rcf-lite 0.27.0 → 0.28.0

package/blueprints/application-empty-error-states/contributions/probes/run-not-found-and-recovery.mjs

@@ -0,0 +1,5 @@
+import runProbe from './not-found-and-recovery.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-empty-error-states/server.js', healthy: true };
+runShim('not-found-and-recovery', engine, runProbe);

package/blueprints/application-empty-error-states/contributions/probes/run-permission-denied-and-offline.mjs

@@ -0,0 +1,5 @@
+import runProbe from './permission-denied-and-offline.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-empty-error-states/server.js', healthy: true };
+runShim('permission-denied-and-offline', engine, runProbe);

package/blueprints/application-error-handling/CHANGELOG.md

@@ -1,17 +1,56 @@
 # application-error-handling CHANGELOG
 
+## 1.0.12 - 2026-09-11
+
+- The AC-16102-4 (mid-stream close) row's shipped comment block in two-boundaries-registered.mjs is rewritten to describe the row as a full anchored counting result rather than a conformanceOnly slice with a browser-network limitation: every clause of the AC (connection closed without rewriting the wire, exactly one companion emission at error level naming the streaming-in-progress condition, and category 'unknown' unless supplied) is observable on this pack, and no browser-network sub-clause is carved out.
+- The AC-16102-4 row's detail is rewritten to open with the AC's first eight words ("Given a handler that throws AFTER the response") and describes the observation directly, without the earlier "server-observable slice" wording. The predicate, evidence and verdict are unchanged; only the shipped comment and detail prose move.
+- The shared anatomy result-shape helper (packages/rcf-lite/test/blueprint/_result-shape.mjs) adds a fourth tightening rule: a counting row (a row that reached the post-notObservableHere / post-conformanceOnly branch) must carry at least one shipped anchor - anchorAcId or anchorReqId. A negative synthetic case (unanchored counting row must fail) and a positive synthetic case (anchored counting row must pass) join the existing negative-cases helper; every family's anatomy suite exercises them via runResultShapeNegativeCases.
+- Anatomy test pin bumped to 1.0.12.
+
+## 1.0.11 - 2026-09-11
+
+- AC-16102-4 (mid-stream close) is now a full counting row anchored on AC-16102-4 rather than conformanceOnly: the shipped AC description names only the connection-close, the exact companion emission, the level, message and category, and every clause is server-observable on this pack. The row records anchorAcId, verdict, a detail opening on the AC's first eight words, and evidence carrying route /stream-then-throw, status 200, the fixture-stamped x-fixture-request-id and a fully-populated derived object with the premature-close, exactly-one mid-stream emission, level, message-names-condition and category flags. The invented "browser-network view" limitation clause is dropped; AC-16102-4 no longer carries a browser-only sub-clause.
+- Detail texts continue to open with the first eight words of the AC or REQ text they observe.
+- Anatomy test pin bumped to 1.0.11.
+
+## 1.0.10 - 2026-09-11
+
+- AC-16102-4 (mid-stream close) pass predicate now REQUIRES the premature socket close: the two-boundaries-registered probe verdict is pass iff midStatus===200, prematureClose===true, exactlyOneMidEmission, midCategoryUnknown, midLevelError, and midMessageNamesCondition. A normal completed 200 response that happens to carry the partial-body prefix fails this row. `partialBodyReceived` is still recorded on evidence.derived but does not participate in the verdict.
+- The probe now reads the response body incrementally via the ReadableStream reader so the partial-body prefix delivered before the socket abort is retained in evidence.derived.partialBodyReceived (and in evidence.bodyExcerpt) even when the read then throws; earlier revisions used res.text() which discarded already-delivered chunks on the abort.
+- Anatomy test pin bumped to 1.0.10.
+
+## 1.0.9 - 2026-09-11
+
+- /stream-then-throw now flushes headers, writes the partial body and, once the write drains, tears the socket down via req.socket.destroy(); res.end() is deliberately not called, so a well-behaved client observes a premature-close error after receiving the 200 headers and the partial-body prefix.
+- Companion invocations now record level (always 'error') and message alongside category, correlationId and source, so probes can observe the emitted level and the emitted message without parsing stderr.
+- AC-16102-4 (mid-stream close) is a conformanceOnly row anchored on AC-16102-4: the probe drives /stream-then-throw and observes (i) the client's premature-close error after the partial-body prefix landed, (ii) exactly one companion emission with category='unknown', level='error', and a message naming the streaming-in-progress condition, and (iii) the recorded 200 status and x-fixture-request-id on the response. The limitation names that the browser-network view of the aborted socket (what a browser network log records for the close condition) is the only clause of AC-16102-4 not observed here.
+- AC-16105-4 is now a conformanceOnly row anchored on AC-16105-4 in the category-vocabulary probe: the probe observes only clause (c), the record-construction refusal of an unelicited category token via /construct/<token>, and the limitation names that clauses (a) and (b) (the mapper reading the applied per-class contract for an elicited additional category and writing the elicited retry hint) require an applying project with a classification-additions elicit and a per-class retry contract, which this probe pack does not ship.
+- Detail texts continue to open with the first eight words of the AC or REQ text they observe.
+- Anatomy test pin bumped to 1.0.9.
+
+## 1.0.8 - 2026-09-11
+
+- Adds a contributions/probes pack meeting rule 7d.
+- Probes: two-boundaries-registered, category-vocabulary, record-shape-adr-1701.
+- Framework boundary probe drives /throw-handler whose handler throws an Error whose induced stack carries system-path substrings and a file-URI substring; the wire body is inspected for those substrings and for stack markers. That observation targets AC-16102-2 and is anchored to it.
+- Process boundary probe spawns the fixture as a child with crashOnRequest=true, hits /crash-real which schedules a real uncaught throw via setImmediate after the response is committed; the registered uncaughtException handler emits the error record (code, category unknown, message, correlationId, cause with stack, context) ONLY through the injected logging companion (no direct stdout or stderr write of the record per REQ-004), then writes a level=info type=companion-dump JSON line to stderr carrying the companion's invocations array, then process.exit(1); the probe reads the companion-dump stderr line and OS exit code from the child.on('exit') event.
+- REQ-004 companion-invocation observation reads the companion-dump stderr line the child writes just before process.exit; both the framework path (an in-process /throw-handler request) AND the process path (the emit written by the uncaughtException handler before process.exit) show up in the companion's invocation list on that same child. No in-process /crash-process short-circuit is used for REQ-004 evidence.
+- AC-16102-4 (mid-stream close) is a conformanceOnly row anchored on AC-16102-4 in this version: the probe drives /stream-then-throw so the fixture flushes headers, writes a partial body, then the framework boundary catches a mid-stream exception, emits EXACTLY ONE record through the injected companion factory naming the streaming-in-progress condition with category 'unknown'; the row observes exact-one-emission and category server-side and carries a limitation naming that the browser-network wire-close half is not observable on a server-driven probe pack.
+- The process-boundary result records the correlationId as its own record.correlationId, and the evidence status field carries the OS exit code (numeric), not an HTTP-shaped fabrication.
+- Detail texts open with the first eight words of the AC or REQ text they observe.
+- Anatomy test pin bumped to 1.0.8.
+
+
 ## 1.0.3 (register-sweep patch, 2026-09-10)
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.0.2 (application-core completion pass, 2026-09-09)
+## 1.0.2 (2026-09-09)
 
 - Adds top-level elicits[] block on blueprint.json declaring the one apply-time answer (classification-additions); backed by REQ-003 naming the transient/permanent/unknown defaults and the elicited-additions grammar per section 7c.
 - Adds refusal-path ACs to US-16102 (stack-and-path scrubbing, non-Error throw defaults, mid-stream exception connection close), US-16104 (non-object context refusal, nested-and-array redaction, circular context handling), US-16105 (permanent no-Retry-After, unknown mapped as permanent, elicited-category retry contract), US-16106 (no-companion fallback stderr JSON single line, direct console.error passthrough, companion factory throw fallback), US-16107 (null-injection refusal, stub invocation contract, transportWriter throw recovery). US-16101 and US-16103 also extended with clean-shutdown preservation, browser-runtime path, double-throw handling, deep cause chain, cause-context redaction and null-vs-undefined cause discipline. Every story now at the 7a floor (4-5 ACs per story, 30 ACs total).
 
-## 1.0.1 (application-core hardening, 2026-09-09)
-
-- hardening pass: chain-consistency lint zero (pass1 + pass2); added deliveredBy to every REQ, added ownerRef and disposition to every AC per section 7b, closed `boundaryFor` and `transportWriter` restatements on AC-16107-1 via ownerRef back to TAC-1701.
-- Added AC-16101-2 (unhandled promise rejection: one record under the `unknown` category, process terminates with exit code 1) covering the 2026-09-08 review finding F-1 on TAC-1701.responsibilities[0].
-
+## 1.0.1 (2026-09-09)
 
+- Hardening cleanup: chain-consistency lint clean; added deliveredBy to every REQ, added ownerRef and disposition to every AC per section 7b, closed `boundaryFor` and `transportWriter` restatements on AC-16107-1 via ownerRef back to TAC-1701.
+- Added AC-16101-2 (unhandled promise rejection: one record under the `unknown` category, process terminates with exit code 1) on TAC-1701.responsibilities[0], so applying projects have an explicit acceptance criterion for the unhandled-rejection path.

package/blueprints/application-error-handling/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-error-handling",
-  "version": "1.0.3",
+  "version": "1.0.12",
   "category": "application",
   "providesRoles": [
     "errorHandling"
@@ -108,5 +108,6 @@
       "elicited": false,
       "standardsTraceClause": "generic enterprise practice"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11T16:04:17Z"
 }

package/blueprints/application-error-handling/contributions/probes/category-vocabulary.mjs

@@ -0,0 +1,90 @@
+// category-vocabulary probe for application-error-handling v1.0.12.
+//
+// Verifies the ADR-1702 recommended default vocabulary (transient,
+// permanent, unknown) via REQ-003 for the pass rows and AC-16105-4
+// for the unelicited-token refusal row.
+//
+// anchorReqId: application-error-handling-REQ-003 on the accepted
+// vocabulary rows; anchorAcId: application-error-handling-AC-16105-4
+// on the refusal row.
+
+import { startFixture, evidenceFromResponse, conformanceOnlyResult } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-error-handling-REQ-003';
+export const accountBound = false;
+
+const RECOMMENDED = ['transient', 'permanent', 'unknown'];
+
+export default async function runProbe() {
+  const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-error-handling/server.js');
+  const fixture = await startFixture({ startServer, port: 0 });
+  try {
+    const results = [];
+    for (const cat of RECOMMENDED) {
+      const res = await fetch(`${fixture.baseUrl}/construct/${cat}`);
+      const body = await res.text();
+      const rec = JSON.parse(body);
+      const pass = res.status === 200 && rec.category === cat;
+      results.push({
+        anchorReqId: 'application-error-handling-REQ-003',
+        verdict: pass ? 'pass' : 'fail',
+        detail: pass
+          ? `Every error class is classified transient, permanent or - /construct/${cat} returned record with category="${cat}"`
+          : `Every error class is classified transient, permanent or - category fault: cat=${cat} status=${res.status} returnedCategory=${rec.category}`,
+        evidence: evidenceFromResponse({
+          route: `/construct/${cat}`,
+          response: res,
+          bodyText: body,
+          extraFields: {
+            input: { requestedCategory: cat },
+            derived: { returnedCategory: rec.category },
+          },
+        }),
+      });
+    }
+
+    // AC-16105-4 partial slice: the AC covers an applying project
+    // that elicited additional categories via the
+    // classification-additions elicit and asserts (a) the mapper
+    // reads the applied per-class contract, (b) it writes the
+    // elicited retry hint alongside the ADR-1702 defaults, and
+    // (c) an unelicited category token is refused at record
+    // construction per REQ-002. This probe pack ships no
+    // classification-additions elicit and no applied per-class
+    // retry contract, so clauses (a) and (b) cannot be observed
+    // here. The probe observes clause (c) only: /construct/<token>
+    // returns 400 naming the refused token and the accepted set,
+    // which is the record-construction refusal REQ-002 requires.
+    // The row is conformanceOnly anchored on AC-16105-4 with a
+    // limitation naming the two clauses not observed here.
+    const bad = await fetch(`${fixture.baseUrl}/construct/notARealCategory`);
+    const badBody = await bad.text();
+    const badParsed = JSON.parse(badBody);
+    const refusalOk = bad.status === 400
+      && badParsed.error === 'unelicited-category'
+      && badParsed.refused === 'notARealCategory'
+      && Array.isArray(badParsed.accepted)
+      && RECOMMENDED.every((c) => badParsed.accepted.includes(c));
+    results.push(conformanceOnlyResult({
+      anchorAcId: 'application-error-handling-AC-16105-4',
+      anchorReqId: 'application-error-handling-REQ-003',
+      verdict: refusalOk ? 'pass' : 'fail',
+      detail: refusalOk
+        ? `Given a project that elicited additional categories via - refusal-of-unelicited slice observed: /construct/notARealCategory returns 400 error=unelicited-category refused=${badParsed.refused} accepted=${JSON.stringify(badParsed.accepted)}`
+        : `Given a project that elicited additional categories via - refusal fault: status=${bad.status} error=${badParsed.error} refused=${badParsed.refused} accepted=${JSON.stringify(badParsed.accepted)}`,
+      evidence: evidenceFromResponse({
+        route: '/construct/notARealCategory',
+        response: bad,
+        bodyText: badBody,
+        extraFields: {
+          input: { requestedCategory: 'notARealCategory' },
+          derived: { httpStatus: bad.status, refused: badParsed.refused, accepted: badParsed.accepted },
+        },
+      }),
+      limitation: 'application-error-handling-AC-16105-4: the AC also requires (a) that the mapper reads the applied per-class contract for an elicited additional category and (b) that the wire response carries the retry hint the elicited class contract specifies; this probe pack ships no classification-additions elicit and no applied per-class retry contract, so those two clauses are not observed here. The observed clause is (c): an unelicited category token is refused at record construction (REQ-002 refusal path)',
+    }));
+    return { results };
+  } finally {
+    await fixture.close();
+  }
+}

package/blueprints/application-error-handling/contributions/probes/probe-utils.mjs

@@ -0,0 +1,177 @@
+// Shared helpers for application-error-handling probes.
+//
+// The engine under probe is the sample-app fixture at
+// packages/rcf-lite/test/fixtures/probe-pack-application-error-handling/server.js. The
+// fixture stamps an x-fixture-request-id header on every response as
+// part of its own request pipeline (no probe-side monkey-patch), so
+// the identifier the probe records is the identifier the engine
+// itself issued. Probes call the fixture over real HTTP via node's
+// fetch, vary inputs, assert derived outputs, and record the
+// request-id, status, body excerpt, the varied input and the derived
+// output as evidence on every result row.
+// No account-bound branch: the engine is a local fixture, not a
+// third-party account, so no CI_HAS_* gate is invented. Every env
+// var this pack reads is declared on the fixture README.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-application-error-handling');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/application-error-handling');
+
+export const DEFAULT_PORT = 0;
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+// Empty results never pass: a synthesised row is emitted with an actionable detail and its
+// own evidence object recording the empty condition so the row is
+// not a naked verdict scalar.
+export function normaliseResults(results) {
+  if (!Array.isArray(results) || results.length === 0) {
+    return [{
+      anchorReqId: 'unknown',
+      verdict: 'fail',
+      detail: 'no checks ran',
+      evidence: {
+        reason: 'empty-results',
+        route: 'n/a',
+        status: 0,
+        xFixtureRequestId: null,
+        bodyExcerpt: '',
+      },
+    }];
+  }
+  return results;
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: 'application-error-handling',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+// Starts the fixture on an ephemeral port (or PROBE_PORT when set)
+// and returns { server, port, baseUrl, close }. The close helper
+// rejects when the underlying close callback carries an error;
+// swallowing a teardown error would hide a boundary failure.
+export async function startFixture({ startServer, port } = {}) {
+  const resolvedPort = typeof port === 'number'
+    ? port
+    : Number(process.env.PROBE_PORT ?? DEFAULT_PORT);
+  const started = await startServer({ port: resolvedPort });
+  return {
+    server: started.server,
+    port: started.port,
+    baseUrl: `http://127.0.0.1:${started.port}`,
+    close: () => new Promise((res, rej) => started.server.close((err) => {
+      if (err) rej(err);
+      else res();
+    })),
+  };
+}
+
+// Reads a distinctive slice of a response body: the first N chars
+// so the report carries a body excerpt alongside the header id.
+export function bodyExcerpt(text, max = 240) {
+  if (text == null) return '';
+  const s = typeof text === 'string' ? text : String(text);
+  return s.length > max ? s.slice(0, max) + '...' : s;
+}
+
+// Records the positive-evidence shape on a probe result. Every row
+// carries route, status, the request id the fixture stamped, and a
+// body excerpt; the caller may extend the object with the varied
+// input and the derived output for that row.
+export function evidenceFromResponse({ route, response, bodyText, extraFields }) {
+  return {
+    route,
+    status: response.status,
+    xFixtureRequestId: response.headers.get('x-fixture-request-id') || null,
+    bodyExcerpt: bodyExcerpt(bodyText),
+    ...(extraFields ?? {}),
+  };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results: normaliseResults(results), extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict !== 'pass') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorReqId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+      evidence: {
+        reason: 'probe-threw',
+        route: 'n/a',
+        status: 0,
+        xFixtureRequestId: null,
+        bodyExcerpt: err && err.stack ? String(err.stack).slice(0, 240) : '',
+      },
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// Browser-observable properties are AMBER on the shelf by ruling.
+// A row that names such a property is recorded as notObservableHere
+// carrying an object with the AC id and a reason; the tally script
+// reads notObservableHere.ac to accept the row.
+export function notObservableHereResult({ ac, anchorAcId, detail, reason, evidence } = {}) {
+  // A notObservableHere row anchors nothing else: no anchorAcId,
+  // no anchorReqId - only notObservableHere.ac.
+  const acId = ac || anchorAcId;
+  return {
+    verdict: 'pass',
+    notObservableHere: {
+      ac: acId,
+      reason: reason || 'not observable on server-side probe pack; needs a browser-driven runner',
+    },
+    detail: detail || 'not observable on server-side probe pack',
+    evidence: {
+      reason: reason || 'not observable here; needs a browser-driven probe runner',
+      ...(evidence || {}),
+    },
+  };
+}
+
+// A row that keeps a real observation but records that the
+// observation only covers part of an AC uses conformanceOnly +
+// limitation carrying the AC id and the property not observed.
+export function conformanceOnlyResult({ anchorAcId, anchorReqId, verdict, detail, evidence, limitation }) {
+  return {
+    ...(anchorAcId ? { anchorAcId } : {}),
+    ...(anchorReqId ? { anchorReqId } : {}),
+    verdict: verdict || 'pass',
+    conformanceOnly: true,
+    limitation: limitation || 'browser-observable property not asserted from the server-side probe',
+    detail,
+    evidence,
+  };
+}

package/blueprints/application-error-handling/contributions/probes/record-shape-adr-1701.mjs

@@ -0,0 +1,78 @@
+// record-shape-adr-1701 probe for application-error-handling v1.0.12.
+//
+// Verifies REQ-002: the constructed record carries exactly the six
+// ADR-1701 fields (code, category, message, correlationId, cause,
+// context). When ?withCause=1 the fixture nests a full ADR-1701
+// record inside cause[] rather than a flat {message, category};
+// the probe walks the nested record for the six fields too.
+
+import { startFixture, evidenceFromResponse } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-error-handling-REQ-002';
+export const accountBound = false;
+
+const REQUIRED_EXACT = ['code', 'category', 'message', 'correlationId', 'cause', 'context'];
+
+function exactShape(rec) {
+  if (!rec || typeof rec !== 'object') return { ok: false, missing: REQUIRED_EXACT, extras: [] };
+  const actual = Object.keys(rec).sort();
+  const missing = REQUIRED_EXACT.filter((k) => !(k in rec));
+  const extras = actual.filter((k) => !REQUIRED_EXACT.includes(k));
+  return { ok: missing.length === 0 && extras.length === 0, missing, extras };
+}
+
+export default async function runProbe() {
+  const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-error-handling/server.js');
+  const fixture = await startFixture({ startServer, port: 0 });
+  try {
+    const results = [];
+
+    // Row 1: top-level shape on the transient record.
+    const res = await fetch(`${fixture.baseUrl}/construct/transient`);
+    const body = await res.text();
+    const rec = JSON.parse(body);
+    const top = exactShape(rec);
+    const topOk = res.status === 200 && top.ok
+      && rec.category === 'transient'
+      && typeof rec.correlationId === 'string' && rec.correlationId.length > 0;
+    results.push({
+      anchorReqId: 'application-error-handling-REQ-002',
+      verdict: topOk ? 'pass' : 'fail',
+      detail: `The internal error record has a stable shape: - top-level record has exactly six ADR-1701 fields; missing=[${top.missing.join(',')}] extras=[${top.extras.join(',')}]`,
+      evidence: evidenceFromResponse({
+        route: '/construct/transient',
+        response: res,
+        bodyText: body,
+        extraFields: {
+          input: { category: 'transient', withCause: false },
+          derived: { topOk: top.ok, missing: top.missing, extras: top.extras, correlationIdLen: rec.correlationId?.length ?? 0 },
+        },
+      }),
+    });
+
+    // Row 2: nested cause has the same six-field shape.
+    const res2 = await fetch(`${fixture.baseUrl}/construct/permanent?withCause=1`);
+    const body2 = await res2.text();
+    const rec2 = JSON.parse(body2);
+    const nested = exactShape(rec2.cause);
+    const nestedOk = res2.status === 200 && exactShape(rec2).ok && nested.ok;
+    results.push({
+      anchorReqId: 'application-error-handling-REQ-002',
+      verdict: nestedOk ? 'pass' : 'fail',
+      detail: `The internal error record has a stable shape: - nested cause record has exactly six ADR-1701 fields; missing=[${nested.missing.join(',')}] extras=[${nested.extras.join(',')}]`,
+      evidence: evidenceFromResponse({
+        route: '/construct/permanent?withCause=1',
+        response: res2,
+        bodyText: body2,
+        extraFields: {
+          input: { category: 'permanent', withCause: true },
+          derived: { causeShape: nested.ok, causeMissing: nested.missing, causeExtras: nested.extras, causeCorrelationId: rec2.cause?.correlationId ?? null },
+        },
+      }),
+    });
+
+    return { results };
+  } finally {
+    await fixture.close();
+  }
+}

package/blueprints/application-error-handling/contributions/probes/run-category-vocabulary.mjs

@@ -0,0 +1,5 @@
+import runProbe from './category-vocabulary.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'application-error-handling-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-error-handling/server.js' };
+runShim('category-vocabulary', engine, runProbe);

package/blueprints/application-error-handling/contributions/probes/run-record-shape-adr-1701.mjs

@@ -0,0 +1,5 @@
+import runProbe from './record-shape-adr-1701.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'application-error-handling-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-error-handling/server.js' };
+runShim('record-shape-adr-1701', engine, runProbe);

package/blueprints/application-error-handling/contributions/probes/run-two-boundaries-registered.mjs

@@ -0,0 +1,5 @@
+import runProbe from './two-boundaries-registered.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'application-error-handling-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-error-handling/server.js' };
+runShim('two-boundaries-registered', engine, runProbe);