rcf-lite 0.27.0 → 0.28.1

package/blueprints/application-empty-error-states/contributions/probes/permission-denied-and-offline.mjs

@@ -0,0 +1,155 @@
+// application-empty-error-states probe: permission-denied
+// (AC-22104-1) and the offline buffer lifecycle (AC-22105-1).
+//
+// AC-22105-1 requires observing the buffered-write lifecycle
+// (intercepted-write when the transport is offline, buffered with
+// idempotency-per-token, flushed on reconnect, delivered count
+// visible). The lifecycle is server-observable via the fixture's
+// /probe/offline/state, /probe/offline/buffer and
+// /probe/offline/reconnect endpoints - a probe can flip the state
+// to offline, POST a varied idempotency token, verify the count
+// increased and the token deduplicates a duplicate POST, trigger
+// reconnect, then verify the buffer drained and the delivered
+// count rose. The polite live-region announcement of the flushed
+// count is browser-driven (client script wires the announce) and
+// is not part of what this row observes.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+import { randomUUID } from 'node:crypto';
+
+export const anchorAcId = 'application-empty-error-states-AC-22104-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const pd = await fixtureFetch(fixture.url, '/probe/permission-denied');
+    const region = /data-surface="permission-denied"[^>]*role="region"/.test(pd.body);
+    const causeMatch = pd.body.match(/<span data-cause>([^<]+)<\/span>/);
+    const causeText = causeMatch ? causeMatch[1] : '';
+    // AC-22104-1 requires a class-level cause string with no digits-run
+    // of 4 or more and no per-resource identifier shape.
+    const causeShape = causeText.length > 0 && !/\d{4,}/.test(causeText);
+    const action = /data-action="request-access"/.test(pd.body);
+    const causeClass = /data-cause-class="scope-missing"/.test(pd.body);
+    const pass = pd.status === 403 && !!pd.requestId && region && causeShape && action && causeClass;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22104-1: the exact cause-shape regex (no UUID form, no identifier-prefixed slug) demanded by the AC is not enforced by this Node HTTP probe; the 403 + region + request-access + class-level-cause walk is a partial observation of AC-22104-1',
+      verdict: pass ? 'warn' : 'fail',
+      detail: pass
+        ? `Given a mocked 403 response with a per-resource cause: observed role="region", class-level cause "${causeText}" (no 4+ digit run), [data-action="request-access"] control and data-cause-class="scope-missing" on the rendered surface; x-fixture-request-id=${pd.requestId}`
+        : `Given a mocked 403 response with a per-resource cause (evidence gap): status=${pd.status} rid=${pd.requestId} region=${region} cause="${causeText}" causeShape=${causeShape} action=${action} causeClass=${causeClass}`,
+      evidence: {
+        requestId: pd.requestId,
+        responseStatus: pd.status,
+        bodyExcerpt: excerpt((pd.body.match(/data-surface="permission-denied"[^]{0,220}/) || [''])[0]),
+        derived: { region, causeText, causeShape, action, causeClass },
+      },
+    });
+
+    // AC-22105-1 server-observable buffer lifecycle: flip state
+    // offline, POST a varied idempotency token, verify buffer grew,
+    // POST the same token and verify dedupe, POST a second distinct
+    // token, trigger reconnect and verify the buffer drained with
+    // the expected delivered count. Every step drives a varied
+    // input the fixture cannot see coming, and every assertion is on
+    // a derived output the fixture had no choice about.
+    const principalId = 'probe-offline-' + randomUUID();
+    // Baseline read (fresh principal begins with the seeded buffer of size 1).
+    const initial = await fixtureFetch(fixture.url, `/probe/offline/state?principal-id=${principalId}`);
+    const initialState = JSON.parse(initial.body || '{}');
+    // Flip to offline.
+    const flipOffline = await fixtureFetch(fixture.url, `/probe/offline/state?principal-id=${principalId}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ state: 'offline' }),
+    });
+    // Enqueue a distinct token.
+    const tokenA = 'probe-write-' + randomUUID();
+    const enqA1 = await fixtureFetch(fixture.url, `/probe/offline/buffer?principal-id=${principalId}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ idempotencyToken: tokenA, payload: { kind: 'note', body: 'first' } }),
+    });
+    const enqA1Body = JSON.parse(enqA1.body || '{}');
+    // Duplicate write with the SAME token must dedupe (no count increase).
+    const enqA2 = await fixtureFetch(fixture.url, `/probe/offline/buffer?principal-id=${principalId}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ idempotencyToken: tokenA, payload: { kind: 'note', body: 'first-again' } }),
+    });
+    const enqA2Body = JSON.parse(enqA2.body || '{}');
+    // Enqueue a second distinct token (count must go up).
+    const tokenB = 'probe-write-' + randomUUID();
+    const enqB = await fixtureFetch(fixture.url, `/probe/offline/buffer?principal-id=${principalId}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ idempotencyToken: tokenB, payload: { kind: 'note', body: 'second' } }),
+    });
+    const enqBBody = JSON.parse(enqB.body || '{}');
+    // Reconnect and drain.
+    const reconnect = await fixtureFetch(fixture.url, `/probe/offline/reconnect?principal-id=${principalId}`, { method: 'POST' });
+    const reconnectBody = JSON.parse(reconnect.body || '{}');
+    // Final GET reads state after reconnect: buffer drained.
+    const finalState = await fixtureFetch(fixture.url, `/probe/offline/state?principal-id=${principalId}`);
+    const finalStateBody = JSON.parse(finalState.body || '{}');
+    // Expectations per AC-22105-1:
+    //   - offline enqueue grows the buffer count on distinct token
+    //   - duplicate token does not grow the count (dedupe)
+    //   - reconnect returns flushed count === buffer count at reconnect time
+    //   - final state shows buffer empty and delivered count rose by the
+    //     flushed count
+    const seededCount = initialState.bufferCount ?? 0;
+    const bufferAfterA1 = enqA1Body.bufferCount ?? 0;
+    const bufferAfterA2 = enqA2Body.bufferCount ?? 0;
+    const bufferAfterB = enqBBody.bufferCount ?? 0;
+    const flushedCount = reconnectBody.flushedCount ?? -1;
+    const deliveredAfter = finalStateBody.deliveredCount ?? -1;
+    const enqueueGrew = bufferAfterA1 === seededCount + 1;
+    const deduped = bufferAfterA2 === bufferAfterA1 && enqA2Body.deduped === true;
+    const secondEnqueueGrew = bufferAfterB === bufferAfterA1 + 1;
+    const flushedMatches = flushedCount === bufferAfterB;
+    const drained = (finalStateBody.bufferCount ?? -1) === 0 && finalStateBody.state === 'online';
+    const deliveredMatches = deliveredAfter === flushedCount;
+    const bufferPass = initial.status === 200 && !!initial.requestId
+      && flipOffline.status === 200
+      && enqA1.status === 200 && enqA2.status === 200 && enqB.status === 200
+      && reconnect.status === 200 && finalState.status === 200
+      && enqueueGrew && deduped && secondEnqueueGrew && flushedMatches && drained && deliveredMatches;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22105-1: the polite live-region announcement of the flushed count and the rendered banner / buffer-count visible on the SPA (the AC clauses beyond the server-side buffer lifecycle) are browser-driven and not observed by this Node HTTP probe; the offline-flip / enqueue / dedupe / reconnect / drain lifecycle is a partial observation of AC-22105-1',
+      verdict: bufferPass ? 'warn' : 'fail',
+      detail: bufferPass
+        ? `Given navigator.onLine simulated false via the runtime seam: with the server-side buffer keyed to a fresh principalId, POST /probe/offline/state{state:offline} flipped the state; two distinct idempotency tokens enqueued (buffer count seededCount=${seededCount} -> ${bufferAfterA1} -> ${bufferAfterB}); duplicate token deduped (deduped=${enqA2Body.deduped}, count stayed ${bufferAfterA2}); POST /probe/offline/reconnect drained ${flushedCount} writes; final state shows bufferCount=0, state=online, deliveredCount=${deliveredAfter} equal to flushedCount; x-fixture-request-id (initial GET)=${initial.requestId}`
+        : `Given navigator.onLine simulated false via the runtime seam (evidence gap): seeded=${seededCount} afterA1=${bufferAfterA1} afterA2=${bufferAfterA2} afterB=${bufferAfterB} flushed=${flushedCount} delivered=${deliveredAfter} state=${finalStateBody.state} enqueueGrew=${enqueueGrew} deduped=${deduped} secondGrew=${secondEnqueueGrew} flushedMatches=${flushedMatches} drained=${drained} deliveredMatches=${deliveredMatches}`,
+      evidence: {
+        requestId: initial.requestId,
+        responseStatus: initial.status,
+        bodyExcerpt: excerpt(JSON.stringify({ initial: initialState, afterEnq: enqBBody, reconnect: reconnectBody, final: finalStateBody })),
+        derived: {
+          principalId,
+          seededCount,
+          bufferAfterA1,
+          bufferAfterA2,
+          bufferAfterB,
+          flushedCount,
+          deliveredAfter,
+          enqueueGrew,
+          deduped,
+          secondEnqueueGrew,
+          flushedMatches,
+          drained,
+          deliveredMatches,
+        },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-empty-error-states/contributions/probes/probe-utils.mjs

@@ -0,0 +1,177 @@
+// Shared helpers for application-empty-error-states contributions/probes/.
+//
+// The real engine for every probe in this pack is the fixture HTTP
+// server at packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/server.js
+// booted on a scratch port from the family range 47630-47639.
+// The fixture echoes a per-request x-fixture-request-id header on
+// every response; probes record that id and a response body excerpt
+// as positive evidence per rule 7d.
+//
+// No account credentials or network calls: every probe is
+// local-fixture-driven, so no probe carries an account-bound branch
+// or a CI_HAS_* gate. Declared env vars are the fixture's own
+// PORT and (where the fixture reads them) the CAPS/state switches
+// the probes drive via query string.
+
+import { spawn } from 'node:child_process';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:net';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export const SLUG = 'application-empty-error-states';
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/application-empty-error-states');
+export const PORT_RANGE_START = 47630;
+export const PORT_RANGE_END = 47639;
+export const DECLARED_ENV = Object.freeze(['PORT', 'EMPTY_ERROR_STATES_BREAK', 'PROBE_BREAK']);
+export const REQUEST_ID_HEADER = 'x-fixture-request-id';
+
+// Pick a free port from the fixture family range. Falls back to
+// asking the OS for an ephemeral port only if the whole range is
+// held by other workers (never expected on a single-machine run).
+export async function pickPort() {
+  for (let port = PORT_RANGE_START; port <= PORT_RANGE_END; port += 1) {
+    if (await canBind(port)) return port;
+  }
+  return await bindEphemeral();
+}
+
+function canBind(port) {
+  return new Promise((res) => {
+    const s = createServer();
+    s.once('error', () => res(false));
+    s.listen(port, '127.0.0.1', () => {
+      const bound = s.address();
+      s.close(() => res(!!bound));
+    });
+  });
+}
+
+function bindEphemeral() {
+  return new Promise((res) => {
+    const s = createServer();
+    s.listen(0, '127.0.0.1', () => {
+      const port = s.address().port;
+      s.close(() => res(port));
+    });
+  });
+}
+
+// Spawns the fixture server as a child on `port` with the given
+// env overlay; resolves once the fixture has printed LISTENING and
+// returns { child, url, kill } (kill is synchronous best-effort).
+export async function startFixture({ port, env = {} } = {}) {
+  const boundPort = port ?? await pickPort();
+  const child = spawn(process.execPath, ['server.js'], {
+    cwd: FIXTURE_DIR,
+    env: { ...process.env, PORT: String(boundPort), ...env },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  await new Promise((res, rej) => {
+    const timer = setTimeout(() => rej(new Error(`fixture did not print LISTENING within 4s on port ${boundPort}`)), 4000);
+    let stderrBuf = '';
+    child.stderr.on('data', (chunk) => { stderrBuf += String(chunk); });
+    child.on('exit', (code) => rej(new Error(`fixture exited early (code=${code}) stderr=${stderrBuf.slice(0, 400)}`)));
+    child.stdout.on('data', (chunk) => {
+      if (String(chunk).includes(`LISTENING ${boundPort}`)) { clearTimeout(timer); res(); }
+    });
+  });
+  const url = new URL(`http://127.0.0.1:${boundPort}`);
+  return {
+    child,
+    url,
+    port: boundPort,
+    // Await child exit and propagate any error. A teardown failure
+    // must fail the verdict (the teardown-propagation rule);
+    // no swallowed errors here.
+    kill: () => new Promise((res, rej) => {
+      let settled = false;
+      const done = (err) => { if (settled) return; settled = true; err ? rej(err) : res(); };
+      child.once('exit', () => done());
+      child.once('error', (err) => done(err));
+      try { child.kill('SIGTERM'); } catch (err) { return done(err); }
+      setTimeout(() => {
+        if (settled) return;
+        try { child.kill('SIGKILL'); } catch (err) { return done(err); }
+      }, 4000);
+    }),
+  };
+}
+
+// Issue an HTTP request against the fixture and return
+// { status, headers, body, requestId }.
+export async function fixtureFetch(url, pathAndQuery, init = {}) {
+  const target = new URL(pathAndQuery, url);
+  const res = await fetch(target, init);
+  const body = await res.text();
+  const requestId = res.headers.get(REQUEST_ID_HEADER);
+  return { status: res.status, headers: Object.fromEntries(res.headers.entries()), body, requestId };
+}
+
+export function excerpt(body, maxLen = 240) {
+  if (typeof body !== 'string') return '';
+  return body.length <= maxLen ? body : body.slice(0, maxLen) + '…';
+}
+
+export function aggregate(results) {
+  // Positive-evidence rule: no-checks-ran is a fail.
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  // Any warn row lifts the aggregate to warn, including honest
+  // notObservableHere de-claims. A probe whose rows are all warn
+  // aggregates to warn, not pass; the shelf reads amber and the tally
+  // accepts a warn aggregate as problems=0 when no fail row is present.
+  if (results.some((r) => r && r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: SLUG,
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const filepath = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(filepath, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path: filepath };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path: filepath } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${filepath}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    // Positive-evidence rule (exception fallback): exception rows have no
+    // observed AC; anchor null (never a fabricated id like
+    // "unknown"), carry an evidence object with the error excerpt.
+    const message = err && err.message ? err.message : String(err);
+    const stack = err && err.stack ? err.stack : String(err);
+    const results = [{
+      anchorAcId: null,
+      verdict: 'fail',
+      detail: `probe threw: ${message}`,
+      evidence: {
+        errorMessage: message,
+        errorExcerpt: excerpt(stack, 480),
+      },
+    }];
+    const { report, path: filepath } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${stack}\n`);
+    process.stderr.write(`report written to ${filepath}\n`);
+    process.exitCode = 1;
+  }
+}

package/blueprints/application-empty-error-states/contributions/probes/run-empty-list-and-no-search.mjs

@@ -0,0 +1,5 @@
+import runProbe from './empty-list-and-no-search.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-empty-error-states/server.js', healthy: true };
+runShim('empty-list-and-no-search', engine, runProbe);

package/blueprints/application-empty-error-states/contributions/probes/run-error-boundary-alert.mjs

@@ -0,0 +1,5 @@
+import runProbe from './error-boundary-alert.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-empty-error-states/server.js', healthy: true };
+runShim('error-boundary-alert', engine, runProbe);

package/blueprints/application-empty-error-states/contributions/probes/run-forbidden-and-server-error.mjs

@@ -0,0 +1,5 @@
+import runProbe from './forbidden-and-server-error.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-empty-error-states/server.js', healthy: true };
+runShim('forbidden-and-server-error', engine, runProbe);

package/blueprints/application-empty-error-states/contributions/probes/run-not-found-and-recovery.mjs

@@ -0,0 +1,5 @@
+import runProbe from './not-found-and-recovery.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-empty-error-states/server.js', healthy: true };
+runShim('not-found-and-recovery', engine, runProbe);

package/blueprints/application-empty-error-states/contributions/probes/run-permission-denied-and-offline.mjs

@@ -0,0 +1,5 @@
+import runProbe from './permission-denied-and-offline.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-empty-error-states/server.js', healthy: true };
+runShim('permission-denied-and-offline', engine, runProbe);

package/blueprints/application-error-handling/CHANGELOG.md

@@ -1,17 +1,56 @@
 # application-error-handling CHANGELOG
 
+## 1.0.12 - 2026-09-11
+
+- The AC-16102-4 (mid-stream close) row's shipped comment block in two-boundaries-registered.mjs is rewritten to describe the row as a full anchored counting result rather than a conformanceOnly slice with a browser-network limitation: every clause of the AC (connection closed without rewriting the wire, exactly one companion emission at error level naming the streaming-in-progress condition, and category 'unknown' unless supplied) is observable on this pack, and no browser-network sub-clause is carved out.
+- The AC-16102-4 row's detail is rewritten to open with the AC's first eight words ("Given a handler that throws AFTER the response") and describes the observation directly, without the earlier "server-observable slice" wording. The predicate, evidence and verdict are unchanged; only the shipped comment and detail prose move.
+- The shared anatomy result-shape helper (packages/rcf-lite/test/blueprint/_result-shape.mjs) adds a fourth tightening rule: a counting row (a row that reached the post-notObservableHere / post-conformanceOnly branch) must carry at least one shipped anchor - anchorAcId or anchorReqId. A negative synthetic case (unanchored counting row must fail) and a positive synthetic case (anchored counting row must pass) join the existing negative-cases helper; every family's anatomy suite exercises them via runResultShapeNegativeCases.
+- Anatomy test pin bumped to 1.0.12.
+
+## 1.0.11 - 2026-09-11
+
+- AC-16102-4 (mid-stream close) is now a full counting row anchored on AC-16102-4 rather than conformanceOnly: the shipped AC description names only the connection-close, the exact companion emission, the level, message and category, and every clause is server-observable on this pack. The row records anchorAcId, verdict, a detail opening on the AC's first eight words, and evidence carrying route /stream-then-throw, status 200, the fixture-stamped x-fixture-request-id and a fully-populated derived object with the premature-close, exactly-one mid-stream emission, level, message-names-condition and category flags. The invented "browser-network view" limitation clause is dropped; AC-16102-4 no longer carries a browser-only sub-clause.
+- Detail texts continue to open with the first eight words of the AC or REQ text they observe.
+- Anatomy test pin bumped to 1.0.11.
+
+## 1.0.10 - 2026-09-11
+
+- AC-16102-4 (mid-stream close) pass predicate now REQUIRES the premature socket close: the two-boundaries-registered probe verdict is pass iff midStatus===200, prematureClose===true, exactlyOneMidEmission, midCategoryUnknown, midLevelError, and midMessageNamesCondition. A normal completed 200 response that happens to carry the partial-body prefix fails this row. `partialBodyReceived` is still recorded on evidence.derived but does not participate in the verdict.
+- The probe now reads the response body incrementally via the ReadableStream reader so the partial-body prefix delivered before the socket abort is retained in evidence.derived.partialBodyReceived (and in evidence.bodyExcerpt) even when the read then throws; earlier revisions used res.text() which discarded already-delivered chunks on the abort.
+- Anatomy test pin bumped to 1.0.10.
+
+## 1.0.9 - 2026-09-11
+
+- /stream-then-throw now flushes headers, writes the partial body and, once the write drains, tears the socket down via req.socket.destroy(); res.end() is deliberately not called, so a well-behaved client observes a premature-close error after receiving the 200 headers and the partial-body prefix.
+- Companion invocations now record level (always 'error') and message alongside category, correlationId and source, so probes can observe the emitted level and the emitted message without parsing stderr.
+- AC-16102-4 (mid-stream close) is a conformanceOnly row anchored on AC-16102-4: the probe drives /stream-then-throw and observes (i) the client's premature-close error after the partial-body prefix landed, (ii) exactly one companion emission with category='unknown', level='error', and a message naming the streaming-in-progress condition, and (iii) the recorded 200 status and x-fixture-request-id on the response. The limitation names that the browser-network view of the aborted socket (what a browser network log records for the close condition) is the only clause of AC-16102-4 not observed here.
+- AC-16105-4 is now a conformanceOnly row anchored on AC-16105-4 in the category-vocabulary probe: the probe observes only clause (c), the record-construction refusal of an unelicited category token via /construct/<token>, and the limitation names that clauses (a) and (b) (the mapper reading the applied per-class contract for an elicited additional category and writing the elicited retry hint) require an applying project with a classification-additions elicit and a per-class retry contract, which this probe pack does not ship.
+- Detail texts continue to open with the first eight words of the AC or REQ text they observe.
+- Anatomy test pin bumped to 1.0.9.
+
+## 1.0.8 - 2026-09-11
+
+- Adds a contributions/probes pack meeting rule 7d.
+- Probes: two-boundaries-registered, category-vocabulary, record-shape-adr-1701.
+- Framework boundary probe drives /throw-handler whose handler throws an Error whose induced stack carries system-path substrings and a file-URI substring; the wire body is inspected for those substrings and for stack markers. That observation targets AC-16102-2 and is anchored to it.
+- Process boundary probe spawns the fixture as a child with crashOnRequest=true, hits /crash-real which schedules a real uncaught throw via setImmediate after the response is committed; the registered uncaughtException handler emits the error record (code, category unknown, message, correlationId, cause with stack, context) ONLY through the injected logging companion (no direct stdout or stderr write of the record per REQ-004), then writes a level=info type=companion-dump JSON line to stderr carrying the companion's invocations array, then process.exit(1); the probe reads the companion-dump stderr line and OS exit code from the child.on('exit') event.
+- REQ-004 companion-invocation observation reads the companion-dump stderr line the child writes just before process.exit; both the framework path (an in-process /throw-handler request) AND the process path (the emit written by the uncaughtException handler before process.exit) show up in the companion's invocation list on that same child. No in-process /crash-process short-circuit is used for REQ-004 evidence.
+- AC-16102-4 (mid-stream close) is a conformanceOnly row anchored on AC-16102-4 in this version: the probe drives /stream-then-throw so the fixture flushes headers, writes a partial body, then the framework boundary catches a mid-stream exception, emits EXACTLY ONE record through the injected companion factory naming the streaming-in-progress condition with category 'unknown'; the row observes exact-one-emission and category server-side and carries a limitation naming that the browser-network wire-close half is not observable on a server-driven probe pack.
+- The process-boundary result records the correlationId as its own record.correlationId, and the evidence status field carries the OS exit code (numeric), not an HTTP-shaped fabrication.
+- Detail texts open with the first eight words of the AC or REQ text they observe.
+- Anatomy test pin bumped to 1.0.8.
+
+
 ## 1.0.3 (register-sweep patch, 2026-09-10)
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.0.2 (application-core completion pass, 2026-09-09)
+## 1.0.2 (2026-09-09)
 
 - Adds top-level elicits[] block on blueprint.json declaring the one apply-time answer (classification-additions); backed by REQ-003 naming the transient/permanent/unknown defaults and the elicited-additions grammar per section 7c.
 - Adds refusal-path ACs to US-16102 (stack-and-path scrubbing, non-Error throw defaults, mid-stream exception connection close), US-16104 (non-object context refusal, nested-and-array redaction, circular context handling), US-16105 (permanent no-Retry-After, unknown mapped as permanent, elicited-category retry contract), US-16106 (no-companion fallback stderr JSON single line, direct console.error passthrough, companion factory throw fallback), US-16107 (null-injection refusal, stub invocation contract, transportWriter throw recovery). US-16101 and US-16103 also extended with clean-shutdown preservation, browser-runtime path, double-throw handling, deep cause chain, cause-context redaction and null-vs-undefined cause discipline. Every story now at the 7a floor (4-5 ACs per story, 30 ACs total).
 
-## 1.0.1 (application-core hardening, 2026-09-09)
-
-- hardening pass: chain-consistency lint zero (pass1 + pass2); added deliveredBy to every REQ, added ownerRef and disposition to every AC per section 7b, closed `boundaryFor` and `transportWriter` restatements on AC-16107-1 via ownerRef back to TAC-1701.
-- Added AC-16101-2 (unhandled promise rejection: one record under the `unknown` category, process terminates with exit code 1) covering the 2026-09-08 review finding F-1 on TAC-1701.responsibilities[0].
-
+## 1.0.1 (2026-09-09)
 
+- Hardening cleanup: chain-consistency lint clean; added deliveredBy to every REQ, added ownerRef and disposition to every AC per section 7b, closed `boundaryFor` and `transportWriter` restatements on AC-16107-1 via ownerRef back to TAC-1701.
+- Added AC-16101-2 (unhandled promise rejection: one record under the `unknown` category, process terminates with exit code 1) on TAC-1701.responsibilities[0], so applying projects have an explicit acceptance criterion for the unhandled-rejection path.

package/blueprints/application-error-handling/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-error-handling",
-  "version": "1.0.3",
+  "version": "1.0.12",
   "category": "application",
   "providesRoles": [
     "errorHandling"
@@ -108,5 +108,6 @@
       "elicited": false,
       "standardsTraceClause": "generic enterprise practice"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11T16:04:17Z"
 }

package/blueprints/application-error-handling/contributions/probes/category-vocabulary.mjs

@@ -0,0 +1,90 @@
+// category-vocabulary probe for application-error-handling v1.0.12.
+//
+// Verifies the ADR-1702 recommended default vocabulary (transient,
+// permanent, unknown) via REQ-003 for the pass rows and AC-16105-4
+// for the unelicited-token refusal row.
+//
+// anchorReqId: application-error-handling-REQ-003 on the accepted
+// vocabulary rows; anchorAcId: application-error-handling-AC-16105-4
+// on the refusal row.
+
+import { startFixture, evidenceFromResponse, conformanceOnlyResult } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-error-handling-REQ-003';
+export const accountBound = false;
+
+const RECOMMENDED = ['transient', 'permanent', 'unknown'];
+
+export default async function runProbe() {
+  const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-error-handling/server.js');
+  const fixture = await startFixture({ startServer, port: 0 });
+  try {
+    const results = [];
+    for (const cat of RECOMMENDED) {
+      const res = await fetch(`${fixture.baseUrl}/construct/${cat}`);
+      const body = await res.text();
+      const rec = JSON.parse(body);
+      const pass = res.status === 200 && rec.category === cat;
+      results.push({
+        anchorReqId: 'application-error-handling-REQ-003',
+        verdict: pass ? 'pass' : 'fail',
+        detail: pass
+          ? `Every error class is classified transient, permanent or - /construct/${cat} returned record with category="${cat}"`
+          : `Every error class is classified transient, permanent or - category fault: cat=${cat} status=${res.status} returnedCategory=${rec.category}`,
+        evidence: evidenceFromResponse({
+          route: `/construct/${cat}`,
+          response: res,
+          bodyText: body,
+          extraFields: {
+            input: { requestedCategory: cat },
+            derived: { returnedCategory: rec.category },
+          },
+        }),
+      });
+    }
+
+    // AC-16105-4 partial slice: the AC covers an applying project
+    // that elicited additional categories via the
+    // classification-additions elicit and asserts (a) the mapper
+    // reads the applied per-class contract, (b) it writes the
+    // elicited retry hint alongside the ADR-1702 defaults, and
+    // (c) an unelicited category token is refused at record
+    // construction per REQ-002. This probe pack ships no
+    // classification-additions elicit and no applied per-class
+    // retry contract, so clauses (a) and (b) cannot be observed
+    // here. The probe observes clause (c) only: /construct/<token>
+    // returns 400 naming the refused token and the accepted set,
+    // which is the record-construction refusal REQ-002 requires.
+    // The row is conformanceOnly anchored on AC-16105-4 with a
+    // limitation naming the two clauses not observed here.
+    const bad = await fetch(`${fixture.baseUrl}/construct/notARealCategory`);
+    const badBody = await bad.text();
+    const badParsed = JSON.parse(badBody);
+    const refusalOk = bad.status === 400
+      && badParsed.error === 'unelicited-category'
+      && badParsed.refused === 'notARealCategory'
+      && Array.isArray(badParsed.accepted)
+      && RECOMMENDED.every((c) => badParsed.accepted.includes(c));
+    results.push(conformanceOnlyResult({
+      anchorAcId: 'application-error-handling-AC-16105-4',
+      anchorReqId: 'application-error-handling-REQ-003',
+      verdict: refusalOk ? 'pass' : 'fail',
+      detail: refusalOk
+        ? `Given a project that elicited additional categories via - refusal-of-unelicited slice observed: /construct/notARealCategory returns 400 error=unelicited-category refused=${badParsed.refused} accepted=${JSON.stringify(badParsed.accepted)}`
+        : `Given a project that elicited additional categories via - refusal fault: status=${bad.status} error=${badParsed.error} refused=${badParsed.refused} accepted=${JSON.stringify(badParsed.accepted)}`,
+      evidence: evidenceFromResponse({
+        route: '/construct/notARealCategory',
+        response: bad,
+        bodyText: badBody,
+        extraFields: {
+          input: { requestedCategory: 'notARealCategory' },
+          derived: { httpStatus: bad.status, refused: badParsed.refused, accepted: badParsed.accepted },
+        },
+      }),
+      limitation: 'application-error-handling-AC-16105-4: the AC also requires (a) that the mapper reads the applied per-class contract for an elicited additional category and (b) that the wire response carries the retry hint the elicited class contract specifies; this probe pack ships no classification-additions elicit and no applied per-class retry contract, so those two clauses are not observed here. The observed clause is (c): an unelicited category token is refused at record construction (REQ-002 refusal path)',
+    }));
+    return { results };
+  } finally {
+    await fixture.close();
+  }
+}