@openwop/openwop-conformance 2.0.0-rc.8 → 2.0.0

package/src/lib/scenario-disposition.ts

@@ -28,7 +28,10 @@
 
 import { scenarioFileOfItId } from './requirement-ids.js';
 import { PROFILE_FLOOR_SCENARIOS } from './profiles.js';
-import { requirementIdForScenario, requirementIdForPrefix, requirementsFor } from './requirement-registry.js';
+import { targetMajor } from './seams.js';
+import { PKG_ROOT_PATH } from './paths.js';
+import { v2ProfileFloorFiles } from './requirement-registry.js';
+import { requirementIdForScenario, requirementIdForPrefix, requirementsFor, v2FloorsActive } from './requirement-registry.js';
 import { UNCLASSIFIED_RETURN_DETAIL } from './soft-skip.js';
 import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './spec-coherence.js';
 import { CERTIFIABLE, type Disposition, type LedgerEntry } from './requirement-ledger.js';
@@ -40,6 +43,20 @@ export function floorScenarioFiles(): ReadonlySet<string> {
     for (const f of floor.required) out.add(f);
     for (const c of floor.conditional ?? []) for (const f of c.required) out.add(f);
   }
+  // At target major 2 the floors come from the declaration, not the v1 hand
+  // table. The ledger and --certify MUST agree on this set, or a floor file is
+  // minted `openwop.scenario.*` and looked up as `openwop.floor.*` — which is
+  // exactly what refused a tier-1 host's first production bundle over 101
+  // executed-pass rows (see v2ProfileFloorFiles).
+  //
+  // rc.55: the runner installs the v2 floor map (`setV2ProfileFloors`) but
+  // reads `targetMajor()` from ITS OWN process.env, which `--target-major 2`
+  // never set — so the worker (env set) minted `openwop.floor.v2-…` and the
+  // runner (env unset) looked up `openwop.scenario.v2-…`. Either signal is
+  // the same fact; honour both so the two halves cannot disagree again.
+  if (targetMajor() === 2 || v2FloorsActive()) {
+    for (const files of Object.values(v2ProfileFloorFiles(PKG_ROOT_PATH))) for (const f of files) out.add(f);
+  }
   return out;
 }
 
@@ -62,6 +79,40 @@ export const PARTIAL_WITNESS_PREFIX = 'partial-witness: ';
 
 export type FileTestState = 'pass' | 'fail' | 'skip';
 
+/**
+ * The per-`it` record (RFC 0148 §A at test granularity), as `setup.ts`
+ * computes it in `afterEach`. Pure so a lib test can pin it:
+ *   - fail                         ⇒ executed-fail (detail = the first error message)
+ *   - pass with ≥ 1 assertion      ⇒ executed-pass
+ *   - a behaviorGate entry journaled during the test ⇒ that gate's disposition
+ *   - pass with 0 assertions       ⇒ the softSkip note written DURING THIS TEST
+ *                                    (`inapplicable` / `skipped` / `blocked`, worst-first),
+ *                                    else `blocked` + the unclassified-return marker
+ *   - vitest skip (ctx.skip / it.skip) ⇒ the note written before the skip, else `skipped`
+ *
+ * rc.56: the fourth line is new. Until then a zero-assertion pass consulted the
+ * journal only, so a leg that returned `softSkip('inapplicable', …)` was
+ * recorded `blocked / unclassified return` at `it` granularity while its file
+ * row (which does read the notes — `resolveFileRecord`) was `inapplicable`.
+ * A bundle with any `blocked` row does not certify (RFC 0168 §E.1), so the
+ * dishonest per-`it` rows denied certification to every profile on a host that
+ * simply did not advertise the gated surface.
+ */
+export function resolveItRecord(
+  state: FileTestState,
+  assertionCalls: number,
+  gate: { disposition: 'inapplicable' | 'skipped'; detail?: string } | undefined,
+  noted: { kind: 'inapplicable' | 'skipped' | 'blocked'; reason: string } | null,
+  firstError?: string,
+): { disposition: Disposition; detail?: string } {
+  if (state === 'fail') return { disposition: 'executed-fail', detail: `the test executed and failed: ${(firstError ?? 'no message').slice(0, 300)}` };
+  if (state === 'pass' && assertionCalls > 0) return { disposition: 'executed-pass' };
+  if (gate !== undefined) return { disposition: gate.disposition, detail: gate.detail ?? `${gate.disposition} (gate recorded no reason)` };
+  if (noted !== null) return { disposition: noted.kind, detail: noted.reason };
+  if (state === 'pass') return { disposition: 'blocked', detail: 'unclassified return: the test passed with zero assertions and recorded no reason — RFC 0148 §A resolves it to blocked, never to a pass' };
+  return { disposition: 'skipped', detail: 'vitest skipped the test (ctx.skip / it.skip) without a recorded gate reason' };
+}
+
 /** Worker half: fold a file's per-test states (+ any gate-recorded reason) into
  *  the ONE disposition the file records. */
 export function fileDisposition(
@@ -202,6 +253,13 @@ export interface DerivedProfileVerdict {
   readonly runtimeDerived: boolean;
   /** For runtime-derived profiles: every floor row is a witnessed executed-pass. */
   readonly held: boolean;
+  /**
+   * Floor rows that are `executed-pass` with `assertionCount > 0` — the number
+   * of things actually witnessed. At major 2 this IS `witnessCount` on the
+   * bundle, and a profile with zero of them is not certifiable however its
+   * other rows read (RFC 0148 §A: no certification without an execution witness).
+   */
+  readonly witnessedPasses: number;
 }
 
 export interface Derivation {
@@ -263,9 +321,15 @@ export function deriveRequirementDispositions(
     perFile.set(file, row);
   }
 
-  // Prefix requirements: derived from the matching files.
+  // Prefix requirements: derived from the matching files. These are the v1 hand
+  // table's `requiredAnyPrefix` groups (`interrupt-`); at major 2 the floors are
+  // the declaration's and have no prefix groups — and the v1 `interrupt-*` files
+  // never run at major 2, so until rc.45 every major-2 bundle carried one
+  // `openwop.floor.any.interrupt-` row recorded `blocked` ("no interrupt-*
+  // scenario ran"), which by RFC 0168 §E.1 denied certification to every
+  // profile on every major-2 bundle. The fifth unjoined floor site.
   const prefixIds = new Set<string>();
-  for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS)) for (const p of floor.requiredAnyPrefix ?? []) prefixIds.add(p);
+  if (!v2FloorsActive()) for (const floor of Object.values(PROFILE_FLOOR_SCENARIOS)) for (const p of floor.requiredAnyPrefix ?? []) prefixIds.add(p);
   for (const prefix of [...prefixIds].sort()) {
     const matching = [...perFile.entries()].filter(([f]) => f.startsWith(prefix)).map(([, r]) => r);
     const id = requirementIdForPrefix(prefix);
@@ -328,12 +392,18 @@ export function deriveRequirementDispositions(
     if (ids === null) {
       const floor = PROFILE_FLOOR_SCENARIOS[profile];
       const why = floor === undefined ? `(no floor defined for ${profile})` : `(discovery-conditional floor for ${profile} is unevaluable without the discovery document)`;
-      verdicts.push({ profile, unclassified: [], blocking: [why], certifiable: false, runtimeDerived: false, held: false });
+      verdicts.push({ profile, unclassified: [], blocking: [why], certifiable: false, runtimeDerived: false, held: false, witnessedPasses: 0 });
       continue;
     }
     const unclassified: string[] = [];
     const blocking: string[] = [];
     let witnessedPasses = 0;
+    // At major 2 the floor is the declaration's (`v2ProfileFloorFiles`), and
+    // the v1 hand table says nothing about these profiles: not their floor, not
+    // `discoveryOnly`, not `runtimeDerived`. Reading it here was the fourth
+    // unjoined floor site — `openwop-discovery-core` is `discoveryOnly` in v1
+    // terms, so at major 2 it certified whatever its v2 floor file said.
+    const atMajor2 = v2FloorsActive();
     for (const id of ids) {
       const r = rowById.get(id);
       const fromLedger = byId.has(id) || (r !== undefined && r.scenarioId.endsWith('*'));
@@ -354,24 +424,33 @@ export function deriveRequirementDispositions(
       const silent = !fromLedger && (ledgerPresent || r?.disposition === 'blocked');
       if (r === undefined || silent || vacuous) unclassified.push(id);
       // Unclassified always blocks: a requirement nobody recorded cannot certify.
-      if (r === undefined || silent || vacuous || !CERTIFIABLE.includes(r.disposition)) blocking.push(id);
+      // A `skipped` floor row at major 2 is an opt-in the host withheld — the
+      // suite was not allowed to look. That is not evidence the requirement
+      // holds; it blocks the floor (a v1 floor keeps the CERTIFIABLE reading).
+      if (r === undefined || silent || vacuous || !CERTIFIABLE.includes(r.disposition) || (atMajor2 && r.disposition === 'skipped')) blocking.push(id);
     }
     // discoveryOnly floors have ids.length === 0 and certify by design here (the
     // requirement-ledger's verifyProfileRequirements is stricter; the runner
-    // consults PROFILE_FLOOR_SCENARIOS.discoveryOnly separately).
-    const discoveryOnly = PROFILE_FLOOR_SCENARIOS[profile]?.discoveryOnly === true;
-    const runtimeDerived = PROFILE_FLOOR_SCENARIOS[profile]?.runtimeDerived === true;
+    // consults PROFILE_FLOOR_SCENARIOS.discoveryOnly separately). Neither flag
+    // exists at major 2.
+    const discoveryOnly = !atMajor2 && PROFILE_FLOOR_SCENARIOS[profile]?.discoveryOnly === true;
+    const runtimeDerived = !atMajor2 && PROFILE_FLOOR_SCENARIOS[profile]?.runtimeDerived === true;
     // A runtime-derived profile is HELD only when every floor row is a witnessed
     // pass ("derivable from which scenarios pass" — profiles.md). Anything else
     // means the host does not hold it: not a rejection, not a blocked claim.
     const held = ids.length > 0 && witnessedPasses === ids.length;
+    // Major 2: a floor certifies only on a witnessed pass. `inapplicable` rows
+    // are honest per file (capabilities.md §2 requires the omission) but a floor
+    // that is inapplicable end to end has witnessed nothing and certifies nothing.
+    const certifiableAt2 = ids.length > 0 && blocking.length === 0 && witnessedPasses >= 1;
     verdicts.push({
       profile,
       unclassified: runtimeDerived && !held ? [] : unclassified,
       blocking: runtimeDerived && !held ? ids.filter((id) => rowById.get(id)?.disposition !== 'executed-pass' || (rowById.get(id)?.assertionCount ?? 0) === 0) : blocking,
-      certifiable: runtimeDerived ? held : discoveryOnly || (ids.length > 0 && blocking.length === 0),
+      certifiable: atMajor2 ? certifiableAt2 : runtimeDerived ? held : discoveryOnly || (ids.length > 0 && blocking.length === 0),
       runtimeDerived,
       held,
+      witnessedPasses,
     });
   }
   return { requirements: rows, totals, verdicts, rejectUnclassified: verdicts.some((v) => v.unclassified.length > 0), ledgerPresent };

package/src/lib/seams.ts

@@ -33,7 +33,37 @@ export function isSeamPath(path: string): boolean {
   return V1_SEAM_PREFIXES.some(([re]) => re.test(path)) || path.startsWith(`${SEAMS_PREFIX}/`);
 }
 
-/** Whether a (v2) discovery document advertises the seams profile. */
+/**
+ * Whether a (v2) discovery document advertises the seams profile.
+ *
+ * **The disposition rule, and it is load-bearing (rc.62).** A scenario that
+ * finds this FALSE records `inapplicable`, never `blocked`. The host has not
+ * claimed the instrument, so the obligation is out of scope for it — the same
+ * sense as `softSkip('inapplicable', 'host does not advertise X')` in
+ * `soft-skip.ts`. `blocked` is reserved for the DIFFERENT fact one line later
+ * in several of these files: the profile IS advertised and the seam answers
+ * 404 — an obligation the host took on and the suite could not measure.
+ *
+ * Why it matters that these are not the same. `blocked` is bundle-wide fatal
+ * (`verifyBundleV3` `blocked-certified`, RFC 0168 §E.1). Until rc.62 fifteen
+ * scenarios recorded `blocked` on an ABSENT advert while the seams profile's
+ * predicate was empty — and an empty predicate is vacuously satisfied, so
+ * `claimedProfilesForV2` claimed the profile for every v2 host. Together that
+ * denied certification of EVERY profile to any host that had simply not
+ * mounted the conformance seams: 19 of MyndHyve's 45 blocked rows and 9 of
+ * openwop-workflow-engine's 29, on hosts that never advertised the profile
+ * they were being held to. Mounting test-only surface is not a precondition of
+ * certifying `openwop-discovery-core`, and a barrier of that shape falls
+ * hardest on the independent implementers the v1 end-of-support clock needs.
+ *
+ * The predicate (`spec/v2/declaration.json`) now requires `conformance` at the
+ * discovery root, which is NECESSARY but not sufficient; this function is the
+ * sufficient test, applied per scenario. A host with a `conformance` block
+ * naming some other profile claims seams-v2, records every floor row
+ * `inapplicable`, witnesses nothing, and so certifies nothing — without a
+ * single blocked row. Claimed-and-unwitnessed and not-claimed are both honest;
+ * blocked-because-unclaimed was not.
+ */
 export function seamsProfileAdvertised(doc: Readonly<Record<string, unknown>> | null | undefined): boolean {
   const conf = doc?.['conformance'];
   return typeof conf === 'object' && conf !== null && (conf as Record<string, unknown>)['seamsProfile'] === SEAMS_PROFILE_ID;

package/src/lib/soft-skip.ts

@@ -22,6 +22,17 @@
  * resolves it to blocked" — and stays UNCLASSIFIED for certification (a floor
  * row with that disposition still rejects), so the honest bundle row and the
  * pressure to say why both survive.
+ *
+ * rc.56: every note also carries a sequence number, so the per-`it` row can
+ * read the notes written DURING ITS OWN TEST (`softSkipMark()` at test start,
+ * `softSkipDispositionSince(file, mark)` at test end). Until rc.56 the
+ * per-`it` row consulted only the journal's `behaviorGate` entries, never a
+ * softSkip note, so a leg that returned `softSkip('inapplicable', 'a2a facet
+ * not advertised')` was recorded `blocked / unclassified return` at `it`
+ * granularity while its file row was honestly `inapplicable` — and a bundle
+ * with any `blocked` row does not certify (RFC 0168 §E.1). Forty-five such
+ * rows on a host that simply does not advertise A2A/MCP denied certification
+ * to every profile it claimed.
  */
 
 import { expect } from 'vitest';
@@ -32,7 +43,10 @@ export type SoftSkipKind = 'inapplicable' | 'skipped' | 'blocked';
 /** Detail marker the runner writes for a zero-assertion file that noted nothing. */
 export const UNCLASSIFIED_RETURN_DETAIL = 'every test returned early with zero assertions and no recorded reason — unclassified return; RFC 0148 §A resolves it to blocked (add softSkip(kind, reason) at the early return)';
 
-const notes = new Map<string, Array<{ kind: SoftSkipKind; reason: string }>>();
+interface Note { readonly kind: SoftSkipKind; readonly reason: string; readonly seq: number }
+
+const notes = new Map<string, Note[]>();
+let seq = 0;
 
 function currentFile(): string | null {
   try {
@@ -48,7 +62,9 @@ export function softSkip(kind: SoftSkipKind, reason: string): undefined {
   const file = currentFile();
   if (file === null) return undefined;
   const arr = notes.get(file) ?? [];
-  if (!arr.some((n) => n.kind === kind && n.reason === reason)) arr.push({ kind, reason });
+  // Every call is recorded with its own sequence number so a per-test window
+  // sees it; the file-level join de-duplicates identical (kind, reason) pairs.
+  arr.push({ kind, reason, seq: ++seq });
   notes.set(file, arr);
   return undefined;
 }
@@ -69,6 +85,15 @@ export function seamAbsent(reason: string): undefined {
 
 const RANK: Record<SoftSkipKind, number> = { blocked: 0, skipped: 1, inapplicable: 2 };
 
+function fold(arr: readonly Note[]): { kind: SoftSkipKind; reason: string } | null {
+  if (arr.length === 0) return null;
+  const uniq: Note[] = [];
+  for (const n of arr) if (!uniq.some((u) => u.kind === n.kind && u.reason === n.reason)) uniq.push(n);
+  const kind = [...uniq].sort((a, b) => RANK[a.kind] - RANK[b.kind])[0]!.kind;
+  const reason = uniq.map((n) => (uniq.length > 1 ? `[${n.kind}] ${n.reason}` : n.reason)).join('; ');
+  return { kind, reason };
+}
+
 /**
  * The noted disposition for a file, worst-first when mixed (`blocked` beats
  * `skipped` beats `inapplicable` — a file that could not check one thing is
@@ -76,14 +101,24 @@ const RANK: Record<SoftSkipKind, number> = { blocked: 0, skipped: 1, inapplicabl
  * the reasons joined. `null` when nothing was noted.
  */
 export function softSkipDisposition(file: string): { kind: SoftSkipKind; reason: string } | null {
-  const arr = notes.get(file);
-  if (arr === undefined || arr.length === 0) return null;
-  const kind = [...arr].sort((a, b) => RANK[a.kind] - RANK[b.kind])[0]!.kind;
-  const reason = arr.map((n) => (arr.length > 1 ? `[${n.kind}] ${n.reason}` : n.reason)).join('; ');
-  return { kind, reason };
+  return fold(notes.get(file) ?? []);
+}
+
+/** A position in the note sequence; pass it to `softSkipDispositionSince`. */
+export function softSkipMark(): number {
+  return seq;
+}
+
+/**
+ * The noted disposition for a file counting only notes written AFTER `mark`
+ * — the notes of the test that is ending. Same fold as the file rule.
+ */
+export function softSkipDispositionSince(file: string, mark: number): { kind: SoftSkipKind; reason: string } | null {
+  return fold((notes.get(file) ?? []).filter((n) => n.seq > mark));
 }
 
 /** Test hook. */
 export function resetSoftSkips(): void {
   notes.clear();
+  seq = 0;
 }

package/src/lib/sse.ts

@@ -33,6 +33,13 @@ export interface SseSubscribeOptions {
   readonly lastEventId?: string;
   /** Optional fetch-level abort. Useful for cancellation in long tests. */
   readonly signal?: AbortSignal;
+  /**
+   * Extra request headers. A major-2 caller MUST pass `OpenWOP-Version: 2.0`:
+   * this helper sends none by itself, and a header-less request on an
+   * unversioned path is served the host's `preferredVersion` major
+   * (versioning.md §1.3) — 1.x through the overlap.
+   */
+  readonly extraHeaders?: Record<string, string>;
 }
 
 export interface SseSubscribeResult {
@@ -62,6 +69,7 @@ export async function subscribe(
   if (opts.lastEventId) {
     headers['Last-Event-ID'] = opts.lastEventId;
   }
+  for (const [k, v] of Object.entries(opts.extraHeaders ?? {})) headers[k] = v;
 
   const internalAbort = new AbortController();
   const timeoutHandle = setTimeout(() => internalAbort.abort(), timeoutMs);

package/src/scenarios/era-key-stamped-v1.test.ts

@@ -0,0 +1,156 @@
+/**
+ * `spec/v1/version-negotiation.md` §Stamping / §Legacy detection — the two
+ * run-document stamping MUSTs, and the legacy rule that makes their absence
+ * actively harmful (suite 2.0.0, target major 1; unaided).
+ *
+ * The rule is a v1 `MUST` and has been since the contract was written:
+ *
+ *   §Stamping        "Every persisted run document MUST carry an
+ *                     `eventLogSchemaVersion: number` field. The current v1
+ *                     value is `2`."
+ *   §Legacy detection "Hosts identify an older run document as legacy when
+ *                     `eventLogSchemaVersion` is undefined or `< 2`" … legacy
+ *                     runs have "no event subcollection … Readers MUST fall
+ *                     back to the snapshot for state."
+ *
+ * **Nothing in the suite has ever asserted it.** `version-negotiation.test.ts`
+ * opens by claiming it checks "the four version axes (`engineVersion`,
+ * `eventLogSchemaVersion`, per-event `schemaVersion`, `pinnedVersions`) appear
+ * where the spec says they should" — and `protocolVersion` is the only axis it
+ * asserts. Across all 444 v1 scenario files the sole occurrence of the
+ * identifier `eventLogSchemaVersion` was that sentence: a docstring describing
+ * a check that does not exist. **A comment claiming coverage is worse than no
+ * comment**, because it answers "is this tested?" for anyone who greps, and
+ * answers it wrongly.
+ *
+ * Both production hosts were measured on 2026-09-04 and neither stamps the
+ * field on any run it has ever served. Each found it independently, after the
+ * other published its own greps.
+ *
+ * The consequence fails in the direction that punishes correctness. A client
+ * following §Legacy detection exactly classifies every such run as legacy and
+ * reads the snapshot — **ignoring the event log the host is in fact serving**.
+ * The host under-serves the conforming reader and over-serves the careless one.
+ *
+ * Why the schema could not catch it: `run-snapshot.schema.json` requires only
+ * `runId`, `workflowId` and `status`, so a snapshot missing the field validates
+ * cleanly. The obligation is prose-only, which is exactly the shape that needs
+ * a scenario rather than a keyword.
+ *
+ * @see spec/v1/version-negotiation.md §Stamping
+ * @see spec/v1/version-negotiation.md §Legacy detection
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID_STAMPED = 'openwop.requirement.version-negotiation.era-key-stamped';
+const ID_NOT_LEGACY = 'openwop.requirement.version-negotiation.era-key-not-legacy';
+const ID_ENGINE = 'openwop.requirement.version-negotiation.engine-version-stamped';
+const DOC = 'spec/v1/version-negotiation.md §Stamping';
+
+interface Snapshot { readonly eventLogSchemaVersion?: unknown; readonly engineVersion?: unknown }
+
+/** A run this host created moments ago — the one case where "legacy" cannot apply. */
+async function freshRun(): Promise<{ runId: string } | { skip: string }> {
+  try {
+    // v1 path keys are explicit: the driver's unversioned rewrite is a major-2
+    // behaviour, and `/runs` answers 404 on a v1 host. The first version of this
+    // file used `/runs` and therefore SOFT-SKIPPED against a host that violates
+    // the rule — passing vacuously, which is the failure this scenario exists to
+    // catch, committed by the scenario itself.
+    const created = await driver.post('/v1/runs', { workflowId: 'conformance-noop', inputs: {} });
+    if (created.status !== 201) return { skip: `POST /v1/runs answered ${created.status} — no run to inspect` };
+    const runId = (created.json as { runId?: unknown } | null)?.runId;
+    if (typeof runId !== 'string') return { skip: 'POST /v1/runs returned no runId' };
+    return { runId };
+  } catch {
+    return { skip: 'POST /v1/runs unreachable' };
+  }
+}
+
+describe('era-key-stamped-v1 (version-negotiation.md §Stamping)', () => {
+  it('a run the host just created carries eventLogSchemaVersion', async () => {
+    const r = await freshRun();
+    if ('skip' in r) return softSkip('blocked', r.skip);
+
+    let snap;
+    try {
+      snap = await driver.get(`/v1/runs/${encodeURIComponent(r.runId)}`);
+    } catch {
+      return softSkip('blocked', 'GET /v1/runs/{runId} unreachable');
+    }
+    if (snap.status !== 200) return softSkip('blocked', `GET /v1/runs/{runId} answered ${snap.status}`);
+
+    const value = (snap.json as Snapshot | null)?.eventLogSchemaVersion;
+    expect(
+      value,
+      req(ID_STAMPED, DOC, 'every persisted run document MUST carry an eventLogSchemaVersion — the field is prose-only (run-snapshot.schema.json requires just runId, workflowId and status), so a snapshot without it validates cleanly and only this check can see its absence'),
+    ).not.toBeUndefined();
+    expect(
+      typeof value === 'number',
+      req(ID_STAMPED, DOC, `eventLogSchemaVersion MUST be a number (got ${JSON.stringify(value)})`),
+    ).toBe(true);
+  });
+
+  it('a freshly created run is not classified legacy by the host\'s own rule', async () => {
+    const r = await freshRun();
+    if ('skip' in r) return softSkip('blocked', r.skip);
+
+    let snap;
+    try {
+      snap = await driver.get(`/v1/runs/${encodeURIComponent(r.runId)}`);
+    } catch {
+      return softSkip('blocked', 'GET /v1/runs/{runId} unreachable');
+    }
+    if (snap.status !== 200) return softSkip('blocked', `GET /v1/runs/{runId} answered ${snap.status}`);
+    const value = (snap.json as Snapshot | null)?.eventLogSchemaVersion;
+    if (value === undefined) {
+      return softSkip('blocked', 'the field is absent — the stamping leg above records that; legacy classification cannot be judged separately from it');
+    }
+
+    // §Legacy detection: "undefined or < 2" is legacy, and a legacy run means
+    // "no event subcollection … Readers MUST fall back to the snapshot". A host
+    // that serves an event log while stamping a legacy value is telling a
+    // conforming client to ignore the log it is serving.
+    expect(
+      typeof value === 'number' && value >= 2,
+      req(ID_NOT_LEGACY, 'spec/v1/version-negotiation.md §Legacy detection', `a run created moments ago MUST NOT be legacy: legacy is "undefined or < 2", and a legacy run is specified to have no event subcollection so readers MUST fall back to the snapshot. Stamping ${JSON.stringify(value)} on a new run instructs a CONFORMING client to ignore the event log this host is serving it — the failure lands on the correct reader and spares the careless one`),
+    ).toBe(true);
+  });
+
+  it('a run the host just created carries engineVersion — the legacy escape cannot reach it', async () => {
+    const r = await freshRun();
+    if ('skip' in r) return softSkip('blocked', r.skip);
+
+    let snap;
+    try {
+      snap = await driver.get(`/v1/runs/${encodeURIComponent(r.runId)}`);
+    } catch {
+      return softSkip('blocked', 'GET /v1/runs/{runId} unreachable');
+    }
+    if (snap.status !== 200) return softSkip('blocked', `GET /v1/runs/{runId} answered ${snap.status}`);
+
+    // §Stamping: "Every persisted run document MUST carry an `engineVersion:
+    // number` field … Servers MAY omit this field on legacy runs that predate
+    // the contract." The escape is scoped to runs that PREDATE the contract, so
+    // it cannot cover a run created seconds ago — which is why this leg creates
+    // one rather than inspecting whatever happens to be in the store.
+    //
+    // Asserted here because nothing else asserts it ON A RUN: version-fold.test.ts
+    // reads engineVersion from the DISCOVERY document, and wasm-pack-load.test.ts
+    // carries it only as a type field. Both mention the identifier, so a grep
+    // suggests coverage that does not exist for this requirement.
+    const value = (snap.json as Snapshot | null)?.engineVersion;
+    expect(
+      value,
+      req(ID_ENGINE, DOC, 'every persisted run document MUST carry engineVersion; the "MAY omit" escape applies only to legacy runs that predate the contract, and this run was created moments ago'),
+    ).not.toBeUndefined();
+    expect(
+      typeof value === 'number',
+      req(ID_ENGINE, DOC, `engineVersion MUST be a number set to the writer engine's CURRENT_ENGINE_VERSION at write time (got ${JSON.stringify(value)})`),
+    ).toBe(true);
+  });
+});