@openwop/openwop-conformance 2.0.0-rc.43 → 2.0.0-rc.45

package/README.md

@@ -112,7 +112,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 503 scenario files under `src/scenarios/`.
+The current suite has 505 scenario files under `src/scenarios/`.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
@@ -457,7 +457,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 503 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 505 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/cli.js

@@ -607,15 +607,24 @@ async function runCertify(args, baseUrl, apiKey) {
         const doc3 = document;
         const protocolVersions = Array.isArray(doc3['protocolVersions']) ? doc3['protocolVersions'] : [String(doc3['protocolVersion'] ?? '')];
         const preferredVersion = typeof doc3['preferredVersion'] === 'string' ? doc3['preferredVersion'] : (protocolVersions[0] ?? '');
-        // witnessCount: executed-pass rows on the profile's floor (PROFILE_FLOOR_SCENARIOS required + requiredAnyPrefix).
+        // witnessCount: witnessed executed-pass rows on the profile's floor. At major
+        // 2 the verdict already counted them against the declaration's floor
+        // (`witnessedPasses`); the v1 hand table below knows no v2 file and printed
+        // 0 for every v2 profile until rc.45 — the third unjoined floor site.
+        const verdictFor = (profile) => derived.verdicts.find((v) => v.profile === profile);
         const witnessCountFor = (profile) => {
+            if (target.major === 2)
+                return verdictFor(profile)?.witnessedPasses ?? 0;
             const floor = PROFILE_FLOOR_SCENARIOS[profile];
             if (!floor)
                 return 0;
             const onFloor = (scenario) => floor.required.includes(scenario) || (floor.requiredAnyPrefix ?? []).some((pre) => scenario.startsWith(pre));
             return derived.requirements.filter((r) => r.disposition === 'executed-pass' && onFloor(r.scenarioId)).length;
         };
-        const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
+        // `certified` IS the verdict (RFC 0148 §A; RFC 0168 §E.1 adds the bundle-wide
+        // blocked rule). Until rc.45 it was `!notHeld && !rejected && blocked === 0`
+        // and never read `certifiable` — an empty v2 floor certified on no evidence.
+        const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: (verdictFor(p)?.certifiable ?? false) && !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
         let relaxations;
         if (process.env['OPENWOP_HOST_RELAXATIONS']) {
             try {

package/dist/lib/requirement-registry.js

@@ -93,6 +93,16 @@ let v2Floors = null;
 export function setV2ProfileFloors(floors) {
     v2Floors = floors;
 }
+/**
+ * True while a major-2 floor map is installed. The v1 hand table
+ * (`PROFILE_FLOOR_SCENARIOS`) MUST NOT be consulted for any per-profile fact
+ * (`discoveryOnly`, `runtimeDerived`, the floor itself, the witness count) while
+ * this is true — every one of those reads is a floor site, and rc.41 found two
+ * of four unjoined; rc.45 found the other two.
+ */
+export function v2FloorsActive() {
+    return v2Floors !== null;
+}
 export function requirementsFor(profile, document) {
     if (v2Floors !== null) {
         const files = v2Floors[profile];

package/dist/lib/scenario-disposition.js

@@ -30,7 +30,7 @@ import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
 import { targetMajor } from './seams.js';
 import { PKG_ROOT_PATH } from './paths.js';
 import { v2ProfileFloorFiles } from './requirement-registry.js';
-import { requirementIdForScenario, requirementIdForPrefix, requirementsFor } from './requirement-registry.js';
+import { requirementIdForScenario, requirementIdForPrefix, requirementsFor, v2FloorsActive } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
 import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './spec-coherence.js';
 import { CERTIFIABLE } from './requirement-ledger.js';
@@ -220,11 +220,18 @@ document) {
         rows.push(row);
         perFile.set(file, row);
     }
-    // Prefix requirements: derived from the matching files.
+    // Prefix requirements: derived from the matching files. These are the v1 hand
+    // table's `requiredAnyPrefix` groups (`interrupt-`); at major 2 the floors are
+    // the declaration's and have no prefix groups — and the v1 `interrupt-*` files
+    // never run at major 2, so until rc.45 every major-2 bundle carried one
+    // `openwop.floor.any.interrupt-` row recorded `blocked` ("no interrupt-*
+    // scenario ran"), which by RFC 0168 §E.1 denied certification to every
+    // profile on every major-2 bundle. The fifth unjoined floor site.
     const prefixIds = new Set();
-    for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS))
-        for (const p of floor.requiredAnyPrefix ?? [])
-            prefixIds.add(p);
+    if (!v2FloorsActive())
+        for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS))
+            for (const p of floor.requiredAnyPrefix ?? [])
+                prefixIds.add(p);
     for (const prefix of [...prefixIds].sort()) {
         const matching = [...perFile.entries()].filter(([f]) => f.startsWith(prefix)).map(([, r]) => r);
         const id = requirementIdForPrefix(prefix);
@@ -293,12 +300,18 @@ document) {
         if (ids === null) {
             const floor = PROFILE_FLOOR_SCENARIOS[profile];
             const why = floor === undefined ? `(no floor defined for ${profile})` : `(discovery-conditional floor for ${profile} is unevaluable without the discovery document)`;
-            verdicts.push({ profile, unclassified: [], blocking: [why], certifiable: false, runtimeDerived: false, held: false });
+            verdicts.push({ profile, unclassified: [], blocking: [why], certifiable: false, runtimeDerived: false, held: false, witnessedPasses: 0 });
             continue;
         }
         const unclassified = [];
         const blocking = [];
         let witnessedPasses = 0;
+        // At major 2 the floor is the declaration's (`v2ProfileFloorFiles`), and
+        // the v1 hand table says nothing about these profiles: not their floor, not
+        // `discoveryOnly`, not `runtimeDerived`. Reading it here was the fourth
+        // unjoined floor site — `openwop-discovery-core` is `discoveryOnly` in v1
+        // terms, so at major 2 it certified whatever its v2 floor file said.
+        const atMajor2 = v2FloorsActive();
         for (const id of ids) {
             const r = rowById.get(id);
             const fromLedger = byId.has(id) || (r !== undefined && r.scenarioId.endsWith('*'));
@@ -320,25 +333,34 @@ document) {
             if (r === undefined || silent || vacuous)
                 unclassified.push(id);
             // Unclassified always blocks: a requirement nobody recorded cannot certify.
-            if (r === undefined || silent || vacuous || !CERTIFIABLE.includes(r.disposition))
+            // A `skipped` floor row at major 2 is an opt-in the host withheld — the
+            // suite was not allowed to look. That is not evidence the requirement
+            // holds; it blocks the floor (a v1 floor keeps the CERTIFIABLE reading).
+            if (r === undefined || silent || vacuous || !CERTIFIABLE.includes(r.disposition) || (atMajor2 && r.disposition === 'skipped'))
                 blocking.push(id);
         }
         // discoveryOnly floors have ids.length === 0 and certify by design here (the
         // requirement-ledger's verifyProfileRequirements is stricter; the runner
-        // consults PROFILE_FLOOR_SCENARIOS.discoveryOnly separately).
-        const discoveryOnly = PROFILE_FLOOR_SCENARIOS[profile]?.discoveryOnly === true;
-        const runtimeDerived = PROFILE_FLOOR_SCENARIOS[profile]?.runtimeDerived === true;
+        // consults PROFILE_FLOOR_SCENARIOS.discoveryOnly separately). Neither flag
+        // exists at major 2.
+        const discoveryOnly = !atMajor2 && PROFILE_FLOOR_SCENARIOS[profile]?.discoveryOnly === true;
+        const runtimeDerived = !atMajor2 && PROFILE_FLOOR_SCENARIOS[profile]?.runtimeDerived === true;
         // A runtime-derived profile is HELD only when every floor row is a witnessed
         // pass ("derivable from which scenarios pass" — profiles.md). Anything else
         // means the host does not hold it: not a rejection, not a blocked claim.
         const held = ids.length > 0 && witnessedPasses === ids.length;
+        // Major 2: a floor certifies only on a witnessed pass. `inapplicable` rows
+        // are honest per file (capabilities.md §2 requires the omission) but a floor
+        // that is inapplicable end to end has witnessed nothing and certifies nothing.
+        const certifiableAt2 = ids.length > 0 && blocking.length === 0 && witnessedPasses >= 1;
         verdicts.push({
             profile,
             unclassified: runtimeDerived && !held ? [] : unclassified,
             blocking: runtimeDerived && !held ? ids.filter((id) => rowById.get(id)?.disposition !== 'executed-pass' || (rowById.get(id)?.assertionCount ?? 0) === 0) : blocking,
-            certifiable: runtimeDerived ? held : discoveryOnly || (ids.length > 0 && blocking.length === 0),
+            certifiable: atMajor2 ? certifiableAt2 : runtimeDerived ? held : discoveryOnly || (ids.length > 0 && blocking.length === 0),
             runtimeDerived,
             held,
+            witnessedPasses,
         });
     }
     return { requirements: rows, totals, verdicts, rejectUnclassified: verdicts.some((v) => v.unclassified.length > 0), ledgerPresent };

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.43",
-  "stampSha256": "2737f8a4be23de309638fc248b80422ac094007293d0ffddf17776071114e5c5"
+  "version": "2.0.0-rc.45",
+  "stampSha256": "3228773ffaa82d2502ca522050d29b33b0cfa3d70b3b2a66ca8dbe6d623e42b0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.0.0-rc.43",
+  "version": "2.0.0-rc.45",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.0.0-rc.43"
+    "@openwop/spec-artifacts": "2.0.0-rc.45"
   }
 }

package/requirements.json

@@ -2,9 +2,9 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 550,
-    "tests": 2126,
-    "withStableId": 2125,
+    "files": 552,
+    "tests": 2127,
+    "withStableId": 2126,
     "interpolatedTitles": 1,
     "explicitIds": 2057
   },
@@ -26311,6 +26311,40 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-created-run-readable.a-run-created-at-this-base-is-readable-and-pollable-at-this-base-by-the-id-it-re",
+      "file": "v2-created-run-readable.test.ts",
+      "line": 63,
+      "title": "a run created at this base is readable and pollable at this base by the id it returned, and its links stay on this base",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/identity.md §5",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/events.md §Poll",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-dual-stack-negotiation.a-run-created-through-v1-runs-with-no-header-is-readable-through-runs-under-open",
       "file": "v2-dual-stack-negotiation.test.ts",
@@ -26468,7 +26502,7 @@
     {
       "id": "openwop.it.v2-effect-seam-manifest.get-host-effect-seams-validates-and-every-row-is-guarded",
       "file": "v2-effect-seam-manifest.test.ts",
-      "line": 51,
+      "line": 53,
       "title": "GET /host/effect-seams validates and every row is guarded",
       "explicitId": "openwop.requirement.0173.effect-seam-manifest",
       "citations": [
@@ -26515,7 +26549,7 @@
     {
       "id": "openwop.it.v2-effect-seam-manifest.the-replay-facet-names-the-manifest-address-as-the-constant-host-effect-seams",
       "file": "v2-effect-seam-manifest.test.ts",
-      "line": 106,
+      "line": 108,
       "title": "the replay facet names the manifest address as the constant /host/effect-seams",
       "explicitId": "openwop.requirement.0173.effect-seam-manifest.facet",
       "citations": [
@@ -26526,11 +26560,11 @@
       ]
     },
     {
-      "id": "openwop.it.v2-effect-seam-manifest.driving-one-seam-of-each-kind-observes-no-re-fire-on-replay",
-      "file": "v2-effect-seam-manifest.test.ts",
-      "line": 117,
+      "id": "openwop.it.v2-effect-seam-no-refire.driving-one-seam-of-each-kind-observes-no-re-fire-on-replay",
+      "file": "v2-effect-seam-no-refire.test.ts",
+      "line": 42,
       "title": "driving one seam of each kind observes no re-fire on replay",
-      "explicitId": "openwop.requirement.0173.effect-seam-manifest.no-re-fire",
+      "explicitId": "openwop.requirement.0173.effect-seam-no-refire",
       "citations": [
         {
           "section": "spec/v2/core/replay.md §The effect-seam manifest",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 503,
+    "files": 505,
     "v1": 445,
-    "v2": 59
+    "v2": 61
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1264,6 +1264,9 @@
     "v2-configurable-closed.test.ts": [
       2
     ],
+    "v2-created-run-readable.test.ts": [
+      2
+    ],
     "v2-dual-stack-negotiation.test.ts": [
       2
     ],
@@ -1273,6 +1276,9 @@
     "v2-effect-seam-manifest.test.ts": [
       2
     ],
+    "v2-effect-seam-no-refire.test.ts": [
+      2
+    ],
     "v2-enum-growth-rule.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.43",
+  "version": "2.0.0-rc.45",
   "corpusTag": null,
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
@@ -9,9 +9,9 @@
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "b8320186a24fb2749bcbed7e9d5c34677ea0fc5c4b83dbbcf31b263dd7a1c714",
-    "api/v2/asyncapi.yaml": "2ee29b26799ea1d180fb7b5726d968bec2f05c707dc863917011e8fd815372bf",
-    "api/v2/openapi.yaml": "895f43f227f50056104feeb680ddb5c950d61f39744076cac673b9d9c95b9ce3",
+    "api/seams-v2.yaml": "d1d2b8bb291cb2f4675470d3fe89e36fd861e8bd31e2e227d3a075ba83c214c0",
+    "api/v2/asyncapi.yaml": "493f45912c431503c1eb1d4bbe5179820f71206270f786f3284b79be1a5e64a1",
+    "api/v2/openapi.yaml": "dbcb3ec60ca4f3c7b7e2d374dcb6e851a7edb5062e3ad8ac25b5f643e193775c",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -199,7 +199,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "efae7332938c2977bf10e780061d16f33b029390c1023fe5418d6421c115d35b",
+    "spec/v1/core-standard-manifest.json": "c105757fc9d32b779b87639eaa6a83e95c5b6e855ca8fcf12f30ca0b400f3050",
     "spec/v1/deprecations.json": "1d5acb69a9b8ccb57275a95605f74aef1d920685f8407c9d382a46b59dc803bb",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -211,7 +211,7 @@
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
     "spec/v1/operation-path-manifest.json": "5f5f4e3842669371730ebbd1aace3fb794192615f0018dc144f484ba5db82ac3",
     "spec/v1/spec-gaps.json": "6cc9962c6b969f632e07a78b52a4f61447ff579e2990cbae989866f584a86042",
-    "spec/v2/declaration.json": "52b8c24a2dd463d44086129bf792ad108746f5102778cbbf0ff469fa534eca48",
+    "spec/v2/declaration.json": "c15a6a8f08ebd326d1b60398d93d7f7d5abe5c1b8284874fdb13b59f44443210",
     "spec/v2/declaration.schema.json": "b0881a76228dfbd1b85a2ec7b7259a60197f768344535cdb475db6ff719b0e54",
     "spec/v2/errors.json": "c2dd3fa0401efa0dc78da3b21e32b58a89ed5114cebdde96d3eb999a702118f0",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
@@ -229,8 +229,8 @@
     "spec/v2/id-field-bindings.json": "965814020c462ad13840b41b26f6830ac472734a1e2e5a67140fad92174c0370",
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
-    "spec/v2/profiles.json": "1f0ee40491131cf561ef19a0394c47ba476b4567514fe16befb6cada4a10a5a4",
-    "spec/v2/release.json": "2013f8d8387352a99c425038cbc98688e8b2f9de1b410b60f25478e09d05f8c0"
+    "spec/v2/profiles.json": "5019ac8209540bfbeee9c3232530d4e599be0ab926d817ff48edcec8419eb209",
+    "spec/v2/release.json": "fac42f53fe422b035cff2c0cb0a33165dbb5353fa834592ef89ff233a939798f"
   },
-  "corpusCommit": "c671cc08657877c3e26316ad8e9849670555f07a"
+  "corpusCommit": "6b79036187e096bc80a79964e1c290b0ff3c5361"
 }

package/src/cli.ts

@@ -641,14 +641,22 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     const doc3 = document as Record<string, unknown>;
     const protocolVersions = Array.isArray(doc3['protocolVersions']) ? (doc3['protocolVersions'] as string[]) : [String(doc3['protocolVersion'] ?? '')];
     const preferredVersion = typeof doc3['preferredVersion'] === 'string' ? (doc3['preferredVersion'] as string) : (protocolVersions[0] ?? '');
-    // witnessCount: executed-pass rows on the profile's floor (PROFILE_FLOOR_SCENARIOS required + requiredAnyPrefix).
+    // witnessCount: witnessed executed-pass rows on the profile's floor. At major
+    // 2 the verdict already counted them against the declaration's floor
+    // (`witnessedPasses`); the v1 hand table below knows no v2 file and printed
+    // 0 for every v2 profile until rc.45 — the third unjoined floor site.
+    const verdictFor = (profile: string) => derived.verdicts.find((v) => v.profile === profile);
     const witnessCountFor = (profile: string): number => {
+      if (target.major === 2) return verdictFor(profile)?.witnessedPasses ?? 0;
       const floor = PROFILE_FLOOR_SCENARIOS[profile];
       if (!floor) return 0;
       const onFloor = (scenario: string): boolean => floor.required.includes(scenario) || (floor.requiredAnyPrefix ?? []).some((pre) => scenario.startsWith(pre));
       return derived.requirements.filter((r) => r.disposition === 'executed-pass' && onFloor(r.scenarioId)).length;
     };
-    const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
+    // `certified` IS the verdict (RFC 0148 §A; RFC 0168 §E.1 adds the bundle-wide
+    // blocked rule). Until rc.45 it was `!notHeld && !rejected && blocked === 0`
+    // and never read `certifiable` — an empty v2 floor certified on no evidence.
+    const claimed3 = claimedProfiles.filter((p) => !(p in DEPRECATED_PROFILE_ALIASES)).map((p) => ({ id: p, evidenceTier: args.evidenceTier, witnessCount: witnessCountFor(p), certified: (verdictFor(p)?.certifiable ?? false) && !notHeld.has(p) && !rejectedProfiles.some((v) => v.profile === p) && totals3.blocked === 0 }));
     let relaxations: BundleV3['host']['relaxations'];
     if (process.env['OPENWOP_HOST_RELAXATIONS']) { try { relaxations = JSON.parse(process.env['OPENWOP_HOST_RELAXATIONS']) as BundleV3['host']['relaxations']; } catch { process.stderr.write('openwop-conformance --certify: OPENWOP_HOST_RELAXATIONS is not JSON\n'); process.exit(2); } }
     const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');

package/src/lib/requirement-registry.ts

@@ -97,6 +97,17 @@ export function setV2ProfileFloors(floors: Readonly<Record<string, readonly stri
   v2Floors = floors;
 }
 
+/**
+ * True while a major-2 floor map is installed. The v1 hand table
+ * (`PROFILE_FLOOR_SCENARIOS`) MUST NOT be consulted for any per-profile fact
+ * (`discoveryOnly`, `runtimeDerived`, the floor itself, the witness count) while
+ * this is true — every one of those reads is a floor site, and rc.41 found two
+ * of four unjoined; rc.45 found the other two.
+ */
+export function v2FloorsActive(): boolean {
+  return v2Floors !== null;
+}
+
 export function requirementsFor(profile: string, document?: Readonly<Record<string, unknown>>): readonly string[] | null {
   if (v2Floors !== null) {
     const files = v2Floors[profile];

package/src/lib/scenario-disposition.ts

@@ -31,7 +31,7 @@ import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
 import { targetMajor } from './seams.js';
 import { PKG_ROOT_PATH } from './paths.js';
 import { v2ProfileFloorFiles } from './requirement-registry.js';
-import { requirementIdForScenario, requirementIdForPrefix, requirementsFor } from './requirement-registry.js';
+import { requirementIdForScenario, requirementIdForPrefix, requirementsFor, v2FloorsActive } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
 import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './spec-coherence.js';
 import { CERTIFIABLE, type Disposition, type LedgerEntry } from './requirement-ledger.js';
@@ -213,6 +213,13 @@ export interface DerivedProfileVerdict {
   readonly runtimeDerived: boolean;
   /** For runtime-derived profiles: every floor row is a witnessed executed-pass. */
   readonly held: boolean;
+  /**
+   * Floor rows that are `executed-pass` with `assertionCount > 0` — the number
+   * of things actually witnessed. At major 2 this IS `witnessCount` on the
+   * bundle, and a profile with zero of them is not certifiable however its
+   * other rows read (RFC 0148 §A: no certification without an execution witness).
+   */
+  readonly witnessedPasses: number;
 }
 
 export interface Derivation {
@@ -274,9 +281,15 @@ export function deriveRequirementDispositions(
     perFile.set(file, row);
   }
 
-  // Prefix requirements: derived from the matching files.
+  // Prefix requirements: derived from the matching files. These are the v1 hand
+  // table's `requiredAnyPrefix` groups (`interrupt-`); at major 2 the floors are
+  // the declaration's and have no prefix groups — and the v1 `interrupt-*` files
+  // never run at major 2, so until rc.45 every major-2 bundle carried one
+  // `openwop.floor.any.interrupt-` row recorded `blocked` ("no interrupt-*
+  // scenario ran"), which by RFC 0168 §E.1 denied certification to every
+  // profile on every major-2 bundle. The fifth unjoined floor site.
   const prefixIds = new Set<string>();
-  for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS)) for (const p of floor.requiredAnyPrefix ?? []) prefixIds.add(p);
+  if (!v2FloorsActive()) for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS)) for (const p of floor.requiredAnyPrefix ?? []) prefixIds.add(p);
   for (const prefix of [...prefixIds].sort()) {
     const matching = [...perFile.entries()].filter(([f]) => f.startsWith(prefix)).map(([, r]) => r);
     const id = requirementIdForPrefix(prefix);
@@ -339,12 +352,18 @@ export function deriveRequirementDispositions(
     if (ids === null) {
       const floor = PROFILE_FLOOR_SCENARIOS[profile];
       const why = floor === undefined ? `(no floor defined for ${profile})` : `(discovery-conditional floor for ${profile} is unevaluable without the discovery document)`;
-      verdicts.push({ profile, unclassified: [], blocking: [why], certifiable: false, runtimeDerived: false, held: false });
+      verdicts.push({ profile, unclassified: [], blocking: [why], certifiable: false, runtimeDerived: false, held: false, witnessedPasses: 0 });
       continue;
     }
     const unclassified: string[] = [];
     const blocking: string[] = [];
     let witnessedPasses = 0;
+    // At major 2 the floor is the declaration's (`v2ProfileFloorFiles`), and
+    // the v1 hand table says nothing about these profiles: not their floor, not
+    // `discoveryOnly`, not `runtimeDerived`. Reading it here was the fourth
+    // unjoined floor site — `openwop-discovery-core` is `discoveryOnly` in v1
+    // terms, so at major 2 it certified whatever its v2 floor file said.
+    const atMajor2 = v2FloorsActive();
     for (const id of ids) {
       const r = rowById.get(id);
       const fromLedger = byId.has(id) || (r !== undefined && r.scenarioId.endsWith('*'));
@@ -365,24 +384,33 @@ export function deriveRequirementDispositions(
       const silent = !fromLedger && (ledgerPresent || r?.disposition === 'blocked');
       if (r === undefined || silent || vacuous) unclassified.push(id);
       // Unclassified always blocks: a requirement nobody recorded cannot certify.
-      if (r === undefined || silent || vacuous || !CERTIFIABLE.includes(r.disposition)) blocking.push(id);
+      // A `skipped` floor row at major 2 is an opt-in the host withheld — the
+      // suite was not allowed to look. That is not evidence the requirement
+      // holds; it blocks the floor (a v1 floor keeps the CERTIFIABLE reading).
+      if (r === undefined || silent || vacuous || !CERTIFIABLE.includes(r.disposition) || (atMajor2 && r.disposition === 'skipped')) blocking.push(id);
     }
     // discoveryOnly floors have ids.length === 0 and certify by design here (the
     // requirement-ledger's verifyProfileRequirements is stricter; the runner
-    // consults PROFILE_FLOOR_SCENARIOS.discoveryOnly separately).
-    const discoveryOnly = PROFILE_FLOOR_SCENARIOS[profile]?.discoveryOnly === true;
-    const runtimeDerived = PROFILE_FLOOR_SCENARIOS[profile]?.runtimeDerived === true;
+    // consults PROFILE_FLOOR_SCENARIOS.discoveryOnly separately). Neither flag
+    // exists at major 2.
+    const discoveryOnly = !atMajor2 && PROFILE_FLOOR_SCENARIOS[profile]?.discoveryOnly === true;
+    const runtimeDerived = !atMajor2 && PROFILE_FLOOR_SCENARIOS[profile]?.runtimeDerived === true;
     // A runtime-derived profile is HELD only when every floor row is a witnessed
     // pass ("derivable from which scenarios pass" — profiles.md). Anything else
     // means the host does not hold it: not a rejection, not a blocked claim.
     const held = ids.length > 0 && witnessedPasses === ids.length;
+    // Major 2: a floor certifies only on a witnessed pass. `inapplicable` rows
+    // are honest per file (capabilities.md §2 requires the omission) but a floor
+    // that is inapplicable end to end has witnessed nothing and certifies nothing.
+    const certifiableAt2 = ids.length > 0 && blocking.length === 0 && witnessedPasses >= 1;
     verdicts.push({
       profile,
       unclassified: runtimeDerived && !held ? [] : unclassified,
       blocking: runtimeDerived && !held ? ids.filter((id) => rowById.get(id)?.disposition !== 'executed-pass' || (rowById.get(id)?.assertionCount ?? 0) === 0) : blocking,
-      certifiable: runtimeDerived ? held : discoveryOnly || (ids.length > 0 && blocking.length === 0),
+      certifiable: atMajor2 ? certifiableAt2 : runtimeDerived ? held : discoveryOnly || (ids.length > 0 && blocking.length === 0),
       runtimeDerived,
       held,
+      witnessedPasses,
     });
   }
   return { requirements: rows, totals, verdicts, rejectUnclassified: verdicts.some((v) => v.unclassified.length > 0), ledgerPresent };

package/src/scenarios/v2-created-run-readable.test.ts

@@ -0,0 +1,98 @@
+/**
+ * `spec/v2/core/runs.md` §Create + `versioning.md` §1.2 — a run created at a
+ * base is readable at that base by the id the base returned, and the links in
+ * the create response stay on that base (suite 2.0.0, target major 2; unaided;
+ * creates one run).
+ *
+ * This is the assertion the suite deferred to a soft-skip. `v2-id-grammar`
+ * reads the run it just created and, on a non-200, records `blocked` — the
+ * honest word for "the host did not let me look". It is the wrong word when
+ * the host DID answer and the answer was `404 No route matches this request`,
+ * because that is not evidence going unread; it is a routing hole, and a
+ * `blocked` row over a routing hole is a vacuous pass one step removed.
+ *
+ * Measured 2026-09-05 on a tier-1 host through its public origin: a run
+ * created at `https://app.openwop.dev` under major 2 could not be read,
+ * polled, cancelled or streamed at `https://app.openwop.dev` — the hosting
+ * layer decoded the tenant-bound id's `%2F` to `/` before forwarding, and the
+ * backend correctly had no route for a literal slash. One hop behind, the
+ * direct service URL answered every read with 200. Every bound id was
+ * unreachable through the front door, and every bound-id scenario recorded
+ * `blocked`. The same create response linked `eventsUrl` and `statusUrl` to
+ * `http://<the direct service host>/…` — a client that follows them leaves the
+ * origin it discovered on and downgrades to plain http.
+ *
+ * Two hard assertions, then: the read-back MUST be 200 at the same base, and
+ * the links MUST resolve under the request's origin without a scheme
+ * downgrade — a relative path satisfies both.
+ *
+ * @see spec/v2/core/runs.md §Create
+ * @see spec/v2/core/versioning.md §1.2
+ * @see spec/v2/core/identity.md §5
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { loadEnv } from '../lib/env.js';
+import { v2Discovery } from '../lib/v2.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.requirement.0172.created-run-readable';
+const DOC = 'spec/v2/core/runs.md §Create';
+const NOOP_WORKFLOW_ID = 'conformance-noop';
+const RUN_ID = /^[A-Za-z0-9._~-]{1,128}\/[A-Za-z0-9._~-]{16,128}$/;
+
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
+  try { return await fn(); } catch { return null; }
+}
+
+/** A link is on-base when it is relative, or absolute under the request origin with the same scheme. */
+function linkOnBase(link: unknown, baseUrl: string): { ok: boolean; why: string } {
+  if (typeof link !== 'string' || link.length === 0) return { ok: false, why: 'not a non-empty string' };
+  if (link.startsWith('/')) return { ok: true, why: 'relative' };
+  let l: URL; let b: URL;
+  try { l = new URL(link); b = new URL(baseUrl); } catch { return { ok: false, why: 'not a URL' }; }
+  if (l.protocol === 'http:' && b.protocol === 'https:') return { ok: false, why: `scheme downgrade ${b.protocol} → ${l.protocol}` };
+  if (l.origin !== b.origin) return { ok: false, why: `origin ${l.origin} is not the request origin ${b.origin}` };
+  return { ok: true, why: 'same-origin absolute' };
+}
+
+describe('v2 created-run-readable (runs.md §Create)', () => {
+  it('a run created at this base is readable and pollable at this base by the id it returned, and its links stay on this base', async () => {
+    try { if (!(await v2Discovery())) return softSkip('blocked', 'v2 discovery unreachable'); } catch { return softSkip('blocked', 'v2 discovery unreachable'); }
+    const { baseUrl } = loadEnv();
+    const created = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID }));
+    if (created === null) return softSkip('blocked', 'POST /runs unreachable (fetch failed)');
+    if (created.status === 429) return softSkip('blocked', 'POST /runs answered 429 — the run budget, not the wire');
+    const body = (created.json ?? {}) as { runId?: unknown; eventsUrl?: unknown; statusUrl?: unknown };
+    if (created.status !== 201 || typeof body.runId !== 'string') return softSkip('blocked', `POST /runs {workflowId: ${NOOP_WORKFLOW_ID}} answered ${created.status} ${readErrorCode(created.json) ?? ''} — the smallest valid create was refused (fixture not seeded?)`.trim());
+    const runId = body.runId;
+    expect(RUN_ID.test(runId), req(ID, 'spec/v2/core/identity.md §5', `the created runId MUST be tenant-bound (got ${runId})`)).toBe(true);
+
+    // HARD, not soft: the base that minted the id MUST resolve it. A 404 here is
+    // not evidence going unread; it is the front door not routing its own ids.
+    const read = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`));
+    expect(
+      read?.status ?? null,
+      req(ID, DOC, `GET /runs/{runId} at the base that created the run MUST answer 200 by the id it returned — got ${read?.status ?? 'no response'} ${readErrorCode(read?.json) ?? ''}. A 404 "No route matches" for a tenant-bound id is a hosting layer decoding %2F to / before the backend sees the path: every bound id is unreachable through this base`.trim()),
+    ).toBe(200);
+    const poll = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`));
+    expect(
+      poll?.status ?? null,
+      req(ID, 'spec/v2/core/events.md §Poll', `GET /runs/{runId}/events/poll at the base that created the run MUST answer 200 — got ${poll?.status ?? 'no response'} ${readErrorCode(poll?.json) ?? ''}`.trim()),
+    ).toBe(200);
+
+    // The links in the create response MUST keep the client on this base.
+    const ev = linkOnBase(body.eventsUrl, baseUrl);
+    expect(
+      ev.ok,
+      req(ID, DOC, `eventsUrl MUST resolve under the origin the create was made to, without a scheme downgrade — a relative path satisfies both (got ${JSON.stringify(body.eventsUrl)}: ${ev.why}). A link to a different host leaves the origin the client discovered on; http on an https origin is a downgrade`),
+    ).toBe(true);
+    if (body.statusUrl !== undefined) {
+      const st = linkOnBase(body.statusUrl, baseUrl);
+      expect(st.ok, req(ID, DOC, `statusUrl, when present, MUST resolve under the request origin without a scheme downgrade (got ${JSON.stringify(body.statusUrl)}: ${st.why})`)).toBe(true);
+    }
+  });
+});

package/src/scenarios/v2-effect-seam-manifest.test.ts

@@ -12,11 +12,14 @@
  *   1. the manifest validates; every row is guarded; at least one row exists
  *      for every `kind` the host declares (the manifest is the host's own
  *      enumeration — RFC 0140 G7 answered by making the host list it);
- *   2. the facet constant equals the served address;
- *   3. driving one seam of each kind through the suite's receiver and
- *      observing no re-fire needs a seam that fires a named manifest row inside
- *      a run — none is catalogued (`host-sample-test-seams.md`,
- *      `api/seams-v2.yaml`), so that leg records `blocked` naming it.
+ *   2. the facet constant equals the served address.
+ *
+ * Both legs are unaided (a `GET` and a schema), which is what lets this file sit
+ * on the `openwop-core-standard` floor as the `replay` family's witness. The
+ * seam-driven no-re-fire leg lived here until rc.45 and moved to
+ * `v2-effect-seam-no-refire` (seams-v2 floor): a file's disposition is
+ * worst-first, so one seam-gated leg made the whole manifest witness read
+ * `blocked` on any host without the seams surface.
  *
  * Completeness of the manifest (a seam outside it) is negative-existence and is
  * not asserted here (RFC 0173 falsifiability table, §C.1 row).
@@ -26,9 +29,8 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { driver } from '../lib/driver.js';
 import { v2Discovery, gateFamily, v2Validator } from '../lib/v2.js';
-import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 
@@ -114,50 +116,4 @@ describe('RFC 0173 §C.1 — effect-seam-manifest (gated on replay)', () => {
     ).toBe(MANIFEST_PATH);
   });
 
-  it('driving one seam of each kind observes no re-fire on replay', async () => {
-    const doc = await discovery();
-    if (!doc) return softSkip('blocked', 'discovery unreachable');
-    const replay = await gateFamily('replay');
-    if (!replay) return softSkip('inapplicable', 'replay family not advertised (gate recorded under openwop.family.replay)');
-    if (!seamsProfileAdvertised(doc)) {
-      return softSkip('blocked', `the no-re-fire leg is seam-gated (RFC 0173 falsifiability §B replay row is witnessable-gated only through a seam that fires a named manifest row inside a run) — seams profile not advertised (conformance.seamsProfile)`);
-    }
-    // The seam is catalogued (api/seams-v2.yaml `fireEffectSeam`). The witness is
-    // the host's own Layer-2 ledger, not an externally reachable receiver: fire a
-    // guarded row that states `branchReFires: false`, fork the run in `replay`
-    // mode, and read GET /runs/{runId}/effects on the fork. Suppression means the
-    // fork issues no further attempt for that seam, so its effect ledger cannot
-    // grow past the parent's.
-    const manifest = await driver.get(MANIFEST_PATH);
-    const seamRows: SeamRow[] = manifest.status === 200 && manifest.json && typeof manifest.json === 'object'
-      ? ((manifest.json as Manifest).seams ?? []) : [];
-    const target = seamRows.find((r) => r.guarded === true && r.branchReFires === false);
-    if (!target) return softSkip('inapplicable', `no manifest row is both guarded and branchReFires: false — nothing to witness suppression on (${seamRows.length} row(s) at ${MANIFEST_PATH})`);
-    const fired = await driver.post(`${SEAMS_PREFIX}/sample/effect-seams/fire`, { seam: String(target.seam) });
-    if (fired.status === 404 || fired.status === 403 || fired.status === 405) {
-      return softSkip('blocked', `the host advertises the seams profile but does not serve ${SEAMS_PREFIX}/sample/effect-seams/fire (answered ${fired.status}) — the no-re-fire leg cannot be driven`);
-    }
-    const firedBody = fired.json as { runId?: unknown } | null;
-    if (fired.status !== 201 || typeof firedBody?.runId !== 'string') {
-      return softSkip('blocked', `${SEAMS_PREFIX}/sample/effect-seams/fire answered ${fired.status} without { runId } — the seam contract in api/seams-v2.yaml is 201 { runId }`);
-    }
-    const parentId = firedBody.runId;
-    const parentEffects = await driver.get(`/runs/${parentId}/effects`);
-    if (parentEffects.status !== 200) return softSkip('blocked', `GET /runs/{runId}/effects answered ${parentEffects.status} on the fired run — the ledger is the witness for suppression (RFC 0173 §C.2)`);
-    const countOf = (r: OpenWOPResponse): number => {
-      const b = r.json as { effects?: unknown } | null;
-      return Array.isArray(b?.effects) ? (b.effects as unknown[]).length : 0;
-    };
-    const forked = await driver.post(`/runs/${parentId}:fork`, { mode: 'replay' });
-    const forkBody = forked.json as { runId?: unknown } | null;
-    if (forked.status !== 201 || typeof forkBody?.runId !== 'string') {
-      return softSkip('blocked', `POST /runs/{runId}:fork mode replay answered ${forked.status} on the fired run — suppression is witnessed on the fork`);
-    }
-    const forkEffects = await driver.get(`/runs/${String(forkBody.runId)}/effects`);
-    if (forkEffects.status !== 200) return softSkip('blocked', `GET /runs/{runId}/effects answered ${forkEffects.status} on the replay fork`);
-    expect(
-      countOf(forkEffects),
-      req('openwop.requirement.0173.effect-seam-manifest.no-re-fire', 'spec/v2/core/replay.md §The effect-seam manifest', `seam ${String(target.seam)} states branchReFires: false, so a replay fork MUST NOT issue a further attempt through it — the fork's effect ledger (${countOf(forkEffects)}) cannot exceed the parent's (${countOf(parentEffects)})`),
-    ).toBeLessThanOrEqual(countOf(parentEffects));
-  });
 });

package/src/scenarios/v2-effect-seam-no-refire.test.ts

@@ -0,0 +1,88 @@
+/**
+ * RFC 0173 §C.2 — `effect-seam-no-refire` (suite 2.0.0, target major 2; gated
+ * on `replay`, driven through the seams profile).
+ *
+ * A guarded manifest row that states `branchReFires: false` MUST NOT be fired
+ * again by a replay fork: the fork's Layer-2 effect ledger cannot grow past the
+ * parent's for that seam. The witness is the host's own ledger, reached by
+ * firing a named manifest row inside a run through the catalogued seam
+ * (`api/seams-v2.yaml` `fireEffectSeam`), forking in `replay` mode, and reading
+ * `GET /runs/{runId}/effects` on both.
+ *
+ * This leg lived in `v2-effect-seam-manifest` until rc.45. It is the one leg of
+ * that file that needs the seam, and a file's disposition is worst-first — so
+ * on a host without the seams surface the whole manifest file recorded
+ * `blocked`, and the manifest witness (unaided, a `GET` and a schema) could not
+ * sit on the `openwop-core-standard` floor without dragging a seam gate onto
+ * it. Split, the manifest file is a core-standard floor witness for the
+ * `replay` family and this file is a seams-v2 floor witness; each records its
+ * own truth.
+ *
+ * @see spec/v2/core/replay.md §The effect-seam manifest
+ * @see spec/v2/core/security-defaults.md §Replay suppression
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const MANIFEST_PATH = '/host/effect-seams';
+
+interface SeamRow { seam?: unknown; kind?: unknown; guarded?: unknown; guardedBy?: unknown; branchReFires?: unknown }
+interface Manifest { manifestVersion?: unknown; seams?: SeamRow[] }
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+
+describe('RFC 0173 §C.2 — effect-seam-no-refire (gated on replay, seam-driven)', () => {
+  it('driving one seam of each kind observes no re-fire on replay', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    const replay = await gateFamily('replay');
+    if (!replay) return softSkip('inapplicable', 'replay family not advertised (gate recorded under openwop.family.replay)');
+    if (!seamsProfileAdvertised(doc)) {
+      return softSkip('blocked', `the no-re-fire leg is seam-gated (RFC 0173 falsifiability §B replay row is witnessable-gated only through a seam that fires a named manifest row inside a run) — seams profile not advertised (conformance.seamsProfile)`);
+    }
+    // The seam is catalogued (api/seams-v2.yaml `fireEffectSeam`). The witness is
+    // the host's own Layer-2 ledger, not an externally reachable receiver: fire a
+    // guarded row that states `branchReFires: false`, fork the run in `replay`
+    // mode, and read GET /runs/{runId}/effects on the fork. Suppression means the
+    // fork issues no further attempt for that seam, so its effect ledger cannot
+    // grow past the parent's.
+    const manifest = await driver.get(MANIFEST_PATH);
+    const seamRows: SeamRow[] = manifest.status === 200 && manifest.json && typeof manifest.json === 'object'
+      ? ((manifest.json as Manifest).seams ?? []) : [];
+    const target = seamRows.find((r) => r.guarded === true && r.branchReFires === false);
+    if (!target) return softSkip('inapplicable', `no manifest row is both guarded and branchReFires: false — nothing to witness suppression on (${seamRows.length} row(s) at ${MANIFEST_PATH})`);
+    const fired = await driver.post(`${SEAMS_PREFIX}/sample/effect-seams/fire`, { seam: String(target.seam) });
+    if (fired.status === 404 || fired.status === 403 || fired.status === 405) {
+      return softSkip('blocked', `the host advertises the seams profile but does not serve ${SEAMS_PREFIX}/sample/effect-seams/fire (answered ${fired.status}) — the no-re-fire leg cannot be driven`);
+    }
+    const firedBody = fired.json as { runId?: unknown } | null;
+    if (fired.status !== 201 || typeof firedBody?.runId !== 'string') {
+      return softSkip('blocked', `${SEAMS_PREFIX}/sample/effect-seams/fire answered ${fired.status} without { runId } — the seam contract in api/seams-v2.yaml is 201 { runId }`);
+    }
+    const parentId = firedBody.runId;
+    const parentEffects = await driver.get(`/runs/${encodeURIComponent(parentId)}/effects`);
+    if (parentEffects.status !== 200) return softSkip('blocked', `GET /runs/{runId}/effects answered ${parentEffects.status} on the fired run — the ledger is the witness for suppression (RFC 0173 §C.2)`);
+    const countOf = (r: OpenWOPResponse): number => {
+      const b = r.json as { effects?: unknown } | null;
+      return Array.isArray(b?.effects) ? (b.effects as unknown[]).length : 0;
+    };
+    const forked = await driver.post(`/runs/${encodeURIComponent(parentId)}:fork`, { mode: 'replay' });
+    const forkBody = forked.json as { runId?: unknown } | null;
+    if (forked.status !== 201 || typeof forkBody?.runId !== 'string') {
+      return softSkip('blocked', `POST /runs/{runId}:fork mode replay answered ${forked.status} on the fired run — suppression is witnessed on the fork`);
+    }
+    const forkEffects = await driver.get(`/runs/${encodeURIComponent(String(forkBody.runId))}/effects`);
+    if (forkEffects.status !== 200) return softSkip('blocked', `GET /runs/{runId}/effects answered ${forkEffects.status} on the replay fork`);
+    expect(
+      countOf(forkEffects),
+      req('openwop.requirement.0173.effect-seam-no-refire', 'spec/v2/core/replay.md §The effect-seam manifest', `seam ${String(target.seam)} states branchReFires: false, so a replay fork MUST NOT issue a further attempt through it — the fork's effect ledger (${countOf(forkEffects)}) cannot exceed the parent's (${countOf(parentEffects)})`),
+    ).toBeLessThanOrEqual(countOf(parentEffects));
+  });
+});