rcf-lite 0.26.0 → 0.27.0

package/blueprints/application-datatable/contributions/user-stories/application-datatable-us-17109.json

@@ -2,7 +2,7 @@
   "usId": "application-datatable-US-17109",
   "prdId": "PRD-001",
   "reqId": "application-datatable-REQ-004",
-  "version": "1.0.0",
+  "version": "1.0.5",
   "status": "approved",
   "title": "Selection persistence across pages holds the elicited contract and announces the running count",
   "asA": "operator selecting rows across several pages before running a bulk action",
@@ -11,12 +11,13 @@
   "acceptanceCriteria": [
     {
       "id": "AC-17109-1",
-      "description": "Given an operator elicited `selectionPersistence=cross-page` (ADR-1804), when the operator selects rows on page 1 and advances to page 2, the previously selected row ids remain in the selection model; a return to page 1 re-renders the checkboxes as checked. The check clicks a row checkbox, advances the page, returns, and asserts the checkbox is still checked.",
+      "description": "Given an operator elicited `selection-persistence=cross-page` on `blueprint.json:elicits[selection-persistence]` (ADR-1804), when the operator selects rows on page 1 and advances to page 2, the previously selected row ids remain in the selection model; a return to page 1 re-renders the checkboxes as checked. The check clicks a row checkbox, advances the page, returns, and asserts the checkbox is still checked. Applying agent sets: the elicited value on `blueprint.json:elicits[selection-persistence]` (`cross-page` here; the corresponding runtime `crossPage` value is fixed on TAC-1803-application-datatable-selection-model.internalStructure) and the pagination control the check advances through.",
       "given": "a rendered datatable with elicited cross-page selection persistence",
       "when": "the operator selects rows on page 1 and paginates away and back",
       "then": "the row checkboxes on page 1 remain in the selected state on return",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-17109-2",
@@ -25,20 +26,68 @@
       "when": "the operator toggles a second row",
       "then": "the accessible selection count updates by one without a full page re-render",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-17109-3",
-      "description": "Given the operator did not elicit cross-page persistence (ADR-1804's non-elicited default), the selection resets on pagination; the surface names this behaviour in the accessible copy near the bulk action control so operators are not surprised on advance.",
+      "description": "Given the operator did not elicit cross-page persistence (ADR-1804's non-elicited default `selection-persistence=per-page`), the selection resets on pagination; the surface names this behaviour in the accessible copy near the bulk action control so operators are not surprised on advance. Applying agent sets: the accessible-copy text near the bulk-action control that names the per-page-only behaviour. The `data-selection-persistence` marker on the bulk-action region is fixed on TAC-1803-application-datatable-selection-model.responsibilities[3] and carries the elicited value from `blueprint.json:elicits[selection-persistence]`.",
       "given": "a rendered datatable without cross-page persistence elicited",
       "when": "the operator selects rows and paginates away",
       "then": "the selection clears on advance and the accessible copy on the bulk-action region names the per-page-only behaviour",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-17109-4",
+      "description": "Given `selectionPersistence=cross-page` and the operator selects rows across pages then activates a bulk action, when the confirmation dialog opens the dialog's `aria-describedby` region names the total selected count (across pages) and the counts per page in a way the operator can verify before confirming; a dialog naming only the current page's count fails the pack check.",
+      "given": "cross-page selection and an operator opening the bulk-action confirmation dialog",
+      "when": "the pack inspects the dialog's aria-describedby content",
+      "then": "the region names the total selected count across pages and per-page counts; a per-page-only count fails",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1803-application-datatable-selection-model",
+        "field": "purpose"
+      }
+    },
+    {
+      "id": "AC-17109-5",
+      "description": "Given `selectionPersistence=cross-page` and the operator selects rows on pages 1 and 2 then filters the visible rows down to a set that excludes some selected rows, when the pack inspects the selection model, the previously selected but now filtered-out row ids remain in the selection model (filter narrows presentation, not selection); the accessible chrome names the retained-but-hidden count so the operator can see the total.",
+      "given": "cross-page selection followed by a filter that hides some selected rows",
+      "when": "the pack inspects the selection model and accessible chrome",
+      "then": "the hidden-but-selected row ids remain in the model and the chrome names the retained-but-hidden count",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1803-application-datatable-selection-model",
+        "field": "purpose"
+      }
+    },
+    {
+      "id": "AC-17109-6",
+      "description": "Given the selection model, when the operator invokes a `Clear selection` control, all selected row ids are removed, the running-count region announces zero, and every selection checkbox on the visible page returns to its unchecked state; the Clear selection control is keyboard-reachable and named `Clear selection` or an equivalent accessible name.",
+      "given": "the operator activating the Clear selection control",
+      "when": "the pack inspects the selection model and the visible checkboxes",
+      "then": "all selected row ids are removed, the running-count region announces zero, visible checkboxes are unchecked, and the control is keyboard-reachable with an accessible name",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1803-application-datatable-selection-model",
+        "field": "purpose"
+      }
     }
   ],
-  "tacIds": ["TAC-1803-application-datatable-selection-model"],
-  "tags": ["blueprint:application-datatable"],
+  "tacIds": [
+    "TAC-1803-application-datatable-selection-model"
+  ],
+  "tags": [
+    "blueprint:application-datatable"
+  ],
   "createdAt": "2026-09-04T19:45:00Z",
-  "updatedAt": "2026-09-04T19:45:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-datatable/docs/topics.md

@@ -7,7 +7,7 @@ The blueprint claims no new global topics at v1.0.0. The datatable shell is a ge
 ## Deliberately unclaimed topics
 
 - `dataGridEngine` (the chosen data-table library). Reserved for the applying project as an elicited choice, not a global topic; a second datatable-shaped blueprint that composes with a specific engine would either supersede this blueprint or share the shell TAC.
-- `columnRegistry` (a shared column vocabulary across surfaces). No blueprint claims it today; a future admin-console blueprint (visual round T-5) may elicit column reuse without minting a global topic.
+- `columnRegistry` (a shared column vocabulary across surfaces). No blueprint claims it today; a future admin-console blueprint (visual round) may elicit column reuse without minting a global topic.
 
 ## Shelf id band and suffix block
 

package/blueprints/application-datatable/guide/application-datatable.md

@@ -12,7 +12,7 @@ A shipped, vendor-neutral datatable contract for a rcf-lite application. One she
 
 ## When to reach for it
 
-- Any surface with tabular data the operator sorts, filters, paginates, or bulk-operates on. Users tables, orders, notifications, records, audit views. The dashboard blueprint (visual round T-3) consumes this shell for its `application-datatable` recent-items strip.
+- Any surface with tabular data the operator sorts, filters, paginates, or bulk-operates on. Users tables, orders, notifications, records, audit views. The dashboard blueprint consumes this shell for its `application-datatable` recent-items strip.
 - Projects that want the ARIA APG discipline (table vs grid per interactivity) enforced at ship without hand-authoring the rule per surface.
 
 ## When it does not fit

package/blueprints/application-empty-error-states/CHANGELOG.md

@@ -1,9 +1,39 @@
 # application-empty-error-states CHANGELOG
 
-## 1.0.0 (visual round T-1, spec 2026-09-06)
+## 1.2.0 (2026-09-10)
+
+### Added
+
+- Elicits `stack-trace-visible` (default `production-hide`) and `offline-strategy` (default `write-buffer`) declared on blueprint.json; REQ-006 binds the three `stack-trace-visible` options and REQ-007 binds the three `offline-strategy` options with a runtime clause per value.
+- Vendor citations on AC-22101-1 (RFC 9110 404), AC-22102-1 (RFC 9110 403) and AC-22103-1 (RFC 9110 500).
+
+### Changed
+
+- REQ-002 widened to the seven-value recovery-shape enum owned by `TAC-2302.notes` (parent-surface, search, request-access, retry, create, clear-filters, no-recovery) via ownerRef.
+- REQ-004.deliveredBy retargeted to `TAC-2301.responsibilities.redactSensitivePatterns` (new responsibility).
+- REQ-005.deliveredBy retargeted to `TAC-2303.interfaces.bufferWrite`.
+- Probe checks AC-22102-1, AC-22103-1, AC-22104-1 and AC-22108-1 reworked to positively assert `data-safe-response` / `data-safe-error` / `data-cause-class` / `data-error-class` markers plus `data-request-id` / `data-correlation-id`; fixture updated to emit the markers.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 (2026-09-10, hardening pass)
+
+### Added
+
+- Failure-path acceptance criteria on US-22102 (failed request-access POST, no per-resource detail), US-22103 (retry failure, no stack trace leak), US-22105 (ordered flush with stable tokens, per-write failure with retry counter and banner, idempotency of retried operations), US-22106 (no-recovery notice for a state without configured recovery), US-22107 (query verbatim rendering, failed clear-filters reload), US-22108 (role=alert, hard-refresh recommendation after 3 recovery retries), US-22101 (gone vs never-existed distinction gated on the applied data provider), US-22104 (class-only naming, no per-resource detail). Closes review findings F-1, F-2 and F-3.
+- Vendor citations on the WCAG status-messages criteria and the ARIA APG alert-pattern criteria (verified 2026-09-10).
+
+### Changed
+
+- Every REQ now carries a deliveredBy link into TAC-2301 (state-machine), TAC-2302 (recovery-router) or TAC-2303 (offline-buffer).
+- Every AC on every user story now carries an explicit disposition (fixed or template).
+
+## 1.0.0 (visual round, spec 2026-09-06)
 
 - First ratified version of the shelf's empty-and-error-states blueprint. Five REQs (state catalogue with eight named states, recovery-action contract, announcement contract with role region and aria-live polite, least-privilege 5xx and 403 posture, offline state with write-buffer and reconnection semantics), eight USs 22101-22108 binding one runtime-observable AC per named state, three TACs 2301-2303 (state-machine, recovery-action router, offline write-buffer), three ADRs 2301-2303 (HTTP status contract per RFC 9110 as recommendedDefault, stack-trace visibility elicited with recommendedDefault true, offline strategy across write-buffer read-only-banner and refuse-writes elicited). No new global topics.
-- Ships `probe-packs/application-empty-error-states.pack.mjs`: eight surface-observable browser-verify checks anchored one per named state (`AC-22101-1` not-found, `AC-22102-1` forbidden, `AC-22103-1` server-error, `AC-22104-1` permission-denied, `AC-22105-1` offline, `AC-22106-1` empty-list, `AC-22107-1` no-search-results, `AC-22108-1` error-boundary). Every URL is composed by the `withUrl(runtimeUrl, path)` helper per the round 3 T-3 fix train; no bare string concatenation. The pack-level `appliesTo` predicate references BOTH `tacIds` (TAC-2301) AND `route` (the operator-configured error-shell path glob).
+- Ships `probe-packs/application-empty-error-states.pack.mjs`: eight surface-observable browser-verify checks anchored one per named state (`AC-22101-1` not-found, `AC-22102-1` forbidden, `AC-22103-1` server-error, `AC-22104-1` permission-denied, `AC-22105-1` offline, `AC-22106-1` empty-list, `AC-22107-1` no-search-results, `AC-22108-1` error-boundary). Every URL is composed by the `withUrl(runtimeUrl, path)` helper per the round 3 fix train; no bare string concatenation. The pack-level `appliesTo` predicate references BOTH `tacIds` (TAC-2301) AND `route` (the operator-configured error-shell path glob).
 - Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/` with a Node HTTP server realising all eight states honestly under `/probe/<name>` and break switches (`?break=stack-trace`, `?break=leak-id`, `?break=no-recovery`, `?break=no-live-region`) driving the negative runs from a single boot. The fixture ships its own README naming PORT, every `?state=`, every `?break=`, the manual boot line and the two-line gate-reviewer boot.
 - Declares `suggestedCompanions` `logging` (every rendered error state writes one request-scoped log line with the correlation identifier) and `errorHandling` (the error-boundary state constructs an internal error record from the caught exception). Does NOT declare `providesRoles` (leaf blueprint per spec; loader refuses an empty `providesRoles` array when set, so the leaf-blueprint intent is expressed by omitting the field). Does NOT declare `capabilities` and does NOT declare `requiresAppliedCapabilities` (no auth required).
-- Sixth shipped consumer of T-0's probe-pack runner extension. T-3 `application-forms-wizard` consumes this blueprint for its "no in-progress forms" empty state; T-4 `application-account-settings` consumes this blueprint for its access-denied and empty-history states.
+- Sixth shipped consumer of the earlier release probe-pack runner extension. `application-forms-wizard` consumes this blueprint for its "no in-progress forms" empty state; `application-account-settings` consumes this blueprint for its access-denied and empty-history states.

package/blueprints/application-empty-error-states/README.md

@@ -53,7 +53,7 @@ The closed set of recovery shapes: `parent-surface`, `search`, `request-access`,
 
 ## The one runtime gate
 
-`probe-packs/application-empty-error-states.pack.mjs` ships eight checks the `rcf verify browser` runner invokes on any FBS whose surface binds `TAC-2301-application-empty-error-states-state-machine` or whose nav model routes name an operator-configured error-shell path. Each check drives the real Playwright browser the runner provisions, reads the accessibility tree and the DOM, and returns a verdict. URLs are composed by the `withUrl(runtimeUrl, path)` helper per the round 3 T-3 fix train; no bare string concatenation.
+`probe-packs/application-empty-error-states.pack.mjs` ships eight checks the `rcf verify browser` runner invokes on any FBS whose surface binds `TAC-2301-application-empty-error-states-state-machine` or whose nav model routes name an operator-configured error-shell path. Each check drives the real Playwright browser the runner provisions, reads the accessibility tree and the DOM, and returns a verdict. URLs are composed by the `withUrl(runtimeUrl, path)` helper per the round 3 fix train; no bare string concatenation.
 
 ## Quality bar
 
@@ -80,8 +80,8 @@ Runtime-observable ACs the pack does NOT bind directly (checklist section 6.g),
 
 ## Consumers
 
-- `application-forms-wizard` (T-3 of this round) consumes the empty-list state as its "no in-progress forms" surface; the wizard's empty branch delegates to this blueprint's TAC-2301 state machine.
-- `application-account-settings` (T-4 of this round) consumes the access-denied path (forbidden and permission-denied) for its scope-gated settings sections and the empty-list state for its empty-history surfaces.
+- `application-forms-wizard` (of this round) consumes the empty-list state as its "no in-progress forms" surface; the wizard's empty branch delegates to this blueprint's TAC-2301 state machine.
+- `application-account-settings` (of this round) consumes the access-denied path (forbidden and permission-denied) for its scope-gated settings sections and the empty-list state for its empty-history surfaces.
 
 ## Composition with application-spa
 

package/blueprints/application-empty-error-states/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-empty-error-states",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "category": "application",
   "suggestedCompanions": [
     {
@@ -38,6 +38,16 @@
       "kind": "req",
       "path": "requirements/application-empty-error-states-req-005.json"
     },
+    {
+      "id": "application-empty-error-states-REQ-006",
+      "kind": "req",
+      "path": "requirements/application-empty-error-states-req-006.json"
+    },
+    {
+      "id": "application-empty-error-states-REQ-007",
+      "kind": "req",
+      "path": "requirements/application-empty-error-states-req-007.json"
+    },
     {
       "id": "application-empty-error-states-US-22101",
       "kind": "us",
@@ -115,5 +125,29 @@
       "elicited": true,
       "standardsTraceClause": "generic enterprise practice"
     }
+  ],
+  "elicits": [
+    {
+      "id": "stack-trace-visible",
+      "prompt": "Server-error stack-trace visibility: production hides stack traces and secrets; staging or local may allow them.",
+      "kind": "enum",
+      "options": [
+        "production-hide",
+        "staging-show",
+        "local-show"
+      ],
+      "default": "production-hide"
+    },
+    {
+      "id": "offline-strategy",
+      "prompt": "Offline strategy when navigator.onLine reports false: write-buffer (queue writes to IndexedDB and flush on reconnection), read-only-banner (render a banner and disable every write control), or refuse-writes (every write attempt fails locally with a clear message).",
+      "kind": "enum",
+      "options": [
+        "write-buffer",
+        "read-only-banner",
+        "refuse-writes"
+      ],
+      "default": "write-buffer"
+    }
   ]
 }

package/blueprints/application-empty-error-states/contributions/requirements/application-empty-error-states-req-001.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "State catalogue: the eight named empty and error states, each with a machine-readable status and a distinct visual",
   "description": "The application realises eight named empty and error states, one contract per state: not-found (HTTP 404 on an unknown resource), forbidden (HTTP 403 on an authenticated principal without scope), server-error (HTTP 5xx on an internal failure), offline (navigator.onLine false), permission-denied (HTTP 403 with a per-resource cause), empty-list (a listing endpoint returned an empty array), no-search-results (a search or filter yielded zero rows), error-boundary (a client-side render exception caught by the SPA boundary). Each state carries a machine-readable status (statusCode for HTTP-triggered states, a well-known token for client-triggered states) and a distinct visual so a screenshot review reader can tell them apart at a glance. Vendor-neutral: the blueprint contributes WHAT surfaces under WHAT condition, not the visual design.",
+  "deliveredBy": {
+    "tacId": "TAC-2301-application-empty-error-states-state-machine",
+    "field": "interfaces.renderState"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-empty-error-states/contributions/requirements/application-empty-error-states-req-002.json

@@ -2,7 +2,11 @@
   "reqId": "application-empty-error-states-REQ-002",
   "prdId": "PRD-001",
   "title": "Recovery-action contract per state: parent-surface link, search entry, request-access flow, retry hook",
-  "description": "Every rendered state carries at least one recovery action. The recovery-action router maps each named state to one of a fixed four action shapes: parent-surface (a link back up the resource hierarchy, used by not-found and empty-list), search (a search entry, used by not-found and no-search-results), request-access (a POST to a well-known request-access endpoint the applied notification centre can surface, used by forbidden and permission-denied), retry (a client-side re-issue of the failed operation, used by server-error and offline). The router refuses to render a state without a recovery action; a state whose applied surface has no legitimate recovery renders an explicit no-recovery notice with the reason.",
+  "description": "Every rendered state carries at least one recovery action. The recovery-action router realises the closed enum owned by `TAC-2302.notes` (`parent-surface`, `search`, `request-access`, `retry`, `create`, `clear-filters`, `no-recovery`): parent-surface anchors a link back up the resource hierarchy (used by not-found and empty-list); search opens a search entry (used by not-found and no-search-results); request-access POSTs to a well-known endpoint the applied notification centre can surface (used by forbidden and permission-denied); retry re-issues the failed operation client-side (used by server-error and offline); create anchors a new-resource affordance (used by empty-list); clear-filters clears the applied filter set (used by no-search-results); no-recovery is an explicit notice the surface authors when no legitimate recovery exists. The router refuses to render a state without a recovery shape from the owned enum.",
+  "deliveredBy": {
+    "tacId": "TAC-2302-application-empty-error-states-recovery-router",
+    "field": "interfaces.renderRecovery"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:application-empty-error-states",
     "category:02-recovery-router"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/contributions/requirements/application-empty-error-states-req-003.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Announcement contract: role region per state, aria-live polite for progress and reconnection, screen-reader traversal order",
   "description": "Every rendered state region carries role=\"region\" with an accessible name naming the state (WCAG 2.4.6 Headings and Labels). Progress announcements (retry attempt, reconnection to server) fire through an aria-live=\"polite\" live-region wrapper (WCAG 4.1.3 Status Messages). Screen-reader traversal order is: state heading first, then the recovery action, then any secondary detail; keyboard focus lands on the recovery control on state entry so a keyboard user reaches recovery in one tab. The error-boundary state announces via role=\"alert\" (assertive) rather than polite because the client render failed and the operator has no context.",
+  "deliveredBy": {
+    "tacId": "TAC-2301-application-empty-error-states-state-machine",
+    "field": "responsibilities.announceState"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-empty-error-states/contributions/requirements/application-empty-error-states-req-004.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Server-error surface: no stack trace in production, no resource-id leak on forbidden per least-privilege posture",
   "description": "The server-error (5xx) state renders in production mode without a stack trace, without a source file path, without any environment-variable key shape (VARNAME=value or process.env.NAME references), and without any framework internal frame prefix. The pack refuses when any word in a bundled sensitive-pattern list matches the rendered surface (path-shape strings, backtrace-frame prefixes, environment-variable key shape). The forbidden (403) and permission-denied (403 with cause) states render without the resource id, without the resource name and without the server-side path so a principal without scope cannot infer resource existence from the error surface. A staging environment override is available via ADR-2302 elicitation.",
+  "deliveredBy": {
+    "tacId": "TAC-2301-application-empty-error-states-state-machine",
+    "field": "responsibilities.redactSensitivePatterns"
+  },
   "category": "security",
   "domain": "application",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:application-empty-error-states",
     "category:04-least-privilege"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/contributions/requirements/application-empty-error-states-req-005.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Offline state: write-buffer contract, navigator.onLine reconnection announcement, per-write reconciliation semantics",
   "description": "When navigator.onLine reports false the offline state renders with a read-only banner naming the offline mode. Queued writes buffer to an applied local buffer (IndexedDB by default, an elicited alternative per ADR-2303) with an idempotency token per write, a serialised payload, and a monotonically increasing sequence. On reconnection (navigator.onLine true) the offline state announces through the polite live-region wrapper the applied notifications-in-app blueprint has preseeded; queued writes flush in sequence, each with the same idempotency token so a server-side dedupe rejects a re-issue. Per-write reconciliation semantics: on flush success the surface clears the buffer entry; on flush failure the entry is retained with a retry counter and the surface renders a per-write error banner.",
+  "deliveredBy": {
+    "tacId": "TAC-2303-application-empty-error-states-offline-buffer",
+    "field": "responsibilities.writeAndFlushReconciliation"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:application-empty-error-states",
     "category:05-offline"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
-}
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-empty-error-states/contributions/requirements/application-empty-error-states-req-006.json

@@ -0,0 +1,21 @@
+{
+  "reqId": "application-empty-error-states-REQ-006",
+  "prdId": "PRD-001",
+  "title": "Stack-trace visibility bound to the stack-trace-visible elicit per option",
+  "description": "The server-error state honours the elicited `blueprint.json.elicits[id=stack-trace-visible]` with a runtime clause per option: when `production-hide` the surface refuses any word matching the sensitive-pattern list (backtrace-frame prefix, source path, environment-variable key shape, framework-internal frame prefix), rendering only a plain summary line and a retry recovery hook; when `staging-show` the surface may include a stack-trace block marked `data-stack-trace=\"staging\"` and the sensitive-pattern refusal narrows to environment-variable keys only; when `local-show` the surface may include full stack traces and source paths under `data-stack-trace=\"local\"` with no pattern refusal. ADR-2302 owns the visibility decision; this REQ binds each option to observable behaviour on the rendered surface.",
+  "deliveredBy": {
+    "tacId": "TAC-2301-application-empty-error-states-state-machine",
+    "field": "responsibilities.stackTraceGate"
+  },
+  "category": "security",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "The elicit offers three visibility levels; each option needs a runtime clause the state machine enforces so a project cannot choose staging-show and inherit local-show behaviour silently.",
+  "tags": [
+    "blueprint:application-empty-error-states"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-empty-error-states/contributions/requirements/application-empty-error-states-req-007.json

@@ -0,0 +1,21 @@
+{
+  "reqId": "application-empty-error-states-REQ-007",
+  "prdId": "PRD-001",
+  "title": "Offline strategy bound to the offline-strategy elicit per option",
+  "description": "The offline state honours the elicited `blueprint.json.elicits[id=offline-strategy]` with a runtime clause per option: when `write-buffer` the surface renders a read-only banner and queues writes to the offline buffer (per REQ-005 and TAC-2303); when `read-only-banner` the surface renders the banner and disables every write control, and no buffer entry is created; when `refuse-writes` every write attempt fails locally with a clear message referencing `OFFLINE_WRITES_REFUSED`, and no buffer entry is created. ADR-2303 owns the strategy decision; this REQ binds each option to observable behaviour on the rendered surface.",
+  "deliveredBy": {
+    "tacId": "TAC-2301-application-empty-error-states-state-machine",
+    "field": "responsibilities.offlineStrategyGate"
+  },
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "The elicit offers three strategies; each option needs a runtime clause the offline buffer or the surface enforces so a project cannot choose refuse-writes and see writes queue silently.",
+  "tags": [
+    "blueprint:application-empty-error-states"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-empty-error-states/contributions/tacs/tac-2301-application-empty-error-states-state-machine.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-2301-application-empty-error-states-state-machine",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Empty and error state machine",
   "purpose": "Owns the mapping from an FBS surface render (a routed page, a listing surface, a search surface, a client-side render) to the eight named empty and error states and from each state to a recovery-action shape. Reads the runtime signals (HTTP status code, response body shape, navigator.onLine, caught render exception) and dispatches the correct state region plus the correct recovery shape. Every AC in this blueprint anchors on this TAC.",
@@ -10,7 +10,10 @@
     "Map HTTP 404 to not-found, 403 to forbidden or permission-denied (see internalStructure), 5xx to server-error, and empty-array response bodies to empty-list or no-search-results (see internalStructure) (AC-22101-1 through AC-22104-1, AC-22106-1, AC-22107-1).",
     "Map navigator.onLine false to offline and the reconnect signal to the polite reconnection announcement (AC-22105-1).",
     "Map a caught client-side render exception to error-boundary announced through role=\"alert\" (AC-22108-1).",
-    "Delegate every recovery action to the recovery-action router (TAC-2302) and every offline buffer operation to the offline-buffer TAC (TAC-2303)."
+    "Delegate every recovery action to the recovery-action router (TAC-2302) and every offline buffer operation to the offline-buffer TAC (TAC-2303).",
+    "redactSensitivePatterns: refuse to render any word matching the sensitive-pattern list (backtrace-frame prefix, source path, environment-variable key shape, framework-internal frame prefix) on the server-error and error-boundary surfaces in production, and any resource-id shape on the forbidden and permission-denied surfaces per least-privilege posture (REQ-004).",
+    "stackTraceGate: gate stack-trace rendering per the elicited stack-trace-visible option (production-hide, staging-show, local-show) per REQ-006.",
+    "offlineStrategyGate: honour `blueprint.json.elicits[id=offline-strategy]` on the offline surface per REQ-007: `write-buffer` renders a read-only banner and delegates writes to TAC-2303.interfaces.bufferWrite; `read-only-banner` renders the banner, disables every write control and creates no buffer entry; `refuse-writes` refuses every write attempt locally with OFFLINE_WRITES_REFUSED and creates no buffer entry."
   ],
   "internalStructure": "One state-machine module the shell mounts on route entry. On response, the machine reads the HTTP status code plus the response body shape: a 403 with a per-resource cause routes to permission-denied, a bare 403 routes to forbidden; a 200 with an empty array on a search endpoint (route carries a q query parameter) routes to no-search-results, a 200 with an empty array on a listing endpoint routes to empty-list. On navigator.onLine transitions the machine dispatches offline entry and reconnection through the polite live-region wrapper. On a caught render exception (the SPA error boundary) the machine dispatches error-boundary through the assertive alert wrapper. Every dispatch writes the state name into the rendered region as an accessible name and delegates the recovery action to the recovery router. The framework is not prescribed; the machines interfaces are what the project realises against React, Vue, Svelte or vanilla DOM.",
   "interfaces": [
@@ -42,5 +45,5 @@
   "tradeoffs": "One state-machine module keeps the mapping deterministic and lint-checkable but ties every state to a runtime signal the project must expose. Projects that route through a framework's own boundary primitive (React error boundary, Vue errorCaptured) wire the machine into that primitive rather than replacing it. Known mechanism-reach gap: the machine cannot prove keyboard focus lands on the recovery control in every framework's rendering; the pack asserts the control is reachable, project-side smoke tests supplement.",
   "notes": "See README Known mechanism-reach gaps for the full list.",
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
-}
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-empty-error-states/contributions/tacs/tac-2303-application-empty-error-states-offline-buffer.json

@@ -10,7 +10,8 @@
     "Persist every buffered write to the applied local buffer (IndexedDB by default per ADR-2303, an elicited alternative for projects that need it) with an idempotency token, serialised payload and sequence (AC-22105-1).",
     "Expose window.__offlineBuffer as a read-only enumeration for the pack and for project-side smoke tests (AC-22105-1).",
     "Announce buffered-write count changes through the polite live-region wrapper on entry and on reconnection (AC-22105-1 via TAC-2301).",
-    "On reconnection, flush the buffer in sequence, retain the entry on flush failure with a retry counter, and clear the entry on flush success."
+    "On reconnection, flush the buffer in sequence, retain the entry on flush failure with a retry counter, and clear the entry on flush success.",
+    "writeAndFlushReconciliation: on write, persist through bufferWrite with idempotency token, serialised payload and monotonic sequence; on reconnection, iterate through flushBuffer, retain entries on flush failure with a retry counter and clear on success, per REQ-005."
   ],
   "internalStructure": "One buffer module the state machine invokes on offline entry and exit. The buffer wraps the applied storage engine (default IndexedDB via a small adapter interface, elicited alternatives per ADR-2303) with a serialise/deserialise pair and a monotonic counter. The reconciliation loop is idempotent: replaying the flush against the same buffer produces the same server-side effect.",
   "interfaces": [
@@ -37,4 +38,4 @@
   "notes": "The buffer is a runtime-observable contract; the pack drives an offline probe with a synthetic write and asserts window.__offlineBuffer is populated.",
   "createdAt": "2026-09-06T15:40:00Z",
   "updatedAt": "2026-09-06T15:40:00Z"
-}
+}

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22101.json

@@ -13,7 +13,22 @@
       "id": "AC-22101-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a 404 response on a route the SPA declares, the not-found state renders inside a role=\"region\" with an accessible name naming the missing resource kind, a keyboard-reachable recovery link to the parent surface with data-recovery=\"parent-surface\", a search entry with data-recovery=\"search\", and the browser tab title matches /^Not found - .+/. The pack drives the real browser to /probe/not-found and reads all four surface tokens."
+      "description": "Given a 404 response on a route the SPA declares, the not-found state renders inside a role=\"region\" with an accessible name naming the missing resource kind, a keyboard-reachable recovery link to the parent surface with data-recovery=\"parent-surface\", a search entry with data-recovery=\"search\", and the browser tab title matches /^Not found - .+/. The pack drives the real browser to /probe/not-found and reads all four surface tokens.",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.rfc-editor.org/rfc/rfc9110#status.404",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-22101-2",
+      "description": "The not-found state distinguishes gone from never-existed only when the applied data blueprint supplies the removal record; otherwise the state renders as not-found with no gone-vs-never inference.",
+      "given": "a not-found state on a resource id",
+      "when": "the surface renders",
+      "then": "when the applied data blueprint supplies a removal record the surface renders the gone variant, otherwise the not-found variant",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +40,5 @@
     "state:not-found"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22102.json

@@ -13,7 +13,36 @@
       "id": "AC-22102-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a 403 response, the forbidden state renders inside role=\"region\" with a keyboard-reachable [data-action=\"request-access\"] control that POSTs to /api/request-access. The rendered surface does NOT contain any word matching the sensitive-pattern list (resource id shape, resource name shape, path-shape strings starting with /). The pack drives /probe/forbidden and reads the region, the control, and the full document text for pattern hits."
+      "description": "Given a 403 response, the forbidden state renders inside role=\"region\" with a keyboard-reachable [data-action=\"request-access\"] control that POSTs to /api/request-access. The rendered surface does NOT contain any word matching the sensitive-pattern list (resource id shape, resource name shape, path-shape strings starting with /). The pack drives /probe/forbidden and reads the region, the control, and the full document text for pattern hits.",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.rfc-editor.org/rfc/rfc9110#status.403",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-22102-2",
+      "description": "When the request-access POST returns a non-2xx or times out, the surface announces the failure via the polite live region, keeps the request-access control keyboard-reachable in a retry-able state (data-state=idle) and never shows a submitted-success state.",
+      "given": "the forbidden state rendered and the request-access endpoint returns a non-2xx or times out",
+      "when": "the principal activates request-access",
+      "then": "the polite live region announces the failure, data-state=idle is restored on the control and no data-state=submitted transition fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#status-messages",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-22102-3",
+      "description": "The forbidden state never renders the resource identifier or any per-resource detail; the heading names the class (\"You do not have access to this resource\") and the explanation names the missing capability class only.",
+      "given": "a forbidden state on any resource id",
+      "when": "the surface renders",
+      "then": "no resource identifier is present in the DOM, only the class name of the resource type and the missing capability class",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +54,5 @@
     "state:forbidden"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22103.json

@@ -13,7 +13,32 @@
       "id": "AC-22103-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a mocked 500 response, the server-error state renders inside role=\"region\" with a keyboard-reachable [data-recovery=\"retry\"] control; the rendered surface does NOT contain any word matching the sensitive-pattern list (backtrace-frame prefix like \"at \" plus function name plus file colon line, a source path starting with / or ./ or ../, an environment-variable key shape NAME= or process.env.NAME, or a framework-internal frame prefix). The pack drives /probe/server-error and greps the document text against the pattern list."
+      "description": "Given a mocked 500 response, the server-error state renders inside role=\"region\" with a keyboard-reachable [data-recovery=\"retry\"] control; the rendered surface does NOT contain any word matching the sensitive-pattern list (backtrace-frame prefix like \"at \" plus function name plus file colon line, a source path starting with / or ./ or ../, an environment-variable key shape NAME= or process.env.NAME, or a framework-internal frame prefix). The pack drives /probe/server-error and greps the document text against the pattern list.",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.rfc-editor.org/rfc/rfc9110#status.500",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-22103-2",
+      "description": "When the retry-recovery action fires and the underlying request fails again, the surface remains on the server-error state, the polite live region announces the retry failure and a further retry stays keyboard-reachable; no success state is transitioned to.",
+      "given": "a server-error state and a retry that returns a non-2xx or times out",
+      "when": "the principal activates retry",
+      "then": "the surface stays on server-error, the polite live region announces retry-failed and the retry control remains keyboard-reachable",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22103-3",
+      "description": "The server-error surface never renders a stack trace, a source path, an environment variable name, or any framework internal frame in the production build (ADR-2302); a break in the fixture that leaks any of the above fails the pack.",
+      "given": "the production build renders the server-error surface",
+      "when": "the DOM is inspected",
+      "then": "no stack trace, source path, environment variable name or backtrace frame is present",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +50,5 @@
     "state:server-error"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22104.json

@@ -13,7 +13,18 @@
       "id": "AC-22104-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a mocked 403 response with a per-resource cause, the permission-denied state renders inside role=\"region\" with a class-level cause string (matches /^[A-Za-z][A-Za-z0-9 ]+$/ with no digits-run of four or more) and a [data-action=\"request-access\"] control. The pack drives /probe/permission-denied, reads the cause string, and refuses when the string contains a resource-id shape (four or more consecutive digits, or a UUID pattern, or a slug-shape id preceded by resource identifiers like \"resource=\" or \"id=\")."
+      "description": "Given a mocked 403 response with a per-resource cause, the permission-denied state renders inside role=\"region\" with a class-level cause string (matches /^[A-Za-z][A-Za-z0-9 ]+$/ with no digits-run of four or more) and a [data-action=\"request-access\"] control. The pack drives /probe/permission-denied, reads the cause string, and refuses when the string contains a resource-id shape (four or more consecutive digits, or a UUID pattern, or a slug-shape id preceded by resource identifiers like \"resource=\" or \"id=\").",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22104-2",
+      "description": "The permission-denied state names the missing scope class (\"You need the admin role\") and never renders the underlying resource identifier; a scope name is a WHOLE role class, never a per-resource permission.",
+      "given": "a permission-denied state on a specific resource",
+      "when": "the surface renders",
+      "then": "the missing scope name is a role class and no resource identifier appears in the DOM",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +36,5 @@
     "state:permission-denied"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }