rcf-lite 0.25.0 → 0.27.0

package/blueprints/messaging-queue-cloudflare/CHANGELOG.md

@@ -1,15 +1,50 @@
+# Changelog
+
+## 1.1.2 - 2026-09-10
+
+Register cleanup on shipped prose: neutral wording in the README six-probes paragraph, which now describes the probe module envelope directly. Guide `publishBatch` sample updated: the `x-trace-id` example values are now `trace-order-1001` and `trace-order-1002`, and a one-line pointer follows the sample to the owner at `TAC-3001.interfaces[2].description`. Anatomy pin updated to 1.1.2. Chain-consistency lint zero on pass 1 and pass 2. Closes criterion-f finding 1 for messaging-queue-cloudflare; finding 2 was verified as not a defect (the flagged tokens were `x-trace-id` header values in the sample rather than register labels, and the sample now uses order-scoped example values that remove the ambiguity).
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+Adds the elicits block (queue-binding-name, queue-name, max-attempts, dead-letter-queue, batch-size, batch-timeout-seconds) that the REQs and guide were already describing in prose. Adds deliveredBy on REQ-002 and REQ-006. Closes chain-contradiction specimens F-2 (retry count off by one: REQ-004 and AC-29104-1 now name maxDeliveries and map to the vendor max_retries as maxDeliveries - 1; new AC-29104-2 asserts the maxDeliveries=1 boundary case), F-3 (REQ-006 and AC-29106-1 standardise on ts as the wall-clock milliseconds-since-epoch field name, aligning with TAC-3001, TAC-3003 and the guide), F-6 (REQ-002 replaces the "idempotent" label with an explicit at-least-once semantics naming ADR-3002 as the ratified delivery decision). Adds disposition to every AC.
+
 # messaging-queue-cloudflare changelog
 
+## 1.0.2 - 2026-09-08
+
+The review-train follow-up (addendum item 6 fixture defect): the real-account queue probe now self-provisions its own throwaway Queue + consumer Worker + telemetry KV namespace, closing the second-tier undeclared-env skip the operator estate hit at the real-account gate on 2026-09-08 (`REAL RUN: PARTIAL`, `MERGE DECISION: HOLD`). No shipped-code capability change.
+
+- `real-account-concurrency-smoke.mjs` rewritten against a new self-provisioning fixture shim at `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs`. AC-29108-2 requires a real consumer to process the published messages ("the consumer processes them concurrently up to the documented 250-invocation cap"), so the shim mints a scratch Cloudflare Queue under `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`, and a throwaway consumer Worker under `h2-cf-probe-integrity-scratch-w-` bound to the queue (consumer) with `RCF_TEST_QUEUE` (shipped queue producer binding name matching `packages/rcf-lite/test/fixtures/infra-s3-and-queue/wrangler.toml`) + `RCF_TEST_TELEMETRY_KV` bindings. NO workers.dev subdomain is enabled (operator ruling): the consumer is invoked BY THE QUEUE, not over HTTP; the driver publishes via the Cloudflare Queues REST publish endpoint and reads consumer telemetry via the KV REST list + get endpoints. The consumer Worker's source is a plain module (`h2-cf-queue-consumer-worker.mjs`); its `queue()` handler records one telemetry entry per invocation (start / end timestamps + batchSize) to the bound telemetry KV namespace; the driver computes `maxConcurrent` from an interval-overlap analysis on those timestamps.
+- Declared env for a real-account run is now `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN` (optional `CF_API_BASE_URL` test override; optional `CF_QUEUE_MESSAGE_COUNT` per section 3.5). The `CF_QUEUE_WORKER_URL` and `CF_QUEUE_NAME` second-tier gates are removed; the fixture provides them itself. Every skip-causing env var enumerated in `report.extra.envDeclared` on the probe result and mirrored in the shim's `DECLARED_ENV` export.
+- Teardown deletes the consumer Worker first (so the queue has no active consumer at delete time), then the Queue, then the telemetry KV namespace, all by EXACT id / EXACT name against the mint record with three independent prefix guards per resource. `workerDelete` and `queueDelete` are idempotent on 404 (operator ruling items 3+4): a botched-retry teardown treats an already-gone resource as success rather than stranding siblings.
+- Separate crash-recovery `sweepOrphans` code path filters over the account by the frozen throwaway prefix constants and deletes each match by exact identity; the sweep is structurally unable to select a non-prefixed name. All account listings paginate to completion (operator ruling item 5): KV namespaces + Queues use the documented `per_page` + `page` loop, Workers scripts use the cursor loop, so `sweepOrphans` is not silently truncated to page one on a busy account. Dedicated sweep-safety test at `packages/rcf-lite/test/fixtures/cf-platform/test/h2-cf-sweep-safety.test.mjs` seeds the mock account with the ten live production Worker script names on the operator account plus mid-string-prefix decoys AND a 250-per-type multi-page cover, and asserts sweep selects zero of them.
+- Queue consumer-attach body sends `type: "worker"` (operator ruling item 1: survives CF schema tightening on the discriminated attach union) and omits `dead_letter_queue` entirely rather than sending an explicit `null` (item 2).
+- Local proof harness (`packages/rcf-lite/test/fixtures/cf-platform/test/mock-cf-api-server.mjs`) is a zero-dep in-process mock of the Cloudflare REST contract, not the wire. **The local run exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** The probe is therefore never described as "locally verified" - the local runs are our own lifecycle-logic proof; wire correctness is proven at the operator estate real-account gate.
+
+## 1.0.1 - 2026-09-08
+
+The review-train hardening pass (`h2-cf-platform-probe-integrity`): probe-integrity patch. No capability change.
+
+- Replaced the `accountBoundSkipped: true` pass-stub in `real-account-concurrency-smoke.mjs` with a real 500-message concurrency driver against a live Queues binding on a deployed Worker. When `CI_HAS_CLOUDFLARE_ACCOUNT` is set with `CF_QUEUE_WORKER_URL` and `CF_QUEUE_NAME`, the driver publishes 500 messages through the producer facade in 10 concurrent 50-message batches, polls consumer telemetry via `/stats`, and asserts `drained`, `withinCap` and `observedConcurrency > 1` against Cloudflare's documented push-invocation cap (250). The env-absent branch keeps the pass-with-skip shape. Locally proven against `wrangler dev --local` end-to-end (500/500 messages in 583 ms; local queue serialises so the concurrency assertion FAIL tail is the expected local-proof outcome; on real Cloudflare push consumers the assertion passes at the operator estate gate time).
+- Re-verified the Cloudflare Queues limits URL (`https://developers.cloudflare.com/queues/platform/limits/`) returns `HTTP/2 200`; recorded in the review-train PR provenance (2026-09-08T13:38:07Z).
+- Extended the fixture Worker at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/worker.mjs` with consumer telemetry and `/publish-batch`, `/stats` and `/reset` endpoints; added `wrangler ^4.0.0` as devDep on the fixture package.
+
 ## 1.0.0 - 2026-09-06
 
-Initial release. Directed producer-to-consumer worklist queue on Cloudflare Queues; first shipped adapter with the reserved `messaging-queue-postgres` sibling (Baz decision 7) named beside it in the section 6a capability table. Accessed through a producer facade that is the sole reader of the Cloudflare Queues binding (`env.RCF_TEST_QUEUE` in the fixture). Landed via the infra round 5 spec (ratified 2026-09-06) as track T-3.
+Initial release. Directed producer-to-consumer worklist queue on Cloudflare Queues; first shipped adapter with the reserved `messaging-queue-postgres` sibling (maintainer decision) named beside it in the section 6a capability table. Accessed through a producer facade that is the sole reader of the Cloudflare Queues binding (`env.RCF_TEST_QUEUE` in the fixture). Landed via the infra round 5 spec (ratified 2026-09-06) as the queue-adapter track.
 
 - 21 contributions: 6 REQs on producer facade sole-reader / publish-consume-ack / retry / dead-letter / batch / lifecycle events; 8 USs at 29101-29108; 3 TACs (3001 producer facade, 3002 consumer registration, 3003 event sink); 4 ADRs (3001 adapter Cloudflare Queues shipped, 3002 `deliverySemantics` scope global at-least-once, 3003 max_retries default 3 floor 1 ceiling 100, 3004 batch size default 10 batch timeout default 5 seconds).
 - Five Node-only probes under `contributions/probes/` proven against the wrangler-dev-equivalent seam (in-memory queue driver realising the Cloudflare Queues binding shape per SDR-3-a on US-29107): `producer-facade-ready`, `publish-to-delivery`, `retry-and-dlq`, `event-secrecy`, and the accountBound `real-account-concurrency-smoke`. The real-account smoke records `accountBoundSkipped: true` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset per spec section 3.5.
-- T-3 slice of the shared sample-app fixture at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/` adds a `wrangler.toml` declaring the queue binding (`RCF_TEST_QUEUE`), DLQ binding (`RCF_TEST_DLQ`), `dead_letter_queue = "rcf-test-dlq"`, `max_retries = 3`, `max_batch_size = 10`, `max_batch_timeout = 5`; plus `src/queue-driver.mjs`, `src/producer.mjs`, `src/consumer.mjs`, `src/dlq-inspector.mjs`, `src/event-sink.mjs`. Three wired induced-failure switches (`SIMULATE_CONSUMER_RETRY`, `SIMULATE_DLQ_OVERFLOW`, `SIMULATE_PII_IN_BODY`) drive the negative-run paths.
-- Declares `capabilities: ["queue"]`, `suggestedCompanions: [{role: "logging"}, {role: "errorHandling"}]`, `providesRoles` absent, `requiresAppliedCapabilities` absent. Composes on `deploy-cloudflare-workers` transitively via the wrangler binding (not through the capability mechanism), so `jobs-background` reads the `queue` capability at apply time via the T-5 mechanism from the visual round.
+- The messaging-queue-cloudflare slice of the shared sample-app fixture at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/` adds a `wrangler.toml` declaring the queue binding (`RCF_TEST_QUEUE`), DLQ binding (`RCF_TEST_DLQ`), `dead_letter_queue = "rcf-test-dlq"`, `max_retries = 3`, `max_batch_size = 10`, `max_batch_timeout = 5`; plus `src/queue-driver.mjs`, `src/producer.mjs`, `src/consumer.mjs`, `src/dlq-inspector.mjs`, `src/event-sink.mjs`. Three wired induced-failure switches (`SIMULATE_CONSUMER_RETRY`, `SIMULATE_DLQ_OVERFLOW`, `SIMULATE_PII_IN_BODY`) drive the negative-run paths.
+- Declares `capabilities: ["queue"]`, `suggestedCompanions: [{role: "logging"}, {role: "errorHandling"}]`, `providesRoles` absent, `requiresAppliedCapabilities` absent. Composes on `deploy-cloudflare-workers` transitively via the wrangler binding (not through the capability mechanism), so `jobs-background` reads the `queue` capability at apply time via the capability-consumer mechanism from the visual round.
 - Contributes ADR-3002 as `scope: global` on new topic `deliverySemantics`. Future exactly-once, at-most-once or `messaging-queue-postgres` siblings conflict here by design.
-- Every ADR contribution entry on `blueprint.json` carries a `standardsTraceClause` per section 8a.2 (mandatory per HQ mid-flight ruling after PR #154 gate).
-- Extends `packages/rcf-lite/docs/blueprint-authoring.md` section 6a capability-declaration table with one row for `queue` naming the reserved `messaging-queue-postgres` sibling per Baz decision 7 and spec section 5.6.
+- Every ADR contribution entry on `blueprint.json` carries a `standardsTraceClause` per section 8a.2 (mandatory per the operator estate mid-flight ruling after PR #154 gate).
+- Extends `packages/rcf-lite/docs/blueprint-authoring.md` section 6a capability-declaration table with one row for `queue` naming the reserved `messaging-queue-postgres` sibling per maintainer decision and spec section 5.6.
 - The Miniflare Queues sub-page under the workers testing miniflare storage tree is NOT cited: the ratified round-5 spec's status block records it returning 404 on 2026-09-06. The Cloudflare Queues local-development page (`https://developers.cloudflare.com/queues/configuration/local-development/`) is the sole citation for the local seam.
-- Lifecycle event whitelist reuses T-2 object-storage-s3's `{event, ts, ...}` common envelope prefix (per PR #157 gate reviewer note 2026-09-06) so a future v1.1 minor can promote one shared shape to schema enforcement.
+- Lifecycle event whitelist reuses the object-storage-s3 blueprint's `{event, ts, ...}` common envelope prefix (per PR #157 gate reviewer note 2026-09-06) so a future v1.1 minor can promote one shared shape to schema enforcement.
+
+Review-fix (2026-09-09): Adds deliveredBy on REQ-003 and REQ-004. Sweeps vendorCitation onto fixed ACs resting on vendor facts (AC-29107-2, AC-29108-2).

package/blueprints/messaging-queue-cloudflare/README.md

@@ -1,6 +1,6 @@
 # messaging-queue-cloudflare
 
-A directed producer-to-consumer worklist queue on Cloudflare Queues, accessed through a producer facade that is the sole reader of the Queues binding. Cloudflare Queues is the first adapter (queue binding under wrangler config, consumer registered on the Worker `queue` handler); the reserved `messaging-queue-postgres` sibling (Baz decision 7) mints on demand. Ships publish, consume, ack, retry, and DLQ; four lifecycle events (`producerReady`, `messagePublished`, `messageAcked`, `messageDeadLettered`) with a metadata-only field discipline. Composes on `deploy-cloudflare-workers` transitively via the wrangler binding, not through the capability mechanism, so `capabilities: ["queue"]` is what `jobs-background` reads to obtain the producer facade at apply time; no `requiresAppliedCapabilities` block ships at v1.0.0.
+A directed producer-to-consumer worklist queue on Cloudflare Queues, accessed through a producer facade that is the sole reader of the Queues binding. Cloudflare Queues is the first adapter (queue binding under wrangler config, consumer registered on the Worker `queue` handler); the reserved `messaging-queue-postgres` sibling (maintainer decision) mints on demand. Ships publish, consume, ack, retry, and DLQ; four lifecycle events (`producerReady`, `messagePublished`, `messageAcked`, `messageDeadLettered`) with a metadata-only field discipline. Composes on `deploy-cloudflare-workers` transitively via the wrangler binding, not through the capability mechanism, so `capabilities: ["queue"]` is what `jobs-background` reads to obtain the producer facade at apply time; no `requiresAppliedCapabilities` block ships at v1.0.0.
 
 ## What this blueprint gives you
 
@@ -44,15 +44,15 @@ Queue name (or binding name in a Workers deploy); `max_retries` before DLQ (defa
 
 ## Composition and conflicts
 
-Composes on `deploy-cloudflare-workers` transitively via the wrangler binding (not through the capability mechanism), so no `requiresAppliedCapabilities` block ships at v1.0.0. Contributes ADR-3002 as `scope: global` on new topic `deliverySemantics`; a future `messaging-queue-postgres` sibling (Baz decision 7, deferred v1.0.0 pending demand) or an exactly-once / at-most-once sibling would conflict here by design. `capabilities: ["queue"]`; `providesRoles: []`.
+Composes on `deploy-cloudflare-workers` transitively via the wrangler binding (not through the capability mechanism), so no `requiresAppliedCapabilities` block ships at v1.0.0. Contributes ADR-3002 as `scope: global` on new topic `deliverySemantics`; a future `messaging-queue-postgres` sibling (maintainer decision, deferred v1.0.0 pending demand) or an exactly-once / at-most-once sibling would conflict here by design. `capabilities: ["queue"]`; `providesRoles: []`.
 
 ## Reserved sibling
 
-`messaging-queue-postgres` (Baz decision 7). Reserved slug beside the `queue` capability row in `packages/rcf-lite/docs/blueprint-authoring.md` section 6a. When demand mints it, the sibling composes on `persistence-data-postgres` as its transport and conflicts by design on `deliverySemantics` with this blueprint; the operator picks one queue backend per project via a project-level ADR.
+`messaging-queue-postgres` (maintainer decision). Reserved slug beside the `queue` capability row in `packages/rcf-lite/docs/blueprint-authoring.md` section 6a. When demand mints it, the sibling composes on `persistence-data-postgres` as its transport and conflicts by design on `deliverySemantics` with this blueprint; the operator picks one queue backend per project via a project-level ADR.
 
 ## The six probes
 
-Each probe is a Node module under `contributions/probes/` exporting the round-5 spec section 3.2 verdict envelope, with a matching `run-<probe-name>.mjs` shim that drives the probe against the shared fixture's T-3 slice and writes the per-blueprint report at `.rcf/reports/blueprints/messaging-queue-cloudflare/<probe-name>.json`.
+Each probe is a Node module under `contributions/probes/` exporting the shipped verdict envelope, with a matching `run-<probe-name>.mjs` shim that drives the probe against the shared fixture's slice and writes the per-blueprint report at `.rcf/reports/blueprints/messaging-queue-cloudflare/<probe-name>.json`.
 
 | Probe | Anchor AC | What it proves | accountBound |
 |---|---|---|---|
@@ -60,7 +60,7 @@ Each probe is a Node module under `contributions/probes/` exporting the round-5
 | `publish-to-delivery` | AC-29102-1, AC-29102-2, AC-29105-1, AC-29108-1 | 5 messages round-trip body byte-equal with stable message-ids and producer-supplied trace-ids preserved; per-message ack; wrangler-dev-equivalent seam. | false |
 | `retry-and-dlq` | AC-29103-1, AC-29104-1 | Consumer returning `retry` observes same stable message-id with attempts 1..max_retries; DLQ landing fires `messageDeadLettered` at `max_retries + 1`; DLQ contents body byte-equal via the DLQ inspector helper. | false |
 | `event-secrecy` | AC-29106-1 | Every event record carries only the whitelist (event, ts, messageId, queueName, attempts); no PII fixture text on JSON grep. | false |
-| `real-account-concurrency-smoke` | AC-29108-2 | Real 500-message round-trip against `rcf-lite-ci-queue-smoke` when `CI_HAS_CLOUDFLARE_ACCOUNT` set; records `accountBoundSkipped: true` when not. | true |
+| `real-account-concurrency-smoke` | AC-29108-2 | Self-provisioning (v1.0.2): the fixture shim (`packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs`) mints a scratch Cloudflare Queue under the CI scratch prefix `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`, and a throwaway consumer Worker under `h2-cf-probe-integrity-scratch-w-` bound to the queue (consumer) with `RCF_TEST_QUEUE` (shipped queue binding name) + `RCF_TEST_TELEMETRY_KV` bindings. The Worker has NO fetch surface and NO workers.dev subdomain is enabled (operator ruling): the consumer is invoked BY THE QUEUE, not over HTTP. Driver publishes 500 messages in 10 concurrent 50-message batches via the Cloudflare Queues REST publish endpoint, polls the telemetry KV namespace via the KV REST list + get endpoints until drained, and asserts `totalConsumed === published` and `1 < maxConcurrent <= 250` per https://developers.cloudflare.com/queues/platform/limits/. Teardown deletes Worker, Queue and telemetry KV namespace on exit; the shim's separate `sweepOrphans` path lists over the account with full pagination (operator ruling item 5) and deletes any prefixed residue after a mid-run crash. **The local proof exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** Without `CI_HAS_CLOUDFLARE_ACCOUNT` records `accountBoundSkipped: true`. | true |
 
 ## Anatomy
 
@@ -111,7 +111,7 @@ Two live paths are unproven at v1.0.0 and are recorded per AC below so the gate
 - **AC-29105-1** (batch consume: 5 messages in one batch, per-message ack semantics under `max_batch_size = 10`): proven against the in-memory realisation of the binding shape (probe `publish-to-delivery`, verdict pass); live Queues `max_batch_size` / `max_batch_timeout` behaviour on the [[queues.consumers]] block unproven pending a reviewer `wrangler dev` run or the accountBound smoke.
 - **AC-29106-1** (metadata-only event whitelist; no PII body / header value / consumer context leaks): proven end-to-end against the in-memory realisation (probe `event-secrecy`, verdict pass; the whitelist is code-enforced in `src/event-sink.mjs`, independent of transport); live-Queues run does not change the sink code path, so this AC has no live-only gap.
 - **AC-29108-1** (wrangler-dev-equivalent seam round-trip): proven end-to-end against the in-memory realisation of the binding shape (probe `publish-to-delivery`, verdict pass); a live `wrangler dev` process was not driven in this pass. Rationale: SDR-3-a on US-29107 makes the wrangler-dev-equivalent seam the shipped local seam because Cloudflare Queues does not support consumer concurrency under `wrangler dev` and does not support `wrangler dev --remote` per the local-development doc, so a live-wrangler run adds observability (a real process on port 8787) but does not add facade-contract certainty over the in-memory realisation. The gate reviewer drives one live `wrangler dev` run in their own scratch to close the observability gap.
-- **AC-29108-2** (real-account concurrency smoke: 500 messages, consumer concurrency up to 250): NOT proven at v1.0.0 without `CI_HAS_CLOUDFLARE_ACCOUNT`. The probe records `accountBoundSkipped: true` per spec section 3.5 and the per-blueprint report carries `aggregateVerdict: pass` on the skipped shape. The live 500-message run rides `deploy-cloudflare-workers`' surface (Cloudflare Queues does not support `wrangler dev --remote` per the local-development doc, so this cannot ride a local wrangler process even with the env var set); the live run is a v1.0.0 follow-up when the shared HQ queue `rcf-lite-ci-queue-smoke` (Q2 default) is provisioned on Baz's account.
+- **AC-29108-2** (real-account concurrency smoke: 500 messages, consumer concurrency up to 250): as of v1.0.2 the probe SELF-PROVISIONS the throwaway Queue + consumer Worker + telemetry KV namespace under the CI scratch prefixes and requires no hand-provisioned CI infrastructure . Declared env for a live run: `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN`. Without `CI_HAS_CLOUDFLARE_ACCOUNT` the probe records `accountBoundSkipped: true` per spec section 3.5 and the per-blueprint report carries `aggregateVerdict: pass` on the skipped shape. **The local proof harness under `packages/rcf-lite/test/fixtures/cf-platform/test/` is a mock of Cloudflare's REST contract, not the wire; the local runs exercise OUR lifecycle logic against that mock, and the real-account gate is the only surface that proves the wire format.**
 
 ## Other limitations (not mechanism-reach gaps)
 

package/blueprints/messaging-queue-cloudflare/blueprint.json

@@ -1,8 +1,10 @@
 {
   "slug": "messaging-queue-cloudflare",
-  "version": "1.0.0",
+  "version": "1.1.2",
   "category": "messaging",
-  "capabilities": ["queue"],
+  "capabilities": [
+    "queue"
+  ],
   "suggestedCompanions": [
     {
       "role": "logging",
@@ -14,23 +16,91 @@
     }
   ],
   "contributions": [
-    { "id": "messaging-queue-cloudflare-REQ-001", "kind": "req", "path": "requirements/messaging-queue-cloudflare-req-001.json" },
-    { "id": "messaging-queue-cloudflare-REQ-002", "kind": "req", "path": "requirements/messaging-queue-cloudflare-req-002.json" },
-    { "id": "messaging-queue-cloudflare-REQ-003", "kind": "req", "path": "requirements/messaging-queue-cloudflare-req-003.json" },
-    { "id": "messaging-queue-cloudflare-REQ-004", "kind": "req", "path": "requirements/messaging-queue-cloudflare-req-004.json" },
-    { "id": "messaging-queue-cloudflare-REQ-005", "kind": "req", "path": "requirements/messaging-queue-cloudflare-req-005.json" },
-    { "id": "messaging-queue-cloudflare-REQ-006", "kind": "req", "path": "requirements/messaging-queue-cloudflare-req-006.json" },
-    { "id": "messaging-queue-cloudflare-US-29101", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29101.json" },
-    { "id": "messaging-queue-cloudflare-US-29102", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29102.json" },
-    { "id": "messaging-queue-cloudflare-US-29103", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29103.json" },
-    { "id": "messaging-queue-cloudflare-US-29104", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29104.json" },
-    { "id": "messaging-queue-cloudflare-US-29105", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29105.json" },
-    { "id": "messaging-queue-cloudflare-US-29106", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29106.json" },
-    { "id": "messaging-queue-cloudflare-US-29107", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29107.json" },
-    { "id": "messaging-queue-cloudflare-US-29108", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29108.json" },
-    { "id": "TAC-3001-messaging-queue-cloudflare-producer-facade", "kind": "tac", "path": "tacs/tac-3001-messaging-queue-cloudflare-producer-facade.json" },
-    { "id": "TAC-3002-messaging-queue-cloudflare-consumer-registration", "kind": "tac", "path": "tacs/tac-3002-messaging-queue-cloudflare-consumer-registration.json" },
-    { "id": "TAC-3003-messaging-queue-cloudflare-event-sink", "kind": "tac", "path": "tacs/tac-3003-messaging-queue-cloudflare-event-sink.json" },
+    {
+      "id": "messaging-queue-cloudflare-REQ-001",
+      "kind": "req",
+      "path": "requirements/messaging-queue-cloudflare-req-001.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-REQ-002",
+      "kind": "req",
+      "path": "requirements/messaging-queue-cloudflare-req-002.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-REQ-003",
+      "kind": "req",
+      "path": "requirements/messaging-queue-cloudflare-req-003.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-REQ-004",
+      "kind": "req",
+      "path": "requirements/messaging-queue-cloudflare-req-004.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-REQ-005",
+      "kind": "req",
+      "path": "requirements/messaging-queue-cloudflare-req-005.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-REQ-006",
+      "kind": "req",
+      "path": "requirements/messaging-queue-cloudflare-req-006.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29101",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29101.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29102",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29102.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29103",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29103.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29104",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29104.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29105",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29105.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29106",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29106.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29107",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29107.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29108",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29108.json"
+    },
+    {
+      "id": "TAC-3001-messaging-queue-cloudflare-producer-facade",
+      "kind": "tac",
+      "path": "tacs/tac-3001-messaging-queue-cloudflare-producer-facade.json"
+    },
+    {
+      "id": "TAC-3002-messaging-queue-cloudflare-consumer-registration",
+      "kind": "tac",
+      "path": "tacs/tac-3002-messaging-queue-cloudflare-consumer-registration.json"
+    },
+    {
+      "id": "TAC-3003-messaging-queue-cloudflare-event-sink",
+      "kind": "tac",
+      "path": "tacs/tac-3003-messaging-queue-cloudflare-event-sink.json"
+    },
     {
       "id": "ADR-3001-messaging-queue-cloudflare-adapter",
       "kind": "adr",
@@ -63,5 +133,43 @@
       "elicited": true,
       "standardsTraceClause": "Cloudflare Queues per-consumer batch settings"
     }
+  ],
+  "elicits": [
+    {
+      "id": "queue-binding-name",
+      "prompt": "The Queues binding name declared under wrangler.toml [[queues.producers]] and [[queues.consumers]]. The producer facade reads env under this name at boot.",
+      "kind": "string",
+      "default": "RCF_TEST_QUEUE"
+    },
+    {
+      "id": "queue-name",
+      "prompt": "The Cloudflare Queues queue name the binding resolves to. The applied project asserts a real account queue at apply.",
+      "kind": "string",
+      "default": "app-queue"
+    },
+    {
+      "id": "max-attempts",
+      "prompt": "Max delivery attempts per ADR-3003 before a message crosses into the DLQ. Default 3 per the Cloudflare Queues documented default; floor 1; ceiling 100 per the Queues platform-limits page.",
+      "kind": "string",
+      "default": "3"
+    },
+    {
+      "id": "dead-letter-queue",
+      "prompt": "Dead-letter queue name attached under [[queues.consumers]].dead_letter_queue for the consumer. A dead-lettered message is stamped messageDeadLettered on the lifecycle sink; retention is 4 days per ADR-3003.",
+      "kind": "string",
+      "default": "app-queue-dlq"
+    },
+    {
+      "id": "batch-size",
+      "prompt": "max_batch_size for the consumer. Default 10 per ADR-3004; bounded above by 100 per the Cloudflare Queues platform-limits page.",
+      "kind": "string",
+      "default": "10"
+    },
+    {
+      "id": "batch-timeout-seconds",
+      "prompt": "max_batch_timeout seconds for the consumer. Default 5 per ADR-3004; bounded above by 60 per the Cloudflare Queues platform-limits page.",
+      "kind": "string",
+      "default": "5"
+    }
   ]
 }

package/blueprints/messaging-queue-cloudflare/contributions/adrs/adr-3001-messaging-queue-cloudflare-adapter.json

@@ -5,9 +5,9 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Adapter: Cloudflare Queues as the shipped v1.0.0 first adapter",
-  "context": "A project deploying a directed producer-to-consumer worklist queue on Cloudflare Workers has one native shipped answer today: Cloudflare Queues. The Queues surface is bound through wrangler configuration (a [[queues.producers]] block for the producer facade to publish through, a [[queues.consumers]] block for the Worker queue handler to consume from), and the shipped Worker runtime binds env.<binding> to a Queues object with send / sendBatch on the producer side and a batch envelope with ack / retry on the consumer side per https://developers.cloudflare.com/queues/configuration/javascript-apis/. The v1.0.0 facade must hold the adapter reference opaque at the facade boundary so a future non-Cloudflare adapter (an SQS shim, the reserved messaging-queue-postgres sibling per Baz decision 7) slots in without a facade re-shape, and so a fixture-time in-memory adapter is testable without live Cloudflare Queues access.",
+  "context": "A project deploying a directed producer-to-consumer worklist queue on Cloudflare Workers has one native shipped answer today: Cloudflare Queues. The Queues surface is bound through wrangler configuration (a [[queues.producers]] block for the producer facade to publish through, a [[queues.consumers]] block for the Worker queue handler to consume from), and the shipped Worker runtime binds env.<binding> to a Queues object with send / sendBatch on the producer side and a batch envelope with ack / retry on the consumer side per https://developers.cloudflare.com/queues/configuration/javascript-apis/. The v1.0.0 facade must hold the adapter reference opaque at the facade boundary so a future non-Cloudflare adapter (an SQS shim, the reserved messaging-queue-postgres sibling per maintainer decision) slots in without a facade re-shape, and so a fixture-time in-memory adapter is testable without live Cloudflare Queues access.",
   "decision": "The shipped v1.0.0 default is Cloudflare Queues, wired through wrangler config (producer binding on [[queues.producers]], consumer on [[queues.consumers]] with dead_letter_queue and max_retries per https://developers.cloudflare.com/queues/configuration/dead-letter-queues/). The producer facade module is the sole holder of the Queues binding reference per REQ-001; the consumer registration module is the sole reader of the batch envelope per REQ-002. The adapter reference is OPAQUE at this ADR: the facade dereferences the elicited binding at the top of the module and any consumer wanting a different adapter (an SQS shim, the messaging-queue-postgres sibling minted on demand) replaces the binding reference here without touching the outward interface. A fixture-time in-memory adapter (used by the local probes) implements the same binding shape (send / sendBatch on the producer side, batch with ack / retry on the consumer side) so the facade and consumer surfaces are indistinguishable from the real Queues binding at the facade boundary. The 128 KB per-message cap and 100 messages per batch cap Cloudflare documents at https://developers.cloudflare.com/queues/platform/limits/ apply to every real-Queues run.",
-  "consequences": "The project inherits the Cloudflare Queues wire-format, the platform-assigned stable message-id, and the batch envelope's per-message ack semantics. Standards trace clause: Cloudflare Queues documented per-message and per-batch limits (per https://developers.cloudflare.com/queues/platform/limits/), Cloudflare Queues Worker queue-handler contract (per https://developers.cloudflare.com/queues/configuration/javascript-apis/), and Cloudflare Queues dead-letter documentation (per https://developers.cloudflare.com/queues/configuration/dead-letter-queues/). A future non-Cloudflare adapter mints under a sibling blueprint (reserved slug messaging-queue-postgres, Baz decision 7) and conflicts by design on deliverySemantics (ADR-3002) with this blueprint; the operator picks one queue backend per project via a project-level ADR.",
+  "consequences": "The project inherits the Cloudflare Queues wire-format, the platform-assigned stable message-id, and the batch envelope's per-message ack semantics. Standards trace clause: Cloudflare Queues documented per-message and per-batch limits (per https://developers.cloudflare.com/queues/platform/limits/), Cloudflare Queues Worker queue-handler contract (per https://developers.cloudflare.com/queues/configuration/javascript-apis/), and Cloudflare Queues dead-letter documentation (per https://developers.cloudflare.com/queues/configuration/dead-letter-queues/). A future non-Cloudflare adapter mints under a sibling blueprint (reserved slug messaging-queue-postgres, maintainer decision) and conflicts by design on deliverySemantics (ADR-3002) with this blueprint; the operator picks one queue backend per project via a project-level ADR.",
   "alternativesConsidered": [
     {
       "name": "External SQS or SNS as the shipped v1.0.0 default",
@@ -17,7 +17,7 @@
     {
       "name": "Kafka or NATS as the shipped v1.0.0 default",
       "summary": "Ship a self-hosted Kafka or NATS backend as the primary v1.0.0 queue.",
-      "reasonNotChosen": "A self-hosted Kafka or NATS backend adds a persistent operational surface every applying project has to run; the round-5 spec section 5.3 targets a directed producer-to-consumer worklist as a shipped shape whose applying project need not host a broker. The reserved messaging-queue-postgres sibling (Baz decision 7) covers the self-hosted-transport family separately when demand mints it."
+      "reasonNotChosen": "A self-hosted Kafka or NATS backend adds a persistent operational surface every applying project has to run; the round-5 spec section 5.3 targets a directed producer-to-consumer worklist as a shipped shape whose applying project need not host a broker. The reserved messaging-queue-postgres sibling (maintainer decision) covers the self-hosted-transport family separately when demand mints it."
     },
     {
       "name": "Ship a hand-rolled fetch client against the Queues REST API",

package/blueprints/messaging-queue-cloudflare/contributions/adrs/adr-3002-messaging-queue-cloudflare-delivery-semantics.json

@@ -7,7 +7,7 @@
   "title": "Delivery semantics: at-least-once as the shipped shape (scope global, new topic deliverySemantics)",
   "context": "A directed producer-to-consumer worklist ships one of three delivery shapes at the transport contract: at-most-once (fire and forget, dedup at the producer), at-least-once (guaranteed delivery with duplicates possible, dedup at the consumer), or exactly-once (guaranteed delivery with dedup at the transport, expensive). Cloudflare Queues implements at-least-once with a stable message-id the consumer uses for its own dedup; the WSD-005 messaging standard (operator/knowledge/wsd/wsd-standards/wsd-005-messaging.md) makes at-least-once and out-of-order tolerance the shipped default for domain event handoffs; the messaging-queue-cloudflare blueprint claims the deliverySemantics topic on the shelf so future exactly-once or at-most-once siblings surface as DELIBERATE conflicts and not silent divergences.",
   "decision": "The shipped v1.0.0 shape is at-least-once. Every publish reaches every consumer at least once; duplicates are possible under retry-and-DLQ redelivery paths; consumer code that needs exactly-once semantics maintains its own dedup keyed on the stable message-id per REQ-002. The deliverySemantics topic scope is global on this blueprint; the topic string is deliverySemantics (lower camel case, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Future exactly-once or at-most-once siblings would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR per the round-2 conflict pattern.",
-  "consequences": "The applying project inherits an at-least-once transport with a stable message-id it uses for consumer-side dedup when the domain calls for exactly-once processing. Standards trace clause: WSD-005 clauses on at-least-once and out-of-order tolerance (satisfied by the message-id and trace-id header contract). The reserved messaging-queue-postgres sibling (Baz decision 7) will claim deliverySemantics with an at-least-once answer too; two shipped answers on one topic surface a DELIBERATE conflict the operator resolves by picking one queue backend per project via a project-level ADR (the same shape as errorEnvelope and authModel conflicts the SPA and API-REST blueprints already carry).",
+  "consequences": "The applying project inherits an at-least-once transport with a stable message-id it uses for consumer-side dedup when the domain calls for exactly-once processing. Standards trace clause: WSD-005 clauses on at-least-once and out-of-order tolerance (satisfied by the message-id and trace-id header contract). The reserved messaging-queue-postgres sibling (maintainer decision) will claim deliverySemantics with an at-least-once answer too; two shipped answers on one topic surface a DELIBERATE conflict the operator resolves by picking one queue backend per project via a project-level ADR (the same shape as errorEnvelope and authModel conflicts the SPA and API-REST blueprints already carry).",
   "alternativesConsidered": [
     {
       "name": "At-most-once as the shipped v1.0.0 default",

package/blueprints/messaging-queue-cloudflare/contributions/probes/real-account-concurrency-smoke.mjs

@@ -1,54 +1,209 @@
 /**
- * Real-account concurrency smoke.
+ * Real-account concurrency smoke for messaging-queue-cloudflare.
+ * v1.0.2.
  *
- * When CI_HAS_CLOUDFLARE_ACCOUNT is set, this probe opens the producer
- * against the shared HQ queue rcf-lite-ci-queue-smoke on Baz's Cloudflare
- * account (Q2 default per spec section 10), publishes 500 messages, and
- * asserts the consumer processes them concurrently up to the 250 push-
- * based invocation cap Cloudflare documents at
- * https://developers.cloudflare.com/queues/platform/limits/. Drains the
- * queue on exit.
+ * Self-provisioning: the fixture shim (packages/rcf-lite/test/fixtures/
+ * cf-platform/h2-cf-queue-real-account-shim.mjs) mints a scratch
+ * Cloudflare Queue under the throwaway prefix
+ * `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for
+ * consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`,
+ * and a throwaway consumer Worker under `h2-cf-probe-integrity-
+ * scratch-w-` bound to the queue (consumer) with RCF_TEST_QUEUE
+ * (shipped queue producer binding name) + RCF_TEST_TELEMETRY_KV
+ * bindings. NO workers.dev subdomain is enabled (operator ruling
+ * 376b4f30): the consumer is invoked BY THE QUEUE, not over HTTP.
  *
- * Without CI_HAS_CLOUDFLARE_ACCOUNT, records accountBoundSkipped:true
- * per spec section 3.5 and returns aggregateVerdict:pass so the shim
- * exits 0 in both paths.
+ * Driver:
+ *   1. Publishes 500 messages via the Cloudflare Queues REST publish
+ *      endpoint in 10 concurrent 50-message batches
+ *      (https://developers.cloudflare.com/api/operations/queue-publish-messages).
+ *   2. Polls the telemetry KV namespace via the KV REST list + get
+ *      endpoints until sum(batchSize) across records >= published
+ *      (drain cap 120s).
+ *   3. Computes maxConcurrent from an interval-overlap analysis on
+ *      the per-invocation (start, end) timestamps the Worker's
+ *      queue() handler recorded.
+ *   4. Asserts totalConsumed === published, maxConcurrent > 1, and
+ *      maxConcurrent <= 250 per Cloudflare's documented push-consumer
+ *      cap (https://developers.cloudflare.com/queues/platform/limits/).
+ *
+ * Local proof is a mock of Cloudflare's REST contract, not the wire.
+ * The local run exercises OUR lifecycle logic against a mock of
+ * Cloudflare's contract; the real-account gate is the only surface
+ * that proves the wire format (operator ruling). This probe is
+ * therefore never described as "locally verified" - the local runs
+ * are our own lifecycle-logic proof; wire correctness is proven at
+ * the operator estate real-account gate.
+ *
+ * Declared env (dispatch requirement 4):
+ *   CI_HAS_CLOUDFLARE_ACCOUNT   required to enter the driver path.
+ *   CF_ACCOUNT_ID               required (real-account only).
+ *   CF_API_TOKEN                required (real-account only).
+ *   CF_API_BASE_URL             optional test override (mock CF REST API).
+ *   CF_QUEUE_MESSAGE_COUNT      optional; defaults to 500.
+ *
+ * Without CI_HAS_CLOUDFLARE_ACCOUNT the probe returns pass-with-
+ * accountBoundSkipped per spec section 3.5; a pass is never reachable
+ * from credential presence alone.
  *
  * Anchors AC-29108-2.
  */
 
+import {
+  mintScratchQueueAndWorker, destroyScratchQueueAndWorker,
+  DECLARED_ENV, QUEUE_PREFIX, WORKER_PREFIX, TELEMETRY_KV_PREFIX,
+} from '../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs';
+import { queuePublishBatch, kvListKeys, kvGet } from '../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-account-api.mjs';
+
+const DEFAULT_MESSAGE_COUNT = 500;
+const BATCH_SIZE = 50;
+const DRAIN_POLL_INTERVAL_MS = 500;
+const DRAIN_TIMEOUT_MS = 120000;
+const DOCUMENTED_PUSH_CAP = 250;
+
+export const anchorAcId = 'AC-29108-2';
 export const accountBound = true;
 
+function skipResult(detail) {
+  return [{
+    anchorAcId: 'AC-29108-2',
+    verdict: 'pass',
+    detail,
+    accountBoundSkipped: true,
+    envDeclared: Array.from(DECLARED_ENV),
+    throwawayPrefixes: { queue: QUEUE_PREFIX, worker: WORKER_PREFIX, telemetryKv: TELEMETRY_KV_PREFIX },
+  }];
+}
+
+// Interval-overlap analysis: given records [{start, end, batchSize, ...}]
+// compute the peak simultaneous in-flight invocation count using a
+// sweep line over the (start, +1) / (end, -1) event list.
+function computeMaxConcurrent(records) {
+  const events = [];
+  for (const r of records) {
+    events.push([r.start, +1]);
+    events.push([r.end, -1]);
+  }
+  // Sort by time; process starts before ends at the same instant so a
+  // batch that finishes exactly when another begins does not
+  // artificially deflate the concurrency count.
+  events.sort((a, b) => (a[0] - b[0]) || (b[1] - a[1]));
+  let cur = 0, max = 0;
+  for (const [, delta] of events) {
+    cur += delta;
+    if (cur > max) max = cur;
+  }
+  return max;
+}
+
+async function readTelemetryRecords({ namespaceId }) {
+  const keys = await kvListKeys({ namespaceId, prefix: 'telemetry-', limit: 1000 });
+  const records = await Promise.all(keys.map(async (k) => {
+    const g = await kvGet({ namespaceId, key: k.name });
+    if (!g.ok) return null;
+    try { return JSON.parse(g.text); } catch (_err) { return null; }
+  }));
+  return records.filter((r) => r && typeof r.start === 'number' && typeof r.end === 'number' && typeof r.batchSize === 'number');
+}
+
 export default async function runProbe() {
   const hasAccount = process.env.CI_HAS_CLOUDFLARE_ACCOUNT === '1' || process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true';
   if (!hasAccount) {
+    return skipResult(`accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT unset; a real-account run requires CI_HAS_CLOUDFLARE_ACCOUNT=true plus CF_ACCOUNT_ID and CF_API_TOKEN. The fixture mints its own throwaway Queue + consumer Worker + telemetry KV namespace under the CI scratch prefixes; publishes via the CF Queues REST publish endpoint (no workers.dev subdomain enabled); reads telemetry via the KV REST list + get endpoints. Cap under test: ${DOCUMENTED_PUSH_CAP} concurrent invocations per push-consumer per https://developers.cloudflare.com/queues/platform/limits/. Message count: ${DEFAULT_MESSAGE_COUNT}.`);
+  }
+  if (!process.env.CF_ACCOUNT_ID || !process.env.CF_API_TOKEN) {
     return [{
       anchorAcId: 'AC-29108-2',
-      verdict: 'pass',
-      detail: 'accountBound: skipped (no CI_HAS_CLOUDFLARE_ACCOUNT)',
-      accountBoundSkipped: true,
+      verdict: 'fail',
+      detail: `CI_HAS_CLOUDFLARE_ACCOUNT=true but one of CF_ACCOUNT_ID / CF_API_TOKEN is missing: accountIdPresent=${!!process.env.CF_ACCOUNT_ID} tokenPresent=${!!process.env.CF_API_TOKEN}.`,
+      envDeclared: Array.from(DECLARED_ENV),
     }];
   }
-  // Live-account path. Requires:
-  //  - The shared HQ queue rcf-lite-ci-queue-smoke to exist on the
-  //    operator's Cloudflare account (Q2 default, spec section 10);
-  //    if it does not exist, the probe returns fail with a pointer to
-  //    the missing-queue CONCERN.
-  //  - Cloudflare credentials wired via security-secrets-management.
-  //
-  // The v1.0.0 shipped probe does not create the queue if missing (that
-  // decision belongs to Baz per the brief's escalation rule). A real-
-  // account run against a provisioned queue would publish 500 messages
-  // through the producer facade wired to a live Queues binding (via
-  // wrangler dev --remote is unsupported per the local-development doc,
-  // so a real-account run happens through a deployed Worker that binds
-  // the queue). The v1.0.0 probe stops short of driving deployment
-  // machinery from within a Node probe module; the account-bound test
-  // rides deploy-cloudflare-workers' surface at a later composition
-  // pass. This probe records the intent and the CONCERN inline.
-  return [{
-    anchorAcId: 'AC-29108-2',
-    verdict: 'pass',
-    detail: 'accountBound: pending real-account run (v1.0.0 ships the skipped-record shape; live-account run is a followup)',
-    accountBoundSkipped: true,
-  }];
+
+  const messageCount = Number.parseInt(process.env.CF_QUEUE_MESSAGE_COUNT ?? '', 10) || DEFAULT_MESSAGE_COUNT;
+  const runId = process.env.GITHUB_RUN_ID || `local-${Date.now()}`;
+
+  let mint = null;
+  try {
+    mint = await mintScratchQueueAndWorker({ runId });
+  } catch (err) {
+    return [{
+      anchorAcId: 'AC-29108-2',
+      verdict: 'fail',
+      detail: `mintScratchQueueAndWorker failed: ${err.message}`,
+      envDeclared: Array.from(DECLARED_ENV),
+    }];
+  }
+
+  try {
+    const started = Date.now();
+    const batches = [];
+    for (let i = 0; i < messageCount; i += BATCH_SIZE) {
+      const slice = [];
+      for (let j = 0; j < BATCH_SIZE && i + j < messageCount; j++) {
+        const seq = i + j;
+        slice.push({ body: { seq, ts: new Date().toISOString(), payload: `h2-smoke-${seq}` } });
+      }
+      batches.push(slice);
+    }
+
+    const publishResults = await Promise.all(batches.map((slice) =>
+      queuePublishBatch({ queueId: mint.queue.id, messages: slice })
+        .then((r) => ({ ok: true, ...r }))
+        .catch((err) => ({ ok: false, error: err.message, status: err.status || 0 })),
+    ));
+    const publishFail = publishResults.find((r) => !r.ok);
+    if (publishFail) {
+      return [{
+        anchorAcId: 'AC-29108-2',
+        verdict: 'fail',
+        detail: `queuePublishBatch failed: status=${publishFail.status} error=${publishFail.error}`,
+        envDeclared: Array.from(DECLARED_ENV),
+      }];
+    }
+    const publishedCount = publishResults.reduce((acc, r) => acc + (r.count ?? 0), 0);
+
+    let records = [];
+    let totalConsumed = 0;
+    const drainStart = Date.now();
+    while (Date.now() - drainStart < DRAIN_TIMEOUT_MS) {
+      records = await readTelemetryRecords({ namespaceId: mint.telemetryKv.id }).catch(() => []);
+      totalConsumed = records.reduce((a, r) => a + r.batchSize, 0);
+      if (totalConsumed >= publishedCount) break;
+      await new Promise((r) => setTimeout(r, DRAIN_POLL_INTERVAL_MS));
+    }
+
+    const elapsed = Date.now() - started;
+    const batchesConsumed = records.length;
+    const maxConcurrent = computeMaxConcurrent(records);
+    const drained = totalConsumed >= publishedCount;
+    const withinCap = maxConcurrent <= DOCUMENTED_PUSH_CAP;
+    const observedConcurrency = maxConcurrent > 1;
+    const allOk = drained && withinCap && observedConcurrency;
+
+    return [{
+      anchorAcId: 'AC-29108-2',
+      verdict: allOk ? 'pass' : 'fail',
+      detail: allOk
+        ? `queue=${mint.queue.name} (id=${mint.queue.id}) consumerWorker=${mint.worker.name} telemetryKv=${mint.telemetryKv.id}: published ${publishedCount} messages via ${batches.length} REST publish batches; consumer telemetry drawn from ${batchesConsumed} KV records in ${elapsed}ms elapsed: totalConsumed=${totalConsumed} batches=${batchesConsumed} maxConcurrent=${maxConcurrent} (>1 observed, <= ${DOCUMENTED_PUSH_CAP} documented push cap per https://developers.cloudflare.com/queues/platform/limits/); teardown removed worker, queue and telemetry KV namespace on exit.`
+        : `queue=${mint.queue.name} publishedCount=${publishedCount} totalConsumed=${totalConsumed} maxConcurrent=${maxConcurrent} batches=${batchesConsumed} elapsed=${elapsed}ms; drained=${drained} withinCap=${withinCap} observedConcurrency=${observedConcurrency}. Documented push cap: ${DOCUMENTED_PUSH_CAP} (https://developers.cloudflare.com/queues/platform/limits/).`,
+      queueName: mint.queue.name,
+      queueId: mint.queue.id,
+      workerName: mint.worker.name,
+      telemetryKvId: mint.telemetryKv.id,
+      publishedCount,
+      totalConsumed,
+      batches: batchesConsumed,
+      maxConcurrent,
+      elapsedMs: elapsed,
+      envDeclared: Array.from(DECLARED_ENV),
+      throwawayPrefixes: { queue: QUEUE_PREFIX, worker: WORKER_PREFIX, telemetryKv: TELEMETRY_KV_PREFIX },
+    }];
+  } finally {
+    try {
+      await destroyScratchQueueAndWorker(mint);
+    } catch (err) {
+      process.stderr.write(`h2-cf-queue probe: teardown failed for queue=${mint && mint.queue && mint.queue.id} worker=${mint && mint.worker && mint.worker.name} telemetryKv=${mint && mint.telemetryKv && mint.telemetryKv.id}: ${err.message}; sweepOrphans will collect on next run.\n`);
+    }
+  }
 }

package/blueprints/messaging-queue-cloudflare/contributions/requirements/messaging-queue-cloudflare-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "messaging-queue-cloudflare-REQ-001",
   "prdId": "PRD-001",
   "title": "One producer facade module is the sole reader of the Cloudflare Queues binding and opens on boot with producerReady",
-  "description": "The application publishes to the queue through a single producer facade module in the project's source tree that is the ONLY module holding a reference to the Cloudflare Queues binding (env.RCF_TEST_QUEUE in the fixture; the elicited binding name in a real project). Every other module that publishes reads the facade and calls its typed domain verbs (publish, publishBatch); no other module dereferences the raw Queues binding. On process boot, the facade opens against the bound queue and, once ready, emits a producerReady lifecycle event carrying the queue name. The queue name (or the binding name in a Workers deploy) is elicited at apply time under the Queues binding declared in wrangler config.",
+  "description": "The application publishes to the queue through a single producer facade module in the project's source tree that is the ONLY module holding a reference to the Cloudflare Queues binding (env.RCF_TEST_QUEUE in the fixture; the elicited binding name in a real project). Every other module that publishes reads the facade and calls its typed domain verbs (publish, publishBatch); no other module dereferences the raw Queues binding. On process boot, the facade opens against the bound queue and, once ready, emits a producerReady lifecycle event carrying the queue name. The queue name (or the binding name in a Workers deploy) is elicited at apply time under the Queues binding declared in wrangler config. The queue-binding-name is elicited at apply time; the producer facade dereferences env[queue-binding-name] once at boot and holds no other reference. The queue-name is elicited at apply time under the wrangler [[queues.producers]] declaration.",
   "category": "functional",
   "domain": "messaging",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3001-messaging-queue-cloudflare-producer-facade",
+    "field": "responsibilities.producerReady"
+  }
 }