rcf-lite 0.20.0 → 0.22.0

package/blueprints/application-forms-wizard/contributions/user-stories/application-forms-wizard-us-24107.json

@@ -0,0 +1,28 @@
+{
+  "usId": "application-forms-wizard-US-24107",
+  "prdId": "PRD-001",
+  "reqId": "application-forms-wizard-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The in-progress forms list surfaces every wizard the operator has started but not yet submitted with a resume link back to the task-list",
+  "asA": "operator returning to the application with more than one wizard on the go",
+  "iWant": "an index surface listing every wizard I have started but not submitted, each with the wizard title, the step I was on and a resume link",
+  "soThat": "I can walk back into the one I meant to finish without hunting through the navigation",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-24107-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given at least one draft persisted per REQ-005, /in-progress renders [data-surface=\"in-progress-list\"] with one [data-wizard-row] per draft carrying the wizard title, the step slug the operator was on and a [data-recovery=\"resume\"] link whose href routes back to the wizard's task-list surface. The row count matches the number of drafts held in the draft store."
+    }
+  ],
+  "tacIds": [
+    "TAC-2503-application-forms-wizard-draft-store"
+  ],
+  "tags": [
+    "blueprint:application-forms-wizard",
+    "case:in-progress-list"
+  ],
+  "createdAt": "2026-09-06T18:00:00Z",
+  "updatedAt": "2026-09-06T18:00:00Z"
+}

package/blueprints/application-forms-wizard/contributions/user-stories/application-forms-wizard-us-24108.json

@@ -0,0 +1,29 @@
+{
+  "usId": "application-forms-wizard-US-24108",
+  "prdId": "PRD-001",
+  "reqId": "application-forms-wizard-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "When no drafts are held the in-progress list surface delegates to the application-empty-error-states empty-list state and offers a create-affordance back to a fresh wizard",
+  "asA": "operator returning to the application with no wizards in flight",
+  "iWant": "the in-progress list to render the empty-list surface from the empty-and-error-states sibling with a control that starts a fresh wizard",
+  "soThat": "the empty case reads consistently with every other empty listing in the application and I have one obvious next action",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-24108-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given zero drafts in the draft store, /in-progress renders [data-surface=\"empty-list\"] (the empty-list wrapper contributed by application-empty-error-states) with a [data-recovery=\"create\"] control whose href routes to the first step of a fresh wizard. The pack asserts the wrapper and the control are present on the honest render and refuses when either is missing."
+    }
+  ],
+  "tacIds": [
+    "TAC-2503-application-forms-wizard-draft-store"
+  ],
+  "tags": [
+    "blueprint:application-forms-wizard",
+    "case:no-in-progress-forms-empty-state",
+    "consumes:application-empty-error-states"
+  ],
+  "createdAt": "2026-09-06T18:00:00Z",
+  "updatedAt": "2026-09-06T18:00:00Z"
+}

package/blueprints/application-forms-wizard/docs/topics.md

@@ -0,0 +1,49 @@
+# application-forms-wizard: coordination vocabulary
+
+## Global topics
+
+The blueprint claims no new global topics at v1.0.0. Every ADR (navigation posture, save-and-return transport, step-indicator shape) is non-global.
+
+## Deliberately unclaimed topics
+
+- `formsEngine` (the validation and field-component engine). Reserved for `application-spa` which owns the engine via TAC-205; this blueprint reads the engine through TAC-2502 and adds the wizard-shell contract on top.
+- `draftSyncEngine` (a shared sync engine across UI and persistence blueprints). Reserved for a future `application-draft-sync` v1.0.0 if three or more consumer blueprints start elicitizing the same cross-tab or server-side sync shape.
+- `emptyStateWrapper` (the DOM shape of the empty-list wrapper). Reserved for `application-empty-error-states` which owns it via TAC-2301; this blueprint delegates the no-in-progress empty case to the sibling and does not re-claim the wrapper.
+
+## Shelf id band and suffix block
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorage` |
+
+The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
+
+## Composition with application-spa
+
+`application-spa` REQ-006 ships the forms-engine (TAC-205) and the field-component library. Applying this blueprint alongside `application-spa` composes cleanly: SPA holds the engine and the field components; this blueprint holds the wizard shell, the task-list, the error-summary contract, the summary review and the save-and-return draft store. No `scope: "global"` ADR conflict.
+
+## Composition with application-empty-error-states
+
+The `no-in-progress-forms` case on the /in-progress list surface delegates to the sibling's `empty-list` state (`[data-surface="empty-list"]` with a `[data-recovery="create"]` control). Per the sibling's `docs/topics.md`: SPA holds the tab-title convention, the component contracts and the state-visual tokens; this sibling holds the state list, the recovery-action router and the runtime enforcement pack. This blueprint's TAC-2503 reads that state on the zero-drafts branch and does not re-claim the wrapper.
+
+## Probe pack
+
+`probe-packs/application-forms-wizard.pack.mjs` ships four surface-observable checks anchored to blueprint AC ids, one per core contract:
+
+- `AC-24101-1` task-list (per-step state from {Cannot start yet, Not started, In progress, Completed}, ARIA progressbar wrapper, ordered step enumeration)
+- `AC-24103-1` error-summary (top-of-page summary, skip links per failed field, aria-invalid on the field, aria-describedby to the field-level error message, focus to summary heading)
+- `AC-24104-1` summary-review (summary-list rows per step, Change link per row, answer retention across an edit-and-save round-trip)
+- `AC-24105-1` save-and-return (server-draft-table transport POST/GET round-trip, client-local-buffer transport localStorage write with a sync tick)
+
+The pack applies to any FBS binding `TAC-2501-application-forms-wizard-task-list` or whose navModel routes name an operator-configured wizard-route path (matching `/(task-list|step|summary|in-progress|wizard)`). See `packages/rcf-lite/docs/blueprint-authoring.md` section 8c for the pack authoring rules.

package/blueprints/application-forms-wizard/guide/application-forms-wizard.md

@@ -0,0 +1,48 @@
+# application-forms-wizard: operator guide
+
+## When to reach for it
+
+Your project ships a workflow whose completion spans two or more surfaces the operator moves between with save points in between: a signup or onboarding flow, a checkout, an account setup, a compliance-heavy submission, an application review. You want the GOV.UK-vocabulary task-list up front (Cannot start yet, Not started, In progress, Completed) so the operator sees where they are at a glance, the per-step validation timing on-blur then on-change so the messages behave predictably, the top-of-page error summary with skip links so a screen-reader user hears the failures in order, the summary review with row-level change and answer retention so the operator can revise before submit, and the save-and-return draft store so a closed tab or a lost network does not force them to start again.
+
+## The four contracts
+
+- **Task-list contract (REQ-001).** Every step is enumerated with a state from the closed vocabulary. The ARIA progressbar wrapper carries the completion count.
+- **Validation timing (REQ-002).** On-blur before first submit, on-change after first failure, full pass on submit. Delegates to the SPA blueprint's forms-engine TAC-205.
+- **Error-summary contract (REQ-003).** Top-of-page summary, skip links per failed field, aria-invalid on the field, focus to summary heading on submit failure.
+- **Summary-review contract (REQ-004).** Summary-list rows per step, Change link per row, answer retention on save.
+- **Save-and-return contract (REQ-005).** Server-side draft table or client-side local buffer with a per-write sync tick. The pack refuses to ship if neither is wired.
+
+## When NOT to reach for it
+
+Your workflow is a single-page form the operator fills in one go with no cross-step dependencies. A wizard shell adds mechanism without payoff; a single-step submit with the same forms-engine and the same error-summary reads better.
+
+Your workflow is a linear questionnaire where every step is optional and the operator can jump anywhere at any time. Consider the free-navigation branch (ADR-2501) or an alternative surface that does not enumerate completion states.
+
+Your workflow ships without any draft store because every submission is single-session (a payment authorisation with a strict short expiry, say). The blueprint refuses to apply without a transport; either wire one or pick a different surface.
+
+## What stays your call
+
+- The step manifest (elicited at apply time). The blueprint ships an example three-step manifest on the fixture; your project supplies its own.
+- The step-indicator shape (task-list, ARIA progressbar-only, breadcrumb; ADR-2503).
+- The linear-vs-free navigation posture (ADR-2501). The default is linear.
+- The save-and-return transport (server-draft-table, client-local-buffer; ADR-2502). No default is committed.
+- The visual design of each surface. The blueprint contributes WHAT surfaces under WHAT condition; the palette, spacing and typography are your design system's call.
+- The per-field validation rules (which fields are required, format constraints). The blueprint contributes the timing rule and the summary shape; the field-level rules are your project's call, wired through the SPA forms-engine.
+
+## What a good outcome looks like
+
+The pack fires on every FBS whose surface renders a wizard task-list or a wizard step, and every check returns `pass` on the honest render and `fail` on the corresponding break switch. Your operator walks the task-list, sees the completion states in order, blur-triggers validation without being interrupted mid-typing, and on submit failure lands on the error summary with the failed fields in order. On summary review the operator revises one answer without losing the rest and submits with confidence. On network loss or a closed tab the draft persists and the operator picks up where they left off.
+
+## Mechanism-reach gaps
+
+The blueprint README lists the runtime-observable ACs the pack does NOT bind directly. Every gap is a candidate for a v1.1.0 minor bump extending the pack. Combine with `application-spa` to inherit the forms-engine and the field-component library, and with `application-empty-error-states` for the no-in-progress empty case.
+
+## Promotion signals
+
+- A wizard state past the four closed strings recurs across three or more consumer wizards (a Skipped or Locked state, say). Candidate: a v1.1.0 minor bump extending REQ-001's state enum.
+- The save-and-return contract wants a shared sync engine across a persistence blueprint and this UI blueprint. Candidate: a dedicated `application-draft-sync` blueprint absorbing the transport.
+- The step-indicator enum wants a per-step count element outside the task-list. Candidate: a v1.1.0 minor bump extending ADR-2503's shape enum.
+
+## Costs to be honest about
+
+A three-step wizard is a couple of days of project-side wiring per framework even after adopting the TACs. The pack is Playwright-first, so a project without a running dev server at gate time cannot fire it. The save-and-return contract's server branch needs a persistence adapter; the local branch needs a serialisation shape agreed with the forms-engine and a per-project namespacing rule for shared devices.

package/blueprints/application-forms-wizard/probe-packs/application-forms-wizard.pack.mjs

@@ -0,0 +1,233 @@
+// application-forms-wizard probe pack (v1.0.0).
+//
+// Four surface-observable checks, one per core contract, anchored
+// to the blueprint's contributed AC ids:
+//   AC-24101-1 task-list (per-step state from the GOV.UK vocabulary,
+//              ARIA progressbar wrapper)
+//   AC-24103-1 error-summary (top-of-page summary, skip links,
+//              aria-invalid on the field, focus to summary heading)
+//   AC-24104-1 summary-review (summary-list rows, Change links,
+//              answer retention across an edit-and-save round-trip)
+//   AC-24105-1 save-and-return (server-draft POST/GET round-trip on
+//              ?draft-store=server, localStorage write plus sync tick
+//              on ?draft-store=local; the ?draft-store=none branch
+//              proves the missing-transport refusal on the fixture)
+//
+// Every check drives the real Playwright browser the T-0 runner
+// injects. URLs are composed by the withUrl(runtimeUrl, path)
+// helper per the round 3 T-3 fix train; no bare string
+// concatenation.
+//
+// Sample-app fixture:
+// packages/rcf-lite/test/fixtures/probe-pack-application-forms-wizard/
+// Fixture ships four routes (/task-list, /step/<n>, /summary,
+// /in-progress) plus query switches (?draft-store=server|local|none,
+// ?nav=linear|free, ?step=<n>) and break switches
+// (?break=task-list-vocab, ?break=no-summary, ?break=no-retain,
+// ?break=no-draft) so the negative runs can be driven from a
+// single boot.
+
+function withUrl(runtimeUrl, path) {
+  return new URL(path, runtimeUrl).toString();
+}
+
+// GOV.UK task-list vocabulary (closed enum, v1.0.0). A fifth state
+// is a v1.1.0 minor bump.
+const TASK_LIST_STATES = ['Cannot start yet', 'Not started', 'In progress', 'Completed'];
+
+export default {
+  packName: 'application-forms-wizard',
+  version: '1.0.0',
+  blueprintSlug: 'application-forms-wizard',
+  // Applies to any FBS that realises the task-list TAC or whose
+  // navModel routes name an operator-configured wizard path.
+  // References BOTH tacIds AND route per the loader source-scan
+  // rule (T-0 AC-1701-3, cross-check with authoring standard 8c).
+  appliesTo: ({ fbs }) => {
+    const routes = fbs?.designStage?.navModel?.routes ?? [];
+    const tacIds = fbs?.contextRequirements?.tacIds ?? [];
+    if (tacIds.includes('TAC-2501-application-forms-wizard-task-list')) return true;
+    return routes.some((r) => typeof r?.path === 'string' && /\/(?:task-list|step|summary|in-progress|wizard)(\/|$|\?)/.test(r.path));
+  },
+  boot: { bootCommand: null, waitForUrl: null, waitForSelector: null },
+  checks: [
+    {
+      id: 'AC-24101-1',
+      severity: 'block',
+      description: 'task-list surface renders every step with a data-step-state from the closed GOV.UK vocabulary {Cannot start yet, Not started, In progress, Completed}, wraps them in an ARIA progressbar with aria-valuenow, aria-valuemax and aria-valuetext, and enumerates the step slugs in the manifest order (per WCAG 2.2 SC 2.4.6 Headings and Labels).',
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/task-list'));
+        const dom = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="task-list"]');
+          if (!region) return { present: false };
+          const progressbar = region.querySelector('[role="progressbar"]');
+          const rows = Array.from(region.querySelectorAll('[data-step-slug]'));
+          return {
+            present: true,
+            hasProgressbar: !!progressbar,
+            valueNow: progressbar ? progressbar.getAttribute('aria-valuenow') : null,
+            valueMax: progressbar ? progressbar.getAttribute('aria-valuemax') : null,
+            valueText: progressbar ? progressbar.getAttribute('aria-valuetext') : null,
+            rows: rows.map((r) => ({ slug: r.getAttribute('data-step-slug'), state: r.getAttribute('data-step-state') })),
+          };
+        });
+        if (!dom.present) return { verdict: 'fail', detail: 'task-list region [data-surface="task-list"] not found' };
+        if (!dom.hasProgressbar) return { verdict: 'fail', detail: 'task-list region missing [role="progressbar"] wrapper' };
+        if (!dom.valueNow || !dom.valueMax || !dom.valueText) {
+          return { verdict: 'fail', detail: `progressbar missing aria attributes: valuenow=${JSON.stringify(dom.valueNow)} valuemax=${JSON.stringify(dom.valueMax)} valuetext=${JSON.stringify(dom.valueText)}` };
+        }
+        if (dom.rows.length < 2) return { verdict: 'fail', detail: `task-list rows must number at least 2; got ${dom.rows.length}` };
+        const closedStates = ['Cannot start yet', 'Not started', 'In progress', 'Completed'];
+        const badRow = dom.rows.find((r) => !r.slug || !closedStates.includes(r.state));
+        if (badRow) return { verdict: 'fail', detail: `task-list row outside the closed GOV.UK vocabulary: ${JSON.stringify(badRow)}` };
+        return { verdict: 'pass', detail: `rows=${dom.rows.length} progressbar=${JSON.stringify({ now: dom.valueNow, max: dom.valueMax, text: dom.valueText })}` };
+      },
+    },
+    {
+      id: 'AC-24103-1',
+      severity: 'block',
+      description: 'On submit refusal the step renders [data-surface="error-summary"] with a heading, one anchor per failed field whose href points at the field id, every failed field carries aria-invalid="true" and aria-describedby referencing its per-field error message, and focus lands on the summary heading (per WCAG 2.2 SC 3.3.1 Error Identification and SC 3.3.3 Error Suggestion).',
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        // The fixture step 2 route pre-renders the error summary shape
+        // on ?refused=1 so the pack can read the DOM without driving
+        // the submit click through the browser transport.
+        await browser.goto(withUrl(runtimeUrl, '/step/2?refused=1'));
+        const dom = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="error-summary"]');
+          if (!region) return { present: false };
+          const heading = region.querySelector('h2, [role="heading"]');
+          const anchors = Array.from(region.querySelectorAll('a[href^="#"]'));
+          const anchorHrefs = anchors.map((a) => a.getAttribute('href'));
+          const invalidFields = Array.from(document.querySelectorAll('[aria-invalid="true"]'));
+          const describedFields = invalidFields.map((f) => ({
+            id: f.id,
+            describedBy: f.getAttribute('aria-describedby'),
+            messagePresent: f.getAttribute('aria-describedby')
+              ? !!document.getElementById(f.getAttribute('aria-describedby'))
+              : false,
+          }));
+          const activeSelector = document.activeElement
+            ? [document.activeElement.tagName.toLowerCase(), document.activeElement.getAttribute('data-role') || document.activeElement.id || ''].filter(Boolean).join('#')
+            : null;
+          return {
+            present: true,
+            headingText: heading ? heading.textContent.trim() : null,
+            anchorHrefs,
+            invalidFields: describedFields,
+            activeSelector,
+            activeIsHeading: !!(document.activeElement && heading && document.activeElement === heading),
+          };
+        });
+        if (!dom.present) return { verdict: 'fail', detail: 'error-summary region [data-surface="error-summary"] not found' };
+        if (!dom.headingText) return { verdict: 'fail', detail: 'error-summary region missing heading' };
+        if (dom.anchorHrefs.length < 1) return { verdict: 'fail', detail: 'error-summary region carries no skip links' };
+        if (dom.invalidFields.length < 1) return { verdict: 'fail', detail: 'no fields carry aria-invalid="true" on submit refusal' };
+        const unbound = dom.invalidFields.find((f) => !f.describedBy || !f.messagePresent);
+        if (unbound) return { verdict: 'fail', detail: `field ${JSON.stringify(unbound.id)} missing aria-describedby or its message: ${JSON.stringify(unbound)}` };
+        if (!dom.activeIsHeading) return { verdict: 'fail', detail: `focus did not land on the summary heading; activeSelector=${JSON.stringify(dom.activeSelector)}` };
+        return { verdict: 'pass', detail: `anchors=${dom.anchorHrefs.length} invalidFields=${dom.invalidFields.length} heading=${JSON.stringify(dom.headingText)}` };
+      },
+    },
+    {
+      id: 'AC-24104-1',
+      severity: 'block',
+      description: 'summary-review surface renders one [data-summary-list-section] per step with a <dl> holding [data-summary-row] entries, every row exposes a [data-recovery="change"] link, and after following one Change link and saving a new value the other rows retain their original values verbatim (per WCAG 2.2 SC 3.3.4 Error Prevention).',
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        // The fixture seeds three steps of answers on ?seed=complete
+        // so /summary renders fully populated for the pack.
+        await browser.goto(withUrl(runtimeUrl, '/summary?seed=complete'));
+        const before = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="summary-review"]');
+          if (!region) return { present: false };
+          const sections = Array.from(region.querySelectorAll('[data-summary-list-section]'));
+          const rows = Array.from(region.querySelectorAll('[data-summary-row]'));
+          const rowSnapshot = rows.map((r) => {
+            const dt = r.querySelector('dt');
+            const dd = r.querySelector('dd');
+            const change = r.querySelector('[data-recovery="change"]');
+            return {
+              label: dt ? dt.textContent.trim() : null,
+              value: dd ? dd.textContent.trim() : null,
+              hasChange: !!change,
+              slug: r.getAttribute('data-field-slug') || null,
+            };
+          });
+          return { present: true, sectionCount: sections.length, rows: rowSnapshot };
+        });
+        if (!before.present) return { verdict: 'fail', detail: 'summary-review region [data-surface="summary-review"] not found' };
+        if (before.sectionCount < 1) return { verdict: 'fail', detail: 'summary-review carries zero [data-summary-list-section] blocks' };
+        if (before.rows.length < 1) return { verdict: 'fail', detail: 'summary-review carries zero [data-summary-row] entries' };
+        const rowMissingChange = before.rows.find((r) => !r.hasChange);
+        if (rowMissingChange) return { verdict: 'fail', detail: `summary-review row missing [data-recovery="change"] link: ${JSON.stringify(rowMissingChange)}` };
+        // Drive the edit-and-save round-trip via the fixture's
+        // synthetic ?edit=<slug>&value=<new> query on /summary so the
+        // browser transport does not require a full form submit path.
+        const editTarget = before.rows[0];
+        if (!editTarget.slug) return { verdict: 'fail', detail: 'first summary row is missing [data-field-slug]; the fixture must expose the slug for the round-trip' };
+        const newValue = `edited-value-${Date.now()}`;
+        await browser.goto(withUrl(runtimeUrl, `/summary?seed=complete&edit=${encodeURIComponent(editTarget.slug)}&value=${encodeURIComponent(newValue)}`));
+        const after = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="summary-review"]');
+          const rows = Array.from(region.querySelectorAll('[data-summary-row]'));
+          return rows.map((r) => {
+            const dd = r.querySelector('dd');
+            return {
+              slug: r.getAttribute('data-field-slug') || null,
+              value: dd ? dd.textContent.trim() : null,
+            };
+          });
+        });
+        const editedAfter = after.find((r) => r.slug === editTarget.slug);
+        if (!editedAfter || editedAfter.value !== newValue) {
+          return { verdict: 'fail', detail: `edited row did not update to the new value; expected ${JSON.stringify(newValue)}, got ${JSON.stringify(editedAfter && editedAfter.value)}` };
+        }
+        const drifted = before.rows.filter((r) => r.slug && r.slug !== editTarget.slug).find((r) => {
+          const afterRow = after.find((a) => a.slug === r.slug);
+          return !afterRow || afterRow.value !== r.value;
+        });
+        if (drifted) return { verdict: 'fail', detail: `an unedited row changed value across the edit-and-save round-trip: ${JSON.stringify(drifted)}` };
+        return { verdict: 'pass', detail: `sections=${before.sectionCount} rows=${before.rows.length} editedSlug=${JSON.stringify(editTarget.slug)}` };
+      },
+    },
+    {
+      id: 'AC-24105-1',
+      severity: 'block',
+      description: 'save-and-return contract ships either the server-side draft table (?draft-store=server issues POST /drafts on advance and GET /drafts returns the persisted answer) or the client-side local buffer (?draft-store=local writes to window.localStorage and renders [data-sync-tick] carrying an ISO-8601 timestamp on every write). The ?draft-store=none branch refuses at severity block (per WCAG 2.2 SC 3.3.7 Redundant Entry).',
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        // The fixture pre-drives the write on /step/1 boot so the
+        // pack can inspect the persisted state without simulating a
+        // form submit through the browser transport.
+        await browser.goto(withUrl(runtimeUrl, '/step/1?draft-store=server&preseed=1'));
+        const server = await browser.evaluate(async () => {
+          const res = await fetch('/drafts');
+          const body = res.ok ? await res.json() : null;
+          return { status: res.status, body };
+        });
+        if (server.status !== 200 || !server.body || typeof server.body !== 'object') {
+          return { verdict: 'fail', detail: `server-draft GET /drafts did not return a JSON body: status=${server.status} body=${JSON.stringify(server.body)}` };
+        }
+        const persistedFields = server.body.fields;
+        if (!persistedFields || Object.keys(persistedFields).length < 1) {
+          return { verdict: 'fail', detail: `server-draft body carries no persisted fields: ${JSON.stringify(server.body)}` };
+        }
+        await browser.goto(withUrl(runtimeUrl, '/step/1?draft-store=local&preseed=1'));
+        const local = await browser.evaluate(() => {
+          const keys = Object.keys(window.localStorage).filter((k) => k.startsWith('draft:application-forms-wizard:'));
+          const tick = document.querySelector('[data-sync-tick]');
+          return { keys, tickText: tick ? tick.getAttribute('data-sync-tick') || tick.textContent.trim() : null };
+        });
+        if (local.keys.length < 1) {
+          return { verdict: 'fail', detail: `client-local localStorage did not carry a namespaced draft key: keys=${JSON.stringify(local.keys)}` };
+        }
+        if (!local.tickText || !/\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/.test(local.tickText)) {
+          return { verdict: 'fail', detail: `client-local [data-sync-tick] missing or not ISO-8601: ${JSON.stringify(local.tickText)}` };
+        }
+        return { verdict: 'pass', detail: `serverPersistedFields=${JSON.stringify(Object.keys(persistedFields))} localKeys=${local.keys.length} tick=${JSON.stringify(local.tickText)}` };
+      },
+    },
+  ],
+};

package/blueprints/application-notifications-in-app/CHANGELOG.md

@@ -0,0 +1,9 @@
+# application-notifications-in-app CHANGELOG
+
+## 1.0.0 (visual round T-4, spec 2026-09-04)
+
+- First ratified version of the shelf's application-notifications-in-app blueprint. Five REQs (live-region preseeding on every declared route; transient toast contract with priority-to-role mapping, one-shot announcement and timeout floor; notification centre inbox with retention and acknowledge round-trip; per-user preferences UI with category silence and sibling delegation; delivery-attempt log with operator-readable rows), eight USs binding runtime-observable ACs plus three cross-cutting cases (page load with backlog, background event, disjoint-content contract), three TACs (live-region wrappers with the toast factory; centre inbox with retention and acknowledge round-trip; preferences UI with sibling delegation), three ADRs (priority-to-role mapping polite/status vs assertive/alert per WCAG 4.1.3 and the ARIA APG alert pattern; six-second toast timeout floor per WCAG 2.2.1 with elicited overrides above the floor; thirty-day centre retention window with elicited overrides). No new global topics.
+- Reserves the `application-notifications-` family prefix for the sibling channel blueprints the shelf will grow into (`-email`, `-push`, `-webhook`) as a doc-only reservation on the blueprint README and every applying blueprint's `docs/topics.md` shelf band registry per Baz decision 2026-09-04 ("we might support more types of notifications - be clear in the name what these ones are").
+- Ships `probe-packs/application-notifications-in-app.pack.mjs`: three browser-verify checks anchored to blueprint AC ids, every check carrying a description field per spec section 9. `AC-20101-1` live-region preseeded on every declared route (wrappers present AND empty at load, enumerated by `[data-live-region]`). `AC-20102-1` transient toast contract with priority-to-role mapping and timeout measured against the ADR-2102 six-second floor via `data-shown-at`/`data-dismissed-at` timestamps (no six-second sleep in the pack; bounded polling). `AC-20103-1` centre acknowledge round-trip enumerated by `data-notification-id` (per-element attribute per T-3 gate discipline), reconciled through both `window.__notificationFetches` and the server-side request log. Fourth blueprint on the shelf that ships a Playwright probe pack under the T-0 runner extension.
+- Ships a sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-notifications-in-app/` (dependency-free Node HTTP server) so the pack can be probed at the shelf's own gate; the fixture is the golden the gate reviewer drives, with `?break=preseed`, `?break=role`, `?break=timeout` and `?break=ack` query switches for the negative runs. Three routes (`/`, `/notifications-centre`, `/notifications-preferences`); every route preseeds both live-region wrappers.
+- Suggests the `logging` and `errorHandling` companions with the ratified spec's reasons. `providesRoles` absent, leaf blueprint per the loader contract (an empty array is refused, an omitted field marks the blueprint as a leaf).

package/blueprints/application-notifications-in-app/README.md

@@ -0,0 +1,80 @@
+# Notifications in-app blueprint (v1.0.0)
+
+Vendor-neutral in-app-notifications contract for a rcf-lite application. Ships the live-region preseeding discipline (polite and assertive wrappers present in the DOM before any notification fires per the WAI-ARIA 1.2 normative reference), the transient toast contract with priority-to-role mapping (info to polite/status, error to assertive/alert per WCAG 4.1.3 and the ARIA APG alert pattern), the WCAG 2.2.1 six-second toast timeout floor with operator-elicited overrides above the floor, the notification centre inbox with a thirty-day retention window and a per-item acknowledge round-trip enumerated by `data-notification-id`, the per-user preferences UI with category silence and sibling-channel digest delegation, and the delivery-attempt log write path. Ships a Playwright probe pack under `probe-packs/application-notifications-in-app.pack.mjs` whose three checks are the runtime gate the delivery-ci-workflows runner drives (visual round spec 2026-09-04, section 5.4). No new global topics; suggests the `logging` and `errorHandling` companions. Fourth blueprint on the shelf that ships a Playwright probe pack under the T-0 runner extension.
+
+## Apply
+
+```
+rcf define blueprint add <path-to>/blueprints/application-notifications-in-app
+```
+
+Applies namespaced contributions into the project tree and records `manifest.blueprints[]`. Consumes the `logging` and `errorHandling` companions when they resolve to an applied provider or a registered library; falls back to the shelf providers otherwise.
+
+## Anatomy
+
+| Piece | Where | What |
+|---|---|---|
+| Metadata | `blueprint.json` | Slug, version 1.0.0, category `application`, `suggestedCompanions: [{ logging }, { errorHandling }]`, `providesRoles` absent (leaf blueprint), 19 contributions in the 20xxx US band and 21xx ADR/TAC block |
+| Doc set | `contributions/` | 5 REQs, 8 USs, 3 TACs, 3 ADRs, schema-valid and namespaced |
+| Probe pack | `probe-packs/application-notifications-in-app.pack.mjs` | Three browser-verify checks anchored to blueprint AC ids: `AC-20101-1` live-region preseeding on every declared route (wrappers present AND empty at load); `AC-20102-1` transient toast contract with priority-to-role mapping and timeout measured against the ADR-2102 floor via `data-shown-at`/`data-dismissed-at`; `AC-20103-1` centre acknowledge round-trip enumerated by `data-notification-id` |
+| Guide | `guide/application-notifications-in-app.md` | Operator-facing: when to reach, when not, mechanism-reach gaps |
+| Coordination vocabulary | `docs/topics.md` | Shelf id band registry update; no new global topics claimed; the family-prefix reservation row |
+
+## What it contributes, and what it deliberately does not
+
+Contributed: REQ, US (with inline ACs), TAC, ADR, plus one shipped probe pack. Adherence is expressed as ACs; the blueprint ships no notifications-framework source and no test files (the probe pack drives the real browser against the applying project's own runtime).
+
+Deliberately not contributed: any transport (email, push, webhook). The in-app slug is the discriminator per Baz decision 2026-09-04: "we might support more types of notifications - be clear in the name what these ones are". Sibling channel blueprints ship their own transport contracts under the reserved `application-notifications-` family prefix.
+
+## Family-prefix reservation
+
+The `application-notifications-` prefix is reserved for the sibling in-app-adjacent channels the shelf will grow into:
+
+- `application-notifications-email`: server-to-user notifications through the applied `email-smtp-resend` companion (or a paired email provider). Owns the email-transport dedupe semantics and the delivery-attempt log rows for the email channel.
+- `application-notifications-push`: Web Push and platform APN/FCM notifications. Owns the subscription lifecycle and the platform-token store.
+- `application-notifications-webhook`: outbound HTTP notifications to operator-configured endpoints. Owns the delivery-retry semantics and the endpoint registry.
+
+The reservation is doc-only in v1.0.0 (per spec Q3 default): the family prefix is named in this README and in every shipped blueprint's `docs/topics.md` shelf band registry as a reserved-slot row. No sibling channel ships in this round. Any future PR that proposes a name outside the family (`application-alerts-email`, `application-messages-push`) reads against this reservation and stops at author-side review.
+
+Digest opt-in on the preferences UI is elicited on the sibling channel, not here: the preferences UI carries a disabled section per sibling channel that is not yet applied, labelled `data-preference-status="sibling not applied"`. When the sibling ships and the applying project applies it, that sibling's own blueprint reads the operator's preference state and drives the digest transport.
+
+## Quality bar
+
+Every route the applying project ships renders with both live-region wrappers preseeded in the DOM before any notification fires (`[aria-live="polite"] [data-live-region="polite"]` and `[role="alert"] [data-live-region="assertive"]`), both empty at page load. Every toast writes into exactly one wrapper based on its priority (info to polite as `role="status"`, error to assertive as `role="alert"`) and records `data-shown-at` and `data-dismissed-at` timestamps a probe can measure the timeout against without sleeping in the pack. Every toast timeout is at or above the WCAG 2.2.1 six-second floor. The notification centre lists notifications inside the ADR-2103 retention window, every item enumerated by `data-notification-id`, every acknowledge control Tab-reachable and round-tripping to `POST /api/notifications/acknowledge` with the DOM updating on the response.
+
+## Known mechanism-reach gaps
+
+Every runtime-observable AC that is not bound to a pack check appears here individually per the T-1 gate discipline (`blueprint-authoring-checklist.md` section 6.g): categories are not enough. The pack has three checks; every other runtime-observable AC on this blueprint is a mechanism-reach gap named below.
+
+- **AC-20101-2 live-region factory identity stable across route changes**. The pack asserts the wrappers are preseeded on every declared route (AC-20101-1); it does not assert the two wrappers are the same DOM nodes across route changes (a factory that recreates the wrappers on route change passes AC-20101-1 but fails AC-20101-2). A v1.1 minor bump could persist a `data-live-region-id` on each wrapper and assert identity across a `browser.click` on a nav link.
+- **AC-20102-2 toast factory library-scope shape**. The pack drives the runtime toast surface (AC-20102-1); the library-scope AC on the factory's own signature is a project-side review concern.
+- **AC-20103-2 centre factory reads through the delivery-log endpoint**. The pack drives the item enumeration and the acknowledge round-trip (AC-20103-1); the library-scope AC on the factory's own delivery-log read is a project-side review concern.
+- **AC-20104-1 preferences category silence**. The preferences surface renders per-category toggles but the pack does not itself activate a silence toggle and assert the round-trip today. A v1.1 minor bump could add a preferences-round-trip check paralleling AC-20103-1.
+- **AC-20104-2 sibling-channel digest section disabled when no sibling applied**. The fixture renders the disabled sections and the pack could inspect them, but the AC's real bite is when a sibling channel ships and the disabled state must lift; this class stays a v1.1 minor bump candidate for when the first sibling ships.
+- **AC-20105-1 delivery-log endpoint shape**. The pack does not enumerate every row on the log (the delivery-log's persistence is delegated to the applied `logging` companion). A v1.1 minor bump could add a log-shape probe that reads `/api/delivery-log`, asserts the row shape and confirms append-only order.
+- **AC-20105-2 delivery-log writes through the applied logging companion factory**. The pack does not inspect the companion's factory today. A v1.1 minor bump could add a companion-boundary check reading a marker the applying project stamps on companion-authored rows.
+- **AC-20106-1 page load with backlog does not saturate the polite queue**. The pack does not itself count polite-queue emissions at load. A v1.1 minor bump could add a MutationObserver-based check that counts inserts into the polite wrapper during the first render tick.
+- **AC-20107-1 background event indistinguishable from operator-driven event**. The pack fires the operator-driven variant (AC-20102-1); a background-event dispatch through `POST /__emit` on the fixture would exercise the same code path and reach the same DOM shape.
+- **AC-20108-1 disjoint content between wrappers**. The pack asserts the disjoint-content rule at the moment it inspects the wrappers, not continuously across the toast lifetime. TAC-2101 notes name this residual; a v1.1 minor bump could add a MutationObserver-based check.
+- **AC-2101-6 family-prefix reservation is documented on the shelf**. This is a doc-observable AC (the reservation paragraph exists in this README and the shelf registry rows). Not runtime-observable; not a mechanism-reach gap in the same sense but named for completeness.
+
+## Elicited parameters (ADR-2101 through ADR-2103 and REQ notes)
+
+The applying project elicits these at apply; the declarative ADR shape (`elicited: true`) records the intent on the manifest. The runner has no apply-time elicitation phase today (w-2026-09-04-dave-022, built in T-5); accept the declarative shape and gather the operator's answers by hand during the apply pass.
+
+- **Toast timeout floor** (ADR-2102): six seconds baseline per WCAG 2.2.1; operator elicits an override above the floor (twelve seconds, thirty seconds); the elicited value lands on `manifest.blueprints[application-notifications-in-app].appliedParameters.toastTimeoutSeconds`. A value below six is refused at apply.
+- **Notification categories** (REQ-004): the operator's category list (payment, security, product, and any project-specific categories). The preferences UI renders one section per elicited category.
+- **Centre retention window** (ADR-2103): thirty days by default; operator elicits an override. Below one day refused at apply.
+- **Notification centre route path** (REQ-003 note): `/notifications-centre` by default; operator elicits an override for a bespoke route.
+- **Digest transports** (REQ-004 note): elicited on the sibling channel blueprint at its apply, not here. This blueprint ships the preferences UI's disabled sibling section only.
+
+## Standards trace
+
+WCAG 4.1.3 Status Messages on the live-region contract (REQ-001, ADR-2101). ARIA APG alert pattern on the assertive slot (ADR-2101). WCAG 2.2.1 Timing Adjustable on the toast timeout floor (ADR-2102). WAI-ARIA 1.2 live regions normative reference (Sara Soueidan's guidance is the shipped project-side citation on the preseeding contract; the standards trace holds against the WAI-ARIA specification directly). `standardsTraceClause` on each ADR carries the primary clause or pattern id.
+
+## Consumers and dependencies
+
+- Consumes the applied `logging` companion (or the shelf provider `observability-logging`) for the delivery-attempt log write path (REQ-005, TAC-2102) and every acknowledge round-trip record. A project without a `logging` companion applied sees the delivery-log endpoint returning an empty rows array, which fails project-side review.
+- Consumes the applied `errorHandling` companion (or the shelf provider `application-error-handling`) for the assertive-slot alert's internal error record when an acknowledge round-trip fails at the server.
+- Reserves the `application-notifications-` family prefix for sibling channel blueprints (see above).
+- Reuses the T-3 pack-browser `resize(width, height)` seam only for future minor bumps; v1.0.0 does not exercise breakpoint reflow in the pack.

package/blueprints/application-notifications-in-app/blueprint.json

@@ -0,0 +1,30 @@
+{
+  "slug": "application-notifications-in-app",
+  "version": "1.0.0",
+  "category": "application",
+  "suggestedCompanions": [
+    { "role": "logging", "reason": "Every acknowledge round-trip and every delivery-attempt row is written through the applied logger; a logging companion supplies the factory the notification centre, the toast surface and the delivery-attempt log write records against." },
+    { "role": "errorHandling", "reason": "The assertive-slot alert routes an internal error record whose error envelope conforms to the applied error contract; an errorHandling companion supplies the record factory and the surface boundary the alert toast renders through." }
+  ],
+  "contributions": [
+    { "id": "application-notifications-in-app-REQ-001", "kind": "req", "path": "requirements/application-notifications-in-app-req-001.json" },
+    { "id": "application-notifications-in-app-REQ-002", "kind": "req", "path": "requirements/application-notifications-in-app-req-002.json" },
+    { "id": "application-notifications-in-app-REQ-003", "kind": "req", "path": "requirements/application-notifications-in-app-req-003.json" },
+    { "id": "application-notifications-in-app-REQ-004", "kind": "req", "path": "requirements/application-notifications-in-app-req-004.json" },
+    { "id": "application-notifications-in-app-REQ-005", "kind": "req", "path": "requirements/application-notifications-in-app-req-005.json" },
+    { "id": "application-notifications-in-app-US-20101", "kind": "us", "path": "user-stories/application-notifications-in-app-us-20101.json" },
+    { "id": "application-notifications-in-app-US-20102", "kind": "us", "path": "user-stories/application-notifications-in-app-us-20102.json" },
+    { "id": "application-notifications-in-app-US-20103", "kind": "us", "path": "user-stories/application-notifications-in-app-us-20103.json" },
+    { "id": "application-notifications-in-app-US-20104", "kind": "us", "path": "user-stories/application-notifications-in-app-us-20104.json" },
+    { "id": "application-notifications-in-app-US-20105", "kind": "us", "path": "user-stories/application-notifications-in-app-us-20105.json" },
+    { "id": "application-notifications-in-app-US-20106", "kind": "us", "path": "user-stories/application-notifications-in-app-us-20106.json" },
+    { "id": "application-notifications-in-app-US-20107", "kind": "us", "path": "user-stories/application-notifications-in-app-us-20107.json" },
+    { "id": "application-notifications-in-app-US-20108", "kind": "us", "path": "user-stories/application-notifications-in-app-us-20108.json" },
+    { "id": "TAC-2101-application-notifications-in-app-live-region", "kind": "tac", "path": "tacs/tac-2101-application-notifications-in-app-live-region.json" },
+    { "id": "TAC-2102-application-notifications-in-app-centre", "kind": "tac", "path": "tacs/tac-2102-application-notifications-in-app-centre.json" },
+    { "id": "TAC-2103-application-notifications-in-app-preferences", "kind": "tac", "path": "tacs/tac-2103-application-notifications-in-app-preferences.json" },
+    { "id": "ADR-2101-application-notifications-in-app-live-region-role-mapping", "kind": "adr", "path": "adrs/adr-2101-application-notifications-in-app-live-region-role-mapping.json", "recommendedDefault": true, "elicited": false, "standardsTraceClause": "WCAG 4.1.3 (Status Messages); ARIA APG alert pattern" },
+    { "id": "ADR-2102-application-notifications-in-app-toast-timeout-floor", "kind": "adr", "path": "adrs/adr-2102-application-notifications-in-app-toast-timeout-floor.json", "recommendedDefault": true, "elicited": true, "standardsTraceClause": "WCAG 2.2.1 (Timing Adjustable)" },
+    { "id": "ADR-2103-application-notifications-in-app-retention-window", "kind": "adr", "path": "adrs/adr-2103-application-notifications-in-app-retention-window.json", "recommendedDefault": true, "elicited": true, "standardsTraceClause": "generic enterprise practice" }
+  ]
+}

package/blueprints/application-notifications-in-app/contributions/adrs/adr-2101-application-notifications-in-app-live-region-role-mapping.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-2101-application-notifications-in-app-live-region-role-mapping",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Map toast priority to live-region wrapper and ARIA role from a fixed two-value enum: info to polite plus status, error to assertive plus alert",
+  "context": "A transient toast needs to reach a screen reader on the queue that matches the reader's attention regime: an informational confirmation belongs on the polite queue, an error interruption belongs on the assertive queue. Free-form role assignment lets a well-meaning implementation route an error into the polite wrapper (the reader misses the interruption) or route an informational message into the assertive wrapper (the reader is interrupted for a confirmation). The WCAG 4.1.3 Status Messages clause and the ARIA APG alert pattern name the correct mapping; the problem is turning that guidance into a runtime discipline the pack can drive.",
+  "decision": "Toast priority is a two-value enum: `info` and `error`. `info` renders inside the polite wrapper (`[aria-live=\"polite\"] [data-live-region=\"polite\"]`) and carries `role=\"status\"` on the toast element. `error` renders inside the assertive wrapper (`[role=\"alert\"] [data-live-region=\"assertive\"]`) and carries `role=\"alert\"` on the toast element. A priority outside the enum is refused at project-side review. The pack asserts the priority-to-role mapping on both branches and asserts the disjoint-content rule (a body text in exactly one wrapper).",
+  "consequences": "Every toast maps to a queue readers already understand; the reader hears an interruption exactly when the application asserts one. The two-value enum is honest about the shipped shelf's known cases; a third priority (`warning`) would land as a v1.1 minor bump with a shelf-wide review because it changes the role vocabulary. The disjoint-content rule keeps a double-post defect visible at ship rather than at incident.",
+  "alternativesConsidered": [
+    {
+      "name": "Free-form priority string with implicit role mapping",
+      "summary": "Any string as priority; the toast factory picks a role based on a runtime rule.",
+      "reasonNotChosen": "Runtime string-to-role rules drift across implementations; the pack cannot usefully assert the mapping without a fixed enum. Free-form is honest about being unspecified but abdicates the accessibility discipline the ADR exists to codify."
+    },
+    {
+      "name": "Three-value enum with a warning priority",
+      "summary": "info, warning, error; warning uses `role=\"status\"` on the polite queue with a distinct visual cue.",
+      "reasonNotChosen": "The ARIA vocabulary does not include a warning-specific role that assistive technologies distinguish; a warning on the polite queue is indistinguishable at the assistive-technology layer from an info. The visual-cue distinction is real but does not warrant an ADR-level split at v1.0.0."
+    }
+  ],
+  "createdAt": "2026-09-04T23:59:00Z",
+  "updatedAt": "2026-09-04T23:59:00Z"
+}

package/blueprints/application-notifications-in-app/contributions/adrs/adr-2102-application-notifications-in-app-toast-timeout-floor.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-2102-application-notifications-in-app-toast-timeout-floor",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Ship a six-second toast timeout floor per WCAG 2.2.1 Timing Adjustable, with elicited overrides above the floor",
+  "context": "A transient toast that disappears too quickly is a comprehension defect: a reader with a screen reader, a reader with a motor impairment or a reader distracted for two seconds by another task cannot recover the message. The WCAG 2.2.1 Timing Adjustable clause names six seconds as the baseline dwell time for a message the reader must read; below that, the shipped surface fails the clause. On the other hand, an operator on a dashboard with a very high notification volume might want a longer dwell time (twelve seconds, thirty seconds) so an errant page reload does not clear the reader's context.",
+  "decision": "The shipped toast timeout floor is six seconds. The applying project may elicit a longer dwell time at apply; the elicited value is recorded in `manifest.blueprints[application-notifications-in-app].appliedParameters.toastTimeoutSeconds`. A value below six seconds is refused at apply (elicitation rejects it with a message naming the clause). The pack measures the actual dismissal timestamp against the shell root's `data-toast-timeout-floor-seconds` attribute (defaulting to six on the shipped fixture, overrideable by the elicited value) and refuses if any toast dismissed by timeout carries an elapsed time below the recorded floor.",
+  "consequences": "Every shipped surface passes the WCAG 2.2.1 clause at the shipped default. Operators with a real need for a longer dwell time set the elicited value and the pack asserts against the raised floor. The refusal at apply of a value below six seconds keeps the accessibility invariant honest at every project.",
+  "alternativesConsidered": [
+    {
+      "name": "No floor, one project-level default",
+      "summary": "The applying project picks any timeout; the pack does not assert a floor.",
+      "reasonNotChosen": "The WCAG 2.2.1 clause is the whole point; a blueprint that ships without asserting the floor lets a project ship a two-second toast and pass the ship gate. Not shipping the floor is not shipping the discipline."
+    },
+    {
+      "name": "Ship four seconds by default, elicit an override",
+      "summary": "Match the commercial-toast default (four seconds); operators elicit six or more.",
+      "reasonNotChosen": "Four seconds does not clear WCAG 2.2.1 for a reader who is not looking directly at the screen when the toast fires. Shipping below the clause and hoping operators elicit above it is a defect posture."
+    }
+  ],
+  "createdAt": "2026-09-04T23:59:00Z",
+  "updatedAt": "2026-09-04T23:59:00Z"
+}