rcf-lite 0.26.0 → 0.27.0

package/blueprints/application-notifications-in-app/contributions/tacs/tac-2102-application-notifications-in-app-centre.json

@@ -2,17 +2,18 @@
   "tacId": "TAC-2102-application-notifications-in-app-centre",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Notification centre inbox, retention window, acknowledge round-trip and delivery-attempt log",
   "purpose": "Owns the shell's persistent notification-centre inbox: the centre route the applying project mounts (default `/notifications-centre`, elicited), the retention window contract per ADR-2103 (default thirty days, elicited), the per-item acknowledge round-trip that POSTs to the applying project's server and updates the DOM on the response, and the delivery-attempt log write path per REQ-005. The centre is the durable inbox the operator returns to; the toast is the transient surface.",
   "responsibilities": [
-    "Render one notification wrapper per delivery-log row within the ADR-2103 retention window. Every wrapper carries `data-notification-id` (per-element attribute the pack enumerates by, never `role=\"listitem\"` on the container alone per the T-3 gate discipline) (AC-20103-1, AC-20103-2).",
+    "Render one notification wrapper per delivery-log row within the ADR-2103 retention window. Every wrapper carries `data-notification-id` (per-element attribute the pack enumerates by, never `role=\"listitem\"` on the container alone per the gate discipline) (AC-20103-1, AC-20103-2).",
     "Render one keyboard-reachable `[data-action=\"acknowledge\"]` control and one `[data-action=\"mark-read\"]` control per item; render exactly one `[data-action=\"mark-all-read\"]` control on the surface, reachable in Tab order after the item list (AC-20103-1).",
     "On acknowledge activation, POST `POST /api/notifications/acknowledge` with the notification id, wait for the server response, and update `data-acknowledged` on the item to `true` on a 2xx response; a failed response surfaces an error toast via the TAC-2101 factory and the item's `data-acknowledged` remains unchanged (AC-20103-1).",
     "On a page load with a backlog, render every backlog item on the surface without writing any body text into the polite or assertive live-region wrapper (AC-20106-1).",
-    "Expose the delivery-log write factory `writeDeliveryRow` the TAC-2101 toast factory and this TAC's centre factory both call; every write goes through the applied `logging` companion's record factory (AC-20105-2).",
-    "Expose the delivery-log read endpoint `GET /api/delivery-log` returning `{ rows: [...] }` where every row carries `notificationId`, `category`, `priority`, `deliveredAt`, optionally `dismissedAt`, optionally `acknowledgedAt`; rows are append-only (AC-20105-1)."
+    "Expose the delivery-log write factory `interfaces.writeDeliveryRow`, called by both the TAC-2101 toast factory and this TAC's centre factory; every write goes through the applied `logging` companion's record factory (AC-20105-2).",
+    "readDeliveryLog: expose the delivery-log read endpoint `GET /api/delivery-log` returning `{ rows: [...] }` where every row conforms to `interfaces.deliveryRowShape`; rows are append-only, per REQ-005 (AC-20105-1).",
+    "applyElicits: at apply time, dispatch each of the five answer families to its owner: `timeout` sets the toast timeout floor on `ADR-2102`; `retention` sets the notification-centre retention window on this TAC per `ADR-2103`; `categories` populates the per-category preference sections on `TAC-2103`; `route` sets the preferences route this TAC mounts; `page-size` sets the notification-centre page size. Per REQ-006."
   ],
   "internalStructure": "One centre-route module reading the delivery-log endpoint filtered to the retention window and rendering one wrapper per row through a shared item factory. One acknowledge-round-trip helper that owns the POST plus the DOM-update code path. One delivery-log write helper (`writeDeliveryRow`) that adapts the shell-side row shape to the applied `logging` companion's record factory.",
   "interfaces": [
@@ -24,12 +25,17 @@
     {
       "name": "writeDeliveryRow",
       "kind": "factory",
-      "description": "writeDeliveryRow({ notificationId, category, priority, deliveredAt, dismissedAt?, acknowledgedAt? }) -> Promise<void>. Writes one row through the applied `logging` companion's record factory. Called from TAC-2101's toast factory on a toast surface event and from this TAC's centre-item activation on an acknowledge event."
+      "description": "writeDeliveryRow(row) -> Promise<void>. Writes one row through the applied `logging` companion's record factory, where `row` conforms to `interfaces.deliveryRowShape`. Called from TAC-2101's toast factory on a toast surface event and from this TAC's centre-item activation on an acknowledge event."
     },
     {
       "name": "acknowledgeRoundTrip",
       "kind": "function",
       "description": "acknowledgeRoundTrip({ notificationId }) -> Promise<{ ok: boolean }>. POSTs `POST /api/notifications/acknowledge` and returns the parsed server response. A 2xx flips `data-acknowledged` on the item; a non-2xx surfaces an error toast through TAC-2101."
+    },
+    {
+      "name": "deliveryRowShape",
+      "kind": "shape",
+      "description": "Delivery-log row schema owned by TAC-2102: { deliveryTs (ISO-8601 timestamp of the surface event), priority (\"info\" | \"error\"), category (string), outcome (\"delivered\" | \"dismissed\" | \"acknowledged\" | \"expired\"), correlationId (string) }. Every row the toast factory and the centre factory write goes through writeDeliveryRow honouring this shape."
     }
   ],
   "dependencies": [
@@ -46,7 +52,7 @@
     }
   ],
   "tradeoffs": "The centre reading through the delivery log (rather than a separate inbox store) keeps the shell single-sourced on the applied `logging` companion but couples the surface latency to the log query; a project with a very high notification volume may want to project a materialised inbox view alongside the log. This TAC accepts the coupling because it collapses two writers of the same row into one; a project that needs the materialised view supersedes with a project-authored REQ.",
-  "notes": "Known mechanism-reach gap: the pack asserts one acknowledge round-trip on one item (AC-20103-1); the mark-read control, the mark-all-read control and the retention-window boundary (a row on day 31 must not surface) are runtime-observable ACs the shipped pack does not itself drive. The README names them individually per the T-1 gate discipline; a v1.1 minor bump could add checks for each.",
+  "notes": "Known mechanism-reach gap: the pack asserts one acknowledge round-trip on one item (AC-20103-1); the mark-read control, the mark-all-read control and the retention-window boundary (a row on day 31 must not surface) are runtime-observable ACs the shipped pack does not itself drive. The README names them individually per the gate discipline; a v1.1 minor bump could add checks for each.",
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
-}
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-notifications-in-app/contributions/tacs/tac-2103-application-notifications-in-app-preferences.json

@@ -33,8 +33,8 @@
       "description": "A preference update that fails at the server surfaces an error toast through TAC-2101."
     }
   ],
-  "tradeoffs": "Delegating digest opt-in to sibling blueprints keeps this blueprint's contract at the in-app surface (Baz decision 2026-09-04: 'be clear in the name what these ones are'). The trade-off is that on a project without any sibling channel applied the preferences surface renders disabled sibling sections; a first-time reader might expect the preferences UI to be silent about siblings that do not exist. This TAC ships the disabled section on the argument that the reserved family prefix (`application-notifications-`) is discoverable to the operator and the labelled disabled state names the residual honestly.",
-  "notes": "Known mechanism-reach gap: elicitation of the notification categories is a declarative field on the ADR-2101 elicited-parameters block; the runner has no apply-time elicitation phase today (w-2026-09-04-dave-022, built in T-5), so the applying project gathers the categories by hand at the apply pass. The README names this individually.",
+  "tradeoffs": "Delegating digest opt-in to sibling blueprints keeps this blueprint's contract at the in-app surface (per the 2026-09-04 shelf decision to make the transport type explicit in the blueprint name). The trade-off is that on a project without any sibling channel applied the preferences surface renders disabled sibling sections; a first-time reader might expect the preferences UI to be silent about siblings that do not exist. This TAC ships the disabled section on the argument that the reserved family prefix (`application-notifications-`) is discoverable to the operator and the labelled disabled state names the residual honestly.",
+  "notes": "Known mechanism-reach gap: elicitation of the notification categories is a declarative field on the ADR-2101 elicited-parameters block; the runner has no apply-time elicitation phase today (planned for a follow-up minor), so the applying project gathers the categories by hand at the apply pass. The README names this individually.",
   "createdAt": "2026-09-04T23:59:00Z",
   "updatedAt": "2026-09-04T23:59:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20101.json

@@ -16,7 +16,8 @@
       "when": "the initial DOM is read",
       "then": "both preseeded wrappers are present, carry their id attribute, and are empty",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-20101-2",
@@ -25,11 +26,34 @@
       "when": "the factory is invoked at first render and again on a route change",
       "then": "the same two wrapper elements are returned; identity is stable",
       "testable": true,
-      "scope": "library"
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2101-application-notifications-in-app-live-region",
+        "field": "interfaces.renderLiveRegions"
+      }
+    },
+    {
+      "id": "AC-20101-3",
+      "description": "The two live-region wrappers pre-seed at document render, before any state-driven mount, so that an announcement fired during a first render lands in a live region already present. A break that mounts the wrapper on state entry fails the pack.",
+      "given": "a page load on any route",
+      "when": "the DOM is inspected before any state-driven announcement fires",
+      "then": "both polite (aria-live=polite) and assertive (aria-live=assertive) live-region containers are present in the initial DOM",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#status-messages",
+        "verifiedOn": "2026-09-10"
+      }
     }
   ],
-  "tacIds": ["TAC-2101-application-notifications-in-app-live-region"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2101-application-notifications-in-app-live-region"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20102.json

@@ -16,7 +16,8 @@
       "when": "the accessibility tree and the toast timestamps are read",
       "then": "the priority-to-role mapping holds, the announcement is one-shot, and the timeout is at or above the six second floor",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-20102-2",
@@ -25,11 +26,48 @@
       "when": "the factory is invoked at a given priority",
       "then": "the correct wrapper receives the toast",
       "testable": true,
-      "scope": "library"
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2101-application-notifications-in-app-live-region",
+        "field": "interfaces.renderToast"
+      }
+    },
+    {
+      "id": "AC-20102-3",
+      "description": "Apply refuses a toast-timeout-floor answer below 6 seconds with TOAST_TIMEOUT_TOO_SHORT naming the elicited value; a value at or above 6 seconds applies and the polite toast honours it. Vendor citation on WCAG 2.2.1 (https://www.w3.org/TR/WCAG22/#timing-adjustable, verified 2026-09-10).",
+      "given": "a project elicits a toast-timeout-floor below 6 seconds",
+      "when": "apply runs",
+      "then": "apply exits with a non-zero code and TOAST_TIMEOUT_TOO_SHORT names the elicited value; at or above 6 seconds apply succeeds",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#timing-adjustable",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-20102-4",
+      "description": "A transient toast auto-dismisses at the elicited timeout only if the principal has not focused it; a focused toast pauses the timer and resumes only after focus leaves (WCAG 2.2.1 Timing Adjustable, https://www.w3.org/TR/WCAG22/#timing-adjustable, verified 2026-09-10).",
+      "given": "a rendered toast and the principal focuses it via the keyboard",
+      "when": "the elicited timeout elapses",
+      "then": "the toast remains visible until focus leaves; on focus loss the timer resumes",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#timing-adjustable",
+        "verifiedOn": "2026-09-10"
+      }
     }
   ],
-  "tacIds": ["TAC-2101-application-notifications-in-app-live-region"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2101-application-notifications-in-app-live-region"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20103.json

@@ -16,7 +16,8 @@
       "when": "an acknowledge control is activated by keyboard",
       "then": "the acknowledge round-trips to the server and the DOM updates in response",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-20103-2",
@@ -25,11 +26,44 @@
       "when": "the delivery log is read",
       "then": "one wrapper is emitted per row within the retention window",
       "testable": true,
-      "scope": "library"
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2102-application-notifications-in-app-centre",
+        "field": "interfaces.renderCentre"
+      }
+    },
+    {
+      "id": "AC-20103-3",
+      "description": "When the acknowledge round-trip returns a non-2xx or times out, an error toast surfaces via the assertive live region naming the failure, and data-acknowledged on the row remains false (the row is not visually or programmatically marked read).",
+      "given": "a notification row and an acknowledge POST that returns a non-2xx or times out",
+      "when": "the principal activates the acknowledge control",
+      "then": "an error toast appears via role=alert, data-acknowledged=false remains and no polite acknowledgement announcement fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2102-application-notifications-in-app-centre",
+        "field": "interfaces.acknowledgeRoundTrip"
+      }
+    },
+    {
+      "id": "AC-20103-4",
+      "description": "The notification centre inbox lists the last N days of notifications enumerated by data-notification-id and paginates once N exceeds the elicited page-size; a paginated request that fails leaves the currently loaded rows visible and shows an inline retry. Applying agent sets: page-size.",
+      "given": "an inbox whose N exceeds the page-size and a paginated fetch that fails",
+      "when": "the principal scrolls or paginates",
+      "then": "the previously loaded rows remain visible, an inline retry control appears and no rows are removed on the failure",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2102-application-notifications-in-app-centre"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2102-application-notifications-in-app-centre"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20104.json

@@ -16,7 +16,8 @@
       "when": "a silence toggle is activated",
       "then": "the preference is recorded and reflected on the DOM",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-20104-2",
@@ -25,11 +26,36 @@
       "when": "the digest opt-in section is read",
       "then": "the section is disabled and labelled as sibling not applied",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-20104-3",
+      "description": "When the preference write POST returns a non-2xx or times out, an error toast surfaces via the assertive live region, the toggle in the DOM returns to its pre-click state and no false persisted-state is shown.",
+      "given": "a preference toggle change and a write POST that returns a non-2xx or times out",
+      "when": "the principal toggles the preference",
+      "then": "an error toast fires, the toggle rolls back to its pre-click state, and no data-persisted=true is emitted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-20104-4",
+      "description": "On a successful preference write, the polite live region announces the new persisted state and the toggle reflects it. Two rapid clicks are debounced to a single write (idempotency of a retried operation).",
+      "given": "a preference toggle change accepted by the write POST",
+      "when": "the write returns 2xx",
+      "then": "the polite live region announces the new state, data-persisted=true is emitted, and two rapid clicks fire exactly one write",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2103-application-notifications-in-app-preferences"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2103-application-notifications-in-app-preferences"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20105.json

@@ -4,19 +4,24 @@
   "reqId": "application-notifications-in-app-REQ-005",
   "version": "1.0.0",
   "status": "approved",
-  "title": "The delivery-attempt log records one row per surfaced notification with the operator-readable fields for later inspection",
+  "title": "The delivery-attempt log records one row per surfaced notification, in the shape owned by TAC-2102, for later inspection",
   "asA": "operator inspecting the notification behaviour of a shipped rcf-lite application",
-  "iWant": "one row in the delivery-attempt log per notification the shell surfaced, with the priority, the category and the delivery and acknowledgement timestamps",
+  "iWant": "one row in the delivery-attempt log per notification the shell surfaced, in the shape owned by `TAC-2102.interfaces.deliveryRowShape`",
   "soThat": "I can reconcile what the shell said with what my operators saw and acknowledged",
   "acceptanceCriteria": [
     {
       "id": "AC-20105-1",
-      "description": "Given a shipped surface that has surfaced N notifications, `GET /api/delivery-log` returns HTTP 200 with body `{ rows: [...] }` and `rows.length === N`; each row carries `notificationId` (string), `category` (string), `priority` (`\"info\"` or `\"error\"`), `deliveredAt` (ISO-8601 timestamp); a row for a dismissed toast additionally carries `dismissedAt`; a row for an acknowledged centre item additionally carries `acknowledgedAt`. Rows are append-only; a `notificationId` never appears twice on the same page load. The pack does not itself enumerate every row (the delivery log's persistence is delegated to the applied `logging` companion); the AC is a mechanism-reach gap for a v1.1 minor bump when the pack gains a log-shape probe.",
+      "description": "Given a shipped surface that has surfaced N notifications, `GET /api/delivery-log` returns HTTP 200 with body `{ rows: [...] }` and `rows.length === N`; each row honours the shape owned by `TAC-2102.interfaces.deliveryRowShape`. Rows are append-only; the same delivery event never appears twice on the same page load. The pack does not itself enumerate every row (the delivery-log persistence is delegated to the applied `logging` companion); the AC is a mechanism-reach gap for a v1.1 minor bump when the pack gains a log-shape probe.",
       "given": "a shipped surface after N notifications",
       "when": "the delivery-log endpoint is read",
       "then": "N rows with the operator-readable fields are returned",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2102-application-notifications-in-app-centre",
+        "field": "interfaces.deliveryRowShape"
+      }
     },
     {
       "id": "AC-20105-2",
@@ -25,11 +30,48 @@
       "when": "a toast or centre event surfaces a notification",
       "then": "a row lands through the applied logging companion",
       "testable": true,
-      "scope": "library"
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2102-application-notifications-in-app-centre",
+        "field": "interfaces.writeDeliveryRow"
+      }
+    },
+    {
+      "id": "AC-20105-3",
+      "description": "A delivery-attempt log row honours exactly the field set owned by `TAC-2102.interfaces.deliveryRowShape`; a row missing any owner-required field refuses the write with DELIVERY_ROW_INCOMPLETE naming the missing owner-required field (per the owner shape).",
+      "given": "a delivery attempt whose row is missing an owner-required field owned by `TAC-2102.interfaces.deliveryRowShape`",
+      "when": "the row write fires",
+      "then": "the write refuses with DELIVERY_ROW_INCOMPLETE naming the missing owner-required field and no partial row is persisted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2102-application-notifications-in-app-centre",
+        "field": "interfaces.deliveryRowShape"
+      }
+    },
+    {
+      "id": "AC-20105-4",
+      "description": "When no applied blueprint provides the `logging` companion (no writeDeliveryRow factory on the applied set), apply refuses with LOGGING_COMPANION_MISSING naming the required remedy (apply the logging companion so the delivery-log rows can persist); no delivery-log entries are written and the toast and centre factories refuse to construct.",
+      "given": "a project applying application-notifications-in-app with no logging companion applied",
+      "when": "apply runs",
+      "then": "apply exits with a non-zero code and LOGGING_COMPANION_MISSING is emitted naming the remedy (apply the logging companion)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2102-application-notifications-in-app-centre",
+        "field": "interfaces.writeDeliveryRow"
+      }
     }
   ],
-  "tacIds": ["TAC-2102-application-notifications-in-app-centre"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2102-application-notifications-in-app-centre"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20106.json

@@ -16,11 +16,26 @@
       "when": "the initial DOM and the live-region wrappers are read",
       "then": "the backlog is rendered on the surface and neither live-region wrapper carries a load-time announcement",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-20106-2",
+      "description": "When the backlog fetch on page load returns a non-2xx or times out, the inbox renders the last cached rows (if any) with a fetch-failed banner and an inline retry; no rows are shown as read that were not previously acknowledged.",
+      "given": "a page load whose backlog fetch fails",
+      "when": "the inbox route renders",
+      "then": "the last cached rows appear with a fetch-failed banner and inline retry; no false read state is shown",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2102-application-notifications-in-app-centre"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2102-application-notifications-in-app-centre"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20107.json

@@ -16,11 +16,26 @@
       "when": "the toast DOM is read",
       "then": "the priority-to-role mapping and the one-shot announcement match an operator-driven toast",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-20107-2",
+      "description": "A background-driven toast that lacks a priority field or a category outside the elicited enum refuses the toast render with TOAST_PAYLOAD_INVALID naming the missing or invalid field, and never surfaces to the DOM.",
+      "given": "a background event that emits a toast payload with a missing priority or unknown category",
+      "when": "the event fires",
+      "then": "no toast renders, TOAST_PAYLOAD_INVALID names the field and the event is logged",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2101-application-notifications-in-app-live-region"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2101-application-notifications-in-app-live-region"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20108.json

@@ -16,11 +16,26 @@
       "when": "both live-region wrappers are read simultaneously",
       "then": "the body text appears in exactly one wrapper",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-20108-2",
+      "description": "When the priority-to-role contract fires with an invalid priority, the announcement is dropped and a console log records the invalid value; no accidental double-announce lands in the alternate live region as a fallback.",
+      "given": "an announcement carrying a priority outside the closed enum",
+      "when": "the announcement is dispatched",
+      "then": "no live region receives the announcement, the console log records the invalid priority and no fallback double-announce fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2101-application-notifications-in-app-live-region"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2101-application-notifications-in-app-live-region"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/guide/application-notifications-in-app.md

@@ -39,7 +39,7 @@ Every route the applying project ships preseeds both live-region wrappers in the
 - The two live-region wrappers must be preseeded before the first notification. A lazy-mount defect is silent at the DOM (the wrapper appears "eventually") but loses the first announcement at the assistive-technology layer. The pack refuses ship on this shape.
 - The priority-to-role mapping is fixed at v1.0.0 (info to polite/status, error to assertive/alert). A third priority (`warning`) is a v1.1 minor bump because it changes the role vocabulary; free-form priorities are refused at project-side review.
 - The toast timeout floor is a floor, not a ceiling. Six seconds is the default; an operator-elicited value above the floor is honoured (thirty seconds), a value below the floor is refused at apply. The pack measures the actual elapsed time against the shell root's declared floor and against the six-second baseline; both must clear.
-- The centre enumerates items by `data-notification-id`, per the T-3 gate discipline. A centre implementation that uses only `role="listitem"` on the children (without a per-element id attribute) passes the accessibility contract but does not let the pack enumerate individual items reliably; ship both.
+- The centre enumerates items by `data-notification-id`, per the gate discipline. A centre implementation that uses only `role="listitem"` on the children (without a per-element id attribute) passes the accessibility contract but does not let the pack enumerate individual items reliably; ship both.
 - The family-prefix reservation is documented; naming a future notifications blueprint outside the family (`application-alerts-email`) reads against the reservation and stops at author-side review.
 
 ## Cost honesty

package/blueprints/application-notifications-in-app/probe-packs/application-notifications-in-app.pack.mjs

@@ -11,16 +11,16 @@
 //   AC-20103-1 centre acknowledge round-trip (Tab-reachable acknowledge
 //              control POSTs to the server, the server responds, the
 //              DOM updates in response; enumerated by data-notification-id
-//              per the T-3 gate discipline, never by role alone)
+//              per the gate discipline, never by role alone)
 //
-// Every check drives the real Playwright browser the T-0 runner
+// Every check drives the real Playwright browser the runner
 // injects (packages/rcf-lite/src/browser-verify/pack-browser.js) and
 // asserts on the DOM the applying project renders under TAC-2101
 // (live-region wrappers and toast factory), TAC-2102 (centre inbox
 // and acknowledge round-trip) and the priority-to-role mapping per
 // ADR-2101.
 //
-// The pack has no network-interception seam (T-0 shipped none); the
+// The pack has no network-interception seam (shipped none); the
 // acknowledge round-trip is captured through the request log the
 // sample app exposes on window.__notificationFetches and at
 // GET /__requests. The toast timeout is measured with browser.evaluate
@@ -34,7 +34,7 @@ export default {
   blueprintSlug: 'application-notifications-in-app',
   // Applies to any FBS that realises the live-region TAC or whose
   // navModel routes include a notifications-centre path. The source
-  // references BOTH `tacIds` and `route` so the T-0 loader's
+  // references BOTH `tacIds` and `route` so the loader's
   // applicability source-scan sees the two legal seams (route is one
   // of the three legal predicates).
   appliesTo: ({ fbs }) => {

package/blueprints/application-onboarding-tour/CHANGELOG.md

@@ -1,6 +1,37 @@
 # application-onboarding-tour CHANGELOG
 
-## 1.0.0 (visual round T-5, spec 2026-09-06 section 5.5)
+## 1.1.2 (2026-09-10)
+
+### Changed
+
+- AC-26109-1 requires `<details open>` per ADR-2703 and references the ADR via ownerRef.
+- ADR-2702 refusal-only decision: `server-side-per-principal` without an applied persistence blueprint refuses with `COMPLETION_STORE_MISSING_PROVIDER` and never falls back; TAC-2703 aligned.
+- AC-26108-4 references `TAC-2703.interfaces.completionStore` via ownerRef; drops the principalId/tourVersion/dismissedAt restatement.
+- AC-26104-2 names `server-side-per-principal` inline and its refusal `COMPLETION_STORE_MISSING_PROVIDER`.
+- REQ-002.deliveredBy retargeted to `TAC-2701.interfaces.renderTourRunner`.
+- Vendor citations on AC-26101-1 (WCAG keyboard) and AC-26102-1 (ARIA APG dialog-modal); AC-26102-2 URL naming tidied.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 (2026-09-10, hardening pass)
+
+### Added
+
+- REQ-005 (dismissal-policy option coverage) and US-26108: dismiss-permanently, dismiss-until-next-major and dismiss-until-next-minor each carry a runtime clause tied to the completion store record shape. This is the section 7c worked example landed as written. Closes review finding [application-onboarding-tour] F-1.
+- REQ-006 (checklist-anchor option coverage) and US-26109: dashboard-top, settings-page and custom-anchor each mount at a resolved slot with a defined default open state; custom-anchor falls back to the settings route on an unresolved/invisible/clipped selector with data-error=CHECKLIST_ANCHOR_UNRESOLVED. Closes review finding [application-onboarding-tour] F-2.
+- Failure-path acceptance criteria on US-26101 (unresolved and clipped anchors, out-of-range step count), US-26102 (dialog-modal role/aria and focus trap with WCAG citation), US-26103 (settings-route fallback), US-26104 (missing-provider refusal, failed write and failed read on the completion store), US-26105 (unparseable completion record), US-26106 (failed clear on restart), US-26107 (polite live-region close announcement). Closes findings F-3 and F-4.
+- Vendor citations on the ARIA APG dialog-modal, focus-trap and WCAG live-region acceptance criteria (verified 2026-09-10).
+
+### Changed
+
+- Every REQ now carries a deliveredBy link into TAC-2701 (step-runner), TAC-2702 (checklist-slot) or TAC-2703 (completion-store).
+- Every AC on every user story now carries an explicit disposition (fixed or template).
+- TAC-2702 responsibilities extended with resolveAnchor so REQ-006 delivery resolves.
+- Review fix pass (2026-09-10): REQ-001 extended with runtime clauses naming the three string elicits `tour-step-manifest`, `anchor-selectors` and `per-step-content-voice` and their refusal branches; US-26101 gained three template ACs (AC-26101-5, AC-26101-6, AC-26101-7) each carrying an `Applying agent sets: <elicit-id>.` clause; README, guide and CHANGELOG register scrubbed (no work-item ids). Closes review-fix-pass findings F-3, O-4.
+
+## 1.0.0 (visual round, spec 2026-09-06 section 5.5)
 
 - First shipped version. Introduces the tour step runner (ARIA APG dialog-modal per step, focus lifecycle, `role="dialog"`, `aria-labelledby`, `aria-describedby`, keyboard trap inside the tooltip with Escape as the exit, focus-not-obscured at 1440 and 360 breakpoints via `browser.resize`), the checklist slot (dashboard-top open collapse on `application-dashboard` applied; settings-page closed collapse when not; `<details>` browser-native for keyboard-native keyboard behaviour and screen-reader-native semantics), and the completion-state store contract (three backend shapes selected at apply time from the elicited answer or the Q4 fallback `spa-local-storage` when no persistence blueprint is applied).
 - Ships six elicits: `tour-step-manifest`, `anchor-selectors`, `per-step-content-voice` (all project-owned strings the blueprint contributes the WHAT for), `dismissal-policy` (default `dismiss-permanently`), `completion-state-store` (default `spa-local-storage` per Q4), `checklist-anchor` (default derived at apply time from the applied-blueprint set).
@@ -8,5 +39,5 @@
 - Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-onboarding-tour/` realising the tour surface honestly across both checklist branches and multiple completion-store shapes, plus four break switches (`?break=no-role`, `?break=focus-escape`, `?break=no-collapse`, `?break=no-persist`) driving the negative runs.
 - Composes on `application-spa` (routing and iconography), `application-dashboard` (dashboard-top anchor slot; settings-page fallback), `application-notifications-in-app` (polite `aria-live` completion announce), `application-account-settings` (restart-tour control home; any settings-shaped surface as fallback), and any `security-auth-*` blueprint (per-principal completion state; per-browser under a bare namespace as fallback).
 - Q4 default: when no persistence blueprint is applied AND the operator does not answer `completion-state-store`, the store defaults to `spa-local-storage`. Rationale in ADR-2702 and the README's Q4 fallback section.
-- Two documented mechanism-reach gaps: `AC-26105-1` first-run detection is fixture-verified via the manual boot line; `AC-26107-1` screen-reader traversal is asserted at the DOM contract level and verified manually via the fixture READMEs VoiceOver smoke. Runner cleanup rides `w-2026-09-04-dave-020`.
+- Two documented mechanism-reach gaps: `AC-26105-1` first-run detection is fixture-verified via the manual boot line; `AC-26107-1` screen-reader traversal is asserted at the DOM contract level and verified manually via the fixture READMEs VoiceOver smoke.
 - No new global topics claimed. Extends the section 5 shelf id band registry with `application-onboarding-tour` at 26101 to 26899 (US) and 27xx (ADR/TAC).

package/blueprints/application-onboarding-tour/README.md

@@ -8,7 +8,7 @@ Vendor-neutral onboarding-tour surface for an rcf-lite application. Composes on
 rcf define blueprint add <path-to>/blueprints/application-onboarding-tour
 ```
 
-No `requiresAppliedCapabilities`: T-5 has no hard dependency, and the compose targets (SPA, dashboard, notifications-in-app, account-settings, any auth) are all optional. Prompts the elicitation phase for six parameters: the step manifest (3 to 5 steps with per-step anchor and content), the anchor selectors, the per-step content voice, the dismissal policy (default `dismiss-permanently`), the completion-state store shape (default `spa-local-storage`, the Q4 fallback), and the checklist anchor slot (default derived at apply time from what is applied). Writes a sidecar `rcf/blueprints/application-onboarding-tour.applied.json` capturing the answered elicits and the discovered `appliedBlueprints[]` (dashboard, notifications-in-app, account-settings, spa presence). Consumes the `logging` and `errorHandling` companions when they resolve to an applied provider or a registered library.
+No `requiresAppliedCapabilities`: the blueprint has no hard dependency, and the compose targets (SPA, dashboard, notifications-in-app, account-settings, any auth) are all optional. The apply step prompts the elicitation phase for six parameters: the step manifest (3 to 5 steps with per-step anchor and content), the anchor selectors, the per-step content voice, the dismissal policy (default `dismiss-permanently`), the completion-state store shape (default `spa-local-storage`, the Q4 fallback), and the checklist anchor slot (default derived at apply time from what is applied). The apply step writes a sidecar `rcf/blueprints/application-onboarding-tour.applied.json` capturing the answered elicits and the discovered `appliedBlueprints[]` (dashboard, notifications-in-app, account-settings, spa presence). Consumes the `logging` and `errorHandling` companions when they resolve to an applied provider or a registered library.
 
 ## Anatomy
 
@@ -48,7 +48,7 @@ Spec `standardsTrace` empty at the blueprint level; each ADR contribution carrie
 ## Known mechanism-reach gaps
 
 - `AC-26105-1` (first-run detection): the runner cannot fully prove the first-run vs returning-principal branch in one browser session without a persisted state seed; the pack drives the first-run branch via `?first-run=1` and the returning branch is verified by the fixture READMEs manual boot line (walk `/tour` twice, confirm the tour auto-opens on run 1 and does not on run 2).
-- `AC-26107-1` (screen-reader traversal): the pack asserts the DOM contract (`aria-labelledby`, `aria-describedby`) but does not drive a real screen reader in CI. The fixture README names the manual VoiceOver smoke. Runner cleanup rides `w-2026-09-04-dave-020`.
+- `AC-26107-1` (screen-reader traversal): the pack asserts the DOM contract (`aria-labelledby`, `aria-describedby`) but does not drive a real screen reader in CI. The fixture README names the manual VoiceOver smoke. Runner cleanup planned for a follow-up minor.
 - `AC-26106-1` (restart-tour clears state and re-opens): fully exercised inside the AC-26104-1 pack check end-to-end (the check clicks restart, then navigates to `/tour` and asserts the tooltip re-appears).
 
 ## Elicited parameters