rcf-lite 0.21.0 → 0.22.0

package/blueprints/application-account-settings/probe-packs/application-account-settings.pack.mjs

@@ -0,0 +1,246 @@
+// application-account-settings probe pack (v1.0.0).
+//
+// Five capability-gated checks anchored to the blueprint AC ids:
+//   AC-25101-1 shell tabs mirror the applied capability set (always fires; guard-checked)
+//   AC-25102-1 profile surface renders with WCAG 1.3.5 autocomplete tokens (always fires)
+//   AC-25105-1 security surface renders the branch matching the applied capability +
+//              the elicited security-surface-shape (fires when credentialSelfService or
+//              hostedIdentityUi is applied)
+//   AC-25106-1 sessions surface lists rows and renders the ARIA APG dialog-modal on
+//              terminate (fires when sessionInventory is applied)
+//   AC-25108-1 theme surface renders the radiogroup and persists per the elicited
+//              theme-persistence (fires when application-spa is applied via caps)
+//
+// Every check drives the real Playwright browser the T-0 runner injects and reads
+// its per-check applicability from the blueprint applied sidecar
+// (rcf/blueprints/application-account-settings.applied.json) written by the apply
+// verb: an absent capability records verdict: skipped and the aggregate treats the
+// check as neither pass nor fail (spec section 3.3, rcf-schemas 0.6.1 has no
+// applicable: false field, per round-3 T-5 precedent).
+//
+// Sample-app fixture: packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/.
+// The fixture ships CAPS and APPS env / ?caps= / ?apps= switches mirroring the
+// applied capability set so the pack can be probed for every fixture combination
+// on the shelf gate.
+
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+async function readAppliedCapabilities(projectRoot) {
+  if (!projectRoot) return [];
+  try {
+    const raw = await readFile(join(projectRoot, 'rcf', 'blueprints', 'application-account-settings.applied.json'), 'utf8');
+    const doc = JSON.parse(raw);
+    return Array.isArray(doc.appliedCapabilities) ? doc.appliedCapabilities.slice() : [];
+  } catch {
+    return [];
+  }
+}
+
+async function readAppliedElicitations(projectRoot) {
+  if (!projectRoot) return {};
+  try {
+    const raw = await readFile(join(projectRoot, 'rcf', 'blueprints', 'application-account-settings.applied.json'), 'utf8');
+    const doc = JSON.parse(raw);
+    return typeof doc.appliedElicitations === 'object' && doc.appliedElicitations ? doc.appliedElicitations : {};
+  } catch {
+    return {};
+  }
+}
+
+function withUrl(runtimeUrl, path) {
+  return new URL(path, runtimeUrl).toString();
+}
+
+export default {
+  packName: 'application-account-settings',
+  version: '1.0.0',
+  blueprintSlug: 'application-account-settings',
+  appliesTo: ({ fbs }) => {
+    const routes = fbs?.designStage?.navModel?.routes ?? [];
+    const tacIds = fbs?.contextRequirements?.tacIds ?? [];
+    if (tacIds.includes('TAC-2601-application-account-settings-shell')) return true;
+    return routes.some((r) => typeof r?.path === 'string' && /\/(account|settings|profile)(\/|$)/.test(r.path));
+  },
+  boot: { bootCommand: null, waitForUrl: null, waitForSelector: null },
+  checks: [
+    {
+      id: 'AC-25101-1',
+      severity: 'block',
+      description: 'Shell renders as an ARIA APG tabs region and its tabs mirror the union of applied capabilities plus the always-on profile tab; a tab whose capability is not applied does not render',
+      appliesTo: async () => true,
+      run: async ({ browser, runtimeUrl, projectRoot }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        const caps = await readAppliedCapabilities(projectRoot);
+        await browser.goto(withUrl(runtimeUrl, '/account'));
+        const dom = await browser.evaluate(() => {
+          const nav = document.querySelector('nav[data-role="account-settings-nav"]');
+          if (!nav) return { present: false };
+          const tabs = Array.from(nav.querySelectorAll('[role="tab"]')).map((t) => t.getAttribute('data-tab-id'));
+          const role = nav.getAttribute('role');
+          const ariaLabel = nav.getAttribute('aria-label');
+          return { present: true, tabs, role, ariaLabel };
+        });
+        if (!dom.present) return { verdict: 'fail', detail: 'nav[data-role="account-settings-nav"] not found' };
+        if (dom.role !== 'tablist') return { verdict: 'fail', detail: `nav role expected tablist, got ${dom.role}` };
+        if (!dom.ariaLabel) return { verdict: 'fail', detail: 'nav missing aria-label (accessible name)' };
+        if (!dom.tabs.includes('profile')) return { verdict: 'fail', detail: `profile tab missing from ${JSON.stringify(dom.tabs)}` };
+        const securityExpected = caps.includes('credentialSelfService') || caps.includes('hostedIdentityUi');
+        const securityRendered = dom.tabs.includes('security');
+        if (securityExpected && !securityRendered) return { verdict: 'fail', detail: `security tab expected (caps=${JSON.stringify(caps)}) but not rendered` };
+        if (!securityExpected && securityRendered) return { verdict: 'fail', detail: `security tab rendered but caps=${JSON.stringify(caps)} declare neither credentialSelfService nor hostedIdentityUi (leak)` };
+        const sessionsExpected = caps.includes('sessionInventory');
+        const sessionsRendered = dom.tabs.includes('sessions');
+        if (sessionsExpected && !sessionsRendered) return { verdict: 'fail', detail: `sessions tab expected but not rendered` };
+        if (!sessionsExpected && sessionsRendered) return { verdict: 'fail', detail: `sessions tab rendered but sessionInventory not applied (leak)` };
+        return { verdict: 'pass', detail: `tabs=${JSON.stringify(dom.tabs)} caps=${JSON.stringify(caps)}` };
+      },
+    },
+    {
+      id: 'AC-25102-1',
+      severity: 'block',
+      description: 'Profile surface renders a form with WCAG 1.3.5 autocomplete tokens (name, email, bday, country) and a polite aria-live save-status region',
+      appliesTo: async () => true,
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/account/profile'));
+        const dom = await browser.evaluate(() => {
+          const form = document.querySelector('form[data-surface="profile"]');
+          if (!form) return { present: false };
+          const nameAuto = form.querySelector('input[name="name"]')?.getAttribute('autocomplete');
+          const emailAuto = form.querySelector('input[name="email"]')?.getAttribute('autocomplete');
+          const bdayAuto = form.querySelector('input[name="bday"]')?.getAttribute('autocomplete');
+          const countryAuto = form.querySelector('input[name="country"]')?.getAttribute('autocomplete');
+          const status = form.querySelector('[role="status"][aria-live="polite"]');
+          return { present: true, nameAuto, emailAuto, bdayAuto, countryAuto, statusPresent: !!status };
+        });
+        if (!dom.present) return { verdict: 'fail', detail: 'form[data-surface="profile"] not found' };
+        if (dom.nameAuto !== 'name') return { verdict: 'fail', detail: `name autocomplete token expected "name", got "${dom.nameAuto}"` };
+        if (dom.emailAuto !== 'email') return { verdict: 'fail', detail: `email autocomplete token expected "email", got "${dom.emailAuto}"` };
+        if (dom.bdayAuto !== 'bday') return { verdict: 'fail', detail: `bday autocomplete token expected "bday", got "${dom.bdayAuto}"` };
+        if (dom.countryAuto !== 'country') return { verdict: 'fail', detail: `country autocomplete token expected "country", got "${dom.countryAuto}"` };
+        if (!dom.statusPresent) return { verdict: 'fail', detail: 'save-status region [role="status"][aria-live="polite"] not found' };
+        return { verdict: 'pass', detail: `autocomplete tokens name+email+bday+country present; save-status present` };
+      },
+    },
+    {
+      id: 'AC-25105-1',
+      severity: 'block',
+      description: 'Security surface renders the self-service branch when credentialSelfService is applied and security-surface-shape=self-service; renders the hosted-link-out or hosted-embed branch when hostedIdentityUi is applied and security-surface-shape matches',
+      appliesTo: async ({ projectRoot }) => {
+        const caps = await readAppliedCapabilities(projectRoot);
+        return caps.includes('credentialSelfService') || caps.includes('hostedIdentityUi');
+      },
+      run: async ({ browser, runtimeUrl, projectRoot }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        const caps = await readAppliedCapabilities(projectRoot);
+        const elicits = await readAppliedElicitations(projectRoot);
+        const shape = elicits['security-surface-shape'] ?? 'self-service';
+        await browser.goto(withUrl(runtimeUrl, `/account/security?security-surface-shape=${encodeURIComponent(shape)}`));
+        const dom = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="security"]');
+          if (!region) return { present: false };
+          return {
+            present: true,
+            branch: region.getAttribute('data-branch'),
+            hasPassword: !!region.querySelector('[data-role="change-password"]'),
+            hasMfa: !!region.querySelector('[data-role="mfa-management"]'),
+            hasLinkOut: !!region.querySelector('[data-role="hosted-link-out"]'),
+            hasEmbed: !!region.querySelector('[data-role="hosted-embed"]'),
+            linkRel: region.querySelector('[data-role="hosted-link-out"]')?.getAttribute('rel'),
+            embedSandbox: region.querySelector('[data-role="hosted-embed"]')?.getAttribute('sandbox'),
+          };
+        });
+        if (!dom.present) return { verdict: 'fail', detail: '[data-surface="security"] not found' };
+        if (caps.includes('credentialSelfService') && shape === 'self-service') {
+          if (!dom.hasPassword) return { verdict: 'fail', detail: 'self-service branch missing [data-role="change-password"]' };
+          if (!dom.hasMfa) return { verdict: 'fail', detail: 'self-service branch missing [data-role="mfa-management"]' };
+        } else if (caps.includes('hostedIdentityUi') && shape === 'hosted-link-out') {
+          if (!dom.hasLinkOut) return { verdict: 'fail', detail: 'hosted-link-out branch missing [data-role="hosted-link-out"]' };
+          if (!/noopener/.test(dom.linkRel || '')) return { verdict: 'fail', detail: `hosted-link-out missing rel=noopener (rel="${dom.linkRel}")` };
+        } else if (caps.includes('hostedIdentityUi') && shape === 'hosted-embed') {
+          if (!dom.hasEmbed) return { verdict: 'fail', detail: 'hosted-embed branch missing [data-role="hosted-embed"]' };
+          if (!/allow-scripts/.test(dom.embedSandbox || '')) return { verdict: 'fail', detail: `hosted-embed sandbox missing allow-scripts (got "${dom.embedSandbox}")` };
+        } else {
+          return { verdict: 'fail', detail: `no branch matches caps=${JSON.stringify(caps)} shape="${shape}"` };
+        }
+        return { verdict: 'pass', detail: `branch=${dom.branch} caps=${JSON.stringify(caps)} shape="${shape}"` };
+      },
+    },
+    {
+      id: 'AC-25106-1',
+      severity: 'block',
+      description: 'Sessions surface renders one row per active session enumerated by data-session-id with device and last-active columns plus a terminate action; opens an ARIA APG dialog-modal on terminate',
+      appliesTo: async ({ projectRoot }) => {
+        const caps = await readAppliedCapabilities(projectRoot);
+        return caps.includes('sessionInventory');
+      },
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/account/sessions'));
+        const dom = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="sessions"]');
+          if (!region) return { present: false };
+          const rows = Array.from(region.querySelectorAll('[data-session-id]'));
+          const ids = rows.map((r) => r.getAttribute('data-session-id'));
+          const firstRowColumns = rows[0] ? Array.from(rows[0].querySelectorAll('[data-column]')).map((c) => c.getAttribute('data-column')) : [];
+          const nonCurrentTerminates = rows.filter((r) => r.getAttribute('data-current-session') !== 'true').every((r) => !!r.querySelector('[data-action="terminate"]'));
+          const currentRow = rows.find((r) => r.getAttribute('data-current-session') === 'true');
+          const currentHasTerminate = currentRow ? !!currentRow.querySelector('[data-action="terminate"]') : false;
+          const dialog = region.querySelector('[role="dialog"][aria-modal="true"][data-role="terminate-confirm"]');
+          const dialogLabel = dialog ? dialog.getAttribute('aria-labelledby') : null;
+          const announce = region.querySelector('[role="status"][aria-live="polite"][data-role="session-terminated-announce"]');
+          return { present: true, ids, firstRowColumns, nonCurrentTerminates, currentHasTerminate, dialogPresent: !!dialog, dialogLabel, announcePresent: !!announce };
+        });
+        if (!dom.present) return { verdict: 'fail', detail: '[data-surface="sessions"] not found' };
+        if (dom.ids.length === 0) return { verdict: 'fail', detail: 'sessions surface rendered no rows with data-session-id' };
+        const required = ['device', 'lastActive'];
+        const missing = required.filter((c) => !dom.firstRowColumns.includes(c));
+        if (missing.length > 0) return { verdict: 'fail', detail: `sessions rows missing columns: ${JSON.stringify(missing)} present=${JSON.stringify(dom.firstRowColumns)}` };
+        if (!dom.nonCurrentTerminates) return { verdict: 'fail', detail: 'at least one non-current session row missing [data-action="terminate"]' };
+        if (dom.currentHasTerminate) return { verdict: 'fail', detail: 'the current-session row must not carry [data-action="terminate"]' };
+        if (!dom.dialogPresent) return { verdict: 'fail', detail: 'terminate confirmation dialog [role="dialog"][aria-modal="true"] not rendered' };
+        if (!dom.dialogLabel) return { verdict: 'fail', detail: 'dialog missing aria-labelledby' };
+        if (!dom.announcePresent) return { verdict: 'fail', detail: 'session-terminated announce region not rendered' };
+        return { verdict: 'pass', detail: `rows=${JSON.stringify(dom.ids)} columns=${JSON.stringify(dom.firstRowColumns)} dialog=${dom.dialogPresent}` };
+      },
+    },
+    {
+      id: 'AC-25108-1',
+      severity: 'block',
+      description: 'Theme surface renders as an ARIA APG radiogroup with light/dark/system options and persists per the elicited theme-persistence',
+      appliesTo: async ({ projectRoot }) => {
+        // The theme surface gates on application-spa being applied. On the
+        // fixture side we mirror this via the ?apps=application-spa switch.
+        // A future minor bump reads the manifest.blueprints[] set directly;
+        // for v1 the applied-blueprint set is inferred from the caps sidecar
+        // and the appliedElicitations map (theme-persistence answered => spa applied).
+        const elicits = await readAppliedElicitations(projectRoot);
+        return typeof elicits['theme-persistence'] === 'string';
+      },
+      run: async ({ browser, runtimeUrl, projectRoot }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        const elicits = await readAppliedElicitations(projectRoot);
+        const persist = elicits['theme-persistence'] ?? 'spa-local-storage';
+        await browser.goto(withUrl(runtimeUrl, `/account/theme?apps=application-spa&theme-persistence=${encodeURIComponent(persist)}`));
+        const dom = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="theme"]');
+          if (!region) return { present: false };
+          const role = region.getAttribute('role');
+          const ariaLabel = region.getAttribute('aria-label');
+          const persistAttr = region.getAttribute('data-persist');
+          const options = Array.from(region.querySelectorAll('input[type="radio"][name="theme"]')).map((el) => el.getAttribute('value'));
+          return { present: true, role, ariaLabel, persistAttr, options };
+        });
+        if (!dom.present) return { verdict: 'fail', detail: '[data-surface="theme"] not found' };
+        if (dom.role !== 'radiogroup') return { verdict: 'fail', detail: `role expected radiogroup, got ${dom.role}` };
+        if (!dom.ariaLabel) return { verdict: 'fail', detail: 'radiogroup missing aria-label' };
+        const required = ['light', 'dark', 'system'];
+        const missing = required.filter((v) => !dom.options.includes(v));
+        if (missing.length > 0) return { verdict: 'fail', detail: `radiogroup missing options: ${JSON.stringify(missing)} present=${JSON.stringify(dom.options)}` };
+        if (dom.persistAttr !== persist) return { verdict: 'fail', detail: `data-persist expected "${persist}", got "${dom.persistAttr}"` };
+        return { verdict: 'pass', detail: `role=${dom.role} options=${JSON.stringify(dom.options)} persist=${dom.persistAttr}` };
+      },
+    },
+  ],
+};

package/blueprints/application-admin-console/docs/topics.md

@@ -20,6 +20,13 @@ The blueprint claims no new global topics at v1.0.0. The console is a consumer o
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
 | application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-api-rest/docs/topics.md

@@ -29,7 +29,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
-| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
 | security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
 | security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
@@ -43,6 +43,13 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
 | application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 
 Suffix-family ids (ADR, TAC): SPA numbers in the 2xx range, this package takes 3xx (ADR-301 to ADR-308, TAC-301 to TAC-306); the next blueprint should take 4xx.
 

package/blueprints/application-charts/docs/topics.md

@@ -19,6 +19,13 @@ The blueprint claims no new global topics at v1.0.0. The chart-component contrac
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
 | application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-dashboard/docs/topics.md

@@ -19,6 +19,13 @@ The blueprint claims no new global topics at v1.0.0. The dashboard-shell contrac
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
 | application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-datatable/docs/topics.md

@@ -18,6 +18,13 @@ The blueprint claims no new global topics at v1.0.0. The datatable shell is a ge
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
 | application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-empty-error-states/CHANGELOG.md

@@ -0,0 +1,9 @@
+# application-empty-error-states CHANGELOG
+
+## 1.0.0 (visual round T-1, spec 2026-09-06)
+
+- First ratified version of the shelf's empty-and-error-states blueprint. Five REQs (state catalogue with eight named states, recovery-action contract, announcement contract with role region and aria-live polite, least-privilege 5xx and 403 posture, offline state with write-buffer and reconnection semantics), eight USs 22101-22108 binding one runtime-observable AC per named state, three TACs 2301-2303 (state-machine, recovery-action router, offline write-buffer), three ADRs 2301-2303 (HTTP status contract per RFC 9110 as recommendedDefault, stack-trace visibility elicited with recommendedDefault true, offline strategy across write-buffer read-only-banner and refuse-writes elicited). No new global topics.
+- Ships `probe-packs/application-empty-error-states.pack.mjs`: eight surface-observable browser-verify checks anchored one per named state (`AC-22101-1` not-found, `AC-22102-1` forbidden, `AC-22103-1` server-error, `AC-22104-1` permission-denied, `AC-22105-1` offline, `AC-22106-1` empty-list, `AC-22107-1` no-search-results, `AC-22108-1` error-boundary). Every URL is composed by the `withUrl(runtimeUrl, path)` helper per the round 3 T-3 fix train; no bare string concatenation. The pack-level `appliesTo` predicate references BOTH `tacIds` (TAC-2301) AND `route` (the operator-configured error-shell path glob).
+- Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/` with a Node HTTP server realising all eight states honestly under `/probe/<name>` and break switches (`?break=stack-trace`, `?break=leak-id`, `?break=no-recovery`, `?break=no-live-region`) driving the negative runs from a single boot. The fixture ships its own README naming PORT, every `?state=`, every `?break=`, the manual boot line and the two-line gate-reviewer boot.
+- Declares `suggestedCompanions` `logging` (every rendered error state writes one request-scoped log line with the correlation identifier) and `errorHandling` (the error-boundary state constructs an internal error record from the caught exception). Does NOT declare `providesRoles` (leaf blueprint per spec; loader refuses an empty `providesRoles` array when set, so the leaf-blueprint intent is expressed by omitting the field). Does NOT declare `capabilities` and does NOT declare `requiresAppliedCapabilities` (no auth required).
+- Sixth shipped consumer of T-0's probe-pack runner extension. T-3 `application-forms-wizard` consumes this blueprint for its "no in-progress forms" empty state; T-4 `application-account-settings` consumes this blueprint for its access-denied and empty-history states.

package/blueprints/application-empty-error-states/README.md

@@ -0,0 +1,88 @@
+# Empty and error states blueprint (v1.0.0)
+
+Vendor-neutral empty-and-error-states contract for an rcf-lite application. Ships eight named states, one contract per state: `not-found` (404), `forbidden` (403), `server-error` (500), `offline`, `permission-denied` (403 with a per-resource cause), `empty-list`, `no-search-results`, `error-boundary` (client-side render failure). Each state carries a machine-readable status, a distinct visual, a `role="region"` accessible name, one recovery-action shape from a closed enum, and a polite live-region wrapper for progress and reconnection announcements. Ships a Playwright probe pack under `probe-packs/application-empty-error-states.pack.mjs` whose eight checks each anchor one named state, refuse on the corresponding break switch, and fire against the sample-app fixture on the shelf gate.
+
+## Apply
+
+```
+rcf define blueprint add <path-to>/blueprints/application-empty-error-states
+```
+
+Applies 19 contributions (5 REQs, 8 USs, 3 TACs, 3 ADRs) cleanly on any fresh init project. No `requiresAppliedCapabilities`, no auth prerequisite, no elicited-only parameters that block the apply; the two elicits (`ADR-2302` stack-trace visibility and `ADR-2303` offline strategy) carry recommended defaults so the apply proceeds silently and the project can revisit the elicited answers later.
+
+## Anatomy
+
+| Piece | Where | What |
+|---|---|---|
+| Metadata | `blueprint.json` | Slug, version 1.0.0, category `application`, `suggestedCompanions: [logging, errorHandling]`, 19 contributions in the 23xx / 22xxx band |
+| Doc set | `contributions/` | 5 REQs, 8 USs (8 runtime-observable ACs), 3 TACs, 3 ADRs |
+| Probe pack | `probe-packs/application-empty-error-states.pack.mjs` | Eight surface-observable browser-verify checks, one per named state |
+| Guide | `guide/application-empty-error-states.md` | Operator-facing: when to reach, when not, mechanism-reach gaps |
+| Coordination vocabulary | `docs/topics.md` | Shelf id band registry update; no new global topics claimed |
+| Sample-app fixture | `packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/` | Dependency-free Node HTTP server the pack is probed against on the shelf gate |
+
+## The eight named states
+
+| State | HTTP status | Recovery shape(s) | Announcement | Region wrapper |
+|---|---|---|---|---|
+| `not-found` | 404 | `parent-surface` + `search` | polite live-region | `[data-surface="not-found"]` |
+| `forbidden` | 403 (no per-resource cause) | `request-access` | polite live-region | `[data-surface="forbidden"]` |
+| `server-error` | 5xx | `retry` | polite live-region | `[data-surface="server-error"]` |
+| `permission-denied` | 403 (class-level cause) | `request-access` | polite live-region | `[data-surface="permission-denied"]` |
+| `offline` | (no HTTP; `navigator.onLine` false) | `retry` (implicit on reconnection) | polite live-region for reconnection | `[data-surface="offline"]` |
+| `empty-list` | 200 (empty array on a listing endpoint) | `create` | polite live-region | `[data-surface="empty-list"]` |
+| `no-search-results` | 200 (empty array on a search endpoint) | `clear-filters` | polite live-region | `[data-surface="no-search-results"]` |
+| `error-boundary` | (no HTTP; caught client-side render exception) | `retry` | `role="alert"` (assertive) | `[data-surface="error-boundary"]` |
+
+The eight-state enum is closed at v1.0.0. A ninth state is a v1.1.0 minor bump; a state removed or renamed is a v2.0.0 major.
+
+## Recovery-action router
+
+The closed set of recovery shapes: `parent-surface`, `search`, `request-access`, `retry`, `create`, `clear-filters`, `no-recovery`. Every rendered state carries at least one. The router refuses to render a state without a legitimate shape; a bare state region without any recovery is a build defect the pack catches.
+
+## Offline strategy
+
+`ADR-2303` commits to `write-buffer` as the default (IndexedDB, idempotency token per write, monotonic sequence, flush in sequence on reconnection with server-side dedupe). Elicited alternatives: `read-only-banner` and `refuse-writes`. All three shapes render the offline region and the polite reconnection announcement per REQ-005; the difference is only whether writes queue, disable or refuse.
+
+## Elicited parameters
+
+- **States in scope for v1.** Default: all eight. A project that has not yet shipped offline mode can elicit a reduced set; the pack skips checks whose state is out of scope on that project.
+- **Recovery-action targets per state.** Default: the router's built-ins (parent-surface, search, request-access, retry, create, clear-filters). Projects override the endpoint paths and callbacks per FBS.
+- **Stack-trace visibility in production.** Default: true (hidden). `ADR-2302` elicits an override for staging.
+- **Offline strategy.** Default: `write-buffer`. `ADR-2303` elicits `read-only-banner` or `refuse-writes`.
+
+## The one runtime gate
+
+`probe-packs/application-empty-error-states.pack.mjs` ships eight checks the `rcf verify browser` runner invokes on any FBS whose surface binds `TAC-2301-application-empty-error-states-state-machine` or whose nav model routes name an operator-configured error-shell path. Each check drives the real Playwright browser the runner provisions, reads the accessibility tree and the DOM, and returns a verdict. URLs are composed by the `withUrl(runtimeUrl, path)` helper per the round 3 T-3 fix train; no bare string concatenation.
+
+## Quality bar
+
+WCAG 2.2 AA on every state region: 3.3.1 Error Identification (every error state names the error class in the heading), 2.4.6 Headings and Labels (every region carries a heading and an accessible name), 3.2.4 Consistent Identification (every recovery control carries the same `data-recovery` attribute across states), 4.1.3 Status Messages (every progress and reconnection announcement fires through the polite live-region wrapper), 3.3.3 Error Suggestion (the recovery-action prose names the next action, not just the error). HTTP semantics per RFC 9110 for the status-code contract (ADR-2301). ARIA APG alert pattern on `error-boundary`. `standardsTrace` on the blueprint is empty (this is a general-enterprise-practice blueprint); each ADR contribution carries `standardsTraceClause` naming the clause it implements.
+
+The 500 surface is a CSP-shape enforcement. `AC-22103-1` reads the rendered surface, tokenises against a bundled sensitive-pattern list (backtrace-frame prefix, source-path shape, environment-variable key shape, framework-internal frame prefix, `process.env.NAME` reference), and refuses when any pattern matches.
+
+## Known mechanism-reach gaps
+
+Runtime-observable ACs the pack does NOT bind directly (checklist section 6.g), listed individually per AC id:
+
+- **AC-22101-1 keyboard-focus-on-recovery.** The pack asserts the parent-surface link and the search entry exist and carry the correct `data-recovery` attribute; it does NOT additionally probe that keyboard focus lands on the recovery control on state entry. A v1.1.0 minor bump can drive the browser's accessibility tree and assert focus placement.
+- **AC-22102-1 request-access transport round-trip.** The pack asserts the `[data-action="request-access"]` control exists; it does NOT additionally exercise the POST round-trip and assert the applied notification centre receives the submission. A v1.1.0 minor bump can invoke the click path and inspect the network request log.
+- **AC-22103-1 non-production staging branch.** The pack drives the production branch (`?break=stack-trace` is the negative run for the production posture); the elicited staging-visible branch (`ADR-2302`) is present on the fixture through the same break switch but the pack does not additionally probe the staging-legitimate render.
+- **AC-22104-1 cause-string vocabulary registry.** The pack asserts the class-level cause is present and refuses when a resource-id shape appears; it does NOT additionally cross-check the cause string against a project-side vocabulary registry. A v1.1.0 minor bump can read a project-declared vocabulary file and diff.
+- **AC-22105-1 write-buffer flush order.** The pack asserts a synthetic buffered write is enumerable on `window.__offlineBuffer` and that the polite reconnection announcement fires; it does NOT additionally probe that a multi-entry buffer flushes in sequence with per-entry retry counters. A v1.1.0 minor bump can seed a multi-entry buffer and drive the flush loop.
+- **AC-22106-1 empty-list distinction from loading.** The pack asserts the `[data-visual="empty-list"]` wrapper is present; it does NOT additionally probe that the wrapper is distinct from `[data-visual="loading"]` and `[data-visual="loaded"]` on the same route. A v1.1.0 minor bump can drive the loading branch and diff the wrapper attributes.
+- **AC-22107-1 clear-filters callback shape.** The pack asserts the `[data-recovery="clear-filters"]` control exists and echoes the query; it does NOT additionally exercise the callback and assert the search parameters are removed from the URL. A v1.1.0 minor bump can drive the click path and inspect the resulting URL.
+- **AC-22108-1 boundary retry re-mounts the component.** The pack asserts the `role="alert"` region and the retry control exist; it does NOT additionally probe that the retry re-mounts the crashed component subtree. A v1.1.0 minor bump can drive the click path and inspect the DOM diff.
+
+## Companions
+
+`suggestedCompanions` declares `logging` (every rendered error state writes one request-scoped log line with the correlation identifier the applied logger factory returns) and `errorHandling` (the error-boundary state constructs an internal error record from the caught exception through the applied error-handling factory). Neither is required to apply the blueprint; a project without a logging companion still ships every state region, it just does not emit a per-state log line.
+
+## Consumers
+
+- `application-forms-wizard` (T-3 of this round) consumes the empty-list state as its "no in-progress forms" surface; the wizard's empty branch delegates to this blueprint's TAC-2301 state machine.
+- `application-account-settings` (T-4 of this round) consumes the access-denied path (forbidden and permission-denied) for its scope-gated settings sections and the empty-list state for its empty-history surfaces.
+
+## Composition with application-spa
+
+`application-spa` REQ-006 ships empty, loading, error, banner and alert components as part of its component library. This blueprint composes with SPA; the topic-ownership boundary lives in `docs/topics.md`. SPA owns the tab-title convention and the state-visual tokens; this sibling owns the state list, the recovery-action router and the runtime enforcement pack.

package/blueprints/application-empty-error-states/blueprint.json

@@ -0,0 +1,119 @@
+{
+  "slug": "application-empty-error-states",
+  "version": "1.0.0",
+  "category": "application",
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every rendered error state writes one request-scoped log line with the correlation identifier; a logging companion supplies the factory the pipeline calls."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "The error-boundary state constructs an internal error record from the caught exception; an error-handling companion supplies the factory and the boundary."
+    }
+  ],
+  "contributions": [
+    {
+      "id": "application-empty-error-states-REQ-001",
+      "kind": "req",
+      "path": "requirements/application-empty-error-states-req-001.json"
+    },
+    {
+      "id": "application-empty-error-states-REQ-002",
+      "kind": "req",
+      "path": "requirements/application-empty-error-states-req-002.json"
+    },
+    {
+      "id": "application-empty-error-states-REQ-003",
+      "kind": "req",
+      "path": "requirements/application-empty-error-states-req-003.json"
+    },
+    {
+      "id": "application-empty-error-states-REQ-004",
+      "kind": "req",
+      "path": "requirements/application-empty-error-states-req-004.json"
+    },
+    {
+      "id": "application-empty-error-states-REQ-005",
+      "kind": "req",
+      "path": "requirements/application-empty-error-states-req-005.json"
+    },
+    {
+      "id": "application-empty-error-states-US-22101",
+      "kind": "us",
+      "path": "user-stories/application-empty-error-states-us-22101.json"
+    },
+    {
+      "id": "application-empty-error-states-US-22102",
+      "kind": "us",
+      "path": "user-stories/application-empty-error-states-us-22102.json"
+    },
+    {
+      "id": "application-empty-error-states-US-22103",
+      "kind": "us",
+      "path": "user-stories/application-empty-error-states-us-22103.json"
+    },
+    {
+      "id": "application-empty-error-states-US-22104",
+      "kind": "us",
+      "path": "user-stories/application-empty-error-states-us-22104.json"
+    },
+    {
+      "id": "application-empty-error-states-US-22105",
+      "kind": "us",
+      "path": "user-stories/application-empty-error-states-us-22105.json"
+    },
+    {
+      "id": "application-empty-error-states-US-22106",
+      "kind": "us",
+      "path": "user-stories/application-empty-error-states-us-22106.json"
+    },
+    {
+      "id": "application-empty-error-states-US-22107",
+      "kind": "us",
+      "path": "user-stories/application-empty-error-states-us-22107.json"
+    },
+    {
+      "id": "application-empty-error-states-US-22108",
+      "kind": "us",
+      "path": "user-stories/application-empty-error-states-us-22108.json"
+    },
+    {
+      "id": "TAC-2301-application-empty-error-states-state-machine",
+      "kind": "tac",
+      "path": "tacs/tac-2301-application-empty-error-states-state-machine.json"
+    },
+    {
+      "id": "TAC-2302-application-empty-error-states-recovery-router",
+      "kind": "tac",
+      "path": "tacs/tac-2302-application-empty-error-states-recovery-router.json"
+    },
+    {
+      "id": "TAC-2303-application-empty-error-states-offline-buffer",
+      "kind": "tac",
+      "path": "tacs/tac-2303-application-empty-error-states-offline-buffer.json"
+    },
+    {
+      "id": "ADR-2301-application-empty-error-states-status-contract",
+      "kind": "adr",
+      "path": "adrs/adr-2301-application-empty-error-states-status-contract.json",
+      "recommendedDefault": true,
+      "standardsTraceClause": "RFC 9110"
+    },
+    {
+      "id": "ADR-2302-application-empty-error-states-stack-trace-visibility",
+      "kind": "adr",
+      "path": "adrs/adr-2302-application-empty-error-states-stack-trace-visibility.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "OWASP ASVS V7 error handling"
+    },
+    {
+      "id": "ADR-2303-application-empty-error-states-offline-strategy",
+      "kind": "adr",
+      "path": "adrs/adr-2303-application-empty-error-states-offline-strategy.json",
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    }
+  ]
+}

package/blueprints/application-empty-error-states/contributions/adrs/adr-2301-application-empty-error-states-status-contract.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-2301-application-empty-error-states-status-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "HTTP status to rendered state mapping follows RFC 9110 semantics",
+  "context": "The blueprint dispatches states from HTTP responses. There are three plausible mappings from status to rendered state: honour RFC 9110 semantics verbatim (404 to not-found, 403 to forbidden, 5xx to server-error, empty 200 to empty-list or no-search-results depending on the endpoint kind); collapse all client errors into a single generic client-error state; or lean on a bespoke response-body flag the server includes to name the state. The first is the least-surprising choice for a shelf blueprint whose surfaces will be composed with vendor libraries that emit plain HTTP; the second loses the affordances (parent-surface link on 404, request-access on 403) that make the state useful; the third couples the client tightly to a server contract the shelf does not otherwise mint.",
+  "decision": "Adopt RFC 9110 semantics verbatim as the state-machine's status mapping. 404 dispatches not-found; 403 dispatches forbidden by default and permission-denied when the response body carries a class-level cause string; 5xx dispatches server-error. An empty 200 response body on a listing endpoint dispatches empty-list; an empty 200 on a search endpoint (identified by a q query parameter or an FBS-declared search route) dispatches no-search-results. This mapping is the recommendedDefault per the ADR contribution field.",
+  "consequences": "Projects composing REST APIs that already answer RFC 9110 status codes get the state dispatch for free. Projects using an RPC-style API layer must wrap their transport in a small adapter that raises the plain status code. The state machine remains stable across vendor libraries (fetch, axios, tRPC clients, GraphQL error-code conventions that project the transport-level status) because the contract is on the status number the machine reads, not on a bespoke body flag.",
+  "alternativesConsidered": [
+    {
+      "name": "Collapse client errors into one generic state",
+      "summary": "Route every 4xx into a single client-error state with a generic recovery.",
+      "reasonNotChosen": "Loses the four recovery-shape specialisations (parent-surface on 404, request-access on 403, retry on 5xx, clear-filters on no-search-results) that make the state actionable and forces every recovery through a generic retry."
+    },
+    {
+      "name": "Bespoke response-body state-name field",
+      "summary": "Require every response body to carry a stateName string the machine reads.",
+      "reasonNotChosen": "Couples the shelf blueprint tightly to a server contract the shelf does not otherwise mint; a vendor library returning plain HTTP would be unsupported by default."
+    }
+  ],
+  "createdAt": "2026-09-06T15:40:00Z",
+  "updatedAt": "2026-09-06T15:40:00Z"
+}

package/blueprints/application-empty-error-states/contributions/adrs/adr-2302-application-empty-error-states-stack-trace-visibility.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-2302-application-empty-error-states-stack-trace-visibility",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "The server-error state hides stack traces, source paths and environment-variable keys in production",
+  "context": "The 5xx state is the most tempting surface for a debug leak because a stack trace is the first thing a developer would like on-screen when something breaks. In production the same surface is a probing target for an attacker: a stack trace names framework versions and internal frame layouts; a source path names filesystem structure; an environment-variable key shape names the deploy environment's configuration surface. Staging environments legitimately want the debug detail; production does not.",
+  "decision": "In production the server-error state renders a plain summary line and a retry recovery hook only. The rendered surface refuses any word matching the sensitive-pattern list: backtrace-frame prefixes (\"at <fn>(<file>:<line>:<col>)\" and variants), source paths (leading /, ./, ../), environment-variable key shape (NAME= or process.env.NAME references), and framework-internal frame prefixes. In non-production environments (staging, local) the elicited stack-trace-visible parameter may flip the guard off; the pack still fires on staging so a leak that reaches production is caught before ship. recommendedDefault is true; elicited is true so the operator can flip the guard for staging or for a build that renders the debug region behind a role gate.",
+  "consequences": "Projects on the recommended default get the least-privilege posture with no configuration. Projects that want a debug region in staging author the elicited toggle and add a role-gated debug region behind an operator scope. The pack fires on both branches with the appropriate expectation. A production build that ships with the toggle flipped on refuses the ship gate through this pack's AC-22103-1.",
+  "alternativesConsidered": [
+    {
+      "name": "Always render the stack trace",
+      "summary": "Ship the full stack trace in every environment, on the theory that the operator will see it before an attacker does.",
+      "reasonNotChosen": "In practice an attacker triggers 5xx surfaces at will (bad payloads, malformed routes); the stack trace ships to their browser too. The debug value in production is negligible compared to the leak."
+    },
+    {
+      "name": "Server-side redaction only",
+      "summary": "Rely on the server to strip the stack trace before it reaches the client.",
+      "reasonNotChosen": "The client-side error boundary also renders 5xx surfaces from caught JS exceptions that never touched the server; a server-side redactor cannot cover the client boundary."
+    }
+  ],
+  "createdAt": "2026-09-06T15:40:00Z",
+  "updatedAt": "2026-09-06T15:40:00Z"
+}