@blamejs/core 0.6.7 → 0.6.11

package/CHANGELOG.md

@@ -8,6 +8,11 @@ upgrading across more than a few patches at a time.
 
 ## v0.6.x
 
+- **0.6.11** (2026-05-01) — wiki example-execution validator: fixture init no longer reaches across module realms (unblocks the npm-publish workflow's wiki-e2e gate, which `npm install --install-links` copies the framework into the wiki's node_modules — two distinct singletons before this fix)
+- **0.6.10** (2026-05-01) — README / SECURITY / CONTRIBUTING / wiki: removed stale version stamps and an inaccurate vendored-dep list; SECURITY now points at `lib/vendor/MANIFEST.json` for the authoritative vendor list; supported-versions table no longer pins to a specific minor; wiki archive example names the digest variable correctly (was `sha256`, output is SHA3-512 hex)
+- **0.6.9** (2026-05-01) — b.archive.zip().digest() returns a SHA3-512 hex string (was SHA-256); operators reconciling against an external SHA-256 must hash the bytes themselves
+- **0.6.8** (2026-05-01) — wiki primitive-section validator: presence + opts diff + example execution against canonical fixture
+- **0.6.7** (2026-05-01) — db.role.switched audit + per-role metrics + API snapshot baseline
 - **0.6.6** (2026-05-01) — request-time DB role binding + Postgres RLS migrations
 - **0.6.5** (2026-05-01) — b.db.declareView + b.externalDb.migrate
 - **0.6.4** (2026-05-01) — wiki schema docs realigned with the actual lib API
@@ -73,7 +78,7 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
-- **0.3.39** (2026-04-29) — MIGRATING.md generator scans deprecate() calls in lib/
+- **0.3.39** (2026-04-29) — MIGRATING.md generator scans deprecate calls in lib/
 - **0.3.38** (2026-04-29) — LTS-CALENDAR.md publishes the major-cadence + algorithm posture
 - **0.3.37** (2026-04-29) — bundled pure-JS mTLS engine + vendor-update.sh + CHANGELOG + thanks page
 - **0.3.36** (2026-04-29) — prepack guard refuses to publish any path that matches a gitignore rule
@@ -88,15 +93,15 @@ upgrading across more than a few patches at a time.
 - **0.3.27** (2026-04-29) — Dockerfile pre-builds public/dist in deps stage so runtime container boots cleanly under --cap-drop ALL
 - **0.3.26** (2026-04-29) — operator-facing env-var surface, GitHub-side ops docs, contribution standards
 - **0.3.25** (2026-04-29) — env-var surface documented across Dockerfile, docker-compose.prod, DEPLOY.md, README; smoke-test GHCR login fix
-- **0.3.24** (2026-04-29) — CI + release-container workflows brought to hermitstash parity (structured output, multi-arch, cosign, post-publish smoke)
+- **0.3.24** (2026-04-29) — CI + release-container workflows brought (structured output, multi-arch, cosign, post-publish smoke)
 - **0.3.23** (2026-04-29) — _runVault and _runBackup refactored to use b.cliHelpers (sweep complete across the three CLI commands the helper was designed for)
 - **0.3.22** (2026-04-29) — blamejs api-key CLI; b.cliHelpers shared primitive for headless app + reporter shape
 - **0.3.21** (2026-04-29) — blamejs backup CLI: inspect / verify / extract; backup encryption format documented
 - **0.3.20** (2026-04-29) — drop redundant Windows-flaky audit.flush perf assertion
 - **0.3.19** (2026-04-29) — wiki docs for the unwired primitives surface
 - **0.3.18** (2026-04-29) — blamejs vault CLI: seal / unseal / rotate / status
-- **0.3.17** (2026-04-29) — Tier-A validateOpts coverage extended to remaining operator-facing primitives (i18n, bundler, migrations, seeders, template, jobs, cookies, log, mtlsCa, staticServe, handlers, websocket, pqcGate, tracing, metrics — 15 more factories now reject typo'd opts at boot). Coverage is now ~39/lib primitives with the helper; the remaining handful (app-shutdown, chain-writer, dev, error-page, nonce-store, protocol-dispatcher, render, session, pqc-agent) are either internal-only — operators don't construct them directly — or have a single required-key surface where typo guards add no value.
-- **0.3.16** (2026-04-29) — Tier-A config validation, CSRF cookie mode, HTML balance, dynamic Cache-Control, URL canonicalization
+- **0.3.17** (2026-04-29) — validateOpts coverage extended to remaining operator-facing primitives (i18n, bundler, migrations, seeders, template, jobs, cookies, log, mtlsCa, staticServe, handlers, websocket, pqcGate, tracing, metrics — 15 more factories now reject typo'd opts at boot). Coverage is now ~39/lib primitives with the helper; the remaining handful (app-shutdown, chain-writer, dev, error-page, nonce-store, protocol-dispatcher, render, session, pqc-agent) are either internal-only — operators don't construct them directly — or have a single required-key surface where typo guards add no value.
+- **0.3.16** (2026-04-29) — config validation, CSRF cookie mode, HTML balance, dynamic Cache-Control, URL canonicalization
 - **0.3.15** (2026-04-29) — cors: accept Origin: null when Sec-Fetch-Site is same-origin (browsers send opaque Origin: null on form-navigation POSTs from a page whose response sets Referrer-Policy: no-referrer; the Fetch-metadata Sec-Fetch-Site header is the matching disambiguation signal — same-origin or none means accept, anything else stays refused)
 - **0.3.14** (2026-04-29) — Dockerfile hotfix + lint as release gate
 - **0.3.13** (2026-04-29) — CI lint scans + Wolfi container + Trivy two-step + lint cleanup
@@ -133,7 +138,7 @@ upgrading across more than a few patches at a time.
 - **0.2.25** (2026-04-28) — b.slug
 - **0.2.24** (2026-04-28) — b.retry primitive
 - **0.2.23** (2026-04-28) — test helpers consolidate
-- **0.2.22** (2026-04-28) — tier-aware input validation
+- **0.2.22** (2026-04-28) — input validation
 - **0.2.21** (2026-04-28) — defineClass.factory replaces per-module _err wrappers
 - **0.2.20** (2026-04-28) — b.requestHelpers + metrics _normalizeLabelArg
 - **0.2.19** (2026-04-28) — audit.safeEmit replaces per-module _emit wrappers
@@ -195,22 +200,22 @@ upgrading across more than a few patches at a time.
 - **0.1.78** (2026-04-27) — pqc-agent: locked-posture HTTPS agent + http-client refactor — slice 2
 - **0.1.77** (2026-04-27) — pqc-gate: TCP-level PQC enforcement on ClientHello — slice 1
 - **0.1.76** (2026-04-27) — bundler: content-hashed asset pipeline + manifest — complete
-- **0.1.75** (2026-04-27) — dev: file-watch + child-process restart engine — slice 6 ( complete)
+- **0.1.75** (2026-04-27) — dev: file-watch + child-process restart engine — slice 6 (complete)
 - **0.1.74** (2026-04-27) — cli: bin/blamejs + migrate up/down/status — slice 5
 - **0.1.73** (2026-04-27) — migrations: public up/down/status runner — slice 4
 - **0.1.72** (2026-04-27) — cookies: parse/serialize + sealed-value access gate — slice 3
 - **0.1.71** (2026-04-27) — errors-page: rich dev page + safe prod page; middleware shim — slice 2
 - **0.1.70** (2026-04-27) — log: structured JSON logging with request-id correlation — slice 1
-- **0.1.69** (2026-04-27) — scheduler: cron + interval over jobs/queue — slice 5 ( complete)
+- **0.1.69** (2026-04-27) — scheduler: cron + interval over jobs/queue — slice 5 (complete)
 - **0.1.68** (2026-04-27) — mail: generalize http transport, demote resend to thin preset
 - **0.1.67** (2026-04-27) — mail: contract + console/memory/smtp/resend transports — slice 4
 - **0.1.66** (2026-04-26) — jobs (define + enqueue + in-process worker) + createApp wiring — slices 2/3
 - **0.1.65** (2026-04-26) — createApp factory — slice 1
-- **0.1.64** (2026-04-26) — forms + csrfProtect — slice 4 ( complete)
+- **0.1.64** (2026-04-26) — forms + csrfProtect — slice 4 (complete)
 - **0.1.63** (2026-04-26) — staticServe: file serving + ETag + SRI integrity — slice 3
 - **0.1.62** (2026-04-26) — render: HTTP response helpers — slice 2
 - **0.1.61** (2026-04-26) — template engine (eval-free interpreter) — slice 1
-- **0.1.60** (2026-04-26) — auth.jwt with SLH-DSA-SHAKE-256f default — slice 5/5 ( complete)
+- **0.1.60** (2026-04-26) — auth.jwt with SLH-DSA-SHAKE-256f default — slice 5/5 (complete)
 - **0.1.59** (2026-04-26) — middleware.attachUser + middleware.requireAuth — slice 4
 - **0.1.58** (2026-04-26) — auth.passkey (WebAuthn / FIDO2) — slice 3
 - **0.1.57** (2026-04-26) — TOTP defaults match spec (HMAC-SHA512 / 128-byte secret / 8 digits / 30s) + crypto.random truncation fix
@@ -221,7 +226,7 @@ upgrading across more than a few patches at a time.
 - **0.1.52** (2026-04-26) — consent_log integrity parity with audit_log (closes the cluster spec storage move)
 - **0.1.51** (2026-04-26) — queue jobs move to external-db in cluster mode
 - **0.1.50** (2026-04-26) — sessions move to external-db in cluster mode
-- **0.1.49** (2026-04-26) — boot-time vault-key consistency check (closes cluster spec phase 4)
+- **0.1.49** (2026-04-26) — boot-time vault-key consistency check (closes cluster spec)
 - **0.1.48** (2026-04-26) — boot-time audit-tip rollback detection in cluster mode
 - **0.1.47** (2026-04-26) — fix handlers.drain unbounded loop on recursive emit (cluster-mode audit hang)
 - **0.1.46** (2026-04-26) — cluster-mode audit-tip fencing-token guard
@@ -278,7 +283,7 @@ upgrading across more than a few patches at a time.
 - **0.0.18** (2026-04-26) — strip internal-process narrative from framework comments
 - **0.0.17** (2026-04-25) — internal adoption sweep + functional scale helpers
 - **0.0.16** (2026-04-25) — atomic file I/O + safe parsers (XML, CSV)
-- **0.0.15** (2026-04-25) — HTTP middleware: request lifecycle hardening ( begin)
+- **0.0.15** (2026-04-25) — HTTP middleware: request lifecycle hardening (begin)
 - **0.0.14** (2026-04-25) — external DB (Shape B: app-data-only, bring-your-own-client)
 - **0.0.13** (2026-04-25) — log streaming + redaction + bidirectional command channel
 - **0.0.12** (2026-04-25) — queue dispatcher + local SQLite-backed protocol

package/README.md

@@ -17,7 +17,7 @@ The modern Node app is a 1,200-package supply-chain liability with no LTS calend
 
 ## Status
 
-Pre-1.0. Usable end-to-end — operators can build production apps on it today; the surface is still subject to change before 1.0. Recent line is **v0.6.3** ([releases](https://github.com/blamejs/blamejs/releases) · [npm](https://www.npmjs.com/package/@blamejs/core) · [container](https://github.com/blamejs/blamejs/pkgs/container/blamejs-wiki)).
+Pre-1.0. Usable end-to-end — operators can build production apps on it today; the surface is still subject to change before 1.0. The latest release lives on [GitHub](https://github.com/blamejs/blamejs/releases), [npm](https://www.npmjs.com/package/@blamejs/core), and the [container registry](https://github.com/blamejs/blamejs/pkgs/container/blamejs-wiki).
 
 ```js
 var b = require("@blamejs/core");

package/lib/api-key.js

@@ -43,14 +43,14 @@
  * Same dual-storage pattern as sessions — local SQLite in single-node
  * mode, external-db in cluster mode, dispatched via cluster-storage.
  *
- * Validation tiers:
+ * Validation policy:
  *
- *   - apiKey.create opts                    → Tier A (throw)
- *   - registry.issue opts                   → Tier A (throw ApiKeyError)
- *   - registry.rotate(id) on missing/revoked → Tier A (throw)
- *   - registry.verify(token) on any failure → Tier C (return null)
- *   - registry.revoke(id) on missing        → Tier C (return false)
- *   - registry.getById(id) on missing       → Tier C (return null)
+ *   - apiKey.create opts                    → throw at config time
+ *   - registry.issue opts                   → throw ApiKeyError at call site
+ *   - registry.rotate(id) on missing/revoked → throw ApiKeyError at call site
+ *   - registry.verify(token) on any failure → return null (tolerant read)
+ *   - registry.revoke(id) on missing        → return false (tolerant read)
+ *   - registry.getById(id) on missing       → return null (tolerant read)
  */
 
 var crypto = require("./crypto");
@@ -69,7 +69,7 @@ var observability = lazyRequire(function () { return require("./observability");
 
 function _emitEvent(name, value, labels) {
   try { observability().event(name, value, labels || {}); }
-  catch (_e) { /* Tier B: hot-path observability sink */ }
+  catch (_e) { /* hot-path observability sink — drops silent on internal throws */ }
 }
 
 var _err = ApiKeyError.factory;
@@ -127,7 +127,7 @@ var DEFAULTS = Object.freeze({
   hashAlgo:         "shake256",
 });
 
-// ---- Tier-A validation helpers ----
+// ---- Config-time validation helpers (throw on bad input) ----
 
 function _isPositiveInt(n) {
   return typeof n === "number" && isFinite(n) && n >= 1 && Math.floor(n) === n;

package/lib/archive.js

@@ -216,11 +216,11 @@ function zip() {
   }
 
   function digest() {
-    // SHA-256 of the produced archive bytes — useful for operator-side
-    // integrity logging on exported bundles. Not vendor-locked to any
-    // particular hash; SHA-256 is universally recognized for content
-    // addressing.
-    return nodeCrypto.createHash("sha256").update(toBuffer()).digest("hex");
+    // SHA3-512 of the produced archive bytes — useful for operator-side
+    // integrity logging on exported bundles. Matches the framework's
+    // PQC-first hash posture; operators reconciling against an external
+    // SHA-256 can hash the bytes themselves.
+    return nodeCrypto.createHash("sha3-512").update(toBuffer()).digest("hex");
   }
 
   return {

package/lib/audit.js

@@ -711,8 +711,8 @@ function emit(event) {
 // audit outage doesn't crash the request handler. This is that helper,
 // hoisted out so each module can stop redefining it.
 //
-// Tier B (drop-silent): malformed input is dropped without throwing, by
-// design. safeEmit is called from request hot paths where throwing on a
+// Drop-silent on malformed input by design. safeEmit is called from
+// request hot paths where throwing on a
 // missing `action` would mean a malformed audit attempt crashes the
 // request that triggered it — strictly worse than the missing audit
 // row. Operators who need a hard guarantee the event landed should call

package/lib/auth/jwt.js

@@ -247,10 +247,10 @@ async function verify(token, opts) {
     if (typeof opts.clockToleranceSec !== "number" ||
         !isFinite(opts.clockToleranceSec) ||
         opts.clockToleranceSec < 0) {
-      // Tier-A: a negative tolerance over-tightens the window (legit
-      // tokens get rejected as expired or not-yet-valid). A non-finite
-      // value would NaN-poison the comparison. Catch both at config
-      // time rather than producing surprise rejections in production.
+      // Throw at config time: a negative tolerance over-tightens the
+      // window (legit tokens get rejected as expired or not-yet-valid)
+      // and a non-finite value would NaN-poison the comparison. Catch
+      // both here rather than producing surprise rejections in production.
       throw new AuthError("auth-jwt/bad-clock-tolerance",
         "verify: clockToleranceSec must be a non-negative finite number, got " +
         JSON.stringify(opts.clockToleranceSec));

package/lib/break-glass.js

@@ -17,10 +17,10 @@
  *
  * Spec: memory/specs/blamejs-break-glass-spec.md
  *
- * v0.5.0 ships Model A (policy gate) + TOTP factor + Tier-A validation +
- * 14 error codes + audit chain integration. Model B (cryptographic
- * gate via per-row K_row), passkey factor, service-account bypass,
- * and admin tools land in v0.5.1 / v0.5.2 per the phasing plan.
+ * Ships Model A (policy gate) + TOTP factor + config-time input
+ * validation + 14 error codes + audit chain integration. Model B
+ * (cryptographic gate via per-row K_row), passkey factor, service-
+ * account bypass, and admin tools land in subsequent patches.
  *
  * Public API:
  *
@@ -59,8 +59,9 @@ var lockout = lazyRequire(function () { return require("./auth/lockout"); });
 var passkey = lazyRequire(function () { return require("./auth/passkey"); });
 
 // Errors — all 14 codes documented in the spec. `permanent: true`
-// means caller's input is bad (Tier-A); `permanent: false` means
-// transient (factor failed, rate-limited) — caller may retry.
+// means caller's input is bad (config-time / call-site reject);
+// `permanent: false` means transient (factor failed, rate-limited)
+// — caller may retry.
 var BreakGlassError = defineClass("BreakGlassError", { alwaysPermanent: false });
 
 // ---- Defaults (matched to operator-locked decisions) ----

package/lib/cache.js

@@ -51,14 +51,14 @@
  *   { get, set, del, clear, size, close } — operator-supplied custom
  *     backend (Redis, Memcached, …). All methods async.
  *
- * Validation tiers:
+ * Validation policy:
  *
- *   - create() opts                       → Tier A (throw at boot)
- *   - get/set/del/has/wrap key arg type   → Tier A (throw — programming bug)
- *   - set value type                      → C (operator decides what to store)
- *   - per-call ttlMs override             → Tier A (throw — bad ttl is silent footgun)
- *   - audit / observability emit failures → Tier B (drop silent)
- *   - method called after close()         → Tier A (throw BAD_STATE)
+ *   - create() opts                       → throw at boot
+ *   - get/set/del/has/wrap key arg type   → throw at call site (programming bug)
+ *   - set value type                      → tolerant (operator decides what to store)
+ *   - per-call ttlMs override             → throw at call site (bad ttl is silent footgun)
+ *   - audit / observability emit failures → drop silent (hot-path sink)
+ *   - method called after close()         → throw BAD_STATE at call site
  *
  * Security defaults:
  *
@@ -114,7 +114,7 @@ var DEFAULTS = Object.freeze({
   auditClear:              true,
 });
 
-// ---- Tier-A validation helpers ----
+// ---- Config-time validation helpers (throw on bad input) ----
 
 function _isFiniteNonNegative(n) {
   return typeof n === "number" && isFinite(n) && n >= 0;
@@ -669,7 +669,7 @@ function create(opts) {
     try {
       if (operatorObs) operatorObs.event(name, 1, labels || {});
       else observability().event(name, 1, labels || {});
-    } catch (_e) { /* Tier B: hot-path observability sink */ }
+    } catch (_e) { /* hot-path observability sink — drops silent on internal throws */ }
   }
 
   function emitAudit(action, info) {

package/lib/constants.js

@@ -18,10 +18,10 @@ var pkg = require("../package.json");
 // reader sees the unit at the call site (`C.TIME.minutes(45)` instead of
 // adding a new FORTY_FIVE_MIN constant). All return integer milliseconds.
 //
-// Tier A validation: these are config-time helpers. Throw on non-finite
-// or negative input so a typo (`C.TIME.minutes(opts.x)` where opts.x is
-// undefined) surfaces at boot instead of silently becoming `NaN` or `0`
-// and shipping a 0ms timeout into production.
+// Throw on non-finite or negative input — these are config-time helpers,
+// so a typo (`C.TIME.minutes(opts.x)` where opts.x is undefined) should
+// surface at boot instead of silently becoming `NaN` or `0` and shipping
+// a 0ms timeout into production.
 function _validateDuration(unit, n) {
   if (typeof n !== "number" || !isFinite(n) || n < 0) {
     throw new TypeError("C.TIME." + unit + ": expected non-negative finite number, got " +
@@ -42,8 +42,8 @@ var TIME = Object.freeze({
 // (KiB/MiB/GiB), since every existing byte literal in the framework
 // already uses 1024 multiplication.
 //
-// Tier A validation: same rationale as TIME — bad input surfaces at the
-// call site, not as a silent NaN cap that disables size limits.
+// Throw on bad input — same rationale as TIME: bad input surfaces at
+// the call site, not as a silent NaN cap that disables size limits.
 function _validateBytes(unit, n) {
   if (typeof n !== "number" || !isFinite(n) || n < 0) {
     throw new TypeError("C.BYTES." + unit + ": expected non-negative finite number, got " +

package/lib/credential-hash.js

@@ -61,13 +61,13 @@
  *   - Transparent rehash via needsRehash() drains old algos at the
  *     pace of organic verify traffic.
  *
- * Validation tiers:
+ * Validation policy:
  *
- *   - hash() opts (algo, params)         → Tier A (throw)
- *   - hash() secret type / length        → Tier A (throw)
- *   - verify() envelope shape unparsable → Tier C (return false)
- *   - verify() unknown algo ID           → Tier C (return false)
- *   - inspect() bad envelope             → Tier C (return null)
+ *   - hash() opts (algo, params)         → throw at call site
+ *   - hash() secret type / length        → throw at call site
+ *   - verify() envelope shape unparsable → return false (tolerant read)
+ *   - verify() unknown algo ID           → return false (tolerant read)
+ *   - inspect() bad envelope             → return null (tolerant read)
  */
 
 var crypto = require("./crypto");
@@ -79,7 +79,7 @@ var observability = lazyRequire(function () { return require("./observability");
 
 function _emitEvent(name, value, labels) {
   try { observability().event(name, value, labels || {}); }
-  catch (_e) { /* Tier B: hot-path observability sink */ }
+  catch (_e) { /* hot-path observability sink — drops silent on internal throws */ }
 }
 
 // Default SHAKE256 output size for newly-issued credentials. 128
@@ -135,7 +135,7 @@ var ID_TO_NAME = Object.freeze({
   0x02: "argon2id",
 });
 
-// ---- Tier-A validation ----
+// ---- Call-site validation (throw on bad input) ----
 
 function _validateSecret(secret) {
   if (typeof secret !== "string" && !Buffer.isBuffer(secret)) {
@@ -223,7 +223,7 @@ async function hash(secret, opts) {
 }
 
 async function verify(secret, envelope) {
-  // Tier C: any malformed input → false. Lets operators write
+  // Tolerant read: any malformed envelope → false. Lets operators write
   //   if (!await ch.verify(s, row.hash)) return res.status(401);
   // without try/catch ceremony. We still reject obvious caller bugs
   // (non-string-or-Buffer secret) loudly because that signals broken

package/lib/db-declare-view.js

@@ -39,7 +39,7 @@
  * typos surface as clear errors at the migrate command, not as silent
  * empty views or grant-to-nonexistent-role footguns.
  *
- * Tier-A validation at declareView() call time:
+ * Throw at declareView() call time on:
  *   - schema, name, source segments → safeSql.validateIdentifier
  *   - column names in redactColumns / sealedColumns / hashColumns →
  *     safeSql.validateIdentifier
@@ -303,7 +303,7 @@ function declareView(opts) {
   var qSource = safeSql.quoteQualified([spec.source.schema, spec.source.name], "postgres");
 
   async function up(xdb, ctx) {
-    // Tier-A boundary: confirm we're on Postgres before any DDL leaves the process.
+    // Boundary throw: confirm we're on Postgres before any DDL leaves the process.
     if (ctx && ctx.externalDb && ctx.backendName) {
       _ensureBackendIsPostgres(ctx.externalDb, ctx.backendName);
     }

package/lib/external-db-migrate.js

@@ -208,7 +208,7 @@ function _emit(audit, action, outcome, info, reason) {
       metadata: info || {},
       reason:   reason || null,
     });
-  } catch (_e) { /* Tier B: drop-silent */ }
+  } catch (_e) { /* drop-silent — audit emit failure must not crash the migration */ }
 }
 
 // ---- Backend resolution ----

package/lib/http-client.js

@@ -480,8 +480,8 @@ function request(opts) {
     return Promise.reject(_makeError(opts && opts.errorClass, "BAD_ARG", "url is required", true));
   }
 
-  // Validate before/after shapes early — Tier-A throw if the operator
-  // passed something un-callable so the bug surfaces at the call site
+  // Validate before/after shapes early — throw at call site if the
+  // operator passed something un-callable so the bug surfaces here
   // rather than inside the request loop.
   if (opts.before !== undefined) {
     if (!Array.isArray(opts.before) || !opts.before.every(function (f) { return typeof f === "function"; })) {
@@ -896,7 +896,7 @@ function _requestH1(transport, u, opts) {
       var bodyBuf = Buffer.isBuffer(opts.body) ? opts.body : Buffer.from(opts.body, "utf8");
       if (onUploadProgress) {
         // Chunked write so progress reports land before req.end().
-        var CHUNK = 64 * 1024;
+        var CHUNK = C.BYTES.kib(64);
         var off = 0;
         while (off < bodyBuf.length) {
           var slice = bodyBuf.slice(off, Math.min(off + CHUNK, bodyBuf.length));

package/lib/i18n.js

@@ -38,16 +38,16 @@
  *   - {var} interpolation; missing vars render as literal {var} unless
  *     `interpolation.strict: true`.
  *
- * Validation tiers:
+ * Validation policy:
  *
- *   - create() opts                           → Tier A (throw at boot)
- *   - bad locale tag at any boundary          → Tier A (throw)
- *   - t(missingKey)                           → Tier C (return key + obs)
- *   - t() with bad locale override            → Tier A (programming bug)
- *   - plural shape missing 'other'            → Tier A (throw at load)
- *   - interpolation missing var               → Tier C (literal {var})
- *   - format* bad input                       → Tier A
- *   - middleware Accept-Language parse error  → Tier C (defaultLocale)
+ *   - create() opts                           → throw at boot
+ *   - bad locale tag at any boundary          → throw at call site
+ *   - t(missingKey)                           → return key + observability event
+ *   - t() with bad locale override            → throw at call site (programming bug)
+ *   - plural shape missing 'other'            → throw at load time
+ *   - interpolation missing var               → render literal {var}
+ *   - format* bad input                       → throw at call site
+ *   - middleware Accept-Language parse error  → fall back to defaultLocale
  *
  * Security stance: translation values come from operator-controlled
  * files, not user input. {var} interpolation does NOT html-escape;
@@ -97,7 +97,7 @@ var DEFAULTS = Object.freeze({
   RTL_LANGUAGES:    RTL_LANGUAGES,
 });
 
-// ---- Tier-A validation ----
+// ---- Call-site validation (throw on bad input) ----
 
 function _isValidBcp47(tag) {
   if (typeof tag !== "string" || tag.length === 0) return false;
@@ -476,7 +476,7 @@ function create(opts) {
     try {
       if (operatorObs) operatorObs.event(name, 1, labels || {});
       else observability().event(name, 1, labels || {});
-    } catch (_e) { /* Tier B */ }
+    } catch (_e) { /* drop-silent — observability sink must not crash i18n calls */ }
   }
 
   // Cardinal plural-rules instances per locale. `Intl.PluralRules` is
@@ -721,7 +721,7 @@ function create(opts) {
       // Permit setting a non-configured locale (operators may want to
       // experiment), but fall the chain through to the configured ones.
       // Don't throw — i18n.locale is set/observed in many flows; making
-      // it Tier-A would force operators into try/catch around UI setters.
+      // this throw would force operators into try/catch around UI setters.
       _emitObs("i18n.miss.locale", { requested: newLocale, resolved: defaultLocale });
     }
     currentLocale = newLocale;

package/lib/middleware/body-parser.js

@@ -1041,8 +1041,40 @@ async function _parseJsonFromBuf(buf, opts) {
   return parsed;
 }
 
+// raw — convenience wrapper that returns a middleware which buffers
+// the request body as a Buffer regardless of Content-Type. Webhook
+// signature-verification routes use this — the HMAC is computed over
+// the literal body bytes, so JSON-parsing first would change them.
+//
+//   router.post("/hooks/in", b.middleware.bodyParser.raw(), function (req, res) {
+//     verifier.verify(req.headers["x-signature"], req.body);  // req.body is a Buffer
+//   });
+//
+// Accepts the same `raw`-section opts as create() (limit, contentTypes).
+// contentTypes default expands to `["*/*"]` so any Content-Type lands
+// as raw bytes.
+function raw(opts) {
+  opts = opts || {};
+  return create({
+    json:        false,
+    urlencoded:  false,
+    text:        false,
+    multipart:   false,
+    raw: {
+      limit:        opts.limit != null ? opts.limit : DEFAULTS.raw.limit,
+      contentTypes: opts.contentTypes || ["*/*"],
+    },
+  });
+}
+
+// Attach raw onto create so b.middleware.bodyParser.raw() works
+// (middleware/index.js exports the create function as the namespace
+// itself, so static helpers hang off it).
+create.raw = raw;
+
 module.exports = {
   create:           create,
+  raw:              raw,
   BodyParserError:  BodyParserError,
   // Internal helpers exposed for tests + the csrf-protect refactor.
   _contentType:     _contentType,

package/lib/middleware/cors.js

@@ -191,7 +191,7 @@ function create(opts) {
     }
   }
 
-  // Tier A validation on opts.siteOrigin — must parse as http(s) URL.
+  // Throw at create() on bad opts.siteOrigin — must parse as http(s) URL.
   // Accept string OR array of strings.
   var siteOrigins = [];
   if (opts.siteOrigin !== undefined && opts.siteOrigin !== null) {

package/lib/middleware/csrf-protect.js

@@ -34,7 +34,7 @@
  *      (e.g. req.session.data.csrfToken). Issuance + req.csrfToken
  *      exposure are the operator's responsibility in this mode.
  *
- * If neither is supplied, the middleware throws at create() — Tier A
+ * If neither is supplied, the middleware throws at create() —
  * config-time validation, no silent passthrough.
  *
  * Submitted-token sources tried in order on state-changing requests:
@@ -177,7 +177,7 @@ function create(opts) {
     ? opts.trustProxy : false;
   var _isHttps = _isHttpsFor(trustProxy);
 
-  // Tier A — exactly one issuance source.
+  // Throw at create() — exactly one issuance source allowed.
   var hasCookie = opts.cookie != null && opts.cookie !== false;
   var hasLookup = typeof opts.tokenLookup === "function";
   if (hasCookie && hasLookup) {

package/lib/middleware/rate-limit.js

@@ -256,8 +256,8 @@ function create(opts) {
   var bodyOnLimit = opts.bodyOnLimit !== undefined ? opts.bodyOnLimit : "Too Many Requests";
   var emitHeaders = opts.header !== false;
   var skipPaths = opts.skipPaths || [];
-  // Tier-A: each entry must be a string prefix or a RegExp. Anything
-  // else would crash _shouldSkip with TypeError on the first request.
+  // Throw at create(): each entry must be a string prefix or a RegExp.
+  // Anything else would crash _shouldSkip with TypeError on the first request.
   for (var sp = 0; sp < skipPaths.length; sp++) {
     if (typeof skipPaths[sp] !== "string" && !(skipPaths[sp] instanceof RegExp)) {
       throw new Error("middleware.rateLimit: skipPaths[" + sp +

package/lib/notify.js

@@ -74,7 +74,7 @@ var DEFAULTS = Object.freeze({
   // we get the framework's policy without forking the constants.
 });
 
-// ---- Tier-A validation ----
+// ---- Call-site validation (throw on bad input) ----
 
 function _isFiniteNonNegative(n) {
   return typeof n === "number" && isFinite(n) && n >= 0;
@@ -360,7 +360,7 @@ function create(opts) {
 
   function _emitObs(name, labels) {
     try { observability().event(name, 1, labels || {}); }
-    catch (_e) { /* Tier B */ }
+    catch (_e) { /* drop-silent — observability sink must not crash send() */ }
   }
 
   function _emitAudit(action, info) {

package/lib/object-store/sigv4-bucket-ops.js

@@ -44,13 +44,14 @@
  *     maxAgeSeconds:  3600,
  *   }]);
  *
- * Validation is Tier-A: every input shape is rejected at the call
- * site rather than producing a server-side 400. Errors surface as
- * ObjectStoreError with codes (BUCKET_INVALID_NAME, INVALID_LIFECYCLE,
- * INVALID_CORS_RULE, BUCKET_ALREADY_OWNED, BUCKET_NOT_EMPTY, etc.).
+ * Validation rejects every bad input shape at the call site rather
+ * than producing a server-side 400. Errors surface as ObjectStoreError
+ * with codes (BUCKET_INVALID_NAME, INVALID_LIFECYCLE, INVALID_CORS_RULE,
+ * BUCKET_ALREADY_OWNED, BUCKET_NOT_EMPTY, etc.).
  */
 var { URL } = require("url");
 var nodeCrypto = require("crypto");
+var C = require("../constants");
 var sigv4 = require("./sigv4");
 var safeXml = require("../parsers/safe-xml");
 var safeUrl = require("../safe-url");
@@ -261,7 +262,7 @@ function _buildCorsXml(rules) {
     body += "</CORSRule>";
   }
   body += "</CORSConfiguration>";
-  if (Buffer.byteLength(body, "utf8") > 64 * 1024) {
+  if (Buffer.byteLength(body, "utf8") > C.BYTES.kib(64)) {
     throw _err("INVALID_CORS_RULE",
       "CORS configuration exceeds 64 KB (S3 spec)", true);
   }

package/lib/object-store/sigv4.js

@@ -214,17 +214,17 @@ function _request(method, url, headers, body, opts) {
 // CompleteMultipartUpload with EntityTooSmall. The framework refuses
 // configurations below this floor at create() time so operators don't
 // see surprising failures only on large uploads.
-var MIN_PART_SIZE_BYTES = 5 * 1024 * 1024;
+var MIN_PART_SIZE_BYTES = C.BYTES.mib(5);
 // S3 spec ceiling on part count. CompleteMultipartUpload rejects
 // uploads with more than 10000 parts.
 var MAX_PARTS = 10000;
 // Auto-multipart trigger: buffered bodies under this stay single-PUT.
 // Streams always go multipart since size isn't known up-front.
-var DEFAULT_MULTIPART_THRESHOLD_BYTES = 64 * 1024 * 1024;
+var DEFAULT_MULTIPART_THRESHOLD_BYTES = C.BYTES.mib(64);
 // Conservative default part size — large enough to keep round-trip
 // overhead small relative to payload, small enough to fit comfortably
 // in a 4-way-concurrent upload's memory footprint.
-var DEFAULT_PART_SIZE_BYTES = 16 * 1024 * 1024;
+var DEFAULT_PART_SIZE_BYTES = C.BYTES.mib(16);
 var DEFAULT_PART_CONCURRENCY = 4;
 
 // ---- SSE option handling ----

package/lib/observability.js

@@ -59,18 +59,43 @@ var lazyRequire = require("./lazy-require");
 var tracing = lazyRequire(function () { return require("./tracing"); });
 var metrics = lazyRequire(function () { return require("./metrics"); });
 
+// Operator-installed tap handler — wired via setTap(). When non-null,
+// every observability event/tap dispatch routes here in addition to
+// the framework's metrics module. Used by b.otelExport.create() so an
+// OTLP/HTTP exporter receives the same hot-path counters the framework
+// emits internally.
+var _externalTap = null;
+
 function _safeMetricsTap(name, value, labels) {
   try { metrics().tap(name, value, labels); }
   catch (_e) { /* boot-order tolerance — metrics may not be loaded */ }
+  if (_externalTap !== null) {
+    try { _externalTap(name, value, labels); }
+    catch (_e) { /* operator-installed handler — drop-silent on its throws */ }
+  }
+}
+
+// setTap — install an external tap handler. Operators wire this from
+// `b.otelExport.create({...}).tapHandler` so every framework counter
+// also lands in the operator's metrics pipeline.
+//
+// The handler signature mirrors metrics.tap: (name, value, labels).
+// Pass null to remove the previously-installed handler.
+function setTap(handler) {
+  if (handler !== null && typeof handler !== "function") {
+    throw new TypeError("observability.setTap: handler must be a function or null, got " +
+      typeof handler);
+  }
+  _externalTap = handler;
 }
 
 function tap(name, attrs, fn) {
   if (typeof attrs === "function") { fn = attrs; attrs = null; }
-  // Tier A validation: tap is called from many call sites and a typo
-  // in the name (e.g. variable holding undefined) silently corrupts both
-  // the span tree AND the metrics counter route, with no obvious symptom
-  // until somebody opens a dashboard. Throw at first call so the
-  // operator catches it.
+  // Throw on bad input: tap is called from many call sites and a typo
+  // in the name (e.g. variable holding undefined) silently corrupts
+  // both the span tree AND the metrics counter route, with no obvious
+  // symptom until somebody opens a dashboard. Throw at first call so
+  // the operator catches it.
   if (typeof name !== "string" || name.length === 0) {
     throw new TypeError("observability.tap: name must be a non-empty string, got " +
       (typeof name) + " " + JSON.stringify(name));
@@ -97,18 +122,19 @@ function tap(name, attrs, fn) {
   });
 }
 
-// Tier B (drop-silent): event is the fire-and-forget shape called from
-// hot paths where throwing would crash the request that triggered it.
-// Bad input is silently dropped — operators with a misnamed event see
-// the missing counter, not a 500. metrics.tap performs its own label-
-// name regex validation; an invalid call surfaces in the metrics module
-// log, not via a thrown exception.
+// Drop-silent on bad input by design: event is the fire-and-forget
+// shape called from hot paths where throwing would crash the request
+// that triggered it. Operators with a misnamed event see the missing
+// counter, not a 500. metrics.tap performs its own label-name regex
+// validation; an invalid call surfaces in the metrics module log, not
+// via a thrown exception.
 function event(name, value, labels) {
   if (typeof name !== "string" || name.length === 0) return;
   _safeMetricsTap(name, value, labels);
 }
 
 module.exports = {
-  tap:   tap,
-  event: event,
+  tap:    tap,
+  event:  event,
+  setTap: setTap,
 };

package/lib/otel-export.js

@@ -27,8 +27,8 @@
  *
  * Wiring with `b.observability`:
  *
- *   // Option A: replace the metrics tap entirely
- *   b.observability._setTap(otel.tapHandler);
+ *   // Option A: install as an external tap on b.observability
+ *   b.observability.setTap(otel.tapHandler);
  *
  *   // Option B: alongside b.metrics — operators write their own
  *   // multi-tap fan-out (or pick one or the other for v1).

package/lib/pagination.js

@@ -215,10 +215,10 @@ async function cursor(query, opts) {
   }
   var limit     = _resolveLimit(opts);
   var orderBy   = typeof opts.orderBy === "string" && opts.orderBy.length > 0 ? opts.orderBy : "_id";
-  // Tier-A on orderBy — the value is interpolated into a raw SQL fragment
-  // for the keyset where-clause. Restrict to identifier-safe characters
-  // so a careless caller piping `req.query.orderBy` through doesn't
-  // create an SQL-injection vector.
+  // Throw at call site on bad orderBy — the value is interpolated into
+  // a raw SQL fragment for the keyset where-clause. Restrict to
+  // identifier-safe characters so a careless caller piping
+  // `req.query.orderBy` through doesn't create an SQL-injection vector.
   if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(orderBy)) {
     throw new PaginationError("pagination/bad-orderby",
       "cursor: orderBy must match /^[A-Za-z_][A-Za-z0-9_]*$/ (identifier-safe), got " +
@@ -342,8 +342,8 @@ async function offset(query, opts) {
   var page = parseInt(opts.page, 10);
   if (isNaN(page) || page < 1) page = 1;
   var orderBy = typeof opts.orderBy === "string" && opts.orderBy.length > 0 ? opts.orderBy : "_id";
-  // Same Tier-A on offset() as cursor() — orderBy passes through to the
-  // db Query; identifier-safe-only to prevent SQL injection.
+  // Same identifier-only check on offset() as cursor() — orderBy passes
+  // through to the db Query; throw at call site to prevent SQL injection.
   if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(orderBy)) {
     throw new PaginationError("pagination/bad-orderby",
       "offset: orderBy must match /^[A-Za-z_][A-Za-z0-9_]*$/ (identifier-safe), got " +

package/lib/permissions.js

@@ -31,14 +31,14 @@
  *   "users:*:read"  matches "users:foo:read" (per-segment *)
  *   "users:read"    matches "users:read" only — no implicit sub-resource grant
  *
- * Validation tiers:
+ * Validation policy:
  *
- *   - create() role table / scope formats → Tier A (throw at app init)
- *   - require(scope) registration arg     → Tier A (throw at route declaration)
- *   - check(actor, scope) bad actor       → Tier C (return false)
+ *   - create() role table / scope formats → throw at app init
+ *   - require(scope) registration arg     → throw at route declaration
+ *   - check(actor, scope) bad actor       → return false (tolerant read)
  *   - resolver returns null in middleware → 401 (missingActorStatus)
  *   - actor lacks scope in middleware     → 403 (denyStatus)
- *   - audit/observability emit failures   → Tier B (drop silent)
+ *   - audit/observability emit failures   → drop silent (hot-path sink)
  *
  * Audit defaults follow the framework's security-defaults stance
  * default: `auditFailures: true`
@@ -57,7 +57,7 @@ var observability = lazyRequire(function () { return require("./observability");
 
 function _emitEvent(name, value, labels) {
   try { observability().event(name, value, labels || {}); }
-  catch (_e) { /* Tier B: hot-path observability sink */ }
+  catch (_e) { /* hot-path observability sink — drops silent on internal throws */ }
 }
 
 // Lowercase tokens, digits, dash, underscore, and `*` allowed per
@@ -331,7 +331,7 @@ function create(opts) {
   }
 
   // Middleware factory. `mode` is "single" | "all" | "any"; `requested`
-  // is the scope or scope list. Tier A on registration arg.
+  // is the scope or scope list. Throw at registration time on bad shape.
   function _middleware(mode, requested) {
     if (mode === "single") {
       _validateScopePattern(requested, "permissions.require");

package/lib/protocol-dispatcher.js

@@ -51,8 +51,8 @@ var { defineClass } = require("./framework-error");
 // supply their own get this generic shape with the same code namespace.
 var ProtocolDispatcherError = defineClass("ProtocolDispatcherError", { withStatusCode: true });
 
-// Tier A validation — called at create-time, throw on bad input so
-// operators catch typos at app boot, not first request.
+// Throw at create-time on bad input so operators catch typos at app
+// boot, not first request.
 function _validateConfig(opts) {
   if (!opts || typeof opts !== "object") {
     throw new Error("protocolDispatcher.create: opts is required");

package/lib/queue.js

@@ -505,7 +505,7 @@ function _resetForTest() {
 //     ],
 //   });
 //
-// Cycle detection runs at registration (Tier-A throw). Each child enters
+// Cycle detection runs at registration (throws at call site). Each child enters
 // the queue with availableAt = MAX_SAFE_INTEGER until parent completion
 // bumps it. Returns { flowId, jobs: [{ name, jobId }, ...] }.
 function enqueueFlow(spec) {

package/lib/request-helpers.js

@@ -175,9 +175,9 @@ function requestProtocol(req, opts) {
 //   parseListHeader(undefined)             → []
 //   parseListHeader("")                    → []
 //
-// Tier-C: tolerant of non-string input (returns []) — these are read
-// from request headers that the network might omit. Callers needing
-// stricter checks layer their own validation on the result.
+// Tolerant read: non-string input returns [] — these are read from
+// request headers that the network might omit. Callers needing stricter
+// checks layer their own validation on the result.
 function parseListHeader(value, opts) {
   if (value == null) return [];
   opts = opts || {};

package/lib/retry.js

@@ -18,14 +18,14 @@
  * compose freely with `safeAsync.withTimeout`, AbortSignals, and any
  * caller-side instrumentation.
  *
- * Validation tiers:
+ * Validation policy:
  *
- *   - withRetry opts at first call            → Tier A (throw)
- *   - CircuitBreaker constructor opts         → Tier A (throw)
- *   - backoffDelay(attempt) attempt argument  → Tier A (throw)
- *   - isRetryable(err) defensive read         → Tier C (return defaults)
- *   - onRetry callback throw                  → Tier B (drop silent)
- *   - breaker internal _onSuccess/_onFailure  → Tier B (drop silent)
+ *   - withRetry opts at first call            → throw at call site
+ *   - CircuitBreaker constructor opts         → throw at call site
+ *   - backoffDelay(attempt) attempt argument  → throw at call site
+ *   - isRetryable(err) defensive read         → tolerant (return defaults)
+ *   - onRetry callback throw                  → drop silent (hot-path sink)
+ *   - breaker internal _onSuccess/_onFailure  → drop silent (hot-path sink)
  *
  * HTTP-client auto-retry is intentionally NOT provided here. Callers
  * wrap their own outbound calls in `b.retry.withRetry(...)` to keep
@@ -40,13 +40,13 @@ var lazyRequire = require("./lazy-require");
 // are fully loaded.
 var safeAsync = lazyRequire(function () { return require("./safe-async"); });
 // observability is also lazy-required because the metrics + tracing
-// registry boots after this file loads. event() is Tier B — any
-// throw inside the metrics sink is swallowed by observability itself.
+// registry boots after this file loads. event() is fire-and-forget —
+// any throw inside the metrics sink is swallowed by observability itself.
 var observability = lazyRequire(function () { return require("./observability"); });
 
 function _emitEvent(name, value, labels) {
   try { observability().event(name, value, labels || {}); }
-  catch (_e) { /* Tier B: hot-path observability sink */ }
+  catch (_e) { /* hot-path observability sink — drops silent on internal throws */ }
 }
 
 // ---- Defaults ----
@@ -80,7 +80,7 @@ var DEFAULT_BREAKER = Object.freeze({
   successThreshold:  2,                   // consecutive HALF probes that close it
 });
 
-// ---- Tier-A validation helpers ----
+// ---- Call-site validation helpers (throw on bad input) ----
 
 function _isPositiveInt(n) {
   return typeof n === "number" && isFinite(n) && n >= 1 && Math.floor(n) === n;
@@ -147,7 +147,7 @@ function _validateBreakerOpts(name, opts) {
 
 // ---- Public surface ----
 
-// Tier C: defensive read of err shape; missing fields → false.
+// Tolerant read of err shape; missing fields → false.
 function isRetryable(err) {
   if (!err) return false;
   if (err.isObjectStoreError && err.permanent) return false;
@@ -162,11 +162,12 @@ function isRetryable(err) {
   return false;                                   // default: not retryable (avoid masking bugs)
 }
 
-// Tier A: attempt must be a positive int; opts (when supplied) must
-// have non-neg-finite baseDelayMs/maxDelayMs and finite jitterFactor in [0,1].
-// We don't full-validate opts here every call (hot path) — defaults are
-// frozen, so the only way a bad opts reaches here is via withRetry which
-// already validated, OR a caller using backoffDelay directly. For that
+// Throw on bad input: attempt must be a positive int; opts (when supplied)
+// must have non-neg-finite baseDelayMs/maxDelayMs and finite jitterFactor
+// in [0,1]. We don't full-validate opts here every call (hot path) —
+// defaults are frozen, so the only way a bad opts reaches here is via
+// withRetry which already validated, OR a caller using backoffDelay
+// directly. For that
 // direct case we still validate the attempt arg loudly.
 function backoffDelay(attempt, opts) {
   if (!_isPositiveInt(attempt)) {
@@ -212,8 +213,8 @@ async function withRetry(fn, opts) {
       var delay = backoffDelay(attempt, opts);
       _emitEvent("retry.attempt", 1, { attempt: attempt });
       if (typeof opts.onRetry === "function") {
-        // Tier B: hot-path observability sink. A thrown observer must
-        // not crash the retry loop — by design.
+        // Hot-path observability sink — drops silent on observer throw
+        // so a thrown observer can't crash the retry loop.
         try { opts.onRetry({ attempt: attempt, delay: delay, error: err }); } catch (_e) {}
       }
       // Honor opts.signal during the backoff sleep — a caller who aborts

package/lib/seeders.js

@@ -36,14 +36,14 @@
  * truncating the seeded tables themselves; "unseed" isn't framework-
  * knowable.
  *
- * Validation tiers:
+ * Validation policy:
  *
- *   - create() opts                       → Tier A (throw at boot)
- *   - run/status `env` arg                → Tier A (throw — explicit)
- *   - seed file shape (missing run, etc)  → Tier A (throw at load)
- *   - dependsOn cycle                     → Tier A (throw at load)
- *   - dependsOn missing                   → Tier A (throw at run)
- *   - audit emit failures                 → Tier B (drop silent)
+ *   - create() opts                       → throw at boot
+ *   - run/status `env` arg                → throw at call site (explicit)
+ *   - seed file shape (missing run, etc)  → throw at load
+ *   - dependsOn cycle                     → throw at load
+ *   - dependsOn missing                   → throw at run
+ *   - audit emit failures                 → drop silent (hot-path sink)
  *
  * Security defaults:
  *
@@ -103,7 +103,7 @@ function _runSql(db, sql) {
   throw _err("BAD_DB", "seeders: db handle exposes no DDL runner (exec / runSql)");
 }
 
-// ---- Tier-A validation helpers ----
+// ---- Call-site validation helpers (throw on bad input) ----
 
 function _validateEnv(name, value) {
   if (typeof value !== "string" || value.length === 0) {
@@ -399,7 +399,7 @@ function create(opts) {
 
   function _emitObs(name, labels) {
     try { observability().event(name, 1, labels || {}); }
-    catch (_e) { /* Tier B */ }
+    catch (_e) { /* drop-silent — observability sink must not crash seeders */ }
   }
 
   function _emitAudit(action, info) {

package/lib/slug.js

@@ -20,12 +20,12 @@
  * symbols, and separators — Cyrillic, Greek, CJK, and other scripts pass
  * through. Operators with non-Latin user content opt into preserveUnicode.
  *
- * Validation tiers:
+ * Validation policy:
  *
- *   - Opts at first call (every public fn) → Tier A (throw)
- *   - title not a string                   → Tier A (throw)
- *   - title normalizes to empty            → Tier C (return opts.fallback)
- *   - unique() exhausts maxAttempts        → Tier A (throw SlugError)
+ *   - Opts at first call (every public fn) → throw at call site
+ *   - title not a string                   → throw at call site
+ *   - title normalizes to empty            → return opts.fallback (tolerant)
+ *   - unique() exhausts maxAttempts        → throw SlugError at call site
  *
  * Out of scope (v1):
  *   - Word-by-word transliteration tables (Russian → English, Chinese →
@@ -61,7 +61,7 @@ var _RESERVED = Object.freeze([
   "new", "edit", "delete", "create", "update",
 ]);
 
-// ---- Tier-A validation helpers ----
+// ---- Call-site validation helpers (throw on bad input) ----
 
 function _isPositiveInt(n) {
   return typeof n === "number" && isFinite(n) && n >= 1 && Math.floor(n) === n;

package/lib/testing.js

@@ -82,7 +82,7 @@ var DEFAULTS = Object.freeze({
   runMiddlewareTimeoutMs:  5000,
 });
 
-// ---- Tier-A helpers ----
+// ---- Call-site validation helpers (throw on bad input) ----
 
 function _isPositiveInt(n) {
   return typeof n === "number" && isFinite(n) && n >= 1 && Math.floor(n) === n;
@@ -268,7 +268,7 @@ function fakeHttpClient(responder) {
 
 // ---- captureAudit ----
 //
-// Matches b.audit.safeEmit Tier-B drop-silent contract. captured holds
+// Matches b.audit.safeEmit's drop-silent contract. captured holds
 // every event pushed; clear() empties; byAction(name) filters.
 
 function captureAudit() {
@@ -276,9 +276,9 @@ function captureAudit() {
   return {
     captured: captured,
     safeEmit: function (event) {
-      // Tier B: drop-silent on caller-side bugs that throw inside the
-      // capture push (shouldn't happen with array.push, but matches the
-      // real safeEmit's defensive shape).
+      // Drop-silent on caller-side bugs that throw inside the capture
+      // push (shouldn't happen with array.push, but matches the real
+      // safeEmit's defensive shape).
       try { captured.push(event); }
       catch (_e) { /* drop-silent */ }
     },

package/lib/validate-opts.js

@@ -1,6 +1,7 @@
 "use strict";
 /**
- * validate-opts — shared Tier-A helper for primitive create() functions.
+ * validate-opts — shared call-site helper for primitive create() functions
+ * that throws on unknown / bad-shape opts at config time.
  *
  * Catches silent operator typos: `cors({ allowedOrigins: [] })` (wrong
  * key name) currently looks like config but does nothing — the primitive

package/lib/webhook.js

@@ -57,12 +57,12 @@
  *     reference impl; operators plug in Redis/SQL by passing any object
  *     with `checkAndInsert(nonce, expireAt) → bool/Promise<bool>`.
  *
- * Validation tiers:
+ * Validation policy:
  *
- *   - signer/verifier creation opts → Tier A (throw)
- *   - signer.sign body type         → Tier A (throw)
- *   - signer.send url shape         → Tier A (throw via safeUrl)
- *   - verifier.verify input shape   → Tier A (throw WebhookError)
+ *   - signer/verifier creation opts → throw at config time
+ *   - signer.sign body type         → throw at call site
+ *   - signer.send url shape         → throw at call site (via safeUrl)
+ *   - verifier.verify input shape   → throw WebhookError at call site
  *   - nonceStore.checkAndInsert err → propagates (fail-closed)
  */
 
@@ -79,7 +79,7 @@ var observability = lazyRequire(function () { return require("./observability");
 
 function _emitEvent(name, value, labels) {
   try { observability().event(name, value, labels || {}); }
-  catch (_e) { /* Tier B: hot-path observability sink */ }
+  catch (_e) { /* hot-path observability sink — drops silent on internal throws */ }
 }
 
 var _err = WebhookError.factory;
@@ -111,7 +111,7 @@ var DEFAULTS = Object.freeze({
   auditSuccess:    true,
 });
 
-// ---- Tier-A validation helpers ----
+// ---- Call-site validation helpers (throw on bad input) ----
 
 function _isPositiveInt(n) {
   return typeof n === "number" && isFinite(n) && n >= 1 && Math.floor(n) === n;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.6.7",
+  "version": "0.6.11",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",