rcf-lite 0.27.0 → 0.28.0

package/blueprints/edge-cloudflare-access/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "edge-cloudflare-access",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "category": "edge",
   "capabilities": [
     "zeroTrustGate"

package/blueprints/edge-cloudflare-access/contributions/probes/admin-console-gate-surface.mjs

@@ -46,7 +46,15 @@ async function bootServer() {
 
 async function fetchDom(url, caps) {
   const target = `${url}/admin/sign-in?caps=${encodeURIComponent(caps)}`;
-  const res = await fetch(target);
+  // The admin-console fixture refuses unauthenticated gated requests
+  // with HTTP 403 (AC-21815-2), so the probe supplies a fixture
+  // Authorization header when the capability set includes
+  // zeroTrustGate so the gated surface can be observed.
+  const capsList = caps.split(',').map((s) => s.trim());
+  const headers = capsList.includes('zeroTrustGate')
+    ? { Authorization: 'Principal probe-signin@example.test' }
+    : undefined;
+  const res = await fetch(target, headers ? { headers } : undefined);
   return { status: res.status, body: await res.text(), target };
 }
 

package/blueprints/edge-cloudflare-access/docs/topics.md

@@ -59,7 +59,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 34101-34109 sit at the LOW end of the 34101-34899 band on purpose (watchpost run-4 lesson). ADR/TAC suffixes for this blueprint use the 3501-3599 block, continuing the shelf pattern.
+US 34101-34109 sit at the LOW end of the 34101-34899 band on purpose. ADR/TAC suffixes for this blueprint use the 3501-3599 block, continuing the shelf pattern.
 
 ## Shared expectations for future composing blueprints
 

package/blueprints/edge-cloudflare-rate-limiting/CHANGELOG.md

@@ -5,9 +5,7 @@
 Positive-evidence rule alignment on the probe pack skip path (authoring standard section 7d); vendor citation on the guide-section AC; register tidy in shipped prose (no capability change).
 
 - Probes and fixture: the account-bound skip return on `contributions/probes/real-account-burst-and-429.mjs` now carries a `reason` field naming the exact env var(s) that were unset; added a "Declared env vars" section to the shared fixture README (`packages/rcf-lite/test/fixtures/cf-edge/README.md`), per authoring standard section 7d. Skip-path probe reports regenerated so the shipped shape carries the new field.
-- Closes F-6: AC-36102-1 on US-36102 now carries a vendorCitation pointing at the Cloudflare WAF rate-limiting rules documentation, verified on 2026-09-10.
-- Closes F-7: README trailing clause with the internal spec reference removed.
-- Closes F-8: guide leading provenance sentence removed.
+- AC-36102-1 on US-36102 now carries a vendorCitation pointing at the Cloudflare WAF rate-limiting rules documentation.
 
 ## 1.1.2 - 2026-09-10
 
@@ -24,19 +22,18 @@ Capability token named in the requirements layer; single-mechanism story legalit
 
 ## 1.1.0 - 2026-09-09
 
-hardening pass edge (criterion a REQ-layer backing; criterion b AC-set sufficiency; criterion c chain consistency lint-zero on pass 1 and pass 2).
-
+Adds REQ-layer backing for elicited options and extends the AC set to cover every documented failure path.
 - Added failure-path ACs to US-36103 (origin-not-executed AC-36103-2 closes F-1: 429 refuses before origin), US-36104 (AC-36104-2 fake-clock cadence assertion closes F-2; AC-36104-3..7 close F-5 drift-runner failure paths for missing zone id, API auth, throttled, malformed and timeout).
 - Split the drift-audit record shape from the runtime request-event record shape: drift records carry `{ruleId, outcome, timestamp, diff}` (no `clientIpHash`, no client on the API path); request-event records carry `{ruleId, clientIpHash, outcome, timestamp}` with a hashed prefix. REQ-004, TAC-3703 responsibilities, AC-36104-1 and AC-36107-1 all now use these exact shapes (closes specimen F-3).
 - Clarified TAC-3701 and REQ-001 that the manifest schema has seven required fields plus one optional `description` field (aligns TAC with the shipped schema; closes specimen F-4).
 - Every REQ now carries `deliveredBy`; every AC carries `disposition`; ACs referencing owner-owned literals carry `ownerRef`.
 - Chain-consistency lint reports 0 findings on both passes.
-- Review fix pass (2026-09-09): finished the split of the drift-audit record shape from the request-event shape by rewriting the TAC-3703 purpose second sentence and the guide's `## Drift audit` section to state the drift record as `{ruleId, outcome, timestamp, diff}` and the request-event record as `{ruleId, clientIpHash, outcome, timestamp}` (closes F-2); the README event-secrecy row assertion now names both shapes. Split every bundled single-AC story on a per-failure-path basis: US-36106 (canonical-pass + SIMULATE_SCHEMA_INVALID-fail), US-36107 (canonical-shape + SIMULATE_EVENT_LEAK_IP-fail), US-36108 (canonical-pass + SIMULATE_MANIFEST_MISSING-fail); each new AC carries a concrete oracle (probe verdict + named field) and an `ownerRef`. Re-judged disposition per AC: mechanism-invariant refusal reasons, record-shape keys and probe verdicts stay `fixed`; US-36101 AC-36101-1 and US-36103 AC-36103-1/-2 re-marked `template` naming the values the applying agent sets (the rate-limit-rules-dir path, per-rule id/expression/threshold/period/characteristics/action/duration, the elicited rate-limit-zone-id, and CF_RATE_LIMIT_URL for the account-bound probe). Genuinely single-mechanism stories (US-36101, US-36102, US-36105) carry the section-7a note inside the story `description` field, not in a schema-illegal new field.
+- Finished the split of the drift-audit record shape from the request-event shape by rewriting the TAC-3703 purpose second sentence and the guide's `## Drift audit` section to state the drift record as `{ruleId, outcome, timestamp, diff}` and the request-event record as `{ruleId, clientIpHash, outcome, timestamp}`; the README event-secrecy row assertion now names both shapes. Split every bundled single-AC story on a per-failure-path basis: US-36106 (canonical-pass + SIMULATE_SCHEMA_INVALID-fail), US-36107 (canonical-shape + SIMULATE_EVENT_LEAK_IP-fail), US-36108 (canonical-pass + SIMULATE_MANIFEST_MISSING-fail); each new AC carries a concrete oracle (probe verdict + named field) and an `ownerRef`. US-36101 AC-36101-1 and US-36103 AC-36103-1/-2 are marked `template` naming the values the applying agent sets (the rate-limit-rules-dir path, per-rule id/expression/threshold/period/characteristics/action/duration, the elicited rate-limit-zone-id, and CF_RATE_LIMIT_URL for the account-bound probe). Genuinely single-mechanism stories (US-36101, US-36102, US-36105) carry the section-7a note inside the story `description` field, not in a schema-illegal new field.
 
 
 ## 1.0.0 (round 6, 2026-09-07)
 
-- First shipped version. Zone-level rate limiting as an edge gate in front of Worker handlers per the ratified `cloudflare-round-6-spec-2026-09-06.md` section 5.6.
+- First shipped version. Zone-level rate limiting as an edge gate in front of Worker handlers.
 - Five REQs, eight USs, three TACs, four ADRs. Twenty contributions total.
 - Ships the local rate-limit rules manifest schema (draft-07), the operator-facing management surface guide with both wrangler and dashboard flows, the drift-audit runner realisation on the `cf-edge` fixture and the composition ADR with `security-auth-magic-link`.
 - Mints capability `edgeRateLimit` and global topic `edgeThrottleContract` (ADR-3701, scope global).

package/blueprints/edge-cloudflare-rate-limiting/docs/topics.md

@@ -59,7 +59,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
-US 36101-36108 sit at the LOW end of the 36101-36899 band on purpose (watchpost run-4 lesson). ADR/TAC suffixes for this blueprint use the 3701-3799 block, continuing the shelf pattern.
+US 36101-36108 sit at the LOW end of the 36101-36899 band on purpose. ADR/TAC suffixes for this blueprint use the 3701-3799 block, continuing the shelf pattern.
 
 ## Shared expectations for future composing blueprints
 

package/blueprints/edge-cloudflare-tunnel/CHANGELOG.md

@@ -6,8 +6,7 @@ Positive-evidence rule alignment on the probe pack skip path (authoring standard
 
 - Probes and fixture: extended the shared `accountBoundSkippedResult` helper in `contributions/probes/probe-utils.mjs` to carry a `reason` field naming the exact env var(s) that were unset on the skip return; added a "Declared env vars" section for the tunnel probes to the shared fixture README (`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/README.md`), per authoring standard section 7d.
 - Probe report detail hygiene: `accountBoundSkippedResult` now names only the actually-unset variables in its `detail` string (a partial skip with one first-tier gate set and the other unset reads honestly, instead of claiming the whole input list is unset). The `reason` field was already exact; this aligns the human-readable detail with it.
-- Closes F-5: README now leads with a category-neutral opening line and drops the account-token remark trailing clause.
-- Closes F-6: guide drops the leading provenance line and rewrites two trailing clauses without internal spec references.
+- README now leads with a category-neutral opening line.
 
 ## 1.1.2 - 2026-09-10
 
@@ -22,9 +21,8 @@ Capability token named in the requirements layer.
 
 ## 1.1.0 - 2026-09-09
 
-Hardening pass on the edge family (criterion a REQ-layer backing; criterion b AC-set sufficiency; criterion c chain consistency lint-zero on pass 1 and pass 2).
-
-- Added REQ-006 (zone resolution via the vault seam; AUD-mandatory-when-gated) and REQ-007 (public-hostname template expansion at apply with malformed and duplicate refusals). Closes review P0 findings F-1 (cloudflare-zone-secret elicit had no covering requirement) and F-2 (public-hostname-template elicit had no covering requirement). Neither elicit or capability token was removed; both are now backed by a `must`-priority requirement.
+Adds REQ-layer backing for zone resolution and hostname expansion, and extends the AC set to cover every documented failure path.
+- Added REQ-006 (zone resolution via the vault seam; AUD-mandatory-when-gated) and REQ-007 (public-hostname template expansion at apply with malformed and duplicate refusals). Neither elicit or capability token was removed; both are now backed by a `must`-priority requirement.
 - Added TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply naming the apply-time responsibilities for zone resolution, hostname expansion and AUD-mandatory refusals.
 - Added user stories US-39109 (four apply-time ACs across the zone-resolution and AUD-mandatory-when-gated paths) and US-39110 (three apply-time ACs across the hostname-template expansion, malformed and duplicate paths).
 - Added the following failure-path ACs to existing stories: AC-tunnel-cloudflaredReady on US-39102 (boot event observation; closes F-4 event-name inconsistency by naming both `cloudflaredReady` (process boot) and `tunnelConnectorUp` (per-connector) as distinct events); AC-tunnel-connectorPrecedence on US-39101 (four-combination precedence with two apply-refusal codes; closes F-5); four `AC-tunnel-accessGatedReject*/Accept*` ACs on US-39106 covering missing, invalid and wrong-audience JWT paths plus the valid-audience accept path (closes F-6); AC-tunnel-credentialsHostMode and AC-tunnel-credentialsTrackedTreeScan on US-39108 (closes F-7).
@@ -33,7 +31,7 @@ Hardening pass on the edge family (criterion a REQ-layer backing; criterion b AC
 - Guide updated in the "Hostname mode: when to reach for Access-gated vs public-hostname" section to name the AUD-mandatory-when-gated rule; the earlier "Graceful degrade" wording is retired.
 - De-identified operator-internal names across the blueprint (operator-internal path prefixes renamed to `vault/*`; other in-house references neutralised) to keep the shipped package customer-facing.
 - Chain-consistency lint (`rcf define blueprint lint-consistency`) reports 0 findings on both passes for this blueprint.
-- Review fix pass (2026-09-09): split every bundled single-AC story on a per-failure-path basis so each named path (SIMULATE_MANIFEST_INVALID_TUNNEL_ID / _CREDENTIALS_INLINE / _MISSING_CATCHALL on US-39103; SIMULATE_INGRESS_INVALID on US-39104 with the happy path split off; SIMULATE_ORIGIN_PORT_OPEN on US-39105 with the happy path split off; SIMULATE_AUD_DROP on US-39107 with the happy path split off) is its own AC on the owning story with a concrete oracle (probe verdict + named field) and an `ownerRef` into the owning TAC. Vendor citations added on the US-39106 four AUD ACs (Cloudflare Access self-hosted-public-app-owned literals) and on the vendor cloudflared local-configuration-file reference (US-39104); the four US-39106 AUD ACs and AC-tunnel-hostnameTemplateExpand on US-39110 re-marked `template` naming the values the applying agent sets (elicited access-aud tag; ingress rule service names and resolved zone). Filled `ownerRef` and given/when/then on AC-tunnel-connectorShape (US-39101; closes F-5). Filled given/when/then on AC-tunnel-accessGated (US-39106; closes F-6). Reworded the US-39102 title and `iWant` to name both `cloudflaredReady` (boot) and `tunnelConnectorUp` (per-connector) as distinct events (closes F-7). Added `## Zone resolution` and `## Public-hostname template expansion` sections to the shipped guide (closes F-8).
+- Split every bundled single-AC story on a per-failure-path basis so each named path (SIMULATE_MANIFEST_INVALID_TUNNEL_ID / _CREDENTIALS_INLINE / _MISSING_CATCHALL on US-39103; SIMULATE_INGRESS_INVALID on US-39104 with the happy path split off; SIMULATE_ORIGIN_PORT_OPEN on US-39105 with the happy path split off; SIMULATE_AUD_DROP on US-39107 with the happy path split off) is its own AC on the owning story with a concrete oracle (probe verdict + named field) and an `ownerRef` into the owning TAC. Vendor citations added on the US-39106 four AUD ACs (Cloudflare Access self-hosted-public-app-owned literals) and on the vendor cloudflared local-configuration-file reference (US-39104); the four US-39106 AUD ACs and AC-tunnel-hostnameTemplateExpand on US-39110 marked `template` naming the values the applying agent sets (elicited access-aud tag; ingress rule service names and resolved zone). Filled `ownerRef` and given/when/then on AC-tunnel-connectorShape (US-39101). Filled given/when/then on AC-tunnel-accessGated (US-39106). Reworded the US-39102 title and `iWant` to name both `cloudflaredReady` (boot) and `tunnelConnectorUp` (per-connector) as distinct events. Added `## Zone resolution` and `## Public-hostname template expansion` sections to the shipped guide.
 
 
 ## 1.0.1 - 2026-09-08

package/blueprints/edge-cloudflare-tunnel/README.md

@@ -124,8 +124,7 @@ Graceful degrade: when Access is not applied (the `zeroTrustGate` capability is
 `origin/main` or the applying project simply does not want the gate),
 the blueprint still ships in public-hostname mode. The probe assertion
 runs on both fixture variants so the shape flip is proven on every
-reviewer boot.
-
+operator boot.
 ## No-public-ports rule
 
 The deploy-hetzner-server firewall on a `cloudHost` allows 22 unconditionally and 80/443

package/blueprints/edge-cloudflare-tunnel/docs/topics.md

@@ -59,7 +59,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 39101-39108 sit at the LOW end of the 39101-39899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from an edge-cloudflare-tunnel REQ id into the number 39108 would collide against the shipped US-39108; band headroom (39109-39899) leaves that space.
+US 39101-39108 sit at the LOW end of the 39101-39899 band on purpose. A project-side story mechanically derived from an edge-cloudflare-tunnel REQ id into the number 39108 would collide against the shipped US-39108; band headroom (39109-39899) leaves that space.
 
 Edge-cloudflare-tunnel suffixes for this blueprint use the 4001-4003 block, continuing the widening pattern (deploy-hetzner-server 3801-3804 for the host sibling, platform-docker-compose-host 3901-3904 for the compose-host sibling).
 

package/blueprints/edge-cloudflare-turnstile/CHANGELOG.md

@@ -22,8 +22,7 @@ Capability token named in the requirements layer; single-mechanism story legalit
 
 ## 1.1.0 - 2026-09-09
 
-hardening pass edge (criterion a REQ-layer backing; criterion b AC-set sufficiency; criterion c chain consistency lint-zero on pass 1 and pass 2).
-
+Adds REQ-layer backing and extends the AC set to cover every documented failure path.
 - Normalised the `cf-turnstile-response` token casing across the shipped guide, README, REQs, TACs and user stories to the lowercase form-field literal Cloudflare's client-side rendering and server-side validation docs specify verbatim (closes specimen F-1 in the vendor-fact direction under 7b; earlier interim pass mistakenly took the pre-existing TAC-3601 title-case as canonical). TAC-3601 owns the literal with a `vendorCitation` and US-35101 AC-35101-1 is re-marked `fixed` with the same citation. The consistency-lint AC-3 spec test continues to assert the specimen is closed on the shipped blueprint.
 - Added failure-path ACs to US-35102 (AC-35102-2..4 close F-3: missing sitekey, missing secret, only-one-of-pair boot refusal) and US-35103 (AC-35103-2..6 close F-2: siteverify timeout, network failure, non-2xx upstream, invalid JSON, missing success-field fail-closed).
 - Every REQ now carries `deliveredBy`; every AC carries `disposition` (`AC-35102-1` and `AC-35103-1` marked `fixed` with vendor citations to the Cloudflare Turnstile testing docs); ACs referencing owner-owned literals carry `ownerRef`.
@@ -31,7 +30,7 @@ hardening pass edge (criterion a REQ-layer backing; criterion b AC-set sufficien
 
 
 All notable changes to `edge-cloudflare-turnstile` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
-- Review fix pass (2026-09-09): flipped `cf-turnstile-response` to the lowercase vendor literal per Cloudflare's client-side rendering and server-side validation docs across guide, README, CHANGELOG, REQ-001, REQ-003, TAC-3601, TAC-3602, US-35101, US-35104 and US-35105 (closes F-1 blocker in the vendor-fact direction); TAC-3601 responsibility 3 owns the literal and US-35101 AC-35101-1 re-marked `fixed` with `vendorCitation` at the client-side-rendering page. Added `AC-35101-2` for the always-fail test-sitekey mount branch (`fixed`, `vendorCitation` at the Cloudflare testing docs). Split US-35104 into canonical-shape (guard-shape-scan) and missing-token-runtime (400 turnstile.token-missing) ACs each with a concrete oracle and an `ownerRef` into TAC-3602. Vendor citations added on US-35101 AC-35101-1/2, US-35102 AC-35102-1, US-35103 AC-35103-1, US-35104 AC-35104-2, US-35105 AC-35105-2 and US-35106 AC-35106-1. Every AC in this blueprint is `fixed` (refusal codes, event-secrecy record shapes, probe verdicts and vendor test-key observables are all mechanism-invariant). Genuinely single-mechanism stories (US-35106, US-35107, US-35108) carry the section-7a note inside the story `description` field, not in a schema-illegal new field.
+- Flipped `cf-turnstile-response` to the lowercase vendor literal per Cloudflare's client-side rendering and server-side validation docs across guide, README, CHANGELOG, REQ-001, REQ-003, TAC-3601, TAC-3602, US-35101, US-35104 and US-35105; TAC-3601 responsibility 3 owns the literal and US-35101 AC-35101-1 is marked `fixed` with `vendorCitation` at the client-side-rendering page. Added `AC-35101-2` for the always-fail test-sitekey mount branch (`fixed`, `vendorCitation` at the Cloudflare testing docs). Split US-35104 into canonical-shape (guard-shape-scan) and missing-token-runtime (400 turnstile.token-missing) ACs each with a concrete oracle and an `ownerRef` into TAC-3602. Vendor citations added on US-35101 AC-35101-1/2, US-35102 AC-35102-1, US-35103 AC-35103-1, US-35104 AC-35104-2, US-35105 AC-35105-2 and US-35106 AC-35106-1. Every AC in this blueprint is `fixed` (refusal codes, event-secrecy record shapes, probe verdicts and vendor test-key observables are all mechanism-invariant). Genuinely single-mechanism stories (US-35106, US-35107, US-35108) carry the section-7a note inside the story `description` field, not in a schema-illegal new field.
 
 
 ## 1.0.0 (2026-09-07)

package/blueprints/edge-cloudflare-turnstile/docs/topics.md

@@ -59,7 +59,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 35101-35108 sit at the LOW end of the 35101-35899 band on purpose (watchpost run-4 lesson). ADR/TAC suffixes for this blueprint use the 3601-3699 block, continuing the shelf pattern.
+US 35101-35108 sit at the LOW end of the 35101-35899 band on purpose. ADR/TAC suffixes for this blueprint use the 3601-3699 block, continuing the shelf pattern.
 
 ## Shared expectations for future composing blueprints
 

package/blueprints/email-smtp-resend/CHANGELOG.md

@@ -1,8 +1,24 @@
+# Changelog
+
+## 1.1.7 - 2026-09-11
+
+unverified-sender-refusal AC-4102-1 and AC-4102-2 rows are de-claimed to conformanceOnly. The refusal is driven by the local catch-all SMTP fixture (fixture-as-engine) and carries no Resend-returned message id, so the identifier half of the strict-evidence contract is not satisfied here. The live real-account-resend-send row (AC-4101-2) is unchanged.
+
+## 1.1.6 - 2026-09-11
+
+unverified-sender-refusal AC-4102-1 verdict now requires the complete refusal outcome shape owned on TAC-401.interfaces.send: providerStatus a valid positive integer AND providerMessageId===null AND thrownMessage===null, alongside the RESEND_SENDER_UNVERIFIED class prefix.
+
 # email-smtp-resend CHANGELOG
 
+## 1.1.5 - 2026-09-11
+
+Adds a contributions/probes/ pack (smtp-round-trip, unverified-sender-refusal, real-account-resend-send) with a fixture-side send adapter (realises TAC-401.interfaces.send), a catch-all SMTP provider seam and a Resend REST provider seam under packages/rcf-lite/test/fixtures/probe-pack-email-smtp-resend/. Probes run against the fixture on Node 24 and against real Resend on the account-bound branch (CI_HAS_RESEND_ACCOUNT gate + RESEND_API_KEY, one variable per skip row).
+
+Anchoring: unverified-sender-refusal anchors AC-4102-1 (adapter classifies the fixture's 550 5.7.1 refusal to a RESEND_SENDER_UNVERIFIED-prefixed error string) and AC-4102-2 (recipient, subject, body do not appear on the returned error string, on any emitted log line, or on any thrown exception; server accepted zero messages on the unverified path). real-account-resend-send anchors AC-4101-2; the row verdict requires ok=true, error=null, a non-empty providerMessageId AND providerStatus to be an integer in the accepted 200-299 range. smtp-round-trip de-claims (conformanceOnly, anchorAcId=null) with the limitation naming AC-4101-3: the row observes a local catch-all SMTP dispatch via a helper, not a call through the adapter and not the Resend endpoint. probe-utils normalisation and thrown-error rows carry an evidence object; the fallback anchorAcId is null.
+
 ## 1.1.3 - 2026-09-10
 
-Second closure fix on the dimension-d ownership sweep for REQ-001: removed the send-signature and outcome-field restatements from `AC-4101-2` (description and then-clause), `AC-4102-1` (description and then-clause), and the guide's "What a good outcome looks like" bullets; each surface now references the outcome record owned on `TAC-401-email-smtp-resend-send-adapter.interfaces.send` and, where relevant, the classification owned on `responsibilities[3]`. US-4101 and US-4102 patch-bumped. Chain-consistency lint zero on pass 1 and pass 2. Third-pass residues cleared without a further bump: the AC-4101-2 and AC-4102-1 when-clauses now reference the send interface owned on `TAC-401-email-smtp-resend-send-adapter.interfaces.send` instead of restating the `adapter.send(...)` signature.
+Removed the send-signature and outcome-field restatements from `AC-4101-2` (description and then-clause), `AC-4102-1` (description and then-clause), and the guide's "What a good outcome looks like" bullets; each surface now references the outcome record owned on `TAC-401-email-smtp-resend-send-adapter.interfaces.send` and, where relevant, the classification owned on `responsibilities[3]`. The AC-4101-2 and AC-4102-1 when-clauses now reference the send interface owned on `TAC-401-email-smtp-resend-send-adapter.interfaces.send` instead of restating the `adapter.send(...)` signature. US-4101 and US-4102 patch-bumped.
 
 ## 1.1.2 - 2026-09-10
 
@@ -12,13 +28,13 @@ Dimension-d single-definition-ownership cleanup on REQ-001: REQ description now
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.1.0 (hardening pass, 2026-09-09)
+## 1.1.0 (2026-09-09)
 
 - Adds `elicits[]` with six apply-time answers: `smtp-host-ref`, `smtp-username-ref`, `smtp-password-ref`, `verified-sender-ref` (string placeholder references the send adapter resolves at boot per REQ-002), `webhook-signing-secret-ref` (string placeholder reference the WEBHOOK VERIFIER resolves per REQ-005 - owned by TAC-402, not TAC-401), `replay-tolerance-ms` (string milliseconds, default 300000; REQ-006).
-- Adds `deliveredBy` to every REQ (REQ-001/003/004 -> TAC-401 interfaces; REQ-002 -> TAC-401.interfaces.secretResolver; REQ-005 -> TAC-402.interfaces.verify; REQ-006 -> TAC-402.interfaces.eventIdStore). Closes 3 pass-2 lint findings.
-- Closes F-3 chain-contradiction specimen (webhook secret ownership): AC-4106-2 rewritten to name only the three SMTP references plus the verified-sender-address (owned by TAC-401.responsibilities[8]); AC-4106-3 added asserting the webhook signing secret is resolved by TAC-402 and does not appear in the send adapter's source.
-- Closes F-1 (transport class retry not asserted): adds AC-4103-4 (transient transport failure ECONNRESET succeeds on retry with the returned envelope id) and AC-4103-5 (exhausted retry -> RESEND_TRANSPORT_ERROR naming the class and attempt count).
-- Closes F-2 (backoff delay range not asserted): adds AC-4103-6 with a deterministic jitter source and clock, asserting scheduled delay under exponential full-jitter caps within [0, 250] for the first retry at the ADR-402 baseline; no delay negative, no delay above the 8000ms cap.
-- Closes F-4 (TTL expiry not asserted): adds AC-4105-3 asserting the eventIdStore `putIfAbsentWithExpiry` receives expiryMs equal to the configured replay tolerance window; a re-post inside the window is refused as duplicate, a re-post after the window expires is accepted.
+- Adds `deliveredBy` to every REQ (REQ-001/003/004 -> TAC-401 interfaces; REQ-002 -> TAC-401.interfaces.secretResolver; REQ-005 -> TAC-402.interfaces.verify; REQ-006 -> TAC-402.interfaces.eventIdStore).
+- Webhook secret ownership: AC-4106-2 rewritten to name only the three SMTP references plus the verified-sender-address (owned by TAC-401.responsibilities[8]); AC-4106-3 added asserting the webhook signing secret is resolved by TAC-402 and does not appear in the send adapter's source.
+- The transport class retry not asserted gap is fixed: adds AC-4103-4 (transient transport failure ECONNRESET succeeds on retry with the returned envelope id) and AC-4103-5 (exhausted retry -> RESEND_TRANSPORT_ERROR naming the class and attempt count).
+- The backoff delay range not asserted gap is fixed: adds AC-4103-6 with a deterministic jitter source and clock, asserting scheduled delay under exponential full-jitter caps within [0, 250] for the first retry at the ADR-402 baseline; no delay negative, no delay above the 8000ms cap.
+- The TTL expiry not asserted gap is fixed: adds AC-4105-3 asserting the eventIdStore `putIfAbsentWithExpiry` receives expiryMs equal to the configured replay tolerance window; a re-post inside the window is refused as duplicate, a re-post after the window expires is accepted.
 - Re-sweeps every existing AC's `disposition` per section 7b: ACs referencing placeholder references and the tolerance window flipped to `template` with `templateFillIns`; the remaining ACs stay `fixed`.
-- Review fix pass (F-4): adds `secretResolver` interface entry to TAC-402 (mirrors the TAC-401 shape) naming the boot-time secret-reference resolver the webhook verifier consumes; corrects TAC-402.responsibilities[5] cross-reference from AC-4106-2 to AC-4106-3 (the F-3 closure split webhook-secret ownership off from the SMTP-secrets AC and the responsibility trailer still cited the older AC); updates AC-4106-3.ownerRef from `TAC-402.interfaces.verify` to `TAC-402.interfaces.secretResolver` so the ownership pointer names the actual secret-resolution interface.
+- adds `secretResolver` interface entry to TAC-402 (mirrors the TAC-401 shape) naming the boot-time secret-reference resolver the webhook verifier consumes; corrects TAC-402.responsibilities[5] cross-reference from AC-4106-2 to AC-4106-3 (the earlier split of webhook-secret ownership off from the SMTP-secrets AC left the responsibility trailer citing the older AC); updates AC-4106-3.ownerRef from `TAC-402.interfaces.verify` to `TAC-402.interfaces.secretResolver` so the ownership pointer names the actual secret-resolution interface.

package/blueprints/email-smtp-resend/README.md

@@ -26,9 +26,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSes are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the send-contract shape, the SMTP transport choice, the four-class error taxonomy, the retry-and-backoff posture, the webhook signature verification, the replay defence, the boundary discipline on the SMTP client library and the secret references); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSes are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the send-contract shape, the SMTP transport choice, the four-class error taxonomy, the retry-and-backoff posture, the webhook signature verification, the replay defence, the boundary discipline on the SMTP client library and the secret references); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 Deliberately not contributed: the magic-link blueprint's auth routes themselves (they live on the magic-link blueprint; this blueprint is an ADAPTER only); the mail-adapter interface as a global topic (the interface belongs to the magic-link blueprint's `TAC-504`, not to this blueprint); an SMTP client library or an HTTP client library (project picks from what it already carries; the adapter injects the client at boot); a specific YAML or JSON schema library; a Secrets Manager client (composable with the shipped `security-secrets-management` blueprint or with a project-authored secret-reference resolver of the same shape); a shared event bus for delivery events (the verifier hands parsed events to a downstream handler the project realises; where those events go beyond the handler is a project concern); regulatory or compliance workflow (double-opt-in surfaces, unsubscribe UI, retention of consent records live outside this blueprint's scope); the Resend HTTP API path (project supersedes ADR-401 and swaps the adapter's internal client if the API path is preferred, without changing the interface the auth routes call).
 

package/blueprints/email-smtp-resend/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "email-smtp-resend",
-  "version": "1.1.3",
+  "version": "1.1.7",
   "category": "email",
   "elicits": [
     {
@@ -121,5 +121,6 @@
       "kind": "adr",
       "path": "adrs/adr-402-email-smtp-resend-retry-and-backoff-posture.json"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11"
 }

package/blueprints/email-smtp-resend/contributions/probes/probe-utils.mjs

@@ -0,0 +1,50 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-email-smtp-resend');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/email-smtp-resend');
+export const DECLARED_ENV = new Set(['RCF_FIXTURE_SMTP_PORT', 'CI_HAS_RESEND_ACCOUNT', 'RESEND_API_KEY']);
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+export function isSkipped(results) { return Array.isArray(results) && results.length > 0 && results.every((r) => r.accountBoundSkipped === true); }
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const normalised = (Array.isArray(results) && results.length > 0)
+    ? results
+    : [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: 'no checks ran', evidence: { reason: 'no checks ran', probeName, runAt: new Date().toISOString(), engine } }];
+  const raw = aggregate(normalised); const aggregateVerdict = isSkipped(normalised) ? 'pass' : raw;
+  const report = { slug: 'email-smtp-resend', probeName, runAt: new Date().toISOString(), engine, results: normalised, aggregateVerdict, ...(extra ?? {}) };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: `probe threw: ${err?.message ?? err}`, evidence: { thrown: true, message: err?.message ?? String(err), name: err?.name ?? 'Error', probeName, runAt: new Date().toISOString(), engine } }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err?.stack ?? err}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+function portFrom(v) { if (v === undefined || v === '') return 0; const n = Number(v); return Number.isInteger(n) && n >= 0 && n <= 65535 ? n : 0; }
+export function envPort(name) {
+  if (name === 'RCF_FIXTURE_SMTP_PORT') return portFrom(process.env.RCF_FIXTURE_SMTP_PORT);
+  return 0;
+}

package/blueprints/email-smtp-resend/contributions/probes/real-account-resend-send.mjs

@@ -0,0 +1,50 @@
+// Real-account Resend send probe for email-smtp-resend.
+//
+// Routes the send through the fixture email-delivery adapter (which
+// realises TAC-401.interfaces.send) with Resend REST as the provider
+// seam behind it. The probe observes the adapter's outcome record
+// (ok, providerStatus, providerMessageId) and asserts AC-4101-2's
+// success shape, including that providerStatus is a positive integer
+// in the accepted 200-299 range (per TAC-401's accepted status
+// contract) alongside a non-empty providerMessageId.
+import { createSendAdapter, createResendRestProvider } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-email-smtp-resend/src/send-adapter.mjs';
+
+export const anchorAcId = 'AC-4101-2';
+export const accountBound = true;
+const AC2 = 'A successful send resolves the outcome record owned';
+
+function skipResult(reason, detail) {
+  return {
+    results: [{ anchorAcId: null, accountBoundSkipped: true, reason, verdict: 'pass', detail, evidence: { reason, declared: 'gate variable' } }],
+    extra: {
+      accountBoundSkipped: true, reason,
+      envDeclared: ['CI_HAS_RESEND_ACCOUNT', 'RESEND_API_KEY'],
+      vendorFact: { url: 'https://resend.com/docs/dashboard/emails/send-test-emails', verifiedOn: '2026-09-11' },
+    },
+  };
+}
+
+export default async function runProbe() {
+  if (process.env.CI_HAS_RESEND_ACCOUNT !== 'true') return skipResult('CI_HAS_RESEND_ACCOUNT', `accountBoundSkipped: CI_HAS_RESEND_ACCOUNT is not set to true; the adapter did not dispatch.`);
+  if (!process.env.RESEND_API_KEY) return skipResult('RESEND_API_KEY', `accountBoundSkipped: RESEND_API_KEY unset; the adapter did not dispatch.`);
+  const results = [];
+  const provider = createResendRestProvider({ apiKey: process.env.RESEND_API_KEY, from: 'onboarding@resend.dev' });
+  const adapter = createSendAdapter({ provider });
+  const outcome = await adapter.send({ to: 'delivered@resend.dev', subject: 'rcf-lite criterion e probe', textBody: 'criterion e probe send at ' + new Date().toISOString(), htmlBody: null });
+  const statusIsAccepted = typeof outcome.providerStatus === 'number' && Number.isInteger(outcome.providerStatus) && outcome.providerStatus >= 200 && outcome.providerStatus < 300;
+  results.push({
+    anchorAcId: 'AC-4101-2',
+    verdict: outcome.ok === true && statusIsAccepted && typeof outcome.providerMessageId === 'string' && outcome.providerMessageId.length > 0 && outcome.error === null ? 'pass' : 'fail',
+    detail: `${AC2} on TAC-401.interfaces.send  -  observed adapter.send() returned { ok: ${outcome.ok}, providerStatus: ${outcome.providerStatus}, providerMessageId: '${outcome.providerMessageId}', error: ${outcome.error === null ? 'null' : `'${outcome.error}'`} }; providerStatus is an integer in the accepted 200-299 range: ${statusIsAccepted}; the adapter dispatched through Resend REST as the provider seam.`,
+    evidence: { ok: outcome.ok, providerStatus: outcome.providerStatus, providerMessageId: outcome.providerMessageId, error: outcome.error, statusIsAccepted },
+  });
+  return {
+    results,
+    extra: {
+      envDeclared: ['CI_HAS_RESEND_ACCOUNT', 'RESEND_API_KEY'],
+      sentTo: 'delivered@resend.dev', sentFrom: 'onboarding@resend.dev',
+      adapterOutcome: outcome,
+      vendorFact: { url: 'https://resend.com/docs/dashboard/emails/send-test-emails', verifiedOn: '2026-09-11' },
+    },
+  };
+}

package/blueprints/email-smtp-resend/contributions/probes/run-real-account-resend-send.mjs

@@ -0,0 +1,3 @@
+import runProbe from './real-account-resend-send.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('real-account-resend-send', { kind: 'https', driver: 'Resend REST API (live)', healthy: true }, runProbe);

package/blueprints/email-smtp-resend/contributions/probes/run-smtp-round-trip.mjs

@@ -0,0 +1,3 @@
+import runProbe from './smtp-round-trip.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('smtp-round-trip', { kind: 'smtp', driver: 'node:net catch-all SMTP on 127.0.0.1', healthy: true }, runProbe);

package/blueprints/email-smtp-resend/contributions/probes/run-unverified-sender-refusal.mjs

@@ -0,0 +1,3 @@
+import runProbe from './unverified-sender-refusal.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('unverified-sender-refusal', { kind: 'smtp', driver: 'node:net catch-all SMTP on 127.0.0.1', healthy: true }, runProbe);

package/blueprints/email-smtp-resend/contributions/probes/smtp-round-trip.mjs

@@ -0,0 +1,43 @@
+// SMTP round-trip probe for email-smtp-resend.
+//
+// Boots the fixture SMTP catch-all on 127.0.0.1 and dials it via the
+// fixture's sendViaSmtp helper. Asserts the transcript reports 250 Ok
+// on MAIL/RCPT/DATA and that the server's recorded envelope carries
+// the sender, recipient and body bytes.
+//
+// The nearest shipped AC is AC-4101-3 ("Exactly one SMTP submission
+// is dispatched per adapter call on the successful path"). This row
+// observes a local catch-all SMTP dispatch, not Resend's SMTP endpoint,
+// and does not go through the send adapter. Row de-claimed
+// (conformanceOnly, anchorAcId=null) with the limitation naming
+// AC-4101-3.
+import { createCatchAllSmtp, sendViaSmtp } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-email-smtp-resend/src/smtp-catch-all.mjs';
+import { envPort } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-4101-3';
+export const accountBound = false;
+const LIM_4101_3 = `AC-4101-3: requires exactly one SMTP submission per adapter call on the successful path. This row observes a local catch-all SMTP dispatch via a helper (sendViaSmtp), not a call through the send adapter, and the transport is not the Resend SMTP endpoint.`;
+
+export default async function runProbe() {
+  const srv = createCatchAllSmtp();
+  const { port } = await srv.listen(envPort('RCF_FIXTURE_SMTP_PORT'));
+  const results = [];
+  let outcome;
+  try {
+    outcome = await sendViaSmtp({ host: '127.0.0.1', port, from: 'probe@verified.example', to: 'x@example.com', subject: 'probe', body: 'hi\n' });
+    const queuedLine = outcome.transcript.find((l) => l.startsWith('250') && l.includes('queued as '));
+    const idFromServer = queuedLine ? queuedLine.split('queued as ')[1] : null;
+    const recorded = srv.messages[0];
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_4101_3,
+      verdict: outcome.ok && queuedLine && recorded && recorded.from === 'probe@verified.example' && recorded.to[0] === 'x@example.com' ? 'pass' : 'fail',
+      detail: `observed local SMTP round-trip via sendViaSmtp ok=${outcome.ok}; queuedId=${idFromServer}; server recorded envelope from=${recorded?.from} to=${recorded?.to?.[0]}. Not the Resend endpoint; not through the send adapter.`,
+      evidence: { queuedLine, messageId: idFromServer, envelope: recorded ? { from: recorded.from, to: recorded.to, dataExcerpt: recorded.dataText?.slice(0, 200) } : null },
+    });
+  } finally {
+    await srv.close();
+  }
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_SMTP_PORT'], port, transcript: outcome?.transcript } };
+}

package/blueprints/email-smtp-resend/contributions/probes/unverified-sender-refusal.mjs

@@ -0,0 +1,99 @@
+// Unverified-sender-refusal probe for email-smtp-resend.
+//
+// Routes an offline unverified-sender send through the fixture
+// email-delivery adapter (which realises TAC-401.interfaces.send)
+// with a catch-all SMTP provider seam behind it. The catch-all
+// fixture is booted in unverified-sender mode, so the underlying
+// SMTP reply is 550 5.7.1; the provider seam classifies that to
+// RESEND_SENDER_UNVERIFIED, and the ADAPTER returns the refusal
+// outcome record { ok:false, providerStatus, providerMessageId:null,
+// error: 'RESEND_SENDER_UNVERIFIED: ...' }.
+//
+// AC-4102-1: the adapter's `error` begins with 'RESEND_SENDER_UNVERIFIED'
+// (adapter refusal outcome).
+// AC-4102-2: recipient, subject, textBody do not appear on the
+// adapter's returned `error`, on any line emitted to the adapter's
+// injected log sink during the call, or on any exception the adapter
+// throws.
+// Every detail line begins with the first eight words of the AC text.
+import { createCatchAllSmtp } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-email-smtp-resend/src/smtp-catch-all.mjs';
+import { createSendAdapter, createCatchAllSmtpProvider } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-email-smtp-resend/src/send-adapter.mjs';
+import { envPort } from './probe-utils.mjs';
+
+// the strict-evidence contract tightening: the refusal is driven by a local catch-all
+// SMTP fixture, which is a fixture-as-engine substitute for the
+// Resend provider; the outcome record carries no Resend-returned
+// message id or request id (providerMessageId is required to be
+// null on the refusal). Both rows are de-claimed to conformanceOnly
+// naming AC-4102-1 and AC-4102-2. The Resend API is not driven for
+// this refusal because there is no way to elicit an unverified-sender
+// refusal on Resend without an unverified sender identity available
+// to the harness.
+// The module anchor names the AC this probe observes as a property;
+// individual rows may still de-claim (conformanceOnly) when the
+// evidence shape does not carry an engine-returned identifier.
+export const anchorAcId = 'AC-4102-1';
+export const accountBound = false;
+const AC1 = 'When the provider refuses the submission because the';
+const AC2 = 'On any adapter refusal, the recipient address, subject,';
+const LIM_4102_1 = `AC-4102-1: requires the refusal outcome shape returned by the Resend send interface when the provider refuses the submission. This probe drives a local catch-all SMTP fixture (fixture-as-engine), not the Resend API, and the adapter's error string is derived content rather than a Resend-returned identifier; the identifier half of the strict-evidence contract is not satisfied here.`;
+const LIM_4102_2 = `AC-4102-2: requires the refusal outcome from the same Resend send interface to hold no recipient/subject/body echo across the returned error, adapter log lines, and thrown exception. This probe observes the property against the local catch-all SMTP fixture; the row is de-claimed because the observation is fixture-as-engine and carries no Resend-returned identifier.`;
+
+export default async function runProbe() {
+  const srv = createCatchAllSmtp();
+  srv.setUnverifiedSenderMode(true);
+  const { port } = await srv.listen(envPort('RCF_FIXTURE_SMTP_PORT'));
+  const results = [];
+  const distinctiveRecipient = 'distinct-recipient@example.test';
+  const distinctiveSubject = 'DISTINCT-SUBJECT-LINE-XYZ';
+  const distinctiveBody = 'DISTINCT-BODY-BYTES-ABC123-DO-NOT-LEAK';
+  const emittedLines = [];
+  let outcome;
+  let thrownMessage = null;
+  try {
+    const provider = createCatchAllSmtpProvider({ host: '127.0.0.1', port, from: 'unverified@somewhere.example' });
+    const adapter = createSendAdapter({ provider, logSink: (l) => emittedLines.push(l) });
+    try {
+      outcome = await adapter.send({ to: distinctiveRecipient, subject: distinctiveSubject, textBody: distinctiveBody, htmlBody: null });
+    } catch (e) {
+      thrownMessage = e?.message ?? String(e);
+    }
+    const errorString = outcome?.error ?? '';
+    const startsWithClass = errorString.startsWith('RESEND_SENDER_UNVERIFIED');
+    const recipientInError = errorString.toLowerCase().includes(distinctiveRecipient.toLowerCase());
+    const subjectInError = errorString.includes(distinctiveSubject);
+    const bodyInError = errorString.includes(distinctiveBody);
+    const recipientInLogs = emittedLines.some((l) => l.toLowerCase().includes(distinctiveRecipient.toLowerCase()));
+    const subjectInLogs = emittedLines.some((l) => l.includes(distinctiveSubject));
+    const bodyInLogs = emittedLines.some((l) => l.includes(distinctiveBody));
+    const recipientInThrown = Boolean(thrownMessage && thrownMessage.toLowerCase().includes(distinctiveRecipient.toLowerCase()));
+    const subjectInThrown = Boolean(thrownMessage && thrownMessage.includes(distinctiveSubject));
+    const bodyInThrown = Boolean(thrownMessage && thrownMessage.includes(distinctiveBody));
+    const cleanCall = !recipientInError && !subjectInError && !bodyInError && !recipientInLogs && !subjectInLogs && !bodyInLogs && !recipientInThrown && !subjectInThrown && !bodyInThrown;
+    // AC-4102-1 refusal outcome: the strict-evidence contract requires the row to
+    // assert BOTH a valid providerStatus AND providerMessageId===null
+    // alongside the RESEND_SENDER_UNVERIFIED class prefix; the shape
+    // is owned on TAC-401-email-smtp-resend-send-adapter.interfaces.send.
+    const providerStatusValid = typeof outcome?.providerStatus === 'number' && Number.isInteger(outcome.providerStatus) && outcome.providerStatus > 0;
+    const providerMessageIdIsNull = outcome?.providerMessageId === null;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_4102_1,
+      verdict: outcome?.ok === false && startsWithClass && providerStatusValid && providerMessageIdIsNull && thrownMessage === null ? 'pass' : 'fail',
+      detail: `observed adapter.send() against the local catch-all SMTP fixture: ok=${outcome?.ok} providerStatus=${outcome?.providerStatus} providerStatusValid=${providerStatusValid} providerMessageId=${JSON.stringify(outcome?.providerMessageId ?? null)} providerMessageIdIsNull=${providerMessageIdIsNull} error='${errorString}' startsWithClass=${startsWithClass} thrown=${thrownMessage === null ? 'null' : `'${thrownMessage}'`}. Fixture-as-engine; Resend API not called for this refusal.`,
+      evidence: { ok: outcome?.ok, providerStatus: outcome?.providerStatus, providerStatusValid, providerMessageIdIsNull, errorString, startsWithClass, thrownMessage, code: outcome?.providerStatus, messageId: outcome?.providerMessageId ?? null, lastLine: emittedLines[emittedLines.length - 1] ?? null, bodyExcerpt: `refusal ok=${outcome?.ok} providerStatus=${outcome?.providerStatus} error='${errorString}'` },
+    });
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_4102_2,
+      verdict: cleanCall && srv.messages.length === 0 ? 'pass' : 'fail',
+      detail: `observed recipient/subject/body in adapter.error=${recipientInError}/${subjectInError}/${bodyInError}; in emitted log lines=${recipientInLogs}/${subjectInLogs}/${bodyInLogs}; in thrown exception=${recipientInThrown}/${subjectInThrown}/${bodyInThrown}; server accepted messages=${srv.messages.length} (must be 0 on unverified-sender refusal). Fixture-as-engine; Resend API not called for this refusal.`,
+      evidence: { recipientInError, subjectInError, bodyInError, recipientInLogs, subjectInLogs, bodyInLogs, recipientInThrown, subjectInThrown, bodyInThrown, serverAcceptedMessages: srv.messages.length, errorString, recipientInRefusal: recipientInError, lastLine: emittedLines[emittedLines.length - 1] ?? null, emittedLines, bodyExcerpt: `cleanCall=${cleanCall} serverAcceptedMessages=${srv.messages.length}` },
+    });
+  } finally {
+    await srv.close();
+  }
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_SMTP_PORT'], port, adapterOutcome: outcome, emittedLogLines: emittedLines, thrownMessage } };
+}

package/blueprints/email-smtp-resend/docs/topics.md

@@ -10,7 +10,7 @@ The neutrality rule (round-2 amendment) applies: `email-smtp-resend` ships alone
 
 ## Id number bands (registry bootstrap)
 
-AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is ratified policy (2026-08-19); this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands.
+AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is policy; this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands.
 
 This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
 
@@ -55,8 +55,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 4101-4106 sit at the LOW end of the 4101-4899 band on purpose. A project-side story that mechanically derives from an email-smtp-resend REQ id into the number `4106` (leading `4` + sequence `106`) would collide against email-smtp-resend-US-4106 in this package; the band leaves headroom at the HIGH end (US 4181-4899) so a project's own stories anchored to email-smtp-resend REQs can allocate without conflict. The watchpost run4 lesson applies here too.
-
+US 4101-4106 sit at the LOW end of the 4101-4899 band on purpose. A project-side story that mechanically derives from an email-smtp-resend REQ id into the number `4106` (leading `4` + sequence `106`) would collide against email-smtp-resend-US-4106 in this package; the band leaves headroom at the HIGH end (US 4181-4899) so a project's own stories anchored to email-smtp-resend REQs can allocate without conflict.
 ## Shared expectations for future composing blueprints
 
 - The mail-adapter contract itself is owned by the magic-link blueprint's `TAC-504-security-auth-magic-link-email-delivery-adapter`, not by this blueprint. A sibling `email-smtp-<othervendor>` blueprint that plugs into the same slot inherits the four-class error taxonomy (`RESEND_*` codes generalise to a `<VENDOR>_*` prefix on the sibling; the class semantics stay the same), the retry-and-backoff posture (ADR-402 is a supersede target), and the webhook signature-and-replay discipline (the header names, the algorithm identifier, and the tolerance window remain configuration references; the vendor's specifics live on the sibling's own `docs/topics.md`).