rcf-lite 0.30.0 → 0.32.0

package/rcf/test-suites/ts-229.json

@@ -1,7 +1,7 @@
 {
   "createdAt": "2026-10-03T09:55:00Z",
-  "updatedAt": "2026-10-03T10:00:00Z",
-  "purpose": "Cover US-206 (wespa's embedding contract is proved by a CI host fixture): the fixture renders a 56px header + resizable sidebar around an iframe pointed at ./?embed=1&theme=light with no inline script (AC-206-1), theme flips via postMessage without a reload (AC-206-2, source invariants + Playwright live proof in the lane evidence), embed and theme survive a hash-only in-iframe navigation (AC-206-3, source invariants + Playwright live proof), cross-origin messages are ignored by the viewer listener (AC-206-4), the three lints keep framing headers, target=_top and localStorage namespace in place (AC-206-5), and no new outbound postMessage shape is introduced by the viewer or the fixture (AC-206-6). All TCs resolve to node tests under test/view/wespa-host-fixture.test.js.",
+  "updatedAt": "2026-10-05T12:30:00Z",
+  "purpose": "Cover US-206 (wespa's embedding contract is proved by a CI host fixture): the fixture renders a 56px header + resizable sidebar around an iframe pointed at ./?embed=1&theme=light with no inline script (AC-206-1), theme flips via postMessage without a reload (AC-206-2, source invariants + Playwright live proof in the lane evidence), embed and theme survive a hash-only in-iframe navigation (AC-206-3, source invariants + Playwright live proof), cross-origin messages are ignored by the viewer listener (AC-206-4), the three lints keep framing headers, target=_top and localStorage namespace in place (AC-206-5), and no new outbound postMessage shape is introduced by the viewer or the fixture (AC-206-6). 2026-10-04 (w-2026-10-04-dave-001): extends coverage to the in-viewer three-state theme control (AC-206-7..10 under ADR-4137). All TCs resolve to node tests under test/view/wespa-host-fixture.test.js and test/view/theme-control.test.js. 2026-10-05 (PR 291 landing review F1): the boot theme is applied once; a `rcfPage.init()` re-run after an SSE swap never overrides a host postMessage theme or a theme-control choice.",
   "testLevel": "unit",
   "acIds": [
     "AC-206-1",
@@ -9,7 +9,11 @@
     "AC-206-3",
     "AC-206-4",
     "AC-206-5",
-    "AC-206-6"
+    "AC-206-6",
+    "AC-206-7",
+    "AC-206-8",
+    "AC-206-9",
+    "AC-206-10"
   ],
   "id": "TS-229",
   "usId": "US-206",
@@ -77,6 +81,48 @@
       "description": "A grep over src/view/** (excluding test-host/embed-client.js, the sanctioned emitter) finds zero .postMessage( call sites; the embed-client itself posts exactly one shape, 'rcf-view-theme'.",
       "status": "pending",
       "testPointer": "test/view/wespa-host-fixture.test.js::AC-206-6: no outbound postMessage shape beyond rcf-view-theme is introduced by the viewer or the fixture"
+    },
+    {
+      "id": "TC-229-theme-control-renders-non-embed",
+      "acId": "AC-206-7",
+      "description": "renderPage renders a `[data-rcf-theme-control]` group with three buttons (Light, Dark, Auto; `aria-pressed`) right of the SearchButton in `.tools` when `data-embed` is absent; a click on a theme button sets `<html data-theme>` live and flips `aria-pressed` across the three.",
+      "status": "pending",
+      "testPointer": "test/view/theme-control.test.js::AC-206-7: renderPage includes the three-state theme control in non-embed; applyThemeControl updates data-theme and aria-pressed on click"
+    },
+    {
+      "id": "TC-229-theme-control-persists",
+      "acId": "AC-206-8",
+      "description": "In non-embed mode, selecting a theme writes `rcf-view:v1:theme` as `light`/`dark`/`auto` and the stored value is reapplied on the next boot; a `rcf-view-theme` postMessage still applies live but does not write the stored key; the boot precedence is `?theme=` -> stored -> auto.",
+      "status": "pending",
+      "testPointer": "test/view/theme-control.test.js::AC-206-8: non-embed persistence under rcf-view:v1:theme; postMessage path writes nothing"
+    },
+    {
+      "id": "TC-229-theme-control-absent-embed",
+      "acId": "AC-206-9",
+      "description": "renderPage with `data-embed=\"1\"` does not emit any `[data-rcf-theme-control]` markup; wireThemeControl under embed never reads or writes `rcf-view:v1:theme` on load, on a postMessage, or on any user action; the key is zero-touched (localStorage spy sees no setItem/getItem call for the key under embed).",
+      "status": "pending",
+      "testPointer": "test/view/theme-control.test.js::AC-206-9: embed=1 omits the control markup and does not touch rcf-view:v1:theme"
+    },
+    {
+      "id": "TC-229-theme-control-query-wins",
+      "acId": "AC-206-10",
+      "description": "In non-embed mode with a stored value `dark`, when the URL carries `?theme=light`, boot resolves to `light` (explicit wins), the Light button is pressed and the stored value is NOT overwritten (next load without a query reuses `dark`).",
+      "status": "pending",
+      "testPointer": "test/view/theme-control.test.js::AC-206-10: explicit ?theme= beats the stored value and leaves the key as-is"
+    },
+    {
+      "id": "TC-229-reinit-keeps-host-theme",
+      "acId": "AC-206-2",
+      "description": "Boot `?embed=1` with no `?theme=`, post `{ type: \"rcf-view-theme\", theme: \"dark\" }`, then call `rcfPage.init()` (the live-client SSE re-run): `<html data-theme>` stays `dark` and no storage is touched.",
+      "status": "pending",
+      "testPointer": "test/view/theme-control.test.js::PR 291 F1 regression: embed=1 host theme survives an rcfPage.init() re-run"
+    },
+    {
+      "id": "TC-229-reinit-keeps-control-choice",
+      "acId": "AC-206-10",
+      "description": "Boot `?theme=light` in non-embed mode, click Dark, then call `rcfPage.init()`: `<html data-theme>` stays `dark` and the Dark button stays pressed.",
+      "status": "pending",
+      "testPointer": "test/view/theme-control.test.js::PR 291 F1 regression: standalone control choice survives an rcfPage.init() re-run with ?theme= in the URL"
     }
   ],
   "status": "draft"

package/rcf/test-suites/ts-230.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-10-03T10:50:00Z",
-  "updatedAt": "2026-10-03T10:50:00Z",
+  "updatedAt": "2026-10-05T18:00:00Z",
   "purpose": "Cover US-17404 (D3 bites): the three D3 bite checks shapes:templateMarkers, shapes:entityJoin and shapes:pathsResolve each have pass, fail, notApplicable, id and why strings; drafts are included in templateMarkers; the readiness CLI --check shapes exits 4 on an unacknowledged D3 failure and 0 when acked at the current hash; ackable() is exactly D3, D5, D6; --ack on D1, D2, D4, D7 or D8 exits 2 unchanged.",
   "testLevel": "unit",
   "acIds": [
@@ -9,7 +9,10 @@
     "AC-17404-3",
     "AC-17404-4",
     "AC-17404-5",
-    "AC-17404-6"
+    "AC-17404-6",
+    "AC-17404-7",
+    "AC-17404-8",
+    "AC-17404-9"
   ],
   "id": "TS-230",
   "usId": "US-17404",
@@ -70,6 +73,27 @@
       "description": "A [draft] recordShape without fields: fails shapes:templateMarkers exactly as a settled one; this completes AC-18801-4 from PR 3.",
       "status": "pending",
       "testPointer": "test/query/gates.test.js::gates (REQ-188, AC-18801-4): draft recordShape without fields fails templateMarkers (lifted by PR 5 ADR-4131)"
+    },
+    {
+      "id": "TC-230-r5-entityjoin-under-narrowed-scope",
+      "acId": "AC-17404-7",
+      "description": "A D3 scope narrowed so no TAC and no shaped REQ is in scope but a coreEntity has no record shape anywhere tree-wide still fails shapes:entityJoin (stage state failing, not notApplicable) via the ADR-4138 helper.",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates (R5, AC-17404-7): entityJoin runs tree-wide under narrowed D3 scope"
+    },
+    {
+      "id": "TC-230-r6-bare-paths-whitelist",
+      "acId": "AC-17404-8",
+      "description": "extractInterfacePathTokens treats Dockerfile, Makefile, LICENSE, Procfile, Containerfile, Justfile, Rakefile, Gemfile and CODEOWNERS as candidate tokens; shapes:pathsResolve fails a path: Dockerfile when not in resolvedPaths and passes when resolved. The exported BARE_PATH_WHITELIST drives both.",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates (R6, AC-17404-8): bare path whitelist is checked by pathsResolve"
+    },
+    {
+      "id": "TC-230-r13-helper-foldstate-delegation",
+      "acId": "AC-17404-9",
+      "description": "treeWideFailureEnvelope returns null when every tree-wide check passes under a scope-empty stage; on D3 with a failing tree-wide check and a freeze.gates ack at the currentTreeHash it folds through foldState to state 'acknowledged'; on D2 (blocking) with a failing tree-wide check it stays 'failing'.",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates (PR 292 follow-up, AC-17404-9): treeWideFailureEnvelope helper semantics"
     }
   ],
   "status": "draft"

package/rcf/test-suites/ts-231.json

@@ -9,7 +9,8 @@
     "AC-17405-3",
     "AC-17405-4",
     "AC-17405-5",
-    "AC-17405-6"
+    "AC-17405-6",
+    "AC-17405-9"
   ],
   "id": "TS-231",
   "usId": "US-17405",
@@ -98,6 +99,20 @@
       "description": "R11 refuses dotted grammar; rcf define validate reports the finding naming the dotted field.",
       "status": "passing",
       "testPointer": "test/define/validate-findings.test.js::validate findings (PR 9, R11): ownerRef uses the widened grammar; deliveredBy object form is checked"
+    },
+    {
+      "id": "TC-231-r8-standards-applied-waived-or-cited",
+      "acId": "AC-17405-5",
+      "description": "A concern-ledger entry concern 'standards:<pack>' with disposition 'applied' satisfies skeleton:standardsCited (R8 2026-10-05); 'waived' also satisfies it; neither nor cited, the pack fails standards:<pack>.",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates (R8, AC-17405-5): applied disposition satisfies standardsCited alongside waived and citation"
+    },
+    {
+      "id": "TC-231-r7-standards-under-narrowed-d2-scope",
+      "acId": "AC-17405-9",
+      "description": "A D2 scope narrowed so no REQ, PRD, TAD or brief statement is in scope but a registered standards pack is neither cited nor waived tree-wide still fails skeleton:standardsCited (stage state failing, not notApplicable) via the ADR-4138 helper.",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates (R7, AC-17405-9): standardsCited runs tree-wide under narrowed D2 scope"
     }
   ],
   "status": "draft"

package/rcf/test-suites/ts-236.json

@@ -0,0 +1,44 @@
+{
+  "createdAt": "2026-10-04T14:00:00Z",
+  "updatedAt": "2026-10-05T12:30:00Z",
+  "purpose": "Cover US-207 (every viewer text and control colour pair meets WCAG 2.1 AA in both themes): a static CSS-contrast audit parses `src/view/style.css`, resolves the `--sv-*` tokens for the light (`:root`) and dark (`:root[data-theme=\"dark\"]`) blocks, enumerates every rule that sets `color` paired with a reachable background, walks state variants (default, :hover, :focus, :focus-visible, :active, [aria-pressed=true], [aria-selected=true], .is-active, :disabled) and asserts the WCAG 2.1 AA thresholds (>= 4.5:1 for text, >= 3:1 for large text and non-text UI boundaries); the test exits non-zero on any failure, naming selector, state, theme, foreground, background, computed ratio and threshold. Points at test/view/contrast-aa.test.js and the BEFORE/AFTER report at ./output/contrast-report.md captured during the lane work (w-2026-10-04-dave-001). 2026-10-05 (PR 291 landing review F2, F3): state rules are merged over their base selector before pairing, border and outline colours are enumerated against the adjacent surface at 3:1, and the SearchButton and theme-control states are required to exist and pass in both themes.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-207-1",
+    "AC-207-2"
+  ],
+  "id": "TS-236",
+  "usId": "US-207",
+  "title": "WCAG 2.1 AA contrast audit across the viewer stylesheet, both themes, every state",
+  "testCases": [
+    {
+      "id": "TC-236-aa-enumerates-all-pairs",
+      "acId": "AC-207-1",
+      "description": "The audit parses `src/view/style.css`, enumerates every selector that sets `color` with every reachable background (own rule, ancestor surface token, page background `--sv-canvas`) in each state (default, :hover, :focus, :focus-visible, :active, [aria-pressed=true], [aria-selected=true], .is-active, :disabled) in both the light and dark token sets, computes the WCAG relative-luminance ratio and asserts >= 4.5:1 for normal text and >= 3:1 for large text and non-text UI boundaries (WCAG 1.4.3 and 1.4.11).",
+      "status": "pending",
+      "testPointer": "test/view/contrast-aa.test.js::enumerates every color/background pair and asserts WCAG 2.1 AA in both themes (AC-207-1)"
+    },
+    {
+      "id": "TC-236-aa-failure-message",
+      "acId": "AC-207-2",
+      "description": "When a contrast pair is below the threshold, the test failure message names the selector, state, theme, foreground colour, background colour, computed ratio and applied threshold; the test exits non-zero so the suite blocks a merge that drops below AA.",
+      "status": "pending",
+      "testPointer": "test/view/contrast-aa.test.js::failure message names selector/state/theme/fg/bg/ratio/threshold and exits non-zero (AC-207-2)"
+    },
+    {
+      "id": "TC-236-state-merge-and-boundaries",
+      "acId": "AC-207-1",
+      "description": "A state rule that changes only the background (the original `.rcf-search-btn:hover` defect) is merged over its base selector and paired with the inherited colour; `border` / `border-color` and `outline` / `outline-color` are enumerated against the adjacent surface at the 3:1 non-text threshold; run against the pre-amendment stylesheet the helper reports the dark `.rcf-search-btn:hover` failure.",
+      "status": "pending",
+      "testPointer": "test/view/contrast-aa.test.js::state rules merge over their base; borders and outlines are enumerated as 3:1 pairs (AC-207-1)"
+    },
+    {
+      "id": "TC-236-theme-btn-states",
+      "acId": "AC-207-1",
+      "description": "`.rcf-theme-btn` hover, focus-visible and active pairs exist and pass in both themes, and its focus ring clears 3:1 against the surface it sits on.",
+      "status": "pending",
+      "testPointer": "test/view/contrast-aa.test.js::.rcf-theme-btn passes WCAG 2.1 AA in both themes across hover, focus-visible and active (AC-207-1)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/user-stories/us-17302.json

@@ -39,6 +39,41 @@
       "id": "AC-17302-6",
       "description": "[must-not] given a statement whose text contains an existing REQ title and no resolvedBy, when D2 runs in 0.30.0, then skeleton:resolvedBy does not pass it on the title hit.",
       "testable": true
+    },
+    {
+      "id": "AC-17302-7",
+      "description": "[happy] (R1 2026-10-05) given rcf define ledger brief add --id 3 --text \"foo\" --kind capability on a ledger whose entry 3 already carries kind capability and text foo, when the verb runs, then it exits 0 and stdout reads 'brief-ledger: unchanged 3' (with --json, {\"status\":\"unchanged\",\"id\":3}); the file is not rewritten.",
+      "testable": true
+    },
+    {
+      "id": "AC-17302-8",
+      "description": "[failure] (R1 2026-10-05) given rcf define ledger brief add --id 3 --text \"bar\" --kind constraint on a ledger whose entry 3 carries kind capability and text foo, when the verb runs, then it exits 3 and stderr names the id and the differing fields (text, kind); the file is not rewritten.",
+      "testable": true
+    },
+    {
+      "id": "AC-17302-9",
+      "description": "[happy] (R1 2026-10-05) given rcf define ledger brief add --text \"foo\" with no --id on an empty ledger, when the verb runs, then it mints id 1 as before (idempotency opt-in is id-carried; the harness threads --id back on replay).",
+      "testable": true
+    },
+    {
+      "id": "AC-17302-10",
+      "description": "[happy] (R1 create extension 2026-10-05, PR 292 follow-up; amended on the PR 293 landing review) given rcf define create ac --parent US-1 --id AC-1-1 --description \"foo\" on a tree where US-1 already carries AC-1-1 with description foo and testable true and no other fields, when the verb runs, then it exits 0 and stdout reads 'AC-1-1: unchanged (rcf/user-stories/us-1.json)'; the parent US file is not rewritten; and given the same verb with --description \"bar\" instead, it exits 3, stderr names the id and the differing field (description), and the file is not rewritten. rcf define create has no --json flag; the stdout line is the whole output (suppressed by --quiet).",
+      "testable": true
+    },
+    {
+      "id": "AC-17302-11",
+      "description": "[happy] (R1 create extension, PR 293 landing review) given rcf define create tc --parent TS-1 --id TC-1-foo --ac AC-1-1 --description \"foo\" --test-pointer t.test.js::foo on a tree where TS-1 already carries TC-1-foo with the same acId, description, testPointer and status pending, when the verb runs, then it exits 0 and stdout reads 'TC-1-foo: unchanged (rcf/test-suites/ts-1.json)' and the file is not rewritten; given the same verb with --description \"bar\", it exits 3 naming the id and the differing field (description) and the file is not rewritten. Idempotency is id-carried: without --id, a derived-slug collision still refuses with exit 2 and the 'supply --slug explicitly' message.",
+      "testable": true
+    },
+    {
+      "id": "AC-17302-12",
+      "description": "[happy] (R1 create extension, PR 293 landing review) given rcf define create cn --id CN-1 --path src/a.js --acs AC-1-1 on a tree where CN-1 already carries path src/a.js, implementsAcIds [AC-1-1], dependencies [], version 0.1.0 and status draft, when the verb runs, then it exits 0 and stdout reads 'CN-1: unchanged (rcf/code-nodes/cn-1.json)' and the file is not rewritten; given the same verb with --path src/b.js, it exits 3 naming the id and the differing field (path) and the file is not rewritten.",
+      "testable": true
+    },
+    {
+      "id": "AC-17302-13",
+      "description": "[happy] (R1 create extension, PR 293 landing review) given rcf define create req --parent PRD-001 --id REQ-050 --title T --description D whose first run persisted a classifier-owned shapeClassification block, when the identical command is replayed, then it exits 0 and stdout reads 'REQ-050: unchanged (rcf/requirements/req-050.json)' and the file is not rewritten: the replay compare ignores every writer- and classifier-owned field (createdAt, updatedAt, shapeClassification; one exported REPLAY_IGNORE_FIELDS list in src/core/store/writer.js); given the same verb with a different --description, it exits 3 naming description and the file is not rewritten.",
+      "testable": true
     }
   ],
   "tacIds": [
@@ -46,5 +81,5 @@
   ],
   "tags": [],
   "createdAt": "2026-10-02T16:40:00Z",
-  "updatedAt": "2026-10-02T16:40:00Z"
+  "updatedAt": "2026-10-05T19:00:00Z"
 }

package/rcf/user-stories/us-17401.json

@@ -59,6 +59,16 @@
       "id": "AC-17401-10",
       "description": "src/setup/identity-seed.js IDENTITY_TEMPLATE seeds a '## Surface' section containing one line that is one of 'viewer' | 'runningApp' | 'prDiff' (default 'prDiff' with explanatory text matching the Register section's style) so that a project immediately after 'rcf init' passes checkD1Brief's profile:surface check without further operator action. The seed stays idempotent (an existing profile.md is left byte-identical, per the slice-1 'kept' contract).",
       "testable": true
+    },
+    {
+      "id": "AC-17401-11",
+      "description": "[happy] (R13 2026-10-05) given a D5 scope narrowed so no REQ is in scope but the tree has an auth or httpApi REQ and TAD.securityArchitecture is empty, when D5 runs, then crosscut:securityArchitecture still fails TAD.securityArchitecture and the stage state is failing (not notApplicable) through the shared tree-wide-before-scope helper (ADR-4138 extended).",
+      "testable": true
+    },
+    {
+      "id": "AC-17401-12",
+      "description": "[happy] (R13 2026-10-05) given a D5 scope narrowed so no REQ is in scope but the tree carries a US with an AC description that contains the '[deployed]' marker and TAD.operationalConcerns is empty, when D5 runs, then crosscut:operationalConcerns still fails TAD.operationalConcerns and the stage state is failing (not notApplicable) through the shared tree-wide-before-scope helper (ADR-4138 extended).",
+      "testable": true
     }
   ],
   "tacIds": [
@@ -66,5 +76,5 @@
   ],
   "tags": [],
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-10-01T13:03:38Z"
+  "updatedAt": "2026-10-05T18:00:00Z"
 }

package/rcf/user-stories/us-17402.json

@@ -44,6 +44,11 @@
       "id": "AC-17402-7",
       "description": "[failure] Given a notApplicable stage, when readiness is computed, then its stage:<D>:scope placeholder check carries the stage's STAGE_FALLBACK_PERSONA and ok true.",
       "testable": true
+    },
+    {
+      "id": "AC-17402-8",
+      "description": "[happy] (R13 2026-10-05) given a D2 scope narrowed so no REQ, PRD, TAD or resolving brief statement is in scope but the tree has zero Deploy target or Deploy deferral ADRs (or two or more), when D2 runs, then skeleton:deployAdr still fails ADR:deploy and the stage state is failing (not notApplicable) through the shared tree-wide-before-scope helper (ADR-4138 extended).",
+      "testable": true
     }
   ],
   "tacIds": [
@@ -51,5 +56,5 @@
   ],
   "tags": [],
   "createdAt": "2026-10-01T14:30:00Z",
-  "updatedAt": "2026-10-01T14:30:00Z"
+  "updatedAt": "2026-10-05T18:00:00Z"
 }

package/rcf/user-stories/us-17403.json

@@ -49,6 +49,16 @@
       "id": "AC-17403-8",
       "description": "[must-not] Given any tree, when D2 or D7 runs, then no check named skeleton:reqFields is emitted and the stage envelope shape (stage, gate, state, checks) is unchanged.",
       "testable": true
+    },
+    {
+      "id": "AC-17403-9",
+      "description": "[happy] (R2 2026-10-05) given a D3 scope that excludes every TAC and shaped REQ (no TAC, no httpApi/persistence/auth REQ in scope) but a [draft] marker exists on a TAC OUTSIDE the narrowed scope, when D3 runs, then shapes:draftSettled still fails the <tacId>:<name> finding and the stage state is failing (not notApplicable) through the shared tree-wide-before-scope helper (ADR-4138); the same test asserted against pre-R2 gates.js (origin/main d8adedff^) returns notApplicable instead.",
+      "testable": true
+    },
+    {
+      "id": "AC-17403-10",
+      "description": "[happy] (PR 292 follow-up 2026-10-05) given a scope-empty D3 with a failing shapes:draftSettled tree-wide, when the failing envelope the ADR-4138 helper returns is rendered by src/cli/readiness.js, then the printed D3 line reads 'D3 (define.shapes): failing' without the pre-R13 '(no TAC ... in scope)' notApplicable reason trailer; the envelope omits the reason field (foldState delegation inside the helper carries no reason text).",
+      "testable": true
     }
   ],
   "tacIds": [
@@ -56,5 +66,5 @@
   ],
   "tags": [],
   "createdAt": "2026-10-01T14:30:00Z",
-  "updatedAt": "2026-10-01T14:30:00Z"
+  "updatedAt": "2026-10-05T18:00:00Z"
 }

package/rcf/user-stories/us-17404.json

@@ -39,6 +39,21 @@
       "id": "AC-17404-6",
       "description": "[must-not] given --ack on D1, D2, D4, D7 or D8, when freeze runs, then it exits 2 unchanged from 0.29.0.",
       "testable": true
+    },
+    {
+      "id": "AC-17404-7",
+      "description": "[happy] (R5 2026-10-05) given a D3 scope narrowed so no recordShape is in scope but a coreEntity has no record shape anywhere tree-wide, when D3 runs, then shapes:entityJoin fails TAD.entity:<name> and the stage state is failing (not notApplicable); the shared tree-wide-before-scope helper (ADR-4138) governs the ordering.",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-8",
+      "description": "[happy] (R6 2026-10-05) given an interface description with path: Dockerfile and no entry for Dockerfile in resolvedPaths, when D3 runs, then shapes:pathsResolve fails it; given resolvedPaths contains Dockerfile, then it passes. The whitelist exported from gates.js names Dockerfile, Makefile, LICENSE, Procfile, Containerfile, Justfile, Rakefile, Gemfile and CODEOWNERS; a bare word outside the list (foo) still skips as before.",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-9",
+      "description": "[happy] (PR 292 follow-up 2026-10-05) given treeWideFailureEnvelope invoked on a scope-empty stage with every tree-wide check passing, when the helper runs, then it returns null (the stage proceeds to its own notApplicable envelope); given at least one failing tree-wide check on an ackable stage (D3) with a freeze.gates acknowledgement whose at.hash equals the currentTreeHash, then the helper returns an envelope with state 'acknowledged' through foldState delegation (the helper does not re-implement ack-at-current-hash); given the same shape on D2 (blocking), then the helper never folds to acknowledged.",
+      "testable": true
     }
   ],
   "tacIds": [
@@ -47,5 +62,5 @@
   ],
   "tags": [],
   "createdAt": "2026-10-03T10:50:00Z",
-  "updatedAt": "2026-10-03T10:50:00Z"
+  "updatedAt": "2026-10-05T18:00:00Z"
 }

package/rcf/user-stories/us-17405.json

@@ -32,7 +32,7 @@
     },
     {
       "id": "AC-17405-5",
-      "description": "[happy] given a registered standards pack cited in an ADR, when D2 runs, then skeleton:standardsCited passes; uncited and unwaived, it fails standards:<pack>.",
+      "description": "[happy] (R8 2026-10-05) given a registered standards pack cited in an ADR, when D2 runs, then skeleton:standardsCited passes; uncited and unwaived, it fails standards:<pack>; given a concern-ledger entry concern 'standards:<pack>' with disposition 'applied' or 'waived', it passes (the check question reads 'cited, applied or waived').",
       "testable": true
     },
     {
@@ -49,6 +49,11 @@
       "id": "AC-17405-8",
       "description": "[must-not] (PR 9 R11) given an ownerRef whose field uses dotted grammar (interfaces.loan, responsibilities.audit), when D4 or rcf define validate runs, then it fails with the finding naming the dotted field so the author can rewrite to bracket grammar.",
       "testable": true
+    },
+    {
+      "id": "AC-17405-9",
+      "description": "[happy] (R7 2026-10-05) given a D2 scope narrowed so no REQ, PRD, TAD or brief statement is in scope but a registered standards pack is neither cited nor waived tree-wide, when D2 runs, then skeleton:standardsCited fails standards:<pack> and the stage state is failing (not notApplicable); the shared tree-wide-before-scope helper (ADR-4138) governs the ordering.",
+      "testable": true
     }
   ],
   "tacIds": [
@@ -57,5 +62,5 @@
   ],
   "tags": [],
   "createdAt": "2026-10-03T13:30:00Z",
-  "updatedAt": "2026-10-03T20:30:00Z"
+  "updatedAt": "2026-10-05T12:00:00Z"
 }

package/rcf/user-stories/us-18001.json

@@ -44,6 +44,11 @@
       "id": "AC-18001-7",
       "description": "[happy] Given the tab and the CLI --json output for the same tree hash, when compared, then every id rendered on the tab appears in the JSON for that hash.",
       "testable": true
+    },
+    {
+      "id": "AC-18001-8",
+      "description": "[must-not] Given any main tab (readiness, overview, requirements, architecture, build, product-map) is the active tab, when an SSE tree-update swaps #rcf-live-content innerHTML and resyncTabsAfterSwap runs, then exactly one tabpanel is visible and it is the active tab's panel. The live-client derives the tab list from the server-rendered nav.tabs rather than carrying a parallel array that can drift from page-init: every nav.tabs [role=tab][data-tab] present at swap time is honoured. Readiness is covered as issue 297's regression.",
+      "testable": true
     }
   ],
   "tacIds": [
@@ -51,5 +56,5 @@
   ],
   "tags": [],
   "createdAt": "2026-10-01T18:00:00Z",
-  "updatedAt": "2026-10-01T18:00:00Z"
+  "updatedAt": "2026-10-06T12:00:00Z"
 }

package/rcf/user-stories/us-202.json

@@ -33,8 +33,32 @@
       "when": "a document links to another",
       "then": "the link navigates to that document's section",
       "testable": true
+    },
+    {
+      "id": "AC-202-4",
+      "description": "[happy] The audit view header keeps every main tab visible and the .tools group right of them at any viewport the chrome supports: the tablist and .tools cannot shrink below their intrinsic width (flex-shrink: 0) and .product carries the shrink budget via min-width: 0 (both on the flex item and on .product .name) so the project name ellipsizes first.",
+      "given": "the viewer rendered in the standalone (non-embed) shell",
+      "when": "any viewport >= 721px the chrome supports (above the responsive @media that re-rows the tabs under 720px)",
+      "then": "the six main tabs are fully visible and the .tools group sits right of them; .product .name ellipsizes when the project name is longer than its slot and nothing in .tools overlaps a clipped tab",
+      "testable": true
+    },
+    {
+      "id": "AC-202-5",
+      "description": "[happy] The .product .name span carries a title=\"<full name>\" attribute so hovering reveals the whole name when the ellipsis has clipped it; the title is HTML-escaped on the same path as the inner text, and when the product block collapses (no project name on the tree) no title attribute is emitted.",
+      "given": "a project tree with a projectName",
+      "when": "the viewer renders the header",
+      "then": "the .name span has title=\"<the full projectName>\" with the same HTML-escaping as the inner text",
+      "testable": true
+    },
+    {
+      "id": "AC-202-6",
+      "description": "[happy] The header display name prefers prd.productName, then manifest.projectName, then prd.productTitle. A rename via `rcf define update PRD-001 --set productName=...` therefore reaches the audit chrome without touching manifest.projectName (which the chain keeps for ids and paths).",
+      "given": "a tree where both manifest.projectName and prd.productName are set",
+      "when": "resolveProductHeader runs",
+      "then": "the header projectName is prd.productName; when the PRD carries no productName the fallback is manifest.projectName, then prd.productTitle",
+      "testable": true
     }
   ],
   "createdAt": "2026-06-25T00:00:00Z",
-  "updatedAt": "2026-07-29T13:34:38.914Z"
+  "updatedAt": "2026-10-06T10:12:07.288Z"
 }

package/rcf/user-stories/us-205.json

@@ -49,6 +49,11 @@
       "id": "AC-205-8",
       "description": "[must-not] Given the LookupModal, when the user types a query, picks a result or closes the modal, then no `postMessage` is sent to the parent window, no outbound network request beyond the `./index.json` fetch is made, and no search term is written to `localStorage` / `sessionStorage` / cookies.",
       "testable": true
+    },
+    {
+      "id": "AC-205-9",
+      "description": "[happy] Given the SearchButton (`.rcf-search-btn`) in the shell's `.tools` group, when it is rendered in either theme and in each of its states (default, `:hover`, `:focus-visible`, `:active`), then the computed foreground / background contrast ratio for the button text, the icon stroke against the background and the focus-ring colour against the adjacent surface meets WCAG 2.1 AA (>= 4.5:1 for the text, >= 3:1 for the icon and the focus-ring boundary) in both the light (`:root`) and dark (`:root[data-theme=\"dark\"]`) token sets.",
+      "testable": true
     }
   ],
   "tacIds": [
@@ -60,5 +65,5 @@
     "navigation"
   ],
   "createdAt": "2026-10-02T19:00:00Z",
-  "updatedAt": "2026-10-02T19:00:00Z"
+  "updatedAt": "2026-10-04T14:00:00Z"
 }

package/rcf/user-stories/us-206.json

@@ -5,10 +5,10 @@
   "version": "0.1.0",
   "status": "draft",
   "title": "wespa's embedding contract is proved by a CI host fixture",
-  "description": "A same-origin test-host fixture served by the viewer's dev server (route `/test-host.html` behind a `--test-host` flag or an env guard; off by default so wespa's proxy allow-list is unaffected) mimics the wespa shell: a 56px header, a resizable sidebar (64px collapsed, 200-400px expanded, user-resizable live via a drag handle), a content pane carrying an `<iframe src=\"./?embed=1&theme=light\">`. The host posts `{ type: \"rcf-view-theme\", theme: \"light\"|\"dark\" }` on a toggle control; it stores no theme itself so a passing run proves the iframe reads the message. The viewer sends no outbound postMessage. Three lints run in the test suite: (1) framing lint (`GET /` returns no `X-Frame-Options`, no CSP `frame-ancestors` that forbids same-origin, and the fixture loads the iframe without a browser error); (2) target lint (no `target=\"_top\"` string in the server-rendered HTML); (3) localStorage namespace lint (every `localStorage.{setItem,getItem,removeItem}` and shared `storage.*` call site in `src/view/**` uses a key starting with `rcf-view:v1:`). See viewer UI refresh design doc section 9 and Dex's wespa requirements of 2026-10-02.",
+  "description": "A same-origin test-host fixture served by the viewer's dev server (route `/test-host.html` behind a `--test-host` flag or an env guard; off by default so wespa's proxy allow-list is unaffected) mimics the wespa shell: a 56px header, a resizable sidebar (64px collapsed, 200-400px expanded, user-resizable live via a drag handle), a content pane carrying an `<iframe src=\"./?embed=1&theme=light\">`. The host posts `{ type: \"rcf-view-theme\", theme: \"light\"|\"dark\" }` on a toggle control; it stores no theme itself so a passing run proves the iframe reads the message. The viewer sends no outbound postMessage. Three lints run in the test suite: (1) framing lint (`GET /` returns no `X-Frame-Options`, no CSP `frame-ancestors` that forbids same-origin, and the fixture loads the iframe without a browser error); (2) target lint (no `target=\"_top\"` string in the server-rendered HTML); (3) localStorage namespace lint (every `localStorage.{setItem,getItem,removeItem}` and shared `storage.*` call site in `src/view/**` uses a key starting with `rcf-view:v1:`). Amended 2026-10-04 (w-2026-10-04-dave-001): the viewer's own three-state theme control (Light|Dark|Auto) sits right of the SearchButton in non-embed mode, is hidden entirely under `embed=1` and in non-embed mode persists its setting under `rcf-view:v1:theme` per ADR-4137 (Dave's storage ruling 2026-10-04). See viewer UI refresh design doc section 9 and section 11 recommendation 6, and Dex's wespa requirements of 2026-10-02.",
   "asA": "Dex integrating the rcf-lite viewer behind wespa's reverse proxy",
-  "iWant": "a CI host fixture that proves the viewer honours the embedding contract and three lints that keep framing, target='_top' and localStorage namespace in place over time",
-  "soThat": "regressions in the embedding contract are caught in the viewer's own suite before they reach wespa",
+  "iWant": "a CI host fixture that proves the viewer honours the embedding contract and three lints that keep framing, target='_top' and localStorage namespace in place over time; and a visible three-state theme control in the standalone viewer that is hidden under embed=1",
+  "soThat": "regressions in the embedding contract are caught in the viewer's own suite before they reach wespa, and standalone viewer users can switch theme without a URL edit",
   "acceptanceCriteria": [
     {
       "id": "AC-206-1",
@@ -39,6 +39,26 @@
       "id": "AC-206-6",
       "description": "[must-not] Given the test-host fixture and the viewer page, when either is loaded, then neither posts any outbound message beyond the host's `rcf-view-theme`; the viewer sends no `postMessage` of any shape, and the test-host adds no new postMessage shape.",
       "testable": true
+    },
+    {
+      "id": "AC-206-7",
+      "description": "[happy] Given the standalone viewer loaded without `embed=1`, when the shell paints, then a three-state theme control (`role=\"group\"`, three buttons Light|Dark|Auto with `aria-pressed`) renders in the header's `.tools` group right of the SearchButton; when a button is pressed, `<html data-theme>` is set to `light` or `dark` (or the attribute is removed for Auto so the `prefers-color-scheme` media query decides) live without a reload, and the pressed button's `aria-pressed` becomes `true` while the others become `false`.",
+      "testable": true
+    },
+    {
+      "id": "AC-206-8",
+      "description": "[happy] Given the standalone (non-embed) viewer, when a theme button is pressed, then the chosen value (`light`, `dark` or `auto`) is written to `localStorage['rcf-view:v1:theme']`; on the next page load the stored value is reapplied; the boot precedence is `?theme=` wins first, then the stored value, then the default (`auto`); and the postMessage `rcf-view-theme` listener still applies live but writes nothing to the stored key.",
+      "testable": true
+    },
+    {
+      "id": "AC-206-9",
+      "description": "[must-not] Given the viewer loaded with `?embed=1`, when the shell paints, then the three-state theme control is absent from the DOM entirely (no `[data-rcf-theme-control]` element rendered, not merely hidden by CSS), and no read or write of `localStorage['rcf-view:v1:theme']` happens on load, on a postMessage theme change, or on any user action inside the viewer.",
+      "testable": true
+    },
+    {
+      "id": "AC-206-10",
+      "description": "[happy] Given the standalone viewer with a stored value `rcf-view:v1:theme = dark`, when the URL carries `?theme=light`, then on load `<html data-theme>` is `light` (the explicit query wins) and the Light button is pressed; the stored value is left as `dark` and is reused on the next load without a `?theme=` query.",
+      "testable": true
     }
   ],
   "tacIds": [
@@ -47,8 +67,9 @@
   "tags": [
     "view",
     "embedding",
+    "theme",
     "lint"
   ],
   "createdAt": "2026-10-02T20:00:00Z",
-  "updatedAt": "2026-10-02T20:00:00Z"
+  "updatedAt": "2026-10-04T14:00:00Z"
 }

package/rcf/user-stories/us-207.json

@@ -0,0 +1,36 @@
+{
+  "usId": "US-207",
+  "prdId": "PRD-001",
+  "reqId": "REQ-002",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Every viewer text and control colour pair meets WCAG 2.1 AA in both themes",
+  "description": "A static CSS-contrast audit test parses `packages/rcf-lite/src/view/style.css`, resolves the `--sv-*` custom properties for the light (`:root`) and dark (`:root[data-theme=\"dark\"]`) token blocks, and enumerates every rule that sets `color` together with a reachable `background` / `background-color` (own rule, then the nearest ancestor surface token, default `--sv-canvas` page background). Each pair is enumerated in both themes and across every reachable state variant: default, `:hover`, `:focus`, `:focus-visible`, `:active`, `[aria-pressed=\"true\"]`, `[aria-selected=\"true\"]`, `.is-active`, `:disabled`. For each pair the WCAG relative-luminance contrast ratio is computed and asserted against the WCAG 2.1 AA thresholds (>= 4.5:1 for normal text, >= 3:1 for large text and non-text UI boundaries per WCAG 1.4.3 and 1.4.11). Pairs that cannot be resolved statically (gradients, rgba over an unknown background) are computed against the two most likely surfaces (`--sv-canvas` and the ancestor surface token) and recorded as approximate rather than skipped. The test emits a BEFORE/AFTER table under `./output/contrast-report.md` and refuses the suite on any failing pair. Scope covers the whole viewer shell, every tab, components, SearchButton and LookupModal, Readiness, Requirements, Architecture, Build (Specs and DAG), ID lookup; Mermaid and Product Map themed palettes are audited on a best-effort basis and anything bound to a third-party default is listed as a known gap with its ratio. See viewer UI refresh design doc section 9 (theme) and Baz's 2026-10-04 review (`w-2026-10-04-dave-001`).",
+  "asA": "an engineer or reviewer looking at the review surface in either theme",
+  "iWant": "every text and control colour pair in the viewer to meet WCAG 2.1 AA in both themes, pinned by a test that fails the suite when a new rule breaks the floor",
+  "soThat": "the review surface stays readable in both themes and nobody has to re-do the audit by hand on every CSS change",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-207-1",
+      "description": "[happy] Given the viewer stylesheet `src/view/style.css` and the two token blocks (`:root` and `:root[data-theme=\"dark\"]`), when the contrast test runs, then it enumerates every CSS rule that sets `color` (and every state rule merged over its base selector, so a state that changes only the background is paired with the inherited colour) paired with every reachable background (own rule, nearest ancestor surface token, page background `--sv-canvas`) and every state variant (default, `:hover`, `:focus`, `:focus-visible`, `:active`, `[aria-pressed=\"true\"]`, `[aria-selected=\"true\"]`, `.is-active`, `:disabled`), computes the WCAG relative-luminance contrast ratio for each, and asserts >= 4.5:1 for text, >= 3:1 for large text (>= 18.66px bold or >= 24px) and for non-text UI boundaries (control borders and outlines, focus rings against the adjacent colour, each enumerated as its own pair) per WCAG 1.4.3 and 1.4.11 in both the light and dark token sets.",
+      "testable": true
+    },
+    {
+      "id": "AC-207-2",
+      "description": "[failure] Given a contrast pair that falls below the applicable threshold, when the test runs, then the failure message names the selector, state, theme, foreground colour, background colour, computed ratio and the threshold applied, and the test exits non-zero so the suite blocks a merge that drops a pair below AA.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4134-wespa-host-fixture"
+  ],
+  "tags": [
+    "view",
+    "contrast",
+    "accessibility",
+    "a11y",
+    "theme"
+  ],
+  "createdAt": "2026-10-04T14:00:00Z",
+  "updatedAt": "2026-10-05T12:30:00Z"
+}

package/releases/releases.yaml

@@ -40,8 +40,27 @@
 # `npm install rcf-lite`.
 
 feedVersion: 1
-latest: "0.30.0"
+latest: "0.32.0"
 releases:
+  - version: "0.32.0"
+    date: "2026-10-06"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.32.0 fixes two readiness and freeze gates that false-tripped under schema-canonical content: D6 consistency:orphanInterfaces now accepts the object-shape REQ.deliveredBy (issue 301), and D3 shapes:pathsResolve inside rcf define freeze pre-resolves TAC interface path tokens the way readiness does (issue 302). The deploy-cloudflare-workers blueprint reworded AC-12113-2 so D6 consistency:unsatisfiable stops reading 'absent' as a field name (PR 300)."
+      - "Viewer fixes: SSE tree-update resync preserves the active tab for every main tab including Readiness (issue 297), and the audit view header keeps the six tabs visible under long project names and prefers prd.productName (issue 295)."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.31.0"
+    date: "2026-10-05"
+    breaking: true
+    headlines:
+      - "rcf-lite 0.31.0 gives the viewer a Light, Dark and Auto theme control in standalone mode and brings its text and control colours up to WCAG AA contrast in both themes, with a test that blocks any regression. Under embed=1 the control is absent, nothing is stored and the rcf-view-theme message contract is unchanged."
+      - "DEFINE step 3 rulings R1 to R13 land: tree-wide readiness checks now run before any scope short-circuit, so a narrowed scope still reports a draft marker, an unjoined core entity, an uncited standards pack, a missing Deploy ADR or an empty security or operational section anywhere in the tree. A stage whose scope is empty but whose tree-wide check fails now reads failing rather than not applicable, and the draft-settled check is tree-wide."
+      - "Write-backs that carry an id are idempotent: rcf define create <kind> --id and rcf define ledger <name> add --id exit 0 and write nothing when the same id is replayed with the same content, and exit 3 naming the differing fields when the content differs."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
   - version: "0.30.0"
     date: "2026-10-03"
     breaking: true