rcf-lite 0.26.0 → 0.28.0

package/blueprints/application-forms-wizard/contributions/user-stories/application-forms-wizard-us-24102.json

@@ -13,7 +13,32 @@
       "id": "AC-24102-1",
       "testable": true,
       "scope": "runtime",
-      "description": "On the wizard step route, focusing a field then blurring it without a valid entry renders a field-level error message referenced by aria-describedby without setting aria-invalid=\"true\" before the first submit (the pack asserts the message element is present and referenced). After a submit attempt fails on the field, subsequent input events on the same field update the message text on every change (the pack drives a first-submit-fail then a valid input and reads the message element's textContent transitioning to empty). On the next submit the engine rebuilds the error set from scratch (the pack asserts a previously failing field that has been corrected no longer appears in the summary)."
+      "description": "On the wizard step route, focusing a field then blurring it without a valid entry renders a field-level error message referenced by aria-describedby without setting aria-invalid=\"true\" before the first submit (the pack asserts the message element is present and referenced). After a submit attempt fails on the field, subsequent input events on the same field update the message text on every change (the pack drives a first-submit-fail then a valid input and reads the message element's textContent transitioning to empty). On the next submit the engine rebuilds the error set from scratch (the pack asserts a previously failing field that has been corrected no longer appears in the summary).",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-24102-2",
+      "description": "On the first attempted advance, every failing field renders its own inline error bound via aria-describedby and the top-of-page error summary renders with one link per failing field; on subsequent change the field re-validates but the top-of-page summary is only re-rendered on the next attempted advance.",
+      "given": "a step with three failing fields and the principal attempts to advance",
+      "when": "the error summary renders",
+      "then": "each failing field carries an aria-describedby-bound inline error and the summary carries one link per failing field",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://design-system.service.gov.uk/components/error-summary/",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-24102-3",
+      "description": "A field whose validator raises (an unexpected exception in a custom validator) refuses to persist an answer for that field, surfaces the exception class in an inline error and never blocks other fields from advancing on the same submit if they pass.",
+      "given": "a validator that throws on a specific field",
+      "when": "the principal advances",
+      "then": "the throwing fields error is surfaced inline naming the exception class and other passing fields still submit",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +50,5 @@
     "contract:validation-timing"
   ],
   "createdAt": "2026-09-06T18:00:00Z",
-  "updatedAt": "2026-09-06T18:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-forms-wizard/contributions/user-stories/application-forms-wizard-us-24103.json

@@ -13,7 +13,26 @@
       "id": "AC-24103-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a submit refusal on the wizard step, the rendered surface exposes [data-surface=\"error-summary\"] with a heading (h2 or role=heading), one anchor element per failed field with href pointing at the field's id, and every failed field carries aria-invalid=\"true\" plus aria-describedby referencing its per-field error message. Focus after submit lands on the summary heading (document.activeElement matches the summary heading selector). The pack drives /step/2 with empty required inputs, submits and reads the summary heading, the anchor href list, the field aria-invalid attribute and the active-element selector."
+      "description": "Given a submit refusal on the wizard step, the rendered surface exposes [data-surface=\"error-summary\"] with a heading (h2 or role=heading), one anchor element per failed field with href pointing at the field's id, and every failed field carries aria-invalid=\"true\" plus aria-describedby referencing its per-field error message. Focus after submit lands on the summary heading (document.activeElement matches the summary heading selector). The pack drives /step/2 with empty required inputs, submits and reads the summary heading, the anchor href list, the field aria-invalid attribute and the active-element selector. (WCAG 3.3.1 verified against https://www.w3.org/TR/WCAG22/#error-identification, 2026-09-10.)",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/ARIA/apg/practices/hiding-and-updating-content/",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-24103-2",
+      "description": "On submit refusal, keyboard focus lands on the error summary at document position, and activating a summary link moves focus to the failing field.",
+      "given": "a submit refusal with the error summary rendered",
+      "when": "focus is queried and a summary link is activated",
+      "then": "focus lands on the summary, then on the failing field after link activation",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://design-system.service.gov.uk/components/error-summary/",
+        "verifiedOn": "2026-09-10"
+      }
     }
   ],
   "tacIds": [
@@ -24,5 +43,5 @@
     "contract:error-summary"
   ],
   "createdAt": "2026-09-06T18:00:00Z",
-  "updatedAt": "2026-09-06T18:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-forms-wizard/contributions/user-stories/application-forms-wizard-us-24104.json

@@ -13,7 +13,18 @@
       "id": "AC-24104-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given every step is Completed, /summary renders [data-surface=\"summary-review\"] with one [data-summary-list-section] per step; each section holds a <dl> summary list carrying [data-summary-row] entries with a <dt> label and a <dd> value; every row carries a [data-recovery=\"change\"] link whose href routes back to the step. After clicking a Change link, editing that field and saving, the operator returns to /summary and every other row's value is preserved verbatim. The pack drives /summary, reads the row count and dl structure, follows one Change link, updates one field, saves, and diffs the summary rows before and after to prove only the edited row changed."
+      "description": "Given every step is Completed, /summary renders [data-surface=\"summary-review\"] with one [data-summary-list-section] per step; each section holds a <dl> summary list carrying [data-summary-row] entries with a <dt> label and a <dd> value; every row carries a [data-recovery=\"change\"] link whose href routes back to the step. After clicking a Change link, editing that field and saving, the operator returns to /summary and every other row's value is preserved verbatim. The pack drives /summary, reads the row count and dl structure, follows one Change link, updates one field, saves, and diffs the summary rows before and after to prove only the edited row changed.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-24104-2",
+      "description": "The summary-review surface renders one row per step with a Change link back to the owning step; a submit from summary that fails leaves the summary intact and surfaces the applied error-summary at the top with no data loss.",
+      "given": "the summary-review surface and a submit that returns a non-2xx",
+      "when": "the failure is reported",
+      "then": "the summary remains rendered, an error summary appears at the top, and no answers are lost from the DOM state",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +36,5 @@
     "contract:summary-review"
   ],
   "createdAt": "2026-09-06T18:00:00Z",
-  "updatedAt": "2026-09-06T18:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-forms-wizard/contributions/user-stories/application-forms-wizard-us-24105.json

@@ -13,7 +13,38 @@
       "id": "AC-24105-1",
       "testable": true,
       "scope": "runtime",
-      "description": "On ?draft-store=server, entering an answer on step 1 and advancing issues a POST /drafts request whose body carries the operator identifier, the wizard slug, the step slug and the answer field; a subsequent GET /drafts on the same operator returns the persisted answer (the pack drives step 1, types into a field, advances, then re-issues a fresh GET /drafts and reads the JSON body). On ?draft-store=local, the same input path writes into window.localStorage under a namespaced key (draft:<wizard-slug>:<step-slug>) and renders a [data-sync-tick] element carrying an ISO-8601 timestamp updated on every write. When both transports are absent (?draft-store=none) the pack fails at severity block naming the missing transport."
+      "description": "On ?draft-store=server, entering an answer on step 1 and advancing issues a POST /drafts request whose body carries the operator identifier, the wizard slug, the step slug and the answer field; a subsequent GET /drafts on the same operator returns the persisted answer (the pack drives step 1, types into a field, advances, then re-issues a fresh GET /drafts and reads the JSON body). On ?draft-store=local, the same input path writes into window.localStorage under a namespaced key (draft:<wizard-slug>:<step-slug>) and renders a [data-sync-tick] element carrying an ISO-8601 timestamp updated on every write. When both transports are absent (?draft-store=none) the pack fails at severity block naming the missing transport.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-24105-2",
+      "description": "When the draft transport is server-side and the POST returns a non-2xx or times out, the wizard preserves in-memory answers, surfaces a visible unsaved banner (data-draft-state=unsaved) and never emits the sync-tick indicator; the retry stays keyboard-reachable.",
+      "given": "server-side draft transport applied and the POST returns a non-2xx or times out",
+      "when": "the principal triggers a save",
+      "then": "the answers stay in memory, a data-draft-state=unsaved banner renders, no data-draft-state=synced tick appears and a retry control is keyboard-reachable",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-24105-3",
+      "description": "When the draft transport is client-side localStorage and the write is denied (quota exceeded or a privacy-mode denial), the wizard preserves in-memory answers, surfaces a visible unsaved banner naming the storage refusal and offers the applied fallback (server-side if configured, otherwise a plain in-session mode).",
+      "given": "client-side localStorage draft transport and a denied setItem",
+      "when": "the principal triggers a save",
+      "then": "the answers stay in memory, a data-draft-state=unsaved banner names the storage refusal and any configured fallback is offered",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-24105-4",
+      "description": "When the draft hydrate on load returns a shape the wizard does not recognise (missing stepStates or malformed answers), the wizard starts fresh, surfaces a data-hydrate-failed=true banner naming the reason and never applies partial answers.",
+      "given": "a stored draft whose shape the wizard cannot parse",
+      "when": "the wizard loads",
+      "then": "the wizard starts fresh, data-hydrate-failed=true is emitted with the reason and no partial answers are pre-filled",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -24,5 +55,5 @@
     "contract:save-and-return"
   ],
   "createdAt": "2026-09-06T18:00:00Z",
-  "updatedAt": "2026-09-06T18:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-forms-wizard/contributions/user-stories/application-forms-wizard-us-24106.json

@@ -13,7 +13,22 @@
       "id": "AC-24106-1",
       "testable": true,
       "scope": "runtime",
-      "description": "On the ?nav=linear branch, task-list rows whose [data-step-state] is Cannot start yet render as non-anchor spans (no clickable href) and the pack asserts a click on the row does not change the URL. On the ?nav=free branch every row renders as an anchor and a click on any row navigates to that step's route. ADR-2501 records the elicit and the shipped default is linear."
+      "description": "On the ?nav=linear branch, task-list rows whose [data-step-state] is Cannot start yet render as non-anchor spans (no clickable href) and the pack asserts a click on the row does not change the URL. On the ?nav=free branch every row renders as an anchor and a click on any row navigates to that step's route. ADR-2501 records the elicit and the shipped default is linear.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-24106-2",
+      "description": "Alternative step-indicator contracts drawn from the closed set owned by `ADR-2503.decision` each render exactly the contract for the elicited option; a value outside the owned set refuses at apply with STEP_INDICATOR_UNKNOWN naming the value.",
+      "given": "a project elicits a step-indicator outside the closed set",
+      "when": "apply runs",
+      "then": "apply exits with a non-zero code and STEP_INDICATOR_UNKNOWN names the value; each option in the set owned by `ADR-2503.decision` renders its own contract",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "adrId": "ADR-2503-application-forms-wizard-step-indicator",
+        "field": "decision"
+      }
     }
   ],
   "tacIds": [
@@ -24,5 +39,5 @@
     "case:linear-vs-free-navigation"
   ],
   "createdAt": "2026-09-06T18:00:00Z",
-  "updatedAt": "2026-09-06T18:00:00Z"
-}
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-forms-wizard/contributions/user-stories/application-forms-wizard-us-24107.json

@@ -13,7 +13,28 @@
       "id": "AC-24107-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given at least one draft persisted per REQ-005, /in-progress renders [data-surface=\"in-progress-list\"] with one [data-wizard-row] per draft carrying the wizard title, the step slug the operator was on and a [data-recovery=\"resume\"] link whose href routes back to the wizard's task-list surface. The row count matches the number of drafts held in the draft store."
+      "description": "Given at least one draft persisted per REQ-005, /in-progress renders [data-surface=\"in-progress-list\"] with one [data-wizard-row] per draft carrying the wizard title, the step slug the operator was on and a [data-recovery=\"resume\"] link whose href routes back to the wizard's task-list surface. The row count matches the number of drafts held in the draft store.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-24107-2",
+      "description": "When the in-progress list read returns a non-2xx or times out, the surface renders the last cached list (if any) with a fetch-failed banner and an inline retry; drafts owned by other principals never appear in the list even on a stale cache.",
+      "given": "a server-side draft list whose read returns a non-2xx or times out",
+      "when": "the in-progress list surface renders",
+      "then": "the last cached list renders with a fetch-failed banner, an inline retry is keyboard-reachable and no cross-principal draft appears",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-24107-3",
+      "description": "A draft in the list is only shown to its owning principal; a request from another principal for the same draft id refuses at the applied auth boundary and never renders the draft on the list.",
+      "given": "a draft owned by principal A and a request from principal B",
+      "when": "the list surface renders for principal B",
+      "then": "the draft is not present in the list and any direct URL for principal B refuses at the auth boundary",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -24,5 +45,5 @@
     "case:in-progress-list"
   ],
   "createdAt": "2026-09-06T18:00:00Z",
-  "updatedAt": "2026-09-06T18:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-forms-wizard/contributions/user-stories/application-forms-wizard-us-24108.json

@@ -13,7 +13,18 @@
       "id": "AC-24108-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given zero drafts in the draft store, /in-progress renders [data-surface=\"empty-list\"] (the empty-list wrapper contributed by application-empty-error-states) with a [data-recovery=\"create\"] control whose href routes to the first step of a fresh wizard. The pack asserts the wrapper and the control are present on the honest render and refuses when either is missing."
+      "description": "Given zero drafts in the draft store, /in-progress renders [data-surface=\"empty-list\"] (the empty-list wrapper contributed by application-empty-error-states) with a [data-recovery=\"create\"] control whose href routes to the first step of a fresh wizard. The pack asserts the wrapper and the control are present on the honest render and refuses when either is missing.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-24108-2",
+      "description": "When application-empty-error-states is not applied, the empty in-progress list renders a minimal inline empty message inside the wizards own surface rather than crashing or leaving a blank region; a break that removes the fallback fails the pack.",
+      "given": "application-empty-error-states not applied and no drafts held",
+      "when": "the in-progress list surface renders",
+      "then": "a minimal inline empty message renders and no blank region appears",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +36,5 @@
     "consumes:application-empty-error-states"
   ],
   "createdAt": "2026-09-06T18:00:00Z",
-  "updatedAt": "2026-09-06T18:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-forms-wizard/probe-packs/application-forms-wizard.pack.mjs

@@ -13,9 +13,9 @@
 //              on ?draft-store=local; the ?draft-store=none branch
 //              proves the missing-transport refusal on the fixture)
 //
-// Every check drives the real Playwright browser the T-0 runner
+// Every check drives the real Playwright browser the runner
 // injects. URLs are composed by the withUrl(runtimeUrl, path)
-// helper per the round 3 T-3 fix train; no bare string
+// helper that joins runtime URL and path safely; no bare string
 // concatenation.
 //
 // Sample-app fixture:
@@ -42,7 +42,7 @@ export default {
   // Applies to any FBS that realises the task-list TAC or whose
   // navModel routes name an operator-configured wizard path.
   // References BOTH tacIds AND route per the loader source-scan
-  // rule (T-0 AC-1701-3, cross-check with authoring standard 8c).
+  // rule (AC-1701-3, cross-check with authoring standard 8c).
   appliesTo: ({ fbs }) => {
     const routes = fbs?.designStage?.navModel?.routes ?? [];
     const tacIds = fbs?.contextRequirements?.tacIds ?? [];

package/blueprints/application-notifications-in-app/CHANGELOG.md

@@ -1,9 +1,74 @@
 # application-notifications-in-app CHANGELOG
 
-## 1.0.0 (visual round T-4, spec 2026-09-04)
+## 1.2.8 - 2026-09-12
 
-- First ratified version of the shelf's application-notifications-in-app blueprint. Five REQs (live-region preseeding on every declared route; transient toast contract with priority-to-role mapping, one-shot announcement and timeout floor; notification centre inbox with retention and acknowledge round-trip; per-user preferences UI with category silence and sibling delegation; delivery-attempt log with operator-readable rows), eight USs binding runtime-observable ACs plus three cross-cutting cases (page load with backlog, background event, disjoint-content contract), three TACs (live-region wrappers with the toast factory; centre inbox with retention and acknowledge round-trip; preferences UI with sibling delegation), three ADRs (priority-to-role mapping polite/status vs assertive/alert per WCAG 4.1.3 and the ARIA APG alert pattern; six-second toast timeout floor per WCAG 2.2.1 with elicited overrides above the floor; thirty-day centre retention window with elicited overrides). No new global topics.
-- Reserves the `application-notifications-` family prefix for the sibling channel blueprints the shelf will grow into (`-email`, `-push`, `-webhook`) as a doc-only reservation on the blueprint README and every applying blueprint's `docs/topics.md` shelf band registry per Baz decision 2026-09-04 ("we might support more types of notifications - be clear in the name what these ones are").
-- Ships `probe-packs/application-notifications-in-app.pack.mjs`: three browser-verify checks anchored to blueprint AC ids, every check carrying a description field per spec section 9. `AC-20101-1` live-region preseeded on every declared route (wrappers present AND empty at load, enumerated by `[data-live-region]`). `AC-20102-1` transient toast contract with priority-to-role mapping and timeout measured against the ADR-2102 six-second floor via `data-shown-at`/`data-dismissed-at` timestamps (no six-second sleep in the pack; bounded polling). `AC-20103-1` centre acknowledge round-trip enumerated by `data-notification-id` (per-element attribute per T-3 gate discipline), reconciled through both `window.__notificationFetches` and the server-side request log. Fourth blueprint on the shelf that ships a Playwright probe pack under the T-0 runner extension.
+- Fixture centre now carries the active query-scoped break switch into the served acknowledge form action: `/notifications-centre?break=ack` renders each per-item form with `action="/actions/acknowledge-notification?notification-id=<id>&break=ack"`, so a JS-off native form submission originating from a broken centre reaches the same broken handler branch as the API and cannot escape the `ack` refusal. Fixture README lists `POST /actions/acknowledge-notification` alongside the JSON API in the routes table and states both refuse under `?break=ack` (or `PROBE_BREAK=ack`), and the `?break=ack` row in the query-switch table now names both HTTP 502 error codes (`ACKNOWLEDGE_ROUND_TRIP_REFUSED` on the JSON API, `ACKNOWLEDGE_FORM_REFUSED` on the form action). The `/actions/acknowledge-notification` route comment corrected: with JS off the native form submission POSTs to the form action, with JS on the client script intercepts the click, calls `preventDefault` on the form, and drives the JSON API instead (previous wording claimed JS-on activation POSTs to the form route). centre-acknowledge-round-trip probe wording ("next principal load"), row detail ("next principal load"), and the 1.2.7 CHANGELOG line ("next principal load") now say "next served load of the centre" - the fixture has no notification-principal key so calling an ordinary refetch a principal load misdescribed the observation.
+
+## 1.2.7 - 2026-09-12
+
+- centre-acknowledge-round-trip AC-20103-1 positive row now observes activation causality through a served progressive-enhancement form action, not a bare API call. Fixture centre wraps each acknowledge button in `<form method="post" action="/actions/acknowledge-notification">` with the notification-id in a hidden input; a new server route accepts the form-encoded submission, flips the delivery-log `acknowledgedAt`, records both an `acknowledge-server` and an `acknowledge-form` entry on `/__requests`, and returns 200 with the applied `acknowledgedAt`; the JS-on client script now calls `preventDefault()` on the button click so only one POST fires per activation (the JSON API path stays for SPA parity). The probe fetches `/notifications-centre`, verifies the form + hidden input for the picked id, SUBMITS the served form action (content-type `application/x-www-form-urlencoded`), verifies the delivery-log flip and the request-log counts, and refetches `/notifications-centre` to observe `data-acknowledged="true"` on the same article on the next served load of the centre (proof that the served control's activation causes the acknowledged state, not just that a hand-crafted API POST does). The companion null-anchored conformance row now narrows to the browser-only same-page in-place DOM mutation the client script performs after fetch resolves (the pack browser check owns that). Fixture `?break=ack` refuses the form action too (`ACKNOWLEDGE_FORM_REFUSED`, HTTP 502) as well as the JSON API, so the anatomy negative-variant assertion continues to drive the probe to fail under `PROBE_BREAK=ack` on both paths.
+
+## 1.2.6 - 2026-09-12
+
+- centre-acknowledge-round-trip upgraded from a null-anchored conformance-only row into TWO rows: a POSITIVE row anchored to AC-20103-1 observing the surface enumeration (per-item `[data-notification-id]` wrappers, matching per-item acknowledge and mark-read controls, exactly one mark-all-read control) AND the server-side round-trip (POST `/api/notifications/acknowledge` returns 200 with the echoed `notificationId`, the delivery-log `acknowledgedAt` for the row flips from null to an ISO timestamp, `/__requests` records exactly one `acknowledge-server` entry), plus a companion CONFORMANCE-ONLY row (null anchor, `limitation` naming AC-20103-1) for the browser-only DOM `data-acknowledged="true"` flip after the fetch resolves. Fixture `?break=ack` extended to also refuse the server-side POST with HTTP 502 `ACKNOWLEDGE_ROUND_TRIP_REFUSED`, so the anatomy negative-variant map now drives the centre-acknowledge probe to fail under `PROBE_BREAK=ack` (added to `brokenExpectations`). Toast-contract row split so AC-20102-1 (browser-only priority-to-role mapping, one-shot announcement, elapsed timeout on `data-shown-at`/`data-dismissed-at`) remains `notObservableHere` without any focus-pause language (that clause is AC-20102-4), and a second null-anchored conformance row names AC-20102-4 in the `limitation` for the focus-pause + dismissal-removal properties (browser-only and unimplemented in the fixture); both rows now carry an evidence object from the fixture shell reachability fetch so the rule-7d shape and the evidence tally accept them. Positive-evidence row shape tightened in the anatomy helper: a positive row now requires a non-empty engine-returned `requestId` AND (a non-empty `bodyExcerpt` OR a non-empty `derived` object); a `{derived:{}}` alone or a `requestId` alone no longer counts, with two new negative-case tests covering the empty-derived and id-only patterns.
+
+## 1.2.5 - 2026-09-12
+
+- Rule-7d shape fix on the centre-acknowledge row: the AC-20103-1 de-claim now carries `anchorAcId: null` and names AC-20103-1 in the `limitation` field per the shipped shape (a `conformanceOnly:true` row must not simultaneously claim an anchor). Fixture README env-var manifest now declares `PROBE_BREAK` (the fixture reads it as an alternate to a per-request `?break=`) and the probe-utils `DECLARED_ENV` list mirrors the addition. Anatomy shape check tightened to reject an anchored `conformanceOnly` row (a positive evidence field no longer bypasses the null-anchor + limitation contract); a new negative-case test constructs an anchored `conformanceOnly` row and asserts the shape helper throws. Product-term usage of "round trip" / "round-trip" (request/response cycle in AC-20103-1 and in the `centre-acknowledge-round-trip` module name) stays as shipped.
+
+## 1.2.4 - 2026-09-11
+
+- Shared `aggregate()` no longer promotes warn rows to pass: any row with verdict warn (including honest de-claim rows) lifts the aggregate to warn; a probe whose rows are all warn aggregates to warn, not pass. Shared teardown propagates a SIGKILL failure through the returned kill() promise instead of swallowing it. centre-acknowledge AC-20103-1 row de-claimed to `conformanceOnly:true` with `verdict:'warn'` and a `limitation` naming the browser-only clause (control activation and DOM `data-acknowledged` mutation are not observed by a Node HTTP probe). toast-contract row keeps `notObservableHere:true` + `verdict:'warn'`; live-region-preseeding stays as a positive-observation row that fails under `?break=preseed`. Anatomy test extended with a negative-variant assertion that the shipped preseed break switch drives the live-region-preseeding aggregate to fail.
+
+## 1.2.3 - 2026-09-11
+
+- toast-contract `notObservableHere` row for AC-20102-1 now emits `verdict:'warn'` (previously `pass`); the aggregate correctly reports amber for the browser-only halves of AC-20102-1 (role mapping, elapsed timeout and focus-pause behaviour on `data-shown-at`/`data-dismissed-at`) rather than a false pass. Anatomy test extended to (a) enumerate the shipped AC/REQ id set from `contributions/user-stories/*.json` and refuse any row whose `anchorAcId` or `notObservableAcId` is not in that set, and (b) accept the conformance-only row shape (null anchor + non-empty `limitation`).
+
+## 1.2.2 - 2026-09-11
+
+- Probes rewritten to observe declared AC properties instead of static constants. live-region-preseeding now enumerates elements by `[data-live-region]` and asserts polite (aria-live="polite", empty) and assertive (role="alert", empty) semantics per AC-20101-1; positive-anchor-on-absence broken-variant row removed. toast-contract row de-claimed to notObservableHere for AC-20102-1 (role mapping, elapsed timeout and focus pausing are client-JS-driven and only observable in a browser); the static timeout-floor constant-echo row is dropped. centre-acknowledge broken-variant shortcut row removed; the positive centre-acknowledge row keeps derived evidence (acknowledgedAt flips null to ISO plus the server-side request log entry). Rule 10 applied to every row detail. Anatomy test extended to accept the notObservableHere row shape (non-empty reason + non-empty anchorAcId) alongside evidence-object and honest-skip. Register cleanup.
+
+
+## 1.2.1 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering 3 properties the fixture engine at `packages/rcf-lite/test/fixtures/probe-pack-application-notifications-in-app/server.js` answers: `live-region-preseeding`, `toast-contract`, `centre-acknowledge-round-trip`. Every response now carries an `x-fixture-request-id` header; probes record the id, the HTTP status and a body excerpt as positive evidence per rule 7d. Fixture README declares every env var the pack reads. Anatomy test at `packages/rcf-lite/test/blueprint/application-notifications-in-app-anatomy.test.js` pins the new pack files and asserts each result carries one of the four 7d evidence shapes.
+
+
+## 1.2.0 (2026-09-10)
+
+### Added
+
+- Five elicits (`timeout`, `retention`, `categories`, `route`, `page-size`) declared on blueprint.json; REQ-006 binds one runtime clause per apply-time answer family.
+- New AC-20105-4 refuses apply with `LOGGING_COMPANION_MISSING` when no logging companion is applied.
+
+### Changed
+
+- `TAC-2102.interfaces.deliveryRowShape` owns the row schema (`deliveryTs`, `priority`, `category`, `outcome`, `correlationId`); AC-20105-1, AC-20105-3 and REQ-005 reference the owner via ownerRef.
+- REQ-001.deliveredBy retargeted to `TAC-2101.interfaces.renderLiveRegions`.
+- REQ-004.deliveredBy retargeted to `TAC-2103.interfaces.renderPreferences`.
+- REQ-005.deliveredBy retargeted to `TAC-2102.writeDeliveryRow`.
+- AC-20102-3 and AC-20102-4 descriptions carry the W3C URL inline alongside the existing vendorCitation object.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 (2026-09-10)
+
+### Added
+
+- Failure-path acceptance criteria on US-20101 (live-region wrappers pre-seeded before any state-driven mount), US-20102 (sub-6s timeout apply refusal with TOAST_TIMEOUT_TOO_SHORT, focused-toast pause per WCAG 2.2.1), US-20103 (non-2xx acknowledgement error toast with unchanged data-acknowledged, paginated fetch failure), US-20104 (failed preference write error toast with toggle rollback, idempotency of retried writes), US-20105 (delivery-row incomplete refusal), US-20106 (page-load backlog failure with cached-row banner), US-20107 (invalid toast payload refusal), US-20108 (invalid priority drop).
+- Vendor citations on the WCAG 2.2.1 Timing Adjustable and status-messages acceptance criteria (verified 2026-09-10).
+
+### Changed
+
+- Every REQ now carries a deliveredBy link into TAC-2101 (live-region), TAC-2102 (centre) or TAC-2103 (preferences).
+- Every AC on every user story now carries an explicit disposition (fixed or template); ACs that observe writeDeliveryRow, renderLiveRegions, renderToast or renderCentre carry ownerRef into the owning TAC field.
+
+## 1.0.0 (visual round, spec 2026-09-04)
+
+- Initial shipped version of the shelf's application-notifications-in-app blueprint. Five REQs (live-region preseeding on every declared route; transient toast contract with priority-to-role mapping, one-shot announcement and timeout floor; notification centre inbox with retention and acknowledge round-trip; per-user preferences UI with category silence and sibling delegation; delivery-attempt log with operator-readable rows), eight USs binding runtime-observable ACs plus three cross-cutting cases (page load with backlog, background event, disjoint-content contract), three TACs (live-region wrappers with the toast factory; centre inbox with retention and acknowledge round-trip; preferences UI with sibling delegation), three ADRs (priority-to-role mapping polite/status vs assertive/alert per WCAG 4.1.3 and the ARIA APG alert pattern; six-second toast timeout floor per WCAG 2.2.1 with elicited overrides above the floor; thirty-day centre retention window with elicited overrides). No new global topics.
+- Reserves the `application-notifications-` family prefix for the sibling channel blueprints the shelf will grow into (`-email`, `-push`, `-webhook`) as a doc-only reservation on the blueprint README and every applying blueprint's `docs/topics.md` shelf band registry per the 2026-09-04 shelf decision to make the transport type explicit in the blueprint name.
+- Ships `probe-packs/application-notifications-in-app.pack.mjs`: three browser-verify checks anchored to blueprint AC ids, every check carrying a description field per spec section 9. `AC-20101-1` live-region preseeded on every declared route (wrappers present AND empty at load, enumerated by `[data-live-region]`). `AC-20102-1` transient toast contract with priority-to-role mapping and timeout measured against the ADR-2102 six-second floor via `data-shown-at`/`data-dismissed-at` timestamps (no six-second sleep in the pack; bounded polling). `AC-20103-1` centre acknowledge round-trip enumerated by `data-notification-id` (per-element attribute per gate discipline), reconciled through both `window.__notificationFetches` and the server-side request log. Fourth blueprint on the shelf that ships a Playwright probe pack under the runner extension.
 - Ships a sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-notifications-in-app/` (dependency-free Node HTTP server) so the pack can be probed at the shelf's own gate; the fixture is the golden the gate reviewer drives, with `?break=preseed`, `?break=role`, `?break=timeout` and `?break=ack` query switches for the negative runs. Three routes (`/`, `/notifications-centre`, `/notifications-preferences`); every route preseeds both live-region wrappers.
-- Suggests the `logging` and `errorHandling` companions with the ratified spec's reasons. `providesRoles` absent, leaf blueprint per the loader contract (an empty array is refused, an omitted field marks the blueprint as a leaf).
+- Suggests the `logging` and `errorHandling` companions with the shipped spec's reasons. `providesRoles` absent, leaf blueprint per the loader contract (an empty array is refused, an omitted field marks the blueprint as a leaf).

package/blueprints/application-notifications-in-app/README.md

@@ -1,6 +1,6 @@
 # Notifications in-app blueprint (v1.0.0)
 
-Vendor-neutral in-app-notifications contract for a rcf-lite application. Ships the live-region preseeding discipline (polite and assertive wrappers present in the DOM before any notification fires per the WAI-ARIA 1.2 normative reference), the transient toast contract with priority-to-role mapping (info to polite/status, error to assertive/alert per WCAG 4.1.3 and the ARIA APG alert pattern), the WCAG 2.2.1 six-second toast timeout floor with operator-elicited overrides above the floor, the notification centre inbox with a thirty-day retention window and a per-item acknowledge round-trip enumerated by `data-notification-id`, the per-user preferences UI with category silence and sibling-channel digest delegation, and the delivery-attempt log write path. Ships a Playwright probe pack under `probe-packs/application-notifications-in-app.pack.mjs` whose three checks are the runtime gate the delivery-ci-workflows runner drives (visual round spec 2026-09-04, section 5.4). No new global topics; suggests the `logging` and `errorHandling` companions. Fourth blueprint on the shelf that ships a Playwright probe pack under the T-0 runner extension.
+Vendor-neutral in-app-notifications contract for a rcf-lite application. Ships the live-region preseeding discipline (polite and assertive wrappers present in the DOM before any notification fires per the WAI-ARIA 1.2 normative reference), the transient toast contract with priority-to-role mapping (info to polite/status, error to assertive/alert per WCAG 4.1.3 and the ARIA APG alert pattern), the WCAG 2.2.1 six-second toast timeout floor with operator-elicited overrides above the floor, the notification centre inbox with a thirty-day retention window and a per-item acknowledge round-trip enumerated by `data-notification-id`, the per-user preferences UI with category silence and sibling-channel digest delegation, and the delivery-attempt log write path. Ships a Playwright probe pack under `probe-packs/application-notifications-in-app.pack.mjs` whose three checks are the runtime gate the delivery-ci-workflows runner drives (visual round spec 2026-09-04, section 5.4). No new global topics; suggests the `logging` and `errorHandling` companions. Fourth blueprint on the shelf that ships a Playwright probe pack under the runner extension.
 
 ## Apply
 
@@ -24,7 +24,7 @@ Applies namespaced contributions into the project tree and records `manifest.blu
 
 Contributed: REQ, US (with inline ACs), TAC, ADR, plus one shipped probe pack. Adherence is expressed as ACs; the blueprint ships no notifications-framework source and no test files (the probe pack drives the real browser against the applying project's own runtime).
 
-Deliberately not contributed: any transport (email, push, webhook). The in-app slug is the discriminator per Baz decision 2026-09-04: "we might support more types of notifications - be clear in the name what these ones are". Sibling channel blueprints ship their own transport contracts under the reserved `application-notifications-` family prefix.
+Deliberately not contributed: any transport (email, push, webhook). The in-app slug is the discriminator per the 2026-09-04 shelf decision to make the transport type explicit in the blueprint name. Sibling channel blueprints ship their own transport contracts under the reserved `application-notifications-` family prefix.
 
 ## Family-prefix reservation
 
@@ -34,7 +34,7 @@ The `application-notifications-` prefix is reserved for the sibling in-app-adjac
 - `application-notifications-push`: Web Push and platform APN/FCM notifications. Owns the subscription lifecycle and the platform-token store.
 - `application-notifications-webhook`: outbound HTTP notifications to operator-configured endpoints. Owns the delivery-retry semantics and the endpoint registry.
 
-The reservation is doc-only in v1.0.0 (per spec Q3 default): the family prefix is named in this README and in every shipped blueprint's `docs/topics.md` shelf band registry as a reserved-slot row. No sibling channel ships in this round. Any future PR that proposes a name outside the family (`application-alerts-email`, `application-messages-push`) reads against this reservation and stops at author-side review.
+The reservation is doc-only in v1.0.0: the family prefix is named in this README and in every shipped blueprint's `docs/topics.md` shelf band registry as a reserved-slot row. No sibling channel currently ships. Any proposal for a name outside the family (`application-alerts-email`, `application-messages-push`) reads against this reservation and is refused at author-side check.
 
 Digest opt-in on the preferences UI is elicited on the sibling channel, not here: the preferences UI carries a disabled section per sibling channel that is not yet applied, labelled `data-preference-status="sibling not applied"`. When the sibling ships and the applying project applies it, that sibling's own blueprint reads the operator's preference state and drives the digest transport.
 
@@ -44,11 +44,11 @@ Every route the applying project ships renders with both live-region wrappers pr
 
 ## Known mechanism-reach gaps
 
-Every runtime-observable AC that is not bound to a pack check appears here individually per the T-1 gate discipline (`blueprint-authoring-checklist.md` section 6.g): categories are not enough. The pack has three checks; every other runtime-observable AC on this blueprint is a mechanism-reach gap named below.
+Every runtime-observable AC that is not bound to a pack check appears here individually per the gate discipline (`blueprint-authoring-checklist.md` section 6.g): categories are not enough. The pack has three checks; every other runtime-observable AC on this blueprint is a mechanism-reach gap named below.
 
 - **AC-20101-2 live-region factory identity stable across route changes**. The pack asserts the wrappers are preseeded on every declared route (AC-20101-1); it does not assert the two wrappers are the same DOM nodes across route changes (a factory that recreates the wrappers on route change passes AC-20101-1 but fails AC-20101-2). A v1.1 minor bump could persist a `data-live-region-id` on each wrapper and assert identity across a `browser.click` on a nav link.
-- **AC-20102-2 toast factory library-scope shape**. The pack drives the runtime toast surface (AC-20102-1); the library-scope AC on the factory's own signature is a project-side review concern.
-- **AC-20103-2 centre factory reads through the delivery-log endpoint**. The pack drives the item enumeration and the acknowledge round-trip (AC-20103-1); the library-scope AC on the factory's own delivery-log read is a project-side review concern.
+- **AC-20102-2 toast factory library-scope shape**. The pack drives the runtime toast surface (AC-20102-1); the library-scope AC on the factory's own signature is a project-side check concern.
+- **AC-20103-2 centre factory reads through the delivery-log endpoint**. The pack drives the item enumeration and the acknowledge round-trip (AC-20103-1); the library-scope AC on the factory's own delivery-log read is a project-side check concern.
 - **AC-20104-1 preferences category silence**. The preferences surface renders per-category toggles but the pack does not itself activate a silence toggle and assert the round-trip today. A v1.1 minor bump could add a preferences-round-trip check paralleling AC-20103-1.
 - **AC-20104-2 sibling-channel digest section disabled when no sibling applied**. The fixture renders the disabled sections and the pack could inspect them, but the AC's real bite is when a sibling channel ships and the disabled state must lift; this class stays a v1.1 minor bump candidate for when the first sibling ships.
 - **AC-20105-1 delivery-log endpoint shape**. The pack does not enumerate every row on the log (the delivery-log's persistence is delegated to the applied `logging` companion). A v1.1 minor bump could add a log-shape probe that reads `/api/delivery-log`, asserts the row shape and confirms append-only order.
@@ -60,7 +60,7 @@ Every runtime-observable AC that is not bound to a pack check appears here indiv
 
 ## Elicited parameters (ADR-2101 through ADR-2103 and REQ notes)
 
-The applying project elicits these at apply; the declarative ADR shape (`elicited: true`) records the intent on the manifest. The runner has no apply-time elicitation phase today (w-2026-09-04-dave-022, built in T-5); accept the declarative shape and gather the operator's answers by hand during the apply pass.
+The applying project elicits these at apply; the declarative ADR shape (`elicited: true`) records the intent on the manifest. The runner has no apply-time elicitation phase today (planned for a follow-up minor); accept the declarative shape and gather the operator's answers by hand during the apply pass.
 
 - **Toast timeout floor** (ADR-2102): six seconds baseline per WCAG 2.2.1; operator elicits an override above the floor (twelve seconds, thirty seconds); the elicited value lands on `manifest.blueprints[application-notifications-in-app].appliedParameters.toastTimeoutSeconds`. A value below six is refused at apply.
 - **Notification categories** (REQ-004): the operator's category list (payment, security, product, and any project-specific categories). The preferences UI renders one section per elicited category.
@@ -74,7 +74,7 @@ WCAG 4.1.3 Status Messages on the live-region contract (REQ-001, ADR-2101). ARIA
 
 ## Consumers and dependencies
 
-- Consumes the applied `logging` companion (or the shelf provider `observability-logging`) for the delivery-attempt log write path (REQ-005, TAC-2102) and every acknowledge round-trip record. A project without a `logging` companion applied sees the delivery-log endpoint returning an empty rows array, which fails project-side review.
+- Consumes the applied `logging` companion (or the shelf provider `observability-logging`) for the delivery-attempt log write path (REQ-005, TAC-2102) and every acknowledge round-trip record. A project without a `logging` companion applied sees the delivery-log endpoint returning an empty rows array, which fails project-side check.
 - Consumes the applied `errorHandling` companion (or the shelf provider `application-error-handling`) for the assertive-slot alert's internal error record when an acknowledge round-trip fails at the server.
 - Reserves the `application-notifications-` family prefix for sibling channel blueprints (see above).
-- Reuses the T-3 pack-browser `resize(width, height)` seam only for future minor bumps; v1.0.0 does not exercise breakpoint reflow in the pack.
+- Reuses the pack-browser `resize(width, height)` seam only for future minor bumps; v1.0.0 does not exercise breakpoint reflow in the pack.