rcf-lite 0.20.0 → 0.22.0

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22104.json

@@ -0,0 +1,29 @@
+{
+  "usId": "application-empty-error-states-US-22104",
+  "prdId": "PRD-001",
+  "reqId": "application-empty-error-states-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The permission-denied state names a class-level cause and never the per-resource id",
+  "asA": "authenticated operator hitting a 403 with a per-resource cause",
+  "iWant": "the permission-denied state to render a class-level cause string (for example \"admin scope required\") not the resource id",
+  "soThat": "I get an actionable class-level explanation and no resource identifier leaks into the surface",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-22104-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given a mocked 403 response with a per-resource cause, the permission-denied state renders inside role=\"region\" with a class-level cause string (matches /^[A-Za-z][A-Za-z0-9 ]+$/ with no digits-run of four or more) and a [data-action=\"request-access\"] control. The pack drives /probe/permission-denied, reads the cause string, and refuses when the string contains a resource-id shape (four or more consecutive digits, or a UUID pattern, or a slug-shape id preceded by resource identifiers like \"resource=\" or \"id=\")."
+    }
+  ],
+  "tacIds": [
+    "TAC-2301-application-empty-error-states-state-machine",
+    "TAC-2302-application-empty-error-states-recovery-router"
+  ],
+  "tags": [
+    "blueprint:application-empty-error-states",
+    "state:permission-denied"
+  ],
+  "createdAt": "2026-09-06T15:40:00Z",
+  "updatedAt": "2026-09-06T15:40:00Z"
+}

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22105.json

@@ -0,0 +1,29 @@
+{
+  "usId": "application-empty-error-states-US-22105",
+  "prdId": "PRD-001",
+  "reqId": "application-empty-error-states-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The offline state renders on navigator.onLine false, buffers a synthetic write, and announces reconnection through a polite live-region wrapper",
+  "asA": "operator whose network drops mid-session",
+  "iWant": "the offline state to render with a read-only banner, my writes to buffer locally with an idempotency token, and a polite reconnection announcement when the network comes back",
+  "soThat": "I keep working through a network drop and my writes flush cleanly with no duplicates when the network returns",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-22105-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given navigator.onLine simulated false via the runtime seam (page.setOffline(true) on the project route, an offline endpoint on the sample-app route the pack uses instead), the offline state renders inside role=\"region\" with a read-only banner naming offline mode. A synthetic write buffers to window.__offlineBuffer with an idempotency token and a monotonic sequence. On the reconnect signal (navigator.onLine true or the sample-app /probe/offline?reconnect route) the polite live-region wrapper with data-live-region=\"polite\" carries a reconnection announcement. The pack drives /probe/offline, reads the banner, the buffer entry and the polite wrapper text."
+    }
+  ],
+  "tacIds": [
+    "TAC-2301-application-empty-error-states-state-machine",
+    "TAC-2303-application-empty-error-states-offline-buffer"
+  ],
+  "tags": [
+    "blueprint:application-empty-error-states",
+    "state:offline"
+  ],
+  "createdAt": "2026-09-06T15:40:00Z",
+  "updatedAt": "2026-09-06T15:40:00Z"
+}

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22106.json

@@ -0,0 +1,29 @@
+{
+  "usId": "application-empty-error-states-US-22106",
+  "prdId": "PRD-001",
+  "reqId": "application-empty-error-states-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The empty-list state renders with a distinct visual and a creation-affordance recovery control",
+  "asA": "operator opening a listing surface that has no rows",
+  "iWant": "the empty-list state to render with a distinct visual and a creation-affordance recovery control",
+  "soThat": "I know the surface loaded successfully and my next action is to create the first row, not to reload",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-22106-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given a listing endpoint returning an empty array, the empty-list state renders inside role=\"region\" with a data-visual=\"empty-list\" wrapper (distinct from data-visual=\"loading\" and data-visual=\"loaded\") and a keyboard-reachable [data-recovery=\"create\"] control. The pack drives /probe/empty-list, reads the region and the wrapper attribute, and asserts the recovery control exists and carries an accessible name."
+    }
+  ],
+  "tacIds": [
+    "TAC-2301-application-empty-error-states-state-machine",
+    "TAC-2302-application-empty-error-states-recovery-router"
+  ],
+  "tags": [
+    "blueprint:application-empty-error-states",
+    "state:empty-list"
+  ],
+  "createdAt": "2026-09-06T15:40:00Z",
+  "updatedAt": "2026-09-06T15:40:00Z"
+}

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22107.json

@@ -0,0 +1,29 @@
+{
+  "usId": "application-empty-error-states-US-22107",
+  "prdId": "PRD-001",
+  "reqId": "application-empty-error-states-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The no-search-results state renders with a distinct visual and a clear-filters recovery control",
+  "asA": "operator running a search or filter that yields zero rows",
+  "iWant": "the no-search-results state to render with a distinct visual and a clear-filters recovery control",
+  "soThat": "I distinguish this state from empty-list and my next action is to widen the query, not to create a row",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-22107-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given a search or filter yielding zero rows, the no-search-results state renders inside role=\"region\" with a data-visual=\"no-search-results\" wrapper distinct from empty-list, echoing the query terms verbatim inside a data-query wrapper, and a keyboard-reachable [data-recovery=\"clear-filters\"] control that removes the search parameters on click. The pack drives /probe/search?q=needle, reads the region, the wrapper attribute, the echoed query and the recovery control."
+    }
+  ],
+  "tacIds": [
+    "TAC-2301-application-empty-error-states-state-machine",
+    "TAC-2302-application-empty-error-states-recovery-router"
+  ],
+  "tags": [
+    "blueprint:application-empty-error-states",
+    "state:no-search-results"
+  ],
+  "createdAt": "2026-09-06T15:40:00Z",
+  "updatedAt": "2026-09-06T15:40:00Z"
+}

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22108.json

@@ -0,0 +1,29 @@
+{
+  "usId": "application-empty-error-states-US-22108",
+  "prdId": "PRD-001",
+  "reqId": "application-empty-error-states-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The error-boundary state renders on a client-side render failure with a role=alert announcement",
+  "asA": "operator hitting a client-side render exception",
+  "iWant": "the error-boundary state to render inside role=\"alert\" with a retry recovery hook and no stack detail",
+  "soThat": "the assistive tech announces the failure immediately (assertive, not polite) and I have an escape from a broken render",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-22108-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given a synthetic client-side render exception thrown via page.evaluate (or the sample-app /probe/error-boundary?crash=1 route), the error-boundary state renders inside role=\"alert\" with a keyboard-reachable [data-recovery=\"retry\"] control, a plain summary line and no stack-frame content matching the sensitive-pattern list. The pack drives /probe/error-boundary?crash=1, reads the region, the retry control and the document text for pattern hits."
+    }
+  ],
+  "tacIds": [
+    "TAC-2301-application-empty-error-states-state-machine",
+    "TAC-2302-application-empty-error-states-recovery-router"
+  ],
+  "tags": [
+    "blueprint:application-empty-error-states",
+    "state:error-boundary"
+  ],
+  "createdAt": "2026-09-06T15:40:00Z",
+  "updatedAt": "2026-09-06T15:40:00Z"
+}

package/blueprints/application-empty-error-states/docs/topics.md

@@ -0,0 +1,53 @@
+# application-empty-error-states: coordination vocabulary
+
+## Global topics
+
+The blueprint claims no new global topics at v1.0.0. Every ADR (HTTP status contract, stack-trace visibility, offline strategy) is non-global.
+
+## Deliberately unclaimed topics
+
+- `errorEnvelope` (the shape of a server error response body). Reserved for the applied API blueprint (`application-api-rest` claims it today); this blueprint reads the HTTP status code, not the envelope body shape, so no claim collides.
+- `sensitivePatternsRegistry` (the tokeniser vocabulary the 500 surface refuses on). Reserved for a future v1.1.0 minor bump if three or more consumer blueprints start elicitizing the same extensions. Held here as an unclaimed topic so a composing author sees the reservation.
+- `stateVisualTokens` (the palette, spacing and typography per state). Reserved for `application-spa` which owns the visual tokens; this blueprint owns the state list and the recovery-action router.
+
+## Shelf id band and suffix block
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+
+The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
+
+## Composition with application-spa
+
+`application-spa` REQ-006 ships empty, loading, error, banner and alert components as part of its component library. Applying this blueprint alongside `application-spa` composes cleanly: SPA holds the tab-title convention and the state-visual tokens; this blueprint holds the state list, the recovery-action router and the runtime enforcement pack. No `scope: "global"` ADR conflict.
+
+## Composition with application-notifications-in-app
+
+The `forbidden` and `permission-denied` states POST request-access submissions to the applied notification centre. When `application-notifications-in-app` is applied, the pack asserts the applied notification centre receives the submission (a v1.1.0 mechanism-reach gap today; the current pack asserts the control's shape only). No global-topic overlap.
+
+## Probe pack
+
+`probe-packs/application-empty-error-states.pack.mjs` ships eight surface-observable checks anchored to blueprint AC ids, one per named state:
+
+- `AC-22101-1` not-found (heading, parent-surface link, search entry, tab title)
+- `AC-22102-1` forbidden (request-access control, no resource-id leak)
+- `AC-22103-1` server-error (retry, no stack trace, no path shape, no env-key shape)
+- `AC-22104-1` permission-denied (class-level cause, no resource id)
+- `AC-22105-1` offline (banner, buffered synthetic write, polite reconnection announcement)
+- `AC-22106-1` empty-list (distinct visual wrapper, creation-affordance recovery)
+- `AC-22107-1` no-search-results (distinct visual wrapper, echoed query, clear-filters recovery)
+- `AC-22108-1` error-boundary (role=alert, retry control, no stack detail)
+
+The pack applies to any FBS binding `TAC-2301-application-empty-error-states-state-machine` or whose navModel routes name an operator-configured error-shell path (matching `/probe/(not-found|forbidden|server-error|permission-denied|offline|empty-list|search|error-boundary)`). See `packages/rcf-lite/docs/blueprint-authoring.md` section 8c for the pack authoring rules.

package/blueprints/application-empty-error-states/guide/application-empty-error-states.md

@@ -0,0 +1,50 @@
+# application-empty-error-states: operator guide
+
+## When to reach for it
+
+Your project renders any surface whose input can be empty, whose network call can fail, whose user can lack scope, or whose client can crash mid-render. That covers every SPA that hits an API and every routed page that can dereference an id. You want one contract for the eight named states, one recovery-action router per state, one polite live-region for progress announcements, and a runtime pack that refuses ship on a stack-trace leak, a resource-id leak, a missing recovery affordance, or a dropped live-region wrapper.
+
+## The eight named states
+
+The blueprint enumerates the eight states in the ratified order below. Every README, guide, pack `checks[]` and `docs/topics.md` row across the family names the same eight slugs.
+
+- `not-found`: routed page dereferences an id that has been removed or was never there.
+- `forbidden`: caller is authenticated but the target resource refuses; the surface offers a request-access affordance.
+- `server-error`: a 500-class failure the client cannot recover from without a retry.
+- `offline`: the client has lost the network; the surface announces the transition and, on reconnection, replays it through the polite live-region wrapper.
+- `permission-denied`: the caller lacks a scope the target resource requires; the surface names the missing scope in the cause without leaking the resource id.
+- `empty-list`: a collection surface has zero rows and offers the recovery-action router entry (create, clear filters, or invite, per project wiring).
+- `no-search-results`: a query returned an empty set; the surface echoes the query verbatim and suggests broadening it.
+- `error-boundary`: a client-side render exception was caught; the surface renders under `role="alert"` and offers a route-level recovery.
+
+## When NOT to reach for it
+
+Your product is a marketing site or a static content surface with no dynamic state. The eight states model a live workspace; a static site has no offline mode, no per-resource forbidden state, no client-side render boundary, and forcing the model on a static site adds mechanism without payoff.
+
+Your product has already committed to an opinionated single-vendor state library (Sentry with a bespoke boundary, a framework-specific error module) whose contract is materially different from the eight-state catalogue. Adopt this blueprint only when the vendor library composes with the state-machine TAC rather than replacing it.
+
+## What stays your call
+
+- The visual design of each state region. The blueprint contributes WHAT surfaces under WHAT condition; the palette, spacing and typography are your project's design system's call.
+- Whether the 500 surface hides the stack trace in staging (ADR-2302 elicited toggle) or hides it everywhere (the recommended default).
+- The offline strategy: write-buffer (the default), read-only-banner, or refuse-writes (ADR-2303 elicited enum).
+- The request-access endpoint the forbidden and permission-denied surfaces POST to. The blueprint declares the shape (`POST /api/request-access` with a JSON body); the endpoint's server-side handling is your call.
+- The parent-surface path and clear-filters callback the recovery-action router wires into the rendered controls.
+
+## What a good outcome looks like
+
+The pack fires on every FBS whose surface renders a routed page or a listing, and every check returns `pass` on the honest render and `fail` on the corresponding break switch. Your CI runs the fixture round-trip on every PR that touches a state region. Your operator sees eight distinct visuals in a screenshot review and can pick out which state a screenshot represents without reading the copy. Your accessibility audit's live-region check on the polite wrapper passes because the wrapper preseeded at page render, not on state entry. Your production 500 surface never leaks a source path, an environment variable, or a backtrace frame.
+
+## Mechanism-reach gaps
+
+The blueprint's README lists the runtime-observable ACs the pack does NOT bind directly. Every gap is a candidate for a v1.1.0 minor bump extending the pack. Combine with `application-notifications-in-app` to route request-access submissions through the shipped notification centre and with `application-spa` to inherit the tab-title convention and the state-visual tokens.
+
+## Promotion signals
+
+- Three or more consumer blueprints (forms-wizard, account-settings, dashboard, admin-console) start elicitizing the same sensitive-pattern extension for the 500 surface. Candidate: a `sensitivePatternsRegistry` global topic in a v1.1.0 minor.
+- The offline-buffer TAC needs a shared engine across a persistence blueprint and this UI blueprint. Candidate: a dedicated `application-offline-sync` blueprint absorbing the write-buffer.
+- The recovery-shape enum needs a request-access-inline shape (inline form rather than a POST). Candidate: a v1.1.0 minor bump extending TAC-2302's recovery-shape closed set.
+
+## Costs to be honest about
+
+Realising all eight states honestly in a client is a chunk of code even after adopting the TACs; project-side wiring per framework is at least an afternoon per state. The pack is Playwright-first, so a project without a running dev server at gate time cannot fire it. The offline TAC assumes IndexedDB by default; a WebView with a locked-down storage policy elicits an alternative per ADR-2303 and takes a small amount of adapter code.

package/blueprints/application-empty-error-states/probe-packs/application-empty-error-states.pack.mjs

@@ -0,0 +1,284 @@
+// application-empty-error-states probe pack (v1.0.0).
+//
+// Eight surface-observable checks, one per named state, anchored to
+// the blueprint's contributed AC ids:
+//   AC-22101-1 not-found (heading, parent-surface link, search entry, tab title)
+//   AC-22102-1 forbidden (request-access control, no resource-id leak)
+//   AC-22103-1 server-error (retry, no stack trace, no path shape, no env-key shape)
+//   AC-22104-1 permission-denied (class-level cause, no resource id)
+//   AC-22105-1 offline (banner, buffered synthetic write, polite reconnection announcement)
+//   AC-22106-1 empty-list (distinct visual wrapper, creation-affordance recovery)
+//   AC-22107-1 no-search-results (distinct visual wrapper, echoed query, clear-filters recovery)
+//   AC-22108-1 error-boundary (role=alert, retry control, no stack detail)
+//
+// Every check drives the real Playwright browser the T-0 runner
+// injects. URLs are composed by the withUrl(runtimeUrl, path) helper
+// per the round 3 T-3 fix train; no bare string concatenation.
+//
+// Sample-app fixture:
+// packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/
+// Fixture ships one route per state under /probe/<state> plus break
+// switches (?break=stack-trace, ?break=leak-id, ?break=no-recovery,
+// ?break=no-live-region) so the negative runs can be driven from a
+// single boot.
+
+function withUrl(runtimeUrl, path) {
+  return new URL(path, runtimeUrl).toString();
+}
+
+// Sensitive-pattern list used by AC-22103-1 (server-error surface)
+// and by AC-22108-1 (error-boundary surface). Words on this list must
+// not appear on the rendered document text in production.
+//
+// Encoded as an array of {name, re} entries so a failure message can
+// cite which pattern matched. Every regexp is anchored on token
+// boundaries to reduce false positives on legitimate copy.
+const SENSITIVE_PATTERNS = [
+  { name: 'backtrace-frame', re: /\bat\s+[A-Za-z_$][\w$.]*\s*\([^)]*:\d+:\d+\)/ },
+  { name: 'source-path-absolute', re: /(?:^|[\s"'>])\/(?:usr|opt|home|var|etc|Users|private)\/[\w\-./]+/ },
+  { name: 'source-path-relative', re: /(?:^|[\s"'>])\.{1,2}\/[\w\-./]+\.(?:js|mjs|cjs|ts|tsx|jsx)/ },
+  { name: 'env-key-assignment', re: /\b[A-Z][A-Z0-9_]{2,}=(?!=)[^\s"']+/ },
+  { name: 'process-env-reference', re: /\bprocess\.env\.[A-Z_][A-Z0-9_]*/ },
+  { name: 'framework-internal-frame', re: /\b(?:node_modules|webpack-internal|nextjs-internal)\b/ },
+];
+
+// Resource-id pattern list for AC-22104-1 (permission-denied cause
+// must be class-level, not per-resource).
+const RESOURCE_ID_PATTERNS = [
+  { name: 'four-plus-digit-run', re: /\b\d{4,}\b/ },
+  { name: 'uuid-shape', re: /\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b/ },
+  { name: 'resource-slug-hint', re: /\b(?:resource|id|slug|handle)=[A-Za-z0-9._-]+/i },
+];
+
+function firstSensitiveMatch(text, patterns) {
+  if (typeof text !== 'string') return null;
+  for (const { name, re } of patterns) {
+    const m = text.match(re);
+    if (m) return { name, match: m[0] };
+  }
+  return null;
+}
+
+export default {
+  packName: 'application-empty-error-states',
+  version: '1.0.0',
+  blueprintSlug: 'application-empty-error-states',
+  // Applies to any FBS that realises the state-machine TAC or whose
+  // navModel routes name the operator-configured error-shell path.
+  // References BOTH `tacIds` AND `route` per the loader source-scan
+  // rule (T-0 AC-1701-3, cross-check with authoring standard 8c).
+  appliesTo: ({ fbs }) => {
+    const routes = fbs?.designStage?.navModel?.routes ?? [];
+    const tacIds = fbs?.contextRequirements?.tacIds ?? [];
+    if (tacIds.includes('TAC-2301-application-empty-error-states-state-machine')) return true;
+    return routes.some((r) => typeof r?.path === 'string' && /\/probe\/(?:not-found|forbidden|server-error|permission-denied|offline|empty-list|search|error-boundary)(\/|$|\?)/.test(r.path));
+  },
+  boot: { bootCommand: null, waitForUrl: null, waitForSelector: null },
+  checks: [
+    {
+      id: 'AC-22101-1',
+      severity: 'block',
+      description: 'not-found state renders inside a region with a naming heading, a parent-surface recovery link, a search entry, and a browser tab title matching /^Not found - .+/',
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/probe/not-found'));
+        const dom = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="not-found"]');
+          if (!region) return { present: false };
+          const heading = region.querySelector('h1, h2, [role="heading"]');
+          const parent = region.querySelector('[data-recovery="parent-surface"]');
+          const search = region.querySelector('[data-recovery="search"]');
+          return {
+            present: true,
+            headingText: heading ? heading.textContent.trim() : null,
+            hasParent: !!parent,
+            hasSearch: !!search,
+            title: document.title,
+          };
+        });
+        if (!dom.present) return { verdict: 'fail', detail: 'not-found region [data-surface="not-found"] not found' };
+        if (!dom.headingText) return { verdict: 'fail', detail: 'not-found region missing heading' };
+        if (!dom.hasParent) return { verdict: 'fail', detail: 'not-found region missing [data-recovery="parent-surface"]' };
+        if (!dom.hasSearch) return { verdict: 'fail', detail: 'not-found region missing [data-recovery="search"]' };
+        if (!/^Not found - .+/.test(dom.title)) return { verdict: 'fail', detail: `not-found tab title did not match /^Not found - .+/: ${JSON.stringify(dom.title)}` };
+        return { verdict: 'pass', detail: `heading=${JSON.stringify(dom.headingText)} title=${JSON.stringify(dom.title)}` };
+      },
+    },
+    {
+      id: 'AC-22102-1',
+      severity: 'block',
+      description: 'forbidden state renders inside a region with a request-access control and the rendered surface refuses to include a resource id, resource name or path-shape token',
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/probe/forbidden'));
+        const dom = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="forbidden"]');
+          if (!region) return { present: false };
+          const control = region.querySelector('[data-action="request-access"]');
+          return { present: true, hasControl: !!control, text: document.body.innerText };
+        });
+        if (!dom.present) return { verdict: 'fail', detail: 'forbidden region [data-surface="forbidden"] not found' };
+        if (!dom.hasControl) return { verdict: 'fail', detail: 'forbidden region missing [data-action="request-access"] control' };
+        // Least-privilege posture: no resource-id shape, no source path leaking through.
+        const leak = firstSensitiveMatch(dom.text, RESOURCE_ID_PATTERNS);
+        if (leak) return { verdict: 'fail', detail: `forbidden surface leaked ${leak.name}: ${leak.match}` };
+        const path = firstSensitiveMatch(dom.text, SENSITIVE_PATTERNS.filter((p) => p.name.startsWith('source-path')));
+        if (path) return { verdict: 'fail', detail: `forbidden surface leaked ${path.name}: ${path.match}` };
+        return { verdict: 'pass', detail: 'forbidden region clean; request-access control present' };
+      },
+    },
+    {
+      id: 'AC-22103-1',
+      severity: 'block',
+      description: 'server-error state renders in production without a stack trace, without a source path, without an env-key shape and without a framework-internal frame prefix',
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/probe/server-error'));
+        const dom = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="server-error"]');
+          if (!region) return { present: false };
+          const retry = region.querySelector('[data-recovery="retry"]');
+          return { present: true, hasRetry: !!retry, text: document.body.innerText };
+        });
+        if (!dom.present) return { verdict: 'fail', detail: 'server-error region [data-surface="server-error"] not found' };
+        if (!dom.hasRetry) return { verdict: 'fail', detail: 'server-error region missing [data-recovery="retry"] control' };
+        const leak = firstSensitiveMatch(dom.text, SENSITIVE_PATTERNS);
+        if (leak) return { verdict: 'fail', detail: `server-error surface leaked ${leak.name}: ${leak.match}` };
+        return { verdict: 'pass', detail: 'server-error region clean; retry control present' };
+      },
+    },
+    {
+      id: 'AC-22104-1',
+      severity: 'block',
+      description: 'permission-denied state renders a class-level cause string and never a resource id',
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/probe/permission-denied'));
+        const dom = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="permission-denied"]');
+          if (!region) return { present: false };
+          const cause = region.querySelector('[data-cause]');
+          const control = region.querySelector('[data-action="request-access"]');
+          return {
+            present: true,
+            causeText: cause ? cause.textContent.trim() : null,
+            hasControl: !!control,
+          };
+        });
+        if (!dom.present) return { verdict: 'fail', detail: 'permission-denied region [data-surface="permission-denied"] not found' };
+        if (!dom.causeText) return { verdict: 'fail', detail: 'permission-denied region missing [data-cause] class-level cause' };
+        if (!dom.hasControl) return { verdict: 'fail', detail: 'permission-denied region missing [data-action="request-access"] control' };
+        const leak = firstSensitiveMatch(dom.causeText, RESOURCE_ID_PATTERNS);
+        if (leak) return { verdict: 'fail', detail: `permission-denied cause leaked ${leak.name}: ${leak.match}` };
+        return { verdict: 'pass', detail: `cause=${JSON.stringify(dom.causeText)}` };
+      },
+    },
+    {
+      id: 'AC-22105-1',
+      severity: 'block',
+      description: 'offline state renders with a read-only banner, a synthetic write buffers to window.__offlineBuffer with an idempotency token, and the polite live-region wrapper carries the reconnection announcement',
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/probe/offline'));
+        const offline = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="offline"]');
+          if (!region) return { present: false };
+          const banner = region.querySelector('[data-banner="offline"]');
+          // Fixture pre-seeds a synthetic write on page load so the
+          // pack can observe the buffer without driving Playwright
+          // page.setOffline directly.
+          const buf = window.__offlineBuffer;
+          const hasBufferEntry = Array.isArray(buf) && buf.length > 0
+            && typeof buf[0].idempotencyToken === 'string' && buf[0].idempotencyToken.length > 0
+            && typeof buf[0].sequence === 'number';
+          return { present: true, hasBanner: !!banner, hasBufferEntry, bufferSample: buf ? buf.slice(0, 1) : null };
+        });
+        if (!offline.present) return { verdict: 'fail', detail: 'offline region [data-surface="offline"] not found' };
+        if (!offline.hasBanner) return { verdict: 'fail', detail: 'offline region missing [data-banner="offline"]' };
+        if (!offline.hasBufferEntry) return { verdict: 'fail', detail: `window.__offlineBuffer not populated with a token-and-sequence entry: ${JSON.stringify(offline.bufferSample)}` };
+        // Reconnection: drive the fixture's reconnect route, then
+        // read the polite live-region wrapper's text.
+        await browser.goto(withUrl(runtimeUrl, '/probe/offline?reconnect=1'));
+        const reconnect = await browser.evaluate(() => {
+          const live = document.querySelector('[data-live-region="polite"]');
+          return { text: live ? live.textContent.trim() : null };
+        });
+        if (!reconnect.text || reconnect.text.length === 0) {
+          return { verdict: 'fail', detail: 'polite live-region wrapper empty on reconnect; expected a reconnection announcement' };
+        }
+        return { verdict: 'pass', detail: `bufferSample=${JSON.stringify(offline.bufferSample)} reconnect=${JSON.stringify(reconnect.text)}` };
+      },
+    },
+    {
+      id: 'AC-22106-1',
+      severity: 'block',
+      description: 'empty-list state renders with a distinct visual wrapper and a creation-affordance recovery control',
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/probe/empty-list'));
+        const dom = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="empty-list"]');
+          if (!region) return { present: false };
+          const wrapper = region.querySelector('[data-visual="empty-list"]');
+          const create = region.querySelector('[data-recovery="create"]');
+          return { present: true, hasWrapper: !!wrapper, hasCreate: !!create };
+        });
+        if (!dom.present) return { verdict: 'fail', detail: 'empty-list region [data-surface="empty-list"] not found' };
+        if (!dom.hasWrapper) return { verdict: 'fail', detail: 'empty-list region missing [data-visual="empty-list"] wrapper' };
+        if (!dom.hasCreate) return { verdict: 'fail', detail: 'empty-list region missing [data-recovery="create"] control' };
+        return { verdict: 'pass', detail: 'empty-list wrapper and create control present' };
+      },
+    },
+    {
+      id: 'AC-22107-1',
+      severity: 'block',
+      description: 'no-search-results state renders with a distinct visual wrapper, an echoed query and a clear-filters recovery control',
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/probe/search?q=needle'));
+        const dom = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="no-search-results"]');
+          if (!region) return { present: false };
+          const wrapper = region.querySelector('[data-visual="no-search-results"]');
+          const query = region.querySelector('[data-query]');
+          const clear = region.querySelector('[data-recovery="clear-filters"]');
+          return {
+            present: true,
+            hasWrapper: !!wrapper,
+            queryText: query ? query.textContent.trim() : null,
+            hasClear: !!clear,
+          };
+        });
+        if (!dom.present) return { verdict: 'fail', detail: 'no-search-results region [data-surface="no-search-results"] not found' };
+        if (!dom.hasWrapper) return { verdict: 'fail', detail: 'no-search-results region missing [data-visual="no-search-results"] wrapper' };
+        if (!dom.hasClear) return { verdict: 'fail', detail: 'no-search-results region missing [data-recovery="clear-filters"] control' };
+        if (!dom.queryText || !dom.queryText.includes('needle')) {
+          return { verdict: 'fail', detail: `no-search-results region did not echo the query verbatim: ${JSON.stringify(dom.queryText)}` };
+        }
+        return { verdict: 'pass', detail: `queryEcho=${JSON.stringify(dom.queryText)}` };
+      },
+    },
+    {
+      id: 'AC-22108-1',
+      severity: 'block',
+      description: 'error-boundary state renders inside role=alert with a retry recovery hook and no stack detail on the rendered surface',
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/probe/error-boundary?crash=1'));
+        const dom = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="error-boundary"]');
+          if (!region) return { present: false };
+          const role = region.getAttribute('role');
+          const retry = region.querySelector('[data-recovery="retry"]');
+          return { present: true, role, hasRetry: !!retry, text: document.body.innerText };
+        });
+        if (!dom.present) return { verdict: 'fail', detail: 'error-boundary region [data-surface="error-boundary"] not found' };
+        if (dom.role !== 'alert') return { verdict: 'fail', detail: `error-boundary region role expected "alert", got ${JSON.stringify(dom.role)}` };
+        if (!dom.hasRetry) return { verdict: 'fail', detail: 'error-boundary region missing [data-recovery="retry"] control' };
+        const leak = firstSensitiveMatch(dom.text, SENSITIVE_PATTERNS);
+        if (leak) return { verdict: 'fail', detail: `error-boundary surface leaked ${leak.name}: ${leak.match}` };
+        return { verdict: 'pass', detail: 'error-boundary role=alert, retry control present, no stack detail' };
+      },
+    },
+  ],
+};

package/blueprints/application-error-handling/docs/topics.md

@@ -20,5 +20,17 @@
 | Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
 |---|---|---|---|---|
 | application-error-handling | 16101-16899 | 17xx | shipped v1.0.0 | `errorHandling` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.

package/blueprints/application-file-upload/CHANGELOG.md

@@ -0,0 +1,9 @@
+# application-file-upload CHANGELOG
+
+## 1.0.0 (visual round T-2, spec 2026-09-06)
+
+- First ratified version of the shelf's file-upload blueprint. Five REQs (input contract with a labelled file input plus drop-zone plus keyboard alternative per WCAG 2.5.7, progress contract with per-file percent and aggregate percent and polite live-region tick, refusal contract with MIME and size and virus-scan gates and aria-describedby error binding and focus-to-retry, transport contract chunked-and-resumable with multipart POST default and tus.io elicited alternative, completion contract with assertive-slot success announcement per WCAG 4.1.3 and per-file remove and retry), seven USs 23101-23107 binding one runtime-observable AC per REQ plus two cross-cutting cases (network-interruption resumption AC-23106-1, background-tab progress AC-23107-1), three TACs 2401-2403 (upload input surface, upload transport contract, upload progress announcer), three ADRs 2401-2403 (transport branch with multipart recommendedDefault true and tus and vendor-sdk elicited, accepted MIME set and per-file size cap elicited, virus-scan integration via a capability-plus-elicit). No new global topics.
+- Ships `probe-packs/application-file-upload.pack.mjs`: four surface-observable browser-verify checks anchored one per contract (`AC-23101-1` input surface, `AC-23102-1` progress announcer, `AC-23103-1` refusal contract, `AC-23104-1` chunked transport). Every URL is composed by the `withUrl(runtimeUrl, path)` helper per the round 3 T-3 fix train; no bare string concatenation. The pack-level `appliesTo` predicate references BOTH `tacIds` (TAC-2401) AND `route` (the operator-configured upload path glob).
+- Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/` with a Node HTTP server realising both transport branches honestly (`?transport=multipart` default, `?transport=tus` elicited alternative) and break switches (`?break=no-input`, `?break=no-live-region`, `?break=send-refused`, `?break=no-chunks`) driving the negative runs from a single boot. The fixture ships its own README naming PORT, every `?transport=`, every `?seed=`, every `?break=`, the manual boot line and the two-line gate-reviewer boot.
+- Declares `suggestedCompanions` `logging` (every refused upload writes one request-scoped log line with the closed refusal reason and the correlation identifier) and `errorHandling` (refusals and transport-layer failures construct an internal error record through the applied error-handling factory). Does NOT declare `providesRoles` (leaf blueprint per spec; loader refuses an empty `providesRoles` array when set, so the leaf-blueprint intent is expressed by omitting the field). Does NOT declare `capabilities` and does NOT declare `requiresAppliedCapabilities` (no auth required).
+- Seventh shipped consumer of T-0's probe-pack runner extension.