rcf-lite 0.27.0 → 0.28.0

package/blueprints/messaging-queue-cloudflare/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "messaging-queue-cloudflare",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "category": "messaging",
   "capabilities": [
     "queue"

package/blueprints/messaging-queue-cloudflare/contributions/adrs/adr-3001-messaging-queue-cloudflare-adapter.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Adapter: Cloudflare Queues as the shipped v1.0.0 first adapter",
-  "context": "A project deploying a directed producer-to-consumer worklist queue on Cloudflare Workers has one native shipped answer today: Cloudflare Queues. The Queues surface is bound through wrangler configuration (a [[queues.producers]] block for the producer facade to publish through, a [[queues.consumers]] block for the Worker queue handler to consume from), and the shipped Worker runtime binds env.<binding> to a Queues object with send / sendBatch on the producer side and a batch envelope with ack / retry on the consumer side per https://developers.cloudflare.com/queues/configuration/javascript-apis/. The v1.0.0 facade must hold the adapter reference opaque at the facade boundary so a future non-Cloudflare adapter (an SQS shim, the reserved messaging-queue-postgres sibling per maintainer decision) slots in without a facade re-shape, and so a fixture-time in-memory adapter is testable without live Cloudflare Queues access.",
+  "context": "A project deploying a directed producer-to-consumer worklist queue on Cloudflare Workers has one native shipped answer today: Cloudflare Queues. The Queues surface is bound through wrangler configuration (a [[queues.producers]] block for the producer facade to publish through, a [[queues.consumers]] block for the Worker queue handler to consume from), and the shipped Worker runtime binds env.<binding> to a Queues object with send / sendBatch on the producer side and a batch envelope with ack / retry on the consumer side per https://developers.cloudflare.com/queues/configuration/javascript-apis/. The v1.0.0 facade must hold the adapter reference opaque at the facade boundary so a future non-Cloudflare adapter (an SQS shim, the reserved messaging-queue-postgres sibling per policy) slots in without a facade re-shape, and so a fixture-time in-memory adapter is testable without live Cloudflare Queues access.",
   "decision": "The shipped v1.0.0 default is Cloudflare Queues, wired through wrangler config (producer binding on [[queues.producers]], consumer on [[queues.consumers]] with dead_letter_queue and max_retries per https://developers.cloudflare.com/queues/configuration/dead-letter-queues/). The producer facade module is the sole holder of the Queues binding reference per REQ-001; the consumer registration module is the sole reader of the batch envelope per REQ-002. The adapter reference is OPAQUE at this ADR: the facade dereferences the elicited binding at the top of the module and any consumer wanting a different adapter (an SQS shim, the messaging-queue-postgres sibling minted on demand) replaces the binding reference here without touching the outward interface. A fixture-time in-memory adapter (used by the local probes) implements the same binding shape (send / sendBatch on the producer side, batch with ack / retry on the consumer side) so the facade and consumer surfaces are indistinguishable from the real Queues binding at the facade boundary. The 128 KB per-message cap and 100 messages per batch cap Cloudflare documents at https://developers.cloudflare.com/queues/platform/limits/ apply to every real-Queues run.",
   "consequences": "The project inherits the Cloudflare Queues wire-format, the platform-assigned stable message-id, and the batch envelope's per-message ack semantics. Standards trace clause: Cloudflare Queues documented per-message and per-batch limits (per https://developers.cloudflare.com/queues/platform/limits/), Cloudflare Queues Worker queue-handler contract (per https://developers.cloudflare.com/queues/configuration/javascript-apis/), and Cloudflare Queues dead-letter documentation (per https://developers.cloudflare.com/queues/configuration/dead-letter-queues/). A future non-Cloudflare adapter mints under a sibling blueprint (reserved slug messaging-queue-postgres, maintainer decision) and conflicts by design on deliverySemantics (ADR-3002) with this blueprint; the operator picks one queue backend per project via a project-level ADR.",
   "alternativesConsidered": [
@@ -17,7 +17,7 @@
     {
       "name": "Kafka or NATS as the shipped v1.0.0 default",
       "summary": "Ship a self-hosted Kafka or NATS backend as the primary v1.0.0 queue.",
-      "reasonNotChosen": "A self-hosted Kafka or NATS backend adds a persistent operational surface every applying project has to run; the round-5 spec section 5.3 targets a directed producer-to-consumer worklist as a shipped shape whose applying project need not host a broker. The reserved messaging-queue-postgres sibling (maintainer decision) covers the self-hosted-transport family separately when demand mints it."
+      "reasonNotChosen": "A self-hosted Kafka or NATS backend adds a persistent operational surface every applying project has to run; a directed producer-to-consumer worklist is a shipped shape whose applying project need not host a broker. The reserved messaging-queue-postgres sibling (sibling reservation) covers the self-hosted-transport family separately when demand mints it."
     },
     {
       "name": "Ship a hand-rolled fetch client against the Queues REST API",

package/blueprints/messaging-queue-cloudflare/contributions/adrs/adr-3002-messaging-queue-cloudflare-delivery-semantics.json

@@ -7,7 +7,7 @@
   "title": "Delivery semantics: at-least-once as the shipped shape (scope global, new topic deliverySemantics)",
   "context": "A directed producer-to-consumer worklist ships one of three delivery shapes at the transport contract: at-most-once (fire and forget, dedup at the producer), at-least-once (guaranteed delivery with duplicates possible, dedup at the consumer), or exactly-once (guaranteed delivery with dedup at the transport, expensive). Cloudflare Queues implements at-least-once with a stable message-id the consumer uses for its own dedup; the WSD-005 messaging standard (operator/knowledge/wsd/wsd-standards/wsd-005-messaging.md) makes at-least-once and out-of-order tolerance the shipped default for domain event handoffs; the messaging-queue-cloudflare blueprint claims the deliverySemantics topic on the shelf so future exactly-once or at-most-once siblings surface as DELIBERATE conflicts and not silent divergences.",
   "decision": "The shipped v1.0.0 shape is at-least-once. Every publish reaches every consumer at least once; duplicates are possible under retry-and-DLQ redelivery paths; consumer code that needs exactly-once semantics maintains its own dedup keyed on the stable message-id per REQ-002. The deliverySemantics topic scope is global on this blueprint; the topic string is deliverySemantics (lower camel case, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Future exactly-once or at-most-once siblings would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR per the round-2 conflict pattern.",
-  "consequences": "The applying project inherits an at-least-once transport with a stable message-id it uses for consumer-side dedup when the domain calls for exactly-once processing. Standards trace clause: WSD-005 clauses on at-least-once and out-of-order tolerance (satisfied by the message-id and trace-id header contract). The reserved messaging-queue-postgres sibling (maintainer decision) will claim deliverySemantics with an at-least-once answer too; two shipped answers on one topic surface a DELIBERATE conflict the operator resolves by picking one queue backend per project via a project-level ADR (the same shape as errorEnvelope and authModel conflicts the SPA and API-REST blueprints already carry).",
+  "consequences": "The applying project inherits an at-least-once transport with a stable message-id it uses for consumer-side dedup when the domain calls for exactly-once processing. Standards trace clause: WSD-005 clauses on at-least-once and out-of-order tolerance (satisfied by the message-id and trace-id header contract). The reserved messaging-queue-postgres sibling (sibling reservation) will claim deliverySemantics with an at-least-once answer too; two shipped answers on one topic surface a DELIBERATE conflict the operator resolves by picking one queue backend per project via a project-level ADR (the same shape as errorEnvelope and authModel conflicts the SPA and API-REST blueprints already carry).",
   "alternativesConsidered": [
     {
       "name": "At-most-once as the shipped v1.0.0 default",

package/blueprints/messaging-queue-cloudflare/contributions/probes/real-account-concurrency-smoke.mjs

@@ -64,13 +64,118 @@ const DOCUMENTED_PUSH_CAP = 250;
 export const anchorAcId = 'AC-29108-2';
 export const accountBound = true;
 
-function skipResult(detail) {
+// Every env var the probe reads. Superset of the shim's DECLARED_ENV
+// (shim tracks its own reads; this probe additionally reads
+// GITHUB_RUN_ID for the mint runId derivation).
+const PROBE_DECLARED_ENV = Object.freeze([
+  ...DECLARED_ENV,
+  'GITHUB_RUN_ID',
+]);
+
+// Pre-flight observation: does the target Cloudflare account have a
+// workers.dev subdomain provisioned? The queue consumer-attach step
+// (see mintScratchQueueAndWorker) requires one, and on accounts
+// without it the attach rejects with HTTP 403 code 10063 leaving a
+// partial mint that the shim rolls back. Observing the account state
+// up front lets the probe record a declared skip whose reason names
+// the missing ACCOUNT prerequisite rather than any env var, and
+// whose detail carries the API status and code as evidence. Endpoint:
+// GET /accounts/{id}/workers/subdomain (verifiedOn 2026-09-11 per
+// https://developers.cloudflare.com/api/operations/worker-subdomain-get-subdomain).
+//
+// Return classification:
+//   - `provisioned`      : HTTP 200 with `success: true` and a
+//                          non-empty `result.subdomain`. The probe
+//                          runs mint / drive / teardown.
+//   - `affirmativelyAbsent`
+//                        : the AFFIRMATIVE absence shape the vendor
+//                          returns for an unprovisioned account,
+//                          EITHER HTTP 404 with error code 10007 OR
+//                          HTTP 200 with `success: true` and a plain
+//                          `result` object whose own `subdomain` key
+//                          is present and is exactly null or the
+//                          empty string ''. The probe records an
+//                          accountBoundSkipped declared skip.
+//   - `unclassified`     : any other shape - non-2xx/non-404, a 200
+//                          success body missing `result` or with
+//                          `result` an array / primitive / null, a
+//                          missing `subdomain` key, a `subdomain` of
+//                          the wrong JSON type (number, boolean,
+//                          object, array, whitespace-only string),
+//                          malformed JSON, unexpected status/code
+//                          combination. The probe fails the verdict
+//                          with the observed status and body code
+//                          in detail; a skip on a non-absence /
+//                          schema-malformed shape is a 7d violation.
+async function preflightWorkersDevSubdomain() {
+  const accountId = process.env.CF_ACCOUNT_ID;
+  const token = process.env.CF_API_TOKEN;
+  const base = (process.env.CF_API_BASE_URL && process.env.CF_API_BASE_URL.trim())
+    ? process.env.CF_API_BASE_URL.replace(/\/$/, '')
+    : 'https://api.cloudflare.com/client/v4';
+  const url = `${base}/accounts/${accountId}/workers/subdomain`;
+  const resp = await fetch(url, { method: 'GET', headers: { authorization: `Bearer ${token}` } });
+  const text = await resp.text();
+  let json = null;
+  let parseError = null;
+  try { json = JSON.parse(text); } catch (err) { parseError = err && err.message ? err.message : 'JSON parse failed'; }
+  const errorCode = json && Array.isArray(json.errors) && json.errors[0] && json.errors[0].code;
+  // Documented success response shape (per Cloudflare API docs for
+  // GET /accounts/{account_id}/workers/subdomain, verifiedOn
+  // 2026-09-11 via https://developers.cloudflare.com/api/operations/
+  // worker-subdomain-get-subdomain): result is an object with a
+  // `subdomain` field of type string (example: "my-subdomain"). The
+  // vendor does not document the unprovisioned shape explicitly, so
+  // this classifier applies the strictest defensible interpretation:
+  //   - provisioned         : result is a plain object, has own
+  //                           `subdomain` key, value is a NON-EMPTY
+  //                           string.
+  //   - affirmativelyAbsent : result is a plain object, has own
+  //                           `subdomain` key, value is EXACTLY null
+  //                           OR the empty string ''.
+  //   - unclassified        : every other structural shape - result
+  //                           missing / null / array / primitive,
+  //                           subdomain key absent, subdomain of any
+  //                           other type (number, boolean, object,
+  //                           array, whitespace-only string, etc).
+  // Schema-malformed success bodies (e.g. `{"success":true}` with no
+  // result, or result an array, or subdomain of the wrong type) are
+  // NOT treated as absence - they fail as unclassified so a reviewer
+  // sees the exact vendor signal rather than a silent skip.
+  const isPlainResultObject = json !== null
+    && typeof json === 'object'
+    && Object.prototype.hasOwnProperty.call(json, 'result')
+    && json.result !== null
+    && typeof json.result === 'object'
+    && !Array.isArray(json.result);
+  const hasSubdomainKey = isPlainResultObject
+    && Object.prototype.hasOwnProperty.call(json.result, 'subdomain');
+  const subdomainRaw = hasSubdomainKey ? json.result.subdomain : undefined;
+  const subdomainIsProvisionedString = typeof subdomainRaw === 'string' && subdomainRaw.length > 0 && subdomainRaw === subdomainRaw.trim() && subdomainRaw.trim().length > 0;
+  const subdomainIsAbsenceSentinel = subdomainRaw === null || subdomainRaw === '';
+  const subdomain = subdomainIsProvisionedString ? subdomainRaw : null;
+  let classification = 'unclassified';
+  if (parseError === null && json) {
+    if (resp.status === 200 && json.success === true && hasSubdomainKey && subdomainIsProvisionedString) {
+      classification = 'provisioned';
+    } else if (resp.status === 404 && json.success === false && errorCode === 10007) {
+      classification = 'affirmativelyAbsent';
+    } else if (resp.status === 200 && json.success === true && hasSubdomainKey && subdomainIsAbsenceSentinel) {
+      classification = 'affirmativelyAbsent';
+    }
+  }
+  const bodyExcerpt = text.length > 400 ? text.slice(0, 400) + '...(truncated)' : text;
+  return { status: resp.status, errorCode, subdomain, classification, parseError, bodyExcerpt };
+}
+
+function skipResult({ reason, detail }) {
   return [{
     anchorAcId: 'AC-29108-2',
     verdict: 'pass',
     detail,
     accountBoundSkipped: true,
-    envDeclared: Array.from(DECLARED_ENV),
+    reason,
+    envDeclared: PROBE_DECLARED_ENV,
     throwawayPrefixes: { queue: QUEUE_PREFIX, worker: WORKER_PREFIX, telemetryKv: TELEMETRY_KV_PREFIX },
   }];
 }
@@ -109,14 +214,53 @@ async function readTelemetryRecords({ namespaceId }) {
 export default async function runProbe() {
   const hasAccount = process.env.CI_HAS_CLOUDFLARE_ACCOUNT === '1' || process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true';
   if (!hasAccount) {
-    return skipResult(`accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT unset; a real-account run requires CI_HAS_CLOUDFLARE_ACCOUNT=true plus CF_ACCOUNT_ID and CF_API_TOKEN. The fixture mints its own throwaway Queue + consumer Worker + telemetry KV namespace under the CI scratch prefixes; publishes via the CF Queues REST publish endpoint (no workers.dev subdomain enabled); reads telemetry via the KV REST list + get endpoints. Cap under test: ${DOCUMENTED_PUSH_CAP} concurrent invocations per push-consumer per https://developers.cloudflare.com/queues/platform/limits/. Message count: ${DEFAULT_MESSAGE_COUNT}.`);
+    return skipResult({
+      reason: 'CI_HAS_CLOUDFLARE_ACCOUNT',
+      detail: `accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT unset; a real-account run requires CI_HAS_CLOUDFLARE_ACCOUNT=true. When set, the fixture shim self-provisions a throwaway Queue, consumer Worker and telemetry KV namespace under the frozen scratch prefixes, publishes via the Cloudflare Queues REST publish endpoint (verifiedOn 2026-09-10 per https://developers.cloudflare.com/api/operations/queue-publish-messages), reads telemetry via the KV REST list and get endpoints, and tears every resource down before exit. Cap under test: ${DOCUMENTED_PUSH_CAP} concurrent invocations per push-consumer per https://developers.cloudflare.com/queues/platform/limits/ (verifiedOn 2026-09-10). Message count: ${DEFAULT_MESSAGE_COUNT}.`,
+    });
+  }
+  const missingCreds = [];
+  if (!process.env.CF_ACCOUNT_ID) missingCreds.push('CF_ACCOUNT_ID');
+  if (!process.env.CF_API_TOKEN) missingCreds.push('CF_API_TOKEN');
+  if (missingCreds.length > 0) {
+    const noun = missingCreds.length > 1 ? 'those credentials are' : 'that credential is';
+    return skipResult({
+      reason: missingCreds.join(','),
+      detail: `accountBoundSkipped: ${missingCreds.join(' and ')} unset; a real-account run requires ${noun} present. Cap under test: ${DOCUMENTED_PUSH_CAP} concurrent invocations per push-consumer per https://developers.cloudflare.com/queues/platform/limits/ (verifiedOn 2026-09-10). Message count: ${DEFAULT_MESSAGE_COUNT}.`,
+    });
   }
-  if (!process.env.CF_ACCOUNT_ID || !process.env.CF_API_TOKEN) {
+  // Pre-flight account-state observation: the queue consumer-attach
+  // API requires the target Cloudflare account to have a workers.dev
+  // subdomain provisioned (rejects with HTTP 403 code 10063 without
+  // one, per https://developers.cloudflare.com/api/resources/queues/
+  // subresources/consumers/ verifiedOn 2026-09-10). This probe
+  // observes the subdomain state directly via
+  // GET /accounts/{id}/workers/subdomain and records a declared skip
+  // when the account has none - the reason names the missing ACCOUNT
+  // prerequisite (not an env var) and the detail carries the API
+  // status and error code as positive evidence of the observation.
+  // A fully capable account carries a subdomain and the probe
+  // proceeds unconditionally to mint / drive / teardown.
+  const preflight = await preflightWorkersDevSubdomain();
+  if (preflight.classification === 'affirmativelyAbsent') {
+    return skipResult({
+      reason: 'cloudflare-account-workers-dev-subdomain-not-provisioned',
+      detail: `accountBoundSkipped: pre-flight GET /accounts/{id}/workers/subdomain returned status=${preflight.status} errorCode=${preflight.errorCode ?? 'null'} subdomain=${preflight.subdomain ?? 'null'} - the target Cloudflare account affirms it has no workers.dev subdomain provisioned. The queue consumer-attach step (see https://developers.cloudflare.com/api/resources/queues/subresources/consumers/, verifiedOn 2026-09-10) rejects with HTTP 403 code 10063 in that state, so the probe cannot complete a live run against this account. The account prerequisite (a provisioned workers.dev subdomain) is out of the probe's authorship scope. Cap under test: ${DOCUMENTED_PUSH_CAP} concurrent invocations per push-consumer per https://developers.cloudflare.com/queues/platform/limits/ (verifiedOn 2026-09-10). Message count: ${DEFAULT_MESSAGE_COUNT}.`,
+    });
+  }
+  if (preflight.classification !== 'provisioned') {
+    // Any non-absence, non-success response from the pre-flight is a
+    // real failure that must not be swallowed as a skip (authoring
+    // standard section 7d: a bare pass on a shape the probe did not
+    // observe would be positive-evidence-missing). Detail carries the
+    // observed status, Cloudflare error code and body excerpt so the
+    // reviewer can act on the exact vendor signal.
     return [{
       anchorAcId: 'AC-29108-2',
       verdict: 'fail',
-      detail: `CI_HAS_CLOUDFLARE_ACCOUNT=true but one of CF_ACCOUNT_ID / CF_API_TOKEN is missing: accountIdPresent=${!!process.env.CF_ACCOUNT_ID} tokenPresent=${!!process.env.CF_API_TOKEN}.`,
-      envDeclared: Array.from(DECLARED_ENV),
+      detail: `pre-flight GET /accounts/{id}/workers/subdomain returned an unclassified shape: status=${preflight.status} errorCode=${preflight.errorCode ?? 'null'} subdomain=${preflight.subdomain ?? 'null'} parseError=${preflight.parseError ?? 'null'} bodyExcerpt=${preflight.bodyExcerpt}. The probe refuses to declare an accountBound skip on a shape that is neither the vendor's affirmative absence (HTTP 404 code 10007, or HTTP 200 with an empty subdomain) nor a provisioned subdomain (HTTP 200 with a non-empty result.subdomain).`,
+      envDeclared: PROBE_DECLARED_ENV,
+      preflight: { status: preflight.status, errorCode: preflight.errorCode, subdomain: preflight.subdomain, parseError: preflight.parseError },
     }];
   }
 
@@ -131,10 +275,11 @@ export default async function runProbe() {
       anchorAcId: 'AC-29108-2',
       verdict: 'fail',
       detail: `mintScratchQueueAndWorker failed: ${err.message}`,
-      envDeclared: Array.from(DECLARED_ENV),
+      envDeclared: PROBE_DECLARED_ENV,
     }];
   }
 
+  let results = null;
   try {
     const started = Date.now();
     const batches = [];
@@ -154,12 +299,13 @@ export default async function runProbe() {
     ));
     const publishFail = publishResults.find((r) => !r.ok);
     if (publishFail) {
-      return [{
+      results = [{
         anchorAcId: 'AC-29108-2',
         verdict: 'fail',
         detail: `queuePublishBatch failed: status=${publishFail.status} error=${publishFail.error}`,
-        envDeclared: Array.from(DECLARED_ENV),
+        envDeclared: PROBE_DECLARED_ENV,
       }];
+      return results;
     }
     const publishedCount = publishResults.reduce((acc, r) => acc + (r.count ?? 0), 0);
 
@@ -181,7 +327,7 @@ export default async function runProbe() {
     const observedConcurrency = maxConcurrent > 1;
     const allOk = drained && withinCap && observedConcurrency;
 
-    return [{
+    results = [{
       anchorAcId: 'AC-29108-2',
       verdict: allOk ? 'pass' : 'fail',
       detail: allOk
@@ -196,14 +342,36 @@ export default async function runProbe() {
       batches: batchesConsumed,
       maxConcurrent,
       elapsedMs: elapsed,
-      envDeclared: Array.from(DECLARED_ENV),
+      envDeclared: PROBE_DECLARED_ENV,
       throwawayPrefixes: { queue: QUEUE_PREFIX, worker: WORKER_PREFIX, telemetryKv: TELEMETRY_KV_PREFIX },
     }];
+    return results;
   } finally {
     try {
       await destroyScratchQueueAndWorker(mint);
     } catch (err) {
-      process.stderr.write(`h2-cf-queue probe: teardown failed for queue=${mint && mint.queue && mint.queue.id} worker=${mint && mint.worker && mint.worker.name} telemetryKv=${mint && mint.telemetryKv && mint.telemetryKv.id}: ${err.message}; sweepOrphans will collect on next run.\n`);
+      const orphaned = {
+        queueId: mint && mint.queue && mint.queue.id,
+        queueName: mint && mint.queue && mint.queue.name,
+        workerName: mint && mint.worker && mint.worker.name,
+        telemetryKvId: mint && mint.telemetryKv && mint.telemetryKv.id,
+      };
+      const orphanRecord = {
+        anchorAcId: 'AC-29108-2',
+        verdict: 'fail',
+        detail: `TEARDOWN FAILED: destroyScratchQueueAndWorker threw ${err && err.message ? err.message : String(err)}; potentially orphaned resources on the account: queue.id=${orphaned.queueId} queue.name=${orphaned.queueName} consumerWorker.name=${orphaned.workerName} telemetryKv.id=${orphaned.telemetryKvId}. sweepOrphans on the shim will collect on the next real-account run; a live account audit is still recommended.`,
+        teardownFailed: true,
+        orphaned,
+        envDeclared: PROBE_DECLARED_ENV,
+        throwawayPrefixes: { queue: QUEUE_PREFIX, worker: WORKER_PREFIX, telemetryKv: TELEMETRY_KV_PREFIX },
+      };
+      if (Array.isArray(results)) {
+        results.push(orphanRecord);
+      } else {
+        // Body threw before assigning results (would have propagated already);
+        // this branch keeps the safety net symmetric.
+        results = [orphanRecord];
+      }
     }
   }
 }

package/blueprints/messaging-queue-cloudflare/contributions/requirements/messaging-queue-cloudflare-req-006.json

@@ -2,7 +2,7 @@
   "reqId": "messaging-queue-cloudflare-REQ-006",
   "prdId": "PRD-001",
   "title": "Lifecycle events with metadata-only fields: producerReady, messagePublished, messageAcked, messageDeadLettered",
-  "description": "The facade fires four lifecycle events on the injected event sink: producerReady (once per facade instance, on the first successful ready-check), messagePublished (once per successful publish), messageAcked (once per successful ack), messageDeadLettered (once per DLQ landing). Every event record carries a metadata-only field whitelist: messageId, queueName, attempts (integer, 0 for producerReady and messagePublished), ts (ISO 8601 UTC). No event record contains the message body, any header value, any consumer-context field, or any producer-context field. The whitelist is enforced in code (the sink adapter refuses forbidden fields); a call site that hands a body-bearing payload to the sink is refused at author-side review.",
+  "description": "The facade fires four lifecycle events on the injected event sink: producerReady (once per facade instance, on the first successful ready-check), messagePublished (once per successful publish), messageAcked (once per successful ack), messageDeadLettered (once per DLQ landing). Every event record carries a metadata-only field whitelist: messageId, queueName, attempts (integer, 0 for producerReady and messagePublished), ts (ISO 8601 UTC). No event record contains the message body, any header value, any consumer-context field, or any producer-context field. The whitelist is enforced in code (the sink adapter refuses forbidden fields); a call site that hands a body-bearing payload to the sink is refused at the author-side check.",
   "category": "functional",
   "domain": "messaging",
   "priority": "must",

package/blueprints/messaging-queue-cloudflare/docs/topics.md

@@ -56,7 +56,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 29101-29108 sit at the LOW end of the 29101-29899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a messaging-queue-cloudflare REQ id into the number 29110 would collide against a shipped US-29110; band headroom (29109-29899) leaves that space.
+US 29101-29108 sit at the LOW end of the 29101-29899 band on purpose. A project-side story mechanically derived from a messaging-queue-cloudflare REQ id into the number 29110 would collide against a shipped US-29110; band headroom (29109-29899) leaves that space.
 
 ADR/TAC suffixes for this blueprint use the 3001-3099 block, continuing the shelf pattern.
 
@@ -68,4 +68,4 @@ ADR/TAC suffixes for this blueprint use the 3001-3099 block, continuing the shel
 
 ## Deliberate-conflict statement
 
-This blueprint's ADR-3002 on `deliverySemantics` is a first shipped answer to a topic that will conflict, by design, with future exactly-once or at-most-once siblings, and with the reserved `messaging-queue-postgres` sibling (maintainer decision). Applying `messaging-queue-cloudflare` alongside a hypothetical `messaging-queue-postgres` raises one `globalAdrTopic` conflict the operator resolves via one of the four documented resolutions per topic (adopt one, keep the existing one, author a project-level supersede ADR, or `--resolve <topic>=project:<ADR-id>` on the add).
+This blueprint's ADR-3002 on `deliverySemantics` is a first shipped answer to a topic that will conflict, by design, with future exactly-once or at-most-once siblings, and with the reserved `messaging-queue-postgres` sibling (sibling reservation). Applying `messaging-queue-cloudflare` alongside a hypothetical `messaging-queue-postgres` raises one `globalAdrTopic` conflict the operator resolves via one of the four documented resolutions per topic (adopt one, keep the existing one, author a project-level supersede ADR, or `--resolve <topic>=project:<ADR-id>` on the add).

package/blueprints/messaging-queue-cloudflare/guide/messaging-queue-cloudflare.md

@@ -6,7 +6,7 @@ A directed producer-to-consumer worklist queue on Cloudflare Queues: publish, co
 
 Four lifecycle events fire on the injected event sink with a rigid metadata-only whitelist (`event`, `ts`, `messageId`, `queueName`, `attempts`); consumer logging cannot leak object body bytes, header values, consumer-context fields or PII from the message body. The whitelist is enforced in code by the sink adapter (`event-sink.mjs`), not just documented.
 
-The reserved sibling `messaging-queue-postgres` (maintainer decision, deferred v1.0.0 pending demand) mints on demand and conflicts by design on `deliverySemantics` with this blueprint; the operator picks one queue backend per project via a project-level ADR.
+The reserved sibling `messaging-queue-postgres` (sibling reservation, deferred v1.0.0 pending demand) mints on demand and conflicts by design on `deliverySemantics` with this blueprint; the operator picks one queue backend per project via a project-level ADR.
 
 ## Apply this blueprint
 
@@ -46,7 +46,7 @@ await producer.publishBatch([
 
 The `x-trace-id` header and the publish and publishBatch verbs are owned at `TAC-3001.interfaces[2].description`; the values above are illustrative.
 
-The facade is the sole holder of the queue binding reference per REQ-001. A call site that reaches into `env.<binding>.send()` directly is refused at author-side review.
+The facade is the sole holder of the queue binding reference per REQ-001. A call site that reaches into `env.<binding>.send()` directly is refused at the author-side check.
 
 ## Consumer registration shape
 

package/blueprints/object-storage-s3/CHANGELOG.md

@@ -1,5 +1,76 @@
 # Changelog
 
+## 1.2.9 - 2026-09-12
+
+R2 and Hetzner account-bound skips now emit the exact anatomy-accepted shape (`<VAR> (not "true")` with no `set to "..."` preamble); a new synthetic negative-case test in the object-storage-s3 anatomy proves the accepted shapes parse to a bare declared env-var name and rejects the earlier malformed emissions. Anatomy pin bumped to 1.2.9.
+
+- fix: `blueprints/object-storage-s3/contributions/probes/r2-real-account-smoke.mjs` non-"true" skip emits `CI_HAS_CLOUDFLARE_ACCOUNT (not "true")` (no value preamble, no `set to`).
+- fix: `blueprints/object-storage-s3/contributions/probes/hetzner-object-storage-round-trip.mjs` non-"true" skip emits `CI_HAS_HETZNER_OBJECT_STORAGE (not "true")` (same rule).
+- test: `packages/rcf-lite/test/blueprint/object-storage-s3-anatomy.test.js` adds `TC-071-skip-shape-negative` covering `CI_HAS_CLOUDFLARE_ACCOUNT`, `CI_HAS_HETZNER_OBJECT_STORAGE` and `S3_ENDPOINT_URL` in both accepted shapes and the malformed shapes the anatomy MUST reject (including the earlier R2 and Hetzner emissions that carried a `set to "..."` preamble).
+
+## 1.2.8 - 2026-09-12
+
+The Hetzner event-secrecy row anchor is corrected, the R2 inventory-diff row is de-claimed to `conformanceOnly`, the event-secrecy fixture stops leaking engine-returned ids on the lifecycle event stream, and `STRICT_ID_KEYS` is tightened to engine-returned scalars only. Anatomy pin bumped to 1.2.8.
+
+- fix: `blueprints/object-storage-s3/contributions/probes/hetzner-object-storage-round-trip.mjs` lifecycle-event whitelist row is now `conformanceOnly` naming AC-28105-1 (metadata-only lifecycle events, whose contract this row actually observes). It previously anchored AC-28110-1, which states endpoint composition / put-get-delete / teardown / skip / malformed-endpoint behaviour and does NOT state event secrecy.
+- fix: `blueprints/object-storage-s3/contributions/probes/r2-real-account-smoke.mjs` per-object inventory-diff row is now `conformanceOnly` naming AC-28108-2. The AC's object round-trip clause is anchored on the byte-equal put/get row (which carries the engine-returned `ETag`); R2 does not surface a per-object `$metadata.requestId` on `listObjects` / `deleteObject`, so the inventory-diff row has no engine-returned scalar id and cannot be an anchor.
+- fix: `packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs` `objectPut` and `objectDeleted` lifecycle events no longer carry `requestId` or `eTag` fields (AC-28105-1's metadata-only whitelist); the engine-returned ids live on the RETURN value of each verb, which the probes read directly.
+- fix: `packages/rcf-lite/test/blueprint/object-storage-s3-anatomy.test.js` STRICT_ID_KEYS removed the plural / probe-selected keys (`requestIds`, `vendorRequestIds`, `metadataRequestId`, `httpRequestId`, `observedUploadId`, `dlqTransportMessageIds`, `primaryTransportMessageId`, `jobIds`, `dlqPayloadJobIds`, `expectedPayloadJobId`) so only engine-returned scalar identifiers qualify as id-witnesses.
+- prose: anatomy header comment corrected to describe the in-memory validation the anatomy performs (probes invoked directly; no `.rcf/reports` record read on this seam).
+
+
+## 1.2.7 - 2026-09-11
+
+Engine-returned identifiers only. The object-storage-s3 facade fixture now surfaces `$metadata.requestId` and `ETag` from every operation (`putObject`, `getObject`, `deleteObject`, `listObjects`, `listMultipartUploads`, `completeMultipartUpload`) as return-value scalars. Every counting probe row records `vendorRequestId` (and where the operation returns it, `eTag` or `uploadId`) as its engine-returned identifier witness, alongside its derived witnesses. STRICT_ID_KEYS on the anatomy shrank to engine-returned scalars only; the anatomy now also enforces that idWitness and derivedWitness sit under DIFFERENT keys. Anatomy pin bumped to 1.2.7.
+
+- fix: `packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs` returns `{ size, requestId, eTag, uploadId }` from `putObject`, `{ body, contentType, requestId, eTag }` from `getObject`, `{ requestId }` from `deleteObject`, `{ keys, isTruncated, nextContinuationToken, requestId }` from `listObjects`, an array with a non-enumerable `requestId` from `listMultipartUploads`. Multipart `completeMultipartUpload` also propagates `uploadId` + `requestId` on the aggregate return.
+- fix: `put-get-round-trip`, `multipart-upload`, `presigned-url`, `event-secrecy`, `r2-real-account-smoke`, `hetzner-object-storage-round-trip` each stamp the engine-returned `vendorRequestId` (and `eTag` / `uploadId` where relevant) as their strict id witness on every counting row.
+- fix: `packages/rcf-lite/test/blueprint/object-storage-s3-anatomy.test.js` STRICT_ID_KEYS retains engine-returned scalars only (`requestId`, `vendorRequestId`, `eTag`, `versionId`, `uploadId`, `queueId`, `messageId`, `jobId`, `rowId`, `insertedId`, `backendPid`, `transactionId`, `migrationVersion` and their labelled siblings). `bucketName`, `scratchBucket`, `queueName`, `databaseName` and the checksum keys were removed. Same-file strict-AND now asserts idWitness and derivedWitness sit under DIFFERENT keys.
+- prose: run-notes now says `S3_ENDPOINT_URL` is a required declared variable with no fixture default; the earlier "fixture default overridden" line was corrected.
+
+
+
+## 1.2.6 - 2026-09-11
+
+Lazy engine-client load discipline. Under a CI condition where the fixture's `node_modules` has not been installed and `S3_ENDPOINT_URL` is unset, the probe module surface must load without touching `@aws-sdk/client-s3`: an anatomy or tooling walk imports the probe, the probe calls `endpointFromEnv`, catches `MissingS3EndpointError`, and returns the exact one-variable `accountBoundSkipped` row. The prior module-level `import * as awsS3 from '@aws-sdk/client-s3'` and `import { getSignedUrl } from '@aws-sdk/s3-request-presigner'` in `object-store.mjs` resolved the SDK on module load and failed the anatomy TC-071-fixture-and-switches test with `ERR_MODULE_NOT_FOUND` in CI. The SDK is now loaded LAZILY inside `createObjectStore` and via the exported `loadSdk()` helper; `createObjectStore` is async and every probe `await`s it. Anatomy pin bumped to 1.2.6.
+
+- fix: `packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs` no longer carries module-level imports of `@aws-sdk/client-s3` or `@aws-sdk/s3-request-presigner`. The retired top-level `export const sdk = awsS3` is replaced by an exported async `loadSdk()` helper that returns the SDK namespace on demand; `createObjectStore` is async and loads the SDK plus signer inside its body, after `S3_ENDPOINT_URL` is present.
+- fix: every probe that instantiates the facade (`facade-round-trip`, `put-get-round-trip`, `presigned-url`, `multipart-upload`, `event-secrecy`, `r2-real-account-smoke`, `hetzner-object-storage-round-trip`) prefixes `createObjectStore` with `await`; behaviour on both the run path and the skip path is unchanged.
+- fix: the two probes that dip into raw SDK constructors on the run path (`facade-round-trip`, `event-secrecy`) now call `loadSdk()` on the same run-path branch that already dynamically imports the fixture facade; the SDK never resolves on the skip path.
+- fix: every counting row on `put-get-round-trip`, `multipart-upload`, `presigned-url` and `event-secrecy` carries `bucketName` as its string id witness so the row satisfies the strict AND-witness rule alongside its existing derived witnesses (the strict identifier predicate refuses non-string id keys).
+
+
+## 1.2.5 - 2026-09-11
+
+The probe owns its skip, the anatomy invokes every probe unconditionally, and no endpoint-host literal remains in shipped fixture code. The infra-s3-and-queue fixture helper `endpointFromEnv` no longer carries an endpoint-host default: when `S3_ENDPOINT_URL` is unset the helper throws a typed `MissingS3EndpointError` and each S3 local probe (facade-round-trip, put-get-round-trip, presigned-url, multipart-upload, event-secrecy) declares `DECLARED_ENV=['S3_ENDPOINT_URL']`, catches the error, and returns the exact one-variable `accountBoundSkipped` row rather than reaching a hard-coded endpoint. The anatomy no longer fabricates a skip row when the gate is unset; it invokes every probe and validates whatever comes back. The identifier predicate is now string-only (booleans, numbers, arrays and objects never qualify) and the limitation-token check sweeps every `AC-[A-Za-z0-9-]+` token. Anatomy pin bumped to 1.2.5.
+
+- fix: `endpointFromEnv` throws `MissingS3EndpointError` when `S3_ENDPOINT_URL` is unset; the retired endpoint-host default is gone from shipped fixture code.
+- fix: every S3 local probe (facade, put-get, presigned, multipart, event-secrecy) catches `MissingS3EndpointError` and returns the exact one-variable `accountBoundSkipped` row per authoring-standard section 7d.
+- fix: anatomy identifier predicate is string-only and non-empty; booleans, numbers, arrays and objects never satisfy an engine-minted id key.
+- fix: anatomy limitation-token regex broadened to `AC-[A-Za-z0-9-]+` so every AC token is checked for membership in the shipped user-story AC set.
+
+
+## 1.2.4 - 2026-09-11
+
+Strict-anatomy rewrite of the 7d witness rules. The anatomy test now REQUIRES an AC-id-membership check on every limitation and every notObservableHere.ac (must exist in the shipped user-story set), REQUIRES both an id-shape witness AND a derived-value witness on every non-declaimed row (strict AND), invokes every probe directly and validates each returned row in-memory, and requires accountBoundSkipped rows to name exactly one env var declared on the probe DECLARED_ENV. Anatomy pin bumped to 1.2.4. Probe enrichment scope: presigned-url row 2 now carries `refusalFired` and `refusalCode` alongside the `refused`/`requestedTtlSeconds`/`floorSeconds` derived witnesses. Section-header comment on the anatomy test rewritten to drop internal work-item terminology.
+
+- fix: run-notes correction so the DeleteBucket HTTP status matches the record (204).
+
+## 1.2.3 - 2026-09-11
+
+Positive-evidence conformance work on the probe pack (authoring standard section 7d), plus live-engine runs on Cloudflare R2 for the real-account probe. The r2-real-account-smoke and hetzner-object-storage-round-trip skip records carry a `reason` field naming the exact unset env var alongside `accountBoundSkipped: true`; both probes export a `DECLARED_ENV` list and gate every second-tier variable so an undeclared short-circuit is impossible. r2-real-account-smoke additionally records the S3 endpoint host prefix (redacted), a scratch bucket lifecycle (create with HTTP status, ListBuckets present-after-create with HTTP status, DeleteBucket with HTTP status, ListBuckets absent-after-delete with HTTP status), and an object round trip inside the scratch bucket (key, byteCount, byteEqual); vendor request ids on the R2 lifecycle rows are recorded when the S3 SDK surfaces them and omitted otherwise. Facade-round-trip and event-secrecy rows embed the vendor request id (SDK $metadata.requestId) and response excerpt from the underlying MinIO or R2 call directly on each result row. probe-utils' `runShim` accepts the `{results, extra}` envelope so account-bound probes surface `accountBoundSkipped`, `envDeclared` and `evidence` bags on the aggregate report; aggregate flips to pass when every result is an account-bound skip. The infra-s3-and-queue fixture README gains a Declared env vars table for the object-storage-s3 pack (endpoint quintet, R2 tier, Hetzner tier, induced-failure switches). Local MinIO runs cover the five in-process probes; the Cloudflare R2 branch mints a throwaway bucket and destroys it inside the run; the Hetzner branch honestly skips with `reason: CI_HAS_HETZNER_OBJECT_STORAGE unset`.
+
+- fix: r2-real-account-smoke mints and DELETES a scratch bucket via S3 CreateBucket/DeleteBucket, records each call's HTTP status, records the bucket present on ListBuckets after create and absent on ListBuckets after delete, and treats a failed inventory as a FAIL (never converted to an empty list). Bucket-lifecycle rows are conformance-only (anchorAcId: null) and their limitation names AC-28108-2 explicitly, since AC-28108-2 states an object-level round trip on an already-provisioned bucket, not bucket-level lifecycle; the object-round-trip and inventory-diff rows anchor AC-28108-2. Endpoint-resolution failure after a preflight is a FAIL, not a compound account skip.
+- fix: multipart-upload forces the induced-failure branch inside the probe (sets `SIMULATE_PART_UPLOAD_FAIL` for the second put, restoring the prior value on exit) so the abort-branch acceptance criterion always carries observed evidence, not "path not run". The propagated error carries `uploadId` and, when the abort itself fails, `abortError` (the uploader no longer swallows abort failures). The row records `observedUploadId` and `abortError` as evidence and matches `observedUploadId` against the create-multipart-upload response's id.
+- fix: presigned-url fetches the same URL after `ttl+2` seconds and asserts HTTP 403 per the presigned TTL acceptance criterion; the tampered-signature shortcut path is removed from the canonical row. The below-floor refusal row is anchored to the presigned TTL requirement (no AC states a below-floor refusal shape). The raw record carries a `urlSha256` of the fetched URL so URL identity across the two fetches is self-contained.
+- fix: hetzner-object-storage-round-trip's honest-skip rows name exactly one unset variable per row (one row for the gate, one for each second-tier variable when set-but-not-true); teardown of the scratch object AND the facade close are each recorded on a result row (a teardown FAIL fails the verdict).
+- fix: `run-*.mjs` shims replace the fabricated engine wrapper with a real MinIO `/minio/health/live` observation (httpStatus + responseTimeMs) for local runs; the R2 shim carries a real ListBuckets observation on the account.
+- fix: facade-round-trip and event-secrecy rows embed the vendor request id (SDK's `$metadata.requestId`) and a response excerpt from the underlying MinIO or R2 call on the row itself, not only in the report envelope.
+- fix: every result row on every probe carries its own `evidence` object; the shared `aggregate([])` helper returns `fail` with `no checks ran` instead of a default success verdict on an empty results array.
+- fix: the R2 evidence records a placeholder for the endpoint host prefix rather than the raw account-id fragment.
+- fixture: `src/bucket-ops.mjs` added (thin wrapper over `@aws-sdk/client-s3`'s bucket-lifecycle commands, dependency-resolved through the fixture's own `node_modules`) so the R2 probe drives scratch-bucket lifecycle without adding an SDK dep to rcf-lite. `src/object-store.mjs`'s multipart uploader attaches `uploadId` and, on abort failure, `abortError` to the propagated error instead of swallowing the abort.
+
+
 ## 1.2.2 (register patch, 2026-09-10)
 
 - Register: remove residual internal editorial and provenance phrases from README and guide (closes F-1, F-2 register findings).
@@ -11,13 +82,13 @@
 
 ## 1.2.0 - 2026-09-09
 
-Adds the elicits block (s3-endpoint-url, s3-bucket-name, s3-adapter, presigned-ttl-ceiling-seconds, multipart-threshold-bytes, hetzner-location-code) that the REQs and guide were already describing in prose. Adds a runtime clause naming the objectStorage applied capability on REQ-001. Adds deliveredBy on REQ-003, REQ-005 and REQ-006. Closes chain-contradiction specimens F-2 (REQ-006 boundary tightened: the facade factory accepts only { secretRef, resolver } and refuses a resolved { accessKeyId, secretAccessKey } object at the boundary with error kind rejectedResolvedCredentials; AC-28106-1 asserts the refusal), F-3 (REQ-005 and AC-28105-1 standardise on ts as the wall-clock milliseconds-since-epoch field name, aligning with TAC-2903), F-5 (REQ-002 gains the shipped key-shape check on the facade's public verbs; new AC-28102-3 asserts the invalidKey refusal for empty keys, leading-slash, ".." or "//" segments, and keys longer than 1024 bytes). Adds disposition to every AC.
+Adds the elicits block (s3-endpoint-url, s3-bucket-name, s3-adapter, presigned-ttl-ceiling-seconds, multipart-threshold-bytes, hetzner-location-code) that the REQs and guide were already describing in prose. Adds a runtime clause naming the objectStorage applied capability on REQ-001. Adds deliveredBy on REQ-003, REQ-005 and REQ-006. REQ-006 boundary tightened: the facade factory accepts only `{ secretRef, resolver }` and refuses a resolved `{ accessKeyId, secretAccessKey }` object at the boundary with error kind `rejectedResolvedCredentials`; AC-28106-1 asserts the refusal. REQ-005 and AC-28105-1 standardise on `ts` as the wall-clock milliseconds-since-epoch field name, aligning with TAC-2903. REQ-002 gains the shipped key-shape check on the facade's public verbs; new AC-28102-3 asserts the `invalidKey` refusal for empty keys, leading-slash, `..` or `//` segments, and keys longer than 1024 bytes. Adds disposition to every AC.
 
 # object-storage-s3 changelog
 
 ## 1.1.0 - 2026-09-08
 
-Follow-up adapter minor bump adding the Hetzner Object Storage provider value under the shipped v1.0.0 S3-API facade contract. Landed via the hetzner-round-7-spec-2026-09-07 section 5.4 follow-up (ratified 2026-09-07T10:15Z on the project maintainer's 09:50Z ruling "round 7 - agreee to all") as a sequential PR post round 7. Additive only: every existing v1.0.0 contribution id is byte-identical; the shipped Cloudflare R2 real-account smoke, the MinIO local emulator round-trip and the five shipped Node-only probes continue to pass byte-identical on the extended fixture. rcf-lite package version does NOT bump for this follow-up (spec section 8).
+Follow-up adapter minor bump adding the Hetzner Object Storage provider value under the shipped v1.0.0 S3-API facade contract. Additive only: every existing v1.0.0 contribution id is byte-identical; the shipped Cloudflare R2 real-account smoke, the MinIO local emulator round-trip and the five shipped Node-only probes continue to pass byte-identical on the extended fixture. rcf-lite package version does NOT bump for this follow-up.
 
 - 4 delta contributions on the blueprint side (25 total, up from 21): 1 REQ (`object-storage-s3-REQ-101`, endpoint-shape contract), 1 US (`object-storage-s3-US-28110` with `AC-28110-1` labelled `AC-hetznerObjectStorage-endpointRoundTrip`), 1 TAC (`TAC-2904-object-storage-s3-hetzner-endpoint-helper`, sole composer of `<bucket>.<location>.your-objectstorage.com`), 1 ADR (`ADR-2905-object-storage-s3-hetzner-object-storage-provider`, scope local, `standardsTraceClause: Hetzner Object Storage S3 compatibility documented endpoint shape`).
 - One new Node-only probe `hetzner-object-storage-round-trip.mjs` under `contributions/probes/`, `accountBound: true`, gated on `CI_HAS_HETZNER_OBJECT_STORAGE` alongside `HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID`, `HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY`, `HETZNER_OBJECT_STORAGE_BUCKET`, `HETZNER_OBJECT_STORAGE_LOCATION`; without the gate env var the probe records `accountBoundSkipped: true` per spec section 3.5. The round-5 R2 real-account smoke is unaffected and stays gated on `CI_HAS_CLOUDFLARE_ACCOUNT`.
@@ -28,7 +99,7 @@ Follow-up adapter minor bump adding the Hetzner Object Storage provider value un
 
 ## 1.0.0 - 2026-09-06
 
-Initial release. Contract for S3-shape object storage on any S3-compatible endpoint (Cloudflare R2 first, MinIO for local dev, AWS S3, Backblaze B2, Wasabi, self-hosted). Accessed through a store facade that is the sole reader of the S3 client (`@aws-sdk/client-s3` on Node targets or `aws4fetch` on Workers targets). Landed via the infra round 5 spec (ratified 2026-09-06).
+Initial release. Contract for S3-shape object storage on any S3-compatible endpoint (Cloudflare R2 first, MinIO for local dev, AWS S3, Backblaze B2, Wasabi, self-hosted). Accessed through a store facade that is the sole reader of the S3 client (`@aws-sdk/client-s3` on Node targets or `aws4fetch` on Workers targets).
 
 - 21 contributions: 6 REQs on facade sole-reader / put-get-delete-list / presigned URL / multipart / lifecycle events / credential-pair discipline; 8 USs at 28101-28108; 3 TACs (2901 facade, 2902 multipart uploader, 2903 event sink); 4 ADRs (2901 adapter elicited between AWS SDK and aws4fetch, 2902 presigned TTL default 15 minutes floor 1 minute, 2903 multipart threshold default 8 MiB, 2904 objectStorageContract with scope global).
 - Six Node-only probes under `contributions/probes/` proven against a live MinIO container: `facade-round-trip`, `put-get-round-trip`, `presigned-url`, `multipart-upload`, `event-secrecy`, and the accountBound `r2-real-account-smoke`. The R2 smoke records `accountBoundSkipped: true` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset per spec section 3.5.
@@ -38,4 +109,4 @@ Initial release. Contract for S3-shape object storage on any S3-compatible endpo
 - Refuses composition when `security-secrets-management` v1.0.1+ is not applied. Declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` per the capability mechanism. `rcf define blueprint add object-storage-s3` on a bare project exits 3 with `[object-storage-s3-no-secrets]` on stderr, names the shipped predecessor, and points at the override. `--allow-no-secrets-yet` records a `notes` line on `rcf/blueprints/object-storage-s3.applied.json` for later reconciliation. Companion runner extensions (added by this PR to keep the mechanism whole): `src/blueprint/capabilities.js` `buildRefusalMessage` gains a bespoke template branch for `object-storage-s3-no-secrets` (echoes the message id as the first-line tag; other refusalMessageId values also gain a `[<id>]` tag on the first line of the generic fallback for dashboards/lint); `src/cli/blueprint.js` accepts the new `--allow-no-secrets-yet` flag; `src/blueprint/apply.js` sidecar `notes` prose derives predecessor family from the `allowSkipFlag` name (auth vs secrets-management) so the note reads sensibly for either predecessor.
 - Every ADR contribution entry on `blueprint.json` carries a `standardsTraceClause` per section 8a.2 (per the operator estate mid-flight ruling after PR #154 gate).
 
-Review-fix (2026-09-09): Adds one option-binding AC on s3-adapter aws-sdk-client-s3 (AC-28101-4) to close section 7c on the elicits catalogue. Adds deliveredBy on REQ-002, REQ-004, REQ-101. Sweeps vendorCitation onto fixed ACs resting on vendor facts (AC-28102-1, AC-28102-2, AC-28103-1, AC-28103-2, AC-28108-1).
+Adds one option-binding AC on s3-adapter aws-sdk-client-s3 (AC-28101-4) to close section 7c on the elicits catalogue. Adds deliveredBy on REQ-002, REQ-004, REQ-101. AC-28102-1, AC-28102-2, AC-28103-1, AC-28103-2, and AC-28108-1 carry vendorCitation.

package/blueprints/object-storage-s3/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "object-storage-s3",
-  "version": "1.2.2",
+  "version": "1.2.9",
   "category": "object-storage",
   "capabilities": [
     "objectStorage"
@@ -210,5 +210,6 @@
       ],
       "default": "fsn1"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-12"
 }