rcf-lite 0.27.0 → 0.28.0

package/blueprints/application-empty-error-states/contributions/probes/error-boundary-alert.mjs

@@ -0,0 +1,65 @@
+// application-empty-error-states probe: error-boundary state
+// (AC-22108-1). AC-22108-1 explicitly permits the sample-app
+// /probe/error-boundary?crash=1 route as the observation trigger; the
+// probe drives that route and observes the active crash state
+// (role="alert" region, [data-recovery="retry"] control, class-level
+// error label). The prior standby-absence row was removed under the
+// positive-anchor cleanup (positive-anchor on absence is void).
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-empty-error-states-AC-22108-1';
+export const accountBound = false;
+
+function stripHtml(html) {
+  return String(html)
+    .replace(/<script[^]*?<\/script>/gi, ' ')
+    .replace(/<style[^]*?<\/style>/gi, ' ')
+    .replace(/<[^>]+>/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function stackFramePresent(text) {
+  // Backtrace frame ("at fn (file:line:col)"), a source path ending in
+  // a JS-family extension, an env-var key shape, or a node_modules
+  // segment. Correlation-id tokens are not stack frames.
+  if (/\bat\s+[A-Za-z_$][A-Za-z0-9_$.]*\s*\([^)]+:\d+:\d+\)/.test(text)) return true;
+  if (/(^|\s)(\.\.?\/|\/)[A-Za-z0-9_./-]+\.(js|mjs|cjs|ts|tsx|jsx)\b/i.test(text)) return true;
+  if (/process\.env\.[A-Z_][A-Z0-9_]*/.test(text)) return true;
+  if (/\bnode_modules\//.test(text)) return true;
+  return false;
+}
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const crash = await fixtureFetch(fixture.url, '/probe/error-boundary?crash=1');
+    const surfaceText = stripHtml(crash.body);
+    const alertRegion = /data-surface="error-boundary"[^>]*role="alert"/.test(crash.body);
+    const retryControl = /data-recovery="retry"/.test(crash.body);
+    const errorClass = /data-error-class="render-failure"/.test(crash.body);
+    const plainSummary = /Widget failed to render/.test(surfaceText);
+    const noStack = !stackFramePresent(surfaceText);
+    const crashPass = crash.status === 200 && !!crash.requestId && alertRegion && retryControl && errorClass && plainSummary && noStack;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22108-1: varied-input plain-summary derivation against a shipped origin (framework internal frames, arbitrary env keys the origin might have leaked) is not observed by this Node HTTP probe against a fixed fixture; the error-boundary alert + retry + error-class + plain-summary + no-stack-frame walk is a partial observation of AC-22108-1',
+      verdict: crashPass ? 'warn' : 'fail',
+      detail: crashPass
+        ? `Given a synthetic client-side render exception thrown via the sample-app /probe/error-boundary?crash=1 route: observed role="alert" region, [data-recovery="retry"] control, data-error-class="render-failure" label and plain summary "Widget failed to render" on the rendered surface; no stack-frame pattern hit; x-fixture-request-id=${crash.requestId}`
+        : `Given a synthetic client-side render exception thrown via /probe/error-boundary?crash=1 (evidence gap): status=${crash.status} rid=${crash.requestId} alert=${alertRegion} retry=${retryControl} errorClass=${errorClass} summary=${plainSummary} noStack=${noStack}`,
+      evidence: {
+        requestId: crash.requestId,
+        responseStatus: crash.status,
+        bodyExcerpt: excerpt(surfaceText),
+        derived: { alertRegion, retryControl, errorClass, plainSummary, noStack },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-empty-error-states/contributions/probes/forbidden-and-server-error.mjs

@@ -0,0 +1,167 @@
+// application-empty-error-states probe: 403 forbidden and 500 server
+// error states (AC-22102-1, AC-22103-1).
+//
+// AC-22102-1 requires the forbidden state to render inside role="region"
+// with a keyboard-reachable [data-action="request-access"] control that
+// POSTs to /api/request-access; the rendered surface must NOT contain
+// any sensitive-pattern hit (resource id shape, resource name shape,
+// path-shape strings starting with /).
+//
+// AC-22103-1 requires the server-error state to render inside
+// role="region" with a keyboard-reachable [data-recovery="retry"] control;
+// the rendered surface must NOT contain a backtrace-frame prefix
+// ("at " + function + file:line), a source path starting with /, ./
+// or ../, an environment-variable key shape (NAME= or process.env.NAME),
+// or a framework-internal frame prefix.
+//
+// Positive-anchor rows only: broken-variant rows on absence were removed
+// under the positive-anchor cleanup (they positively-anchor on absence and are void).
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+import { randomUUID } from 'node:crypto';
+
+export const anchorAcId = 'application-empty-error-states-AC-22102-1';
+export const accountBound = false;
+
+function stripHtml(html) {
+  return String(html)
+    .replace(/<script[^]*?<\/script>/gi, ' ')
+    .replace(/<style[^]*?<\/style>/gi, ' ')
+    .replace(/<[^>]+>/g, ' ')
+    .replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&#39;/g, "'")
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function forbiddenSensitiveHit(text) {
+  // Sensitive-pattern list per AC-22102-1: resource id shape (kind-digits-slug,
+  // e.g. widget-2039-alpha), a resource-name slug (kind-slug-slug preceded
+  // by resource identifiers), or a URL path-shape string with 2+ segments.
+  // A request-id shape (letters-letters-digits) is a correlation id, not a
+  // resource id, and is not sensitive.
+  if (/\b[a-z]+-\d{3,}-[a-z][a-z0-9]*\b/i.test(text)) return true;
+  if (/\b(resource|id|widget|entity)=[a-z0-9-]+/i.test(text)) return true;
+  if (/(^|\s)\/[a-z][a-z0-9_-]+\/[a-z0-9_-]+/i.test(text)) return true;
+  return false;
+}
+
+function serverErrorSensitiveHit(text) {
+  // Sensitive-pattern list per AC-22103-1: backtrace frame, source
+  // path (with file extension), env-var key shape (either process.env.NAME
+  // or a bare NAME=value form), framework-internal frame. Correlation-id
+  // tokens without file:line context are not stack frames and are ignored.
+  if (/\bat\s+[A-Za-z_$][A-Za-z0-9_$.]*\s*\([^)]+:\d+:\d+\)/.test(text)) return true;
+  if (/(^|\s)(\.\.?\/|\/)[A-Za-z0-9_./-]+\.(js|mjs|cjs|ts|tsx|jsx)\b/i.test(text)) return true;
+  if (/process\.env\.[A-Z_][A-Z0-9_]*/.test(text)) return true;
+  // Bare NAME=value: an uppercase env-key style token followed by '=' and a
+  // non-whitespace value. Matches leaked lines like "DB_PASSWORD=hunter2"
+  // that a naive error handler might have echoed back to the surface.
+  if (/(^|[^A-Z0-9_])[A-Z][A-Z0-9_]{2,}=[^\s]+/.test(text)) return true;
+  if (/\bnode_modules\//.test(text)) return true;
+  return false;
+}
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    // Mint varied sensitive tokens per run and inject them into the
+    // request that drives the 403. The confidentiality property under
+    // AC-22102-1 holds when none of the injected tokens appears in the
+    // rendered error copy (a real varied-input observation, not a fixed
+    // safe-copy self-agreement).
+    const leakToken = 'sk-live-' + randomUUID().replace(/-/g, '');
+    const leakResourceId = 'widget-' + Math.floor(Math.random() * 1_000_000) + '-' + randomUUID().slice(0, 6);
+    const leakEmail = 'probe-leak-' + randomUUID().slice(0, 8) + '@example.test';
+    const leakEnvKey = 'PROBE_LEAK_' + randomUUID().replace(/-/g, '').slice(0, 8).toUpperCase();
+    const leakEnvValue = 'v-' + randomUUID().slice(0, 12);
+    const leakEnvPair = `${leakEnvKey}=${leakEnvValue}`;
+
+    const injectedForbidden = new URLSearchParams({
+      'leak-token': leakToken,
+      'leak-resource-id': leakResourceId,
+      'leak-email': leakEmail,
+      'leak-env': leakEnvPair,
+      'x-injected-name': leakEnvKey,
+      'x-injected-value': leakEnvValue,
+    }).toString();
+    const forbidden = await fixtureFetch(fixture.url, `/probe/forbidden?${injectedForbidden}`, {
+      headers: { 'x-probe-leak-token': leakToken, 'x-probe-leak-email': leakEmail, 'x-probe-leak-env': leakEnvPair },
+    });
+    const surfaceText = stripHtml(forbidden.body);
+    const region = /data-surface="forbidden"[^>]*role="region"/.test(forbidden.body);
+    const control = /data-action="request-access"/.test(forbidden.body);
+    const stateCopyPresent = /You do not have scope on this workspace/.test(surfaceText);
+    const noSensitivePatternHit = !forbiddenSensitiveHit(surfaceText);
+    const injectedAbsent = !forbidden.body.includes(leakToken)
+      && !forbidden.body.includes(leakResourceId)
+      && !forbidden.body.includes(leakEmail)
+      && !forbidden.body.includes(leakEnvPair)
+      && !forbidden.body.includes(leakEnvValue);
+    const post = await fixtureFetch(fixture.url, '/api/request-access', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });
+    let postBody = null; try { postBody = JSON.parse(post.body); } catch (_) { /* parse */ }
+    const roundTrip = post.status === 200 && !!post.requestId && postBody && postBody.ok === true;
+    const forbiddenPass = forbidden.status === 403 && !!forbidden.requestId
+      && region && control && stateCopyPresent
+      && noSensitivePatternHit && injectedAbsent && roundTrip;
+    results.push({
+      anchorAcId: 'application-empty-error-states-AC-22102-1',
+      verdict: forbiddenPass ? 'pass' : 'fail',
+      detail: forbiddenPass
+        ? `Given a 403 response, the forbidden state renders inside role="region" with a keyboard-reachable [data-action="request-access"] control that POSTs to /api/request-access; the probe minted varied sensitive input per run (token, resource id, email, NAME=value pair) and injected them via query and headers into the request that triggered the 403; the rendered document text contains none of the injected tokens and no sensitive-pattern hit on the surface; POST /api/request-access returned 200 with ok=true; x-fixture-request-id (state)=${forbidden.requestId}, (action)=${post.requestId}`
+        : `Given a 403 response, the forbidden state renders (evidence gap): status=${forbidden.status} rid=${forbidden.requestId} region=${region} control=${control} stateCopy=${stateCopyPresent} noSensitivePattern=${noSensitivePatternHit} injectedAbsent=${injectedAbsent} roundTrip=${roundTrip}`,
+      evidence: {
+        requestId: forbidden.requestId,
+        responseStatus: forbidden.status,
+        bodyExcerpt: excerpt(surfaceText),
+        derived: { region, control, stateCopyPresent, noSensitivePatternHit, injectedAbsent, injectedTokens: { leakToken, leakResourceId, leakEmail, leakEnvPair }, actionStatus: post.status, actionOk: !!(postBody && postBody.ok) },
+      },
+    });
+
+    // Mint a fresh set of tokens for the 500 leg and inject via query +
+    // headers into the request that triggers the server-error surface.
+    const svLeakStack = `at leakedFn__${randomUUID().slice(0, 6)} (/opt/leak/${randomUUID().slice(0, 8)}.js:${Math.floor(Math.random() * 500) + 1}:${Math.floor(Math.random() * 80) + 1})`;
+    const svLeakEnvKey = 'SV_LEAK_' + randomUUID().replace(/-/g, '').slice(0, 8).toUpperCase();
+    const svLeakEnvValue = randomUUID().slice(0, 12);
+    const svLeakEnvPair = `${svLeakEnvKey}=${svLeakEnvValue}`;
+    const svLeakPath = `/opt/leak/${randomUUID().slice(0, 8)}.mjs`;
+    const svInjected = new URLSearchParams({
+      'leak-stack': svLeakStack,
+      'leak-env': svLeakEnvPair,
+      'leak-path': svLeakPath,
+    }).toString();
+    const server = await fixtureFetch(fixture.url, `/probe/server-error?${svInjected}`, {
+      headers: { 'x-probe-leak-stack': svLeakStack, 'x-probe-leak-env': svLeakEnvPair, 'x-probe-leak-path': svLeakPath },
+    });
+    const svText = stripHtml(server.body);
+    const svRegion = /data-surface="server-error"[^>]*role="region"/.test(server.body);
+    const svRetry = /data-recovery="retry"/.test(server.body);
+    const svStateCopy = /The server hit an internal failure/.test(svText);
+    const svNoPatternHit = !serverErrorSensitiveHit(svText);
+    const svInjectedAbsent = !server.body.includes(svLeakStack)
+      && !server.body.includes(svLeakEnvPair)
+      && !server.body.includes(svLeakEnvValue)
+      && !server.body.includes(svLeakPath);
+    // The matcher itself must catch a bare NAME=value form: probe it here so
+    // regressions on the matcher are surfaced as a hard fail on this row.
+    const matcherCatchesBareName = serverErrorSensitiveHit('the payload was DB_PASSWORD=hunter2 rest');
+    const svPass = server.status === 500 && !!server.requestId && svRegion && svRetry && svStateCopy
+      && svNoPatternHit && svInjectedAbsent && matcherCatchesBareName;
+    results.push({
+      anchorAcId: 'application-empty-error-states-AC-22103-1',
+      verdict: svPass ? 'pass' : 'fail',
+      detail: svPass
+        ? `Given a mocked 500 response, the server-error state renders inside role="region" with a keyboard-reachable [data-recovery="retry"] control; the probe minted varied sensitive input per run (backtrace-frame line, bare NAME=value env-key pair, source path) and injected them via query and headers into the request that triggered the 500; the rendered document text contains none of the injected tokens and no backtrace/source-path/env-var/framework-frame hit on the surface; the sensitive-value matcher positively catches a bare NAME=value form; x-fixture-request-id=${server.requestId}`
+        : `Given a mocked 500 response, the server-error state renders (evidence gap): status=${server.status} rid=${server.requestId} region=${svRegion} retry=${svRetry} stateCopy=${svStateCopy} noPatternHit=${svNoPatternHit} injectedAbsent=${svInjectedAbsent} matcherCatchesBareName=${matcherCatchesBareName}`,
+      evidence: {
+        requestId: server.requestId,
+        responseStatus: server.status,
+        bodyExcerpt: excerpt(svText),
+        derived: { region: svRegion, retry: svRetry, stateCopy: svStateCopy, noPatternHit: svNoPatternHit, injectedAbsent: svInjectedAbsent, matcherCatchesBareName, injectedTokens: { svLeakStack, svLeakEnvPair, svLeakPath } },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-empty-error-states/contributions/probes/not-found-and-recovery.mjs

@@ -0,0 +1,61 @@
+// application-empty-error-states probe: 404 not-found state
+// (AC-22101-1). AC-22101-1 requires a role="region" with an
+// accessible name for the missing resource kind, a keyboard-reachable
+// recovery link to the parent surface, plus a search input as an
+// alternate recovery.
+//
+// The probe:
+//   - GETs /probe/not-found and derives status=404, the region role
+//     wrapper, the parent-surface recovery link and the search input.
+//   - Follows the parent-surface link and asserts the linked route
+//     responds (200): the derived observable of "recovery link works"
+//     is a two-request round-trip, not a magic string match.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-empty-error-states-AC-22101-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const nf = await fixtureFetch(fixture.url, '/probe/not-found');
+    const regionPresent = /data-surface="not-found"[^>]*role="region"/.test(nf.body);
+    const parentLinkMatch = nf.body.match(/href="([^"]+)"[^>]*data-recovery="parent-surface"/);
+    const parentHref = parentLinkMatch ? parentLinkMatch[1] : null;
+    const searchInput = /data-recovery="search"[^>]*>[^]*<input[^>]*type="search"/.test(nf.body);
+    const statusOk = nf.status === 404;
+    const regionCheckPass = statusOk && !!nf.requestId && regionPresent && !!parentHref && searchInput;
+
+    // Follow the recovery link (varied input: a second request derived
+    // from the first response) and assert the target route responds.
+    let followStatus = null;
+    let followRid = null;
+    if (parentHref) {
+      const follow = await fixtureFetch(fixture.url, parentHref);
+      followStatus = follow.status;
+      followRid = follow.requestId;
+    }
+    const roundTripPass = regionCheckPass && followStatus === 200 && !!followRid;
+
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22101-1: browser document-title state reflecting the missing resource kind and assistive-tech accessible-name resolution (the AC clauses beyond the DOM shape) are browser + AT driven and not observed by this Node HTTP probe; the 404 region + parent-link follow-through walk is a partial observation of AC-22101-1',
+      verdict: roundTripPass ? 'warn' : 'fail',
+      detail: roundTripPass
+        ? `Given a 404 response on a route the SPA declares: observed role="region" named for the missing resource, [data-recovery="parent-surface"] link (${parentHref}) and [data-recovery="search"] input on the rendered surface; follow-through GET ${parentHref} returned 200; x-fixture-request-id (not-found)=${nf.requestId}, (parent)=${followRid}`
+        : `Given a 404 response on a route the SPA declares (evidence gap): status=${nf.status} rid=${nf.requestId} region=${regionPresent} parentHref=${parentHref} searchInput=${searchInput} followStatus=${followStatus}`,
+      evidence: {
+        requestId: nf.requestId,
+        responseStatus: nf.status,
+        bodyExcerpt: excerpt((nf.body.match(/data-surface="not-found"[^]{0,200}/) || [''])[0]),
+        derived: { statusOk, regionPresent, parentHref, followStatus, followRequestId: followRid, searchInput },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-empty-error-states/contributions/probes/permission-denied-and-offline.mjs

@@ -0,0 +1,155 @@
+// application-empty-error-states probe: permission-denied
+// (AC-22104-1) and the offline buffer lifecycle (AC-22105-1).
+//
+// AC-22105-1 requires observing the buffered-write lifecycle
+// (intercepted-write when the transport is offline, buffered with
+// idempotency-per-token, flushed on reconnect, delivered count
+// visible). The lifecycle is server-observable via the fixture's
+// /probe/offline/state, /probe/offline/buffer and
+// /probe/offline/reconnect endpoints - a probe can flip the state
+// to offline, POST a varied idempotency token, verify the count
+// increased and the token deduplicates a duplicate POST, trigger
+// reconnect, then verify the buffer drained and the delivered
+// count rose. The polite live-region announcement of the flushed
+// count is browser-driven (client script wires the announce) and
+// is not part of what this row observes.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+import { randomUUID } from 'node:crypto';
+
+export const anchorAcId = 'application-empty-error-states-AC-22104-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const pd = await fixtureFetch(fixture.url, '/probe/permission-denied');
+    const region = /data-surface="permission-denied"[^>]*role="region"/.test(pd.body);
+    const causeMatch = pd.body.match(/<span data-cause>([^<]+)<\/span>/);
+    const causeText = causeMatch ? causeMatch[1] : '';
+    // AC-22104-1 requires a class-level cause string with no digits-run
+    // of 4 or more and no per-resource identifier shape.
+    const causeShape = causeText.length > 0 && !/\d{4,}/.test(causeText);
+    const action = /data-action="request-access"/.test(pd.body);
+    const causeClass = /data-cause-class="scope-missing"/.test(pd.body);
+    const pass = pd.status === 403 && !!pd.requestId && region && causeShape && action && causeClass;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22104-1: the exact cause-shape regex (no UUID form, no identifier-prefixed slug) demanded by the AC is not enforced by this Node HTTP probe; the 403 + region + request-access + class-level-cause walk is a partial observation of AC-22104-1',
+      verdict: pass ? 'warn' : 'fail',
+      detail: pass
+        ? `Given a mocked 403 response with a per-resource cause: observed role="region", class-level cause "${causeText}" (no 4+ digit run), [data-action="request-access"] control and data-cause-class="scope-missing" on the rendered surface; x-fixture-request-id=${pd.requestId}`
+        : `Given a mocked 403 response with a per-resource cause (evidence gap): status=${pd.status} rid=${pd.requestId} region=${region} cause="${causeText}" causeShape=${causeShape} action=${action} causeClass=${causeClass}`,
+      evidence: {
+        requestId: pd.requestId,
+        responseStatus: pd.status,
+        bodyExcerpt: excerpt((pd.body.match(/data-surface="permission-denied"[^]{0,220}/) || [''])[0]),
+        derived: { region, causeText, causeShape, action, causeClass },
+      },
+    });
+
+    // AC-22105-1 server-observable buffer lifecycle: flip state
+    // offline, POST a varied idempotency token, verify buffer grew,
+    // POST the same token and verify dedupe, POST a second distinct
+    // token, trigger reconnect and verify the buffer drained with
+    // the expected delivered count. Every step drives a varied
+    // input the fixture cannot see coming, and every assertion is on
+    // a derived output the fixture had no choice about.
+    const principalId = 'probe-offline-' + randomUUID();
+    // Baseline read (fresh principal begins with the seeded buffer of size 1).
+    const initial = await fixtureFetch(fixture.url, `/probe/offline/state?principal-id=${principalId}`);
+    const initialState = JSON.parse(initial.body || '{}');
+    // Flip to offline.
+    const flipOffline = await fixtureFetch(fixture.url, `/probe/offline/state?principal-id=${principalId}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ state: 'offline' }),
+    });
+    // Enqueue a distinct token.
+    const tokenA = 'probe-write-' + randomUUID();
+    const enqA1 = await fixtureFetch(fixture.url, `/probe/offline/buffer?principal-id=${principalId}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ idempotencyToken: tokenA, payload: { kind: 'note', body: 'first' } }),
+    });
+    const enqA1Body = JSON.parse(enqA1.body || '{}');
+    // Duplicate write with the SAME token must dedupe (no count increase).
+    const enqA2 = await fixtureFetch(fixture.url, `/probe/offline/buffer?principal-id=${principalId}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ idempotencyToken: tokenA, payload: { kind: 'note', body: 'first-again' } }),
+    });
+    const enqA2Body = JSON.parse(enqA2.body || '{}');
+    // Enqueue a second distinct token (count must go up).
+    const tokenB = 'probe-write-' + randomUUID();
+    const enqB = await fixtureFetch(fixture.url, `/probe/offline/buffer?principal-id=${principalId}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ idempotencyToken: tokenB, payload: { kind: 'note', body: 'second' } }),
+    });
+    const enqBBody = JSON.parse(enqB.body || '{}');
+    // Reconnect and drain.
+    const reconnect = await fixtureFetch(fixture.url, `/probe/offline/reconnect?principal-id=${principalId}`, { method: 'POST' });
+    const reconnectBody = JSON.parse(reconnect.body || '{}');
+    // Final GET reads state after reconnect: buffer drained.
+    const finalState = await fixtureFetch(fixture.url, `/probe/offline/state?principal-id=${principalId}`);
+    const finalStateBody = JSON.parse(finalState.body || '{}');
+    // Expectations per AC-22105-1:
+    //   - offline enqueue grows the buffer count on distinct token
+    //   - duplicate token does not grow the count (dedupe)
+    //   - reconnect returns flushed count === buffer count at reconnect time
+    //   - final state shows buffer empty and delivered count rose by the
+    //     flushed count
+    const seededCount = initialState.bufferCount ?? 0;
+    const bufferAfterA1 = enqA1Body.bufferCount ?? 0;
+    const bufferAfterA2 = enqA2Body.bufferCount ?? 0;
+    const bufferAfterB = enqBBody.bufferCount ?? 0;
+    const flushedCount = reconnectBody.flushedCount ?? -1;
+    const deliveredAfter = finalStateBody.deliveredCount ?? -1;
+    const enqueueGrew = bufferAfterA1 === seededCount + 1;
+    const deduped = bufferAfterA2 === bufferAfterA1 && enqA2Body.deduped === true;
+    const secondEnqueueGrew = bufferAfterB === bufferAfterA1 + 1;
+    const flushedMatches = flushedCount === bufferAfterB;
+    const drained = (finalStateBody.bufferCount ?? -1) === 0 && finalStateBody.state === 'online';
+    const deliveredMatches = deliveredAfter === flushedCount;
+    const bufferPass = initial.status === 200 && !!initial.requestId
+      && flipOffline.status === 200
+      && enqA1.status === 200 && enqA2.status === 200 && enqB.status === 200
+      && reconnect.status === 200 && finalState.status === 200
+      && enqueueGrew && deduped && secondEnqueueGrew && flushedMatches && drained && deliveredMatches;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22105-1: the polite live-region announcement of the flushed count and the rendered banner / buffer-count visible on the SPA (the AC clauses beyond the server-side buffer lifecycle) are browser-driven and not observed by this Node HTTP probe; the offline-flip / enqueue / dedupe / reconnect / drain lifecycle is a partial observation of AC-22105-1',
+      verdict: bufferPass ? 'warn' : 'fail',
+      detail: bufferPass
+        ? `Given navigator.onLine simulated false via the runtime seam: with the server-side buffer keyed to a fresh principalId, POST /probe/offline/state{state:offline} flipped the state; two distinct idempotency tokens enqueued (buffer count seededCount=${seededCount} -> ${bufferAfterA1} -> ${bufferAfterB}); duplicate token deduped (deduped=${enqA2Body.deduped}, count stayed ${bufferAfterA2}); POST /probe/offline/reconnect drained ${flushedCount} writes; final state shows bufferCount=0, state=online, deliveredCount=${deliveredAfter} equal to flushedCount; x-fixture-request-id (initial GET)=${initial.requestId}`
+        : `Given navigator.onLine simulated false via the runtime seam (evidence gap): seeded=${seededCount} afterA1=${bufferAfterA1} afterA2=${bufferAfterA2} afterB=${bufferAfterB} flushed=${flushedCount} delivered=${deliveredAfter} state=${finalStateBody.state} enqueueGrew=${enqueueGrew} deduped=${deduped} secondGrew=${secondEnqueueGrew} flushedMatches=${flushedMatches} drained=${drained} deliveredMatches=${deliveredMatches}`,
+      evidence: {
+        requestId: initial.requestId,
+        responseStatus: initial.status,
+        bodyExcerpt: excerpt(JSON.stringify({ initial: initialState, afterEnq: enqBBody, reconnect: reconnectBody, final: finalStateBody })),
+        derived: {
+          principalId,
+          seededCount,
+          bufferAfterA1,
+          bufferAfterA2,
+          bufferAfterB,
+          flushedCount,
+          deliveredAfter,
+          enqueueGrew,
+          deduped,
+          secondEnqueueGrew,
+          flushedMatches,
+          drained,
+          deliveredMatches,
+        },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-empty-error-states/contributions/probes/probe-utils.mjs

@@ -0,0 +1,177 @@
+// Shared helpers for application-empty-error-states contributions/probes/.
+//
+// The real engine for every probe in this pack is the fixture HTTP
+// server at packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/server.js
+// booted on a scratch port from the family range 47630-47639.
+// The fixture echoes a per-request x-fixture-request-id header on
+// every response; probes record that id and a response body excerpt
+// as positive evidence per rule 7d.
+//
+// No account credentials or network calls: every probe is
+// local-fixture-driven, so no probe carries an account-bound branch
+// or a CI_HAS_* gate. Declared env vars are the fixture's own
+// PORT and (where the fixture reads them) the CAPS/state switches
+// the probes drive via query string.
+
+import { spawn } from 'node:child_process';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:net';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export const SLUG = 'application-empty-error-states';
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/application-empty-error-states');
+export const PORT_RANGE_START = 47630;
+export const PORT_RANGE_END = 47639;
+export const DECLARED_ENV = Object.freeze(['PORT', 'EMPTY_ERROR_STATES_BREAK', 'PROBE_BREAK']);
+export const REQUEST_ID_HEADER = 'x-fixture-request-id';
+
+// Pick a free port from the fixture family range. Falls back to
+// asking the OS for an ephemeral port only if the whole range is
+// held by other workers (never expected on a single-machine run).
+export async function pickPort() {
+  for (let port = PORT_RANGE_START; port <= PORT_RANGE_END; port += 1) {
+    if (await canBind(port)) return port;
+  }
+  return await bindEphemeral();
+}
+
+function canBind(port) {
+  return new Promise((res) => {
+    const s = createServer();
+    s.once('error', () => res(false));
+    s.listen(port, '127.0.0.1', () => {
+      const bound = s.address();
+      s.close(() => res(!!bound));
+    });
+  });
+}
+
+function bindEphemeral() {
+  return new Promise((res) => {
+    const s = createServer();
+    s.listen(0, '127.0.0.1', () => {
+      const port = s.address().port;
+      s.close(() => res(port));
+    });
+  });
+}
+
+// Spawns the fixture server as a child on `port` with the given
+// env overlay; resolves once the fixture has printed LISTENING and
+// returns { child, url, kill } (kill is synchronous best-effort).
+export async function startFixture({ port, env = {} } = {}) {
+  const boundPort = port ?? await pickPort();
+  const child = spawn(process.execPath, ['server.js'], {
+    cwd: FIXTURE_DIR,
+    env: { ...process.env, PORT: String(boundPort), ...env },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  await new Promise((res, rej) => {
+    const timer = setTimeout(() => rej(new Error(`fixture did not print LISTENING within 4s on port ${boundPort}`)), 4000);
+    let stderrBuf = '';
+    child.stderr.on('data', (chunk) => { stderrBuf += String(chunk); });
+    child.on('exit', (code) => rej(new Error(`fixture exited early (code=${code}) stderr=${stderrBuf.slice(0, 400)}`)));
+    child.stdout.on('data', (chunk) => {
+      if (String(chunk).includes(`LISTENING ${boundPort}`)) { clearTimeout(timer); res(); }
+    });
+  });
+  const url = new URL(`http://127.0.0.1:${boundPort}`);
+  return {
+    child,
+    url,
+    port: boundPort,
+    // Await child exit and propagate any error. A teardown failure
+    // must fail the verdict (the teardown-propagation rule);
+    // no swallowed errors here.
+    kill: () => new Promise((res, rej) => {
+      let settled = false;
+      const done = (err) => { if (settled) return; settled = true; err ? rej(err) : res(); };
+      child.once('exit', () => done());
+      child.once('error', (err) => done(err));
+      try { child.kill('SIGTERM'); } catch (err) { return done(err); }
+      setTimeout(() => {
+        if (settled) return;
+        try { child.kill('SIGKILL'); } catch (err) { return done(err); }
+      }, 4000);
+    }),
+  };
+}
+
+// Issue an HTTP request against the fixture and return
+// { status, headers, body, requestId }.
+export async function fixtureFetch(url, pathAndQuery, init = {}) {
+  const target = new URL(pathAndQuery, url);
+  const res = await fetch(target, init);
+  const body = await res.text();
+  const requestId = res.headers.get(REQUEST_ID_HEADER);
+  return { status: res.status, headers: Object.fromEntries(res.headers.entries()), body, requestId };
+}
+
+export function excerpt(body, maxLen = 240) {
+  if (typeof body !== 'string') return '';
+  return body.length <= maxLen ? body : body.slice(0, maxLen) + '…';
+}
+
+export function aggregate(results) {
+  // Positive-evidence rule: no-checks-ran is a fail.
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  // Any warn row lifts the aggregate to warn, including honest
+  // notObservableHere de-claims. A probe whose rows are all warn
+  // aggregates to warn, not pass; the shelf reads amber and the tally
+  // accepts a warn aggregate as problems=0 when no fail row is present.
+  if (results.some((r) => r && r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: SLUG,
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const filepath = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(filepath, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path: filepath };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path: filepath } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${filepath}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    // Positive-evidence rule (exception fallback): exception rows have no
+    // observed AC; anchor null (never a fabricated id like
+    // "unknown"), carry an evidence object with the error excerpt.
+    const message = err && err.message ? err.message : String(err);
+    const stack = err && err.stack ? err.stack : String(err);
+    const results = [{
+      anchorAcId: null,
+      verdict: 'fail',
+      detail: `probe threw: ${message}`,
+      evidence: {
+        errorMessage: message,
+        errorExcerpt: excerpt(stack, 480),
+      },
+    }];
+    const { report, path: filepath } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${stack}\n`);
+    process.stderr.write(`report written to ${filepath}\n`);
+    process.exitCode = 1;
+  }
+}

package/blueprints/application-empty-error-states/contributions/probes/run-empty-list-and-no-search.mjs

@@ -0,0 +1,5 @@
+import runProbe from './empty-list-and-no-search.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-empty-error-states/server.js', healthy: true };
+runShim('empty-list-and-no-search', engine, runProbe);

package/blueprints/application-empty-error-states/contributions/probes/run-error-boundary-alert.mjs

@@ -0,0 +1,5 @@
+import runProbe from './error-boundary-alert.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-empty-error-states/server.js', healthy: true };
+runShim('error-boundary-alert', engine, runProbe);

package/blueprints/application-empty-error-states/contributions/probes/run-forbidden-and-server-error.mjs

@@ -0,0 +1,5 @@
+import runProbe from './forbidden-and-server-error.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-empty-error-states/server.js', healthy: true };
+runShim('forbidden-and-server-error', engine, runProbe);