rcf-lite 0.28.4 → 0.30.0

package/CHANGELOG.md

@@ -6,11 +6,204 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+
+## [0.30.0] - 2026-10-03
+
+0.30.0 lands the DEFINE step 3 gates bite (see spec section 10). The Remi path (PRs 1 to 3) shipped in 0.29.0. This release carries the gates bite (PRs 5, 6, 7 = rcf-lite PRs 282, 284, 286), the bundle refuse / override / skip + validate findings + NV-DL ruleset flip (PR 8 = rcf-lite PR 288), and the R11 ownerRef / deliveredBy grammar + blueprint recount + NV-DL wrap + test tightening (PR 9 = rcf-lite PR 289). A follow-up fix on this branch lands ruling R12 (NV-DL-ADM-02 override channel is `freeze.override` only). The release is built and gated on Node 24.
+
+Spec note: the DEFINE step 3 spec (`projects/rcf-lite-wsd/specs/2026-10-01_define-step3-po-elicitation-spec.md` section 16 and prose) names certain D2 behaviours "0.30.0" that in fact shipped in 0.29.0 (the `skeleton:resolvedBy` closed-grammar tightening, the `rcf define ledger <name> update <id>` subverb, and the `resolvedBy` closed grammar). The spec will be amended on the next pass.
+
+Breaking under the pre-1.0 convention: `rcf define readiness --check`, `rcf build bundle --next` and `rcf define validate` all change exit behaviour on verbs consumers run in CI. See "For consumers (upgrading)" below for the exact flags, override channels and the migration table.
+
+### Added
+
+- **DEFINE step 3 PR 5: D3 bite (template markers, entity join, resolved paths, ackable, --check exit 4 policy; #282).** `shapes:templateMarkers` enforces per-kind marker presence on `interfaces[].description` (recordShape needs `fields:`, httpRoute needs method/path/request/response/errors, fixture needs `instances:`, event needs `payload:`, cliCommand needs `usage:`, uiRoute needs `path`, port needs `protocol`, fileFormat needs `format:`, other needs a note); drafts included. `shapes:entityJoin` fails every `coreEntities[].name` not named by exactly one `recordShape` tree-wide. `shapes:pathsResolve` fails any `path:`-like token on an interface description that does not resolve on disk (readiness collects candidates; the CLI and tab pass `resolvedPaths` in the stage context). `ackable(stage)` returns true for D3/D5/D6 and false otherwise; `--check` exits 4 unacked and 0 at the current hash. ADR-4131, US-17404.
+- **DEFINE step 3 PR 6: D4 closed sets and ownerRef as findings, D5 concern catalogue, standards citation (#284).** `stories:closedSets` fails an AC whose description carries an enumeration cue ("one of", "any of", "the following", "types of", "status is") without an inline bracketed list or an `ownerRef`. `stories:ownerRefResolves` fails every `ownerRef { tacId, field }` that does not resolve to `interfaces[<name>]` on that TAC. `src/define/concern-catalogue.js` ships the eight-concern catalogue keyed by REQ shape; `crosscut:catalogue` enumerates every applicable pair per in-scope REQ against the concern ledger (applied or waived). `skeleton:standardsCited` fails every registered standards pack neither cited in a REQ `rationale` or an ADR nor waived by a concern-ledger entry with key `standards:<pack>`. D5 is ackable through the --check crosscut fold. US-17405.
+- **DEFINE step 3 PR 7: D6 consistency scans, probe seam, --litmus and rcf_define_litmus (#286).** Four D6 scans: `consistency:contradictions` (two ACs on one story sharing a `when` clause with a negated `then`), `consistency:unsatisfiable` (a `then` naming a field no `recordShape` `fields:` defines; a field in a `[draft]` recordShape counts as defined), `consistency:duplicates` (identical AC descriptions across stories), `consistency:orphanInterfaces` (no AC `ownerRef` and no REQ `deliveredBy` reaches an interface). `computeReadiness(tree, { probeRunner })` accepts an injectable runner; findings land as probe-ledger entries. `--litmus <n>` on readiness and freeze requires n distinct readers to have recorded a litmus reading at the current litmus hash (`tree.litmusHash`, the tree hash computed with the probes ledger excluded per R9 amendment 2026-10-03); `readiness --json` prints the litmus hash. The `rcf_define_litmus` prompt tells the harness to spawn n fresh-context readers and land their readings. US-17406, US-17504.
+- **DEFINE step 3 PR 9: R11 ownerRef / deliveredBy grammar, blueprint recount, NV-DL-ADM-02/03/04 enforcement locus, test tightening (this release).** `resolveOwnerRefField(doc, field)` widens the D4 `stories:ownerRefResolves` check and the `rcf define validate` `defineValidate:ownerRefResolves` / `defineValidate:deliveredByResolves` findings beyond `interfaces[<name>]` to every bracket-grammar path on the owning TAC or ADR: `interfaces[<name>]`, `responsibilities[<n>]`, `dependencies[<name>]`, `alternativesConsidered[<n>]`, and a bare schema field name (`purpose`, `internalStructure`, `decision`, `context`, `consequences`, `name`, `tradeoffs`, `notes`, `description`, `title`, and the arrays themselves). Dotted grammar is refused; validate names the dotted field so the author can rewrite. The ADR branch of `ownerRef { adrId, field }` now resolves (pre-R11 code recognised only `tacId`). `rcf define validate` now checks the OBJECT form of `deliveredBy` (`{ tacId | adrId, field }`), which was silently skipped before PR 9 (review 2026-10-03). `freeze.override.by` is resolved by `resolveOverrideBy({ projectRoot })` with the preference order `git config user.email` -> `GITHUB_ACTOR` -> `USER` -> `USERNAME` -> literal `operator`; each failing arm falls through silently to the next (AC-17702-6). The admissibility wrap (`src/query/refuse-on-admissibility.js`) now cites NV-DL-ADM-02 (failing D4), NV-DL-ADM-03 (failing D3) and NV-DL-ADM-04 (non-empty validate errors) alongside the NV-BL rules; readiness and freeze pass the computed `stages[]` and `validateErrors` via new `defineStages` / `defineValidateErrors` arguments. The wrap's refusal line names every biting rule; the recordedInChain override channel is `--ack <gate>=<reason>` on `freeze.gates` at the current tree hash for ADM-03 (D3 is ackable; `foldState` masks the stage as `acknowledged`), `freeze.override` only for ADM-02 (D4 is NOT ackable per decision 9; fix the D4 findings or record `freeze.override` via `rcf build bundle --next --override "<reason>"`) -- ruling R12 2026-10-03 corrected the pre-R12 wrap wording that named --ack as the ADM-02 channel -- and a chain-document correction committed to git is the override for ADM-04. Readiness itself stays informational (AC-17902-4 unchanged); freeze keeps its own `freezeableAfterAck` gate. `packages/rcf-lite/scripts/blueprint-r11-sweep.mjs` rewrites every dotted `interfaces.<name>` / `responsibilities.<key>` / `dependencies.<name>` / `decision.<key>` to bracket grammar across the shipped blueprint corpus (`blueprints/*/contributions/**`), then collapses every dead bracket name to its bare parent field (which resolves) or drops the ownerRef / deliveredBy where even the parent is empty (walker treats both as optional); the script is idempotent (re-run writes nothing) and tally-reports per blueprint. AC-17702-3 pins the two-FBS skip-and-hand-out to a single expected `exit 0` with the FBS-002 bundle; AC-17702-4 pins the all-impacted refusal to a single expected `exit 4`; AC-17702-5 compares byte-for-byte against the captured 0.29.0 bundle golden (`test/cli/fixtures/bundle-next-029-golden.md`, captured from `origin/main` at `9860aab3`). AC-17405-7, AC-17405-8, AC-17702-6 and AC-17902-5 extend US-17405, US-17702 and US-17902; FBS-202 gains the four new ac ids; TAC-4122, TAC-4123, TAC-4125, TAC-4126 and REQ-179 amended. No new ADR.
+- **DEFINE step 3 PR 8: bundle refuse / override / skip, validate findings, NV-DL enforced (this release).** `rcf build bundle --next` refuses on an unfrozen tree with exit 4 (message pointing at `rcf define readiness` and the `--override "<reason>"` channel), accepts `--override "<reason>"` writing `freeze.override { reason, by, at }` through `applyOverrideToFreezeRecord` and proceeds, skips re-execute FBS impacted by the delta with the reason on stderr and hands out the next unimpacted FBS; when every actionable FBS is impacted and no override is given the verb exits 4 (NV-DL-ADM-01, NV-DL-ADM-05). `rcf define validate` grows four findings: an interface kind outside the closed vocabulary (`INTERFACE_KINDS`), a bracketed AC class prefix outside the five known classes, a `tacIds` naming a non-TAC, and an unresolving `ownerRef` or `deliveredBy`; absence of a class marker is NOT a validate finding (decision 10 kept; D4 reports absence as the floor). `packages/rcf-lite/src/ruleset/ruleset.json` gains NV-DL-ADM-01..05 with `refuseByDefault: true` and `overrideChannel: recordedInChain`. The readiness compute still runs and prints under NV-DL refusal (ADR-4123, informational posture on the compute unchanged). REQ-177 / US-17702, REQ-178 / US-17802, REQ-179 / US-17902 under TAC-4125 and TAC-4126. No new ADR (spec section 11.9).
+
+### Changed
+
+- **Dogfood: 18 TAC files remapped off legacy interface kinds (DEFINE step 3 PR 8).** 64 interfaces across TAC-001..008, TAC-4101..4108, TAC-4129 and TAC-4134 carried pre-DEFINE-era kind labels (`function`, `command`, `mcpTool`, `type`, `prompt`, `artifact`, `constant`, `moduleApi`, `interface`) that pre-date the DEFINE spec section 5.2 closed vocabulary. The mapping (`function`/`mcpTool`/`prompt`/`constant`/`moduleApi`/`interface` -> `other`; `command` -> `cliCommand`; `type` -> `recordShape`; `artifact` -> `fileFormat`) is applied mechanically and the legacy label is preserved in the interface description for provenance. `rcf define validate` is now clean on the dogfood tree (AC-17802-3).
+
+- **Blueprints: 284 shipped contribution files remapped off legacy interface kinds and dotted ownerRef grammar (DEFINE step 3 PR 8).** 40 blueprints under `blueprints/` carried pre-DEFINE-era interface kinds (47 distinct labels across 330 interfaces) and 252 ownerRefs written in the `interfaces.<name>` form. The dogfood mapping table extends to this corpus (`function`/`mcpTool`/`prompt`/`constant`/`moduleApi`/`interface` -> `other`; `command` -> `cliCommand`; `type` -> `recordShape`; `artifact` / `artefact` -> `fileFormat`; everything else -> `other`); dotted ownerRefs rewrite to `interfaces[<name>]`; the legacy label is kept in the interface description. `rcf define validate` is now clean on the application-onboarding-tour blueprint applied to a fresh project (TC-057 passes without a skip).
+
+### Fixed
+
+- **NV-DL-ADM-02 override channel wording (ruling R12, 2026-10-03).** The PR 9 admissibility wrap, REQ-179 and the ruleset notes named `--ack <gate>=<reason>` as the override channel for NV-DL-ADM-02. ADM-02 maps to D4 (stories floor), and decision 9 keeps `ackable` to D3/D5/D6 only, so D4 cannot be masked by an ack. The only recordedInChain override channel for ADM-02 is `freeze.override` written by `rcf build bundle --next --override "<reason>"`; the normal path is to fix the failing D4 findings. ADM-03 (D3) keeps `--ack`; ADM-04 keeps the chain-document correction committed to git. `src/query/refuse-on-admissibility.js` refusal message rewritten; `src/ruleset/ruleset.json` NV-DL-ADM-02 notes rewritten; `rcf/requirements/req-179.json` PR 9 enforcement-locus paragraph split per rule; `test/query/refuse-on-admissibility-nvdl.test.js` asserts the R12 phrasing.
+
+### For consumers (upgrading)
+
+This release changes exit behaviour on three verbs that WSD, wespa and other consumers run in CI. Upgrade carefully.
+
+- **`rcf define readiness --check`** exits **4** on a failing D3, D5 or D6 at the current tree hash. Clear with `--ack <gate>=<reason>` recorded at the current hash on `freeze.gates` (D3/D5/D6 only; decision 9). Readiness itself (no `--check`) still prints and exits 0; the DEFINE-stage admissibility wrap writes a `[warn]` line naming any biting NV-DL rule.
+- **`rcf build bundle --next`** exits **4** on an unfrozen tree. Clear with `--override "<reason>"` which writes `freeze.override { reason, by, at }` and proceeds. `freeze.override.by` is resolved via `resolveOverrideBy({ projectRoot })` with the preference order `git config user.email` -> `GITHUB_ACTOR` -> `USER` -> `USERNAME` -> literal `operator`; set `USER` or a git identity in CI if you want something recognisable in the record. Impacted FBS are skipped with the reason on stderr; when every actionable FBS is impacted and no override is given the verb also exits 4.
+- **`rcf define validate`** exits **3** on four new finding kinds introduced in PR 8 (an interface kind outside the closed vocabulary, a bracketed AC class prefix outside the five known classes, a `tacIds` naming a non-TAC, and an unresolving `ownerRef` / `deliveredBy`), plus PR 9 extends the ownerRef / deliveredBy finding to the R11 bracket grammar on the full owner document AND checks the object form of `deliveredBy` (`{ tacId | adrId, field }`), which the pre-PR 9 code silently skipped. Dotted grammar is refused with the dotted field named so the author can rewrite. Absence of an AC class marker is NOT a finding (decision 10 kept; D4 reports absence as the floor).
+- **NV-DL-ADM-01..05 flip to `refuseByDefault: true`** with `overrideChannel: recordedInChain`. Per-rule enforcement locus and override channel (R12 split applied):
+  - NV-DL-ADM-01: `rcf build bundle --next` refuses without a freeze record. Override: `--override "<reason>"` writes `freeze.override`.
+  - NV-DL-ADM-02: D4 stories floor failing items are findings (closed sets, ownerRef). Surfaced through the admissibility wrap. Override: `freeze.override` only (D4 is NOT ackable); fix the D4 findings otherwise.
+  - NV-DL-ADM-03: D3 shapes bite failing items are findings (template markers, entity join, paths). Surfaced through the wrap. Override: `--ack <gate>=<reason>` on `freeze.gates` at the current tree hash (D3 is ackable).
+  - NV-DL-ADM-04: `rcf define validate` finding set refuses with exit 3. Surfaced through the wrap when callers pass `defineValidateErrors`. Override: a chain-document correction committed to git (not a gate ack).
+  - NV-DL-ADM-05: `rcf build bundle --next` skips re-execute FBS impacted by the delta with the reason on stderr; when every actionable FBS is impacted and no override is given, exit 4.
+- **Litmus flag (PR 7, R9).** `--litmus <n>` on `rcf define readiness` and `rcf define freeze` requires n distinct readers to have recorded a litmus reading at the current litmus hash. The litmus hash is `tree.litmusHash` -- the tree hash computed with the probes ledger EXCLUDED (R9 amendment 2026-10-03) -- and `readiness --json` prints it. The `rcf_define_litmus` prompt tells the harness to spawn n fresh-context readers and land their readings.
+- **probeRunner seam (PR 7).** `computeReadiness(tree, { probeRunner })` accepts an injectable runner; findings land as probe-ledger entries. No runner ships in 0.30.0; consumers (or harnesses) wire their own if they want D6 probes to execute.
+- **Node 24 is the build and gate floor.** `rcf-lite` requires `node >= 24` (`packages/rcf-lite/package.json#engines`) and is gated on Node 24. The sandbox default Node version is below the repo floor; use nvm, `~/.n`, or an equivalent in CI.
+- **Blueprint authors.** Tighten bare `interfaces` and `responsibilities` pointers to the bracket forms (`interfaces[<name>]`, `responsibilities[<n>]`) where you know the specific target; the bare field resolves under R11 while the owning doc carries a non-empty value under that key, but a bracketed form is the stricter and more useful record.
+- **Sweep script re-runnable in dry-run mode.** `packages/rcf-lite/scripts/blueprint-r11-sweep.mjs` can be run on a consumer's own tree with `--dry-run` to see what would change before any write; the script is idempotent either way (re-running it writes zero rewrites and reports zero findings once clean).
+- **Two blueprint REQs now resolve deliveredBy on owner presence alone.** PR 9's CI-fix pass restored `deliveredBy = { tacId }` entries on `application-spa` REQ-004 (points at `TAC-201-application-spa-app-shell`) and `application-api-rest` REQ-002 (points at `TAC-301-application-api-rest-request-pipeline`); `field` is schema-optional and R11 resolves on owner presence alone when it is absent.
+
+### Known gaps and parked rulings
+
+- **Parked rulings not resolved in PR 8** (named in the PR 8 report.md KNOWN GAPS section): write-back idempotency of the add/create verbs; D3 draft scope tree-wide vs delta; the stagePolicy label drift, D3 notApplicable ordering and Dockerfile-token path findings from the PR 5 review; `skeleton:standardsCited` inside the D2 scope early-return and a `standards:<pack>` ledger entry with disposition applied counting as a waiver from the PR 6 review; anything PR 7's review parked (R9 litmus-hash amendment landed; other PR 7 parked rulings carried forward).
+- **Decision 9 and decision 10 are binding:** `--ack` remains the recorded override for D3/D5/D6; validate reports no finding for a missing AC class marker (D4's floor).
+- **Node 24 re-gate:** Dave re-gates PR 8 and PR 9 on Node 24 before merge. The sandbox default Node version is below the repo floor; PR 8 was built and tested on Node 24 via nvm in the cloud session, PR 9 locally.
+
+### Migrating existing trees
+
+Consumers (WSD among them) will see one new failure class on upgrade. On a fresh project with an existing tree, `rcf define validate` now exits 3 under PR 8 for any of:
+
+1. **Interface kind outside the closed vocabulary** `recordShape`, `httpRoute`, `event`, `cliCommand`, `uiRoute`, `port`, `fileFormat`, `fixture`, `other`. Mechanical remap table (safe conservative default):
+
+   | Legacy kind                                                | Remap to      |
+   |------------------------------------------------------------|---------------|
+   | `function`, `mcpTool`, `prompt`, `constant`, `moduleApi`, `interface` | `other`       |
+   | `command`                                                  | `cliCommand`  |
+   | `type`                                                     | `recordShape` |
+   | `artifact`, `artefact`                                     | `fileFormat`  |
+   | anything else                                              | `other`       |
+
+   Keep the original kind in the interface `description` so the migration stays auditable (`"(legacy kind: factory)"` is the convention this release used across the shipped blueprint corpus).
+
+2. **AC `ownerRef.field` grammar (widened under R11, PR 9).** Bracket grammar is the only accepted form. Rewrite `interfaces.<name>` to `interfaces[<name>]`, `responsibilities.<key>` to `responsibilities[<key>]`, `dependencies.<name>` to `dependencies[<name>]`, and `decision.<key>` to the bare field `decision`. R11 broadens resolution so a bracket path or bare schema field name resolves when it exists on the owning document: `interfaces[<name>]`, `responsibilities[<n>]` (zero-based integer index into the string array), `dependencies[<name>]`, `alternativesConsidered[<n>]`, or a bare field name (`purpose`, `internalStructure`, `decision`, `context`, `consequences`, `name`, `tradeoffs`, `notes`, `description`, `title`, and the collection arrays themselves). The ADR branch of `ownerRef { adrId, field }` now resolves. Dotted grammar is refused; the validate finding names the dotted field so the author can rewrite. Any ownerRef that still resolves to nothing can be collapsed to its bare parent field (which does resolve while the owning doc carries a non-empty value under that key) or dropped (the walker treats ownerRef as optional).
+
+3. **Interface or path on `ownerRef`.** `interfaces[<name>]` must resolve to an interface declared on the referenced TAC; `responsibilities[<n>]` must land on an existing index; `dependencies[<name>]` must match a declared dependency name. Rename, add, or fall back to the bare field name before the AC is reconnected.
+
+4. **Object-form `deliveredBy` (PR 9).** `rcf define validate` now checks the `{ tacId | adrId, field }` object form of `deliveredBy` under the same R11 grammar; the pre-PR 9 code silently skipped it. `deliveredBy` without a `field` resolves on the owner's presence alone (field is schema-optional).
+
+5. **`freeze.override.by` identity (PR 9, AC-17702-6).** `bundle --next --override "<reason>"` now writes `freeze.override.by` from the preference order `git config user.email` -> `GITHUB_ACTOR` -> `USER` -> `USERNAME` -> literal `operator`. CI runners that set `GITHUB_ACTOR` get the actor identity on an unconfigured git; the literal `operator` is the never-null fallback.
+
+6. **NV-DL-ADM-02/03/04 enforcement locus (PR 9).** The admissibility wrap (`src/query/refuse-on-admissibility.js`) now cites NV-DL-ADM-02 (failing D4), NV-DL-ADM-03 (failing D3) and NV-DL-ADM-04 (non-empty validate errors) in its refusal line, next to the NV-BL rules. Override channels differ by rule (ruling R12 2026-10-03): for ADM-03 the channel is `--ack <gate>=<reason>` recorded on `freeze.gates` at the current tree hash (D3 is ackable per decision 9, same ack mechanism the stage gates already honour); for ADM-02 the channel is `freeze.override` only (D4 is NOT ackable; decision 9 keeps `ackable` to D3/D5/D6, so the only recordedInChain path is `rcf build bundle --next --override "<reason>"` writing `freeze.override`; the normal expectation is to fix the failing D4 findings); for ADM-04 the override is a chain-document correction committed to git. Readiness stays informational; freeze's own `freezeableAfterAck` gate still enforces.
+
+The AC class prefix check (`[happy]`, `[edge]`, `[failure]`, `[must-not]`, `[non-functional]`) and the `tacIds` / `deliveredBy` resolution rules are also enforced. Absence of a class prefix is NOT a finding (decision 10 kept; D4 reports absence as the floor).
+
+**Blueprint recount (PR 9, replaces the pre-PR 9 "about 295" estimate).** `packages/rcf-lite/scripts/blueprint-r11-sweep.mjs` records the authoritative numbers over the shipped `blueprints/` corpus of 39 blueprints. After PR 9 the shipped blueprints are clean under R11:
+
+- 31 dotted-to-bracket rewrites across 16 blueprints (phase 1).
+- 493 dead-bracket collapses to the bare parent field, plus 12 ownerRef / deliveredBy drops where even the parent was empty, across the full shelf (phase 2).
+- 0 `rcf define validate` findings and 0 D4 `stories:ownerRefResolves` failures across all 39 blueprints after the sweep (direct contribution-tree recount; `applyBlueprint` paths with pre-existing walker defects, orthogonal to R11, are flagged separately by the sweep).
+- The sweep is idempotent: re-running it writes zero rewrites and reports zero findings.
+
+## [0.29.0] - 2026-10-03
+
+0.29.0 lands the viewer UI refresh train (nine PRs that rebuild the shell, add shared components, redesign the Requirements, Architecture, Build and Readiness tabs, ship a Build DAG sub-tab, add fast ID lookup, and prove the embedding contract with a same-origin test-host fixture), the DEFINE readiness persona split (two readiness levels, `--level` and `--persona` on `rcf define readiness`, a Readiness tab as tab 1), and the first three DEFINE step 3 PRs (document intake into the brief ledger with the closed `resolvedBy` grammar, a `rcf define questions` verb with three new MCP tools and two argument-free prompts for the harness loop, and the `[draft]` shapes gate across TAC purpose, interface and core-entity homes with a DISCOVERY prototypes doctrine). The brief said 0.29.0 was never tagged; it is tagged here, and the spec sections that referred to those D2 behaviours as "0.30.0" now read 0.29.0.
+
+Scope note: DEFINE step 3 PR 5 (D3 bite) is still on the cloud at cut time and is NOT included; it rides a later minor. Spec amendment note: `projects/rcf-lite-wsd/specs/2026-10-01_define-step3-po-elicitation-spec.md` section 16 and every "0.30.0" reference to the D2 `skeleton:resolvedBy` tightening, the `rcf define ledger <name> update <id>` subverb and the `resolvedBy` closed grammar should read "0.29.0" at the next amendment pass.
+
+### Added
+
+- **Viewer UI refresh PR 1 of 9: shell, brand tokens, theme contract, embed contract, Router and relative asset refs (`#263` + `#265`; w-2026-10-02-dave-017).** AppShell with a compact header (icon mark, product block, sticky tabstrip, tools well) and a one-line footer carrying version, GitHub, docs links and the live-update pill. Full `--sv-*` Stravica brand token set under `:root[data-theme="light"]` and `:root[data-theme="dark"]` with a `prefers-color-scheme` fallback; pre-PR-1 `--colour-*` names kept as aliases so doc-renderer, Mermaid and Product Map rules get dark theme for free. `theme=light|dark|auto` and `embed=1` on `/`; live theme switch via same-origin `postMessage({ type: "rcf-view-theme", theme })` (origin checked). Router (`#tab=&sub=&entity=`) with bare-id compatibility and query-string preservation on every hash write. Relative asset and stream refs for embedding: `./style.css`, `./mermaid.min.js`, `./page-init.js`, `./live-client.js`, `./events`, `./scope.json`, `./product-map/<group>`. Inline-script-free shell: the former inline IIFE lives in `src/view/page-init.js` served by a new relative route (see "For embedders" below).
+- **Viewer UI refresh PR 2 of 9: shared components layer and shell polish (#266; w-2026-10-02-dave-010).** Six shared component helpers under `src/view/components/` land for the per-tab cutover PRs: `DocRow`, `FilterBar`, `Badge`, `EmptyState`, `Toast`, `SubTabStrip`, with matching `.rcf-*` CSS. Toast container mounted once in the shell outside `#rcf-live-content` so the SSE innerHTML swap cannot blow it away. `/_fixtures/components` route renders every shared component in isolation with sample data. Shell polish per decision 17: `resolveProductHeader()` returns the project name only; no technology chip under any register.
+- **Viewer UI refresh PR 3 of 9: Requirements tab and PRD EntitySelector (#268; w-2026-10-02-dave-025).** Requirements tab under `#tab=requirements` ships a FilterBar (text, Area, Priority, Status, Needs-work toggle), Expand/Collapse all and a live count; FilterBar state mirrors into the hash. DocRow per REQ carries `data-domain`, `data-priority`, `data-status`, `data-needswork`, `data-text`; row body has nested per-US DocRows with the full renderUserStory body, slice diagram and raw-JSON disclosure as collapsed `<details>` so first-paint stays cheap. `#entity=US-304` resolves to REQ-003 and US-304; bare `#entity=<id>` works. Needs-work set sourced from `model.readiness.levels.intentComplete.blockedBy` filtered to the engineer-plain reasons (viewer never re-runs gates). PRD tab (`#tab=overview` for hash backwards compatibility) collapses the five lists into `<details>` with count badges, drops the 109 inline requirement links, and mounts a shared EntitySelector below the article (bold total line, type-ahead jump input, 21 area chips deep-linking into `#tab=requirements&domain=<area>`). Component payload data rides on `data-*` attributes, never inline `<script>` bodies.
+- **Viewer UI refresh PR 4 of 9: Architecture tab with TAD sections and TAC/ADR filters (#269; w-2026-10-02-dave-026).** Six TAD sections (`systemOverview`, `architecturePrinciples`, `integrationArchitecture`, `operationalConcerns`, `dataArchitecture`, `securityArchitecture`) render as shared `DocRow` with a one-line preview, closed by default. Absent sections keep their heading, read "Nothing written yet" with an `empty` badge, and name the exact authoring command `rcf define update TAD-001 --set <section>.<field>="..."`. Components (TAC) and Decisions (ADR) panels each use shared `FilterBar` plus `DocRow` list; TAC rows carry interface and dependency count badges, ADR rows carry a status pill sized against the dogfood vocabulary. Hash scheme extends: `#tab=architecture[&cq=...][&cstatus=...][&dq=...][&dstatus=...][&open=<tad-section-keys>]`. Raw TAD JSON kept as a muted collapsed disclosure at the foot of the tab.
+- **Viewer UI refresh PR 5 of 9: Build tab with Specs and sub-tab strip (#271; w-2026-10-02-dave-027).** SubTabStrip "Specs | DAG" inside the Build tab (DAG is a placeholder empty state at PR 5; PR 6 wires it). BuildStats card with six totals read from `computeQueue({ fbsItems })` (items, verified, complete, in progress, not started, buildable now = `queue.totals.actionable`). Specs FilterBar (text, status, area, size, Buildable-now toggle) over a shared DocRow list. Expanded Spec body: summary, approach, AC and dep links, deliverables, context links (TACs, ADRs, TAD sections), "Show in the DAG" pointer, raw JSON disclosure. Hash scheme extends: `#tab=build[&sub=specs|dag][&q=][&status=][&domain=][&size=][&buildable=1]`.
+- **Viewer UI refresh PR 6 of 9: Build/DAG sub-tab (#272; w-2026-10-02-dave-031).** Lands DagCanvas, DagInspector, DagToolbar and the unconnected lane: depth-by-`dependsOnFbsIds` columns, buildOrder rows, node-count critical path (longest chain), hidden unconnected lane with a visible count. Click-to-highlight closure (upstream outlined in link colour, downstream in warning, rest dimmed); inspector lists direct needs and waits-on with Open-in-Specs; `#tab=build&sub=dag&entity=FBS-<n>` deep-links. Inspector payload rides on a `data-rcf-dag-inspector-data` attribute, never an inline `<script>` body. Chain: REQ-002 amended, US-204 new (seven ACs), TAC-4131, ADR-4133.
+- **Viewer UI refresh PR 7 of 9: ID lookup over `./index.json` (#275; REQ-002 / US-205; TAC-4132; ADR-4134).** The viewer serves a new relative route `./index.json` built from `BuiltTreeModel` on every rewalk, one row per document id plus one per AC, carrying `{ id, kind, title, snippet, parent, tab }` (`src/view/view-index.js` + `src/server/routes.js` + `src/server/index.js`). A SearchButton renders to the right of the tabstrip and a LookupModal mounts outside `#rcf-live-content` so the SSE innerHTML swap cannot blow it away; Cmd/Ctrl+F opens the modal from any tab (Cmd/Ctrl+Shift+F stays the browser's in-page find). Type-ahead ranks id matches first (exact > prefix > contains); then every query word must match title or snippet, title above snippet; a single character searches ids only; 20 results; matches marked. The index is fetched lazily on first open and refreshed when the next SSE `tree-update` event lands (`__rcfLookupDirty` is set in `src/view/live-client.js`). A pick writes `#tab=<tab>&entity=<id>` through the existing writeHash so `?embed=` and `?theme=` survive every navigation. Keyboard: up/down/Enter/Esc; the modal is a `role="dialog"` with `aria-modal`, labelled live-region status, and the SearchButton is `aria-label`-ed as `Find any document or AC (Cmd/Ctrl+F)`. The new relative viewer route is `./index.json` (released alongside PR 1's `./page-init.js`; wespa's reverse-proxy allow-list is extended before the version pin bump).
+- **Viewer UI refresh PR 8 of 9: Readiness tab Product Owner redesign (#277; REQ-180 / US-18002 / TAC-4133 / ADR-4135; w-2026-10-02-dave-033).** PO layer with two equal-height VerdictCards (muted chain term on both), QuestionCards grouped by source span, Requirements-that-still-need-work table, and a "For engineers" DocRow at the foot that collapses the pre-PR-8 engineer rendering (never removed from the DOM in any register, per AC-18002-3). Readiness phrasebook ships now. Feature-detected adapter seam consumes DEFINE step 3 PR 2's `computeQuestions` output on the real path and falls back to the blockers path with phrasebook asks when it is absent. `src/view/index.js` folds `computeQuestions(readiness, { tree, ledgers, profileText, persona: 'productOwner' })` onto `readiness.{questions,questionGroups,questionOptional,questionEngineer}` before the view reads it, so the two sources render identical labels on the dogfood tree.
+- **Viewer UI refresh PR 9 of 9: embedding proof via a same-origin test-host fixture (#279; REQ-002 / US-206; TAC-4134; ADR-4136; w-2026-10-02-dave-034).** `src/view/test-host/` (`fixture.js`, `embed-client.js`, `lints.js`) and routes `GET /test-host.html` and `GET /test-host.js` served ONLY behind `--test-host` (CLI) or `RCF_VIEW_TEST_HOST=1` (env), 404 by default so wespa's reverse-proxy allow-list is unaffected. The fixture ships a 56 px header, a resizable sidebar (64 to 400 px) and a toggle posting `rcf-view-theme`. Three in-suite guards pin the embedding contract: framing headers absent (no `X-Frame-Options`, no CSP), zero `target="_top"` across all served responses, and every `src/view` storage key under the `rcf-view:v1:` namespace.
+- **DEFINE viewer: Readiness tab as tab 1 and Overview-to-PRD rename (#262; REQ-180 / REQ-181 / US-18001 / US-18101; TAC-4127; ADR-4127; w-2026-10-01-dave-003 PR C).** `src/view/readiness.js` lands and `src/view/html-page.js` wires it as the first tab of the HTML review surface. The former Overview tab is renamed PRD (label-only; the `data-tab="overview"` identifier and `id="tab-overview"` are preserved so every existing `#tab-overview` hash link still resolves). The tab renders the `computeReadiness` object top-to-bottom in the layout spec section 5 pins: tree line, two verdict pills with `formatVerdictLines` strings as labels, two per-persona next-action lines, D1 to D8 state chips, blockers grouped by persona (register orders the pair; the non-register group collapses with its count visible, never omitted), delta list grouped by REQ ancestor with a document-level `diff` on changed items, per-stage check detail, coverage tree-versus-delta, decisions outstanding, a Freeze now control enabled iff `levels.readyToBuild.ok`, and the loaded freeze record. The renderer is pure: it never recomputes readiness or hits disk. Three shared view components (`src/view/components/{pill,findings-list,diff}.js`) land as additive modules.
+- **DEFINE readiness CLI: `--level` and `--persona` flags, persona-grouped text report (#261; ADR-4126; REQ-175 / US-17503; TAC-4123; w-2026-10-01-dave-003 PR B).** `rcf define readiness` gains `--level intent|build` and `--persona productOwner|engineer`. `--level intent` exits 4 iff `levels.intentComplete.ok === false`, `--level build` exits 4 iff `levels.readyToBuild.ok === false` (stricter than `--check all` on unacknowledged warn-with-ack failures; the `[warn]` line still prints). When both `--check` and `--level` are given, the invocation exits 4 if either policy says 4. With neither flag the exit code stays 0. `--persona` is a display filter only: it never affects the exit code or `--json` content, and is ignored under `--json`. Unknown values exit 2 with a usage line naming the accepted set. The text report prints both verdict lines at the top, then groups blockers into a `Product owner: N question(s)` section and an `Engineer: N check(s) blocking` section ordered by the `profile.md` register (PO first when `register: productOwner` or when the marker is `unstated`/absent; engineer first when `register: engineer`). The JSON gains `_meta.level` reflecting the invocation (`"intent"`, `"build"` or `null`).
+- **DEFINE readiness: persona tags on every gate check, two readiness levels (#260; ADR-4126; REQ-174 / US-17402 / US-17403 and REQ-175 / US-17502; TAC-4122 and TAC-4123; w-2026-10-01-dave-003 PR A).** Every entry in `stages[].checks[]` carries `persona` (`productOwner` | `engineer`) and a one-sentence `question` heading, declared in `CHECK_PERSONA` / `CHECK_QUESTION` maps in `src/query/gates.js`. The `notApplicable` placeholder (`stage:<D>:scope`) carries the `STAGE_FALLBACK_PERSONA` for its stage so the per-check vocabulary is total. `skeleton:reqFields` splits into `skeleton:reqIntent` (productOwner: description without TODO + domain) and `skeleton:reqShape` (engineer: shapeClassification.shapes), each evaluating every REQ independently. `decisions:allAnswered` splits into `decisions:wellFormed` (productOwner) and `decisions:allAnswered` (engineer). A new D3 check `shapes:draftSettled` fails any interface whose `description` starts with `[draft]` (leading whitespace tolerated). `computeReadiness` folds `levels.intentComplete`, `levels.readyToBuild`, `personas.productOwner.blockers` and `personas.engineer.blockers` on every read. `deriveNextAction(stages, persona?)` gains an optional persona filter. New shared helper `formatVerdictLines(result)` builds the two verdict strings. All additions are strictly additive; `rcf define freeze` is untouched and remains L2-only.
+- **DEFINE step 3 PR 1: document intake into the brief ledger, `rcf define ledger <name> update <id>` subverb, closed `resolvedBy` grammar (#270; REQ-187 / US-18701 / US-18702; REQ-173 amended / US-17302; TAC-4121 amended, TAC-4130 new).** `rcf define ledger brief add` grows `--from <statement-file>`, `--scan` / `--no-scan`, `--findings <path>`, `--dry-run` and `--json`; the parser recognises `[kind]` and `(source: ...)` text markers (with `--kind` and `--source` defaults) and promotes `?` / `TBC` / `TBD` / `Open:` / `Question:` to `openQuestion`; unknown `[kind]` exits 2 before any write. The mechanical intake scans run over new statements against existing ones and append `openQuestion` statements per finding (`--no-scan` with `--findings` exits 2). A new `rcf define ledger <name> update <id>` subverb lands on every ledger with the add-side validation; `brief --resolved-by` validates the closed pointer grammar before any write. The D2 `skeleton:resolvedBy` check now parses the pointer against the closed grammar (`REQ-nnn`, `TAD.entity:<name>`, `PRD.user:<name>`, `TAD.system:<name>`, `TAC-nnnn`, `omitted:<reason>`); see Changed for the dropped title-hit fallback. Chain: FBS-202 new (holds the new ACs with `executionStatus: notStarted`; the CN axis is deferred); `docs/capability-tags.md` grows a `define-intake` slug.
+- **DEFINE step 3 PR 2: `rcf define questions` verb, three MCP tools and two argument-free prompts (#274; REQ-186 / US-18601 / US-18602 / US-18603; TAC-4128, TAC-4129; ADR-4129, ADR-4130).** `rcf define questions` turns every failing product-owner check into one plain question carrying its exact write-back (real three-step `create req; define update <REQ-id> --set description=... --set domain=...; ledger brief update ... --resolved-by <REQ-id>` for new REQ; real `create us --parent --title`, `define update <US-id> --json --set story='{...}'` and `create ac --parent --description "[happy] ..."` sequence for new US; `decisions add ...; ledger brief resolve <N> --answer "decision <id>"` for `brief:openQuestions`). Three new MCP tools expose the same compute: `rcf_define_questions`, `rcf_define_readiness`, `rcf_define_ledger`; two argument-free prompts (`rcf_define_intent`, `rcf_define_intake`) steer the harness through the loop. The question extractor reads the full `readiness.stages[].checks[].failing[]` so a check with 25 failing items yields 25 questions (not 20). Termination under `--stage` is `result.ok` alone (not `result.ok || result.remaining === 0`). Stable sort of questions by `(stageIndex, sourceSpan, originalIndex)`.
+- **DEFINE step 3 PR 3: `[draft]` shapes across TAC purpose, interface and core-entity homes; DISCOVERY prototypes doctrine; two new argument-free prompts (#278; REQ-188 / US-18801; REQ-182 / US-18202; ADR-4132).** `parseInterfaceDraft` becomes a thin wrapper over a shared `hasDraftMarker` string test; two sibling readers `parseTacPurposeDraft` and `parseCoreEntityDraft` cover the new homes. `checkD3Shapes` enumerates all three draft homes and emits `shapes:draftSettled` findings with ids `<tacId>:<name>`, `<tacId>` and `TAD.entity:<name>`. D3 `notApplicable` widens to include any tree-wide `[draft]` core entity so a draft-only tree reports under D3 rather than being skipped. `guidance/discovery-prototypes.md` (slug `discovery-prototypes`, `rcf://docs/discovery-prototypes`) lands the doctrine (prototype as elicitation instrument; outputs as `prototype:<name>:<observation>` statements; code burned by a single `constraint`; salvage by re-derivation only). `guidance/discover-prototype.md` wraps it as the argument-free `rcf_discover_prototype` prompt. `guidance/define-draft-shapes.md` lands the argument-free `rcf_define_draft_shapes` prompt. `guidance/manifest.json` registers the slug and the two prompts; the managed block gains the "Prototypes in DISCOVERY (ADR-4132)" rule beside the existing "Prototype rule". `docs/capability-tags.md` grows a `define-drafts` slug.
+
+### Changed
+
+- **DEFINE D2 `skeleton:resolvedBy` tightens to the closed pointer grammar (PR #270, breaking under the pre-1.0 convention; spec amendment: this behaviour was previously named "0.30.0" in the DEFINE step 3 spec section 16 and now ships at 0.29.0).** The 0.28.4 title-hit fallback (a brief statement with `resolvedBy` left as free-form title text was quietly accepted if the title matched any downstream document) is dropped. A pointer that does not parse against the closed grammar (`REQ-nnn`, `TAD.entity:<name>`, `PRD.user:<name>`, `TAD.system:<name>`, `TAC-nnnn`, `omitted:<reason>`) now fails `skeleton:resolvedBy` on D2. Operators with brief ledgers written against 0.28.4 must rewrite non-conforming `resolvedBy` values to the closed grammar; `rcf define ledger brief update <id> --resolved-by <pointer>` validates before write.
+- **Managed agent-instructions block regenerated: adds the "Prototypes in DISCOVERY (ADR-4132)" rule and registers the four argument-free DEFINE/DISCOVERY prompts (PRs #274 and #278).** `scripts/gen-managed-artefacts.mjs` reran on PR 2 and PR 3 of DEFINE step 3; the block hash changed. Agents update their copy of the managed block by rerunning `rcf init` (`minAgentAction: rerun-init`).
+
+### Removed
+
+- **Viewer Build tab: the "FBS slots" ordered list and the "Test suites" section are gone (PR #271).** The Build tab's "Specs" sub-tab replaces both. Suites stay reachable via AC links and PR 7's ID lookup (Cmd/Ctrl+F). Consumers that embedded a deep link into the old Build-tab FBS-slots list need to update to `#tab=build&sub=specs&entity=FBS-<n>` or to the DAG sub-tab `#tab=build&sub=dag&entity=FBS-<n>`.
+
+### Fixed
+
+- **DEFINE D2 skeleton gate reads TAD at the schema-authorised path (#259; w-2026-09-25-dave-004 defect A, REQ-174 / US-17401 / TAC-4122).** `checkD2Skeleton` in `src/query/gates.js` now reads `tad.dataArchitecture.dataStores` and `tad.dataArchitecture.coreEntities` instead of the top-level `tad.dataStores` / `tad.coreEntities` that slice-2 drifted onto. The authority is rcf-schemas 0.6.3 (`tad.schema.json` requires both arrays under `dataArchitecture`), so the previous top-level reads failed `skeleton:tadPersistence` on every valid tree carrying a persistence REQ. The `failing` entry ids tracked the move to `TAD.dataArchitecture.dataStores` and `TAD.dataArchitecture.coreEntities`.
+- **DEFINE D1 brief gate: a fresh `rcf init` tree now satisfies the review-surface marker without operator edits (#259; w-2026-09-25-dave-004 defect B, REQ-174 / US-17401 / TAC-4122).** `src/setup/identity-seed.js` IDENTITY_TEMPLATE now carries a `## Surface` section between `## Register` and `## Project-scoped notes`, mirroring the Register section's shape: a short italicised explanation, one bullet each for `viewer` / `runningApp` / `prDiff`, and a bare `prDiff` line as the default. `checkD1Brief`'s `profile:surface` check now passes on a clean post-init tree. The slice-1 idempotency contract (an existing profile.md is left byte-identical) is preserved.
+
+### For embedders (wespa reverse-proxy)
+
+- **New relative routes shipped since 0.28.4.** `GET /page-init.js` (PR 1), `GET ./index.json` (PR 7). Both must be allow-listed on the wespa reverse-proxy for `/rcf-viewer/*` before the version pin bump, or the proxy returns 404 for `/rcf-viewer/page-init.js` (losing tab wiring, Mermaid lazy render, product-map interactivity, theme boot, embed stamp, origin-checked `postMessage` listener and the hash router) and `/rcf-viewer/index.json` (losing the Cmd/Ctrl+F ID lookup).
+- **No new allow-list routes from PR 9.** `GET /test-host.html` and `GET /test-host.js` are served ONLY when `--test-host` (CLI) or `RCF_VIEW_TEST_HOST=1` (env) is set, and return 404 otherwise. Production wespa does not set the flag, so the allow-list is unchanged by PR 9.
+- **Removed inline script in the viewer shell (PR 1).** CSP hash pin for the inline shell IIFE is no longer needed; the IIFE lives in `src/view/page-init.js` (served by `GET /page-init.js`). Wespa's CSP for `/rcf-viewer/*` should allow the external script in place of the previous inline hash pin.
+- **Live update pill in the footer (PR 1).** Carries connection state (connecting, open, retrying, closed); styled through the `--sv-*` tokens so it tracks the theme.
+- **`embed=1` and `theme=light|dark|auto` query params (PR 1).** `embed=1` stamps `data-embed="1"` on `<html>`, suppresses the title block and footer, and left-aligns the tabstrip; the icon mark and project name remain. `theme` on `/` either stamps `data-theme` (explicit value), clears it (`auto`), or leaves the default light (absent).
+- **Live theme switch via `postMessage({ type: "rcf-view-theme", theme })` (PR 1).** Same-origin only; the viewer's listener checks `event.origin`.
+- **Hash contract (PR 1, extended by PRs 3 to 9).** `#tab=<name>&sub=<name>&entity=<id>` is the canonical hash form; bare `#<id>` and `#entity=<id>` keep working. `?embed=` and `?theme=` and unknown query params survive every in-viewer navigation.
+- **`./index.json` (PR 7).** Lazy JSON index served from the viewer root; refreshed on every SSE `tree-update`.
+
 ## [0.28.4] - 2026-09-30
 
 Note: 0.28.3 (2026-09-22 below) was never tagged or published; its entries ship in 0.28.4 together with the ones here.
 ### Added
 
+- **DEFINE workflow: `rcf define freeze` CLI verb (REQ-176, first slice of the 0.29.0 train; slices 1 and 2 shipped in 0.28.4 on 2026-09-30).** New module `src/cli/freeze.js` is the only
+  writer of `rcf/define/freeze.json` in the shipped product. It runs
+  `computeReadiness` once (REQ-175) over the live tree, freeze record
+  and four ledgers; refuses (exit 4) on any stage state `failing`
+  after applying any `--ack` acknowledgements; and, on success, writes
+  the freeze record via `saveFreezeRecord` (REQ-172) plus the
+  proposal 2026-09-22 v3 §2.5 summary line the operator signs off.
+  `--ack <gate> --reason <text>` is accepted only for the three
+  warn-with-ack gates (`define.shapes` / D3 / shapes,
+  `define.crosscut` / D5 / crosscut, `define.consistency` / D6 /
+  consistency); `--ack` on any other gate is a usage refusal
+  (exit 2) with a stderr message naming the accepted set. Ack pairs
+  are folded in-memory at the current tree hash and the readiness
+  compute runs with a synthesised freeze context so D8's
+  `priorGates` check sees the acked stages as `acknowledged`. On
+  success the record carries `frozenAt` (ISO UTC now), `treeHash`
+  (from `computeDelta`), `docHashes`, `briefStatements`,
+  `gates` (per-stage envelope including acked entries),
+  `counts` (`req` / `us` / `ac` / `acByClass` / `tac` /
+  `interfaces` by kind / `adr` / `fbs`), `litmus`
+  (`{ attestedAt: [], readers: 0 }` default; `--litmus-attested
+  D3,D6` records the agent's attestation per proposal §9 decision
+  7), `versions` (`rcfLite` / `ruleset` / `schemas` read from
+  package.json, `src/ruleset/ruleset.json` and the installed
+  `@stravica-ai/rcf-schemas`), `note` and `override: null`. The
+  producer is wrapped with `runWithAdmissibilityGate` per ADR-4124;
+  refused admissibility is informational (a stderr `[warn]` line)
+  and never a freeze refusal (ADR-4123 carried). `--status` prints
+  the current record and the live delta summary without running any
+  gates and without writing; `--status --json` emits
+  `{ record, delta }`. `--json` on a freeze success emits
+  `{ record, summary, delta }`. The `--litmus <n>` real-dispatch
+  runner is a named 0.30 seam.
+
+### Changed
+
+- **Freeze record `override` is now a required-nullable field
+  (slice 3, resolves the slice-1 P3).** `validateFreezeRecord` in
+  `src/define/freeze-record.js` throws `FreezeRecordError` with
+  `field: 'override'` when the key is missing; `saveFreezeRecord`
+  refuses to write a body that omits override. `loadFreezeRecord`
+  defaults a missing key to `null` on read so pre-slice-3
+  freeze.json records survive without a migration step. Every
+  fresh freeze written by the new CLI stamps `override: null`, so
+  the on-disk shape converges on the current schema the next time
+  a project freezes.
+
+### Fixed
+
+- **DEFINE hygiene: the ` -- ` double-dash is gone from the
+  readiness CLI stage header and the CHANGELOG's TODO-regex line
+  (slice 3).** The readiness `rcf define readiness` stage block
+  now uses `: ` between the stage id / gate and the state label
+  (`D1 (define.brief): failing`); the CHANGELOG's `The regex is
+  now /\bTODO:/` line likewise uses a colon.
+
 - **Product Map tab on the review surface (#238).** Merged on `main` at
   `ab35dd7d`; grouped by shape, component, trace coverage, capability,
   blueprint. This entry backfills the changelog now that the following
@@ -133,7 +326,7 @@ Note: 0.28.3 (2026-09-22 below) was never tagged or published; its entries ship
   the whole-word `/\btodo\b/i`, which false-positived on prose
   mentioning the word ("no AC description contains the scaffold TODO
   placeholder" on US-17401 / AC-17401-4 tripped D4 against itself).
-  The regex is now `/\bTODO:/` -- case-sensitive uppercase `TODO`
+  The regex is now `/\bTODO:/`: case-sensitive uppercase `TODO`
   followed by a colon, matching every scaffold string
   `src/core/store/init.js` and `src/core/store/writer.js` write for a
   fresh `rcf init` / `rcf define create`. `src/cli/validate.js` keeps

package/bin/rcf.js

@@ -53,6 +53,8 @@ import { main as intakeMain } from '../src/cli/intake.js';
 import { main as evalMain } from '../src/cli/eval.js';
 import { main as ledgerMain } from '../src/cli/ledger.js';
 import { main as readinessMain } from '../src/cli/readiness.js';
+import { main as questionsMain } from '../src/cli/questions.js';
+import { main as freezeMain } from '../src/cli/freeze.js';
 
 // Verify group members are handled by the verify-suite dispatch tree.
 import { main as verifyRunMain } from '../src/verify/cli/run.js';
@@ -99,6 +101,8 @@ export const GROUPS = {
     standards: standardsMain,
     ledger: ledgerMain,
     readiness: readinessMain,
+    questions: questionsMain,
+    freeze: freezeMain,
   },
   build: {
     // build sub-verbs are dispatched by build.js internally (queue |

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-001.json

@@ -5,7 +5,7 @@
   "description": "The settings shell renders a single primary tabs region (ARIA APG tabs pattern) whose entries mirror the union of applied capabilities discovered via readAppliedCapabilities. The applied capability floor is principalDirectory: the shell reads the current authenticated principal (name, email, id) from the applied principalDirectory provider on first render and passes the identity to every child surface without re-reading it per tab switch. A tab whose capability is not applied does NOT render (no dead link, no disabled shell). A principal without an authenticated session reaching /account routes to the access-denied state through application-empty-error-states with a sign-in link; no bespoke access-denied UI is invented here. Landmark, headings, focus order per WCAG 2.4.6.",
   "deliveredBy": {
     "tacId": "TAC-2601-application-account-settings-shell",
-    "field": "responsibilities.renderShell"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-002.json

@@ -5,7 +5,7 @@
   "description": "The profile surface (/account/profile) is unconditional (any authenticated principal reaches it) and renders a form with WCAG 1.3.5 autocomplete tokens on every editable identifier (name, email, bday, country). Save success announces via aria-live polite (\"Profile saved\"). Save failure per field renders aria-invalid true with aria-describedby to the per-field error message and focus moves to the first invalid field (WCAG 3.3.1 Error Identification).",
   "deliveredBy": {
     "tacId": "TAC-2601-application-account-settings-shell",
-    "field": "responsibilities.renderProfileSurface"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-003.json

@@ -5,7 +5,7 @@
   "description": "The security surface (/account/security) renders when the applied capability set contains credentialSelfService (self-service branch of the security-surface-shape elicit: password change, MFA setup, session-based sign-out) or hostedIdentityUi (hosted-link-out or hosted-embed branch of the security-surface-shape elicit: hosted-link-out surfaces an operator-elicited href through the hosted-identity-url handle; hosted-embed surfaces the same handle inside a same-origin iframe when the applied hosted-identity provider names an embed clause). When NEITHER capability is applied, the security tab does not render and the surface refuses at apply with the two-remedy message (declare a capability, or drop the security tab from scope) per spec Q3.",
   "deliveredBy": {
     "tacId": "TAC-2603-application-account-settings-hosted-ui-bridge",
-    "field": "interfaces.renderSecuritySurface"
+    "field": "interfaces[renderSecuritySurface]"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-004.json

@@ -5,7 +5,7 @@
   "description": "The sessions surface (/account/sessions) renders when sessionInventory is applied. Lists active sessions in a table enumerated by data-session-id with device label, last-active timestamp and terminate control. Terminate opens an ARIA APG dialog-modal (role=dialog, aria-modal=true, aria-labelledby to the heading, focus trap, focus returns to the row on close) confirming the action; on submit the row disappears from the table and a polite \"Session ended\" announcement fires (WCAG 4.1.3 Status Messages).",
   "deliveredBy": {
     "tacId": "TAC-2604-application-account-settings-session-store",
-    "field": "interfaces.sessionInventoryConsumer"
+    "field": "interfaces[sessionInventoryConsumer]"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-005.json

@@ -5,7 +5,7 @@
   "description": "The notification-preferences surface (/account/notifications) renders when application-notifications-in-app is applied. Provides a per-category silence control and a per-channel opt-in (in-app, email, push where channels apply). The blueprint does NOT own the notification model; it delegates the model to the applied blueprint and renders the operator interface only. Save-success and save-failure announcements follow the profile surface contract.",
   "deliveredBy": {
     "tacId": "TAC-2601-application-account-settings-shell",
-    "field": "responsibilities.renderPreferencesSurface"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-006.json

@@ -5,7 +5,7 @@
   "description": "The theme surface (/account/theme) renders when application-spa is applied. Renders a light/dark/system radiogroup (ARIA APG radiogroup, keyboard reachable) and persists the choice per the theme-persistence elicit (spa-local-storage default, server-scoped, or none). Choice takes effect immediately (data-theme attribute on the html element flips) and honours the users prefers-color-scheme when set to system.",
   "deliveredBy": {
     "tacId": "TAC-2601-application-account-settings-shell",
-    "field": "responsibilities.renderThemeSurface"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-007.json

@@ -5,7 +5,7 @@
   "description": "The security and sessions surfaces honour the elicited reauth-window with a runtime clause per option, applied before a high-value change (credential change, session termination, MFA enrolment). `never` bypasses reauthentication for any interval since the last successful sign-in and permits the high-value action to proceed with only the standard confirmation dialog. `5`, `15` and `60` denote a minute-count: when more than that many minutes have elapsed since the principal's last successful sign-in (as recorded on the applied auth providers session inventory), the surface presents a reauth prompt before the high-value action; the action refuses with REAUTH_REQUIRED until the reauth prompt returns success, then proceeds. The comparison uses the last-active timestamp on the current session record from the applied provider (security-auth-clerk TAC-1003 sessionInventory or the equivalent TAC on another auth blueprint), never a local clock. The reauth prompt never accepts the current session's own credentials as sufficient for the reauth without a fresh challenge (a fresh password entry, a fresh MFA challenge or a fresh magic-link click).",
   "deliveredBy": {
     "tacId": "TAC-2604-application-account-settings-session-store",
-    "field": "responsibilities.reauthWindowGate"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "security",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-009.json

@@ -5,7 +5,7 @@
   "description": "When the applying project runs its own auth (no shipped security-auth-* blueprint) and answers the four custom-auth-provides-* boolean elicits, the account-settings shell binds each answer to the appliedCapabilities union with a runtime clause per token: when `blueprint.json.elicits[id=custom-auth-provides-principal-directory]` is `true` the union includes `principalDirectory` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-credential-self-service]` is `true` the union includes `credentialSelfService` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-session-inventory]` is `true` the union includes `sessionInventory` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-hosted-identity-ui]` is `true` the union includes `hostedIdentityUi` and `false` omits it. The sidecar the shell reads reflects the exact union the boolean answers produce.",
   "deliveredBy": {
     "tacId": "TAC-2602-application-account-settings-capability-discovery",
-    "field": "responsibilities.runElicitationPhase"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-account-settings/contributions/tacs/tac-2601-application-account-settings-shell.json

@@ -21,13 +21,13 @@
   "interfaces": [
     {
       "name": "renderShell",
-      "kind": "factory",
-      "description": "renderShell({ capsSidecarUrl, surfaceRegistry, sessionGuard, themeAdapter, notificationsAdapter }) -> { mount(rootElement), unmount() }. The project supplies the capsSidecarUrl (where the sidecar is served from), the surfaceRegistry (maps a capability string to a surface component), the sessionGuard (returns whether the current principal has an authenticated session), the themeAdapter (persists the theme per the elicited persistence strategy) and the notificationsAdapter (reads and writes preferences through the applied notifications blueprint)."
+      "kind": "other",
+      "description": "renderShell({ capsSidecarUrl, surfaceRegistry, sessionGuard, themeAdapter, notificationsAdapter }) -> { mount(rootElement), unmount() }. The project supplies the capsSidecarUrl (where the sidecar is served from), the surfaceRegistry (maps a capability string to a surface component), the sessionGuard (returns whether the current principal has an authenticated session), the themeAdapter (persists the theme per the elicited persistence strategy) and the notificationsAdapter (reads and writes preferences through the applied notifications blueprint). (legacy kind: factory)"
     },
     {
       "name": "capabilitiesSidecar",
-      "kind": "shape",
-      "description": "{ slug, version, appliedAt, appliedCapabilities: string[], appliedElicitations: {}, allowNoAuthYet?: boolean, notes?: string }. Written by apply, read by the shell."
+      "kind": "other",
+      "description": "{ slug, version, appliedAt, appliedCapabilities: string[], appliedElicitations: {}, allowNoAuthYet?: boolean, notes?: string }. Written by apply, read by the shell. (legacy kind: shape)"
     }
   ],
   "dependencies": [

package/blueprints/application-account-settings/contributions/tacs/tac-2602-application-account-settings-capability-discovery.json

@@ -16,8 +16,8 @@
   "interfaces": [
     {
       "name": "readAppliedCapabilities",
-      "kind": "function",
-      "description": "readAppliedCapabilities(projectRoot) -> Promise<string[]>. Reads rcf/blueprints/application-account-settings.applied.json and returns appliedCapabilities[] or []. Never throws."
+      "kind": "other",
+      "description": "readAppliedCapabilities(projectRoot) -> Promise<string[]>. Reads rcf/blueprints/application-account-settings.applied.json and returns appliedCapabilities[] or []. Never throws. (legacy kind: function)"
     }
   ],
   "dependencies": [],

package/blueprints/application-account-settings/contributions/tacs/tac-2603-application-account-settings-hosted-ui-bridge.json

@@ -16,8 +16,8 @@
   "interfaces": [
     {
       "name": "renderSecuritySurface",
-      "kind": "factory",
-      "description": "renderSecuritySurface({ appliedCapabilities, appliedElicitations }) -> { mount(root), unmount() }. Reads security-surface-shape and hosted-identity-url from appliedElicitations."
+      "kind": "other",
+      "description": "renderSecuritySurface({ appliedCapabilities, appliedElicitations }) -> { mount(root), unmount() }. Reads security-surface-shape and hosted-identity-url from appliedElicitations. (legacy kind: factory)"
     }
   ],
   "dependencies": [

package/blueprints/application-account-settings/contributions/tacs/tac-2604-application-account-settings-session-store.json

@@ -17,18 +17,18 @@
   "interfaces": [
     {
       "name": "renderSessionsSurface",
-      "kind": "factory",
-      "description": "renderSessionsSurface({ inventoryAdapter, terminateAdapter }) -> { mount(root), unmount() }. The project supplies the two adapters against the applied provider."
+      "kind": "other",
+      "description": "renderSessionsSurface({ inventoryAdapter, terminateAdapter }) -> { mount(root), unmount() }. The project supplies the two adapters against the applied provider. (legacy kind: factory)"
     },
     {
       "name": "sessionRecord",
-      "kind": "shape",
-      "description": "Shape owned by `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` (or the equivalent session-inventory TAC on the applied auth blueprint). The consumer reads that shape without restating it; the pack asserts the surface renders every session, the terminate control is present on every non-current row, and the current row (data-current-session=\"true\") does not carry the terminate action."
+      "kind": "other",
+      "description": "Shape owned by `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` (or the equivalent session-inventory TAC on the applied auth blueprint). The consumer reads that shape without restating it; the pack asserts the surface renders every session, the terminate control is present on every non-current row, and the current row (data-current-session=\"true\") does not carry the terminate action. (legacy kind: shape)"
     },
     {
       "name": "sessionInventoryConsumer",
-      "kind": "consumer",
-      "description": "Consumer contract on top of the applied auth providers sessionInventory (owner TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory or the equivalent TAC on another auth blueprint). Reads list()/revoke()/revokeAllExceptCurrent() and never restates the row shape."
+      "kind": "other",
+      "description": "Consumer contract on top of the applied auth providers sessionInventory (owner TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory or the equivalent TAC on another auth blueprint). Reads list()/revoke()/revokeAllExceptCurrent() and never restates the row shape. (legacy kind: consumer)"
     }
   ],
   "dependencies": [
@@ -43,4 +43,4 @@
   "notes": "Known mechanism-reach gap: the read-inventory adapter contract cannot prove the applied provider actually returns a device label the operator will recognise (User-Agent parsing varies); the pack asserts the DOM shape.",
   "createdAt": "2026-09-06T20:55:46Z",
   "updatedAt": "2026-09-10T00:00:00Z"
-}
+}

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25105.json

@@ -35,11 +35,7 @@
       "then": "the surface shows an inventory-read-failed banner, no data-session-id rows appear as terminated, and a retry control is keyboard-reachable",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed",
-      "ownerRef": {
-        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
-        "field": "interfaces.sessionInventory"
-      }
+      "disposition": "fixed"
     },
     {
       "id": "AC-25105-4",
@@ -49,11 +45,7 @@
       "then": "the row remains with data-terminate-outcome=failed, the polite live region announces the failure and no session-terminated-announce is emitted",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed",
-      "ownerRef": {
-        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
-        "field": "interfaces.sessionInventory"
-      }
+      "disposition": "fixed"
     },
     {
       "id": "AC-25105-5",
@@ -63,11 +55,7 @@
       "then": "the current row carries data-current-session=true and its terminate control is disabled with an aria-describedby explanation",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed",
-      "ownerRef": {
-        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
-        "field": "interfaces.sessionInventory"
-      }
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25106.json

@@ -14,11 +14,7 @@
       "testable": true,
       "scope": "runtime",
       "description": "The sessions surface reads sessionInventory from the applied auth provider (security-auth-clerk 1.3.0+, security-auth-keycloak 1.2.0+, security-auth-oauth2 1.2.0+); the render contract of AC-25105-1 is identical regardless of which auth blueprint supplied the capability. observability-logging 1.3.0 no longer provides sessionInventory and is not consulted on this surface.",
-      "disposition": "fixed",
-      "ownerRef": {
-        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
-        "field": "interfaces.sessionInventory"
-      }
+      "disposition": "fixed"
     },
     {
       "id": "AC-25106-2",
@@ -28,11 +24,7 @@
       "then": "the surface reads the first providers inventory only, no cross-provider merge occurs and a divergent-shape observation refuses with SESSION_PROVIDER_CONFLICT",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed",
-      "ownerRef": {
-        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
-        "field": "interfaces.sessionInventory"
-      }
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25111.json

@@ -27,8 +27,7 @@
       "then": "the action refuses with REAUTH_REQUIRED, a reauth prompt renders and the action proceeds only after the reauth prompt returns success",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed",
-      "ownerRef": { "tacId": "TAC-1003-security-auth-clerk-session-verifier", "field": "interfaces.sessionInventory" }
+      "disposition": "fixed"
     },
     {
       "id": "AC-25111-3",
@@ -38,8 +37,7 @@
       "then": "the action refuses with REAUTH_REQUIRED and a reauth prompt renders; below the threshold no reauth prompt renders",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed",
-      "ownerRef": { "tacId": "TAC-1003-security-auth-clerk-session-verifier", "field": "interfaces.sessionInventory" }
+      "disposition": "fixed"
     },
     {
       "id": "AC-25111-4",
@@ -59,8 +57,7 @@
       "then": "the action refuses with REAUTH_WINDOW_UNKNOWN, a retry control renders keyboard-reachable and no client clock is used",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed",
-      "ownerRef": { "tacId": "TAC-1003-security-auth-clerk-session-verifier", "field": "interfaces.sessionInventory" }
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25112.json

@@ -20,7 +20,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-2602-application-account-settings-capability-discovery",
-        "field": "responsibilities.runElicitationPhase"
+        "field": "responsibilities"
       }
     },
     {
@@ -34,7 +34,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-2602-application-account-settings-capability-discovery",
-        "field": "responsibilities.runElicitationPhase"
+        "field": "responsibilities"
       }
     },
     {
@@ -48,7 +48,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-2602-application-account-settings-capability-discovery",
-        "field": "responsibilities.runElicitationPhase"
+        "field": "responsibilities"
       }
     },
     {
@@ -62,7 +62,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-2602-application-account-settings-capability-discovery",
-        "field": "responsibilities.runElicitationPhase"
+        "field": "responsibilities"
       }
     }
   ],