rcf-lite 0.26.0 → 0.27.0

package/blueprints/application-file-upload/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-file-upload",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "category": "application",
   "suggestedCompanions": [
     {
@@ -38,6 +38,16 @@
       "kind": "req",
       "path": "requirements/application-file-upload-req-005.json"
     },
+    {
+      "id": "application-file-upload-REQ-006",
+      "kind": "req",
+      "path": "requirements/application-file-upload-req-006.json"
+    },
+    {
+      "id": "application-file-upload-REQ-007",
+      "kind": "req",
+      "path": "requirements/application-file-upload-req-007.json"
+    },
     {
       "id": "application-file-upload-US-23101",
       "kind": "us",
@@ -110,5 +120,50 @@
       "elicited": true,
       "standardsTraceClause": "OWASP ASVS V12 file uploads"
     }
+  ],
+  "elicits": [
+    {
+      "id": "accepted-set",
+      "prompt": "Accepted MIME set: comma-separated IANA media types or wildcards (image/*, application/*).",
+      "kind": "string",
+      "default": "image/*"
+    },
+    {
+      "id": "size-cap",
+      "prompt": "Per-file size cap in bytes.",
+      "kind": "string",
+      "default": "10485760"
+    },
+    {
+      "id": "tick-interval",
+      "prompt": "Internal progress polling cadence in milliseconds (default 250, internal only).",
+      "kind": "string",
+      "default": "250"
+    },
+    {
+      "id": "concurrency",
+      "prompt": "Chunk upload concurrency cap (default 3).",
+      "kind": "string",
+      "default": "3"
+    },
+    {
+      "id": "polling",
+      "prompt": "Announcement cap in seconds for the polite live region (default 2).",
+      "kind": "string",
+      "default": "2"
+    },
+    {
+      "id": "chunked-transport",
+      "prompt": "Chunked-and-resumable transport branch: multipart (default) or tus.",
+      "kind": "enum",
+      "options": [
+        "multipart",
+        "tus"
+      ],
+      "default": "multipart"
+    }
+  ],
+  "capabilities": [
+    "virusScan"
   ]
 }

package/blueprints/application-file-upload/contributions/adrs/adr-2402-application-file-upload-accepted-set.json

@@ -2,11 +2,11 @@
   "adrId": "ADR-2402-application-file-upload-accepted-set",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Accepted MIME set and per-file size cap are elicited per project; no shelf default beyond \"nothing accepted\"",
   "context": "A shelf blueprint cannot know what a downstream project's upload endpoint accepts. A photo-gallery product accepts a narrow image set (jpeg, png, webp) with a 20 MB per-file cap; a document workspace accepts pdf, docx, txt with a 100 MB cap; a code-review product accepts a broad set with a 5 MB cap. Picking a default that fits all projects picks one that fits none. Shipping without any elicited values leaves the input TAC in a state where every file is refused (the safe default), which is the correct floor: a project that forgets to elicit the accepted set discovers this immediately on the first upload.",
-  "decision": "The accepted MIME set and the per-file size cap are elicited per project through this ADR. The blueprint contributes the two parameters as elicits on apply; the input TAC's MIME gate refuses every file until both are elicited. The elicited MIME set is a list of IANA media types; wildcards (image/*, application/*) are permitted for projects that want them but discouraged in the guide. The per-file size cap is a positive integer in bytes. A concurrency cap and the polling interval for the announcer are secondary elicits with recommended defaults (concurrency 3, interval 250 ms).",
+  "decision": "The accepted MIME set and the per-file size cap are elicited per project through this ADR. The blueprint contributes the two parameters as elicits on apply; the input TAC's MIME gate refuses every file until both are elicited. The elicited MIME set is a list of IANA media types; wildcards (image/*, application/*) are permitted for projects that want them but discouraged in the guide. The per-file size cap is a positive integer in bytes. A concurrency cap and the announcer cadences are secondary elicits with recommended defaults owned by `TAC-2403.interfaces.tickInterval` (250 ms internal poll, not user-observable) and `TAC-2403.interfaces.announcementInterval` (2 seconds user-observable announcement cap); concurrency defaults to 3.",
   "consequences": "Projects that apply the blueprint without elicitizing discover the refusal on the first upload attempt and go through the elicit flow to unblock it; the refusal is legible (\"MIME gate has no accepted set\") rather than silently accepting everything. Projects with a mature accepted-set list paste it in once and never revisit. The pack asserts the input TAC refuses an obvious wrong-MIME file (a text/plain payload with a jpeg extension) and refuses a payload exceeding the size cap.",
   "alternativesConsidered": [
     {
@@ -21,5 +21,5 @@
     }
   ],
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-001.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Input contract: a labelled file input plus a drop-zone plus a keyboard alternative per WCAG 2.5.7",
   "description": "The upload surface renders a labelled native file input, a labelled drop-zone region for pointer users, and a keyboard-focusable alternative control that opens the picker on Enter or Space. Every input carries an accessible name via label association or aria-label. The three affordances share the same underlying file collector so a keyboard-only user, a pointer user with drag-drop and a screen-reader user reach the same state. Per WCAG 2.5.7 Dragging Movements, the drop-zone is never the only way to add a file; a click and keyboard path both satisfy the same acceptance criterion.",
+  "deliveredBy": {
+    "tacId": "TAC-2401-application-file-upload-input",
+    "field": "interfaces.collectFiles"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-002.json

@@ -2,7 +2,11 @@
   "reqId": "application-file-upload-REQ-002",
   "prdId": "PRD-001",
   "title": "Progress contract: per-file percent, aggregate percent, and a polite live-region tick",
-  "description": "Every file in the upload set carries a per-file percent that advances monotonically from 0 to 100. The surface also carries an aggregate percent that reflects the mean weighted by byte size. A polite live-region wrapper (aria-live polite) receives a text tick at least every 10 percent of aggregate progress with the string format \"<uploaded> of <total> files, <PP> percent\". The polite wrapper is preseeded at render time so a screen reader adopts it before the first tick fires.",
+  "description": "Every file in the upload set carries a per-file percent that advances monotonically from 0 to 100. The surface also carries an aggregate percent that reflects the mean weighted by byte size. A polite live-region wrapper (aria-live polite) receives a text tick per the elicited announcement cap (default 2 seconds, owned by `TAC-2403.interfaces.announcementInterval`) with the string format \"<uploaded> of <total> files, <PP> percent\". Internal progress polling runs at the internal cadence owned by `TAC-2403.interfaces.tickInterval` (default 250 ms, internal only, not user-observable); the polite wrapper is preseeded at render time so a screen reader adopts it before the first announcement fires.",
+  "deliveredBy": {
+    "tacId": "TAC-2403-application-file-upload-progress-announcer",
+    "field": "interfaces.tick"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:application-file-upload",
     "category:02-progress-contract"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-003.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Refusal contract: MIME-type, size-limit and virus-scan refusals with an aria-describedby error binding and focus-to-retry",
   "description": "The upload surface refuses a file that fails the MIME-type gate, exceeds the per-file size cap, or matches the virus-scan hit. Every refusal renders a per-file error message inside a region bound to the file row via aria-describedby, moves keyboard focus to the row's retry control, and refuses to send the file to the server. The refusal reason is one of the closed strings mime-refused, size-refused, virus-refused so a project's log pipeline can classify without prose parsing.",
+  "deliveredBy": {
+    "tacId": "TAC-2401-application-file-upload-input",
+    "field": "interfaces.renderRefusal"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:application-file-upload",
     "category:03-refusal-contract"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-004.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Transport contract: chunked-and-resumable, multipart POST default, tus.io elicited alternative",
   "description": "The upload transport is chunked-and-resumable: an interrupted upload resumes from the last acknowledged offset on retry, and the client retries on transient failures without re-sending acknowledged bytes. The recommended default is a multipart POST with the file split into fixed-size chunks the server assembles server-side. The tus.io resumable upload protocol 1.0.0 is the elicited alternative for projects with a tus server or the third-party SDK; when applied it exposes an Upload-Offset header per PATCH request and supports server-side pause and resume. A per-vendor SDK (S3 multipart, Cloudflare R2 client-direct) is the second elicited alternative when the project has committed to a vendor library.",
+  "deliveredBy": {
+    "tacId": "TAC-2402-application-file-upload-transport",
+    "field": "interfaces.uploadFile"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:application-file-upload",
     "category:04-transport-contract"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-005.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Completion contract: assertive-slot success announcement per WCAG 4.1.3 plus per-file remove and retry",
   "description": "On successful completion of the upload set, the surface renders an assertive-slot announcement in a wrapper carrying role=status or aria-live=assertive with the string \"<N> files uploaded successfully\", per WCAG 4.1.3 Status Messages. Every completed file row carries a keyboard-reachable remove control (returns the row to the pre-upload state and issues a DELETE against the transport where the transport supports removal) and a retry control (visible only after a refusal or a transport error). The completion announcement fires exactly once per set; a retried refusal that then succeeds increments the completed count but does not re-announce.",
+  "deliveredBy": {
+    "tacId": "TAC-2402-application-file-upload-transport",
+    "field": "interfaces.removeFile"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-006.json

@@ -0,0 +1,21 @@
+{
+  "reqId": "application-file-upload-REQ-006",
+  "prdId": "PRD-001",
+  "title": "Apply-time answer families bind the six elicits to the upload contract",
+  "description": "When the applying project answers the six apply-time elicits, the surface honours each with a runtime clause per family: `blueprint.json.elicits[id=accepted-set]` populates the MIME-type gate; `blueprint.json.elicits[id=size-cap]` populates the per-file byte cap; `blueprint.json.elicits[id=tick-interval]` sets the internal progress polling cadence (owned by `TAC-2403.interfaces.tickInterval`, internal only, not user-observable); `blueprint.json.elicits[id=concurrency]` sets the chunk upload parallelism on the transport TAC; `blueprint.json.elicits[id=polling]` caps the polite live-region announcement cadence (owned by `TAC-2403.interfaces.announcementInterval`); `blueprint.json.elicits[id=chunked-transport]` picks the multipart or tus branch on the transport TAC.",
+  "deliveredBy": {
+    "tacId": "TAC-2401-application-file-upload-input",
+    "field": "responsibilities.applyElicits"
+  },
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "The six apply-time answer families named in the guide and ADR-2402 needed one must REQ per family so a project cannot elicit a value and see it ignored silently.",
+  "tags": [
+    "blueprint:application-file-upload"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-007.json

@@ -0,0 +1,21 @@
+{
+  "reqId": "application-file-upload-REQ-007",
+  "prdId": "PRD-001",
+  "title": "virusScan is declared as an own capability the input TAC calls; the applied verifier is elicited per project",
+  "description": "The blueprint declares `virusScan` in `capabilities` and the input TAC calls the applied verifier as an async predicate over a File that resolves to `{clean: true}` or `{clean: false, reason: <string>}`. A project supplies the verifier (or elicits the noop verifier and accepts the risk per ADR-2403). The refusal path on a virus-scan hit fires on the input TAC and the refused file never leaves the browser.",
+  "deliveredBy": {
+    "tacId": "TAC-2401-application-file-upload-input",
+    "field": "responsibilities.verifyVirusScan"
+  },
+  "category": "security",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "ADR-2403 contributes virusScan but the manifest declared no capability; declaring it as an own capability with a must REQ closes the seam.",
+  "tags": [
+    "blueprint:application-file-upload"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-file-upload/contributions/tacs/tac-2401-application-file-upload-input.json

@@ -11,7 +11,9 @@
     "Render a [data-drop-zone] region that accepts dropped files but is never the only input path (WCAG 2.5.7).",
     "Render a [data-open-picker] button that opens the same picker on Enter or Space (AC-23101-1).",
     "Aggregate the three input paths into one file-selection set the transport TAC drains (AC-23101-1).",
-    "Render a per-file error region with an aria-describedby binding and a [data-recovery=\"retry\"] control on refusal, and hand refused files to the transport TAC's refusal-render seam so no bytes leave the browser (AC-23103-1)."
+    "Render a per-file error region with an aria-describedby binding and a [data-recovery=\"retry\"] control on refusal, and hand refused files to the transport TAC's refusal-render seam so no bytes leave the browser (AC-23103-1).",
+    "applyElicits: at apply time, dispatch each of the six answer families to its owner interface: `accepted-set` and `size-cap` populate the input gate; `tick-interval` binds `TAC-2403.interfaces.tickInterval`; `concurrency` binds the transport chunk parallelism on `TAC-2402`; `polling` binds `TAC-2403.interfaces.announcementInterval`; `chunked-transport` selects the transport branch on `TAC-2402`. Per REQ-006 (AC-23106-1 through AC-23108-1).",
+    "verifyVirusScan: call the applied virus-scan verifier as an async predicate over each collected File; on `{clean: false, reason}` route the file to `interfaces.renderRefusal`, ensuring no bytes leave the browser. The blueprint provides the `virusScan` capability that names this verifier hook. Per REQ-007 (AC-23103-1)."
   ],
   "internalStructure": "One input-surface module the shell mounts on route entry. On file addition the module normalises the three input paths (input change, drop event, picker-opener button) into a File[] selection set, tags each entry with a stable [data-file-row] id, runs the accepted-set gates (MIME per ADR-2402, size per ADR-2402) and the virus-scan hook per ADR-2403 before handing the set to the transport TAC. Refusal renders inside the file row with a [data-error-message] element whose id is referenced by the row's aria-describedby attribute; the closed refusal-reason enum {mime-refused, size-refused, virus-refused} rides [data-refusal-reason].",
   "interfaces": [
@@ -43,4 +45,4 @@
   "notes": "See README Known mechanism-reach gaps for the full list.",
   "createdAt": "2026-09-06T16:55:00Z",
   "updatedAt": "2026-09-06T16:55:00Z"
-}
+}

package/blueprints/application-file-upload/contributions/tacs/tac-2402-application-file-upload-transport.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-2402-application-file-upload-transport",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Upload transport contract",
   "purpose": "Owns the wire-level side of the file-upload contract: chunking, resumption, the multipart POST default, the tus.io elicited alternative, the refusal-render seam, and the completion callback. Every AC on REQ-004 that reads the request log anchors on this TAC.",
@@ -30,6 +30,11 @@
       "name": "transportsEnum",
       "kind": "shape",
       "description": "The transport branches are the closed enum {multipart, tus, vendor-sdk}. multipart is the recommended default per ADR-2401."
+    },
+    {
+      "name": "removeFile",
+      "kind": "function",
+      "description": "removeFile(fileId) -> Promise<void>. Issues a DELETE against the applied endpoint on the multipart branch or aborts the tus PATCH session on the tus branch; refuses with REMOVE_FAILED and surfaces the failure through the per-file error region on non-2xx."
     }
   ],
   "dependencies": [
@@ -43,5 +48,5 @@
   "tradeoffs": "Three transport branches keep the shelf usable for teams already committed to a vendor SDK, but the per-branch adapter code is real work; a project that never elicits tus or a vendor SDK ships with the multipart adapter only. Bounded parallelism (default 3) is a heuristic; a slow-link project can lower it via the applied endpoint config. Known mechanism-reach gap: the pack cannot probe a network-interruption resume path on the multipart branch without a request-blocking driver; the fixture simulates the pause via a ?interrupt=1 branch and the pack reads the resulting DOM state.",
   "notes": "See README Known mechanism-reach gaps for the full list.",
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/tacs/tac-2403-application-file-upload-progress-announcer.json

@@ -2,18 +2,18 @@
   "tacId": "TAC-2403-application-file-upload-progress-announcer",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Upload progress announcer",
   "purpose": "Owns the announcement side of the file-upload contract: the polite live-region wrapper the transport ticks, the aggregate-percent calculator, the assertive-slot completion announcement, and the background-tab tick continuity. Every AC on REQ-002 and REQ-005 that reads the aria-live regions anchors on this TAC.",
   "responsibilities": [
     "Mount the polite live-region wrapper at render time so a screen reader adopts it before the first tick (AC-23102-1).",
-    "Emit a polite text tick every 10 percent of aggregate progress in the closed format \"<uploaded> of <total> files, <PP> percent\" (AC-23102-1).",
+    "Emit a polite text tick at the cadence owned by `interfaces.announcementInterval` in the closed format owned by `interfaces.announcementFormatsEnum` (AC-23102-1).",
     "Compute the aggregate percent as the mean weighted by byte size across the active file set (AC-23102-1).",
-    "On completion of the set, mount an assertive-slot announcement (aria-live=\"assertive\" or role=\"status\") with the closed text \"<N> files uploaded successfully\", exactly once per set (AC-23105-1).",
+    "On completion of the set, mount an assertive-slot announcement (aria-live=\"assertive\" or role=\"status\") in the closed format owned by `interfaces.announcementFormatsEnum`, exactly once per set (AC-23105-1).",
     "Continue ticking under document visibilitychange to hidden so a backgrounded tab does not stall the announcement (AC-23107-1)."
   ],
-  "internalStructure": "One announcer module the transport hooks. The module preseeds the polite wrapper (aria-live polite) on mount, reads per-chunk acknowledgements from the transport, updates a per-file percent + aggregate percent record, and pushes a text tick every time the floor(aggregate/10) integer changes. Completion detection is a single flag; the assertive slot is mounted on mount as an empty wrapper and its textContent is set exactly once per set. Background-tab continuity is achieved by using setInterval on the ack polling loop rather than requestAnimationFrame; the interval keeps firing when the tab is hidden. A project that wants to pause on hidden explicitly elicits the alternative.",
+  "internalStructure": "One announcer module the transport hooks. The module preseeds the polite wrapper (aria-live polite) on mount, reads per-chunk acknowledgements from the transport, updates a per-file percent and aggregate percent record, and pushes a text tick at the cadence owned by `interfaces.announcementInterval`. Completion detection is a single flag; the assertive slot is mounted on mount as an empty wrapper and its textContent is set exactly once per set. Background-tab continuity is achieved by using setInterval on the ack polling loop rather than requestAnimationFrame; the interval keeps firing when the tab is hidden. A project that wants to pause on hidden explicitly elicits the alternative.",
   "interfaces": [
     {
       "name": "tick",
@@ -29,6 +29,16 @@
       "name": "announcementFormatsEnum",
       "kind": "shape",
       "description": "The polite format is fixed: /^\\d+ of \\d+ files, \\d{1,3} percent$/; the assertive format is fixed: /^\\d+ files uploaded successfully$/. Localisation is a v1.1.0 minor bump extending the enum with a lookup table."
+    },
+    {
+      "name": "tickInterval",
+      "kind": "shape",
+      "description": "Internal progress polling cadence in milliseconds (default 250). Internal only, not user-observable; drives the byte-progress reader that feeds the announcer."
+    },
+    {
+      "name": "announcementInterval",
+      "kind": "shape",
+      "description": "Announcement cadence in seconds (default 2). Caps the polite live-region announcement frequency the user hears; independent of the internal tickInterval."
     }
   ],
   "dependencies": [
@@ -42,5 +52,5 @@
   "tradeoffs": "One announcer module keeps the aria-live discipline testable but pins the wire format in English at v1.0.0; a localised project elicits the format table in a v1.1.0 minor. Known mechanism-reach gap: the pack asserts the polite wrapper's textContent format but does not additionally probe screen-reader adoption (that requires a real assistive tech in the loop).",
   "notes": "See README Known mechanism-reach gaps for the full list.",
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
-}
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-file-upload/contributions/user-stories/application-file-upload-us-23101.json

@@ -13,7 +13,28 @@
       "id": "AC-23101-1",
       "testable": true,
       "scope": "runtime",
-      "description": "The upload region carries [data-surface=\"file-upload\"] and inside it: a labelled <input type=\"file\"> with a keyboard-reachable label (an id-referenced <label> or an aria-label), a [data-drop-zone] region, and a keyboard-focusable [data-open-picker] button that opens the same picker on Enter or Space. The pack drives the real browser to /upload, asserts the three affordances are present, focuses the [data-open-picker] control and presses Enter, then reads that the file input received focus."
+      "description": "The upload region carries [data-surface=\"file-upload\"] and inside it: a labelled <input type=\"file\"> with a keyboard-reachable label (an id-referenced <label> or an aria-label), a [data-drop-zone] region, and a keyboard-focusable [data-open-picker] button that opens the same picker on Enter or Space. The pack drives the real browser to /upload, asserts the three affordances are present, focuses the [data-open-picker] control and presses Enter, then reads that the file input received focus.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-23101-2",
+      "description": "A file whose MIME type is outside the elicited accepted-set is refused at the input with an inline error naming the mismatch and the accepted set; no request is sent to the transport. Applying agent sets: accepted-set.",
+      "given": "a file whose MIME type is outside the accepted-set",
+      "when": "the principal drops or selects the file",
+      "then": "the input refuses the file inline, an aria-describedby-bound error names the mismatch and the accepted set, and no transport call fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-23101-3",
+      "description": "A file whose size exceeds the elicited size-cap is refused inline with the cap named in bytes and a human-readable form; the input never accepts the file into the drop-zone queue. Applying agent sets: size-cap.",
+      "given": "a file whose size exceeds the elicited size-cap",
+      "when": "the principal drops or selects the file",
+      "then": "the input refuses inline with the cap named and no transport call fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -24,5 +45,5 @@
     "affordance:input-plus-drop-plus-keyboard"
   ],
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/user-stories/application-file-upload-us-23102.json

@@ -4,16 +4,41 @@
   "reqId": "application-file-upload-REQ-002",
   "version": "1.0.0",
   "status": "approved",
-  "title": "The progress announcer emits per-file and aggregate progress through a polite live-region wrapper",
+  "title": "The progress announcer emits per-file and aggregate progress through a polite live-region wrapper at the manifest-owned cadence",
   "asA": "operator watching an upload progress on a screen reader or a low-vision magnifier",
-  "iWant": "a polite live-region tick every 10 percent of aggregate progress that names how many files have completed out of how many",
+  "iWant": "a polite live-region tick at the cadence owned by `TAC-2403.interfaces.announcementInterval` that names how many files have completed out of how many",
   "soThat": "I know the upload is still working without watching the screen and I can tell when it stalls",
   "acceptanceCriteria": [
     {
       "id": "AC-23102-1",
       "testable": true,
       "scope": "runtime",
-      "description": "The upload region ships a [data-live-region=\"polite\"] wrapper with aria-live=\"polite\" preseeded at render time. During an upload the wrapper's textContent matches /^\\d+ of \\d+ files, \\d{1,3} percent$/ and the numeric aggregate percent advances monotonically. Per-file rows carry [data-file-row] with a [data-file-progress] element whose text or aria-valuenow reflects the per-file percent. The pack drives /upload?transport=multipart, starts the upload, and reads the wrapper text plus one per-file progress value before completion."
+      "description": "The upload region ships a [data-live-region=\"polite\"] wrapper with aria-live=\"polite\" preseeded at render time. During an upload the wrapper's textContent matches /^\\d+ of \\d+ files, \\d{1,3} percent$/ and the numeric aggregate percent advances monotonically. Per-file rows carry [data-file-row] with a [data-file-progress] element whose text or aria-valuenow reflects the per-file percent. The pack drives /upload?transport=multipart, starts the upload, and reads the wrapper text plus one per-file progress value before completion.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-23102-2",
+      "description": "Aggregate progress is the byte-weighted sum of per-file progresses: three files of 1 MiB, 2 MiB and 5 MiB produce an aggregate percentage weighted by size, not a plain average of the three per-file percentages.",
+      "given": "three files of unequal size uploading concurrently",
+      "when": "the announcer emits aggregate progress",
+      "then": "the announced aggregate percentage equals the byte-weighted sum of per-file bytes uploaded over total bytes",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-23102-3",
+      "description": "The polite live region emits one aggregate progress announcement per the elicited announcement interval owned by `TAC-2403.interfaces.announcementInterval` and never emits more than once per that interval, so that assistive tech does not receive an announcement flood.",
+      "given": "an in-flight upload and the announcement interval resolved from `TAC-2403.interfaces.announcementInterval`",
+      "when": "ticks fire",
+      "then": "the polite live region carries at most one aggregate announcement per that interval",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2403-application-file-upload-progress-announcer",
+        "field": "interfaces.announcementInterval"
+      }
     }
   ],
   "tacIds": [
@@ -24,5 +49,5 @@
     "affordance:polite-progress"
   ],
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/user-stories/application-file-upload-us-23103.json

@@ -13,7 +13,18 @@
       "id": "AC-23103-1",
       "testable": true,
       "scope": "runtime",
-      "description": "When the fixture is seeded with a refused file (MIME mismatch, size cap exceeded, or virus-scan hit), the file row [data-file-row][data-refused=\"true\"] renders a [data-error-message] element whose id is referenced by the row's aria-describedby attribute, the row exposes the closed refusal reason via [data-refusal-reason] (one of mime-refused, size-refused, virus-refused), a [data-recovery=\"retry\"] control receives keyboard focus, and the pack observes zero POST or PATCH requests carrying the refused filename on the browser's request log."
+      "description": "When the fixture is seeded with a refused file (MIME mismatch, size cap exceeded, or virus-scan hit), the file row [data-file-row][data-refused=\"true\"] renders a [data-error-message] element whose id is referenced by the row's aria-describedby attribute, the row exposes the closed refusal reason via [data-refusal-reason] (one of mime-refused, size-refused, virus-refused), a [data-recovery=\"retry\"] control receives keyboard focus, and the pack observes zero POST or PATCH requests carrying the refused filename on the browser's request log.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-23103-2",
+      "description": "On a per-file transport failure (non-2xx from the transport POST/PATCH), the row renders with data-file-outcome=failed and focus moves to a retry control on the row; a subsequent retry starts from the last acknowledged Upload-Offset on tus.",
+      "given": "a per-file upload that fails on the transport",
+      "when": "the failure is reported",
+      "then": "the row shows data-file-outcome=failed, focus lands on the retry control and retry starts from the last acknowledged offset",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +36,5 @@
     "affordance:refusal"
   ],
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/user-stories/application-file-upload-us-23104.json

@@ -13,7 +13,50 @@
       "id": "AC-23104-1",
       "testable": true,
       "scope": "runtime",
-      "description": "On the ?transport=multipart branch the fixture returns 200 with a completed chunk count higher than 1 on a file large enough to force chunking; the DOM exposes [data-transport=\"multipart\"] and [data-chunks-uploaded] whose numeric value equals the completed chunk count. On the ?transport=tus branch the pack observes at least one PATCH request on the browser's network log whose request headers include Upload-Offset with a numeric value, and the DOM exposes [data-transport=\"tus\"] with [data-chunks-uploaded] > 1."
+      "description": "On the ?transport=multipart branch the fixture returns 200 with a completed chunk count higher than 1 on a file large enough to force chunking; the DOM exposes [data-transport=\"multipart\"] and [data-chunks-uploaded] whose numeric value equals the completed chunk count. On the ?transport=tus branch the pack observes at least one PATCH request on the browser's network log whose request headers include Upload-Offset with a numeric value, and the DOM exposes [data-transport=\"tus\"] with [data-chunks-uploaded] > 1.",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://tus.io/protocols/resumable-upload#patch",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-23104-2",
+      "description": "When the transport is tus.io and no tus server or client library prerequisite is available at apply time, apply refuses with TUS_PREREQUISITE_MISSING naming the missing side (server or client) and the remedy to install it; no upload code is written to the project until the prerequisite is present.",
+      "given": "tus transport elicited without the tus server or client dependency installed",
+      "when": "apply runs",
+      "then": "apply exits with a non-zero code, TUS_PREREQUISITE_MISSING names the missing side and the remedy, and no transport code is added",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-23104-3",
+      "description": "Upload-Offset on the tus branch matches the byte offset the server has durably acknowledged; a chunk write that returns a non-2xx does not advance Upload-Offset and a subsequent PATCH resumes from the last acknowledged offset.",
+      "given": "a tus upload with a chunk that returns a non-2xx",
+      "when": "the client inspects Upload-Offset and retries",
+      "then": "Upload-Offset reflects the last acknowledged offset only, and the resume PATCH sends bytes from that offset onward",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://tus.io/protocols/resumable-upload#patch",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-23104-4",
+      "description": "A chunk write whose response headers do not include a valid Upload-Offset header (missing, malformed, or beyond the total) is treated as a transport failure: the client refuses to advance and the polite live region announces the failure.",
+      "given": "a chunk response with a malformed or missing Upload-Offset",
+      "when": "the client processes the response",
+      "then": "the client does not advance its offset, the polite live region announces the failure and a retry stays keyboard-reachable",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://tus.io/protocols/resumable-upload#patch",
+        "verifiedOn": "2026-09-10"
+      }
     }
   ],
   "tacIds": [
@@ -24,5 +67,5 @@
     "affordance:chunked-resumable"
   ],
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/user-stories/application-file-upload-us-23105.json

@@ -13,7 +13,42 @@
       "id": "AC-23105-1",
       "testable": true,
       "scope": "runtime",
-      "description": "After the fixture completes the upload set the upload region carries a [data-assertive-slot] element with aria-live=\"assertive\" or role=\"status\" whose textContent matches /^\\d+ files uploaded successfully$/, each completed file row carries [data-file-row][data-file-state=\"complete\"], a keyboard-reachable [data-recovery=\"remove\"] button per row and, after a refused-then-succeeded row, a [data-recovery=\"retry\"] button visible only until the retry succeeds."
+      "description": "After the fixture completes the upload set the upload region carries a [data-assertive-slot] element with aria-live=\"assertive\" or role=\"status\" whose textContent matches /^\\d+ files uploaded successfully$/, each completed file row carries [data-file-row][data-file-state=\"complete\"], a keyboard-reachable [data-recovery=\"remove\"] button per row and, after a refused-then-succeeded row, a [data-recovery=\"retry\"] button visible only until the retry succeeds.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-23105-2",
+      "description": "On successful removal (the transport DELETE returns 204 or a defined 200), the upload surface removes the row, announces the removal via the polite live region and no upload artefact remains referenced in the applied data blueprint.",
+      "given": "a completed upload row and a successful DELETE",
+      "when": "the principal activates remove",
+      "then": "the row is removed from the DOM, a polite announcement fires and the applied data blueprint no longer references the artefact",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-23105-3",
+      "description": "When the transport DELETE returns a non-2xx or times out, the row remains with data-remove-outcome=failed, the assertive live region announces the failure, no recovery artefact is deleted downstream, and a retry stays keyboard-reachable.",
+      "given": "a completed upload row and a DELETE that returns a non-2xx or times out",
+      "when": "the principal activates remove",
+      "then": "the row remains with data-remove-outcome=failed, the assertive live region announces the failure and a retry is keyboard-reachable",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2402-application-file-upload-transport",
+        "field": "interfaces.removeFile"
+      }
+    },
+    {
+      "id": "AC-23105-4",
+      "description": "The completion once contract: a single upload emits exactly one completion announcement even under a retry; two rapid completions from the same upload id emit one announcement (idempotency of a retried operation).",
+      "given": "an upload that emits two completion events for the same upload id",
+      "when": "the completions are dispatched",
+      "then": "exactly one completion announcement fires and no duplicate data-complete=true is emitted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +60,5 @@
     "affordance:completion"
   ],
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-file-upload/contributions/user-stories/application-file-upload-us-23106.json

@@ -13,7 +13,18 @@
       "id": "AC-23106-1",
       "testable": true,
       "scope": "runtime",
-      "description": "On the ?interrupt=1 branch of the fixture the upload pauses after the first acknowledged chunk, the DOM exposes [data-file-state=\"paused\"] and [data-chunks-uploaded] with a numeric value greater than zero on the paused row, and after the fixture resumes with ?resume=1 the row transitions to [data-file-state=\"complete\"] with the accumulated [data-chunks-uploaded] equal to the total chunk count. The pack asserts no chunk index is re-uploaded (the fixture records the received offsets on the row and never repeats one)."
+      "description": "On the ?interrupt=1 branch of the fixture the upload pauses after the first acknowledged chunk, the DOM exposes [data-file-state=\"paused\"] and [data-chunks-uploaded] with a numeric value greater than zero on the paused row, and after the fixture resumes with ?resume=1 the row transitions to [data-file-state=\"complete\"] with the accumulated [data-chunks-uploaded] equal to the total chunk count. The pack asserts no chunk index is re-uploaded (the fixture records the received offsets on the row and never repeats one).",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-23106-2",
+      "description": "When the resume PATCH lands but the server responds with an Upload-Offset less than the client-known offset (a lost server-side state), the client aborts the upload with UPLOAD_OFFSET_REGRESSION rather than replaying bytes; the row remains with a defined failure and a manual retry option.",
+      "given": "a resume attempt where the server returns a lower Upload-Offset than the client tracked",
+      "when": "the client processes the response",
+      "then": "the upload aborts with UPLOAD_OFFSET_REGRESSION, the row shows the defined failure and a manual retry is offered",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -24,5 +35,5 @@
     "affordance:resumption"
   ],
   "createdAt": "2026-09-06T16:55:00Z",
-  "updatedAt": "2026-09-06T16:55:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }