@openwop/openwop-conformance 2.0.0-rc.2 → 2.0.0-rc.29

package/src/scenarios/v2-advertised-path-space-served.test.ts

@@ -0,0 +1,140 @@
+/**
+ * RFC 0172 §A.1 / `spec/v2/core/versioning.md` §1.2 — a host that advertises
+ * major 2 serves the major-2 PATH SPACE, not just the major-2 discovery
+ * document (suite 2.0.0, target major 2; unaided).
+ *
+ * `v2-version-header-honored` checks that `OpenWOP-Version` is honored or
+ * refused rather than ignored. It probes `/.well-known/openwop`, because that
+ * is the one resource whose representation the header selects. **It therefore
+ * cannot see a host that negotiates correctly on the well-known resource and
+ * has mounted almost none of the rest of the v2 surface.**
+ *
+ * That is not hypothetical. A tier-1 host advertising
+ * `protocolVersions: ["1.1","2.0"]` was found serving **two of fifteen**
+ * top-level segments of the v2 path space: its unversioned mount was a
+ * deliberate allowlist (`['/runs','/interrupts']`, chosen over a blanket
+ * `/v1`-strip because the host serves a large non-`/v1` surface a blanket
+ * rewrite would shadow) and the list was simply incomplete. Every probe used to
+ * call the dual stack live — `protocolVersions`, `preferredVersion`, the
+ * response header, the two differing representations — hits `/.well-known`, so
+ * every one of them passed. `POST /webhooks` under major 2 returned `404` while
+ * `POST /v1/webhooks` returned `201`. The host found this itself by applying
+ * the artifact rule to a scenario it had first classified as a harness defect.
+ *
+ * The discriminator is a PAIR, not a single probe, because "this host does not
+ * implement webhooks at all" and "this host implements webhooks but did not
+ * mount them under major 2" are different facts that a lone `404` cannot
+ * separate:
+ *
+ *   /v1<path> exists  AND  <path> is 404 under major 2  ⇒  the advertisement
+ *   overstates: the surface exists and major 2 does not reach it.
+ *
+ *   both 404  ⇒  the host does not serve that surface in either major. Not this
+ *   scenario's business, and recorded as neither pass nor failure.
+ *
+ * Only parameterless GETs from `spec/v2/path-manifest.json` are probed: they
+ * need no fixture, mutate nothing, and a route that is not mounted answers 404
+ * regardless of auth, so the check is unaided and safe against a live host.
+ *
+ * @see spec/v2/core/versioning.md §1.2
+ * @see RFCS/0172-v2-versioning-and-release.md §A.1
+ */
+
+import { describe, it, expect } from 'vitest';
+import { loadEnv } from '../lib/env.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+
+const ID = 'openwop.requirement.0172.advertised-path-space-served';
+const DOC = 'spec/v2/core/versioning.md §1.2';
+
+/** The well-known resource is the one the HEADER selects; it has no /v1 twin to pair against. */
+const NOT_PAIRABLE = new Set(['/.well-known/openwop']);
+
+interface Probe { readonly status: number | null }
+
+async function get(path: string, major2: boolean): Promise<Probe> {
+  const { baseUrl, apiKey } = loadEnv();
+  const headers: Record<string, string> = { Accept: 'application/json' };
+  if (major2) headers['OpenWOP-Version'] = '2.0';
+  if (apiKey) headers['authorization'] = `Bearer ${apiKey}`;
+  try {
+    const res = await fetch(`${baseUrl.replace(/\/$/, '')}${path}`, { headers });
+    return { status: res.status };
+  } catch {
+    return { status: null };
+  }
+}
+
+function parameterlessGets(): string[] {
+  try {
+    const manifest = JSON.parse(
+      readFileSync(join(SCHEMAS_DIR, '..', 'spec', 'v2', 'path-manifest.json'), 'utf8'),
+    ) as { operations?: ReadonlyArray<{ method: string; path: string }> };
+    return (manifest.operations ?? [])
+      .filter((o) => o.method === 'GET' && !o.path.includes('{') && !NOT_PAIRABLE.has(o.path))
+      .map((o) => o.path)
+      .sort();
+  } catch {
+    return [];
+  }
+}
+
+describe('v2-advertised-path-space-served (RFC 0172 §A.1)', () => {
+  it('a host advertising major 2 reaches the surfaces it already serves under /v1', async () => {
+    const { baseUrl } = loadEnv();
+    const bare = await (async () => {
+      try {
+        const res = await fetch(`${baseUrl.replace(/\/$/, '')}/.well-known/openwop`, { headers: { Accept: 'application/json' } });
+        return res.status === 200 ? ((await res.json()) as Record<string, unknown>) : null;
+      } catch {
+        return null;
+      }
+    })();
+    if (!bare) return softSkip('blocked', 'the discovery document is unreadable, so the advertised majors are unknown');
+
+    const versions = Array.isArray(bare['protocolVersions']) ? (bare['protocolVersions'] as unknown[]).map(String) : [];
+    if (!new Set(versions.map((v) => v.split('.')[0])).has('2')) {
+      return softSkip('inapplicable', `the host advertises [${versions.join(', ') || 'no protocolVersions'}] — it does not claim major 2, so there is no path space to hold it to`);
+    }
+
+    const paths = parameterlessGets();
+    if (paths.length === 0) return softSkip('blocked', 'spec/v2/path-manifest.json is unreadable from this layout');
+
+    const overstated: string[] = [];
+    const served: string[] = [];
+    let pairable = 0;
+    for (const path of paths) {
+      const v1 = await get(`/v1${path}`, false);
+      if (v1.status === null) return softSkip('blocked', `the host became unreachable while probing /v1${path}`);
+      // The host does not serve this surface in EITHER major. Legitimate, and a
+      // different question from the one asked here.
+      if (v1.status === 404) continue;
+      pairable += 1;
+
+      const v2 = await get(path, true);
+      if (v2.status === null) return softSkip('blocked', `the host became unreachable while probing ${path}`);
+      // Any status but 404 means the route is MOUNTED — 401/403/422 all answer
+      // "this path exists". Only 404 says major 2 cannot reach it.
+      if (v2.status === 404) overstated.push(`${path} (/v1 → ${v1.status}, major 2 → 404)`);
+      else served.push(path);
+    }
+
+    if (pairable === 0) {
+      return softSkip('inapplicable', 'no parameterless GET in the v2 manifest is served under /v1 either, so there is no pair to compare and the advertisement cannot be checked this way');
+    }
+
+    expect(
+      overstated,
+      req(ID, DOC, `a host advertising major 2 MUST reach, under major 2, the surfaces it already serves under /v1 — advertising the major is a claim about the PATH SPACE and not only about the well-known resource, whose representation the header selects and which therefore passes even when almost nothing else is mounted (${overstated.length} of ${pairable} pairable surface(s) unreachable: ${overstated.slice(0, 6).join('; ')})`),
+    ).toEqual([]);
+
+    expect(
+      served.length,
+      req(ID, DOC, 'at least one non-well-known surface MUST be reachable under major 2, or the advertisement rests entirely on the one resource the header selects'),
+    ).toBeGreaterThan(0);
+  });
+});

package/src/scenarios/v2-dual-stack-negotiation.test.ts

@@ -76,7 +76,35 @@ describe('v2 dual-stack-negotiation (RFC 0172 §A.3–§A.4 — gated on two maj
     const read = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`, { headers: { 'OpenWOP-Version': '2.0' } }));
     if (read === null) return softSkip('blocked', 'GET /runs/{runId} unreachable (fetch failed)');
     expect(read.status, req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §5', 'the overlap: a run created through /v1/runs MUST be readable through GET /runs/{runId} with OpenWOP-Version: 2.0')).toBe(200);
-    expect((read.json as { runId?: unknown } | undefined)?.runId, req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §5', 'the v2 read MUST name the same run')).toBe(runId);
+    // The v2 read MUST name the same run BY ITS TENANT-BOUND PROJECTION.
+    //
+    // This assertion has been wrong twice, in opposite directions, and the pair
+    // is the point:
+    //
+    //   until 2026-09-04  `.toBe(runId)` — byte-equality with the v1 id, cited to
+    //                     versioning.md §5, which said nothing about identifiers.
+    //                     TIGHTER than its prose: it failed a host that had
+    //                     implemented identity.md §5 faithfully.
+    //   rc.28             accepted the bare v1 id OR its projection. LOOSER than
+    //                     its prose: `run-snapshot.schema.json` binds `runId` to
+    //                     `ids.schema.json#/$defs/runId`, whose pattern REQUIRES
+    //                     the `/`. rc.28 passed a response the v2 contract
+    //                     rejects — the same defect it was written to fix,
+    //                     committed in the act of fixing it.
+    //
+    // §5 now states the rule outright, and the reason it is a MUST is not
+    // stylistic: `identity.md` §5 requires a host to refuse a tenant-bound id
+    // whose tenant segment is not the caller's (`403 id_tenant_mismatch`). A
+    // bare id HAS no tenant segment, so that mandatory check cannot run on it.
+    // A legacy unprefixed form would be a class of ids — precisely the ones
+    // carried over from v1 — exempt from major 2's tenant isolation.
+    //
+    // So: the projection, and only the projection. A bare id here is a finding.
+    const readId = (read.json as { runId?: unknown } | undefined)?.runId;
+    expect(
+      readId,
+      req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §5', `a run minted under major 1 MUST be named by its tenant-bound projection <tenantId>/${'${the v1 id}'} when read under major 2 — the bare id is not merely unconventional, it carries no tenant segment for the mandatory 403 id_tenant_mismatch check to read (identity.md §5), and ids.schema.json#/$defs/runId has no legacy branch. Got ${JSON.stringify(readId)} for a run created as ${JSON.stringify(runId)}`),
+    ).toMatch(new RegExp(`^[A-Za-z0-9._~-]{1,128}/${runId.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`));
     expect(major(read), req('openwop.requirement.0172.dual-stack-negotiation.cross-major-read', 'spec/v2/core/versioning.md §1.4', 'the v2 read MUST report the 2.x contract that produced it')).toBe('2');
   });
 

package/src/scenarios/v2-era-2-append-vocabulary.test.ts

@@ -61,13 +61,22 @@ describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () =>
       return softSkip('blocked', `GET /runs/${runId}/events/poll answered ${before?.status ?? 'no response'} on the seeded era-2 run — the log cannot be read back`);
     }
     const seedCount = eventsOf(before).length;
+    // The seam returning ok is a WRAPPER claim; the readable log is the artifact.
+    // A seam that reports success and seeds nothing leaves no era-2 log to append
+    // to, so there is nothing here to witness the writer rule with — that is
+    // `blocked`, not a writer-rule failure. Asserting against an empty log would
+    // charge this requirement for a seam defect, which is the misattribution the
+    // suite exists to avoid.
+    if (seedCount === 0) {
+      return softSkip('blocked', `seedEra2Log reported success but the log reads back empty (0 events) — the seam's return value is not evidence that a log exists, and without a seeded era-2 log the writer rule is unwitnessed here`);
+    }
 
     // One canonical mutation so the HOST's own writer appends. Cancel is the
     // universally available terminal transition; a host that refuses it on a
     // seeded run records `blocked` rather than a pass.
-    const cancelled = await http(() => driver.post(`/runs/${encodeURIComponent(runId)}:cancel`, {}));
+    const cancelled = await http(() => driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {}));
     if (cancelled === null || (cancelled.status !== 200 && cancelled.status !== 202 && cancelled.status !== 204)) {
-      return softSkip('blocked', `POST /runs/{runId}:cancel answered ${cancelled?.status ?? 'no response'} on a seeded era-2 run — no canonical mutation drove the host's writer, so the append is unwitnessed`);
+      return softSkip('blocked', `POST /runs/{runId}/cancel answered ${cancelled?.status ?? 'no response'} on a seeded era-2 run — no canonical mutation drove the host's writer, so the append is unwitnessed`);
     }
 
     const after = await pollEvents(runId);
@@ -125,7 +134,7 @@ describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () =>
     if (!seeded.ok) return softSkip(seeded.kind, seeded.reason);
     const runId = seeded.runId;
 
-    await http(() => driver.post(`/runs/${encodeURIComponent(runId)}:cancel`, {}));
+    await http(() => driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {}));
 
     const snap = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`));
     if (snap === null || snap.status !== 200) {

package/src/scenarios/v2-era-stamp-universal.test.ts

@@ -0,0 +1,103 @@
+/**
+ * RFC 0176 §A.7 / `spec/v2/core/persistence.md` §The era key — every creation
+ * path stamps the same era, and discovery advertises that one value (suite
+ * 2.0.0, target major 2; unaided).
+ *
+ * The era trichotomy (absent ⇒ `2`, `2` = v1 era, `3` = v2 era) is sound only
+ * because a v2 host stamps `3` on EVERY run it creates. A host with more than
+ * one creation path that leaves one unstamped produces runs indistinguishable
+ * from pre-cut runs, and every reader translates them as era `2` — a silent
+ * wrong read, not an error. A tier-2 host found exactly this shape in review:
+ * one creation path writing `2`, another writing nothing, and discovery
+ * advertising `1`, a value no path wrote.
+ *
+ * This is witnessable unaided because the host's own discovery document states
+ * the value it claims to write, and a run created through the canonical path
+ * states what it actually wrote. A disagreement between them is the defect.
+ *
+ * @see spec/v2/core/persistence.md §The era key
+ * @see RFCS/0176-v2-persisted-data-and-coexistence.md §A
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.requirement.0176.era-stamp-universal';
+const DOC = 'spec/v2/core/persistence.md §The era key';
+
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try {
+    return await fn();
+  } catch {
+    return null;
+  }
+}
+
+describe('v2-era-stamp-universal (RFC 0176 §A.7)', () => {
+  it('discovery advertises an era the host actually writes, and a new run carries it', async () => {
+    const doc = await v2Discovery().catch(() => null);
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable');
+
+    const advertised = doc['eventLogSchemaVersion'];
+    if (advertised === undefined) {
+      return softSkip('inapplicable', 'the host advertises no eventLogSchemaVersion — the era axis is undeclared, so there is no claim to falsify here');
+    }
+    expect(
+      typeof advertised === 'number' && Number.isInteger(advertised),
+      req(ID, DOC, `eventLogSchemaVersion is the era key and MUST be an integer (got ${JSON.stringify(advertised)})`),
+    ).toBe(true);
+
+    const created = await http(() => driver.post('/runs', { workflowId: 'conformance-noop', inputs: {} }));
+    if (created === null || created.status !== 201) {
+      return softSkip('blocked', `POST /runs answered ${created?.status ?? 'no response'} — a run the host created is what states the era it actually writes`);
+    }
+    const runId = (created.json as { runId?: unknown } | null)?.runId;
+    if (typeof runId !== 'string') return softSkip('blocked', 'POST /runs returned no runId');
+
+    const snap = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`));
+    if (snap === null || snap.status !== 200) {
+      return softSkip('blocked', `GET /runs/{runId} answered ${snap?.status ?? 'no response'} — the snapshot is where the written era is reported`);
+    }
+    const written = (snap.json as { eventLogSchemaVersion?: unknown } | null)?.eventLogSchemaVersion;
+
+    // The snapshot field is REQUIRED on the wire and may be synthesized for an
+    // era-2 run, but a run this host just created is not era 2 — it is whatever
+    // the host writes for new runs, which is the value discovery names.
+    expect(
+      written,
+      req(ID, DOC, `the run snapshot MUST carry the era key — it is required on the wire, synthesized from absent-⇒-2 for historical runs and stated outright for a run the host just created (got ${JSON.stringify(written)})`),
+    ).not.toBeUndefined();
+
+    expect(
+      written,
+      req(ID, DOC, `discovery MUST advertise the value the host writes for new runs and nothing else: discovery says ${JSON.stringify(advertised)}, the run it just created says ${JSON.stringify(written)}. A host whose creation paths disagree has no single value to advertise, and whatever it publishes is false for some of its own runs`),
+    ).toBe(advertised);
+  });
+
+  it('a v2-era host stamps 3, so its new runs are never read as the v1 era', async () => {
+    const doc = await v2Discovery().catch(() => null);
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable');
+    const advertised = doc['eventLogSchemaVersion'];
+    if (advertised === undefined) return softSkip('inapplicable', 'the host advertises no eventLogSchemaVersion');
+    if (advertised !== 3) {
+      return softSkip('inapplicable', `the host advertises era ${JSON.stringify(advertised)}, not 3 — this scenario checks that the advertised value AGREES with what the creation paths write, whatever that value is. Whether it MUST be 3 is v2-era-key's assertion, not this one; a host reached under target major 2 is a v2 host and persistence.md requires 3 there`);
+    }
+
+    const created = await http(() => driver.post('/runs', { workflowId: 'conformance-noop', inputs: {} }));
+    if (created === null || created.status !== 201) {
+      return softSkip('blocked', `POST /runs answered ${created?.status ?? 'no response'}`);
+    }
+    const runId = (created.json as { runId?: unknown } | null)?.runId;
+    if (typeof runId !== 'string') return softSkip('blocked', 'POST /runs returned no runId');
+    const snap = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`));
+    if (snap === null || snap.status !== 200) return softSkip('blocked', `GET /runs/{runId} answered ${snap?.status ?? 'no response'}`);
+
+    expect(
+      (snap.json as { eventLogSchemaVersion?: unknown } | null)?.eventLogSchemaVersion,
+      req(ID, DOC, 'a host advertising era 3 MUST stamp 3 on every run it creates — an unstamped run made after the cut is indistinguishable from a pre-cut run and every reader translates it as era 2, which is a silent wrong read rather than an error'),
+    ).toBe(3);
+  });
+});

package/src/scenarios/v2-interrupt-token-scheme.test.ts

@@ -40,7 +40,7 @@ describe('v2 interrupt-token-scheme (RFC 0170 §E.1)', () => {
     if (res === null) return softSkip('blocked', 'GET /interrupts/{token} unreachable (fetch failed)');
     expect([401, 404].includes(res.status), req('openwop.requirement.0170.interrupt-token-scheme.unprefixed-refused', DOC, `a token outside the ow2.<alg>.<kid>.<payload>.<mac> grammar MUST NOT resolve — 401 interrupt_token_invalid (or 404 not_found where the signed-token surface is not mounted); got ${res.status}`)).toBe(true);
     const code = readErrorCode(res.json);
-    expect(res.status === 401 ? code === 'interrupt_token_invalid' : code === 'not_found', req('openwop.requirement.0170.interrupt-token-scheme.unprefixed-refused', 'spec/v2/core/interrupt.md §Tokens', `the refusal MUST carry its registered code (401 → interrupt_token_invalid, 404 → not_found); got ${String(code)}`)).toBe(true);
+    expect(res.status === 401 ? code === 'interrupt_token_invalid' : (code === 'not_found' || code === 'interrupt_not_found'), req('openwop.requirement.0170.interrupt-token-scheme.unprefixed-refused', 'spec/v2/core/interrupt.md §Tokens', `the refusal MUST carry a registered code (401 → interrupt_token_invalid; 404 → not_found OR the more precise interrupt_not_found, both registered in spec/v2/errors.json for this state — a scenario narrower than its own registry fails the host that answers more precisely); got ${String(code)}`)).toBe(true);
   });
 
   it('a well-formed token under a kid the host does not hold is 401 interrupt_token_invalid', async () => {

package/src/scenarios/v2-version-header-honored.test.ts

@@ -0,0 +1,124 @@
+/**
+ * RFC 0172 §A.3 — the `OpenWOP-Version` header is HONORED or REFUSED, never
+ * ignored (suite 2.0.0, target major 2; unaided).
+ *
+ * A host that does not implement v2 has two correct answers to
+ * `OpenWOP-Version: 2`: serve the v2 representation, or refuse with `406
+ * protocol_version_unsupported`. There is a third thing it can do, and it is
+ * the dangerous one — return `200` with the v1 document, ignoring the header
+ * entirely.
+ *
+ * That third case is invisible to every presence-gated scenario in the suite.
+ * A scenario that skips when a v2 shape is absent records `inapplicable`
+ * whether the host REFUSED major 2 or silently handed back v1; both are
+ * non-failures, so a bundle looks clean while witnessing nothing. This is not
+ * hypothetical: it is the shape that let RFC 0165 sit `Accepted` on a host
+ * that served none of it — the acceptance cited merged PRs, the gated
+ * scenarios recorded `inapplicable`, and nothing in the chain ever compared
+ * the two representations. Measured on a live tier-1 host 2026-09-04:
+ * `OpenWOP-Version: 2` returned `200` with a body byte-identical to the
+ * header-less fetch. Credit to the openwop-app session for the probe.
+ *
+ * The check is cheap and needs no v2 support: fetch the resource twice, once
+ * with the header and once without. A host advertising two majors MUST NOT
+ * return the same bytes for both, because the two representations differ by
+ * construction (`capabilities.md` §1). A host advertising one major MUST
+ * refuse rather than ignore.
+ *
+ * @see spec/v2/core/versioning.md §1.3
+ * @see RFCS/0172-v2-versioning-and-release.md §A.3
+ */
+
+import { describe, it, expect } from 'vitest';
+import { loadEnv } from '../lib/env.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.requirement.0172.version-header-honored';
+const DOC = 'spec/v2/core/versioning.md §1.3';
+const PATH = '/.well-known/openwop';
+
+interface Fetched {
+  readonly status: number;
+  readonly body: string;
+  readonly version: string | null;
+}
+
+async function fetchRepresentation(header: string | null): Promise<Fetched | null> {
+  const { baseUrl, apiKey } = loadEnv();
+  const headers: Record<string, string> = { Accept: 'application/json' };
+  if (header !== null) headers['OpenWOP-Version'] = header;
+  if (apiKey) headers['authorization'] = `Bearer ${apiKey}`;
+  try {
+    const res = await fetch(`${baseUrl.replace(/\/$/, '')}${PATH}`, { headers });
+    return { status: res.status, body: await res.text(), version: res.headers.get('openwop-version') };
+  } catch {
+    return null;
+  }
+}
+
+describe('v2-version-header-honored (RFC 0172 §A.3)', () => {
+  it('OpenWOP-Version is honored or refused — never ignored', async () => {
+    const bare = await fetchRepresentation(null);
+    const asked = await fetchRepresentation('2.0');
+    if (bare === null || asked === null) {
+      return softSkip('blocked', `${PATH} unreachable for one of the two probes — the comparison needs both`);
+    }
+    if (bare.status !== 200) {
+      return softSkip('blocked', `the header-less GET ${PATH} answered ${bare.status}; there is no baseline representation to compare against`);
+    }
+
+    // A refusal is a correct answer and ends the check: the host has told the
+    // truth about not serving major 2.
+    if (asked.status === 406) {
+      expect(
+        asked.status,
+        req(ID, DOC, 'a host that does not serve major 2 MUST refuse with 406 protocol_version_unsupported, which it did'),
+      ).toBe(406);
+      return softSkip('inapplicable', 'the host refused major 2 with the specified 406 — a correct answer, and there is no second representation to compare bytes against');
+    }
+    if (asked.status !== 200) {
+      return softSkip('blocked', `GET ${PATH} with OpenWOP-Version: 2.0 answered ${asked.status} — neither the v2 representation (200) nor the specified refusal (406), so this scenario cannot rule on it`);
+    }
+
+    // 200 means the host claims to have served major 2. The bytes decide
+    // whether it actually did.
+    expect(
+      asked.body === bare.body,
+      req(ID, DOC, `answering 200 to OpenWOP-Version: 2.0 with a body byte-identical to the header-less fetch means the header was IGNORED, not honored — the host served v1 and called it v2. Refusing with 406 is the correct answer for a host that does not implement major 2; silently returning v1 is the one answer that no presence-gated scenario can detect, because an absent v2 shape records \`inapplicable\` whether the host refused or ignored`),
+    ).toBe(false);
+  });
+
+  it('a host advertising two majors serves two different representations', async () => {
+    const bare = await fetchRepresentation(null);
+    if (bare === null || bare.status !== 200) {
+      return softSkip('blocked', `the header-less GET ${PATH} answered ${bare?.status ?? 'no response'}`);
+    }
+    let doc: Record<string, unknown>;
+    try {
+      doc = JSON.parse(bare.body) as Record<string, unknown>;
+    } catch {
+      return softSkip('blocked', `${PATH} did not return a JSON object`);
+    }
+    const versions = Array.isArray(doc['protocolVersions']) ? (doc['protocolVersions'] as unknown[]).map(String) : [];
+    const majors = new Set(versions.map((v) => v.split('.')[0]));
+    if (!(majors.has('1') && majors.has('2'))) {
+      return softSkip('inapplicable', `the host advertises [${versions.join(', ') || 'no protocolVersions'}] — one major or none, so there is no second representation to differ from`);
+    }
+
+    const asked = await fetchRepresentation('2.0');
+    if (asked === null) return softSkip('blocked', `${PATH} unreachable under OpenWOP-Version: 2.0`);
+    expect(
+      asked.status,
+      req(ID, DOC, `a host advertising both majors MUST serve major 2 when asked for it, not refuse (got ${asked.status})`),
+    ).toBe(200);
+    expect(
+      asked.body === bare.body,
+      req(ID, DOC, 'the v1 document and the closed v2 root differ by construction (capabilities.md §1), so a host advertising both majors returning identical bytes for both has advertised a major it does not actually serve'),
+    ).toBe(false);
+    expect(
+      asked.version?.trim().split('.')[0] ?? null,
+      req(ID, DOC, `the response to OpenWOP-Version: 2.0 MUST carry OpenWOP-Version naming the major it served (got ${String(asked.version)})`),
+    ).toBe('2');
+  });
+});

package/src/scenarios/version-negotiation.test.ts

@@ -7,9 +7,31 @@
  *
  * What we CAN test cheaply:
  *   1. Server advertises a `protocolVersion` in `Capabilities`.
- *   2. The four version axes (`engineVersion`,
- *      `eventLogSchemaVersion`, per-event `schemaVersion`,
- *      `pinnedVersions`) appear where the spec says they should.
+ *   2. `protocolVersion` is advertised, and every event carries the six
+ *      required `RunEventDoc` fields.
+ *
+ *   This file previously claimed to check "the four version axes
+ *   (`engineVersion`, `eventLogSchemaVersion`, per-event `schemaVersion`,
+ *   `pinnedVersions`)". IT DID NOT. `protocolVersion` was the only axis
+ *   asserted, and across all 444 v1 scenario files the sole occurrence of the
+ *   identifier `eventLogSchemaVersion` was that sentence — a docstring
+ *   describing a check that did not exist. A comment claiming coverage is
+ *   worse than no comment: it answers "is this tested?" for anyone who greps,
+ *   and answers it wrongly.
+ *
+ *   Current state of the four, stated so this comment can be checked rather
+ *   than trusted: `eventLogSchemaVersion` and `engineVersion` are witnessed by
+ *   `era-key-stamped-v1.test.ts` (both are run-document `MUST`s in
+ *   `version-negotiation.md` §Stamping, and both were unasserted until
+ *   2026-09-04). Per-event `schemaVersion` and `pinnedVersions` are **not
+ *   asserted here and carry no `MUST` in that document** — checked, rather
+ *   than assumed to be a gap.
+ *
+ *   This paragraph was itself wrong for one release candidate: it said
+ *   `engineVersion` "remains UNASSERTED" after the leg asserting it had
+ *   landed. A docstring that describes coverage goes stale the moment
+ *   coverage changes, which is the argument for stating what can be
+ *   re-derived rather than what was true once.
  *   3. Forward-compat read: events carrying an UNKNOWN
  *      `schemaVersion` SHOULD still be readable via the events/poll
  *      endpoint without 5xx (best-effort fold per