@openwop/openwop-conformance 2.2.1 → 2.2.3

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.2.3] — 2026-09-16 — a payload def that v1 left open gets a conforming escape hatch
+
+**Why a patch.** `PUBLISHING.md` §"Versioning alignment": one scenario file is
+added, which is a minor — but `v2-payload-vendor-hatch.test.ts` is server-free
+and additive to a corpus rule, and no existing scenario changes. Cut as a patch
+alongside the spec edit it witnesses.
+
+### Added
+
+- **`v2-payload-vendor-hatch.test.ts`** (server-free) — a def v1 left open
+  admits `vendor.*` / `x-` / `openwop-` keys; still **refuses** a bare
+  unmodelled key, because the hatch is an escape valve rather than a reopening;
+  and a vendor key nested inside `refineFeedback` is **refused**, since RFC 0183
+  modelled that object closed on purpose and it was never open in v1. That third
+  leg is the load-bearing one: it fails if a later edit sprays
+  `patternProperties` down the tree instead of applying it to the 53 narrowed
+  defs. Sabotage-proved both ways.
+
+## [2.2.2] — 2026-09-16 — a registry tree that says "read-only" when it means "deliberately behind"
+
+**Why a patch.** `PUBLISHING.md` §"Versioning alignment": no scenario file is
+added or removed; this is spec prose plus packaging metadata.
+
+### Fixed
+
+- **`spec/v2/core/packs.md` §The registry tree** now says the v1 tree is
+  *"frozen through the overlap, deliberately behind this one"* rather than
+  *"served read-only through the overlap."* A tier-1 host operator read
+  "read-only" as *current, just not accepting writes*, resolved
+  `packs.openwop.dev/v1/index.json` from a major-2 host, and reported 154 of 156
+  packs drifted; a second session reproduced and confirmed it. Against
+  `registry/v2/` the drift was **zero**. The MUST that prevents this was already
+  in the next sentence — a client MUST resolve registry paths through
+  `endpoints` rather than construct one — but nothing said that constructing the
+  v1 path returns deliberately-older versions instead of failing.
+- **`package-lock.json`** pinned the `@openwop/spec-artifacts` peer at
+  `2.0.0-rc.0` while `package.json` tracked the current release. Consumers
+  installing from the lockfile resolved a peer range two majors' worth of
+  prereleases behind the one the package declares.
+
 ## [2.2.1] — 2026-09-16 — RFC 0183's `edit-accept` arm is witnessed, and the MUST the suite already enforced is now the spec's
 
 **Why a patch.** `PUBLISHING.md` §"Versioning alignment": new `it` blocks in an

package/README.md

@@ -117,7 +117,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 518 scenario files under `src/scenarios/`.
+The current suite has 519 scenario files under `src/scenarios/`.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
 - 2026-08-19 (suite `1.136.15 → 1.137.0`): NEW `replay-fanout-suppression.test.ts` — capability-gated on `webhooks.supported`, **outside every profile floor**; witnesses `replay.md` §"Host-initiated fan-out is an external effect", which was the largest normative MUST NOT on the replay surface with no scenario and no SECURITY invariant. Three legs in ONE `it` against ONE receiver and ONE subscription — a positive control, the MUST NOT, and a `branch` boundary leg — because "no delivery arrived" passes identically when delivery never worked, so absence is asserted only after presence is proven on that exact wiring. A host with an SSRF guard correctly refuses the loopback receiver and records `blocked`: **unobservable, not unmet.**
@@ -462,7 +462,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 518 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 519 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.2.1",
-  "stampSha256": "35a007d7fd7df22f277d9b3c6d58c2a723e3a7312eaafd851a0f771c18c844c5"
+  "version": "2.2.3",
+  "stampSha256": "69115713bb818c82018807f79b5c45d759b3fd8d434e81d386b005fc90ca4e6c"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.2.1",
+  "version": "2.2.3",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.2.1"
+    "@openwop/spec-artifacts": "2.2.3"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 567,
-    "tests": 2161,
-    "withStableId": 2161,
+    "files": 568,
+    "tests": 2162,
+    "withStableId": 2162,
     "interpolatedTitles": 0,
-    "explicitIds": 2116
+    "explicitIds": 2117
   },
   "records": [
     {
@@ -27720,6 +27720,32 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-payload-vendor-hatch.a-def-v1-left-open-carries-the-hatch-still-refuses-a-bare-key-and-a-deliberately",
+      "file": "v2-payload-vendor-hatch.test.ts",
+      "line": 52,
+      "title": "a def v1 left open carries the hatch, still refuses a bare key, and a deliberately-closed def refuses both",
+      "explicitId": "openwop.requirement.0185.payload-vendor-hatch",
+      "citations": [
+        {
+          "section": "RFCS/0185-run-event-payload-closure.md §B",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFCS/0185-run-event-payload-closure.md §B",
+          "requirement": "`variableChanged` MUST still REJECT a bare unmodelled key (`value`) — the hatch is an escape valve, not a reopening; `additionalProperties: false` stays"
+        },
+        {
+          "section": "RFCS/0185-run-event-payload-closure.md §B",
+          "requirement": "`interruptResolved` was open in v1, so its own hatch MUST admit a vendor key"
+        },
+        {
+          "section": "RFCS/0185-run-event-payload-closure.md §B",
+          "requirement": "a vendor key inside `refineFeedback` MUST be REFUSED — RFC 0183 modelled that object closed on purpose and it was never open in v1. The hatch belongs to the 53 defs that were narrowed, not to everything nested under them; this leg fails if a later edit sprays `patternProperties` down the tree"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-peer-dependency-declared.a-peerdependencies-key-the-declaration-file-does-not-name-is-refused-with-pack-p",
       "file": "v2-peer-dependency-declared.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 518,
+    "files": 519,
     "v1": 445,
-    "v2": 75
+    "v2": 76
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1361,6 +1361,9 @@
     "v2-payload-registry-closed.test.ts": [
       2
     ],
+    "v2-payload-vendor-hatch.test.ts": [
+      2
+    ],
     "v2-peer-dependency-declared.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.2.1",
-  "corpusTag": "v2.2.1",
+  "version": "2.2.3",
+  "corpusTag": "v2.2.3",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "a309a537a5b0aaa20c5f496943bb8cc6642b143eb27b7481ee0b9e1030d00bfb",
-    "api/v2/asyncapi.yaml": "1f7023d581d02dba0427630dfd89ec890941ecbbc31bf8f09ce7ec8b965988b2",
-    "api/v2/openapi.yaml": "f26603003e562b928c148ebaebe49b93c9bd35c01e0996611311114908858e5d",
+    "api/seams-v2.yaml": "43a0aa0f08070b9d51a1651d5edc96f936ed814617bb0af85eac2b7186711295",
+    "api/v2/asyncapi.yaml": "a32add439289805a6303b36f31ff54ff9c728dea1e9a98ab417b6b339215f025",
+    "api/v2/openapi.yaml": "8b8c18154b77775f9d11918a3182e6c4396f2a4c2065bee0dbe7056dafc775da",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -169,7 +169,7 @@
     "schemas/v2/residency.schema.json": "3fd23c9732beb140504e81560fc426eb6764d547e56da5fb92c5a5c7bf04db3a",
     "schemas/v2/run-ancestry-response.schema.json": "334c17f2062dea62726ca1d07b8be3f169cdc422af843c1def5fb317039814c9",
     "schemas/v2/run-diff-response.schema.json": "8bdb2045c274580038bd74781f7d062f5049839797c164a89de4ed89edc53a74",
-    "schemas/v2/run-event-payloads.schema.json": "38dd47929f0245c865e4850aab453e073bb717bc81590d68a91bd7b490536d63",
+    "schemas/v2/run-event-payloads.schema.json": "3f6c256871970cdfa789d4b7e353bc96975cc17319e769c73d2dfd80fbc9670c",
     "schemas/v2/run-event.schema.json": "1a9946374af9323b71635d00fed22abe02c300fa2cf3ae3e9c30f3e553e408ec",
     "schemas/v2/run-list-response.schema.json": "c2dbc34768dcf64528914a213aa3cb55952e8e3e90a64b04a9423b2a19749d38",
     "schemas/v2/run-options.schema.json": "f0e9f494d80086c2ed2cf9fe87df54e5b4e66601699c4a1089f4edbc7ba58867",
@@ -200,7 +200,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "9d76a090508697628031972795c813a12ff83b53ed1dff2dbaabe14d853b90c2",
+    "spec/v1/core-standard-manifest.json": "9f5501b6c3406ace7df7c4a53501d47745480df76b65d65ac2d298045a73d41d",
     "spec/v1/deprecations.json": "a2022c2d6eb501bf406b5d75fe2d431a3fe0158e8509125d2453985eb1bf511a",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -217,7 +217,7 @@
     "spec/v2/core/conformance.md": "622084e3c74c4549087f4d861b1bb98cec201a0c5aec23788d27f53a355fde3b",
     "spec/v2/core/connection-packs.md": "1d759681e2962f5103228c52c45f24607ed4bb9ae73e30605f690c1d5a59e9ee",
     "spec/v2/core/errors.md": "74fdb5862f432a831cf0c2eadbe0c8cca6b2660ec578180ae33db54773a1df28",
-    "spec/v2/core/events.md": "3b7d1ad34f9e438c9825d60c0114b9a21c82a468f15ccbd7567022641a4537ad",
+    "spec/v2/core/events.md": "8162bb96730ef8a98b19eb180a0251a107fd629d993fe57345dacf81e53561ca",
     "spec/v2/core/form-content-packs.md": "6ffaae85d4550be48dd53fb6e2959af8aceb35bd87c5343b722885084f197713",
     "spec/v2/core/headers.md": "2dd67d71673539e16612f09f3f2513a384f6566052d7cd8a00885885689854c2",
     "spec/v2/core/idempotency.md": "b86c352d964aebad532727f314e26ed2177d49de382076fa64d3162e2f56118d",
@@ -225,7 +225,7 @@
     "spec/v2/core/interop.md": "d4c404e469e1d9d9be88bc2c939d777e7d7c1d0419b1251c18770f039838a401",
     "spec/v2/core/interrupt.md": "f525479a99104655219fa2e51c4cad2a03d8e3be93ff4dac173a684675e57348",
     "spec/v2/core/overview.md": "69377c90bbb87b6bfe4b8be4f1b65810094b0759c8d4f93ca6df92cc530ea023",
-    "spec/v2/core/packs.md": "e72a7586a61630cdfd342eaf84e989f864b3e199006f5511ef59ea7c1a1c56f7",
+    "spec/v2/core/packs.md": "8b3e1587270bb1aec814befbd287181a05b7f76aeb0802787ee7ebdc85901205",
     "spec/v2/core/persistence.md": "2373c2815b25b7b4fe29dfdf3783d3f2f3e637d3abce5085e69f019546302fb6",
     "spec/v2/core/replay.md": "bd191a2565aa7ad0df9b35a0716f3de53be34b8722f1807c5e5b02859404a9b9",
     "spec/v2/core/runs.md": "f7a95fc82fda5b7c0c613de6e5edd376bbd6d8ba4c665a500c94eacbe42b86f2",
@@ -268,10 +268,10 @@
     "spec/v2/facets/webhooks.schema.json": "0b766033ef4b4c6c2ac6f9979a19843ba024d3a1d1576972dcb55aaba52f1b9a",
     "spec/v2/id-field-bindings.json": "eecadfd11581ba2e075ccb320d85fc033b816edfdd51edb5c5727a181e55dcb4",
     "spec/v2/path-manifest.json": "a6f4e652e866889e8bde815874062f62929aee95dc8e58e7152c56adee262163",
-    "spec/v2/peer-dependency-aliases.json": "10fcab53c65305e9b6bae4a40d30176091dca68739ac8a78291510c77b50ca6b",
+    "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "ee596fce1d27e7ec3f7a061b5705ca8022158adee5ba1aa7f321ee9abd97e9fb",
+    "spec/v2/release.json": "9a258b0740e7c26f74dbd56b2816407b7d0ac39cff2873b20e8171f3d8e5239b",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "a27e18972293865c72e4a776426718be6e2d77cc"
+  "corpusCommit": "f3d945720da0143ed932f50281ebe94c3162c063"
 }

package/src/scenarios/v2-payload-vendor-hatch.test.ts

@@ -0,0 +1,87 @@
+/**
+ * `spec/v2/core/events.md` §Era-2 + RFC 0185 §B — a run-event payload def that
+ * v1 left open carries a vendor hatch, so a host has a CONFORMING place for a
+ * fact the corpus does not model (suite 2.2.3, target major 2; server-free).
+ *
+ * v1's `run-event-payloads.schema.json` declares `additionalProperties: true`.
+ * v2's declares `false` on the same defs — 53 of them — with no hatch and no
+ * migration row. Every extra key a host legitimately recorded under v1, because
+ * v1 explicitly invited them, became invalid at the cut with nowhere to go.
+ *
+ * Two production hosts lost data to that independently: one drops 32 distinct
+ * keys at the major-2 read (the conversation content among them), the other
+ * projects era-3 rows ON WRITE and lost a variable's value AT REST. Both had a
+ * validator that got happier the more they deleted.
+ *
+ * The load-bearing leg is the THIRD one. A hatch that accepts a vendor key is
+ * satisfied by spraying `patternProperties` across every def in the file; what
+ * makes it a scoped decision is that a def closed DELIBERATELY in v2 still
+ * refuses one. `refineFeedback` is that def — RFC 0183 modelled it closed on
+ * purpose — and this leg fails if a later edit hatches it by reflex.
+ *
+ * @see RFCS/0185-run-event-payload-closure.md §B
+ * @see spec/v2/core/events.md §Era-2 logs
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { SCHEMAS_DIR } from '../lib/paths.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.requirement.0185.payload-vendor-hatch';
+const DOC = 'RFCS/0185-run-event-payload-closure.md §B';
+
+/** Compile a validator for ONE `$def` of the payload schema. */
+function defValidator(def: string): (doc: unknown) => boolean {
+  const ajv = new Ajv2020({ strict: false, allErrors: true });
+  addFormats(ajv);
+  // Register the whole v2 tree: the payload defs $ref `ids.schema.json` for
+  // their id kinds, so compiling the file alone cannot resolve.
+  const dir = join(SCHEMAS_DIR, 'v2');
+  for (const f of readdirSync(dir)) {
+    if (!f.endsWith('.schema.json') || statSync(join(dir, f)).isDirectory()) continue;
+    try { ajv.addSchema(JSON.parse(readFileSync(join(dir, f), 'utf8')) as Record<string, unknown>); } catch { /* duplicate $id */ }
+  }
+  return ajv.compile({ $ref: `https://openwop.dev/spec/v2/run-event-payloads.schema.json#/$defs/${def}` }) as unknown as (doc: unknown) => boolean;
+}
+
+describe('v2 payload vendor hatch (RFC 0185 §B)', () => {
+  it('a def v1 left open carries the hatch, still refuses a bare key, and a deliberately-closed def refuses both', () => {
+    const variableChanged = defValidator('variableChanged');
+    const base = { nodeId: 'n1', name: 'total', previous: 1, next: 2 };
+
+    // 1. the hatch admits a vendor-prefixed key
+    for (const key of ['vendor.myndhyve.value', 'x-legacy-value', 'openwop-internal']) {
+      expect(
+        variableChanged({ ...base, [key]: 'carried' }),
+        req(ID, DOC, `\`variableChanged\` MUST admit the hatched property \`${key}\` — v1 was additionalProperties:true, so a host may hold keys v2 does not name and needs a conforming home for them`),
+      ).toBe(true);
+    }
+
+    // 2. and the closure it was made for still holds
+    expect(
+      variableChanged({ ...base, value: 2 }),
+      req(ID, DOC, '`variableChanged` MUST still REJECT a bare unmodelled key (`value`) — the hatch is an escape valve, not a reopening; `additionalProperties: false` stays'),
+    ).toBe(false);
+
+    // 3. THE LOAD-BEARING LEG: the hatch is scoped to the DEF, not inherited by
+    //    the objects nested inside it. `interruptResolved` was open in v1 and is
+    //    hatched; `refineFeedback` sits INSIDE it, was modelled closed on purpose
+    //    by RFC 0183, and was never open in v1 — so it is outside §B.
+    const interruptResolved = defValidator('interruptResolved');
+    const resolved = { interruptId: 't/0123456789abcdef', nodeId: 'n1', kind: 'approval' };
+
+    expect(
+      interruptResolved({ ...resolved, 'vendor.example.extra': 1 }),
+      req(ID, DOC, '`interruptResolved` was open in v1, so its own hatch MUST admit a vendor key'),
+    ).toBe(true);
+
+    expect(
+      interruptResolved({ ...resolved, action: 'refine', refineFeedback: { scope: 'whole', 'vendor.example.extra': 1 } }),
+      req(ID, DOC, 'a vendor key inside `refineFeedback` MUST be REFUSED — RFC 0183 modelled that object closed on purpose and it was never open in v1. The hatch belongs to the 53 defs that were narrowed, not to everything nested under them; this leg fails if a later edit sprays `patternProperties` down the tree'),
+    ).toBe(false);
+  });
+});