rcf-lite 0.26.0 → 0.28.0

package/blueprints/application-spa/CHANGELOG.md

@@ -0,0 +1,39 @@
+# application-spa CHANGELOG
+
+## 1.5.11 - 2026-09-11
+
+- Adds a contributions/probes pack meeting rule 7d: each probe drives a real HTTP round trip against the dependency-free sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-spa/ and records the fixture-echoed x-fixture-request-id, response status, a distinctive body excerpt, the varied input and the derived output on every result row.
+- Probes: route-inventory-published, shell-nav-present, designed-empty-state.
+- Route-inventory probe injects two independent route sets into startServer({ routes }); reads /__routes and /__mounted for each; asserts both endpoints follow the injected input verbatim; asserts declared paths respond 200 and out-of-inventory paths return 404. Route inventory completeness is derived from probe-controlled input, not from fixture self-agreement.
+- Fixture README declares every env var the probes read (PORT, PROBE_PORT in the reserved 47300-47399 range). No account-bound branch: the engine is a local fixture.
+- Empty results now fail with detail "no checks ran"; anatomy test asserts each result carries evidence with a non-empty x-fixture-request-id AND a body excerpt or derived value, or an honest notObservableHere / accountBoundSkipped row carrying a shipped AC id; status zero never counts; {} is rejected as a populated derived value.
+- notObservableHere rows anchor nothing else (no anchorAcId, no anchorReqId); conformanceOnly rows carry a limitation naming the specific AC id and the property not observed.
+- Anatomy test pin bumped to 1.5.11 (probe modules, run-*.mjs wrappers, probe-utils.mjs helper, anchorReqId cross-check against contributed REQs, fixture env-var declaration).
+
+
+## 1.5.6 - 2026-09-10
+
+Template-AC fill-in clauses on AC-1101-1, AC-1102-3, AC-1106-2, AC-1114-1 and AC-1131-3 now enumerate the specific applying-project substitutions (route inventory location, secondary-navigation toggle and breakpoint, semantic-token file and added keys, journey inventory and per-step states, UI-bearing routes and strict-CSP header set) in place of the earlier generic "project-specific bindings, routes, thresholds, budgets, and names" phrasing, so applying projects have precise values to fill in.
+
+
+## 1.5.5 - 2026-09-10
+
+Dimension-d single-definition-ownership cleanup on REQ-009: REQ description now references the deep-link return-to behaviour owned on `TAC-201-application-spa-app-shell.responsibilities[5]` rather than restating it; `deliveredBy.field` re-pointed at `responsibilities[5]` (was generic `responsibilities`). Corrected the 1.5.4 changelog line that recorded the obsolete `responsibilities[0]` ownerRef for AC-1135-2 to `responsibilities[5]`. REQ-009 patch-bumped. Chain-consistency lint clean.
+
+## 1.5.4 - 2026-09-10
+
+Dimension-b acceptance-criteria-sufficiency cleanup on US-1134 and US-1135: each story previously shipped a single AC. AC-1134-2 added to bind the icon-adherence probe refusal path on inline-SVG or unknown-alias violations against the primary-navigation slot (ownerRef TAC-208.interfaces.runIconAdherenceProbe). AC-1135-2 added to bind the signed-in and post-sign-out deep-link preservation and return-to flow on the app shell (ownerRef TAC-201.responsibilities[5]). Chain-consistency lint clean.
+
+## 1.5.3 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.5.2 (2026-09-09)
+
+- Donor hand-sweep on all 197 ACs: flipped 19 additional ACs from fixed to template where the assertion carries a project-set literal (per-project section inventories, viewport table widths, journey-inventory checkpoints and events, per-route empty-state text, cache-invalidation entry sets, canonical URL shapes cache keys derive from, offline telemetry buffer bound N, per-route payload budgets, external-dependency inventory, deferral-record path and metadata, core-flow definitions, plus the AC-1111-5 tablist activation mode flip and the AC-1116-2 journey preservation set flip). Each flipped AC carries an Applying agent sets: <specific values> clause. Final split: 173 fixed / 24 template.
+- Register-and-citation sweep 2026-09-10: vendorCitation added to AC-1126-4 (WCAG 2.5.8 target-size-minimum) and AC-1126-7 (WCAG 2.2 recommendation); the completion sweep flipped AC-1111-5 and AC-1116-2 to template with Applying agent sets clauses; internal work-item ids stripped from README v1.2.0 and v1.3.0 changelog paragraphs, from TAC-209 responsibility and tradeoffs, from TAC-210 and TAC-211 purpose, and from AC-1131-3 (the class defect is named without the internal id); spa guide counts corrected to 76 documents / 35 user stories / 197 acceptance criteria.
+
+## 1.5.1 (2026-09-09)
+
+- Hardening cleanup: chain-consistency lint clean; added deliveredBy to every REQ pointing at a TAC responsibility or interface, added ownerRef and disposition to every AC per section 7b, closed case drifts on `content-security-policy` in REQ-018, AC-1125-1 and AC-1131-1 to match the owner spelling on TAC-209.
+- Added AC-1123-6 (telemetry buffer overflow with drop-oldest and drop-count observability on reconnect) on TAC-206.responsibilities[3], and AC-1107-6 (theme persistence failure: visible session-only theme, aria-live unsaved announcement, no persisted preference) on TAC-202.responsibilities[2], so applying projects have explicit acceptance criteria for both failure paths.

package/blueprints/application-spa/README.md

@@ -1,6 +1,6 @@
-# application-spa blueprint (v1.3.0)
+# application-spa blueprint (v1.5.6)
 
-The first content blueprint on the rcf-build-lite blueprint mechanism (design brief v2, ratified; Phase 2 of the blueprint programme). Scope: single-page applications with public and authenticated surfaces, session-based auth, single deployable, dark and light by default, fully responsive by default.
+Scope: single-page applications with public and authenticated surfaces, session-based auth, single deployable, dark and light by default, fully responsive by default.
 
 ## Apply
 
@@ -20,7 +20,7 @@ Phase 1 resolves local path sources only; registry and git-ref resolution is a m
 | Stylesheet | `assets/tokens/theme.css` | The tokens realised as CSS custom properties with the theme-switch, focus, and reduced-motion machinery |
 | Wireframes | `assets/wireframes/` | Nine canonical surfaces: dashboard, list, detail, form, empty, error, sign-in, sign-out, session-expired |
 | Component specs | `assets/component-specs/` | Behaviour contracts for the full application-spa-REQ-006 component inventory |
-| Viewport table | `assets/viewports.md` | The ratified 360/768/1024/1440 baseline and per-breakpoint layout rules |
+| Viewport table | `assets/viewports.md` | The shipped 360/768/1024/1440 baseline and per-breakpoint layout rules |
 | Sample data | `assets/sample-data/` | Neutral entities for skeletons, wireframe realisation, and state demos |
 | Guide | `guide/application-spa.md` | Operator-facing: when to use it, when not, what stays your call |
 | Coordination vocabulary | `docs/topics.md` | Exact global-topic strings and id number bands for composing blueprints |
@@ -29,21 +29,20 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (a shelf-wide policy) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT; the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing. Structurally the same conclusion falls out of the mechanism: an FBS binds to a bsId and a buildOrder slot the blueprint cannot know.
+No FBS contributions, as a matter of principle (a shelf-wide policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT; the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing. Structurally the same conclusion falls out of the mechanism: an FBS binds to a bsId and a buildOrder slot the blueprint cannot know.
 
 ## The five global decisions
 
 ADR-201 clientRouting, ADR-202 theming, ADR-203 clientState, ADR-204 errorEnvelope, ADR-205 authModel ship `scope: global`. Composing with the application-api-rest blueprint deliberately conflicts on `errorEnvelope` and `authModel`; see `docs/topics.md` for the exact strings, the expected resolutions, and the AC id band allocation (application-spa owns 1101-1899).
 
-## Quality bar (ratified)
-
+## Quality bar
 WCAG 2.2 AA (contrast 4.5:1 body / 3:1 large-and-non-text, visible focus, 24x24 targets, no traps), breakpoints 360/768/1024/1440 with zero horizontal overflow, dark/light token parity, modular type scale with 14/16px body floors, motion tokens honouring reduced motion, performance budget (FMP under 2s on 3G-fast, Lighthouse 90+, main-thread under 3s). Every bar is carried by ACs in the doc set, not by this README.
 
 ## What v1.1.0 adds
 
-v1.1.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump introduces the mechanism-reach cure for the icon and semantic-token disciplines that watchpost run4 caught shipping while the build cycle ran green.
+v1.1.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump binds the icon and semantic-token disciplines to build-scan probes so a violation refuses ship rather than passing silently.
 
 - `application-spa-US-1129` (anchored to application-spa-REQ-005) with four ACs binding the token-adherence probe.
 - `application-spa-US-1130` (anchored to application-spa-REQ-011) with four ACs binding the icon-adherence probe.
@@ -51,11 +50,11 @@ v1.1.0 is an additive-non-global minor bump. No global topics change; no contrib
 - `TAC-208-application-spa-icon-adherence-probe`: a Node build-scan probe the project realises; scans the component source for inline SVG outside the icon registry and for icon references naming aliases the registry does not declare, writes a stable JSON report, and exits non-zero on any violation.
 - `ADR-202-application-spa-theming` and `ADR-206-application-spa-iconography` are amended in place at version 1.1.0: the decision is unchanged; the consequences narrative names the new probe and the delivery-ci-workflows gate-failure path the probe rides.
 
-The v1.1 probes are runtime-observable AC binding at the ship gate. When a project wires each probe as a required gate in the delivery-ci-workflows runner (TAC-701), a violation refuses ship through TAC-702's per-gate report and TAC-703's aggregate report; the run4 pattern of a discipline declared but not compelled no longer applies to these two categories.
+The v1.1 probes are runtime-observable AC binding at the ship gate. When a project wires each probe as a required gate in the delivery-ci-workflows runner (TAC-701), a violation refuses ship through TAC-702's per-gate report and TAC-703's aggregate report; the earlier pattern of a discipline declared but not compelled no longer applies to these two categories.
 
 ## What v1.2.0 adds
 
-v1.2.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump cures the styled-under-shipped-CSP mechanism-reach gap watchpost caught at first production review (w-2026-08-24-003, w-2026-08-24-004): FBS-011 declared strict CSP (`style-src 'self'`, no `'unsafe-inline'`), FBS-013/015 rendered inline `<style>` blocks, every existing UI-bearing gate passed, and every production page rendered unstyled at deploy because the harness bypassed the production security-header path.
+v1.2.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump binds the styled-under-shipped-CSP discipline: TAC-209 boots the target through the production entry-point path, drives a real headless browser at every enumerated UI route, and refuses on any inline `<style>` block, any `style-src` relaxation, any browser-default computed body background, or any non-200 `text/css` stylesheet response.
 
 - `application-spa-US-1131` (anchored to application-spa-REQ-018) with six ACs binding the styled-under-shipped-CSP probe.
 - `TAC-209-application-spa-csp-styled-adherence-probe`: a Node probe the project realises; boots the target server through the production entry-point path, drives a real headless browser at every enumerated UI route, refuses on any inline `<style>` block, any style-src relaxation, any browser-default computed body background, or any non-200 text/css stylesheet response.
@@ -63,13 +62,13 @@ v1.2.0 is an additive-non-global minor bump. No global topics change; no contrib
 
 ## What v1.3.0 adds
 
-v1.3.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump cures the deployment-gate class defect the watchpost first-production review caught (w-2026-08-24-005, class cure w-2026-08-24-006): the app was signed off as DEPLOYED with the only login path (magic-link email) inert because RESEND_API_KEY carried a placeholder value, admin access was reachable only via manually minted tokens, and the gap was filed as a "quirk" note in status.md rather than blocked at gate time. A real key existed in the estate the whole time.
+v1.3.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump binds two class rules the deployment / handover gates now compel: every credential field is checked against the canonical placeholder-shape detector before an aggregate verdict of `ok` is possible, and every core user flow (including the login path when the surface carries application-spa-REQ-009) executes end-to-end against the shipped runtime.
 
 The bump encodes three class rules the deployment / handover gates now compel:
 
 1. **External-service dependency provisioning.** Every external service the app calls at runtime is enumerated on a stable manifest; every credential field is checked against the canonical placeholder-shape detector; every `verified` dependency requires captured live-handshake evidence from the shipped runtime; every `deferred` dependency requires an operator-ratified persistent record (a README note or a status.md quirk line does NOT satisfy).
 2. **Core-flow end-to-end.** Every core user flow is enumerated on a stable manifest; authentication is ALWAYS included when the app has a application-spa-REQ-009 surface; every flow executes end-to-end against the shipped runtime (production entry-point construction, production security headers, real external providers) driven by a real browser, with captured evidence per flow; a skipped, timed-out, or absent flow is a hard refusal.
-3. **Sign-off vocabulary.** A run in which every core flow completes and every external dependency is verified-or-ratified-deferred lands at aggregate verdict `ok`. Any placeholder-shape credential, any missing handshake evidence, any unratified deferral, any core-flow fail-or-skip lands at aggregate verdict `deployed-with-defects`. A "documented workaround exists" does not convert a broken flow into `ok`; the aggregate verdict is what the delivery-ci-workflows runner surfaces.
+3. **Aggregate-verdict vocabulary.** A run in which every core flow completes and every external dependency is verified-or-ratified-deferred lands at aggregate verdict `ok`. Any placeholder-shape credential, any missing handshake evidence, any unratified deferral, any core-flow fail-or-skip lands at aggregate verdict `deployed-with-defects`. A "documented workaround exists" does not convert a broken flow into `ok`; the aggregate verdict is what the delivery-ci-workflows runner surfaces.
 
 Contributions:
 

package/blueprints/application-spa/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-spa",
-  "version": "1.5.0",
+  "version": "1.5.11",
   "category": "application",
   "contributions": [
     {
@@ -415,5 +415,6 @@
       "role": "errorHandling",
       "reason": "The browser-facing error boundary constructs the internal record from a client-side exception and hands it to the applied transport writer; an error-handling companion supplies the boundary and the record factory the SPA composes on."
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11T16:04:17Z"
 }

package/blueprints/application-spa/contributions/adrs/adr-201-application-spa-routing.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-201-application-spa-routing",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Client-side routing over the History API with a declared route inventory",
   "context": "A single-page application needs one answer to how URLs map to surfaces. Implicit or component-local routing makes deep links, canonical URLs, 404 handling, and telemetry unverifiable. The route model is a whole-project decision: two routing regimes in one deployable produce broken back-button behaviour and unshareable URLs.",

package/blueprints/application-spa/contributions/adrs/adr-202-application-spa-theming.json

@@ -2,10 +2,10 @@
   "adrId": "ADR-202-application-spa-theming",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "status": "accepted",
   "title": "Semantic design tokens as CSS custom properties with a root-level theme switch",
-  "context": "Dark and light parity is a ratified requirement (application-spa-REQ-005). Parity is only checkable when every colour decision routes through a named token that exists in both palettes. How theming is realised is a whole-project decision: two theming mechanisms cannot coexist without drift. Watchpost run4 demonstrated that declaring the discipline is not the same as compelling it: raw palette values can sit in component stylesheets across passing build cycles. v1.1 pairs the decision with a runtime-observable enforcement handle so the ship gate refuses on violation, not the operator's later reading of the ADR.",
+  "context": "Dark and light parity is a shipped requirement (application-spa-REQ-005). Parity is only checkable when every colour decision routes through a named token that exists in both palettes. How theming is realised is a whole-project decision: two theming mechanisms cannot coexist without drift. A declared discipline is not the same as a compelled one: raw palette values can sit in component stylesheets across passing build cycles. The token-adherence gate enforces token parity so a violation refuses ship at gate time.",
   "decision": "The token layer in assets/tokens/design-tokens.json is the single source of colour, spacing, radius, typography, elevation, and motion values. Tokens are realised as CSS custom properties on the document root (assets/tokens/theme.css); the active theme is a data-theme attribute swap. Components consume semantic tokens only; raw palette values in component styles are a defect.",
   "consequences": "Theme parity and contrast become data checks over one JSON file. Re-skinning is a token edit. The indirection cost is one layer of naming; the working agent extends tokens by adding pairs, never by inlining values. The v1.1 token-adherence probe (TAC-207-application-spa-token-adherence-probe) is the runtime-observable handle the ship gate exercises: the probe scans the built stylesheet output for raw colour literals outside the token-realisation file and diffs the light and dark token key sets, and exits non-zero on any violation. When the probe is wired as a delivery-ci-workflows gate (TAC-701), a violation refuses ship through the ordinary gate-failure path.",
   "alternativesConsidered": [

package/blueprints/application-spa/contributions/adrs/adr-203-application-spa-client-state.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-203-application-spa-client-state",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Server-state cache separated from UI state, stale-while-revalidate by default",
   "context": "application-spa-REQ-013 requires a client cache discipline. Whether client state is one store or two regimes is a whole-project decision; mixing regimes per feature produces stale lists, flicker, and phantom optimistic state.",

package/blueprints/application-spa/contributions/adrs/adr-204-application-spa-error-envelope.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-204-application-spa-error-envelope",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "RFC 7807 problem details as the error shape the client consumes",
   "context": "The client must render errors it can rely on structurally. The wire error shape is a whole-project decision shared with whatever serves the API; this ADR records the client half. A application-api-rest blueprint applied to the same project contributes its own decision on the same topic, and blueprint composition will surface that pairing for the operator to reconcile at add time. That surfacing is intended.",

package/blueprints/application-spa/contributions/adrs/adr-205-application-spa-auth-model.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-205-application-spa-auth-model",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Cookie-based session authentication with client-side expiry handling",
   "context": "The blueprint scope is public plus authenticated surfaces with session-based auth. The authentication model is a whole-project decision: the client, the API, and the deploy target must hold the same answer. A application-api-rest blueprint contributes its own decision on this topic; composition surfaces the pairing for operator reconciliation, which is intended.",

package/blueprints/application-spa/contributions/adrs/adr-206-application-spa-iconography.json

@@ -2,10 +2,10 @@
   "adrId": "ADR-206-application-spa-iconography",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "status": "accepted",
   "title": "One icon set behind semantic aliases",
-  "context": "application-spa-REQ-011 requires a single icon set. Which construction (stroke width, grid) and how components reference icons needs one recorded answer inside the SPA. Watchpost run4 demonstrated that recording the discipline is not the same as compelling it: a build cycle passed while eight surfaces shipped zero icons. v1.1 pairs the decision with a runtime-observable enforcement handle so the ship gate refuses on violation, not the operator's later reading of the ADR.",
+  "context": "application-spa-REQ-011 requires a single icon set. Which construction (stroke width, grid) and how components reference icons needs one recorded answer inside the SPA. A recorded discipline is not the same as a compelled one: raw inline SVG can sit outside the registry across passing build cycles. The icon-adherence gate enforces registry use so a violation refuses ship at gate time.",
   "decision": "The project selects exactly one icon set (consistent stroke and grid across all glyphs) and components reference icons only through semantic aliases (icon.close, icon.danger, icon.search, and peers) declared in one registry. Bespoke per-component artwork requires extending the registry, not inlining SVG.",
   "consequences": "Swapping icon sets is a registry edit. Decorative versus meaningful icon semantics get one enforcement point for the application-spa-REQ-019 naming rules. The v1.1 icon-adherence probe (TAC-208-application-spa-icon-adherence-probe) is the runtime-observable handle the ship gate exercises: the probe scans the component source for inline SVG outside the registry and for icon references naming aliases the registry does not declare, and exits non-zero on any violation. When the probe is wired as a delivery-ci-workflows gate (TAC-701), a violation refuses ship through the ordinary gate-failure path.",
   "createdAt": "2026-08-19T09:00:00Z",

package/blueprints/application-spa/contributions/adrs/adr-207-application-spa-motion.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-207-application-spa-motion",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Motion tokens with ease-out defaults and a reduced-motion kill switch",
   "context": "application-spa-REQ-012 requires tokenised motion. The duration range, easing family, and the reduced-motion mechanism need one recorded answer inside the SPA.",

package/blueprints/application-spa/contributions/adrs/adr-208-application-spa-i18n.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-208-application-spa-i18n",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "String extraction and locale-aware formatting from day one, translations deferred",
   "context": "application-spa-REQ-015 requires internationalisation readiness without shipping translations. The mechanism needs one recorded answer inside the SPA.",

package/blueprints/application-spa/contributions/adrs/adr-209-application-spa-telemetry-naming.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-209-application-spa-telemetry-naming",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Typed journey-checkpoint events named domain.surface.action",
   "context": "application-spa-REQ-016 requires named events. Free-text names drift with refactors and kill dashboard continuity; the scheme needs one recorded answer inside the SPA.",

package/blueprints/application-spa/contributions/probes/designed-empty-state.mjs

@@ -0,0 +1,72 @@
+// designed-empty-state probe for application-spa v1.5.11.
+//
+// Verifies AC-1117-1: every data-bearing route renders a designed
+// loading, empty, error and success state (not a generic frame).
+// The probe drives every data-bearing route through each of the
+// four state values via ?state= and asserts the state-specific
+// region markers.
+//
+// anchorAcId: application-spa-AC-1117-1.
+
+import { startFixture, evidenceFromResponse } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-spa-REQ-010';
+export const accountBound = false;
+
+const STATES = ['loading', 'empty', 'error', 'success'];
+
+function stateMarkers(state) {
+  if (state === 'loading') return { attr: /data-route-state="loading"/, region: /aria-busy="true"/ };
+  if (state === 'empty') return { attr: /data-route-state="empty"/, region: /data-empty-state=/ };
+  if (state === 'error') return { attr: /data-route-state="error"/, region: /data-state="error"/ };
+  return { attr: /data-route-state="success"/, region: /data-state="success"/ };
+}
+
+export default async function runProbe() {
+  const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js');
+  const fixture = await startFixture({ startServer, port: 0 });
+  try {
+    const results = [];
+
+    const routesRes = await fetch(`${fixture.baseUrl}/__routes`);
+    const routesJson = JSON.parse(await routesRes.text());
+    const dataBearing = (routesJson.routes || []).filter((r) => r.dataBearing);
+
+    const matrix = {};
+    let allPass = true;
+    let lastRes = null, lastBody = null, lastRoute = null;
+    for (const r of dataBearing) {
+      matrix[r.path] = {};
+      for (const state of STATES) {
+        const res = await fetch(`${fixture.baseUrl}${r.path}?state=${state}`);
+        const body = await res.text();
+        lastRes = res; lastBody = body; lastRoute = `${r.path}?state=${state}`;
+        const markers = stateMarkers(state);
+        const attrOk = markers.attr.test(body);
+        const regionOk = markers.region.test(body);
+        const pass = res.status === 200 && attrOk && regionOk;
+        matrix[r.path][state] = { status: res.status, attrOk, regionOk, pass };
+        if (!pass) allPass = false;
+      }
+    }
+    const overallPass = allPass && dataBearing.length > 0;
+    results.push({
+      anchorAcId: 'application-spa-AC-1117-1',
+      anchorReqId: 'application-spa-REQ-010',
+      verdict: overallPass ? 'pass' : 'fail',
+      detail: `Every data-bearing route renders designed loading, empty, error, - drove ${dataBearing.length} data-bearing routes through 4 states each (${dataBearing.length * 4} observations); all state markers present: ${allPass}`,
+      evidence: evidenceFromResponse({
+        route: lastRoute || '/reports?state=empty',
+        response: lastRes,
+        bodyText: lastBody,
+        extraFields: {
+          input: { dataBearingPaths: dataBearing.map((r) => r.path), states: STATES },
+          derived: { matrix, allPass },
+        },
+      }),
+    });
+    return { results };
+  } finally {
+    await fixture.close();
+  }
+}

package/blueprints/application-spa/contributions/probes/probe-utils.mjs

@@ -0,0 +1,177 @@
+// Shared helpers for application-spa probes.
+//
+// The engine under probe is the sample-app fixture at
+// packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js. The
+// fixture stamps an x-fixture-request-id header on every response as
+// part of its own request pipeline (no probe-side monkey-patch), so
+// the identifier the probe records is the identifier the engine
+// itself issued. Probes call the fixture over real HTTP via node's
+// fetch, vary inputs, assert derived outputs, and record the
+// request-id, status, body excerpt, the varied input and the derived
+// output as evidence on every result row.
+// No account-bound branch: the engine is a local fixture, not a
+// third-party account, so no CI_HAS_* gate is invented. Every env
+// var this pack reads is declared on the fixture README.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-application-spa');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/application-spa');
+
+export const DEFAULT_PORT = 0;
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+// Empty results never pass: a synthesised row is emitted with an actionable detail and its
+// own evidence object recording the empty condition so the row is
+// not a naked verdict scalar.
+export function normaliseResults(results) {
+  if (!Array.isArray(results) || results.length === 0) {
+    return [{
+      anchorReqId: 'unknown',
+      verdict: 'fail',
+      detail: 'no checks ran',
+      evidence: {
+        reason: 'empty-results',
+        route: 'n/a',
+        status: 0,
+        xFixtureRequestId: null,
+        bodyExcerpt: '',
+      },
+    }];
+  }
+  return results;
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: 'application-spa',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+// Starts the fixture on an ephemeral port (or PROBE_PORT when set)
+// and returns { server, port, baseUrl, close }. The close helper
+// rejects when the underlying close callback carries an error;
+// swallowing a teardown error would hide a boundary failure.
+export async function startFixture({ startServer, port } = {}) {
+  const resolvedPort = typeof port === 'number'
+    ? port
+    : Number(process.env.PROBE_PORT ?? DEFAULT_PORT);
+  const started = await startServer({ port: resolvedPort });
+  return {
+    server: started.server,
+    port: started.port,
+    baseUrl: `http://127.0.0.1:${started.port}`,
+    close: () => new Promise((res, rej) => started.server.close((err) => {
+      if (err) rej(err);
+      else res();
+    })),
+  };
+}
+
+// Reads a distinctive slice of a response body: the first N chars
+// so the report carries a body excerpt alongside the header id.
+export function bodyExcerpt(text, max = 240) {
+  if (text == null) return '';
+  const s = typeof text === 'string' ? text : String(text);
+  return s.length > max ? s.slice(0, max) + '...' : s;
+}
+
+// Records the positive-evidence shape on a probe result. Every row
+// carries route, status, the request id the fixture stamped, and a
+// body excerpt; the caller may extend the object with the varied
+// input and the derived output for that row.
+export function evidenceFromResponse({ route, response, bodyText, extraFields }) {
+  return {
+    route,
+    status: response.status,
+    xFixtureRequestId: response.headers.get('x-fixture-request-id') || null,
+    bodyExcerpt: bodyExcerpt(bodyText),
+    ...(extraFields ?? {}),
+  };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results: normaliseResults(results), extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict !== 'pass') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorReqId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+      evidence: {
+        reason: 'probe-threw',
+        route: 'n/a',
+        status: 0,
+        xFixtureRequestId: null,
+        bodyExcerpt: err && err.stack ? String(err.stack).slice(0, 240) : '',
+      },
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// Browser-observable properties are AMBER on the shelf by ruling.
+// A row that names such a property is recorded as notObservableHere
+// carrying an object with the AC id and a reason; the tally script
+// reads notObservableHere.ac to accept the row.
+export function notObservableHereResult({ ac, anchorAcId, detail, reason, evidence } = {}) {
+  // A notObservableHere row anchors nothing else: no anchorAcId,
+  // no anchorReqId - only notObservableHere.ac.
+  const acId = ac || anchorAcId;
+  return {
+    verdict: 'pass',
+    notObservableHere: {
+      ac: acId,
+      reason: reason || 'not observable on server-side probe pack; needs a browser-driven runner',
+    },
+    detail: detail || 'not observable on server-side probe pack',
+    evidence: {
+      reason: reason || 'not observable here; needs a browser-driven probe runner',
+      ...(evidence || {}),
+    },
+  };
+}
+
+// A row that keeps a real observation but records that the
+// observation only covers part of an AC uses conformanceOnly +
+// limitation carrying the AC id and the property not observed.
+export function conformanceOnlyResult({ anchorAcId, anchorReqId, verdict, detail, evidence, limitation }) {
+  return {
+    ...(anchorAcId ? { anchorAcId } : {}),
+    ...(anchorReqId ? { anchorReqId } : {}),
+    verdict: verdict || 'pass',
+    conformanceOnly: true,
+    limitation: limitation || 'browser-observable property not asserted from the server-side probe',
+    detail,
+    evidence,
+  };
+}