rcf-lite 0.27.0 → 0.28.0

package/blueprints/jobs-background/contributions/probes/retry-and-fail-real-account.mjs

@@ -0,0 +1,355 @@
+/**
+ * Retry-and-fail real-account probe (live-engine coverage).
+ *
+ * Exercises REAL Cloudflare Queues end-to-end through the vendor's
+ * pull-consumer + dead-letter-queue mechanism (per
+ * https://developers.cloudflare.com/queues/configuration/pull-consumers/
+ * and https://developers.cloudflare.com/queues/configuration/dead-letter-queues/).
+ *
+ * Flow:
+ *   1. Mint a scratch queue (name minted at run time from a probe
+ *      constant plus a short random suffix; see the code below and
+ *      the run-notes.md in the evidence tree for the resolved name)
+ *      and a paired DLQ via the CF REST Queues API.
+ *   2. Attach an `http_pull` consumer to the main queue with
+ *      max_retries=3, dead_letter_queue=<dlq name>, visibility timeout
+ *      short (2 s) so the observation window stays tight. Attach an
+ *      `http_pull` consumer to the DLQ so a subsequent pull can
+ *      positively record DLQ landing.
+ *   3. Publish one message.
+ *   4. Pull, retry, repeat until the message no longer appears on the
+ *      primary queue (Cloudflare moved it to the DLQ after
+ *      max_retries+1 deliveries). Record the observed attempts on each
+ *      pull.
+ *   5. Pull the DLQ and assert the message id landed there.
+ *   6. Teardown: delete both queues; confirm each is absent from the
+ *      account queue listing.
+ *
+ * Skip on missing account creds: exactly one variable per skip row.
+ *
+ * Row anchoring:
+ *  - The account-bound skip row anchors AC-jobs-retryOnHandlerFailure
+ *    (the shipped retry AC) with `accountBoundSkipped: true` and a
+ *    `reason` naming the one unset gate variable.
+ *  - Every non-skip row is CONFORMANCE-ONLY with `anchorAcId: null`
+ *    and a `limitation` naming the nearest shipped AC id and the
+ *    property it states that this probe does NOT positively observe:
+ *      - Provisioning row -> AC-jobs-requiresQueue (states init-time
+ *        queue requirement; this row records vendor queue creation).
+ *      - Attempts-counter row -> AC-jobs-retryOnHandlerFailure (states
+ *        the applied in-memory queue redelivery and three jobStarted
+ *        events on the sink; this row records Cloudflare Queues'
+ *        vendor attempts counter, not the sink events).
+ *      - DLQ landing row -> AC-30109-1 (states DLQ-producer invocation
+ *        on the in-memory driver; this row records real Cloudflare
+ *        Queues DLQ landing).
+ *      - Teardown row -> AC-jobs-requiresQueue (no AC states scratch
+ *        teardown; this row records DELETE + post-run absence).
+ */
+
+export const accountBound = true;
+export const DECLARED_ENV = Object.freeze([
+  'CI_HAS_CLOUDFLARE_ACCOUNT',
+  'CF_ACCOUNT_ID',
+  'CF_API_TOKEN',
+  'CF_API_BASE',
+]);
+
+// CF_API_BASE is a required declared variable per the endpoint-hosts rule;
+// no literal endpoint host in probe source. The runProbe() gate checks
+// it before use and returns an exact one-variable skip when unset.
+
+const AC_RETRY_FIRST8 = 'With SIMULATE_HANDLER_THROW=true set on the shared sample-app fixture,';
+const AC_REQUIRES_FIRST8 = 'On a fresh init scratch project with NO';
+const AC_PROVISION_LIMITATION = 'AC-jobs-requiresQueue: On a fresh init scratch project with NO messaging-queue provider applied, rcf-lite refuses to apply jobs-background with the stable message id jobs-background-no-queue. Not observed on this row: this row records vendor queue and DLQ provisioning on a real Cloudflare account, which the AC does not state (its property is CLI refusal at init time, not vendor-side queue creation).';
+const AC_ATTEMPTS_LIMITATION = 'AC-jobs-retryOnHandlerFailure: With SIMULATE_HANDLER_THROW=true set on the shared sample-app fixture, the retry-and-fail probe schedules a job whose handler throws a retryable error; the applied in-memory queue redelivers the message per retryPolicy.maxAttempts. Three jobStarted events fire on the sink with the same jobId and attempts counter 1, 2, 3; after the third failure jobFailed fires with a terminal error code and no further re-delivery follows. Not observed on this row: the AC states applied in-memory queue redelivery and jobStarted-on-sink events; this row records the vendor Cloudflare Queues attempts counter across pulls [0,1,2,3], not the jobStarted sink events the AC states.';
+const AC_DLQ_LIMITATION = 'AC-30109-1: The retry-and-fail probe report, after the three failing attempts, records the DLQ-producer invocation on the in-memory driver via a jobDeadLettered event carrying the terminal job id and the original job body. Not observed on this row: the AC pins the in-memory driver DLQ-producer invocation; this row records real Cloudflare Queues DLQ landing (backlog + payload-id match on a real DLQ), which the AC does not state.';
+const AC_TEARDOWN_LIMITATION = 'AC-jobs-requiresQueue: On a fresh init scratch project with NO messaging-queue provider applied, rcf-lite refuses to apply jobs-background with the stable message id jobs-background-no-queue. Not observed on this row: this row records scratch Cloudflare Queues DELETE + post-run absence via the account queue listing, which no jobs-background AC or REQ states; the AC used as a signpost is the nearest shipped AC on queue existence.';
+
+function skipRow(reason) {
+  return {
+    results: [{
+      anchorAcId: 'AC-jobs-retryOnHandlerFailure',
+      verdict: 'pass',
+      detail: `${AC_RETRY_FIRST8} - accountBound: skipped (${reason})`,
+      accountBoundSkipped: true,
+      reason,
+      evidence: { skip: true, reason, envDeclared: [...DECLARED_ENV] },
+    }],
+    extra: { accountBoundSkipped: true, reason, envDeclared: [...DECLARED_ENV] },
+  };
+}
+
+async function cf(apiBase, method, path, token, body) {
+  const res = await fetch(`${apiBase}${path}`, {
+    method,
+    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  const text = await res.text();
+  let json = null;
+  try { json = JSON.parse(text); } catch { /* keep raw */ }
+  return { httpStatus: res.status, json, raw: text };
+}
+
+function shortId() {
+  return Math.random().toString(36).slice(2, 8);
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+export default async function runProbe() {
+  const gate = process.env.CI_HAS_CLOUDFLARE_ACCOUNT;
+  if (gate == null || gate === '') return skipRow('CI_HAS_CLOUDFLARE_ACCOUNT unset');
+  if (gate !== 'true') return skipRow('CI_HAS_CLOUDFLARE_ACCOUNT (not "true")');
+  if (!process.env.CF_ACCOUNT_ID) return skipRow('CF_ACCOUNT_ID unset');
+  if (!process.env.CF_API_TOKEN) return skipRow('CF_API_TOKEN unset');
+  if (!process.env.CF_API_BASE) return skipRow('CF_API_BASE unset');
+
+  const API_BASE = process.env.CF_API_BASE;
+  const accountId = process.env.CF_ACCOUNT_ID;
+  const token = process.env.CF_API_TOKEN;
+  const short = shortId();
+  const queueName = `qa-e-jobs-q-${short}`;
+  const dlqName = `qa-e-jobs-dlq-${short}`;
+  const results = [];
+  const teardown = { deletePrimary: null, deleteDlq: null, primaryAbsent: null, dlqAbsent: null };
+  let qid = null;
+  let dlqId = null;
+  try {
+    // 1. mint DLQ first, then the main queue (main queue's consumer
+    // config references the DLQ by name).
+    const dlqCreate = await cf(API_BASE, 'POST', `/accounts/${accountId}/queues`, token, { queue_name: dlqName });
+    dlqId = dlqCreate.json && dlqCreate.json.result && dlqCreate.json.result.queue_id;
+    if (!dlqId) throw new Error(`DLQ create failed: httpStatus=${dlqCreate.httpStatus} body=${dlqCreate.raw}`);
+    const dlqConsumer = await cf(API_BASE, 'POST', `/accounts/${accountId}/queues/${dlqId}/consumers`, token, {
+      type: 'http_pull',
+      settings: { batch_size: 10, visibility_timeout_ms: 10000, max_retries: 3, retry_delay: 0 },
+    });
+    if (!(dlqConsumer.json && dlqConsumer.json.success)) throw new Error(`DLQ consumer attach failed: ${dlqConsumer.raw}`);
+
+    const primaryCreate = await cf(API_BASE, 'POST', `/accounts/${accountId}/queues`, token, { queue_name: queueName });
+    qid = primaryCreate.json && primaryCreate.json.result && primaryCreate.json.result.queue_id;
+    if (!qid) throw new Error(`primary create failed: httpStatus=${primaryCreate.httpStatus} body=${primaryCreate.raw}`);
+    const primaryConsumer = await cf(API_BASE, 'POST', `/accounts/${accountId}/queues/${qid}/consumers`, token, {
+      type: 'http_pull',
+      dead_letter_queue: dlqName,
+      settings: { batch_size: 10, visibility_timeout_ms: 2000, max_retries: 3, retry_delay: 0 },
+    });
+    if (!(primaryConsumer.json && primaryConsumer.json.success)) throw new Error(`primary consumer attach failed: ${primaryConsumer.raw}`);
+
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: AC_PROVISION_LIMITATION,
+      verdict: 'pass',
+      detail: `conformanceOnly (${AC_PROVISION_LIMITATION}) - provisioned scratch queue ${queueName} (id=${qid}) with DLQ ${dlqName} (id=${dlqId}), both with http_pull consumers, max_retries=3`,
+      evidence: {
+        queueName, dlqName,
+        primaryConsumerResponseMetadata: primaryConsumer.json && primaryConsumer.json.result,
+        dlqConsumerResponseMetadata: dlqConsumer.json && dlqConsumer.json.result,
+      },
+    });
+
+    // 3. publish one message
+    const publishJobId = `job-${short}`;
+    const pubBody = { jobId: publishJobId, jobName: 'send-welcome-email', jobInput: { userId: 7, email: 'ok@example.com' } };
+    const pub = await cf(API_BASE, 'POST', `/accounts/${accountId}/queues/${qid}/messages`, token, { body: pubBody, content_type: 'json' });
+    if (!(pub.json && pub.json.success)) throw new Error(`publish failed: ${pub.raw}`);
+
+    // 4. pull + retry loop; observe attempts increasing to 3, then absent
+    const attemptsObserved = [];
+    let messageIdObserved = null;
+    for (let i = 0; i < 20; i += 1) {
+      const pull = await cf(API_BASE, 'POST', `/accounts/${accountId}/queues/${qid}/messages/pull`, token, {
+        batch_size: 10,
+        visibility_timeout_ms: 2000,
+      });
+      const msgs = (pull.json && pull.json.result && pull.json.result.messages) || [];
+      if (msgs.length === 0) {
+        // Wait a bit; message may have been consumed by the retry cycle
+        // and not yet visible again, OR moved to DLQ.
+        attemptsObserved.push({ pulled: 0 });
+        await sleep(2500);
+        continue;
+      }
+      const m = msgs[0];
+      messageIdObserved = m.id;
+      attemptsObserved.push({ pulled: msgs.length, attempts: m.attempts, id: m.id });
+      // Retry: tell CF to reschedule with retry_delay=0
+      const ack = await cf(API_BASE, 'POST', `/accounts/${accountId}/queues/${qid}/messages/ack`, token, {
+        retries: [{ lease_id: m.lease_id, delay_seconds: 0 }],
+      });
+      if (!(ack.json && ack.json.success)) throw new Error(`ack retry failed: ${ack.raw}`);
+      await sleep(500);
+    }
+    // After the loop, message should be either absent (moved to DLQ) or
+    // in the DLQ. Poll the DLQ a few times to allow for the vendor's
+    // internal retry-to-DLQ transfer window.
+    let dlqMsgs = [];
+    let dlqBacklog = 0;
+    let dlqPullAttempts = 0;
+    for (let dp = 0; dp < 10; dp += 1) {
+      await sleep(2000);
+      dlqPullAttempts += 1;
+      const dlqPull = await cf(API_BASE, 'POST', `/accounts/${accountId}/queues/${dlqId}/messages/pull`, token, {
+        batch_size: 10,
+        visibility_timeout_ms: 30000,
+      });
+      dlqMsgs = (dlqPull.json && dlqPull.json.result && dlqPull.json.result.messages) || [];
+      dlqBacklog = (dlqPull.json && dlqPull.json.result && dlqPull.json.result.message_backlog_count) || dlqMsgs.length;
+      if (dlqMsgs.length > 0 || dlqBacklog >= 1) break;
+    }
+    // Cloudflare Queues assigns fresh transport message ids when a
+    // message lands in the DLQ, so a strict transport id-match is not
+    // achievable at the vendor surface. The probe carries its own
+    // application-level correlation id in the message body payload
+    // (`publishJobId`) and matches on that: the row is only a pass
+    // when the same payload jobId that was published to the primary
+    // is observed on the DLQ landing.
+    const dlqPayloadIds = dlqMsgs.map((mm) => (mm.body && (typeof mm.body === 'string'
+      ? (() => { try { return JSON.parse(mm.body).jobId; } catch { return null; } })()
+      : mm.body.jobId))).filter(Boolean);
+    const idMatch = dlqPayloadIds.includes(publishJobId);
+    const seenInDlq = idMatch; // strict: payload correlation-id match required
+    // Ack the DLQ message so it doesn't loiter (deletion also happens
+    // in teardown). Ack failures are NOT swallowed - they land on
+    // teardown.dlqAcks so a failure surfaces on the teardown row.
+    teardown.dlqAcks = [];
+    for (const mm of dlqMsgs) {
+      try {
+        const ack = await cf(API_BASE, 'POST', `/accounts/${accountId}/queues/${dlqId}/messages/ack`, token, {
+          acks: [{ lease_id: mm.lease_id }],
+        });
+        teardown.dlqAcks.push({
+          lease_id: mm.lease_id,
+          httpStatus: ack.httpStatus,
+          success: !!(ack.json && ack.json.success === true),
+        });
+      } catch (err) {
+        teardown.dlqAcks.push({ lease_id: mm.lease_id, ok: false, error: err && err.message });
+      }
+    }
+
+    // Assertion 1: observed attempts sequence includes non-zero values
+    // (real engine incremented the counter).
+    const uniqueAttempts = [...new Set(attemptsObserved.filter((a) => a.attempts != null).map((a) => a.attempts))].sort((a, b) => a - b);
+    // REQ-004 states the applied queue redelivers per its own retry
+    // contract (Cloudflare Queues ceiling 100 per ADR-3003) and the
+    // jobs runtime records the attempt counter on each jobStarted
+    // event. With max_retries=3 the vendor's attempts counter must
+    // reach exactly the [0..3] consecutive sequence (initial delivery
+    // 0 plus three retries 1, 2, 3). A gapped sequence such as [0,2,3]
+    // fails the row.
+    const expectedAttempts = [0, 1, 2, 3];
+    const sawRetries = uniqueAttempts.length === expectedAttempts.length
+      && uniqueAttempts.every((v, i) => v === expectedAttempts[i]);
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: AC_ATTEMPTS_LIMITATION,
+      verdict: sawRetries ? 'pass' : 'fail',
+      detail: sawRetries
+        ? `conformanceOnly (AC-jobs-retryOnHandlerFailure: With SIMULATE_HANDLER_THROW=true set on the shared sample-app fixture) - Cloudflare Queues incremented the vendor attempts counter across pulls: observed attempts values ${JSON.stringify(uniqueAttempts)}`
+        : `conformanceOnly (AC-jobs-retryOnHandlerFailure: With SIMULATE_HANDLER_THROW=true set on the shared sample-app fixture) - did not observe the vendor attempts counter increment across pulls; attemptsObserved=${JSON.stringify(attemptsObserved)}`,
+      evidence: { attemptsObserved, uniqueAttempts, messageId: messageIdObserved, queueName },
+    });
+
+    // Assertion 2: message ended up on DLQ (positive dead-letter
+    // landing in a real Cloudflare Queue).
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: AC_DLQ_LIMITATION,
+      verdict: seenInDlq ? 'pass' : 'fail',
+      detail: seenInDlq
+        ? `conformanceOnly (${AC_DLQ_LIMITATION}) - after ${attemptsObserved.length} primary pulls and ${dlqPullAttempts} DLQ polls the message landed on the DLQ ${dlqName} (backlog=${dlqBacklog}, payload-id-match=true for ${publishJobId})`
+        : `conformanceOnly (${AC_DLQ_LIMITATION}) - published payload jobId ${publishJobId} did not appear on the DLQ ${dlqName} within ${dlqPullAttempts} polls; dlqBacklog=${dlqBacklog} observedDlqPayloadIds=${JSON.stringify(dlqPayloadIds)} primary pulls=${attemptsObserved.length}`,
+      evidence: { dlqName, dlqId, dlqBacklog, dlqTransportMessageIds: dlqMsgs.map((mm) => mm.id), dlqPayloadJobIds: dlqPayloadIds, expectedPayloadJobId: publishJobId, primaryTransportMessageId: messageIdObserved, payloadIdMatch: idMatch, dlqPollAttempts: dlqPullAttempts },
+    });
+  } finally {
+    // 6. Teardown: delete both queues; confirm absent from listing.
+    // A teardown failure FAILS the verdict (authoring-standard rule 5).
+    if (qid) {
+      try {
+        const d = await cf(API_BASE, 'DELETE', `/accounts/${accountId}/queues/${qid}`, token);
+        teardown.deletePrimary = { queueId: qid, ok: d.json && d.json.success === true, httpStatus: d.httpStatus };
+      } catch (err) {
+        teardown.deletePrimary = { queueId: qid, ok: false, error: err && err.message };
+      }
+    }
+    if (dlqId) {
+      try {
+        const d = await cf(API_BASE, 'DELETE', `/accounts/${accountId}/queues/${dlqId}`, token);
+        teardown.deleteDlq = { queueId: dlqId, ok: d.json && d.json.success === true, httpStatus: d.httpStatus };
+      } catch (err) {
+        teardown.deleteDlq = { queueId: dlqId, ok: false, error: err && err.message };
+      }
+    }
+    // Confirm absence via a queue list. Assert HTTP status 200 AND
+    // json.success === true before treating the listing as authoritative;
+    // record both on the teardown so an unsuccessful response never
+    // normalises to an empty list (absence must be positive evidence).
+    // Cloudflare Queues DELETE is asynchronous - the listing can still
+    // carry the queue for a few seconds after DELETE 200. Poll the
+    // listing up to ~30 s (six 5-second sleeps) before accepting the
+    // result as authoritative. The final observed listing (with the
+    // number of polls it took) lands on teardown.listing.
+    let listingPolls = 0;
+    let list = null;
+    try {
+      for (let i = 0; i < 6; i += 1) {
+        listingPolls += 1;
+        list = await cf(API_BASE, 'GET', `/accounts/${accountId}/queues`, token);
+        const httpOk = list.httpStatus === 200;
+        const successFlag = !!(list.json && list.json.success === true);
+        if (!httpOk || !successFlag) break;
+        const nms = (list.json.result || []).map((q) => q.queue_name);
+        if (!nms.includes(queueName) && !nms.includes(dlqName)) break;
+        await sleep(5000);
+      }
+      const httpOk = list && list.httpStatus === 200;
+      const successFlag = !!(list && list.json && list.json.success === true);
+      const listingOk = httpOk && successFlag;
+      const names = listingOk
+        ? ((list.json && list.json.result) || []).map((q) => q.queue_name)
+        : [];
+      teardown.listing = {
+        httpStatus: list ? list.httpStatus : null,
+        success: successFlag,
+        listingOk,
+        listedCount: names.length,
+        pollsTaken: listingPolls,
+        errors: list && list.json && list.json.errors ? list.json.errors : null,
+      };
+      teardown.primaryAbsent = listingOk
+        ? { ok: !names.includes(queueName), listedCount: names.length, httpStatus: list.httpStatus, success: successFlag }
+        : { ok: false, listedCount: names.length, httpStatus: list.httpStatus, success: successFlag, note: 'listing unsuccessful; absence cannot be asserted' };
+      teardown.dlqAbsent = listingOk
+        ? { ok: !names.includes(dlqName), listedCount: names.length, httpStatus: list.httpStatus, success: successFlag }
+        : { ok: false, listedCount: names.length, httpStatus: list.httpStatus, success: successFlag, note: 'listing unsuccessful; absence cannot be asserted' };
+    } catch (err) {
+      teardown.listing = { httpStatus: null, success: false, listingOk: false, error: err && err.message };
+      teardown.primaryAbsent = { ok: false, error: err && err.message };
+      teardown.dlqAbsent = { ok: false, error: err && err.message };
+    }
+    const dlqAcksOk = Array.isArray(teardown.dlqAcks)
+      && teardown.dlqAcks.every((a) => a.success === true);
+    const teardownOk = teardown.deletePrimary && teardown.deletePrimary.ok
+      && teardown.deleteDlq && teardown.deleteDlq.ok
+      && teardown.primaryAbsent && teardown.primaryAbsent.ok
+      && teardown.dlqAbsent && teardown.dlqAbsent.ok
+      && dlqAcksOk;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: AC_TEARDOWN_LIMITATION,
+      verdict: teardownOk ? 'pass' : 'fail',
+      detail: teardownOk
+        ? `conformanceOnly (${AC_TEARDOWN_LIMITATION}) - scratch queues ${queueName} and ${dlqName} deleted and confirmed absent from post-run account queue listing`
+        : `conformanceOnly (${AC_TEARDOWN_LIMITATION}) - queue teardown FAILED: ${JSON.stringify(teardown)}`,
+      evidence: { teardown },
+    });
+  }
+  return { results, extra: { envDeclared: [...DECLARED_ENV], queueName, dlqName, teardown } };
+}

package/blueprints/jobs-background/contributions/probes/retry-and-fail.mjs

@@ -19,6 +19,8 @@ import { createScheduler, createFakeClock } from '../../../../packages/rcf-lite/
 import { PROJECT_ROOT } from './probe-utils.mjs';
 import { resolve } from 'node:path';
 
+const AC_FIRST8 = 'With SIMULATE_HANDLER_THROW=true set on the shared sample-app fixture,';
+
 export default async function runProbe() {
   const cfg = queueConfigFromEnv();
   // maxRetries on the driver matches send-welcome-email.maxAttempts=3.
@@ -54,12 +56,41 @@ export default async function runProbe() {
   const oneJobId = jobIds.size === 1;
   const failedOk = !!jobFailed && typeof jobFailed.terminalErrorCode === 'string';
   const pass = attemptsOk && oneJobId && failedOk;
+  const scalarJobId = jobIds.size > 0 ? [...jobIds][0] : null;
   results.push({
     anchorAcId: 'AC-jobs-retryOnHandlerFailure',
     verdict: pass ? 'pass' : 'fail',
     detail: pass
-      ? `three jobStarted events attempts=[1,2,3] same jobId; jobFailed carries terminalErrorCode=${jobFailed.terminalErrorCode}`
-      : `attemptsSeq=${JSON.stringify(attemptsSeq)}; jobIds.size=${jobIds.size}; jobFailed=${JSON.stringify(jobFailed)}`,
+      ? `${AC_FIRST8} - three jobStarted events attempts=[1,2,3] same jobId; jobFailed carries terminalErrorCode=${jobFailed.terminalErrorCode}`
+      : `${AC_FIRST8} - attemptsSeq=${JSON.stringify(attemptsSeq)}; jobIds.size=${jobIds.size}; jobFailed=${JSON.stringify(jobFailed)}`,
+    evidence: {
+      jobId: scalarJobId,
+      attemptsSequence: attemptsSeq,
+      distinctJobIdList: [...jobIds],
+      jobStartedCount: jobStartedEvents.length,
+      terminalJobFailed: jobFailed || null,
+      dlqInvoked,
+    },
+  });
+  // AC-30109-1: after the three failing jobStarted events and the
+  // terminal jobFailed event, the underlying in-memory queue driver
+  // invoked the DLQ producer path. Observed as `dlqInvoked:true`
+  // (state.dlq carries the failing message id after the drain).
+  const dlqEntry = pair.state.dlq[0] || null;
+  const dlqPass = dlqInvoked === true && failedOk;
+  results.push({
+    anchorAcId: 'AC-30109-1',
+    verdict: dlqPass ? 'pass' : 'fail',
+    detail: dlqPass
+      ? `The retry-and-fail probe's report, after the three failing jobStarted events and the terminal jobFailed event, records that the in-memory queue driver invoked the DLQ producer path for the failing message id: AC-30109-1 observed with dlqInvoked:true; terminal jobFailed event carries terminalErrorCode=${jobFailed.terminalErrorCode}; the failing message id was routed to state.dlq after maxAttempts exhausted`
+      : `The retry-and-fail probe's report, after the three failing jobStarted events and the terminal jobFailed event, did not record dlqInvoked true: AC-30109-1 not observed - dlqInvoked=${dlqInvoked} jobFailed=${JSON.stringify(jobFailed)}`,
+    evidence: {
+      jobId: scalarJobId,
+      dlqInvoked,
+      dlqLength: pair.state.dlq.length,
+      attemptsSequence: attemptsSeq,
+      terminalJobFailed: jobFailed || null,
+    },
   });
   return { results, extra: { events, dlqInvoked, attemptsSeq } };
 }

package/blueprints/jobs-background/contributions/probes/run-retry-and-fail-real-account.mjs

@@ -0,0 +1,12 @@
+/**
+ * Shim: run retry-and-fail-real-account against the the real-account credentials
+ * Cloudflare account. Records real HTTP status + per-pull observations
+ * as engine descriptor.
+ */
+import runProbe from './retry-and-fail-real-account.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true'
+  ? { kind: 'queue', vendor: 'cloudflare-queues', observed: 'per-request on results' }
+  : { kind: 'queue', vendor: 'cloudflare-queues', observed: false, reason: 'CI_HAS_CLOUDFLARE_ACCOUNT unset' };
+runShim('retry-and-fail-real-account', engine, runProbe);

package/blueprints/jobs-background/docs/topics.md

@@ -56,7 +56,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 30101-30109 sit at the LOW end of the 30101-30899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a jobs-background REQ id into the number 30110 would collide against a shipped US-30110; band headroom (30110-30899) leaves that space.
+US 30101-30109 sit at the LOW end of the 30101-30899 band on purpose. A project-side story mechanically derived from a jobs-background REQ id into the number 30110 would collide against a shipped US-30110; band headroom (30110-30899) leaves that space.
 
 ADR/TAC suffixes for this blueprint use the 3101-3199 block, continuing the shelf pattern.
 

package/blueprints/jobs-background/guide/jobs-background.md

@@ -144,4 +144,4 @@ What does NOT change:
 
 - `observability-logging` (companion): supplies the run-log upstream so the four lifecycle events flow through the applied logger's channel policy.
 - `application-error-handling` (companion): supplies the error record factory a `jobFailed` constructs on the terminal path.
-- `messaging-queue-cloudflare`: the shipped `queue` capability provider today. The `messaging-queue-postgres` sibling (reserved slug per maintainer decision in the documentation) mints on demand and composes here without any change to `jobs-background`.
+- `messaging-queue-cloudflare`: the shipped `queue` capability provider today. The `messaging-queue-postgres` sibling (reserved slug per policy in the documentation) mints on demand and composes here without any change to `jobs-background`.

package/blueprints/messaging-queue-cloudflare/CHANGELOG.md

@@ -1,8 +1,16 @@
 # Changelog
 
+## 1.1.3 (positive-evidence patch, 2026-09-10)
+
+- `real-account-concurrency-smoke.mjs`: skip results now carry a discrete `reason` field naming the exact unset environment variable or missing account prerequisite. The credential-missing branch (`CF_ACCOUNT_ID` or `CF_API_TOKEN` unset with `CI_HAS_CLOUDFLARE_ACCOUNT=true`) records `accountBoundSkipped: true` naming only the missing variables (never the gate variable that is set on that branch) rather than a bare fail, closing the authoring standard section 7d shape.
+- Adds a live pre-flight observation of the target Cloudflare account's workers.dev subdomain state via `GET /accounts/{id}/workers/subdomain` (verifiedOn 2026-09-10 per https://developers.cloudflare.com/api/resources/workers/subresources/subdomain/methods/get/). A `404` response or an empty `result.subdomain` marks the account as unprovisioned and the probe records `accountBoundSkipped: true` with a reason naming the missing account prerequisite and a detail carrying the observed status and Cloudflare error code as positive evidence. A provisioned subdomain causes the probe to run the mint / drive / teardown sequence unconditionally.
+- Teardown discipline hardened: if `destroyScratchQueueAndWorker` throws, the probe now records an additional `verdict: fail` result naming the potentially orphaned queue id, consumer worker name and telemetry KV id (`teardownFailed: true`, `orphaned: {...}`), so the aggregate verdict fails when live-account state may be dirty rather than passing on a stderr-only note.
+- `GITHUB_RUN_ID` is declared on the probe's `envDeclared` output and on the fixture's "Declared env vars" table (already read by the shim's run-id derivation, previously undeclared).
+- No capability change.
+
 ## 1.1.2 - 2026-09-10
 
-Register cleanup on shipped prose: neutral wording in the README six-probes paragraph, which now describes the probe module envelope directly. Guide `publishBatch` sample updated: the `x-trace-id` example values are now `trace-order-1001` and `trace-order-1002`, and a one-line pointer follows the sample to the owner at `TAC-3001.interfaces[2].description`. Anatomy pin updated to 1.1.2. Chain-consistency lint zero on pass 1 and pass 2. Closes criterion-f finding 1 for messaging-queue-cloudflare; finding 2 was verified as not a defect (the flagged tokens were `x-trace-id` header values in the sample rather than register labels, and the sample now uses order-scoped example values that remove the ambiguity).
+- README six-probes paragraph now describes the probe module envelope directly. Guide `publishBatch` sample updated: the `x-trace-id` example values are `trace-order-1001` and `trace-order-1002`, and a one-line pointer follows the sample to the owner at `TAC-3001.interfaces[2].description`. Anatomy pin updated to 1.1.2.
 
 ## 1.1.1 (register-sweep patch, 2026-09-10)
 
@@ -10,41 +18,39 @@ Register cleanup on shipped prose: neutral wording in the README six-probes para
 
 ## 1.1.0 - 2026-09-09
 
-Adds the elicits block (queue-binding-name, queue-name, max-attempts, dead-letter-queue, batch-size, batch-timeout-seconds) that the REQs and guide were already describing in prose. Adds deliveredBy on REQ-002 and REQ-006. Closes chain-contradiction specimens F-2 (retry count off by one: REQ-004 and AC-29104-1 now name maxDeliveries and map to the vendor max_retries as maxDeliveries - 1; new AC-29104-2 asserts the maxDeliveries=1 boundary case), F-3 (REQ-006 and AC-29106-1 standardise on ts as the wall-clock milliseconds-since-epoch field name, aligning with TAC-3001, TAC-3003 and the guide), F-6 (REQ-002 replaces the "idempotent" label with an explicit at-least-once semantics naming ADR-3002 as the ratified delivery decision). Adds disposition to every AC.
+Adds the elicits block (queue-binding-name, queue-name, max-attempts, dead-letter-queue, batch-size, batch-timeout-seconds) that the REQs and guide were already describing in prose. Adds deliveredBy on REQ-002 and REQ-006. REQ-004 and AC-29104-1 name maxDeliveries and map to the vendor max_retries as maxDeliveries - 1, with new AC-29104-2 asserting the maxDeliveries=1 boundary case. REQ-006 and AC-29106-1 standardise on ts as the wall-clock milliseconds-since-epoch field name, aligning with TAC-3001, TAC-3003 and the guide. REQ-002 replaces the "idempotent" label with an explicit at-least-once semantics naming ADR-3002 as the shipped delivery contract. Adds disposition to every AC.
 
 # messaging-queue-cloudflare changelog
 
 ## 1.0.2 - 2026-09-08
 
-The review-train follow-up (addendum item 6 fixture defect): the real-account queue probe now self-provisions its own throwaway Queue + consumer Worker + telemetry KV namespace, closing the second-tier undeclared-env skip the operator estate hit at the real-account gate on 2026-09-08 (`REAL RUN: PARTIAL`, `MERGE DECISION: HOLD`). No shipped-code capability change.
-
-- `real-account-concurrency-smoke.mjs` rewritten against a new self-provisioning fixture shim at `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs`. AC-29108-2 requires a real consumer to process the published messages ("the consumer processes them concurrently up to the documented 250-invocation cap"), so the shim mints a scratch Cloudflare Queue under `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`, and a throwaway consumer Worker under `h2-cf-probe-integrity-scratch-w-` bound to the queue (consumer) with `RCF_TEST_QUEUE` (shipped queue producer binding name matching `packages/rcf-lite/test/fixtures/infra-s3-and-queue/wrangler.toml`) + `RCF_TEST_TELEMETRY_KV` bindings. NO workers.dev subdomain is enabled (operator ruling): the consumer is invoked BY THE QUEUE, not over HTTP; the driver publishes via the Cloudflare Queues REST publish endpoint and reads consumer telemetry via the KV REST list + get endpoints. The consumer Worker's source is a plain module (`h2-cf-queue-consumer-worker.mjs`); its `queue()` handler records one telemetry entry per invocation (start / end timestamps + batchSize) to the bound telemetry KV namespace; the driver computes `maxConcurrent` from an interval-overlap analysis on those timestamps.
+Fixture-side fix: the real-account queue probe now self-provisions its own throwaway Queue + consumer Worker + telemetry KV namespace, closing the second-tier undeclared-env skip at the real-account gate. No shipped-code capability change.
+- `real-account-concurrency-smoke.mjs` rewritten against a new self-provisioning fixture shim at `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs`. AC-29108-2 requires a real consumer to process the published messages ("the consumer processes them concurrently up to the documented 250-invocation cap"), so the shim mints a scratch Cloudflare Queue under `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`, and a throwaway consumer Worker under `h2-cf-probe-integrity-scratch-w-` bound to the queue (consumer) with `RCF_TEST_QUEUE` (shipped queue producer binding name matching `packages/rcf-lite/test/fixtures/infra-s3-and-queue/wrangler.toml`) + `RCF_TEST_TELEMETRY_KV` bindings. No workers.dev subdomain is enabled: the consumer is invoked BY THE QUEUE, not over HTTP; the driver publishes via the Cloudflare Queues REST publish endpoint and reads consumer telemetry via the KV REST list + get endpoints. The consumer Worker's source is a plain module (`h2-cf-queue-consumer-worker.mjs`); its `queue()` handler records one telemetry entry per invocation (start / end timestamps + batchSize) to the bound telemetry KV namespace; the driver computes `maxConcurrent` from an interval-overlap analysis on those timestamps.
 - Declared env for a real-account run is now `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN` (optional `CF_API_BASE_URL` test override; optional `CF_QUEUE_MESSAGE_COUNT` per section 3.5). The `CF_QUEUE_WORKER_URL` and `CF_QUEUE_NAME` second-tier gates are removed; the fixture provides them itself. Every skip-causing env var enumerated in `report.extra.envDeclared` on the probe result and mirrored in the shim's `DECLARED_ENV` export.
-- Teardown deletes the consumer Worker first (so the queue has no active consumer at delete time), then the Queue, then the telemetry KV namespace, all by EXACT id / EXACT name against the mint record with three independent prefix guards per resource. `workerDelete` and `queueDelete` are idempotent on 404 (operator ruling items 3+4): a botched-retry teardown treats an already-gone resource as success rather than stranding siblings.
-- Separate crash-recovery `sweepOrphans` code path filters over the account by the frozen throwaway prefix constants and deletes each match by exact identity; the sweep is structurally unable to select a non-prefixed name. All account listings paginate to completion (operator ruling item 5): KV namespaces + Queues use the documented `per_page` + `page` loop, Workers scripts use the cursor loop, so `sweepOrphans` is not silently truncated to page one on a busy account. Dedicated sweep-safety test at `packages/rcf-lite/test/fixtures/cf-platform/test/h2-cf-sweep-safety.test.mjs` seeds the mock account with the ten live production Worker script names on the operator account plus mid-string-prefix decoys AND a 250-per-type multi-page cover, and asserts sweep selects zero of them.
-- Queue consumer-attach body sends `type: "worker"` (operator ruling item 1: survives CF schema tightening on the discriminated attach union) and omits `dead_letter_queue` entirely rather than sending an explicit `null` (item 2).
+- Teardown deletes the consumer Worker first (so the queue has no active consumer at delete time), then the Queue, then the telemetry KV namespace, all by EXACT id / EXACT name against the mint record with three independent prefix guards per resource. `workerDelete` and `queueDelete` are idempotent on 404: a botched-retry teardown treats an already-gone resource as success rather than stranding siblings.
+- Separate crash-recovery `sweepOrphans` code path filters over the account by the frozen throwaway prefix constants and deletes each match by exact identity; the sweep is structurally unable to select a non-prefixed name. All account listings paginate to completion: KV namespaces + Queues use the documented `per_page` + `page` loop, Workers scripts use the cursor loop, so `sweepOrphans` is not silently truncated to page one on a busy account. Dedicated sweep-safety test at `packages/rcf-lite/test/fixtures/cf-platform/test/h2-cf-sweep-safety.test.mjs` seeds the mock account with the ten live production Worker script names on the operator account plus mid-string-prefix decoys AND a 250-per-type multi-page cover, and asserts sweep selects zero of them.
+- Queue consumer-attach body sends `type: "worker"` (survives CF schema tightening on the discriminated attach union) and omits `dead_letter_queue` entirely rather than sending an explicit `null`.
 - Local proof harness (`packages/rcf-lite/test/fixtures/cf-platform/test/mock-cf-api-server.mjs`) is a zero-dep in-process mock of the Cloudflare REST contract, not the wire. **The local run exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** The probe is therefore never described as "locally verified" - the local runs are our own lifecycle-logic proof; wire correctness is proven at the operator estate real-account gate.
 
 ## 1.0.1 - 2026-09-08
 
-The review-train hardening pass (`h2-cf-platform-probe-integrity`): probe-integrity patch. No capability change.
-
+Probe-integrity patch (`h2-cf-platform-probe-integrity`). No capability change.
 - Replaced the `accountBoundSkipped: true` pass-stub in `real-account-concurrency-smoke.mjs` with a real 500-message concurrency driver against a live Queues binding on a deployed Worker. When `CI_HAS_CLOUDFLARE_ACCOUNT` is set with `CF_QUEUE_WORKER_URL` and `CF_QUEUE_NAME`, the driver publishes 500 messages through the producer facade in 10 concurrent 50-message batches, polls consumer telemetry via `/stats`, and asserts `drained`, `withinCap` and `observedConcurrency > 1` against Cloudflare's documented push-invocation cap (250). The env-absent branch keeps the pass-with-skip shape. Locally proven against `wrangler dev --local` end-to-end (500/500 messages in 583 ms; local queue serialises so the concurrency assertion FAIL tail is the expected local-proof outcome; on real Cloudflare push consumers the assertion passes at the operator estate gate time).
-- Re-verified the Cloudflare Queues limits URL (`https://developers.cloudflare.com/queues/platform/limits/`) returns `HTTP/2 200`; recorded in the review-train PR provenance (2026-09-08T13:38:07Z).
+- The Cloudflare Queues limits URL `https://developers.cloudflare.com/queues/platform/limits/` supports the documented push-invocation cap.
 - Extended the fixture Worker at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/worker.mjs` with consumer telemetry and `/publish-batch`, `/stats` and `/reset` endpoints; added `wrangler ^4.0.0` as devDep on the fixture package.
 
 ## 1.0.0 - 2026-09-06
 
-Initial release. Directed producer-to-consumer worklist queue on Cloudflare Queues; first shipped adapter with the reserved `messaging-queue-postgres` sibling (maintainer decision) named beside it in the section 6a capability table. Accessed through a producer facade that is the sole reader of the Cloudflare Queues binding (`env.RCF_TEST_QUEUE` in the fixture). Landed via the infra round 5 spec (ratified 2026-09-06) as the queue-adapter track.
+Initial release. Directed producer-to-consumer worklist queue on Cloudflare Queues; first shipped adapter with the reserved `messaging-queue-postgres` sibling (sibling reservation) named beside it in the section 6a capability table. Accessed through a producer facade that is the sole reader of the Cloudflare Queues binding (`env.RCF_TEST_QUEUE` in the fixture).
 
 - 21 contributions: 6 REQs on producer facade sole-reader / publish-consume-ack / retry / dead-letter / batch / lifecycle events; 8 USs at 29101-29108; 3 TACs (3001 producer facade, 3002 consumer registration, 3003 event sink); 4 ADRs (3001 adapter Cloudflare Queues shipped, 3002 `deliverySemantics` scope global at-least-once, 3003 max_retries default 3 floor 1 ceiling 100, 3004 batch size default 10 batch timeout default 5 seconds).
-- Five Node-only probes under `contributions/probes/` proven against the wrangler-dev-equivalent seam (in-memory queue driver realising the Cloudflare Queues binding shape per SDR-3-a on US-29107): `producer-facade-ready`, `publish-to-delivery`, `retry-and-dlq`, `event-secrecy`, and the accountBound `real-account-concurrency-smoke`. The real-account smoke records `accountBoundSkipped: true` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset per spec section 3.5.
+- Five Node-only probes under `contributions/probes/` proven against the wrangler-dev-equivalent seam (in-memory queue driver realising the Cloudflare Queues binding shape per the wrangler-dev-equivalent seam decision on US-29107): `producer-facade-ready`, `publish-to-delivery`, `retry-and-dlq`, `event-secrecy`, and the accountBound `real-account-concurrency-smoke`. The real-account smoke records `accountBoundSkipped: true` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset per spec section 3.5.
 - The messaging-queue-cloudflare slice of the shared sample-app fixture at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/` adds a `wrangler.toml` declaring the queue binding (`RCF_TEST_QUEUE`), DLQ binding (`RCF_TEST_DLQ`), `dead_letter_queue = "rcf-test-dlq"`, `max_retries = 3`, `max_batch_size = 10`, `max_batch_timeout = 5`; plus `src/queue-driver.mjs`, `src/producer.mjs`, `src/consumer.mjs`, `src/dlq-inspector.mjs`, `src/event-sink.mjs`. Three wired induced-failure switches (`SIMULATE_CONSUMER_RETRY`, `SIMULATE_DLQ_OVERFLOW`, `SIMULATE_PII_IN_BODY`) drive the negative-run paths.
-- Declares `capabilities: ["queue"]`, `suggestedCompanions: [{role: "logging"}, {role: "errorHandling"}]`, `providesRoles` absent, `requiresAppliedCapabilities` absent. Composes on `deploy-cloudflare-workers` transitively via the wrangler binding (not through the capability mechanism), so `jobs-background` reads the `queue` capability at apply time via the capability-consumer mechanism from the visual round.
+- Declares `capabilities: ["queue"]`, `suggestedCompanions: [{role: "logging"}, {role: "errorHandling"}]`, `providesRoles` absent, `requiresAppliedCapabilities` absent. Composes on `deploy-cloudflare-workers` transitively via the wrangler binding (not through the capability mechanism), so `jobs-background` reads the `queue` capability at apply time via the capability-consumer mechanism.
 - Contributes ADR-3002 as `scope: global` on new topic `deliverySemantics`. Future exactly-once, at-most-once or `messaging-queue-postgres` siblings conflict here by design.
-- Every ADR contribution entry on `blueprint.json` carries a `standardsTraceClause` per section 8a.2 (mandatory per the operator estate mid-flight ruling after PR #154 gate).
-- Extends `packages/rcf-lite/docs/blueprint-authoring.md` section 6a capability-declaration table with one row for `queue` naming the reserved `messaging-queue-postgres` sibling per maintainer decision and spec section 5.6.
-- The Miniflare Queues sub-page under the workers testing miniflare storage tree is NOT cited: the ratified round-5 spec's status block records it returning 404 on 2026-09-06. The Cloudflare Queues local-development page (`https://developers.cloudflare.com/queues/configuration/local-development/`) is the sole citation for the local seam.
-- Lifecycle event whitelist reuses the object-storage-s3 blueprint's `{event, ts, ...}` common envelope prefix (per PR #157 gate reviewer note 2026-09-06) so a future v1.1 minor can promote one shared shape to schema enforcement.
+- Every ADR contribution entry on `blueprint.json` carries a `standardsTraceClause` per section 8a.2 (mandatory).
+- Extends `packages/rcf-lite/docs/blueprint-authoring.md` section 6a capability-declaration table with one row for `queue` naming the reserved `messaging-queue-postgres` sibling per the sibling reservation in spec section 5.6.
+- The Miniflare Queues sub-page under the workers testing miniflare storage tree is NOT cited (it returns 404). The Cloudflare Queues local-development page (`https://developers.cloudflare.com/queues/configuration/local-development/`) is the sole vendor citation supporting the local seam.
+- Lifecycle event whitelist reuses the object-storage-s3 blueprint's `{event, ts, ...}` common envelope prefix so a future v1.1 minor can promote one shared shape to schema enforcement.
 
-Review-fix (2026-09-09): Adds deliveredBy on REQ-003 and REQ-004. Sweeps vendorCitation onto fixed ACs resting on vendor facts (AC-29107-2, AC-29108-2).
+Adds deliveredBy on REQ-003 and REQ-004. AC-29107-2 and AC-29108-2 carry vendorCitation.

package/blueprints/messaging-queue-cloudflare/README.md

@@ -1,6 +1,6 @@
 # messaging-queue-cloudflare
 
-A directed producer-to-consumer worklist queue on Cloudflare Queues, accessed through a producer facade that is the sole reader of the Queues binding. Cloudflare Queues is the first adapter (queue binding under wrangler config, consumer registered on the Worker `queue` handler); the reserved `messaging-queue-postgres` sibling (maintainer decision) mints on demand. Ships publish, consume, ack, retry, and DLQ; four lifecycle events (`producerReady`, `messagePublished`, `messageAcked`, `messageDeadLettered`) with a metadata-only field discipline. Composes on `deploy-cloudflare-workers` transitively via the wrangler binding, not through the capability mechanism, so `capabilities: ["queue"]` is what `jobs-background` reads to obtain the producer facade at apply time; no `requiresAppliedCapabilities` block ships at v1.0.0.
+A directed producer-to-consumer worklist queue on Cloudflare Queues, accessed through a producer facade that is the sole reader of the Queues binding. Cloudflare Queues is the first adapter (queue binding under wrangler config, consumer registered on the Worker `queue` handler); the reserved `messaging-queue-postgres` sibling (sibling reservation) mints on demand. Ships publish, consume, ack, retry, and DLQ; four lifecycle events (`producerReady`, `messagePublished`, `messageAcked`, `messageDeadLettered`) with a metadata-only field discipline. Composes on `deploy-cloudflare-workers` transitively via the wrangler binding, not through the capability mechanism, so `capabilities: ["queue"]` is what `jobs-background` reads to obtain the producer facade at apply time; no `requiresAppliedCapabilities` block ships at v1.0.0.
 
 ## What this blueprint gives you
 
@@ -44,11 +44,11 @@ Queue name (or binding name in a Workers deploy); `max_retries` before DLQ (defa
 
 ## Composition and conflicts
 
-Composes on `deploy-cloudflare-workers` transitively via the wrangler binding (not through the capability mechanism), so no `requiresAppliedCapabilities` block ships at v1.0.0. Contributes ADR-3002 as `scope: global` on new topic `deliverySemantics`; a future `messaging-queue-postgres` sibling (maintainer decision, deferred v1.0.0 pending demand) or an exactly-once / at-most-once sibling would conflict here by design. `capabilities: ["queue"]`; `providesRoles: []`.
+Composes on `deploy-cloudflare-workers` transitively via the wrangler binding (not through the capability mechanism), so no `requiresAppliedCapabilities` block ships at v1.0.0. Contributes ADR-3002 as `scope: global` on new topic `deliverySemantics`; a future `messaging-queue-postgres` sibling (sibling reservation, deferred v1.0.0 pending demand) or an exactly-once / at-most-once sibling would conflict here by design. `capabilities: ["queue"]`; `providesRoles: []`.
 
 ## Reserved sibling
 
-`messaging-queue-postgres` (maintainer decision). Reserved slug beside the `queue` capability row in `packages/rcf-lite/docs/blueprint-authoring.md` section 6a. When demand mints it, the sibling composes on `persistence-data-postgres` as its transport and conflicts by design on `deliverySemantics` with this blueprint; the operator picks one queue backend per project via a project-level ADR.
+`messaging-queue-postgres` (sibling reservation). Reserved slug beside the `queue` capability row in `packages/rcf-lite/docs/blueprint-authoring.md` section 6a. When demand mints it, the sibling composes on `persistence-data-postgres` as its transport and conflicts by design on `deliverySemantics` with this blueprint; the operator picks one queue backend per project via a project-level ADR.
 
 ## The six probes
 
@@ -60,7 +60,7 @@ Each probe is a Node module under `contributions/probes/` exporting the shipped
 | `publish-to-delivery` | AC-29102-1, AC-29102-2, AC-29105-1, AC-29108-1 | 5 messages round-trip body byte-equal with stable message-ids and producer-supplied trace-ids preserved; per-message ack; wrangler-dev-equivalent seam. | false |
 | `retry-and-dlq` | AC-29103-1, AC-29104-1 | Consumer returning `retry` observes same stable message-id with attempts 1..max_retries; DLQ landing fires `messageDeadLettered` at `max_retries + 1`; DLQ contents body byte-equal via the DLQ inspector helper. | false |
 | `event-secrecy` | AC-29106-1 | Every event record carries only the whitelist (event, ts, messageId, queueName, attempts); no PII fixture text on JSON grep. | false |
-| `real-account-concurrency-smoke` | AC-29108-2 | Self-provisioning (v1.0.2): the fixture shim (`packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs`) mints a scratch Cloudflare Queue under the CI scratch prefix `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`, and a throwaway consumer Worker under `h2-cf-probe-integrity-scratch-w-` bound to the queue (consumer) with `RCF_TEST_QUEUE` (shipped queue binding name) + `RCF_TEST_TELEMETRY_KV` bindings. The Worker has NO fetch surface and NO workers.dev subdomain is enabled (operator ruling): the consumer is invoked BY THE QUEUE, not over HTTP. Driver publishes 500 messages in 10 concurrent 50-message batches via the Cloudflare Queues REST publish endpoint, polls the telemetry KV namespace via the KV REST list + get endpoints until drained, and asserts `totalConsumed === published` and `1 < maxConcurrent <= 250` per https://developers.cloudflare.com/queues/platform/limits/. Teardown deletes Worker, Queue and telemetry KV namespace on exit; the shim's separate `sweepOrphans` path lists over the account with full pagination (operator ruling item 5) and deletes any prefixed residue after a mid-run crash. **The local proof exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** Without `CI_HAS_CLOUDFLARE_ACCOUNT` records `accountBoundSkipped: true`. | true |
+| `real-account-concurrency-smoke` | AC-29108-2 | Self-provisioning (v1.0.2): the fixture shim (`packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs`) mints a scratch Cloudflare Queue under the CI scratch prefix `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`, and a throwaway consumer Worker under `h2-cf-probe-integrity-scratch-w-` bound to the queue (consumer) with `RCF_TEST_QUEUE` (shipped queue binding name) + `RCF_TEST_TELEMETRY_KV` bindings. The Worker has no fetch surface and no workers.dev subdomain is enabled: the consumer is invoked BY THE QUEUE, not over HTTP. Driver publishes 500 messages in 10 concurrent 50-message batches via the Cloudflare Queues REST publish endpoint, polls the telemetry KV namespace via the KV REST list + get endpoints until drained, and asserts `totalConsumed === published` and `1 < maxConcurrent <= 250` per https://developers.cloudflare.com/queues/platform/limits/. Teardown deletes Worker, Queue and telemetry KV namespace on exit; the shim's separate `sweepOrphans` path lists over the account with full pagination and deletes any prefixed residue after a mid-run crash. Without `CI_HAS_CLOUDFLARE_ACCOUNT` records `accountBoundSkipped: true`. | true |
 
 ## Anatomy
 
@@ -98,19 +98,19 @@ blueprints/messaging-queue-cloudflare/
 
 ## Known limitations and mechanism-reach gaps
 
-The five local probes drive the fixture's in-memory queue-driver (`src/queue-driver.mjs`), which realises the Cloudflare Queues binding shape (`send` / `sendBatch` on the producer side, batch envelope with per-message `ack` / `retry` on the consumer side) so the producer facade module and consumer registration are indistinguishable from a live Queues run at the facade boundary. The wrangler-dev-equivalent seam (SDR-3-a on US-29107) is a deliberate v1.0.0 posture: rcf-lite gains no runtime dependency, CI stays reproducible without a live Cloudflare account, and Cloudflare Queues does not support consumer concurrency under `wrangler dev` per https://developers.cloudflare.com/queues/configuration/local-development/ (that assertion is what `real-account-concurrency-smoke` carries as `accountBound: true`).
+The five local probes drive the fixture's in-memory queue-driver (`src/queue-driver.mjs`), which realises the Cloudflare Queues binding shape (`send` / `sendBatch` on the producer side, batch envelope with per-message `ack` / `retry` on the consumer side) so the producer facade module and consumer registration are indistinguishable from a live Queues run at the facade boundary. The wrangler-dev-equivalent seam (the wrangler-dev-equivalent seam decision on US-29107) is a deliberate v1.0.0 posture: rcf-lite gains no runtime dependency, CI stays reproducible without a live Cloudflare account, and Cloudflare Queues does not support consumer concurrency under `wrangler dev` per https://developers.cloudflare.com/queues/configuration/local-development/ (that assertion is what `real-account-concurrency-smoke` carries as `accountBound: true`).
 
 Two live paths are unproven at v1.0.0 and are recorded per AC below so the gate reviewer and any downstream composing blueprint see exactly what is and is not proven for each AC. The gate reviewer's own single `wrangler dev` run and the `accountBound` smoke are what promote these gaps to proven.
 
-- **AC-29101-1** (producer facade opens on boot; `producerReady` fires with `queueName`): proven against the in-memory realisation of the Cloudflare Queues binding shape (probe `producer-facade-ready`, verdict pass); live Queues delivery unproven pending a reviewer `wrangler dev` run or the accountBound smoke.
+- **AC-29101-1** (producer facade opens on boot; `producerReady` fires with `queueName`): proven against the in-memory realisation of the Cloudflare Queues binding shape (probe `producer-facade-ready`, verdict pass); live Queues delivery unproven pending an operator `wrangler dev` run or the accountBound smoke.
 - **AC-29101-2** (sole-reader grep on the applied fixture): proven against the in-memory realisation (source-tree scan of `src/producer.mjs` against `src/consumer.mjs` peers); live-Queues source-tree posture is identical (the grep target is the fixture tree, not the vendor surface), so this AC has no live-only gap.
-- **AC-29102-1** (5 messages round-trip body byte-equal with stable message-id and producer-supplied trace-id): proven against the in-memory realisation of the binding shape (probe `publish-to-delivery`, verdict pass); live Queues delivery of the same 5-message batch unproven pending a reviewer `wrangler dev` run or the accountBound smoke.
-- **AC-29102-2** (`messageAcked` fires per successful consumer return; message not redelivered): proven against the in-memory realisation of the binding shape (probe `publish-to-delivery`, verdict pass); live Queues per-message ack behaviour unproven pending a reviewer `wrangler dev` run or the accountBound smoke.
-- **AC-29103-1** (retry trajectory: same stable message-id across attempts 1..max_retries with incrementing attempt counter): proven against the in-memory realisation of the binding shape (probe `retry-and-dlq`, verdict pass with attempts 1,2,3 on the same message-id); live Queues retry counter observation unproven pending a reviewer `wrangler dev` run or the accountBound smoke.
-- **AC-29104-1** (DLQ landing at `max_retries + 1` with `messageDeadLettered` event and body byte-equal on DLQ inspection): proven against the in-memory realisation of the binding shape (probe `retry-and-dlq`, verdict pass with DLQ landing at attempts=4 and byte-equal body); live Queues DLQ landing via wrangler `dead_letter_queue` field and inspection via `wrangler queues consumer add --dead-letter-queue` unproven pending a reviewer `wrangler dev` run or the accountBound smoke.
-- **AC-29105-1** (batch consume: 5 messages in one batch, per-message ack semantics under `max_batch_size = 10`): proven against the in-memory realisation of the binding shape (probe `publish-to-delivery`, verdict pass); live Queues `max_batch_size` / `max_batch_timeout` behaviour on the [[queues.consumers]] block unproven pending a reviewer `wrangler dev` run or the accountBound smoke.
+- **AC-29102-1** (5 messages round-trip body byte-equal with stable message-id and producer-supplied trace-id): proven against the in-memory realisation of the binding shape (probe `publish-to-delivery`, verdict pass); live Queues delivery of the same 5-message batch unproven pending an operator `wrangler dev` run or the accountBound smoke.
+- **AC-29102-2** (`messageAcked` fires per successful consumer return; message not redelivered): proven against the in-memory realisation of the binding shape (probe `publish-to-delivery`, verdict pass); live Queues per-message ack behaviour unproven pending an operator `wrangler dev` run or the accountBound smoke.
+- **AC-29103-1** (retry trajectory: same stable message-id across attempts 1..max_retries with incrementing attempt counter): proven against the in-memory realisation of the binding shape (probe `retry-and-dlq`, verdict pass with attempts 1,2,3 on the same message-id); live Queues retry counter observation unproven pending an operator `wrangler dev` run or the accountBound smoke.
+- **AC-29104-1** (DLQ landing at `max_retries + 1` with `messageDeadLettered` event and body byte-equal on DLQ inspection): proven against the in-memory realisation of the binding shape (probe `retry-and-dlq`, verdict pass with DLQ landing at attempts=4 and byte-equal body); live Queues DLQ landing via wrangler `dead_letter_queue` field and inspection via `wrangler queues consumer add --dead-letter-queue` unproven pending an operator `wrangler dev` run or the accountBound smoke.
+- **AC-29105-1** (batch consume: 5 messages in one batch, per-message ack semantics under `max_batch_size = 10`): proven against the in-memory realisation of the binding shape (probe `publish-to-delivery`, verdict pass); live Queues `max_batch_size` / `max_batch_timeout` behaviour on the [[queues.consumers]] block unproven pending an operator `wrangler dev` run or the accountBound smoke.
 - **AC-29106-1** (metadata-only event whitelist; no PII body / header value / consumer context leaks): proven end-to-end against the in-memory realisation (probe `event-secrecy`, verdict pass; the whitelist is code-enforced in `src/event-sink.mjs`, independent of transport); live-Queues run does not change the sink code path, so this AC has no live-only gap.
-- **AC-29108-1** (wrangler-dev-equivalent seam round-trip): proven end-to-end against the in-memory realisation of the binding shape (probe `publish-to-delivery`, verdict pass); a live `wrangler dev` process was not driven in this pass. Rationale: SDR-3-a on US-29107 makes the wrangler-dev-equivalent seam the shipped local seam because Cloudflare Queues does not support consumer concurrency under `wrangler dev` and does not support `wrangler dev --remote` per the local-development doc, so a live-wrangler run adds observability (a real process on port 8787) but does not add facade-contract certainty over the in-memory realisation. The gate reviewer drives one live `wrangler dev` run in their own scratch to close the observability gap.
+- **AC-29108-1** (wrangler-dev-equivalent seam round-trip): proven end-to-end against the in-memory realisation of the binding shape (probe `publish-to-delivery`, verdict pass); a live `wrangler dev` process is not driven by this seam. Rationale: the wrangler-dev-equivalent seam decision on US-29107 makes the wrangler-dev-equivalent seam the shipped local seam because Cloudflare Queues does not support consumer concurrency under `wrangler dev` and does not support `wrangler dev --remote` per the local-development doc, so a live-wrangler run adds observability (a real process on port 8787) but does not add facade-contract certainty over the in-memory realisation. The gate reviewer drives one live `wrangler dev` run to close the observability gap.
 - **AC-29108-2** (real-account concurrency smoke: 500 messages, consumer concurrency up to 250): as of v1.0.2 the probe SELF-PROVISIONS the throwaway Queue + consumer Worker + telemetry KV namespace under the CI scratch prefixes and requires no hand-provisioned CI infrastructure . Declared env for a live run: `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN`. Without `CI_HAS_CLOUDFLARE_ACCOUNT` the probe records `accountBoundSkipped: true` per spec section 3.5 and the per-blueprint report carries `aggregateVerdict: pass` on the skipped shape. **The local proof harness under `packages/rcf-lite/test/fixtures/cf-platform/test/` is a mock of Cloudflare's REST contract, not the wire; the local runs exercise OUR lifecycle logic against that mock, and the real-account gate is the only surface that proves the wire format.**
 
 ## Other limitations (not mechanism-reach gaps)