@openwop/openwop-conformance 2.33.2 → 2.34.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.34.0] — 2026-09-21 — the rung and the recovery bound, in the bundle RFC 0158 said they were in
+
+- **RFC 0158 §E publishes a host's rung and recovery bound in its certification bundle instead of in discovery — and the bundle had no seat for either.** `certification-bundle.schema.json` is closed; a reader saw five pass/fail rows and could neither tell which rung was claimed nor recompute the bound, whose terms lived only on a non-normative seam route. Found by reading the RFC's first acceptance criterion at the moment of flipping it, with every row green.
+- **Evidence rides on ROWS, because that is the only place it is signed.** The attestation covers `{ witnessSha256, host.build, suite.version, discovery.sha256 }` and the witness digest covers rows, so a root-level block would be editable after signing on a bundle that still verifies. A row gains an OPTIONAL closed `evidence` object that enters the digest **only when present** — every earlier bundle digests byte-identically, pinned against the three committed host bundles.
+  - `0158.bound-is-derived` → `evidence.recoveryBounds[]` of `{ class, bound, terms[{ name, ms }] }`, **per recovery class, no aggregate** (Unresolved Question 1: a scalar would have to be the maximum, which overstates recovery for every faster class).
+  - `0158.kill-after-accept`, `0158.kill-during-execution` → `evidence.recovery { class, boundMs, observedMs }`. The kill → resumption interval was always measured and appeared only in a FAILURE message; a passing row recorded nothing.
+- **`durability.rung` is a claim, and the verifier does not trust it.** It sits outside the signature, which is sound for the reason `claimedProfiles[].certified` is: `--verify` re-derives it from signed rows — all five rows `executed-pass`, each kill row's `class` naming a declared entry whose `bound` equals its `boundMs` and is not exceeded by its `observedMs`, each entry's terms summing to its bound — and rejects what it cannot derive (new rejection `rung-not-derivable`). Only `durable-single-instance` is derivable; `peer-resume` evidence is not carried yet, so a higher claim is **refused rather than assumed**. `--certify` claims a rung only when the same derivation supports it, and says on stderr which rung it derived and why.
+- **`class` and term names are opaque, host-chosen, and pattern-constrained** (`^[a-z][A-Za-z0-9._-]{0,63}$`, ≤ 16 classes × ≤ 16 terms). Never an enum: "leased" names one host's mechanism and "boot re-entry" another's. Only `{ name, ms }` survives from a term — free text a host attaches to its seam response never reaches a published bundle.
+- **What class-binding does NOT catch, stated and pinned by a test so nobody reads more into it.** It refuses an undeclared class, a bound label that disagrees with its class, and a resumption outside the bound. It does not refuse a seam that kills *before* the execution claim is held and labels the exercise with the slower class — a tier-1 host shipped exactly that (11.6 s against a 750 s leased class, every row green), and no arithmetic separates it from a fast recovery. The evidence makes it **visible** where before nothing was recorded; killing only once the claim is held stays the host's obligation.
+- **Seam contract (non-normative):** the bound response may be `{ classes: [{ class, bound, terms[] }] }`, a map keyed by class, or the flat `{ bound, terms[], class? }` two hosts already serve. A top-level scalar beside `classes` is ignored. A flat response that names no class is recorded as `default`, which will not match a kill response naming a real class — so the rung is not derivable until the bound says which class it governs.
+- **`--verify` gains a `rung:` line and a newer-suite notice.** A verifier older than the bundle it reads recomputes a different witness digest and fails closed, correctly — but `witness-digest` reads as tampering when the truth is "upgrade the verifier".
+- Additive. No scenario added or removed; no host that passed before fails now. `bundleVersion` stays `"3"`.
+
 ## [2.33.2] — 2026-09-21 — `v2-run-snapshot-etag` took its tag from a run that was still moving
 
 - **The scenario slept a fixed 1 s after `POST /runs`, took the snapshot's `ETag`, and demanded `304`.** A host whose ETag tracks the run's event-log sequence — the strong tag `runs.md` §Snapshot asks for — is still appending while a noop executes, so between the two GETs the representation **changes** and `200` with a new tag is the only correct answer; a `304` there would be a stale-cache bug. **Measured on a tier-2 production host, 4 of 4:** immediately after create `etag1 ≠ etag2` and the conditional GET answers `200`; after the run settles the same request answers `304` every time. The row had passed three earlier cuts of that host and failed the fourth — a timing lottery, won whenever the run finished inside the sleep.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.33.2 @openwop/spec-artifacts@2.33.2
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.34.0 @openwop/spec-artifacts@2.34.0
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/coverage.md

@@ -145,7 +145,7 @@ The scenario groups in the table below (one row per group; count the rows — th
 | `egress-audience-binding.test.ts`                                                                                                                                                                                                                       | `capabilities.httpClient.egressPolicy.supported` (RFC 0079 §C, `host-capabilities.md`) + `SECURITY/invariants.yaml` `egress-credential-audience-bound`                                                                                                                                                                  | A (KEYSTONE — the §C confused-deputy MUST via `POST /v1/host/sample/egress/decide`: an out-of-audience egress is `denied`/`downgraded` with `reason:"out-of-audience"` and the credential is NOT attached (`credentialAttached !== true`); a provenance-unevaluable egress fails closed `denied`+`reason:"provenance-unevaluable"`; decision/reason ∈ the closed enums)                                                                                                                                                                                                                                                                                                                             | `host-pending`                                                                                                                   | `behaviorGate('openwop-egress-audience-binding', …)`. Seam-gated; soft-skips on 404. **This is the RFC 0079 → Accepted bar** (the `egress-credential-audience-bound` invariant graduates reference-impl → protocol tier when this passes against a host). First adopter: MyndHyve `httpClient.egressPolicy`.                                                                                                                                                                                                                                                                                                                            |
 | `egress-decision-content-free.test.ts`                                                                                                                                                                                                                  | `capabilities.httpClient.egressPolicy.supported` (RFC 0079 §F / SR-1)                                                                                                                                                                                                                                                   | A (the secret non-leak — a `canary` credential's sentinel never surfaces in the decision (`canaryLeaked !== true`), the `egress.decided` payload carries no forbidden content key, and `reason` stays in the CLOSED vocabulary so no blocked destination spills into a free-form field)                                                                                                                                                                                                                                                                                                                                                                                                             | `host-pending`                                                                                                                   | `behaviorGate('openwop-egress-decision-content-free', …)`. Seam-gated; soft-skips on 404. **Part of the RFC 0079 → Accepted bar.** First adopter: MyndHyve `httpClient.egressPolicy`.                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | `v2-webhook-egress-refusal.test.ts` | the `webhooks` family (capability-gated) | A (`webhooks.md` §SSRF at MAJOR 2 — eight registration probes, one per class the sentence names: non-`https`, IPv4/IPv6 loopback, `localhost`, two RFC 1918 ranges, link-local / cloud metadata, IPv6 ULA; each MUST answer `400 webhook_url_rejected`. Until 2.33.0 no major-2 row asserted the guard refuses anything — the refusal scenarios were major-1 only. THREE OUTCOMES: all refused → `executed-pass`; a probe accepted with a `webhooks.*` relaxation DECLARED in `OPENWOP_HOST_RELAXATIONS` → `inapplicable`, and the declared relaxation denies the owning profile; a probe accepted with NOTHING declared → `executed-fail`, which the emitter and verifier read as an OBSERVED undeclared relaxation and deny every profile built on `webhooks` (`undeclared-relaxation-observed`). Registration-time only: no probe is a destination the suite owns, nothing is delivered, an accepted registration is deleted at once) |
-| `v2-durability-recovery.test.ts` | the RFC 0158 host-extension durability seam `POST /host/durability/kill` (non-normative; §E mints no capability field, so seam PRESENCE is how a host says it claims a rung) | A (all five `durable-single-instance` rows: `kill-after-accept` as a HOLD-DISPATCH exercise, `kill-during-execution` asserting that work executing at a real process death is never observable as completed without re-execution, `duplicate-delivery` counted AT THE EFFECT'S DESTINATION — a receiver the suite owns, `effectUrl` — because a ledger keyed on effect identity admits one row per identity by construction and cannot show a double-fire (2.32.0), `bound-is-derived` as an explicitly-labelled paper check, and `poison-exhaustion` ported from the major-1 scenario — at major 2 it reads the canonical JSON log read `GET /runs/{runId}/events/poll` (NOT `/events`, which is SSE-only at major 2 — reading it as JSON made this row pass vacuously on a host serving exactly the OpenAPI; 2.32.0), so unlike its v1 twin it needs NO seam and can never record `blocked` for want of one a host did not wire) | `host-pending` | **Disposition rule, and it protects fleet certification:** no seam route at all ⇒ `inapplicable` (the host claims no rung); seam present but an operator precondition unmet — a restart supervisor, which a black-box suite cannot supply — ⇒ `blocked` with the precondition NAMED. Collapsing the two would deny certification to every host the day these rows entered the lane. `peer-resume` is deliberately NOT written: §E makes it bundle-witnessed, so a scenario could only ever record `blocked`. **This is the RFC 0158 → Accepted bar, and it is now complete at major 2** — before the port, a major-2 bundle could carry at most four of the five rows and the rung was unwitnessable no matter what a host did, and its witness is openwop-app, which the RFC records as having observed `kill-during-execution` across a real `SIGKILL`. |
+| `v2-durability-recovery.test.ts` | the RFC 0158 host-extension durability seam `POST /host/durability/kill` (non-normative; §E mints no capability field, so seam PRESENCE is how a host says it claims a rung) | A (all five `durable-single-instance` rows: `kill-after-accept` as a HOLD-DISPATCH exercise, `kill-during-execution` asserting that work executing at a real process death is never observable as completed without re-execution, `duplicate-delivery` counted AT THE EFFECT'S DESTINATION — a receiver the suite owns, `effectUrl` — because a ledger keyed on effect identity admits one row per identity by construction and cannot show a double-fire (2.32.0), `bound-is-derived` as an explicitly-labelled paper check, and `poison-exhaustion` ported from the major-1 scenario — at major 2 it reads the canonical JSON log read `GET /runs/{runId}/events/poll` (NOT `/events`, which is SSE-only at major 2 — reading it as JSON made this row pass vacuously on a host serving exactly the OpenAPI; 2.32.0), so unlike its v1 twin it needs NO seam and can never record `blocked` for want of one a host did not wire) | `host-pending` | **2.34.0 — the rows now WRITE evidence into the bundle (RFC 0158 §E):** `bound-is-derived` records `evidence.recoveryBounds[]` per recovery class and each kill row records `evidence.recovery { class, boundMs, observedMs }` — the interval was always measured and, on a pass, never recorded. Both ride on the ROW so the witness digest, and through it the signature, covers them; the bundle claims `durability.rung` only when `deriveRung` supports it and `--verify` rejects a claim it cannot re-derive (`rung-not-derivable`). A kill row records nothing unless the seam NAMES the class it exercised (`recoveryClass`) and the bound response declares that class — no name, no rung, rather than a guessed one. **Disposition rule, and it protects fleet certification:** no seam route at all ⇒ `inapplicable` (the host claims no rung); seam present but an operator precondition unmet — a restart supervisor, which a black-box suite cannot supply — ⇒ `blocked` with the precondition NAMED. Collapsing the two would deny certification to every host the day these rows entered the lane. `peer-resume` is deliberately NOT written: §E makes it bundle-witnessed, so a scenario could only ever record `blocked`. **This is the RFC 0158 → Accepted bar, and it is now complete at major 2** — before the port, a major-2 bundle could carry at most four of the five rows and the rung was unwitnessable no matter what a host did, and its witness is openwop-app, which the RFC records as having observed `kill-during-execution` across a real `SIGKILL`. |
 | `memory-degraded-projection.test.ts`                                                                                                                                                                                                                    | `capabilities.agents.manifestRuntime.supported` + `capabilities.memory.supported` (RFC 0080 §C, `agent-memory.md`)                                                                                                                                                                                                      | A (the §C iff-contract on the NORMATIVE `GET /v1/agents`: a degraded entry MUST carry `memoryDegraded:true` + a non-empty, unique `degradedMemoryDimensions[]` drawn from the closed §A-name enum [read/write/search/long-term-durability/compaction/attribution/replay-snapshot/retention]; a non-degraded entry MUST NOT carry a non-empty list; the inventory is non-empty; the degraded branch runs non-vacuously when `OPENWOP_DEGRADED_AGENT_ID` names a known-degraded agent)                                                                                                                                                                                                                | `host-pending`                                                                                                                   | `behaviorGate('openwop-memory-degraded', …)`. Black-box on the normative path (no POST seam); soft-skips on 404 / when the host computes no degradation. **This is the RFC 0080 → Accepted bar.** First adopter: MyndHyve `memory`.                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `budget-enforcement.test.ts`                                                                                                                                                                                                                            | `capabilities.budget.supported` (RFC 0084 §C/§D, `budget-policy.md`) + `SECURITY/invariants.yaml` `budget-no-pricing-leak`                                                                                                                                                                                              | A (the §C/§D enforcement via `POST /v1/host/sample/budget/run` + the test event-log seam: a `hard-cost-exhaust` run emits the strict-ordered `budget.reserved → budget.consumed → budget.threshold.crossed{percent} → budget.exhausted → cap.breached{kind:"budget-cost"} → run.failed{error:"budget_exhausted"}` chain; a `model-denied` run is refused `budget_model_denied` BEFORE the provider call (fail-closed); an `advisory` host emits the `budget.*` events without stopping; every `budget.*` payload content-free — no pricing/rate)                                                                                                                                                    | `host-pending`                                                                                                                   | `behaviorGate('openwop-budget-enforcement', …)`. Seam-gated; soft-skips on 404. **This is the RFC 0084 → Accepted bar.** First adopter: MyndHyve `budget`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `agent-platform-aggregate-evidence.test.ts`                                                                                                                                                                                                             | `openwop-agent-platform` claim — live discovery `profiles[]` includes it (RFC 0085 §C, `agent-platform-profile.md`)                                                                                                                                                                                                     | A (the §C/§D honest-advertisement on live `/.well-known/openwop`: a host claiming `openwop-agent-platform` MUST satisfy the §B floor predicate (`isAgentPlatformPartial` → `partial`/`full`, never `none`), the claim backed by per-capability evidence not the profile string; `OPENWOP_AGENT_PLATFORM_TIER=full` forces the full-predicate bar — all governance terms + tenant installScope + all 16 §D terms)                                                                                                                                                                                                                                                                                    | `host-pending`                                                                                                                   | `behaviorGate('openwop-agent-platform', …)`. Black-box on the discovery doc (no POST seam); soft-skips until a host claims the profile. **This is the RFC 0085 → Accepted bar.** First adopter: MyndHyve (after the memory batch surfaces the floor's `memory.supported`).                                                                                                                                                                                                                                                                                                                                                              |

package/dist/cli.js

@@ -41,6 +41,7 @@ import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import { SCHEMAS_DIR } from './lib/paths.js';
 import { readLedgerFile } from './lib/requirement-ledger.js';
+import { deriveRung, emittedByNewerSuite } from './lib/durability-evidence.js';
 import { deriveRequirementDispositions } from './lib/scenario-disposition.js';
 import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/certification-bundle-verify.js';
 import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest } from './lib/certification-bundle-v3.js';
@@ -619,7 +620,15 @@ async function runCertify(args, baseUrl, apiKey) {
             process.stderr.write('openwop-conformance --certify: a v3 bundle needs --host-build <kind>:<id> (or OPENWOP_HOST_BUILD), --signing-key <pem> (or OPENWOP_BUNDLE_SIGNING_KEY) and --signing-key-id (or OPENWOP_BUNDLE_SIGNING_KEY_ID) — an unsigned bundle does not exist in v3 (RFC 0168 §E.2).\n');
             process.exit(2);
         }
-        const rows3 = derived.requirements.map((r) => ({ id: r.requirementId, scenario: r.scenarioId, result: r.disposition, ...(r.assertionCount === undefined ? {} : { assertions: r.assertionCount }), ...(r.detail === undefined ? {} : { detail: r.detail }) }));
+        const evidenceById = new Map();
+        for (const e of ledgerEntries)
+            if (e.evidence !== undefined && e.disposition === 'executed-pass')
+                evidenceById.set(e.requirementId, e.evidence);
+        const rows3 = derived.requirements.map((r) => ({ id: r.requirementId, scenario: r.scenarioId, result: r.disposition, ...(r.assertionCount === undefined ? {} : { assertions: r.assertionCount }), ...(r.detail === undefined ? {} : { detail: r.detail }),
+            // RFC 0158 §E: structured evidence rides on the ROW, so the witness digest —
+            // and through it the signature — covers it. Lifted from the raw ledger by
+            // requirement id, and only onto a row that is itself `executed-pass`.
+            ...(r.disposition === 'executed-pass' && evidenceById.has(r.requirementId) ? { evidence: evidenceById.get(r.requirementId) } : {}) }));
         const totals3 = derived.totals;
         const doc3 = document;
         const protocolVersions = Array.isArray(doc3['protocolVersions']) ? doc3['protocolVersions'] : [String(doc3['protocolVersion'] ?? '')];
@@ -672,6 +681,10 @@ async function runCertify(args, baseUrl, apiKey) {
         const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');
         const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, 'utf8')) : undefined;
         const nonPass = rows3.filter((r) => r.result !== 'executed-pass');
+        const rung3 = deriveRung(rows3);
+        if (rows3.some((r) => r.id.startsWith('openwop.requirement.0158.') && r.result === 'executed-pass' && r.id !== 'openwop.requirement.0158.poison-exhaustion')) {
+            process.stderr.write(`openwop-conformance --certify: RFC 0158 rung — ${rung3.rung ?? 'NONE'} (${rung3.why})\n`);
+        }
         const unsigned = {
             bundleVersion: '3',
             generatedAt: new Date().toISOString(),
@@ -687,6 +700,10 @@ async function runCertify(args, baseUrl, apiKey) {
             witnessSha256: witnessDigest(rows3),
             assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
             ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
+            // RFC 0158 §D: claimed ONLY when these rows support it. The verifier
+            // re-derives the same answer from the same signed rows, so an emitter that
+            // claimed more would be writing a bundle its own `--verify` rejects.
+            ...(rung3.rung === null ? {} : { durability: { rung: rung3.rung } }),
         };
         const signature = signBundleV3(unsigned, signingKeyPem, keyId);
         const v3 = { ...unsigned, signature };
@@ -889,6 +906,8 @@ async function main() {
             `suite:     ${bundle.suite?.version ?? '?'} (this CLI is ${suiteVersion()})`,
             `totals:    executedPass=${t.executedPass ?? '?'} executedFail=${t.executedFail ?? '?'} blocked=${t.blocked ?? '?'} inapplicable=${t.inapplicable ?? '?'} skipped=${t.skipped ?? '?'}`,
             `certified: ${verdict.certifiedProfiles.length > 0 ? verdict.certifiedProfiles.join(', ') : '(none)'}`,
+            // RFC 0158 §D/§E: the rung is a CLAIM; a claim the signed rows do not support is a rejection below.
+            `rung:      ${bundle.durability?.rung ?? '(none claimed)'}`,
             '',
             'What this command does NOT do:',
             '  · It does not re-run anything. A host that measured itself wrongly, and signed',
@@ -899,6 +918,9 @@ async function main() {
             '    an older bundle measured less, and whose fact that is belongs to its emitter.',
             '',
         ];
+        if (emittedByNewerSuite(bundle.suite?.version, suiteVersion())) {
+            out.push(`NOTE \u2014 this bundle was emitted by suite ${String(bundle.suite?.version)}, NEWER than this verifier (${suiteVersion()}).`, '  A newer suite may digest row members this verifier does not know. If a `witness-digest`', '  rejection follows, upgrade the verifier before reading it as tampering.', '');
+        }
         if (verdict.rejections.length > 0) {
             out.push(`REJECTED \u2014 ${verdict.rejections.length} problem(s):`);
             for (const r of verdict.rejections)

package/dist/lib/certification-bundle-v3.js

@@ -19,6 +19,7 @@
  */
 import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify } from 'node:crypto';
 import { profileDerivable } from './profiles.js';
+import { checkRungClaim } from './durability-evidence.js';
 import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2RegistryAvailable } from './v2-profiles.js';
 export const SIGNATURE_OVER = ['witnessSha256', 'host.build', 'suite.version', 'discovery.sha256'];
 /** Deterministic JSON: keys sorted at every level, no whitespace. */
@@ -32,7 +33,9 @@ export function canonicalJSON(value) {
 }
 /** RFC 0148 §C — the digest over the reporter record (the requirement rows). */
 export function witnessDigest(rows) {
-    const canonicalRows = [...rows].sort((a, b) => a.id.localeCompare(b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }) }));
+    const canonicalRows = [...rows].sort((a, b) => a.id.localeCompare(b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }),
+        // ONLY WHEN PRESENT: every bundle cut before 2.34.0 has no `evidence` and digests byte-identically.
+        ...(r.evidence === undefined ? {} : { evidence: r.evidence }) }));
     return createHash('sha256').update(canonicalJSON(canonicalRows), 'utf8').digest('hex');
 }
 /** The bytes the attestation covers. */
@@ -120,6 +123,11 @@ export function verifyBundleV3(bundle, opts = {}) {
     const relaxed = new Set((bundle.host?.relaxations ?? []).map((r) => r.obligation.split('.')[0]));
     // Ownership comes from the profile registry, not from the profile's name — see profilesRelaxedBy.
     const relaxedProfiles = profilesRelaxedBy((bundle.host?.relaxations ?? []).map((r) => r.obligation), (bundle.claimedProfiles ?? []).map((p) => p.id));
+    // RFC 0158 §D: a rung is CLAIMED at the top level, outside the signature, and
+    // is therefore only ever as good as its re-derivation from the signed rows.
+    const rung = checkRungClaim(bundle.durability?.rung, rows);
+    if (!rung.ok)
+        rejections.push({ kind: 'rung-not-derivable', detail: rung.detail });
     // An OBSERVED relaxation nobody declared: the bundle's own results show the
     // host accepting a destination its egress guard MUST refuse. Same denial as a
     // declared one, so declaring nothing is not a way around the rule.

package/dist/lib/durability-evidence.js

@@ -0,0 +1,182 @@
+/**
+ * RFC 0158 §E — the rung and the recovery bound, IN THE BUNDLE.
+ *
+ * §E.10 mints no discovery capability: "a qualification ladder is evidence about
+ * behaviour that already exists, so the useful place for a rung and a recovery
+ * bound is the host's conformance evidence bundle — where a claim without
+ * evidence is already a defect." Until 2.34.0 that sentence had nothing behind
+ * it. `certification-bundle.schema.json` had no seat for a rung, a bound or its
+ * terms; a bundle showed five pass/fail rows, and a reader could neither tell
+ * which rung was claimed nor recompute the bound. The terms lived only on a
+ * non-normative seam route. Found by READING acceptance criterion 1 at the
+ * moment of flipping the RFC, with every row already green.
+ *
+ * ── Why the evidence rides on ROWS ───────────────────────────────────────────
+ * The attestation covers exactly `{ witnessSha256, host.build, suite.version,
+ * discovery.sha256 }` (`conformance.md` §Bundle v3), and `witnessSha256` digests
+ * the requirement rows. A top-level block would therefore be UNSIGNED — a bound
+ * or a rung editable after signing on a bundle that still verifies. Evidence
+ * carried on a row is inside the witness digest, and so inside the signature.
+ * It enters the digest ONLY WHEN PRESENT, so every bundle cut before 2.34.0
+ * digests byte-identically and still verifies (pinned against the three
+ * committed bundles in `durability-evidence.test.ts`).
+ *
+ * ── Why the rung claim is NOT trusted ────────────────────────────────────────
+ * `durability.rung` sits at the top level, outside the signature, and that is
+ * sound for the same reason `claimedProfiles[].certified` is: the verifier
+ * RE-DERIVES it from signed rows and rejects a claim it cannot derive. §D: "a
+ * host MAY claim a rung only with the evidence named for it."
+ *
+ * ── Why a kill row names its recovery CLASS ──────────────────────────────────
+ * Unresolved Question 1 resolved PER WORK CLASS, not a scalar. A host with an
+ * outbox lane (65 s) and a dispatch lease (750 s) has two bounds, so each kill
+ * row records `{ class, boundMs, observedMs }`: the class MUST name a declared
+ * entry, `boundMs` MUST equal that entry's `bound`, and `observedMs` MUST NOT
+ * exceed it.
+ *
+ * WHAT THAT CATCHES, and what it cannot. It refuses an undeclared class, a bound
+ * label that disagrees with its class, and a resumption outside the bound. It
+ * does NOT catch a host that names the WRONG DECLARED class while resuming
+ * inside that class's (longer) bound — which a tier-1 host actually shipped: the
+ * seam killed before the execution claim was held, the 65 s lane rescued the run
+ * in 11.6 s, and the exercise was labelled leased / 750 s, every row green. No
+ * arithmetic separates that from a fast leased recovery. What the evidence
+ * changes is that it becomes VISIBLE — 11.6 s recorded against a class whose own
+ * terms say 720 s of lease — where before nothing was recorded at all. Killing
+ * only once the claim is held stays the HOST's obligation (§E).
+ *
+ * `class` is an OPAQUE host-chosen string, never an enum: "leased" / "unleased"
+ * name one host's mechanisms and boot re-entry is another's. An enum would
+ * select for an architecture, which this RFC refuses to do everywhere else.
+ * There is NO scalar "overall bound": that is UQ1's lie by aggregation with a
+ * friendlier name, and a reader would use it.
+ *
+ * What this block proves: ARITHMETIC (Σ terms = bound) and, through the kill
+ * rows' `observedMs`, that the mechanism RAN at least once inside the bound.
+ * `bound-is-derived` alone remains a paper check and MUST NOT be cited for
+ * liveness.
+ */
+/** Host-chosen identifiers enter a PUBLISHED bundle: short, plain, no free text. */
+export const EVIDENCE_NAME_PATTERN = /^[a-z][A-Za-z0-9._-]{0,63}$/;
+export const MAX_RECOVERY_CLASSES = 16;
+export const MAX_TERMS_PER_CLASS = 16;
+export const RUNGS = ['durable-single-instance', 'durable-multi-instance', 'multi-region-qualified'];
+const R = 'openwop.requirement.0158.';
+/** The rows §Acceptance names for the lowest rung. */
+export const SINGLE_INSTANCE_ROWS = ['kill-after-accept', 'kill-during-execution', 'duplicate-delivery', 'poison-exhaustion', 'bound-is-derived'].map((r) => R + r);
+const KILL_ROWS = [R + 'kill-after-accept', R + 'kill-during-execution'];
+const BOUND_ROW = R + 'bound-is-derived';
+const isCount = (n) => typeof n === 'number' && Number.isInteger(n) && n >= 0;
+const isName = (s) => typeof s === 'string' && EVIDENCE_NAME_PATTERN.test(s);
+/** Normalise what a host's seam returned into bundle evidence, or say exactly why it cannot be. */
+export function parseRecoveryBounds(raw) {
+    if (!Array.isArray(raw) || raw.length === 0)
+        return { ok: false, why: 'no recovery classes were declared' };
+    if (raw.length > MAX_RECOVERY_CLASSES)
+        return { ok: false, why: `more than ${MAX_RECOVERY_CLASSES} recovery classes` };
+    const bounds = [];
+    const seen = new Set();
+    for (const entry of raw) {
+        const cls = entry?.['class'];
+        if (!isName(cls))
+            return { ok: false, why: `a recovery class name does not match ${String(EVIDENCE_NAME_PATTERN)}` };
+        if (seen.has(cls))
+            return { ok: false, why: `recovery class ${cls} is declared twice` };
+        seen.add(cls);
+        const terms = entry['terms'];
+        if (!Array.isArray(terms) || terms.length === 0 || terms.length > MAX_TERMS_PER_CLASS)
+            return { ok: false, why: `class ${cls}: terms[] MUST carry 1..${MAX_TERMS_PER_CLASS} entries — a total alone cannot be recomputed` };
+        const clean = [];
+        for (const t of terms) {
+            if (!isName(t?.['name']) || !isCount(t['ms']))
+                return { ok: false, why: `class ${cls}: every term is { name, ms } with ms a non-negative integer` };
+            clean.push({ name: t['name'], ms: t['ms'] });
+        }
+        if (!isCount(entry['bound']))
+            return { ok: false, why: `class ${cls}: bound is a non-negative integer of milliseconds` };
+        const sum = clean.reduce((a, t) => a + t.ms, 0);
+        if (sum !== entry['bound'])
+            return { ok: false, why: `class ${cls}: terms sum to ${sum} ms but the declared bound is ${String(entry['bound'])} ms — a host that states a bound its terms do not produce fails §B.5` };
+        bounds.push({ class: cls, bound: entry['bound'], terms: clean });
+    }
+    return { ok: true, bounds };
+}
+/**
+ * The highest rung these SIGNED rows support, and — when it is lower than a
+ * reader might hope — the first reason why. Only `durable-single-instance` is
+ * derivable today: `peer-resume` is bundle-witnessed by a per-boot incarnation
+ * token this revision does not yet carry (§E), so a higher claim is REFUSED
+ * rather than waved through.
+ */
+export function deriveRung(rows) {
+    const byId = new Map(rows.map((r) => [r.id, r]));
+    for (const id of SINGLE_INSTANCE_ROWS) {
+        const row = byId.get(id);
+        if (row === undefined)
+            return { rung: null, why: `${id} is absent from the bundle` };
+        if (row.result !== 'executed-pass')
+            return { rung: null, why: `${id} is ${row.result}, not executed-pass` };
+    }
+    const declared = parseRecoveryBounds(byId.get(BOUND_ROW)?.evidence?.recoveryBounds);
+    if (!declared.ok)
+        return { rung: null, why: `${BOUND_ROW} carries no usable evidence.recoveryBounds — ${declared.why}` };
+    const bounds = new Map(declared.bounds.map((b) => [b.class, b.bound]));
+    for (const id of KILL_ROWS) {
+        const obs = byId.get(id)?.evidence?.recovery;
+        if (obs === undefined)
+            return { rung: null, why: `${id} passed but recorded no evidence.recovery — the class it exercised and the interval it observed are unknown` };
+        if (!isName(obs.class) || !isCount(obs.boundMs) || !isCount(obs.observedMs))
+            return { rung: null, why: `${id}: evidence.recovery is malformed` };
+        const bound = bounds.get(obs.class);
+        if (bound === undefined)
+            return { rung: null, why: `${id} exercised recovery class "${obs.class}", which ${BOUND_ROW} does not declare (declared: ${[...bounds.keys()].join(', ')})` };
+        if (obs.boundMs !== bound)
+            return { rung: null, why: `${id} was judged against ${obs.boundMs} ms but class "${obs.class}" declares ${bound} ms — the exercise was labelled with a bound that does not govern it` };
+        if (obs.observedMs > bound)
+            return { rung: null, why: `${id} resumed after ${obs.observedMs} ms, outside the ${bound} ms bound of class "${obs.class}"` };
+    }
+    return { rung: 'durable-single-instance', why: 'all five rows executed-pass; each kill row names a declared class and resumed inside its bound' };
+}
+/** Is the rung a bundle CLAIMS supported by its own signed rows? */
+export function checkRungClaim(claimed, rows) {
+    if (claimed === undefined)
+        return { ok: true };
+    if (typeof claimed !== 'string' || !RUNGS.includes(claimed))
+        return { ok: false, detail: `durability.rung ${JSON.stringify(claimed)} is not one of ${RUNGS.join(' | ')}` };
+    const derived = deriveRung(rows);
+    if (derived.rung === null)
+        return { ok: false, detail: `durability.rung claims ${claimed}, but the signed rows do not support any rung: ${derived.why}` };
+    if (claimed !== derived.rung)
+        return { ok: false, detail: `durability.rung claims ${claimed}, but the signed rows support only ${derived.rung} — a higher rung is bundle-witnessed by evidence this revision does not yet carry (RFC 0158 §E, peer-resume), so it is refused rather than assumed` };
+    return { ok: true };
+}
+/**
+ * Was this bundle cut by a NEWER suite than the verifier reading it?
+ *
+ * Row evidence enters the witness digest, so a verifier older than 2.34.0 that
+ * meets a bundle carrying it recomputes a different digest and reports
+ * `witness-digest` — it FAILS CLOSED, which is right, but the message reads as
+ * tampering when the truth is "upgrade the verifier". Every later digested
+ * member will repeat that. The notice is advice; it never changes a verdict.
+ */
+export function emittedByNewerSuite(bundleSuite, verifierSuite) {
+    const parse = (v) => {
+        const m = typeof v === 'string' ? /^(\d+)\.(\d+)\.(\d+)/.exec(v) : null;
+        return m === null ? null : [Number(m[1]), Number(m[2]), Number(m[3])];
+    };
+    const b = parse(bundleSuite);
+    const mine = parse(verifierSuite);
+    if (b === null || mine === null)
+        return false;
+    for (let i = 0; i < 3; i++) {
+        if (b[i] !== mine[i])
+            return b[i] > mine[i];
+    }
+    return false;
+}
+// ── the scenario → setup.ts → ledger channel ─────────────────────────────────
+let pending = null;
+/** Called by a scenario inside an `it`; setup.ts attaches it to that test's ledger row. Later notes merge. */
+export function noteEvidence(evidence) { pending = { ...(pending ?? {}), ...evidence }; }
+/** setup.ts reads and clears it after each test. */
+export function takeNotedEvidence() { const e = pending; pending = null; return e; }

package/dist/lib/requirement-ledger.js

@@ -64,6 +64,7 @@ export function recordRequirement(requirementId, disposition, detail, extras) {
         ...(detail === undefined ? {} : { detail }),
         ...(extras?.assertionCount === undefined ? {} : { assertionCount: extras.assertionCount }),
         ...(extras?.scenarioFile === undefined ? {} : { scenarioFile: extras.scenarioFile }),
+        ...(extras?.evidence === undefined || disposition !== 'executed-pass' ? {} : { evidence: extras.evidence }),
     };
     ledger.set(requirementId, entry);
     journal.push(entry);

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.33.2",
-  "stampSha256": "005732c466b247dadf5ee3d8c68186c6ce4f586febbaa260b7906fd496153965"
+  "version": "2.34.0",
+  "stampSha256": "68cccf1a2b742ba8666acfa944d92ef209dd5cef3a7b067b06a5d36dbac31d03"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.33.2",
+  "version": "2.34.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.33.2"
+    "@openwop/spec-artifacts": "2.34.0"
   }
 }

package/requirements.json

@@ -26650,7 +26650,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.accepted-work-survives-a-kill-before-dispatch-and-dispatches-on-resume",
       "file": "v2-durability-recovery.test.ts",
-      "line": 254,
+      "line": 283,
       "title": "accepted work survives a kill before dispatch and dispatches on resume",
       "explicitId": "openwop.requirement.0158.kill-after-accept",
       "citations": [
@@ -26664,7 +26664,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.work-executing-at-a-real-process-death-is-never-reported-complete-and-resumes",
       "file": "v2-durability-recovery.test.ts",
-      "line": 299,
+      "line": 337,
       "title": "work executing at a real process death is never reported complete, and resumes",
       "explicitId": "openwop.requirement.0158.kill-during-execution",
       "citations": [
@@ -26683,7 +26683,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.the-same-accepted-work-delivered-twice-fires-each-effect-exactly-once",
       "file": "v2-durability-recovery.test.ts",
-      "line": 346,
+      "line": 393,
       "title": "the same accepted work delivered twice fires each effect exactly once",
       "explicitId": "openwop.requirement.0158.duplicate-delivery",
       "citations": [
@@ -26702,7 +26702,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.the-declared-recovery-bound-is-derived-from-the-mechanism-that-enforces-it",
       "file": "v2-durability-recovery.test.ts",
-      "line": 420,
+      "line": 467,
       "title": "the declared recovery bound is derived from the mechanism that enforces it",
       "explicitId": "openwop.requirement.0158.bound-is-derived",
       "citations": [
@@ -26716,7 +26716,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.deterministically-failing-work-reaches-a-terminal-state-and-stops-being-retried",
       "file": "v2-durability-recovery.test.ts",
-      "line": 450,
+      "line": 498,
       "title": "deterministically failing work reaches a terminal state and stops being retried",
       "explicitId": "openwop.requirement.0158.poison-exhaustion",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.33.2",
-  "corpusTag": "v2.33.0",
+  "version": "2.34.0",
+  "corpusTag": "v2.34.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "975b6cd87fa679857df9fcdc60b6a2bed98510b831e82a5eff5a114e3b263f6e",
-    "api/v2/asyncapi.yaml": "96ba13176119bbf54a94bd41d789ebaa919f67c81d529bdc3c66ffb3f419ee36",
-    "api/v2/openapi.yaml": "428ab881d0a8d08d388dd89d4b4457f3454cd0433b665674180d3e85821b978d",
+    "api/seams-v2.yaml": "d26d906b044e53fbb6ba742be90c853b9dcf14af4005bb6376e354d618fbdd5a",
+    "api/v2/asyncapi.yaml": "eda3679b6902a3ab931e2dab55a04f6b6bb2b9b664748de38d8a104e53e93c76",
+    "api/v2/openapi.yaml": "313fc72043a3730fbb98fdf47f4539773564bf9c5bed54f1f180efb50cf57410",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -116,7 +116,7 @@
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
     "schemas/v2/capabilities.schema.json": "e62d44f23c21c8f64b273fcdb083636e801c0de976cbd1f93333f99928dd1025",
-    "schemas/v2/certification-bundle.schema.json": "ab9204e37f9e0bba79857275cd38be2da98e54d26b4ecb97469829efe6ebea28",
+    "schemas/v2/certification-bundle.schema.json": "46a5a07670f2457bf1b7af8f6df1f4f76edb3ff7e64d1b6ed85738270c95668e",
     "schemas/v2/channel-presence-payload.schema.json": "1c20ad810cb311d47aa0b95d928490826b2468fd161f884cd29e867053e6782f",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "f7cf09b30d3e1d2251620d84ea9f65541438d015ab44aec10d1dcfe68d8bd496",
@@ -201,7 +201,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "40069d5976eeb6ba1384a648e57e5cfd673db3fce36175115fb8293bee9664d4",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "65a8576c2e5ea9deb9d463be5b02a8bfb0e125a8dcbe3fe2cf286a4fd6d5d53e",
+    "spec/v1/core-standard-manifest.json": "fce628a67bffe5923a01fd1bda89c44dc1fb5a679a609079b89030b5da7f116c",
     "spec/v1/deprecations.json": "307083ce29c23fd406015951f99a30d78d6187ff061d38dc9732f62191b40f3f",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -215,7 +215,7 @@
     "spec/v1/spec-gaps.json": "eb3bfcb9c7d05c9a6845d4a40ec9493cfaa5a671932daf1af561310136fdabe8",
     "spec/v2/README.md": "8dbfc17b10f373dba95bdd2e8fec0580f35b380a834d304be3e24e7498170185",
     "spec/v2/core/capabilities.md": "4c4e5577caf4ae20c84fe59d580de4c6599e76783471d3b59f9730fc3807de71",
-    "spec/v2/core/conformance.md": "a451c0a2ba79d93c55e540ccef480eba7de9602d59bbb03eead05daafde0beac",
+    "spec/v2/core/conformance.md": "e5cb403f6ea6633eebc8ee4fa7bde5bf023bf4aee7c959b849e7105d37ab1f8b",
     "spec/v2/core/connection-packs.md": "466bdb9dde79d85615ad8281dacfb7bf923ca22d7fb3ed219749e59574c753ed",
     "spec/v2/core/conversation.md": "e425887c4ba199b8cdc5c99e792689f7bd7d46de492f28670de2e402fa6d9506",
     "spec/v2/core/errors.md": "0dff4a0ae102a86f6a17a9a3b16a203292588a0f422ed19d1c0d9213995aa01d",
@@ -229,7 +229,7 @@
     "spec/v2/core/interrupt.md": "3a926d84b942d4ee7daccc4443c93dc29f6a69f2936ba813182f2c1336db2cbb",
     "spec/v2/core/overview.md": "7dc00ace32d4e4ce929a383651f0029fc4b7091ec87487b1bf26ead1be209e0e",
     "spec/v2/core/packs.md": "1c0919059760f9a3940a93264a76b7e30f9a0f6f27ff19753cc88f15753d8088",
-    "spec/v2/core/persistence.md": "9e241f84259e38848f4a2ad1c21debb0dffd5f8aafbad26408aa6cc8969bf93b",
+    "spec/v2/core/persistence.md": "b4f37792dddc651ec554ef92ce873c4fa14ad62be4500547a5078863609e16e5",
     "spec/v2/core/replay.md": "b980a66e2543107240e3dc4f58131b9f4ff52478737e79ade6d5777b26ad1119",
     "spec/v2/core/runs.md": "136319842bacbbb300178980e4b83444917d5b193cc5fdd92e39a4902ba8d3c0",
     "spec/v2/core/security-defaults.md": "2a54ceaa4cef02c26ee0fbcf44f822ceeea79537c7d5a51ed300f21aa4fea576",
@@ -279,8 +279,8 @@
     "spec/v2/path-manifest.json": "c123c9fd77dc1b3f9c2e9346ace80cdae007e6511138894956abda01e61ec1c6",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "94a3ea302324d9f7df87ce62a186b0b98936de6ce5ac5ec01a3fb3208c38efc3",
+    "spec/v2/release.json": "eaf652e3a01f02a1d9c4eee7d7ea2c2a0396fe5694b5dce4cb01ca2af2891cc5",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "65e40d60fbf43b1a0cd95a58e63d7464ed944ddb"
+  "corpusCommit": "9ccc722c0600fc4b01a2a80bad95c9a1a4a88ee5"
 }

package/src/cli.ts

@@ -42,6 +42,7 @@ import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import { SCHEMAS_DIR } from './lib/paths.js';
 import { readLedgerFile } from './lib/requirement-ledger.js';
+import { deriveRung, emittedByNewerSuite, type RowEvidence } from './lib/durability-evidence.js';
 import { deriveRequirementDispositions } from './lib/scenario-disposition.js';
 import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/certification-bundle-verify.js';
 import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest, type BundleV3, type BundleV3Requirement } from './lib/certification-bundle-v3.js';
@@ -658,7 +659,13 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       process.stderr.write('openwop-conformance --certify: a v3 bundle needs --host-build <kind>:<id> (or OPENWOP_HOST_BUILD), --signing-key <pem> (or OPENWOP_BUNDLE_SIGNING_KEY) and --signing-key-id (or OPENWOP_BUNDLE_SIGNING_KEY_ID) — an unsigned bundle does not exist in v3 (RFC 0168 §E.2).\n');
       process.exit(2);
     }
-    const rows3: BundleV3Requirement[] = derived.requirements.map((r) => ({ id: r.requirementId, scenario: r.scenarioId, result: r.disposition as BundleV3Requirement['result'], ...(r.assertionCount === undefined ? {} : { assertions: r.assertionCount }), ...(r.detail === undefined ? {} : { detail: r.detail }) }));
+    const evidenceById = new Map<string, RowEvidence>();
+    for (const e of ledgerEntries) if (e.evidence !== undefined && e.disposition === 'executed-pass') evidenceById.set(e.requirementId, e.evidence);
+    const rows3: BundleV3Requirement[] = derived.requirements.map((r) => ({ id: r.requirementId, scenario: r.scenarioId, result: r.disposition as BundleV3Requirement['result'], ...(r.assertionCount === undefined ? {} : { assertions: r.assertionCount }), ...(r.detail === undefined ? {} : { detail: r.detail }),
+      // RFC 0158 §E: structured evidence rides on the ROW, so the witness digest —
+      // and through it the signature — covers it. Lifted from the raw ledger by
+      // requirement id, and only onto a row that is itself `executed-pass`.
+      ...(r.disposition === 'executed-pass' && evidenceById.has(r.requirementId) ? { evidence: evidenceById.get(r.requirementId) as RowEvidence } : {}) }));
     const totals3 = derived.totals;
     const doc3 = document as Record<string, unknown>;
     const protocolVersions = Array.isArray(doc3['protocolVersions']) ? (doc3['protocolVersions'] as string[]) : [String(doc3['protocolVersion'] ?? '')];
@@ -701,6 +708,10 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
     const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');
     const lock = existsSync(lockPath) ? (JSON.parse(readFileSync(lockPath, 'utf8')) as { version: string; stampSha256: string }) : undefined;
     const nonPass = rows3.filter((r) => r.result !== 'executed-pass');
+    const rung3 = deriveRung(rows3);
+    if (rows3.some((r) => r.id.startsWith('openwop.requirement.0158.') && r.result === 'executed-pass' && r.id !== 'openwop.requirement.0158.poison-exhaustion')) {
+      process.stderr.write(`openwop-conformance --certify: RFC 0158 rung — ${rung3.rung ?? 'NONE'} (${rung3.why})\n`);
+    }
     const unsigned: Omit<BundleV3, 'signature'> = {
       bundleVersion: '3',
       generatedAt: new Date().toISOString(),
@@ -716,6 +727,10 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       witnessSha256: witnessDigest(rows3),
       assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
       ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
+      // RFC 0158 §D: claimed ONLY when these rows support it. The verifier
+      // re-derives the same answer from the same signed rows, so an emitter that
+      // claimed more would be writing a bundle its own `--verify` rejects.
+      ...(rung3.rung === null ? {} : { durability: { rung: rung3.rung } }),
     };
     const signature = signBundleV3(unsigned, signingKeyPem, keyId);
     const v3: BundleV3 = { ...unsigned, signature };
@@ -942,6 +957,8 @@ async function main(): Promise<never> {
       `suite:     ${bundle.suite?.version ?? '?'} (this CLI is ${suiteVersion()})`,
       `totals:    executedPass=${t.executedPass ?? '?'} executedFail=${t.executedFail ?? '?'} blocked=${t.blocked ?? '?'} inapplicable=${t.inapplicable ?? '?'} skipped=${t.skipped ?? '?'}`,
       `certified: ${verdict.certifiedProfiles.length > 0 ? verdict.certifiedProfiles.join(', ') : '(none)'}`,
+      // RFC 0158 §D/§E: the rung is a CLAIM; a claim the signed rows do not support is a rejection below.
+      `rung:      ${bundle.durability?.rung ?? '(none claimed)'}`,
       '',
       'What this command does NOT do:',
       '  · It does not re-run anything. A host that measured itself wrongly, and signed',
@@ -952,6 +969,11 @@ async function main(): Promise<never> {
       '    an older bundle measured less, and whose fact that is belongs to its emitter.',
       '',
     ];
+    if (emittedByNewerSuite(bundle.suite?.version, suiteVersion())) {
+      out.push(`NOTE \u2014 this bundle was emitted by suite ${String(bundle.suite?.version)}, NEWER than this verifier (${suiteVersion()}).`,
+        '  A newer suite may digest row members this verifier does not know. If a `witness-digest`',
+        '  rejection follows, upgrade the verifier before reading it as tampering.', '');
+    }
     if (verdict.rejections.length > 0) {
       out.push(`REJECTED \u2014 ${verdict.rejections.length} problem(s):`);
       for (const r of verdict.rejections) out.push(`  [${r.kind}]${r.profile ? ` (${r.profile})` : ''} ${r.detail}`);

package/src/lib/certification-bundle-v3.ts

@@ -19,6 +19,7 @@
  */
 import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify, type KeyObject } from 'node:crypto';
 import { profileDerivable, type DiscoveryPayload } from './profiles.js';
+import { checkRungClaim, type DurabilityRung, type RowEvidence } from './durability-evidence.js';
 import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2RegistryAvailable } from './v2-profiles.js';
 
 export type BundleV3Result = 'executed-pass' | 'executed-fail' | 'skipped' | 'inapplicable' | 'blocked';
@@ -29,6 +30,8 @@ export interface BundleV3Requirement {
   readonly result: BundleV3Result;
   readonly assertions?: number;
   readonly detail?: string;
+  /** RFC 0158 §E — structured evidence. Inside the witness digest, hence inside the signature. */
+  readonly evidence?: RowEvidence;
 }
 export interface BundleV3Profile {
   readonly id: string;
@@ -67,6 +70,8 @@ export interface BundleV3 {
   witnessSha256: string;
   assertionCount: number;
   detail?: { nonPass: { id: string; result: string; reason: string }[] };
+  /** RFC 0158 §D — a CLAIM, outside the signature and never trusted: the verifier re-derives it from the signed rows. */
+  durability?: { rung: DurabilityRung };
   signature: BundleV3Signature;
   verifierSignature?: { alg: 'ed25519'; keyId: string; sig: string };
 }
@@ -84,7 +89,9 @@ export function canonicalJSON(value: unknown): string {
 
 /** RFC 0148 §C — the digest over the reporter record (the requirement rows). */
 export function witnessDigest(rows: readonly BundleV3Requirement[]): string {
-  const canonicalRows = [...rows].sort((a, b) => a.id.localeCompare(b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }) }));
+  const canonicalRows = [...rows].sort((a, b) => a.id.localeCompare(b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }),
+    // ONLY WHEN PRESENT: every bundle cut before 2.34.0 has no `evidence` and digests byte-identically.
+    ...(r.evidence === undefined ? {} : { evidence: r.evidence }) }));
   return createHash('sha256').update(canonicalJSON(canonicalRows), 'utf8').digest('hex');
 }
 
@@ -181,6 +188,11 @@ export function verifyBundleV3(bundle: BundleV3, opts: VerifyV3Options = {}): V3
   const relaxed = new Set((bundle.host?.relaxations ?? []).map((r) => r.obligation.split('.')[0]));
   // Ownership comes from the profile registry, not from the profile's name — see profilesRelaxedBy.
   const relaxedProfiles = profilesRelaxedBy((bundle.host?.relaxations ?? []).map((r) => r.obligation), (bundle.claimedProfiles ?? []).map((p) => p.id));
+  // RFC 0158 §D: a rung is CLAIMED at the top level, outside the signature, and
+  // is therefore only ever as good as its re-derivation from the signed rows.
+  const rung = checkRungClaim(bundle.durability?.rung, rows);
+  if (!rung.ok) rejections.push({ kind: 'rung-not-derivable', detail: rung.detail });
+
   // An OBSERVED relaxation nobody declared: the bundle's own results show the
   // host accepting a destination its egress guard MUST refuse. Same denial as a
   // declared one, so declaring nothing is not a way around the rule.

package/src/lib/durability-evidence.ts

@@ -0,0 +1,175 @@
+/**
+ * RFC 0158 §E — the rung and the recovery bound, IN THE BUNDLE.
+ *
+ * §E.10 mints no discovery capability: "a qualification ladder is evidence about
+ * behaviour that already exists, so the useful place for a rung and a recovery
+ * bound is the host's conformance evidence bundle — where a claim without
+ * evidence is already a defect." Until 2.34.0 that sentence had nothing behind
+ * it. `certification-bundle.schema.json` had no seat for a rung, a bound or its
+ * terms; a bundle showed five pass/fail rows, and a reader could neither tell
+ * which rung was claimed nor recompute the bound. The terms lived only on a
+ * non-normative seam route. Found by READING acceptance criterion 1 at the
+ * moment of flipping the RFC, with every row already green.
+ *
+ * ── Why the evidence rides on ROWS ───────────────────────────────────────────
+ * The attestation covers exactly `{ witnessSha256, host.build, suite.version,
+ * discovery.sha256 }` (`conformance.md` §Bundle v3), and `witnessSha256` digests
+ * the requirement rows. A top-level block would therefore be UNSIGNED — a bound
+ * or a rung editable after signing on a bundle that still verifies. Evidence
+ * carried on a row is inside the witness digest, and so inside the signature.
+ * It enters the digest ONLY WHEN PRESENT, so every bundle cut before 2.34.0
+ * digests byte-identically and still verifies (pinned against the three
+ * committed bundles in `durability-evidence.test.ts`).
+ *
+ * ── Why the rung claim is NOT trusted ────────────────────────────────────────
+ * `durability.rung` sits at the top level, outside the signature, and that is
+ * sound for the same reason `claimedProfiles[].certified` is: the verifier
+ * RE-DERIVES it from signed rows and rejects a claim it cannot derive. §D: "a
+ * host MAY claim a rung only with the evidence named for it."
+ *
+ * ── Why a kill row names its recovery CLASS ──────────────────────────────────
+ * Unresolved Question 1 resolved PER WORK CLASS, not a scalar. A host with an
+ * outbox lane (65 s) and a dispatch lease (750 s) has two bounds, so each kill
+ * row records `{ class, boundMs, observedMs }`: the class MUST name a declared
+ * entry, `boundMs` MUST equal that entry's `bound`, and `observedMs` MUST NOT
+ * exceed it.
+ *
+ * WHAT THAT CATCHES, and what it cannot. It refuses an undeclared class, a bound
+ * label that disagrees with its class, and a resumption outside the bound. It
+ * does NOT catch a host that names the WRONG DECLARED class while resuming
+ * inside that class's (longer) bound — which a tier-1 host actually shipped: the
+ * seam killed before the execution claim was held, the 65 s lane rescued the run
+ * in 11.6 s, and the exercise was labelled leased / 750 s, every row green. No
+ * arithmetic separates that from a fast leased recovery. What the evidence
+ * changes is that it becomes VISIBLE — 11.6 s recorded against a class whose own
+ * terms say 720 s of lease — where before nothing was recorded at all. Killing
+ * only once the claim is held stays the HOST's obligation (§E).
+ *
+ * `class` is an OPAQUE host-chosen string, never an enum: "leased" / "unleased"
+ * name one host's mechanisms and boot re-entry is another's. An enum would
+ * select for an architecture, which this RFC refuses to do everywhere else.
+ * There is NO scalar "overall bound": that is UQ1's lie by aggregation with a
+ * friendlier name, and a reader would use it.
+ *
+ * What this block proves: ARITHMETIC (Σ terms = bound) and, through the kill
+ * rows' `observedMs`, that the mechanism RAN at least once inside the bound.
+ * `bound-is-derived` alone remains a paper check and MUST NOT be cited for
+ * liveness.
+ */
+
+/** Host-chosen identifiers enter a PUBLISHED bundle: short, plain, no free text. */
+export const EVIDENCE_NAME_PATTERN = /^[a-z][A-Za-z0-9._-]{0,63}$/;
+export const MAX_RECOVERY_CLASSES = 16;
+export const MAX_TERMS_PER_CLASS = 16;
+
+export interface RecoveryTerm { readonly name: string; readonly ms: number }
+export interface RecoveryBound { readonly class: string; readonly bound: number; readonly terms: readonly RecoveryTerm[] }
+export interface RecoveryObservation { readonly class: string; readonly boundMs: number; readonly observedMs: number }
+/** Closed. One optional member per KIND of structured evidence a row may carry. */
+export interface RowEvidence { readonly recovery?: RecoveryObservation; readonly recoveryBounds?: readonly RecoveryBound[] }
+
+export type DurabilityRung = 'durable-single-instance' | 'durable-multi-instance' | 'multi-region-qualified';
+export const RUNGS: readonly DurabilityRung[] = ['durable-single-instance', 'durable-multi-instance', 'multi-region-qualified'];
+
+const R = 'openwop.requirement.0158.';
+/** The rows §Acceptance names for the lowest rung. */
+export const SINGLE_INSTANCE_ROWS: readonly string[] = ['kill-after-accept', 'kill-during-execution', 'duplicate-delivery', 'poison-exhaustion', 'bound-is-derived'].map((r) => R + r);
+const KILL_ROWS: readonly string[] = [R + 'kill-after-accept', R + 'kill-during-execution'];
+const BOUND_ROW = R + 'bound-is-derived';
+
+const isCount = (n: unknown): n is number => typeof n === 'number' && Number.isInteger(n) && n >= 0;
+const isName = (s: unknown): s is string => typeof s === 'string' && EVIDENCE_NAME_PATTERN.test(s);
+
+/** Normalise what a host's seam returned into bundle evidence, or say exactly why it cannot be. */
+export function parseRecoveryBounds(raw: unknown): { ok: true; bounds: RecoveryBound[] } | { ok: false; why: string } {
+  if (!Array.isArray(raw) || raw.length === 0) return { ok: false, why: 'no recovery classes were declared' };
+  if (raw.length > MAX_RECOVERY_CLASSES) return { ok: false, why: `more than ${MAX_RECOVERY_CLASSES} recovery classes` };
+  const bounds: RecoveryBound[] = [];
+  const seen = new Set<string>();
+  for (const entry of raw as Array<Record<string, unknown>>) {
+    const cls = entry?.['class'];
+    if (!isName(cls)) return { ok: false, why: `a recovery class name does not match ${String(EVIDENCE_NAME_PATTERN)}` };
+    if (seen.has(cls)) return { ok: false, why: `recovery class ${cls} is declared twice` };
+    seen.add(cls);
+    const terms = entry['terms'];
+    if (!Array.isArray(terms) || terms.length === 0 || terms.length > MAX_TERMS_PER_CLASS) return { ok: false, why: `class ${cls}: terms[] MUST carry 1..${MAX_TERMS_PER_CLASS} entries — a total alone cannot be recomputed` };
+    const clean: RecoveryTerm[] = [];
+    for (const t of terms as Array<Record<string, unknown>>) {
+      if (!isName(t?.['name']) || !isCount(t['ms'])) return { ok: false, why: `class ${cls}: every term is { name, ms } with ms a non-negative integer` };
+      clean.push({ name: t['name'] as string, ms: t['ms'] as number });
+    }
+    if (!isCount(entry['bound'])) return { ok: false, why: `class ${cls}: bound is a non-negative integer of milliseconds` };
+    const sum = clean.reduce((a, t) => a + t.ms, 0);
+    if (sum !== entry['bound']) return { ok: false, why: `class ${cls}: terms sum to ${sum} ms but the declared bound is ${String(entry['bound'])} ms — a host that states a bound its terms do not produce fails §B.5` };
+    bounds.push({ class: cls, bound: entry['bound'] as number, terms: clean });
+  }
+  return { ok: true, bounds };
+}
+
+interface Row { readonly id: string; readonly result: string; readonly evidence?: RowEvidence }
+
+/**
+ * The highest rung these SIGNED rows support, and — when it is lower than a
+ * reader might hope — the first reason why. Only `durable-single-instance` is
+ * derivable today: `peer-resume` is bundle-witnessed by a per-boot incarnation
+ * token this revision does not yet carry (§E), so a higher claim is REFUSED
+ * rather than waved through.
+ */
+export function deriveRung(rows: readonly Row[]): { rung: DurabilityRung | null; why: string } {
+  const byId = new Map(rows.map((r) => [r.id, r]));
+  for (const id of SINGLE_INSTANCE_ROWS) {
+    const row = byId.get(id);
+    if (row === undefined) return { rung: null, why: `${id} is absent from the bundle` };
+    if (row.result !== 'executed-pass') return { rung: null, why: `${id} is ${row.result}, not executed-pass` };
+  }
+  const declared = parseRecoveryBounds(byId.get(BOUND_ROW)?.evidence?.recoveryBounds);
+  if (!declared.ok) return { rung: null, why: `${BOUND_ROW} carries no usable evidence.recoveryBounds — ${declared.why}` };
+  const bounds = new Map(declared.bounds.map((b) => [b.class, b.bound]));
+  for (const id of KILL_ROWS) {
+    const obs = byId.get(id)?.evidence?.recovery;
+    if (obs === undefined) return { rung: null, why: `${id} passed but recorded no evidence.recovery — the class it exercised and the interval it observed are unknown` };
+    if (!isName(obs.class) || !isCount(obs.boundMs) || !isCount(obs.observedMs)) return { rung: null, why: `${id}: evidence.recovery is malformed` };
+    const bound = bounds.get(obs.class);
+    if (bound === undefined) return { rung: null, why: `${id} exercised recovery class "${obs.class}", which ${BOUND_ROW} does not declare (declared: ${[...bounds.keys()].join(', ')})` };
+    if (obs.boundMs !== bound) return { rung: null, why: `${id} was judged against ${obs.boundMs} ms but class "${obs.class}" declares ${bound} ms — the exercise was labelled with a bound that does not govern it` };
+    if (obs.observedMs > bound) return { rung: null, why: `${id} resumed after ${obs.observedMs} ms, outside the ${bound} ms bound of class "${obs.class}"` };
+  }
+  return { rung: 'durable-single-instance', why: 'all five rows executed-pass; each kill row names a declared class and resumed inside its bound' };
+}
+
+/** Is the rung a bundle CLAIMS supported by its own signed rows? */
+export function checkRungClaim(claimed: unknown, rows: readonly Row[]): { ok: true } | { ok: false; detail: string } {
+  if (claimed === undefined) return { ok: true };
+  if (typeof claimed !== 'string' || !(RUNGS as readonly string[]).includes(claimed)) return { ok: false, detail: `durability.rung ${JSON.stringify(claimed)} is not one of ${RUNGS.join(' | ')}` };
+  const derived = deriveRung(rows);
+  if (derived.rung === null) return { ok: false, detail: `durability.rung claims ${claimed}, but the signed rows do not support any rung: ${derived.why}` };
+  if (claimed !== derived.rung) return { ok: false, detail: `durability.rung claims ${claimed}, but the signed rows support only ${derived.rung} — a higher rung is bundle-witnessed by evidence this revision does not yet carry (RFC 0158 §E, peer-resume), so it is refused rather than assumed` };
+  return { ok: true };
+}
+
+/**
+ * Was this bundle cut by a NEWER suite than the verifier reading it?
+ *
+ * Row evidence enters the witness digest, so a verifier older than 2.34.0 that
+ * meets a bundle carrying it recomputes a different digest and reports
+ * `witness-digest` — it FAILS CLOSED, which is right, but the message reads as
+ * tampering when the truth is "upgrade the verifier". Every later digested
+ * member will repeat that. The notice is advice; it never changes a verdict.
+ */
+export function emittedByNewerSuite(bundleSuite: unknown, verifierSuite: string): boolean {
+  const parse = (v: unknown): number[] | null => {
+    const m = typeof v === 'string' ? /^(\d+)\.(\d+)\.(\d+)/.exec(v) : null;
+    return m === null ? null : [Number(m[1]), Number(m[2]), Number(m[3])];
+  };
+  const b = parse(bundleSuite); const mine = parse(verifierSuite);
+  if (b === null || mine === null) return false;
+  for (let i = 0; i < 3; i++) { if ((b[i] as number) !== (mine[i] as number)) return (b[i] as number) > (mine[i] as number); }
+  return false;
+}
+
+// ── the scenario → setup.ts → ledger channel ─────────────────────────────────
+let pending: RowEvidence | null = null;
+/** Called by a scenario inside an `it`; setup.ts attaches it to that test's ledger row. Later notes merge. */
+export function noteEvidence(evidence: RowEvidence): void { pending = { ...(pending ?? {}), ...evidence }; }
+/** setup.ts reads and clears it after each test. */
+export function takeNotedEvidence(): RowEvidence | null { const e = pending; pending = null; return e; }

package/src/lib/requirement-ledger.ts

@@ -16,6 +16,7 @@
  * That is the whole mechanism. Everything else here is bookkeeping.
  */
 
+import type { RowEvidence } from './durability-evidence.js';
 import { appendFileSync, readFileSync, existsSync } from 'node:fs';
 
 /** RFC 0148 §A. Exactly one of these per requirement, per run. */
@@ -66,6 +67,10 @@ export interface LedgerEntry {
    *  the row to a file and drops it — which is how every explicit requirement id
    *  went missing from bundle v3 while the per-`it` ids came through. */
   readonly scenarioFile?: string;
+  /** RFC 0158 §E — structured evidence the scenario noted for this row
+   *  (`durability-evidence.ts`). Recorded for `executed-pass` only: a row that
+   *  failed, blocked or skipped witnessed nothing to describe. */
+  readonly evidence?: RowEvidence;
 }
 
 const ledger = new Map<string, LedgerEntry>();
@@ -87,7 +92,7 @@ export function recordRequirement(
   requirementId: string,
   disposition: Disposition,
   detail?: string,
-  extras?: { assertionCount?: number; scenarioFile?: string },
+  extras?: { assertionCount?: number; scenarioFile?: string; evidence?: RowEvidence },
 ): void {
   const prior = ledger.get(requirementId);
   if (prior !== undefined && prior.disposition !== disposition) {
@@ -108,6 +113,7 @@ export function recordRequirement(
     ...(detail === undefined ? {} : { detail }),
     ...(extras?.assertionCount === undefined ? {} : { assertionCount: extras.assertionCount }),
     ...(extras?.scenarioFile === undefined ? {} : { scenarioFile: extras.scenarioFile }),
+    ...(extras?.evidence === undefined || disposition !== 'executed-pass' ? {} : { evidence: extras.evidence }),
   };
   ledger.set(requirementId, entry);
   journal.push(entry);

package/src/scenarios/v2-durability-recovery.test.ts

@@ -74,6 +74,7 @@ import { pollUntilTerminal, scaledTimeoutMs } from '../lib/polling.js';
 import { req } from '../lib/requirement-ids.js';
 import { receiverBinding, resolveRegistrationUrl } from '../lib/webhook-receiver.js';
 import { watchForResumption, type Observation, type Watch } from '../lib/durability-watch.js';
+import { noteEvidence, parseRecoveryBounds, EVIDENCE_NAME_PATTERN } from '../lib/durability-evidence.js';
 
 const FIXTURE = 'conformance-noop';
 const FAILURE_FIXTURE = 'conformance-failure';
@@ -186,6 +187,32 @@ const KILL_ROW_TIMEOUT_MS = OBSERVATION_CEILING_MS + 120_000;
 /** Used only when the host serves no bound to read; named in the row's detail. */
 const UNDECLARED_BOUND_FALLBACK_MS = 60_000;
 
+/**
+ * The declared recovery bounds, PER CLASS, read off the seam and normalised.
+ *
+ * Three response shapes are accepted, because the seam is non-normative and two
+ * hosts built it before this was written down:
+ *   { classes: [{ class, bound, terms[] }] }          — the preferred shape
+ *   { classes: { <name>: { bound, terms[] } } }       — a map keyed by class
+ *   { bound, terms[], class? }                        — one class; named `class`
+ *                                                       or, absent that, `default`
+ * A top-level scalar `bound` beside `classes` is IGNORED: Unresolved Question 1
+ * resolved per class, and a convenience total is the aggregation it rejects.
+ * Only `{ name, ms }` survives from a term — free text a host attaches (the
+ * reference host's `enforcedBy`) never reaches a published bundle.
+ */
+function readClasses(json: unknown): unknown[] | null {
+  const body = (json as { classes?: unknown; class?: unknown; bound?: unknown; terms?: unknown } | null) ?? {};
+  const strip = (cls: unknown, e: { bound?: unknown; terms?: unknown }): unknown => ({
+    class: cls, bound: e.bound,
+    terms: Array.isArray(e.terms) ? (e.terms as Array<{ name?: unknown; ms?: unknown }>).map((t) => ({ name: t?.name, ms: t?.ms })) : e.terms,
+  });
+  if (Array.isArray(body.classes)) return (body.classes as Array<{ class?: unknown; bound?: unknown; terms?: unknown }>).map((e) => strip(e?.class, e ?? {}));
+  if (body.classes !== null && typeof body.classes === 'object') return Object.entries(body.classes as Record<string, { bound?: unknown; terms?: unknown }>).map(([k, e]) => strip(k, e ?? {}));
+  if (body.bound !== undefined || body.terms !== undefined) return [strip(typeof body.class === 'string' ? body.class : 'default', body)];
+  return null;
+}
+
 /**
  * How long to keep observing: the host's OWN declared recovery bound.
  *
@@ -199,19 +226,21 @@ const UNDECLARED_BOUND_FALLBACK_MS = 60_000;
  * bound is used as a CEILING FOR WAITING only; it is never asserted as a
  * scalar here (`bound-is-derived` owns the arithmetic).
  */
-async function declaredBoundMs(fired: unknown): Promise<{ ms: number; declared: boolean }> {
+async function declaredBoundMs(fired: unknown): Promise<{ ms: number; declared: boolean; recoveryClass: string | null }> {
+  const named = (fired as { recoveryClass?: unknown } | null)?.recoveryClass;
+  const recoveryClass = typeof named === 'string' && EVIDENCE_NAME_PATTERN.test(named) ? named : null;
   // A host whose bound is PER CLASS (Unresolved Question 1: unleased work waits
   // out an outbox lease, leased work a dispatch lease — 65 s against 750 s on
   // one measured host) names the figure that governs THIS work on the seam's
   // own response. The bare read below returns one class and would report the
   // interval against a bound that does not govern the staged run.
   const governing = (fired as { recoveryBoundMs?: unknown } | null)?.recoveryBoundMs;
-  if (typeof governing === 'number' && Number.isFinite(governing) && governing > 0) return { ms: governing, declared: true };
+  if (typeof governing === 'number' && Number.isFinite(governing) && governing > 0) return { ms: governing, declared: true, recoveryClass };
   const r = await driver.get('/host/durability/bound');
   const bound = (r.json as { bound?: unknown } | null)?.bound;
   return r.status === 200 && typeof bound === 'number' && Number.isFinite(bound) && bound > 0
-    ? { ms: bound, declared: true }
-    : { ms: UNDECLARED_BOUND_FALLBACK_MS, declared: false };
+    ? { ms: bound, declared: true, recoveryClass }
+    : { ms: UNDECLARED_BOUND_FALLBACK_MS, declared: false, recoveryClass };
 }
 
 /**
@@ -294,6 +323,15 @@ describe('v2-durability-recovery (RFC 0158 §B.4, §D.9, §E — the durable-sin
       w.resumedAfterMs !== null,
       req('openwop.requirement.0158.kill-after-accept', 'RFC 0158 §B.4', `work accepted before a real process death MUST dispatch on resume within the declared recovery bound — service answered again after ${backIn}ms, then observed for ${w.waitedMs}ms against a ${bound.declared ? `declared ${bound.ms}ms bound` : `${bound.ms}ms fallback (the host serves no /host/durability/bound)`}: ${w.last.runStarted} run.started, ${w.last.nodeStarted} node.started, ${w.last.restored} restored${w.resumedAfterMs !== null ? `; dispatch first observed ${backIn + w.resumedAfterMs}ms after the kill` : ''}`),
     ).toBe(true);
+    // RFC 0158 §E, 2.34.0: the interval this row MEASURED is evidence, and until
+    // now it existed only inside a failure message — a passing row recorded
+    // nothing, so a bundle could not show what was observed or against which
+    // class. Recorded only when the seam NAMED the class it exercised: without
+    // that the bundle cannot bind this exercise to a declared bound, the rung is
+    // not derivable, and saying so is more honest than guessing a class.
+    if (bound.declared && bound.recoveryClass !== null && w.resumedAfterMs !== null) {
+      noteEvidence({ recovery: { class: bound.recoveryClass, boundMs: Math.round(bound.ms), observedMs: backIn + w.resumedAfterMs } });
+    }
   }, KILL_ROW_TIMEOUT_MS);
 
   it('work executing at a real process death is never reported complete, and resumes', async () => {
@@ -341,6 +379,15 @@ describe('v2-durability-recovery (RFC 0158 §B.4, §D.9, §E — the durable-sin
       w.resumedAfterMs !== null,
       req('openwop.requirement.0158.kill-during-execution', 'RFC 0158 §B.4 / §E item 11', `work executing at a real process death MUST resume within the declared recovery bound; §B.4 measures kill → RESUMPTION, never kill → terminal — service answered again after ${backIn}ms, then observed for ${w.waitedMs}ms against a ${bound.declared ? `declared ${bound.ms}ms bound` : `${bound.ms}ms fallback (the host serves no /host/durability/bound)`}: ${w.last.runStarted} run.started, ${w.last.restored} restored${w.resumedAfterMs !== null ? `; resumption first observed ${backIn + w.resumedAfterMs}ms after the kill` : ''}`),
     ).toBe(true);
+    // RFC 0158 §E, 2.34.0: the interval this row MEASURED is evidence, and until
+    // now it existed only inside a failure message — a passing row recorded
+    // nothing, so a bundle could not show what was observed or against which
+    // class. Recorded only when the seam NAMED the class it exercised: without
+    // that the bundle cannot bind this exercise to a declared bound, the rung is
+    // not derivable, and saying so is more honest than guessing a class.
+    if (bound.declared && bound.recoveryClass !== null && w.resumedAfterMs !== null) {
+      noteEvidence({ recovery: { class: bound.recoveryClass, boundMs: Math.round(bound.ms), observedMs: backIn + w.resumedAfterMs } });
+    }
   }, KILL_ROW_TIMEOUT_MS);
 
   it('the same accepted work delivered twice fires each effect exactly once', async () => {
@@ -427,24 +474,25 @@ describe('v2-durability-recovery (RFC 0158 §B.4, §D.9, §E — the durable-sin
     if (terms.status === 404 || terms.status === 405) {
       return softSkip('blocked', 'the host exposes the durability seam but serves no recovery-bound terms — §E puts the per-class arithmetic in the RFC 0148 evidence bundle where a reader can recompute it, and there is nothing here to recompute');
     }
-    const body = (terms.json as { bound?: unknown; terms?: unknown } | null) ?? {};
-    const bound = typeof body.bound === 'number' ? body.bound : null;
-    const parts = Array.isArray(body.terms) ? (body.terms as unknown[]) : null;
-    if (bound === null || parts === null || parts.length === 0) {
-      return softSkip('blocked', 'the recovery-bound response names no { bound, terms[] } — §E asks for the per-class arithmetic, not a single total (Unresolved Question 1), and a total alone cannot be recomputed');
+    const classes = readClasses(terms.json);
+    if (classes === null) {
+      return softSkip('blocked', 'the recovery-bound response names no classes and no { bound, terms[] } — §E asks for the per-class arithmetic, not a single total (Unresolved Question 1), and a total alone cannot be recomputed');
     }
-    const summed = parts.reduce<number>((acc, t) => acc + (typeof (t as { ms?: unknown }).ms === 'number' ? (t as { ms: number }).ms : Number.NaN), 0);
     // THIS ROW IS A PAPER CHECK BY CONSTRUCTION AND THE RFC SAYS SO. It checks
-    // that the declared number follows from the stated mechanism. It cannot
+    // that each declared number follows from the stated mechanism. It cannot
     // check that the mechanism RUNS: a host whose sweeper wedges has a
     // derivation that stays perfectly correct while the bound is not produced
     // at all — a run sat unclaimed for 16 minutes against a derived bound of
     // 12.5 with every isolated check of the mechanism passing. Only the kill
     // rows above witness liveness, and this row MUST NOT be cited for it.
+    const parsed = parseRecoveryBounds(classes);
     expect(
-      Number.isFinite(summed) && Math.abs(summed - bound) <= 1,
-      req('openwop.requirement.0158.bound-is-derived', 'RFC 0158 §B.5', `the declared recovery bound MUST follow from the per-class terms that produce it — declared ${bound}, terms sum to ${summed}. A host that states a bound it cannot produce fails; a host whose sweeper wedges still passes, which is why this row MUST NOT be read as evidence that the mechanism runs`),
+      parsed.ok,
+      req('openwop.requirement.0158.bound-is-derived', 'RFC 0158 §B.5', `every declared recovery bound MUST follow from the per-class terms that produce it, each term { name, ms } — ${parsed.ok ? '' : parsed.why}. A host that states a bound it cannot produce fails; this checks the ARITHMETIC only, never that the mechanism runs`),
     ).toBe(true);
+    // The derivation goes INTO THE BUNDLE, per class, where a reader can
+    // recompute it (§E) — until 2.34.0 it lived only on this seam route.
+    if (parsed.ok) noteEvidence({ recoveryBounds: parsed.bounds });
   }, 120_000);
 
   it('deterministically failing work reaches a terminal state and stops being retried', async () => {

package/src/setup.ts

@@ -43,6 +43,7 @@ import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './lib/spec-cohe
 import type { DiscoveryPayload } from './lib/profiles.js';
 import { targetMajor } from './lib/seams.js';
 import { softSkip } from './lib/soft-skip.js';
+import { takeNotedEvidence } from './lib/durability-evidence.js';
 
 // 20 s, not 5: a Cloud Run cold start routinely exceeds 5 s, and a discovery
 // fetch that aborted at init used to turn every fixture-gated scenario into a
@@ -457,7 +458,8 @@ afterEach(({ task }) => {
     detail = rec.detail;
   }
   try {
-    recordRequirement(itId, disposition, detail, { assertionCount: calls, scenarioFile: file });
+    const evidence = takeNotedEvidence();
+    recordRequirement(itId, disposition, detail, { assertionCount: calls, scenarioFile: file, ...(evidence === null ? {} : { evidence }) });
   } catch {
     /* never fail a test for bookkeeping */
   }