rcf-lite 0.22.0 → 0.24.0

package/blueprints/messaging-queue-cloudflare/contributions/user-stories/messaging-queue-cloudflare-us-29108.json

@@ -0,0 +1,25 @@
+{
+  "usId": "messaging-queue-cloudflare-US-29108",
+  "prdId": "PRD-001",
+  "reqId": "messaging-queue-cloudflare-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Real-account concurrency smoke: 500 messages processed concurrently up to the 250 cap",
+  "asA": "developer verifying the facade works against a real Cloudflare account",
+  "iWant": "a smoke test that publishes 500 messages against the shared HQ queue rcf-lite-ci-queue-smoke and asserts the consumer processes them concurrently up to the documented 250-invocation cap",
+  "soThat": "the shipped shape's compatibility with the real Cloudflare Queues surface is proven end-to-end at least once per release, without requiring every CI run to be account-bound",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-29108-2",
+      "description": "Given CI_HAS_CLOUDFLARE_ACCOUNT=1 and the credentials for the shared HQ queue rcf-lite-ci-queue-smoke wired via security-secrets-management, when the real-account-concurrency-smoke probe runs against the real queue, then 500 messages are published, the consumer processes them concurrently up to the 250 push-based invocation cap Cloudflare documents at https://developers.cloudflare.com/queues/platform/limits/, and the smoke drains the queue on exit. Without CI_HAS_CLOUDFLARE_ACCOUNT the probe records accountBoundSkipped true per spec section 3.5 and the per-blueprint report carries aggregateVerdict pass.",
+      "given": "the shared HQ queue rcf-lite-ci-queue-smoke on Baz's account, or the env var unset",
+      "when": "the real-account-concurrency-smoke run-shim executes",
+      "then": "with the env var set, 500 messages round-trip with observed concurrency below or equal to 250; with the env var unset, the report carries accountBoundSkipped true and aggregateVerdict pass; the shim exits 0 in both paths",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": ["TAC-3001-messaging-queue-cloudflare-producer-facade", "TAC-3002-messaging-queue-cloudflare-consumer-registration"],
+  "createdAt": "2026-09-06T21:00:00.000Z",
+  "updatedAt": "2026-09-06T21:00:00.000Z"
+}

package/blueprints/messaging-queue-cloudflare/docs/topics.md

@@ -0,0 +1,68 @@
+# messaging-queue-cloudflare blueprint coordination vocabulary
+
+This file is the messaging-queue-cloudflare half of the cross-blueprint contract. The Phase 1 conflict detector matches scope:global ADR topics by EXACT string equality, and AC ids are unnamespaced by the 0.4.4 grammar. Any blueprint intended to compose with this one must reuse these exact strings and respect these bands.
+
+## Global ADR topics this blueprint contributes (exact strings)
+
+| Topic string | messaging-queue-cloudflare contribution | Origin | Composition note |
+|---|---|---|---|
+| `deliverySemantics` | ADR-3002-messaging-queue-cloudflare-delivery-semantics | Minted by this blueprint. Names the wire-shape contract for message-delivery guarantees; the shipped answer is at-least-once (Cloudflare Queues implements at-least-once with a stable message-id the consumer uses for its own dedup per https://developers.cloudflare.com/queues/configuration/javascript-apis/, and WSD-005 makes at-least-once and out-of-order tolerance the shipped default for domain event handoffs). | The one project-wide decision on delivery semantics for the primary worklist queue. A future exactly-once or at-most-once sibling would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR |
+
+The messaging-queue-cloudflare blueprint claims one global topic. Every other contribution is scope-local (ADR-3001 adapter, ADR-3003 max-attempts floor, ADR-3004 batch defaults do not contribute global topics; a composing blueprint that holds an opinion on any of them authors its own project-level ADR).
+
+Rules for new topics: lower camel case, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer.
+
+## Id number bands (registry bootstrap)
+
+This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-spa | 1101-1899 | 2xx | shipped v1.3.0 | `clientRouting`, `theming`, `clientState`, `errorEnvelope`, `authModel` |
+| application-api-rest | 2101-2899 | 3xx | shipped v1.0.0 | `errorEnvelope`, `authModel`, `apiVersioning`, `logging` |
+| security-auth-magic-link | 3101-3899 | 5xx | shipped v1.0.0 | `authModel` |
+| email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
+| hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
+| persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
+| observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
+| security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
+| security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
+| security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
+| deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.0.0 | `deploymentTarget` |
+| persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| observability-logging | 15101-15899 | 16xx | shipped v1.0.0 | `logging` |
+| application-error-handling | 16101-16899 | 17xx | shipped v1.0.0 | `errorHandling` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+
+US 29101-29108 sit at the LOW end of the 29101-29899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a messaging-queue-cloudflare REQ id into the number 29110 would collide against a shipped US-29110; band headroom (29109-29899) leaves that space.
+
+ADR/TAC suffixes for this blueprint use the 3001-3099 block, continuing the shelf pattern.
+
+## Shared expectations for future composing blueprints
+
+- Reuse `deliverySemantics` exactly as spelled here when your blueprint holds an opinion on the delivery-guarantee contract for the primary worklist queue; contribute your own scope:global ADR on that string and let composition surface the pairing.
+- A future exactly-once, at-most-once, or `messaging-queue-postgres` sibling mints on demand; each claims `deliverySemantics` and conflicts by design.
+- `jobs-background` (round-5 track T-4) reads the `queue` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` to obtain the producer facade at apply time via the T-5 visual-round capability-declaration mechanism.
+
+## Deliberate-conflict statement
+
+This blueprint's ADR-3002 on `deliverySemantics` is a first shipped answer to a topic that will conflict, by design, with future exactly-once or at-most-once siblings, and with the reserved `messaging-queue-postgres` sibling (Baz decision 7). Applying `messaging-queue-cloudflare` alongside a hypothetical `messaging-queue-postgres` raises one `globalAdrTopic` conflict the operator resolves via one of the four documented resolutions per topic (adopt one, keep the existing one, author a project-level supersede ADR, or `--resolve <topic>=project:<ADR-id>` on the add).

package/blueprints/messaging-queue-cloudflare/guide/messaging-queue-cloudflare.md

@@ -0,0 +1,110 @@
+# messaging-queue-cloudflare guide
+
+## What this blueprint gets you
+
+A directed producer-to-consumer worklist queue on Cloudflare Queues: publish, consume, ack, retry, DLQ. The producer facade is the sole reader of the Queues binding declared in your wrangler config (a `[[queues.producers]]` block); the consumer registration attaches to the Worker's `queue` handler through the paired `[[queues.consumers]]` block. Consumer code calls typed named domain verbs on the facade (`publish`, `publishBatch`) and never touches the raw binding. Every publish attaches a producer-supplied trace-id header so downstream consumers stitch the enqueue-to-process boundary; every consumer receipt records `messageAcked` on the sink with the stable platform-assigned message-id.
+
+Four lifecycle events fire on the injected event sink with a rigid metadata-only whitelist (`event`, `ts`, `messageId`, `queueName`, `attempts`); consumer logging cannot leak object body bytes, header values, consumer-context fields or PII from the message body. The whitelist is enforced in code by the sink adapter (`event-sink.mjs`), not just documented.
+
+The reserved sibling `messaging-queue-postgres` (Baz decision 7, deferred v1.0.0 pending demand) mints on demand and conflicts by design on `deliverySemantics` with this blueprint; the operator picks one queue backend per project via a project-level ADR.
+
+## Apply this blueprint
+
+`deploy-cloudflare-workers` is the composition target this blueprint expects on a Workers project. The v1.0.0 shipped shape does NOT declare a `requiresAppliedCapabilities` block: the queue binding is wired through wrangler config (not through the capability mechanism), and `jobs-background` composes on the `queue` capability this blueprint provides (per spec section 5.6).
+
+```sh
+rcf define blueprint add messaging-queue-cloudflare
+```
+
+Exits 0 on any Workers-adjacent project. Contributes ADR-3002 on `scope: global` topic `deliverySemantics` (at-least-once as the shipped shape); a project that already declares a different answer on `deliverySemantics` (an exactly-once or at-most-once sibling minted on demand) surfaces a DELIBERATE conflict for operator resolution.
+
+## Producer facade shape
+
+```js
+import { createProducer, queueConfigFromEnv } from './producer.mjs';
+
+const cfg = queueConfigFromEnv();
+const producer = createProducer({
+  binding: env.RCF_TEST_QUEUE, // the wrangler-bound Queues producer
+  queueName: cfg.queueName,
+  onEvent: (record) => logger.log('messaging-queue', record),
+});
+
+await producer.ready;
+
+// publish one message with a producer-supplied trace-id
+const { id } = await producer.publish({ userId: '42', action: 'sendConfirmation' }, {
+  headers: { 'x-trace-id': crypto.randomUUID() },
+});
+
+// publish a batch
+await producer.publishBatch([
+  { body: { seq: 1 }, headers: { 'x-trace-id': 't-1' } },
+  { body: { seq: 2 }, headers: { 'x-trace-id': 't-2' } },
+]);
+```
+
+The facade is the sole holder of the queue binding reference per REQ-001. A call site that reaches into `env.<binding>.send()` directly is refused at author-side review.
+
+## Consumer registration shape
+
+```js
+import { createConsumer } from './consumer.mjs';
+
+export default {
+  queue: createConsumer({
+    handler: async (msg) => {
+      // msg.id, msg.body, msg.headers, msg.attempts, msg.timestamp
+      try {
+        await processBackgroundWork(msg.body);
+        return 'ack';
+      } catch (err) {
+        // Return 'retry' to redeliver with an incremented attempt counter;
+        // after max_retries the message lands on the DLQ per REQ-004.
+        return 'retry';
+      }
+    },
+    onEvent: (record) => logger.log('messaging-queue', record),
+    env: process.env,
+  }),
+};
+```
+
+## Wrangler dev section
+
+Local iteration on the fixture uses `wrangler dev` (v3.1.0+ per the Cloudflare Queues local-development doc). The wrangler-dev seam brings up producer and consumer in a single command with `--persist-to` for reproducible state:
+
+```sh
+cd packages/rcf-lite/test/fixtures/infra-s3-and-queue
+npx wrangler dev --persist-to .wrangler-state
+```
+
+Consumer concurrency is NOT supported under `wrangler dev` per https://developers.cloudflare.com/queues/configuration/local-development/; the local run proves the facade contract, publish, consume, ack, retry, and DLQ landing, but does not exercise the 250-invocation concurrency cap. That assertion is the accountBound `real-account-concurrency-smoke` probe. Similarly, Cloudflare Queues does not support `wrangler dev --remote` per the same page.
+
+The shipped v1.0.0 probes drive the wrangler-dev-equivalent seam (in-memory queue driver realising the same binding shape) so CI stays reproducible without a live Cloudflare account; the boundary at the facade is indistinguishable from a live-Queues run.
+
+## Miniflare in CI section
+
+Miniflare (`https://developers.cloudflare.com/workers/testing/miniflare/`, fetched 2026-09-06 status 200) documents itself as full-featured and supports KV, Durable Objects, WebSockets, modules, and more, without listing Queues explicitly. The Miniflare Queues sub-page returned 404 during spec ratification, so no citation ships at that URL. In CI, the wrangler-dev-equivalent seam the fixture ships is the reference; a project that needs the full Miniflare surface for a broader integration test wires it separately and defers to the Cloudflare Queues local-development page above for the Queues-specific behaviour.
+
+## Real-account smoke section
+
+`node ../../../../blueprints/messaging-queue-cloudflare/contributions/probes/run-real-account-concurrency-smoke.mjs` is the accountBound probe. Without `CI_HAS_CLOUDFLARE_ACCOUNT` it exits 0 with `accountBoundSkipped: true` per spec section 3.5 and the per-blueprint report reads `aggregateVerdict: pass`. With `CI_HAS_CLOUDFLARE_ACCOUNT=1` plus credentials for the shared HQ queue `rcf-lite-ci-queue-smoke` (Q2 default) wired via `security-secrets-management`, a live-account run is queued as a v1.0.0 follow-up: the run itself rides `deploy-cloudflare-workers`' surface (not a Node probe module) since Cloudflare Queues does not support `wrangler dev --remote`, and the v1.0.0 probe stops short of driving deployment machinery.
+
+## Retry and DLQ discipline
+
+ADR-3003 sets `max_retries` to 3 (matching the Cloudflare Queues documented default at https://developers.cloudflare.com/queues/configuration/dead-letter-queues/) with a floor of 1 and a ceiling of 100 (matching the Cloudflare Queues documented per-message max at https://developers.cloudflare.com/queues/platform/limits/). On overflow, the message lands on the elicited DLQ declared via the `dead_letter_queue` field on the wrangler `[[queues.consumers]]` block; the DLQ has its own retention (4 days when no active consumer is attached per the DLQ doc). A DLQ inspector helper (`src/dlq-inspector.mjs` in the fixture; `wrangler queues consumer add --dead-letter-queue` in production per the DLQ doc's CLI form) reads the DLQ contents for triage.
+
+## Batch consume discipline
+
+ADR-3004 sets `max_batch_size` to 10 (ceiling 100) and `max_batch_timeout` to 5 seconds (ceiling 60 seconds) per the Cloudflare Queues platform limits. Batch settings live on the `[[queues.consumers]]` block in wrangler config; a project running closer to the ceiling changes the config values, not the code. Per-message ack semantics keep one bad message in a batch from rolling back its peers.
+
+## Composition with jobs-background
+
+`jobs-background` (round-5 track T-4) declares `requiresAppliedCapabilities: ["queue"]`; applying `jobs-background` on a project that already applied `messaging-queue-cloudflare` gets the T-4 apply-time capability check to pass with the `queue` capability discovered on the applied manifest. The T-4 blueprint enqueues jobs through the producer facade this blueprint exposes; the retry-and-DLQ trajectory is what turns transient job failures into eventual success and permanent failures into a DLQ receipt.
+
+## What this blueprint does not do
+
+- No exactly-once transport (Cloudflare Queues does not implement transport-level dedup); consumer code that needs exactly-once processing dedups on the stable message-id.
+- No fan-out / broadcast pub-sub; that shape lives in the parked `messaging-eventbus` candidate on a different global topic.
+- No schema registry on the message bodies (they are opaque to the blueprint boundary).

package/blueprints/object-storage-s3/docs/topics.md

@@ -39,13 +39,21 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 28101-28108 sit at the LOW end of the 28101-28899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from an object-storage-s3 REQ id into the number 28110 would collide against a shipped US-28110; band headroom (28109-28899) leaves that space.
 

package/blueprints/observability-essentials/docs/topics.md

@@ -54,7 +54,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -62,6 +62,14 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 7101-7110 sit at the LOW end of the 7101-7899 band on purpose. A project-side story that mechanically derives from an observability-essentials REQs id into the number `7110` would collide against observability-essentials-US-7110 in this package; the band leaves headroom at the HIGH end (US 7181-7899) so a project's own stories anchored to observability-essentials REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/observability-logging/docs/topics.md

@@ -21,7 +21,7 @@
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -29,5 +29,13 @@
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.

package/blueprints/observability-probe-endpoints/docs/topics.md

@@ -44,7 +44,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -52,6 +52,14 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 14101-14108 sit at the LOW end of the 14101-14899 band on purpose. A project-side story that mechanically derives from an observability-probe-endpoints REQ id into the number `14108` would collide against observability-probe-endpoints-US-14108 in this package; the band leaves headroom at the HIGH end (US 14181-14899) so a project's own stories anchored to observability-probe-endpoints REQs can allocate without conflict. The watchpost run4 lesson applies here too. Band spacing between the previous HQ-lane row (persistence-data-d1, 13101-13899, 14xx) and this one (14101-14899, 15xx) reflects the four-digit widening pattern opened by security-auth-clerk at 10xx and continued through the round-2 HQ lane.
 

package/blueprints/persistence-data-d1/docs/topics.md

@@ -42,7 +42,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -50,6 +50,14 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 13101-13107 sit at the LOW end of the 13101-13899 band on purpose. A project-side story that mechanically derives from a persistence-data-d1 REQ id into the number `13107` would collide against persistence-data-d1-US-13107 in this package; the band leaves headroom at the HIGH end (US 13181-13899) so a project's own stories anchored to persistence-data-d1 REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/persistence-data-postgres/docs/topics.md

@@ -42,12 +42,20 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 27101-27110 sit at the LOW end of the 27101-27899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a persistence-data-postgres REQ id into the number 27110 would collide against the shipped US-27110; band headroom (27111-27899) leaves that space.
 

package/blueprints/persistence-data-sqlite/docs/topics.md

@@ -42,7 +42,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -50,6 +50,14 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 5101-5111 sit at the LOW end of the 5101-5899 band on purpose. A project-side story that mechanically derives from `persistence-data-sqlite-REQ-011` into the number `5111` would collide against persistence-data-sqlite-US-5111 in this package; the band leaves headroom at the HIGH end (US 5181-5899) so a project's own stories anchored to persistence-data-sqlite REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/platform-cloudflare-cron-triggers/CHANGELOG.md

@@ -0,0 +1,22 @@
+# Changelog
+
+All notable changes to `platform-cloudflare-cron-triggers` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
+
+## 1.0.0 (2026-09-07)
+
+### Added
+
+- v1.0.0 mint of the `platform-cloudflare-cron-triggers` blueprint, category `platform`, capabilities `["scheduledTrigger"]`. Ships a scheduled() handler over the Cloudflare Workers Cron Trigger event, an expression-routed dispatcher over multiple cron expressions, a skew-tolerance classifier, a soft-budget observer, and five metadata-only lifecycle events (`cronReady`, `cronFired`, `cronSkewed`, `cronStalled`, `cronUnmatched`).
+- 4 REQs (`platform-cloudflare-cron-triggers-REQ-001..004`), 7 USs (`platform-cloudflare-cron-triggers-US-32101..32107`), 3 TACs (`TAC-3301` scheduled handler, `TAC-3302` expression-router dispatcher, `TAC-3303` lifecycle-event sink), 3 ADRs (`ADR-3301` scope-global on new topic `scheduledTriggerContract` with `standardsTraceClause: Cloudflare Workers Cron Triggers documented shape`; `ADR-3302` dispatcher mode `elicited: true` `recommendedDefault: expression-routed` when more than one cron expression is elicited; `ADR-3303` default skew tolerance 30 seconds floor 5 ceiling 300 `elicited: true`).
+- 5 Node-only probes under `contributions/probes/`: `wrangler-test-scheduled` (drives `wrangler dev --test-scheduled` on the shared cf-platform fixture, `warn` on CLI regression per spec section 3.1), `dispatcher-routing`, `skew-tolerance` (also folds AC-32104 soft-budget as additional results), `event-secrecy` (SIMULATE_PII_LEAK=true mutation surfaces the leaked fields), and `real-account-scheduled-smoke` (`accountBound: true`; skipped in CI without `CI_HAS_CLOUDFLARE_ACCOUNT`).
+- Elicited parameters on `blueprint.json`: `cron-expressions` (default `* * * * *`), `cron-dispatcher-mode` (default `expression-routed`), `cron-skew-tolerance-seconds` (default `30`, floor `5`, ceiling `300`), `cron-soft-budget-seconds` (default `30`).
+- `suggestedCompanions`: `logging` (for the event-sink boundary) and `errorHandling` (for the handler-failure boundary).
+- Extends the shared `cf-platform` sample-app fixture with the `[triggers] crons` block on `wrangler.toml`, the sole-reader scheduled handler (`src/scheduled.mjs`), and the expression-routed dispatcher (`src/dispatcher.mjs`). The T-0 `[assets]` block and the T-1 `[[kv_namespaces]]` block are preserved verbatim; the scheduled handler does NOT dereference `env.CACHE` (KV stays owned by the T-1 facade).
+- Anatomy test at `packages/rcf-lite/test/blueprint/platform-cloudflare-cron-triggers-anatomy.test.js` covers `TS-090..096` on the T-2 chain slice (blueprint shape, contributions cross-check, probe module contracts, fixture files, ADR bodies and clauses, guide sections and URLs, three-state probed verdicts).
+
+### Known limitations
+
+- The `real-account-scheduled-smoke` probe records `accountBoundSkipped: true` and aggregates to `pass` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset (spec section 3.5 pass-with-skip). Full mechanism reach requires a CI environment with the paired `CF_ACCOUNT_ID`, `CF_WORKER_NAME` and `CF_API_TOKEN` env vars plus a deployed Worker running a per-minute cron.
+- The `wrangler-test-scheduled` probe returns `warn` (never `fail`) on a CLI regression that prevents `wrangler dev --test-scheduled` from binding within 30 seconds; the in-process `dispatcher-routing` and `skew-tolerance` probes carry the runtime evidence for the shipped handler regardless.
+- The dispatcher does NOT terminate a handler on soft-budget breach; termination is Cloudflare's platform-level concern. A project that needs hard termination on a stalled fire builds it inside the handler code path against `AbortController`.
+- The loader's supported `when` block on `elicits[]` only accepts `requiresCapability` arrays, so `cron-dispatcher-mode` cannot yet gate its `expression-routed` default on `elicitedNonEmpty` over `cron-expressions`. A future loader minor extending `validateElicits` would close that gap; the elicit fires unconditionally today and the guide teaches the pattern.

package/blueprints/platform-cloudflare-cron-triggers/README.md

@@ -0,0 +1,117 @@
+# platform-cloudflare-cron-triggers
+
+A rcf-lite blueprint that ships a small, opinionated wiring over
+Cloudflare Workers Cron Triggers. One module holds the scheduled
+handler; a dispatcher routes multiple cron expressions to distinct
+handlers; every fire emits a metadata-only lifecycle event a
+logging companion can render without ever writing a body byte.
+
+- Version: `1.0.0`
+- Category: `platform`
+- Capabilities: `["scheduledTrigger"]`
+- Suggested companions: `logging`, `errorHandling`
+
+## What it gives you
+
+- One place that dereferences the Cloudflare Workers Cron Trigger
+  event (`src/scheduled.mjs`), wires the dispatcher and the event
+  sink at boot, and emits `cronReady` on the first ready-check.
+- An expression-routed dispatcher (`src/dispatcher.mjs`) that maps
+  cron expressions to distinct handlers, records `cronUnmatched`
+  on an unknown expression, and observes each fire against a
+  skew-tolerance window and a soft budget.
+- Five metadata-only lifecycle events (`cronReady`, `cronFired`,
+  `cronSkewed`, `cronStalled`, `cronUnmatched`) with a bounded
+  payload shape `{event, expression, scheduledTime, outcome,
+  duration}` plus optional numeric fields (`softBudgetMs`,
+  `deltaMs`). Two-layer secrecy assertion in the event-secrecy
+  probe.
+- A decision-tree cross-reference in the guide to `jobs-background`
+  (round 5) and to the follow-up Workflows adapter (round 6 jobs-
+  background 1.1.0 minor bump per spec section 5.7) for cases that
+  need durable, retried, workflow-shaped scheduled work.
+
+## The four REQs
+
+| REQ | What |
+| --- | --- |
+| `platform-cloudflare-cron-triggers-REQ-001` | The scheduled() handler is the sole reader of the Cron Trigger event and opens on boot with `cronReady`. |
+| `platform-cloudflare-cron-triggers-REQ-002` | Multiple cron expressions route to distinct handlers via the expression-router dispatcher. |
+| `platform-cloudflare-cron-triggers-REQ-003` | Skew tolerance: fires observed inside the elicited window are `onTime`; outside record `cronSkewed` with the delta. |
+| `platform-cloudflare-cron-triggers-REQ-004` | Soft budget: a handler running past the elicited budget fires `cronStalled` but the dispatcher does not terminate; every event record is metadata-only. |
+
+## The wired shape
+
+The scheduled handler is the ONE place the Cron Trigger event lives.
+The dispatcher factors the routing, skew and soft-budget concerns
+into one seam. The public surface is:
+
+```
+createScheduledHandler({ routes, eventSink, skewToleranceMs, softBudgetMs, clock? })
+  -> { ready, scheduled }
+```
+
+The dispatcher underneath:
+
+```
+createDispatcher({ routes, eventSink, skewToleranceMs, softBudgetMs, clock? })
+  -> { dispatch }
+```
+
+## Elicited parameters
+
+- `cron-expressions` (default `* * * * *`): the cron expressions
+  to schedule; the operator's comma-separated list is written into
+  `wrangler.toml` under `[triggers] crons`.
+- `cron-dispatcher-mode` (default `expression-routed` when the
+  elicited list has more than one entry, else `single-handler`):
+  the dispatcher mode per `ADR-3302`.
+- `cron-skew-tolerance-seconds` (default `30`, floor `5`, ceiling
+  `300`): the skew tolerance window per `ADR-3303`.
+- `cron-soft-budget-seconds` (default `30`, no floor): the
+  per-handler soft budget.
+
+## The five probes
+
+The five probes live under `contributions/probes/`. Each has a
+matching `run-<probe-name>.mjs` shim that writes a per-blueprint
+report to `.rcf/reports/blueprints/platform-cloudflare-cron-triggers/<probe-name>.json`
+under the fixture root.
+
+| Probe | Anchor AC | Account-bound | What it drives |
+| --- | --- | --- | --- |
+| `wrangler-test-scheduled.mjs` | `AC-32105-1` | no | Spawns `wrangler dev --test-scheduled` on the cf-platform fixture, waits bounded 30 seconds for it to bind, drives `/__scheduled?cron=<expr>`, asserts status 200 and kills wrangler cleanly. Returns `warn` on a CLI regression per spec section 3.1 pass-with-skip. |
+| `dispatcher-routing.mjs` | `AC-32102-1` | no | Wires two spy handlers on two expressions, drives the matched expression (asserting only the routed spy fires with the bounded context), then an unmatched expression (asserting `cronUnmatched` fires and no spy runs). Also covers `AC-32102-2`. |
+| `skew-tolerance.mjs` | `AC-32103-1` | no | Drives the dispatcher against a fake clock aligned to `scheduledTime` (asserting `cronFired` outcome `onTime`) then advanced 60s past (asserting `cronSkewed` with `deltaMs: 60000` and the handler still runs). Also folds soft-budget as additional results: a spy handler resolving after 250ms with `softBudgetMs=100` fires exactly one `cronStalled` at the crossing and a final `cronFired` follows (covers `AC-32103-2`, `AC-32104-1`, `AC-32104-2`). |
+| `event-secrecy.mjs` | `AC-32106-1` | no | Drives the dispatcher with a spy handler that closes over a PII fixture (`{userId, ssn}`); layer-1 asserts every event record's keys are a subset of the allow-list `{event, expression, scheduledTime, outcome, duration, softBudgetMs, deltaMs}`; layer-2 asserts no PII substring in the JSON serialisation. `SIMULATE_PII_LEAK=true` wraps the sink to forward the closure so the mutation-run surfaces the leaked fields and returns `fail`. |
+| `real-account-scheduled-smoke.mjs` | `AC-32107-1` | yes | Polls the Cloudflare Workers analytics API for the named Worker every 5s, waits bounded 90s for a scheduled event to appear. Without `CI_HAS_CLOUDFLARE_ACCOUNT` the probe records `accountBoundSkipped: true` and aggregates to `pass` per spec section 3.5. |
+
+## Known limitations (per-AC mechanism reach)
+
+- **`AC-32105-1` (wrangler dev --test-scheduled)** requires the
+  fixture's `wrangler` devDependency to be installed
+  (`pnpm install --ignore-workspace` in
+  `packages/rcf-lite/test/fixtures/cf-platform`). Without it the
+  probe returns `warn` with a documented gap; the shipped
+  `src/scheduled.mjs` is still exercised end to end by the
+  in-process dispatcher probes.
+- **`AC-32107-1` (real-account live-cron smoke)** requires a live
+  Cloudflare account with a deployed Worker running a per-minute
+  cron plus the paired `CI_HAS_CLOUDFLARE_ACCOUNT=true`,
+  `CF_ACCOUNT_ID`, `CF_WORKER_NAME` and `CF_API_TOKEN` env vars.
+  Without them the probe records `accountBoundSkipped: true` and
+  aggregates to `pass` per spec section 3.5. Full mechanism reach
+  requires a CI environment with those env vars set and a Worker
+  already deployed.
+- **The dispatcher does NOT terminate a handler on soft-budget
+  breach.** Termination is Cloudflare's platform-level concern
+  per https://developers.cloudflare.com/workers/platform/limits/.
+  A project that needs hard termination on a stalled fire builds
+  it inside the handler code path against `AbortController`; the
+  dispatcher's role stops at the `cronStalled` event.
+- **The dispatcher matches by exact string equality on the cron
+  expression.** Wildcarded expression sets or expression-family
+  routing (a single handler for every `*/5 * * * *`-like schedule)
+  are not shipped. A follow-up minor could add a matcher-shape
+  dispatch mode; today the elicited expression list is a
+  one-to-one mapping.

package/blueprints/platform-cloudflare-cron-triggers/blueprint.json

@@ -0,0 +1,85 @@
+{
+  "slug": "platform-cloudflare-cron-triggers",
+  "version": "1.0.0",
+  "category": "platform",
+  "capabilities": ["scheduledTrigger"],
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every scheduled fire emits a metadata-only lifecycle event through the applied logger; a logging companion supplies the sink factory."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "A handler failure inside a scheduled invocation constructs an internal error record; an error-handling companion supplies the record factory and the boundary."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "cron-expressions",
+      "prompt": "Cron expressions to schedule (comma-separated list of POSIX cron strings; each expression pairs with one handler under the dispatcher; recommended shape at least one).",
+      "kind": "string",
+      "default": "* * * * *"
+    },
+    {
+      "id": "cron-dispatcher-mode",
+      "prompt": "Dispatcher mode: single-handler routes every fire to one handler; expression-routed maps each expression to a distinct handler (per ADR-3302; recommended default expression-routed when more than one cron expression is elicited).",
+      "kind": "enum",
+      "options": ["single-handler", "expression-routed"],
+      "default": "expression-routed"
+    },
+    {
+      "id": "cron-skew-tolerance-seconds",
+      "prompt": "Skew tolerance in seconds; fires observed within the window are onTime, fires outside record cronSkewed with the delta (per ADR-3303; floor 5 seconds, ceiling 300 seconds).",
+      "kind": "string",
+      "default": "30"
+    },
+    {
+      "id": "cron-soft-budget-seconds",
+      "prompt": "Soft budget per handler in seconds; a handler running past this budget logs cronStalled but is not terminated by the dispatcher (Cloudflare's platform concern retains termination). Recommended default 30.",
+      "kind": "string",
+      "default": "30"
+    }
+  ],
+  "contributions": [
+    { "id": "platform-cloudflare-cron-triggers-REQ-001", "kind": "req", "path": "requirements/platform-cloudflare-cron-triggers-req-001.json" },
+    { "id": "platform-cloudflare-cron-triggers-REQ-002", "kind": "req", "path": "requirements/platform-cloudflare-cron-triggers-req-002.json" },
+    { "id": "platform-cloudflare-cron-triggers-REQ-003", "kind": "req", "path": "requirements/platform-cloudflare-cron-triggers-req-003.json" },
+    { "id": "platform-cloudflare-cron-triggers-REQ-004", "kind": "req", "path": "requirements/platform-cloudflare-cron-triggers-req-004.json" },
+    { "id": "platform-cloudflare-cron-triggers-US-32101", "kind": "us", "path": "user-stories/platform-cloudflare-cron-triggers-us-32101.json" },
+    { "id": "platform-cloudflare-cron-triggers-US-32102", "kind": "us", "path": "user-stories/platform-cloudflare-cron-triggers-us-32102.json" },
+    { "id": "platform-cloudflare-cron-triggers-US-32103", "kind": "us", "path": "user-stories/platform-cloudflare-cron-triggers-us-32103.json" },
+    { "id": "platform-cloudflare-cron-triggers-US-32104", "kind": "us", "path": "user-stories/platform-cloudflare-cron-triggers-us-32104.json" },
+    { "id": "platform-cloudflare-cron-triggers-US-32105", "kind": "us", "path": "user-stories/platform-cloudflare-cron-triggers-us-32105.json" },
+    { "id": "platform-cloudflare-cron-triggers-US-32106", "kind": "us", "path": "user-stories/platform-cloudflare-cron-triggers-us-32106.json" },
+    { "id": "platform-cloudflare-cron-triggers-US-32107", "kind": "us", "path": "user-stories/platform-cloudflare-cron-triggers-us-32107.json" },
+    { "id": "TAC-3301-platform-cloudflare-cron-triggers-scheduled-handler", "kind": "tac", "path": "tacs/tac-3301-platform-cloudflare-cron-triggers-scheduled-handler.json" },
+    { "id": "TAC-3302-platform-cloudflare-cron-triggers-expression-router", "kind": "tac", "path": "tacs/tac-3302-platform-cloudflare-cron-triggers-expression-router.json" },
+    { "id": "TAC-3303-platform-cloudflare-cron-triggers-event-sink", "kind": "tac", "path": "tacs/tac-3303-platform-cloudflare-cron-triggers-event-sink.json" },
+    {
+      "id": "ADR-3301-platform-cloudflare-cron-triggers-scheduled-trigger-contract",
+      "kind": "adr",
+      "path": "adrs/adr-3301-platform-cloudflare-cron-triggers-scheduled-trigger-contract.json",
+      "scope": "global",
+      "topic": "scheduledTriggerContract",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare Workers Cron Triggers documented shape"
+    },
+    {
+      "id": "ADR-3302-platform-cloudflare-cron-triggers-dispatcher-mode",
+      "kind": "adr",
+      "path": "adrs/adr-3302-platform-cloudflare-cron-triggers-dispatcher-mode.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-3303-platform-cloudflare-cron-triggers-skew-tolerance-default",
+      "kind": "adr",
+      "path": "adrs/adr-3303-platform-cloudflare-cron-triggers-skew-tolerance-default.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    }
+  ]
+}