rcf-lite 0.26.0 → 0.27.0

package/blueprints/messaging-queue-cloudflare/contributions/user-stories/messaging-queue-cloudflare-us-29102.json

@@ -16,7 +16,8 @@
       "when": "the consumer processes the queue batch",
       "then": "all 5 messages are received with body byte-equal, message-id present and stable per message across the delivery, and the producer-supplied trace-id present on the message headers",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-29102-2",
@@ -25,10 +26,28 @@
       "when": "the consumer returns success",
       "then": "a messageAcked event fires with messageId and queueName; the message is not redelivered",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-29102-3",
+      "description": "Publish upstream refusal surfaces. Given the Cloudflare Queues API returns a non-2xx response to a publish call (throttled 429, or 5xx), when the producer's publish verb runs, then the facade catches the failure and emits publishFailed on the event sink carrying { queueName, tracelId, httpStatus, retryable: boolean }, the caller receives the error, and no messageAcked fires downstream for that trace-id.",
+      "given": "the Queues API returns non-2xx on publish",
+      "when": "the publish verb runs",
+      "then": "publishFailed fires with {queueName, traceId, httpStatus, retryable}; the caller receives the error; no messageAcked fires downstream",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3001-messaging-queue-cloudflare-producer-facade",
+        "field": "interfaces.producer.verbs"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-3001-messaging-queue-cloudflare-producer-facade", "TAC-3002-messaging-queue-cloudflare-consumer-registration"],
+  "tacIds": [
+    "TAC-3001-messaging-queue-cloudflare-producer-facade",
+    "TAC-3002-messaging-queue-cloudflare-consumer-registration"
+  ],
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/messaging-queue-cloudflare/contributions/user-stories/messaging-queue-cloudflare-us-29103.json

@@ -16,10 +16,27 @@
       "when": "the consumer is invoked across successive deliveries",
       "then": "the message-id is stable across attempts 1 to 3; the attempt counter increments on each delivery; body, headers and producer-supplied trace-id remain byte-equal across attempts",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-29103-2",
+      "description": "Attempt counter monotonic across N retries. Given a consumer that returns retry on every delivery, when the queue redelivers up to maxDeliveries, then each delivery carries an attempt count strictly greater than the previous (1, 2, 3, ...), and the counter does not reset mid-cycle; a mutation SIMULATE_ATTEMPT_RESET=true swaps two attempt values and the assertion FAILS.",
+      "given": "a consumer that returns retry on every delivery",
+      "when": "the queue redelivers up to maxDeliveries",
+      "then": "each delivery carries a strictly greater attempt count; the reset mutation FAILS",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3002-messaging-queue-cloudflare-consumer-registration",
+        "field": "interfaces.createConsumer"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-3002-messaging-queue-cloudflare-consumer-registration"],
+  "tacIds": [
+    "TAC-3002-messaging-queue-cloudflare-consumer-registration"
+  ],
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/messaging-queue-cloudflare/contributions/user-stories/messaging-queue-cloudflare-us-29104.json

@@ -11,15 +11,37 @@
   "acceptanceCriteria": [
     {
       "id": "AC-29104-1",
-      "description": "Given a message that returns retry across max_retries deliveries (default 3), when the third delivery returns retry, then a messageDeadLettered event fires on the sink with the stable message-id, the queue name, and attempts equal to the terminal attempt count. The message is present on the DLQ; inspecting the DLQ through the fixture DLQ-inspector helper returns the body byte-equal to the original publish.",
-      "given": "the fixture with max_retries 3 and SIMULATE_CONSUMER_RETRY=true published once",
-      "when": "the delivery loop runs to exhaustion",
-      "then": "the retry-and-dlq probe records attempts 1, 2, 3 with the same message-id; messageDeadLettered fires with attempts equal to the terminal count; the DLQ-inspector reads the message body back byte-equal",
+      "description": "Given the consumer registered under maxDeliveries=3 (mapped to max_retries=2 on wrangler consumers per TAC-3002), when a handler refuses on delivery 1 and delivery 2 and delivery 3, then delivery 3's refusal routes the message into the DLQ (dead_letter_queue field), messageDeadLettered fires with { queueName, messageId, deliveries: 3, deadLetterQueue }, and no fourth delivery is attempted against the primary consumer. A boundary case at maxDeliveries=1 asserts the message crosses to DLQ on the first refusal.",
+      "given": "consumer registered under maxDeliveries=3 (max_retries=2)",
+      "when": "the handler refuses on deliveries 1, 2 and 3",
+      "then": "delivery 3's refusal dead-letters the message; messageDeadLettered fires with { queueName, messageId, deliveries: 3, deadLetterQueue }; no fourth primary delivery",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3002-messaging-queue-cloudflare-consumer-registration",
+        "field": "interfaces.createConsumer"
+      }
+    },
+    {
+      "id": "AC-29104-2",
+      "description": "Boundary at maxDeliveries=1. Given the consumer registered under maxDeliveries=1 (max_retries=0), when a handler refuses on delivery 1, then delivery 1's refusal routes the message into the DLQ immediately; messageDeadLettered fires with { queueName, messageId, deliveries: 1, deadLetterQueue }; no second primary delivery is attempted.",
+      "given": "consumer registered under maxDeliveries=1 (max_retries=0)",
+      "when": "the handler refuses on delivery 1",
+      "then": "the message crosses to DLQ on the first refusal; messageDeadLettered fires with deliveries=1; no second delivery",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3002-messaging-queue-cloudflare-consumer-registration",
+        "field": "interfaces.createConsumer"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-3002-messaging-queue-cloudflare-consumer-registration", "TAC-3003-messaging-queue-cloudflare-event-sink"],
+  "tacIds": [
+    "TAC-3002-messaging-queue-cloudflare-consumer-registration",
+    "TAC-3003-messaging-queue-cloudflare-event-sink"
+  ],
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/messaging-queue-cloudflare/contributions/user-stories/messaging-queue-cloudflare-us-29105.json

@@ -16,10 +16,27 @@
       "when": "the publish-to-delivery probe publishes 5 messages",
       "then": "the consumer receives them in one batch; per-message ack fires 5 times; the messageAcked events on the sink number 5",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-29105-2",
+      "description": "Batch-size ceiling refused at load. Given the elicited batch-size answered above the Cloudflare limit of 100, when the loader validates the elicited answer, then the loader refuses with a named error kind (batchSizeAboveCeiling) and the ship gate FAILS; a mutation SIMULATE_BATCH_LIMIT_BREACH=true forces a 150 value into the applied sidecar and the same refusal fires downstream.",
+      "given": "batch-size answered above 100",
+      "when": "the loader validates the elicited answer",
+      "then": "the loader refuses with batchSizeAboveCeiling; the ship gate FAILS; the mutation surfaces the same refusal downstream",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3002-messaging-queue-cloudflare-consumer-registration",
+        "field": "interfaces.createConsumer"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-3002-messaging-queue-cloudflare-consumer-registration"],
+  "tacIds": [
+    "TAC-3002-messaging-queue-cloudflare-consumer-registration"
+  ],
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/messaging-queue-cloudflare/contributions/user-stories/messaging-queue-cloudflare-us-29106.json

@@ -11,15 +11,36 @@
   "acceptanceCriteria": [
     {
       "id": "AC-29106-1",
-      "description": "Given the SIMULATE_PII_IN_BODY=true induced-failure switch driving publish and ack with a PII fixture body (userId 1234, ssn 123-45-6789), when the event-secrecy probe captures the events, then every event record carries exactly the whitelist fields (event, messageId, queueName, attempts, timestamp) and no more; no body bytes, no header value, no userId string, no ssn string, no consumer-context field appears in any record, verified by JSON-stringify substring grep.",
+      "description": "Given the SIMULATE_PII_IN_BODY=true induced-failure switch driving publish and ack with a PII fixture body (userId 1234, ssn 123-45-6789), when the event-secrecy probe captures the events, then every event record carries exactly the whitelist fields (event, messageId, queueName, attempts, ts (number of milliseconds since epoch)) and no more; no body bytes, no header value, no userId string, no ssn string, no consumer-context field appears in any record, verified by JSON-stringify substring grep.",
       "given": "the PII fixture body driven through publish, consume and ack",
       "when": "the event-secrecy probe reads the captured event records",
       "then": "every record carries only the whitelist; JSON-stringify substring grep for the fixture PII strings returns no match on any record",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3003-messaging-queue-cloudflare-event-sink",
+        "field": "interfaces.createSinkAdapter"
+      }
+    },
+    {
+      "id": "AC-29106-2",
+      "description": "Secret exclusion by grep-across-source. Given the producer facade source, the consumer registration source, and the event sink source, when a source-tree scan searches every onEvent call site for header values, message body bytes, and any elicited binding name substring, then no match is found; a mutation SIMULATE_HEADER_VALUE_IN_EVENT=true injects a header value into one event record and the scan FAILS naming the leaked event id.",
+      "given": "the producer, consumer and sink source files",
+      "when": "a source-tree scan runs across every onEvent call site",
+      "then": "no header-value, body-byte, or binding-name match is found; the header-leak mutation FAILS",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3001-messaging-queue-cloudflare-producer-facade",
+        "field": "interfaces.onEvent"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-3003-messaging-queue-cloudflare-event-sink"],
+  "tacIds": [
+    "TAC-3003-messaging-queue-cloudflare-event-sink"
+  ],
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/messaging-queue-cloudflare/contributions/user-stories/messaging-queue-cloudflare-us-29107.json

@@ -16,10 +16,32 @@
       "when": "the producer-facade-ready and publish-to-delivery run-shims execute",
       "then": "each shim exits 0; the per-blueprint reports carry aggregateVerdict pass; the event records observed include producerReady with queueName and 5 messageAcked events with matching messageIds",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-29107-2",
+      "description": "wrangler dev absent surfaces cleanly. Given wrangler is not on PATH on the runner's process shell, when the wrangler-dev round-trip probe runs, then the probe skips with accountBoundSkipped: true and a non-empty reason naming the missing wrangler binary; no partial round-trip is asserted.",
+      "given": "wrangler is not on PATH",
+      "when": "the wrangler-dev round-trip probe runs",
+      "then": "the probe skips with accountBoundSkipped: true and a non-empty reason naming missing wrangler; no partial round-trip is asserted",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3001-messaging-queue-cloudflare-producer-facade",
+        "field": "interfaces.producer.verbs"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/workers/wrangler/commands/#dev",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
-  "tacIds": ["TAC-3001-messaging-queue-cloudflare-producer-facade", "TAC-3002-messaging-queue-cloudflare-consumer-registration"],
+  "tacIds": [
+    "TAC-3001-messaging-queue-cloudflare-producer-facade",
+    "TAC-3002-messaging-queue-cloudflare-consumer-registration"
+  ],
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/messaging-queue-cloudflare/contributions/user-stories/messaging-queue-cloudflare-us-29108.json

@@ -6,20 +6,42 @@
   "status": "approved",
   "title": "Real-account concurrency smoke: 500 messages processed concurrently up to the 250 cap",
   "asA": "developer verifying the facade works against a real Cloudflare account",
-  "iWant": "a smoke test that publishes 500 messages against the shared HQ queue rcf-lite-ci-queue-smoke and asserts the consumer processes them concurrently up to the documented 250-invocation cap",
+  "iWant": "a smoke test that publishes 500 messages against the shared CI queue rcf-lite-ci-queue-smoke and asserts the consumer processes them concurrently up to the documented 250-invocation cap",
   "soThat": "the shipped shape's compatibility with the real Cloudflare Queues surface is proven end-to-end at least once per release, without requiring every CI run to be account-bound",
   "acceptanceCriteria": [
     {
       "id": "AC-29108-2",
-      "description": "Given CI_HAS_CLOUDFLARE_ACCOUNT=1 and the credentials for the shared HQ queue rcf-lite-ci-queue-smoke wired via security-secrets-management, when the real-account-concurrency-smoke probe runs against the real queue, then 500 messages are published, the consumer processes them concurrently up to the 250 push-based invocation cap Cloudflare documents at https://developers.cloudflare.com/queues/platform/limits/, and the smoke drains the queue on exit. Without CI_HAS_CLOUDFLARE_ACCOUNT the probe records accountBoundSkipped true per spec section 3.5 and the per-blueprint report carries aggregateVerdict pass.",
-      "given": "the shared HQ queue rcf-lite-ci-queue-smoke on Baz's account, or the env var unset",
+      "description": "Given CI_HAS_CLOUDFLARE_ACCOUNT=1 and the credentials for the shared CI queue rcf-lite-ci-queue-smoke wired via security-secrets-management, when the real-account-concurrency-smoke probe runs against the real queue, then 500 messages are published, the consumer processes them concurrently up to the 250 push-based invocation cap Cloudflare documents at https://developers.cloudflare.com/queues/platform/limits/, and the smoke drains the queue on exit. Without CI_HAS_CLOUDFLARE_ACCOUNT the probe records accountBoundSkipped true per spec section 3.5 and the per-blueprint report carries aggregateVerdict pass.",
+      "given": "the shared CI queue rcf-lite-ci-queue-smoke on the maintainer's account, or the env var unset",
       "when": "the real-account-concurrency-smoke run-shim executes",
       "then": "with the env var set, 500 messages round-trip with observed concurrency below or equal to 250; with the env var unset, the report carries accountBoundSkipped true and aggregateVerdict pass; the shim exits 0 in both paths",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/queues/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-29108-3",
+      "description": "Concurrency cap enforced. Given 500 messages published in a burst on the real-account probe, when the consumer processes them, then at no observed moment is the concurrent in-flight count greater than the Cloudflare-documented 250 cap; a mutation SIMULATE_CONCURRENCY_BREACH=true drives the concurrency past 250 and the smoke FAILS naming the observed peak.",
+      "given": "500 messages published in a burst",
+      "when": "the consumer processes them under the real-account probe",
+      "then": "in-flight count never exceeds 250; the breach mutation FAILS naming the observed peak",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3002-messaging-queue-cloudflare-consumer-registration",
+        "field": "interfaces.createConsumer"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-3001-messaging-queue-cloudflare-producer-facade", "TAC-3002-messaging-queue-cloudflare-consumer-registration"],
+  "tacIds": [
+    "TAC-3001-messaging-queue-cloudflare-producer-facade",
+    "TAC-3002-messaging-queue-cloudflare-consumer-registration"
+  ],
   "createdAt": "2026-09-06T21:00:00.000Z",
-  "updatedAt": "2026-09-06T21:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/messaging-queue-cloudflare/docs/topics.md

@@ -64,8 +64,8 @@ ADR/TAC suffixes for this blueprint use the 3001-3099 block, continuing the shel
 
 - Reuse `deliverySemantics` exactly as spelled here when your blueprint holds an opinion on the delivery-guarantee contract for the primary worklist queue; contribute your own scope:global ADR on that string and let composition surface the pairing.
 - A future exactly-once, at-most-once, or `messaging-queue-postgres` sibling mints on demand; each claims `deliverySemantics` and conflicts by design.
-- `jobs-background` (round-5 track T-4) reads the `queue` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` to obtain the producer facade at apply time via the T-5 visual-round capability-declaration mechanism.
+- `jobs-background` (round-5 sibling on the jobs track) reads the `queue` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` to obtain the producer facade at apply time via the visual-round capability-declaration mechanism.
 
 ## Deliberate-conflict statement
 
-This blueprint's ADR-3002 on `deliverySemantics` is a first shipped answer to a topic that will conflict, by design, with future exactly-once or at-most-once siblings, and with the reserved `messaging-queue-postgres` sibling (Baz decision 7). Applying `messaging-queue-cloudflare` alongside a hypothetical `messaging-queue-postgres` raises one `globalAdrTopic` conflict the operator resolves via one of the four documented resolutions per topic (adopt one, keep the existing one, author a project-level supersede ADR, or `--resolve <topic>=project:<ADR-id>` on the add).
+This blueprint's ADR-3002 on `deliverySemantics` is a first shipped answer to a topic that will conflict, by design, with future exactly-once or at-most-once siblings, and with the reserved `messaging-queue-postgres` sibling (maintainer decision). Applying `messaging-queue-cloudflare` alongside a hypothetical `messaging-queue-postgres` raises one `globalAdrTopic` conflict the operator resolves via one of the four documented resolutions per topic (adopt one, keep the existing one, author a project-level supersede ADR, or `--resolve <topic>=project:<ADR-id>` on the add).

package/blueprints/messaging-queue-cloudflare/guide/messaging-queue-cloudflare.md

@@ -6,7 +6,7 @@ A directed producer-to-consumer worklist queue on Cloudflare Queues: publish, co
 
 Four lifecycle events fire on the injected event sink with a rigid metadata-only whitelist (`event`, `ts`, `messageId`, `queueName`, `attempts`); consumer logging cannot leak object body bytes, header values, consumer-context fields or PII from the message body. The whitelist is enforced in code by the sink adapter (`event-sink.mjs`), not just documented.
 
-The reserved sibling `messaging-queue-postgres` (Baz decision 7, deferred v1.0.0 pending demand) mints on demand and conflicts by design on `deliverySemantics` with this blueprint; the operator picks one queue backend per project via a project-level ADR.
+The reserved sibling `messaging-queue-postgres` (maintainer decision, deferred v1.0.0 pending demand) mints on demand and conflicts by design on `deliverySemantics` with this blueprint; the operator picks one queue backend per project via a project-level ADR.
 
 ## Apply this blueprint
 
@@ -39,11 +39,13 @@ const { id } = await producer.publish({ userId: '42', action: 'sendConfirmation'
 
 // publish a batch
 await producer.publishBatch([
-  { body: { seq: 1 }, headers: { 'x-trace-id': 't-1' } },
-  { body: { seq: 2 }, headers: { 'x-trace-id': 't-2' } },
+  { body: { seq: 1 }, headers: { 'x-trace-id': 'trace-order-1001' } },
+  { body: { seq: 2 }, headers: { 'x-trace-id': 'trace-order-1002' } },
 ]);
 ```
 
+The `x-trace-id` header and the publish and publishBatch verbs are owned at `TAC-3001.interfaces[2].description`; the values above are illustrative.
+
 The facade is the sole holder of the queue binding reference per REQ-001. A call site that reaches into `env.<binding>.send()` directly is refused at author-side review.
 
 ## Consumer registration shape
@@ -89,7 +91,7 @@ Miniflare (`https://developers.cloudflare.com/workers/testing/miniflare/`, fetch
 
 ## Real-account smoke section
 
-`node ../../../../blueprints/messaging-queue-cloudflare/contributions/probes/run-real-account-concurrency-smoke.mjs` is the accountBound probe. Without `CI_HAS_CLOUDFLARE_ACCOUNT` it exits 0 with `accountBoundSkipped: true` per spec section 3.5 and the per-blueprint report reads `aggregateVerdict: pass`. With `CI_HAS_CLOUDFLARE_ACCOUNT=1` plus credentials for the shared HQ queue `rcf-lite-ci-queue-smoke` (Q2 default) wired via `security-secrets-management`, a live-account run is queued as a v1.0.0 follow-up: the run itself rides `deploy-cloudflare-workers`' surface (not a Node probe module) since Cloudflare Queues does not support `wrangler dev --remote`, and the v1.0.0 probe stops short of driving deployment machinery.
+`node ../../../../blueprints/messaging-queue-cloudflare/contributions/probes/run-real-account-concurrency-smoke.mjs` is the accountBound probe. Without `CI_HAS_CLOUDFLARE_ACCOUNT` it exits 0 with `accountBoundSkipped: true` per spec section 3.5 and the per-blueprint report reads `aggregateVerdict: pass`. With `CI_HAS_CLOUDFLARE_ACCOUNT=1` plus credentials for the shared CI queue `rcf-lite-ci-queue-smoke` (Q2 default) wired via `security-secrets-management`, a live-account run is queued as a v1.0.0 follow-up: the run itself rides `deploy-cloudflare-workers`' surface (not a Node probe module) since Cloudflare Queues does not support `wrangler dev --remote`, and the v1.0.0 probe stops short of driving deployment machinery.
 
 ## Retry and DLQ discipline
 
@@ -101,7 +103,7 @@ ADR-3004 sets `max_batch_size` to 10 (ceiling 100) and `max_batch_timeout` to 5
 
 ## Composition with jobs-background
 
-`jobs-background` (round-5 track T-4) declares `requiresAppliedCapabilities: ["queue"]`; applying `jobs-background` on a project that already applied `messaging-queue-cloudflare` gets the T-4 apply-time capability check to pass with the `queue` capability discovered on the applied manifest. The T-4 blueprint enqueues jobs through the producer facade this blueprint exposes; the retry-and-DLQ trajectory is what turns transient job failures into eventual success and permanent failures into a DLQ receipt.
+`jobs-background` (round-5 sibling on the jobs track) declares `requiresAppliedCapabilities: ["queue"]`; applying `jobs-background` on a project that already applied `messaging-queue-cloudflare` gets the apply-time capability check to pass with the `queue` capability discovered on the applied manifest. The jobs-background blueprint enqueues jobs through the producer facade this blueprint exposes; the retry-and-DLQ trajectory is what turns transient job failures into eventual success and permanent failures into a DLQ receipt.
 
 ## What this blueprint does not do
 

package/blueprints/object-storage-s3/CHANGELOG.md

@@ -1,11 +1,26 @@
+# Changelog
+
+## 1.2.2 (register patch, 2026-09-10)
+
+- Register: remove residual internal editorial and provenance phrases from README and guide (closes F-1, F-2 register findings).
+
+
+## 1.2.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.2.0 - 2026-09-09
+
+Adds the elicits block (s3-endpoint-url, s3-bucket-name, s3-adapter, presigned-ttl-ceiling-seconds, multipart-threshold-bytes, hetzner-location-code) that the REQs and guide were already describing in prose. Adds a runtime clause naming the objectStorage applied capability on REQ-001. Adds deliveredBy on REQ-003, REQ-005 and REQ-006. Closes chain-contradiction specimens F-2 (REQ-006 boundary tightened: the facade factory accepts only { secretRef, resolver } and refuses a resolved { accessKeyId, secretAccessKey } object at the boundary with error kind rejectedResolvedCredentials; AC-28106-1 asserts the refusal), F-3 (REQ-005 and AC-28105-1 standardise on ts as the wall-clock milliseconds-since-epoch field name, aligning with TAC-2903), F-5 (REQ-002 gains the shipped key-shape check on the facade's public verbs; new AC-28102-3 asserts the invalidKey refusal for empty keys, leading-slash, ".." or "//" segments, and keys longer than 1024 bytes). Adds disposition to every AC.
+
 # object-storage-s3 changelog
 
 ## 1.1.0 - 2026-09-08
 
-Follow-up adapter minor bump adding the Hetzner Object Storage provider value under the shipped v1.0.0 S3-API facade contract. Landed via the hetzner-round-7-spec-2026-09-07 section 5.4 follow-up (ratified 2026-09-07T10:15Z on Baz's 09:50Z ruling "round 7 - agreee to all") as a sequential PR post round 7. Additive only: every existing v1.0.0 contribution id is byte-identical; the shipped Cloudflare R2 real-account smoke, the MinIO local emulator round-trip and the five shipped Node-only probes continue to pass byte-identical on the extended fixture. rcf-lite package version does NOT bump for this follow-up (spec section 8).
+Follow-up adapter minor bump adding the Hetzner Object Storage provider value under the shipped v1.0.0 S3-API facade contract. Landed via the hetzner-round-7-spec-2026-09-07 section 5.4 follow-up (ratified 2026-09-07T10:15Z on the project maintainer's 09:50Z ruling "round 7 - agreee to all") as a sequential PR post round 7. Additive only: every existing v1.0.0 contribution id is byte-identical; the shipped Cloudflare R2 real-account smoke, the MinIO local emulator round-trip and the five shipped Node-only probes continue to pass byte-identical on the extended fixture. rcf-lite package version does NOT bump for this follow-up (spec section 8).
 
 - 4 delta contributions on the blueprint side (25 total, up from 21): 1 REQ (`object-storage-s3-REQ-101`, endpoint-shape contract), 1 US (`object-storage-s3-US-28110` with `AC-28110-1` labelled `AC-hetznerObjectStorage-endpointRoundTrip`), 1 TAC (`TAC-2904-object-storage-s3-hetzner-endpoint-helper`, sole composer of `<bucket>.<location>.your-objectstorage.com`), 1 ADR (`ADR-2905-object-storage-s3-hetzner-object-storage-provider`, scope local, `standardsTraceClause: Hetzner Object Storage S3 compatibility documented endpoint shape`).
-- One new Node-only probe `hetzner-object-storage-round-trip.mjs` under `contributions/probes/`, `accountBound: true`, gated on `CI_HAS_HETZNER_OBJECT_STORAGE` alongside `HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID`, `HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY`, `HETZNER_OBJECT_STORAGE_BUCKET`, `HETZNER_OBJECT_STORAGE_LOCATION`; without the gate env var the probe records `accountBoundSkipped: true` per spec section 3.5. The round-5 T-2 R2 real-account smoke is unaffected and stays gated on `CI_HAS_CLOUDFLARE_ACCOUNT`.
+- One new Node-only probe `hetzner-object-storage-round-trip.mjs` under `contributions/probes/`, `accountBound: true`, gated on `CI_HAS_HETZNER_OBJECT_STORAGE` alongside `HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID`, `HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY`, `HETZNER_OBJECT_STORAGE_BUCKET`, `HETZNER_OBJECT_STORAGE_LOCATION`; without the gate env var the probe records `accountBoundSkipped: true` per spec section 3.5. The round-5 R2 real-account smoke is unaffected and stays gated on `CI_HAS_CLOUDFLARE_ACCOUNT`.
 - Extended the shared `packages/rcf-lite/test/fixtures/infra-s3-and-queue/` fixture (no second fixture directory) with `src/hetzner-endpoint.mjs` (endpoint helper plus two fixture-side mutation switches per the 2026-09-08 mutation-purity discipline: `SIMULATE_HETZNER_ENDPOINT_MISSHAPEN` drops the vendor subdomain, `SIMULATE_HETZNER_EVENT_LEAK` appends fixture-labelled credential fields to event records) and a fixture-root shim `run-hetzner-object-storage-round-trip.mjs`. The probe module reads no `SIMULATE_` variable.
 - Vendor endpoint pattern and location codes verbatim from https://docs.hetzner.com/storage/object-storage/overview (`<bucket>.<location>.your-objectstorage.com`; locations `fsn1` Falkenstein, `hel1` Helsinki, `nbg1` Nuremberg). Composition helper refuses any location outside the enum.
 - Blueprint README extended with a Hetzner Object Storage sub-section under the provider-choice section; `guide/object-storage-s3.md` extended with a Hetzner section including the when-to-reach-for guidance; shelf-wide sweep on every blueprint's `docs/topics.md` updates the object-storage-s3 row from `shipped v1.0.0` to `shipped v1.1.0` per the round-6 admin-console 1.1.0 precedent (PR #169).
@@ -13,12 +28,14 @@ Follow-up adapter minor bump adding the Hetzner Object Storage provider value un
 
 ## 1.0.0 - 2026-09-06
 
-Initial release. Contract for S3-shape object storage on any S3-compatible endpoint (Cloudflare R2 first, MinIO for local dev, AWS S3, Backblaze B2, Wasabi, self-hosted). Accessed through a store facade that is the sole reader of the S3 client (`@aws-sdk/client-s3` on Node targets or `aws4fetch` on Workers targets). Landed via the infra round 5 spec (ratified 2026-09-06) as track T-2.
+Initial release. Contract for S3-shape object storage on any S3-compatible endpoint (Cloudflare R2 first, MinIO for local dev, AWS S3, Backblaze B2, Wasabi, self-hosted). Accessed through a store facade that is the sole reader of the S3 client (`@aws-sdk/client-s3` on Node targets or `aws4fetch` on Workers targets). Landed via the infra round 5 spec (ratified 2026-09-06).
 
 - 21 contributions: 6 REQs on facade sole-reader / put-get-delete-list / presigned URL / multipart / lifecycle events / credential-pair discipline; 8 USs at 28101-28108; 3 TACs (2901 facade, 2902 multipart uploader, 2903 event sink); 4 ADRs (2901 adapter elicited between AWS SDK and aws4fetch, 2902 presigned TTL default 15 minutes floor 1 minute, 2903 multipart threshold default 8 MiB, 2904 objectStorageContract with scope global).
 - Six Node-only probes under `contributions/probes/` proven against a live MinIO container: `facade-round-trip`, `put-get-round-trip`, `presigned-url`, `multipart-upload`, `event-secrecy`, and the accountBound `r2-real-account-smoke`. The R2 smoke records `accountBoundSkipped: true` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset per spec section 3.5.
-- T-2 slice of the shared sample-app fixture at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/` boots MinIO via docker compose, exposes the facade over `@aws-sdk/client-s3`, ships a security-secrets-management shim realising the `secretRef` opaque-string contract, and hosts four wired induced-failure switches for the negative-run paths (SIMULATE_MINIO_DOWN, SIMULATE_403_ON_GET, SIMULATE_PART_UPLOAD_FAIL, SIMULATE_PRESIGN_MALFORMED).
+- The `object-storage-s3` slice of the shared sample-app fixture at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/` boots MinIO via docker compose, exposes the facade over `@aws-sdk/client-s3`, ships a security-secrets-management shim realising the `secretRef` opaque-string contract, and hosts four wired induced-failure switches for the negative-run paths (SIMULATE_MINIO_DOWN, SIMULATE_403_ON_GET, SIMULATE_PART_UPLOAD_FAIL, SIMULATE_PRESIGN_MALFORMED).
 - Declares `capabilities: ["objectStorage"]`, `suggestedCompanions: [{role: "logging"}, {role: "errorHandling"}]`, `providesRoles` absent, `requiresAppliedCapabilities` absent.
 - Contributes ADR-2904 as `scope: global` on new topic `objectStorageContract`. Future non-S3-shape siblings (`object-storage-native-gcs`, `object-storage-native-azure`, reserved slugs) conflict here by design.
-- Refuses composition when `security-secrets-management` v1.0.1+ is not applied. Declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` per the T-5 capability mechanism. `rcf define blueprint add object-storage-s3` on a bare project exits 3 with `[object-storage-s3-no-secrets]` on stderr, names the shipped predecessor, and points at the override. `--allow-no-secrets-yet` records a `notes` line on `rcf/blueprints/object-storage-s3.applied.json` for later reconciliation. Companion runner extensions (added by this PR to keep the mechanism whole): `src/blueprint/capabilities.js` `buildRefusalMessage` gains a bespoke template branch for `object-storage-s3-no-secrets` (echoes the message id as the first-line tag; other refusalMessageId values also gain a `[<id>]` tag on the first line of the generic fallback for dashboards/lint); `src/cli/blueprint.js` accepts the new `--allow-no-secrets-yet` flag; `src/blueprint/apply.js` sidecar `notes` prose derives predecessor family from the `allowSkipFlag` name (auth vs secrets-management) so the note reads sensibly for either predecessor.
-- Every ADR contribution entry on `blueprint.json` carries a `standardsTraceClause` per section 8a.2 (per HQ mid-flight ruling after PR #154 gate).
+- Refuses composition when `security-secrets-management` v1.0.1+ is not applied. Declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` per the capability mechanism. `rcf define blueprint add object-storage-s3` on a bare project exits 3 with `[object-storage-s3-no-secrets]` on stderr, names the shipped predecessor, and points at the override. `--allow-no-secrets-yet` records a `notes` line on `rcf/blueprints/object-storage-s3.applied.json` for later reconciliation. Companion runner extensions (added by this PR to keep the mechanism whole): `src/blueprint/capabilities.js` `buildRefusalMessage` gains a bespoke template branch for `object-storage-s3-no-secrets` (echoes the message id as the first-line tag; other refusalMessageId values also gain a `[<id>]` tag on the first line of the generic fallback for dashboards/lint); `src/cli/blueprint.js` accepts the new `--allow-no-secrets-yet` flag; `src/blueprint/apply.js` sidecar `notes` prose derives predecessor family from the `allowSkipFlag` name (auth vs secrets-management) so the note reads sensibly for either predecessor.
+- Every ADR contribution entry on `blueprint.json` carries a `standardsTraceClause` per section 8a.2 (per the operator estate mid-flight ruling after PR #154 gate).
+
+Review-fix (2026-09-09): Adds one option-binding AC on s3-adapter aws-sdk-client-s3 (AC-28101-4) to close section 7c on the elicits catalogue. Adds deliveredBy on REQ-002, REQ-004, REQ-101. Sweeps vendorCitation onto fixed ACs resting on vendor facts (AC-28102-1, AC-28102-2, AC-28103-1, AC-28103-2, AC-28108-1).

package/blueprints/object-storage-s3/README.md

@@ -1,6 +1,6 @@
 # object-storage-s3
 
-Object storage on the S3 API, accessed through a store facade that is the sole reader of the S3 client. Cloudflare R2 is the first adapter, MinIO is the local dev target, any S3-compatible remote (AWS S3, Backblaze B2, Wasabi, self-hosted) composes cleanly. Ships put / get / delete / list, presigned GET URLs with a bounded TTL, and multipart-upload above an elicited threshold, plus a lifecycle-event sink with a metadata-only field discipline. Refuses composition without `security-secrets-management` applied (Baz decision 6): the credential pair is a `secretRef`, never a value.
+Object storage on the S3 API, accessed through a store facade that is the sole reader of the S3 client. Cloudflare R2 is the first adapter, MinIO is the local dev target, any S3-compatible remote (AWS S3, Backblaze B2, Wasabi, self-hosted) composes cleanly. Ships put / get / delete / list, presigned GET URLs with a bounded TTL, and multipart-upload above an elicited threshold, plus a lifecycle-event sink with a metadata-only field discipline. Refuses composition without `security-secrets-management` applied: the credential pair is a `secretRef`, never a value.
 
 ## What this blueprint gives you
 
@@ -55,7 +55,7 @@ A new Node-only probe `hetzner-object-storage-round-trip.mjs` binds AC-28110-1:
 
 ## Composition and conflicts
 
-Consumes `security-secrets-management` v1.0.1+ for the credential pair. Declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` per the T-5 capability mechanism (visual round spec 5.5.1). The apply verb refuses on a project without `secretsProvider` (exit 3, stderr carries `[object-storage-s3-no-secrets]` as the first-line tag and names the required capability, the shipped predecessor, and the override flag). `--allow-no-secrets-yet` overrides for a scaffolding pass and records a `notes` line on `rcf/blueprints/object-storage-s3.applied.json` for later reconciliation. Contributes ADR-2904 as `scope: global` on new topic `objectStorageContract`; future `object-storage-native-gcs` or `object-storage-native-azure` siblings would conflict here by design. `capabilities: ["objectStorage"]`; `providesRoles: []`.
+Consumes `security-secrets-management` v1.0.1+ for the credential pair. Declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` per the capability mechanism. The apply verb refuses on a project without `secretsProvider` (exit 3, stderr carries `[object-storage-s3-no-secrets]` as the first-line tag and names the required capability, the shipped predecessor, and the override flag). `--allow-no-secrets-yet` overrides for a scaffolding pass and records a `notes` line on `rcf/blueprints/object-storage-s3.applied.json` for later reconciliation. Contributes ADR-2904 as `scope: global` on new topic `objectStorageContract`; future `object-storage-native-gcs` or `object-storage-native-azure` siblings would conflict here by design. `capabilities: ["objectStorage"]`; `providesRoles: []`.
 
 ## The six probes