rcf-lite 0.26.0 → 0.27.0

package/blueprints/messaging-queue-cloudflare/CHANGELOG.md

@@ -1,34 +1,50 @@
+# Changelog
+
+## 1.1.2 - 2026-09-10
+
+Register cleanup on shipped prose: neutral wording in the README six-probes paragraph, which now describes the probe module envelope directly. Guide `publishBatch` sample updated: the `x-trace-id` example values are now `trace-order-1001` and `trace-order-1002`, and a one-line pointer follows the sample to the owner at `TAC-3001.interfaces[2].description`. Anatomy pin updated to 1.1.2. Chain-consistency lint zero on pass 1 and pass 2. Closes criterion-f finding 1 for messaging-queue-cloudflare; finding 2 was verified as not a defect (the flagged tokens were `x-trace-id` header values in the sample rather than register labels, and the sample now uses order-scoped example values that remove the ambiguity).
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+Adds the elicits block (queue-binding-name, queue-name, max-attempts, dead-letter-queue, batch-size, batch-timeout-seconds) that the REQs and guide were already describing in prose. Adds deliveredBy on REQ-002 and REQ-006. Closes chain-contradiction specimens F-2 (retry count off by one: REQ-004 and AC-29104-1 now name maxDeliveries and map to the vendor max_retries as maxDeliveries - 1; new AC-29104-2 asserts the maxDeliveries=1 boundary case), F-3 (REQ-006 and AC-29106-1 standardise on ts as the wall-clock milliseconds-since-epoch field name, aligning with TAC-3001, TAC-3003 and the guide), F-6 (REQ-002 replaces the "idempotent" label with an explicit at-least-once semantics naming ADR-3002 as the ratified delivery decision). Adds disposition to every AC.
+
 # messaging-queue-cloudflare changelog
 
 ## 1.0.2 - 2026-09-08
 
-H-2 follow-up (`w-2026-09-08-dave-017`, addendum item 6 fixture defect): the real-account queue probe now self-provisions its own throwaway Queue + consumer Worker + telemetry KV namespace, closing the second-tier undeclared-env skip HQ hit at the real-account gate on 2026-09-08 (`REAL RUN: PARTIAL`, `MERGE DECISION: HOLD`). No shipped-code capability change.
+The review-train follow-up (addendum item 6 fixture defect): the real-account queue probe now self-provisions its own throwaway Queue + consumer Worker + telemetry KV namespace, closing the second-tier undeclared-env skip the operator estate hit at the real-account gate on 2026-09-08 (`REAL RUN: PARTIAL`, `MERGE DECISION: HOLD`). No shipped-code capability change.
 
-- `real-account-concurrency-smoke.mjs` rewritten against a new self-provisioning fixture shim at `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs`. AC-29108-2 requires a real consumer to process the published messages ("the consumer processes them concurrently up to the documented 250-invocation cap"), so the shim mints a scratch Cloudflare Queue under `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`, and a throwaway consumer Worker under `h2-cf-probe-integrity-scratch-w-` bound to the queue (consumer) with `RCF_TEST_QUEUE` (shipped queue producer binding name matching `packages/rcf-lite/test/fixtures/infra-s3-and-queue/wrangler.toml`) + `RCF_TEST_TELEMETRY_KV` bindings. NO workers.dev subdomain is enabled (Dave ruling 376b4f30): the consumer is invoked BY THE QUEUE, not over HTTP; the driver publishes via the Cloudflare Queues REST publish endpoint and reads consumer telemetry via the KV REST list + get endpoints. The consumer Worker's source is a plain module (`h2-cf-queue-consumer-worker.mjs`); its `queue()` handler records one telemetry entry per invocation (start / end timestamps + batchSize) to the bound telemetry KV namespace; the driver computes `maxConcurrent` from an interval-overlap analysis on those timestamps.
+- `real-account-concurrency-smoke.mjs` rewritten against a new self-provisioning fixture shim at `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs`. AC-29108-2 requires a real consumer to process the published messages ("the consumer processes them concurrently up to the documented 250-invocation cap"), so the shim mints a scratch Cloudflare Queue under `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`, and a throwaway consumer Worker under `h2-cf-probe-integrity-scratch-w-` bound to the queue (consumer) with `RCF_TEST_QUEUE` (shipped queue producer binding name matching `packages/rcf-lite/test/fixtures/infra-s3-and-queue/wrangler.toml`) + `RCF_TEST_TELEMETRY_KV` bindings. NO workers.dev subdomain is enabled (operator ruling): the consumer is invoked BY THE QUEUE, not over HTTP; the driver publishes via the Cloudflare Queues REST publish endpoint and reads consumer telemetry via the KV REST list + get endpoints. The consumer Worker's source is a plain module (`h2-cf-queue-consumer-worker.mjs`); its `queue()` handler records one telemetry entry per invocation (start / end timestamps + batchSize) to the bound telemetry KV namespace; the driver computes `maxConcurrent` from an interval-overlap analysis on those timestamps.
 - Declared env for a real-account run is now `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN` (optional `CF_API_BASE_URL` test override; optional `CF_QUEUE_MESSAGE_COUNT` per section 3.5). The `CF_QUEUE_WORKER_URL` and `CF_QUEUE_NAME` second-tier gates are removed; the fixture provides them itself. Every skip-causing env var enumerated in `report.extra.envDeclared` on the probe result and mirrored in the shim's `DECLARED_ENV` export.
-- Teardown deletes the consumer Worker first (so the queue has no active consumer at delete time), then the Queue, then the telemetry KV namespace, all by EXACT id / EXACT name against the mint record with three independent prefix guards per resource. `workerDelete` and `queueDelete` are idempotent on 404 (Dave ruling 4e9ff62d items 3+4): a botched-retry teardown treats an already-gone resource as success rather than stranding siblings.
-- Separate crash-recovery `sweepOrphans` code path filters over the account by the frozen throwaway prefix constants and deletes each match by exact identity; the sweep is structurally unable to select a non-prefixed name. All account listings paginate to completion (Dave ruling 4e9ff62d item 5): KV namespaces + Queues use the documented `per_page` + `page` loop, Workers scripts use the cursor loop, so `sweepOrphans` is not silently truncated to page one on a busy account. Dedicated sweep-safety test at `packages/rcf-lite/test/fixtures/cf-platform/test/h2-cf-sweep-safety.test.mjs` seeds the mock account with the ten live production Worker script names on the operator account plus mid-string-prefix decoys AND a 250-per-type multi-page cover, and asserts sweep selects zero of them.
-- Queue consumer-attach body sends `type: "worker"` (Dave ruling 4e9ff62d item 1: survives CF schema tightening on the discriminated attach union) and omits `dead_letter_queue` entirely rather than sending an explicit `null` (item 2).
-- Local proof harness (`packages/rcf-lite/test/fixtures/cf-platform/test/mock-cf-api-server.mjs`) is a zero-dep in-process mock of the Cloudflare REST contract, not the wire. **The local run exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** The probe is therefore never described as "locally verified" - the local runs are our own lifecycle-logic proof; wire correctness is proven at the HQ real-account gate.
+- Teardown deletes the consumer Worker first (so the queue has no active consumer at delete time), then the Queue, then the telemetry KV namespace, all by EXACT id / EXACT name against the mint record with three independent prefix guards per resource. `workerDelete` and `queueDelete` are idempotent on 404 (operator ruling items 3+4): a botched-retry teardown treats an already-gone resource as success rather than stranding siblings.
+- Separate crash-recovery `sweepOrphans` code path filters over the account by the frozen throwaway prefix constants and deletes each match by exact identity; the sweep is structurally unable to select a non-prefixed name. All account listings paginate to completion (operator ruling item 5): KV namespaces + Queues use the documented `per_page` + `page` loop, Workers scripts use the cursor loop, so `sweepOrphans` is not silently truncated to page one on a busy account. Dedicated sweep-safety test at `packages/rcf-lite/test/fixtures/cf-platform/test/h2-cf-sweep-safety.test.mjs` seeds the mock account with the ten live production Worker script names on the operator account plus mid-string-prefix decoys AND a 250-per-type multi-page cover, and asserts sweep selects zero of them.
+- Queue consumer-attach body sends `type: "worker"` (operator ruling item 1: survives CF schema tightening on the discriminated attach union) and omits `dead_letter_queue` entirely rather than sending an explicit `null` (item 2).
+- Local proof harness (`packages/rcf-lite/test/fixtures/cf-platform/test/mock-cf-api-server.mjs`) is a zero-dep in-process mock of the Cloudflare REST contract, not the wire. **The local run exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** The probe is therefore never described as "locally verified" - the local runs are our own lifecycle-logic proof; wire correctness is proven at the operator estate real-account gate.
 
 ## 1.0.1 - 2026-09-08
 
-H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch. No capability change.
+The review-train hardening pass (`h2-cf-platform-probe-integrity`): probe-integrity patch. No capability change.
 
-- Replaced the `accountBoundSkipped: true` pass-stub in `real-account-concurrency-smoke.mjs` with a real 500-message concurrency driver against a live Queues binding on a deployed Worker. When `CI_HAS_CLOUDFLARE_ACCOUNT` is set with `CF_QUEUE_WORKER_URL` and `CF_QUEUE_NAME`, the driver publishes 500 messages through the producer facade in 10 concurrent 50-message batches, polls consumer telemetry via `/stats`, and asserts `drained`, `withinCap` and `observedConcurrency > 1` against Cloudflare's documented push-invocation cap (250). The env-absent branch keeps the pass-with-skip shape. Locally proven against `wrangler dev --local` end-to-end (500/500 messages in 583 ms; local queue serialises so the concurrency assertion FAIL tail is the expected local-proof outcome; on real Cloudflare push consumers the assertion passes at HQ gate time).
-- Re-verified the Cloudflare Queues limits URL (`https://developers.cloudflare.com/queues/platform/limits/`) returns `HTTP/2 200`; recorded in the H-2 PR provenance (2026-09-08T13:38:07Z).
+- Replaced the `accountBoundSkipped: true` pass-stub in `real-account-concurrency-smoke.mjs` with a real 500-message concurrency driver against a live Queues binding on a deployed Worker. When `CI_HAS_CLOUDFLARE_ACCOUNT` is set with `CF_QUEUE_WORKER_URL` and `CF_QUEUE_NAME`, the driver publishes 500 messages through the producer facade in 10 concurrent 50-message batches, polls consumer telemetry via `/stats`, and asserts `drained`, `withinCap` and `observedConcurrency > 1` against Cloudflare's documented push-invocation cap (250). The env-absent branch keeps the pass-with-skip shape. Locally proven against `wrangler dev --local` end-to-end (500/500 messages in 583 ms; local queue serialises so the concurrency assertion FAIL tail is the expected local-proof outcome; on real Cloudflare push consumers the assertion passes at the operator estate gate time).
+- Re-verified the Cloudflare Queues limits URL (`https://developers.cloudflare.com/queues/platform/limits/`) returns `HTTP/2 200`; recorded in the review-train PR provenance (2026-09-08T13:38:07Z).
 - Extended the fixture Worker at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/worker.mjs` with consumer telemetry and `/publish-batch`, `/stats` and `/reset` endpoints; added `wrangler ^4.0.0` as devDep on the fixture package.
 
 ## 1.0.0 - 2026-09-06
 
-Initial release. Directed producer-to-consumer worklist queue on Cloudflare Queues; first shipped adapter with the reserved `messaging-queue-postgres` sibling (Baz decision 7) named beside it in the section 6a capability table. Accessed through a producer facade that is the sole reader of the Cloudflare Queues binding (`env.RCF_TEST_QUEUE` in the fixture). Landed via the infra round 5 spec (ratified 2026-09-06) as track T-3.
+Initial release. Directed producer-to-consumer worklist queue on Cloudflare Queues; first shipped adapter with the reserved `messaging-queue-postgres` sibling (maintainer decision) named beside it in the section 6a capability table. Accessed through a producer facade that is the sole reader of the Cloudflare Queues binding (`env.RCF_TEST_QUEUE` in the fixture). Landed via the infra round 5 spec (ratified 2026-09-06) as the queue-adapter track.
 
 - 21 contributions: 6 REQs on producer facade sole-reader / publish-consume-ack / retry / dead-letter / batch / lifecycle events; 8 USs at 29101-29108; 3 TACs (3001 producer facade, 3002 consumer registration, 3003 event sink); 4 ADRs (3001 adapter Cloudflare Queues shipped, 3002 `deliverySemantics` scope global at-least-once, 3003 max_retries default 3 floor 1 ceiling 100, 3004 batch size default 10 batch timeout default 5 seconds).
 - Five Node-only probes under `contributions/probes/` proven against the wrangler-dev-equivalent seam (in-memory queue driver realising the Cloudflare Queues binding shape per SDR-3-a on US-29107): `producer-facade-ready`, `publish-to-delivery`, `retry-and-dlq`, `event-secrecy`, and the accountBound `real-account-concurrency-smoke`. The real-account smoke records `accountBoundSkipped: true` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset per spec section 3.5.
-- T-3 slice of the shared sample-app fixture at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/` adds a `wrangler.toml` declaring the queue binding (`RCF_TEST_QUEUE`), DLQ binding (`RCF_TEST_DLQ`), `dead_letter_queue = "rcf-test-dlq"`, `max_retries = 3`, `max_batch_size = 10`, `max_batch_timeout = 5`; plus `src/queue-driver.mjs`, `src/producer.mjs`, `src/consumer.mjs`, `src/dlq-inspector.mjs`, `src/event-sink.mjs`. Three wired induced-failure switches (`SIMULATE_CONSUMER_RETRY`, `SIMULATE_DLQ_OVERFLOW`, `SIMULATE_PII_IN_BODY`) drive the negative-run paths.
-- Declares `capabilities: ["queue"]`, `suggestedCompanions: [{role: "logging"}, {role: "errorHandling"}]`, `providesRoles` absent, `requiresAppliedCapabilities` absent. Composes on `deploy-cloudflare-workers` transitively via the wrangler binding (not through the capability mechanism), so `jobs-background` reads the `queue` capability at apply time via the T-5 mechanism from the visual round.
+- The messaging-queue-cloudflare slice of the shared sample-app fixture at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/` adds a `wrangler.toml` declaring the queue binding (`RCF_TEST_QUEUE`), DLQ binding (`RCF_TEST_DLQ`), `dead_letter_queue = "rcf-test-dlq"`, `max_retries = 3`, `max_batch_size = 10`, `max_batch_timeout = 5`; plus `src/queue-driver.mjs`, `src/producer.mjs`, `src/consumer.mjs`, `src/dlq-inspector.mjs`, `src/event-sink.mjs`. Three wired induced-failure switches (`SIMULATE_CONSUMER_RETRY`, `SIMULATE_DLQ_OVERFLOW`, `SIMULATE_PII_IN_BODY`) drive the negative-run paths.
+- Declares `capabilities: ["queue"]`, `suggestedCompanions: [{role: "logging"}, {role: "errorHandling"}]`, `providesRoles` absent, `requiresAppliedCapabilities` absent. Composes on `deploy-cloudflare-workers` transitively via the wrangler binding (not through the capability mechanism), so `jobs-background` reads the `queue` capability at apply time via the capability-consumer mechanism from the visual round.
 - Contributes ADR-3002 as `scope: global` on new topic `deliverySemantics`. Future exactly-once, at-most-once or `messaging-queue-postgres` siblings conflict here by design.
-- Every ADR contribution entry on `blueprint.json` carries a `standardsTraceClause` per section 8a.2 (mandatory per HQ mid-flight ruling after PR #154 gate).
-- Extends `packages/rcf-lite/docs/blueprint-authoring.md` section 6a capability-declaration table with one row for `queue` naming the reserved `messaging-queue-postgres` sibling per Baz decision 7 and spec section 5.6.
+- Every ADR contribution entry on `blueprint.json` carries a `standardsTraceClause` per section 8a.2 (mandatory per the operator estate mid-flight ruling after PR #154 gate).
+- Extends `packages/rcf-lite/docs/blueprint-authoring.md` section 6a capability-declaration table with one row for `queue` naming the reserved `messaging-queue-postgres` sibling per maintainer decision and spec section 5.6.
 - The Miniflare Queues sub-page under the workers testing miniflare storage tree is NOT cited: the ratified round-5 spec's status block records it returning 404 on 2026-09-06. The Cloudflare Queues local-development page (`https://developers.cloudflare.com/queues/configuration/local-development/`) is the sole citation for the local seam.
-- Lifecycle event whitelist reuses T-2 object-storage-s3's `{event, ts, ...}` common envelope prefix (per PR #157 gate reviewer note 2026-09-06) so a future v1.1 minor can promote one shared shape to schema enforcement.
+- Lifecycle event whitelist reuses the object-storage-s3 blueprint's `{event, ts, ...}` common envelope prefix (per PR #157 gate reviewer note 2026-09-06) so a future v1.1 minor can promote one shared shape to schema enforcement.
+
+Review-fix (2026-09-09): Adds deliveredBy on REQ-003 and REQ-004. Sweeps vendorCitation onto fixed ACs resting on vendor facts (AC-29107-2, AC-29108-2).

package/blueprints/messaging-queue-cloudflare/README.md

@@ -1,6 +1,6 @@
 # messaging-queue-cloudflare
 
-A directed producer-to-consumer worklist queue on Cloudflare Queues, accessed through a producer facade that is the sole reader of the Queues binding. Cloudflare Queues is the first adapter (queue binding under wrangler config, consumer registered on the Worker `queue` handler); the reserved `messaging-queue-postgres` sibling (Baz decision 7) mints on demand. Ships publish, consume, ack, retry, and DLQ; four lifecycle events (`producerReady`, `messagePublished`, `messageAcked`, `messageDeadLettered`) with a metadata-only field discipline. Composes on `deploy-cloudflare-workers` transitively via the wrangler binding, not through the capability mechanism, so `capabilities: ["queue"]` is what `jobs-background` reads to obtain the producer facade at apply time; no `requiresAppliedCapabilities` block ships at v1.0.0.
+A directed producer-to-consumer worklist queue on Cloudflare Queues, accessed through a producer facade that is the sole reader of the Queues binding. Cloudflare Queues is the first adapter (queue binding under wrangler config, consumer registered on the Worker `queue` handler); the reserved `messaging-queue-postgres` sibling (maintainer decision) mints on demand. Ships publish, consume, ack, retry, and DLQ; four lifecycle events (`producerReady`, `messagePublished`, `messageAcked`, `messageDeadLettered`) with a metadata-only field discipline. Composes on `deploy-cloudflare-workers` transitively via the wrangler binding, not through the capability mechanism, so `capabilities: ["queue"]` is what `jobs-background` reads to obtain the producer facade at apply time; no `requiresAppliedCapabilities` block ships at v1.0.0.
 
 ## What this blueprint gives you
 
@@ -44,15 +44,15 @@ Queue name (or binding name in a Workers deploy); `max_retries` before DLQ (defa
 
 ## Composition and conflicts
 
-Composes on `deploy-cloudflare-workers` transitively via the wrangler binding (not through the capability mechanism), so no `requiresAppliedCapabilities` block ships at v1.0.0. Contributes ADR-3002 as `scope: global` on new topic `deliverySemantics`; a future `messaging-queue-postgres` sibling (Baz decision 7, deferred v1.0.0 pending demand) or an exactly-once / at-most-once sibling would conflict here by design. `capabilities: ["queue"]`; `providesRoles: []`.
+Composes on `deploy-cloudflare-workers` transitively via the wrangler binding (not through the capability mechanism), so no `requiresAppliedCapabilities` block ships at v1.0.0. Contributes ADR-3002 as `scope: global` on new topic `deliverySemantics`; a future `messaging-queue-postgres` sibling (maintainer decision, deferred v1.0.0 pending demand) or an exactly-once / at-most-once sibling would conflict here by design. `capabilities: ["queue"]`; `providesRoles: []`.
 
 ## Reserved sibling
 
-`messaging-queue-postgres` (Baz decision 7). Reserved slug beside the `queue` capability row in `packages/rcf-lite/docs/blueprint-authoring.md` section 6a. When demand mints it, the sibling composes on `persistence-data-postgres` as its transport and conflicts by design on `deliverySemantics` with this blueprint; the operator picks one queue backend per project via a project-level ADR.
+`messaging-queue-postgres` (maintainer decision). Reserved slug beside the `queue` capability row in `packages/rcf-lite/docs/blueprint-authoring.md` section 6a. When demand mints it, the sibling composes on `persistence-data-postgres` as its transport and conflicts by design on `deliverySemantics` with this blueprint; the operator picks one queue backend per project via a project-level ADR.
 
 ## The six probes
 
-Each probe is a Node module under `contributions/probes/` exporting the round-5 spec section 3.2 verdict envelope, with a matching `run-<probe-name>.mjs` shim that drives the probe against the shared fixture's T-3 slice and writes the per-blueprint report at `.rcf/reports/blueprints/messaging-queue-cloudflare/<probe-name>.json`.
+Each probe is a Node module under `contributions/probes/` exporting the shipped verdict envelope, with a matching `run-<probe-name>.mjs` shim that drives the probe against the shared fixture's slice and writes the per-blueprint report at `.rcf/reports/blueprints/messaging-queue-cloudflare/<probe-name>.json`.
 
 | Probe | Anchor AC | What it proves | accountBound |
 |---|---|---|---|
@@ -60,7 +60,7 @@ Each probe is a Node module under `contributions/probes/` exporting the round-5
 | `publish-to-delivery` | AC-29102-1, AC-29102-2, AC-29105-1, AC-29108-1 | 5 messages round-trip body byte-equal with stable message-ids and producer-supplied trace-ids preserved; per-message ack; wrangler-dev-equivalent seam. | false |
 | `retry-and-dlq` | AC-29103-1, AC-29104-1 | Consumer returning `retry` observes same stable message-id with attempts 1..max_retries; DLQ landing fires `messageDeadLettered` at `max_retries + 1`; DLQ contents body byte-equal via the DLQ inspector helper. | false |
 | `event-secrecy` | AC-29106-1 | Every event record carries only the whitelist (event, ts, messageId, queueName, attempts); no PII fixture text on JSON grep. | false |
-| `real-account-concurrency-smoke` | AC-29108-2 | Self-provisioning (v1.0.2): the fixture shim (`packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs`) mints a scratch Cloudflare Queue under the H-2 prefix `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`, and a throwaway consumer Worker under `h2-cf-probe-integrity-scratch-w-` bound to the queue (consumer) with `RCF_TEST_QUEUE` (shipped queue binding name) + `RCF_TEST_TELEMETRY_KV` bindings. The Worker has NO fetch surface and NO workers.dev subdomain is enabled (Dave ruling 376b4f30): the consumer is invoked BY THE QUEUE, not over HTTP. Driver publishes 500 messages in 10 concurrent 50-message batches via the Cloudflare Queues REST publish endpoint, polls the telemetry KV namespace via the KV REST list + get endpoints until drained, and asserts `totalConsumed === published` and `1 < maxConcurrent <= 250` per https://developers.cloudflare.com/queues/platform/limits/. Teardown deletes Worker, Queue and telemetry KV namespace on exit; the shim's separate `sweepOrphans` path lists over the account with full pagination (Dave ruling 4e9ff62d item 5) and deletes any prefixed residue after a mid-run crash. **The local proof exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** Without `CI_HAS_CLOUDFLARE_ACCOUNT` records `accountBoundSkipped: true`. | true |
+| `real-account-concurrency-smoke` | AC-29108-2 | Self-provisioning (v1.0.2): the fixture shim (`packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs`) mints a scratch Cloudflare Queue under the CI scratch prefix `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`, and a throwaway consumer Worker under `h2-cf-probe-integrity-scratch-w-` bound to the queue (consumer) with `RCF_TEST_QUEUE` (shipped queue binding name) + `RCF_TEST_TELEMETRY_KV` bindings. The Worker has NO fetch surface and NO workers.dev subdomain is enabled (operator ruling): the consumer is invoked BY THE QUEUE, not over HTTP. Driver publishes 500 messages in 10 concurrent 50-message batches via the Cloudflare Queues REST publish endpoint, polls the telemetry KV namespace via the KV REST list + get endpoints until drained, and asserts `totalConsumed === published` and `1 < maxConcurrent <= 250` per https://developers.cloudflare.com/queues/platform/limits/. Teardown deletes Worker, Queue and telemetry KV namespace on exit; the shim's separate `sweepOrphans` path lists over the account with full pagination (operator ruling item 5) and deletes any prefixed residue after a mid-run crash. **The local proof exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** Without `CI_HAS_CLOUDFLARE_ACCOUNT` records `accountBoundSkipped: true`. | true |
 
 ## Anatomy
 
@@ -111,7 +111,7 @@ Two live paths are unproven at v1.0.0 and are recorded per AC below so the gate
 - **AC-29105-1** (batch consume: 5 messages in one batch, per-message ack semantics under `max_batch_size = 10`): proven against the in-memory realisation of the binding shape (probe `publish-to-delivery`, verdict pass); live Queues `max_batch_size` / `max_batch_timeout` behaviour on the [[queues.consumers]] block unproven pending a reviewer `wrangler dev` run or the accountBound smoke.
 - **AC-29106-1** (metadata-only event whitelist; no PII body / header value / consumer context leaks): proven end-to-end against the in-memory realisation (probe `event-secrecy`, verdict pass; the whitelist is code-enforced in `src/event-sink.mjs`, independent of transport); live-Queues run does not change the sink code path, so this AC has no live-only gap.
 - **AC-29108-1** (wrangler-dev-equivalent seam round-trip): proven end-to-end against the in-memory realisation of the binding shape (probe `publish-to-delivery`, verdict pass); a live `wrangler dev` process was not driven in this pass. Rationale: SDR-3-a on US-29107 makes the wrangler-dev-equivalent seam the shipped local seam because Cloudflare Queues does not support consumer concurrency under `wrangler dev` and does not support `wrangler dev --remote` per the local-development doc, so a live-wrangler run adds observability (a real process on port 8787) but does not add facade-contract certainty over the in-memory realisation. The gate reviewer drives one live `wrangler dev` run in their own scratch to close the observability gap.
-- **AC-29108-2** (real-account concurrency smoke: 500 messages, consumer concurrency up to 250): as of v1.0.2 the probe SELF-PROVISIONS the throwaway Queue + consumer Worker + telemetry KV namespace under the H-2 prefixes and requires no hand-provisioned CI infrastructure (`w-2026-09-08-dave-017`). Declared env for a live run: `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN`. Without `CI_HAS_CLOUDFLARE_ACCOUNT` the probe records `accountBoundSkipped: true` per spec section 3.5 and the per-blueprint report carries `aggregateVerdict: pass` on the skipped shape. **The local proof harness under `packages/rcf-lite/test/fixtures/cf-platform/test/` is a mock of Cloudflare's REST contract, not the wire; the local runs exercise OUR lifecycle logic against that mock, and the real-account gate is the only surface that proves the wire format.**
+- **AC-29108-2** (real-account concurrency smoke: 500 messages, consumer concurrency up to 250): as of v1.0.2 the probe SELF-PROVISIONS the throwaway Queue + consumer Worker + telemetry KV namespace under the CI scratch prefixes and requires no hand-provisioned CI infrastructure . Declared env for a live run: `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN`. Without `CI_HAS_CLOUDFLARE_ACCOUNT` the probe records `accountBoundSkipped: true` per spec section 3.5 and the per-blueprint report carries `aggregateVerdict: pass` on the skipped shape. **The local proof harness under `packages/rcf-lite/test/fixtures/cf-platform/test/` is a mock of Cloudflare's REST contract, not the wire; the local runs exercise OUR lifecycle logic against that mock, and the real-account gate is the only surface that proves the wire format.**
 
 ## Other limitations (not mechanism-reach gaps)
 

package/blueprints/messaging-queue-cloudflare/blueprint.json

@@ -1,8 +1,10 @@
 {
   "slug": "messaging-queue-cloudflare",
-  "version": "1.0.2",
+  "version": "1.1.2",
   "category": "messaging",
-  "capabilities": ["queue"],
+  "capabilities": [
+    "queue"
+  ],
   "suggestedCompanions": [
     {
       "role": "logging",
@@ -14,23 +16,91 @@
     }
   ],
   "contributions": [
-    { "id": "messaging-queue-cloudflare-REQ-001", "kind": "req", "path": "requirements/messaging-queue-cloudflare-req-001.json" },
-    { "id": "messaging-queue-cloudflare-REQ-002", "kind": "req", "path": "requirements/messaging-queue-cloudflare-req-002.json" },
-    { "id": "messaging-queue-cloudflare-REQ-003", "kind": "req", "path": "requirements/messaging-queue-cloudflare-req-003.json" },
-    { "id": "messaging-queue-cloudflare-REQ-004", "kind": "req", "path": "requirements/messaging-queue-cloudflare-req-004.json" },
-    { "id": "messaging-queue-cloudflare-REQ-005", "kind": "req", "path": "requirements/messaging-queue-cloudflare-req-005.json" },
-    { "id": "messaging-queue-cloudflare-REQ-006", "kind": "req", "path": "requirements/messaging-queue-cloudflare-req-006.json" },
-    { "id": "messaging-queue-cloudflare-US-29101", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29101.json" },
-    { "id": "messaging-queue-cloudflare-US-29102", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29102.json" },
-    { "id": "messaging-queue-cloudflare-US-29103", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29103.json" },
-    { "id": "messaging-queue-cloudflare-US-29104", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29104.json" },
-    { "id": "messaging-queue-cloudflare-US-29105", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29105.json" },
-    { "id": "messaging-queue-cloudflare-US-29106", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29106.json" },
-    { "id": "messaging-queue-cloudflare-US-29107", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29107.json" },
-    { "id": "messaging-queue-cloudflare-US-29108", "kind": "us", "path": "user-stories/messaging-queue-cloudflare-us-29108.json" },
-    { "id": "TAC-3001-messaging-queue-cloudflare-producer-facade", "kind": "tac", "path": "tacs/tac-3001-messaging-queue-cloudflare-producer-facade.json" },
-    { "id": "TAC-3002-messaging-queue-cloudflare-consumer-registration", "kind": "tac", "path": "tacs/tac-3002-messaging-queue-cloudflare-consumer-registration.json" },
-    { "id": "TAC-3003-messaging-queue-cloudflare-event-sink", "kind": "tac", "path": "tacs/tac-3003-messaging-queue-cloudflare-event-sink.json" },
+    {
+      "id": "messaging-queue-cloudflare-REQ-001",
+      "kind": "req",
+      "path": "requirements/messaging-queue-cloudflare-req-001.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-REQ-002",
+      "kind": "req",
+      "path": "requirements/messaging-queue-cloudflare-req-002.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-REQ-003",
+      "kind": "req",
+      "path": "requirements/messaging-queue-cloudflare-req-003.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-REQ-004",
+      "kind": "req",
+      "path": "requirements/messaging-queue-cloudflare-req-004.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-REQ-005",
+      "kind": "req",
+      "path": "requirements/messaging-queue-cloudflare-req-005.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-REQ-006",
+      "kind": "req",
+      "path": "requirements/messaging-queue-cloudflare-req-006.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29101",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29101.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29102",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29102.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29103",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29103.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29104",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29104.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29105",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29105.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29106",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29106.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29107",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29107.json"
+    },
+    {
+      "id": "messaging-queue-cloudflare-US-29108",
+      "kind": "us",
+      "path": "user-stories/messaging-queue-cloudflare-us-29108.json"
+    },
+    {
+      "id": "TAC-3001-messaging-queue-cloudflare-producer-facade",
+      "kind": "tac",
+      "path": "tacs/tac-3001-messaging-queue-cloudflare-producer-facade.json"
+    },
+    {
+      "id": "TAC-3002-messaging-queue-cloudflare-consumer-registration",
+      "kind": "tac",
+      "path": "tacs/tac-3002-messaging-queue-cloudflare-consumer-registration.json"
+    },
+    {
+      "id": "TAC-3003-messaging-queue-cloudflare-event-sink",
+      "kind": "tac",
+      "path": "tacs/tac-3003-messaging-queue-cloudflare-event-sink.json"
+    },
     {
       "id": "ADR-3001-messaging-queue-cloudflare-adapter",
       "kind": "adr",
@@ -63,5 +133,43 @@
       "elicited": true,
       "standardsTraceClause": "Cloudflare Queues per-consumer batch settings"
     }
+  ],
+  "elicits": [
+    {
+      "id": "queue-binding-name",
+      "prompt": "The Queues binding name declared under wrangler.toml [[queues.producers]] and [[queues.consumers]]. The producer facade reads env under this name at boot.",
+      "kind": "string",
+      "default": "RCF_TEST_QUEUE"
+    },
+    {
+      "id": "queue-name",
+      "prompt": "The Cloudflare Queues queue name the binding resolves to. The applied project asserts a real account queue at apply.",
+      "kind": "string",
+      "default": "app-queue"
+    },
+    {
+      "id": "max-attempts",
+      "prompt": "Max delivery attempts per ADR-3003 before a message crosses into the DLQ. Default 3 per the Cloudflare Queues documented default; floor 1; ceiling 100 per the Queues platform-limits page.",
+      "kind": "string",
+      "default": "3"
+    },
+    {
+      "id": "dead-letter-queue",
+      "prompt": "Dead-letter queue name attached under [[queues.consumers]].dead_letter_queue for the consumer. A dead-lettered message is stamped messageDeadLettered on the lifecycle sink; retention is 4 days per ADR-3003.",
+      "kind": "string",
+      "default": "app-queue-dlq"
+    },
+    {
+      "id": "batch-size",
+      "prompt": "max_batch_size for the consumer. Default 10 per ADR-3004; bounded above by 100 per the Cloudflare Queues platform-limits page.",
+      "kind": "string",
+      "default": "10"
+    },
+    {
+      "id": "batch-timeout-seconds",
+      "prompt": "max_batch_timeout seconds for the consumer. Default 5 per ADR-3004; bounded above by 60 per the Cloudflare Queues platform-limits page.",
+      "kind": "string",
+      "default": "5"
+    }
   ]
 }

package/blueprints/messaging-queue-cloudflare/contributions/adrs/adr-3001-messaging-queue-cloudflare-adapter.json

@@ -5,9 +5,9 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Adapter: Cloudflare Queues as the shipped v1.0.0 first adapter",
-  "context": "A project deploying a directed producer-to-consumer worklist queue on Cloudflare Workers has one native shipped answer today: Cloudflare Queues. The Queues surface is bound through wrangler configuration (a [[queues.producers]] block for the producer facade to publish through, a [[queues.consumers]] block for the Worker queue handler to consume from), and the shipped Worker runtime binds env.<binding> to a Queues object with send / sendBatch on the producer side and a batch envelope with ack / retry on the consumer side per https://developers.cloudflare.com/queues/configuration/javascript-apis/. The v1.0.0 facade must hold the adapter reference opaque at the facade boundary so a future non-Cloudflare adapter (an SQS shim, the reserved messaging-queue-postgres sibling per Baz decision 7) slots in without a facade re-shape, and so a fixture-time in-memory adapter is testable without live Cloudflare Queues access.",
+  "context": "A project deploying a directed producer-to-consumer worklist queue on Cloudflare Workers has one native shipped answer today: Cloudflare Queues. The Queues surface is bound through wrangler configuration (a [[queues.producers]] block for the producer facade to publish through, a [[queues.consumers]] block for the Worker queue handler to consume from), and the shipped Worker runtime binds env.<binding> to a Queues object with send / sendBatch on the producer side and a batch envelope with ack / retry on the consumer side per https://developers.cloudflare.com/queues/configuration/javascript-apis/. The v1.0.0 facade must hold the adapter reference opaque at the facade boundary so a future non-Cloudflare adapter (an SQS shim, the reserved messaging-queue-postgres sibling per maintainer decision) slots in without a facade re-shape, and so a fixture-time in-memory adapter is testable without live Cloudflare Queues access.",
   "decision": "The shipped v1.0.0 default is Cloudflare Queues, wired through wrangler config (producer binding on [[queues.producers]], consumer on [[queues.consumers]] with dead_letter_queue and max_retries per https://developers.cloudflare.com/queues/configuration/dead-letter-queues/). The producer facade module is the sole holder of the Queues binding reference per REQ-001; the consumer registration module is the sole reader of the batch envelope per REQ-002. The adapter reference is OPAQUE at this ADR: the facade dereferences the elicited binding at the top of the module and any consumer wanting a different adapter (an SQS shim, the messaging-queue-postgres sibling minted on demand) replaces the binding reference here without touching the outward interface. A fixture-time in-memory adapter (used by the local probes) implements the same binding shape (send / sendBatch on the producer side, batch with ack / retry on the consumer side) so the facade and consumer surfaces are indistinguishable from the real Queues binding at the facade boundary. The 128 KB per-message cap and 100 messages per batch cap Cloudflare documents at https://developers.cloudflare.com/queues/platform/limits/ apply to every real-Queues run.",
-  "consequences": "The project inherits the Cloudflare Queues wire-format, the platform-assigned stable message-id, and the batch envelope's per-message ack semantics. Standards trace clause: Cloudflare Queues documented per-message and per-batch limits (per https://developers.cloudflare.com/queues/platform/limits/), Cloudflare Queues Worker queue-handler contract (per https://developers.cloudflare.com/queues/configuration/javascript-apis/), and Cloudflare Queues dead-letter documentation (per https://developers.cloudflare.com/queues/configuration/dead-letter-queues/). A future non-Cloudflare adapter mints under a sibling blueprint (reserved slug messaging-queue-postgres, Baz decision 7) and conflicts by design on deliverySemantics (ADR-3002) with this blueprint; the operator picks one queue backend per project via a project-level ADR.",
+  "consequences": "The project inherits the Cloudflare Queues wire-format, the platform-assigned stable message-id, and the batch envelope's per-message ack semantics. Standards trace clause: Cloudflare Queues documented per-message and per-batch limits (per https://developers.cloudflare.com/queues/platform/limits/), Cloudflare Queues Worker queue-handler contract (per https://developers.cloudflare.com/queues/configuration/javascript-apis/), and Cloudflare Queues dead-letter documentation (per https://developers.cloudflare.com/queues/configuration/dead-letter-queues/). A future non-Cloudflare adapter mints under a sibling blueprint (reserved slug messaging-queue-postgres, maintainer decision) and conflicts by design on deliverySemantics (ADR-3002) with this blueprint; the operator picks one queue backend per project via a project-level ADR.",
   "alternativesConsidered": [
     {
       "name": "External SQS or SNS as the shipped v1.0.0 default",
@@ -17,7 +17,7 @@
     {
       "name": "Kafka or NATS as the shipped v1.0.0 default",
       "summary": "Ship a self-hosted Kafka or NATS backend as the primary v1.0.0 queue.",
-      "reasonNotChosen": "A self-hosted Kafka or NATS backend adds a persistent operational surface every applying project has to run; the round-5 spec section 5.3 targets a directed producer-to-consumer worklist as a shipped shape whose applying project need not host a broker. The reserved messaging-queue-postgres sibling (Baz decision 7) covers the self-hosted-transport family separately when demand mints it."
+      "reasonNotChosen": "A self-hosted Kafka or NATS backend adds a persistent operational surface every applying project has to run; the round-5 spec section 5.3 targets a directed producer-to-consumer worklist as a shipped shape whose applying project need not host a broker. The reserved messaging-queue-postgres sibling (maintainer decision) covers the self-hosted-transport family separately when demand mints it."
     },
     {
       "name": "Ship a hand-rolled fetch client against the Queues REST API",

package/blueprints/messaging-queue-cloudflare/contributions/adrs/adr-3002-messaging-queue-cloudflare-delivery-semantics.json

@@ -7,7 +7,7 @@
   "title": "Delivery semantics: at-least-once as the shipped shape (scope global, new topic deliverySemantics)",
   "context": "A directed producer-to-consumer worklist ships one of three delivery shapes at the transport contract: at-most-once (fire and forget, dedup at the producer), at-least-once (guaranteed delivery with duplicates possible, dedup at the consumer), or exactly-once (guaranteed delivery with dedup at the transport, expensive). Cloudflare Queues implements at-least-once with a stable message-id the consumer uses for its own dedup; the WSD-005 messaging standard (operator/knowledge/wsd/wsd-standards/wsd-005-messaging.md) makes at-least-once and out-of-order tolerance the shipped default for domain event handoffs; the messaging-queue-cloudflare blueprint claims the deliverySemantics topic on the shelf so future exactly-once or at-most-once siblings surface as DELIBERATE conflicts and not silent divergences.",
   "decision": "The shipped v1.0.0 shape is at-least-once. Every publish reaches every consumer at least once; duplicates are possible under retry-and-DLQ redelivery paths; consumer code that needs exactly-once semantics maintains its own dedup keyed on the stable message-id per REQ-002. The deliverySemantics topic scope is global on this blueprint; the topic string is deliverySemantics (lower camel case, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Future exactly-once or at-most-once siblings would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR per the round-2 conflict pattern.",
-  "consequences": "The applying project inherits an at-least-once transport with a stable message-id it uses for consumer-side dedup when the domain calls for exactly-once processing. Standards trace clause: WSD-005 clauses on at-least-once and out-of-order tolerance (satisfied by the message-id and trace-id header contract). The reserved messaging-queue-postgres sibling (Baz decision 7) will claim deliverySemantics with an at-least-once answer too; two shipped answers on one topic surface a DELIBERATE conflict the operator resolves by picking one queue backend per project via a project-level ADR (the same shape as errorEnvelope and authModel conflicts the SPA and API-REST blueprints already carry).",
+  "consequences": "The applying project inherits an at-least-once transport with a stable message-id it uses for consumer-side dedup when the domain calls for exactly-once processing. Standards trace clause: WSD-005 clauses on at-least-once and out-of-order tolerance (satisfied by the message-id and trace-id header contract). The reserved messaging-queue-postgres sibling (maintainer decision) will claim deliverySemantics with an at-least-once answer too; two shipped answers on one topic surface a DELIBERATE conflict the operator resolves by picking one queue backend per project via a project-level ADR (the same shape as errorEnvelope and authModel conflicts the SPA and API-REST blueprints already carry).",
   "alternativesConsidered": [
     {
       "name": "At-most-once as the shipped v1.0.0 default",

package/blueprints/messaging-queue-cloudflare/contributions/probes/real-account-concurrency-smoke.mjs

@@ -10,7 +10,7 @@
  * and a throwaway consumer Worker under `h2-cf-probe-integrity-
  * scratch-w-` bound to the queue (consumer) with RCF_TEST_QUEUE
  * (shipped queue producer binding name) + RCF_TEST_TELEMETRY_KV
- * bindings. NO workers.dev subdomain is enabled (Dave ruling
+ * bindings. NO workers.dev subdomain is enabled (operator ruling
  * 376b4f30): the consumer is invoked BY THE QUEUE, not over HTTP.
  *
  * Driver:
@@ -30,10 +30,10 @@
  * Local proof is a mock of Cloudflare's REST contract, not the wire.
  * The local run exercises OUR lifecycle logic against a mock of
  * Cloudflare's contract; the real-account gate is the only surface
- * that proves the wire format (Dave ruling 376b4f30). This probe is
+ * that proves the wire format (operator ruling). This probe is
  * therefore never described as "locally verified" - the local runs
  * are our own lifecycle-logic proof; wire correctness is proven at
- * the HQ real-account gate.
+ * the operator estate real-account gate.
  *
  * Declared env (dispatch requirement 4):
  *   CI_HAS_CLOUDFLARE_ACCOUNT   required to enter the driver path.
@@ -109,7 +109,7 @@ async function readTelemetryRecords({ namespaceId }) {
 export default async function runProbe() {
   const hasAccount = process.env.CI_HAS_CLOUDFLARE_ACCOUNT === '1' || process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true';
   if (!hasAccount) {
-    return skipResult(`accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT unset; a real-account run requires CI_HAS_CLOUDFLARE_ACCOUNT=true plus CF_ACCOUNT_ID and CF_API_TOKEN. The fixture mints its own throwaway Queue + consumer Worker + telemetry KV namespace under the H-2 prefixes; publishes via the CF Queues REST publish endpoint (no workers.dev subdomain enabled); reads telemetry via the KV REST list + get endpoints. Cap under test: ${DOCUMENTED_PUSH_CAP} concurrent invocations per push-consumer per https://developers.cloudflare.com/queues/platform/limits/. Message count: ${DEFAULT_MESSAGE_COUNT}.`);
+    return skipResult(`accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT unset; a real-account run requires CI_HAS_CLOUDFLARE_ACCOUNT=true plus CF_ACCOUNT_ID and CF_API_TOKEN. The fixture mints its own throwaway Queue + consumer Worker + telemetry KV namespace under the CI scratch prefixes; publishes via the CF Queues REST publish endpoint (no workers.dev subdomain enabled); reads telemetry via the KV REST list + get endpoints. Cap under test: ${DOCUMENTED_PUSH_CAP} concurrent invocations per push-consumer per https://developers.cloudflare.com/queues/platform/limits/. Message count: ${DEFAULT_MESSAGE_COUNT}.`);
   }
   if (!process.env.CF_ACCOUNT_ID || !process.env.CF_API_TOKEN) {
     return [{

package/blueprints/messaging-queue-cloudflare/contributions/requirements/messaging-queue-cloudflare-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "messaging-queue-cloudflare-REQ-001",
   "prdId": "PRD-001",
   "title": "One producer facade module is the sole reader of the Cloudflare Queues binding and opens on boot with producerReady",
-  "description": "The application publishes to the queue through a single producer facade module in the project's source tree that is the ONLY module holding a reference to the Cloudflare Queues binding (env.RCF_TEST_QUEUE in the fixture; the elicited binding name in a real project). Every other module that publishes reads the facade and calls its typed domain verbs (publish, publishBatch); no other module dereferences the raw Queues binding. On process boot, the facade opens against the bound queue and, once ready, emits a producerReady lifecycle event carrying the queue name. The queue name (or the binding name in a Workers deploy) is elicited at apply time under the Queues binding declared in wrangler config.",
+  "description": "The application publishes to the queue through a single producer facade module in the project's source tree that is the ONLY module holding a reference to the Cloudflare Queues binding (env.RCF_TEST_QUEUE in the fixture; the elicited binding name in a real project). Every other module that publishes reads the facade and calls its typed domain verbs (publish, publishBatch); no other module dereferences the raw Queues binding. On process boot, the facade opens against the bound queue and, once ready, emits a producerReady lifecycle event carrying the queue name. The queue name (or the binding name in a Workers deploy) is elicited at apply time under the Queues binding declared in wrangler config. The queue-binding-name is elicited at apply time; the producer facade dereferences env[queue-binding-name] once at boot and holds no other reference. The queue-name is elicited at apply time under the wrangler [[queues.producers]] declaration.",
   "category": "functional",
   "domain": "messaging",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3001-messaging-queue-cloudflare-producer-facade",
+    "field": "responsibilities.producerReady"
+  }
 }

package/blueprints/messaging-queue-cloudflare/contributions/requirements/messaging-queue-cloudflare-req-002.json

@@ -2,7 +2,7 @@
   "reqId": "messaging-queue-cloudflare-REQ-002",
   "prdId": "PRD-001",
   "title": "Publish, consume and ack with stable message-id and producer-supplied trace-id",
-  "description": "The producer facade publishes messages with a stable message-id assigned by the Cloudflare Queues platform on send and a producer-supplied trace-id carried in the message headers. The consumer, registered on the Worker's queue handler, reads a batch of messages, dispatches each to the registered handler, acknowledges each per message on successful return, and returns retry when the handler throws a retryable error. The received body equals the published body byte-for-byte; the received headers include both the stable message-id and the producer-supplied trace-id. Publish is idempotent from the producer's point of view within a single facade instance (an application layer that reissues a publish for the same domain event gets a new message-id, per the at-least-once shape).",
+  "description": "The producer facade publishes messages with a stable message-id assigned by the Cloudflare Queues platform on send and a producer-supplied trace-id carried in the message headers. The consumer, registered on the Worker's queue handler, reads a batch of messages, dispatches each to the registered handler, acknowledges each per message on successful return, and returns retry when the handler throws a retryable error. The received body equals the published body byte-for-byte; the received headers include both the stable message-id and the producer-supplied trace-id. Publish is at-least-once (never idempotent; ADR-3002 records the ratified delivery semantics) from the producer's point of view within a single facade instance (an application layer that reissues a publish for the same domain event gets a new message-id, per the at-least-once shape).",
   "category": "functional",
   "domain": "messaging",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-3002-messaging-queue-cloudflare-delivery-semantics",
+    "field": "decision.at-least-once"
+  }
 }

package/blueprints/messaging-queue-cloudflare/contributions/requirements/messaging-queue-cloudflare-req-003.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3002-messaging-queue-cloudflare-consumer-registration",
+    "field": "responsibilities.retryClassification"
+  }
 }

package/blueprints/messaging-queue-cloudflare/contributions/requirements/messaging-queue-cloudflare-req-004.json

@@ -2,7 +2,7 @@
   "reqId": "messaging-queue-cloudflare-REQ-004",
   "prdId": "PRD-001",
   "title": "Dead-letter contract: elicited max-attempts default 3, DLQ retention 4 days, dead_letter_queue field on the consumer",
-  "description": "After the elicited max-attempts (default 3 per the Cloudflare Queues documented default) is reached on a message, the message lands on the configured dead-letter queue (DLQ) and the facade fires messageDeadLettered on the sink with the stable message-id, the queue name, and the terminal attempt count. The DLQ is declared per-consumer in wrangler config through the dead_letter_queue field (per https://developers.cloudflare.com/queues/configuration/dead-letter-queues/); the field syntax in wrangler.toml is dead_letter_queue = \"<dlq-queue-name>\" alongside max_retries on the [[queues.consumers]] block. The DLQ retention defaults to 4 days when no active consumer is attached per the same Cloudflare DLQ documentation. Consumer code can attach a DLQ consumer to drain the DLQ (via wrangler queues consumer add) for inspection or replay per the same Cloudflare DLQ documentation.",
+  "description": "After the elicited max-attempts (default 3 per the Cloudflare Queues documented default) is reached on a message, the message lands on the configured dead-letter queue (DLQ) and the facade fires messageDeadLettered on the sink with the stable message-id, the queue name, and the terminal attempt count. The DLQ is declared per-consumer in wrangler config through the dead_letter_queue field (per https://developers.cloudflare.com/queues/configuration/dead-letter-queues/); the field syntax in wrangler.toml is dead_letter_queue = \"<dlq-queue-name>\" alongside maxDeliveries mapped to the vendor max_retries field per TAC-3002 as (maxDeliveries - 1) so max_retries=2 delivers three times before DLQ on the [[queues.consumers]] block. The DLQ retention defaults to 4 days when no active consumer is attached per the same Cloudflare DLQ documentation. Consumer code can attach a DLQ consumer to drain the DLQ (via wrangler queues consumer add) for inspection or replay per the same Cloudflare DLQ documentation.",
   "category": "functional",
   "domain": "messaging",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-3003-messaging-queue-cloudflare-max-attempts-floor",
+    "field": "decision.maxAttemptsCeiling"
+  }
 }

package/blueprints/messaging-queue-cloudflare/contributions/requirements/messaging-queue-cloudflare-req-005.json

@@ -2,7 +2,7 @@
   "reqId": "messaging-queue-cloudflare-REQ-005",
   "prdId": "PRD-001",
   "title": "Batch consume: elicited batch size default 10 max 100, batch timeout default 5 seconds max 60 seconds",
-  "description": "The consumer reads messages in batches whose size is elicited (default 10, bounded above by the Cloudflare max 100 messages per batch per https://developers.cloudflare.com/queues/platform/limits/) and whose batch-timeout (batch wait) is elicited (default 5 seconds, bounded above by the Cloudflare max 60 seconds per the same limits doc). Batch settings live on the [[queues.consumers]] block in wrangler config as max_batch_size and max_batch_timeout. When the batch is full or the timeout fires, the Worker's queue handler receives the whole batch in one invocation; the facade dispatches per-message to the registered handler and acknowledges per-message. A batch member returning retry does not roll the whole batch back; only that message is redelivered.",
+  "description": "The consumer reads messages in batches whose size is elicited (default 10, bounded above by the Cloudflare max 100 messages per batch per https://developers.cloudflare.com/queues/platform/limits/) and whose batch-timeout (batch wait) is elicited (default 5 seconds, bounded above by the Cloudflare max 60 seconds per the same limits doc). Batch settings live on the [[queues.consumers]] block in wrangler config as max_batch_size and max_batch_timeout. When the batch is full or the timeout fires, the Worker's queue handler receives the whole batch in one invocation; the facade dispatches per-message to the registered handler and acknowledges per-message. A batch member returning retry does not roll the whole batch back; only that message is redelivered. The batch-size is elicited at apply time (default 10, ceiling 100 per the Cloudflare Queues platform-limits page). The batch-timeout-seconds is elicited at apply time (default 5, ceiling 60 per the same limits doc).",
   "category": "functional",
   "domain": "messaging",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3002-messaging-queue-cloudflare-consumer-registration",
+    "field": "responsibilities.createConsumer"
+  }
 }

package/blueprints/messaging-queue-cloudflare/contributions/requirements/messaging-queue-cloudflare-req-006.json

@@ -2,7 +2,7 @@
   "reqId": "messaging-queue-cloudflare-REQ-006",
   "prdId": "PRD-001",
   "title": "Lifecycle events with metadata-only fields: producerReady, messagePublished, messageAcked, messageDeadLettered",
-  "description": "The facade fires four lifecycle events on the injected event sink: producerReady (once per facade instance, on the first successful ready-check), messagePublished (once per successful publish), messageAcked (once per successful ack), messageDeadLettered (once per DLQ landing). Every event record carries a metadata-only field whitelist: messageId, queueName, attempts (integer, 0 for producerReady and messagePublished), timestamp (ISO 8601 UTC). No event record contains the message body, any header value, any consumer-context field, or any producer-context field. The whitelist is enforced in code (the sink adapter refuses forbidden fields); a call site that hands a body-bearing payload to the sink is refused at author-side review.",
+  "description": "The facade fires four lifecycle events on the injected event sink: producerReady (once per facade instance, on the first successful ready-check), messagePublished (once per successful publish), messageAcked (once per successful ack), messageDeadLettered (once per DLQ landing). Every event record carries a metadata-only field whitelist: messageId, queueName, attempts (integer, 0 for producerReady and messagePublished), ts (ISO 8601 UTC). No event record contains the message body, any header value, any consumer-context field, or any producer-context field. The whitelist is enforced in code (the sink adapter refuses forbidden fields); a call site that hands a body-bearing payload to the sink is refused at author-side review.",
   "category": "functional",
   "domain": "messaging",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-3003-messaging-queue-cloudflare-event-sink",
+    "field": "responsibilities.producerReady"
+  }
 }

package/blueprints/messaging-queue-cloudflare/contributions/user-stories/messaging-queue-cloudflare-us-29101.json

@@ -16,7 +16,8 @@
       "when": "the process boots and the facade ready-check returns",
       "then": "a producerReady event fires on the injected event sink with a payload containing queueName; the facade exposes named domain verbs (publish, publishBatch) and does not re-export the raw Queues binding",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-29101-2",
@@ -25,10 +26,27 @@
       "when": "grep for a Queues binding dereference walks the tree outside the facade directory",
       "then": "no match is found outside the facade directory; the facade's public surface exports named domain verbs only, no raw binding reference",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-29101-3",
+      "description": "Binding missing at boot. Given the elicited queue-binding-name resolves to no binding on env (the wrangler.toml [[queues.producers]] block is absent, or the binding name is mistyped), when the producer facade opens on boot, then the facade refuses with a named error kind (missingQueueBinding); no producerReady fires on the sink.",
+      "given": "env[queue-binding-name] is undefined",
+      "when": "the producer facade opens on boot",
+      "then": "the facade refuses with missingQueueBinding; no producerReady fires",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3001-messaging-queue-cloudflare-producer-facade",
+        "field": "interfaces.createProducer"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-3001-messaging-queue-cloudflare-producer-facade"],
+  "tacIds": [
+    "TAC-3001-messaging-queue-cloudflare-producer-facade"
+  ],
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }