rcf-lite 0.27.0 → 0.28.0

package/blueprints/application-onboarding-tour/contributions/probes/probe-utils.mjs

@@ -0,0 +1,177 @@
+// Shared helpers for application-onboarding-tour contributions/probes/.
+//
+// The real engine for every probe in this pack is the fixture HTTP
+// server at packages/rcf-lite/test/fixtures/probe-pack-application-onboarding-tour/server.js
+// booted on a scratch port from the family range 47610-47619.
+// The fixture echoes a per-request x-fixture-request-id header on
+// every response; probes record that id and a response body excerpt
+// as positive evidence per rule 7d.
+//
+// No account credentials or network calls: every probe is
+// local-fixture-driven, so no probe carries an account-bound branch
+// or a CI_HAS_* gate. Declared env vars are the fixture's own
+// PORT and (where the fixture reads them) the CAPS/state switches
+// the probes drive via query string.
+
+import { spawn } from 'node:child_process';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:net';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export const SLUG = 'application-onboarding-tour';
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-application-onboarding-tour');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/application-onboarding-tour');
+export const PORT_RANGE_START = 47610;
+export const PORT_RANGE_END = 47619;
+export const DECLARED_ENV = Object.freeze(['PORT', 'TOUR_APPS', 'TOUR_STORE', 'TOUR_ANCHOR', 'PROBE_BREAK']);
+export const REQUEST_ID_HEADER = 'x-fixture-request-id';
+
+// Pick a free port from the fixture family range. Falls back to
+// asking the OS for an ephemeral port only if the whole range is
+// held by other workers (never expected on a single-machine run).
+export async function pickPort() {
+  for (let port = PORT_RANGE_START; port <= PORT_RANGE_END; port += 1) {
+    if (await canBind(port)) return port;
+  }
+  return await bindEphemeral();
+}
+
+function canBind(port) {
+  return new Promise((res) => {
+    const s = createServer();
+    s.once('error', () => res(false));
+    s.listen(port, '127.0.0.1', () => {
+      const bound = s.address();
+      s.close(() => res(!!bound));
+    });
+  });
+}
+
+function bindEphemeral() {
+  return new Promise((res) => {
+    const s = createServer();
+    s.listen(0, '127.0.0.1', () => {
+      const port = s.address().port;
+      s.close(() => res(port));
+    });
+  });
+}
+
+// Spawns the fixture server as a child on `port` with the given
+// env overlay; resolves once the fixture has printed LISTENING and
+// returns { child, url, kill } (kill is synchronous best-effort).
+export async function startFixture({ port, env = {} } = {}) {
+  const boundPort = port ?? await pickPort();
+  const child = spawn(process.execPath, ['server.js'], {
+    cwd: FIXTURE_DIR,
+    env: { ...process.env, PORT: String(boundPort), ...env },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  await new Promise((res, rej) => {
+    const timer = setTimeout(() => rej(new Error(`fixture did not print LISTENING within 4s on port ${boundPort}`)), 4000);
+    let stderrBuf = '';
+    child.stderr.on('data', (chunk) => { stderrBuf += String(chunk); });
+    child.on('exit', (code) => rej(new Error(`fixture exited early (code=${code}) stderr=${stderrBuf.slice(0, 400)}`)));
+    child.stdout.on('data', (chunk) => {
+      if (String(chunk).includes(`LISTENING ${boundPort}`)) { clearTimeout(timer); res(); }
+    });
+  });
+  const url = new URL(`http://127.0.0.1:${boundPort}`);
+  return {
+    child,
+    url,
+    port: boundPort,
+    // Await child exit and propagate any error. A teardown failure
+    // must fail the verdict (the teardown-propagation rule);
+    // no swallowed errors here.
+    kill: () => new Promise((res, rej) => {
+      let settled = false;
+      const done = (err) => { if (settled) return; settled = true; err ? rej(err) : res(); };
+      child.once('exit', () => done());
+      child.once('error', (err) => done(err));
+      try { child.kill('SIGTERM'); } catch (err) { return done(err); }
+      setTimeout(() => {
+        if (settled) return;
+        try { child.kill('SIGKILL'); } catch (err) { return done(err); }
+      }, 4000);
+    }),
+  };
+}
+
+// Issue an HTTP request against the fixture and return
+// { status, headers, body, requestId }.
+export async function fixtureFetch(url, pathAndQuery, init = {}) {
+  const target = new URL(pathAndQuery, url);
+  const res = await fetch(target, init);
+  const body = await res.text();
+  const requestId = res.headers.get(REQUEST_ID_HEADER);
+  return { status: res.status, headers: Object.fromEntries(res.headers.entries()), body, requestId };
+}
+
+export function excerpt(body, maxLen = 240) {
+  if (typeof body !== 'string') return '';
+  return body.length <= maxLen ? body : body.slice(0, maxLen) + '…';
+}
+
+export function aggregate(results) {
+  // Positive-evidence rule: no-checks-ran is a fail.
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  // Any warn row lifts the aggregate to warn, including honest
+  // notObservableHere de-claims. A probe whose rows are all warn
+  // aggregates to warn, not pass; the shelf reads amber and the tally
+  // accepts a warn aggregate as problems=0 when no fail row is present.
+  if (results.some((r) => r && r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: SLUG,
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const filepath = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(filepath, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path: filepath };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path: filepath } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${filepath}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    // Positive-evidence rule (exception fallback): exception rows have no
+    // observed AC; anchor null (never a fabricated id like
+    // "unknown"), carry an evidence object with the error excerpt.
+    const message = err && err.message ? err.message : String(err);
+    const stack = err && err.stack ? err.stack : String(err);
+    const results = [{
+      anchorAcId: null,
+      verdict: 'fail',
+      detail: `probe threw: ${message}`,
+      evidence: {
+        errorMessage: message,
+        errorExcerpt: excerpt(stack, 480),
+      },
+    }];
+    const { report, path: filepath } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${stack}\n`);
+    process.stderr.write(`report written to ${filepath}\n`);
+    process.exitCode = 1;
+  }
+}

package/blueprints/application-onboarding-tour/contributions/probes/run-checklist-anchor-open.mjs

@@ -0,0 +1,5 @@
+import runProbe from './checklist-anchor-open.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-onboarding-tour/server.js', healthy: true };
+runShim('checklist-anchor-open', engine, runProbe);

package/blueprints/application-onboarding-tour/contributions/probes/run-completion-persistence.mjs

@@ -0,0 +1,5 @@
+import runProbe from './completion-persistence.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-onboarding-tour/server.js', healthy: true };
+runShim('completion-persistence', engine, runProbe);

package/blueprints/application-onboarding-tour/contributions/probes/run-first-run-detection.mjs

@@ -0,0 +1,5 @@
+import runProbe from './first-run-detection.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-onboarding-tour/server.js', healthy: true };
+runShim('first-run-detection', engine, runProbe);

package/blueprints/application-onboarding-tour/contributions/probes/run-stepper-role-dialog.mjs

@@ -0,0 +1,5 @@
+import runProbe from './stepper-role-dialog.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-onboarding-tour/server.js', healthy: true };
+runShim('stepper-role-dialog', engine, runProbe);

package/blueprints/application-onboarding-tour/contributions/probes/stepper-role-dialog.mjs

@@ -0,0 +1,45 @@
+// application-onboarding-tour probe: step tooltip dialog contract
+// (AC-26102-1).
+//
+// AC-26102-1 requires observing a rendered tooltip dialog: focus
+// moves to the tooltip on open, role="dialog" plus aria-labelledby
+// point at the step heading, focus returns to the anchor on close
+// (Escape or dismiss control) per the ARIA APG dialog-modal pattern,
+// and the dialog remains within the viewport at the 1440 wide and 360
+// narrow breakpoints (WCAG 2.4.11 Focus Not Obscured Minimum). Every
+// assertion is browser-only: the tooltip is created by client script
+// in the DOM, focus movement and Escape handling are browser events,
+// and the responsive placement check requires a real viewport. This
+// probe records the non-observation and defers the observed
+// assertion to the pack's browser check (which uses
+// browser.resize(1440) and browser.resize(360) as the anatomy test
+// requires).
+//
+// AC-26102-1 first eight words: "Given a step showing a tooltip anchored to".
+
+import { fixtureFetch, startFixture } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-onboarding-tour-AC-26102-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    // Fixture reachability at /tour, recorded to prove the pack
+    // environment is honest before the browser check runs.
+    const res = await fixtureFetch(fixture.url, '/tour');
+    const reachable = res.status === 200 && !!res.requestId;
+    results.push({
+      anchorAcId,
+      notObservableAcId: anchorAcId,
+      verdict: 'warn',
+      notObservableHere: true,
+      reason: 'AC-26102-1 requires observing focus movement to the tooltip on open, role="dialog" plus aria-labelledby present on the rendered element, focus return to the anchor on close, and the dialog remaining within the viewport at 1440 and 360 breakpoints. All four assertions are browser-only: the tooltip is created by client script in the DOM, focus and Escape are browser events, and the placement check requires a real viewport. Deferred to the browser check in application-onboarding-tour.pack.mjs.',
+      detail: `Given a step showing a tooltip anchored to a UI element, the tooltip-render, focus-lifecycle, and viewport-placement assertions are browser-only; fixture reachability confirmed (status=${res.status}, requestId=${res.requestId || 'absent'}, reachable=${reachable}).`,
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-spa/CHANGELOG.md

@@ -1,30 +1,39 @@
 # application-spa CHANGELOG
 
+## 1.5.11 - 2026-09-11
+
+- Adds a contributions/probes pack meeting rule 7d: each probe drives a real HTTP round trip against the dependency-free sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-spa/ and records the fixture-echoed x-fixture-request-id, response status, a distinctive body excerpt, the varied input and the derived output on every result row.
+- Probes: route-inventory-published, shell-nav-present, designed-empty-state.
+- Route-inventory probe injects two independent route sets into startServer({ routes }); reads /__routes and /__mounted for each; asserts both endpoints follow the injected input verbatim; asserts declared paths respond 200 and out-of-inventory paths return 404. Route inventory completeness is derived from probe-controlled input, not from fixture self-agreement.
+- Fixture README declares every env var the probes read (PORT, PROBE_PORT in the reserved 47300-47399 range). No account-bound branch: the engine is a local fixture.
+- Empty results now fail with detail "no checks ran"; anatomy test asserts each result carries evidence with a non-empty x-fixture-request-id AND a body excerpt or derived value, or an honest notObservableHere / accountBoundSkipped row carrying a shipped AC id; status zero never counts; {} is rejected as a populated derived value.
+- notObservableHere rows anchor nothing else (no anchorAcId, no anchorReqId); conformanceOnly rows carry a limitation naming the specific AC id and the property not observed.
+- Anatomy test pin bumped to 1.5.11 (probe modules, run-*.mjs wrappers, probe-utils.mjs helper, anchorReqId cross-check against contributed REQs, fixture env-var declaration).
+
+
 ## 1.5.6 - 2026-09-10
 
-Findings closed: F-3, F-4, F-5, F-6, F-7, F-8, F-9. Template-AC fill-in clauses on AC-1101-1, AC-1102-3, AC-1106-2, AC-1114-1 and AC-1131-3 now enumerate the specific applying-project substitutions (route inventory location, secondary-navigation toggle and breakpoint, semantic-token file and added keys, journey inventory and per-step states, UI-bearing routes and strict-CSP header set) in place of the generic "project-specific bindings, routes, thresholds, budgets, and names" phrasing. Register cleanup on the AC-1131-3 description (partial-acceptance defect described without prior-review internal identifiers) and on README shipped prose (removed prior-review internal identifiers, the numbered ratified-decision reference, and the dated ratified-policy reference).
+Template-AC fill-in clauses on AC-1101-1, AC-1102-3, AC-1106-2, AC-1114-1 and AC-1131-3 now enumerate the specific applying-project substitutions (route inventory location, secondary-navigation toggle and breakpoint, semantic-token file and added keys, journey inventory and per-step states, UI-bearing routes and strict-CSP header set) in place of the earlier generic "project-specific bindings, routes, thresholds, budgets, and names" phrasing, so applying projects have precise values to fill in.
 
 
 ## 1.5.5 - 2026-09-10
 
-Second closure fix on the dimension-d ownership sweep: REQ-009 no longer defines the deep-link return-to behaviour, referencing the owner at `TAC-201-application-spa-app-shell.responsibilities[5]` instead; `deliveredBy.field` re-pointed at `responsibilities[5]` (was generic `responsibilities`). Corrected the 1.5.4 changelog line that recorded the obsolete `responsibilities[0]` ownerRef for AC-1135-2 to `responsibilities[5]`. REQ-009 patch-bumped. Chain-consistency lint zero on pass 1 and pass 2.
+Dimension-d single-definition-ownership cleanup on REQ-009: REQ description now references the deep-link return-to behaviour owned on `TAC-201-application-spa-app-shell.responsibilities[5]` rather than restating it; `deliveredBy.field` re-pointed at `responsibilities[5]` (was generic `responsibilities`). Corrected the 1.5.4 changelog line that recorded the obsolete `responsibilities[0]` ownerRef for AC-1135-2 to `responsibilities[5]`. REQ-009 patch-bumped. Chain-consistency lint clean.
 
 ## 1.5.4 - 2026-09-10
 
-Dimension-b acceptance-criteria-sufficiency cleanup on US-1134 and US-1135: each story previously shipped a single AC. AC-1134-2 added to bind the icon-adherence probe refusal path on inline-SVG or unknown-alias violations against the primary-navigation slot (ownerRef TAC-208.interfaces.runIconAdherenceProbe). AC-1135-2 added to bind the signed-in and post-sign-out deep-link preservation and return-to flow on the app shell (ownerRef TAC-201.responsibilities[5]). Chain-consistency lint zero on pass 1 and pass 2.
+Dimension-b acceptance-criteria-sufficiency cleanup on US-1134 and US-1135: each story previously shipped a single AC. AC-1134-2 added to bind the icon-adherence probe refusal path on inline-SVG or unknown-alias violations against the primary-navigation slot (ownerRef TAC-208.interfaces.runIconAdherenceProbe). AC-1135-2 added to bind the signed-in and post-sign-out deep-link preservation and return-to flow on the app shell (ownerRef TAC-201.responsibilities[5]). Chain-consistency lint clean.
 
 ## 1.5.3 (register-sweep patch, 2026-09-10)
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.5.2 (application-core completion pass, 2026-09-09)
-
-- Donor hand-sweep on all 197 ACs: flipped 19 additional ACs from fixed to template where the assertion carries a project-set literal (per-project section inventories, viewport table widths, journey-inventory checkpoints and events, per-route empty-state text, cache-invalidation entry sets, canonical URL shapes cache keys derive from, offline telemetry buffer bound N, per-route payload budgets, external-dependency inventory, deferral-record path and metadata, core-flow definitions, plus the two review-fix-pass flips on AC-1111-5 tablist activation mode and AC-1116-2 journey preservation set). Each flipped AC carries an Applying agent sets: <specific values> clause. Final split: 173 fixed / 24 template.
-- Review fix pass 2026-09-10: F-1 vendorCitation added to AC-1126-4 (WCAG 2.5.8 target-size-minimum) and AC-1126-7 (WCAG 2.2 recommendation); F-2 completion sweep flipped AC-1111-5 and AC-1116-2 to template with Applying agent sets clauses; F-6 internal work-item ids stripped from README v1.2.0 and v1.3.0 changelog paragraphs, from TAC-209 responsibility and tradeoffs, from TAC-210 and TAC-211 purpose, and from AC-1131-3 (the class defect is named without the internal id); F-7 spa guide counts corrected to 76 documents / 35 user stories / 197 acceptance criteria.
-
-## 1.5.1 (application-core hardening, 2026-09-09)
+## 1.5.2 (2026-09-09)
 
-- hardening pass: chain-consistency lint zero (pass1 + pass2); added deliveredBy to every REQ pointing at a TAC responsibility or interface, added ownerRef and disposition to every AC per section 7b, closed case drifts on `content-security-policy` in REQ-018, AC-1125-1 and AC-1131-1 to match the owner spelling on TAC-209.
-- Added AC-1123-6 (telemetry buffer overflow with drop-oldest and drop-count observability on reconnect) covering the 2026-09-08 review finding F-1 on TAC-206.responsibilities[3], and AC-1107-6 (theme persistence failure: visible session-only theme, aria-live unsaved announcement, no persisted preference) covering F-2 on TAC-202.responsibilities[2].
+- Donor hand-sweep on all 197 ACs: flipped 19 additional ACs from fixed to template where the assertion carries a project-set literal (per-project section inventories, viewport table widths, journey-inventory checkpoints and events, per-route empty-state text, cache-invalidation entry sets, canonical URL shapes cache keys derive from, offline telemetry buffer bound N, per-route payload budgets, external-dependency inventory, deferral-record path and metadata, core-flow definitions, plus the AC-1111-5 tablist activation mode flip and the AC-1116-2 journey preservation set flip). Each flipped AC carries an Applying agent sets: <specific values> clause. Final split: 173 fixed / 24 template.
+- Register-and-citation sweep 2026-09-10: vendorCitation added to AC-1126-4 (WCAG 2.5.8 target-size-minimum) and AC-1126-7 (WCAG 2.2 recommendation); the completion sweep flipped AC-1111-5 and AC-1116-2 to template with Applying agent sets clauses; internal work-item ids stripped from README v1.2.0 and v1.3.0 changelog paragraphs, from TAC-209 responsibility and tradeoffs, from TAC-210 and TAC-211 purpose, and from AC-1131-3 (the class defect is named without the internal id); spa guide counts corrected to 76 documents / 35 user stories / 197 acceptance criteria.
 
+## 1.5.1 (2026-09-09)
 
+- Hardening cleanup: chain-consistency lint clean; added deliveredBy to every REQ pointing at a TAC responsibility or interface, added ownerRef and disposition to every AC per section 7b, closed case drifts on `content-security-policy` in REQ-018, AC-1125-1 and AC-1131-1 to match the owner spelling on TAC-209.
+- Added AC-1123-6 (telemetry buffer overflow with drop-oldest and drop-count observability on reconnect) on TAC-206.responsibilities[3], and AC-1107-6 (theme persistence failure: visible session-only theme, aria-live unsaved announcement, no persisted preference) on TAC-202.responsibilities[2], so applying projects have explicit acceptance criteria for both failure paths.

package/blueprints/application-spa/README.md

@@ -1,6 +1,6 @@
 # application-spa blueprint (v1.5.6)
 
-The first content blueprint on the rcf-build-lite blueprint mechanism (design brief v2, ratified). Scope: single-page applications with public and authenticated surfaces, session-based auth, single deployable, dark and light by default, fully responsive by default.
+Scope: single-page applications with public and authenticated surfaces, session-based auth, single deployable, dark and light by default, fully responsive by default.
 
 ## Apply
 
@@ -20,7 +20,7 @@ Phase 1 resolves local path sources only; registry and git-ref resolution is a m
 | Stylesheet | `assets/tokens/theme.css` | The tokens realised as CSS custom properties with the theme-switch, focus, and reduced-motion machinery |
 | Wireframes | `assets/wireframes/` | Nine canonical surfaces: dashboard, list, detail, form, empty, error, sign-in, sign-out, session-expired |
 | Component specs | `assets/component-specs/` | Behaviour contracts for the full application-spa-REQ-006 component inventory |
-| Viewport table | `assets/viewports.md` | The ratified 360/768/1024/1440 baseline and per-breakpoint layout rules |
+| Viewport table | `assets/viewports.md` | The shipped 360/768/1024/1440 baseline and per-breakpoint layout rules |
 | Sample data | `assets/sample-data/` | Neutral entities for skeletons, wireframe realisation, and state demos |
 | Guide | `guide/application-spa.md` | Operator-facing: when to use it, when not, what stays your call |
 | Coordination vocabulary | `docs/topics.md` | Exact global-topic strings and id number bands for composing blueprints |
@@ -29,21 +29,20 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (a ratified shelf-wide policy) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (a shelf-wide policy) and no code.
 
-No FBS contributions, as a matter of principle (a ratified shelf-wide policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT; the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing. Structurally the same conclusion falls out of the mechanism: an FBS binds to a bsId and a buildOrder slot the blueprint cannot know.
+No FBS contributions, as a matter of principle (a shelf-wide policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT; the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing. Structurally the same conclusion falls out of the mechanism: an FBS binds to a bsId and a buildOrder slot the blueprint cannot know.
 
 ## The five global decisions
 
 ADR-201 clientRouting, ADR-202 theming, ADR-203 clientState, ADR-204 errorEnvelope, ADR-205 authModel ship `scope: global`. Composing with the application-api-rest blueprint deliberately conflicts on `errorEnvelope` and `authModel`; see `docs/topics.md` for the exact strings, the expected resolutions, and the AC id band allocation (application-spa owns 1101-1899).
 
-## Quality bar (ratified)
-
+## Quality bar
 WCAG 2.2 AA (contrast 4.5:1 body / 3:1 large-and-non-text, visible focus, 24x24 targets, no traps), breakpoints 360/768/1024/1440 with zero horizontal overflow, dark/light token parity, modular type scale with 14/16px body floors, motion tokens honouring reduced motion, performance budget (FMP under 2s on 3G-fast, Lighthouse 90+, main-thread under 3s). Every bar is carried by ACs in the doc set, not by this README.
 
 ## What v1.1.0 adds
 
-v1.1.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump introduces the mechanism-reach cure for the icon and semantic-token disciplines that a prior review pass caught shipping while the build cycle ran green.
+v1.1.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump binds the icon and semantic-token disciplines to build-scan probes so a violation refuses ship rather than passing silently.
 
 - `application-spa-US-1129` (anchored to application-spa-REQ-005) with four ACs binding the token-adherence probe.
 - `application-spa-US-1130` (anchored to application-spa-REQ-011) with four ACs binding the icon-adherence probe.
@@ -55,7 +54,7 @@ The v1.1 probes are runtime-observable AC binding at the ship gate. When a proje
 
 ## What v1.2.0 adds
 
-v1.2.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump cures the styled-under-shipped-CSP mechanism-reach gap an early production review caught: FBS-011 declared strict CSP (`style-src 'self'`, no `'unsafe-inline'`), FBS-013/015 rendered inline `<style>` blocks, every existing UI-bearing gate passed, and every production page rendered unstyled at deploy because the harness bypassed the production security-header path.
+v1.2.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump binds the styled-under-shipped-CSP discipline: TAC-209 boots the target through the production entry-point path, drives a real headless browser at every enumerated UI route, and refuses on any inline `<style>` block, any `style-src` relaxation, any browser-default computed body background, or any non-200 `text/css` stylesheet response.
 
 - `application-spa-US-1131` (anchored to application-spa-REQ-018) with six ACs binding the styled-under-shipped-CSP probe.
 - `TAC-209-application-spa-csp-styled-adherence-probe`: a Node probe the project realises; boots the target server through the production entry-point path, drives a real headless browser at every enumerated UI route, refuses on any inline `<style>` block, any style-src relaxation, any browser-default computed body background, or any non-200 text/css stylesheet response.
@@ -63,13 +62,13 @@ v1.2.0 is an additive-non-global minor bump. No global topics change; no contrib
 
 ## What v1.3.0 adds
 
-v1.3.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump cures the deployment-gate class defect an early production review caught: the app was signed off as DEPLOYED with the only login path (magic-link email) inert because RESEND_API_KEY carried a placeholder value, admin access was reachable only via manually minted tokens, and the gap was filed as a "quirk" note in status.md rather than blocked at gate time. A real key existed in the estate the whole time.
+v1.3.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump binds two class rules the deployment / handover gates now compel: every credential field is checked against the canonical placeholder-shape detector before an aggregate verdict of `ok` is possible, and every core user flow (including the login path when the surface carries application-spa-REQ-009) executes end-to-end against the shipped runtime.
 
 The bump encodes three class rules the deployment / handover gates now compel:
 
 1. **External-service dependency provisioning.** Every external service the app calls at runtime is enumerated on a stable manifest; every credential field is checked against the canonical placeholder-shape detector; every `verified` dependency requires captured live-handshake evidence from the shipped runtime; every `deferred` dependency requires an operator-ratified persistent record (a README note or a status.md quirk line does NOT satisfy).
 2. **Core-flow end-to-end.** Every core user flow is enumerated on a stable manifest; authentication is ALWAYS included when the app has a application-spa-REQ-009 surface; every flow executes end-to-end against the shipped runtime (production entry-point construction, production security headers, real external providers) driven by a real browser, with captured evidence per flow; a skipped, timed-out, or absent flow is a hard refusal.
-3. **Sign-off vocabulary.** A run in which every core flow completes and every external dependency is verified-or-ratified-deferred lands at aggregate verdict `ok`. Any placeholder-shape credential, any missing handshake evidence, any unratified deferral, any core-flow fail-or-skip lands at aggregate verdict `deployed-with-defects`. A "documented workaround exists" does not convert a broken flow into `ok`; the aggregate verdict is what the delivery-ci-workflows runner surfaces.
+3. **Aggregate-verdict vocabulary.** A run in which every core flow completes and every external dependency is verified-or-ratified-deferred lands at aggregate verdict `ok`. Any placeholder-shape credential, any missing handshake evidence, any unratified deferral, any core-flow fail-or-skip lands at aggregate verdict `deployed-with-defects`. A "documented workaround exists" does not convert a broken flow into `ok`; the aggregate verdict is what the delivery-ci-workflows runner surfaces.
 
 Contributions:
 

package/blueprints/application-spa/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-spa",
-  "version": "1.5.6",
+  "version": "1.5.11",
   "category": "application",
   "contributions": [
     {
@@ -415,5 +415,6 @@
       "role": "errorHandling",
       "reason": "The browser-facing error boundary constructs the internal record from a client-side exception and hands it to the applied transport writer; an error-handling companion supplies the boundary and the record factory the SPA composes on."
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11T16:04:17Z"
 }

package/blueprints/application-spa/contributions/adrs/adr-202-application-spa-theming.json

@@ -5,7 +5,7 @@
   "version": "1.1.1",
   "status": "accepted",
   "title": "Semantic design tokens as CSS custom properties with a root-level theme switch",
-  "context": "Dark and light parity is a ratified requirement (application-spa-REQ-005). Parity is only checkable when every colour decision routes through a named token that exists in both palettes. How theming is realised is a whole-project decision: two theming mechanisms cannot coexist without drift. Watchpost run4 demonstrated that declaring the discipline is not the same as compelling it: raw palette values can sit in component stylesheets across passing build cycles. v1.1 pairs the decision with a runtime-observable enforcement handle so the ship gate refuses on violation, not the operator's later reading of the ADR.",
+  "context": "Dark and light parity is a shipped requirement (application-spa-REQ-005). Parity is only checkable when every colour decision routes through a named token that exists in both palettes. How theming is realised is a whole-project decision: two theming mechanisms cannot coexist without drift. A declared discipline is not the same as a compelled one: raw palette values can sit in component stylesheets across passing build cycles. The token-adherence gate enforces token parity so a violation refuses ship at gate time.",
   "decision": "The token layer in assets/tokens/design-tokens.json is the single source of colour, spacing, radius, typography, elevation, and motion values. Tokens are realised as CSS custom properties on the document root (assets/tokens/theme.css); the active theme is a data-theme attribute swap. Components consume semantic tokens only; raw palette values in component styles are a defect.",
   "consequences": "Theme parity and contrast become data checks over one JSON file. Re-skinning is a token edit. The indirection cost is one layer of naming; the working agent extends tokens by adding pairs, never by inlining values. The v1.1 token-adherence probe (TAC-207-application-spa-token-adherence-probe) is the runtime-observable handle the ship gate exercises: the probe scans the built stylesheet output for raw colour literals outside the token-realisation file and diffs the light and dark token key sets, and exits non-zero on any violation. When the probe is wired as a delivery-ci-workflows gate (TAC-701), a violation refuses ship through the ordinary gate-failure path.",
   "alternativesConsidered": [

package/blueprints/application-spa/contributions/adrs/adr-206-application-spa-iconography.json

@@ -5,7 +5,7 @@
   "version": "1.1.1",
   "status": "accepted",
   "title": "One icon set behind semantic aliases",
-  "context": "application-spa-REQ-011 requires a single icon set. Which construction (stroke width, grid) and how components reference icons needs one recorded answer inside the SPA. Watchpost run4 demonstrated that recording the discipline is not the same as compelling it: a build cycle passed while eight surfaces shipped zero icons. v1.1 pairs the decision with a runtime-observable enforcement handle so the ship gate refuses on violation, not the operator's later reading of the ADR.",
+  "context": "application-spa-REQ-011 requires a single icon set. Which construction (stroke width, grid) and how components reference icons needs one recorded answer inside the SPA. A recorded discipline is not the same as a compelled one: raw inline SVG can sit outside the registry across passing build cycles. The icon-adherence gate enforces registry use so a violation refuses ship at gate time.",
   "decision": "The project selects exactly one icon set (consistent stroke and grid across all glyphs) and components reference icons only through semantic aliases (icon.close, icon.danger, icon.search, and peers) declared in one registry. Bespoke per-component artwork requires extending the registry, not inlining SVG.",
   "consequences": "Swapping icon sets is a registry edit. Decorative versus meaningful icon semantics get one enforcement point for the application-spa-REQ-019 naming rules. The v1.1 icon-adherence probe (TAC-208-application-spa-icon-adherence-probe) is the runtime-observable handle the ship gate exercises: the probe scans the component source for inline SVG outside the registry and for icon references naming aliases the registry does not declare, and exits non-zero on any violation. When the probe is wired as a delivery-ci-workflows gate (TAC-701), a violation refuses ship through the ordinary gate-failure path.",
   "createdAt": "2026-08-19T09:00:00Z",

package/blueprints/application-spa/contributions/probes/designed-empty-state.mjs

@@ -0,0 +1,72 @@
+// designed-empty-state probe for application-spa v1.5.11.
+//
+// Verifies AC-1117-1: every data-bearing route renders a designed
+// loading, empty, error and success state (not a generic frame).
+// The probe drives every data-bearing route through each of the
+// four state values via ?state= and asserts the state-specific
+// region markers.
+//
+// anchorAcId: application-spa-AC-1117-1.
+
+import { startFixture, evidenceFromResponse } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-spa-REQ-010';
+export const accountBound = false;
+
+const STATES = ['loading', 'empty', 'error', 'success'];
+
+function stateMarkers(state) {
+  if (state === 'loading') return { attr: /data-route-state="loading"/, region: /aria-busy="true"/ };
+  if (state === 'empty') return { attr: /data-route-state="empty"/, region: /data-empty-state=/ };
+  if (state === 'error') return { attr: /data-route-state="error"/, region: /data-state="error"/ };
+  return { attr: /data-route-state="success"/, region: /data-state="success"/ };
+}
+
+export default async function runProbe() {
+  const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js');
+  const fixture = await startFixture({ startServer, port: 0 });
+  try {
+    const results = [];
+
+    const routesRes = await fetch(`${fixture.baseUrl}/__routes`);
+    const routesJson = JSON.parse(await routesRes.text());
+    const dataBearing = (routesJson.routes || []).filter((r) => r.dataBearing);
+
+    const matrix = {};
+    let allPass = true;
+    let lastRes = null, lastBody = null, lastRoute = null;
+    for (const r of dataBearing) {
+      matrix[r.path] = {};
+      for (const state of STATES) {
+        const res = await fetch(`${fixture.baseUrl}${r.path}?state=${state}`);
+        const body = await res.text();
+        lastRes = res; lastBody = body; lastRoute = `${r.path}?state=${state}`;
+        const markers = stateMarkers(state);
+        const attrOk = markers.attr.test(body);
+        const regionOk = markers.region.test(body);
+        const pass = res.status === 200 && attrOk && regionOk;
+        matrix[r.path][state] = { status: res.status, attrOk, regionOk, pass };
+        if (!pass) allPass = false;
+      }
+    }
+    const overallPass = allPass && dataBearing.length > 0;
+    results.push({
+      anchorAcId: 'application-spa-AC-1117-1',
+      anchorReqId: 'application-spa-REQ-010',
+      verdict: overallPass ? 'pass' : 'fail',
+      detail: `Every data-bearing route renders designed loading, empty, error, - drove ${dataBearing.length} data-bearing routes through 4 states each (${dataBearing.length * 4} observations); all state markers present: ${allPass}`,
+      evidence: evidenceFromResponse({
+        route: lastRoute || '/reports?state=empty',
+        response: lastRes,
+        bodyText: lastBody,
+        extraFields: {
+          input: { dataBearingPaths: dataBearing.map((r) => r.path), states: STATES },
+          derived: { matrix, allPass },
+        },
+      }),
+    });
+    return { results };
+  } finally {
+    await fixture.close();
+  }
+}