rcf-lite 0.26.0 → 0.27.0

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-003.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "adrId": "ADR-3701-edge-cloudflare-rate-limiting-throttle-contract",
+    "field": "decision.overThresholdBehaviour"
+  }
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-004.json

@@ -2,7 +2,7 @@
   "reqId": "edge-cloudflare-rate-limiting-REQ-004",
   "prdId": "PRD-001",
   "title": "Drift audit: an opt-in scheduled runner reads live zone rules via the Cloudflare API and diffs against the local manifest, reporting mismatches metadata-only",
-  "description": "The blueprint ships a scheduled drift-audit runner (TAC-3703) the applying project can wire behind the elicited rate-limit-drift-audit-cadence per ADR-3704. When enabled (daily or hourly), the runner fetches the live rate-limiting rules on the elicited zone via the Cloudflare API, diffs the returned rule set against the local manifest field-by-field, and constructs one drift-audit record per mismatched rule. Each record is written through the applied logger's audit sink with the metadata-only shape {ruleId, clientIpHash, outcome, timestamp} plus the diff fields; a record never carries a full client IP, a request body or a user agent per REQ-005's event-secrecy discipline. The runner's report artefact writes to the standard blueprint-report location under .rcf/reports/blueprints/edge-cloudflare-rate-limiting/. When the elicited cadence is off, the runner is not wired.",
+  "description": "The blueprint ships a scheduled drift-audit runner (TAC-3703) the applying project can wire behind the elicited rate-limit-drift-audit-cadence per ADR-3704. When enabled (daily or hourly), the runner fetches the live rate-limiting rules on the elicited zone via the Cloudflare API, diffs the returned rule set against the local manifest field-by-field, and constructs one drift-audit record per mismatched rule. The drift-audit record shape is the metadata-only shape named on `TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner.purpose` (drift-audit record clause); the runtime request-event record shape emitted by the applied guard on a live client request is the separate shape named on the same TAC field (request-event record clause). Neither shape carries a full IP, a request body or a user agent (event-secrecy discipline per AC-36107-1). The runner report artefact writes to `.rcf/reports/blueprints/edge-cloudflare-rate-limiting/`. When the elicited cadence is off, the runner is not wired.",
   "category": "operational",
   "domain": "edge",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+    "field": "interfaces.createDriftAuditRunner"
+  }
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-005.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "adrId": "ADR-3702-edge-cloudflare-rate-limiting-layering",
+    "field": "decision.layering"
+  }
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/tacs/tac-3701-edge-cloudflare-rate-limiting-manifest-schema.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Rate-limit rule manifest schema and manifest layout",
-  "purpose": "The shipped JSON Schema (draft-07) at blueprints/edge-cloudflare-rate-limiting/contributions/schemas/rate-limit-rule.schema.json is the single source of truth for the shape of one manifest file under the elicited rate-limit-rules-dir. The schema names the seven Cloudflare WAF rate-limiting rules fields per https://developers.cloudflare.com/waf/rate-limiting-rules/ (id, expression, threshold, period, characteristics, action, duration), their types (string, string, positive integer, positive integer, non-empty string array, enum of block/challenge/log/managed_challenge, positive integer), and the additionalProperties: false stance. The manifest-schema-validate probe reads every file in the fixture manifest directory and validates against this schema; the manifest-presence probe asserts the seven required fields are all present. This TAC anchors AC-36101-1, AC-36106-1 and AC-36108-1.",
+  "purpose": "The shipped JSON Schema (draft-07) at blueprints/edge-cloudflare-rate-limiting/contributions/schemas/rate-limit-rule.schema.json is the single source of truth for the shape of one manifest file under the elicited rate-limit-rules-dir. The schema declares seven required Cloudflare WAF rate-limiting rules fields per https://developers.cloudflare.com/waf/rate-limiting-rules/ (id, expression, threshold, period, characteristics, action, duration) plus one optional operator-facing description field, their types (string, string, positive integer, positive integer, non-empty string array, enum of block/challenge/log/managed_challenge, positive integer, and an optional string description), and the additionalProperties: false stance. The manifest-schema-validate probe reads every file in the fixture manifest directory and validates against this schema; the manifest-presence probe asserts the seven required fields are all present (the optional description is not required). This TAC anchors AC-36101-1, AC-36106-1 and AC-36108-1.",
   "responsibilities": [
     "Ship a JSON Schema (draft-07) at contributions/schemas/rate-limit-rule.schema.json naming the seven required fields, their types and additionalProperties: false (AC-36101-1, AC-36106-1).",
     "Ship the shape used by the manifest-presence probe to assert every manifest file carries the seven required fields (AC-36101-1).",
@@ -27,5 +27,5 @@
   ],
   "dependencies": [],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z"
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/tacs/tac-3703-edge-cloudflare-rate-limiting-drift-audit-runner.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Drift-audit runner: read live zone rules via the Cloudflare API and diff against the local manifest",
-  "purpose": "The single project-side module realising the scheduled drift-audit runner. It fetches the live rate-limiting rules on the elicited zone via the Cloudflare API (GET /client/v4/zones/{zone_id}/rulesets), diffs the returned rule set against the local manifest file-by-file, and constructs one drift-audit record per mismatched rule. Records write through the applied logger's audit sink with the metadata-only shape {ruleId, clientIpHash, outcome, timestamp, diff}; no record carries a full IP, a request body or a user agent (event-secrecy discipline per REQ-004 and AC-36107-1). The runner is factory-driven for testability: probes and the anatomy test inject a fake fetch that returns a synthetic live-zone response. This TAC anchors AC-36104-1 and AC-36107-1.",
+  "purpose": "The single project-side module realising the scheduled drift-audit runner. It fetches the live rate-limiting rules on the elicited zone via the Cloudflare API (GET /client/v4/zones/{zone_id}/rulesets), diffs the returned rule set against the local manifest file-by-file, and constructs one drift-audit record per mismatched rule. Drift-audit records write through the applied logger's audit sink with the metadata-only shape {ruleId, outcome, timestamp, diff} (no clientIpHash on the drift record; drift is manifest-vs-live divergence, not a request event). The separate request-event record class emitted by the applied guard on a real client request carries {ruleId, clientIpHash, outcome, timestamp}; no record carries a full IP, a request body or a user agent (event-secrecy discipline per REQ-004 and AC-36107-1). The runner is factory-driven for testability: probes and the anatomy test inject a fake fetch that returns a synthetic live-zone response. This TAC anchors AC-36104-1 and AC-36107-1.",
   "responsibilities": [
     "Export createDriftAuditRunner({env, eventSink, fetch, clock, cadence}) returning {runOnce, schedule, stop} matching the drift-audit shape (AC-36104-1).",
     "Diff every manifest rule against every live rule and construct one drift record per mismatched rule, with the metadata-only shape {ruleId, outcome, timestamp, diff} (AC-36104-1, AC-36107-1).",
@@ -22,5 +22,5 @@
   ],
   "dependencies": [],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36101.json

@@ -11,17 +11,41 @@
   "acceptanceCriteria": [
     {
       "id": "AC-36101-1",
-      "description": "The rate-limit manifest directory (default cloudflare/rate-limits/) exists in the applied project and holds at least one JSON file per rule; every file parses as JSON and carries the seven documented Cloudflare WAF rate-limiting rules fields (id, expression, threshold, period, characteristics, action, duration); no file body contains a plaintext Cloudflare API token or the elicited zone id (the zone id is elicited and stored via the applied secretsManagement companion).",
+      "description": "The rate-limit manifest directory (default cloudflare/rate-limits/) exists in the applied project and holds at least one JSON file per rule; every file parses as JSON and carries the seven documented Cloudflare WAF rate-limiting rules fields (id, expression, threshold, period, characteristics, action, duration); no file body contains a plaintext Cloudflare API token or the elicited zone id (the zone id is elicited and stored via the applied secretsManagement companion). Applying agent sets: the applying agent sets the elicited rate-limit-rules-dir path and, per rule file, the id, expression, threshold, period, characteristics, action and duration values. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the cf-edge fixture with the two committed manifest files under cloudflare/rate-limits/",
       "when": "the manifest-presence probe scans the fixture directory",
       "then": "every manifest file parses, every file carries the seven required fields, and no file references a secret in plaintext",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+        "field": "interfaces.rate-limits"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/waf/rate-limiting-rules/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-36101-2",
+      "description": "The applied blueprint's manifest declares the `edgeRateLimit` capability token and the elicited rate-limit-rules-dir under the applied project holds at least one committed rule file that parses against the shipped rate-limit-rule schema; therefore the `edgeRateLimit` promise the manifest carries is backed by at least one operator-owned rule the applying project intends to run.",
+      "given": "the applied blueprint manifest at `blueprints/edge-cloudflare-rate-limiting/blueprint.json` and the applied fixture manifest directory under `cloudflare/rate-limits/`",
+      "when": "the manifest-presence probe reads the blueprint manifest and scans the applied rule directory",
+      "then": "the blueprint manifest lists `edgeRateLimit` on `capabilities[]` and the applied fixture has at least one schema-valid manifest file, so `edgeRateLimit` is a live promise the applying project can act on",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+        "field": "interfaces.rate-limits"
+      }
     }
   ],
   "tacIds": [
     "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the applied-project manifest-directory shape assertion. The rate-limit-rule schema and its refusal path (SIMULATE_SCHEMA_INVALID) are owned by US-36106; a missing manifest file is owned by US-36108. Per section 7a, this story carries a single AC because its mechanism has no additional documented failure path in the guide or the anchored TAC."
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36102.json

@@ -11,17 +11,23 @@
   "acceptanceCriteria": [
     {
       "id": "AC-36102-1",
-      "description": "The blueprint guide at blueprints/edge-cloudflare-rate-limiting/guide/edge-cloudflare-rate-limiting.md documents an operator-facing management surface with both a wrangler command flow and a Cloudflare dashboard flow; each flow names the exact steps to apply one rule from a manifest file to the elicited zone; the guide references https://developers.cloudflare.com/waf/rate-limiting-rules/ as the vendor doc for the rule shape.",
+      "description": "The blueprint guide at blueprints/edge-cloudflare-rate-limiting/guide/edge-cloudflare-rate-limiting.md documents an operator-facing management surface with both a wrangler command flow and a Cloudflare dashboard flow; each flow names the exact steps to apply one rule from a manifest file to the elicited zone; the guide references https://developers.cloudflare.com/waf/rate-limiting-rules/ as the vendor doc for the rule shape. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the shipped guide file in the blueprint tree",
       "when": "the anatomy test scans the guide for the wrangler headings, the dashboard headings and the vendor URL",
       "then": "both flow headings are present and the vendor URL appears",
       "testable": true,
-      "scope": "documentation"
+      "scope": "documentation",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/waf/rate-limiting-rules/",
+        "verifiedOn": "2026-09-10"
+      }
     }
   ],
   "tacIds": [
     "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the guide-section presence assertion for the management-surface documentation. Per section 7a, this story carries a single AC because the guide names no runtime failure path for the guide-section-presence mechanism."
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36103.json

@@ -5,23 +5,42 @@
   "version": "1.0.0",
   "status": "approved",
   "title": "Over-threshold burst returns 429 with Retry-After and Cf-Ray on the (N+1)th request within the elicited duration",
-  "asA": "operator running the real-account burst probe against a scheduled HQ-owned URL configured with the manifest rule",
+  "asA": "operator running the real-account burst probe against a scheduled operator-owned URL configured with the manifest rule",
   "iWant": "the probe to fire an undici burst above the rule threshold and observe the (N+1)th and subsequent requests return HTTP 429 with a Retry-After header consistent with the elicited duration and a Cf-Ray header for the CF edge that served the refusal",
   "soThat": "the shipped over-threshold behaviour is verified against a real Cloudflare account and, in CI without CI_HAS_CLOUDFLARE_ACCOUNT, the probe records accountBound: skipped per ruling 6",
   "acceptanceCriteria": [
     {
       "id": "AC-36103-1",
-      "description": "When CI_HAS_CLOUDFLARE_ACCOUNT is true and CF_RATE_LIMIT_URL is set to a scheduled HQ-owned URL configured with the manifest rule, the real-account-burst-and-429 probe fires the elicited threshold plus one requests within the rule period and observes the (N+1)th and subsequent requests within the elicited duration return HTTP 429 with a Retry-After header value consistent with the elicited duration and a Cf-Ray header naming the CF edge; when either env var is absent the probe records accountBoundSkipped: true and the aggregate verdict is pass per spec section 3.5 and ruling 6.",
-      "given": "a scheduled HQ-owned URL configured with the manifest rule (or the accountBound: skipped fallback in CI)",
+      "description": "When CI_HAS_CLOUDFLARE_ACCOUNT is true and CF_RATE_LIMIT_URL is set to a scheduled operator-owned URL configured with the manifest rule, the real-account-burst-and-429 probe fires the elicited threshold plus one requests within the rule period and observes the (N+1)th and subsequent requests within the elicited duration return HTTP 429 with a Retry-After header value consistent with the elicited duration and a Cf-Ray header naming the CF edge; when either env var is absent the probe records accountBoundSkipped: true and the aggregate verdict is pass per spec section 3.5 and ruling 6. Applying agent sets: the applying agent sets the elicited rate-limit-zone-id, the per-rule threshold, period and duration values on each rate-limit rule file, and CF_RATE_LIMIT_URL in the operator environment for the account-bound probe.",
+      "given": "a scheduled operator-owned URL configured with the manifest rule (or the accountBound: skipped fallback in CI)",
       "when": "the real-account-burst-and-429 probe fires the burst (or records the skip)",
       "then": "the probe returns 429 with the two required headers on the over-threshold requests, or records accountBoundSkipped: true and aggregates to pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/waf/rate-limiting-rules/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-36103-2",
+      "description": "Given a scheduled operator-owned URL whose origin Worker increments a monotonic origin counter on every invocation, when a client fires N+1 requests within the elicited period, the client observes 429 for the (N+1)th and subsequent requests AND the origin counter reads exactly N (the origin never executes on the refused requests); when either env var is absent the probe records accountBoundSkipped:true. Applying agent sets: the applying agent sets the same per-rule threshold, period and duration values plus the scheduled operator-owned URL whose origin Worker increments the monotonic counter.",
+      "given": "a scheduled operator-owned URL whose origin Worker exposes a monotonic origin-hit counter, or the accountBound:skipped fallback",
+      "when": "a client fires N+1 requests within the elicited period against the configured rule",
+      "then": "the client observes 429 on the (N+1)th and subsequent requests and the origin counter reads exactly N",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "adrId": "ADR-3701-edge-cloudflare-rate-limiting-throttle-contract",
+        "field": "decision.overThresholdBehaviour"
+      }
     }
   ],
   "tacIds": [
     "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36104.json

@@ -11,17 +11,102 @@
   "acceptanceCriteria": [
     {
       "id": "AC-36104-1",
-      "description": "Given a synthetic drift scenario (a fixture manifest file that names threshold 10 and a fake live-zone response that reports threshold 20 on the same rule id), the drift-audit runner's diff step constructs one drift record per mismatched rule; the record carries {ruleId, outcome: driftDetected, timestamp, diff: [field: threshold, manifestValue: 10, liveValue: 20]} and NO full IP, NO request body, NO user agent; when the cadence elicit is off the runner is not wired and no report is written.",
+      "description": "Given a synthetic drift scenario (a fixture manifest file that names threshold 10 and a fake live-zone response that reports threshold 20 on the same rule id), the drift-audit runner's diff step constructs one drift record per mismatched rule; the record carries {ruleId, outcome: driftDetected, timestamp, diff: [{field: threshold, manifestValue: 10, liveValue: 20}]} and NEVER a clientIpHash key, NEVER a full IP, NEVER a request body, NEVER a user agent; when the cadence elicit is off the runner is not wired and no report is written.",
       "given": "the cf-edge fixture with the committed manifest and a synthetic Cloudflare API response with one mismatched rule",
       "when": "the drift-audit runner's diff step runs against the pair",
       "then": "one drift record is constructed per mismatched rule with the metadata-only shape and the report writes to .rcf/reports/blueprints/edge-cloudflare-rate-limiting/",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-36104-2",
+      "description": "Given a fake clock and cadence \"daily\", when the runner is scheduled and 25 hours of virtual time elapse, the drift-audit runOnce fires exactly once; cadence \"hourly\" fires 25 times; cadence \"off\" fires zero times and produces no scheduled timer; stopping and restarting the runner never leaves a duplicate timer.",
+      "given": "the fake-clock harness with cadence set successively to off, daily and hourly",
+      "when": "the runner is scheduled with the harness clock and virtual time advances 25 hours",
+      "then": "daily fires exactly once, hourly exactly 25 times, off fires zero times, and stop+restart yields exactly one timer per active cadence",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+        "field": "interfaces.createDriftAuditRunner"
+      }
+    },
+    {
+      "id": "AC-36104-3",
+      "description": "Given the elicited rate-limit-zone-id is empty at apply, when the runner attempts a runOnce, the runner refuses with outcome:\"error\" reason:\"zone-id-missing\" on exactly one audit event, no live API call is issued, and no false no-drift result is written.",
+      "given": "the fake-fetch harness with rate-limit-zone-id set to empty string",
+      "when": "the runner attempts runOnce",
+      "then": "the runner emits one audit event with outcome \"error\" reason \"zone-id-missing\"; no fetch call fires and no no-drift audit is emitted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+        "field": "interfaces.createDriftAuditRunner"
+      }
+    },
+    {
+      "id": "AC-36104-4",
+      "description": "Given the injected fetch returns status 401 or 403 on the Cloudflare API endpoint, when the runner runs runOnce, the runner emits one audit event with outcome:\"error\" reason:\"api-auth\" carrying the upstream status but no token, header or body echo, and no no-drift audit is emitted.",
+      "given": "the fake-fetch harness returning 401 or 403 on GET /client/v4/zones/{zone_id}/rulesets",
+      "when": "the runner runs runOnce",
+      "then": "the runner emits one audit event outcome \"error\" reason \"api-auth\" with the upstream status and no leaked token/header/body",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+        "field": "interfaces.createDriftAuditRunner"
+      }
+    },
+    {
+      "id": "AC-36104-5",
+      "description": "Given the injected fetch returns status 429 (Cloudflare API-side rate limit), when the runner runs runOnce, the runner emits one audit event with outcome:\"error\" reason:\"api-throttled\" carrying the Retry-After metadata value only, and no no-drift audit is emitted.",
+      "given": "the fake-fetch harness returning 429 with Retry-After",
+      "when": "the runner runs runOnce",
+      "then": "the runner emits one audit event outcome \"error\" reason \"api-throttled\" carrying only the Retry-After metadata and no no-drift audit",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+        "field": "interfaces.createDriftAuditRunner"
+      }
+    },
+    {
+      "id": "AC-36104-6",
+      "description": "Given the injected fetch resolves with status 200 but the body is not valid JSON, or the JSON body omits the expected result field, when the runner parses the response, the runner emits one audit event with outcome:\"error\" reason:\"api-malformed\" and no no-drift audit is emitted.",
+      "given": "the fake-fetch harness returning 200 with an unparseable body or a missing result field",
+      "when": "the runner parses the response",
+      "then": "the runner emits one audit event outcome \"error\" reason \"api-malformed\" and never emits a no-drift audit",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+        "field": "interfaces.createDriftAuditRunner"
+      }
+    },
+    {
+      "id": "AC-36104-7",
+      "description": "Given the injected fetch never resolves within the bounded timeout, when the runner runs runOnce, the runner aborts and emits one audit event with outcome:\"error\" reason:\"api-timeout\" and no no-drift audit is emitted.",
+      "given": "the fake-fetch harness that never resolves",
+      "when": "the runner runs runOnce within the bounded timeout window",
+      "then": "the runner aborts and emits one audit event outcome \"error\" reason \"api-timeout\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+        "field": "interfaces.createDriftAuditRunner"
+      }
     }
   ],
   "tacIds": [
     "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36105.json

@@ -11,17 +11,19 @@
   "acceptanceCriteria": [
     {
       "id": "AC-36105-1",
-      "description": "The guide contains a section titled Composition with security-auth-magic-link that names ADR-3702 explicitly, states the zone rule characteristic (IP-per-URL) and the application rule characteristic (per-email per-minute) verbatim, and shows a copy-paste example of both blueprints applied on the same project.",
+      "description": "The guide contains a section titled Composition with security-auth-magic-link that names ADR-3702 explicitly, states the zone rule characteristic (IP-per-URL) and the application rule characteristic (per-email per-minute) verbatim, and shows a copy-paste example of both blueprints applied on the same project. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the shipped guide at blueprints/edge-cloudflare-rate-limiting/guide/edge-cloudflare-rate-limiting.md",
       "when": "the anatomy test scans the guide for the composition section and ADR-3702 reference",
       "then": "the section heading, ADR-3702 reference, both characteristic strings and the copy-paste example are present",
       "testable": true,
-      "scope": "documentation"
+      "scope": "documentation",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the guide-section presence assertion for the security-auth-magic-link composition documentation. Per section 7a, this story carries a single AC because the guide names no runtime failure path for this guide-section-presence mechanism."
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36106.json

@@ -11,17 +11,36 @@
   "acceptanceCriteria": [
     {
       "id": "AC-36106-1",
-      "description": "Given the shipped rate-limit-rule JSON Schema (blueprints/edge-cloudflare-rate-limiting/contributions/schemas/rate-limit-rule.schema.json, draft-07), the manifest-schema-validate probe reads every manifest file in the fixture manifest directory and validates each against the schema; every valid file passes; a manifest file with a missing threshold field (simulated via SIMULATE_SCHEMA_INVALID=true) fails validation and the probe returns aggregateVerdict: fail with the offending field named in the detail.",
+      "description": "Given the shipped rate-limit-rule JSON Schema (blueprints/edge-cloudflare-rate-limiting/contributions/schemas/rate-limit-rule.schema.json, draft-07) and the canonical cf-edge fixture manifest directory, when the manifest-schema-validate probe reads every manifest file and validates each against the schema, every file passes and the probe returns aggregateVerdict:pass.",
       "given": "the cf-edge fixture with the two committed manifest files and the shipped JSON Schema",
       "when": "the manifest-schema-validate probe validates every manifest file",
       "then": "every valid file passes; the SIMULATE_SCHEMA_INVALID=true switch surfaces the missing threshold field and the aggregate verdict is fail",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+        "field": "interfaces.rate-limit-rule"
+      }
+    },
+    {
+      "id": "AC-36106-2",
+      "description": "Given a fixture manifest file with a missing threshold field, injected via the SIMULATE_SCHEMA_INVALID=true switch, when manifest-schema-validate runs, the probe returns aggregateVerdict:fail with detail naming the offending field.",
+      "given": "the fixture cf-edge manifest with the threshold field removed on one rule (SIMULATE_SCHEMA_INVALID=true)",
+      "when": "manifest-schema-validate runs against the mutated fixture",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the missing `threshold` field",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+        "field": "interfaces.rate-limit-rule"
+      }
     }
   ],
   "tacIds": [
     "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36107.json

@@ -4,24 +4,35 @@
   "reqId": "edge-cloudflare-rate-limiting-REQ-004",
   "version": "1.0.0",
   "status": "approved",
-  "title": "Drift-audit records carry metadata-only fields (ruleId, clientIpHash, outcome, timestamp) with no full IP, no body, no user agent",
+  "title": "Drift-audit and request-event records follow the metadata-only shapes declared on TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner.purpose (drift records omit clientIpHash; request-event records carry a hashed prefix only)",
   "asA": "operator on the applying project reading drift-audit reports and rate-limit event records through the applied logging companion",
-  "iWant": "every drift-audit record and every rate-limit event record to carry only metadata-safe fields (ruleId, clientIpHash, outcome, timestamp, plus the drift diff fields where applicable), never a full client IP, never a request body, never a user agent string",
+  "iWant": "the drift-audit runner and the runtime request-event path to emit records shaped exactly as TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner.purpose declares; both classes never carry a full client IP, never a request body, never a user agent",
   "soThat": "the audit trail is safe to store, forward and read without additional PII scrubbing at the audit sink",
   "acceptanceCriteria": [
     {
       "id": "AC-36107-1",
-      "description": "The event-secrecy probe drives a synthetic drift-audit payload constructed from a fixture rule and a fake live-zone response; every record on the sink carries only {ruleId, clientIpHash, outcome, timestamp} plus (for drift records) a diff array with the schema-safe fields; the probe asserts NO full IP (regex 4-octet dotted quad or v6 group), NO request body key, NO user-agent key; the SIMULATE_EVENT_LEAK_IP=true switch injects a full IP into the drift record and the probe returns aggregateVerdict: fail with the leaked key named in the detail.",
+      "description": "Given a synthetic drift-audit payload constructed from a fixture rule and a fake live-zone response, and a separate runtime request-event synthetic payload, when the event-secrecy probe reads the sink, every drift-audit record carries only {ruleId, outcome, timestamp, diff} (never clientIpHash, never a full IP as regex 4-octet dotted quad or v6 group, never a request-body key, never a user-agent key), and every request-event record carries only {ruleId, clientIpHash, outcome, timestamp} where clientIpHash is a bounded hashed prefix (32 hex chars max, never a full IP); the probe returns aggregateVerdict:pass.",
       "given": "the shipped drift-audit runner and a synthetic input pair",
       "when": "the event-secrecy probe drives the runner and inspects the resulting records",
       "then": "every record carries only the metadata-safe fields; SIMULATE_EVENT_LEAK_IP=true surfaces a leaked key and the aggregate verdict is fail",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-36107-2",
+      "description": "Given the SIMULATE_EVENT_LEAK_IP=true switch, a full IP is injected into a record produced by the runner, when the event-secrecy probe reads the sink, the probe returns aggregateVerdict:fail with detail naming the leaked key.",
+      "given": "the drift-audit runner producing records under SIMULATE_EVENT_LEAK_IP=true (a full IP injected into one record)",
+      "when": "the event-secrecy probe scans the sink",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the leaked key",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z"
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36108.json

@@ -11,17 +11,28 @@
   "acceptanceCriteria": [
     {
       "id": "AC-36108-1",
-      "description": "Given the cf-edge fixture with the SIMULATE_MANIFEST_MISSING=true switch, one committed manifest file is treated as absent by the probe; the manifest-presence probe returns aggregateVerdict: fail with the missing file's basename named in the detail; without the switch the probe passes and both manifest files are inspected.",
+      "description": "Given the canonical cf-edge fixture with every committed manifest file present, when the manifest-presence probe walks the fixture manifest directory, both fixture files are inspected and the probe returns aggregateVerdict:pass.",
       "given": "the cf-edge fixture with two committed manifest files and the SIMULATE_MANIFEST_MISSING=true switch",
       "when": "the manifest-presence probe scans the fixture manifest directory",
       "then": "the probe returns aggregateVerdict: fail and the missing file basename is present in the detail",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-36108-2",
+      "description": "Given the cf-edge fixture with the SIMULATE_MANIFEST_MISSING=true switch (one committed manifest file is treated as absent by the probe), when manifest-presence runs, the probe returns aggregateVerdict:fail with detail naming the missing file's basename.",
+      "given": "the cf-edge fixture with SIMULATE_MANIFEST_MISSING=true (one committed manifest file treated as absent)",
+      "when": "the manifest-presence probe runs",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the missing file's basename",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-rate-limiting/guide/edge-cloudflare-rate-limiting.md

@@ -1,6 +1,6 @@
 # edge-cloudflare-rate-limiting guide
 
-Round 6 T-6 of the Cloudflare-first blueprint line. Ships zone-level rate limiting as an edge gate in front of Worker handlers. The rule set is a local manifest the applying project commits, and an operator applies it to the live Cloudflare zone through either a wrangler command flow or the Cloudflare dashboard flow, both walked below.
+Ships zone-level rate limiting as an edge gate in front of Worker handlers. The rule set is a local manifest the applying project commits, and an operator applies it to the live Cloudflare zone through either a wrangler command flow or the Cloudflare dashboard flow, both walked below.
 
 ## Manifest
 
@@ -79,7 +79,7 @@ The applied recorder records both blueprints so the operator sees the two-rule s
 
 ## Drift audit
 
-The blueprint ships a scheduled drift-audit runner realisation in the `cf-edge` fixture at `packages/rcf-lite/test/fixtures/cf-edge/src/drift-audit-runner.mjs`. The runner exports `createDriftAuditRunner({env, eventSink, fetch, clock, cadence, manifestLoader})` per TAC-3703 and fetches the live rules on the elicited zone via `https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets`, diffs field-by-field against the local manifest, and constructs one drift-audit record per mismatched rule with the metadata-only shape `{ruleId, clientIpHash, outcome, timestamp, diff}`. No record carries a full client IP, a request body or a user agent (event-secrecy discipline per REQ-005 and AC-36107-1).
+The blueprint ships a scheduled drift-audit runner realisation in the `cf-edge` fixture at `packages/rcf-lite/test/fixtures/cf-edge/src/drift-audit-runner.mjs`. The runner exports `createDriftAuditRunner({env, eventSink, fetch, clock, cadence, manifestLoader})` per TAC-3703 and fetches the live rules on the elicited zone via `https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets`, diffs field-by-field against the local manifest, and constructs one drift-audit record per mismatched rule following the metadata-only shape declared on `TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner.purpose` (drift records omit the runtime-only clientIpHash because drift is manifest-vs-live divergence, not a request event). The separate request-event record class emitted by the applied guard on a real client request follows the request-event shape declared on the same TAC field. No record carries a full client IP, a request body or a user agent (event-secrecy discipline per REQ-005 and AC-36107-1).
 
 The elicited `rate-limit-drift-audit-cadence` per ADR-3704 picks `off` (runner not wired), `daily` (24-hour cadence, `recommendedDefault`), or `hourly`.
 

package/blueprints/edge-cloudflare-tunnel/CHANGELOG.md

@@ -1,23 +1,58 @@
 # edge-cloudflare-tunnel CHANGELOG
 
+## 1.1.3 - 2026-09-10
+
+Positive-evidence rule alignment on the probe pack skip path (authoring standard section 7d); register tidy in shipped prose (no capability change).
+
+- Probes and fixture: extended the shared `accountBoundSkippedResult` helper in `contributions/probes/probe-utils.mjs` to carry a `reason` field naming the exact env var(s) that were unset on the skip return; added a "Declared env vars" section for the tunnel probes to the shared fixture README (`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/README.md`), per authoring standard section 7d.
+- Probe report detail hygiene: `accountBoundSkippedResult` now names only the actually-unset variables in its `detail` string (a partial skip with one first-tier gate set and the other unset reads honestly, instead of claiming the whole input list is unset). The `reason` field was already exact; this aligns the human-readable detail with it.
+- Closes F-5: README now leads with a category-neutral opening line and drops the account-token remark trailing clause.
+- Closes F-6: guide drops the leading provenance line and rewrites two trailing clauses without internal spec references.
+
+## 1.1.2 - 2026-09-10
+
+Capability token named in the requirements layer.
+
+- Extended REQ-001 description to name the declared `tunnelBridge` capability token verbatim with a one-line runtime clause tying the token to the connector shape that supplies it.
+- Added AC-tunnel-capabilityToken on US-39101 as a fixed AC that binds the manifest-declared `tunnelBridge` token to the on-disk connector variant selected by the applied capability set.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+Hardening pass on the edge family (criterion a REQ-layer backing; criterion b AC-set sufficiency; criterion c chain consistency lint-zero on pass 1 and pass 2).
+
+- Added REQ-006 (zone resolution via the vault seam; AUD-mandatory-when-gated) and REQ-007 (public-hostname template expansion at apply with malformed and duplicate refusals). Closes review P0 findings F-1 (cloudflare-zone-secret elicit had no covering requirement) and F-2 (public-hostname-template elicit had no covering requirement). Neither elicit or capability token was removed; both are now backed by a `must`-priority requirement.
+- Added TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply naming the apply-time responsibilities for zone resolution, hostname expansion and AUD-mandatory refusals.
+- Added user stories US-39109 (four apply-time ACs across the zone-resolution and AUD-mandatory-when-gated paths) and US-39110 (three apply-time ACs across the hostname-template expansion, malformed and duplicate paths).
+- Added the following failure-path ACs to existing stories: AC-tunnel-cloudflaredReady on US-39102 (boot event observation; closes F-4 event-name inconsistency by naming both `cloudflaredReady` (process boot) and `tunnelConnectorUp` (per-connector) as distinct events); AC-tunnel-connectorPrecedence on US-39101 (four-combination precedence with two apply-refusal codes; closes F-5); four `AC-tunnel-accessGatedReject*/Accept*` ACs on US-39106 covering missing, invalid and wrong-audience JWT paths plus the valid-audience accept path (closes F-6); AC-tunnel-credentialsHostMode and AC-tunnel-credentialsTrackedTreeScan on US-39108 (closes F-7).
+- Every REQ now carries `deliveredBy` into the owning TAC or ADR; every AC carries `disposition` (`fixed` or `template`); ACs referencing owner-owned literals carry `ownerRef`. Vendor citations added where an AC rests on a mechanism-invariant vendor fact.
+- Tightened the `access-aud` elicit prompt: when `zeroTrustGate` is applied the value is mandatory (apply refuses with `apply.tunnel-aud-missing`); when absent, the tunnel serves in the deliberate public-hostname mode per ADR-4003 (closes specimen F-3).
+- Guide updated in the "Hostname mode: when to reach for Access-gated vs public-hostname" section to name the AUD-mandatory-when-gated rule; the earlier "Graceful degrade" wording is retired.
+- De-identified operator-internal names across the blueprint (operator-internal path prefixes renamed to `vault/*`; other in-house references neutralised) to keep the shipped package customer-facing.
+- Chain-consistency lint (`rcf define blueprint lint-consistency`) reports 0 findings on both passes for this blueprint.
+- Review fix pass (2026-09-09): split every bundled single-AC story on a per-failure-path basis so each named path (SIMULATE_MANIFEST_INVALID_TUNNEL_ID / _CREDENTIALS_INLINE / _MISSING_CATCHALL on US-39103; SIMULATE_INGRESS_INVALID on US-39104 with the happy path split off; SIMULATE_ORIGIN_PORT_OPEN on US-39105 with the happy path split off; SIMULATE_AUD_DROP on US-39107 with the happy path split off) is its own AC on the owning story with a concrete oracle (probe verdict + named field) and an `ownerRef` into the owning TAC. Vendor citations added on the US-39106 four AUD ACs (Cloudflare Access self-hosted-public-app-owned literals) and on the vendor cloudflared local-configuration-file reference (US-39104); the four US-39106 AUD ACs and AC-tunnel-hostnameTemplateExpand on US-39110 re-marked `template` naming the values the applying agent sets (elicited access-aud tag; ingress rule service names and resolved zone). Filled `ownerRef` and given/when/then on AC-tunnel-connectorShape (US-39101; closes F-5). Filled given/when/then on AC-tunnel-accessGated (US-39106; closes F-6). Reworded the US-39102 title and `iWant` to name both `cloudflaredReady` (boot) and `tunnelConnectorUp` (per-connector) as distinct events (closes F-7). Added `## Zone resolution` and `## Public-hostname template expansion` sections to the shipped guide (closes F-8).
+
+
 ## 1.0.1 - 2026-09-08
 
-H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch. No capability change.
+Probe-integrity patch. No capability change.
 
-- Replaced the warn-on-env-set stub in `real-account-connector-healthy.mjs` with a real cloudflared connector-health driver via the new cf-edge shim (`packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs`). With both `CI_HAS_CLOUDFLARE_ACCOUNT` and `CI_HAS_HETZNER_ACCOUNT` set, the driver provisions the throwaway server through the hetzner fixture surface (H-1 territory, consumed as-is), runs `cloudflared tunnel info <name>` via the shim, asserts healthy connector count, captures the `tunnelConnectorUp` event, and always tears the server down. Env-absent branch keeps pass-with-skip. Env-present-with-fixture-failure yields FAIL with a pointer to the fixture step, never warn.
+- Replaced the warn-on-env-set stub in `real-account-connector-healthy.mjs` with a real cloudflared connector-health driver via the new cf-edge shim (`packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs`). With both `CI_HAS_CLOUDFLARE_ACCOUNT` and `CI_HAS_HETZNER_ACCOUNT` set, the driver provisions the throwaway server through the hetzner fixture surface (consumed as-is), runs `cloudflared tunnel info <name>` via the shim, asserts healthy connector count, captures the `tunnelConnectorUp` event, and always tears the server down. Env-absent branch keeps pass-with-skip. Env-present-with-fixture-failure yields FAIL with a pointer to the fixture step, never warn.
 - Replaced both warn-on-env-set stubs in `real-account-tunnel-hostname-routes.mjs` with real drivers. Public-hostname sub-case: undici fetch against the scratch subdomain via the shim's `fetchTunnelHostname` seam, activated on `CI_HAS_CLOUDFLARE_ACCOUNT`. Access-gated sub-case: two-identity HS256 JWT check, activated only when `CI_HAS_CLOUDFLARE_ACCESS` is ALSO set (amendment 4). Env-absent branch keeps pass-with-skip. A pass is no longer reachable from `CI_HAS_CLOUDFLARE_ACCOUNT` presence alone.
 - Converted the credentials-placeholder-read-failed branch in `manifest-schema-validate.mjs::eventSecrecyScan` from warn to fail with a pointer to the exact fixture path (`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/*/credentials/probe.json.example`) and the setup requirement (must exist and parse as JSON).
 - Added the cf-edge tunnel shim (`packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs`) with five seams: `provisionScratchServer`, `destroyScratchServer`, `cloudflaredTunnelInfo`, `fetchTunnelHostname`, `mintScratchIdentity`. The shim reads `H2_CF_TUNNEL_SHIM_MODE` and `H2_CF_TUNNEL_HOSTNAME_SHIM_MODE` for synthetic-mode branches; the probe bodies hold zero `SIMULATE_` token references.
-- Tunnel symbolic-anchor ruling (task C4): the `AC-tunnel-*` symbolic ids on the five tunnel probes ARE the shipped AC ids in the `US-39101..US-39108` contribution band, so no re-anchor was performed. Full mapping in the H-2 PR body.
+- The `AC-tunnel-*` symbolic ids on the five tunnel probes ARE the shipped AC ids in the `US-39101..US-39108` contribution band, so no re-anchor is performed by this patch.
 
 ## 1.0.0 - 2026-09-08
 
-Initial release. Round-7 T-3 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`.
+Initial release. Round-7 blueprint of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`.
 
 - Mints capability `tunnelBridge` and global topic `edgeIngressBridge`.
 - Five REQs, eight USs, three TACs, three ADRs; five Node-only probes.
-- Extends the shared throwaway-Hetzner-server fixture with a cloudflared connector in both runtime shapes (compose-service alongside the T-2 web and caddy services when `containerHost` is applied; systemd-unit for a bare `cloudHost`) and both hostname modes (access-gated when `zeroTrustGate` is applied; public-hostname when absent) plus five `run-<probe>.mjs` delegate shims.
+- Extends the shared throwaway-Hetzner-server fixture with a cloudflared connector in both runtime shapes (compose-service alongside the compose-host web and caddy services when `containerHost` is applied; systemd-unit for a bare `cloudHost`) and both hostname modes (access-gated when `zeroTrustGate` is applied; public-hostname when absent) plus five `run-<probe>.mjs` delegate shims.
 - manifest-schema-validate carries five fixture-side mutation switches (`SIMULATE_MANIFEST_INVALID_TUNNEL_ID`, `SIMULATE_MANIFEST_CREDENTIALS_INLINE`, `SIMULATE_MANIFEST_MISSING_CATCHALL`, `SIMULATE_ORIGIN_PORT_OPEN`, `SIMULATE_EVENT_SECRECY_LEAK`); cloudflared-config-lint carries `SIMULATE_INGRESS_INVALID` and runs `cloudflared tunnel ingress validate` via the `cloudflare/cloudflared:2026.8.3` container when a local binary is not on PATH; aud-presence-check carries `SIMULATE_AUD_DROP`.
-- Mutation-discipline (T-2 gate ruling carried forward): every `SIMULATE_*` switch lives in the fixture-side delegate shim; the probe modules read only `RCF_LITE_T3_FIXTURE_ROOT` and never branch on being under mutation.
+- Mutation-discipline (real-account gate ruling carried forward): every `SIMULATE_*` switch lives in the fixture-side delegate shim; the probe modules read only `RCF_LITE_T3_FIXTURE_ROOT` and never branch on being under mutation.
 - Connector-runtime choice elicited via `connector-runtime` (compose-service default when `containerHost` applied; systemd-unit alternative for bare `cloudHost`, per the vendor cloudflared as-a-service local-configuration-file docs); hostname-mode discovered (not elicited) from `appliedCapabilities` via the sidecar per ADR-4003.
-- Consumers: `w-2026-09-06-dave-010` follow-on (make the librarian API and workspace viewer reachable without Mullvad) is the estate consumer; blueprint acceptance never depends on that consumer, and the ops-01 migration mints as its own work item.