rcf-lite 0.27.0 → 0.28.0

package/blueprints/application-notifications-in-app/CHANGELOG.md

@@ -1,5 +1,39 @@
 # application-notifications-in-app CHANGELOG
 
+## 1.2.8 - 2026-09-12
+
+- Fixture centre now carries the active query-scoped break switch into the served acknowledge form action: `/notifications-centre?break=ack` renders each per-item form with `action="/actions/acknowledge-notification?notification-id=<id>&break=ack"`, so a JS-off native form submission originating from a broken centre reaches the same broken handler branch as the API and cannot escape the `ack` refusal. Fixture README lists `POST /actions/acknowledge-notification` alongside the JSON API in the routes table and states both refuse under `?break=ack` (or `PROBE_BREAK=ack`), and the `?break=ack` row in the query-switch table now names both HTTP 502 error codes (`ACKNOWLEDGE_ROUND_TRIP_REFUSED` on the JSON API, `ACKNOWLEDGE_FORM_REFUSED` on the form action). The `/actions/acknowledge-notification` route comment corrected: with JS off the native form submission POSTs to the form action, with JS on the client script intercepts the click, calls `preventDefault` on the form, and drives the JSON API instead (previous wording claimed JS-on activation POSTs to the form route). centre-acknowledge-round-trip probe wording ("next principal load"), row detail ("next principal load"), and the 1.2.7 CHANGELOG line ("next principal load") now say "next served load of the centre" - the fixture has no notification-principal key so calling an ordinary refetch a principal load misdescribed the observation.
+
+## 1.2.7 - 2026-09-12
+
+- centre-acknowledge-round-trip AC-20103-1 positive row now observes activation causality through a served progressive-enhancement form action, not a bare API call. Fixture centre wraps each acknowledge button in `<form method="post" action="/actions/acknowledge-notification">` with the notification-id in a hidden input; a new server route accepts the form-encoded submission, flips the delivery-log `acknowledgedAt`, records both an `acknowledge-server` and an `acknowledge-form` entry on `/__requests`, and returns 200 with the applied `acknowledgedAt`; the JS-on client script now calls `preventDefault()` on the button click so only one POST fires per activation (the JSON API path stays for SPA parity). The probe fetches `/notifications-centre`, verifies the form + hidden input for the picked id, SUBMITS the served form action (content-type `application/x-www-form-urlencoded`), verifies the delivery-log flip and the request-log counts, and refetches `/notifications-centre` to observe `data-acknowledged="true"` on the same article on the next served load of the centre (proof that the served control's activation causes the acknowledged state, not just that a hand-crafted API POST does). The companion null-anchored conformance row now narrows to the browser-only same-page in-place DOM mutation the client script performs after fetch resolves (the pack browser check owns that). Fixture `?break=ack` refuses the form action too (`ACKNOWLEDGE_FORM_REFUSED`, HTTP 502) as well as the JSON API, so the anatomy negative-variant assertion continues to drive the probe to fail under `PROBE_BREAK=ack` on both paths.
+
+## 1.2.6 - 2026-09-12
+
+- centre-acknowledge-round-trip upgraded from a null-anchored conformance-only row into TWO rows: a POSITIVE row anchored to AC-20103-1 observing the surface enumeration (per-item `[data-notification-id]` wrappers, matching per-item acknowledge and mark-read controls, exactly one mark-all-read control) AND the server-side round-trip (POST `/api/notifications/acknowledge` returns 200 with the echoed `notificationId`, the delivery-log `acknowledgedAt` for the row flips from null to an ISO timestamp, `/__requests` records exactly one `acknowledge-server` entry), plus a companion CONFORMANCE-ONLY row (null anchor, `limitation` naming AC-20103-1) for the browser-only DOM `data-acknowledged="true"` flip after the fetch resolves. Fixture `?break=ack` extended to also refuse the server-side POST with HTTP 502 `ACKNOWLEDGE_ROUND_TRIP_REFUSED`, so the anatomy negative-variant map now drives the centre-acknowledge probe to fail under `PROBE_BREAK=ack` (added to `brokenExpectations`). Toast-contract row split so AC-20102-1 (browser-only priority-to-role mapping, one-shot announcement, elapsed timeout on `data-shown-at`/`data-dismissed-at`) remains `notObservableHere` without any focus-pause language (that clause is AC-20102-4), and a second null-anchored conformance row names AC-20102-4 in the `limitation` for the focus-pause + dismissal-removal properties (browser-only and unimplemented in the fixture); both rows now carry an evidence object from the fixture shell reachability fetch so the rule-7d shape and the evidence tally accept them. Positive-evidence row shape tightened in the anatomy helper: a positive row now requires a non-empty engine-returned `requestId` AND (a non-empty `bodyExcerpt` OR a non-empty `derived` object); a `{derived:{}}` alone or a `requestId` alone no longer counts, with two new negative-case tests covering the empty-derived and id-only patterns.
+
+## 1.2.5 - 2026-09-12
+
+- Rule-7d shape fix on the centre-acknowledge row: the AC-20103-1 de-claim now carries `anchorAcId: null` and names AC-20103-1 in the `limitation` field per the shipped shape (a `conformanceOnly:true` row must not simultaneously claim an anchor). Fixture README env-var manifest now declares `PROBE_BREAK` (the fixture reads it as an alternate to a per-request `?break=`) and the probe-utils `DECLARED_ENV` list mirrors the addition. Anatomy shape check tightened to reject an anchored `conformanceOnly` row (a positive evidence field no longer bypasses the null-anchor + limitation contract); a new negative-case test constructs an anchored `conformanceOnly` row and asserts the shape helper throws. Product-term usage of "round trip" / "round-trip" (request/response cycle in AC-20103-1 and in the `centre-acknowledge-round-trip` module name) stays as shipped.
+
+## 1.2.4 - 2026-09-11
+
+- Shared `aggregate()` no longer promotes warn rows to pass: any row with verdict warn (including honest de-claim rows) lifts the aggregate to warn; a probe whose rows are all warn aggregates to warn, not pass. Shared teardown propagates a SIGKILL failure through the returned kill() promise instead of swallowing it. centre-acknowledge AC-20103-1 row de-claimed to `conformanceOnly:true` with `verdict:'warn'` and a `limitation` naming the browser-only clause (control activation and DOM `data-acknowledged` mutation are not observed by a Node HTTP probe). toast-contract row keeps `notObservableHere:true` + `verdict:'warn'`; live-region-preseeding stays as a positive-observation row that fails under `?break=preseed`. Anatomy test extended with a negative-variant assertion that the shipped preseed break switch drives the live-region-preseeding aggregate to fail.
+
+## 1.2.3 - 2026-09-11
+
+- toast-contract `notObservableHere` row for AC-20102-1 now emits `verdict:'warn'` (previously `pass`); the aggregate correctly reports amber for the browser-only halves of AC-20102-1 (role mapping, elapsed timeout and focus-pause behaviour on `data-shown-at`/`data-dismissed-at`) rather than a false pass. Anatomy test extended to (a) enumerate the shipped AC/REQ id set from `contributions/user-stories/*.json` and refuse any row whose `anchorAcId` or `notObservableAcId` is not in that set, and (b) accept the conformance-only row shape (null anchor + non-empty `limitation`).
+
+## 1.2.2 - 2026-09-11
+
+- Probes rewritten to observe declared AC properties instead of static constants. live-region-preseeding now enumerates elements by `[data-live-region]` and asserts polite (aria-live="polite", empty) and assertive (role="alert", empty) semantics per AC-20101-1; positive-anchor-on-absence broken-variant row removed. toast-contract row de-claimed to notObservableHere for AC-20102-1 (role mapping, elapsed timeout and focus pausing are client-JS-driven and only observable in a browser); the static timeout-floor constant-echo row is dropped. centre-acknowledge broken-variant shortcut row removed; the positive centre-acknowledge row keeps derived evidence (acknowledgedAt flips null to ISO plus the server-side request log entry). Rule 10 applied to every row detail. Anatomy test extended to accept the notObservableHere row shape (non-empty reason + non-empty anchorAcId) alongside evidence-object and honest-skip. Register cleanup.
+
+
+## 1.2.1 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering 3 properties the fixture engine at `packages/rcf-lite/test/fixtures/probe-pack-application-notifications-in-app/server.js` answers: `live-region-preseeding`, `toast-contract`, `centre-acknowledge-round-trip`. Every response now carries an `x-fixture-request-id` header; probes record the id, the HTTP status and a body excerpt as positive evidence per rule 7d. Fixture README declares every env var the pack reads. Anatomy test at `packages/rcf-lite/test/blueprint/application-notifications-in-app-anatomy.test.js` pins the new pack files and asserts each result carries one of the four 7d evidence shapes.
+
+
 ## 1.2.0 (2026-09-10)
 
 ### Added
@@ -19,23 +53,22 @@
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.1.0 (2026-09-10, hardening pass)
+## 1.1.0 (2026-09-10)
 
 ### Added
 
-- Failure-path acceptance criteria on US-20101 (live-region wrappers pre-seeded before any state-driven mount), US-20102 (sub-6s timeout apply refusal with TOAST_TIMEOUT_TOO_SHORT, focused-toast pause per WCAG 2.2.1), US-20103 (non-2xx acknowledgement error toast with unchanged data-acknowledged, paginated fetch failure), US-20104 (failed preference write error toast with toggle rollback, idempotency of retried writes), US-20105 (delivery-row incomplete refusal), US-20106 (page-load backlog failure with cached-row banner), US-20107 (invalid toast payload refusal), US-20108 (invalid priority drop). Closes review findings F-1, F-2 and F-3.
+- Failure-path acceptance criteria on US-20101 (live-region wrappers pre-seeded before any state-driven mount), US-20102 (sub-6s timeout apply refusal with TOAST_TIMEOUT_TOO_SHORT, focused-toast pause per WCAG 2.2.1), US-20103 (non-2xx acknowledgement error toast with unchanged data-acknowledged, paginated fetch failure), US-20104 (failed preference write error toast with toggle rollback, idempotency of retried writes), US-20105 (delivery-row incomplete refusal), US-20106 (page-load backlog failure with cached-row banner), US-20107 (invalid toast payload refusal), US-20108 (invalid priority drop).
 - Vendor citations on the WCAG 2.2.1 Timing Adjustable and status-messages acceptance criteria (verified 2026-09-10).
 
 ### Changed
 
 - Every REQ now carries a deliveredBy link into TAC-2101 (live-region), TAC-2102 (centre) or TAC-2103 (preferences).
 - Every AC on every user story now carries an explicit disposition (fixed or template); ACs that observe writeDeliveryRow, renderLiveRegions, renderToast or renderCentre carry ownerRef into the owning TAC field.
-- Review fix pass (2026-09-10): README, TAC-2103 and REQ-004 register scrubbed (no operator names or work-item ids). Closes review-fix-pass findings O-2, O-3.
 
 ## 1.0.0 (visual round, spec 2026-09-04)
 
-- First ratified version of the shelf's application-notifications-in-app blueprint. Five REQs (live-region preseeding on every declared route; transient toast contract with priority-to-role mapping, one-shot announcement and timeout floor; notification centre inbox with retention and acknowledge round-trip; per-user preferences UI with category silence and sibling delegation; delivery-attempt log with operator-readable rows), eight USs binding runtime-observable ACs plus three cross-cutting cases (page load with backlog, background event, disjoint-content contract), three TACs (live-region wrappers with the toast factory; centre inbox with retention and acknowledge round-trip; preferences UI with sibling delegation), three ADRs (priority-to-role mapping polite/status vs assertive/alert per WCAG 4.1.3 and the ARIA APG alert pattern; six-second toast timeout floor per WCAG 2.2.1 with elicited overrides above the floor; thirty-day centre retention window with elicited overrides). No new global topics.
+- Initial shipped version of the shelf's application-notifications-in-app blueprint. Five REQs (live-region preseeding on every declared route; transient toast contract with priority-to-role mapping, one-shot announcement and timeout floor; notification centre inbox with retention and acknowledge round-trip; per-user preferences UI with category silence and sibling delegation; delivery-attempt log with operator-readable rows), eight USs binding runtime-observable ACs plus three cross-cutting cases (page load with backlog, background event, disjoint-content contract), three TACs (live-region wrappers with the toast factory; centre inbox with retention and acknowledge round-trip; preferences UI with sibling delegation), three ADRs (priority-to-role mapping polite/status vs assertive/alert per WCAG 4.1.3 and the ARIA APG alert pattern; six-second toast timeout floor per WCAG 2.2.1 with elicited overrides above the floor; thirty-day centre retention window with elicited overrides). No new global topics.
 - Reserves the `application-notifications-` family prefix for the sibling channel blueprints the shelf will grow into (`-email`, `-push`, `-webhook`) as a doc-only reservation on the blueprint README and every applying blueprint's `docs/topics.md` shelf band registry per the 2026-09-04 shelf decision to make the transport type explicit in the blueprint name.
 - Ships `probe-packs/application-notifications-in-app.pack.mjs`: three browser-verify checks anchored to blueprint AC ids, every check carrying a description field per spec section 9. `AC-20101-1` live-region preseeded on every declared route (wrappers present AND empty at load, enumerated by `[data-live-region]`). `AC-20102-1` transient toast contract with priority-to-role mapping and timeout measured against the ADR-2102 six-second floor via `data-shown-at`/`data-dismissed-at` timestamps (no six-second sleep in the pack; bounded polling). `AC-20103-1` centre acknowledge round-trip enumerated by `data-notification-id` (per-element attribute per gate discipline), reconciled through both `window.__notificationFetches` and the server-side request log. Fourth blueprint on the shelf that ships a Playwright probe pack under the runner extension.
 - Ships a sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-notifications-in-app/` (dependency-free Node HTTP server) so the pack can be probed at the shelf's own gate; the fixture is the golden the gate reviewer drives, with `?break=preseed`, `?break=role`, `?break=timeout` and `?break=ack` query switches for the negative runs. Three routes (`/`, `/notifications-centre`, `/notifications-preferences`); every route preseeds both live-region wrappers.
-- Suggests the `logging` and `errorHandling` companions with the ratified spec's reasons. `providesRoles` absent, leaf blueprint per the loader contract (an empty array is refused, an omitted field marks the blueprint as a leaf).
+- Suggests the `logging` and `errorHandling` companions with the shipped spec's reasons. `providesRoles` absent, leaf blueprint per the loader contract (an empty array is refused, an omitted field marks the blueprint as a leaf).

package/blueprints/application-notifications-in-app/README.md

@@ -34,7 +34,7 @@ The `application-notifications-` prefix is reserved for the sibling in-app-adjac
 - `application-notifications-push`: Web Push and platform APN/FCM notifications. Owns the subscription lifecycle and the platform-token store.
 - `application-notifications-webhook`: outbound HTTP notifications to operator-configured endpoints. Owns the delivery-retry semantics and the endpoint registry.
 
-The reservation is doc-only in v1.0.0 (per spec Q3 default): the family prefix is named in this README and in every shipped blueprint's `docs/topics.md` shelf band registry as a reserved-slot row. No sibling channel ships in this round. Any future PR that proposes a name outside the family (`application-alerts-email`, `application-messages-push`) reads against this reservation and stops at author-side review.
+The reservation is doc-only in v1.0.0: the family prefix is named in this README and in every shipped blueprint's `docs/topics.md` shelf band registry as a reserved-slot row. No sibling channel currently ships. Any proposal for a name outside the family (`application-alerts-email`, `application-messages-push`) reads against this reservation and is refused at author-side check.
 
 Digest opt-in on the preferences UI is elicited on the sibling channel, not here: the preferences UI carries a disabled section per sibling channel that is not yet applied, labelled `data-preference-status="sibling not applied"`. When the sibling ships and the applying project applies it, that sibling's own blueprint reads the operator's preference state and drives the digest transport.
 
@@ -47,8 +47,8 @@ Every route the applying project ships renders with both live-region wrappers pr
 Every runtime-observable AC that is not bound to a pack check appears here individually per the gate discipline (`blueprint-authoring-checklist.md` section 6.g): categories are not enough. The pack has three checks; every other runtime-observable AC on this blueprint is a mechanism-reach gap named below.
 
 - **AC-20101-2 live-region factory identity stable across route changes**. The pack asserts the wrappers are preseeded on every declared route (AC-20101-1); it does not assert the two wrappers are the same DOM nodes across route changes (a factory that recreates the wrappers on route change passes AC-20101-1 but fails AC-20101-2). A v1.1 minor bump could persist a `data-live-region-id` on each wrapper and assert identity across a `browser.click` on a nav link.
-- **AC-20102-2 toast factory library-scope shape**. The pack drives the runtime toast surface (AC-20102-1); the library-scope AC on the factory's own signature is a project-side review concern.
-- **AC-20103-2 centre factory reads through the delivery-log endpoint**. The pack drives the item enumeration and the acknowledge round-trip (AC-20103-1); the library-scope AC on the factory's own delivery-log read is a project-side review concern.
+- **AC-20102-2 toast factory library-scope shape**. The pack drives the runtime toast surface (AC-20102-1); the library-scope AC on the factory's own signature is a project-side check concern.
+- **AC-20103-2 centre factory reads through the delivery-log endpoint**. The pack drives the item enumeration and the acknowledge round-trip (AC-20103-1); the library-scope AC on the factory's own delivery-log read is a project-side check concern.
 - **AC-20104-1 preferences category silence**. The preferences surface renders per-category toggles but the pack does not itself activate a silence toggle and assert the round-trip today. A v1.1 minor bump could add a preferences-round-trip check paralleling AC-20103-1.
 - **AC-20104-2 sibling-channel digest section disabled when no sibling applied**. The fixture renders the disabled sections and the pack could inspect them, but the AC's real bite is when a sibling channel ships and the disabled state must lift; this class stays a v1.1 minor bump candidate for when the first sibling ships.
 - **AC-20105-1 delivery-log endpoint shape**. The pack does not enumerate every row on the log (the delivery-log's persistence is delegated to the applied `logging` companion). A v1.1 minor bump could add a log-shape probe that reads `/api/delivery-log`, asserts the row shape and confirms append-only order.
@@ -74,7 +74,7 @@ WCAG 4.1.3 Status Messages on the live-region contract (REQ-001, ADR-2101). ARIA
 
 ## Consumers and dependencies
 
-- Consumes the applied `logging` companion (or the shelf provider `observability-logging`) for the delivery-attempt log write path (REQ-005, TAC-2102) and every acknowledge round-trip record. A project without a `logging` companion applied sees the delivery-log endpoint returning an empty rows array, which fails project-side review.
+- Consumes the applied `logging` companion (or the shelf provider `observability-logging`) for the delivery-attempt log write path (REQ-005, TAC-2102) and every acknowledge round-trip record. A project without a `logging` companion applied sees the delivery-log endpoint returning an empty rows array, which fails project-side check.
 - Consumes the applied `errorHandling` companion (or the shelf provider `application-error-handling`) for the assertive-slot alert's internal error record when an acknowledge round-trip fails at the server.
 - Reserves the `application-notifications-` family prefix for sibling channel blueprints (see above).
 - Reuses the pack-browser `resize(width, height)` seam only for future minor bumps; v1.0.0 does not exercise breakpoint reflow in the pack.

package/blueprints/application-notifications-in-app/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-notifications-in-app",
-  "version": "1.2.0",
+  "version": "1.2.8",
   "category": "application",
   "suggestedCompanions": [
     {
@@ -154,5 +154,7 @@
       "kind": "string",
       "default": "20"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-12T02:05:15Z",
+  "updatedIso": "2026-09-11T22:30:00Z"
 }

package/blueprints/application-notifications-in-app/contributions/adrs/adr-2101-application-notifications-in-app-live-region-role-mapping.json

@@ -6,7 +6,7 @@
   "status": "accepted",
   "title": "Map toast priority to live-region wrapper and ARIA role from a fixed two-value enum: info to polite plus status, error to assertive plus alert",
   "context": "A transient toast needs to reach a screen reader on the queue that matches the reader's attention regime: an informational confirmation belongs on the polite queue, an error interruption belongs on the assertive queue. Free-form role assignment lets a well-meaning implementation route an error into the polite wrapper (the reader misses the interruption) or route an informational message into the assertive wrapper (the reader is interrupted for a confirmation). The WCAG 4.1.3 Status Messages clause and the ARIA APG alert pattern name the correct mapping; the problem is turning that guidance into a runtime discipline the pack can drive.",
-  "decision": "Toast priority is a two-value enum: `info` and `error`. `info` renders inside the polite wrapper (`[aria-live=\"polite\"] [data-live-region=\"polite\"]`) and carries `role=\"status\"` on the toast element. `error` renders inside the assertive wrapper (`[role=\"alert\"] [data-live-region=\"assertive\"]`) and carries `role=\"alert\"` on the toast element. A priority outside the enum is refused at project-side review. The pack asserts the priority-to-role mapping on both branches and asserts the disjoint-content rule (a body text in exactly one wrapper).",
+  "decision": "Toast priority is a two-value enum: `info` and `error`. `info` renders inside the polite wrapper (`[aria-live=\"polite\"] [data-live-region=\"polite\"]`) and carries `role=\"status\"` on the toast element. `error` renders inside the assertive wrapper (`[role=\"alert\"] [data-live-region=\"assertive\"]`) and carries `role=\"alert\"` on the toast element. A priority outside the enum is refused at project-side check. The pack asserts the priority-to-role mapping on both branches and asserts the disjoint-content rule (a body text in exactly one wrapper).",
   "consequences": "Every toast maps to a queue readers already understand; the reader hears an interruption exactly when the application asserts one. The two-value enum is honest about the shipped shelf's known cases; a third priority (`warning`) would land as a v1.1 minor bump with a shelf-wide review because it changes the role vocabulary. The disjoint-content rule keeps a double-post defect visible at ship rather than at incident.",
   "alternativesConsidered": [
     {

package/blueprints/application-notifications-in-app/contributions/probes/centre-acknowledge-round-trip.mjs

@@ -0,0 +1,210 @@
+// application-notifications-in-app probe: centre-acknowledge-round-trip
+// (AC-20103-1).
+//
+// AC-20103-1 first eight words:
+//   "Given the notification centre route with a seeded".
+//
+// AC-20103-1 has three clauses:
+//   1. Surface enumeration: /notifications-centre lists notifications
+//      with per-item [data-notification-id], [data-action="acknowledge"]
+//      and [data-action="mark-read"] controls, plus exactly one
+//      [data-action="mark-all-read"] control.
+//   2. Activation causes a POST: activating the per-item acknowledge
+//      control POSTs to the acknowledge endpoint; the server responds
+//      200 { ok:true } and the delivery log's acknowledgedAt for the
+//      row flips from null to an ISO timestamp; the round-trip is
+//      recorded on the server request log.
+//   3. Post-response DOM update on the CURRENT page: the item's
+//      data-acknowledged reads "true" after the response (client-side
+//      DOM mutation without a page reload).
+//
+// Clauses 1 and 2 are server-observable via the shipped
+// progressive-enhancement form action: the centre wraps each
+// acknowledge button in a <form method="post"
+// action="/actions/acknowledge-notification"> with the notification-id
+// in a hidden input, so a Node HTTP probe can fetch the served page,
+// find the form action, SUBMIT that form action, and observe both the
+// server-side flip (delivery-log acknowledgedAt) and the next served
+// centre page rendering data-acknowledged="true" on the same article
+// (proof that the served control's activation causes the acknowledged
+// state, not just that a bare API POST does). Clause 3 (the
+// same-page DOM mutation triggered by the JS-on client script) is
+// browser-only and covered as a null-anchored conformance de-claim.
+//
+// This probe emits TWO rows:
+//   - Row A: POSITIVE anchor to AC-20103-1 covering clauses 1 and 2
+//     (surface enumeration + activation-of-the-served-control causing
+//     the server-side round-trip and the served acknowledged state on
+//     the next centre fetch). It picks a notificationId derived from
+//     the centre HTML, verifies the article carries a form whose
+//     action points at /actions/acknowledge-notification with the
+//     principal-id in a hidden input, SUBMITS that form action, and
+//     asserts derived outputs the fixture had no choice about (the
+//     delivery-log acknowledgedAt flipping from null to an ISO
+//     timestamp for THAT id, the server request log carrying exactly
+//     one acknowledge-server entry and one acknowledge-form entry for
+//     that id, and the next-load centre HTML rendering
+//     data-acknowledged="true" on that same article).
+//   - Row B: CONFORMANCE-ONLY (null anchor) naming AC-20103-1 in the
+//     limitation for the browser-only same-page DOM flip (the client
+//     script's fetch-then-setAttribute mutation happens post-response
+//     without a reload; deferred to the browser check).
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-notifications-in-app-AC-20103-1';
+export const accountBound = false;
+
+const FIRST_EIGHT = 'Given the notification centre route with a seeded';
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const centre = await fixtureFetch(fixture.url, '/notifications-centre');
+    // Strip inline <script> blocks so the DOM-shape enumeration below
+    // does not match literal attribute strings that live inside the
+    // client script (for example a `data-notification-id="' +
+    // notificationId + '"` template string or an
+    // `[data-action="mark-all-read"]` selector inside JS).
+    const centreDom = centre.body.replace(/<script\b[\s\S]*?<\/script>/gi, '');
+    const ids = Array.from(centreDom.matchAll(/data-notification-id="([^"]+)"/g)).map((m) => m[1]);
+    const uniqueIds = Array.from(new Set(ids));
+    const notificationId = uniqueIds[0] ?? null;
+    const perItemAckControls = Array.from(centreDom.matchAll(/<button[^>]*data-action="acknowledge"[^>]*data-notification-id="([^"]+)"/g)).map((m) => m[1]);
+    const markReadControls = Array.from(centreDom.matchAll(/<button[^>]*data-action="mark-read"[^>]*data-notification-id="([^"]+)"/g)).map((m) => m[1]);
+    const markAllReadCount = (centreDom.match(/<button[^>]*data-action="mark-all-read"/g) || []).length;
+    // Find the acknowledge form wrapping the picked notificationId's
+    // button. The form action is the observable activation surface
+    // (JS-off progressive enhancement); the hidden input carries the
+    // notification-id so the POST body identifies the row without
+    // relying on the query string.
+    const ackFormMatch = notificationId
+      ? centreDom.match(new RegExp('<form[^>]*method="post"[^>]*action="([^"]*\\/actions\\/acknowledge-notification[^"]*)"[^>]*data-notification-id="' + notificationId + '"[^>]*>[\\s\\S]*?<input[^>]*type="hidden"[^>]*name="notification-id"[^>]*value="' + notificationId + '"[\\s\\S]*?<button[^>]*data-action="acknowledge"[^>]*data-notification-id="' + notificationId + '"[\\s\\S]*?<\\/form>', 'i'))
+      : null;
+    const ackFormAction = ackFormMatch ? ackFormMatch[1] : null;
+    const ackFormPresent = !!ackFormMatch && !!ackFormAction;
+    const surfaceOk = centre.status === 200 && !!centre.requestId
+      && uniqueIds.length >= 1
+      && perItemAckControls.length === uniqueIds.length
+      && markReadControls.length === uniqueIds.length
+      && markAllReadCount === 1
+      && ackFormPresent;
+
+    const beforeLog = await fixtureFetch(fixture.url, '/api/delivery-log');
+    let beforeRow = null;
+    try { beforeRow = (JSON.parse(beforeLog.body).rows || []).find((r) => r.notificationId === notificationId) || null; } catch (_) { /* parse */ }
+
+    // Submit the served form action as a native form submission would:
+    // a POST with content-type application/x-www-form-urlencoded and
+    // the hidden input's name=value pair in the body. This proves
+    // activation causality: the served form action is what caused the
+    // server-side acknowledge, not a hand-crafted API call.
+    const formBody = 'notification-id=' + encodeURIComponent(notificationId ?? '');
+    const ack = await fixtureFetch(fixture.url, ackFormAction ?? '/actions/acknowledge-notification', {
+      method: 'POST',
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: formBody,
+    });
+    let ackBody = null;
+    try { ackBody = JSON.parse(ack.body); } catch (_) { /* parse */ }
+
+    const afterLog = await fixtureFetch(fixture.url, '/api/delivery-log');
+    let afterRow = null;
+    try { afterRow = (JSON.parse(afterLog.body).rows || []).find((r) => r.notificationId === notificationId) || null; } catch (_) { /* parse */ }
+
+    // Refetch the served centre page: the SAME article should now render
+    // data-acknowledged="true" (proof that activation of the served
+    // control produces the acknowledged state on the next served load
+    // of the centre - the AC's "the item's data-acknowledged reads true
+    // after the response" clause, observed via the server-rendered
+    // next-load rather than the browser-only same-page DOM mutation).
+    const centreAfter = await fixtureFetch(fixture.url, '/notifications-centre');
+    const centreAfterDom = centreAfter.body.replace(/<script\b[\s\S]*?<\/script>/gi, '');
+    const acknowledgedArticleMatch = notificationId
+      ? centreAfterDom.match(new RegExp('<article[^>]*data-notification-id="' + notificationId + '"[^>]*data-acknowledged="([^"]+)"'))
+      : null;
+    const nextLoadAcknowledgedAttr = acknowledgedArticleMatch ? acknowledgedArticleMatch[1] : null;
+
+    const requestsAfter = await fixtureFetch(fixture.url, '/__requests');
+    let requestEntries = [];
+    try { requestEntries = JSON.parse(requestsAfter.body); } catch (_) { /* parse */ }
+    const ackServerLogs = requestEntries.filter((e) => e.kind === 'acknowledge-server' && e.notificationId === notificationId);
+    const ackFormLogs = requestEntries.filter((e) => e.kind === 'acknowledge-form' && e.notificationId === notificationId);
+
+    const roundTripPass = ack.status === 200
+      && !!ack.requestId
+      && ackBody && ackBody.ok === true && ackBody.notificationId === notificationId
+      && typeof ackBody.acknowledgedAt === 'string' && /^\d{4}-\d{2}-\d{2}T/.test(ackBody.acknowledgedAt)
+      && !!beforeRow && beforeRow.acknowledgedAt === null
+      && !!afterRow && typeof afterRow.acknowledgedAt === 'string' && /^\d{4}-\d{2}-\d{2}T/.test(afterRow.acknowledgedAt)
+      && ackServerLogs.length === 1
+      && ackFormLogs.length === 1
+      && nextLoadAcknowledgedAttr === 'true';
+
+    const positivePass = surfaceOk && roundTripPass;
+
+    results.push({
+      anchorAcId,
+      verdict: positivePass ? 'pass' : 'fail',
+      detail: positivePass
+        ? `${FIRST_EIGHT} backlog, /notifications-centre enumerated ${uniqueIds.length} [data-notification-id] wrappers with matching per-item acknowledge and mark-read controls and exactly one mark-all-read control; the acknowledge control for notificationId=${notificationId} was wrapped in a <form method="post" action="${ackFormAction}"> with the notification-id in a hidden input; submitting that served form action (content-type application/x-www-form-urlencoded, body notification-id=${notificationId}) returned 200 { ok:true, notificationId, acknowledgedAt:${ackBody?.acknowledgedAt} }; the delivery-log acknowledgedAt for that id flipped from null to ${afterRow?.acknowledgedAt}; the /__requests log recorded exactly one acknowledge-server entry AND one acknowledge-form entry for that id; refetching /notifications-centre rendered data-acknowledged="true" on the same article (proof that activation of the served control causes the acknowledged state on the next served load of the centre); x-fixture-request-id on the form POST=${ack.requestId}`
+        : `${FIRST_EIGHT} backlog, evidence gap: surfaceOk=${surfaceOk} (uniqueIds=${uniqueIds.length} perItemAck=${perItemAckControls.length} markRead=${markReadControls.length} markAllRead=${markAllReadCount} ackFormPresent=${ackFormPresent}) notificationId=${notificationId} ackFormAction=${ackFormAction} ackStatus=${ack.status} ackBody=${JSON.stringify(ackBody)} beforeAck=${beforeRow ? beforeRow.acknowledgedAt : 'missing'} afterAck=${afterRow ? afterRow.acknowledgedAt : 'missing'} ackServerLogs=${ackServerLogs.length} ackFormLogs=${ackFormLogs.length} nextLoadAcknowledgedAttr=${nextLoadAcknowledgedAttr}`,
+      evidence: {
+        requestId: ack.requestId,
+        responseStatus: ack.status,
+        bodyExcerpt: excerpt(ack.body),
+        derived: {
+          notificationId,
+          uniqueIdCount: uniqueIds.length,
+          perItemAckControlCount: perItemAckControls.length,
+          markReadControlCount: markReadControls.length,
+          markAllReadCount,
+          ackFormPresent,
+          ackFormAction,
+          beforeAck: beforeRow ? beforeRow.acknowledgedAt : null,
+          afterAck: afterRow ? afterRow.acknowledgedAt : null,
+          ackServerLogCount: ackServerLogs.length,
+          ackFormLogCount: ackFormLogs.length,
+          nextLoadAcknowledgedAttr,
+          surfaceOk,
+          roundTripPass,
+        },
+      },
+    });
+
+    // Conformance-only companion row: the same-page DOM
+    // data-acknowledged flip that AC-20103-1 requires ("the item's
+    // data-acknowledged reads true after the response") when the JS
+    // client script mutates the article element in place after the
+    // fetch resolves (no page reload) is browser-only; the Node HTTP
+    // probe cannot observe the client script's in-place DOM mutation.
+    // The positive row above already covers the served next-load
+    // acknowledged state (the server-observable equivalent); this
+    // de-claim narrows to the client-side in-place mutation the
+    // browser check owns. Recorded as a null-anchored conformance
+    // de-claim per the rule-7d shape.
+    const centreArticleExcerpt = (centreDom.match(new RegExp(`<article[^>]*data-notification-id="${notificationId}"[^]{0,240}`)) || [''])[0];
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-notifications-in-app-AC-20103-1: the client-side, same-page DOM data-acknowledged="true" flip on the /notifications-centre article (the fetch()-then-setAttribute mutation the JS-on client script performs without a page reload) is browser-only. The positive row above covers the served next-load equivalent (activation of the served form action produces data-acknowledged="true" on the same article on the next /notifications-centre fetch). The in-place same-page DOM mutation is deferred to the pack browser check.',
+      verdict: 'warn',
+      detail: `${FIRST_EIGHT} backlog, the client-side same-page DOM data-acknowledged="true" flip on the notification article after the fetch resolves (without a page reload) is browser-only; recorded as a null-anchored conformance de-claim so the AC-20103-1 in-place-mutation clause the positive row does not cover is on the record; fixture centre reachability confirmed via the same /notifications-centre fetch (x-fixture-request-id=${centre.requestId}).`,
+      evidence: {
+        requestId: centre.requestId,
+        responseStatus: centre.status,
+        bodyExcerpt: excerpt(centreArticleExcerpt),
+        derived: {
+          notificationId,
+          articleServerRenderedAcknowledgedAttr: (centreArticleExcerpt.match(/data-acknowledged="([^"]+)"/) || [null, null])[1],
+          inPlaceDomFlipObserved: false,
+          reason: 'browser-only in-place DOM mutation clause of AC-20103-1',
+        },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-notifications-in-app/contributions/probes/live-region-preseeding.mjs

@@ -0,0 +1,93 @@
+// application-notifications-in-app probe: live-region preseeding
+// (AC-20101-1). Boots the fixture, GETs the shell root and the two
+// nested surfaces (/notifications-centre, /notifications-preferences),
+// enumerates elements by the per-element attribute [data-live-region]
+// (per AC-20101-1 wording), and observes the polite/assertive semantics
+// on each preseeded wrapper.
+//
+// AC-20101-1 requires BOTH wrappers to be present at page load on
+// every declared route, enumerated by [data-live-region]:
+//   the polite wrapper carries aria-live="polite" AND
+//     data-live-region="polite" AND is empty (no descendant text nodes);
+//   the assertive wrapper carries role="alert" AND
+//     data-live-region="assertive" AND is empty.
+//
+// A broken-variant absence row is deliberately not emitted
+// (positive-anchor rule: broken-variant rows must not be
+// positive-anchored on absence, removed here per the charts pattern).
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-notifications-in-app-AC-20101-1';
+export const accountBound = false;
+
+// Enumerate every element that carries a data-live-region attribute
+// in the served HTML. Returns per-element observed semantics.
+function enumerateLiveRegions(body) {
+  const rx = /<([a-z][a-z0-9]*)\b([^>]*\bdata-live-region="([^"]+)"[^>]*)>([\s\S]*?)<\/\1>/gi;
+  const out = [];
+  let m;
+  while ((m = rx.exec(body)) !== null) {
+    const attrs = m[2];
+    const kind = m[3];
+    const inner = m[4];
+    const ariaLiveMatch = /\baria-live="([^"]+)"/.exec(attrs);
+    const roleMatch = /\brole="([^"]+)"/.exec(attrs);
+    out.push({
+      kind,
+      empty: inner.length === 0,
+      ariaLive: ariaLiveMatch ? ariaLiveMatch[1] : null,
+      role: roleMatch ? roleMatch[1] : null,
+    });
+  }
+  return out;
+}
+
+function observePoliteAssertive(elements) {
+  const polite = elements.find((e) => e.kind === 'polite') || null;
+  const assertive = elements.find((e) => e.kind === 'assertive') || null;
+  const politeOk = !!polite && polite.ariaLive === 'polite' && polite.empty === true;
+  const assertiveOk = !!assertive && assertive.role === 'alert' && assertive.empty === true;
+  return { polite, assertive, politeOk, assertiveOk };
+}
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const routes = ['/', '/notifications-centre', '/notifications-preferences'];
+    for (const route of routes) {
+      const r = await fixtureFetch(fixture.url, route);
+      const elements = enumerateLiveRegions(r.body);
+      const { polite, assertive, politeOk, assertiveOk } = observePoliteAssertive(elements);
+      const pass = r.status === 200 && !!r.requestId && politeOk && assertiveOk;
+      const politeShape = polite
+        ? `ariaLive=${polite.ariaLive} dataLiveRegion=polite empty=${polite.empty}`
+        : 'missing';
+      const assertiveShape = assertive
+        ? `role=${assertive.role} dataLiveRegion=assertive empty=${assertive.empty}`
+        : 'missing';
+      results.push({
+        anchorAcId,
+        verdict: pass ? 'pass' : 'fail',
+        detail: pass
+          ? `Given a page load on any declared route; observed on GET ${route}: enumerated by [data-live-region] found ${elements.length} elements; polite {${politeShape}}; assertive {${assertiveShape}}; x-fixture-request-id=${r.requestId}`
+          : `Given a page load on any declared route; evidence gap on GET ${route}: status=${r.status} rid=${r.requestId} polite {${politeShape}} assertive {${assertiveShape}}`,
+        evidence: {
+          requestId: r.requestId,
+          responseStatus: r.status,
+          bodyExcerpt: excerpt((r.body.match(/<[^>]+data-live-region="polite"[^>]*>[\s\S]*?<\/[a-z]+>/i) || [''])[0]),
+          derived: {
+            route,
+            elementCount: elements.length,
+            polite: polite && { ariaLive: polite.ariaLive, role: polite.role, empty: polite.empty },
+            assertive: assertive && { ariaLive: assertive.ariaLive, role: assertive.role, empty: assertive.empty },
+          },
+        },
+      });
+    }
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-notifications-in-app/contributions/probes/probe-utils.mjs

@@ -0,0 +1,177 @@
+// Shared helpers for application-notifications-in-app contributions/probes/.
+//
+// The real engine for every probe in this pack is the fixture HTTP
+// server at packages/rcf-lite/test/fixtures/probe-pack-application-notifications-in-app/server.js
+// booted on a scratch port from the family range 47640-47649.
+// The fixture echoes a per-request x-fixture-request-id header on
+// every response; probes record that id and a response body excerpt
+// as positive evidence per rule 7d.
+//
+// No account credentials or network calls: every probe is
+// local-fixture-driven, so no probe carries an account-bound branch
+// or a CI_HAS_* gate. Declared env vars are the fixture's own
+// PORT and (where the fixture reads them) the CAPS/state switches
+// the probes drive via query string.
+
+import { spawn } from 'node:child_process';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:net';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export const SLUG = 'application-notifications-in-app';
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-application-notifications-in-app');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/application-notifications-in-app');
+export const PORT_RANGE_START = 47640;
+export const PORT_RANGE_END = 47649;
+export const DECLARED_ENV = Object.freeze(['PORT', 'PROBE_BREAK']);
+export const REQUEST_ID_HEADER = 'x-fixture-request-id';
+
+// Pick a free port from the fixture family range. Falls back to
+// asking the OS for an ephemeral port only if the whole range is
+// held by other workers (never expected on a single-machine run).
+export async function pickPort() {
+  for (let port = PORT_RANGE_START; port <= PORT_RANGE_END; port += 1) {
+    if (await canBind(port)) return port;
+  }
+  return await bindEphemeral();
+}
+
+function canBind(port) {
+  return new Promise((res) => {
+    const s = createServer();
+    s.once('error', () => res(false));
+    s.listen(port, '127.0.0.1', () => {
+      const bound = s.address();
+      s.close(() => res(!!bound));
+    });
+  });
+}
+
+function bindEphemeral() {
+  return new Promise((res) => {
+    const s = createServer();
+    s.listen(0, '127.0.0.1', () => {
+      const port = s.address().port;
+      s.close(() => res(port));
+    });
+  });
+}
+
+// Spawns the fixture server as a child on `port` with the given
+// env overlay; resolves once the fixture has printed LISTENING and
+// returns { child, url, kill } (kill is synchronous best-effort).
+export async function startFixture({ port, env = {} } = {}) {
+  const boundPort = port ?? await pickPort();
+  const child = spawn(process.execPath, ['server.js'], {
+    cwd: FIXTURE_DIR,
+    env: { ...process.env, PORT: String(boundPort), ...env },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  await new Promise((res, rej) => {
+    const timer = setTimeout(() => rej(new Error(`fixture did not print LISTENING within 4s on port ${boundPort}`)), 4000);
+    let stderrBuf = '';
+    child.stderr.on('data', (chunk) => { stderrBuf += String(chunk); });
+    child.on('exit', (code) => rej(new Error(`fixture exited early (code=${code}) stderr=${stderrBuf.slice(0, 400)}`)));
+    child.stdout.on('data', (chunk) => {
+      if (String(chunk).includes(`LISTENING ${boundPort}`)) { clearTimeout(timer); res(); }
+    });
+  });
+  const url = new URL(`http://127.0.0.1:${boundPort}`);
+  return {
+    child,
+    url,
+    port: boundPort,
+    // Await child exit and propagate any error. A teardown failure
+    // must fail the verdict (the teardown-propagation rule);
+    // no swallowed errors here.
+    kill: () => new Promise((res, rej) => {
+      let settled = false;
+      const done = (err) => { if (settled) return; settled = true; err ? rej(err) : res(); };
+      child.once('exit', () => done());
+      child.once('error', (err) => done(err));
+      try { child.kill('SIGTERM'); } catch (err) { return done(err); }
+      setTimeout(() => {
+        if (settled) return;
+        try { child.kill('SIGKILL'); } catch (err) { return done(err); }
+      }, 4000);
+    }),
+  };
+}
+
+// Issue an HTTP request against the fixture and return
+// { status, headers, body, requestId }.
+export async function fixtureFetch(url, pathAndQuery, init = {}) {
+  const target = new URL(pathAndQuery, url);
+  const res = await fetch(target, init);
+  const body = await res.text();
+  const requestId = res.headers.get(REQUEST_ID_HEADER);
+  return { status: res.status, headers: Object.fromEntries(res.headers.entries()), body, requestId };
+}
+
+export function excerpt(body, maxLen = 240) {
+  if (typeof body !== 'string') return '';
+  return body.length <= maxLen ? body : body.slice(0, maxLen) + '…';
+}
+
+export function aggregate(results) {
+  // Positive-evidence rule: no-checks-ran is a fail.
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  // Any warn row lifts the aggregate to warn, including honest
+  // notObservableHere de-claims. A probe whose rows are all warn
+  // aggregates to warn, not pass; the shelf reads amber and the tally
+  // accepts a warn aggregate as problems=0 when no fail row is present.
+  if (results.some((r) => r && r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: SLUG,
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const filepath = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(filepath, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path: filepath };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path: filepath } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${filepath}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    // Positive-evidence rule (exception fallback): exception rows have no
+    // observed AC; anchor null (never a fabricated id like
+    // "unknown"), carry an evidence object with the error excerpt.
+    const message = err && err.message ? err.message : String(err);
+    const stack = err && err.stack ? err.stack : String(err);
+    const results = [{
+      anchorAcId: null,
+      verdict: 'fail',
+      detail: `probe threw: ${message}`,
+      evidence: {
+        errorMessage: message,
+        errorExcerpt: excerpt(stack, 480),
+      },
+    }];
+    const { report, path: filepath } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${stack}\n`);
+    process.stderr.write(`report written to ${filepath}\n`);
+    process.exitCode = 1;
+  }
+}

package/blueprints/application-notifications-in-app/contributions/probes/run-centre-acknowledge-round-trip.mjs

@@ -0,0 +1,5 @@
+import runProbe from './centre-acknowledge-round-trip.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-notifications-in-app/server.js', healthy: true };
+runShim('centre-acknowledge-round-trip', engine, runProbe);