@openwop/openwop-conformance 2.0.0-rc.19 → 2.0.0-rc.28

package/README.md

@@ -112,7 +112,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 499 scenario files under `src/scenarios/`.
+The current suite has 500 scenario files under `src/scenarios/`.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
@@ -457,7 +457,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 499 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 500 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.19",
-  "stampSha256": "586fb1ee88414176538723785bdca6d0ecc5dee48cbafa8f889b7960e206d9da"
+  "version": "2.0.0-rc.28",
+  "stampSha256": "c7d6661057eca87dffb69c7d262e9b0dd6025087be2950df2007214fda6b0e57"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.0-rc.19",
+  "version": "2.0.0-rc.28",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.0-rc.19"
+    "@openwop/spec-artifacts": "2.0.0-rc.28"
   }
 }

package/requirements.json

@@ -2,9 +2,9 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 545,
-    "tests": 2119,
-    "withStableId": 2119,
+    "files": 546,
+    "tests": 2122,
+    "withStableId": 2122,
     "interpolatedTitles": 0,
     "explicitIds": 2057
   },
@@ -12262,6 +12262,58 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.era-key-stamped-v1.a-run-the-host-just-created-carries-eventlogschemaversion",
+      "file": "era-key-stamped-v1.test.ts",
+      "line": 75,
+      "title": "a run the host just created carries eventLogSchemaVersion",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "every persisted run document MUST carry an eventLogSchemaVersion — the field is prose-only (run-snapshot.schema.json requires just runId, workflowId and status), so a snapshot without it validates cleanly and only this check can see its absence",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.era-key-stamped-v1.a-freshly-created-run-is-not-classified-legacy-by-the-host-s-own-rule",
+      "file": "era-key-stamped-v1.test.ts",
+      "line": 98,
+      "title": "a freshly created run is not classified legacy by the host's own rule",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v1/version-negotiation.md §Legacy detection",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.era-key-stamped-v1.a-run-the-host-just-created-carries-engineversion-the-legacy-escape-cannot-reach",
+      "file": "era-key-stamped-v1.test.ts",
+      "line": 124,
+      "title": "a run the host just created carries engineVersion — the legacy escape cannot reach it",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": null,
+          "requirement": "every persisted run document MUST carry engineVersion; the \"MAY omit\" escape applies only to legacy runs that predate the contract, and this run was created moments ago",
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.errors.get-v1-runs-nonexistentid-returns-canonical-envelope",
       "file": "errors.test.ts",
@@ -26276,7 +26328,8 @@
         },
         {
           "section": "spec/v2/core/versioning.md §5",
-          "requirement": "the v2 read MUST name the same run"
+          "requirement": null,
+          "interpolated": true
         },
         {
           "section": "spec/v2/core/versioning.md §1.4",
@@ -26287,7 +26340,7 @@
     {
       "id": "openwop.it.v2-dual-stack-negotiation.an-unlisted-major-is-406-protocol-version-unsupported-with-details-protocolversi",
       "file": "v2-dual-stack-negotiation.test.ts",
-      "line": 83,
+      "line": 108,
       "title": "an unlisted major is 406 protocol_version_unsupported with details.protocolVersions[]",
       "explicitId": "openwop.requirement.0172.dual-stack-negotiation.unlisted-major",
       "citations": [
@@ -26311,7 +26364,7 @@
     {
       "id": "openwop.it.v2-dual-stack-negotiation.openwop-version-2-0-on-a-v1-path-is-400-protocol-version-mismatch",
       "file": "v2-dual-stack-negotiation.test.ts",
-      "line": 94,
+      "line": 119,
       "title": "OpenWOP-Version: 2.0 on a /v1/ path is 400 protocol_version_mismatch",
       "explicitId": "openwop.requirement.0172.dual-stack-negotiation.v1-path-mismatch",
       "citations": [
@@ -26330,7 +26383,7 @@
     {
       "id": "openwop.it.v2-dual-stack-negotiation.every-response-reports-the-contract-that-produced-it",
       "file": "v2-dual-stack-negotiation.test.ts",
-      "line": 103,
+      "line": 128,
       "title": "every response reports the contract that produced it",
       "explicitId": "openwop.requirement.0172.dual-stack-negotiation.response-header",
       "citations": [
@@ -28425,7 +28478,7 @@
     {
       "id": "openwop.it.version-negotiation.get-well-known-openwop-returns-capabilities-with-protocolversion-string",
       "file": "version-negotiation.test.ts",
-      "line": 46,
+      "line": 68,
       "title": "GET /.well-known/openwop returns Capabilities with protocolVersion (string)",
       "explicitId": "openwop.it.version-negotiation.get-well-known-openwop-returns-capabilities-with-protocolversion-string",
       "citations": [
@@ -28438,7 +28491,7 @@
     {
       "id": "openwop.it.version-negotiation.every-event-has-the-6-required-runeventdoc-fields-per-run-event-schema-json",
       "file": "version-negotiation.test.ts",
-      "line": 60,
+      "line": 82,
       "title": "every event has the 6 required RunEventDoc fields per run-event.schema.json",
       "explicitId": "openwop.it.version-negotiation.every-event-has-the-6-required-runeventdoc-fields-per-run-event-schema-json",
       "citations": [
@@ -28479,7 +28532,7 @@
     {
       "id": "openwop.it.version-negotiation.event-sequences-within-a-run-are-strictly-monotonic",
       "file": "version-negotiation.test.ts",
-      "line": 104,
+      "line": 126,
       "title": "event sequences within a run are strictly monotonic",
       "explicitId": "openwop.it.version-negotiation.event-sequences-within-a-run-are-strictly-monotonic",
       "citations": [
@@ -28493,7 +28546,7 @@
     {
       "id": "openwop.it.version-negotiation.events-poll-with-lastsequence-past-current-end-returns-empty-events-iscomplete",
       "file": "version-negotiation.test.ts",
-      "line": 132,
+      "line": 154,
       "title": "events/poll with lastSequence past current end returns empty events + isComplete",
       "explicitId": "openwop.it.version-negotiation.events-poll-with-lastsequence-past-current-end-returns-empty-events-iscomplete",
       "citations": [
@@ -34543,7 +34596,7 @@
     {
       "id": "openwop.it.v2-bundle-signature-attributable.the-v2-discovery-root-publishes-signingkeys-the-surface-the-rfc-named",
       "file": "v2-bundle-signature-attributable.test.ts",
-      "line": 94,
+      "line": 103,
       "title": "the v2 discovery root publishes signingKeys[] — the surface the RFC named",
       "explicitId": null,
       "citations": [
@@ -34572,7 +34625,7 @@
     {
       "id": "openwop.it.v2-bundle-signature-attributable.the-front-door-gate-verifies-the-attestation-instead-of-inspecting-the-string",
       "file": "v2-bundle-signature-attributable.test.ts",
-      "line": 125,
+      "line": 134,
       "title": "the Front-door gate verifies the attestation instead of inspecting the string",
       "explicitId": null,
       "citations": [
@@ -34591,7 +34644,7 @@
     {
       "id": "openwop.it.v2-bundle-signature-attributable.the-four-signature-outcomes-stay-distinct-collapsing-any-two-restores-the-defect",
       "file": "v2-bundle-signature-attributable.test.ts",
-      "line": 140,
+      "line": 149,
       "title": "the four signature outcomes stay distinct — collapsing any two restores the defect",
       "explicitId": null,
       "citations": [
@@ -34605,7 +34658,7 @@
     {
       "id": "openwop.it.v2-bundle-signature-attributable.signingkeys-is-reachable-from-a-v1-root-too-a-bundle-is-v3-regardless-of-major",
       "file": "v2-bundle-signature-attributable.test.ts",
-      "line": 161,
+      "line": 170,
       "title": "signingKeys[] is reachable from a v1 root too — a bundle is v3 regardless of major",
       "explicitId": null,
       "citations": [

package/scenario-majors.json

@@ -1,8 +1,8 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 499,
-    "v1": 444,
+    "files": 500,
+    "v1": 445,
     "v2": 56
   },
   "majors": {
@@ -564,6 +564,9 @@
     "envelope-variant-discriminator-static.test.ts": [
       1
     ],
+    "era-key-stamped-v1.test.ts": [
+      1
+    ],
     "errors.test.ts": [
       1
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.19",
+  "version": "2.0.0-rc.28",
   "corpusTag": null,
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
@@ -9,9 +9,9 @@
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "954d7668c34a0f6132fe427f606af73999dd5b97971d1ce1f701ff8cbbf7191c",
-    "api/v2/asyncapi.yaml": "5139025faefe214771b239a7d82b154eb225298d90017a20d28e642dc3a1d546",
-    "api/v2/openapi.yaml": "b657a099dc5c36727ee6177face4fad66a5ac6b2110de8caa1d4ae6c1900948e",
+    "api/seams-v2.yaml": "d92f0832250f7e2943304c3ebb3b4ac4d94a627a5f275a8cd29f608cae48f920",
+    "api/v2/asyncapi.yaml": "917d25c0c03d418b43b778423182de1aaa2f7b4f30a175bdeab3b7d3ffdb894a",
+    "api/v2/openapi.yaml": "ccd9e6a5dd8084c6d6c0959157f447da96fc7493cad2479abbf97b69483f9404",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -86,7 +86,7 @@
     "schemas/run-event.schema.json": "c70c06932b9831295042836213e617c8e946f20ddd49cf4e889b74d89d2175a8",
     "schemas/run-options.schema.json": "f8241ece6ddc6527de9160d811d42c231b4f77b935f2e107b3c05608545c59ab",
     "schemas/run-orchestrator-decided-event.schema.json": "17a43a3c44680a24d411141357a867b3caed6107d56de88fe2e062eaf93fa2c1",
-    "schemas/run-snapshot.schema.json": "8a45f997beec0a2fa596f4631129a869cfbc37c9ad38583530ed11655301d2ab",
+    "schemas/run-snapshot.schema.json": "3343550f6973a0975c61624df569d341e843ac8592a2aa2b3b7cf540d72563ad",
     "schemas/security-advisory.schema.json": "9c550f0bf10a3193dcca4a127081fb66fe5dc1b6f729c4c17bfaea3ba3ce05fc",
     "schemas/self-hosted-runner-dispatch-frame.schema.json": "3f1d7edd572c6747657299525d8e85329b93b6fadf670e3a19c74d53e725adec",
     "schemas/self-hosted-runner-registration.schema.json": "6c781adf1bb915a9e47796494f4a527353cbbf72b480e5a05be4aac65a6d0c6e",
@@ -198,7 +198,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "28497ea7f168ac18f721751e87ad5056579be070ef2088fa85d69282ea62cc23",
+    "spec/v1/core-standard-manifest.json": "bd06beb20cc52f8558e8b72598becb380e3159bb842f13389bcf92619f1fad23",
     "spec/v1/deprecations.json": "520d79927a8ed43ccf62c207a7cf6cf7b19b16e00bbbbdf0410667e939c19d85",
     "spec/v1/deprecations.schema.json": "4cdbbb8eb9c0092913a5704c943880f0c8581bcf0f640a7df5a84105d53c8aee",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -228,7 +228,7 @@
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "1f0ee40491131cf561ef19a0394c47ba476b4567514fe16befb6cada4a10a5a4",
-    "spec/v2/release.json": "eab43630e8b036b91589ffb275db1e172fda81c8a851fe31d833d9b54ac98e45"
+    "spec/v2/release.json": "20a6cb7efde5fcdbbc2b663976882b6dec93ec52556d422de7290e25906f2748"
   },
-  "corpusCommit": "c8d036fb1c060a77d066de932f9ae3b6e9cf76c2"
+  "corpusCommit": "e9aa9131f3d64f814b2c0ca16535675968efad76"
 }

package/src/scenarios/era-key-stamped-v1.test.ts

@@ -0,0 +1,156 @@
+/**
+ * `spec/v1/version-negotiation.md` §Stamping / §Legacy detection — the two
+ * run-document stamping MUSTs, and the legacy rule that makes their absence
+ * actively harmful (suite 2.0.0, target major 1; unaided).
+ *
+ * The rule is a v1 `MUST` and has been since the contract was written:
+ *
+ *   §Stamping        "Every persisted run document MUST carry an
+ *                     `eventLogSchemaVersion: number` field. The current v1
+ *                     value is `2`."
+ *   §Legacy detection "Hosts identify an older run document as legacy when
+ *                     `eventLogSchemaVersion` is undefined or `< 2`" … legacy
+ *                     runs have "no event subcollection … Readers MUST fall
+ *                     back to the snapshot for state."
+ *
+ * **Nothing in the suite has ever asserted it.** `version-negotiation.test.ts`
+ * opens by claiming it checks "the four version axes (`engineVersion`,
+ * `eventLogSchemaVersion`, per-event `schemaVersion`, `pinnedVersions`) appear
+ * where the spec says they should" — and `protocolVersion` is the only axis it
+ * asserts. Across all 444 v1 scenario files the sole occurrence of the
+ * identifier `eventLogSchemaVersion` was that sentence: a docstring describing
+ * a check that does not exist. **A comment claiming coverage is worse than no
+ * comment**, because it answers "is this tested?" for anyone who greps, and
+ * answers it wrongly.
+ *
+ * Both production hosts were measured on 2026-09-04 and neither stamps the
+ * field on any run it has ever served. Each found it independently, after the
+ * other published its own greps.
+ *
+ * The consequence fails in the direction that punishes correctness. A client
+ * following §Legacy detection exactly classifies every such run as legacy and
+ * reads the snapshot — **ignoring the event log the host is in fact serving**.
+ * The host under-serves the conforming reader and over-serves the careless one.
+ *
+ * Why the schema could not catch it: `run-snapshot.schema.json` requires only
+ * `runId`, `workflowId` and `status`, so a snapshot missing the field validates
+ * cleanly. The obligation is prose-only, which is exactly the shape that needs
+ * a scenario rather than a keyword.
+ *
+ * @see spec/v1/version-negotiation.md §Stamping
+ * @see spec/v1/version-negotiation.md §Legacy detection
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID_STAMPED = 'openwop.requirement.version-negotiation.era-key-stamped';
+const ID_NOT_LEGACY = 'openwop.requirement.version-negotiation.era-key-not-legacy';
+const ID_ENGINE = 'openwop.requirement.version-negotiation.engine-version-stamped';
+const DOC = 'spec/v1/version-negotiation.md §Stamping';
+
+interface Snapshot { readonly eventLogSchemaVersion?: unknown; readonly engineVersion?: unknown }
+
+/** A run this host created moments ago — the one case where "legacy" cannot apply. */
+async function freshRun(): Promise<{ runId: string } | { skip: string }> {
+  try {
+    // v1 path keys are explicit: the driver's unversioned rewrite is a major-2
+    // behaviour, and `/runs` answers 404 on a v1 host. The first version of this
+    // file used `/runs` and therefore SOFT-SKIPPED against a host that violates
+    // the rule — passing vacuously, which is the failure this scenario exists to
+    // catch, committed by the scenario itself.
+    const created = await driver.post('/v1/runs', { workflowId: 'conformance-noop', inputs: {} });
+    if (created.status !== 201) return { skip: `POST /v1/runs answered ${created.status} — no run to inspect` };
+    const runId = (created.json as { runId?: unknown } | null)?.runId;
+    if (typeof runId !== 'string') return { skip: 'POST /v1/runs returned no runId' };
+    return { runId };
+  } catch {
+    return { skip: 'POST /v1/runs unreachable' };
+  }
+}
+
+describe('era-key-stamped-v1 (version-negotiation.md §Stamping)', () => {
+  it('a run the host just created carries eventLogSchemaVersion', async () => {
+    const r = await freshRun();
+    if ('skip' in r) return softSkip('blocked', r.skip);
+
+    let snap;
+    try {
+      snap = await driver.get(`/v1/runs/${encodeURIComponent(r.runId)}`);
+    } catch {
+      return softSkip('blocked', 'GET /v1/runs/{runId} unreachable');
+    }
+    if (snap.status !== 200) return softSkip('blocked', `GET /v1/runs/{runId} answered ${snap.status}`);
+
+    const value = (snap.json as Snapshot | null)?.eventLogSchemaVersion;
+    expect(
+      value,
+      req(ID_STAMPED, DOC, 'every persisted run document MUST carry an eventLogSchemaVersion — the field is prose-only (run-snapshot.schema.json requires just runId, workflowId and status), so a snapshot without it validates cleanly and only this check can see its absence'),
+    ).not.toBeUndefined();
+    expect(
+      typeof value === 'number',
+      req(ID_STAMPED, DOC, `eventLogSchemaVersion MUST be a number (got ${JSON.stringify(value)})`),
+    ).toBe(true);
+  });
+
+  it('a freshly created run is not classified legacy by the host\'s own rule', async () => {
+    const r = await freshRun();
+    if ('skip' in r) return softSkip('blocked', r.skip);
+
+    let snap;
+    try {
+      snap = await driver.get(`/v1/runs/${encodeURIComponent(r.runId)}`);
+    } catch {
+      return softSkip('blocked', 'GET /v1/runs/{runId} unreachable');
+    }
+    if (snap.status !== 200) return softSkip('blocked', `GET /v1/runs/{runId} answered ${snap.status}`);
+    const value = (snap.json as Snapshot | null)?.eventLogSchemaVersion;
+    if (value === undefined) {
+      return softSkip('blocked', 'the field is absent — the stamping leg above records that; legacy classification cannot be judged separately from it');
+    }
+
+    // §Legacy detection: "undefined or < 2" is legacy, and a legacy run means
+    // "no event subcollection … Readers MUST fall back to the snapshot". A host
+    // that serves an event log while stamping a legacy value is telling a
+    // conforming client to ignore the log it is serving.
+    expect(
+      typeof value === 'number' && value >= 2,
+      req(ID_NOT_LEGACY, 'spec/v1/version-negotiation.md §Legacy detection', `a run created moments ago MUST NOT be legacy: legacy is "undefined or < 2", and a legacy run is specified to have no event subcollection so readers MUST fall back to the snapshot. Stamping ${JSON.stringify(value)} on a new run instructs a CONFORMING client to ignore the event log this host is serving it — the failure lands on the correct reader and spares the careless one`),
+    ).toBe(true);
+  });
+
+  it('a run the host just created carries engineVersion — the legacy escape cannot reach it', async () => {
+    const r = await freshRun();
+    if ('skip' in r) return softSkip('blocked', r.skip);
+
+    let snap;
+    try {
+      snap = await driver.get(`/v1/runs/${encodeURIComponent(r.runId)}`);
+    } catch {
+      return softSkip('blocked', 'GET /v1/runs/{runId} unreachable');
+    }
+    if (snap.status !== 200) return softSkip('blocked', `GET /v1/runs/{runId} answered ${snap.status}`);
+
+    // §Stamping: "Every persisted run document MUST carry an `engineVersion:
+    // number` field … Servers MAY omit this field on legacy runs that predate
+    // the contract." The escape is scoped to runs that PREDATE the contract, so
+    // it cannot cover a run created seconds ago — which is why this leg creates
+    // one rather than inspecting whatever happens to be in the store.
+    //
+    // Asserted here because nothing else asserts it ON A RUN: version-fold.test.ts
+    // reads engineVersion from the DISCOVERY document, and wasm-pack-load.test.ts
+    // carries it only as a type field. Both mention the identifier, so a grep
+    // suggests coverage that does not exist for this requirement.
+    const value = (snap.json as Snapshot | null)?.engineVersion;
+    expect(
+      value,
+      req(ID_ENGINE, DOC, 'every persisted run document MUST carry engineVersion; the "MAY omit" escape applies only to legacy runs that predate the contract, and this run was created moments ago'),
+    ).not.toBeUndefined();
+    expect(
+      typeof value === 'number',
+      req(ID_ENGINE, DOC, `engineVersion MUST be a number set to the writer engine's CURRENT_ENGINE_VERSION at write time (got ${JSON.stringify(value)})`),
+    ).toBe(true);
+  });
+});

package/src/scenarios/v2-dual-stack-negotiation.test.ts

@@ -76,7 +76,32 @@ describe('v2 dual-stack-negotiation (RFC 0172 §A.3–§A.4 — gated on two maj
     const read = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`, { headers: { 'OpenWOP-Version': '2.0' } }));
     if (read === null) return softSkip('blocked', 'GET /runs/{runId} unreachable (fetch failed)');
     expect(read.status, req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §5', 'the overlap: a run created through /v1/runs MUST be readable through GET /runs/{runId} with OpenWOP-Version: 2.0')).toBe(200);
-    expect((read.json as { runId?: unknown } | undefined)?.runId, req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §5', 'the v2 read MUST name the same run')).toBe(runId);
+    // NAMES the same run — not byte-identical to the v1 id.
+    //
+    // This asserted `.toBe(runId)` until 2026-09-04, which invented a
+    // requirement. `versioning.md` §5 describes the dual-stack scenario's SHAPE
+    // ("creates one run through /v1/runs … and reads it through /runs with
+    // OpenWOP-Version: 2; the response headers name the contract used") and says
+    // nothing about the identifier. `identity.md` §5 does: under major 2 a
+    // `runId` is tenant-bound `<tenantId>/<opaque>`, a grammar in
+    // `ids.schema.json`. A host implementing BOTH sections faithfully cannot
+    // satisfy byte-equality, and one turned its P4-D branch red on exactly this.
+    //
+    // The assertion tighter than its own prose is the mirror of the schema
+    // looser than its own prose: both are gaps between a check and the text it
+    // cites, and both are invisible until a host implements the text.
+    //
+    // What §5 actually requires is that the v2 read resolves to the SAME RUN.
+    // Accept the identical id (a host that does not project) or the tenant-bound
+    // projection of it (a host that does); reject anything else, which would be
+    // a different run.
+    const readId = (read.json as { runId?: unknown } | undefined)?.runId;
+    const namesSameRun =
+      readId === runId || (typeof readId === 'string' && readId.endsWith(`/${runId}`) && readId.split('/').length === 2);
+    expect(
+      namesSameRun,
+      req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §5', `the v2 read MUST name the same run: either the v1 id verbatim, or its tenant-bound projection <tenantId>/${'${runId}'} per identity.md §5. Got ${JSON.stringify(readId)} for a run created as ${JSON.stringify(runId)}`),
+    ).toBe(true);
     expect(major(read), req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §1.4', 'the v2 read MUST report the 2.x contract that produced it')).toBe('2');
   });
 

package/src/scenarios/version-negotiation.test.ts

@@ -7,9 +7,31 @@
  *
  * What we CAN test cheaply:
  *   1. Server advertises a `protocolVersion` in `Capabilities`.
- *   2. The four version axes (`engineVersion`,
- *      `eventLogSchemaVersion`, per-event `schemaVersion`,
- *      `pinnedVersions`) appear where the spec says they should.
+ *   2. `protocolVersion` is advertised, and every event carries the six
+ *      required `RunEventDoc` fields.
+ *
+ *   This file previously claimed to check "the four version axes
+ *   (`engineVersion`, `eventLogSchemaVersion`, per-event `schemaVersion`,
+ *   `pinnedVersions`)". IT DID NOT. `protocolVersion` was the only axis
+ *   asserted, and across all 444 v1 scenario files the sole occurrence of the
+ *   identifier `eventLogSchemaVersion` was that sentence — a docstring
+ *   describing a check that did not exist. A comment claiming coverage is
+ *   worse than no comment: it answers "is this tested?" for anyone who greps,
+ *   and answers it wrongly.
+ *
+ *   Current state of the four, stated so this comment can be checked rather
+ *   than trusted: `eventLogSchemaVersion` and `engineVersion` are witnessed by
+ *   `era-key-stamped-v1.test.ts` (both are run-document `MUST`s in
+ *   `version-negotiation.md` §Stamping, and both were unasserted until
+ *   2026-09-04). Per-event `schemaVersion` and `pinnedVersions` are **not
+ *   asserted here and carry no `MUST` in that document** — checked, rather
+ *   than assumed to be a gap.
+ *
+ *   This paragraph was itself wrong for one release candidate: it said
+ *   `engineVersion` "remains UNASSERTED" after the leg asserting it had
+ *   landed. A docstring that describes coverage goes stale the moment
+ *   coverage changes, which is the argument for stating what can be
+ *   re-derived rather than what was true once.
  *   3. Forward-compat read: events carrying an UNKNOWN
  *      `schemaVersion` SHOULD still be readable via the events/poll
  *      endpoint without 5xx (best-effort fold per