Probe-integrity patch (`h2-cf-platform-probe-integrity`). No capability change.
 ### Changed
 
 - Replaced the credential-readiness pass-stub in `real-account-storage-smoke.mjs` with a real HTTP PUT-then-GET storage round-trip driver against a deployed Worker route (`/cell/:id/storage/:key`) that opens the DO facade, writes a fixture key, reads it back, and asserts byte equality. Activated when `CI_HAS_CLOUDFLARE_ACCOUNT` is set with `CF_DO_WORKER_URL`, `CF_ACCOUNT_ID`, `CF_DO_NAMESPACE_ID` and `CF_API_TOKEN`. Locally proven against `wrangler dev --local` (64-byte round-trip byte-equal). A pass is no longer reachable from credential presence alone.

package/blueprints/platform-cloudflare-durable-objects/docs/topics.md

@@ -60,7 +60,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 33101-33112 sit at the LOW end of the 33101-33899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a platform-cloudflare-durable-objects REQ id into the number 33113 would collide against a shipped US-33113; band headroom (33113-33899) leaves that space.
+US 33101-33112 sit at the LOW end of the 33101-33899 band on purpose. A project-side story mechanically derived from a platform-cloudflare-durable-objects REQ id into the number 33113 would collide against a shipped US-33113; band headroom (33113-33899) leaves that space.
 
 ADR/TAC suffixes for this blueprint use the 3401-3499 block, continuing the shelf pattern.
 

package/blueprints/platform-cloudflare-kv/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to `platform-cloudflare-kv` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
 
+## 1.1.4 - 2026-09-12
+
+Event-secrecy anatomy runs the mutation-switch case in-process so the shipped report record stays untouched.
+
+- Anatomy: `test/blueprint/platform-cloudflare-kv-anatomy.test.js` toggles `SIMULATE_PII_LEAK` inside the test process and invokes the `event-secrecy` probe module a second time, then validates the returned result set against fail and forbiddenKeys in memory. The prior child-process spawn of `contributions/probes/run-event-secrecy.mjs` is removed; the probe body and the fixture-side shim are unchanged.
+- Reports: the tracked `event-secrecy` record under `.rcf/reports/blueprints/platform-cloudflare-kv/` is now byte-identical after a full `pnpm test` run and is regenerated only through a deliberate shim invocation.
+
 ## 1.1.3 - 2026-09-10
 
 Positive-evidence rule alignment on the probe pack skip path (authoring standard section 7d), plus a register and citation patch.
@@ -34,19 +41,17 @@ Owner reference for the KV event-record whitelist.
 - `platform-cloudflare-kv-REQ-005` reworded to separate the applied cache-aside TTL (LOCAL expiry) from the KV eventual-consistency propagation window (vendor-owned, up to 60 seconds or more per the Cloudflare KV documentation). The v1.0.x wording that called the elicited TTL a "global staleness ceiling" is retired; the guide surfaces the two clocks separately and cross-references `platform-cloudflare-durable-objects` as the strong-consistency answer (F-3).
 - Every existing REQ carries a `deliveredBy` link into a TAC or ADR (five links). Every existing AC carries `disposition`. `rcf define blueprint lint-consistency` reports zero pass-1 and pass-2 findings.
 
-### Added (criterion b completion, second pass 2026-09-09)
+### Added
 
-- Every story on this blueprint now reaches the section 7a AC-set-sufficiency floor. 36 new hand-authored ACs cover the documented failure paths named in the guide and TAC records, per-story range 4-6 (from the 1-3 shipped in the first 1.1.0 pass): US-31101 gains four failure-path ACs (binding-unbound closing F-7 write, invalid sink, repeat-boot idempotency, ready-check rejects with KV_FACADE_NOT_READY); US-31102 gains three ACs (non-facade leak, comment-only mention, nested-directory recursion); US-31103 gains four ACs (getWithMetadata closing F-5, per-call TTL propagation closing F-5, write-failed with KV_WRITE_FAILED closing F-7, read-failed with KV_READ_FAILED closing F-7); US-31104 gains four ACs (cursor pagination closing F-5, empty prefix, no-match, list_complete indicator); US-31105 gains four ACs (TTL floor clamping closing F-6, origin-throws, concurrent-miss single-flight, source classification); US-31106 gains three ACs (per-call TTL override closing F-6, per-call TTL below floor clamps, TTL boundary strict less-than); US-31107 gains three ACs (additional-field mutation, causal ordering, closed vocabulary); US-31108 gains three ACs (metadata-blob never a body, substring scan across all kinds, layer separation); US-31109 gains three ACs (vendor propagation window in guide, DO as strong-consistency alternative in guide, no cross-region claim on any AC); US-31110 gains three ACs (unknown mode refuses, empty prefix behaves as flat, nested prefix); US-31111 gains two ACs (strict FIFO drain of 10 pre-ready calls, post-ready no-queue path). Every new AC carries `disposition`, most carry `ownerRef` into the owning TAC, and vendor-fact ACs carry `vendorCitation` (KV overview, KV API, KV how-KV-works, KV limits) with today's verifiedOn date.
-- `rcf define blueprint lint-consistency` still reports zero pass-1 and pass-2 findings. Blueprint stays at v1.1.0 on the same unreleased minor.
+- Every story on this blueprint now reaches the section 7a AC-set-sufficiency floor. 36 new hand-authored ACs cover the documented failure paths named in the guide and TAC records, per-story range 4-6: US-31101 gains four failure-path ACs (binding-unbound closing the write gap, invalid sink, repeat-boot idempotency, ready-check rejects with KV_FACADE_NOT_READY); US-31102 gains three ACs (non-facade leak, comment-only mention, nested-directory recursion); US-31103 gains four ACs (getWithMetadata, per-call TTL propagation, write-failed with KV_WRITE_FAILED, read-failed with KV_READ_FAILED); US-31104 gains four ACs (cursor pagination, empty prefix, no-match, list_complete indicator); US-31105 gains four ACs (TTL floor clamping, origin-throws, concurrent-miss single-flight, source classification); US-31106 gains three ACs (per-call TTL override, per-call TTL below floor clamps, TTL boundary strict less-than); US-31107 gains three ACs (additional-field mutation, causal ordering, closed vocabulary); US-31108 gains three ACs (metadata-blob never a body, substring scan across all kinds, layer separation); US-31109 gains three ACs (vendor propagation window in guide, DO as strong-consistency alternative in guide, no cross-region claim on any AC); US-31110 gains three ACs (unknown mode refuses, empty prefix behaves as flat, nested prefix); US-31111 gains two ACs (strict FIFO drain of 10 pre-ready calls, post-ready no-queue path). Every new AC carries `disposition`, most carry `ownerRef` into the owning TAC, and vendor-fact ACs carry `vendorCitation` (KV overview, KV API, KV how-KV-works, KV limits).
 
-### Fixed (review fix pass, 2026-09-09)
+### Fixed
 
-- `AC-31109-1` disposition flipped from `fixed` to `template`: the applying project sets the cache-aside TTL, so an AC that binds the local-expiry window to `elicitedTtlMs` is an elicit-branch AC per section 7b (review F-4).
-- Register sweep: README, ADR and probe comments have internal operator names, host names, work-item ids, internal train labels and "operator ruling" references neutralised to concept ("throwaway prefix", "probe-integrity pass", "operator ruling"); code literals bound to real Cloudflare API state ("h2-cf-probe-integrity-scratch-kv-" and similar) are unchanged. CHANGELOG entries keep internal provenance (review F-3).
+- `AC-31109-1` disposition flipped from `fixed` to `template`: the applying project sets the cache-aside TTL, so an AC that binds the local-expiry window to `elicitedTtlMs` is an elicit-branch AC per section 7b.
 
 ## 1.0.2 (2026-09-08)
 
-follow-up (addendum item 6 fixture defect): the real-account KV probe now self-provisions its own throwaway namespace, closing the second-tier undeclared-env skip real-account hit at the real-account gate on 2026-09-08 (`REAL RUN: PARTIAL`, `MERGE DECISION: HOLD`). No shipped-code capability change.
+The real-account KV probe self-provisions its own throwaway namespace, so a pre-declared namespace id is no longer required at the real-account gate. No shipped-code capability change.
 
 ### Changed
 
@@ -65,15 +70,14 @@ The local proof harness under `packages/rcf-lite/test/fixtures/cf-platform/test/
 
 ## 1.0.1 (2026-09-08)
 
-hardening pass (`h2-cf-platform-probe-integrity`): probe-integrity patch across the four Cloudflare-platform blueprints. No capability change.
-
+Probe-integrity patch (`h2-cf-platform-probe-integrity`) across the four Cloudflare-platform blueprints. No capability change.
 ### Changed
 
-- Re-anchored all five KV probes and the README from the defunct `AC-5xxx` id space to the shipped `AC-31xxx` band (nine shipped ACs: `AC-31101-1`, `AC-31102-1`, `AC-31103-1`, `AC-31103-2`, `AC-31104-1`, `AC-31105-1`, `AC-31106-1`, `AC-31107-1`, `AC-31108-1`). Every one of the nine now has a runtime observable through a re-anchored probe. Anatomy-test assertions in `packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js` moved with the re-anchor. Dispatch addendum ruling 1.
+- Re-anchored all five KV probes and the README from the defunct `AC-5xxx` id space to the shipped `AC-31xxx` band (nine shipped ACs: `AC-31101-1`, `AC-31102-1`, `AC-31103-1`, `AC-31103-2`, `AC-31104-1`, `AC-31105-1`, `AC-31106-1`, `AC-31107-1`, `AC-31108-1`). Every one of the nine now has a runtime observable through a re-anchored probe. Anatomy-test assertions in `packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js` moved with the re-anchor.
 - Moved the `SIMULATE_CACHE_MISS` mutation switch out of `cache-aside-hit-then-miss.mjs` into fixture shim `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-cache-aside-shim.mjs`; the probe body holds zero `SIMULATE_` token references (`AC-15401-1` mutation-purity rule).
 - Moved the `SIMULATE_PII_LEAK` mutation switch out of `event-secrecy.mjs` into fixture shim `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-event-secrecy-shim.mjs`; the probe body holds zero `SIMULATE_` token references.
 - Reworded the "fake clock" comment on `cache-aside-hit-then-miss.mjs` header to name the local test double honestly ("elicited deterministic clock the fixture advances").
-- Reworded the `Known limitations` (CHANGELOG) and `Known mechanism-reach gaps` (README) entries on the loader `elicits[]` `when` block predicate to name the loader-capability uplift as a loader-capability follow-up (0.26.x capability change, out of the hardening pass's 0.25.x patch scope per operator ruling 1). The entry describes the current shipped shape and points forward to the follow-up.
+- The `Known limitations` (CHANGELOG) and `Known mechanism-reach gaps` (README) entries name the loader `elicits[]` `when` block behaviour: only `requiresCapability` arrays are currently supported, so an `elicitedNonEmpty` predicate is not available and the elicit fires unconditionally. Supporting the predicate requires a loader-side capability extension.
 
 ### Fixed
 
@@ -99,4 +103,4 @@ hardening pass (`h2-cf-platform-probe-integrity`): probe-integrity patch across
 
 - The `real-account-eventual-consistency-smoke` probe records `accountBoundSkipped: true` and aggregates to `pass` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset (spec section 3.5 pass-with-skip). Full mechanism reach requires a CI environment with the paired `CF_ACCOUNT_ID`, `CF_KV_NAMESPACE_ID` and `CF_API_TOKEN` env vars.
 - The four local probes drive an in-memory KV driver whose shape matches the Workers KV binding at the facade boundary. Vendor surface changes beyond that boundary (a new list cursor format, a header-only limit) are not caught by the local probes; the real-account smoke is the mechanism-reach closure for that gap.
-- The loader's supported `when` block on `elicits[]` currently accepts only `requiresCapability` arrays, so the elicited `kv-metadata-field-pattern` fires unconditionally rather than gating on an `elicitedNonEmpty` predicate for `kv-binding-name`. The elicit fires unconditionally today and the guide teaches the pattern; a loader-capability uplift extending `validateElicits` to accept an `elicitedNonEmpty` predicate is captured as follow-up work item a loader-capability follow-up (0.26.x capability change, out of the hardening pass's 0.25.x patch scope per operator ruling 1).
+- The loader's supported `when` block on `elicits[]` currently accepts only `requiresCapability` arrays. An `elicitedNonEmpty` predicate for gating `kv-metadata-field-pattern` on `kv-binding-name` is not supported by the loader today, so the elicit fires unconditionally; the guide teaches the intended pattern.