rcf-lite 0.26.0 → 0.28.0

package/blueprints/application-datatable/contributions/user-stories/application-datatable-us-17106.json

@@ -2,7 +2,7 @@
   "usId": "application-datatable-US-17106",
   "prdId": "PRD-001",
   "reqId": "application-datatable-REQ-006",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "status": "approved",
   "title": "Column visibility, reorder and resize each expose a keyboard-reachable alternative to any drag pointer path",
   "asA": "operator who cannot drag with a pointer",
@@ -16,7 +16,8 @@
       "when": "the operator activates a keyboard-reachable move control on a column",
       "then": "the header order changes to reflect the move",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-17106-2",
@@ -25,7 +26,8 @@
       "when": "the operator activates a column visibility control",
       "then": "the target column's header and body cells hide or show accordingly",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-17106-3",
@@ -34,11 +36,62 @@
       "when": "the operator activates the keyboard resize path on a column",
       "then": "the column width changes by the declared increment without a pointer drag",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-17106-4",
+      "description": "Given a drag-only reorder or resize control (no keyboard alternative surface), the pack fails the check per REQ-006 and WCAG 2.5.7 Dragging Movements; a passing surface exposes a paired button pair (move-left / move-right, resize-up / resize-down) or a menu ordering per column reachable by Tab.",
+      "given": "a datatable whose reorder or resize is pointer-drag-only",
+      "when": "the pack inspects the keyboard-alternative surface",
+      "then": "the check fails; a passing surface exposes a paired button or menu ordering reachable by Tab",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1801-application-datatable-shell",
+        "field": "purpose"
+      },
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/WCAG22/Understanding/dragging-movements.html",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-17106-5",
+      "description": "Given the column visibility toggle activated to hide a column, when the pack re-renders the table, the hidden column is removed from the DOM AND from the paired header/data cell binding (no orphan `<td>` rows narrower than the visible column count); a shell that leaves orphan cells fails the pack check.",
+      "given": "a column visibility toggle activated to hide a column",
+      "when": "the pack inspects the rendered rows",
+      "then": "the column is removed from the DOM and each row's cell count matches the visible column count; orphan cells fail",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1801-application-datatable-shell",
+        "field": "purpose"
+      }
+    },
+    {
+      "id": "AC-17106-6",
+      "description": "Given a hidden column with an active sort or filter, when the operator hides the column, the sort or filter remains applied to the underlying query (the operator did not de-select the sort; hiding is presentation only) and the accessible copy near the chrome names the retained sort or filter so the operator can see why the visible rows narrowed.",
+      "given": "a hidden column that carries an active sort or filter",
+      "when": "the pack inspects the shell after hiding",
+      "then": "the sort or filter remains applied to the query and the accessible chrome names the retained state",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1802-application-datatable-query-adapter",
+        "field": "purpose"
+      }
     }
   ],
-  "tacIds": ["TAC-1801-application-datatable-shell"],
-  "tags": ["blueprint:application-datatable"],
+  "tacIds": [
+    "TAC-1801-application-datatable-shell"
+  ],
+  "tags": [
+    "blueprint:application-datatable"
+  ],
   "createdAt": "2026-09-04T19:45:00Z",
-  "updatedAt": "2026-09-04T19:45:00Z"
+  "updatedAt": "2026-09-10T07:07:28Z"
 }

package/blueprints/application-datatable/contributions/user-stories/application-datatable-us-17107.json

@@ -2,7 +2,7 @@
   "usId": "application-datatable-US-17107",
   "prdId": "PRD-001",
   "reqId": "application-datatable-REQ-001",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "status": "approved",
   "title": "The rendered table shell uses the ARIA APG pattern that matches the surface's interactivity",
   "asA": "assistive-tech user reading the datatable",
@@ -16,7 +16,8 @@
       "when": "the shell renders",
       "then": "the rendered table has `role=\"grid\"` and header cells scoped to `col`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-17107-2",
@@ -25,7 +26,12 @@
       "when": "assistive tech reads the action controls",
       "then": "each action's accessible name identifies the acted-on row",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-17107-3",
@@ -34,11 +40,70 @@
       "when": "assistive tech traverses a data cell",
       "then": "the announced context includes the column header the cell resolves to",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/WCAG22/Understanding/info-and-relationships.html",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-17107-4",
+      "description": "Given a datatable shell whose rows carry NO interactive controls (a read-only presentation), the rendered element is a `<table>` without `role=\"grid\"` (or with an explicit `role=\"table\"` per ARIA APG); a read-only surface that advertises `role=\"grid\"` fails the pack check per ADR-1801 because it advertises two-dimensional keyboard navigation the surface does not implement.",
+      "given": "a read-only datatable shell (no interactive per-row controls)",
+      "when": "the pack inspects the shell's role attribute",
+      "then": "the shell is `<table>` (or role=table); role=grid on a read-only surface fails per ADR-1801",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "adrId": "ADR-1801-application-datatable-pattern-choice",
+        "field": "decision"
+      },
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/ARIA/apg/patterns/table/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-17107-5",
+      "description": "Given a `role=\"grid\"` shell, when the operator uses the arrow keys, keyboard focus moves cell-by-cell (Right, Left, Up, Down) per the ARIA APG grid pattern; a `role=\"grid\"` shell whose arrow keys do not move cell focus fails the pack check because the pattern advertises a navigation the surface does not implement.",
+      "given": "a role=grid datatable shell",
+      "when": "the operator presses arrow keys",
+      "then": "focus moves cell-by-cell per ARIA APG grid; arrow keys with no cell focus movement fail",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "adrId": "ADR-1801-application-datatable-pattern-choice",
+        "field": "decision"
+      },
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/ARIA/apg/patterns/grid/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-17107-6",
+      "description": "Given a datatable that carries a mix of read-only rows and rows with per-row inline controls (some rows have an Edit button, others do not), the shell picks the grid pattern for the whole shell (ADR-1801: `grid` once ANY cell becomes an interactive control); the pack fails a shell that renders `<table>` on such a surface.",
+      "given": "a datatable with mixed read-only and interactive rows",
+      "when": "the pack inspects the shell's role",
+      "then": "the shell is role=grid (per ADR-1801, grid once any cell becomes interactive); a role=table on such a surface fails",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "adrId": "ADR-1801-application-datatable-pattern-choice",
+        "field": "decision"
+      }
     }
   ],
-  "tacIds": ["TAC-1801-application-datatable-shell"],
-  "tags": ["blueprint:application-datatable"],
+  "tacIds": [
+    "TAC-1801-application-datatable-shell"
+  ],
+  "tags": [
+    "blueprint:application-datatable"
+  ],
   "createdAt": "2026-09-04T19:45:00Z",
-  "updatedAt": "2026-09-04T19:45:00Z"
+  "updatedAt": "2026-09-10T07:07:28Z"
 }

package/blueprints/application-datatable/contributions/user-stories/application-datatable-us-17108.json

@@ -2,7 +2,7 @@
   "usId": "application-datatable-US-17108",
   "prdId": "PRD-001",
   "reqId": "application-datatable-REQ-002",
-  "version": "1.0.0",
+  "version": "1.0.4",
   "status": "approved",
   "title": "URL state serialisation preserves sort, filter and page across reload and share",
   "asA": "operator sharing a specific datatable view with a colleague",
@@ -16,29 +16,79 @@
       "when": "the operator reloads the URL",
       "then": "the reloaded surface renders the same sort, filter and page",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-17108-2",
-      "description": "Given the elicited client-side sort alternative (ADR-1802 elicited variant) applied to a small in-memory collection, the sort direction still writes to the URL so reload stability is preserved; the client-side branch never invents a URL state divergent from the server-side default.",
+      "description": "Given the elicited client-side query adapter mode (`query-adapter-mode=client-side` per `blueprint.json:elicits[query-adapter-mode]`) applied to a small in-memory collection, the sort direction still writes to the URL so reload stability is preserved; the client-side branch never invents a URL state divergent from the server-side default. Applying agent sets: the elicited value on `blueprint.json:elicits[query-adapter-mode]` (`server-side` or `client-side`). The URL `sort=<column>:<asc|desc>` grammar is fixed on TAC-1802-application-datatable-query-adapter.responsibilities[0].",
       "given": "a rendered datatable applying the client-side sort alternative",
       "when": "the operator activates a sort control",
       "then": "the URL query parameters update with `sort=<column>:<direction>` in the same shape as the server-side default",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-17108-3",
-      "description": "Given a rendered datatable, the default page size on the recommended default (ADR-1803) applies when no `pageSize` is present in the URL; the operator's elicited page-size override at apply time changes the default without changing the URL contract.",
+      "description": "Given a rendered datatable, the default page size on the recommended default (ADR-1803) applies when no `pageSize` is present in the URL; the operator's elicited page-size override at apply time changes the default without changing the URL contract. Applying agent sets: the applied default page size from ADR-1803-application-datatable-page-size (25 unless the operator elicits an override on `blueprint.json:elicits[page-size]`). The query parameter name `pageSize` is fixed on TAC-1802-application-datatable-query-adapter.responsibilities[0].",
       "given": "a rendered datatable landed at the shell route without a `pageSize` query parameter",
       "when": "the initial render fetches the first page",
       "then": "the fetch carries `pageSize=<applied-default>` and the URL is left untouched",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-17108-4",
+      "description": "Given the elicited session-scoped alternative (`url-state-strategy=session-scoped` per ADR-1802), when the operator applies a sort, filter and page advance, the URL does NOT change (no query parameters appear) and the state is retained in memory for the shell mount lifetime; a reload of the URL lands on the default state (no state restoration) and the shell announces the session-scoped mode in the accessible copy on first mount.",
+      "given": "an operator applying sort, filter and page under url-state-strategy=session-scoped",
+      "when": "the pack inspects URL and state after operator actions",
+      "then": "the URL carries no query parameters, the state is retained in memory for the mount lifetime, and reload lands on the default state",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "adrId": "ADR-1802-application-datatable-url-state",
+        "field": "decision"
+      }
+    },
+    {
+      "id": "AC-17108-5",
+      "description": "Given a URL carrying an INVALID state (a `sort=notacolumn` referencing a column that does not exist on the schema, a `page=999` past the last page, a `q=<value>` longer than the input's maxlength), when the shell loads, the shell rejects the invalid parts of the URL state, falls back to the default for each rejected part, and announces the fallback through the aria-live polite region; a shell that hard-fails on invalid URL state fails the pack check.",
+      "given": "a URL with invalid sort, page or q parameters",
+      "when": "the shell mounts and reads the URL state",
+      "then": "the shell rejects invalid parts, falls back to defaults per part, and announces the fallback; a hard failure on invalid URL state fails",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1802-application-datatable-query-adapter",
+        "field": "purpose"
+      }
+    },
+    {
+      "id": "AC-17108-6",
+      "description": "Given a rendered datatable, when the operator applies a new sort mid-view, the URL is updated with `history.replaceState` (not `pushState`); the browser history does NOT gain a new entry per micro-change so the operator's back button returns them to the page BEFORE the datatable, not to the previous sort state. A shell using `pushState` per micro-change fails the pack check per ADR-1802.",
+      "given": "a rendered datatable and an operator applying a new sort",
+      "when": "the pack inspects browser history after the sort",
+      "then": "the URL updated via history.replaceState and no new history entry was added; pushState per micro-change fails per ADR-1802",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "adrId": "ADR-1802-application-datatable-url-state",
+        "field": "decision"
+      }
     }
   ],
-  "tacIds": ["TAC-1801-application-datatable-shell", "TAC-1802-application-datatable-query-adapter"],
-  "tags": ["blueprint:application-datatable"],
+  "tacIds": [
+    "TAC-1801-application-datatable-shell",
+    "TAC-1802-application-datatable-query-adapter"
+  ],
+  "tags": [
+    "blueprint:application-datatable"
+  ],
   "createdAt": "2026-09-04T19:45:00Z",
-  "updatedAt": "2026-09-04T19:45:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-datatable/contributions/user-stories/application-datatable-us-17109.json

@@ -2,7 +2,7 @@
   "usId": "application-datatable-US-17109",
   "prdId": "PRD-001",
   "reqId": "application-datatable-REQ-004",
-  "version": "1.0.0",
+  "version": "1.0.5",
   "status": "approved",
   "title": "Selection persistence across pages holds the elicited contract and announces the running count",
   "asA": "operator selecting rows across several pages before running a bulk action",
@@ -11,12 +11,13 @@
   "acceptanceCriteria": [
     {
       "id": "AC-17109-1",
-      "description": "Given an operator elicited `selectionPersistence=cross-page` (ADR-1804), when the operator selects rows on page 1 and advances to page 2, the previously selected row ids remain in the selection model; a return to page 1 re-renders the checkboxes as checked. The check clicks a row checkbox, advances the page, returns, and asserts the checkbox is still checked.",
+      "description": "Given an operator elicited `selection-persistence=cross-page` on `blueprint.json:elicits[selection-persistence]` (ADR-1804), when the operator selects rows on page 1 and advances to page 2, the previously selected row ids remain in the selection model; a return to page 1 re-renders the checkboxes as checked. The check clicks a row checkbox, advances the page, returns, and asserts the checkbox is still checked. Applying agent sets: the elicited value on `blueprint.json:elicits[selection-persistence]` (`cross-page` here; the corresponding runtime `crossPage` value is fixed on TAC-1803-application-datatable-selection-model.internalStructure) and the pagination control the check advances through.",
       "given": "a rendered datatable with elicited cross-page selection persistence",
       "when": "the operator selects rows on page 1 and paginates away and back",
       "then": "the row checkboxes on page 1 remain in the selected state on return",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-17109-2",
@@ -25,20 +26,68 @@
       "when": "the operator toggles a second row",
       "then": "the accessible selection count updates by one without a full page re-render",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-17109-3",
-      "description": "Given the operator did not elicit cross-page persistence (ADR-1804's non-elicited default), the selection resets on pagination; the surface names this behaviour in the accessible copy near the bulk action control so operators are not surprised on advance.",
+      "description": "Given the operator did not elicit cross-page persistence (ADR-1804's non-elicited default `selection-persistence=per-page`), the selection resets on pagination; the surface names this behaviour in the accessible copy near the bulk action control so operators are not surprised on advance. Applying agent sets: the accessible-copy text near the bulk-action control that names the per-page-only behaviour. The `data-selection-persistence` marker on the bulk-action region is fixed on TAC-1803-application-datatable-selection-model.responsibilities[3] and carries the elicited value from `blueprint.json:elicits[selection-persistence]`.",
       "given": "a rendered datatable without cross-page persistence elicited",
       "when": "the operator selects rows and paginates away",
       "then": "the selection clears on advance and the accessible copy on the bulk-action region names the per-page-only behaviour",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-17109-4",
+      "description": "Given `selectionPersistence=cross-page` and the operator selects rows across pages then activates a bulk action, when the confirmation dialog opens the dialog's `aria-describedby` region names the total selected count (across pages) and the counts per page in a way the operator can verify before confirming; a dialog naming only the current page's count fails the pack check.",
+      "given": "cross-page selection and an operator opening the bulk-action confirmation dialog",
+      "when": "the pack inspects the dialog's aria-describedby content",
+      "then": "the region names the total selected count across pages and per-page counts; a per-page-only count fails",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1803-application-datatable-selection-model",
+        "field": "purpose"
+      }
+    },
+    {
+      "id": "AC-17109-5",
+      "description": "Given `selectionPersistence=cross-page` and the operator selects rows on pages 1 and 2 then filters the visible rows down to a set that excludes some selected rows, when the pack inspects the selection model, the previously selected but now filtered-out row ids remain in the selection model (filter narrows presentation, not selection); the accessible chrome names the retained-but-hidden count so the operator can see the total.",
+      "given": "cross-page selection followed by a filter that hides some selected rows",
+      "when": "the pack inspects the selection model and accessible chrome",
+      "then": "the hidden-but-selected row ids remain in the model and the chrome names the retained-but-hidden count",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1803-application-datatable-selection-model",
+        "field": "purpose"
+      }
+    },
+    {
+      "id": "AC-17109-6",
+      "description": "Given the selection model, when the operator invokes a `Clear selection` control, all selected row ids are removed, the running-count region announces zero, and every selection checkbox on the visible page returns to its unchecked state; the Clear selection control is keyboard-reachable and named `Clear selection` or an equivalent accessible name.",
+      "given": "the operator activating the Clear selection control",
+      "when": "the pack inspects the selection model and the visible checkboxes",
+      "then": "all selected row ids are removed, the running-count region announces zero, visible checkboxes are unchecked, and the control is keyboard-reachable with an accessible name",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1803-application-datatable-selection-model",
+        "field": "purpose"
+      }
     }
   ],
-  "tacIds": ["TAC-1803-application-datatable-selection-model"],
-  "tags": ["blueprint:application-datatable"],
+  "tacIds": [
+    "TAC-1803-application-datatable-selection-model"
+  ],
+  "tags": [
+    "blueprint:application-datatable"
+  ],
   "createdAt": "2026-09-04T19:45:00Z",
-  "updatedAt": "2026-09-04T19:45:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-datatable/docs/topics.md

@@ -7,7 +7,7 @@ The blueprint claims no new global topics at v1.0.0. The datatable shell is a ge
 ## Deliberately unclaimed topics
 
 - `dataGridEngine` (the chosen data-table library). Reserved for the applying project as an elicited choice, not a global topic; a second datatable-shaped blueprint that composes with a specific engine would either supersede this blueprint or share the shell TAC.
-- `columnRegistry` (a shared column vocabulary across surfaces). No blueprint claims it today; a future admin-console blueprint (visual round T-5) may elicit column reuse without minting a global topic.
+- `columnRegistry` (a shared column vocabulary across surfaces). No blueprint claims it today; a future admin-console blueprint may elicit column reuse without minting a global topic.
 
 ## Shelf id band and suffix block
 

package/blueprints/application-datatable/guide/application-datatable.md

@@ -12,7 +12,7 @@ A shipped, vendor-neutral datatable contract for a rcf-lite application. One she
 
 ## When to reach for it
 
-- Any surface with tabular data the operator sorts, filters, paginates, or bulk-operates on. Users tables, orders, notifications, records, audit views. The dashboard blueprint (visual round T-3) consumes this shell for its `application-datatable` recent-items strip.
+- Any surface with tabular data the operator sorts, filters, paginates, or bulk-operates on. Users tables, orders, notifications, records, audit views. The dashboard blueprint consumes this shell for its `application-datatable` recent-items strip.
 - Projects that want the ARIA APG discipline (table vs grid per interactivity) enforced at ship without hand-authoring the rule per surface.
 
 ## When it does not fit

package/blueprints/application-empty-error-states/CHANGELOG.md

@@ -1,9 +1,69 @@
 # application-empty-error-states CHANGELOG
 
-## 1.0.0 (visual round T-1, spec 2026-09-06)
+## 1.2.7 - 2026-09-12
 
-- First ratified version of the shelf's empty-and-error-states blueprint. Five REQs (state catalogue with eight named states, recovery-action contract, announcement contract with role region and aria-live polite, least-privilege 5xx and 403 posture, offline state with write-buffer and reconnection semantics), eight USs 22101-22108 binding one runtime-observable AC per named state, three TACs 2301-2303 (state-machine, recovery-action router, offline write-buffer), three ADRs 2301-2303 (HTTP status contract per RFC 9110 as recommendedDefault, stack-trace visibility elicited with recommendedDefault true, offline strategy across write-buffer read-only-banner and refuse-writes elicited). No new global topics.
-- Ships `probe-packs/application-empty-error-states.pack.mjs`: eight surface-observable browser-verify checks anchored one per named state (`AC-22101-1` not-found, `AC-22102-1` forbidden, `AC-22103-1` server-error, `AC-22104-1` permission-denied, `AC-22105-1` offline, `AC-22106-1` empty-list, `AC-22107-1` no-search-results, `AC-22108-1` error-boundary). Every URL is composed by the `withUrl(runtimeUrl, path)` helper per the round 3 T-3 fix train; no bare string concatenation. The pack-level `appliesTo` predicate references BOTH `tacIds` (TAC-2301) AND `route` (the operator-configured error-shell path glob).
+- Register cleanup on branch-added prose: fixture server comment above the offline-buffer store now names the single-organisation fixture principal explicitly; empty-list-and-no-search notObservableHere limitation now says "subsequent navigation" for the browser-only clause beyond the DOM shape and the query echo, so the register-token grep on the added lines is clean. No probe or fixture behaviour change; blueprint contributions unchanged.
+
+## 1.2.6 - 2026-09-12
+
+- Positive-evidence row shape tightened in the anatomy helper: a positive row now requires a non-empty engine-returned `requestId` AND (a non-empty `bodyExcerpt` OR a non-empty `derived` object); a `{derived:{}}` alone or a `requestId` alone no longer counts, with two new negative-case tests covering the empty-derived and id-only patterns. No probe or fixture behaviour change on the empty-error-states family (positive AC-22102-1 and AC-22103-1 rows on forbidden-and-server-error already carry both request-id and non-empty derived; the existing `leak-id` and `stack-trace` breaks stay in the shipped negative-variant map).
+
+## 1.2.5 - 2026-09-12
+
+- Rule-7d shape fix on the de-claimed conformance rows across not-found (AC-22101-1), permission-denied + offline (AC-22104-1, AC-22105-1), empty-list + no-search (AC-22106-1, AC-22107-1) and error-boundary (AC-22108-1): each row now carries `anchorAcId: null` and names the anchored AC in the `limitation` field per the shipped shape (a `conformanceOnly:true` row must not simultaneously claim an anchor). Confidentiality upgrade on forbidden-and-server-error (AC-22102-1 and AC-22103-1): the probe now MINTS varied sensitive input per run (a token, a resource id, an email, a bare NAME=value env pair, a backtrace-frame line, a source path) and INJECTS them into the request that triggers the 403 / 500 via query and headers, then asserts none of the injected tokens appears in the rendered surface; the sensitive-value matcher for AC-22103-1 now catches bare NAME=value forms (in addition to `process.env.NAME`), and the probe verifies the matcher positively catches a bare NAME= on a canary string. Both rows are re-anchored to positive-evidence (`verdict: 'pass'`) against the shipped ACs. Fixture README env-var manifest now declares `PROBE_BREAK` (the fixture reads it as an alternate to `EMPTY_ERROR_STATES_BREAK` / `?break=`) and the probe-utils `DECLARED_ENV` list mirrors the addition. Anatomy shape check tightened to reject an anchored `conformanceOnly` row (a positive evidence field no longer bypasses the null-anchor + limitation contract); a new negative-case test constructs an anchored `conformanceOnly` row and asserts the shape helper throws.
+
+## 1.2.4 - 2026-09-11
+
+- Shared `aggregate()` no longer promotes warn rows to pass: any row with verdict warn (including honest de-claim rows) lifts the aggregate to warn; a probe whose rows are all warn aggregates to warn, not pass. Shared teardown propagates a SIGKILL failure through the returned kill() promise instead of swallowing it. Overclaiming rows across not-found (AC-22101-1), forbidden + server-error (AC-22102-1, AC-22103-1), permission-denied (AC-22104-1), offline buffer (AC-22105-1), empty-list + no-search (AC-22106-1, AC-22107-1) and error-boundary (AC-22108-1) are de-claimed to `conformanceOnly:true` with `verdict:'warn'` and a `limitation` field naming the anchored AC and the varied-input or browser-only clause that lives outside the Node HTTP probe. The server-observable halves (403/500 status, region roles, recovery controls, buffer lifecycle) still drive the row-observation and flip verdict to fail under the shipped fixture break switches. Anatomy test extended with a negative-variant assertion that the shipped break switches drive the affected probe aggregates to fail.
+
+## 1.2.3 - 2026-09-11
+
+- Buffer lifecycle for AC-22105-1 is now observed server-side. Fixture ships three new endpoints keyed by `x-principal-id` header (or `?principal-id=` query): `POST /probe/offline/state` flips online/offline, `POST /probe/offline/buffer` enqueues with an idempotency-per-token contract (duplicate token returns `deduped:true` and count stays), `POST /probe/offline/reconnect` drains the buffer and returns the flushed count; `GET` variants return current state. The `/probe/offline` HTML surface now renders `data-buffer-state`, `data-buffer-count`, `data-flushed-count` and a banner reflecting the current transport state. permission-denied-and-offline probe drives a fresh principalId through the full lifecycle (flip offline, enqueue distinct tokens, verify count grew, POST duplicate token and verify dedupe, reconnect and verify drain+delivered) instead of de-claiming as `notObservableHere`. Anatomy test extended to enumerate the shipped AC/REQ id set from `contributions/user-stories/*.json` and refuse any row whose anchor is not in it, and to accept the conformance-only row shape.
+
+## 1.2.2 - 2026-09-11
+
+- forbidden-and-server-error probes now compare positive state-copy tokens rendered in the response HTML against the AC-22102-1 (forbidden) and AC-22103-1 (server-error) contracts, replacing the fixture-specific data-leak marker key that did not observe the state copy. permission-denied-and-offline offline row de-claimed to notObservableHere for AC-22105-1 (buffer lifecycle intercepted-write, buffered, reconnect, flushed sequence is client-driven and only observable in a browser). error-boundary-alert reanchored to AC-22108-1 active crash state; the standby-absence row that lacked a positive anchor is removed. Positive-anchor-on-absence broken-variant rows removed. Rule 10 applied to every row detail. Anatomy test extended to accept notObservableHere row shape. Register cleanup.
+
+
+## 1.2.1 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering 5 properties the fixture engine at `packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/server.js` answers: `not-found-and-recovery`, `forbidden-and-server-error`, `permission-denied-and-offline`, `empty-list-and-no-search`, `error-boundary-alert`. Every response now carries an `x-fixture-request-id` header; probes record the id, the HTTP status and a body excerpt as positive evidence per rule 7d. Fixture README declares every env var the pack reads. Anatomy test at `packages/rcf-lite/test/blueprint/application-empty-error-states-anatomy.test.js` pins the new pack files and asserts each result carries one of the four 7d evidence shapes.
+
+
+## 1.2.0 (2026-09-10)
+
+### Added
+
+- Elicits `stack-trace-visible` (default `production-hide`) and `offline-strategy` (default `write-buffer`) declared on blueprint.json; REQ-006 binds the three `stack-trace-visible` options and REQ-007 binds the three `offline-strategy` options with a runtime clause per value.
+- Vendor citations on AC-22101-1 (RFC 9110 404), AC-22102-1 (RFC 9110 403) and AC-22103-1 (RFC 9110 500).
+
+### Changed
+
+- REQ-002 widened to the seven-value recovery-shape enum owned by `TAC-2302.notes` (parent-surface, search, request-access, retry, create, clear-filters, no-recovery) via ownerRef.
+- REQ-004.deliveredBy retargeted to `TAC-2301.responsibilities.redactSensitivePatterns` (new responsibility).
+- REQ-005.deliveredBy retargeted to `TAC-2303.interfaces.bufferWrite`.
+- Probe checks AC-22102-1, AC-22103-1, AC-22104-1 and AC-22108-1 reworked to positively assert `data-safe-response` / `data-safe-error` / `data-cause-class` / `data-error-class` markers plus `data-request-id` / `data-correlation-id`; fixture updated to emit the markers.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 (2026-09-10)
+
+### Added
+
+- Failure-path acceptance criteria on US-22102 (failed request-access POST, no per-resource detail), US-22103 (retry failure, no stack trace leak), US-22105 (ordered flush with stable tokens, per-write failure with retry counter and banner, idempotency of retried operations), US-22106 (no-recovery notice for a state without configured recovery), US-22107 (query verbatim rendering, failed clear-filters reload), US-22108 (role=alert, hard-refresh recommendation after 3 recovery retries), US-22101 (gone vs never-existed distinction gated on the applied data provider), US-22104 (class-only naming, no per-resource detail).
+- Vendor citations on the WCAG status-messages criteria and the ARIA APG alert-pattern criteria (verified 2026-09-10).
+
+### Changed
+
+- Every REQ now carries a deliveredBy link into TAC-2301 (state-machine), TAC-2302 (recovery-router) or TAC-2303 (offline-buffer).
+- Every AC on every user story now carries an explicit disposition (fixed or template).
+
+## 1.0.0 (visual round, spec 2026-09-06)
+
+- Initial shipped version of the shelf's empty-and-error-states blueprint. Five REQs (state catalogue with eight named states, recovery-action contract, announcement contract with role region and aria-live polite, least-privilege 5xx and 403 posture, offline state with write-buffer and reconnection semantics), eight USs 22101-22108 binding one runtime-observable AC per named state, three TACs 2301-2303 (state-machine, recovery-action router, offline write-buffer), three ADRs 2301-2303 (HTTP status contract per RFC 9110 as recommendedDefault, stack-trace visibility elicited with recommendedDefault true, offline strategy across write-buffer read-only-banner and refuse-writes elicited). No new global topics.
+- Ships `probe-packs/application-empty-error-states.pack.mjs`: eight surface-observable browser-verify checks anchored one per named state (`AC-22101-1` not-found, `AC-22102-1` forbidden, `AC-22103-1` server-error, `AC-22104-1` permission-denied, `AC-22105-1` offline, `AC-22106-1` empty-list, `AC-22107-1` no-search-results, `AC-22108-1` error-boundary). Every URL is composed by the `withUrl(runtimeUrl, path)` helper per the round 3 fix train; no bare string concatenation. The pack-level `appliesTo` predicate references BOTH `tacIds` (TAC-2301) AND `route` (the operator-configured error-shell path glob).
 - Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/` with a Node HTTP server realising all eight states honestly under `/probe/<name>` and break switches (`?break=stack-trace`, `?break=leak-id`, `?break=no-recovery`, `?break=no-live-region`) driving the negative runs from a single boot. The fixture ships its own README naming PORT, every `?state=`, every `?break=`, the manual boot line and the two-line gate-reviewer boot.
 - Declares `suggestedCompanions` `logging` (every rendered error state writes one request-scoped log line with the correlation identifier) and `errorHandling` (the error-boundary state constructs an internal error record from the caught exception). Does NOT declare `providesRoles` (leaf blueprint per spec; loader refuses an empty `providesRoles` array when set, so the leaf-blueprint intent is expressed by omitting the field). Does NOT declare `capabilities` and does NOT declare `requiresAppliedCapabilities` (no auth required).
-- Sixth shipped consumer of T-0's probe-pack runner extension. T-3 `application-forms-wizard` consumes this blueprint for its "no in-progress forms" empty state; T-4 `application-account-settings` consumes this blueprint for its access-denied and empty-history states.
+- Sixth shipped consumer of the earlier release probe-pack runner extension. `application-forms-wizard` consumes this blueprint for its "no in-progress forms" empty state; `application-account-settings` consumes this blueprint for its access-denied and empty-history states.

package/blueprints/application-empty-error-states/README.md

@@ -53,7 +53,7 @@ The closed set of recovery shapes: `parent-surface`, `search`, `request-access`,
 
 ## The one runtime gate
 
-`probe-packs/application-empty-error-states.pack.mjs` ships eight checks the `rcf verify browser` runner invokes on any FBS whose surface binds `TAC-2301-application-empty-error-states-state-machine` or whose nav model routes name an operator-configured error-shell path. Each check drives the real Playwright browser the runner provisions, reads the accessibility tree and the DOM, and returns a verdict. URLs are composed by the `withUrl(runtimeUrl, path)` helper per the round 3 T-3 fix train; no bare string concatenation.
+`probe-packs/application-empty-error-states.pack.mjs` ships eight checks the `rcf verify browser` runner invokes on any FBS whose surface binds `TAC-2301-application-empty-error-states-state-machine` or whose nav model routes name an operator-configured error-shell path. Each check drives the real Playwright browser the runner provisions, reads the accessibility tree and the DOM, and returns a verdict. URLs are composed by the `withUrl(runtimeUrl, path)` helper per the round 3 fix train; no bare string concatenation.
 
 ## Quality bar
 
@@ -80,8 +80,8 @@ Runtime-observable ACs the pack does NOT bind directly (checklist section 6.g),
 
 ## Consumers
 
-- `application-forms-wizard` (T-3 of this round) consumes the empty-list state as its "no in-progress forms" surface; the wizard's empty branch delegates to this blueprint's TAC-2301 state machine.
-- `application-account-settings` (T-4 of this round) consumes the access-denied path (forbidden and permission-denied) for its scope-gated settings sections and the empty-list state for its empty-history surfaces.
+- `application-forms-wizard` (of this round) consumes the empty-list state as its "no in-progress forms" surface; the wizard's empty branch delegates to this blueprint's TAC-2301 state machine.
+- `application-account-settings` (of this round) consumes the access-denied path (forbidden and permission-denied) for its scope-gated settings sections and the empty-list state for its empty-history surfaces.
 
 ## Composition with application-spa
 

package/blueprints/application-empty-error-states/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-empty-error-states",
-  "version": "1.0.0",
+  "version": "1.2.7",
   "category": "application",
   "suggestedCompanions": [
     {
@@ -38,6 +38,16 @@
       "kind": "req",
       "path": "requirements/application-empty-error-states-req-005.json"
     },
+    {
+      "id": "application-empty-error-states-REQ-006",
+      "kind": "req",
+      "path": "requirements/application-empty-error-states-req-006.json"
+    },
+    {
+      "id": "application-empty-error-states-REQ-007",
+      "kind": "req",
+      "path": "requirements/application-empty-error-states-req-007.json"
+    },
     {
       "id": "application-empty-error-states-US-22101",
       "kind": "us",
@@ -115,5 +125,31 @@
       "elicited": true,
       "standardsTraceClause": "generic enterprise practice"
     }
-  ]
+  ],
+  "elicits": [
+    {
+      "id": "stack-trace-visible",
+      "prompt": "Server-error stack-trace visibility: production hides stack traces and secrets; staging or local may allow them.",
+      "kind": "enum",
+      "options": [
+        "production-hide",
+        "staging-show",
+        "local-show"
+      ],
+      "default": "production-hide"
+    },
+    {
+      "id": "offline-strategy",
+      "prompt": "Offline strategy when navigator.onLine reports false: write-buffer (queue writes to IndexedDB and flush on reconnection), read-only-banner (render a banner and disable every write control), or refuse-writes (every write attempt fails locally with a clear message).",
+      "kind": "enum",
+      "options": [
+        "write-buffer",
+        "read-only-banner",
+        "refuse-writes"
+      ],
+      "default": "write-buffer"
+    }
+  ],
+  "updatedAt": "2026-09-12T01:30:44Z",
+  "updatedIso": "2026-09-11T22:30:00Z"
 }