v1.2.0

• lastSuccessfulRefresh() now tracks liveness, not just installs (qfg-41nh.11). The stamp is a
  liveness signal — the last moment the SDK confirmed its config source reachable and its held
  config current — but it previously advanced only on an envelope install. A healthy long-lived
  client parked on 304s (or same-generation payloads) under-reported liveness: the stamp froze even
  though every fetch succeeded. It now also advances on an HTTP config fetch that completed
  successfully WITHOUT installing (a 304 Not Modified, or a 200 the reject-older guard dropped as
  equal-or-older) and on a received-and-processed SSE message that was a guard no-op. Transport
  errors still never advance it. Diagnostic-only accessor; no behavior change to config resolution
  and no new dependencies. Matches sdk-go.
• Warning when an explicit apiUrls disables failover (qfg-41nh.26). The default (and every
  QUONFIG_DOMAIN-derived) apiUrls list carries a primary and a secondary leg, and the SDK
  hedges/fails over between them. An explicit apiUrls with a single entry silently dropped the
  secondary; the SDK now logs a one-line WARN at init pointing the caller at the fix (pass both a
  primary and a secondary URL). Behavior is otherwise unchanged; no new dependencies. A new README
  "Failover & QUONFIG_DOMAIN" section documents the QUONFIG_DOMAIN derivation and the failover
  model.
• Failover telemetry (qfg-41nh.18). The SDK now folds failover-behavior counters into the
  existing periodic telemetry flush so the failover dashboards can be built. A new failover event
  reports, per flush window: hedgeFired (config-fetch cycles where the parallel hedge fired its
  secondary leg), guardRejected (installs dropped by the reject-older ordering guard, on both the
  HTTP fetch path and the SSE message path), and resolvedFromPrimary / resolvedFromSecondary
  (which leg served each successful HTTP install; SSE/datadir installs are not counted). The event
  is additive on the wire — an older telemetry backend strips the unknown field — and is emitted
  only when at least one counter is non-zero, so a steady-state client streaming updates over SSE
  sends nothing. It rides the existing telemetry opt-out (no sdk key, or every collector disabled,
  disables it too). No new options or dependencies; near-zero overhead.