@openwop/openwop-conformance 2.33.2 → 2.34.1

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.34.1] — 2026-09-21 — a 90 s window convicted a host for retrying at its production pace
+
+- **`v2-webhook-durable-delivery` capped every wait at a hard 90 s, and a conformant host with a slower schedule could not advertise `webhooks.deadLetter` without failing its bundle.** A host retrying at 15 / 30 / 60 / 120 s with `maxAttempts: 5` makes its attempts at t0, +15, +45, +105, +225 s. The dead-letter leg waited for a second attempt, waited 90 s more, and read the sink ~120 s before that host exhausts: **`0173.webhook-durable-delivery.dead-letter` → `executed-fail`, "an exhausted delivery MUST be routed to the sink, not dropped"**, about a delivery still in flight; `0188.dead-letter-content-free` → `blocked`, which denies certification. To pass, the host would have had to cut its production retry window from ~225 s to ~75 s for every real subscriber — the instrument choosing the host's durability. Reported by a tier-2 host from its own constants *before* advertising the facet; reproduced on the reference host configured to the same schedule.
+- **The window is now operator-RAISABLE and never lowerable:** `OPENWOP_WEBHOOK_RETRY_WAIT_MS` (default 90 000 per wait, at most 3 600 000). A smaller or non-numeric value is ignored, so no operator can shrink the window to hide a slow retry, and a raised window is still bounded — a host that never retries still fails, later. The `it` timeouts derive from it, as they already did from the constant. Same shape as `OPENWOP_DURABILITY_OBSERVATION_CEILING_MS`; both are now documented in the README, which had neither.
+- **The dead-letter leg no longer asserts "not dropped" before exhaustion was observable.** Fewer attempts than the advertised `maxAttempts` AND nothing in the sink is a window that closed early *or* a host that stopped retrying — indistinguishable without an interval on the wire (`webhooks.retryPolicy` is closed over `{ maxAttempts, backoff }`) — so it records **`blocked`**, naming the variable and the numbers the run used, never `executed-fail`. **A host that reaches `maxAttempts` and has nothing in the sink still FAILS.** `blocked` denies certification exactly as the false fail did; what changes is that the row stops saying something untrue about the host.
+- **`blocked` had to be made to stand, and two rows had no id — both found by measuring the fix, not by reading it.** (1) A leg that asserts and *then* soft-skips records `executed-pass` with a `partial-witness:` detail (`resolveItRecord`): the acceptance predicate refuses it, **certification counts it as a pass**. Both dead-letter legs assert inside `register()` before they can observe anything, so the first draft of this fix turned a false FAIL into a certifying pass that never looked at the sink. New opt-in `blockedDespiteAssertions(reason)` (`lib/soft-skip.ts`) records a `blocked` that survives setup assertions; the ordinary soft-skip convention is unchanged everywhere else. (2) `register()` asserts under the base `0173.webhook-durable-delivery` id and `req()` is last-wins, so a leg that returned before naming its own id recorded under the base id — **`0173…dead-letter` and `0188.dead-letter-content-free` then had no row in the bundle at all.** That was already true of `0188.dead-letter-content-free` on 2.34.0 and earlier whenever the sink was empty: it read as a partial-witness pass of the base row, not the `blocked` it appeared to be. Each leg now names its row first. Measured on the reference host at 15 / 30 / 60 / 120 s: both rows `blocked` under their own ids; at the host's default schedule: all `executed-pass`, same ids; with the window raised to 300 s: all `executed-pass`, exhaustion observed at 226 s.
+- The dead-letter leg also observes before it asserts: it waits, reads the sink and deletes the subscription, returns on the inconclusive case, and only then asserts the obligations in their original order. A create failure still fails at once.
+- **The cost, stated:** a host that advertises 5 attempts, stops at 3 and drops the delivery used to read `executed-fail` and now reads `blocked`. Neither certifies. Detection of that case comes back only by putting the interval on the wire — normative surface, an RFC, not a patch.
+- Pure window logic moved to `lib/webhook-retry-window.ts` with unit tests (raisable, not lowerable, bounded, floor unchanged for a host advertising no policy).
+- `spec/v2/core/persistence.md`'s Stable banner now lists RFC 0158 §A–§D — owed since the RFC's flip, which could not edit a file shipped inside the published 2.34.0.
+- False FAIL only. Suite patch: corpus release stays `2.34.0`.
+
+## [2.34.0] — 2026-09-21 — the rung and the recovery bound, in the bundle RFC 0158 said they were in
+
+- **RFC 0158 §E publishes a host's rung and recovery bound in its certification bundle instead of in discovery — and the bundle had no seat for either.** `certification-bundle.schema.json` is closed; a reader saw five pass/fail rows and could neither tell which rung was claimed nor recompute the bound, whose terms lived only on a non-normative seam route. Found by reading the RFC's first acceptance criterion at the moment of flipping it, with every row green.
+- **Evidence rides on ROWS, because that is the only place it is signed.** The attestation covers `{ witnessSha256, host.build, suite.version, discovery.sha256 }` and the witness digest covers rows, so a root-level block would be editable after signing on a bundle that still verifies. A row gains an OPTIONAL closed `evidence` object that enters the digest **only when present** — every earlier bundle digests byte-identically, pinned against the three committed host bundles.
+  - `0158.bound-is-derived` → `evidence.recoveryBounds[]` of `{ class, bound, terms[{ name, ms }] }`, **per recovery class, no aggregate** (Unresolved Question 1: a scalar would have to be the maximum, which overstates recovery for every faster class).
+  - `0158.kill-after-accept`, `0158.kill-during-execution` → `evidence.recovery { class, boundMs, observedMs }`. The kill → resumption interval was always measured and appeared only in a FAILURE message; a passing row recorded nothing.
+- **`durability.rung` is a claim, and the verifier does not trust it.** It sits outside the signature, which is sound for the reason `claimedProfiles[].certified` is: `--verify` re-derives it from signed rows — all five rows `executed-pass`, each kill row's `class` naming a declared entry whose `bound` equals its `boundMs` and is not exceeded by its `observedMs`, each entry's terms summing to its bound — and rejects what it cannot derive (new rejection `rung-not-derivable`). Only `durable-single-instance` is derivable; `peer-resume` evidence is not carried yet, so a higher claim is **refused rather than assumed**. `--certify` claims a rung only when the same derivation supports it, and says on stderr which rung it derived and why.
+- **`class` and term names are opaque, host-chosen, and pattern-constrained** (`^[a-z][A-Za-z0-9._-]{0,63}$`, ≤ 16 classes × ≤ 16 terms). Never an enum: "leased" names one host's mechanism and "boot re-entry" another's. Only `{ name, ms }` survives from a term — free text a host attaches to its seam response never reaches a published bundle.
+- **What class-binding does NOT catch, stated and pinned by a test so nobody reads more into it.** It refuses an undeclared class, a bound label that disagrees with its class, and a resumption outside the bound. It does not refuse a seam that kills *before* the execution claim is held and labels the exercise with the slower class — a tier-1 host shipped exactly that (11.6 s against a 750 s leased class, every row green), and no arithmetic separates it from a fast recovery. The evidence makes it **visible** where before nothing was recorded; killing only once the claim is held stays the host's obligation.
+- **Seam contract (non-normative):** the bound response may be `{ classes: [{ class, bound, terms[] }] }`, a map keyed by class, or the flat `{ bound, terms[], class? }` two hosts already serve. A top-level scalar beside `classes` is ignored. A flat response that names no class is recorded as `default`, which will not match a kill response naming a real class — so the rung is not derivable until the bound says which class it governs.
+- **`--verify` gains a `rung:` line and a newer-suite notice.** A verifier older than the bundle it reads recomputes a different witness digest and fails closed, correctly — but `witness-digest` reads as tampering when the truth is "upgrade the verifier".
+- Additive. No scenario added or removed; no host that passed before fails now. `bundleVersion` stays `"3"`.
+
 ## [2.33.2] — 2026-09-21 — `v2-run-snapshot-etag` took its tag from a run that was still moving
 
 - **The scenario slept a fixed 1 s after `POST /runs`, took the snapshot's `ETag`, and demanded `304`.** A host whose ETag tracks the run's event-log sequence — the strong tag `runs.md` §Snapshot asks for — is still appending while a noop executes, so between the two GETs the representation **changes** and `200` with a new tag is the only correct answer; a `304` there would be a stale-cache bug. **Measured on a tier-2 production host, 4 of 4:** immediately after create `etag1 ≠ etag2` and the conditional GET answers `200`; after the run settles the same request answers `304` every time. The row had passed three earlier cuts of that host and failed the fourth — a timing lottery, won whenever the run finished inside the sleep.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.33.2 @openwop/spec-artifacts@2.33.2
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.34.1 @openwop/spec-artifacts@2.34.1
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```
@@ -110,6 +110,8 @@ Run `npm run test` for normal CI cadence; `npm run test:strict` when claiming fu
 | `OPENWOP_WEBHOOK_ALLOW_PRIVATE=true`      | Relaxes the webhook egress guard for the loopback test receiver used by `webhook-signed-delivery.test.ts`, `webhook-negative.test.ts`, and `replay-fanout-suppression.test.ts`. **The receiver is `http://127.0.0.1:{port}/`, which `webhooks.md` forbids three separate times, and the opt-in MUST relax all three to be witnessable:** (1) the **scheme** check — §"SSRF protection" bullet 1 rejects non-`https://`, and this gate fires FIRST on a host that validates scheme before address; (2) the **registration-time** address check — §"SSRF protection"; and (3) **delivery-time re-resolution** — §"Delivery-time egress validation (RFC 0093)". Gates 2 and 3 are independent MUSTs at different layers, so an opt-in reaching only one layer **cannot** produce a witness: delivery-only leaves registration returning `400 webhook_url_rejected`, registration-only leaves the dispatcher refusing to connect. A host whose opt-in reaches one layer is **not** non-conformant — it cannot witness these scenarios, which is a property of the test posture and not of its webhook signing. The scheme gate went unstated here until 2026-08-25; a tier-2 host validating scheme-then-address was blocked by a gate the documented contract never named. Relaxing gates 2 and 3 is **test-only posture** — see `SECURITY/threat-model-secret-leakage.md` §4.9 for why a registration-time relaxation is the more dangerous of the two. When the host rejects, the scenario records `blocked` (RFC 0148 §A), not a pass.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `OPENWOP_WEBHOOK_RECEIVER_URL=<https-url>` | **The route to a webhook witness that relaxes nothing.** A host refusing the loopback receiver on *two* independent grounds — private address **and** non-`https:` — cannot be unblocked by `OPENWOP_WEBHOOK_ALLOW_PRIVATE`, because the scheme arm still stands. This supplies **the public `https:` front for THIS SUITE'S OWN receiver** (tunnel / TLS-terminating proxy), never an arbitrary endpoint: the scenario asserts on what *this process* received, so pointing registration elsewhere makes every header assertion vacuous while the row turns green. Zero deliveries with it set is a **hard failure**, never a skip. Preferred over the flag — it waives nothing and writes no durable subscription row aimed at a private address (`SECURITY/threat-model-secret-leakage.md` §4.9). Pair with `OPENWOP_WEBHOOK_RECEIVER_PORT`. |
 | `OPENWOP_WEBHOOK_RECEIVER_PORT=<port>`     | Pins the in-process webhook receiver to a known port instead of an ephemeral one. Required in practice by `OPENWOP_WEBHOOK_RECEIVER_URL`: a tunnel must be aimed at a port known **in advance**, and the receiver binds `0` by default. Unset ⇒ ephemeral, as before. |
+| `OPENWOP_WEBHOOK_RETRY_WAIT_MS=<ms>`       | **Raises** how long `v2-webhook-durable-delivery` waits for a retry schedule to play out (default `90000`, per wait; at most `3600000`). `webhooks.retryPolicy` carries `{ maxAttempts, backoff }` and no interval, so the suite cannot derive how long exhaustion takes: set this above the SUM of your backoff intervals (a host retrying at 15/30/60/120 s needs > 225 s). **It can be raised, never lowered** — a smaller or non-numeric value is ignored — and the window stays bounded, so a host that never retries still fails. A window that closes before the advertised `maxAttempts` arrive records `blocked` naming this variable, never a conviction. |
+| `OPENWOP_DURABILITY_OBSERVATION_CEILING_MS=<ms>` | **Raises** how long the RFC 0158 kill rows observe for resumption (default `240000`). A host with a long *declared* recovery bound — a 750 s dispatch lease is conformant — sets this above its bound and waits it out. Raisable, never lowerable. |
 | `OPENWOP_MCP_FAKE_SERVER=true`            | Boots the synthetic MCP peer for `mcp-tool-roundtrip.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `OPENWOP_MCP_REAL_SERVER_URL=<base-url>`  | Points the MCP wire-shape probe at a real MCP server. The probe POSTs JSON-RPC and reads a single-JSON response — matches MCP's `streamable-http` transport in single-response mode. **Does NOT support** stdio transport (which is what most `modelcontextprotocol/servers` references default to) or SSE-streamed responses; an operator collecting interop evidence today runs a custom `StreamableHTTPServerTransport`-style server that returns a single JSON body per request. Adding SSE-frame parsing is tracked in `docs/PROTOCOL-GAP-CLOSURE-PLAN.md` Track 6. Assertions relax to shape-only. When both this and `OPENWOP_MCP_FAKE_SERVER` are set, the real URL wins. Phase 3 T3.4 interop-evidence path.                                                                                                               |
 | `OPENWOP_A2A_FAKE_PEER=true`              | Boots the synthetic A2A peer for `a2a-task-roundtrip.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |

package/coverage.md

@@ -145,7 +145,7 @@ The scenario groups in the table below (one row per group; count the rows — th
 | `egress-audience-binding.test.ts`                                                                                                                                                                                                                       | `capabilities.httpClient.egressPolicy.supported` (RFC 0079 §C, `host-capabilities.md`) + `SECURITY/invariants.yaml` `egress-credential-audience-bound`                                                                                                                                                                  | A (KEYSTONE — the §C confused-deputy MUST via `POST /v1/host/sample/egress/decide`: an out-of-audience egress is `denied`/`downgraded` with `reason:"out-of-audience"` and the credential is NOT attached (`credentialAttached !== true`); a provenance-unevaluable egress fails closed `denied`+`reason:"provenance-unevaluable"`; decision/reason ∈ the closed enums)                                                                                                                                                                                                                                                                                                                             | `host-pending`                                                                                                                   | `behaviorGate('openwop-egress-audience-binding', …)`. Seam-gated; soft-skips on 404. **This is the RFC 0079 → Accepted bar** (the `egress-credential-audience-bound` invariant graduates reference-impl → protocol tier when this passes against a host). First adopter: MyndHyve `httpClient.egressPolicy`.                                                                                                                                                                                                                                                                                                                            |
 | `egress-decision-content-free.test.ts`                                                                                                                                                                                                                  | `capabilities.httpClient.egressPolicy.supported` (RFC 0079 §F / SR-1)                                                                                                                                                                                                                                                   | A (the secret non-leak — a `canary` credential's sentinel never surfaces in the decision (`canaryLeaked !== true`), the `egress.decided` payload carries no forbidden content key, and `reason` stays in the CLOSED vocabulary so no blocked destination spills into a free-form field)                                                                                                                                                                                                                                                                                                                                                                                                             | `host-pending`                                                                                                                   | `behaviorGate('openwop-egress-decision-content-free', …)`. Seam-gated; soft-skips on 404. **Part of the RFC 0079 → Accepted bar.** First adopter: MyndHyve `httpClient.egressPolicy`.                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | `v2-webhook-egress-refusal.test.ts` | the `webhooks` family (capability-gated) | A (`webhooks.md` §SSRF at MAJOR 2 — eight registration probes, one per class the sentence names: non-`https`, IPv4/IPv6 loopback, `localhost`, two RFC 1918 ranges, link-local / cloud metadata, IPv6 ULA; each MUST answer `400 webhook_url_rejected`. Until 2.33.0 no major-2 row asserted the guard refuses anything — the refusal scenarios were major-1 only. THREE OUTCOMES: all refused → `executed-pass`; a probe accepted with a `webhooks.*` relaxation DECLARED in `OPENWOP_HOST_RELAXATIONS` → `inapplicable`, and the declared relaxation denies the owning profile; a probe accepted with NOTHING declared → `executed-fail`, which the emitter and verifier read as an OBSERVED undeclared relaxation and deny every profile built on `webhooks` (`undeclared-relaxation-observed`). Registration-time only: no probe is a destination the suite owns, nothing is delivered, an accepted registration is deleted at once) |
-| `v2-durability-recovery.test.ts` | the RFC 0158 host-extension durability seam `POST /host/durability/kill` (non-normative; §E mints no capability field, so seam PRESENCE is how a host says it claims a rung) | A (all five `durable-single-instance` rows: `kill-after-accept` as a HOLD-DISPATCH exercise, `kill-during-execution` asserting that work executing at a real process death is never observable as completed without re-execution, `duplicate-delivery` counted AT THE EFFECT'S DESTINATION — a receiver the suite owns, `effectUrl` — because a ledger keyed on effect identity admits one row per identity by construction and cannot show a double-fire (2.32.0), `bound-is-derived` as an explicitly-labelled paper check, and `poison-exhaustion` ported from the major-1 scenario — at major 2 it reads the canonical JSON log read `GET /runs/{runId}/events/poll` (NOT `/events`, which is SSE-only at major 2 — reading it as JSON made this row pass vacuously on a host serving exactly the OpenAPI; 2.32.0), so unlike its v1 twin it needs NO seam and can never record `blocked` for want of one a host did not wire) | `host-pending` | **Disposition rule, and it protects fleet certification:** no seam route at all ⇒ `inapplicable` (the host claims no rung); seam present but an operator precondition unmet — a restart supervisor, which a black-box suite cannot supply — ⇒ `blocked` with the precondition NAMED. Collapsing the two would deny certification to every host the day these rows entered the lane. `peer-resume` is deliberately NOT written: §E makes it bundle-witnessed, so a scenario could only ever record `blocked`. **This is the RFC 0158 → Accepted bar, and it is now complete at major 2** — before the port, a major-2 bundle could carry at most four of the five rows and the rung was unwitnessable no matter what a host did, and its witness is openwop-app, which the RFC records as having observed `kill-during-execution` across a real `SIGKILL`. |
+| `v2-durability-recovery.test.ts` | the RFC 0158 host-extension durability seam `POST /host/durability/kill` (non-normative; §E mints no capability field, so seam PRESENCE is how a host says it claims a rung) | A (all five `durable-single-instance` rows: `kill-after-accept` as a HOLD-DISPATCH exercise, `kill-during-execution` asserting that work executing at a real process death is never observable as completed without re-execution, `duplicate-delivery` counted AT THE EFFECT'S DESTINATION — a receiver the suite owns, `effectUrl` — because a ledger keyed on effect identity admits one row per identity by construction and cannot show a double-fire (2.32.0), `bound-is-derived` as an explicitly-labelled paper check, and `poison-exhaustion` ported from the major-1 scenario — at major 2 it reads the canonical JSON log read `GET /runs/{runId}/events/poll` (NOT `/events`, which is SSE-only at major 2 — reading it as JSON made this row pass vacuously on a host serving exactly the OpenAPI; 2.32.0), so unlike its v1 twin it needs NO seam and can never record `blocked` for want of one a host did not wire) | `host-pending` | **2.34.0 — the rows now WRITE evidence into the bundle (RFC 0158 §E):** `bound-is-derived` records `evidence.recoveryBounds[]` per recovery class and each kill row records `evidence.recovery { class, boundMs, observedMs }` — the interval was always measured and, on a pass, never recorded. Both ride on the ROW so the witness digest, and through it the signature, covers them; the bundle claims `durability.rung` only when `deriveRung` supports it and `--verify` rejects a claim it cannot re-derive (`rung-not-derivable`). A kill row records nothing unless the seam NAMES the class it exercised (`recoveryClass`) and the bound response declares that class — no name, no rung, rather than a guessed one. **Disposition rule, and it protects fleet certification:** no seam route at all ⇒ `inapplicable` (the host claims no rung); seam present but an operator precondition unmet — a restart supervisor, which a black-box suite cannot supply — ⇒ `blocked` with the precondition NAMED. Collapsing the two would deny certification to every host the day these rows entered the lane. `peer-resume` is deliberately NOT written: §E makes it bundle-witnessed, so a scenario could only ever record `blocked`. **This is the RFC 0158 → Accepted bar, and it is now complete at major 2** — before the port, a major-2 bundle could carry at most four of the five rows and the rung was unwitnessable no matter what a host did, and its witness is openwop-app, which the RFC records as having observed `kill-during-execution` across a real `SIGKILL`. |
 | `memory-degraded-projection.test.ts`                                                                                                                                                                                                                    | `capabilities.agents.manifestRuntime.supported` + `capabilities.memory.supported` (RFC 0080 §C, `agent-memory.md`)                                                                                                                                                                                                      | A (the §C iff-contract on the NORMATIVE `GET /v1/agents`: a degraded entry MUST carry `memoryDegraded:true` + a non-empty, unique `degradedMemoryDimensions[]` drawn from the closed §A-name enum [read/write/search/long-term-durability/compaction/attribution/replay-snapshot/retention]; a non-degraded entry MUST NOT carry a non-empty list; the inventory is non-empty; the degraded branch runs non-vacuously when `OPENWOP_DEGRADED_AGENT_ID` names a known-degraded agent)                                                                                                                                                                                                                | `host-pending`                                                                                                                   | `behaviorGate('openwop-memory-degraded', …)`. Black-box on the normative path (no POST seam); soft-skips on 404 / when the host computes no degradation. **This is the RFC 0080 → Accepted bar.** First adopter: MyndHyve `memory`.                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `budget-enforcement.test.ts`                                                                                                                                                                                                                            | `capabilities.budget.supported` (RFC 0084 §C/§D, `budget-policy.md`) + `SECURITY/invariants.yaml` `budget-no-pricing-leak`                                                                                                                                                                                              | A (the §C/§D enforcement via `POST /v1/host/sample/budget/run` + the test event-log seam: a `hard-cost-exhaust` run emits the strict-ordered `budget.reserved → budget.consumed → budget.threshold.crossed{percent} → budget.exhausted → cap.breached{kind:"budget-cost"} → run.failed{error:"budget_exhausted"}` chain; a `model-denied` run is refused `budget_model_denied` BEFORE the provider call (fail-closed); an `advisory` host emits the `budget.*` events without stopping; every `budget.*` payload content-free — no pricing/rate)                                                                                                                                                    | `host-pending`                                                                                                                   | `behaviorGate('openwop-budget-enforcement', …)`. Seam-gated; soft-skips on 404. **This is the RFC 0084 → Accepted bar.** First adopter: MyndHyve `budget`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `agent-platform-aggregate-evidence.test.ts`                                                                                                                                                                                                             | `openwop-agent-platform` claim — live discovery `profiles[]` includes it (RFC 0085 §C, `agent-platform-profile.md`)                                                                                                                                                                                                     | A (the §C/§D honest-advertisement on live `/.well-known/openwop`: a host claiming `openwop-agent-platform` MUST satisfy the §B floor predicate (`isAgentPlatformPartial` → `partial`/`full`, never `none`), the claim backed by per-capability evidence not the profile string; `OPENWOP_AGENT_PLATFORM_TIER=full` forces the full-predicate bar — all governance terms + tenant installScope + all 16 §D terms)                                                                                                                                                                                                                                                                                    | `host-pending`                                                                                                                   | `behaviorGate('openwop-agent-platform', …)`. Black-box on the discovery doc (no POST seam); soft-skips until a host claims the profile. **This is the RFC 0085 → Accepted bar.** First adopter: MyndHyve (after the memory batch surfaces the floor's `memory.supported`).                                                                                                                                                                                                                                                                                                                                                              |

package/dist/cli.js

@@ -41,6 +41,7 @@ import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import { SCHEMAS_DIR } from './lib/paths.js';
 import { readLedgerFile } from './lib/requirement-ledger.js';
+import { deriveRung, emittedByNewerSuite } from './lib/durability-evidence.js';
 import { deriveRequirementDispositions } from './lib/scenario-disposition.js';
 import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/certification-bundle-verify.js';
 import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest } from './lib/certification-bundle-v3.js';
@@ -619,7 +620,15 @@ async function runCertify(args, baseUrl, apiKey) {
             process.stderr.write('openwop-conformance --certify: a v3 bundle needs --host-build <kind>:<id> (or OPENWOP_HOST_BUILD), --signing-key <pem> (or OPENWOP_BUNDLE_SIGNING_KEY) and --signing-key-id (or OPENWOP_BUNDLE_SIGNING_KEY_ID) — an unsigned bundle does not exist in v3 (RFC 0168 §E.2).\n');
             process.exit(2);
         }
-        const rows3 = derived.requirements.map((r) => ({ id: r.requirementId, scenario: r.scenarioId, result: r.disposition, ...(r.assertionCount === undefined ? {} : { assertions: r.assertionCount }), ...(r.detail === undefined ? {} : { detail: r.detail }) }));
+        const evidenceById = new Map();
+        for (const e of ledgerEntries)
+            if (e.evidence !== undefined && e.disposition === 'executed-pass')
+                evidenceById.set(e.requirementId, e.evidence);
+        const rows3 = derived.requirements.map((r) => ({ id: r.requirementId, scenario: r.scenarioId, result: r.disposition, ...(r.assertionCount === undefined ? {} : { assertions: r.assertionCount }), ...(r.detail === undefined ? {} : { detail: r.detail }),
+            // RFC 0158 §E: structured evidence rides on the ROW, so the witness digest —
+            // and through it the signature — covers it. Lifted from the raw ledger by
+            // requirement id, and only onto a row that is itself `executed-pass`.
+            ...(r.disposition === 'executed-pass' && evidenceById.has(r.requirementId) ? { evidence: evidenceById.get(r.requirementId) } : {}) }));
         const totals3 = derived.totals;
         const doc3 = document;
         const protocolVersions = Array.isArray(doc3['protocolVersions']) ? doc3['protocolVersions'] : [String(doc3['protocolVersion'] ?? '')];
@@ -672,6 +681,10 @@ async function runCertify(args, baseUrl, apiKey) {
         const lockPath = resolvePath(conformanceRoot, 'dist', 'spec-artifacts.lock.json');
         const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, 'utf8')) : undefined;
         const nonPass = rows3.filter((r) => r.result !== 'executed-pass');
+        const rung3 = deriveRung(rows3);
+        if (rows3.some((r) => r.id.startsWith('openwop.requirement.0158.') && r.result === 'executed-pass' && r.id !== 'openwop.requirement.0158.poison-exhaustion')) {
+            process.stderr.write(`openwop-conformance --certify: RFC 0158 rung — ${rung3.rung ?? 'NONE'} (${rung3.why})\n`);
+        }
         const unsigned = {
             bundleVersion: '3',
             generatedAt: new Date().toISOString(),
@@ -687,6 +700,10 @@ async function runCertify(args, baseUrl, apiKey) {
             witnessSha256: witnessDigest(rows3),
             assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
             ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
+            // RFC 0158 §D: claimed ONLY when these rows support it. The verifier
+            // re-derives the same answer from the same signed rows, so an emitter that
+            // claimed more would be writing a bundle its own `--verify` rejects.
+            ...(rung3.rung === null ? {} : { durability: { rung: rung3.rung } }),
         };
         const signature = signBundleV3(unsigned, signingKeyPem, keyId);
         const v3 = { ...unsigned, signature };
@@ -889,6 +906,8 @@ async function main() {
             `suite:     ${bundle.suite?.version ?? '?'} (this CLI is ${suiteVersion()})`,
             `totals:    executedPass=${t.executedPass ?? '?'} executedFail=${t.executedFail ?? '?'} blocked=${t.blocked ?? '?'} inapplicable=${t.inapplicable ?? '?'} skipped=${t.skipped ?? '?'}`,
             `certified: ${verdict.certifiedProfiles.length > 0 ? verdict.certifiedProfiles.join(', ') : '(none)'}`,
+            // RFC 0158 §D/§E: the rung is a CLAIM; a claim the signed rows do not support is a rejection below.
+            `rung:      ${bundle.durability?.rung ?? '(none claimed)'}`,
             '',
             'What this command does NOT do:',
             '  · It does not re-run anything. A host that measured itself wrongly, and signed',
@@ -899,6 +918,9 @@ async function main() {
             '    an older bundle measured less, and whose fact that is belongs to its emitter.',
             '',
         ];
+        if (emittedByNewerSuite(bundle.suite?.version, suiteVersion())) {
+            out.push(`NOTE \u2014 this bundle was emitted by suite ${String(bundle.suite?.version)}, NEWER than this verifier (${suiteVersion()}).`, '  A newer suite may digest row members this verifier does not know. If a `witness-digest`', '  rejection follows, upgrade the verifier before reading it as tampering.', '');
+        }
         if (verdict.rejections.length > 0) {
             out.push(`REJECTED \u2014 ${verdict.rejections.length} problem(s):`);
             for (const r of verdict.rejections)

package/dist/lib/certification-bundle-v3.js

@@ -19,6 +19,7 @@
  */
 import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify } from 'node:crypto';
 import { profileDerivable } from './profiles.js';
+import { checkRungClaim } from './durability-evidence.js';
 import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2RegistryAvailable } from './v2-profiles.js';
 export const SIGNATURE_OVER = ['witnessSha256', 'host.build', 'suite.version', 'discovery.sha256'];
 /** Deterministic JSON: keys sorted at every level, no whitespace. */
@@ -32,7 +33,9 @@ export function canonicalJSON(value) {
 }
 /** RFC 0148 §C — the digest over the reporter record (the requirement rows). */
 export function witnessDigest(rows) {
-    const canonicalRows = [...rows].sort((a, b) => a.id.localeCompare(b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }) }));
+    const canonicalRows = [...rows].sort((a, b) => a.id.localeCompare(b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }),
+        // ONLY WHEN PRESENT: every bundle cut before 2.34.0 has no `evidence` and digests byte-identically.
+        ...(r.evidence === undefined ? {} : { evidence: r.evidence }) }));
     return createHash('sha256').update(canonicalJSON(canonicalRows), 'utf8').digest('hex');
 }
 /** The bytes the attestation covers. */
@@ -120,6 +123,11 @@ export function verifyBundleV3(bundle, opts = {}) {
     const relaxed = new Set((bundle.host?.relaxations ?? []).map((r) => r.obligation.split('.')[0]));
     // Ownership comes from the profile registry, not from the profile's name — see profilesRelaxedBy.
     const relaxedProfiles = profilesRelaxedBy((bundle.host?.relaxations ?? []).map((r) => r.obligation), (bundle.claimedProfiles ?? []).map((p) => p.id));
+    // RFC 0158 §D: a rung is CLAIMED at the top level, outside the signature, and
+    // is therefore only ever as good as its re-derivation from the signed rows.
+    const rung = checkRungClaim(bundle.durability?.rung, rows);
+    if (!rung.ok)
+        rejections.push({ kind: 'rung-not-derivable', detail: rung.detail });
     // An OBSERVED relaxation nobody declared: the bundle's own results show the
     // host accepting a destination its egress guard MUST refuse. Same denial as a
     // declared one, so declaring nothing is not a way around the rule.

package/dist/lib/durability-evidence.js

@@ -0,0 +1,182 @@
+/**
+ * RFC 0158 §E — the rung and the recovery bound, IN THE BUNDLE.
+ *
+ * §E.10 mints no discovery capability: "a qualification ladder is evidence about
+ * behaviour that already exists, so the useful place for a rung and a recovery
+ * bound is the host's conformance evidence bundle — where a claim without
+ * evidence is already a defect." Until 2.34.0 that sentence had nothing behind
+ * it. `certification-bundle.schema.json` had no seat for a rung, a bound or its
+ * terms; a bundle showed five pass/fail rows, and a reader could neither tell
+ * which rung was claimed nor recompute the bound. The terms lived only on a
+ * non-normative seam route. Found by READING acceptance criterion 1 at the
+ * moment of flipping the RFC, with every row already green.
+ *
+ * ── Why the evidence rides on ROWS ───────────────────────────────────────────
+ * The attestation covers exactly `{ witnessSha256, host.build, suite.version,
+ * discovery.sha256 }` (`conformance.md` §Bundle v3), and `witnessSha256` digests
+ * the requirement rows. A top-level block would therefore be UNSIGNED — a bound
+ * or a rung editable after signing on a bundle that still verifies. Evidence
+ * carried on a row is inside the witness digest, and so inside the signature.
+ * It enters the digest ONLY WHEN PRESENT, so every bundle cut before 2.34.0
+ * digests byte-identically and still verifies (pinned against the three
+ * committed bundles in `durability-evidence.test.ts`).
+ *
+ * ── Why the rung claim is NOT trusted ────────────────────────────────────────
+ * `durability.rung` sits at the top level, outside the signature, and that is
+ * sound for the same reason `claimedProfiles[].certified` is: the verifier
+ * RE-DERIVES it from signed rows and rejects a claim it cannot derive. §D: "a
+ * host MAY claim a rung only with the evidence named for it."
+ *
+ * ── Why a kill row names its recovery CLASS ──────────────────────────────────
+ * Unresolved Question 1 resolved PER WORK CLASS, not a scalar. A host with an
+ * outbox lane (65 s) and a dispatch lease (750 s) has two bounds, so each kill
+ * row records `{ class, boundMs, observedMs }`: the class MUST name a declared
+ * entry, `boundMs` MUST equal that entry's `bound`, and `observedMs` MUST NOT
+ * exceed it.
+ *
+ * WHAT THAT CATCHES, and what it cannot. It refuses an undeclared class, a bound
+ * label that disagrees with its class, and a resumption outside the bound. It
+ * does NOT catch a host that names the WRONG DECLARED class while resuming
+ * inside that class's (longer) bound — which a tier-1 host actually shipped: the
+ * seam killed before the execution claim was held, the 65 s lane rescued the run
+ * in 11.6 s, and the exercise was labelled leased / 750 s, every row green. No
+ * arithmetic separates that from a fast leased recovery. What the evidence
+ * changes is that it becomes VISIBLE — 11.6 s recorded against a class whose own
+ * terms say 720 s of lease — where before nothing was recorded at all. Killing
+ * only once the claim is held stays the HOST's obligation (§E).
+ *
+ * `class` is an OPAQUE host-chosen string, never an enum: "leased" / "unleased"
+ * name one host's mechanisms and boot re-entry is another's. An enum would
+ * select for an architecture, which this RFC refuses to do everywhere else.
+ * There is NO scalar "overall bound": that is UQ1's lie by aggregation with a
+ * friendlier name, and a reader would use it.
+ *
+ * What this block proves: ARITHMETIC (Σ terms = bound) and, through the kill
+ * rows' `observedMs`, that the mechanism RAN at least once inside the bound.
+ * `bound-is-derived` alone remains a paper check and MUST NOT be cited for
+ * liveness.
+ */
+/** Host-chosen identifiers enter a PUBLISHED bundle: short, plain, no free text. */
+export const EVIDENCE_NAME_PATTERN = /^[a-z][A-Za-z0-9._-]{0,63}$/;
+export const MAX_RECOVERY_CLASSES = 16;
+export const MAX_TERMS_PER_CLASS = 16;
+export const RUNGS = ['durable-single-instance', 'durable-multi-instance', 'multi-region-qualified'];
+const R = 'openwop.requirement.0158.';
+/** The rows §Acceptance names for the lowest rung. */
+export const SINGLE_INSTANCE_ROWS = ['kill-after-accept', 'kill-during-execution', 'duplicate-delivery', 'poison-exhaustion', 'bound-is-derived'].map((r) => R + r);
+const KILL_ROWS = [R + 'kill-after-accept', R + 'kill-during-execution'];
+const BOUND_ROW = R + 'bound-is-derived';
+const isCount = (n) => typeof n === 'number' && Number.isInteger(n) && n >= 0;
+const isName = (s) => typeof s === 'string' && EVIDENCE_NAME_PATTERN.test(s);
+/** Normalise what a host's seam returned into bundle evidence, or say exactly why it cannot be. */
+export function parseRecoveryBounds(raw) {
+    if (!Array.isArray(raw) || raw.length === 0)
+        return { ok: false, why: 'no recovery classes were declared' };
+    if (raw.length > MAX_RECOVERY_CLASSES)
+        return { ok: false, why: `more than ${MAX_RECOVERY_CLASSES} recovery classes` };
+    const bounds = [];
+    const seen = new Set();
+    for (const entry of raw) {
+        const cls = entry?.['class'];
+        if (!isName(cls))
+            return { ok: false, why: `a recovery class name does not match ${String(EVIDENCE_NAME_PATTERN)}` };
+        if (seen.has(cls))
+            return { ok: false, why: `recovery class ${cls} is declared twice` };
+        seen.add(cls);
+        const terms = entry['terms'];
+        if (!Array.isArray(terms) || terms.length === 0 || terms.length > MAX_TERMS_PER_CLASS)
+            return { ok: false, why: `class ${cls}: terms[] MUST carry 1..${MAX_TERMS_PER_CLASS} entries — a total alone cannot be recomputed` };
+        const clean = [];
+        for (const t of terms) {
+            if (!isName(t?.['name']) || !isCount(t['ms']))
+                return { ok: false, why: `class ${cls}: every term is { name, ms } with ms a non-negative integer` };
+            clean.push({ name: t['name'], ms: t['ms'] });
+        }
+        if (!isCount(entry['bound']))
+            return { ok: false, why: `class ${cls}: bound is a non-negative integer of milliseconds` };
+        const sum = clean.reduce((a, t) => a + t.ms, 0);
+        if (sum !== entry['bound'])
+            return { ok: false, why: `class ${cls}: terms sum to ${sum} ms but the declared bound is ${String(entry['bound'])} ms — a host that states a bound its terms do not produce fails §B.5` };
+        bounds.push({ class: cls, bound: entry['bound'], terms: clean });
+    }
+    return { ok: true, bounds };
+}
+/**
+ * The highest rung these SIGNED rows support, and — when it is lower than a
+ * reader might hope — the first reason why. Only `durable-single-instance` is
+ * derivable today: `peer-resume` is bundle-witnessed by a per-boot incarnation
+ * token this revision does not yet carry (§E), so a higher claim is REFUSED
+ * rather than waved through.
+ */
+export function deriveRung(rows) {
+    const byId = new Map(rows.map((r) => [r.id, r]));
+    for (const id of SINGLE_INSTANCE_ROWS) {
+        const row = byId.get(id);
+        if (row === undefined)
+            return { rung: null, why: `${id} is absent from the bundle` };
+        if (row.result !== 'executed-pass')
+            return { rung: null, why: `${id} is ${row.result}, not executed-pass` };
+    }
+    const declared = parseRecoveryBounds(byId.get(BOUND_ROW)?.evidence?.recoveryBounds);
+    if (!declared.ok)
+        return { rung: null, why: `${BOUND_ROW} carries no usable evidence.recoveryBounds — ${declared.why}` };
+    const bounds = new Map(declared.bounds.map((b) => [b.class, b.bound]));
+    for (const id of KILL_ROWS) {
+        const obs = byId.get(id)?.evidence?.recovery;
+        if (obs === undefined)
+            return { rung: null, why: `${id} passed but recorded no evidence.recovery — the class it exercised and the interval it observed are unknown` };
+        if (!isName(obs.class) || !isCount(obs.boundMs) || !isCount(obs.observedMs))
+            return { rung: null, why: `${id}: evidence.recovery is malformed` };
+        const bound = bounds.get(obs.class);
+        if (bound === undefined)
+            return { rung: null, why: `${id} exercised recovery class "${obs.class}", which ${BOUND_ROW} does not declare (declared: ${[...bounds.keys()].join(', ')})` };
+        if (obs.boundMs !== bound)
+            return { rung: null, why: `${id} was judged against ${obs.boundMs} ms but class "${obs.class}" declares ${bound} ms — the exercise was labelled with a bound that does not govern it` };
+        if (obs.observedMs > bound)
+            return { rung: null, why: `${id} resumed after ${obs.observedMs} ms, outside the ${bound} ms bound of class "${obs.class}"` };
+    }
+    return { rung: 'durable-single-instance', why: 'all five rows executed-pass; each kill row names a declared class and resumed inside its bound' };
+}
+/** Is the rung a bundle CLAIMS supported by its own signed rows? */
+export function checkRungClaim(claimed, rows) {
+    if (claimed === undefined)
+        return { ok: true };
+    if (typeof claimed !== 'string' || !RUNGS.includes(claimed))
+        return { ok: false, detail: `durability.rung ${JSON.stringify(claimed)} is not one of ${RUNGS.join(' | ')}` };
+    const derived = deriveRung(rows);
+    if (derived.rung === null)
+        return { ok: false, detail: `durability.rung claims ${claimed}, but the signed rows do not support any rung: ${derived.why}` };
+    if (claimed !== derived.rung)
+        return { ok: false, detail: `durability.rung claims ${claimed}, but the signed rows support only ${derived.rung} — a higher rung is bundle-witnessed by evidence this revision does not yet carry (RFC 0158 §E, peer-resume), so it is refused rather than assumed` };
+    return { ok: true };
+}
+/**
+ * Was this bundle cut by a NEWER suite than the verifier reading it?
+ *
+ * Row evidence enters the witness digest, so a verifier older than 2.34.0 that
+ * meets a bundle carrying it recomputes a different digest and reports
+ * `witness-digest` — it FAILS CLOSED, which is right, but the message reads as
+ * tampering when the truth is "upgrade the verifier". Every later digested
+ * member will repeat that. The notice is advice; it never changes a verdict.
+ */
+export function emittedByNewerSuite(bundleSuite, verifierSuite) {
+    const parse = (v) => {
+        const m = typeof v === 'string' ? /^(\d+)\.(\d+)\.(\d+)/.exec(v) : null;
+        return m === null ? null : [Number(m[1]), Number(m[2]), Number(m[3])];
+    };
+    const b = parse(bundleSuite);
+    const mine = parse(verifierSuite);
+    if (b === null || mine === null)
+        return false;
+    for (let i = 0; i < 3; i++) {
+        if (b[i] !== mine[i])
+            return b[i] > mine[i];
+    }
+    return false;
+}
+// ── the scenario → setup.ts → ledger channel ─────────────────────────────────
+let pending = null;
+/** Called by a scenario inside an `it`; setup.ts attaches it to that test's ledger row. Later notes merge. */
+export function noteEvidence(evidence) { pending = { ...(pending ?? {}), ...evidence }; }
+/** setup.ts reads and clears it after each test. */
+export function takeNotedEvidence() { const e = pending; pending = null; return e; }

package/dist/lib/requirement-ledger.js

@@ -64,6 +64,7 @@ export function recordRequirement(requirementId, disposition, detail, extras) {
         ...(detail === undefined ? {} : { detail }),
         ...(extras?.assertionCount === undefined ? {} : { assertionCount: extras.assertionCount }),
         ...(extras?.scenarioFile === undefined ? {} : { scenarioFile: extras.scenarioFile }),
+        ...(extras?.evidence === undefined || disposition !== 'executed-pass' ? {} : { evidence: extras.evidence }),
     };
     ledger.set(requirementId, entry);
     journal.push(entry);

package/dist/lib/scenario-disposition.js

@@ -100,6 +100,10 @@ export function resolveItRecord(state, assertionCalls, gate, noted, firstError)
     if (state === 'fail')
         return { disposition: 'executed-fail', detail: `the test executed and failed: ${(firstError ?? 'no message').slice(0, 300)}` };
     if (state === 'pass' && assertionCalls > 0) {
+        // `blockedDespiteAssertions` (soft-skip.ts): the leg says its setup
+        // assertions are not the requirement, and the requirement went unobserved.
+        if (noted !== null && noted.kind === 'blocked' && noted.conclusive === true)
+            return { disposition: 'blocked', detail: noted.reason };
         // A leg that asserted AND THEN soft-skipped is only a partial witness, and
         // the file-level record has always said so (`resolveFileRecord` below).
         // This `it`-level record dropped the note — and the `it`-level rows are the

package/dist/lib/soft-skip.js

@@ -74,6 +74,32 @@ export function seamAbsent(reason) {
     }
     return softSkip('blocked', reason);
 }
+/**
+ * `blocked` that STANDS even though the test already asserted something.
+ *
+ * A plain `softSkip` after an assertion records `executed-pass` with a
+ * `partial-witness:` detail (`resolveItRecord`): the acceptance predicate
+ * refuses such a row, but certification counts it as a pass. That is right for
+ * a leg that finished its requirement and skipped an optional extra. It is
+ * wrong for a leg whose REQUIREMENT went unobserved after setup assertions it
+ * could not avoid — a helper like `register()` asserts `201` before the leg has
+ * observed anything. Use this only there: the row records `blocked`, which
+ * denies certification (RFC 0168 §E.1) without convicting the host.
+ *
+ * Opt-in and per-call on purpose. Honouring every note-after-assertion as
+ * `blocked` would downgrade legs that legitimately completed; that is a suite-
+ * wide semantic change, not a patch. First use: `v2-webhook-durable-delivery`'s
+ * dead-letter leg when the retry window closes before exhaustion (2.34.1).
+ */
+export function blockedDespiteAssertions(reason) {
+    const file = currentFile();
+    if (file === null)
+        return undefined;
+    const arr = notes.get(file) ?? [];
+    arr.push({ kind: 'blocked', reason, seq: ++seq, conclusive: true });
+    notes.set(file, arr);
+    return undefined;
+}
 const RANK = { blocked: 0, skipped: 1, inapplicable: 2 };
 function fold(arr) {
     if (arr.length === 0)
@@ -84,7 +110,7 @@ function fold(arr) {
             uniq.push(n);
     const kind = [...uniq].sort((a, b) => RANK[a.kind] - RANK[b.kind])[0].kind;
     const reason = uniq.map((n) => (uniq.length > 1 ? `[${n.kind}] ${n.reason}` : n.reason)).join('; ');
-    return { kind, reason };
+    return uniq.some((n) => n.conclusive === true) ? { kind, reason, conclusive: true } : { kind, reason };
 }
 /**
  * The noted disposition for a file, worst-first when mixed (`blocked` beats

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.33.2",
-  "stampSha256": "005732c466b247dadf5ee3d8c68186c6ce4f586febbaa260b7906fd496153965"
+  "version": "2.34.1",
+  "stampSha256": "3f491c227a43a26ab8f77081df1443d066b404d3af64e50c5e9786d8f03462e5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.33.2",
+  "version": "2.34.1",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.33.2"
+    "@openwop/spec-artifacts": "2.34.1"
   }
 }

package/requirements.json

@@ -26650,7 +26650,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.accepted-work-survives-a-kill-before-dispatch-and-dispatches-on-resume",
       "file": "v2-durability-recovery.test.ts",
-      "line": 254,
+      "line": 283,
       "title": "accepted work survives a kill before dispatch and dispatches on resume",
       "explicitId": "openwop.requirement.0158.kill-after-accept",
       "citations": [
@@ -26664,7 +26664,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.work-executing-at-a-real-process-death-is-never-reported-complete-and-resumes",
       "file": "v2-durability-recovery.test.ts",
-      "line": 299,
+      "line": 337,
       "title": "work executing at a real process death is never reported complete, and resumes",
       "explicitId": "openwop.requirement.0158.kill-during-execution",
       "citations": [
@@ -26683,7 +26683,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.the-same-accepted-work-delivered-twice-fires-each-effect-exactly-once",
       "file": "v2-durability-recovery.test.ts",
-      "line": 346,
+      "line": 393,
       "title": "the same accepted work delivered twice fires each effect exactly once",
       "explicitId": "openwop.requirement.0158.duplicate-delivery",
       "citations": [
@@ -26702,7 +26702,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.the-declared-recovery-bound-is-derived-from-the-mechanism-that-enforces-it",
       "file": "v2-durability-recovery.test.ts",
-      "line": 420,
+      "line": 467,
       "title": "the declared recovery bound is derived from the mechanism that enforces it",
       "explicitId": "openwop.requirement.0158.bound-is-derived",
       "citations": [
@@ -26716,7 +26716,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.deterministically-failing-work-reaches-a-terminal-state-and-stops-being-retried",
       "file": "v2-durability-recovery.test.ts",
-      "line": 450,
+      "line": 498,
       "title": "deterministically failing work reaches a terminal state and stops being retried",
       "explicitId": "openwop.requirement.0158.poison-exhaustion",
       "citations": [
@@ -29507,7 +29507,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-failed-attempt-is-retried-and-the-event-is-delivered-at-least-once",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 234,
+      "line": 235,
       "title": "a failed attempt is retried and the event is delivered at least once",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery",
       "citations": [
@@ -29538,10 +29538,18 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.an-exhausted-delivery-is-dead-lettered-never-dropped",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 322,
+      "line": 323,
       "title": "an exhausted delivery is dead-lettered, never dropped",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery.dead-letter",
       "citations": [
+        {
+          "section": "webhooks.md §Durability",
+          "requirement": "an exhausted delivery MUST be routed to the sink, not dropped"
+        },
+        {
+          "section": "runs.md §Create",
+          "requirement": "POST /runs MUST answer 201 for the noop fixture"
+        },
         {
           "section": "runs.md §Create",
           "requirement": "POST /runs MUST answer 201 for the noop fixture"
@@ -29564,7 +29572,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.the-dead-letter-read-is-served-and-its-records-carry-no-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 379,
+      "line": 417,
       "title": "the dead-letter read is served and its records carry no payload",
       "explicitId": "openwop.requirement.0188.dead-letter-read",
       "citations": [
@@ -29577,10 +29585,14 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-dead-letter-record-carries-no-delivered-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 400,
+      "line": 438,
       "title": "a dead-letter record carries no delivered payload",
       "explicitId": "openwop.requirement.0188.dead-letter-content-free",
       "citations": [
+        {
+          "section": "RFC 0188 §B.1",
+          "requirement": "a dead-letter record MUST NOT carry the delivered body, headers or subscription secret"
+        },
         {
           "section": "RFC 0188 §B.1",
           "requirement": null,