@openwop/openwop-conformance 2.33.0 → 2.33.2

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.33.2] — 2026-09-21 — `v2-run-snapshot-etag` took its tag from a run that was still moving
+
+- **The scenario slept a fixed 1 s after `POST /runs`, took the snapshot's `ETag`, and demanded `304`.** A host whose ETag tracks the run's event-log sequence — the strong tag `runs.md` §Snapshot asks for — is still appending while a noop executes, so between the two GETs the representation **changes** and `200` with a new tag is the only correct answer; a `304` there would be a stale-cache bug. **Measured on a tier-2 production host, 4 of 4:** immediately after create `etag1 ≠ etag2` and the conditional GET answers `200`; after the run settles the same request answers `304` every time. The row had passed three earlier cuts of that host and failed the fourth — a timing lottery, won whenever the run finished inside the sleep.
+- **It now waits for the run to be terminal, and the violation is stated exactly:** a `200` whose `ETag` **equals** the `If-None-Match` that was sent. A `200` carrying a *different* tag means the representation moved and the tag sent was honestly stale, so the scenario takes the new tag and retries (up to four reads); a terminal run whose snapshot never holds still records `blocked`, not fail.
+- A host with a **constant** ETag passed the old row for the wrong reason whenever it won the lottery; the non-matching control (`If-None-Match: "…no-such-tag"` MUST answer `200`) still catches a host that answers `304` to everything.
+- False FAIL only. Found by the MyndHyve host session, reproduced by hand on production before being reported.
+- Suite patch: corpus release stays `2.33.0`.
+
+## [2.33.1] — 2026-09-21 — two false fails: a race between two reads, and a subscription nobody unregistered
+
+- **`v2-durability-recovery`: the "completed without re-execution" latch was decided from two non-atomic reads in the wrong order.** Each iteration read the LOG, then the STATUS, and latched when the status said `completed` and the — older — log showed no resumption. A host that re-dispatched between the two requests read as "completed un-re-executed" while being neither. `conformance-noop` re-executes in milliseconds, so the window is real: per run roughly (gap between the requests) / (500 ms poll), a few percent. **Measured on a tier-1 host:** after a genuine SIGKILL and a correct recovery by lease expiry (727 s inside a declared 750 s bound) the row failed with *"read status completed with 2 run.started"* — printing the re-execution it was denying, because the message used a later read than the latch. The same host and code had passed the two previous runs.
+- **Status first, log second.** A run's log is append-only, so a log read taken *after* a `completed` status can only show more than the status implied: if it still shows no resumption the defect is real, if it shows resumption nothing was wrong, if it is unreadable nothing is concluded. The loop moves to `src/lib/durability-watch.ts` with injected readers, and `durability-watch.test.ts` pins the ordering without a host — the race reproduced, the genuine defect still latching, the latch staying sticky, and an unreadable log concluding nothing.
+- **The defect only ever produced FALSE FAILS, never false passes** — the latch could be set wrongly, never cleared wrongly — so an `executed-pass` on this row under 2.32.0 or 2.33.0 stands. A host that saw this row fail on those versions should re-run on 2.33.1 before triaging it.
+- Found by the openwop-app host session reading the installed scenario after an unexplained red. Introduced in 2.32.0, by the same change that made the row assert both clauses of §E item 11.
+- **`v2-webhook-delivery-shape` never unregistered anything, and behind a public front that failed a correct host.** On loopback each leg's receiver binds its own ephemeral port, so leg 1's leftover MAJOR-2 subscription delivered to a dead address and nobody noticed. Behind a tunnel every leg shares ONE URL on ONE pinned port: the still-live v2 subscription delivered its v2 rendering into leg 2, and the major-1 leg read it — *"a major-1 run.started payload MUST validate against the V1 definition … engineVersion must be string"* — on a host that had rendered both contracts correctly. It was the ONE failing row of the v2 reference host's first relaxation-free cut (241 pass / 1 fail / 0 blocked). **Reproduced with no ingress at all** by pinning `OPENWOP_WEBHOOK_RECEIVER_PORT` on a loopback run: ephemeral → 3/3, pinned → the major-1 leg fails; after the fix both → 3/3 and the host is left with **0** subscriptions. Every leg now unregisters what it registered, and — belt and braces — a delivery whose `OpenWOP-Webhook-Id` / `X-openwop-Webhook-Id` names a different subscription is not read as this leg's. The file also left a live subscription on every host it ever ran against; MyndHyve's operator had been sweeping them by hand after each tunnelled cut. The other major-2 webhook files were audited and already unregister.
+- Suite patch: corpus release stays `2.33.0`.
+
 ## [2.33.0] — 2026-09-21 — a declared relaxation denied nothing, an undeclared one was invisible, and two fakes made both unavoidable
 
 Step 2 of closing `docs/KNOWN-LIMITS.md` §"The reference host's certified bundles were cut under an undeclared relaxation". Three suite defects, all the corpus's.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.33.0 @openwop/spec-artifacts@2.33.0
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.33.2 @openwop/spec-artifacts@2.33.2
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.33.0",
-  "stampSha256": "e4dbaa49468204c51012de2eb0d2f121b9805804a77c6d108a0bafb707a86bf4"
+  "version": "2.33.2",
+  "stampSha256": "005732c466b247dadf5ee3d8c68186c6ce4f586febbaa260b7906fd496153965"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.33.0",
+  "version": "2.33.2",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.33.0"
+    "@openwop/spec-artifacts": "2.33.2"
   }
 }

package/requirements.json

@@ -26650,7 +26650,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.accepted-work-survives-a-kill-before-dispatch-and-dispatches-on-resume",
       "file": "v2-durability-recovery.test.ts",
-      "line": 262,
+      "line": 254,
       "title": "accepted work survives a kill before dispatch and dispatches on resume",
       "explicitId": "openwop.requirement.0158.kill-after-accept",
       "citations": [
@@ -26664,7 +26664,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.work-executing-at-a-real-process-death-is-never-reported-complete-and-resumes",
       "file": "v2-durability-recovery.test.ts",
-      "line": 307,
+      "line": 299,
       "title": "work executing at a real process death is never reported complete, and resumes",
       "explicitId": "openwop.requirement.0158.kill-during-execution",
       "citations": [
@@ -26683,7 +26683,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.the-same-accepted-work-delivered-twice-fires-each-effect-exactly-once",
       "file": "v2-durability-recovery.test.ts",
-      "line": 354,
+      "line": 346,
       "title": "the same accepted work delivered twice fires each effect exactly once",
       "explicitId": "openwop.requirement.0158.duplicate-delivery",
       "citations": [
@@ -26702,7 +26702,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.the-declared-recovery-bound-is-derived-from-the-mechanism-that-enforces-it",
       "file": "v2-durability-recovery.test.ts",
-      "line": 428,
+      "line": 420,
       "title": "the declared recovery bound is derived from the mechanism that enforces it",
       "explicitId": "openwop.requirement.0158.bound-is-derived",
       "citations": [
@@ -26716,7 +26716,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.deterministically-failing-work-reaches-a-terminal-state-and-stops-being-retried",
       "file": "v2-durability-recovery.test.ts",
-      "line": 458,
+      "line": 450,
       "title": "deterministically failing work reaches a terminal state and stops being retried",
       "explicitId": "openwop.requirement.0158.poison-exhaustion",
       "citations": [
@@ -28985,7 +28985,7 @@
     {
       "id": "openwop.it.v2-run-snapshot-etag.a-matching-if-none-match-receives-304-with-no-body-and-the-version-header-a-non",
       "file": "v2-run-snapshot-etag.test.ts",
-      "line": 34,
+      "line": 35,
       "title": "a matching If-None-Match receives 304 with no body and the version header; a non-matching one receives 200",
       "explicitId": "openwop.requirement.0170.run-snapshot-etag",
       "citations": [
@@ -29440,7 +29440,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-major-2-subscriber-receives-the-v2-rendering-the-delivery-validates-and-run-st",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 186,
+      "line": 220,
       "title": "a major-2 subscriber receives the v2 rendering: the delivery validates, and run.started.owner carries subject, never principal",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -29471,7 +29471,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-major-1-subscriber-still-receives-the-v1-rendering-the-v1-wire-does-not-move-m",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 205,
+      "line": 240,
       "title": "a major-1 subscriber still receives the v1 rendering — the v1 wire does not move mid-overlap",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -29489,7 +29489,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-seeded-era-2-run-is-delivered-projected-too-the-fan-out-branch-a-fresh-run-can",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 228,
+      "line": 264,
       "title": "a seeded era-2 run is delivered projected too — the fan-out branch a fresh run cannot reach (seam-gated)",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.33.0",
+  "version": "2.33.2",
   "corpusTag": "v2.33.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
@@ -201,7 +201,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "40069d5976eeb6ba1384a648e57e5cfd673db3fce36175115fb8293bee9664d4",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "9f5d065a0a84cf4745f53957f395b1e868453f910531e030f2da4039ee2c9140",
+    "spec/v1/core-standard-manifest.json": "65a8576c2e5ea9deb9d463be5b02a8bfb0e125a8dcbe3fe2cf286a4fd6d5d53e",
     "spec/v1/deprecations.json": "307083ce29c23fd406015951f99a30d78d6187ff061d38dc9732f62191b40f3f",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -282,5 +282,5 @@
     "spec/v2/release.json": "94a3ea302324d9f7df87ce62a186b0b98936de6ce5ac5ec01a3fb3208c38efc3",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "e9825b0da6ca8e2dbc76353e52aea73a56473393"
+  "corpusCommit": "65e40d60fbf43b1a0cd95a58e63d7464ed944ddb"
 }

package/src/lib/durability-watch.ts

@@ -0,0 +1,53 @@
+/**
+ * RFC 0158 §E item 11 — watching a run across a real process death.
+ *
+ * Two facts are wanted from one watch: (a) did resumption appear within the
+ * budget, and (b) was the run EVER observable as `completed` without having
+ * been re-executed. (b) is a statement about two pieces of host state — the
+ * status and the log — and they come from two requests, so the ORDER of the
+ * reads decides whether a conclusion is sound.
+ *
+ * Until 2.33.1 each iteration read the LOG, then the STATUS, and latched (b)
+ * when the status said `completed` and the (older) log showed no resumption. A
+ * host that re-dispatched between the two requests therefore read as "completed
+ * un-re-executed" while being neither: the log read predated the re-execution,
+ * the status read followed its completion. The staged work is `conformance-noop`,
+ * which re-executes in milliseconds, so the window is real — per run roughly
+ * (gap between the two requests) / (poll interval), a few percent. Measured on
+ * a tier-1 host: after a genuine SIGKILL and a correct recovery by lease expiry
+ * (727 s, inside a declared 750 s bound), the row failed with the message
+ * "read status completed with 2 run.started" — it printed the re-execution it
+ * was denying, because the message used a LATER read than the latch did. It had
+ * passed on the two previous runs of the same host and code.
+ *
+ * The rule: STATUS FIRST, LOG SECOND. A run's log is append-only, so a log read
+ * taken AFTER a `completed` status can only show MORE than the status implied.
+ * If that later log still shows no resumption, the run really was observable as
+ * completed un-re-executed. If it shows resumption, nothing was wrong. If it is
+ * unreadable, nothing is concluded — an unreadable log is never evidence.
+ *
+ * Readers are injected so the ordering itself is testable without a host.
+ */
+export interface Observation { readonly readable: boolean; readonly runStarted: number; readonly nodeStarted: number; readonly restored: number }
+export interface Watch { readonly resumedAfterMs: number | null; readonly last: Observation; readonly completedUnresumed: boolean; readonly waitedMs: number }
+export interface WatchIo {
+  readStatus(): Promise<string | null>;
+  readLog(): Promise<Observation>;
+  now(): number;
+  sleep(ms: number): Promise<void>;
+}
+
+export async function watchForResumption(io: WatchIo, budgetMs: number, resumed: (o: Observation) => boolean, pollMs = 500): Promise<Watch> {
+  const t0 = io.now();
+  let completedUnresumed = false;
+  for (;;) {
+    const status = await io.readStatus();   // FIRST
+    const last = await io.readLog();        // SECOND — never older than the status it is judged against
+    const waitedMs = io.now() - t0;
+    const isResumed = last.readable && resumed(last);
+    if (status === 'completed' && last.readable && !isResumed) completedUnresumed = true;
+    if (isResumed) return { resumedAfterMs: waitedMs, last, completedUnresumed, waitedMs };
+    if (waitedMs >= budgetMs) return { resumedAfterMs: null, last, completedUnresumed, waitedMs };
+    await io.sleep(pollMs);
+  }
+}

package/src/scenarios/v2-durability-recovery.test.ts

@@ -73,6 +73,7 @@ import { softSkip } from '../lib/soft-skip.js';
 import { pollUntilTerminal, scaledTimeoutMs } from '../lib/polling.js';
 import { req } from '../lib/requirement-ids.js';
 import { receiverBinding, resolveRegistrationUrl } from '../lib/webhook-receiver.js';
+import { watchForResumption, type Observation, type Watch } from '../lib/durability-watch.js';
 
 const FIXTURE = 'conformance-noop';
 const FAILURE_FIXTURE = 'conformance-failure';
@@ -156,7 +157,6 @@ async function waitBack(deadlineMs: number): Promise<number | null> {
  * minted for it is not failed for declining to re-emit `run.started`.
  */
 const RESTORED_TYPES = new Set(['workflow.restored', 'run.restored-from-snapshot']);
-interface Observation { readable: boolean; runStarted: number; nodeStarted: number; restored: number }
 async function observe(runId: string): Promise<Observation> {
   const events = await runEvents(runId);
   if (events === null) return { readable: false, runStarted: 0, nodeStarted: 0, restored: 0 };
@@ -214,26 +214,18 @@ async function declaredBoundMs(fired: unknown): Promise<{ ms: number; declared:
     : { ms: UNDECLARED_BOUND_FALLBACK_MS, declared: false };
 }
 
-interface Watch { resumedAfterMs: number | null; last: Observation; completedUnresumed: boolean; waitedMs: number }
 /**
- * Observe `runId` from the moment the service answers again until `resumed`
- * holds or `budgetMs` elapses. `completedUnresumed` latches if ANY observation
- * shows the run `completed` while `resumed` is still false — the item-11 defect
- * is a state a later observation can paper over, so it is checked at every read.
+ * Observe `runId` until `resumed` holds or `budgetMs` elapses. The loop itself —
+ * and the reason the STATUS is read before the LOG — lives in
+ * `lib/durability-watch.ts`, where the ordering is unit-tested without a host.
  */
-async function watchForResumption(runId: string, budgetMs: number, resumed: (o: Observation) => boolean): Promise<Watch> {
-  const t0 = Date.now();
-  let last: Observation = { readable: false, runStarted: 0, nodeStarted: 0, restored: 0 };
-  let completedUnresumed = false;
-  for (;;) {
-    last = await observe(runId);
-    const waitedMs = Date.now() - t0;
-    if (last.readable && resumed(last)) return { resumedAfterMs: waitedMs, last, completedUnresumed, waitedMs };
-    const snap = await driver.get(`/runs/${encodeURIComponent(runId)}`);
-    if ((snap.json as { status?: unknown } | null)?.status === 'completed' && !(last.readable && resumed(last))) completedUnresumed = true;
-    if (waitedMs >= budgetMs) return { resumedAfterMs: null, last, completedUnresumed, waitedMs };
-    await new Promise((r) => setTimeout(r, 500));
-  }
+function watch(runId: string, budgetMs: number, resumed: (o: Observation) => boolean): Promise<Watch> {
+  return watchForResumption({
+    readStatus: async () => { const snap = await driver.get(`/runs/${encodeURIComponent(runId)}`); const st = (snap.json as { status?: unknown } | null)?.status; return typeof st === 'string' ? st : null; },
+    readLog: () => observe(runId),
+    now: () => Date.now(),
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+  }, budgetMs, resumed);
 }
 
 /**
@@ -293,7 +285,7 @@ describe('v2-durability-recovery (RFC 0158 §B.4, §D.9, §E — the durable-sin
     // host's OWN declared bound elapses, never once at the instant of return.
     const bound = await declaredBoundMs(fired.json);
     const budget = Math.min(bound.ms, OBSERVATION_CEILING_MS);
-    const w = await watchForResumption(runId, budget, (o) => o.runStarted >= 1 || o.nodeStarted >= 1 || o.restored >= 1);
+    const w = await watch(runId, budget, (o) => o.runStarted >= 1 || o.nodeStarted >= 1 || o.restored >= 1);
     if (!w.last.readable) return softSkip('blocked', 'GET /runs/{runId}/events/poll did not answer after the restart — resumption is unobservable, and an unreadable log must not read as "nothing resumed"');
     if (w.resumedAfterMs === null && bound.ms > OBSERVATION_CEILING_MS) {
       return softSkip('blocked', `no dispatch observed in ${w.waitedMs}ms, but the host declares a ${bound.ms}ms recovery bound and this run observes for at most ${OBSERVATION_CEILING_MS}ms — a bound longer than the observation ceiling is conformant (§B.6) and is neither witnessed nor refuted here; the operator precondition for this row is OPENWOP_DURABILITY_OBSERVATION_CEILING_MS >= the declared bound`);
@@ -336,7 +328,7 @@ describe('v2-durability-recovery (RFC 0158 §B.4, §D.9, §E — the durable-sin
     // further one, or the registry's own recovery event.
     const bound = await declaredBoundMs(fired.json);
     const budget = Math.min(bound.ms, OBSERVATION_CEILING_MS);
-    const w = await watchForResumption(runId, budget, (o) => o.runStarted > 1 || o.restored >= 1);
+    const w = await watch(runId, budget, (o) => o.runStarted > 1 || o.restored >= 1);
     if (!w.last.readable) return softSkip('blocked', 'GET /runs/{runId}/events/poll did not answer after the restart — resumption is unobservable, and an unreadable log must not read as "nothing resumed"');
     expect(
       w.completedUnresumed,

package/src/scenarios/v2-run-snapshot-etag.test.ts

@@ -16,6 +16,7 @@
  * @see spec/v2/core/versioning.md §1.4
  */
 
+import { pollUntilTerminal, scaledTimeoutMs } from '../lib/polling.js';
 import { describe, it, expect } from 'vitest';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery } from '../lib/v2.js';
@@ -38,15 +39,39 @@ describe('v2 run-snapshot-etag (runs.md §Snapshot)', () => {
     const runId = (created.json as { runId?: unknown } | null)?.runId;
     if (created.status !== 201 || typeof runId !== 'string') return softSkip('blocked', `POST /runs answered ${created.status} ${readErrorCode(created.json) ?? ''} — create refused`.trim());
     const path = `/runs/${encodeURIComponent(runId)}`;
-    // Let the noop settle so the tag is stable across the two conditional reads.
-    await new Promise((r) => setTimeout(r, 1_000));
-    const first = await http(() => driver.get(path));
-    if (first === null || first.status !== 200) return softSkip('blocked', `GET /runs/{runId} answered ${first?.status ?? 'no response'}`);
-    const etag = first.headers.get('etag');
-    if (!etag) return softSkip('inapplicable', 'the snapshot carries no ETag — runs.md §Snapshot makes the ETag a SHOULD; the 304 rule applies only when it is present');
-    const hit = await http(() => driver.get(path, { headers: { 'If-None-Match': etag } }));
-    if (hit === null) return softSkip('blocked', 'conditional GET unreachable (fetch failed)');
-    expect(hit.status, req(ID, DOC, `a request whose If-None-Match matches the ETag MUST receive 304 — got ${hit.status}`)).toBe(304);
+    // The tag MUST be taken from a representation that has stopped moving. Until
+    // 2.33.2 this slept a fixed 1 s and hoped. A host whose ETag tracks the run's
+    // event-log sequence (RFC 0115 — the strong tag the SHOULD asks for) is still
+    // appending while a noop executes, so between the two GETs the representation
+    // CHANGES and `200` with a new tag is the only correct answer; a `304` there
+    // would be a stale-cache bug. Measured on a tier-2 production host, 4 of 4:
+    // immediately after create etag1 != etag2 and the conditional GET answers 200;
+    // after the run settles the same request answers 304 every time. The row had
+    // passed three earlier cuts of that host — a timing lottery, won when the run
+    // happened to finish inside the sleep. It also let a host with a CONSTANT tag
+    // pass for the wrong reason, which the control below still catches.
+    await pollUntilTerminal(runId, { timeoutMs: scaledTimeoutMs(30_000) });
+    let etag: string | null = null;
+    let hit: OpenWOPResponse | null = null;
+    // A terminal run should be still, but "should" is not the claim under test:
+    // if the tag moves again, take the NEW tag and retry. The violation is a 200
+    // whose ETag EQUALS the If-None-Match that was sent — never a 200 per se.
+    for (let attempt = 0; attempt < 4; attempt++) {
+      const first = await http(() => driver.get(path));
+      if (first === null || first.status !== 200) return softSkip('blocked', `GET /runs/{runId} answered ${first?.status ?? 'no response'}`);
+      etag = first.headers.get('etag');
+      if (!etag) return softSkip('inapplicable', 'the snapshot carries no ETag — runs.md §Snapshot makes the ETag a SHOULD; the 304 rule applies only when it is present');
+      const sent = etag;
+      hit = await http(() => driver.get(path, { headers: { 'If-None-Match': sent } }));
+      if (hit === null) return softSkip('blocked', 'conditional GET unreachable (fetch failed)');
+      if (hit.status !== 200 || hit.headers.get('etag') === sent) break; // 304, or the real violation: decided below
+      await new Promise((r) => setTimeout(r, 500)); // 200 with a DIFFERENT tag: the representation moved; the tag sent was honestly stale
+    }
+    if (hit === null || etag === null) return softSkip('blocked', 'no conditional GET was made');
+    if (hit.status === 200 && hit.headers.get('etag') !== etag) {
+      return softSkip('blocked', `the snapshot of a TERMINAL run kept changing across four reads (last tag sent ${etag}, answered 200 with ${String(hit.headers.get('etag'))}) — the 304 rule cannot be witnessed against a representation that never holds still`);
+    }
+    expect(hit.status, req(ID, DOC, `a request whose If-None-Match matches the CURRENT ETag MUST receive 304 — got ${hit.status} while the response still carried the same tag ${etag}`)).toBe(304);
     expect(hit.text.length, req(ID, DOC, `the 304 MUST carry no body (got ${hit.text.length} byte(s))`)).toBe(0);
     expect(hit.headers.get('openwop-version'), req(ID, 'spec/v2/core/versioning.md §1.4', 'every response carries OpenWOP-Version, the 304 included')).not.toBeNull();
     const miss = await http(() => driver.get(path, { headers: { 'If-None-Match': '"openwop-conformance-no-such-tag"' } }));

package/src/scenarios/v2-webhook-delivery-shape.test.ts

@@ -115,9 +115,32 @@ async function register(url: string, major: 1 | 2): Promise<string | null> {
   }
   expect(reg.status, req(ID, 'webhooks.md §Surfaces', 'POST /webhooks MUST answer 201 { webhookId }')).toBe(201);
   const id = (reg.json as { webhookId?: unknown } | null)?.webhookId;
+  if (typeof id === 'string') registered.push({ id, major });
   return typeof id === 'string' ? id : null;
 }
 
+/**
+ * Every subscription this file registers, unregistered after the leg that made
+ * it. Until 2.33.1 NOTHING here was ever unregistered. On loopback that was
+ * invisible: each leg's receiver bound its own ephemeral port, so a leftover
+ * subscription delivered to a dead address. Behind a public front every leg
+ * shares ONE URL on ONE pinned port - so leg 1's still-live MAJOR-2
+ * subscription delivered its v2 rendering into leg 2, and the major-1 leg read
+ * it and failed a host that had rendered both contracts correctly ("a major-1
+ * run.started payload MUST validate against the V1 definition … engineVersion
+ * must be string"). Found on the v2 reference host's first relaxation-free cut;
+ * reproduced with no ingress at all by pinning OPENWOP_WEBHOOK_RECEIVER_PORT on
+ * a loopback run. It also left a live subscription on every host this file ever
+ * ran against.
+ */
+const registered: Array<{ id: string; major: 1 | 2 }> = [];
+async function unregisterAll(): Promise<void> {
+  for (const r of registered.splice(0)) {
+    const path = `${r.major === 2 ? '' : '/v1'}/webhooks/${encodeURIComponent(r.id)}`;
+    try { await driver.delete(path, { headers: { 'OpenWOP-Version': r.major === 2 ? '2.0' : '1.0' } }); } catch { /* best effort: the leg's verdict is already recorded */ }
+  }
+}
+
 async function driveRun(): Promise<string> {
   const create = await driver.post('/runs', { workflowId: FIXTURE });
   expect(create.status, req(ID, 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
@@ -135,10 +158,21 @@ async function waitFor<T>(fn: () => T | undefined, ms: number): Promise<T | unde
  * receive the bare opaque id (versioning.md §5), so the match is on the segment
  * both spellings share.
  */
-function deliveryFor(deliveries: Delivery[], runId: string): { event: Record<string, unknown>; envelope: Record<string, unknown> } | undefined {
+/** The subscription a delivery says it belongs to, from either header family; undefined when it carries neither. */
+function subscriptionOf(d: Delivery): string | undefined {
+  const h = d.headers['openwop-webhook-id'] ?? d.headers['x-openwop-webhook-id'];
+  return typeof h === 'string' ? h : Array.isArray(h) ? h[0] : undefined;
+}
+const bare = (id: string): string => (id.includes('/') ? id.slice(id.indexOf('/') + 1) : id);
+
+function deliveryFor(deliveries: Delivery[], runId: string, webhookId?: string): { event: Record<string, unknown>; envelope: Record<string, unknown> } | undefined {
   const opaque = runId.includes('/') ? runId.slice(runId.indexOf('/') + 1) : runId;
   for (const d of deliveries) {
     if (!d.body.includes(opaque)) continue;
+    // Belt and braces beside unregisterAll(): a delivery that NAMES another
+    // subscription is not this leg's, whatever URL it arrived on.
+    const sub = subscriptionOf(d);
+    if (webhookId !== undefined && sub !== undefined && bare(sub) !== bare(webhookId)) continue;
     let parsed: unknown;
     try { parsed = JSON.parse(d.body); } catch { continue; }
     if (parsed === null || typeof parsed !== 'object') continue;
@@ -181,15 +215,16 @@ const V1 = 'https://openwop.dev/spec/v1/';
 
 describe('webhook delivery shape is per-contract (webhooks.md §Delivery, versioning.md §1.2)', () => {
   let active: Server | null = null;
-  afterEach(async () => { const s = active; active = null; if (s) await new Promise<void>((r) => s.close(() => r())); });
+  afterEach(async () => { await unregisterAll(); const s = active; active = null; if (s) await new Promise<void>((r) => s.close(() => r())); });
 
   it('a major-2 subscriber receives the v2 rendering: the delivery validates, and run.started.owner carries subject, never principal', async () => {
     if (!(await v2Discovery())) return softSkip('blocked', 'v2 discovery unreachable');
     if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
     const receiver = await startReceiver(); active = receiver.server;
-    if ((await register(receiver.url, 2)) === null) return softSkip('blocked', 'registration refused (reason recorded above)');
+    const webhookId = await register(receiver.url, 2);
+    if (webhookId === null) return softSkip('blocked', 'registration refused (reason recorded above)');
     const runId = await driveRun();
-    const d = await waitFor(() => deliveryFor(receiver.deliveries, runId), 15_000);
+    const d = await waitFor(() => deliveryFor(receiver.deliveries, runId, webhookId), 15_000);
     if (!d) return softSkip('blocked', `no ${EVENT_TYPE} delivery for this run arrived inside 15s — durability is v2-webhook-durable-delivery's claim, not this file's`);
     const v2 = validators(2);
     const envelope = v2.ref(`${V2}webhook-delivery.schema.json`)(d.envelope);
@@ -211,9 +246,10 @@ describe('webhook delivery shape is per-contract (webhooks.md §Delivery, versio
     const versions = Array.isArray(disc?.['protocolVersions']) ? (disc?.['protocolVersions'] as unknown[]).map(String) : [];
     if (!versions.some((v) => v.startsWith('1.'))) return softSkip('inapplicable', `host advertises [${versions.join(', ') || 'no protocolVersions'}] — no 1.x member, so there is no v1 wire to keep still`);
     const receiver = await startReceiver(); active = receiver.server;
-    if ((await register(receiver.url, 1)) === null) return softSkip('blocked', 'registration refused or inapplicable (disposition recorded above)');
+    const webhookId = await register(receiver.url, 1);
+    if (webhookId === null) return softSkip('blocked', 'registration refused or inapplicable (disposition recorded above)');
     const runId = await driveRun();
-    const d = await waitFor(() => deliveryFor(receiver.deliveries, runId), 15_000);
+    const d = await waitFor(() => deliveryFor(receiver.deliveries, runId, webhookId), 15_000);
     if (!d) return softSkip('blocked', `no ${EVENT_TYPE} delivery for this run arrived inside 15s`);
     // The v1 definition is the discriminator, not the owner's keys: v1's owner admits `subject` (RFC 0165
     // §B, echoed verbatim when present) alongside `principal`, so a v2 owner is ALSO a valid v1 owner.
@@ -234,11 +270,12 @@ describe('webhook delivery shape is per-contract (webhooks.md §Delivery, versio
     const gate = era2Gate(disc);
     if (gate !== null && !gate.ok) return softSkip(gate.kind, gate.reason);
     const receiver = await startReceiver(); active = receiver.server;
-    if ((await register(receiver.url, 2)) === null) return softSkip('blocked', 'registration refused (reason recorded above)');
+    const webhookId = await register(receiver.url, 2);
+    if (webhookId === null) return softSkip('blocked', 'registration refused (reason recorded above)');
     const log = await seedEra2Log(v1FixtureLog(FIXTURE), 'completed');
     if (!log.ok) return softSkip(log.kind, log.reason);
     const runId = log.runId;
-    const d = await waitFor(() => deliveryFor(receiver.deliveries, runId), 15_000);
+    const d = await waitFor(() => deliveryFor(receiver.deliveries, runId, webhookId), 15_000);
     // The seam appends HISTORY — rows that already happened — and a host MAY not fan out history (the
     // reference host's seam appends with fan-out suppressed by design). No delivery inside 15s means the
     // era-2 fan-out branch is unobservable on this host, not that a measurement failed: inapplicable.