rcf-lite 0.25.0 → 0.27.0

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22102.json

@@ -13,7 +13,36 @@
       "id": "AC-22102-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a 403 response, the forbidden state renders inside role=\"region\" with a keyboard-reachable [data-action=\"request-access\"] control that POSTs to /api/request-access. The rendered surface does NOT contain any word matching the sensitive-pattern list (resource id shape, resource name shape, path-shape strings starting with /). The pack drives /probe/forbidden and reads the region, the control, and the full document text for pattern hits."
+      "description": "Given a 403 response, the forbidden state renders inside role=\"region\" with a keyboard-reachable [data-action=\"request-access\"] control that POSTs to /api/request-access. The rendered surface does NOT contain any word matching the sensitive-pattern list (resource id shape, resource name shape, path-shape strings starting with /). The pack drives /probe/forbidden and reads the region, the control, and the full document text for pattern hits.",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.rfc-editor.org/rfc/rfc9110#status.403",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-22102-2",
+      "description": "When the request-access POST returns a non-2xx or times out, the surface announces the failure via the polite live region, keeps the request-access control keyboard-reachable in a retry-able state (data-state=idle) and never shows a submitted-success state.",
+      "given": "the forbidden state rendered and the request-access endpoint returns a non-2xx or times out",
+      "when": "the principal activates request-access",
+      "then": "the polite live region announces the failure, data-state=idle is restored on the control and no data-state=submitted transition fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#status-messages",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-22102-3",
+      "description": "The forbidden state never renders the resource identifier or any per-resource detail; the heading names the class (\"You do not have access to this resource\") and the explanation names the missing capability class only.",
+      "given": "a forbidden state on any resource id",
+      "when": "the surface renders",
+      "then": "no resource identifier is present in the DOM, only the class name of the resource type and the missing capability class",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +54,5 @@
     "state:forbidden"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22103.json

@@ -13,7 +13,32 @@
       "id": "AC-22103-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a mocked 500 response, the server-error state renders inside role=\"region\" with a keyboard-reachable [data-recovery=\"retry\"] control; the rendered surface does NOT contain any word matching the sensitive-pattern list (backtrace-frame prefix like \"at \" plus function name plus file colon line, a source path starting with / or ./ or ../, an environment-variable key shape NAME= or process.env.NAME, or a framework-internal frame prefix). The pack drives /probe/server-error and greps the document text against the pattern list."
+      "description": "Given a mocked 500 response, the server-error state renders inside role=\"region\" with a keyboard-reachable [data-recovery=\"retry\"] control; the rendered surface does NOT contain any word matching the sensitive-pattern list (backtrace-frame prefix like \"at \" plus function name plus file colon line, a source path starting with / or ./ or ../, an environment-variable key shape NAME= or process.env.NAME, or a framework-internal frame prefix). The pack drives /probe/server-error and greps the document text against the pattern list.",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.rfc-editor.org/rfc/rfc9110#status.500",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-22103-2",
+      "description": "When the retry-recovery action fires and the underlying request fails again, the surface remains on the server-error state, the polite live region announces the retry failure and a further retry stays keyboard-reachable; no success state is transitioned to.",
+      "given": "a server-error state and a retry that returns a non-2xx or times out",
+      "when": "the principal activates retry",
+      "then": "the surface stays on server-error, the polite live region announces retry-failed and the retry control remains keyboard-reachable",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22103-3",
+      "description": "The server-error surface never renders a stack trace, a source path, an environment variable name, or any framework internal frame in the production build (ADR-2302); a break in the fixture that leaks any of the above fails the pack.",
+      "given": "the production build renders the server-error surface",
+      "when": "the DOM is inspected",
+      "then": "no stack trace, source path, environment variable name or backtrace frame is present",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +50,5 @@
     "state:server-error"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22104.json

@@ -13,7 +13,18 @@
       "id": "AC-22104-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a mocked 403 response with a per-resource cause, the permission-denied state renders inside role=\"region\" with a class-level cause string (matches /^[A-Za-z][A-Za-z0-9 ]+$/ with no digits-run of four or more) and a [data-action=\"request-access\"] control. The pack drives /probe/permission-denied, reads the cause string, and refuses when the string contains a resource-id shape (four or more consecutive digits, or a UUID pattern, or a slug-shape id preceded by resource identifiers like \"resource=\" or \"id=\")."
+      "description": "Given a mocked 403 response with a per-resource cause, the permission-denied state renders inside role=\"region\" with a class-level cause string (matches /^[A-Za-z][A-Za-z0-9 ]+$/ with no digits-run of four or more) and a [data-action=\"request-access\"] control. The pack drives /probe/permission-denied, reads the cause string, and refuses when the string contains a resource-id shape (four or more consecutive digits, or a UUID pattern, or a slug-shape id preceded by resource identifiers like \"resource=\" or \"id=\").",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22104-2",
+      "description": "The permission-denied state names the missing scope class (\"You need the admin role\") and never renders the underlying resource identifier; a scope name is a WHOLE role class, never a per-resource permission.",
+      "given": "a permission-denied state on a specific resource",
+      "when": "the surface renders",
+      "then": "the missing scope name is a role class and no resource identifier appears in the DOM",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +36,5 @@
     "state:permission-denied"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22105.json

@@ -13,7 +13,38 @@
       "id": "AC-22105-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given navigator.onLine simulated false via the runtime seam (page.setOffline(true) on the project route, an offline endpoint on the sample-app route the pack uses instead), the offline state renders inside role=\"region\" with a read-only banner naming offline mode. A synthetic write buffers to window.__offlineBuffer with an idempotency token and a monotonic sequence. On the reconnect signal (navigator.onLine true or the sample-app /probe/offline?reconnect route) the polite live-region wrapper with data-live-region=\"polite\" carries a reconnection announcement. The pack drives /probe/offline, reads the banner, the buffer entry and the polite wrapper text."
+      "description": "Given navigator.onLine simulated false via the runtime seam (page.setOffline(true) on the project route, an offline endpoint on the sample-app route the pack uses instead), the offline state renders inside role=\"region\" with a read-only banner naming offline mode. A synthetic write buffers to window.__offlineBuffer with an idempotency token and a monotonic sequence. On the reconnect signal (navigator.onLine true or the sample-app /probe/offline?reconnect route) the polite live-region wrapper with data-live-region=\"polite\" carries a reconnection announcement. The pack drives /probe/offline, reads the banner, the buffer entry and the polite wrapper text.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22105-2",
+      "description": "On reconnection, the offline buffer flushes in the order of enqueue: each buffered write is replayed with the stable token it was buffered under, and a successful write removes the entry from the buffer.",
+      "given": "a buffer with two writes enqueued while offline",
+      "when": "navigator.onLine transitions to true and the buffer flushes",
+      "then": "the two writes are replayed in the order they were enqueued, each keyed by its stable token, and each success removes the entry",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22105-3",
+      "description": "When a buffered write returns a non-2xx or times out on replay, the entry stays in the buffer, its retry-count increments, a banner announces the failure via the polite live region, and no downstream surface renders as if the write had succeeded.",
+      "given": "a buffer with one write enqueued and the flush replay returns a non-2xx or times out",
+      "when": "the flush runs",
+      "then": "the entry remains in the buffer with retryCount incremented, the polite live region announces the failure and no downstream surface reflects the write",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22105-4",
+      "description": "The buffer refuses to enqueue two writes with the same stable token (idempotency of a retried operation): the second enqueue is a no-op and the buffer size remains 1.",
+      "given": "a buffer that already contains a write with token T",
+      "when": "the client attempts to enqueue a second write with the same token T",
+      "then": "the second enqueue is a no-op, the buffer size stays at 1 and no duplicate replay fires on flush",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +56,5 @@
     "state:offline"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22106.json

@@ -13,7 +13,18 @@
       "id": "AC-22106-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a listing endpoint returning an empty array, the empty-list state renders inside role=\"region\" with a data-visual=\"empty-list\" wrapper (distinct from data-visual=\"loading\" and data-visual=\"loaded\") and a keyboard-reachable [data-recovery=\"create\"] control. The pack drives /probe/empty-list, reads the region and the wrapper attribute, and asserts the recovery control exists and carries an accessible name."
+      "description": "Given a listing endpoint returning an empty array, the empty-list state renders inside role=\"region\" with a data-visual=\"empty-list\" wrapper (distinct from data-visual=\"loading\" and data-visual=\"loaded\") and a keyboard-reachable [data-recovery=\"create\"] control. The pack drives /probe/empty-list, reads the region and the wrapper attribute, and asserts the recovery control exists and carries an accessible name.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22106-2",
+      "description": "When the recovery-action router has no recovery configured for a state, the router refuses to render a recovery control and renders an explicit no-recovery notice naming the state; a broken configuration (a recovery-shape enum outside the closed set) is refused at apply.",
+      "given": "an empty-list state with no configured create/clear/invite recovery",
+      "when": "the surface renders",
+      "then": "a no-recovery notice renders naming the state and no false recovery control appears",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +36,5 @@
     "state:empty-list"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22107.json

@@ -13,7 +13,28 @@
       "id": "AC-22107-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a search or filter yielding zero rows, the no-search-results state renders inside role=\"region\" with a data-visual=\"no-search-results\" wrapper distinct from empty-list, echoing the query terms verbatim inside a data-query wrapper, and a keyboard-reachable [data-recovery=\"clear-filters\"] control that removes the search parameters on click. The pack drives /probe/search?q=needle, reads the region, the wrapper attribute, the echoed query and the recovery control."
+      "description": "Given a search or filter yielding zero rows, the no-search-results state renders inside role=\"region\" with a data-visual=\"no-search-results\" wrapper distinct from empty-list, echoing the query terms verbatim inside a data-query wrapper, and a keyboard-reachable [data-recovery=\"clear-filters\"] control that removes the search parameters on click. The pack drives /probe/search?q=needle, reads the region, the wrapper attribute, the echoed query and the recovery control.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22107-2",
+      "description": "The surface echoes the exact search query verbatim in the DOM (data-query attribute or visible text) so a screen reader can name the searched term; a query containing special characters is escaped for HTML but never truncated.",
+      "given": "a no-search-results state on the query \"foo & bar\"",
+      "when": "the surface renders",
+      "then": "the DOM carries the query verbatim (HTML-escaped) and no truncation occurs",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22107-3",
+      "description": "When the clear-filters recovery is fired and the underlying reload fails, the surface stays on the no-search-results state and the polite live region announces the failure; no false clear-success is emitted.",
+      "given": "a no-search-results state and a failing clear-filters reload",
+      "when": "the principal activates clear-filters",
+      "then": "the surface stays on no-search-results, the polite live region announces the failure and no clear-success is announced",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +46,5 @@
     "state:no-search-results"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22108.json

@@ -13,7 +13,32 @@
       "id": "AC-22108-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a synthetic client-side render exception thrown via page.evaluate (or the sample-app /probe/error-boundary?crash=1 route), the error-boundary state renders inside role=\"alert\" with a keyboard-reachable [data-recovery=\"retry\"] control, a plain summary line and no stack-frame content matching the sensitive-pattern list. The pack drives /probe/error-boundary?crash=1, reads the region, the retry control and the document text for pattern hits."
+      "description": "Given a synthetic client-side render exception thrown via page.evaluate (or the sample-app /probe/error-boundary?crash=1 route), the error-boundary state renders inside role=\"alert\" with a keyboard-reachable [data-recovery=\"retry\"] control, a plain summary line and no stack-frame content matching the sensitive-pattern list. The pack drives /probe/error-boundary?crash=1, reads the region, the retry control and the document text for pattern hits.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22108-2",
+      "description": "The error-boundary state renders under role=\"alert\" so it is announced by screen readers as it appears without requiring focus; the announcement carries the class of failure (never the error stack).",
+      "given": "a client-side render exception in a child component",
+      "when": "the error-boundary catches it",
+      "then": "the rendered surface carries role=\"alert\" and the announced text names the class only",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/ARIA/apg/patterns/alert/",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-22108-3",
+      "description": "When the route-level recovery from an error-boundary fails (a subsequent navigation throws again), the surface renders the outer shell error state and never loops the client-side render exception; a retry counter caps at 3 before surfacing a hard-refresh recommendation.",
+      "given": "a repeated failure in the same route",
+      "when": "the recovery navigation fires and the render fails again",
+      "then": "the outer shell error state renders, no infinite loop occurs and after 3 retries a hard-refresh recommendation appears",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +50,5 @@
     "state:error-boundary"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/docs/topics.md

@@ -25,7 +25,7 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (HTTP status cont
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/application-empty-error-states/probe-packs/application-empty-error-states.pack.mjs

@@ -11,9 +11,9 @@
 //   AC-22107-1 no-search-results (distinct visual wrapper, echoed query, clear-filters recovery)
 //   AC-22108-1 error-boundary (role=alert, retry control, no stack detail)
 //
-// Every check drives the real Playwright browser the T-0 runner
+// Every check drives the real Playwright browser the runner
 // injects. URLs are composed by the withUrl(runtimeUrl, path) helper
-// per the round 3 T-3 fix train; no bare string concatenation.
+// per the round 3 fix train; no bare string concatenation.
 //
 // Sample-app fixture:
 // packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/
@@ -50,6 +50,34 @@ const RESOURCE_ID_PATTERNS = [
   { name: 'resource-slug-hint', re: /\b(?:resource|id|slug|handle)=[A-Za-z0-9._-]+/i },
 ];
 
+// Fixture-seeded exact tokens. The pack asserts the surface renders
+// these exact values so a check cannot pass on any syntactically valid
+// look-alike; the fixture server is the single source of truth for
+// them and the pack rejects a mismatch.
+const SEEDED_FIXTURE_TOKENS = {
+  forbidden: {
+    requestId: 'req-forbidden-000001',
+    safeResponse: 'The workspace exists but its details are hidden from unauthorised viewers.',
+    // Known secret the pack SEEDS into the exercised /probe/forbidden request
+    // context (?resource=<seededSecretResourceId>). The rendered surface must
+    // redact it: the exact string must be absent from the response body while
+    // the [data-safe-response] redaction marker is present.
+    seededSecretResourceId: 'seeded-secret-widget-forbidden-a7f3c1',
+  },
+  serverError: {
+    correlationId: 'cid-server-000001',
+    safeError: 'The server hit an internal failure. The support team has the request id below.',
+  },
+  permissionDenied: {
+    causeClass: 'scope-missing',
+    requestId: 'req-perm-000001',
+  },
+  errorBoundary: {
+    errorClass: 'render-failure',
+    correlationId: 'cid-boundary-000001',
+  },
+};
+
 function firstSensitiveMatch(text, patterns) {
   if (typeof text !== 'string') return null;
   for (const { name, re } of patterns) {
@@ -66,7 +94,7 @@ export default {
   // Applies to any FBS that realises the state-machine TAC or whose
   // navModel routes name the operator-configured error-shell path.
   // References BOTH `tacIds` AND `route` per the loader source-scan
-  // rule (T-0 AC-1701-3, cross-check with authoring standard 8c).
+  // rule (AC-1701-3, cross-check with authoring standard 8c).
   appliesTo: ({ fbs }) => {
     const routes = fbs?.designStage?.navModel?.routes ?? [];
     const tacIds = fbs?.contextRequirements?.tacIds ?? [];
@@ -110,7 +138,10 @@ export default {
       description: 'forbidden state renders inside a region with a request-access control and the rendered surface refuses to include a resource id, resource name or path-shape token',
       run: async ({ browser, runtimeUrl }) => {
         if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
-        await browser.goto(withUrl(runtimeUrl, '/probe/forbidden'));
+        // Seed the known secret into the exercised request context via a query param on the forbidden path;
+        // the fixture receives the seeded value but never echoes it in the response body in normal mode.
+        const seededSecret = SEEDED_FIXTURE_TOKENS.forbidden.seededSecretResourceId;
+        await browser.goto(withUrl(runtimeUrl, `/probe/forbidden?resource=${encodeURIComponent(seededSecret)}`));
         const dom = await browser.evaluate(() => {
           const region = document.querySelector('[data-surface="forbidden"]');
           if (!region) return { present: false };
@@ -119,12 +150,27 @@ export default {
         });
         if (!dom.present) return { verdict: 'fail', detail: 'forbidden region [data-surface="forbidden"] not found' };
         if (!dom.hasControl) return { verdict: 'fail', detail: 'forbidden region missing [data-action="request-access"] control' };
-        // Least-privilege posture: no resource-id shape, no source path leaking through.
+        // positive-marker gate: fixture seeds a known secret in the request context; the surface must render the safe-response marker plus a request-id, and the pack asserts absence of the leaked secret alongside the positive marker.
+        const positive = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="forbidden"]');
+          const safe = region.querySelector('[data-safe-response]');
+          const rid = region.querySelector('[data-request-id]');
+          return {
+            hasSafeMarker: !!safe,
+            safeText: safe ? safe.textContent.trim() : null,
+            requestId: rid ? rid.getAttribute('data-request-id') : null,
+          };
+        });
+        if (!positive.hasSafeMarker) return { verdict: 'fail', detail: 'forbidden region missing positive [data-safe-response] redaction marker' };
+        if (positive.safeText !== SEEDED_FIXTURE_TOKENS.forbidden.safeResponse) return { verdict: 'fail', detail: `forbidden region [data-safe-response] did not match seeded safe body: got ${JSON.stringify(positive.safeText)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.forbidden.safeResponse)}` };
+        if (positive.requestId !== SEEDED_FIXTURE_TOKENS.forbidden.requestId) return { verdict: 'fail', detail: `forbidden region [data-request-id] did not match seeded id: got ${JSON.stringify(positive.requestId)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.forbidden.requestId)}` };
+        // Positive redaction assertion: the exact seeded secret MUST be absent from the response body.
+        if (dom.text.includes(seededSecret)) return { verdict: 'fail', detail: `forbidden surface leaked the seeded secret resource id ${JSON.stringify(seededSecret)} into the response body` };
         const leak = firstSensitiveMatch(dom.text, RESOURCE_ID_PATTERNS);
         if (leak) return { verdict: 'fail', detail: `forbidden surface leaked ${leak.name}: ${leak.match}` };
         const path = firstSensitiveMatch(dom.text, SENSITIVE_PATTERNS.filter((p) => p.name.startsWith('source-path')));
         if (path) return { verdict: 'fail', detail: `forbidden surface leaked ${path.name}: ${path.match}` };
-        return { verdict: 'pass', detail: 'forbidden region clean; request-access control present' };
+        return { verdict: 'pass', detail: `forbidden region carries positive safe-response marker; requestId=${positive.requestId}; seeded secret ${JSON.stringify(seededSecret)} absent from body and [data-safe-response] marker present with seeded body` };
       },
     },
     {
@@ -142,9 +188,23 @@ export default {
         });
         if (!dom.present) return { verdict: 'fail', detail: 'server-error region [data-surface="server-error"] not found' };
         if (!dom.hasRetry) return { verdict: 'fail', detail: 'server-error region missing [data-recovery="retry"] control' };
+        // positive-marker gate: fixture seeds a known safe-error body; the surface must render the safe-error marker plus a correlation id, and the pack asserts absence of a stack trace alongside the positive marker.
+        const positive = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="server-error"]');
+          const safe = region.querySelector('[data-safe-error]');
+          const cid = region.querySelector('[data-correlation-id]');
+          return {
+            hasSafeMarker: !!safe,
+            safeText: safe ? safe.textContent.trim() : null,
+            correlationId: cid ? cid.getAttribute('data-correlation-id') : null,
+          };
+        });
+        if (!positive.hasSafeMarker) return { verdict: 'fail', detail: 'server-error region missing positive [data-safe-error] body marker' };
+        if (positive.safeText !== SEEDED_FIXTURE_TOKENS.serverError.safeError) return { verdict: 'fail', detail: `server-error region [data-safe-error] did not match seeded safe body: got ${JSON.stringify(positive.safeText)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.serverError.safeError)}` };
+        if (positive.correlationId !== SEEDED_FIXTURE_TOKENS.serverError.correlationId) return { verdict: 'fail', detail: `server-error region [data-correlation-id] did not match seeded id: got ${JSON.stringify(positive.correlationId)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.serverError.correlationId)}` };
         const leak = firstSensitiveMatch(dom.text, SENSITIVE_PATTERNS);
         if (leak) return { verdict: 'fail', detail: `server-error surface leaked ${leak.name}: ${leak.match}` };
-        return { verdict: 'pass', detail: 'server-error region clean; retry control present' };
+        return { verdict: 'pass', detail: `server-error region carries positive safe-error marker; correlationId=${positive.correlationId}` };
       },
     },
     {
@@ -168,9 +228,21 @@ export default {
         if (!dom.present) return { verdict: 'fail', detail: 'permission-denied region [data-surface="permission-denied"] not found' };
         if (!dom.causeText) return { verdict: 'fail', detail: 'permission-denied region missing [data-cause] class-level cause' };
         if (!dom.hasControl) return { verdict: 'fail', detail: 'permission-denied region missing [data-action="request-access"] control' };
+        // positive-marker gate: fixture seeds an exact cause-class token; the surface must expose it on [data-cause-class] with a request id, and the pack asserts absence of any resource-id shape alongside the positive marker.
+        const positive = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="permission-denied"]');
+          const cls = region.querySelector('[data-cause-class]');
+          const rid = region.querySelector('[data-request-id]');
+          return {
+            causeClass: cls ? cls.getAttribute('data-cause-class') : null,
+            requestId: rid ? rid.getAttribute('data-request-id') : null,
+          };
+        });
+        if (positive.causeClass !== SEEDED_FIXTURE_TOKENS.permissionDenied.causeClass) return { verdict: 'fail', detail: `permission-denied region [data-cause-class] did not match seeded token: got ${JSON.stringify(positive.causeClass)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.permissionDenied.causeClass)}` };
+        if (positive.requestId !== SEEDED_FIXTURE_TOKENS.permissionDenied.requestId) return { verdict: 'fail', detail: `permission-denied region [data-request-id] did not match seeded id: got ${JSON.stringify(positive.requestId)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.permissionDenied.requestId)}` };
         const leak = firstSensitiveMatch(dom.causeText, RESOURCE_ID_PATTERNS);
         if (leak) return { verdict: 'fail', detail: `permission-denied cause leaked ${leak.name}: ${leak.match}` };
-        return { verdict: 'pass', detail: `cause=${JSON.stringify(dom.causeText)}` };
+        return { verdict: 'pass', detail: `cause-class=${positive.causeClass} requestId=${positive.requestId}` };
       },
     },
     {
@@ -275,9 +347,21 @@ export default {
         if (!dom.present) return { verdict: 'fail', detail: 'error-boundary region [data-surface="error-boundary"] not found' };
         if (dom.role !== 'alert') return { verdict: 'fail', detail: `error-boundary region role expected "alert", got ${JSON.stringify(dom.role)}` };
         if (!dom.hasRetry) return { verdict: 'fail', detail: 'error-boundary region missing [data-recovery="retry"] control' };
+        // positive-marker gate: the boundary must expose a safe error-class token and a correlation id; the pack asserts absence of stack detail alongside the positive markers.
+        const positive = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="error-boundary"]');
+          const cls = region.querySelector('[data-error-class]');
+          const cid = region.querySelector('[data-correlation-id]');
+          return {
+            errorClass: cls ? cls.getAttribute('data-error-class') : null,
+            correlationId: cid ? cid.getAttribute('data-correlation-id') : null,
+          };
+        });
+        if (positive.errorClass !== SEEDED_FIXTURE_TOKENS.errorBoundary.errorClass) return { verdict: 'fail', detail: `error-boundary region [data-error-class] did not match seeded token: got ${JSON.stringify(positive.errorClass)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.errorBoundary.errorClass)}` };
+        if (positive.correlationId !== SEEDED_FIXTURE_TOKENS.errorBoundary.correlationId) return { verdict: 'fail', detail: `error-boundary region [data-correlation-id] did not match seeded id: got ${JSON.stringify(positive.correlationId)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.errorBoundary.correlationId)}` };
         const leak = firstSensitiveMatch(dom.text, SENSITIVE_PATTERNS);
         if (leak) return { verdict: 'fail', detail: `error-boundary surface leaked ${leak.name}: ${leak.match}` };
-        return { verdict: 'pass', detail: 'error-boundary role=alert, retry control present, no stack detail' };
+        return { verdict: 'pass', detail: `error-boundary carries error-class=${positive.errorClass} correlationId=${positive.correlationId}; no stack detail` };
       },
     },
   ],

package/blueprints/application-error-handling/CHANGELOG.md

@@ -0,0 +1,17 @@
+# application-error-handling CHANGELOG
+
+## 1.0.3 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.0.2 (application-core completion pass, 2026-09-09)
+
+- Adds top-level elicits[] block on blueprint.json declaring the one apply-time answer (classification-additions); backed by REQ-003 naming the transient/permanent/unknown defaults and the elicited-additions grammar per section 7c.
+- Adds refusal-path ACs to US-16102 (stack-and-path scrubbing, non-Error throw defaults, mid-stream exception connection close), US-16104 (non-object context refusal, nested-and-array redaction, circular context handling), US-16105 (permanent no-Retry-After, unknown mapped as permanent, elicited-category retry contract), US-16106 (no-companion fallback stderr JSON single line, direct console.error passthrough, companion factory throw fallback), US-16107 (null-injection refusal, stub invocation contract, transportWriter throw recovery). US-16101 and US-16103 also extended with clean-shutdown preservation, browser-runtime path, double-throw handling, deep cause chain, cause-context redaction and null-vs-undefined cause discipline. Every story now at the 7a floor (4-5 ACs per story, 30 ACs total).
+
+## 1.0.1 (application-core hardening, 2026-09-09)
+
+- hardening pass: chain-consistency lint zero (pass1 + pass2); added deliveredBy to every REQ, added ownerRef and disposition to every AC per section 7b, closed `boundaryFor` and `transportWriter` restatements on AC-16107-1 via ownerRef back to TAC-1701.
+- Added AC-16101-2 (unhandled promise rejection: one record under the `unknown` category, process terminates with exit code 1) covering the 2026-09-08 review finding F-1 on TAC-1701.responsibilities[0].
+
+

package/blueprints/application-error-handling/blueprint.json

@@ -1,27 +1,112 @@
 {
   "slug": "application-error-handling",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "category": "application",
-  "providesRoles": ["errorHandling"],
+  "providesRoles": [
+    "errorHandling"
+  ],
   "suggestedCompanions": [
-    { "role": "logging", "reason": "The internal error record emits through the logging companion, not direct stdout or stderr writes; a logging companion supplies the factory the boundary calls." }
+    {
+      "role": "logging",
+      "reason": "The internal error record emits through the logging companion, not direct stdout or stderr writes; a logging companion supplies the factory the boundary calls."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "classification-additions",
+      "prompt": "Additional error classification categories the project adds to the recommended default set (transient, permanent, unknown). Comma-separated kebab or dotted-namespace tokens (rate-limited, quota-exceeded, dependency-degraded); refused at boot otherwise. Applied alongside the defaults.",
+      "kind": "string",
+      "default": ""
+    }
   ],
   "contributions": [
-    { "id": "application-error-handling-REQ-001", "kind": "req", "path": "requirements/application-error-handling-req-001.json" },
-    { "id": "application-error-handling-REQ-002", "kind": "req", "path": "requirements/application-error-handling-req-002.json" },
-    { "id": "application-error-handling-REQ-003", "kind": "req", "path": "requirements/application-error-handling-req-003.json" },
-    { "id": "application-error-handling-REQ-004", "kind": "req", "path": "requirements/application-error-handling-req-004.json" },
-    { "id": "application-error-handling-US-16101", "kind": "us", "path": "user-stories/application-error-handling-us-16101.json" },
-    { "id": "application-error-handling-US-16102", "kind": "us", "path": "user-stories/application-error-handling-us-16102.json" },
-    { "id": "application-error-handling-US-16103", "kind": "us", "path": "user-stories/application-error-handling-us-16103.json" },
-    { "id": "application-error-handling-US-16104", "kind": "us", "path": "user-stories/application-error-handling-us-16104.json" },
-    { "id": "application-error-handling-US-16105", "kind": "us", "path": "user-stories/application-error-handling-us-16105.json" },
-    { "id": "application-error-handling-US-16106", "kind": "us", "path": "user-stories/application-error-handling-us-16106.json" },
-    { "id": "application-error-handling-US-16107", "kind": "us", "path": "user-stories/application-error-handling-us-16107.json" },
-    { "id": "TAC-1701-application-error-handling-boundary", "kind": "tac", "path": "tacs/tac-1701-application-error-handling-boundary.json" },
-    { "id": "TAC-1702-application-error-handling-record-factory", "kind": "tac", "path": "tacs/tac-1702-application-error-handling-record-factory.json" },
-    { "id": "ADR-1701-application-error-handling-record-shape", "kind": "adr", "path": "adrs/adr-1701-application-error-handling-record-shape.json", "scope": "global", "topic": "errorHandling" },
-    { "id": "ADR-1702-application-error-handling-classification-vocabulary", "kind": "adr", "path": "adrs/adr-1702-application-error-handling-classification-vocabulary.json", "recommendedDefault": true, "elicited": true, "standardsTraceClause": "generic enterprise practice" },
-    { "id": "ADR-1703-application-error-handling-transport-mapping", "kind": "adr", "path": "adrs/adr-1703-application-error-handling-transport-mapping.json", "recommendedDefault": true, "elicited": false, "standardsTraceClause": "generic enterprise practice" }
+    {
+      "id": "application-error-handling-REQ-001",
+      "kind": "req",
+      "path": "requirements/application-error-handling-req-001.json"
+    },
+    {
+      "id": "application-error-handling-REQ-002",
+      "kind": "req",
+      "path": "requirements/application-error-handling-req-002.json"
+    },
+    {
+      "id": "application-error-handling-REQ-003",
+      "kind": "req",
+      "path": "requirements/application-error-handling-req-003.json"
+    },
+    {
+      "id": "application-error-handling-REQ-004",
+      "kind": "req",
+      "path": "requirements/application-error-handling-req-004.json"
+    },
+    {
+      "id": "application-error-handling-US-16101",
+      "kind": "us",
+      "path": "user-stories/application-error-handling-us-16101.json"
+    },
+    {
+      "id": "application-error-handling-US-16102",
+      "kind": "us",
+      "path": "user-stories/application-error-handling-us-16102.json"
+    },
+    {
+      "id": "application-error-handling-US-16103",
+      "kind": "us",
+      "path": "user-stories/application-error-handling-us-16103.json"
+    },
+    {
+      "id": "application-error-handling-US-16104",
+      "kind": "us",
+      "path": "user-stories/application-error-handling-us-16104.json"
+    },
+    {
+      "id": "application-error-handling-US-16105",
+      "kind": "us",
+      "path": "user-stories/application-error-handling-us-16105.json"
+    },
+    {
+      "id": "application-error-handling-US-16106",
+      "kind": "us",
+      "path": "user-stories/application-error-handling-us-16106.json"
+    },
+    {
+      "id": "application-error-handling-US-16107",
+      "kind": "us",
+      "path": "user-stories/application-error-handling-us-16107.json"
+    },
+    {
+      "id": "TAC-1701-application-error-handling-boundary",
+      "kind": "tac",
+      "path": "tacs/tac-1701-application-error-handling-boundary.json"
+    },
+    {
+      "id": "TAC-1702-application-error-handling-record-factory",
+      "kind": "tac",
+      "path": "tacs/tac-1702-application-error-handling-record-factory.json"
+    },
+    {
+      "id": "ADR-1701-application-error-handling-record-shape",
+      "kind": "adr",
+      "path": "adrs/adr-1701-application-error-handling-record-shape.json",
+      "scope": "global",
+      "topic": "errorHandling"
+    },
+    {
+      "id": "ADR-1702-application-error-handling-classification-vocabulary",
+      "kind": "adr",
+      "path": "adrs/adr-1702-application-error-handling-classification-vocabulary.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-1703-application-error-handling-transport-mapping",
+      "kind": "adr",
+      "path": "adrs/adr-1703-application-error-handling-transport-mapping.json",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "generic enterprise practice"
+    }
   ]
 }

package/blueprints/application-error-handling/contributions/adrs/adr-1701-application-error-handling-record-shape.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-1701-application-error-handling-record-shape",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Internal error record shape: code, category, message, correlationId, cause chain, redacted context",
   "context": "Without a shared record shape, every consumer of error data (log ingestion pipelines, alerting rules, wire-response mappers, retry policies) invents its own view. The record loses information at each hop and downstream tools reconstruct it from string parsing. The 'errorHandling' global topic is minted here (distinct from 'errorEnvelope', which stays with application-api-rest as the REST wire shape): errorHandling is the internal record shape and the uncaught-exception boundary; errorEnvelope is the wire format one transport chooses to translate the record into.",