rcf-lite 0.26.0 → 0.27.0

package/blueprints/application-error-handling/contributions/user-stories/application-error-handling-us-16101.json

@@ -2,7 +2,7 @@
   "usId": "application-error-handling-US-16101",
   "prdId": "PRD-001",
   "reqId": "application-error-handling-REQ-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "A process-level uncaught exception constructs the record, emits it, and terminates cleanly with exit 1",
   "asA": "operator running the application under a supervising process",
@@ -16,10 +16,69 @@
       "when": "an uncaught exception is thrown from any code path",
       "then": "one log line is emitted at error level with the record shape (code, category unknown, message, correlationId, cause, context), and process.exitCode equals 1",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-16101-2",
+      "description": "Given an unhandled promise rejection fires on the process (a rejected Promise with no `.catch` handler), when the process-level boundary observes the event, then one error record is written under the `unknown` category with the rejection value serialised as its cause, and the process terminates with exit code 1.",
+      "given": "a process with the error-handling boundary armed and a promise rejection with no attached handler",
+      "when": "the unhandledRejection event fires",
+      "then": "one record under category `unknown` is written and the process exits with code 1",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "interfaces[0].name"
+      }
+    },
+    {
+      "id": "AC-16101-3",
+      "description": "Given the process-level boundary is registered and a code path deliberately calls `process.exit(0)` (a clean shutdown from elsewhere in the application), when the process exits, then the boundary does NOT construct a record and does NOT override the exit code to 1; the clean-shutdown path is preserved and only uncaughtException / unhandledRejection paths coerce to exit 1.",
+      "given": "the process-level boundary registered and a code path calling process.exit(0)",
+      "when": "the process exits",
+      "then": "no record is constructed, no exit-code override fires, and the clean-shutdown code 0 is preserved",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "responsibilities[0]"
+      }
+    },
+    {
+      "id": "AC-16101-4",
+      "description": "Given two uncaughtException events fire in quick succession (a rare double-throw during shutdown), when the process-level boundary observes them, then TWO records are constructed and emitted through the logging companion in order (one per event); the process still terminates cleanly with exit 1; no recursive re-entry into the boundary constructs a third record.",
+      "given": "two uncaughtException events firing in quick succession",
+      "when": "the process-level boundary observes them",
+      "then": "two records emit in order through the logging companion, the process exits 1 cleanly, and no re-entry constructs a third record",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "responsibilities[0]"
+      }
+    },
+    {
+      "id": "AC-16101-5",
+      "description": "Given the process-level boundary is registered under a browser runtime (rather than Node), when an equivalent unhandled error fires (`window.error` / `window.unhandledrejection`), the boundary constructs the internal record via TAC-1702 the same way, emits it through the logging companion, and does NOT attempt to call `process.exit` (which does not exist in the browser); the applying project's guide names the browser-runtime path.",
+      "given": "a browser runtime with the boundary registered and an unhandled error firing",
+      "when": "the boundary observes the event",
+      "then": "a record is constructed and emitted; no process.exit call is attempted; the browser-runtime path is honoured",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "responsibilities[0]"
+      }
     }
   ],
-  "tacIds": ["TAC-1701-application-error-handling-boundary"],
+  "tacIds": [
+    "TAC-1701-application-error-handling-boundary"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-error-handling/contributions/user-stories/application-error-handling-us-16102.json

@@ -2,7 +2,7 @@
   "usId": "application-error-handling-US-16102",
   "prdId": "PRD-001",
   "reqId": "application-error-handling-REQ-001",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "status": "approved",
   "title": "A framework-level exception thrown from handler code is caught, mapped to the wire, and never leaks a raw stack trace",
   "asA": "consumer of an application endpoint",
@@ -16,10 +16,55 @@
       "when": "a request hits the handler",
       "then": "the response arrives cleanly with the mapped wire body, and no raw stack trace or internal path appears in the body",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-16102-2",
+      "description": "Given a handler that throws a JavaScript Error with a stack trace containing a filesystem path, when the framework-level boundary catches the exception, then the wire response body carries no stack, no filesystem path substring, and no file:// URL; the response's error envelope is populated only through ADR-1703's transport mapping. The check drives a fixture endpoint that throws a synthetic Error with a stack containing /Users/, /home/ and file:// prefixes and inspects the response body substrings.",
+      "given": "a fixture endpoint whose handler throws an Error carrying a stack with filesystem paths and file:// URLs",
+      "when": "the framework-level boundary catches the exception and writes the wire response",
+      "then": "the response body carries no stack, no /Users/, no /home/ and no file:// substring; only the transport envelope fields populate",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "responsibilities[1]"
+      }
+    },
+    {
+      "id": "AC-16102-3",
+      "description": "Given a handler that throws a plain object literal (not an Error instance) and one that throws a primitive (string, number), when the framework-level boundary catches, then the constructed record's category defaults to `unknown` when no code pattern maps, message defaults to a controlled placeholder (never the raw thrown value), and the wire response follows ADR-1703's transport mapping the same as for an Error. The check drives fixture endpoints that throw `{foo: 1}` and `'string thrown'` and inspects the emitted record and the wire response.",
+      "given": "fixture endpoints that throw non-Error values (a plain object and a bare string)",
+      "when": "the framework-level boundary catches",
+      "then": "the record's category resolves to `unknown` (no code pattern), the message is a controlled placeholder (not the raw thrown value), and the wire response is written via ADR-1703's transport mapping",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1702-application-error-handling-record-factory",
+        "field": "purpose"
+      }
+    },
+    {
+      "id": "AC-16102-4",
+      "description": "Given a handler that throws AFTER the response body has already begun streaming to the client (headers flushed, partial body written), when the framework-level boundary observes the exception, then the connection is closed without attempting to rewrite the wire response, exactly one error record emits through the logging companion at error level naming the streaming-in-progress condition, and the boundary contract records the emitted record with category `unknown` unless the throwing site supplied one.",
+      "given": "a handler that has flushed headers and started streaming when an exception fires",
+      "when": "the framework-level boundary observes the mid-stream exception",
+      "then": "the connection is closed cleanly, one record emits through the logging companion at error level naming the streaming-in-progress condition, and no further bytes are written to the wire",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "responsibilities[1]"
+      }
     }
   ],
-  "tacIds": ["TAC-1701-application-error-handling-boundary"],
+  "tacIds": [
+    "TAC-1701-application-error-handling-boundary"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-error-handling/contributions/user-stories/application-error-handling-us-16103.json

@@ -2,7 +2,7 @@
   "usId": "application-error-handling-US-16103",
   "prdId": "PRD-001",
   "reqId": "application-error-handling-REQ-002",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "The record factory refuses to construct a record without code and category, and preserves the cause chain across nested wrappings",
   "asA": "developer wrapping a low-level exception into a higher-level record",
@@ -16,7 +16,8 @@
       "when": "the factory is called",
       "then": "the factory throws with a message naming the missing field",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-16103-2",
@@ -25,10 +26,55 @@
       "when": "the outermost record is emitted",
       "then": "the emitted JSON carries the full cause chain in the same shape as the top-level record fields, nested under cause",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-16103-3",
+      "description": "Given a call to `createErrorRecord({code, category, cause: <deeply-nested cause 5 levels deep>})`, the returned record's `record.cause.cause.cause.cause.cause` chain is fully traversable and each level preserves its own `code`, `category` and `message`; the factory does NOT truncate the chain at an arbitrary depth (or if it does, the truncation is documented on the factory's contract as a maximum depth constant).",
+      "given": "createErrorRecord called with a 5-level nested cause chain",
+      "when": "the pack traverses the cause chain",
+      "then": "each level preserves its own code, category and message; the chain is either fully traversable or truncation is documented on the factory's contract",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1702-application-error-handling-record-factory",
+        "field": "responsibilities[0]"
+      }
+    },
+    {
+      "id": "AC-16103-4",
+      "description": "Given `createErrorRecord({code, category, cause: <cause carrying its own context field with redactable fields>})`, the redaction pass applies to the cause's `context` at every level of the chain (not only the top-level record); a record whose top-level context is redacted but whose cause.context leaks PII fails the pack check.",
+      "given": "createErrorRecord with a cause carrying its own context with redactable fields",
+      "when": "the pack inspects the returned record's cause chain",
+      "then": "the redaction pass has applied to every level's context; unredacted cause context fails",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1702-application-error-handling-record-factory",
+        "field": "responsibilities[0]"
+      }
+    },
+    {
+      "id": "AC-16103-5",
+      "description": "Given `createErrorRecord({code, category, cause: null})`, the returned record has `record.cause === null` (not undefined, not omitted); a record whose cause is undefined when the caller passed null fails the pack check because it breaks the schema contract on ADR-1701.",
+      "given": "createErrorRecord called with cause explicitly null",
+      "when": "the pack inspects the returned record",
+      "then": "record.cause is exactly null (not undefined, not omitted)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "adrId": "ADR-1701-application-error-handling-record-shape",
+        "field": "decision"
+      }
     }
   ],
-  "tacIds": ["TAC-1702-application-error-handling-record-factory"],
+  "tacIds": [
+    "TAC-1702-application-error-handling-record-factory"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-error-handling/contributions/user-stories/application-error-handling-us-16104.json

@@ -2,7 +2,7 @@
   "usId": "application-error-handling-US-16104",
   "prdId": "PRD-001",
   "reqId": "application-error-handling-REQ-002",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "status": "approved",
   "title": "The record's context field is redacted at record construction, not at emission",
   "asA": "operator concerned about PII in error records",
@@ -16,10 +16,55 @@
       "when": "the factory returns",
       "then": "the returned record's context.email equals [REDACTED:pii.email] and the caller's context object still holds the original value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-16104-2",
+      "description": "Given `createErrorRecord({context: <value>})` called with a context value that is not a plain object (a string, a number, a Date, null), the factory refuses with a controlled error naming the invalid context type; no record is constructed and no partial context leaks. The check enumerates the non-object inputs and inspects the thrown error.",
+      "given": "createErrorRecord called with a context that is not a plain object (string, number, Date, null)",
+      "when": "the factory validates its arguments",
+      "then": "it throws a controlled error naming the invalid context type; no record is constructed and no partial context is returned",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1702-application-error-handling-record-factory",
+        "field": "responsibilities[0]"
+      }
+    },
+    {
+      "id": "AC-16104-3",
+      "description": "Given `createErrorRecord({context: nested})` where `nested` carries redactable fields at depth (`user.email`, `payment.card.pan`, an array containing an object with an `ip`), the returned record has every redactable field replaced by `[REDACTED:<category>]` at every depth including array elements; sibling fields at each depth are untouched. The check builds a nested-and-array-mixed context and walks the returned record asserting the redaction shape.",
+      "given": "a context carrying redactable fields at nested depths and inside arrays",
+      "when": "the factory constructs the record",
+      "then": "every redactable field at every depth (including inside arrays) reads `[REDACTED:<category>]`; sibling fields at each depth remain unchanged and the caller's original context object is not mutated",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1702-application-error-handling-record-factory",
+        "field": "responsibilities[0]"
+      }
+    },
+    {
+      "id": "AC-16104-4",
+      "description": "Given `createErrorRecord({context: circular})` where the context object contains a cyclic reference, the factory returns a record whose context serialises safely (the cycle is broken with a controlled marker such as `[CIRCULAR]`) and the redaction pass still fires on the reachable fields; no stack overflow, no unbounded recursion.",
+      "given": "a context object containing a circular reference",
+      "when": "the factory constructs the record",
+      "then": "the returned record's context serialises without stack overflow, the cycle is broken with a controlled marker, and redaction still applies to the reachable fields",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1702-application-error-handling-record-factory",
+        "field": "responsibilities[0]"
+      }
     }
   ],
-  "tacIds": ["TAC-1702-application-error-handling-record-factory"],
+  "tacIds": [
+    "TAC-1702-application-error-handling-record-factory"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-error-handling/contributions/user-stories/application-error-handling-us-16105.json

@@ -2,7 +2,7 @@
   "usId": "application-error-handling-US-16105",
   "prdId": "PRD-001",
   "reqId": "application-error-handling-REQ-003",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "status": "approved",
   "title": "The record's classification drives the transport response's retry hint",
   "asA": "caller of an application endpoint that failed",
@@ -16,10 +16,55 @@
       "when": "each request runs",
       "then": "the transport response bodies and headers reflect the per-class contract above",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-16105-2",
+      "description": "Given a record with category `permanent`, the transport response the mapper writes carries no Retry-After header and no retry-hint field on the envelope, regardless of whether the origin supplied one; the HTTP status is a non-retryable class (4xx that is not 408 or 429) per ADR-1703. The check drives the mapper with fixture records at each category and inspects the wire response.",
+      "given": "a record with category `permanent`",
+      "when": "the transport response mapper writes the wire response",
+      "then": "no Retry-After header and no retry-hint field appear on the envelope; the HTTP status is a non-retryable class per ADR-1703",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "responsibilities[2]"
+      }
+    },
+    {
+      "id": "AC-16105-3",
+      "description": "Given a record with category `unknown`, the transport response is logged at error level and mapped to a non-retryable wire response identical in classification to `permanent`; no Retry-After hint is emitted even if the origin supplied one on the record (unknown is not a permission to retry). The check inspects the mapped response and the emitted log line's level attribute.",
+      "given": "a record with category `unknown` and an origin-supplied Retry-After hint",
+      "when": "the mapper writes the wire response",
+      "then": "the response is non-retryable (no Retry-After), the log line for the record is level `error`, and the wire status matches the `permanent` mapping per ADR-1703",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "responsibilities[2]"
+      }
+    },
+    {
+      "id": "AC-16105-4",
+      "description": "Given a project that elicited additional categories via the `classification-additions` elicit (for example `rate-limited`, `dependency-degraded`), when a record carries one of those categories, the mapper reads the applied per-class contract (elicited additions apply alongside the ADR-1702 defaults) and writes the retry hint the elicited class contract specifies; an unknown category token that the project never elicited is refused at record construction per REQ-002. Applying agent sets: the elicited additional category tokens and the per-class retry contract.",
+      "given": "a project with elicited additional categories and a record carrying one of them",
+      "when": "the mapper writes the wire response",
+      "then": "the retry hint reflects the elicited per-class contract for that category (applied alongside the ADR-1702 defaults)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "adrId": "ADR-1702-application-error-handling-classification-vocabulary",
+        "field": "decision"
+      }
     }
   ],
-  "tacIds": ["TAC-1701-application-error-handling-boundary"],
+  "tacIds": [
+    "TAC-1701-application-error-handling-boundary"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-error-handling/contributions/user-stories/application-error-handling-us-16106.json

@@ -2,7 +2,7 @@
   "usId": "application-error-handling-US-16106",
   "prdId": "PRD-001",
   "reqId": "application-error-handling-REQ-004",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "status": "approved",
   "title": "Records emit through the logging companion; the fallback stderr path fires only when no companion is applied",
   "asA": "operator debugging why an error record did not appear in the log ingestion pipeline",
@@ -16,10 +16,55 @@
       "when": "an error is emitted from the boundary",
       "then": "the first case emits via the logging companion (nothing on stderr from the boundary itself); the second case emits one JSON line on stderr with the warning",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-16106-2",
+      "description": "Given a project WITHOUT a logging companion applied, when the boundary constructs a record and reaches the emission path, the fallback stderr path writes exactly ONE line of newline-terminated JSON to stderr per record (a single `JSON.stringify(record)` call), and the applying project's guide names the gap as a known state; no double-emission, no console.error mirror, no additional plain-text prefix.",
+      "given": "a project with no logging companion applied and a constructed record",
+      "when": "the boundary emits the record",
+      "then": "exactly one newline-terminated JSON line is written to stderr and no other writer fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "responsibilities[3]"
+      }
+    },
+    {
+      "id": "AC-16106-3",
+      "description": "Given a project WITH a logging companion applied, when a caller elsewhere in the codebase calls `console.error(<message>)` directly (not through the boundary), the boundary contract does NOT intercept or double-emit that call; the direct console.error call remains a documented anti-pattern the applying project's linter or code review catches, not something the boundary silently rewrites.",
+      "given": "a project with a logging companion applied and a direct console.error call in application code (not through the boundary)",
+      "when": "the direct call fires",
+      "then": "the boundary contract does not intercept or route it through the companion; the direct call remains visible for lint or review to catch (per REQ-004's refusal wording)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "responsibilities[3]"
+      }
+    },
+    {
+      "id": "AC-16106-4",
+      "description": "Given a logging companion whose factory `error()` method itself throws (a rare defect in the applied companion), when the boundary attempts to emit, then the boundary catches the companion's failure, falls back to the one-line stderr JSON path for the record AND writes exactly one additional stderr line naming the companion failure so the operator can spot the double outage; the process does not crash on the companion's throw.",
+      "given": "a logging companion applied whose error() method itself throws when called",
+      "when": "the boundary attempts to emit through it",
+      "then": "the boundary catches the throw, emits the record via the fallback stderr JSON path, and writes one additional stderr line naming the companion failure; the process continues",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "responsibilities[3]"
+      }
     }
   ],
-  "tacIds": ["TAC-1701-application-error-handling-boundary"],
+  "tacIds": [
+    "TAC-1701-application-error-handling-boundary"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-error-handling/contributions/user-stories/application-error-handling-us-16107.json

@@ -2,7 +2,7 @@
   "usId": "application-error-handling-US-16107",
   "prdId": "PRD-001",
   "reqId": "application-error-handling-REQ-001",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "status": "approved",
   "title": "The boundary is substitutable via the framework interface so tests exercise it without booting the whole stack",
   "asA": "test author verifying that a specific exception produces the expected record",
@@ -16,10 +16,59 @@
       "when": "the test invokes handle with a synthetic exception",
       "then": "the stub loggerFactory records one error() call with the constructed record and the stub transportWriter records one write with the mapped wire body",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-16107-2",
+      "description": "Given `boundaryFor({ loggerFactory: null, transportWriter: <stub> })` called with a null or undefined loggerFactory, the constructor refuses with a controlled error naming the missing dependency; no partial boundary is returned. Symmetric refusal for `boundaryFor({ loggerFactory: <stub>, transportWriter: null })`. The check enumerates the two null-injection shapes and inspects the thrown error.",
+      "given": "boundaryFor called with a null or undefined loggerFactory or transportWriter",
+      "when": "the constructor validates its arguments",
+      "then": "it throws a controlled error naming the missing dependency; no partial boundary is returned",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "interfaces[0]"
+      }
+    },
+    {
+      "id": "AC-16107-3",
+      "description": "Given a constructed boundary with a stub loggerFactory, when `boundary.handle(err, context)` is called with a synthetic error, then the stub loggerFactory's `error()` receives exactly one call whose first argument is the constructed record (record.code, record.category, record.correlationId present), the stub transportWriter receives exactly one call carrying the same record, and no direct process.stderr.write fires during the call.",
+      "given": "a boundary constructed with stub loggerFactory and transportWriter, invoked on a synthetic error",
+      "when": "handle(err, context) is called",
+      "then": "the stubs each receive exactly one call carrying the constructed record; no process.stderr.write fires during the call",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "interfaces[0]"
+      }
+    },
+    {
+      "id": "AC-16107-4",
+      "description": "Given a constructed boundary, when `boundary.handle(err, context)` is called and the stub transportWriter throws, then the boundary contract catches the transport failure, emits one additional record through the stub loggerFactory naming the transport failure, and does not re-throw; the caller (the framework) sees a clean return.",
+      "given": "a boundary whose stub transportWriter throws when called",
+      "when": "boundary.handle fires",
+      "then": "the boundary catches the transport throw, emits one additional record through the loggerFactory naming the transport failure, and returns cleanly to the caller",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1701-application-error-handling-boundary",
+        "field": "interfaces[0]"
+      }
     }
   ],
-  "tacIds": ["TAC-1701-application-error-handling-boundary"],
+  "tacIds": [
+    "TAC-1701-application-error-handling-boundary"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-file-upload/CHANGELOG.md

@@ -1,9 +1,42 @@
 # application-file-upload CHANGELOG
 
-## 1.0.0 (visual round T-2, spec 2026-09-06)
+## 1.2.0 (2026-09-10)
+
+### Added
+
+- Six elicits (`accepted-set`, `size-cap`, `tick-interval`, `concurrency`, `polling`, `chunked-transport`) declared on blueprint.json; REQ-006 binds one runtime clause per apply-time answer family.
+- `virusScan` declared on `blueprint.json.capabilities` and REQ-007 binds the input TAC's refusal path to the applied verifier.
+- Vendor citations on AC-23104-1, AC-23104-3 and AC-23104-4 (tus.io PATCH); AC-23104-4 names the response header (not body).
+
+### Changed
+
+- REQ-002 drops the "at least every 10 percent" clause and keeps the 2-second announcement cap owned by `TAC-2403.interfaces.announcementInterval` (user-observable); names `TAC-2403.interfaces.tickInterval` (250 ms internal poll, not user-observable); ADR-2402 references both via ownerRef.
+- REQ-002.deliveredBy retargeted to `TAC-2403.interfaces.tick`.
+- REQ-003.deliveredBy retargeted to `TAC-2401.interfaces.renderRefusal`.
+- REQ-004.deliveredBy retargeted to `TAC-2402.interfaces.uploadFile`.
+- `TAC-2402.interfaces.removeFile` declared with DELETE failure semantics; REQ-005 targets it.
+- Probe check AC-23103-1 reworked to positively assert a per-file `[data-refusal-receipt]` keyed by file id; fixture updated to emit the marker alongside `data-file-id`.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 (2026-09-10, hardening pass)
+
+### Added
+
+- Failure-path acceptance criteria on US-23101 (MIME and size cap refusal), US-23102 (byte-weighted aggregate progress, tick-cadence cap), US-23103 (per-file failure with focus on retry), US-23104 (tus prerequisite apply refusal with TUS_PREREQUISITE_MISSING, Upload-Offset semantics on retry, malformed Upload-Offset handling), US-23105 (successful removal with polite announce, failed DELETE with data-remove-outcome=failed, completion-once idempotency), US-23106 (Upload-Offset regression abort with UPLOAD_OFFSET_REGRESSION), US-23107 (prefers-reduced-motion static-text fallback). Closes review findings F-1 and F-2.
+- Vendor citations on the tus.io resumable-upload protocol AC and the WCAG animation-from-interactions AC (verified 2026-09-10).
+
+### Changed
+
+- Every REQ now carries a deliveredBy link into TAC-2401 (input), TAC-2402 (transport) or TAC-2403 (progress-announcer).
+- Every AC on every user story now carries an explicit disposition (fixed or template); ACs that observe removeFile carry ownerRef into TAC-2402.
+
+## 1.0.0 (visual round, spec 2026-09-06)
 
 - First ratified version of the shelf's file-upload blueprint. Five REQs (input contract with a labelled file input plus drop-zone plus keyboard alternative per WCAG 2.5.7, progress contract with per-file percent and aggregate percent and polite live-region tick, refusal contract with MIME and size and virus-scan gates and aria-describedby error binding and focus-to-retry, transport contract chunked-and-resumable with multipart POST default and tus.io elicited alternative, completion contract with assertive-slot success announcement per WCAG 4.1.3 and per-file remove and retry), seven USs 23101-23107 binding one runtime-observable AC per REQ plus two cross-cutting cases (network-interruption resumption AC-23106-1, background-tab progress AC-23107-1), three TACs 2401-2403 (upload input surface, upload transport contract, upload progress announcer), three ADRs 2401-2403 (transport branch with multipart recommendedDefault true and tus and vendor-sdk elicited, accepted MIME set and per-file size cap elicited, virus-scan integration via a capability-plus-elicit). No new global topics.
-- Ships `probe-packs/application-file-upload.pack.mjs`: four surface-observable browser-verify checks anchored one per contract (`AC-23101-1` input surface, `AC-23102-1` progress announcer, `AC-23103-1` refusal contract, `AC-23104-1` chunked transport). Every URL is composed by the `withUrl(runtimeUrl, path)` helper per the round 3 T-3 fix train; no bare string concatenation. The pack-level `appliesTo` predicate references BOTH `tacIds` (TAC-2401) AND `route` (the operator-configured upload path glob).
+- Ships `probe-packs/application-file-upload.pack.mjs`: four surface-observable browser-verify checks anchored one per contract (`AC-23101-1` input surface, `AC-23102-1` progress announcer, `AC-23103-1` refusal contract, `AC-23104-1` chunked transport). Every URL is composed by the `withUrl(runtimeUrl, path)` helper per the round 3 fix train; no bare string concatenation. The pack-level `appliesTo` predicate references BOTH `tacIds` (TAC-2401) AND `route` (the operator-configured upload path glob).
 - Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/` with a Node HTTP server realising both transport branches honestly (`?transport=multipart` default, `?transport=tus` elicited alternative) and break switches (`?break=no-input`, `?break=no-live-region`, `?break=send-refused`, `?break=no-chunks`) driving the negative runs from a single boot. The fixture ships its own README naming PORT, every `?transport=`, every `?seed=`, every `?break=`, the manual boot line and the two-line gate-reviewer boot.
 - Declares `suggestedCompanions` `logging` (every refused upload writes one request-scoped log line with the closed refusal reason and the correlation identifier) and `errorHandling` (refusals and transport-layer failures construct an internal error record through the applied error-handling factory). Does NOT declare `providesRoles` (leaf blueprint per spec; loader refuses an empty `providesRoles` array when set, so the leaf-blueprint intent is expressed by omitting the field). Does NOT declare `capabilities` and does NOT declare `requiresAppliedCapabilities` (no auth required).
-- Seventh shipped consumer of T-0's probe-pack runner extension.
+- Seventh shipped consumer of the earlier release probe-pack runner extension.

package/blueprints/application-file-upload/README.md

@@ -52,7 +52,7 @@ Every file row on the fixture cycles through the closed state set `idle` -> `upl
 
 ## The one runtime gate
 
-`probe-packs/application-file-upload.pack.mjs` ships four checks the `rcf verify browser` runner invokes on any FBS whose surface binds `TAC-2401-application-file-upload-input` or whose nav model routes name an operator-configured upload path. Each check drives the real Playwright browser the runner provisions, reads the accessibility tree and the DOM (and the request log for the refusal check and the tus branch), and returns a verdict. URLs are composed by the `withUrl(runtimeUrl, path)` helper per the round 3 T-3 fix train; no bare string concatenation.
+`probe-packs/application-file-upload.pack.mjs` ships four checks the `rcf verify browser` runner invokes on any FBS whose surface binds `TAC-2401-application-file-upload-input` or whose nav model routes name an operator-configured upload path. Each check drives the real Playwright browser the runner provisions, reads the accessibility tree and the DOM (and the request log for the refusal check and the tus branch), and returns a verdict. URLs are composed by the `withUrl(runtimeUrl, path)` helper per the round 3 fix train; no bare string concatenation.
 
 ## Quality bar