rcf-lite 0.26.0 → 0.28.0

package/CHANGELOG.md

@@ -6,6 +6,49 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.28.0] - 2026-09-17
+
+rcf-lite 0.28.0 lands two referee-facing trains together. The `rcf feedback` verb family lets an agent record what a blueprint or rcf-lite did that contradicts its own docs, fails, or forces a workaround, redact it to the eight rules of the design plus a whole-body residual scan, and, after one operator yes at a natural pause, file each finding as a GitHub issue under the operator's own `gh` login (or a pastable outbox bundle on the fallback path). The referee-guarantees train tightens the three sentences the docs page makes about `rcf define validate`, `rcf audit coverage` and `rcf build finalise`: validate now walks ADR `supersededBy`, coverage is strict-by-default with `--mode shallow-any` as the deliberate opt-out, and finalise refuses on the three per-AC verdicts (UI-BASELINE-UNMET, BROWSER-VERIFICATION-MISSING, SCOPE-MISMATCH), gates the manual `verified` override behind `--acknowledge-verified-override`, and adds a merge-state precondition with `--allow-pre-merge` as the deliberate pre-merge dry-run opt-out. `rcf init` now merges three hook entries into `.claude/settings.json` and `.codex/hooks.json` so the feedback ask fires once per session at idle; RULE 17 lands in the managed instructions block as the belt-and-braces path. Coverage-strict-by-default is the single migration surface: downstream projects that ran plain `rcf audit coverage` and treated its exit code as passing will see the same tree exit 4; the fix is either to close the coverage gap or to run `rcf audit coverage --mode shallow-any` when the intent is a printed gap report.
+
+### Fixed
+
+- **Referee-guarantee train: schema pin bumped to `@stravica-ai/rcf-schemas` `0.6.3` and the two schema-skipped workarounds removed (closes C-33 and C-38).** `packages/rcf-lite/package.json` pins `0.6.3` (adds the optional `shipWithoutEval[]` carrier on the manifest and the optional `applicable` boolean on `browserVerificationProbePackCheck`). `src/finalise/ship-without-eval.js:writeShipWithoutEvalRecord` now validates the composed manifest through `validateDocument` before the atomic write, mirroring the sister `ship-without-verified` writer; the "write path skips the validator" comment and the follow-up delta block are gone. `src/browser-verify/pack-runner.js` emits `{ id, applicable: false, detail }` (no `verdict`, no `severity`) when a check's own `appliesTo` predicate returns false, instead of the compatibility-carry `verdict: 'skipped'`; the aggregate verdict already ignored applicable-false packs and non-`fail` check verdicts, so the record shape now matches the docs promise without changing gate semantics. Test evidence: `test/browser-verify/pack-runner.test.js` gains the check-level applicable=false shape assertion; the existing `finalise --ship-without-eval` integration test in `test/cli/finalise-eval-refusal.test.js` continues to pass with the manifest now validated on write. All twelve referee-guarantees docs claims on the referee-guarantees page are now true against the shipped tree. Chain: work item w-2026-09-17-dave-009.
+
+- **`rcf feedback defer` now means "not now, ask again next session" (C-39).** The 0.28.0 build shipped a `handleDefer` that stamped every pending entry with `status: deferredUntilSession` and a `sessionId`, but no lifecycle path ever returned a deferred entry to `pending`, so the `Stop` and `SessionStart` hooks filtered it out for the life of the store: defer behaved like a permanent opt-out and only `discard` or `opt-out` were reversible. Both hooks now call a shared `requeueDeferredForSession` helper that appends one `{ status: pending }` state-transition line for every `deferredUntilSession` entry whose stored `sessionId` differs from the incoming one, with no `sessionId` field on the transition so fold-by-id preserves the entry's prior session and the `anyCarriedOver` gate in both hooks fires naturally in the new session. The requeue runs on `session-start` (the primary path) AND on `stop` (belt to the SessionStart hook's braces, so a project that only wired Stop still gets the ask), is idempotent per session (a repeat in the same incoming session is a no-op), and preserves `recordedAt` and `askNow` untouched. `packages/rcf-lite/docs/feedback.md` updated with the ruling. Chain: US-16103 gains AC-16103-3 (design 3.1 / 3.5); TS-197 gains three test cases; CN-600 picks up the new AC; FBS-184 the same. No behaviour change for entries that were never deferred.
+
+### Added
+
+- **`rcf feedback`: end-to-end feedback submission for blueprints and rcf-lite itself (PR #221).** New core verb family that lets an agent record what a blueprint or rcf-lite did that contradicts its own docs, fails, or forces a workaround, and, after one operator yes at a natural pause, files each finding as a GitHub issue under the operator's own `gh` login: `Stravica/rcf-lite` for core and shelf blueprints, the library's own repo for library blueprints. The store is gitignored (raw entries can carry paths, hostnames and secret-looking strings the redactor strips on submit); the render path runs the eight redaction rules of design section 5 plus a whole-body residual scan and refuses to ship anything that still carries a shape the rules exist to strip; dedupe folds ten users' reports of the same defect into one issue with nine +1 comments through a fingerprint over kind / target / anchor / symptom class; the fallback path (no `gh`, no login, no access, issues disabled) writes a pastable bundle under `.rcf/feedback/outbox/` and prints the repo `issues/new` URL. `rcf init` merges three hook entries into `.claude/settings.json` and `.codex/hooks.json` (Stop, SessionEnd, SessionStart) so the ask fires once per session at idle, and `rcf doctor --check feedback-hooks` keeps them honest across clones. RULE 17 lands in the managed instructions block so an agent on a harness that has not trusted the hooks still follows the shape. Never handles a token, never calls an LLM, never submits without an explicit yes. Design of record: `projects/rcf-lite-wsd/specs/2026-09-16-feedback-submission-design.md`. Chain: REQ-155 to REQ-162, FBS-180 to FBS-185. Full user docs: `packages/rcf-lite/docs/feedback.md`.
+- **`rcf feedback`: R4 separator shapes (fix round 5, design amendment R4).** The redaction pass now folds a vocabulary key labelling a value-shape token (8+ chars, at least two character classes among upper / lower / digit / symbol) via any non-`:=` separator: markdown table pipes (`| password | Sup3rSecretV@lue!! |`), whitespace runs, tabs, hyphens (including em-dash after dash normalisation), arrows, HTML numeric entities (`pass=SuperSecretValue1234`, `pass=...`) and the prose bridges `is` / `was` / `set to`. Runs after the primary rule-5 loop so `key=value` and `Authorization:` shapes keep their canonical ledger names; the residual safeguard runs the same scan under `kv-secret-r4` so a shape the first-pass missed refuses submit fail-closed. False positives are visible in the ledger; the mixed-classes gate keeps ordinary prose (`the password is required`, `the password field is required`) intact. Docs also clarify that `authorization` is deliberately excluded from `SECRET_KEY_VOCABULARY` (the line-anchored header rule folds the whole header line instead), and that the vocabulary is English-only (a non-English key on a short value should be hand-redacted before submit; a 32+ char value still folds via the entropy-blob backstop). Closes the HQ re-gate note's F-05 (P1), F-07 (P2, HTML entity separator closed as a side effect of R4) and F-11 (P3, docs prose fix); documents F-06 (P2, non-English keys) and F-08/F-09/F-10 (P3, acceptable as-is per design). Chain: AC-15601-1 updated with R4 fixture cases; TS-188 gains TC-188-r4-separator-probes, TC-188-r4-residual-safeguard and TC-188-r4-overredaction-guard on test/cli/feedback-fix-round-5.test.js.
+
+### Changed
+
+- **Referee-guarantee train: `rcf build finalise` refuses UI-BASELINE-UNMET / BROWSER-VERIFICATION-MISSING / SCOPE-MISMATCH, gates the manual `verified` override, and refuses off a default trunk (REQ-165 / US-16501, US-16502).** Closes referee-guarantees docs claims C-22, C-26, C-28, C-29, C-30 and C-36. **Finalise per-AC refusals (C-28, C-29, C-30, C-36):** three refusal branches added to `src/cli/finalise.js` after the existing MOCK-ONLY / EVAL branches, in the order UI-BASELINE-UNMET, BROWSER-VERIFICATION-MISSING, SCOPE-MISMATCH. Each reads `report.perAcVerdicts[]` and refuses promotion (exit 4) when the verdict is present; the stderr message names the AC(s), the count, and the referee-guarantees claim ids. The three new ingest helpers (`findUiBaselineUnmetAcs`, `findBrowserVerificationMissingAcs`, plus the existing `findScopeMismatchAcs`) are re-exported through `src/finalise/index.js`. A block-severity probe-pack failure aggregates into UI-BASELINE-UNMET, so the same branch closes both C-28 and C-36. No `--ship-without-*` opt-out is added for these three: the docs page names none, and the failure classes (broken baseline, missing browser check, scope-mismatched TC) are the shape the referee is chartered to refuse; the fix is on the tree. **Manual verified-override gate (C-22):** the writer refuses `FBS.executionStatus=verified` unless the caller passes `options.allowVerifiedOverride: true`. `rcf define update` exposes `--acknowledge-verified-override` as the deliberate manual escape (a logged operator decision that skips the post-merge runtime check); `rcf build finalise`'s own updateDocument call passes the flag through so the finalise happy path is unchanged. **Merge-state precondition (C-26):** finalise spawns `git rev-parse --abbrev-ref HEAD` just before the executionStatus write and refuses promotion (exit 4) when the branch is not one of `{main, master}`. `--allow-pre-merge` is the deliberate pre-merge dry-run opt-out; the decision is logged on stdout so the operator sees it. Absent a git checkout the check degrades to a warn line rather than a hard fail. Chain: REQ-165, US-16501 (AC-16501-1 UI-BASELINE-UNMET, AC-16501-2 BROWSER-VERIFICATION-MISSING, AC-16501-3 SCOPE-MISMATCH), US-16502 (AC-16502-1 writer refusal, AC-16502-2 writer opt-out seam, AC-16502-3 merge-state), TAC-4111, TAC-4112, ADR-4111, ADR-4112, TS-202, TS-203. **C-33 and C-38 closed by the rcf-schemas 0.6.3 pin bump follow-up in the Fixed section above:** the manifest write in `src/finalise/ship-without-eval.js` now validates through the schema, and `src/browser-verify/pack-runner.js` emits the check-level `applicable: false` shape 0.6.3 accepts.
+
+- **Referee-guarantee train: `rcf audit coverage` is strict-by-default (REQ-164 / US-16401).** The 0.27.0 default is shallow-any and strict is opt-in via `--strict`, so the referee-guarantees docs page's "a stub or stale pointer fails the gate exactly as a missing test does when the displayed command (`rcf audit coverage`) is run" is false against the shipped default. This release flips the default to strict: plain `rcf audit coverage` runs per-AC strict and exits 4 on any gap. The explicit opt-out is `--mode shallow-any` (prints gaps, exits 0) for author-time exploration on a not-yet-shippable chain. The legacy `--strict` flag is a no-op alias for the new default, so every existing invocation stays green: the repo's own CI, every shipped blueprint's `rcf audit coverage --strict` gate (delivery-ci-workflows ADR-702), the getting-started walkthrough, and downstream projects' pipelines. `--mode shallow-any --strict` (or the inverse) is a usage refusal (exit 2) so a scripted invocation cannot silently disagree with itself; `--mode <unknown>` is likewise exit 2. **Migration:** downstream projects that ran the plain `rcf audit coverage` and treated its exit code as passing will see the same tree exit 4; the fix is either to close the coverage gap or to run `rcf audit coverage --mode shallow-any` when the intent is a printed gap report rather than a gate. The repo's own CI dogfood step in `.github/workflows/ci.yml` is updated to the shipped default. Chain: REQ-164, US-16401 (AC-16401-1 strict-by-default, AC-16401-2 shallow-any opt-out, AC-16401-3 conflict refusal), TAC-4110, ADR-4110, TS-201. Closes referee-guarantees docs claims C-11 and C-14 (audit at `reviews/2026-09-15-docs-claims-audit/how-it-works__what-the-referee-guarantees.json`). C-20 (the rcf-lite project's CI runs both ordinary coverage and EVAL coverage in strict mode) is closed alongside: the CI workflow now runs `rcf audit eval coverage --strict` after the coverage step, so the referee-page CI sentence holds by inspection.
+
+- **Referee-guarantee train: `rcf define validate` walks ADR supersededBy; relatedAdrs stays a schemas follow-up (REQ-163 / US-16301, compatibility carry).** The 0.27.0 walker's referential-integrity pass checks parent-id fields and FBS / TS / EVAL / CN cross-links but skips the two ADR-schema-declared reference fields, `supersededBy` (single ADR id) and `relatedAdrs` (array of ADR ids). That leaves an honest gap against the referee-guarantees docs promise that every reference in every document resolves: an ADR whose supersededBy names a stem with no file on disk passes validate. `collectBrokenReferences` now walks `supersededBy` under the same `check` helper as every other cross-link, reusing the existing `brokenReference` error shape (`documentId`, `filePath`, `field`, `rule: 'resolveTo:adr'`). `supersededBy` is optional, so an absent or empty field stays silent; a present target must resolve to a loaded ADR of the expected kind. **Compatibility carry (escalation clause on this dispatch):** `relatedAdrs` is intentionally NOT walked. `rcf define blueprint supersede` writes a project ruling ADR whose relatedAdrs lists BOTH the applied blueprint ADR (present on disk) AND the incoming blueprint ADR (not yet on disk: the incoming add is the closing step of the option-3 workflow the conflict message prints). Walking relatedAdrs would refuse that ratified workflow between the supersede write and the re-add. Tightening the soft back-reference is a schemas follow-up (value-narrow to already-applied ADR ids, or a workflow-aware exception on the supersede write path). Chain: REQ-163, US-16301 (AC-16301-1 supersededBy walked, AC-16301-2 relatedAdrs stays silent), TAC-4109, ADR-4109, TS-200. Partial-closes referee-guarantees docs claim C-7 (the strong reference half; the soft-reference half tracked as a schemas follow-up).
+
+## [0.27.0] - 2026-09-11
+
+rcf-lite 0.27.0 is a shelf-wide hardening release. Every shipped blueprint has been re-verified against the 2026-09-08 authoring criteria: every requirement is backed at the REQ layer, every user story carries a sufficient acceptance-criteria set with disposition and owner references, and chain-consistency lint reports zero on every slug. Shipped prose is now customer-facing throughout: internal workflow labels, operator names, work-item and dispatch identifiers, and long dashes are gone. CI adds a hard register-scan gate and flips the chain-consistency lint gate to hard mode over the monorepo-root shelf. One CLI reliability fix lands alongside: the `rcf audit view` SIGINT handler is now installed before the readiness line is written, closing a race with Node's default signal disposition. Nothing here is breaking.
+
+### Fixed
+
+- **`rcf audit view` SIGINT handler race (PR #192).** `src/cli/view.js:main` installed the `SIGINT` and `SIGTERM` handlers AFTER writing the `rcf audit view server listening at ...` line, so a caller that keyed on the readiness line and immediately sent `SIGINT` could deliver the signal in the window between the stdout flush and `process.on('SIGINT', ...)` calling into `sigaction`, and the child would be killed by Node's default disposition instead of running its own clean-shutdown path. The `rcf view SIGINT triggers a clean shutdown within the 2s budget` test intermittently failed on CI with `expected a self-directed exit, got killed by SIGINT`. Handlers are now installed before the readiness write; the ordering is a documented contract with a deterministic in-process regression test (`SIGINT/SIGTERM handlers before writing the "listening at" line`) that drives `viewMain` with an injected `onSignal` and asserts install-order against stdout-write-order.
+
+### Changed
+
+- **Shelf-wide hardening pass, criteria a, b and c (PRs #185, #186, #187, #188, #189, #190, #191).** Seven family passes bring every shipped blueprint on the root shelf to the 2026-09-08 authoring criteria: criterion a (every requirement is backed at the REQ layer with a `deliveredBy` reference to a delivering TAC or ADR), criterion b (every user story carries a sufficient acceptance-criteria set, each row marked `fixed` or `template` per section 7b with an `ownerRef` where a TAC contract is observed), and criterion c (chain-consistency lint reports zero on pass 1 and pass 2 for every slug with no suppressions). Coverage across the families: observability, delivery and email (5 slugs, PR #185); edge (4 slugs, PR #186); platform (4 slugs, PR #187); security (5 slugs, PR #188); application core (6 slugs, PR #189); persistence, deploy, messaging, jobs and object storage (8 slugs, PR #190); application tail (7 slugs, PR #191). Each family closes the chain-contradiction specimens named in its brief and moves the shelf-wide unsuppressed-finding total towards zero.
+- **Shelf-wide register sweep and hard-mode lint gates (PR #193).** Every shipped blueprint under `blueprints/` is swept for customer-facing register: internal operator names, work-item and dispatch identifiers, host names, hardening and train labels, and long dashes are removed from shipped prose. The register scan is zero on all 39 slugs including their CHANGELOG entries. `packages/rcf-lite/scripts/run-register-scan.mjs` lands as a Node scanner and is wired into `.github/workflows/ci.yml` as a hard step above the consistency lint, which now runs in hard mode over the monorepo-root shelf (`RCF_LINT_SHELF: root`, `RCF_LINT_MODE: hard`) and reports zero unsuppressed findings on both passes. 38 blueprints take a register patch bump with the note "Register: neutral wording in shipped prose (no capability change)"; the affected anatomy tests and cross-blueprint version pins move in step.
+- **Criterion-f P0 and P1 closure across the shelf (PRs #196, #194, #197, #195).** Four waves close every P0 and P1 criterion-f finding recorded against the shelf in the 2026-09-10 adversarial review. Wave 1 closes seven P0 and eight P1 findings on the security family (PR #196: `security-auth-keycloak`, `security-auth-clerk`, `security-auth-oauth2`, `security-auth-magic-link`, `security-secrets-management`). Wave 2 closes four P0 and eighteen P1 findings on the edge and platform families (PR #194). Wave 3 closes eight P1 dimension-d single-definition-ownership references across seven blueprints and adds two dimension-b refusal acceptance criteria on `application-spa` (PR #197). Wave 5 closes every remaining P0, P1 and P2 recorded against the seven application-tail blueprints (PR #195: `application-admin-console`, `application-onboarding-tour`, `application-account-settings`, `application-empty-error-states`, `application-file-upload`, `application-forms-wizard`, `application-notifications-in-app`), minting new requirements where an elicit prompt was previously unbacked at the REQ layer.
+- **Criterion-f wave 4 P2 and P3 tail across seven families (PRs #198, #199, #200, #201, #202, #204, #206).** Wave 4 closes the criterion-f P2 and P3 residue on the edge (PR #198), object storage (PR #199), deploy (PR #200), security (PR #201), platform (PR #202), messaging (PR #204) and application (PR #206) families. Findings closed on this wave include the last of the shipped-prose register residue (README, guide, ADR consequences), acceptance-criteria vendor citations added where a `vendorCitation` was missing, and a small number of dimension-b acceptance-criteria refinements. Each affected slug takes a patch bump and the anatomy tests move in step.
+- **Criterion-e positive-evidence skip-path conformance on the Cloudflare families (PRs #203, #205).** Every account-bound skip result on the Cloudflare edge and platform families now carries a discrete `reason` field naming the exact unset environment variable, mirrored on `extra`, and the fixture READMEs declare those variables under a "Declared env vars" section. Coverage: `edge-cloudflare-tunnel`, `edge-cloudflare-rate-limiting`, `edge-cloudflare-access` and `edge-cloudflare-turnstile` (PR #203); `platform-cloudflare-kv`, `platform-cloudflare-durable-objects` and `platform-cloudflare-cron-triggers` (PR #205). One incidental probe fix: the cron `platform-cloudflare-cron-triggers` unset-second-tier branch is rewritten from an unreachable `verdict: fail` to a declared skip (positive-evidence rules treat a fail without evidence as a fail regardless of the verdict field, so the branch could never surface).
+
+#### Also in this release
+
+- **Application-charts AC-18105-3 (PR #193).** Prose narrowed to WCAG 1.4.11 to match its `vendorCitation`.
+
 ## [0.26.0] - 2026-09-09
 
 rcf-lite 0.26.0 is a hardening and authoring release. The Cloudflare-platform blueprints on the shelf pick up real-account probe drivers with positive evidence and one shared account-token env matrix, the blueprint authoring standard gains three new sections (7c REQ-layer sufficiency, 7d positive-evidence verification, 7e single-definition ownership) plus RULE 16 for the managed agent block, and `rcf define blueprint` gains a `lint-consistency` verb, a per-slug disposition ledger, an apply-time disposition prompt and an identity-register field on the seeded profile. The schema floor moves to `@stravica-ai/rcf-schemas` 0.6.2. Nothing here is breaking.

package/README.md

@@ -40,6 +40,16 @@ Let's get started.
 
 If you'd rather drive it by hand, [docs/getting-started.md](docs/getting-started.md) covers the same ground at human pace. Prerequisites, install checks and agent-harness wiring live in [docs/install.md](docs/install.md).
 
+## Agent support
+
+Claude Code is the supported path today. Codex CLI works end to end for a small app, with three sharp edges to know about before you start:
+
+- The `.mcp.json` that `rcf init` writes uses the Claude Code convention, which Codex does not read. To make the RCF MCP entry reachable from Codex, copy it by hand into `~/.codex/config.toml` under `[mcp_servers]`.
+- The chain discipline in `AGENTS.md` holds when nothing pushes on the session. Under user pressure for pace, Codex has been observed to drop the chain and ship code without the intervening `rcf define` calls; keep an eye on `rcf define validate` between turns.
+- `rcf init` does not `git init` the directory, so every `codex exec` and `codex exec resume` needs `--skip-git-repo-check` until you initialise git yourself.
+
+Fuller Codex support is on the roadmap; for now the recommended path is Claude Code.
+
 ## Migrating from the pre-0.7.1 packages
 
 If your project pinned one of the pre-consolidation packages, replace it with `rcf-lite`:

package/bin/rcf.js

@@ -23,6 +23,7 @@ import { main as coverageMain } from '../src/cli/coverage.js';
 import { main as createMain } from '../src/cli/create.js';
 import { main as deleteMain } from '../src/cli/delete.js';
 import { main as doctorMain } from '../src/cli/doctor.js';
+import { main as feedbackMain } from '../src/cli/feedback.js';
 import { main as finaliseMain } from '../src/cli/finalise.js';
 import { main as guidanceMain } from '../src/cli/guidance.js';
 import { main as helpMain, TOP_LEVEL_HELP, GROUP_HELP, HELP_MAP } from '../src/cli/help.js';
@@ -68,6 +69,7 @@ export const CORE = {
   guidance: guidanceMain,
   mcp: mcpMain,
   version: versionMain,
+  feedback: feedbackMain,
   // help handled inline below (needs group context)
 };
 

package/blueprints/application-account-settings/CHANGELOG.md

@@ -1,6 +1,68 @@
 # application-account-settings CHANGELOG
 
-## 1.0.0 (visual round T-4, spec 2026-09-06 section 5.4)
+## 1.2.7 - 2026-09-12
+
+- Register cleanup on branch-added prose: fixture server comment above the server-scoped theme store now names the single-organisation fixture default explicitly; theme-radiogroup notObservableHere reason and detail now say "change-event firing" and "firing a change event" for the browser-only DOM-event half of AC-25108-1, so the register-token grep on the added lines is clean. No probe or fixture behaviour change; blueprint contributions unchanged.
+
+## 1.2.6 - 2026-09-12
+
+- Positive-evidence row shape tightened in the anatomy helper: a positive row now requires a non-empty engine-returned `requestId` AND (a non-empty `bodyExcerpt` OR a non-empty `derived` object); a `{derived:{}}` alone or a `requestId` alone no longer counts, with two new negative-case tests covering the empty-derived and id-only patterns. Fixture `?break=no-persist` extended to also refuse the server-side POST `/api/theme` with HTTP 507 `THEME_WRITE_REFUSED` and DELETE `/api/theme` with HTTP 507 `THEME_CLEAR_REFUSED`, so the anatomy negative-variant map now drives the theme-radiogroup positive server-scoped-persistence row (AC-25108-1) to fail under `PROBE_BREAK=no-persist` (added to `brokenExpectations`).
+
+## 1.2.5 - 2026-09-12
+
+- Rule-7d shape fix on the de-claimed conformance rows across shell-tablist (AC-25101-1), profile-form-autocomplete (AC-25102-1) and sessions-surface-shape (both AC-25105-1 branches): each row now carries `anchorAcId: null` and names the anchored AC in the `limitation` field per the shipped shape (a `conformanceOnly:true` row must not simultaneously claim an anchor). theme-radiogroup positive server-scoped-persistence row's detail is corrected to open on AC-25108-1's first eight words verbatim ("When application-spa is in the applied-blueprint set, GET"), and a stale source comment previously stating the aggregate skipped the notObservableHere row is corrected to reflect the shipped aggregate (any warn row lifts the aggregate to warn; the notObservableHere row emits warn honestly). Prior 1.2.4 CHANGELOG note asserted the shipped fixture break switches drive the adapter-uniform aggregate to fail; the shipped anatomy negative-variant map covers profile-form-autocomplete (under `no-autocomplete`) and shell-tablist-per-capability (under `leak-tab`) - the sessions-adapter-uniform probe is not among the mapped fails. That earlier CHANGELOG line is superseded here; the anatomy negative map is unchanged. Fixture README env-var manifest now declares `PROBE_BREAK` (the fixture reads it as an alternate to a per-request `?break=`) and the probe-utils `DECLARED_ENV` list mirrors the addition. Anatomy shape check tightened to reject an anchored `conformanceOnly` row (a positive evidence field no longer bypasses the null-anchor + limitation contract); a new negative-case test constructs an anchored `conformanceOnly` row and asserts the shape helper throws.
+
+## 1.2.4 - 2026-09-11
+
+- Shared `aggregate()` no longer promotes warn rows to pass: any row with verdict warn (including honest de-claim rows) lifts the aggregate to warn; a probe whose rows are all warn aggregates to warn, not pass. Shared teardown propagates a SIGKILL failure through the returned kill() promise instead of swallowing it. Overclaiming rows across shell-tablist (AC-25101-1), profile-form-autocomplete (AC-25102-1), sessions-surface-shape (AC-25105-1) and theme-radiogroup interaction-half (AC-25108-1) are de-claimed to `conformanceOnly:true` with `verdict:'warn'` and a `limitation` field naming the anchored AC and the browser-only or varied-input clause that lives outside the Node HTTP probe. sessions-adapter-uniform (AC-25106-1) stays as a positive-observation row (three distinct per-provider raw inventories, disjoint device-label sets, per-row column uniformity, ISO lastActive derivation). theme-radiogroup server-scoped persistence row (AC-25108-1 server-observable half) stays positive (POST-then-GET reflects on `<html data-theme>`; DELETE returns to default). Anatomy test extended with a negative-variant assertion that the shipped fixture break switches drive the adapter-uniform aggregate to fail.
+
+## 1.2.3 - 2026-09-11
+
+- sessions-adapter-uniform now proves the AC-25106-1 uniform-render contract against three DISTINCT per-provider raw inventories. Fixture ships three provider-specific raw payload shapes (clerk uses `session_id`/`ua`/`last_seen_iso`, keycloak uses `sid`/`client`/`lastAccessed` epoch ms, oauth2 uses `tokenSubject`/`deviceLabel`/`issuedAt`) with per-provider adapters that normalise each to a common `id`/`device`/`lastActive` ISO / `current` row. Probe asserts: sizes vary across providers (proves raw payloads are distinct, not one array echoed with a swapped label), device-label sets are pairwise disjoint, the per-row column set is uniform across providers, and every lastActive value is ISO 8601 (keycloak epoch-ms conversion is a derived-output check). sessions-surface-shape now `await`s both fixture teardown calls (teardown failure fails the verdict). theme-radiogroup grows a server-scoped persistence row for the observable half of AC-25108-1: fixture ships `POST /api/theme?theme=X` (writes per principal only when `theme-persistence=server-scoped`), the subsequent GET renders the stored theme on `<html data-theme>` and pre-checks the matching radio, DELETE clears back to default. The interaction-half row is now conformance-only (null anchor + `limitation` naming the browser-only clause) and emits `verdict:'warn'` (never `pass`). Anatomy test extended to enumerate the shipped AC/REQ id set and refuse any row whose anchor is not in it, and to accept the conformance-only row shape.
+
+## 1.2.2 - 2026-09-11
+
+- sessions-adapter-uniform earlier introduced a `?provider=<clerk|keycloak|oauth2>` query switch and a `<meta data-observed-provider="X">` marker inside `[data-surface="sessions"]`; the earlier probe compared normalised subtrees to a reference for byte equality but the fixture served the same hard-coded rows regardless of provider, so the check was self-consistent rather than adapter-derived (superseded by 1.2.3 above). theme-radiogroup earlier de-claimed the AC-25108-1 interaction half to `notObservableHere`; profile-form-autocomplete's positive-anchor-on-absence broken row was removed; rule 10 applied to every row detail across all five probes; anatomy test extended to accept notObservableHere row shape; register cleanup.
+
+
+## 1.2.1 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering 5 properties the fixture engine at `packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/server.js` answers: `shell-tablist-per-capability`, `profile-form-autocomplete`, `sessions-surface-shape`, `sessions-adapter-uniform`, `theme-radiogroup`. Every response now carries an `x-fixture-request-id` header; probes record the id, the HTTP status and a body excerpt as positive evidence per rule 7d. Fixture README declares every env var the pack reads. Anatomy test at `packages/rcf-lite/test/blueprint/application-account-settings-anatomy.test.js` pins the new pack files and asserts each result carries one of the four 7d evidence shapes.
+
+
+## 1.2.0 (2026-09-10)
+
+### Added
+
+- REQ-009: custom-auth-provides-* runtime clauses covering the four boolean elicits with a per-token clause on the applied capability union.
+- Vendor citations on AC-25101-1 (APG tabs), AC-25102-3 (WCAG 1.3.5), AC-25105-2 (APG dialog) and AC-25108-2 (APG radio).
+
+### Changed
+
+- ADR-2604.decision references `blueprint.json.elicits[id=reauth-window].options` (never|5|15|60) via ownerRef.
+- TAC-2604.tradeoffs references the manifest's `reauth-window` default (`15`) via ownerRef; `sessionRecord` shape references the session-verifier owner (`TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory`) via ownerRef.
+- REQ-003.deliveredBy retargeted to `TAC-2603.interfaces.renderSecuritySurface`.
+- REQ-006.deliveredBy retargeted to `TAC-2601.responsibilities.renderThemeSurface` (new responsibility carrying the theme-persistence clauses).
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 (2026-09-10)
+
+### Added
+
+- REQ-007 (reauth-window option coverage) and US-25111: never, 5, 15 and 60 each carry a defined runtime clause tied to the applied auth providers session inventory (owner TAC-1003-security-auth-clerk-session-verifier interfaces.sessionInventory), with REAUTH_REQUIRED, REAUTH_STALE and REAUTH_WINDOW_UNKNOWN refusal branches.
+- Failure-path acceptance criteria on US-25101 (unauthenticated /account routes to the forbidden state with sign-in link and no profile data), US-25105 (inventory read failure, terminate write failure, current-session protection).
+
+### Changed
+
+- sessionInventory prose corrected across README (provider table row and companion paragraph), blueprint.json (custom-auth-provides-session-inventory prompt and suggestedCompanions logging reason), docs/topics.md (topics enumeration and reserved-topic entry), TAC-2604 (responsibilities[0]) and US-25106 (title, prose and AC-25106-1). observability-logging 1.3.0 no longer provides sessionInventory; the owner is security-auth-clerk TAC-1003 interfaces.sessionInventory and equivalent TACs on other auth blueprints. requiresAppliedCapabilities remains [principalDirectory].
+- Every REQ now carries a deliveredBy link into TAC-2601, TAC-2603 or TAC-2604.
+- Every AC on every user story now carries an explicit disposition (fixed or template); ACs that observe a session-inventory row carry ownerRef into TAC-1003.
+- TAC-2601 responsibilities extended with renderProfileSurface, renderPreferencesSurface and renderCorrelationId; TAC-2604 extended with reauthWindowGate and sessionInventoryConsumer.
+- elicit-token coverage tightened on REQ-003 to name `self-service`, `hosted-link-out` and `hosted-embed` literally alongside the branch prose; principalDirectory named literally in REQ-001; template ACs on US-25104, US-25108 and US-25101 carry an `Applying agent sets: <elicit-id>.` clause; anatomy test name at TC-056-shelf-doc-consistency renamed to say observability-logging drops sessionInventory.
+## 1.0.0 (visual round, spec 2026-09-06 section 5.4)
 
 - First shipped version. Introduces the account-settings shell (ARIA APG tabs, WCAG 2.4.6 landmark), the profile surface (WCAG 1.3.5 autocomplete tokens, aria-live save-status), the security surface (self-service branch and hosted-UI branch through ADR-2602's elicited security-surface-shape), the sessions surface (ARIA APG dialog-modal terminate flow, aria-live session-terminated announcement, current-session cannot terminate itself), the notification-preferences surface (per-category silence, per-channel opt-in) and the theme surface (light/dark/system radiogroup persisted per ADR-2603's elicited theme-persistence).
 - Declares `requiresAppliedCapabilities: [principalDirectory]` with `refusalMessageId: application-account-settings-bare-spa` and `allowSkipFlag: allow-no-auth-yet`. The refusal template ships in this PR's mechanism minor at `packages/rcf-lite/src/blueprint/capabilities.js` (`buildRefusalMessage`). The Q3 gate (a project declaring neither `credentialSelfService` nor `hostedIdentityUi`) is enforced through the shell's tab-suppression rule (AC-25101-1 probed by the pack), the mechanism's silent gating of the `security-surface-shape` elicit (its `when` predicate refuses), and the surface-side hosted-UI bridge TAC-2603 refusal (documented mechanism-reach gap under AC-25110-1).
@@ -8,5 +70,5 @@
 - Ships four regular elicits (`security-surface-shape`, `hosted-identity-url`, `theme-persistence`, `reauth-window`) whose `when` predicates gate on the applied capability set.
 - Ships a Playwright probe pack under `probe-packs/application-account-settings.pack.mjs` with five checks anchored to `AC-25101-1` (shell tabs mirror caps), `AC-25102-1` (profile autocomplete tokens), `AC-25105-1` (security branch matches applied + elicit), `AC-25106-1` (sessions rows and dialog-modal) and `AC-25108-1` (theme radiogroup and persistence). Every check gates via `readAppliedCapabilities(projectRoot)`; an absent capability records `verdict: skipped` per spec section 3.3.
 - Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/` realising the five conditional surfaces honestly plus four break switches (`?break=leak-tab`, `?break=no-autocomplete`, `?break=no-dialog`, `?break=no-persist`) driving the negative runs.
-- Composes on `application-empty-error-states` (T-1) for the forbidden and empty-history states; no bespoke access-denied UI is invented here.
+- Composes on `application-empty-error-states` for the forbidden and empty-history states; no bespoke access-denied UI is invented here.
 - Rides with the auth blueprints minor bumps (`security-auth-clerk` 1.3.0, `security-auth-keycloak` 1.2.0, `security-auth-oauth2` 1.2.0, `security-auth-magic-link` 1.2.0 doc-only) and the `observability-logging` 1.2.0 minor bump (declares `sessionInventory` as the logging-projection provider), extending the section 6a capability table with `credentialSelfService`, `sessionInventory` and `hostedIdentityUi`.

package/blueprints/application-account-settings/README.md

@@ -1,6 +1,6 @@
 # Account settings blueprint (v1.0.0)
 
-Vendor-neutral account-settings surface for an rcf-lite application. Surfaces are CONDITIONAL on what the applied identity blueprints and companion blueprints declare via `capabilities[]`. Ships the settings shell with an ARIA APG tabs region (no dead links to unapplied capabilities), a WCAG 1.3.5 profile surface (always active), a security surface with a self-service branch (password change, MFA) and a hosted-UI branch (link-out or embed), a sessions surface with an ARIA APG dialog-modal terminate flow, a notification preferences surface and a theme surface with light/dark/system. Reuses the visual round T-5 capability grammar and the apply-time discovery, refusal and custom-auth elicitation the spec section 5.4 ratifies. Ships a Playwright probe pack under `probe-packs/application-account-settings.pack.mjs` whose five checks are capability-gated: an absent capability records `verdict: skipped` and the aggregate verdict treats it as neither pass nor fail (spec section 3.3).
+Vendor-neutral account-settings surface for an rcf-lite application. Surfaces are CONDITIONAL on what the applied identity blueprints and companion blueprints declare via `capabilities[]`. Ships the settings shell with an ARIA APG tabs region (no dead links to unapplied capabilities), a WCAG 1.3.5 profile surface (always active), a security surface with a self-service branch (password change, MFA) and a hosted-UI branch (link-out or embed), a sessions surface with an ARIA APG dialog-modal terminate flow, a notification preferences surface and a theme surface with light/dark/system. Reuses the visual round capability grammar and the apply-time discovery, refusal and custom-auth elicitation the spec section 5.4 ratifies. Ships a Playwright probe pack under `probe-packs/application-account-settings.pack.mjs` whose five checks are capability-gated: an absent capability records `verdict: skipped` and the aggregate verdict treats it as neither pass nor fail (spec section 3.3).
 
 ## Apply
 
@@ -18,7 +18,7 @@ Refuses with exit 3 and the spec 5.4.1 verbatim message on a project with no app
 | Doc set | `contributions/` | 6 REQs, 10 USs (13 runtime-observable ACs), 4 TACs, 4 ADRs |
 | Probe pack | `probe-packs/application-account-settings.pack.mjs` | Five capability-gated browser-verify checks anchored to AC-25101-1, AC-25102-1, AC-25105-1, AC-25106-1, AC-25108-1 |
 | Guide | `guide/application-account-settings.md` | Operator-facing: when to reach, when not, mechanism-reach gaps |
-| Coordination vocabulary | `docs/topics.md` | Shelf id band registry update; no new global topics claimed; cross-references application-empty-error-states (T-1) and application-admin-console (T-5) |
+| Coordination vocabulary | `docs/topics.md` | Shelf id band registry update; no new global topics claimed; cross-references application-empty-error-states and application-admin-console |
 | Sample-app fixture | `packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/` | Dependency-free Node HTTP server the pack is probed against on the shelf gate |
 
 ## Conditionality: what surfaces render when
@@ -27,10 +27,10 @@ Refuses with exit 3 and the spec 5.4.1 verbatim message on a project with no app
 |---|---|---|
 | `principalDirectory` | Profile (`/account/profile`) always available | Any applied auth blueprint (magic-link, clerk, oauth2, keycloak). |
 | `credentialSelfService` OR `hostedIdentityUi` | Security (`/account/security`) | credentialSelfService: Keycloak from 1.2.0, OAuth2 from 1.2.0 (provider-conditional). hostedIdentityUi: Clerk from 1.3.0, OAuth2 from 1.2.0 (provider-conditional). Neither present: security tab suppressed AND the Q3 refusal fires at apply if the operator answers `--answer security-surface-shape=...`. |
-| `sessionInventory` | Sessions (`/account/sessions`) | Clerk from 1.3.0, Keycloak from 1.2.0, OAuth2 from 1.2.0, or observability-logging from 1.2.0 (as the logging-projection provider). Magic-link does NOT declare it. |
+| `sessionInventory` | Sessions (`/account/sessions`) | Clerk from 1.3.0, Keycloak from 1.2.0, OAuth2 from 1.2.0. Owner: security-auth-clerk TAC-1003-security-auth-clerk-session-verifier field interfaces.sessionInventory (the shape any auth blueprint declaring the capability agrees to). Magic-link does NOT declare it; observability-logging 1.3.0 no longer declares it. |
 | `application-notifications-in-app` applied | Notification preferences (`/account/notifications`) | Suppressed when the notifications-in-app blueprint is not applied. |
 | `application-spa` applied | Theme (`/account/theme`) | Suppressed when the SPA blueprint is not applied. |
-| (none) | Unauthenticated principal | Composes on `application-empty-error-states` (T-1) forbidden state; no bespoke access-denied UI. |
+| (none) | Unauthenticated principal | Composes on `application-empty-error-states` forbidden state; no bespoke access-denied UI. |
 
 ## Bare-SPA refusal
 
@@ -62,7 +62,7 @@ A project that declares `principalDirectory` (so apply is not refused at the bar
 2. Renders the shell WITHOUT a security tab (AC-25101-1, probed by the pack).
 3. Refuses the security surface at load time through TAC-2603 hosted-ui-bridge if a project-side FBS renders `/account/security` regardless (project-side enforcement per AC-25110-1 known mechanism-reach gap, spec section 5.4.1).
 
-No `auth managed elsewhere` placeholder ships from the shipped shell surface. Per Baz decision Q3 in the ratified spec, the shell never lies about a surface that has no home.
+No `auth managed elsewhere` placeholder ships from the shipped shell surface. The shell never lies about a surface that has no home.
 
 ## Custom-auth projects (auth outside the shelf)
 
@@ -79,7 +79,7 @@ Answers land on `rcf/blueprints/application-account-settings.applied.json`'s `ap
 
 ## The one runtime gate
 
-`probe-packs/application-account-settings.pack.mjs` ships five checks the `rcf verify browser` runner invokes on any FBS whose surface matches the pack's `appliesTo` predicate (an FBS that binds `TAC-2601-application-account-settings-shell` or whose nav model routes name an `/account`, `/settings` or `/profile` path). Each check ALSO carries its own `appliesTo` predicate that reads the applied capability sidecar and returns false when the required capability is absent; the check records `verdict: skipped` and the aggregate verdict treats it as neither pass nor fail (spec section 3.3, T-5 residual cure).
+`probe-packs/application-account-settings.pack.mjs` ships five checks the `rcf verify browser` runner invokes on any FBS whose surface matches the pack's `appliesTo` predicate (an FBS that binds `TAC-2601-application-account-settings-shell` or whose nav model routes name an `/account`, `/settings` or `/profile` path). Each check ALSO carries its own `appliesTo` predicate that reads the applied capability sidecar and returns false when the required capability is absent; the check records `verdict: skipped` and the aggregate verdict treats it as neither pass nor fail (spec section 3.3, residual cure).
 
 Each check drives the real Playwright browser the runner provisions (through the pinned Playwright MCP or the consuming project's own `playwright` installation), reads the accessibility tree and the DOM, and returns a verdict.
 
@@ -101,14 +101,14 @@ Runtime-observable ACs the pack does NOT bind directly (checklist section 6.g),
 
 ## Known schema follow-ups
 
-The applied-blueprint sidecar at `rcf/blueprints/application-account-settings.applied.json` uses the schema shape T-5 admin-console established (no `verdict: skipped` field on the applied-record; the pack runtime records `verdict: skipped` per-check per spec section 3.3, and rcf-schemas 0.6.1 has no `applicable: false` field for the record). A future rcf-schemas minor may adopt the `appliedCapabilities[]` field on the applied-blueprint record directly; the sidecar path stays supported for backward compatibility.
+The applied-blueprint sidecar at `rcf/blueprints/application-account-settings.applied.json` uses the schema shape admin-console established (no `verdict: skipped` field on the applied-record; the pack runtime records `verdict: skipped` per-check per spec section 3.3, and rcf-schemas 0.6.1 has no `applicable: false` field for the record). A future rcf-schemas minor may adopt the `appliedCapabilities[]` field on the applied-blueprint record directly; the sidecar path stays supported for backward compatibility.
 
 ## Companions
 
-`suggestedCompanions` declares `logging` (every rendered account surface writes one request-scoped log line with the correlation identifier; the sessions surface reads a session inventory from `observability-logging` 1.2.0+ when configured) and `errorHandling` (profile-save, security-flow and session-terminate failures construct internal error records). Neither is required to apply the blueprint; the audit-history surface is deferred to v1.1.0.
+`suggestedCompanions` declares `logging` (every rendered account surface writes one request-scoped log line with the correlation identifier) and `errorHandling` (profile-save, security-flow and session-terminate failures construct internal error records). Neither is required to apply the blueprint; the audit-history surface is deferred to v1.1.0.
 
 ## Consumers
 
-The forbidden and empty-history states MAP to `application-empty-error-states` (T-1)'s `forbidden` and `empty-list` states. Every project applying `application-account-settings` MUST also apply `application-empty-error-states` if they want the shipped access-denied state; the shell composes on the empty-error-states components rather than inventing bespoke UI.
+The forbidden and empty-history states MAP to `application-empty-error-states`'s `forbidden` and `empty-list` states. Every project applying `application-account-settings` MUST also apply `application-empty-error-states` if they want the shipped access-denied state; the shell composes on the empty-error-states components rather than inventing bespoke UI.
 
-The sessions and notification-preferences surfaces reuse the `application-datatable` (round-3 T-1) table shell contract when the project renders them through the datatable factory.
+The sessions and notification-preferences surfaces reuse the `application-datatable` (round-3) table shell contract when the project renders them through the datatable factory.

package/blueprints/application-account-settings/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-account-settings",
-  "version": "1.0.0",
+  "version": "1.2.7",
   "category": "application",
   "requiresAppliedCapabilities": {
     "capabilities": [
@@ -26,7 +26,7 @@
     },
     {
       "id": "custom-auth-provides-session-inventory",
-      "prompt": "Custom auth: does your projects own auth (or logging companion) expose an inventory of active sessions with device labels and a terminate action?",
+      "prompt": "Custom auth: does your projects own auth expose an inventory of active sessions with device labels and a terminate action?",
       "kind": "boolean",
       "default": false,
       "providesCapability": "sessionInventory"
@@ -92,7 +92,7 @@
   "suggestedCompanions": [
     {
       "role": "logging",
-      "reason": "Every rendered account surface writes one request-scoped log line with the correlation identifier; a logging companion supplies the factory the pipeline calls. When the logging companion also declares sessionInventory (observability-logging 1.2.0+), the sessions surface reads the inventory from the log projection."
+      "reason": "Every rendered account surface writes one request-scoped log line with the correlation identifier; a logging companion supplies the factory the pipeline calls. sessionInventory is owned by security-auth-clerk TAC-1003-security-auth-clerk-session-verifier interfaces.sessionInventory (and by the equivalent TAC on any auth blueprint that declares it); observability-logging does not provide it as of 1.3.0."
     },
     {
       "role": "errorHandling",
@@ -100,6 +100,11 @@
     }
   ],
   "contributions": [
+    {
+      "id": "application-account-settings-REQ-009",
+      "kind": "req",
+      "path": "requirements/application-account-settings-req-009.json"
+    },
     {
       "id": "application-account-settings-REQ-001",
       "kind": "req",
@@ -130,6 +135,11 @@
       "kind": "req",
       "path": "requirements/application-account-settings-req-006.json"
     },
+    {
+      "id": "application-account-settings-REQ-007",
+      "kind": "req",
+      "path": "requirements/application-account-settings-req-007.json"
+    },
     {
       "id": "application-account-settings-US-25101",
       "kind": "us",
@@ -180,6 +190,16 @@
       "kind": "us",
       "path": "user-stories/application-account-settings-us-25110.json"
     },
+    {
+      "id": "application-account-settings-US-25111",
+      "kind": "us",
+      "path": "user-stories/application-account-settings-us-25111.json"
+    },
+    {
+      "id": "application-account-settings-US-25112",
+      "kind": "us",
+      "path": "user-stories/application-account-settings-us-25112.json"
+    },
     {
       "id": "TAC-2601-application-account-settings-shell",
       "kind": "tac",
@@ -230,5 +250,7 @@
       "elicited": true,
       "standardsTraceClause": "WCAG 3.3.4 Error Prevention (Legal, Financial, Data)"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-12T01:30:44Z",
+  "updatedIso": "2026-09-11T22:30:00Z"
 }

package/blueprints/application-account-settings/contributions/adrs/adr-2601-application-account-settings-capability-vocabulary.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Capability vocabulary: credentialSelfService, sessionInventory, hostedIdentityUi additions plus auditLog reuse",
-  "context": "The account-settings blueprint composes on the section 6a capability grammar visual round T-5 ratified. The T-4 spec (section 5.4.2) adds three capability strings the auth vendors need to declare in order for the security and sessions surfaces to render, and reuses auditLog where a project wants a self-view audit history rendered on the account surface (deferred: not a v1 surface but named in the vocabulary so a future minor bump can wire it without a chunk-zero edit).",
+  "context": "The account-settings blueprint composes on the section 6a capability grammar visual round ratified. The spec (section 5.4.2) adds three capability strings the auth vendors need to declare in order for the security and sessions surfaces to render, and reuses auditLog where a project wants a self-view audit history rendered on the account surface (deferred: not a v1 surface but named in the vocabulary so a future minor bump can wire it without a chunk-zero edit).",
   "decision": "v1.0.0 ratifies three additions to the section 6a capability table: credentialSelfService (in-place password change, MFA management, email change surface), sessionInventory (active-session listing with device labels and a terminate write), and hostedIdentityUi (link-out or embed to a hosted account portal). The auditLog capability continues to route via observability-logging. The three new strings follow the same shape rule (lower camelCase, ^[a-z][a-zA-Z0-9]*$) validated on the loader; the vocabulary lives in the section 6a table extended in the same PR.",
   "consequences": "A bare-magic-link project gets a profile surface only; a Keycloak project gets profile plus security (self-service) plus sessions; a Clerk project gets profile plus security (hosted-link-out or embed) plus sessions; an OAuth2 project gets what the vendor declares. A future account-audit-history surface lands as a v1.1.0 minor bump reusing auditLog with no new vocabulary.",
   "alternativesConsidered": [

package/blueprints/application-account-settings/contributions/adrs/adr-2602-application-account-settings-security-surface-shape.json

@@ -7,7 +7,7 @@
   "title": "Security surface shape: password vs passkey vs hosted-UI vs link-out per applied auth",
   "context": "The security surface has four legal shapes depending on the applied auth: self-service password (Keycloak, OAuth2 with a self-service endpoint), self-service passkey (WebAuthn where the auth blueprint declares credentialSelfService and the operator has stood up a passkey flow), hosted link-out to a portal (Clerk, Auth0), or hosted embed of the same portal in an iframe. The spec section 5.4 marks security-surface-shape as elicited with no recommended default because the security surface leaks the vendors identity architecture and no default is honest across all four applied-auth combinations.",
   "decision": "security-surface-shape is elicited (enum: self-service | hosted-link-out | hosted-embed). No recommended default. Recording no default is the point: the operator picks the shape that matches the applied auth vendors surface. When the elicit is answered but no applied blueprint declares credentialSelfService (for self-service) or hostedIdentityUi (for the two hosted branches), apply refuses (AC-25110-1). The hosted-embed sandbox default is allow-scripts allow-forms allow-same-origin; a project that needs a different token set writes a project-scoped ADR overriding the sandbox.",
-  "consequences": "The operator makes an explicit choice at apply that reads on the sidecar; downstream review has a stable record of which security-surface-shape was elicited. A project that mis-answers (elicits hosted-link-out on a Keycloak project) hits the AC-25110-1 refusal at apply, not at runtime.",
+  "consequences": "The operator makes an explicit choice at apply that reads on the sidecar; downstream inspection sees a stable record of which security-surface-shape was elicited. A project that mis-answers (elicits hosted-link-out on a Keycloak project) hits the AC-25110-1 refusal at apply, not at runtime.",
   "alternativesConsidered": [
     {
       "name": "Alternative approach considered",

package/blueprints/application-account-settings/contributions/adrs/adr-2604-application-account-settings-reauth-window.json

@@ -2,12 +2,12 @@
   "adrId": "ADR-2604-application-account-settings-reauth-window",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Re-authenticate before high-value changes (default: enabled)",
-  "context": "A high-value change (password change, MFA change, session terminate, account delete) that runs on the same session that opened the surface is a phishing risk when the session is stale. WCAG 3.3.4 (Error Prevention on legal, financial and data-changing actions) applies. The spec section 5.4 marks reauth-window as elicited with recommendedDefault true, meaning re-authenticate is enabled by default.",
-  "decision": "reauth-window is elicited (enum: never | 5m | 15m | 60m). Recommended default: 15m. A high-value change fires the re-authenticate flow when the session was last authenticated more than reauth-window minutes ago. A project that ships a short-lived session token (reauth-window irrelevant because the session itself expires within minutes) may set never; ADR records the choice and the risk. The re-authenticate flow itself is owned by the applied auth blueprint; this ADR names the trigger, not the implementation.",
-  "consequences": "A stolen laptop with an unlocked session cannot terminate every other session without re-authenticating within 15 minutes. The re-authenticate cost is a modal prompt on the operators sessions view, not a full sign-out flow.",
+  "context": "A high-value change (password change, MFA change, session terminate, account delete) that runs on the same session that opened the surface is a phishing risk when the session is stale. WCAG 3.3.4 (Error Prevention on legal, financial and data-changing actions) applies. The spec section 5.4 marks reauth-window as elicited; the manifest elicit `blueprint.json.elicits[id=reauth-window]` owns the option set (its `.options`) and the recommended default (its `.default`).",
+  "decision": "reauth-window is elicited as an enum owned by `blueprint.json.elicits[id=reauth-window]`; the option vocabulary lives on its `.options` and the recommended default on its `.default` (this ADR does not restate either). A high-value change fires the re-authenticate flow when the session was last authenticated more than the elicited number of minutes ago; the disable-the-trigger case is whichever option the manifest elicit documents for that (this ADR does not name it). The re-authenticate flow itself is owned by the applied auth blueprint; this ADR names the trigger, not the implementation.",
+  "consequences": "A stolen laptop with an unlocked session cannot terminate every other session without re-authenticating within the elicited window. The re-authenticate cost is a modal prompt on the operators sessions view, not a full sign-out flow.",
   "alternativesConsidered": [
     {
       "name": "Alternative approach considered",
@@ -16,5 +16,5 @@
     }
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/probes/probe-utils.mjs

@@ -0,0 +1,177 @@
+// Shared helpers for application-account-settings contributions/probes/.
+//
+// The real engine for every probe in this pack is the fixture HTTP
+// server at packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/server.js
+// booted on a scratch port from the family range 47620-47629.
+// The fixture echoes a per-request x-fixture-request-id header on
+// every response; probes record that id and a response body excerpt
+// as positive evidence per rule 7d.
+//
+// No account credentials or network calls: every probe is
+// local-fixture-driven, so no probe carries an account-bound branch
+// or a CI_HAS_* gate. Declared env vars are the fixture's own
+// PORT and (where the fixture reads them) the CAPS/state switches
+// the probes drive via query string.
+
+import { spawn } from 'node:child_process';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:net';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export const SLUG = 'application-account-settings';
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-application-account-settings');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/application-account-settings');
+export const PORT_RANGE_START = 47620;
+export const PORT_RANGE_END = 47629;
+export const DECLARED_ENV = Object.freeze(['PORT', 'ACCOUNT_SETTINGS_CAPS', 'ACCOUNT_SETTINGS_APPS', 'ACCOUNT_SETTINGS_SECURITY_SHAPE', 'ACCOUNT_SETTINGS_HOSTED_URL', 'ACCOUNT_SETTINGS_THEME_PERSIST', 'PROBE_BREAK']);
+export const REQUEST_ID_HEADER = 'x-fixture-request-id';
+
+// Pick a free port from the fixture family range. Falls back to
+// asking the OS for an ephemeral port only if the whole range is
+// held by other workers (never expected on a single-machine run).
+export async function pickPort() {
+  for (let port = PORT_RANGE_START; port <= PORT_RANGE_END; port += 1) {
+    if (await canBind(port)) return port;
+  }
+  return await bindEphemeral();
+}
+
+function canBind(port) {
+  return new Promise((res) => {
+    const s = createServer();
+    s.once('error', () => res(false));
+    s.listen(port, '127.0.0.1', () => {
+      const bound = s.address();
+      s.close(() => res(!!bound));
+    });
+  });
+}
+
+function bindEphemeral() {
+  return new Promise((res) => {
+    const s = createServer();
+    s.listen(0, '127.0.0.1', () => {
+      const port = s.address().port;
+      s.close(() => res(port));
+    });
+  });
+}
+
+// Spawns the fixture server as a child on `port` with the given
+// env overlay; resolves once the fixture has printed LISTENING and
+// returns { child, url, kill } (kill is synchronous best-effort).
+export async function startFixture({ port, env = {} } = {}) {
+  const boundPort = port ?? await pickPort();
+  const child = spawn(process.execPath, ['server.js'], {
+    cwd: FIXTURE_DIR,
+    env: { ...process.env, PORT: String(boundPort), ...env },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  await new Promise((res, rej) => {
+    const timer = setTimeout(() => rej(new Error(`fixture did not print LISTENING within 4s on port ${boundPort}`)), 4000);
+    let stderrBuf = '';
+    child.stderr.on('data', (chunk) => { stderrBuf += String(chunk); });
+    child.on('exit', (code) => rej(new Error(`fixture exited early (code=${code}) stderr=${stderrBuf.slice(0, 400)}`)));
+    child.stdout.on('data', (chunk) => {
+      if (String(chunk).includes(`LISTENING ${boundPort}`)) { clearTimeout(timer); res(); }
+    });
+  });
+  const url = new URL(`http://127.0.0.1:${boundPort}`);
+  return {
+    child,
+    url,
+    port: boundPort,
+    // Await child exit and propagate any error. A teardown failure
+    // must fail the verdict (the teardown-propagation rule);
+    // no swallowed errors here.
+    kill: () => new Promise((res, rej) => {
+      let settled = false;
+      const done = (err) => { if (settled) return; settled = true; err ? rej(err) : res(); };
+      child.once('exit', () => done());
+      child.once('error', (err) => done(err));
+      try { child.kill('SIGTERM'); } catch (err) { return done(err); }
+      setTimeout(() => {
+        if (settled) return;
+        try { child.kill('SIGKILL'); } catch (err) { return done(err); }
+      }, 4000);
+    }),
+  };
+}
+
+// Issue an HTTP request against the fixture and return
+// { status, headers, body, requestId }.
+export async function fixtureFetch(url, pathAndQuery, init = {}) {
+  const target = new URL(pathAndQuery, url);
+  const res = await fetch(target, init);
+  const body = await res.text();
+  const requestId = res.headers.get(REQUEST_ID_HEADER);
+  return { status: res.status, headers: Object.fromEntries(res.headers.entries()), body, requestId };
+}
+
+export function excerpt(body, maxLen = 240) {
+  if (typeof body !== 'string') return '';
+  return body.length <= maxLen ? body : body.slice(0, maxLen) + '…';
+}
+
+export function aggregate(results) {
+  // Positive-evidence rule: no-checks-ran is a fail.
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  // Any warn row lifts the aggregate to warn, including honest
+  // notObservableHere de-claims. A probe whose rows are all warn
+  // aggregates to warn, not pass; the shelf reads amber and the tally
+  // accepts a warn aggregate as problems=0 when no fail row is present.
+  if (results.some((r) => r && r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: SLUG,
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const filepath = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(filepath, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path: filepath };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path: filepath } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${filepath}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    // Positive-evidence rule (exception fallback): exception rows have no
+    // observed AC; anchor null (never a fabricated id like
+    // "unknown"), carry an evidence object with the error excerpt.
+    const message = err && err.message ? err.message : String(err);
+    const stack = err && err.stack ? err.stack : String(err);
+    const results = [{
+      anchorAcId: null,
+      verdict: 'fail',
+      detail: `probe threw: ${message}`,
+      evidence: {
+        errorMessage: message,
+        errorExcerpt: excerpt(stack, 480),
+      },
+    }];
+    const { report, path: filepath } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${stack}\n`);
+    process.stderr.write(`report written to ${filepath}\n`);
+    process.exitCode = 1;
+  }
+}