rcf-lite 0.25.0 → 0.27.0

package/blueprints/application-error-handling/contributions/user-stories/application-error-handling-us-16107.json

@@ -2,7 +2,7 @@
   "usId": "application-error-handling-US-16107",
   "prdId": "PRD-001",
   "reqId": "application-error-handling-REQ-001",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "status": "approved",
   "title": "The boundary is substitutable via the framework interface so tests exercise it without booting the whole stack",
   "asA": "test author verifying that a specific exception produces the expected record",
@@ -16,10 +16,59 @@
       "when": "the test invokes handle with a synthetic exception",
       "then": "the stub loggerFactory records one error() call with the constructed record and the stub transportWriter records one write with the mapped wire body",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-16107-2",
+      "description": "Given `boundaryFor({ loggerFactory: null, transportWriter: <stub> })` called with a null or undefined loggerFactory, the constructor refuses with a controlled error naming the missing dependency; no partial boundary is returned. Symmetric refusal for `boundaryFor({ loggerFactory: <stub>, transportWriter: null })`. The check enumerates the two null-injection shapes and inspects the thrown error.",
+      "given": "boundaryFor called with a null or undefined loggerFactory or transportWriter",
+      "when": "the constructor validates its arguments",
+      "then": "it throws a controlled error naming the missing dependency; no partial boundary is returned",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "interfaces[0]"
+      }
+    },
+    {
+      "id": "AC-16107-3",
+      "description": "Given a constructed boundary with a stub loggerFactory, when `boundary.handle(err, context)` is called with a synthetic error, then the stub loggerFactory's `error()` receives exactly one call whose first argument is the constructed record (record.code, record.category, record.correlationId present), the stub transportWriter receives exactly one call carrying the same record, and no direct process.stderr.write fires during the call.",
+      "given": "a boundary constructed with stub loggerFactory and transportWriter, invoked on a synthetic error",
+      "when": "handle(err, context) is called",
+      "then": "the stubs each receive exactly one call carrying the constructed record; no process.stderr.write fires during the call",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "interfaces[0]"
+      }
+    },
+    {
+      "id": "AC-16107-4",
+      "description": "Given a constructed boundary, when `boundary.handle(err, context)` is called and the stub transportWriter throws, then the boundary contract catches the transport failure, emits one additional record through the stub loggerFactory naming the transport failure, and does not re-throw; the caller (the framework) sees a clean return.",
+      "given": "a boundary whose stub transportWriter throws when called",
+      "when": "boundary.handle fires",
+      "then": "the boundary catches the transport throw, emits one additional record through the loggerFactory naming the transport failure, and returns cleanly to the caller",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "interfaces[0]"
+      }
     }
   ],
-  "tacIds": ["TAC-1701-application-error-handling-boundary"],
+  "tacIds": [
+    "TAC-1701-application-error-handling-boundary"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-error-handling/docs/topics.md

@@ -31,7 +31,7 @@
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/application-file-upload/CHANGELOG.md

@@ -1,9 +1,42 @@
 # application-file-upload CHANGELOG
 
-## 1.0.0 (visual round T-2, spec 2026-09-06)
+## 1.2.0 (2026-09-10)
+
+### Added
+
+- Six elicits (`accepted-set`, `size-cap`, `tick-interval`, `concurrency`, `polling`, `chunked-transport`) declared on blueprint.json; REQ-006 binds one runtime clause per apply-time answer family.
+- `virusScan` declared on `blueprint.json.capabilities` and REQ-007 binds the input TAC's refusal path to the applied verifier.
+- Vendor citations on AC-23104-1, AC-23104-3 and AC-23104-4 (tus.io PATCH); AC-23104-4 names the response header (not body).
+
+### Changed
+
+- REQ-002 drops the "at least every 10 percent" clause and keeps the 2-second announcement cap owned by `TAC-2403.interfaces.announcementInterval` (user-observable); names `TAC-2403.interfaces.tickInterval` (250 ms internal poll, not user-observable); ADR-2402 references both via ownerRef.
+- REQ-002.deliveredBy retargeted to `TAC-2403.interfaces.tick`.
+- REQ-003.deliveredBy retargeted to `TAC-2401.interfaces.renderRefusal`.
+- REQ-004.deliveredBy retargeted to `TAC-2402.interfaces.uploadFile`.
+- `TAC-2402.interfaces.removeFile` declared with DELETE failure semantics; REQ-005 targets it.
+- Probe check AC-23103-1 reworked to positively assert a per-file `[data-refusal-receipt]` keyed by file id; fixture updated to emit the marker alongside `data-file-id`.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 (2026-09-10, hardening pass)
+
+### Added
+
+- Failure-path acceptance criteria on US-23101 (MIME and size cap refusal), US-23102 (byte-weighted aggregate progress, tick-cadence cap), US-23103 (per-file failure with focus on retry), US-23104 (tus prerequisite apply refusal with TUS_PREREQUISITE_MISSING, Upload-Offset semantics on retry, malformed Upload-Offset handling), US-23105 (successful removal with polite announce, failed DELETE with data-remove-outcome=failed, completion-once idempotency), US-23106 (Upload-Offset regression abort with UPLOAD_OFFSET_REGRESSION), US-23107 (prefers-reduced-motion static-text fallback). Closes review findings F-1 and F-2.
+- Vendor citations on the tus.io resumable-upload protocol AC and the WCAG animation-from-interactions AC (verified 2026-09-10).
+
+### Changed
+
+- Every REQ now carries a deliveredBy link into TAC-2401 (input), TAC-2402 (transport) or TAC-2403 (progress-announcer).
+- Every AC on every user story now carries an explicit disposition (fixed or template); ACs that observe removeFile carry ownerRef into TAC-2402.
+
+## 1.0.0 (visual round, spec 2026-09-06)
 
 - First ratified version of the shelf's file-upload blueprint. Five REQs (input contract with a labelled file input plus drop-zone plus keyboard alternative per WCAG 2.5.7, progress contract with per-file percent and aggregate percent and polite live-region tick, refusal contract with MIME and size and virus-scan gates and aria-describedby error binding and focus-to-retry, transport contract chunked-and-resumable with multipart POST default and tus.io elicited alternative, completion contract with assertive-slot success announcement per WCAG 4.1.3 and per-file remove and retry), seven USs 23101-23107 binding one runtime-observable AC per REQ plus two cross-cutting cases (network-interruption resumption AC-23106-1, background-tab progress AC-23107-1), three TACs 2401-2403 (upload input surface, upload transport contract, upload progress announcer), three ADRs 2401-2403 (transport branch with multipart recommendedDefault true and tus and vendor-sdk elicited, accepted MIME set and per-file size cap elicited, virus-scan integration via a capability-plus-elicit). No new global topics.
-- Ships `probe-packs/application-file-upload.pack.mjs`: four surface-observable browser-verify checks anchored one per contract (`AC-23101-1` input surface, `AC-23102-1` progress announcer, `AC-23103-1` refusal contract, `AC-23104-1` chunked transport). Every URL is composed by the `withUrl(runtimeUrl, path)` helper per the round 3 T-3 fix train; no bare string concatenation. The pack-level `appliesTo` predicate references BOTH `tacIds` (TAC-2401) AND `route` (the operator-configured upload path glob).
+- Ships `probe-packs/application-file-upload.pack.mjs`: four surface-observable browser-verify checks anchored one per contract (`AC-23101-1` input surface, `AC-23102-1` progress announcer, `AC-23103-1` refusal contract, `AC-23104-1` chunked transport). Every URL is composed by the `withUrl(runtimeUrl, path)` helper per the round 3 fix train; no bare string concatenation. The pack-level `appliesTo` predicate references BOTH `tacIds` (TAC-2401) AND `route` (the operator-configured upload path glob).
 - Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/` with a Node HTTP server realising both transport branches honestly (`?transport=multipart` default, `?transport=tus` elicited alternative) and break switches (`?break=no-input`, `?break=no-live-region`, `?break=send-refused`, `?break=no-chunks`) driving the negative runs from a single boot. The fixture ships its own README naming PORT, every `?transport=`, every `?seed=`, every `?break=`, the manual boot line and the two-line gate-reviewer boot.
 - Declares `suggestedCompanions` `logging` (every refused upload writes one request-scoped log line with the closed refusal reason and the correlation identifier) and `errorHandling` (refusals and transport-layer failures construct an internal error record through the applied error-handling factory). Does NOT declare `providesRoles` (leaf blueprint per spec; loader refuses an empty `providesRoles` array when set, so the leaf-blueprint intent is expressed by omitting the field). Does NOT declare `capabilities` and does NOT declare `requiresAppliedCapabilities` (no auth required).
-- Seventh shipped consumer of T-0's probe-pack runner extension.
+- Seventh shipped consumer of the earlier release probe-pack runner extension.

package/blueprints/application-file-upload/README.md

@@ -52,7 +52,7 @@ Every file row on the fixture cycles through the closed state set `idle` -> `upl
 
 ## The one runtime gate
 
-`probe-packs/application-file-upload.pack.mjs` ships four checks the `rcf verify browser` runner invokes on any FBS whose surface binds `TAC-2401-application-file-upload-input` or whose nav model routes name an operator-configured upload path. Each check drives the real Playwright browser the runner provisions, reads the accessibility tree and the DOM (and the request log for the refusal check and the tus branch), and returns a verdict. URLs are composed by the `withUrl(runtimeUrl, path)` helper per the round 3 T-3 fix train; no bare string concatenation.
+`probe-packs/application-file-upload.pack.mjs` ships four checks the `rcf verify browser` runner invokes on any FBS whose surface binds `TAC-2401-application-file-upload-input` or whose nav model routes name an operator-configured upload path. Each check drives the real Playwright browser the runner provisions, reads the accessibility tree and the DOM (and the request log for the refusal check and the tus branch), and returns a verdict. URLs are composed by the `withUrl(runtimeUrl, path)` helper per the round 3 fix train; no bare string concatenation.
 
 ## Quality bar
 

package/blueprints/application-file-upload/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-file-upload",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "category": "application",
   "suggestedCompanions": [
     {
@@ -38,6 +38,16 @@
       "kind": "req",
       "path": "requirements/application-file-upload-req-005.json"
     },
+    {
+      "id": "application-file-upload-REQ-006",
+      "kind": "req",
+      "path": "requirements/application-file-upload-req-006.json"
+    },
+    {
+      "id": "application-file-upload-REQ-007",
+      "kind": "req",
+      "path": "requirements/application-file-upload-req-007.json"
+    },
     {
       "id": "application-file-upload-US-23101",
       "kind": "us",
@@ -110,5 +120,50 @@
       "elicited": true,
       "standardsTraceClause": "OWASP ASVS V12 file uploads"
     }
+  ],
+  "elicits": [
+    {
+      "id": "accepted-set",
+      "prompt": "Accepted MIME set: comma-separated IANA media types or wildcards (image/*, application/*).",
+      "kind": "string",
+      "default": "image/*"
+    },
+    {
+      "id": "size-cap",
+      "prompt": "Per-file size cap in bytes.",
+      "kind": "string",
+      "default": "10485760"
+    },
+    {
+      "id": "tick-interval",
+      "prompt": "Internal progress polling cadence in milliseconds (default 250, internal only).",
+      "kind": "string",
+      "default": "250"
+    },
+    {
+      "id": "concurrency",
+      "prompt": "Chunk upload concurrency cap (default 3).",
+      "kind": "string",
+      "default": "3"
+    },
+    {
+      "id": "polling",
+      "prompt": "Announcement cap in seconds for the polite live region (default 2).",
+      "kind": "string",
+      "default": "2"
+    },
+    {
+      "id": "chunked-transport",
+      "prompt": "Chunked-and-resumable transport branch: multipart (default) or tus.",
+      "kind": "enum",
+      "options": [
+        "multipart",
+        "tus"
+      ],
+      "default": "multipart"
+    }
+  ],
+  "capabilities": [
+    "virusScan"
   ]
 }

package/blueprints/application-file-upload/contributions/adrs/adr-2402-application-file-upload-accepted-set.json

@@ -2,11 +2,11 @@
   "adrId": "ADR-2402-application-file-upload-accepted-set",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Accepted MIME set and per-file size cap are elicited per project; no shelf default beyond \"nothing accepted\"",
   "context": "A shelf blueprint cannot know what a downstream project's upload endpoint accepts. A photo-gallery product accepts a narrow image set (jpeg, png, webp) with a 20 MB per-file cap; a document workspace accepts pdf, docx, txt with a 100 MB cap; a code-review product accepts a broad set with a 5 MB cap. Picking a default that fits all projects picks one that fits none. Shipping without any elicited values leaves the input TAC in a state where every file is refused (the safe default), which is the correct floor: a project that forgets to elicit the accepted set discovers this immediately on the first upload.",
-  "decision": "The accepted MIME set and the per-file size cap are elicited per project through this ADR. The blueprint contributes the two parameters as elicits on apply; the input TAC's MIME gate refuses every file until both are elicited. The elicited MIME set is a list of IANA media types; wildcards (image/*, application/*) are permitted for projects that want them but discouraged in the guide. The per-file size cap is a positive integer in bytes. A concurrency cap and the polling interval for the announcer are secondary elicits with recommended defaults (concurrency 3, interval 250 ms).",
+  "decision": "The accepted MIME set and the per-file size cap are elicited per project through this ADR. The blueprint contributes the two parameters as elicits on apply; the input TAC's MIME gate refuses every file until both are elicited. The elicited MIME set is a list of IANA media types; wildcards (image/*, application/*) are permitted for projects that want them but discouraged in the guide. The per-file size cap is a positive integer in bytes. A concurrency cap and the announcer cadences are secondary elicits with recommended defaults owned by `TAC-2403.interfaces.tickInterval` (250 ms internal poll, not user-observable) and `TAC-2403.interfaces.announcementInterval` (2 seconds user-observable announcement cap); concurrency defaults to 3.",
   "consequences": "Projects that apply the blueprint without elicitizing discover the refusal on the first upload attempt and go through the elicit flow to unblock it; the refusal is legible (\"MIME gate has no accepted set\") rather than silently accepting everything. Projects with a mature accepted-set list paste it in once and never revisit. The pack asserts the input TAC refuses an obvious wrong-MIME file (a text/plain payload with a jpeg extension) and refuses a payload exceeding the size cap.",
   "alternativesConsidered": [
     {
@@ -21,5 +21,5 @@
     }
   ],
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-001.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Input contract: a labelled file input plus a drop-zone plus a keyboard alternative per WCAG 2.5.7",
   "description": "The upload surface renders a labelled native file input, a labelled drop-zone region for pointer users, and a keyboard-focusable alternative control that opens the picker on Enter or Space. Every input carries an accessible name via label association or aria-label. The three affordances share the same underlying file collector so a keyboard-only user, a pointer user with drag-drop and a screen-reader user reach the same state. Per WCAG 2.5.7 Dragging Movements, the drop-zone is never the only way to add a file; a click and keyboard path both satisfy the same acceptance criterion.",
+  "deliveredBy": {
+    "tacId": "TAC-2401-application-file-upload-input",
+    "field": "interfaces.collectFiles"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-002.json

@@ -2,7 +2,11 @@
   "reqId": "application-file-upload-REQ-002",
   "prdId": "PRD-001",
   "title": "Progress contract: per-file percent, aggregate percent, and a polite live-region tick",
-  "description": "Every file in the upload set carries a per-file percent that advances monotonically from 0 to 100. The surface also carries an aggregate percent that reflects the mean weighted by byte size. A polite live-region wrapper (aria-live polite) receives a text tick at least every 10 percent of aggregate progress with the string format \"<uploaded> of <total> files, <PP> percent\". The polite wrapper is preseeded at render time so a screen reader adopts it before the first tick fires.",
+  "description": "Every file in the upload set carries a per-file percent that advances monotonically from 0 to 100. The surface also carries an aggregate percent that reflects the mean weighted by byte size. A polite live-region wrapper (aria-live polite) receives a text tick per the elicited announcement cap (default 2 seconds, owned by `TAC-2403.interfaces.announcementInterval`) with the string format \"<uploaded> of <total> files, <PP> percent\". Internal progress polling runs at the internal cadence owned by `TAC-2403.interfaces.tickInterval` (default 250 ms, internal only, not user-observable); the polite wrapper is preseeded at render time so a screen reader adopts it before the first announcement fires.",
+  "deliveredBy": {
+    "tacId": "TAC-2403-application-file-upload-progress-announcer",
+    "field": "interfaces.tick"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:application-file-upload",
     "category:02-progress-contract"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-003.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Refusal contract: MIME-type, size-limit and virus-scan refusals with an aria-describedby error binding and focus-to-retry",
   "description": "The upload surface refuses a file that fails the MIME-type gate, exceeds the per-file size cap, or matches the virus-scan hit. Every refusal renders a per-file error message inside a region bound to the file row via aria-describedby, moves keyboard focus to the row's retry control, and refuses to send the file to the server. The refusal reason is one of the closed strings mime-refused, size-refused, virus-refused so a project's log pipeline can classify without prose parsing.",
+  "deliveredBy": {
+    "tacId": "TAC-2401-application-file-upload-input",
+    "field": "interfaces.renderRefusal"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:application-file-upload",
     "category:03-refusal-contract"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-004.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Transport contract: chunked-and-resumable, multipart POST default, tus.io elicited alternative",
   "description": "The upload transport is chunked-and-resumable: an interrupted upload resumes from the last acknowledged offset on retry, and the client retries on transient failures without re-sending acknowledged bytes. The recommended default is a multipart POST with the file split into fixed-size chunks the server assembles server-side. The tus.io resumable upload protocol 1.0.0 is the elicited alternative for projects with a tus server or the third-party SDK; when applied it exposes an Upload-Offset header per PATCH request and supports server-side pause and resume. A per-vendor SDK (S3 multipart, Cloudflare R2 client-direct) is the second elicited alternative when the project has committed to a vendor library.",
+  "deliveredBy": {
+    "tacId": "TAC-2402-application-file-upload-transport",
+    "field": "interfaces.uploadFile"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:application-file-upload",
     "category:04-transport-contract"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-005.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Completion contract: assertive-slot success announcement per WCAG 4.1.3 plus per-file remove and retry",
   "description": "On successful completion of the upload set, the surface renders an assertive-slot announcement in a wrapper carrying role=status or aria-live=assertive with the string \"<N> files uploaded successfully\", per WCAG 4.1.3 Status Messages. Every completed file row carries a keyboard-reachable remove control (returns the row to the pre-upload state and issues a DELETE against the transport where the transport supports removal) and a retry control (visible only after a refusal or a transport error). The completion announcement fires exactly once per set; a retried refusal that then succeeds increments the completed count but does not re-announce.",
+  "deliveredBy": {
+    "tacId": "TAC-2402-application-file-upload-transport",
+    "field": "interfaces.removeFile"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-006.json

@@ -0,0 +1,21 @@
+{
+  "reqId": "application-file-upload-REQ-006",
+  "prdId": "PRD-001",
+  "title": "Apply-time answer families bind the six elicits to the upload contract",
+  "description": "When the applying project answers the six apply-time elicits, the surface honours each with a runtime clause per family: `blueprint.json.elicits[id=accepted-set]` populates the MIME-type gate; `blueprint.json.elicits[id=size-cap]` populates the per-file byte cap; `blueprint.json.elicits[id=tick-interval]` sets the internal progress polling cadence (owned by `TAC-2403.interfaces.tickInterval`, internal only, not user-observable); `blueprint.json.elicits[id=concurrency]` sets the chunk upload parallelism on the transport TAC; `blueprint.json.elicits[id=polling]` caps the polite live-region announcement cadence (owned by `TAC-2403.interfaces.announcementInterval`); `blueprint.json.elicits[id=chunked-transport]` picks the multipart or tus branch on the transport TAC.",
+  "deliveredBy": {
+    "tacId": "TAC-2401-application-file-upload-input",
+    "field": "responsibilities.applyElicits"
+  },
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "The six apply-time answer families named in the guide and ADR-2402 needed one must REQ per family so a project cannot elicit a value and see it ignored silently.",
+  "tags": [
+    "blueprint:application-file-upload"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-007.json

@@ -0,0 +1,21 @@
+{
+  "reqId": "application-file-upload-REQ-007",
+  "prdId": "PRD-001",
+  "title": "virusScan is declared as an own capability the input TAC calls; the applied verifier is elicited per project",
+  "description": "The blueprint declares `virusScan` in `capabilities` and the input TAC calls the applied verifier as an async predicate over a File that resolves to `{clean: true}` or `{clean: false, reason: <string>}`. A project supplies the verifier (or elicits the noop verifier and accepts the risk per ADR-2403). The refusal path on a virus-scan hit fires on the input TAC and the refused file never leaves the browser.",
+  "deliveredBy": {
+    "tacId": "TAC-2401-application-file-upload-input",
+    "field": "responsibilities.verifyVirusScan"
+  },
+  "category": "security",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "ADR-2403 contributes virusScan but the manifest declared no capability; declaring it as an own capability with a must REQ closes the seam.",
+  "tags": [
+    "blueprint:application-file-upload"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-file-upload/contributions/tacs/tac-2401-application-file-upload-input.json

@@ -11,7 +11,9 @@
     "Render a [data-drop-zone] region that accepts dropped files but is never the only input path (WCAG 2.5.7).",
     "Render a [data-open-picker] button that opens the same picker on Enter or Space (AC-23101-1).",
     "Aggregate the three input paths into one file-selection set the transport TAC drains (AC-23101-1).",
-    "Render a per-file error region with an aria-describedby binding and a [data-recovery=\"retry\"] control on refusal, and hand refused files to the transport TAC's refusal-render seam so no bytes leave the browser (AC-23103-1)."
+    "Render a per-file error region with an aria-describedby binding and a [data-recovery=\"retry\"] control on refusal, and hand refused files to the transport TAC's refusal-render seam so no bytes leave the browser (AC-23103-1).",
+    "applyElicits: at apply time, dispatch each of the six answer families to its owner interface: `accepted-set` and `size-cap` populate the input gate; `tick-interval` binds `TAC-2403.interfaces.tickInterval`; `concurrency` binds the transport chunk parallelism on `TAC-2402`; `polling` binds `TAC-2403.interfaces.announcementInterval`; `chunked-transport` selects the transport branch on `TAC-2402`. Per REQ-006 (AC-23106-1 through AC-23108-1).",
+    "verifyVirusScan: call the applied virus-scan verifier as an async predicate over each collected File; on `{clean: false, reason}` route the file to `interfaces.renderRefusal`, ensuring no bytes leave the browser. The blueprint provides the `virusScan` capability that names this verifier hook. Per REQ-007 (AC-23103-1)."
   ],
   "internalStructure": "One input-surface module the shell mounts on route entry. On file addition the module normalises the three input paths (input change, drop event, picker-opener button) into a File[] selection set, tags each entry with a stable [data-file-row] id, runs the accepted-set gates (MIME per ADR-2402, size per ADR-2402) and the virus-scan hook per ADR-2403 before handing the set to the transport TAC. Refusal renders inside the file row with a [data-error-message] element whose id is referenced by the row's aria-describedby attribute; the closed refusal-reason enum {mime-refused, size-refused, virus-refused} rides [data-refusal-reason].",
   "interfaces": [
@@ -43,4 +45,4 @@
   "notes": "See README Known mechanism-reach gaps for the full list.",
   "createdAt": "2026-09-06T16:55:00Z",
   "updatedAt": "2026-09-06T16:55:00Z"
-}
+}

package/blueprints/application-file-upload/contributions/tacs/tac-2402-application-file-upload-transport.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-2402-application-file-upload-transport",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Upload transport contract",
   "purpose": "Owns the wire-level side of the file-upload contract: chunking, resumption, the multipart POST default, the tus.io elicited alternative, the refusal-render seam, and the completion callback. Every AC on REQ-004 that reads the request log anchors on this TAC.",
@@ -30,6 +30,11 @@
       "name": "transportsEnum",
       "kind": "shape",
       "description": "The transport branches are the closed enum {multipart, tus, vendor-sdk}. multipart is the recommended default per ADR-2401."
+    },
+    {
+      "name": "removeFile",
+      "kind": "function",
+      "description": "removeFile(fileId) -> Promise<void>. Issues a DELETE against the applied endpoint on the multipart branch or aborts the tus PATCH session on the tus branch; refuses with REMOVE_FAILED and surfaces the failure through the per-file error region on non-2xx."
     }
   ],
   "dependencies": [
@@ -43,5 +48,5 @@
   "tradeoffs": "Three transport branches keep the shelf usable for teams already committed to a vendor SDK, but the per-branch adapter code is real work; a project that never elicits tus or a vendor SDK ships with the multipart adapter only. Bounded parallelism (default 3) is a heuristic; a slow-link project can lower it via the applied endpoint config. Known mechanism-reach gap: the pack cannot probe a network-interruption resume path on the multipart branch without a request-blocking driver; the fixture simulates the pause via a ?interrupt=1 branch and the pack reads the resulting DOM state.",
   "notes": "See README Known mechanism-reach gaps for the full list.",
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/tacs/tac-2403-application-file-upload-progress-announcer.json

@@ -2,18 +2,18 @@
   "tacId": "TAC-2403-application-file-upload-progress-announcer",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Upload progress announcer",
   "purpose": "Owns the announcement side of the file-upload contract: the polite live-region wrapper the transport ticks, the aggregate-percent calculator, the assertive-slot completion announcement, and the background-tab tick continuity. Every AC on REQ-002 and REQ-005 that reads the aria-live regions anchors on this TAC.",
   "responsibilities": [
     "Mount the polite live-region wrapper at render time so a screen reader adopts it before the first tick (AC-23102-1).",
-    "Emit a polite text tick every 10 percent of aggregate progress in the closed format \"<uploaded> of <total> files, <PP> percent\" (AC-23102-1).",
+    "Emit a polite text tick at the cadence owned by `interfaces.announcementInterval` in the closed format owned by `interfaces.announcementFormatsEnum` (AC-23102-1).",
     "Compute the aggregate percent as the mean weighted by byte size across the active file set (AC-23102-1).",
-    "On completion of the set, mount an assertive-slot announcement (aria-live=\"assertive\" or role=\"status\") with the closed text \"<N> files uploaded successfully\", exactly once per set (AC-23105-1).",
+    "On completion of the set, mount an assertive-slot announcement (aria-live=\"assertive\" or role=\"status\") in the closed format owned by `interfaces.announcementFormatsEnum`, exactly once per set (AC-23105-1).",
     "Continue ticking under document visibilitychange to hidden so a backgrounded tab does not stall the announcement (AC-23107-1)."
   ],
-  "internalStructure": "One announcer module the transport hooks. The module preseeds the polite wrapper (aria-live polite) on mount, reads per-chunk acknowledgements from the transport, updates a per-file percent + aggregate percent record, and pushes a text tick every time the floor(aggregate/10) integer changes. Completion detection is a single flag; the assertive slot is mounted on mount as an empty wrapper and its textContent is set exactly once per set. Background-tab continuity is achieved by using setInterval on the ack polling loop rather than requestAnimationFrame; the interval keeps firing when the tab is hidden. A project that wants to pause on hidden explicitly elicits the alternative.",
+  "internalStructure": "One announcer module the transport hooks. The module preseeds the polite wrapper (aria-live polite) on mount, reads per-chunk acknowledgements from the transport, updates a per-file percent and aggregate percent record, and pushes a text tick at the cadence owned by `interfaces.announcementInterval`. Completion detection is a single flag; the assertive slot is mounted on mount as an empty wrapper and its textContent is set exactly once per set. Background-tab continuity is achieved by using setInterval on the ack polling loop rather than requestAnimationFrame; the interval keeps firing when the tab is hidden. A project that wants to pause on hidden explicitly elicits the alternative.",
   "interfaces": [
     {
       "name": "tick",
@@ -29,6 +29,16 @@
       "name": "announcementFormatsEnum",
       "kind": "shape",
       "description": "The polite format is fixed: /^\\d+ of \\d+ files, \\d{1,3} percent$/; the assertive format is fixed: /^\\d+ files uploaded successfully$/. Localisation is a v1.1.0 minor bump extending the enum with a lookup table."
+    },
+    {
+      "name": "tickInterval",
+      "kind": "shape",
+      "description": "Internal progress polling cadence in milliseconds (default 250). Internal only, not user-observable; drives the byte-progress reader that feeds the announcer."
+    },
+    {
+      "name": "announcementInterval",
+      "kind": "shape",
+      "description": "Announcement cadence in seconds (default 2). Caps the polite live-region announcement frequency the user hears; independent of the internal tickInterval."
     }
   ],
   "dependencies": [
@@ -42,5 +52,5 @@
   "tradeoffs": "One announcer module keeps the aria-live discipline testable but pins the wire format in English at v1.0.0; a localised project elicits the format table in a v1.1.0 minor. Known mechanism-reach gap: the pack asserts the polite wrapper's textContent format but does not additionally probe screen-reader adoption (that requires a real assistive tech in the loop).",
   "notes": "See README Known mechanism-reach gaps for the full list.",
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
-}
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-file-upload/contributions/user-stories/application-file-upload-us-23101.json

@@ -13,7 +13,28 @@
       "id": "AC-23101-1",
       "testable": true,
       "scope": "runtime",
-      "description": "The upload region carries [data-surface=\"file-upload\"] and inside it: a labelled <input type=\"file\"> with a keyboard-reachable label (an id-referenced <label> or an aria-label), a [data-drop-zone] region, and a keyboard-focusable [data-open-picker] button that opens the same picker on Enter or Space. The pack drives the real browser to /upload, asserts the three affordances are present, focuses the [data-open-picker] control and presses Enter, then reads that the file input received focus."
+      "description": "The upload region carries [data-surface=\"file-upload\"] and inside it: a labelled <input type=\"file\"> with a keyboard-reachable label (an id-referenced <label> or an aria-label), a [data-drop-zone] region, and a keyboard-focusable [data-open-picker] button that opens the same picker on Enter or Space. The pack drives the real browser to /upload, asserts the three affordances are present, focuses the [data-open-picker] control and presses Enter, then reads that the file input received focus.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-23101-2",
+      "description": "A file whose MIME type is outside the elicited accepted-set is refused at the input with an inline error naming the mismatch and the accepted set; no request is sent to the transport. Applying agent sets: accepted-set.",
+      "given": "a file whose MIME type is outside the accepted-set",
+      "when": "the principal drops or selects the file",
+      "then": "the input refuses the file inline, an aria-describedby-bound error names the mismatch and the accepted set, and no transport call fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-23101-3",
+      "description": "A file whose size exceeds the elicited size-cap is refused inline with the cap named in bytes and a human-readable form; the input never accepts the file into the drop-zone queue. Applying agent sets: size-cap.",
+      "given": "a file whose size exceeds the elicited size-cap",
+      "when": "the principal drops or selects the file",
+      "then": "the input refuses inline with the cap named and no transport call fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -24,5 +45,5 @@
     "affordance:input-plus-drop-plus-keyboard"
   ],
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/user-stories/application-file-upload-us-23102.json

@@ -4,16 +4,41 @@
   "reqId": "application-file-upload-REQ-002",
   "version": "1.0.0",
   "status": "approved",
-  "title": "The progress announcer emits per-file and aggregate progress through a polite live-region wrapper",
+  "title": "The progress announcer emits per-file and aggregate progress through a polite live-region wrapper at the manifest-owned cadence",
   "asA": "operator watching an upload progress on a screen reader or a low-vision magnifier",
-  "iWant": "a polite live-region tick every 10 percent of aggregate progress that names how many files have completed out of how many",
+  "iWant": "a polite live-region tick at the cadence owned by `TAC-2403.interfaces.announcementInterval` that names how many files have completed out of how many",
   "soThat": "I know the upload is still working without watching the screen and I can tell when it stalls",
   "acceptanceCriteria": [
     {
       "id": "AC-23102-1",
       "testable": true,
       "scope": "runtime",
-      "description": "The upload region ships a [data-live-region=\"polite\"] wrapper with aria-live=\"polite\" preseeded at render time. During an upload the wrapper's textContent matches /^\\d+ of \\d+ files, \\d{1,3} percent$/ and the numeric aggregate percent advances monotonically. Per-file rows carry [data-file-row] with a [data-file-progress] element whose text or aria-valuenow reflects the per-file percent. The pack drives /upload?transport=multipart, starts the upload, and reads the wrapper text plus one per-file progress value before completion."
+      "description": "The upload region ships a [data-live-region=\"polite\"] wrapper with aria-live=\"polite\" preseeded at render time. During an upload the wrapper's textContent matches /^\\d+ of \\d+ files, \\d{1,3} percent$/ and the numeric aggregate percent advances monotonically. Per-file rows carry [data-file-row] with a [data-file-progress] element whose text or aria-valuenow reflects the per-file percent. The pack drives /upload?transport=multipart, starts the upload, and reads the wrapper text plus one per-file progress value before completion.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-23102-2",
+      "description": "Aggregate progress is the byte-weighted sum of per-file progresses: three files of 1 MiB, 2 MiB and 5 MiB produce an aggregate percentage weighted by size, not a plain average of the three per-file percentages.",
+      "given": "three files of unequal size uploading concurrently",
+      "when": "the announcer emits aggregate progress",
+      "then": "the announced aggregate percentage equals the byte-weighted sum of per-file bytes uploaded over total bytes",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-23102-3",
+      "description": "The polite live region emits one aggregate progress announcement per the elicited announcement interval owned by `TAC-2403.interfaces.announcementInterval` and never emits more than once per that interval, so that assistive tech does not receive an announcement flood.",
+      "given": "an in-flight upload and the announcement interval resolved from `TAC-2403.interfaces.announcementInterval`",
+      "when": "ticks fire",
+      "then": "the polite live region carries at most one aggregate announcement per that interval",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2403-application-file-upload-progress-announcer",
+        "field": "interfaces.announcementInterval"
+      }
     }
   ],
   "tacIds": [
@@ -24,5 +49,5 @@
     "affordance:polite-progress"
   ],
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/user-stories/application-file-upload-us-23103.json

@@ -13,7 +13,18 @@
       "id": "AC-23103-1",
       "testable": true,
       "scope": "runtime",
-      "description": "When the fixture is seeded with a refused file (MIME mismatch, size cap exceeded, or virus-scan hit), the file row [data-file-row][data-refused=\"true\"] renders a [data-error-message] element whose id is referenced by the row's aria-describedby attribute, the row exposes the closed refusal reason via [data-refusal-reason] (one of mime-refused, size-refused, virus-refused), a [data-recovery=\"retry\"] control receives keyboard focus, and the pack observes zero POST or PATCH requests carrying the refused filename on the browser's request log."
+      "description": "When the fixture is seeded with a refused file (MIME mismatch, size cap exceeded, or virus-scan hit), the file row [data-file-row][data-refused=\"true\"] renders a [data-error-message] element whose id is referenced by the row's aria-describedby attribute, the row exposes the closed refusal reason via [data-refusal-reason] (one of mime-refused, size-refused, virus-refused), a [data-recovery=\"retry\"] control receives keyboard focus, and the pack observes zero POST or PATCH requests carrying the refused filename on the browser's request log.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-23103-2",
+      "description": "On a per-file transport failure (non-2xx from the transport POST/PATCH), the row renders with data-file-outcome=failed and focus moves to a retry control on the row; a subsequent retry starts from the last acknowledged Upload-Offset on tus.",
+      "given": "a per-file upload that fails on the transport",
+      "when": "the failure is reported",
+      "then": "the row shows data-file-outcome=failed, focus lands on the retry control and retry starts from the last acknowledged offset",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +36,5 @@
     "affordance:refusal"
   ],
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }