rcf-lite 0.26.0 → 0.28.0

package/blueprints/application-empty-error-states/contributions/probes/empty-list-and-no-search.mjs

@@ -0,0 +1,66 @@
+// application-empty-error-states probe: empty-list state
+// (AC-22106-1) and no-search-results state echoing the query
+// (AC-22107-1). Broken-variant row on empty-list?break=no-recovery
+// was removed under the positive-anchor cleanup (positive-anchor on
+// absence is void).
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-empty-error-states-AC-22106-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const empty = await fixtureFetch(fixture.url, '/probe/empty-list');
+    const region = /data-surface="empty-list"[^>]*role="region"/.test(empty.body);
+    const visualWrapper = /data-visual="empty-list"/.test(empty.body);
+    const recoveryLink = /data-recovery="create"/.test(empty.body);
+    const emptyPass = empty.status === 200 && !!empty.requestId && region && visualWrapper && recoveryLink;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22106-1: assistive-tech accessible-name resolution on the create control (the AC clause beyond the DOM shape) is AT-driven and not observed by this Node HTTP probe; the empty-list region + visual + create-link walk is a partial observation of AC-22106-1',
+      verdict: emptyPass ? 'warn' : 'fail',
+      detail: emptyPass
+        ? `Given a listing endpoint returning an empty array, observed role="region", data-visual="empty-list" wrapper and keyboard-reachable [data-recovery="create"] link on the rendered surface; x-fixture-request-id=${empty.requestId}`
+        : `Given a listing endpoint returning an empty array, evidence gap: status=${empty.status} rid=${empty.requestId} region=${region} visual=${visualWrapper} recovery=${recoveryLink}`,
+      evidence: {
+        requestId: empty.requestId,
+        responseStatus: empty.status,
+        bodyExcerpt: excerpt((empty.body.match(/data-surface="empty-list"[^]{0,220}/) || [''])[0]),
+        derived: { region, visualWrapper, recoveryLink },
+      },
+    });
+
+    // AC-22107-1: query echoed verbatim inside data-query span.
+    const query = 'probe-search-' + Math.random().toString(36).slice(2, 8);
+    const noSearch = await fixtureFetch(fixture.url, `/probe/search?q=${encodeURIComponent(query)}`);
+    const nsRegion = /data-surface="no-search-results"[^>]*role="region"/.test(noSearch.body);
+    const nsVisual = /data-visual="no-search-results"/.test(noSearch.body);
+    const qMatch = noSearch.body.match(/<span data-query>([^<]*)<\/span>/);
+    const derivedQ = qMatch ? qMatch[1] : '';
+    const echoed = derivedQ === query;
+    const clearControl = /data-recovery="clear-filters"/.test(noSearch.body);
+    const nsPass = noSearch.status === 200 && !!noSearch.requestId && nsRegion && nsVisual && echoed && clearControl;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22107-1: clear-filters control activation and subsequent navigation (the AC clauses beyond the DOM shape and the query echo) are browser-driven and not observed by this Node HTTP probe; the no-search-results region + visual + clear-filters + varied-query echo walk is a partial observation of AC-22107-1',
+      verdict: nsPass ? 'warn' : 'fail',
+      detail: nsPass
+        ? `Given a search or filter yielding zero rows, observed role="region", data-visual="no-search-results" wrapper, [data-recovery="clear-filters"] control and a data-query span echoing the varied query verbatim ("${derivedQ}"); x-fixture-request-id=${noSearch.requestId}`
+        : `Given a search or filter yielding zero rows, evidence gap: status=${noSearch.status} rid=${noSearch.requestId} region=${nsRegion} visual=${nsVisual} echoed=${echoed} derived="${derivedQ}" expected="${query}" clear=${clearControl}`,
+      evidence: {
+        requestId: noSearch.requestId,
+        responseStatus: noSearch.status,
+        bodyExcerpt: excerpt((noSearch.body.match(/<span data-query>[^<]*<\/span>[^]{0,140}/) || [''])[0]),
+        derived: { query, derivedQ, echoed, clearControl },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-empty-error-states/contributions/probes/error-boundary-alert.mjs

@@ -0,0 +1,65 @@
+// application-empty-error-states probe: error-boundary state
+// (AC-22108-1). AC-22108-1 explicitly permits the sample-app
+// /probe/error-boundary?crash=1 route as the observation trigger; the
+// probe drives that route and observes the active crash state
+// (role="alert" region, [data-recovery="retry"] control, class-level
+// error label). The prior standby-absence row was removed under the
+// positive-anchor cleanup (positive-anchor on absence is void).
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-empty-error-states-AC-22108-1';
+export const accountBound = false;
+
+function stripHtml(html) {
+  return String(html)
+    .replace(/<script[^]*?<\/script>/gi, ' ')
+    .replace(/<style[^]*?<\/style>/gi, ' ')
+    .replace(/<[^>]+>/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function stackFramePresent(text) {
+  // Backtrace frame ("at fn (file:line:col)"), a source path ending in
+  // a JS-family extension, an env-var key shape, or a node_modules
+  // segment. Correlation-id tokens are not stack frames.
+  if (/\bat\s+[A-Za-z_$][A-Za-z0-9_$.]*\s*\([^)]+:\d+:\d+\)/.test(text)) return true;
+  if (/(^|\s)(\.\.?\/|\/)[A-Za-z0-9_./-]+\.(js|mjs|cjs|ts|tsx|jsx)\b/i.test(text)) return true;
+  if (/process\.env\.[A-Z_][A-Z0-9_]*/.test(text)) return true;
+  if (/\bnode_modules\//.test(text)) return true;
+  return false;
+}
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const crash = await fixtureFetch(fixture.url, '/probe/error-boundary?crash=1');
+    const surfaceText = stripHtml(crash.body);
+    const alertRegion = /data-surface="error-boundary"[^>]*role="alert"/.test(crash.body);
+    const retryControl = /data-recovery="retry"/.test(crash.body);
+    const errorClass = /data-error-class="render-failure"/.test(crash.body);
+    const plainSummary = /Widget failed to render/.test(surfaceText);
+    const noStack = !stackFramePresent(surfaceText);
+    const crashPass = crash.status === 200 && !!crash.requestId && alertRegion && retryControl && errorClass && plainSummary && noStack;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22108-1: varied-input plain-summary derivation against a shipped origin (framework internal frames, arbitrary env keys the origin might have leaked) is not observed by this Node HTTP probe against a fixed fixture; the error-boundary alert + retry + error-class + plain-summary + no-stack-frame walk is a partial observation of AC-22108-1',
+      verdict: crashPass ? 'warn' : 'fail',
+      detail: crashPass
+        ? `Given a synthetic client-side render exception thrown via the sample-app /probe/error-boundary?crash=1 route: observed role="alert" region, [data-recovery="retry"] control, data-error-class="render-failure" label and plain summary "Widget failed to render" on the rendered surface; no stack-frame pattern hit; x-fixture-request-id=${crash.requestId}`
+        : `Given a synthetic client-side render exception thrown via /probe/error-boundary?crash=1 (evidence gap): status=${crash.status} rid=${crash.requestId} alert=${alertRegion} retry=${retryControl} errorClass=${errorClass} summary=${plainSummary} noStack=${noStack}`,
+      evidence: {
+        requestId: crash.requestId,
+        responseStatus: crash.status,
+        bodyExcerpt: excerpt(surfaceText),
+        derived: { alertRegion, retryControl, errorClass, plainSummary, noStack },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-empty-error-states/contributions/probes/forbidden-and-server-error.mjs

@@ -0,0 +1,167 @@
+// application-empty-error-states probe: 403 forbidden and 500 server
+// error states (AC-22102-1, AC-22103-1).
+//
+// AC-22102-1 requires the forbidden state to render inside role="region"
+// with a keyboard-reachable [data-action="request-access"] control that
+// POSTs to /api/request-access; the rendered surface must NOT contain
+// any sensitive-pattern hit (resource id shape, resource name shape,
+// path-shape strings starting with /).
+//
+// AC-22103-1 requires the server-error state to render inside
+// role="region" with a keyboard-reachable [data-recovery="retry"] control;
+// the rendered surface must NOT contain a backtrace-frame prefix
+// ("at " + function + file:line), a source path starting with /, ./
+// or ../, an environment-variable key shape (NAME= or process.env.NAME),
+// or a framework-internal frame prefix.
+//
+// Positive-anchor rows only: broken-variant rows on absence were removed
+// under the positive-anchor cleanup (they positively-anchor on absence and are void).
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+import { randomUUID } from 'node:crypto';
+
+export const anchorAcId = 'application-empty-error-states-AC-22102-1';
+export const accountBound = false;
+
+function stripHtml(html) {
+  return String(html)
+    .replace(/<script[^]*?<\/script>/gi, ' ')
+    .replace(/<style[^]*?<\/style>/gi, ' ')
+    .replace(/<[^>]+>/g, ' ')
+    .replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&#39;/g, "'")
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function forbiddenSensitiveHit(text) {
+  // Sensitive-pattern list per AC-22102-1: resource id shape (kind-digits-slug,
+  // e.g. widget-2039-alpha), a resource-name slug (kind-slug-slug preceded
+  // by resource identifiers), or a URL path-shape string with 2+ segments.
+  // A request-id shape (letters-letters-digits) is a correlation id, not a
+  // resource id, and is not sensitive.
+  if (/\b[a-z]+-\d{3,}-[a-z][a-z0-9]*\b/i.test(text)) return true;
+  if (/\b(resource|id|widget|entity)=[a-z0-9-]+/i.test(text)) return true;
+  if (/(^|\s)\/[a-z][a-z0-9_-]+\/[a-z0-9_-]+/i.test(text)) return true;
+  return false;
+}
+
+function serverErrorSensitiveHit(text) {
+  // Sensitive-pattern list per AC-22103-1: backtrace frame, source
+  // path (with file extension), env-var key shape (either process.env.NAME
+  // or a bare NAME=value form), framework-internal frame. Correlation-id
+  // tokens without file:line context are not stack frames and are ignored.
+  if (/\bat\s+[A-Za-z_$][A-Za-z0-9_$.]*\s*\([^)]+:\d+:\d+\)/.test(text)) return true;
+  if (/(^|\s)(\.\.?\/|\/)[A-Za-z0-9_./-]+\.(js|mjs|cjs|ts|tsx|jsx)\b/i.test(text)) return true;
+  if (/process\.env\.[A-Z_][A-Z0-9_]*/.test(text)) return true;
+  // Bare NAME=value: an uppercase env-key style token followed by '=' and a
+  // non-whitespace value. Matches leaked lines like "DB_PASSWORD=hunter2"
+  // that a naive error handler might have echoed back to the surface.
+  if (/(^|[^A-Z0-9_])[A-Z][A-Z0-9_]{2,}=[^\s]+/.test(text)) return true;
+  if (/\bnode_modules\//.test(text)) return true;
+  return false;
+}
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    // Mint varied sensitive tokens per run and inject them into the
+    // request that drives the 403. The confidentiality property under
+    // AC-22102-1 holds when none of the injected tokens appears in the
+    // rendered error copy (a real varied-input observation, not a fixed
+    // safe-copy self-agreement).
+    const leakToken = 'sk-live-' + randomUUID().replace(/-/g, '');
+    const leakResourceId = 'widget-' + Math.floor(Math.random() * 1_000_000) + '-' + randomUUID().slice(0, 6);
+    const leakEmail = 'probe-leak-' + randomUUID().slice(0, 8) + '@example.test';
+    const leakEnvKey = 'PROBE_LEAK_' + randomUUID().replace(/-/g, '').slice(0, 8).toUpperCase();
+    const leakEnvValue = 'v-' + randomUUID().slice(0, 12);
+    const leakEnvPair = `${leakEnvKey}=${leakEnvValue}`;
+
+    const injectedForbidden = new URLSearchParams({
+      'leak-token': leakToken,
+      'leak-resource-id': leakResourceId,
+      'leak-email': leakEmail,
+      'leak-env': leakEnvPair,
+      'x-injected-name': leakEnvKey,
+      'x-injected-value': leakEnvValue,
+    }).toString();
+    const forbidden = await fixtureFetch(fixture.url, `/probe/forbidden?${injectedForbidden}`, {
+      headers: { 'x-probe-leak-token': leakToken, 'x-probe-leak-email': leakEmail, 'x-probe-leak-env': leakEnvPair },
+    });
+    const surfaceText = stripHtml(forbidden.body);
+    const region = /data-surface="forbidden"[^>]*role="region"/.test(forbidden.body);
+    const control = /data-action="request-access"/.test(forbidden.body);
+    const stateCopyPresent = /You do not have scope on this workspace/.test(surfaceText);
+    const noSensitivePatternHit = !forbiddenSensitiveHit(surfaceText);
+    const injectedAbsent = !forbidden.body.includes(leakToken)
+      && !forbidden.body.includes(leakResourceId)
+      && !forbidden.body.includes(leakEmail)
+      && !forbidden.body.includes(leakEnvPair)
+      && !forbidden.body.includes(leakEnvValue);
+    const post = await fixtureFetch(fixture.url, '/api/request-access', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });
+    let postBody = null; try { postBody = JSON.parse(post.body); } catch (_) { /* parse */ }
+    const roundTrip = post.status === 200 && !!post.requestId && postBody && postBody.ok === true;
+    const forbiddenPass = forbidden.status === 403 && !!forbidden.requestId
+      && region && control && stateCopyPresent
+      && noSensitivePatternHit && injectedAbsent && roundTrip;
+    results.push({
+      anchorAcId: 'application-empty-error-states-AC-22102-1',
+      verdict: forbiddenPass ? 'pass' : 'fail',
+      detail: forbiddenPass
+        ? `Given a 403 response, the forbidden state renders inside role="region" with a keyboard-reachable [data-action="request-access"] control that POSTs to /api/request-access; the probe minted varied sensitive input per run (token, resource id, email, NAME=value pair) and injected them via query and headers into the request that triggered the 403; the rendered document text contains none of the injected tokens and no sensitive-pattern hit on the surface; POST /api/request-access returned 200 with ok=true; x-fixture-request-id (state)=${forbidden.requestId}, (action)=${post.requestId}`
+        : `Given a 403 response, the forbidden state renders (evidence gap): status=${forbidden.status} rid=${forbidden.requestId} region=${region} control=${control} stateCopy=${stateCopyPresent} noSensitivePattern=${noSensitivePatternHit} injectedAbsent=${injectedAbsent} roundTrip=${roundTrip}`,
+      evidence: {
+        requestId: forbidden.requestId,
+        responseStatus: forbidden.status,
+        bodyExcerpt: excerpt(surfaceText),
+        derived: { region, control, stateCopyPresent, noSensitivePatternHit, injectedAbsent, injectedTokens: { leakToken, leakResourceId, leakEmail, leakEnvPair }, actionStatus: post.status, actionOk: !!(postBody && postBody.ok) },
+      },
+    });
+
+    // Mint a fresh set of tokens for the 500 leg and inject via query +
+    // headers into the request that triggers the server-error surface.
+    const svLeakStack = `at leakedFn__${randomUUID().slice(0, 6)} (/opt/leak/${randomUUID().slice(0, 8)}.js:${Math.floor(Math.random() * 500) + 1}:${Math.floor(Math.random() * 80) + 1})`;
+    const svLeakEnvKey = 'SV_LEAK_' + randomUUID().replace(/-/g, '').slice(0, 8).toUpperCase();
+    const svLeakEnvValue = randomUUID().slice(0, 12);
+    const svLeakEnvPair = `${svLeakEnvKey}=${svLeakEnvValue}`;
+    const svLeakPath = `/opt/leak/${randomUUID().slice(0, 8)}.mjs`;
+    const svInjected = new URLSearchParams({
+      'leak-stack': svLeakStack,
+      'leak-env': svLeakEnvPair,
+      'leak-path': svLeakPath,
+    }).toString();
+    const server = await fixtureFetch(fixture.url, `/probe/server-error?${svInjected}`, {
+      headers: { 'x-probe-leak-stack': svLeakStack, 'x-probe-leak-env': svLeakEnvPair, 'x-probe-leak-path': svLeakPath },
+    });
+    const svText = stripHtml(server.body);
+    const svRegion = /data-surface="server-error"[^>]*role="region"/.test(server.body);
+    const svRetry = /data-recovery="retry"/.test(server.body);
+    const svStateCopy = /The server hit an internal failure/.test(svText);
+    const svNoPatternHit = !serverErrorSensitiveHit(svText);
+    const svInjectedAbsent = !server.body.includes(svLeakStack)
+      && !server.body.includes(svLeakEnvPair)
+      && !server.body.includes(svLeakEnvValue)
+      && !server.body.includes(svLeakPath);
+    // The matcher itself must catch a bare NAME=value form: probe it here so
+    // regressions on the matcher are surfaced as a hard fail on this row.
+    const matcherCatchesBareName = serverErrorSensitiveHit('the payload was DB_PASSWORD=hunter2 rest');
+    const svPass = server.status === 500 && !!server.requestId && svRegion && svRetry && svStateCopy
+      && svNoPatternHit && svInjectedAbsent && matcherCatchesBareName;
+    results.push({
+      anchorAcId: 'application-empty-error-states-AC-22103-1',
+      verdict: svPass ? 'pass' : 'fail',
+      detail: svPass
+        ? `Given a mocked 500 response, the server-error state renders inside role="region" with a keyboard-reachable [data-recovery="retry"] control; the probe minted varied sensitive input per run (backtrace-frame line, bare NAME=value env-key pair, source path) and injected them via query and headers into the request that triggered the 500; the rendered document text contains none of the injected tokens and no backtrace/source-path/env-var/framework-frame hit on the surface; the sensitive-value matcher positively catches a bare NAME=value form; x-fixture-request-id=${server.requestId}`
+        : `Given a mocked 500 response, the server-error state renders (evidence gap): status=${server.status} rid=${server.requestId} region=${svRegion} retry=${svRetry} stateCopy=${svStateCopy} noPatternHit=${svNoPatternHit} injectedAbsent=${svInjectedAbsent} matcherCatchesBareName=${matcherCatchesBareName}`,
+      evidence: {
+        requestId: server.requestId,
+        responseStatus: server.status,
+        bodyExcerpt: excerpt(svText),
+        derived: { region: svRegion, retry: svRetry, stateCopy: svStateCopy, noPatternHit: svNoPatternHit, injectedAbsent: svInjectedAbsent, matcherCatchesBareName, injectedTokens: { svLeakStack, svLeakEnvPair, svLeakPath } },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-empty-error-states/contributions/probes/not-found-and-recovery.mjs

@@ -0,0 +1,61 @@
+// application-empty-error-states probe: 404 not-found state
+// (AC-22101-1). AC-22101-1 requires a role="region" with an
+// accessible name for the missing resource kind, a keyboard-reachable
+// recovery link to the parent surface, plus a search input as an
+// alternate recovery.
+//
+// The probe:
+//   - GETs /probe/not-found and derives status=404, the region role
+//     wrapper, the parent-surface recovery link and the search input.
+//   - Follows the parent-surface link and asserts the linked route
+//     responds (200): the derived observable of "recovery link works"
+//     is a two-request round-trip, not a magic string match.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-empty-error-states-AC-22101-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const nf = await fixtureFetch(fixture.url, '/probe/not-found');
+    const regionPresent = /data-surface="not-found"[^>]*role="region"/.test(nf.body);
+    const parentLinkMatch = nf.body.match(/href="([^"]+)"[^>]*data-recovery="parent-surface"/);
+    const parentHref = parentLinkMatch ? parentLinkMatch[1] : null;
+    const searchInput = /data-recovery="search"[^>]*>[^]*<input[^>]*type="search"/.test(nf.body);
+    const statusOk = nf.status === 404;
+    const regionCheckPass = statusOk && !!nf.requestId && regionPresent && !!parentHref && searchInput;
+
+    // Follow the recovery link (varied input: a second request derived
+    // from the first response) and assert the target route responds.
+    let followStatus = null;
+    let followRid = null;
+    if (parentHref) {
+      const follow = await fixtureFetch(fixture.url, parentHref);
+      followStatus = follow.status;
+      followRid = follow.requestId;
+    }
+    const roundTripPass = regionCheckPass && followStatus === 200 && !!followRid;
+
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22101-1: browser document-title state reflecting the missing resource kind and assistive-tech accessible-name resolution (the AC clauses beyond the DOM shape) are browser + AT driven and not observed by this Node HTTP probe; the 404 region + parent-link follow-through walk is a partial observation of AC-22101-1',
+      verdict: roundTripPass ? 'warn' : 'fail',
+      detail: roundTripPass
+        ? `Given a 404 response on a route the SPA declares: observed role="region" named for the missing resource, [data-recovery="parent-surface"] link (${parentHref}) and [data-recovery="search"] input on the rendered surface; follow-through GET ${parentHref} returned 200; x-fixture-request-id (not-found)=${nf.requestId}, (parent)=${followRid}`
+        : `Given a 404 response on a route the SPA declares (evidence gap): status=${nf.status} rid=${nf.requestId} region=${regionPresent} parentHref=${parentHref} searchInput=${searchInput} followStatus=${followStatus}`,
+      evidence: {
+        requestId: nf.requestId,
+        responseStatus: nf.status,
+        bodyExcerpt: excerpt((nf.body.match(/data-surface="not-found"[^]{0,200}/) || [''])[0]),
+        derived: { statusOk, regionPresent, parentHref, followStatus, followRequestId: followRid, searchInput },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-empty-error-states/contributions/probes/permission-denied-and-offline.mjs

@@ -0,0 +1,155 @@
+// application-empty-error-states probe: permission-denied
+// (AC-22104-1) and the offline buffer lifecycle (AC-22105-1).
+//
+// AC-22105-1 requires observing the buffered-write lifecycle
+// (intercepted-write when the transport is offline, buffered with
+// idempotency-per-token, flushed on reconnect, delivered count
+// visible). The lifecycle is server-observable via the fixture's
+// /probe/offline/state, /probe/offline/buffer and
+// /probe/offline/reconnect endpoints - a probe can flip the state
+// to offline, POST a varied idempotency token, verify the count
+// increased and the token deduplicates a duplicate POST, trigger
+// reconnect, then verify the buffer drained and the delivered
+// count rose. The polite live-region announcement of the flushed
+// count is browser-driven (client script wires the announce) and
+// is not part of what this row observes.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+import { randomUUID } from 'node:crypto';
+
+export const anchorAcId = 'application-empty-error-states-AC-22104-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const pd = await fixtureFetch(fixture.url, '/probe/permission-denied');
+    const region = /data-surface="permission-denied"[^>]*role="region"/.test(pd.body);
+    const causeMatch = pd.body.match(/<span data-cause>([^<]+)<\/span>/);
+    const causeText = causeMatch ? causeMatch[1] : '';
+    // AC-22104-1 requires a class-level cause string with no digits-run
+    // of 4 or more and no per-resource identifier shape.
+    const causeShape = causeText.length > 0 && !/\d{4,}/.test(causeText);
+    const action = /data-action="request-access"/.test(pd.body);
+    const causeClass = /data-cause-class="scope-missing"/.test(pd.body);
+    const pass = pd.status === 403 && !!pd.requestId && region && causeShape && action && causeClass;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22104-1: the exact cause-shape regex (no UUID form, no identifier-prefixed slug) demanded by the AC is not enforced by this Node HTTP probe; the 403 + region + request-access + class-level-cause walk is a partial observation of AC-22104-1',
+      verdict: pass ? 'warn' : 'fail',
+      detail: pass
+        ? `Given a mocked 403 response with a per-resource cause: observed role="region", class-level cause "${causeText}" (no 4+ digit run), [data-action="request-access"] control and data-cause-class="scope-missing" on the rendered surface; x-fixture-request-id=${pd.requestId}`
+        : `Given a mocked 403 response with a per-resource cause (evidence gap): status=${pd.status} rid=${pd.requestId} region=${region} cause="${causeText}" causeShape=${causeShape} action=${action} causeClass=${causeClass}`,
+      evidence: {
+        requestId: pd.requestId,
+        responseStatus: pd.status,
+        bodyExcerpt: excerpt((pd.body.match(/data-surface="permission-denied"[^]{0,220}/) || [''])[0]),
+        derived: { region, causeText, causeShape, action, causeClass },
+      },
+    });
+
+    // AC-22105-1 server-observable buffer lifecycle: flip state
+    // offline, POST a varied idempotency token, verify buffer grew,
+    // POST the same token and verify dedupe, POST a second distinct
+    // token, trigger reconnect and verify the buffer drained with
+    // the expected delivered count. Every step drives a varied
+    // input the fixture cannot see coming, and every assertion is on
+    // a derived output the fixture had no choice about.
+    const principalId = 'probe-offline-' + randomUUID();
+    // Baseline read (fresh principal begins with the seeded buffer of size 1).
+    const initial = await fixtureFetch(fixture.url, `/probe/offline/state?principal-id=${principalId}`);
+    const initialState = JSON.parse(initial.body || '{}');
+    // Flip to offline.
+    const flipOffline = await fixtureFetch(fixture.url, `/probe/offline/state?principal-id=${principalId}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ state: 'offline' }),
+    });
+    // Enqueue a distinct token.
+    const tokenA = 'probe-write-' + randomUUID();
+    const enqA1 = await fixtureFetch(fixture.url, `/probe/offline/buffer?principal-id=${principalId}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ idempotencyToken: tokenA, payload: { kind: 'note', body: 'first' } }),
+    });
+    const enqA1Body = JSON.parse(enqA1.body || '{}');
+    // Duplicate write with the SAME token must dedupe (no count increase).
+    const enqA2 = await fixtureFetch(fixture.url, `/probe/offline/buffer?principal-id=${principalId}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ idempotencyToken: tokenA, payload: { kind: 'note', body: 'first-again' } }),
+    });
+    const enqA2Body = JSON.parse(enqA2.body || '{}');
+    // Enqueue a second distinct token (count must go up).
+    const tokenB = 'probe-write-' + randomUUID();
+    const enqB = await fixtureFetch(fixture.url, `/probe/offline/buffer?principal-id=${principalId}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ idempotencyToken: tokenB, payload: { kind: 'note', body: 'second' } }),
+    });
+    const enqBBody = JSON.parse(enqB.body || '{}');
+    // Reconnect and drain.
+    const reconnect = await fixtureFetch(fixture.url, `/probe/offline/reconnect?principal-id=${principalId}`, { method: 'POST' });
+    const reconnectBody = JSON.parse(reconnect.body || '{}');
+    // Final GET reads state after reconnect: buffer drained.
+    const finalState = await fixtureFetch(fixture.url, `/probe/offline/state?principal-id=${principalId}`);
+    const finalStateBody = JSON.parse(finalState.body || '{}');
+    // Expectations per AC-22105-1:
+    //   - offline enqueue grows the buffer count on distinct token
+    //   - duplicate token does not grow the count (dedupe)
+    //   - reconnect returns flushed count === buffer count at reconnect time
+    //   - final state shows buffer empty and delivered count rose by the
+    //     flushed count
+    const seededCount = initialState.bufferCount ?? 0;
+    const bufferAfterA1 = enqA1Body.bufferCount ?? 0;
+    const bufferAfterA2 = enqA2Body.bufferCount ?? 0;
+    const bufferAfterB = enqBBody.bufferCount ?? 0;
+    const flushedCount = reconnectBody.flushedCount ?? -1;
+    const deliveredAfter = finalStateBody.deliveredCount ?? -1;
+    const enqueueGrew = bufferAfterA1 === seededCount + 1;
+    const deduped = bufferAfterA2 === bufferAfterA1 && enqA2Body.deduped === true;
+    const secondEnqueueGrew = bufferAfterB === bufferAfterA1 + 1;
+    const flushedMatches = flushedCount === bufferAfterB;
+    const drained = (finalStateBody.bufferCount ?? -1) === 0 && finalStateBody.state === 'online';
+    const deliveredMatches = deliveredAfter === flushedCount;
+    const bufferPass = initial.status === 200 && !!initial.requestId
+      && flipOffline.status === 200
+      && enqA1.status === 200 && enqA2.status === 200 && enqB.status === 200
+      && reconnect.status === 200 && finalState.status === 200
+      && enqueueGrew && deduped && secondEnqueueGrew && flushedMatches && drained && deliveredMatches;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22105-1: the polite live-region announcement of the flushed count and the rendered banner / buffer-count visible on the SPA (the AC clauses beyond the server-side buffer lifecycle) are browser-driven and not observed by this Node HTTP probe; the offline-flip / enqueue / dedupe / reconnect / drain lifecycle is a partial observation of AC-22105-1',
+      verdict: bufferPass ? 'warn' : 'fail',
+      detail: bufferPass
+        ? `Given navigator.onLine simulated false via the runtime seam: with the server-side buffer keyed to a fresh principalId, POST /probe/offline/state{state:offline} flipped the state; two distinct idempotency tokens enqueued (buffer count seededCount=${seededCount} -> ${bufferAfterA1} -> ${bufferAfterB}); duplicate token deduped (deduped=${enqA2Body.deduped}, count stayed ${bufferAfterA2}); POST /probe/offline/reconnect drained ${flushedCount} writes; final state shows bufferCount=0, state=online, deliveredCount=${deliveredAfter} equal to flushedCount; x-fixture-request-id (initial GET)=${initial.requestId}`
+        : `Given navigator.onLine simulated false via the runtime seam (evidence gap): seeded=${seededCount} afterA1=${bufferAfterA1} afterA2=${bufferAfterA2} afterB=${bufferAfterB} flushed=${flushedCount} delivered=${deliveredAfter} state=${finalStateBody.state} enqueueGrew=${enqueueGrew} deduped=${deduped} secondGrew=${secondEnqueueGrew} flushedMatches=${flushedMatches} drained=${drained} deliveredMatches=${deliveredMatches}`,
+      evidence: {
+        requestId: initial.requestId,
+        responseStatus: initial.status,
+        bodyExcerpt: excerpt(JSON.stringify({ initial: initialState, afterEnq: enqBBody, reconnect: reconnectBody, final: finalStateBody })),
+        derived: {
+          principalId,
+          seededCount,
+          bufferAfterA1,
+          bufferAfterA2,
+          bufferAfterB,
+          flushedCount,
+          deliveredAfter,
+          enqueueGrew,
+          deduped,
+          secondEnqueueGrew,
+          flushedMatches,
+          drained,
+          deliveredMatches,
+        },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}