rcf-lite 0.26.0 → 0.28.0

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20102.json

@@ -16,20 +16,58 @@
       "when": "the accessibility tree and the toast timestamps are read",
       "then": "the priority-to-role mapping holds, the announcement is one-shot, and the timeout is at or above the six second floor",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-20102-2",
-      "description": "Given the toast factory (TAC-2101 `renderToast({ priority, body })`), the factory picks the polite wrapper for `info` priority and the assertive wrapper for `error` priority; a factory that writes into both wrappers on one call, or picks the wrong wrapper for a priority, fails at project-side review.",
+      "description": "Given the toast factory (TAC-2101 `renderToast({ priority, body })`), the factory picks the polite wrapper for `info` priority and the assertive wrapper for `error` priority; a factory that writes into both wrappers on one call, or picks the wrong wrapper for a priority, fails at project-side check.",
       "given": "the toast factory",
       "when": "the factory is invoked at a given priority",
       "then": "the correct wrapper receives the toast",
       "testable": true,
-      "scope": "library"
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2101-application-notifications-in-app-live-region",
+        "field": "interfaces.renderToast"
+      }
+    },
+    {
+      "id": "AC-20102-3",
+      "description": "Apply refuses a toast-timeout-floor answer below 6 seconds with TOAST_TIMEOUT_TOO_SHORT naming the elicited value; a value at or above 6 seconds applies and the polite toast honours it. Vendor citation on WCAG 2.2.1 (https://www.w3.org/TR/WCAG22/#timing-adjustable, verified 2026-09-10).",
+      "given": "a project elicits a toast-timeout-floor below 6 seconds",
+      "when": "apply runs",
+      "then": "apply exits with a non-zero code and TOAST_TIMEOUT_TOO_SHORT names the elicited value; at or above 6 seconds apply succeeds",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#timing-adjustable",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-20102-4",
+      "description": "A transient toast auto-dismisses at the elicited timeout only if the principal has not focused it; a focused toast pauses the timer and resumes only after focus leaves (WCAG 2.2.1 Timing Adjustable, https://www.w3.org/TR/WCAG22/#timing-adjustable, verified 2026-09-10).",
+      "given": "a rendered toast and the principal focuses it via the keyboard",
+      "when": "the elicited timeout elapses",
+      "then": "the toast remains visible until focus leaves; on focus loss the timer resumes",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#timing-adjustable",
+        "verifiedOn": "2026-09-10"
+      }
     }
   ],
-  "tacIds": ["TAC-2101-application-notifications-in-app-live-region"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2101-application-notifications-in-app-live-region"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20103.json

@@ -16,20 +16,54 @@
       "when": "an acknowledge control is activated by keyboard",
       "then": "the acknowledge round-trips to the server and the DOM updates in response",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-20103-2",
-      "description": "Given the centre factory (TAC-2102 `renderCentre`), the factory reads the delivery-attempt log from REQ-005's endpoint and emits one wrapper per row within the retention window; a factory that emits rows older than the retention window, or that skips rows within the window, fails at project-side review.",
+      "description": "Given the centre factory (TAC-2102 `renderCentre`), the factory reads the delivery-attempt log from REQ-005's endpoint and emits one wrapper per row within the retention window; a factory that emits rows older than the retention window, or that skips rows within the window, fails at project-side check.",
       "given": "the centre factory",
       "when": "the delivery log is read",
       "then": "one wrapper is emitted per row within the retention window",
       "testable": true,
-      "scope": "library"
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2102-application-notifications-in-app-centre",
+        "field": "interfaces.renderCentre"
+      }
+    },
+    {
+      "id": "AC-20103-3",
+      "description": "When the acknowledge round-trip returns a non-2xx or times out, an error toast surfaces via the assertive live region naming the failure, and data-acknowledged on the row remains false (the row is not visually or programmatically marked read).",
+      "given": "a notification row and an acknowledge POST that returns a non-2xx or times out",
+      "when": "the principal activates the acknowledge control",
+      "then": "an error toast appears via role=alert, data-acknowledged=false remains and no polite acknowledgement announcement fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2102-application-notifications-in-app-centre",
+        "field": "interfaces.acknowledgeRoundTrip"
+      }
+    },
+    {
+      "id": "AC-20103-4",
+      "description": "The notification centre inbox lists the last N days of notifications enumerated by data-notification-id and paginates once N exceeds the elicited page-size; a paginated request that fails leaves the currently loaded rows visible and shows an inline retry. Applying agent sets: page-size.",
+      "given": "an inbox whose N exceeds the page-size and a paginated fetch that fails",
+      "when": "the principal scrolls or paginates",
+      "then": "the previously loaded rows remain visible, an inline retry control appears and no rows are removed on the failure",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2102-application-notifications-in-app-centre"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2102-application-notifications-in-app-centre"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20104.json

@@ -16,7 +16,8 @@
       "when": "a silence toggle is activated",
       "then": "the preference is recorded and reflected on the DOM",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-20104-2",
@@ -25,11 +26,36 @@
       "when": "the digest opt-in section is read",
       "then": "the section is disabled and labelled as sibling not applied",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-20104-3",
+      "description": "When the preference write POST returns a non-2xx or times out, an error toast surfaces via the assertive live region, the toggle in the DOM returns to its pre-click state and no false persisted-state is shown.",
+      "given": "a preference toggle change and a write POST that returns a non-2xx or times out",
+      "when": "the principal toggles the preference",
+      "then": "an error toast fires, the toggle rolls back to its pre-click state, and no data-persisted=true is emitted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-20104-4",
+      "description": "On a successful preference write, the polite live region announces the new persisted state and the toggle reflects it. Two rapid clicks are debounced to a single write (idempotency of a retried operation).",
+      "given": "a preference toggle change accepted by the write POST",
+      "when": "the write returns 2xx",
+      "then": "the polite live region announces the new state, data-persisted=true is emitted, and two rapid clicks fire exactly one write",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2103-application-notifications-in-app-preferences"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2103-application-notifications-in-app-preferences"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20105.json

@@ -4,32 +4,74 @@
   "reqId": "application-notifications-in-app-REQ-005",
   "version": "1.0.0",
   "status": "approved",
-  "title": "The delivery-attempt log records one row per surfaced notification with the operator-readable fields for later inspection",
+  "title": "The delivery-attempt log records one row per surfaced notification, in the shape owned by TAC-2102, for later inspection",
   "asA": "operator inspecting the notification behaviour of a shipped rcf-lite application",
-  "iWant": "one row in the delivery-attempt log per notification the shell surfaced, with the priority, the category and the delivery and acknowledgement timestamps",
+  "iWant": "one row in the delivery-attempt log per notification the shell surfaced, in the shape owned by `TAC-2102.interfaces.deliveryRowShape`",
   "soThat": "I can reconcile what the shell said with what my operators saw and acknowledged",
   "acceptanceCriteria": [
     {
       "id": "AC-20105-1",
-      "description": "Given a shipped surface that has surfaced N notifications, `GET /api/delivery-log` returns HTTP 200 with body `{ rows: [...] }` and `rows.length === N`; each row carries `notificationId` (string), `category` (string), `priority` (`\"info\"` or `\"error\"`), `deliveredAt` (ISO-8601 timestamp); a row for a dismissed toast additionally carries `dismissedAt`; a row for an acknowledged centre item additionally carries `acknowledgedAt`. Rows are append-only; a `notificationId` never appears twice on the same page load. The pack does not itself enumerate every row (the delivery log's persistence is delegated to the applied `logging` companion); the AC is a mechanism-reach gap for a v1.1 minor bump when the pack gains a log-shape probe.",
+      "description": "Given a shipped surface that has surfaced N notifications, `GET /api/delivery-log` returns HTTP 200 with body `{ rows: [...] }` and `rows.length === N`; each row honours the shape owned by `TAC-2102.interfaces.deliveryRowShape`. Rows are append-only; the same delivery event never appears twice on the same page load. The pack does not itself enumerate every row (the delivery-log persistence is delegated to the applied `logging` companion); the AC is a mechanism-reach gap for a v1.1 minor bump when the pack gains a log-shape probe.",
       "given": "a shipped surface after N notifications",
       "when": "the delivery-log endpoint is read",
       "then": "N rows with the operator-readable fields are returned",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2102-application-notifications-in-app-centre",
+        "field": "interfaces.deliveryRowShape"
+      }
     },
     {
       "id": "AC-20105-2",
-      "description": "Given the delivery-log write factory (TAC-2102 `writeDeliveryRow`), a call from the toast factory and a call from the centre factory both write through the applied `logging` companion's record factory (the row shape lives on this blueprint; the persistence layer lives on the companion). A row written outside the companion's factory bypasses the companion's retention and audit path and is refused at project-side review.",
+      "description": "Given the delivery-log write factory (TAC-2102 `writeDeliveryRow`), a call from the toast factory and a call from the centre factory both write through the applied `logging` companion's record factory (the row shape lives on this blueprint; the persistence layer lives on the companion). A row written outside the companion's factory bypasses the companion's retention and audit path and is refused at project-side check.",
       "given": "the delivery-log write factory",
       "when": "a toast or centre event surfaces a notification",
       "then": "a row lands through the applied logging companion",
       "testable": true,
-      "scope": "library"
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2102-application-notifications-in-app-centre",
+        "field": "interfaces.writeDeliveryRow"
+      }
+    },
+    {
+      "id": "AC-20105-3",
+      "description": "A delivery-attempt log row honours exactly the field set owned by `TAC-2102.interfaces.deliveryRowShape`; a row missing any owner-required field refuses the write with DELIVERY_ROW_INCOMPLETE naming the missing owner-required field (per the owner shape).",
+      "given": "a delivery attempt whose row is missing an owner-required field owned by `TAC-2102.interfaces.deliveryRowShape`",
+      "when": "the row write fires",
+      "then": "the write refuses with DELIVERY_ROW_INCOMPLETE naming the missing owner-required field and no partial row is persisted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2102-application-notifications-in-app-centre",
+        "field": "interfaces.deliveryRowShape"
+      }
+    },
+    {
+      "id": "AC-20105-4",
+      "description": "When no applied blueprint provides the `logging` companion (no writeDeliveryRow factory on the applied set), apply refuses with LOGGING_COMPANION_MISSING naming the required remedy (apply the logging companion so the delivery-log rows can persist); no delivery-log entries are written and the toast and centre factories refuse to construct.",
+      "given": "a project applying application-notifications-in-app with no logging companion applied",
+      "when": "apply runs",
+      "then": "apply exits with a non-zero code and LOGGING_COMPANION_MISSING is emitted naming the remedy (apply the logging companion)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2102-application-notifications-in-app-centre",
+        "field": "interfaces.writeDeliveryRow"
+      }
     }
   ],
-  "tacIds": ["TAC-2102-application-notifications-in-app-centre"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2102-application-notifications-in-app-centre"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20106.json

@@ -16,11 +16,26 @@
       "when": "the initial DOM and the live-region wrappers are read",
       "then": "the backlog is rendered on the surface and neither live-region wrapper carries a load-time announcement",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-20106-2",
+      "description": "When the backlog fetch on page load returns a non-2xx or times out, the inbox renders the last cached rows (if any) with a fetch-failed banner and an inline retry; no rows are shown as read that were not previously acknowledged.",
+      "given": "a page load whose backlog fetch fails",
+      "when": "the inbox route renders",
+      "then": "the last cached rows appear with a fetch-failed banner and inline retry; no false read state is shown",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2102-application-notifications-in-app-centre"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2102-application-notifications-in-app-centre"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20107.json

@@ -16,11 +16,26 @@
       "when": "the toast DOM is read",
       "then": "the priority-to-role mapping and the one-shot announcement match an operator-driven toast",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-20107-2",
+      "description": "A background-driven toast that lacks a priority field or a category outside the elicited enum refuses the toast render with TOAST_PAYLOAD_INVALID naming the missing or invalid field, and never surfaces to the DOM.",
+      "given": "a background event that emits a toast payload with a missing priority or unknown category",
+      "when": "the event fires",
+      "then": "no toast renders, TOAST_PAYLOAD_INVALID names the field and the event is logged",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2101-application-notifications-in-app-live-region"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2101-application-notifications-in-app-live-region"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/user-stories/application-notifications-in-app-us-20108.json

@@ -16,11 +16,26 @@
       "when": "both live-region wrappers are read simultaneously",
       "then": "the body text appears in exactly one wrapper",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-20108-2",
+      "description": "When the priority-to-role contract fires with an invalid priority, the announcement is dropped and a console log records the invalid value; no accidental double-announce lands in the alternate live region as a fallback.",
+      "given": "an announcement carrying a priority outside the closed enum",
+      "when": "the announcement is dispatched",
+      "then": "no live region receives the announcement, the console log records the invalid priority and no fallback double-announce fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2101-application-notifications-in-app-live-region"],
-  "tags": ["blueprint:application-notifications-in-app"],
+  "tacIds": [
+    "TAC-2101-application-notifications-in-app-live-region"
+  ],
+  "tags": [
+    "blueprint:application-notifications-in-app"
+  ],
   "createdAt": "2026-09-04T23:59:00Z",
-  "updatedAt": "2026-09-04T23:59:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-notifications-in-app/guide/application-notifications-in-app.md

@@ -37,11 +37,11 @@ Every route the applying project ships preseeds both live-region wrappers in the
 ## Common gotchas
 
 - The two live-region wrappers must be preseeded before the first notification. A lazy-mount defect is silent at the DOM (the wrapper appears "eventually") but loses the first announcement at the assistive-technology layer. The pack refuses ship on this shape.
-- The priority-to-role mapping is fixed at v1.0.0 (info to polite/status, error to assertive/alert). A third priority (`warning`) is a v1.1 minor bump because it changes the role vocabulary; free-form priorities are refused at project-side review.
+- The priority-to-role mapping is fixed at v1.0.0 (info to polite/status, error to assertive/alert). A third priority (`warning`) is a v1.1 minor bump because it changes the role vocabulary; free-form priorities are refused at project-side check.
 - The toast timeout floor is a floor, not a ceiling. Six seconds is the default; an operator-elicited value above the floor is honoured (thirty seconds), a value below the floor is refused at apply. The pack measures the actual elapsed time against the shell root's declared floor and against the six-second baseline; both must clear.
-- The centre enumerates items by `data-notification-id`, per the T-3 gate discipline. A centre implementation that uses only `role="listitem"` on the children (without a per-element id attribute) passes the accessibility contract but does not let the pack enumerate individual items reliably; ship both.
-- The family-prefix reservation is documented; naming a future notifications blueprint outside the family (`application-alerts-email`) reads against the reservation and stops at author-side review.
+- The centre enumerates items by `data-notification-id`, per the gate discipline. A centre implementation that uses only `role="listitem"` on the children (without a per-element id attribute) passes the accessibility contract but does not let the pack enumerate individual items reliably; ship both.
+- The family-prefix reservation is documented; naming a future notifications blueprint outside the family (`application-alerts-email`) reads against the reservation and stops at author-side check.
 
 ## Cost honesty
 
-Shipping this blueprint costs the project a design pass on the notification categories and retention window, and a build pass on the live-region factory and the centre inbox surface. It buys the WCAG 4.1.3 and WCAG 2.2.1 disciplines enforced at ship, the ARIA APG alert pattern on the assertive slot, the centre inbox with the acknowledge round-trip, the preferences UI with sibling delegation, and the family-prefix reservation that survives when the shelf grows a second notifications channel. The gate reviewer verifies the pack runs green against the sample-app fixture and reviews the applying project's own notifications surfaces against the ADR set.
+Shipping this blueprint costs the project a design pass on the notification categories and retention window, and a build pass on the live-region factory and the centre inbox surface. It buys the WCAG 4.1.3 and WCAG 2.2.1 disciplines enforced at ship, the ARIA APG alert pattern on the assertive slot, the centre inbox with the acknowledge round-trip, the preferences UI with sibling delegation, and the family-prefix reservation that survives when the shelf grows a second notifications channel. The gate reviewer verifies the pack runs green against the sample-app fixture and inspects the applying project's own notifications surfaces against the ADR set.

package/blueprints/application-notifications-in-app/probe-packs/application-notifications-in-app.pack.mjs

@@ -11,16 +11,16 @@
 //   AC-20103-1 centre acknowledge round-trip (Tab-reachable acknowledge
 //              control POSTs to the server, the server responds, the
 //              DOM updates in response; enumerated by data-notification-id
-//              per the T-3 gate discipline, never by role alone)
+//              per the gate discipline, never by role alone)
 //
-// Every check drives the real Playwright browser the T-0 runner
+// Every check drives the real Playwright browser the runner
 // injects (packages/rcf-lite/src/browser-verify/pack-browser.js) and
 // asserts on the DOM the applying project renders under TAC-2101
 // (live-region wrappers and toast factory), TAC-2102 (centre inbox
 // and acknowledge round-trip) and the priority-to-role mapping per
 // ADR-2101.
 //
-// The pack has no network-interception seam (T-0 shipped none); the
+// The pack has no network-interception seam (shipped none); the
 // acknowledge round-trip is captured through the request log the
 // sample app exposes on window.__notificationFetches and at
 // GET /__requests. The toast timeout is measured with browser.evaluate
@@ -34,7 +34,7 @@ export default {
   blueprintSlug: 'application-notifications-in-app',
   // Applies to any FBS that realises the live-region TAC or whose
   // navModel routes include a notifications-centre path. The source
-  // references BOTH `tacIds` and `route` so the T-0 loader's
+  // references BOTH `tacIds` and `route` so the loader's
   // applicability source-scan sees the two legal seams (route is one
   // of the three legal predicates).
   appliesTo: ({ fbs }) => {

package/blueprints/application-onboarding-tour/CHANGELOG.md

@@ -1,6 +1,63 @@
 # application-onboarding-tour CHANGELOG
 
-## 1.0.0 (visual round T-5, spec 2026-09-06 section 5.5)
+## 1.1.9 - 2026-09-12
+
+- Fixture client script fix: the restart-tour click listener now calls `event.preventDefault()` when the button is a submit-button inside the progressive-enhancement `<form method="post" action="/actions/restart-tour">`, so JS-on activation POSTs the server-side clear exactly once (previously the native form submission and the fetch fired both writes; the clear was idempotent so no data was lost, but the duplicate POST was measurable on `/__requests`). JS-off activation continues to POST the form natively; JS-on drives the same POST via fetch. Probe assertions and record shape are unchanged.
+
+## 1.1.8 - 2026-09-12
+
+- completion-persistence (AC-26104-1) upgraded from a de-claim to an honest positive-evidence row that observes both the persistence half and the restart-control-activation half of the AC server-side. The fixture derives the server-side first-run flag on `/tour` from the applied `completion-state-store` elicit when its value is `server-side-per-principal`: pages render `data-tour-first-run="true"` when the principal has no completion record and `data-tour-first-run="false"` when a completion record is present (`data-tour-completion-source` and `data-tour-principal-id` name the source). The settings surface now renders the restart-tour control inside a progressive-enhancement `<form method="post" action="/actions/restart-tour">` carrying the principal-id in a hidden input, backed by a new server route that clears the applied server-side completion record for the principal and returns `200 { ok:true, cleared:true, restartControl:"restart-tour" }`; the client script also fires the same POST via fetch on click for SPA parity, but the form action is the source of truth even with JS off. The probe drives the full cycle - initial completion GET (404) and initial `/tour` render (`data-tour-first-run="true"`); POST completion write; subsequent completion GET and `/tour` render (`data-tour-first-run="false"`); `/settings` render carrying the restart-tour form with the hidden principal-id input; POST `/actions/restart-tour` (the same form submission the button fires); final completion GET (404) and `/tour` render (`data-tour-first-run="true"`). The `?break=no-persist` switch now refuses the server-side POST and the restart-tour form action with a defined error shape (`COMPLETION_WRITE_FAILED` / `COMPLETION_CLEAR_FAILED`), so the negative-variants anatomy assertion drives the completion-persistence aggregate to fail. First-run-detection's returning-principal row re-anchored to AC-26104-1 (the AC the suppression clause belongs to) and left as `notObservableHere` for the client-side auto-open branch; the misleading AC-26101-1 attribution is removed. Stepper-role-dialog rows keep `notObservableHere` on the browser-only halves. Positive-evidence row shape tightened in the anatomy helper: a positive row now requires a non-empty engine-returned `requestId` AND (a non-empty `bodyExcerpt` OR a non-empty `derived` object); a `{derived:{}}` alone or a `requestId` alone no longer counts, with two new negative-case tests covering the empty-derived and id-only patterns. Fixture README env-var manifest already declared `PROBE_BREAK` and the probe-utils `DECLARED_ENV` list already carries it.
+
+## 1.1.6 - 2026-09-11
+
+- Shared `aggregate()` no longer promotes warn rows to pass: any row with verdict warn (including honest de-claim rows) lifts the aggregate to warn; a probe whose rows are all warn aggregates to warn, not pass. Shared teardown propagates a SIGKILL failure through the returned kill() promise instead of swallowing it. completion-persistence AC-26104-1 row de-claimed to `conformanceOnly:true` with `verdict:'warn'` and a `limitation` naming the browser-only clause (the restart-tour control activation and subsequent tour re-open are browser-driven and not observed by this Node HTTP probe); the server-side write-read-clear cycle still drives the row observation and flips to fail if the fixture cycle breaks. first-run-detection and stepper-role-dialog rows keep `notObservableHere` on the browser-only halves and emit `verdict:'warn'`. checklist-anchor-open stays as a positive-observation row that fully observes AC-26103-1 across both applied-branches. Anatomy test extended with a negative-variant assertion that the shipped fixture break switches drive the checklist aggregate to fail.
+
+## 1.1.5 - 2026-09-11
+
+- completion-persistence probe now observes AC-26104-1's server-observable half. Fixture ships three new endpoints keyed by `x-principal-id` header (or `?principal-id=` query) exercised only when `TOUR_STORE=server-side-per-principal`: `POST /api/tour/completion` writes, `GET /api/tour/completion` reads (404 when absent, 200 with the record when present), `DELETE /api/tour/completion` clears (models the restart-tour control). Probe drives a fresh principal through the full sequence (initial absent -> write -> read -> clear -> absent again) instead of de-claiming as `notObservableHere`. first-run-detection and stepper-role-dialog rows keep `notObservableHere` on the browser-only halves but now emit `verdict:'warn'` (never `pass`) so the aggregate correctly reports amber for those AC halves. Anatomy test extended to enumerate the shipped AC/REQ id set and refuse any row whose anchor is not in it, and to accept the conformance-only row shape.
+
+## 1.1.4 - 2026-09-11
+
+- Fixture tour-open runtime condition corrected from `FIRST_RUN || !alreadyDone` to `!alreadyDone` alone per AC-26101-1 (the tour opens on first run once, not any time FIRST_RUN is set past a stored completion). first-run-detection, stepper-role-dialog and completion-persistence probes de-claimed to notObservableHere with their AC anchors (AC-26101-1, AC-26102-1, AC-26104-1) because the observable properties - tour open behaviour, dialog focus lifecycle, focus return, responsive placement, completion write-and-restart-read - are all client-JS-driven and only observable in a browser. checklist-anchor-open remains observed (server-side surfaces the applied-capability-driven checklist state); rule 10 applied to both branches. Positive-anchor-on-absence broken-variant rows removed. Anatomy test extended to accept notObservableHere row shape. Register cleanup.
+
+
+## 1.1.3 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering 4 properties the fixture engine at `packages/rcf-lite/test/fixtures/probe-pack-application-onboarding-tour/server.js` answers: `first-run-detection`, `stepper-role-dialog`, `checklist-anchor-open`, `completion-persistence`. Every response now carries an `x-fixture-request-id` header; probes record the id, the HTTP status and a body excerpt as positive evidence per rule 7d. Fixture README declares every env var the pack reads. Anatomy test at `packages/rcf-lite/test/blueprint/application-onboarding-tour-anatomy.test.js` pins the new pack files and asserts each result carries one of the four 7d evidence shapes.
+
+
+## 1.1.2 (2026-09-10)
+
+### Changed
+
+- AC-26109-1 requires `<details open>` per ADR-2703 and references the ADR via ownerRef.
+- ADR-2702 refusal-only decision: `server-side-per-principal` without an applied persistence blueprint refuses with `COMPLETION_STORE_MISSING_PROVIDER` and never falls back; TAC-2703 aligned.
+- AC-26108-4 references `TAC-2703.interfaces.completionStore` via ownerRef; drops the principalId/tourVersion/dismissedAt restatement.
+- AC-26104-2 names `server-side-per-principal` inline and its refusal `COMPLETION_STORE_MISSING_PROVIDER`.
+- REQ-002.deliveredBy retargeted to `TAC-2701.interfaces.renderTourRunner`.
+- Vendor citations on AC-26101-1 (WCAG keyboard) and AC-26102-1 (ARIA APG dialog-modal); AC-26102-2 URL naming tidied.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 (2026-09-10)
+
+### Added
+
+- REQ-005 (dismissal-policy option coverage) and US-26108: dismiss-permanently, dismiss-until-next-major and dismiss-until-next-minor each carry a runtime clause tied to the completion store record shape. This is the section 7c worked example.
+- REQ-006 (checklist-anchor option coverage) and US-26109: dashboard-top, settings-page and custom-anchor each mount at a resolved slot with a defined default open state; custom-anchor falls back to the settings route on an unresolved/invisible/clipped selector with data-error=CHECKLIST_ANCHOR_UNRESOLVED.
+- Failure-path acceptance criteria on US-26101 (unresolved and clipped anchors, out-of-range step count), US-26102 (dialog-modal role/aria and focus trap with WCAG citation), US-26103 (settings-route fallback), US-26104 (missing-provider refusal, failed write and failed read on the completion store), US-26105 (unparseable completion record), US-26106 (failed clear on restart), US-26107 (polite live-region close announcement).
+- Vendor citations on the ARIA APG dialog-modal, focus-trap and WCAG live-region acceptance criteria (verified 2026-09-10).
+
+### Changed
+
+- Every REQ now carries a deliveredBy link into TAC-2701 (step-runner), TAC-2702 (checklist-slot) or TAC-2703 (completion-store).
+- Every AC on every user story now carries an explicit disposition (fixed or template).
+- TAC-2702 responsibilities extended with resolveAnchor so REQ-006 delivery resolves.
+- REQ-001 extended with runtime clauses naming the three string elicits `tour-step-manifest`, `anchor-selectors` and `per-step-content-voice` and their refusal branches; US-26101 gained three template ACs (AC-26101-5, AC-26101-6, AC-26101-7) each carrying an `Applying agent sets: <elicit-id>.` clause.
+
+## 1.0.0 (visual round, spec 2026-09-06 section 5.5)
 
 - First shipped version. Introduces the tour step runner (ARIA APG dialog-modal per step, focus lifecycle, `role="dialog"`, `aria-labelledby`, `aria-describedby`, keyboard trap inside the tooltip with Escape as the exit, focus-not-obscured at 1440 and 360 breakpoints via `browser.resize`), the checklist slot (dashboard-top open collapse on `application-dashboard` applied; settings-page closed collapse when not; `<details>` browser-native for keyboard-native keyboard behaviour and screen-reader-native semantics), and the completion-state store contract (three backend shapes selected at apply time from the elicited answer or the Q4 fallback `spa-local-storage` when no persistence blueprint is applied).
 - Ships six elicits: `tour-step-manifest`, `anchor-selectors`, `per-step-content-voice` (all project-owned strings the blueprint contributes the WHAT for), `dismissal-policy` (default `dismiss-permanently`), `completion-state-store` (default `spa-local-storage` per Q4), `checklist-anchor` (default derived at apply time from the applied-blueprint set).
@@ -8,5 +65,5 @@
 - Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-onboarding-tour/` realising the tour surface honestly across both checklist branches and multiple completion-store shapes, plus four break switches (`?break=no-role`, `?break=focus-escape`, `?break=no-collapse`, `?break=no-persist`) driving the negative runs.
 - Composes on `application-spa` (routing and iconography), `application-dashboard` (dashboard-top anchor slot; settings-page fallback), `application-notifications-in-app` (polite `aria-live` completion announce), `application-account-settings` (restart-tour control home; any settings-shaped surface as fallback), and any `security-auth-*` blueprint (per-principal completion state; per-browser under a bare namespace as fallback).
 - Q4 default: when no persistence blueprint is applied AND the operator does not answer `completion-state-store`, the store defaults to `spa-local-storage`. Rationale in ADR-2702 and the README's Q4 fallback section.
-- Two documented mechanism-reach gaps: `AC-26105-1` first-run detection is fixture-verified via the manual boot line; `AC-26107-1` screen-reader traversal is asserted at the DOM contract level and verified manually via the fixture READMEs VoiceOver smoke. Runner cleanup rides `w-2026-09-04-dave-020`.
+- Two documented mechanism-reach gaps: `AC-26105-1` first-run detection is fixture-verified via the manual boot line; `AC-26107-1` screen-reader traversal is asserted at the DOM contract level and verified manually via the fixture READMEs VoiceOver smoke.
 - No new global topics claimed. Extends the section 5 shelf id band registry with `application-onboarding-tour` at 26101 to 26899 (US) and 27xx (ADR/TAC).

package/blueprints/application-onboarding-tour/README.md

@@ -8,7 +8,7 @@ Vendor-neutral onboarding-tour surface for an rcf-lite application. Composes on
 rcf define blueprint add <path-to>/blueprints/application-onboarding-tour
 ```
 
-No `requiresAppliedCapabilities`: T-5 has no hard dependency, and the compose targets (SPA, dashboard, notifications-in-app, account-settings, any auth) are all optional. Prompts the elicitation phase for six parameters: the step manifest (3 to 5 steps with per-step anchor and content), the anchor selectors, the per-step content voice, the dismissal policy (default `dismiss-permanently`), the completion-state store shape (default `spa-local-storage`, the Q4 fallback), and the checklist anchor slot (default derived at apply time from what is applied). Writes a sidecar `rcf/blueprints/application-onboarding-tour.applied.json` capturing the answered elicits and the discovered `appliedBlueprints[]` (dashboard, notifications-in-app, account-settings, spa presence). Consumes the `logging` and `errorHandling` companions when they resolve to an applied provider or a registered library.
+No `requiresAppliedCapabilities`: the blueprint has no hard dependency, and the compose targets (SPA, dashboard, notifications-in-app, account-settings, any auth) are all optional. The apply step prompts the elicitation phase for six parameters: the step manifest (3 to 5 steps with per-step anchor and content), the anchor selectors, the per-step content voice, the dismissal policy (default `dismiss-permanently`), the completion-state store shape (default `spa-local-storage`, the Q4 fallback), and the checklist anchor slot (default derived at apply time from what is applied). The apply step writes a sidecar `rcf/blueprints/application-onboarding-tour.applied.json` capturing the answered elicits and the discovered `appliedBlueprints[]` (dashboard, notifications-in-app, account-settings, spa presence). Consumes the `logging` and `errorHandling` companions when they resolve to an applied provider or a registered library.
 
 ## Anatomy
 
@@ -33,7 +33,7 @@ No `requiresAppliedCapabilities`: T-5 has no hard dependency, and the compose ta
 
 ## Q4 fallback: completion-state store shape
 
-Q4 of the ratified spec (section 10) settles the completion-state fallback. When no persistence blueprint is applied AND the operator does not answer `completion-state-store` explicitly, the store defaults to `spa-local-storage`: a per-browser record so a returning principal on the same browser is not re-onboarded, and a different browser is re-onboarded. Rationale: a per-session tour that re-plays on every new session is worse than a one-time tour that persists across sessions on that browser; per the elicit surface, the operator can override to `spa-session-storage` (per-session refresh) or `server-side-per-principal` (cross-device; requires an applied persistence blueprint).
+When no persistence blueprint is applied AND the operator does not answer `completion-state-store` explicitly, the store defaults to `spa-local-storage`: a per-browser record so a returning principal on the same browser is not re-onboarded, and a different browser is re-onboarded. Rationale: a per-session tour that re-plays on every new session is worse than a one-time tour that persists across sessions on that browser; per the elicit surface, the operator can override to `spa-session-storage` (per-session refresh) or `server-side-per-principal` (cross-device; requires an applied persistence blueprint).
 
 ## Standards trace
 
@@ -48,7 +48,7 @@ Spec `standardsTrace` empty at the blueprint level; each ADR contribution carrie
 ## Known mechanism-reach gaps
 
 - `AC-26105-1` (first-run detection): the runner cannot fully prove the first-run vs returning-principal branch in one browser session without a persisted state seed; the pack drives the first-run branch via `?first-run=1` and the returning branch is verified by the fixture READMEs manual boot line (walk `/tour` twice, confirm the tour auto-opens on run 1 and does not on run 2).
-- `AC-26107-1` (screen-reader traversal): the pack asserts the DOM contract (`aria-labelledby`, `aria-describedby`) but does not drive a real screen reader in CI. The fixture README names the manual VoiceOver smoke. Runner cleanup rides `w-2026-09-04-dave-020`.
+- `AC-26107-1` (screen-reader traversal): the pack asserts the DOM contract (`aria-labelledby`, `aria-describedby`) but does not drive a real screen reader in CI. The fixture README names the manual VoiceOver smoke. Runner cleanup planned for a follow-up minor.
 - `AC-26106-1` (restart-tour clears state and re-opens): fully exercised inside the AC-26104-1 pack check end-to-end (the check clicks restart, then navigates to `/tour` and asserts the tooltip re-appears).
 
 ## Elicited parameters

package/blueprints/application-onboarding-tour/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-onboarding-tour",
-  "version": "1.0.0",
+  "version": "1.1.9",
   "category": "application",
   "elicits": [
     {
@@ -86,6 +86,16 @@
       "kind": "req",
       "path": "requirements/application-onboarding-tour-req-004.json"
     },
+    {
+      "id": "application-onboarding-tour-REQ-005",
+      "kind": "req",
+      "path": "requirements/application-onboarding-tour-req-005.json"
+    },
+    {
+      "id": "application-onboarding-tour-REQ-006",
+      "kind": "req",
+      "path": "requirements/application-onboarding-tour-req-006.json"
+    },
     {
       "id": "application-onboarding-tour-US-26101",
       "kind": "us",
@@ -121,6 +131,16 @@
       "kind": "us",
       "path": "user-stories/application-onboarding-tour-us-26107.json"
     },
+    {
+      "id": "application-onboarding-tour-US-26108",
+      "kind": "us",
+      "path": "user-stories/application-onboarding-tour-us-26108.json"
+    },
+    {
+      "id": "application-onboarding-tour-US-26109",
+      "kind": "us",
+      "path": "user-stories/application-onboarding-tour-us-26109.json"
+    },
     {
       "id": "TAC-2701-application-onboarding-tour-step-runner",
       "kind": "tac",
@@ -160,5 +180,7 @@
       "elicited": true,
       "standardsTraceClause": "generic enterprise practice"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-12T01:30:44Z",
+  "updatedIso": "2026-09-11T22:30:00Z"
 }

package/blueprints/application-onboarding-tour/contributions/adrs/adr-2702-application-onboarding-tour-completion-store-shape.json

@@ -2,12 +2,12 @@
   "adrId": "ADR-2702-application-onboarding-tour-completion-store-shape",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Completion-state store shape: spa-local-storage default (Q4 fallback), spa-session-storage or server-side-per-principal",
   "context": "The completion state needs a store. Three shapes are legal. spa-local-storage keeps the completion state per browser and per principal identifier; a returning principal on the same browser is not re-onboarded, and a different browser (or a private window) is re-onboarded. spa-session-storage keeps the completion state per session and re-plays the tour on every new session; useful only for a project that deliberately wants a per-session refresher. server-side-per-principal keeps the completion state on the principals record so it follows the user across devices; requires an applied persistence blueprint and the projects own writer adapter. The spec section 5.5 and section 10 Q4 ratify spa-local-storage as the fallback when no persistence blueprint is applied because a per-session tour that re-plays on every new session is worse than a one-time tour that persists across sessions on that browser.",
-  "decision": "completion-state-store is elicited (enum: spa-local-storage | spa-session-storage | server-side-per-principal). Recommended default: spa-local-storage. At apply time the elicit surface offers all three; a project that answers server-side-per-principal without an applied persistence blueprint hits a documented refusal (the elicit's when predicate refuses per the mechanism minor T-5 does not extend; the refusal is enforced at the surface load by TAC-2703 which refuses to construct a server-side backend without a resolved persistence adapter and falls back to spa-local-storage with a documented note on the sidecar).",
-  "consequences": "A project with no persistence blueprint applied gets the spa-local-storage backend automatically per the Q4 fallback; a project with a persistence blueprint and the server-side-per-principal answer gets a cross-device tour completion; a project answering spa-session-storage accepts a per-session re-onboarding. The dismiss-until-next-major and dismiss-until-next-minor policies (ADR-2701) still work under any of the three shapes because the CompletionRecord.blueprintSetVersion travels with the record.",
+  "decision": "completion-state-store is elicited (enum: spa-local-storage | spa-session-storage | server-side-per-principal). Recommended default: spa-local-storage. A project that answers server-side-per-principal without an applied persistence blueprint hits a hard refusal (error class COMPLETION_STORE_MISSING_PROVIDER) at surface load; TAC-2703 refuses to construct a server-side backend and does not fall back to any other store. spa-local-storage and spa-session-storage need no persistence blueprint and construct their backend directly.",
+  "consequences": "A project with no persistence blueprint applied that answers spa-local-storage or spa-session-storage gets that backend directly; a project answering server-side-per-principal without a persistence blueprint hits COMPLETION_STORE_MISSING_PROVIDER and does not silently downgrade. The dismiss-until-next-major and dismiss-until-next-minor policies (ADR-2701) still work under any of the three shapes because the CompletionRecord.blueprintSetVersion travels with the record.",
   "alternativesConsidered": [
     {
       "name": "Alternative approach considered",
@@ -16,5 +16,5 @@
     }
   ],
   "createdAt": "2026-09-06T23:15:00Z",
-  "updatedAt": "2026-09-06T23:15:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }