rcf-lite 0.26.0 → 0.28.0

package/blueprints/jobs-background/contributions/user-stories/jobs-background-us-30102.json

@@ -2,24 +2,59 @@
   "usId": "jobs-background-US-30102",
   "prdId": "PRD-001",
   "reqId": "jobs-background-REQ-002",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
-  "title": "Job definition contract with name, handler, inputSchema, retryPolicy and timeoutMs",
+  "title": "Job module conforms to the TAC-3101 default export shape",
   "asA": "developer authoring a job in an applying project",
-  "iWant": "one shipped job-definition shape { name, handler, inputSchema, retryPolicy, timeoutMs } that the jobs runtime registers at boot on the applied queue consumer",
+  "iWant": "one shipped job-definition shape owned on TAC-3101-jobs-background-job-definition.interfaces.jobModule.default that the jobs runtime registers at boot on the applied queue consumer",
   "soThat": "every job in the project follows one uniform contract without the blueprint prescribing an input-validation library or a handler-callback style",
   "acceptanceCriteria": [
     {
       "id": "AC-30102-1",
-      "description": "The two toy job-definition modules under packages/rcf-lite/test/fixtures/infra-s3-and-queue/jobs/ (send-welcome-email.mjs and refresh-cache.mjs) each export a plain object with name (string), handler (async function), inputSchema (opaque, non-null), retryPolicy ({ maxAttempts: positive integer, backoff: one of exponential | constant | linear }), and timeoutMs (positive integer). The jobs runtime under src/jobs-runtime.mjs registers every job by name at boot and dispatches by message.name.",
-      "given": "the shared sample-app fixture with the T-4 jobs-runtime wired on top of the T-3 in-memory queue seam",
+      "description": "The two toy job-definition modules under packages/rcf-lite/test/fixtures/infra-s3-and-queue/jobs/ (send-welcome-email.mjs and refresh-cache.mjs) each export a plain object matching the shape owned on TAC-3101-jobs-background-job-definition.interfaces.jobModule.default. The jobs runtime under src/jobs-runtime.mjs registers every job by name at boot and dispatches by message.name.",
+      "given": "the shared sample-app fixture with the jobs-runtime wired on top of the in-memory queue seam",
       "when": "the fixture jobs runtime boots and reads the jobs/ directory",
-      "then": "both toy job modules load without throwing; the runtime's registry has entries keyed by name whose values carry handler, inputSchema, retryPolicy and timeoutMs; dispatch by message.name calls the matching handler",
+      "then": "both toy job modules load without throwing; the runtime's registry has entries keyed by name whose values match the shape owned on TAC-3101-jobs-background-job-definition.interfaces.jobModule.default; dispatch by message.name calls the matching handler",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3101-jobs-background-job-definition",
+        "field": "interfaces.jobModule.default"
+      }
+    },
+    {
+      "id": "AC-30102-2",
+      "description": "Malformed job-definition module refused at load. Given a job module in the elicited jobs-directory whose default export is missing one of the fields owned on TAC-3101-jobs-background-job-definition.interfaces.jobModule.default, when registerJobs walks the directory at boot, then it refuses with a named error kind (malformedJobDefinition) naming the missing field and the module path; no job registers into the runtime.",
+      "given": "a job module missing one shape field",
+      "when": "registerJobs walks the elicited jobs-directory at boot",
+      "then": "registerJobs refuses with malformedJobDefinition naming the missing field and the module path; no job registers",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3101-jobs-background-job-definition",
+        "field": "interfaces.jobModule.default"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-30102-3",
+      "description": "retryPolicy.maxAttempts above applied queue ceiling refused at load. Given a job-definition module whose retryPolicy.maxAttempts exceeds the applied queue's max-attempts ceiling (Cloudflare Queues caps at 100 per ADR-3003 in the messaging-queue-cloudflare blueprint), when the job-definition loader validates the module against the applied queue's ceiling, then the loader refuses with a named error kind (retryPolicyExceedsQueueCeiling) carrying { requested: <maxAttempts>, ceiling: <queueCap> } and the job does not register on the scheduler; no jobScheduled fires.",
+      "given": "a job-definition module with retryPolicy.maxAttempts > applied queue's ceiling",
+      "when": "the job-definition loader validates the module against the applied queue",
+      "then": "loader refuses with retryPolicyExceedsQueueCeiling carrying { requested, ceiling }; the job does not register; no jobScheduled fires",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3101-jobs-background-job-definition",
+        "field": "responsibilities.respectMaxAttemptsCeiling"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-3101-jobs-background-job-definition"],
+  "tacIds": [
+    "TAC-3101-jobs-background-job-definition"
+  ],
   "createdAt": "2026-09-06T20:30:00.000Z",
-  "updatedAt": "2026-09-06T20:30:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/jobs-background/contributions/user-stories/jobs-background-us-30103.json

@@ -16,10 +16,55 @@
       "when": "the fake clock advances one POSIX cron minute or past a scheduled delayMs",
       "then": "one message per fire lands on the applied in-memory queue with the target job.name and an ISO-8601 timestamp",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-30103-2",
+      "description": "Malformed cron string refused. Given a job definition scheduled with a cron string that does not match a POSIX cron shape (missing a field, or an out-of-range value), when the scheduler validates the schedule, then the scheduler refuses with a named error kind (malformedCronExpression) and the job does not register into the schedule; jobScheduled does not fire.",
+      "given": "a job scheduled with a malformed cron string",
+      "when": "the scheduler validates",
+      "then": "the scheduler refuses with malformedCronExpression; the job does not register; jobScheduled does not fire",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3102-jobs-background-scheduler",
+        "field": "interfaces.scheduler.schedule"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-30103-3",
+      "description": "Scheduler mode workerCron. Given the elicited scheduler-mode answers workerCron and the applied deploy-cloudflare-workers target carries at least one job with a cron string, when the sidecar records the answer, then the generated wrangler.toml carries a `[triggers] crons = [\"<cron-string>\"]` entry per scheduled job (one entry per distinct cron string) and the Worker's `scheduled(event, env, ctx)` handler dispatches to the same publisher the inProcess scheduler would call; the scheduler.start entry point returns immediately in workerCron mode and holds no setInterval.",
+      "given": "scheduler-mode = workerCron and one job scheduled on cron '* * * * *'",
+      "when": "the sidecar records the answer",
+      "then": "wrangler.toml carries `[triggers] crons = [\"* * * * *\"]` and the Worker's scheduled handler dispatches to the publisher; scheduler.start holds no setInterval",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-3102-jobs-background-scheduler-mode",
+        "field": "decision"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-30103-4",
+      "description": "Scheduler mode external. Given the elicited scheduler-mode answers external, when the sidecar records the answer, then the scheduler.start entry point holds no setInterval and no wrangler cron entry is emitted; the operator surface (per the operator-surface elicit) exposes a fire-now command the external cron runner (a Kubernetes CronJob, a GitHub Actions schedule, a systemd timer) invokes on its own tick; a jobScheduled event fires per invocation from the fire-now command, not from an in-process clock.",
+      "given": "scheduler-mode = external",
+      "when": "the sidecar records the answer and the external cron runner invokes the fire-now command",
+      "then": "scheduler.start holds no setInterval; no wrangler cron entry is emitted; jobScheduled fires per fire-now invocation, not per in-process tick",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-3102-jobs-background-scheduler-mode",
+        "field": "decision"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-3102-jobs-background-scheduler"],
+  "tacIds": [
+    "TAC-3102-jobs-background-scheduler"
+  ],
   "createdAt": "2026-09-06T20:30:00.000Z",
-  "updatedAt": "2026-09-06T20:30:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/jobs-background/contributions/user-stories/jobs-background-us-30104.json

@@ -16,10 +16,70 @@
       "when": "the failing job is scheduled",
       "then": "three jobStarted records with the same jobId and attempts 1,2,3; one jobFailed with a terminalErrorCode; no fourth jobStarted",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-30104-2",
+      "description": "Handler timeout raises a retryable error. Given a handler exceeding the elicited handler-timeout-seconds without completing, when the runtime wall-clock reaches the timeout, then the runtime raises a retryable timeout error routed through the applied queue redelivery, jobFailed fires with { jobId, reason: \"timeout\" }, and the message is redelivered against maxAttempts.",
+      "given": "a handler exceeding the elicited handler-timeout-seconds",
+      "when": "the wall-clock reaches the timeout",
+      "then": "a retryable timeout error routes through the queue; jobFailed fires with reason: timeout; the message is redelivered",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3101-jobs-background-job-definition",
+        "field": "responsibilities.retry"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-30104-3",
+      "description": "Retry backoff exponential effective-delay per attempt is base * 2^(attempts-1) capped at 10 minutes. Given a job with retryPolicy.backoff='exponential' and base=1 second, when the runtime issues retries for attempts 1..15, then the effective inter-attempt delay observed on the sink is 1s, 2s, 4s, 8s, 16s, ..., 512s, then capped at 600s (10 minutes) for every subsequent attempt; a probe measuring the schedule spacing FAILS if any attempt spacing exceeds 10 minutes or does not follow the 2^(n-1) curve until the cap.",
+      "given": "retryPolicy.backoff='exponential' with base=1s and maxAttempts sufficient to reach the cap",
+      "when": "the runtime issues retries",
+      "then": "inter-attempt delays observed on the sink follow base*2^(attempts-1) up to 600s then cap at 600s; the cap probe FAILS on any spacing above 10 minutes",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3101-jobs-background-job-definition",
+        "field": "responsibilities.backoffExponential"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-30104-4",
+      "description": "Retry backoff constant effective-delay per attempt equals base seconds. Given a job with retryPolicy.backoff='constant' and base=5 seconds, when the runtime issues retries for attempts 1..N, then every observed inter-attempt delay on the sink equals 5 seconds and the probe measuring the schedule spacing FAILS on any observed delay that deviates from base by more than the sink's tick resolution.",
+      "given": "retryPolicy.backoff='constant' with base=5s",
+      "when": "the runtime issues retries",
+      "then": "every observed inter-attempt delay equals 5 seconds; probe FAILS on any deviation beyond the sink tick",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3101-jobs-background-job-definition",
+        "field": "responsibilities.backoffConstant"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-30104-5",
+      "description": "Retry backoff linear effective-delay per attempt is base * attempts. Given a job with retryPolicy.backoff='linear' and base=2 seconds, when the runtime issues retries for attempts 1..N, then the observed inter-attempt delay on the sink is 2s, 4s, 6s, 8s, ..., growing linearly; a probe measuring the schedule spacing FAILS on any spacing that does not equal base*attempts within the sink tick resolution.",
+      "given": "retryPolicy.backoff='linear' with base=2s",
+      "when": "the runtime issues retries",
+      "then": "observed inter-attempt delays follow base*attempts (2s, 4s, 6s, ...); probe FAILS on any deviation",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3101-jobs-background-job-definition",
+        "field": "responsibilities.backoffLinear"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-3101-jobs-background-job-definition", "TAC-3103-jobs-background-run-log"],
+  "tacIds": [
+    "TAC-3101-jobs-background-job-definition",
+    "TAC-3103-jobs-background-run-log"
+  ],
   "createdAt": "2026-09-06T20:30:00.000Z",
-  "updatedAt": "2026-09-06T20:30:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/jobs-background/contributions/user-stories/jobs-background-us-30105.json

@@ -16,10 +16,27 @@
       "when": "the PII-input job is scheduled",
       "then": "every event record whitelisted; grep on the serialised event stream returns zero matches for the PII fixture text",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-30105-2",
+      "description": "Secret exclusion by grep-across-source. Given the runtime source, the scheduler source and the run-log source, when a source-tree scan searches every runLog.fire call site for job-input fields other than the whitelist {jobId, jobName, startedAt, finishedAt, attempts, duration, resultDigest, errorKind}, then no match is found; a mutation SIMULATE_PII_IN_JOB_INPUT=true forces a PII field onto an event and the scan FAILS naming the leaked field.",
+      "given": "runtime, scheduler and run-log source",
+      "when": "a scan runs across every runLog.fire call site",
+      "then": "no non-whitelist field is found; the PII mutation FAILS naming the leaked field",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3103-jobs-background-run-log",
+        "field": "interfaces.eventEnvelope"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-3103-jobs-background-run-log"],
+  "tacIds": [
+    "TAC-3103-jobs-background-run-log"
+  ],
   "createdAt": "2026-09-06T20:30:00.000Z",
-  "updatedAt": "2026-09-06T20:30:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/jobs-background/contributions/user-stories/jobs-background-us-30106.json

@@ -16,10 +16,27 @@
       "when": "grep queries walk the guide and README",
       "then": "guide/jobs-background.md contains the substring operator-facing surface and names all three values cli, httpEndpoint, none; README.md names the same three values; neither ships a CLI binary nor an HTTP router",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-30106-2",
+      "description": "Enum drift refused at load. Given the elicited operator-surface answered outside the shipped enum {cli, httpEndpoint, none}, when the loader validates the elicited answer, then the loader refuses with a named error kind (invalidOperatorSurface) and the applied sidecar is not written.",
+      "given": "operator-surface answered outside {cli, httpEndpoint, none}",
+      "when": "the loader validates",
+      "then": "the loader refuses with invalidOperatorSurface; the applied sidecar is not written",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3103-jobs-background-run-log",
+        "field": "interfaces.createRunLog"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-3103-jobs-background-run-log"],
+  "tacIds": [
+    "TAC-3103-jobs-background-run-log"
+  ],
   "createdAt": "2026-09-06T20:30:00.000Z",
-  "updatedAt": "2026-09-06T20:30:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/jobs-background/contributions/user-stories/jobs-background-us-30107.json

@@ -16,10 +16,27 @@
       "when": "rcf define blueprint add ./blueprints/jobs-background --allow-no-queue-yet runs",
       "then": "exit code is 0; rcf/blueprints/jobs-background.applied.json exists; slug is jobs-background; allowNoAuthYet is true; appliedCapabilities is []; notes contains 'no queue yet', '--allow-no-queue-yet' and 'queue'; notes does NOT contain 'no auth yet' nor 'no secrets-management yet'",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-30107-2",
+      "description": "Sidecar note references the flag verbatim. Given the --allow-no-queue-yet override applied, when the sidecar is inspected, then its notes field contains the exact substring \"--allow-no-queue-yet\" (so an operator later dropping the note can grep for the flag) and does not carry an \"auth\"-family phrasing that would misdirect the operator to a different override.",
+      "given": "the --allow-no-queue-yet override applied",
+      "when": "the sidecar is inspected",
+      "then": "the notes field contains the exact --allow-no-queue-yet substring and no auth-family phrasing",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-3103-jobs-background-requires-applied-capabilities",
+        "field": "decision.allowSkipFlag"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-3101-jobs-background-job-definition"],
+  "tacIds": [
+    "TAC-3101-jobs-background-job-definition"
+  ],
   "createdAt": "2026-09-06T20:30:00.000Z",
-  "updatedAt": "2026-09-06T20:30:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/jobs-background/contributions/user-stories/jobs-background-us-30108.json

@@ -16,10 +16,28 @@
       "when": "the fake clock advances 60 seconds",
       "then": "one jobStarted event fires within fireToleranceMs; one jobCompleted event fires within timeoutMs; both records match the whitelist",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-30108-2",
+      "description": "Cron tick outside tolerance FAILS. Given a job scheduled on a cron string and the elicited fire tolerance window, when the cron tick fires more than tolerance seconds past the scheduled boundary, then the scheduler emits jobFireOutsideTolerance on the event sink carrying the observed delay; a mutation SIMULATE_CRON_JITTER=true delays the tick past tolerance and the sink observer FAILS the run.",
+      "given": "a scheduled cron string and the elicited fire tolerance",
+      "when": "the cron tick fires beyond tolerance",
+      "then": "jobFireOutsideTolerance fires with the observed delay; the jitter mutation FAILS the run",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3102-jobs-background-scheduler",
+        "field": "interfaces.scheduler.schedule"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-3102-jobs-background-scheduler", "TAC-3103-jobs-background-run-log"],
+  "tacIds": [
+    "TAC-3102-jobs-background-scheduler",
+    "TAC-3103-jobs-background-run-log"
+  ],
   "createdAt": "2026-09-06T20:30:00.000Z",
-  "updatedAt": "2026-09-06T20:30:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/jobs-background/contributions/user-stories/jobs-background-us-30109.json

@@ -7,19 +7,36 @@
   "title": "Cross-cutting: retry-then-DLQ handoff when maxAttempts is exhausted",
   "asA": "operator observing a terminally failing job",
   "iWant": "the applied queue's DLQ to receive the message after maxAttempts is exhausted, and jobFailed to fire on the sink with a terminal error code",
-  "soThat": "a terminally failing job lands on the queue's DLQ (as ratified by the T-3 messaging-queue-cloudflare DLQ contract) and the run log records the terminal event",
+  "soThat": "a terminally failing job lands on the queue's DLQ (as ratified by the messaging-queue-cloudflare DLQ contract) and the run log records the terminal event",
   "acceptanceCriteria": [
     {
       "id": "AC-30109-1",
-      "description": "The retry-and-fail probe's report, after the three failing jobStarted events and the terminal jobFailed event, records that the underlying in-memory queue driver invoked the DLQ producer path (dlqOverflow flag on the driver's introspection API) for the failing message id. The DLQ handoff is a T-3 concern; jobs-background only asserts the terminal jobFailed event fires and the DLQ path is exercised, not the DLQ delivery contents (T-3 covers that).",
-      "given": "the fixture with SIMULATE_HANDLER_THROW=true and the T-3 in-memory queue seam active",
+      "description": "The retry-and-fail probe's report, after the three failing jobStarted events and the terminal jobFailed event, records that the underlying in-memory queue driver invoked the DLQ producer path (dlqOverflow flag on the driver's introspection API) for the failing message id. The DLQ handoff is a queue-blueprint concern; jobs-background only asserts the terminal jobFailed event fires and the DLQ path is exercised, not the DLQ delivery contents (the queue blueprint covers that).",
+      "given": "the fixture with SIMULATE_HANDLER_THROW=true and the in-memory queue seam active",
       "when": "the retry-and-fail probe runs to completion",
       "then": "the probe report carries dlqInvoked true; the sink shows jobFailed with terminalErrorCode; the retry-and-fail run report at .rcf/reports/blueprints/jobs-background/retry-and-fail.json carries aggregateVerdict pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-30109-2",
+      "description": "Retry chain observability. Given a handler that throws retryable on every delivery up to maxAttempts, when the chain completes, then the run-log carries a jobStarted plus jobFailed pair per delivery attempt and one final jobDeadLettered event; the run-log ordering is stable and each event carries the same jobId; a mutation SIMULATE_JOB_LOG_DUPLICATE=true fires an extra jobStarted and the observer FAILS.",
+      "given": "a handler throwing retryable up to maxAttempts",
+      "when": "the retry chain completes",
+      "then": "the run-log has jobStarted/jobFailed pairs per attempt and one jobDeadLettered; ordering stable; jobId consistent; the duplicate mutation FAILS",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3103-jobs-background-run-log",
+        "field": "interfaces.runLog.fire"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-3103-jobs-background-run-log"],
+  "tacIds": [
+    "TAC-3103-jobs-background-run-log"
+  ],
   "createdAt": "2026-09-06T20:30:00.000Z",
-  "updatedAt": "2026-09-06T20:30:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/jobs-background/docs/topics.md

@@ -6,7 +6,7 @@ This file is the jobs-background half of the cross-blueprint contract. The Phase
 
 | Topic string | jobs-background contribution | Origin | Composition note |
 |---|---|---|---|
-| `backgroundJobModel` | ADR-3101-jobs-background-model | Minted by this blueprint. Names the shipped background-job model; the shipped answer is retry-and-schedule (per-message re-delivery on failure inheriting the applied queue's max-attempts ceiling; POSIX cron plus one-shot delayed schedules; metadata-only run-log at four moments). | The one project-wide decision on what background-job discipline the project ships. A future stateful-workflow sibling (Temporal-shape, Airflow-shape) would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR. The round-6 Workflows adapter (per Baz section 5.7 and round-6 decision (b)) lives INSIDE this blueprint as a v1.1.0 minor scheduler-mode value at ADR-3102 and does NOT re-claim this topic. |
+| `backgroundJobModel` | ADR-3101-jobs-background-model | Minted by this blueprint. Names the shipped background-job model; the shipped answer is retry-and-schedule (per-message re-delivery on failure inheriting the applied queue's max-attempts ceiling; POSIX cron plus one-shot delayed schedules; metadata-only run-log at four moments). | The one project-wide decision on what background-job discipline the project ships. A future stateful-workflow sibling (Temporal-shape, Airflow-shape) would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR. The round-6 Workflows adapter (per spec section 5.7 and round-6 decision (b)) lives INSIDE this blueprint as a v1.1.0 minor scheduler-mode value at ADR-3102 and does NOT re-claim this topic. |
 
 The jobs-background blueprint claims one global topic. Every other contribution is scope-local (ADR-3102 scheduler mode, ADR-3103 requires-applied-capabilities, ADR-3104 timeout floor do not contribute global topics; a composing blueprint that holds an opinion on any of them authors its own project-level ADR).
 
@@ -56,7 +56,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 30101-30109 sit at the LOW end of the 30101-30899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a jobs-background REQ id into the number 30110 would collide against a shipped US-30110; band headroom (30110-30899) leaves that space.
+US 30101-30109 sit at the LOW end of the 30101-30899 band on purpose. A project-side story mechanically derived from a jobs-background REQ id into the number 30110 would collide against a shipped US-30110; band headroom (30110-30899) leaves that space.
 
 ADR/TAC suffixes for this blueprint use the 3101-3199 block, continuing the shelf pattern.
 
@@ -64,7 +64,7 @@ ADR/TAC suffixes for this blueprint use the 3101-3199 block, continuing the shel
 
 - Reuse `backgroundJobModel` exactly as spelled here when your blueprint holds an opinion on the shipped background-job discipline; contribute your own scope:global ADR on that string and let composition surface the pairing.
 - A future stateful-workflow sibling (Temporal-shape, Airflow-shape) mints on demand; each claims `backgroundJobModel` and conflicts by design.
-- A consumer blueprint that surfaces "run this later" or "run this on a schedule" reads the `backgroundJobs` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` to obtain the job-definition and scheduler surfaces at apply time via the T-5 capability-declaration mechanism.
+- A consumer blueprint that surfaces "run this later" or "run this on a schedule" reads the `backgroundJobs` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` to obtain the job-definition and scheduler surfaces at apply time via the capability-declaration mechanism.
 
 ## Deliberate-conflict statement
 

package/blueprints/jobs-background/guide/jobs-background.md

@@ -24,7 +24,7 @@ On a fresh project with `messaging-queue-cloudflare` already applied:
 rcf define blueprint add jobs-background
 ```
 
-Applies 22 contributions and writes the sidecar `rcf/blueprints/jobs-background.applied.json` with `appliedCapabilities: ["queue"]` (discovered through the T-5 capability mechanism).
+Applies 22 contributions and writes the sidecar `rcf/blueprints/jobs-background.applied.json` with `appliedCapabilities: ["queue"]` (discovered through the capability mechanism).
 
 On a bare project (no queue provider applied), apply refuses:
 
@@ -49,7 +49,7 @@ Exits 0 and writes the sidecar with `allowNoAuthYet: true`, `appliedCapabilities
 
 ## Writing a job
 
-Every job module in `./jobs/` exports a plain object:
+Every job module in `./jobs/` default-exports the shape owned on `TAC-3101-jobs-background-job-definition.interfaces.jobModule.default`. This section demonstrates that shape with a worked example; the definition lives on the TAC.
 
 ```js
 export default {
@@ -109,7 +109,7 @@ dead_letter_queue = "rcf-test-dlq"
 max_retries = 3
 ```
 
-Boot line for local development against the T-3 in-memory queue-driver seam:
+Boot line for local development against the in-memory queue-driver seam:
 
 ```sh
 node ../../../../blueprints/jobs-background/contributions/probes/run-fake-clock-cron.mjs
@@ -127,7 +127,7 @@ The blueprint ships the contract these shims build against; the shim itself is t
 
 ## Reserved v1.1.0 Workflows adapter
 
-The `workflows` scheduler mode arrives at v1.1.0 per Baz section 5.7 and round-6 decision (b). It wraps the same job-definition contract with Cloudflare Workflows `step.do` orchestration, adding durable multi-step execution without changing the outward job-definition shape. What changes:
+The `workflows` scheduler mode arrives at v1.1.0 per spec section 5.7 and round-6 decision (b). It wraps the same job-definition contract with Cloudflare Workflows `step.do` orchestration, adding durable multi-step execution without changing the outward job-definition shape. What changes:
 
 - One new enum value at ADR-3102: `scheduler: "workflows"`.
 - One new section in this guide covering how to declare durable steps through the workflow adapter.
@@ -136,7 +136,7 @@ The `workflows` scheduler mode arrives at v1.1.0 per Baz section 5.7 and round-6
 What does NOT change:
 
 - The `backgroundJobModel` topic answer (still retry-and-schedule at ADR-3101).
-- The job-definition module shape (`name`, `handler`, `inputSchema`, `retryPolicy`, `timeoutMs`).
+- The job-definition module shape owned on `TAC-3101-jobs-background-job-definition.interfaces.jobModule.default`.
 - The run-log envelope whitelist (`event`, `jobId`, `jobName`, `attempts`, `duration`, `timestamp`, optional `terminalErrorCode`).
 - The `requiresAppliedCapabilities` block on the applying blueprint.
 
@@ -144,4 +144,4 @@ What does NOT change:
 
 - `observability-logging` (companion): supplies the run-log upstream so the four lifecycle events flow through the applied logger's channel policy.
 - `application-error-handling` (companion): supplies the error record factory a `jobFailed` constructs on the terminal path.
-- `messaging-queue-cloudflare`: the shipped `queue` capability provider today. The `messaging-queue-postgres` sibling (reserved slug per Baz decision 7 in the T-3 documentation) mints on demand and composes here without any change to `jobs-background`.
+- `messaging-queue-cloudflare`: the shipped `queue` capability provider today. The `messaging-queue-postgres` sibling (reserved slug per policy in the documentation) mints on demand and composes here without any change to `jobs-background`.

package/blueprints/messaging-queue-cloudflare/CHANGELOG.md

@@ -1,34 +1,56 @@
+# Changelog
+
+## 1.1.3 (positive-evidence patch, 2026-09-10)
+
+- `real-account-concurrency-smoke.mjs`: skip results now carry a discrete `reason` field naming the exact unset environment variable or missing account prerequisite. The credential-missing branch (`CF_ACCOUNT_ID` or `CF_API_TOKEN` unset with `CI_HAS_CLOUDFLARE_ACCOUNT=true`) records `accountBoundSkipped: true` naming only the missing variables (never the gate variable that is set on that branch) rather than a bare fail, closing the authoring standard section 7d shape.
+- Adds a live pre-flight observation of the target Cloudflare account's workers.dev subdomain state via `GET /accounts/{id}/workers/subdomain` (verifiedOn 2026-09-10 per https://developers.cloudflare.com/api/resources/workers/subresources/subdomain/methods/get/). A `404` response or an empty `result.subdomain` marks the account as unprovisioned and the probe records `accountBoundSkipped: true` with a reason naming the missing account prerequisite and a detail carrying the observed status and Cloudflare error code as positive evidence. A provisioned subdomain causes the probe to run the mint / drive / teardown sequence unconditionally.
+- Teardown discipline hardened: if `destroyScratchQueueAndWorker` throws, the probe now records an additional `verdict: fail` result naming the potentially orphaned queue id, consumer worker name and telemetry KV id (`teardownFailed: true`, `orphaned: {...}`), so the aggregate verdict fails when live-account state may be dirty rather than passing on a stderr-only note.
+- `GITHUB_RUN_ID` is declared on the probe's `envDeclared` output and on the fixture's "Declared env vars" table (already read by the shim's run-id derivation, previously undeclared).
+- No capability change.
+
+## 1.1.2 - 2026-09-10
+
+- README six-probes paragraph now describes the probe module envelope directly. Guide `publishBatch` sample updated: the `x-trace-id` example values are `trace-order-1001` and `trace-order-1002`, and a one-line pointer follows the sample to the owner at `TAC-3001.interfaces[2].description`. Anatomy pin updated to 1.1.2.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+Adds the elicits block (queue-binding-name, queue-name, max-attempts, dead-letter-queue, batch-size, batch-timeout-seconds) that the REQs and guide were already describing in prose. Adds deliveredBy on REQ-002 and REQ-006. REQ-004 and AC-29104-1 name maxDeliveries and map to the vendor max_retries as maxDeliveries - 1, with new AC-29104-2 asserting the maxDeliveries=1 boundary case. REQ-006 and AC-29106-1 standardise on ts as the wall-clock milliseconds-since-epoch field name, aligning with TAC-3001, TAC-3003 and the guide. REQ-002 replaces the "idempotent" label with an explicit at-least-once semantics naming ADR-3002 as the shipped delivery contract. Adds disposition to every AC.
+
 # messaging-queue-cloudflare changelog
 
 ## 1.0.2 - 2026-09-08
 
-H-2 follow-up (`w-2026-09-08-dave-017`, addendum item 6 fixture defect): the real-account queue probe now self-provisions its own throwaway Queue + consumer Worker + telemetry KV namespace, closing the second-tier undeclared-env skip HQ hit at the real-account gate on 2026-09-08 (`REAL RUN: PARTIAL`, `MERGE DECISION: HOLD`). No shipped-code capability change.
-
-- `real-account-concurrency-smoke.mjs` rewritten against a new self-provisioning fixture shim at `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs`. AC-29108-2 requires a real consumer to process the published messages ("the consumer processes them concurrently up to the documented 250-invocation cap"), so the shim mints a scratch Cloudflare Queue under `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`, and a throwaway consumer Worker under `h2-cf-probe-integrity-scratch-w-` bound to the queue (consumer) with `RCF_TEST_QUEUE` (shipped queue producer binding name matching `packages/rcf-lite/test/fixtures/infra-s3-and-queue/wrangler.toml`) + `RCF_TEST_TELEMETRY_KV` bindings. NO workers.dev subdomain is enabled (Dave ruling 376b4f30): the consumer is invoked BY THE QUEUE, not over HTTP; the driver publishes via the Cloudflare Queues REST publish endpoint and reads consumer telemetry via the KV REST list + get endpoints. The consumer Worker's source is a plain module (`h2-cf-queue-consumer-worker.mjs`); its `queue()` handler records one telemetry entry per invocation (start / end timestamps + batchSize) to the bound telemetry KV namespace; the driver computes `maxConcurrent` from an interval-overlap analysis on those timestamps.
+Fixture-side fix: the real-account queue probe now self-provisions its own throwaway Queue + consumer Worker + telemetry KV namespace, closing the second-tier undeclared-env skip at the real-account gate. No shipped-code capability change.
+- `real-account-concurrency-smoke.mjs` rewritten against a new self-provisioning fixture shim at `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs`. AC-29108-2 requires a real consumer to process the published messages ("the consumer processes them concurrently up to the documented 250-invocation cap"), so the shim mints a scratch Cloudflare Queue under `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`, and a throwaway consumer Worker under `h2-cf-probe-integrity-scratch-w-` bound to the queue (consumer) with `RCF_TEST_QUEUE` (shipped queue producer binding name matching `packages/rcf-lite/test/fixtures/infra-s3-and-queue/wrangler.toml`) + `RCF_TEST_TELEMETRY_KV` bindings. No workers.dev subdomain is enabled: the consumer is invoked BY THE QUEUE, not over HTTP; the driver publishes via the Cloudflare Queues REST publish endpoint and reads consumer telemetry via the KV REST list + get endpoints. The consumer Worker's source is a plain module (`h2-cf-queue-consumer-worker.mjs`); its `queue()` handler records one telemetry entry per invocation (start / end timestamps + batchSize) to the bound telemetry KV namespace; the driver computes `maxConcurrent` from an interval-overlap analysis on those timestamps.
 - Declared env for a real-account run is now `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN` (optional `CF_API_BASE_URL` test override; optional `CF_QUEUE_MESSAGE_COUNT` per section 3.5). The `CF_QUEUE_WORKER_URL` and `CF_QUEUE_NAME` second-tier gates are removed; the fixture provides them itself. Every skip-causing env var enumerated in `report.extra.envDeclared` on the probe result and mirrored in the shim's `DECLARED_ENV` export.
-- Teardown deletes the consumer Worker first (so the queue has no active consumer at delete time), then the Queue, then the telemetry KV namespace, all by EXACT id / EXACT name against the mint record with three independent prefix guards per resource. `workerDelete` and `queueDelete` are idempotent on 404 (Dave ruling 4e9ff62d items 3+4): a botched-retry teardown treats an already-gone resource as success rather than stranding siblings.
-- Separate crash-recovery `sweepOrphans` code path filters over the account by the frozen throwaway prefix constants and deletes each match by exact identity; the sweep is structurally unable to select a non-prefixed name. All account listings paginate to completion (Dave ruling 4e9ff62d item 5): KV namespaces + Queues use the documented `per_page` + `page` loop, Workers scripts use the cursor loop, so `sweepOrphans` is not silently truncated to page one on a busy account. Dedicated sweep-safety test at `packages/rcf-lite/test/fixtures/cf-platform/test/h2-cf-sweep-safety.test.mjs` seeds the mock account with the ten live production Worker script names on the operator account plus mid-string-prefix decoys AND a 250-per-type multi-page cover, and asserts sweep selects zero of them.
-- Queue consumer-attach body sends `type: "worker"` (Dave ruling 4e9ff62d item 1: survives CF schema tightening on the discriminated attach union) and omits `dead_letter_queue` entirely rather than sending an explicit `null` (item 2).
-- Local proof harness (`packages/rcf-lite/test/fixtures/cf-platform/test/mock-cf-api-server.mjs`) is a zero-dep in-process mock of the Cloudflare REST contract, not the wire. **The local run exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** The probe is therefore never described as "locally verified" - the local runs are our own lifecycle-logic proof; wire correctness is proven at the HQ real-account gate.
+- Teardown deletes the consumer Worker first (so the queue has no active consumer at delete time), then the Queue, then the telemetry KV namespace, all by EXACT id / EXACT name against the mint record with three independent prefix guards per resource. `workerDelete` and `queueDelete` are idempotent on 404: a botched-retry teardown treats an already-gone resource as success rather than stranding siblings.
+- Separate crash-recovery `sweepOrphans` code path filters over the account by the frozen throwaway prefix constants and deletes each match by exact identity; the sweep is structurally unable to select a non-prefixed name. All account listings paginate to completion: KV namespaces + Queues use the documented `per_page` + `page` loop, Workers scripts use the cursor loop, so `sweepOrphans` is not silently truncated to page one on a busy account. Dedicated sweep-safety test at `packages/rcf-lite/test/fixtures/cf-platform/test/h2-cf-sweep-safety.test.mjs` seeds the mock account with the ten live production Worker script names on the operator account plus mid-string-prefix decoys AND a 250-per-type multi-page cover, and asserts sweep selects zero of them.
+- Queue consumer-attach body sends `type: "worker"` (survives CF schema tightening on the discriminated attach union) and omits `dead_letter_queue` entirely rather than sending an explicit `null`.
+- Local proof harness (`packages/rcf-lite/test/fixtures/cf-platform/test/mock-cf-api-server.mjs`) is a zero-dep in-process mock of the Cloudflare REST contract, not the wire. **The local run exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** The probe is therefore never described as "locally verified" - the local runs are our own lifecycle-logic proof; wire correctness is proven at the operator estate real-account gate.
 
 ## 1.0.1 - 2026-09-08
 
-H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch. No capability change.
-
-- Replaced the `accountBoundSkipped: true` pass-stub in `real-account-concurrency-smoke.mjs` with a real 500-message concurrency driver against a live Queues binding on a deployed Worker. When `CI_HAS_CLOUDFLARE_ACCOUNT` is set with `CF_QUEUE_WORKER_URL` and `CF_QUEUE_NAME`, the driver publishes 500 messages through the producer facade in 10 concurrent 50-message batches, polls consumer telemetry via `/stats`, and asserts `drained`, `withinCap` and `observedConcurrency > 1` against Cloudflare's documented push-invocation cap (250). The env-absent branch keeps the pass-with-skip shape. Locally proven against `wrangler dev --local` end-to-end (500/500 messages in 583 ms; local queue serialises so the concurrency assertion FAIL tail is the expected local-proof outcome; on real Cloudflare push consumers the assertion passes at HQ gate time).
-- Re-verified the Cloudflare Queues limits URL (`https://developers.cloudflare.com/queues/platform/limits/`) returns `HTTP/2 200`; recorded in the H-2 PR provenance (2026-09-08T13:38:07Z).
+Probe-integrity patch (`h2-cf-platform-probe-integrity`). No capability change.
+- Replaced the `accountBoundSkipped: true` pass-stub in `real-account-concurrency-smoke.mjs` with a real 500-message concurrency driver against a live Queues binding on a deployed Worker. When `CI_HAS_CLOUDFLARE_ACCOUNT` is set with `CF_QUEUE_WORKER_URL` and `CF_QUEUE_NAME`, the driver publishes 500 messages through the producer facade in 10 concurrent 50-message batches, polls consumer telemetry via `/stats`, and asserts `drained`, `withinCap` and `observedConcurrency > 1` against Cloudflare's documented push-invocation cap (250). The env-absent branch keeps the pass-with-skip shape. Locally proven against `wrangler dev --local` end-to-end (500/500 messages in 583 ms; local queue serialises so the concurrency assertion FAIL tail is the expected local-proof outcome; on real Cloudflare push consumers the assertion passes at the operator estate gate time).
+- The Cloudflare Queues limits URL `https://developers.cloudflare.com/queues/platform/limits/` supports the documented push-invocation cap.
 - Extended the fixture Worker at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/worker.mjs` with consumer telemetry and `/publish-batch`, `/stats` and `/reset` endpoints; added `wrangler ^4.0.0` as devDep on the fixture package.
 
 ## 1.0.0 - 2026-09-06
 
-Initial release. Directed producer-to-consumer worklist queue on Cloudflare Queues; first shipped adapter with the reserved `messaging-queue-postgres` sibling (Baz decision 7) named beside it in the section 6a capability table. Accessed through a producer facade that is the sole reader of the Cloudflare Queues binding (`env.RCF_TEST_QUEUE` in the fixture). Landed via the infra round 5 spec (ratified 2026-09-06) as track T-3.
+Initial release. Directed producer-to-consumer worklist queue on Cloudflare Queues; first shipped adapter with the reserved `messaging-queue-postgres` sibling (sibling reservation) named beside it in the section 6a capability table. Accessed through a producer facade that is the sole reader of the Cloudflare Queues binding (`env.RCF_TEST_QUEUE` in the fixture).
 
 - 21 contributions: 6 REQs on producer facade sole-reader / publish-consume-ack / retry / dead-letter / batch / lifecycle events; 8 USs at 29101-29108; 3 TACs (3001 producer facade, 3002 consumer registration, 3003 event sink); 4 ADRs (3001 adapter Cloudflare Queues shipped, 3002 `deliverySemantics` scope global at-least-once, 3003 max_retries default 3 floor 1 ceiling 100, 3004 batch size default 10 batch timeout default 5 seconds).
-- Five Node-only probes under `contributions/probes/` proven against the wrangler-dev-equivalent seam (in-memory queue driver realising the Cloudflare Queues binding shape per SDR-3-a on US-29107): `producer-facade-ready`, `publish-to-delivery`, `retry-and-dlq`, `event-secrecy`, and the accountBound `real-account-concurrency-smoke`. The real-account smoke records `accountBoundSkipped: true` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset per spec section 3.5.
-- T-3 slice of the shared sample-app fixture at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/` adds a `wrangler.toml` declaring the queue binding (`RCF_TEST_QUEUE`), DLQ binding (`RCF_TEST_DLQ`), `dead_letter_queue = "rcf-test-dlq"`, `max_retries = 3`, `max_batch_size = 10`, `max_batch_timeout = 5`; plus `src/queue-driver.mjs`, `src/producer.mjs`, `src/consumer.mjs`, `src/dlq-inspector.mjs`, `src/event-sink.mjs`. Three wired induced-failure switches (`SIMULATE_CONSUMER_RETRY`, `SIMULATE_DLQ_OVERFLOW`, `SIMULATE_PII_IN_BODY`) drive the negative-run paths.
-- Declares `capabilities: ["queue"]`, `suggestedCompanions: [{role: "logging"}, {role: "errorHandling"}]`, `providesRoles` absent, `requiresAppliedCapabilities` absent. Composes on `deploy-cloudflare-workers` transitively via the wrangler binding (not through the capability mechanism), so `jobs-background` reads the `queue` capability at apply time via the T-5 mechanism from the visual round.
+- Five Node-only probes under `contributions/probes/` proven against the wrangler-dev-equivalent seam (in-memory queue driver realising the Cloudflare Queues binding shape per the wrangler-dev-equivalent seam decision on US-29107): `producer-facade-ready`, `publish-to-delivery`, `retry-and-dlq`, `event-secrecy`, and the accountBound `real-account-concurrency-smoke`. The real-account smoke records `accountBoundSkipped: true` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset per spec section 3.5.
+- The messaging-queue-cloudflare slice of the shared sample-app fixture at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/` adds a `wrangler.toml` declaring the queue binding (`RCF_TEST_QUEUE`), DLQ binding (`RCF_TEST_DLQ`), `dead_letter_queue = "rcf-test-dlq"`, `max_retries = 3`, `max_batch_size = 10`, `max_batch_timeout = 5`; plus `src/queue-driver.mjs`, `src/producer.mjs`, `src/consumer.mjs`, `src/dlq-inspector.mjs`, `src/event-sink.mjs`. Three wired induced-failure switches (`SIMULATE_CONSUMER_RETRY`, `SIMULATE_DLQ_OVERFLOW`, `SIMULATE_PII_IN_BODY`) drive the negative-run paths.
+- Declares `capabilities: ["queue"]`, `suggestedCompanions: [{role: "logging"}, {role: "errorHandling"}]`, `providesRoles` absent, `requiresAppliedCapabilities` absent. Composes on `deploy-cloudflare-workers` transitively via the wrangler binding (not through the capability mechanism), so `jobs-background` reads the `queue` capability at apply time via the capability-consumer mechanism.
 - Contributes ADR-3002 as `scope: global` on new topic `deliverySemantics`. Future exactly-once, at-most-once or `messaging-queue-postgres` siblings conflict here by design.
-- Every ADR contribution entry on `blueprint.json` carries a `standardsTraceClause` per section 8a.2 (mandatory per HQ mid-flight ruling after PR #154 gate).
-- Extends `packages/rcf-lite/docs/blueprint-authoring.md` section 6a capability-declaration table with one row for `queue` naming the reserved `messaging-queue-postgres` sibling per Baz decision 7 and spec section 5.6.
-- The Miniflare Queues sub-page under the workers testing miniflare storage tree is NOT cited: the ratified round-5 spec's status block records it returning 404 on 2026-09-06. The Cloudflare Queues local-development page (`https://developers.cloudflare.com/queues/configuration/local-development/`) is the sole citation for the local seam.
-- Lifecycle event whitelist reuses T-2 object-storage-s3's `{event, ts, ...}` common envelope prefix (per PR #157 gate reviewer note 2026-09-06) so a future v1.1 minor can promote one shared shape to schema enforcement.
+- Every ADR contribution entry on `blueprint.json` carries a `standardsTraceClause` per section 8a.2 (mandatory).
+- Extends `packages/rcf-lite/docs/blueprint-authoring.md` section 6a capability-declaration table with one row for `queue` naming the reserved `messaging-queue-postgres` sibling per the sibling reservation in spec section 5.6.
+- The Miniflare Queues sub-page under the workers testing miniflare storage tree is NOT cited (it returns 404). The Cloudflare Queues local-development page (`https://developers.cloudflare.com/queues/configuration/local-development/`) is the sole vendor citation supporting the local seam.
+- Lifecycle event whitelist reuses the object-storage-s3 blueprint's `{event, ts, ...}` common envelope prefix so a future v1.1 minor can promote one shared shape to schema enforcement.
+
+Adds deliveredBy on REQ-003 and REQ-004. AC-29107-2 and AC-29108-2 carry vendorCitation.