@openwop/openwop-conformance 2.31.0 → 2.32.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.32.0] — 2026-09-20 — every published v2 pack failed the corpus schema, and two kill rows that mandated a fast bound
+
+- **`v2-one-signing-scheme` now covers every bare `*-pack-manifest`, enumerated rather than listed** (openwop#1367). It pinned one file — `registry-version-manifest` — while six bare manifests kept the v1 `{ publicKeyRef, signatureRef, method }` block, closed, and `connection-pack-manifest` had no `signing` seat at all. Measured against the published v2 registry: **0 of 190** `pack.json` documents validated. New id `openwop.requirement.0177.one-signing-scheme.bare-manifests`. Sabotage-proven: fails on the 2.31.1 `node-pack-manifest`.
+- **`openwop.requirement.0177.chain-fragment-config-open`** — `FragmentNode.config` is open exactly as the `WorkflowNode.config` it expands into. The v1→v2 seed closed it because it documents one key (`subChainRef`); 73 of 81 published chain packs failed on `config must NOT have additional properties`. With both corrections: **185 of 190** validate; the remaining five fail on constraints identical in v1 (registry data, not schema).
+- **`v2-durability-recovery`: both kill rows observe until the host's DECLARED recovery bound elapses.** They read the log once, the instant discovery answered again — demanding resumption within ~0 ms of the listener returning, a fast bound RFC 0158 rejects. A host whose sweeper first ticks 5 s after boot against a derived 65 s bound failed, then resumed correctly ten seconds later. The bound (`GET /host/durability/bound`) is a ceiling for waiting only; 60 s fallback when unserved; the governing per-class figure is read off the seam's own response (`recoveryBoundMs`) when the host names one. The observation ceiling is 240 s by default and **operator-raisable** (`OPENWOP_DURABILITY_OBSERVATION_CEILING_MS`): a fixed ceiling would have moved the single read's defect from 0 s to 240 s and made a §B.6-conformant 12.5-minute leased-class bound uncertifiable. A declared bound over the ceiling records `blocked` with that precondition named, not fail. The row detail records the observed kill → resumption interval.
+- **`kill-during-execution` asserts both clauses of §E item 11.** `status !== 'completed' || starts > 1` held forever for a run that was never resumed, so the row passed on a host that lost the work. Now: never observable as completed un-re-executed (latched across every observation) **and** resumed within the bound.
+- **A resumption signal is a further `run.started` or the registry's own recovery event** (`workflow.restored`, `run.restored-from-snapshot`) — item 11's "equivalent progress-past-the-pre-kill-point signal", named.
+- **`duplicate-delivery` counts the effect where it lands.** It counted rows per identity on `GET /runs/{id}/effects` — and a ledger keyed on effect identity admits at most one row per identity *by construction*, so the assertion held whatever the effect did. openwop-app sabotage-tested it before building to it: dedup claim forced to always win, then the effect emitted **twice per fire**; the per-identity count stayed 1 and the row stayed green. §C asks for invocation counts; the projection exposes identities. The scenario now starts its own receiver, passes `effectUrl` to the seam, and asserts **exactly one arrival**; the seam MUST stage work performing exactly one outbound effect addressed there and deliver it twice. The ledger read stays as a labelled consistency check. It also sends no `workflowId` (`conformance-noop` records no effect, so the row could only record `blocked`). Receiver reachability is a declared operator precondition, as for the webhook rows.
+- **The run log is read from `GET /runs/{runId}/events/poll`, not `/events`.** At major 2 `/events` is `streamRunEvents`, SSE only; `pollRunEvents` is the JSON read. The scenario parsed the stream path as JSON, so on a host serving exactly what the OpenAPI states the read came back null and **`poison-exhaustion` resolved `executed-pass` with `partial-witness: blocked`** — its load-bearing clause never ran. Measured on the v2 reference host; openwop-app content-negotiates the stream path, which is why it never showed there. An unreadable log on a kill row is now `blocked`, never "nothing resumed".
+- Four of the five durability defects were found by the openwop-app host reading the scenario against its own mechanism **before building the seam**; the fifth by the v2 reference host's first run. No host had witnessed the seam rows, so no bundle's seam rows are invalidated — but the reference host's committed `poison-exhaustion` pass was vacuous and is superseded by its next cut.
+- **`--certify` no longer hands the bundle signing key to the vitest child.** The child's environment was `{ ...process.env }`, so `OPENWOP_BUNDLE_SIGNING_KEY` — the PKCS8 PEM — went with it, though only the parent signs. Reported by a host operator mid-cut: on macOS `npm exec` rewrites `process.title` and a process listing spills into the child's environ, so `ps` printed the signing key in full into a terminal and transcript. New `src/lib/child-env.ts`; both spawn sites use it, and a self-test asserts on `cli.ts`'s source that no child environment is a bare spread of `process.env`. The key **id** is not secret and stays. **If you listed processes during a `--certify` on ≤ 2.31.1, treat that key as seen and rotate it.**
+- Suite pinned to corpus `2.32.0`.
+
+## [2.31.1] — 2026-09-20 — major-correct shared polling
+
+- Fixed the shared run polling helper to use `/runs/{runId}` in the major-2 lane and retain `/v1/runs/{runId}` only in the major-1 lane. The old helper combined a `/v1` path with `OpenWOP-Version: 2`, so a conforming host correctly answered `protocol_version_mismatch`; `v2-durability-recovery` then misreported an unreachable run even though it had already failed terminally.
+- Added a two-major self-test that pins both paths. Suite remains pinned to corpus `2.31.0`; this is a conformance-harness patch only.
+
 ## [2.31.0] — 2026-09-19 — the fifth rung row, and the projection helper
 
 - `v2-durability-recovery` gains `poison-exhaustion`, completing RFC 0158's `durable-single-instance` rung at major 2. The existing scenario was major-1 only and seam-bound; the port reads the canonical `GET /runs/{runId}/events` and needs **no seam**, so it can never record `blocked` for want of one. The v1 scenario is untouched.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.31.0 @openwop/spec-artifacts@2.31.0
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.32.0 @openwop/spec-artifacts@2.32.0
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/cli.js

@@ -47,6 +47,7 @@ import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witne
 import { deriveProfiles, isCoreStandard, agentPlatformStatus, DEPRECATED_PROFILE_ALIASES, PROFILE_FLOOR_SCENARIOS, } from './lib/profiles.js';
 import { setV2ProfileFloors, v2ProfileFloorFiles } from './lib/requirement-registry.js';
 import { v2ProfileIds } from './lib/v2-profiles.js';
+import { childEnv } from './lib/child-env.js';
 function parseArgs(argv) {
     let baseUrl;
     let apiKey;
@@ -493,7 +494,7 @@ async function runCertify(args, baseUrl, apiKey) {
     // (and assertion count) here; the runner reads it after the run so bundle v2
     // rows come from what scenarios RECORDED, not from per-file pass/fail/skip.
     const ledgerFile = join(reportDir, 'requirement-ledger.jsonl');
-    const env = { ...process.env };
+    const env = childEnv(process.env);
     env.OPENWOP_BASE_URL = baseUrl;
     env.OPENWOP_API_KEY = apiKey;
     env.OPENWOP_LEDGER_PATH = ledgerFile;
@@ -924,7 +925,7 @@ async function main() {
     }
     // Env vars OVERRIDE flags only when the flag was unset (consistent
     // with the rest of the harness — env wins on the absence of CLI input).
-    const env = { ...process.env };
+    const env = childEnv(process.env);
     if (args.baseUrl)
         env.OPENWOP_BASE_URL = args.baseUrl;
     if (args.apiKey)

package/dist/lib/child-env.js

@@ -0,0 +1,29 @@
+/**
+ * The environment handed to the vitest child the CLI spawns.
+ *
+ * `{ ...process.env }` handed the child EVERYTHING the operator exported,
+ * including `OPENWOP_BUNDLE_SIGNING_KEY` — the PKCS8 PEM of the key that signs
+ * the certification bundle. Nothing in the child reads it: the signer runs in
+ * the PARENT, after the run (`cli.ts` `--certify`). It was there only because
+ * nothing took it out.
+ *
+ * Why that is a leak and not a tidiness point. Measured by a host operator
+ * during a production cut (2026-09-20): on macOS `npm exec` rewrites
+ * `process.title`, and a process listing (`ps`, `pgrep -fl`) then spills into
+ * the child's environ — so listing processes mid-cut printed the signing key,
+ * in full, into the operator's terminal and transcript. Same-uid or root only,
+ * but that is exactly who is looking at the terminal. A scenario, a reporter, a
+ * vitest plugin or a crash dump in the child had the same access for no reason.
+ *
+ * The rule: material only the parent uses never enters the child. The key IDS
+ * are not secret and stay (a scenario may legitimately name the key it expects).
+ */
+export const PARENT_ONLY_ENV = [
+    'OPENWOP_BUNDLE_SIGNING_KEY',
+];
+export function childEnv(parent) {
+    const env = { ...parent };
+    for (const name of PARENT_ONLY_ENV)
+        delete env[name];
+    return env;
+}

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.31.0",
-  "stampSha256": "6a1c3396dc82087916910d32e2eec70aa589d22110dc3dec2f44472cc0289c5f"
+  "version": "2.32.0",
+  "stampSha256": "09ede2a5f7639c91137ef502d8484ae467f51d0b66f37663081423c8c61f593f"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.31.0",
+  "version": "2.32.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.31.0"
+    "@openwop/spec-artifacts": "2.32.0"
   }
 }

package/requirements.json

@@ -3,10 +3,10 @@
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
     "files": 581,
-    "tests": 2205,
-    "withStableId": 2205,
+    "tests": 2207,
+    "withStableId": 2207,
     "interpolatedTitles": 0,
-    "explicitIds": 2159
+    "explicitIds": 2161
   },
   "records": [
     {
@@ -26650,7 +26650,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.accepted-work-survives-a-kill-before-dispatch-and-dispatches-on-resume",
       "file": "v2-durability-recovery.test.ts",
-      "line": 129,
+      "line": 262,
       "title": "accepted work survives a kill before dispatch and dispatches on resume",
       "explicitId": "openwop.requirement.0158.kill-after-accept",
       "citations": [
@@ -26664,10 +26664,15 @@
     {
       "id": "openwop.it.v2-durability-recovery.work-executing-at-a-real-process-death-is-never-reported-complete-and-resumes",
       "file": "v2-durability-recovery.test.ts",
-      "line": 165,
+      "line": 307,
       "title": "work executing at a real process death is never reported complete, and resumes",
       "explicitId": "openwop.requirement.0158.kill-during-execution",
       "citations": [
+        {
+          "section": "RFC 0158 §B.4 / §E item 11",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "RFC 0158 §B.4 / §E item 11",
           "requirement": null,
@@ -26678,10 +26683,15 @@
     {
       "id": "openwop.it.v2-durability-recovery.the-same-accepted-work-delivered-twice-fires-each-effect-exactly-once",
       "file": "v2-durability-recovery.test.ts",
-      "line": 199,
+      "line": 354,
       "title": "the same accepted work delivered twice fires each effect exactly once",
       "explicitId": "openwop.requirement.0158.duplicate-delivery",
       "citations": [
+        {
+          "section": "RFC 0158 §C",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "RFC 0158 §C",
           "requirement": null,
@@ -26692,7 +26702,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.the-declared-recovery-bound-is-derived-from-the-mechanism-that-enforces-it",
       "file": "v2-durability-recovery.test.ts",
-      "line": 238,
+      "line": 428,
       "title": "the declared recovery bound is derived from the mechanism that enforces it",
       "explicitId": "openwop.requirement.0158.bound-is-derived",
       "citations": [
@@ -26706,7 +26716,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.deterministically-failing-work-reaches-a-terminal-state-and-stops-being-retried",
       "file": "v2-durability-recovery.test.ts",
-      "line": 268,
+      "line": 458,
       "title": "deterministically failing work reaches a terminal state and stops being retried",
       "explicitId": "openwop.requirement.0158.poison-exhaustion",
       "citations": [
@@ -36398,7 +36408,7 @@
     {
       "id": "openwop.it.v2-one-signing-scheme.registry-version-manifest-signing-has-exactly-one-scheme-ed25519-canonical-json",
       "file": "v2-one-signing-scheme.test.ts",
-      "line": 37,
+      "line": 42,
       "title": "registry-version-manifest signing has exactly one scheme, ed25519-canonical-json, and no method / publicKeyRef",
       "explicitId": "openwop.requirement.0177.one-signing-scheme",
       "citations": [
@@ -36428,6 +36438,70 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-one-signing-scheme.every-bare-pack-manifest-carries-the-same-closed-keyid-scheme-signing-block-and",
+      "file": "v2-one-signing-scheme.test.ts",
+      "line": 62,
+      "title": "every bare *-pack-manifest carries the same closed { keyId, scheme } signing block, and none keeps the v1 one",
+      "explicitId": "openwop.requirement.0177.one-signing-scheme.bare-manifests",
+      "citations": [
+        {
+          "section": "RFC 0177 §C.3",
+          "requirement": "schemas/v2/ MUST hold the bare pack-manifest schemas this rule covers"
+        },
+        {
+          "section": "RFC 0177 §C.3",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0177 §C.3",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0177 §C.3",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0177 §C.3",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0177 §C.3",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0177 §C.3",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-one-signing-scheme.fragmentnode-config-is-open-exactly-as-the-workflownode-config-it-expands-into-a",
+      "file": "v2-one-signing-scheme.test.ts",
+      "line": 90,
+      "title": "FragmentNode.config is open exactly as the WorkflowNode.config it expands into, and keeps its documented subChainRef key",
+      "explicitId": "openwop.requirement.0177.chain-fragment-config-open",
+      "citations": [
+        {
+          "section": "spec/v2/core/workflow-chain-packs.md §Parameter substitution",
+          "requirement": "WorkflowNode.config is a free-form map validated against the typeId's own config schema — the premise this rule compares against"
+        },
+        {
+          "section": "spec/v2/core/workflow-chain-packs.md §Parameter substitution",
+          "requirement": "FragmentNode.config MUST be open: a fragment node expands into a WorkflowNode, so a config the expanded node may carry MUST be expressible in the fragment"
+        },
+        {
+          "section": "spec/v2/core/workflow-chain-packs.md §Parameter substitution",
+          "requirement": "opening the map MUST NOT drop the documented `subChainRef` key (RFC 0133)"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-path-parity.the-corpus-gate-script-exits-0",
       "file": "v2-path-parity.test.ts",

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.31.0",
-  "corpusTag": "v2.31.0",
+  "version": "2.32.0",
+  "corpusTag": "v2.32.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "dfecf104a518efca7b9b915578c4198c6a9e1f8965d8e84fc300bbbafc5503e7",
-    "api/v2/asyncapi.yaml": "577bd2252f10d8c3dceaac0dc7855925cc466e06fd6bf1613b8e451869fcdc54",
-    "api/v2/openapi.yaml": "82b884b23460438059a5b38b47b5f3e883d03365013ed8c2632b664417c0f699",
+    "api/seams-v2.yaml": "a1db4d5558ec828482688ad34db7a749f6f52ef102158d24036819402720a3e9",
+    "api/v2/asyncapi.yaml": "8bfff7d7d9c5ef82196d5b6da1566b36e7070d4996da731c4499fd90b8ee51a7",
+    "api/v2/openapi.yaml": "02338e18f6e0ba029dde8b6dadee126904d2ca97b10a6bdd43c7c1a423ad88d7",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -112,19 +112,19 @@
     "schemas/v2/ai-envelope.schema.json": "0dc7dfbf032a37239ffd81fc2d67f999a40782ff5074866a56e414164cdee809",
     "schemas/v2/annotation-create.schema.json": "ec32c22a243b343eeb6956a23be2d76ba5b50c8018ec3ec9d6efa5a1d9b0c792",
     "schemas/v2/annotation.schema.json": "eb4813cdaa8e325412cfcaeeee5c8a28f3751c946dec64e546c7ba0ad3aad8d4",
-    "schemas/v2/artifact-type-pack-manifest.schema.json": "85630d1b760d0b41cf5a6fad2acfada39abaf7f0befd95cc4334e1e883e9615d",
+    "schemas/v2/artifact-type-pack-manifest.schema.json": "f77d8dcc3112afec8b2a8e67e56752d5811deb2c2455b0d6d4c6489eb4c4a829",
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
     "schemas/v2/capabilities.schema.json": "e62d44f23c21c8f64b273fcdb083636e801c0de976cbd1f93333f99928dd1025",
     "schemas/v2/certification-bundle.schema.json": "ab9204e37f9e0bba79857275cd38be2da98e54d26b4ecb97469829efe6ebea28",
     "schemas/v2/channel-presence-payload.schema.json": "1c20ad810cb311d47aa0b95d928490826b2468fd161f884cd29e867053e6782f",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
-    "schemas/v2/chat-card-pack-manifest.schema.json": "8df0d9d273ae22efc6876d5586833f1d4c2e551edc3ac6cf6e8f0719329f03dd",
+    "schemas/v2/chat-card-pack-manifest.schema.json": "f7cf09b30d3e1d2251620d84ea9f65541438d015ab44aec10d1dcfe68d8bd496",
     "schemas/v2/compact-tool-descriptor.schema.json": "b5c418d72082d5b713bf318212a83397e5be98e56d25ca056302b41b8dd8273b",
     "schemas/v2/compensation-policy.schema.json": "b3c1142637f5bf980f2b0bb67adb47e8cb7abb99a0405a4b6816ccf5d9c089d6",
     "schemas/v2/compensation-projection.schema.json": "f46977c7076347b5473faa8c4bbe73d8321c33b33c98fff2f26ee7cbada4ed98",
     "schemas/v2/configurable.schema.json": "33a6884047e2490f723733bf8b74d3b9164e00374cfea6dc3eac5a70dc368861",
-    "schemas/v2/connection-pack-manifest.schema.json": "7410a3011b28829b286e3ff764bdb283854dca69ea4b71a8441f8c1c4f1cc948",
+    "schemas/v2/connection-pack-manifest.schema.json": "4300e815cf376959f8250ed25ba0545ae8bd525e449c6442326934f451070cc9",
     "schemas/v2/conversation-event.schema.json": "e87b7fb36ab4ca0afe9f77993654065b28b67e5f24b20175907f90e238942025",
     "schemas/v2/conversation-turn.schema.json": "a15b43dc15dbcc6aaf216bfab7424c540b514d7e40e661a732384aad45387006",
     "schemas/v2/credential-provenance.schema.json": "f86b09e94b1c524dec7d1c6353965665ae8891e9517faef6e742d639c5578c99",
@@ -144,7 +144,7 @@
     "schemas/v2/error-envelope.schema.json": "bb3e6c487dafa951a56ff224a7c029c462f0f1b754a7f51f6729609b4f43a438",
     "schemas/v2/eval-summary.schema.json": "9d31025752d0f67ad3b8a32e82a5314972c530ef9f780dd82e484ae8c5131198",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
-    "schemas/v2/form-content-pack-manifest.schema.json": "461529e4287ec3b15a9fbcde57226a1c6f17ea3ae71b33b418e6f595ff0619fe",
+    "schemas/v2/form-content-pack-manifest.schema.json": "8ec157cf51241d4df800398e811d2c35addd076b929c58be3ce3dcd671c67641",
     "schemas/v2/frontend-plugin-manifest.schema.json": "fed6b8ddb3056c53b1bfc91525410a4445a3c37a8bf9eb9f6f9964ffea26d993",
     "schemas/v2/goal.schema.json": "146c4182e36d3538778f947e668a92cdb69ec42ee0820104b00063b035e342d7",
     "schemas/v2/heartbeat-evaluated.schema.json": "4086b1ba1d0547c08b038dfb263ac89416a3e406430db1250156fb2f9b74f8d6",
@@ -156,12 +156,12 @@
     "schemas/v2/localized-content-section.schema.json": "29c7bad0ad9ebc6c45211282e8afb3fdb35a4ca075ce0404b6e2c29f35fa5313",
     "schemas/v2/memory-entry.schema.json": "290576ae84f4fef4cdf975932b87963283b11c50ea3d2654b32cd96aa6537c3d",
     "schemas/v2/memory-list-options.schema.json": "f66703bccb68efb28391c273abb66aa117ee5b5ce475c477846ed700c336afcd",
-    "schemas/v2/node-pack-manifest.schema.json": "0da826ca63a29026f7a9551748048104910e0d9962db6bad2b50b97a24a9ea30",
+    "schemas/v2/node-pack-manifest.schema.json": "47d122f7d4711eaa13464c5487c26ed36103b7c85adf1987004bf2d6842d663b",
     "schemas/v2/orchestrator-decision.schema.json": "2da17538e84cfbe70151eb118f1ccf670cff58b8697148e394074d32ac4af6b4",
     "schemas/v2/org-chart-responsibility-view.schema.json": "8a2565e4cdc6737a3946a70799f93642808b92f9c8d56dcdff3a0782053b89a1",
     "schemas/v2/pack-lockfile.schema.json": "2685417702c105146b780cd99154296a46578fbb10d81c8c713348ee26fea898",
     "schemas/v2/prompt-kind.schema.json": "67251c937a5a91fb97c0422050e808dc0c162a9b8561366814cf87b0a7f62e00",
-    "schemas/v2/prompt-pack-manifest.schema.json": "8e77d23840250640d26f2f99c1c5902e79bf4a6974cae2d6c6637176236bddb9",
+    "schemas/v2/prompt-pack-manifest.schema.json": "4b1e510341cc6ba167b007ecae38ce0d71d5b89c751671777c5457da926e9744",
     "schemas/v2/prompt-ref.schema.json": "11538fa36a7a652c93100cac4f1857eb4130137b546e3d94890618636d44b729",
     "schemas/v2/prompt-template.schema.json": "494fc83028cb3af5dbb8a943d0e83b2348f7775e9fa02369162bcb58a6f81559",
     "schemas/v2/proposal.schema.json": "cb5ea4fcb54be94fd2a92cf2799357dc73335181a89f5766f432d69e21cc3a80",
@@ -189,7 +189,7 @@
     "schemas/v2/ui-plugin-message.schema.json": "879d65867c01656b3962d64283e66364dcb8f626ad26c5fcf2d2d55a79ae0ce9",
     "schemas/v2/webhook-dead-letter-page.schema.json": "543f5ccc26d8f777684a037172ab7b9fdf70735e5394eeb42e5fa6569503f528",
     "schemas/v2/webhook-delivery.schema.json": "4e8ab3b722ad1731adf0548c1217f0de62da40de14e8abf77533aee4ace4c079",
-    "schemas/v2/workflow-chain-pack-manifest.schema.json": "b61cc945b4df1c7093a1058fa71ee59ef10bacb3433ae4d7ae7536136e616cc2",
+    "schemas/v2/workflow-chain-pack-manifest.schema.json": "58fa5b67c6e3a320f77aa1eb5d5fa7c6c9b3356afe8b75ad74a7cf082496e04b",
     "schemas/v2/workflow-definition.schema.json": "9aafddec32b84eb6aec3185be024850f1b9444c6193568771b0b636595fef136",
     "schemas/v2/workload-identity.schema.json": "1f589debfac6d70e0908da511550ec69a27b4bcc8314551cd843b6d923605efc",
     "schemas/v2/workspace-file-create.schema.json": "b6b5260857318c3b67de0231ed15e3a746f525880a763e7b36a7854178dd10d0",
@@ -201,7 +201,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "40069d5976eeb6ba1384a648e57e5cfd673db3fce36175115fb8293bee9664d4",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "c8cc668bd5c1e504e8b0171e3c078f770f9d9e5765938750f600defb2fcb986f",
+    "spec/v1/core-standard-manifest.json": "01ed93af96a8ca6c562b8fa25658ff2e33a793970133c50838d50ac5e362819e",
     "spec/v1/deprecations.json": "307083ce29c23fd406015951f99a30d78d6187ff061d38dc9732f62191b40f3f",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -228,7 +228,7 @@
     "spec/v2/core/interop.md": "6bd581556b9ab1a1509c01b9a1ec2bcb9e4a8300e68fb01570704417e70f20b9",
     "spec/v2/core/interrupt.md": "3a926d84b942d4ee7daccc4443c93dc29f6a69f2936ba813182f2c1336db2cbb",
     "spec/v2/core/overview.md": "7dc00ace32d4e4ce929a383651f0029fc4b7091ec87487b1bf26ead1be209e0e",
-    "spec/v2/core/packs.md": "cc06de2d49dd08410eececd5c279996ec839680553b332b4f33d6b31989b5757",
+    "spec/v2/core/packs.md": "1c0919059760f9a3940a93264a76b7e30f9a0f6f27ff19753cc88f15753d8088",
     "spec/v2/core/persistence.md": "9e241f84259e38848f4a2ad1c21debb0dffd5f8aafbad26408aa6cc8969bf93b",
     "spec/v2/core/replay.md": "b980a66e2543107240e3dc4f58131b9f4ff52478737e79ade6d5777b26ad1119",
     "spec/v2/core/runs.md": "136319842bacbbb300178980e4b83444917d5b193cc5fdd92e39a4902ba8d3c0",
@@ -274,13 +274,13 @@
     "spec/v2/facets/schemaVersions.schema.json": "890d3416c4b66511d51f329abc68e6f467f4338f16807e489fe682999b2b56b9",
     "spec/v2/facets/supportedEnvelopes.schema.json": "644f22cc2236e30a611b5b7f1ba0458ff1925d68b94c514d9672583224e126bd",
     "spec/v2/facets/webhooks.schema.json": "4bf3f8eb3161a43910efac4c44ccaf9567060c9da52d4cf09bcf3888d1b92192",
-    "spec/v2/facets/workflowChainPacks.schema.json": "cd30907ac92396866a524e4db8d8c1537e3818cfff455d780efd72bcd0ebdac1",
+    "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
     "spec/v2/id-field-bindings.json": "e73c06f3055ad30173507ac817a458b96362c8f26209ba105c53653292cf63d3",
     "spec/v2/path-manifest.json": "c123c9fd77dc1b3f9c2e9346ace80cdae007e6511138894956abda01e61ec1c6",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "92131d62a7fcd12445d7e04eb588e2297f839b7e5e2a87f89ae9e61593f837cd",
+    "spec/v2/release.json": "df06e652e6f851338df9b4e0f230bb176511e62691e867f7228d05c4263b1bec",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "cb0aa58bb79366383a13b4b2843f47662888a189"
+  "corpusCommit": "7091dae28be398d49c446f779b4c91755a80a5ff"
 }

package/src/cli.ts

@@ -55,6 +55,7 @@ import {
 } from './lib/profiles.js';
 import { setV2ProfileFloors, v2ProfileFloorFiles } from './lib/requirement-registry.js';
 import { v2ProfileIds } from './lib/v2-profiles.js';
+import { childEnv } from './lib/child-env.js';
 
 interface ParsedArgs {
   readonly baseUrl: string | undefined;
@@ -525,7 +526,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
   // (and assertion count) here; the runner reads it after the run so bundle v2
   // rows come from what scenarios RECORDED, not from per-file pass/fail/skip.
   const ledgerFile = join(reportDir, 'requirement-ledger.jsonl');
-  const env: NodeJS.ProcessEnv = { ...process.env };
+  const env: NodeJS.ProcessEnv = childEnv(process.env);
   env.OPENWOP_BASE_URL = baseUrl;
   env.OPENWOP_API_KEY = apiKey;
   env.OPENWOP_LEDGER_PATH = ledgerFile;
@@ -973,7 +974,7 @@ async function main(): Promise<never> {
 
   // Env vars OVERRIDE flags only when the flag was unset (consistent
   // with the rest of the harness — env wins on the absence of CLI input).
-  const env: NodeJS.ProcessEnv = { ...process.env };
+  const env: NodeJS.ProcessEnv = childEnv(process.env);
   if (args.baseUrl) env.OPENWOP_BASE_URL = args.baseUrl;
   if (args.apiKey) env.OPENWOP_API_KEY = args.apiKey;
   if (args.impl) env.OPENWOP_IMPLEMENTATION_NAME = args.impl;

package/src/lib/child-env.ts

@@ -0,0 +1,29 @@
+/**
+ * The environment handed to the vitest child the CLI spawns.
+ *
+ * `{ ...process.env }` handed the child EVERYTHING the operator exported,
+ * including `OPENWOP_BUNDLE_SIGNING_KEY` — the PKCS8 PEM of the key that signs
+ * the certification bundle. Nothing in the child reads it: the signer runs in
+ * the PARENT, after the run (`cli.ts` `--certify`). It was there only because
+ * nothing took it out.
+ *
+ * Why that is a leak and not a tidiness point. Measured by a host operator
+ * during a production cut (2026-09-20): on macOS `npm exec` rewrites
+ * `process.title`, and a process listing (`ps`, `pgrep -fl`) then spills into
+ * the child's environ — so listing processes mid-cut printed the signing key,
+ * in full, into the operator's terminal and transcript. Same-uid or root only,
+ * but that is exactly who is looking at the terminal. A scenario, a reporter, a
+ * vitest plugin or a crash dump in the child had the same access for no reason.
+ *
+ * The rule: material only the parent uses never enters the child. The key IDS
+ * are not secret and stay (a scenario may legitimately name the key it expects).
+ */
+export const PARENT_ONLY_ENV: readonly string[] = [
+  'OPENWOP_BUNDLE_SIGNING_KEY',
+];
+
+export function childEnv(parent: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = { ...parent };
+  for (const name of PARENT_ONLY_ENV) delete env[name];
+  return env;
+}

package/src/lib/polling.ts

@@ -28,6 +28,7 @@
  */
 
 import { driver } from './driver.js';
+import { targetMajor } from './seams.js';
 
 export interface RunSnapshot {
   readonly runId: string;
@@ -73,9 +74,14 @@ export function scaledTimeoutMs(timeoutMs: number): number {
 const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
 
 export async function getRun(runId: string): Promise<RunSnapshot> {
-  const res = await driver.get(`/v1/runs/${encodeURIComponent(runId)}`);
+  // A major-2 request MUST use the unversioned path space. The driver adds the
+  // OpenWOP-Version: 2 header, so retaining `/v1` here asked the host to serve
+  // two different majors at once and a conforming negotiator correctly refused
+  // it with protocol_version_mismatch. Keep the v1 key only in the v1 lane.
+  const prefix = targetMajor() === 2 ? '' : '/v1';
+  const res = await driver.get(`${prefix}/runs/${encodeURIComponent(runId)}`);
   if (res.status !== 200) {
-    throw new Error(`GET /v1/runs/${runId} returned ${res.status}: ${res.text.slice(0, 200)}`);
+    throw new Error(`GET ${prefix}/runs/${runId} returned ${res.status}: ${res.text.slice(0, 200)}`);
   }
   return res.json as RunSnapshot;
 }

package/src/scenarios/v2-durability-recovery.test.ts

@@ -10,7 +10,7 @@
  * v2 bundle could carry a durability row of any kind and the rung was
  * unwitnessable at major 2 even with the other four passing. The port is the
  * fifth `it` below, and it needs NO SEAM: at major 2 the canonical
- * `GET /runs/{runId}/events` answers the same question the v1 sample seam was
+ * `GET /runs/{runId}/events/poll` answers the same question the v1 sample seam was
  * invented to answer, so the row can never be `blocked` for want of a seam a
  * host did not wire. The v1 scenario stays where it is, unchanged.
  *
@@ -41,6 +41,18 @@
  * derived bound: a §B.5 violation that did not happen. Both measured failures
  * are recorded in the RFC.
  *
+ * ── 2.32.0: the observation runs to the DECLARED bound ───────────────────────
+ * Until 2.32.0 both kill rows read the log ONCE, the instant discovery answered
+ * again — mandating resumption within ~0 ms of the listener returning, i.e. a
+ * fast bound, which the RFC rejects. Found by the openwop-app host reading this
+ * file against its own sweeper BEFORE building the seam; a first witness on a
+ * host that re-enters runs at boot would have passed the single read and hidden
+ * it. `kill-during-execution` also asserted only the first clause of item 11
+ * and so passed on a host that never resumed. See the RFC's 2026-09-20 note.
+ * `duplicate-delivery` counted rows per identity on an identity-keyed ledger,
+ * which cannot show a double-fire; the effect is now counted at a receiver the
+ * suite owns. All four were found by hosts reading this file, not by a run.
+ *
  * ── What this file deliberately does not do ─────────────────────────────────
  * `durability/peer-resume` is the `durable-multi-instance` discriminator and is
  * NOT required for the rung these rows witness. §E makes it bundle-witnessed
@@ -52,6 +64,7 @@
  * @see RFCS/0158-durable-execution-and-disaster-recovery-qualification.md §B.4 §D.9 §E
  */
 
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
 import { describe, expect, it } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { v2Discovery } from '../lib/v2.js';
@@ -59,6 +72,7 @@ import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { pollUntilTerminal, scaledTimeoutMs } from '../lib/polling.js';
 import { req } from '../lib/requirement-ids.js';
+import { receiverBinding, resolveRegistrationUrl } from '../lib/webhook-receiver.js';
 
 const FIXTURE = 'conformance-noop';
 const FAILURE_FIXTURE = 'conformance-failure';
@@ -71,9 +85,23 @@ const ATTEMPT_TYPES = new Set(['node.started', 'node.retried']);
  *  it is a wait for something that must not happen. */
 const QUIET_WINDOW_MS = 4_000;
 
-/** The canonical major-2 run-event read. Null when it does not answer. */
+/**
+ * The canonical major-2 JSON read of a run's log. Null when it does not answer.
+ *
+ * `GET /runs/{runId}/events/poll` — NOT `/runs/{runId}/events`. At major 2 the
+ * latter is `streamRunEvents`, `text/event-stream` ONLY (api/v2/openapi.yaml);
+ * the JSON read is `pollRunEvents`. Until 2.32.0 this file parsed the STREAM
+ * path as JSON. A host that content-negotiates the stream path answered anyway;
+ * a host that serves exactly what the OpenAPI states answered SSE, the parse
+ * came back null, and `poison-exhaustion` — having already asserted the
+ * terminal status — soft-skipped its load-bearing clause and resolved
+ * `executed-pass` with the detail "partial-witness: blocked". Measured on the
+ * v2 reference host: a vacuous pass sitting in a bundle, from the suite reading
+ * the wrong one of the corpus's own two operations. `timeout=1`: existing
+ * events are returned at once; the wait only applies when there are none.
+ */
 async function runEvents(runId: string): Promise<Array<{ type: string }> | null> {
-  const r = await driver.get(`/runs/${encodeURIComponent(runId)}/events`);
+  const r = await driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`);
   if (r.status !== 200) return null;
   const events = (r.json as { events?: Array<{ type?: unknown }> } | null)?.events;
   if (!Array.isArray(events)) return null;
@@ -117,12 +145,117 @@ async function waitBack(deadlineMs: number): Promise<number | null> {
   return null;
 }
 
-/** Count the run-lifecycle re-starts on a run: §B.4's resumption observation. */
-async function runStartedCount(runId: string): Promise<number> {
-  const r = await driver.get(`/runs/${encodeURIComponent(runId)}/events`);
-  if (r.status !== 200) return -1;
-  const events = (r.json as { events?: Array<{ type?: string }> } | null)?.events ?? [];
-  return events.filter((e) => e.type === 'run.started').length;
+/**
+ * §B.4's resumption observation, read off the canonical event log.
+ *
+ * RFC 0158 §E item 11 names "a second `run.started`, or any equivalent
+ * progress-past-the-pre-kill-point signal". The registry already has two events
+ * whose whole meaning is that signal — `workflow.restored` ("an in-flight run is
+ * recovered from the event log on a fresh engine boot") and
+ * `run.restored-from-snapshot` — so a host that reports recovery with the event
+ * minted for it is not failed for declining to re-emit `run.started`.
+ */
+const RESTORED_TYPES = new Set(['workflow.restored', 'run.restored-from-snapshot']);
+interface Observation { readable: boolean; runStarted: number; nodeStarted: number; restored: number }
+async function observe(runId: string): Promise<Observation> {
+  const events = await runEvents(runId);
+  if (events === null) return { readable: false, runStarted: 0, nodeStarted: 0, restored: 0 };
+  const n = (pred: (t: string) => boolean): number => events.filter((e) => pred(e.type)).length;
+  return { readable: true, runStarted: n((t) => t === 'run.started'), nodeStarted: n((t) => t === 'node.started'), restored: n((t) => RESTORED_TYPES.has(t)) };
+}
+
+/**
+ * The longest this suite will wait for a resumption. 240 s by DEFAULT, and
+ * operator-raisable, because a fixed ceiling is the single read's defect moved
+ * from 0 s to 240 s: a host whose leased-class bound is 12.5 min (a 12 min
+ * dispatch lease + a 30 s orphan sweep) is conformant under §B.6, would observe
+ * nothing in 240 s, record `blocked`, and — `blocked` denying certification
+ * (RFC 0168 §E.1) — could never certify the rung without shortening a lease,
+ * the outcome §"Alternatives considered" rejects. An operator with a long bound
+ * sets `OPENWOP_DURABILITY_OBSERVATION_CEILING_MS` and waits it out; a
+ * 13-minute row in a certification cut is affordable, an uncertifiable
+ * conformant host is not. The `it` timeouts below scale from it.
+ */
+const DEFAULT_OBSERVATION_CEILING_MS = 240_000;
+const OBSERVATION_CEILING_MS = ((): number => {
+  const raw = Number(process.env['OPENWOP_DURABILITY_OBSERVATION_CEILING_MS']);
+  return Number.isFinite(raw) && raw >= DEFAULT_OBSERVATION_CEILING_MS ? raw : DEFAULT_OBSERVATION_CEILING_MS;
+})();
+/** RESUME_WINDOW + the observation + slack for the reads themselves. */
+const KILL_ROW_TIMEOUT_MS = OBSERVATION_CEILING_MS + 120_000;
+/** Used only when the host serves no bound to read; named in the row's detail. */
+const UNDECLARED_BOUND_FALLBACK_MS = 60_000;
+
+/**
+ * How long to keep observing: the host's OWN declared recovery bound.
+ *
+ * §E item 11: resumption "MUST be observed on a subsequent observation within
+ * the declared recovery bound", and §B.6 makes a long bound conformant. Until
+ * 2.32.0 both kill rows read the log ONCE, the instant discovery answered
+ * again — which demanded resumption within ~0 ms of the listener coming up, a
+ * fast bound the RFC's §"Alternatives considered" explicitly rejects. A host
+ * whose sweeper first ticks 5 s after boot against a 65 s derived bound read
+ * `0 run.started` and failed, then resumed correctly ten seconds later. The
+ * bound is used as a CEILING FOR WAITING only; it is never asserted as a
+ * scalar here (`bound-is-derived` owns the arithmetic).
+ */
+async function declaredBoundMs(fired: unknown): Promise<{ ms: number; declared: boolean }> {
+  // A host whose bound is PER CLASS (Unresolved Question 1: unleased work waits
+  // out an outbox lease, leased work a dispatch lease — 65 s against 750 s on
+  // one measured host) names the figure that governs THIS work on the seam's
+  // own response. The bare read below returns one class and would report the
+  // interval against a bound that does not govern the staged run.
+  const governing = (fired as { recoveryBoundMs?: unknown } | null)?.recoveryBoundMs;
+  if (typeof governing === 'number' && Number.isFinite(governing) && governing > 0) return { ms: governing, declared: true };
+  const r = await driver.get('/host/durability/bound');
+  const bound = (r.json as { bound?: unknown } | null)?.bound;
+  return r.status === 200 && typeof bound === 'number' && Number.isFinite(bound) && bound > 0
+    ? { ms: bound, declared: true }
+    : { ms: UNDECLARED_BOUND_FALLBACK_MS, declared: false };
+}
+
+interface Watch { resumedAfterMs: number | null; last: Observation; completedUnresumed: boolean; waitedMs: number }
+/**
+ * Observe `runId` from the moment the service answers again until `resumed`
+ * holds or `budgetMs` elapses. `completedUnresumed` latches if ANY observation
+ * shows the run `completed` while `resumed` is still false — the item-11 defect
+ * is a state a later observation can paper over, so it is checked at every read.
+ */
+async function watchForResumption(runId: string, budgetMs: number, resumed: (o: Observation) => boolean): Promise<Watch> {
+  const t0 = Date.now();
+  let last: Observation = { readable: false, runStarted: 0, nodeStarted: 0, restored: 0 };
+  let completedUnresumed = false;
+  for (;;) {
+    last = await observe(runId);
+    const waitedMs = Date.now() - t0;
+    if (last.readable && resumed(last)) return { resumedAfterMs: waitedMs, last, completedUnresumed, waitedMs };
+    const snap = await driver.get(`/runs/${encodeURIComponent(runId)}`);
+    if ((snap.json as { status?: unknown } | null)?.status === 'completed' && !(last.readable && resumed(last))) completedUnresumed = true;
+    if (waitedMs >= budgetMs) return { resumedAfterMs: null, last, completedUnresumed, waitedMs };
+    await new Promise((r) => setTimeout(r, 500));
+  }
+}
+
+/**
+ * The suite's own destination for the one staged effect. Every request that
+ * reaches it is an INVOCATION — the thing §C says to count. Honours
+ * OPENWOP_WEBHOOK_RECEIVER_PORT so a tunnelled cut forwards here (the
+ * certification setting is already `--max-workers 1`, so the pinned port is
+ * not contended by the webhook files).
+ */
+async function startEffectReceiver(): Promise<{ server: Server; url: string; arrivals: Array<{ method: string; at: number }> }> {
+  const arrivals: Array<{ method: string; at: number }> = [];
+  const server = createServer((request: IncomingMessage, res: ServerResponse) => {
+    request.on('data', () => { /* drain */ });
+    request.on('end', () => { arrivals.push({ method: request.method ?? '', at: Date.now() }); res.writeHead(204); res.end(); });
+  });
+  const pinned = Number(process.env['OPENWOP_WEBHOOK_RECEIVER_PORT'] ?? '');
+  const bindPort = Number.isInteger(pinned) && pinned > 0 && pinned < 65536 ? pinned : 0;
+  const binding = receiverBinding();
+  await new Promise<void>((resolve) => server.listen(bindPort, binding.bind, () => resolve()));
+  const addr = server.address();
+  const port = typeof addr === 'object' && addr ? addr.port : 0;
+  return { server, url: `http://${binding.advertise}:${port}/effect`, arrivals };
 }
 
 describe('v2-durability-recovery (RFC 0158 §B.4, §D.9, §E — the durable-single-instance rows)', () => {
@@ -155,12 +288,21 @@ describe('v2-durability-recovery (RFC 0158 §B.4, §D.9, §E — the durable-sin
       return softSkip('blocked', 'the service never answered again within the window — the operator precondition for this row is a restart supervisor (something must restart the killed instance; the suite cannot)');
     }
 
-    const starts = await runStartedCount(runId);
+    // Accepted-but-undispatched work has, by definition, not executed: any
+    // dispatch evidence after the death is the resumption. Observed until the
+    // host's OWN declared bound elapses, never once at the instant of return.
+    const bound = await declaredBoundMs(fired.json);
+    const budget = Math.min(bound.ms, OBSERVATION_CEILING_MS);
+    const w = await watchForResumption(runId, budget, (o) => o.runStarted >= 1 || o.nodeStarted >= 1 || o.restored >= 1);
+    if (!w.last.readable) return softSkip('blocked', 'GET /runs/{runId}/events/poll did not answer after the restart — resumption is unobservable, and an unreadable log must not read as "nothing resumed"');
+    if (w.resumedAfterMs === null && bound.ms > OBSERVATION_CEILING_MS) {
+      return softSkip('blocked', `no dispatch observed in ${w.waitedMs}ms, but the host declares a ${bound.ms}ms recovery bound and this run observes for at most ${OBSERVATION_CEILING_MS}ms — a bound longer than the observation ceiling is conformant (§B.6) and is neither witnessed nor refuted here; the operator precondition for this row is OPENWOP_DURABILITY_OBSERVATION_CEILING_MS >= the declared bound`);
+    }
     expect(
-      starts >= 1,
-      req('openwop.requirement.0158.kill-after-accept', 'RFC 0158 §B.4', `work accepted before a real process death MUST dispatch on resume — the run's log MUST show it being executed after the kill, observed ${starts} run.started (service answered again after ${backIn}ms)`),
+      w.resumedAfterMs !== null,
+      req('openwop.requirement.0158.kill-after-accept', 'RFC 0158 §B.4', `work accepted before a real process death MUST dispatch on resume within the declared recovery bound — service answered again after ${backIn}ms, then observed for ${w.waitedMs}ms against a ${bound.declared ? `declared ${bound.ms}ms bound` : `${bound.ms}ms fallback (the host serves no /host/durability/bound)`}: ${w.last.runStarted} run.started, ${w.last.nodeStarted} node.started, ${w.last.restored} restored${w.resumedAfterMs !== null ? `; dispatch first observed ${backIn + w.resumedAfterMs}ms after the kill` : ''}`),
     ).toBe(true);
-  }, 120_000);
+  }, KILL_ROW_TIMEOUT_MS);
 
   it('work executing at a real process death is never reported complete, and resumes', async () => {
     const doc = await v2Discovery();
@@ -183,18 +325,31 @@ describe('v2-durability-recovery (RFC 0158 §B.4, §D.9, §E — the durable-sin
       return softSkip('blocked', 'the service never answered again within the window — the operator precondition for this row is a restart supervisor (something must restart the killed instance; the suite cannot)');
     }
 
-    // §E item 11's first clause, and the one a host is most likely to get
-    // wrong: work that was executing when the process died MUST NOT be
-    // observable as completed. A host that marks it complete on restart has
-    // reported success for work it never finished.
-    const snap = await driver.get(`/runs/${encodeURIComponent(runId)}`);
-    const status = (snap.json as { status?: unknown } | null)?.status;
-    const starts = await runStartedCount(runId);
+    // §E item 11 is TWO clauses and until 2.32.0 only the first was asserted:
+    // `status !== 'completed' || starts > 1` holds forever for a run that is
+    // simply never resumed, so the row passed on a host that lost the work —
+    // weaker than its own RFC table row ("resumed within the declared bound").
+    // (1) work executing at the death MUST NOT be observable as completed
+    //     without having been re-executed — latched across EVERY observation;
+    // (2) resumption MUST be observed within the declared recovery bound.
+    // Work that was executing already has one `run.started`; resumption is a
+    // further one, or the registry's own recovery event.
+    const bound = await declaredBoundMs(fired.json);
+    const budget = Math.min(bound.ms, OBSERVATION_CEILING_MS);
+    const w = await watchForResumption(runId, budget, (o) => o.runStarted > 1 || o.restored >= 1);
+    if (!w.last.readable) return softSkip('blocked', 'GET /runs/{runId}/events/poll did not answer after the restart — resumption is unobservable, and an unreadable log must not read as "nothing resumed"');
     expect(
-      status !== 'completed' || starts > 1,
-      req('openwop.requirement.0158.kill-during-execution', 'RFC 0158 §B.4 / §E item 11', `work executing at a real process death MUST NOT be observable as completed without having been re-executed — read status ${String(status)} with ${starts} run.started (service answered again after ${backIn}ms); §B.4 measures kill → RESUMPTION, never kill → terminal`),
+      w.completedUnresumed,
+      req('openwop.requirement.0158.kill-during-execution', 'RFC 0158 §B.4 / §E item 11', `work executing at a real process death MUST NOT be observable as completed without having been re-executed — an observation after the kill read status completed with ${w.last.runStarted} run.started and ${w.last.restored} restored (service answered again after ${backIn}ms)`),
+    ).toBe(false);
+    if (w.resumedAfterMs === null && bound.ms > OBSERVATION_CEILING_MS) {
+      return softSkip('blocked', `no resumption observed in ${w.waitedMs}ms, but the host declares a ${bound.ms}ms recovery bound and this run observes for at most ${OBSERVATION_CEILING_MS}ms — a bound longer than the observation ceiling is conformant (§B.6) and is neither witnessed nor refuted here; the operator precondition for this row is OPENWOP_DURABILITY_OBSERVATION_CEILING_MS >= the declared bound`);
+    }
+    expect(
+      w.resumedAfterMs !== null,
+      req('openwop.requirement.0158.kill-during-execution', 'RFC 0158 §B.4 / §E item 11', `work executing at a real process death MUST resume within the declared recovery bound; §B.4 measures kill → RESUMPTION, never kill → terminal — service answered again after ${backIn}ms, then observed for ${w.waitedMs}ms against a ${bound.declared ? `declared ${bound.ms}ms bound` : `${bound.ms}ms fallback (the host serves no /host/durability/bound)`}: ${w.last.runStarted} run.started, ${w.last.restored} restored${w.resumedAfterMs !== null ? `; resumption first observed ${backIn + w.resumedAfterMs}ms after the kill` : ''}`),
     ).toBe(true);
-  }, 120_000);
+  }, KILL_ROW_TIMEOUT_MS);
 
   it('the same accepted work delivered twice fires each effect exactly once', async () => {
     const doc = await v2Discovery();
@@ -202,38 +357,73 @@ describe('v2-durability-recovery (RFC 0158 §B.4, §D.9, §E — the durable-sin
     const seam = await probeSeam();
     if (seam.kind === 'absent') return softSkip('inapplicable', seam.why);
 
-    const fired = await driver.post(KILL_SEAM, { mode: 'duplicate-delivery', workflowId: FIXTURE });
-    if (fired.status >= 400) {
-      return softSkip('blocked', `the durability seam answered ${fired.status} for mode=duplicate-delivery — the host exposes the route but could not stage a double delivery`);
-    }
-    const runId = (fired.json as { runId?: unknown } | null)?.runId;
-    if (typeof runId !== 'string') {
-      return softSkip('blocked', 'the seam staged a duplicate delivery but named no runId');
-    }
+    // THE EFFECT IS COUNTED WHERE IT LANDS, not where the host says it landed.
+    // Until 2.32.0 this row counted rows per identity on GET /runs/{id}/effects.
+    // A ledger keyed on effect identity admits AT MOST ONE ROW per identity by
+    // construction — a second fire at the same identity writes the same key —
+    // so `no identity appears twice` held whatever the effect did. Measured by
+    // the openwop-app host before it built to this row: with its dedup claim
+    // forced to always win, and then with the effect emitted twice per fire (an
+    // unambiguous double-fire), the per-identity count stayed 1 and the row
+    // stayed green. §C asks for INVOCATION counts; the projection exposes
+    // IDENTITIES. The only black-box oracle for "fired once" is a receiver the
+    // suite owns, so the seam aims the staged work's effect at `effectUrl`.
+    //
+    // NO `workflowId` is sent: no canonical fixture is guaranteed effectful
+    // (`conformance-noop` records none). The seam is host test infrastructure
+    // (§E) and chooses the work; it MUST stage work that performs EXACTLY ONE
+    // outbound effect, addressed to `effectUrl`, and deliver it twice.
+    const rx = await startEffectReceiver();
+    try {
+      const target = resolveRegistrationUrl(rx.url);
+      const fired = await driver.post(KILL_SEAM, { mode: 'duplicate-delivery', effectUrl: target.url });
+      if (fired.status >= 400) {
+        return softSkip('blocked', `the durability seam answered ${fired.status} for mode=duplicate-delivery with effectUrl ${target.tunnelled ? '(tunnelled)' : rx.url} — the host exposes the route but could not stage a double delivery; if its egress guard refused the receiver, the operator precondition is the webhook rows' own: a publicly-resolvable https front (OPENWOP_WEBHOOK_RECEIVER_URL) or a host run with its private-egress relaxation recorded`);
+      }
+      const runId = (fired.json as { runId?: unknown } | null)?.runId;
+      if (typeof runId !== 'string') {
+        return softSkip('blocked', 'the seam staged a duplicate delivery but named no runId');
+      }
 
-    const eff = await driver.get(`/runs/${encodeURIComponent(runId)}/effects`);
-    if (eff.status !== 200) {
-      return softSkip('blocked', `GET /runs/{runId}/effects answered ${eff.status} — per-identity invocation counts are unobservable, so the assertion would be vacuous`);
-    }
-    const effects = (eff.json as { effects?: Array<Record<string, unknown>> } | null)?.effects ?? [];
-    if (effects.length === 0) {
-      return softSkip('blocked', 'the staged run recorded no effects — there is no identity to count invocations against, and an end-state assertion is exactly what §C rules out');
-    }
-    // §C: assert INVOCATION COUNTS PER IDENTITY, not final state. A legal end
-    // state is precisely what a double-fire produces, so an end-state
-    // assertion passes on the defect it exists to catch.
-    const byIdentity = new Map<string, number>();
-    for (const e of effects) {
-      const id = String(e['effectId'] ?? e['keying'] ?? '');
-      if (id === '') continue;
-      byIdentity.set(id, (byIdentity.get(id) ?? 0) + 1);
+      await pollUntilTerminal(runId, { timeoutMs: scaledTimeoutMs(60_000) });
+      // A LONGER wait is a STRONGER claim: this is a wait for a second arrival
+      // that must not happen, and the second delivery may trail the first.
+      await new Promise((r) => setTimeout(r, scaledTimeoutMs(QUIET_WINDOW_MS)));
+
+      const arrivals = rx.arrivals.length;
+      if (arrivals === 0 && !target.tunnelled) {
+        return softSkip('blocked', `the staged work's effect never reached the suite's receiver at ${rx.url} — for mode=duplicate-delivery the seam MUST aim exactly one outbound effect at the given effectUrl; with nothing landed there is no invocation to count, and the ledger alone cannot witness a double-fire`);
+      }
+      // With a tunnel declared, zero arrivals is a hard failure, never a skip
+      // (webhook-receiver.ts): a mis-wired tunnel must not read as a pass.
+      expect(
+        arrivals,
+        req('openwop.requirement.0158.duplicate-delivery', 'RFC 0158 §C', `the same accepted work delivered twice MUST fire each effect exactly once, counted at the effect's destination — the suite's receiver observed ${arrivals} arrival(s) of the one staged effect for run ${runId}`),
+      ).toBe(1);
+
+      // Secondary, and labelled for what it is: the host's own account agrees
+      // with what landed. On an identity-keyed ledger this can never exceed one
+      // row per identity, so it witnesses that the PROJECTION IS CONSISTENT, not
+      // that no double-fire happened — the arrival count above owns that.
+      const eff = await driver.get(`/runs/${encodeURIComponent(runId)}/effects`);
+      if (eff.status === 200) {
+        const effects = (eff.json as { effects?: Array<Record<string, unknown>> } | null)?.effects ?? [];
+        const byIdentity = new Map<string, number>();
+        for (const e of effects) {
+          const id = String(e['effectId'] ?? e['keying'] ?? '');
+          if (id === '') continue;
+          byIdentity.set(id, (byIdentity.get(id) ?? 0) + 1);
+        }
+        const doubled = [...byIdentity.entries()].filter(([, n]) => n > 1);
+        expect(
+          doubled.length === 0,
+          req('openwop.requirement.0158.duplicate-delivery', 'RFC 0158 §C', `the effect ledger MUST agree with the destination: no effect identity recorded more than once — ${byIdentity.size} identity/identities, ${doubled.length} recorded more than once${doubled.length ? ` (${doubled.map(([k, n]) => `${k}×${n}`).join(', ')})` : ''}`),
+        ).toBe(true);
+      }
+    } finally {
+      await new Promise<void>((r) => rx.server.close(() => r()));
     }
-    const doubled = [...byIdentity.entries()].filter(([, n]) => n > 1);
-    expect(
-      doubled.length === 0,
-      req('openwop.requirement.0158.duplicate-delivery', 'RFC 0158 §C', `the same accepted work delivered twice MUST fire each effect exactly once, asserted per effect identity — ${byIdentity.size} identity/identities recorded, ${doubled.length} fired more than once${doubled.length ? ` (${doubled.map(([k, n]) => `${k}×${n}`).join(', ')})` : ''}`),
-    ).toBe(true);
-  }, 120_000);
+  }, 180_000);
 
   it('the declared recovery bound is derived from the mechanism that enforces it', async () => {
     const doc = await v2Discovery();
@@ -290,7 +480,7 @@ describe('v2-durability-recovery (RFC 0158 §B.4, §D.9, §E — the durable-sin
     ).toBe('failed');
 
     const before = await runEvents(runId);
-    if (before === null) return softSkip('blocked', 'GET /runs/{runId}/events did not answer — attempts are unobservable, so boundedness would be a vacuous claim');
+    if (before === null) return softSkip('blocked', 'GET /runs/{runId}/events/poll did not answer — attempts are unobservable, so boundedness would be a vacuous claim');
     // Non-vacuity: the failure must actually be ON the log. Without this a host
     // returning an empty array sails through every count comparison below,
     // because 0 === 0 after any wait.
@@ -308,7 +498,7 @@ describe('v2-durability-recovery (RFC 0158 §B.4, §D.9, §E — the durable-sin
     // reports a terminal status at some point. Count, wait, count again.
     await new Promise((r) => setTimeout(r, scaledTimeoutMs(QUIET_WINDOW_MS)));
     const after = await runEvents(runId);
-    if (after === null) return softSkip('blocked', 'the second GET /runs/{runId}/events did not answer, so the stability comparison has one side');
+    if (after === null) return softSkip('blocked', 'the second GET /runs/{runId}/events/poll did not answer, so the stability comparison has one side');
     const attemptsAfter = after.filter((e) => ATTEMPT_TYPES.has(e.type)).length;
     expect(
       attemptsAfter,