@openwop/openwop-conformance 2.34.0 → 2.34.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.34.1] — 2026-09-21 — a 90 s window convicted a host for retrying at its production pace
+
+- **`v2-webhook-durable-delivery` capped every wait at a hard 90 s, and a conformant host with a slower schedule could not advertise `webhooks.deadLetter` without failing its bundle.** A host retrying at 15 / 30 / 60 / 120 s with `maxAttempts: 5` makes its attempts at t0, +15, +45, +105, +225 s. The dead-letter leg waited for a second attempt, waited 90 s more, and read the sink ~120 s before that host exhausts: **`0173.webhook-durable-delivery.dead-letter` → `executed-fail`, "an exhausted delivery MUST be routed to the sink, not dropped"**, about a delivery still in flight; `0188.dead-letter-content-free` → `blocked`, which denies certification. To pass, the host would have had to cut its production retry window from ~225 s to ~75 s for every real subscriber — the instrument choosing the host's durability. Reported by a tier-2 host from its own constants *before* advertising the facet; reproduced on the reference host configured to the same schedule.
+- **The window is now operator-RAISABLE and never lowerable:** `OPENWOP_WEBHOOK_RETRY_WAIT_MS` (default 90 000 per wait, at most 3 600 000). A smaller or non-numeric value is ignored, so no operator can shrink the window to hide a slow retry, and a raised window is still bounded — a host that never retries still fails, later. The `it` timeouts derive from it, as they already did from the constant. Same shape as `OPENWOP_DURABILITY_OBSERVATION_CEILING_MS`; both are now documented in the README, which had neither.
+- **The dead-letter leg no longer asserts "not dropped" before exhaustion was observable.** Fewer attempts than the advertised `maxAttempts` AND nothing in the sink is a window that closed early *or* a host that stopped retrying — indistinguishable without an interval on the wire (`webhooks.retryPolicy` is closed over `{ maxAttempts, backoff }`) — so it records **`blocked`**, naming the variable and the numbers the run used, never `executed-fail`. **A host that reaches `maxAttempts` and has nothing in the sink still FAILS.** `blocked` denies certification exactly as the false fail did; what changes is that the row stops saying something untrue about the host.
+- **`blocked` had to be made to stand, and two rows had no id — both found by measuring the fix, not by reading it.** (1) A leg that asserts and *then* soft-skips records `executed-pass` with a `partial-witness:` detail (`resolveItRecord`): the acceptance predicate refuses it, **certification counts it as a pass**. Both dead-letter legs assert inside `register()` before they can observe anything, so the first draft of this fix turned a false FAIL into a certifying pass that never looked at the sink. New opt-in `blockedDespiteAssertions(reason)` (`lib/soft-skip.ts`) records a `blocked` that survives setup assertions; the ordinary soft-skip convention is unchanged everywhere else. (2) `register()` asserts under the base `0173.webhook-durable-delivery` id and `req()` is last-wins, so a leg that returned before naming its own id recorded under the base id — **`0173…dead-letter` and `0188.dead-letter-content-free` then had no row in the bundle at all.** That was already true of `0188.dead-letter-content-free` on 2.34.0 and earlier whenever the sink was empty: it read as a partial-witness pass of the base row, not the `blocked` it appeared to be. Each leg now names its row first. Measured on the reference host at 15 / 30 / 60 / 120 s: both rows `blocked` under their own ids; at the host's default schedule: all `executed-pass`, same ids; with the window raised to 300 s: all `executed-pass`, exhaustion observed at 226 s.
+- The dead-letter leg also observes before it asserts: it waits, reads the sink and deletes the subscription, returns on the inconclusive case, and only then asserts the obligations in their original order. A create failure still fails at once.
+- **The cost, stated:** a host that advertises 5 attempts, stops at 3 and drops the delivery used to read `executed-fail` and now reads `blocked`. Neither certifies. Detection of that case comes back only by putting the interval on the wire — normative surface, an RFC, not a patch.
+- Pure window logic moved to `lib/webhook-retry-window.ts` with unit tests (raisable, not lowerable, bounded, floor unchanged for a host advertising no policy).
+- `spec/v2/core/persistence.md`'s Stable banner now lists RFC 0158 §A–§D — owed since the RFC's flip, which could not edit a file shipped inside the published 2.34.0.
+- False FAIL only. Suite patch: corpus release stays `2.34.0`.
+
 ## [2.34.0] — 2026-09-21 — the rung and the recovery bound, in the bundle RFC 0158 said they were in
 
 - **RFC 0158 §E publishes a host's rung and recovery bound in its certification bundle instead of in discovery — and the bundle had no seat for either.** `certification-bundle.schema.json` is closed; a reader saw five pass/fail rows and could neither tell which rung was claimed nor recompute the bound, whose terms lived only on a non-normative seam route. Found by reading the RFC's first acceptance criterion at the moment of flipping it, with every row green.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.34.0 @openwop/spec-artifacts@2.34.0
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.34.1 @openwop/spec-artifacts@2.34.1
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```
@@ -110,6 +110,8 @@ Run `npm run test` for normal CI cadence; `npm run test:strict` when claiming fu
 | `OPENWOP_WEBHOOK_ALLOW_PRIVATE=true`      | Relaxes the webhook egress guard for the loopback test receiver used by `webhook-signed-delivery.test.ts`, `webhook-negative.test.ts`, and `replay-fanout-suppression.test.ts`. **The receiver is `http://127.0.0.1:{port}/`, which `webhooks.md` forbids three separate times, and the opt-in MUST relax all three to be witnessable:** (1) the **scheme** check — §"SSRF protection" bullet 1 rejects non-`https://`, and this gate fires FIRST on a host that validates scheme before address; (2) the **registration-time** address check — §"SSRF protection"; and (3) **delivery-time re-resolution** — §"Delivery-time egress validation (RFC 0093)". Gates 2 and 3 are independent MUSTs at different layers, so an opt-in reaching only one layer **cannot** produce a witness: delivery-only leaves registration returning `400 webhook_url_rejected`, registration-only leaves the dispatcher refusing to connect. A host whose opt-in reaches one layer is **not** non-conformant — it cannot witness these scenarios, which is a property of the test posture and not of its webhook signing. The scheme gate went unstated here until 2026-08-25; a tier-2 host validating scheme-then-address was blocked by a gate the documented contract never named. Relaxing gates 2 and 3 is **test-only posture** — see `SECURITY/threat-model-secret-leakage.md` §4.9 for why a registration-time relaxation is the more dangerous of the two. When the host rejects, the scenario records `blocked` (RFC 0148 §A), not a pass.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `OPENWOP_WEBHOOK_RECEIVER_URL=<https-url>` | **The route to a webhook witness that relaxes nothing.** A host refusing the loopback receiver on *two* independent grounds — private address **and** non-`https:` — cannot be unblocked by `OPENWOP_WEBHOOK_ALLOW_PRIVATE`, because the scheme arm still stands. This supplies **the public `https:` front for THIS SUITE'S OWN receiver** (tunnel / TLS-terminating proxy), never an arbitrary endpoint: the scenario asserts on what *this process* received, so pointing registration elsewhere makes every header assertion vacuous while the row turns green. Zero deliveries with it set is a **hard failure**, never a skip. Preferred over the flag — it waives nothing and writes no durable subscription row aimed at a private address (`SECURITY/threat-model-secret-leakage.md` §4.9). Pair with `OPENWOP_WEBHOOK_RECEIVER_PORT`. |
 | `OPENWOP_WEBHOOK_RECEIVER_PORT=<port>`     | Pins the in-process webhook receiver to a known port instead of an ephemeral one. Required in practice by `OPENWOP_WEBHOOK_RECEIVER_URL`: a tunnel must be aimed at a port known **in advance**, and the receiver binds `0` by default. Unset ⇒ ephemeral, as before. |
+| `OPENWOP_WEBHOOK_RETRY_WAIT_MS=<ms>`       | **Raises** how long `v2-webhook-durable-delivery` waits for a retry schedule to play out (default `90000`, per wait; at most `3600000`). `webhooks.retryPolicy` carries `{ maxAttempts, backoff }` and no interval, so the suite cannot derive how long exhaustion takes: set this above the SUM of your backoff intervals (a host retrying at 15/30/60/120 s needs > 225 s). **It can be raised, never lowered** — a smaller or non-numeric value is ignored — and the window stays bounded, so a host that never retries still fails. A window that closes before the advertised `maxAttempts` arrive records `blocked` naming this variable, never a conviction. |
+| `OPENWOP_DURABILITY_OBSERVATION_CEILING_MS=<ms>` | **Raises** how long the RFC 0158 kill rows observe for resumption (default `240000`). A host with a long *declared* recovery bound — a 750 s dispatch lease is conformant — sets this above its bound and waits it out. Raisable, never lowerable. |
 | `OPENWOP_MCP_FAKE_SERVER=true`            | Boots the synthetic MCP peer for `mcp-tool-roundtrip.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `OPENWOP_MCP_REAL_SERVER_URL=<base-url>`  | Points the MCP wire-shape probe at a real MCP server. The probe POSTs JSON-RPC and reads a single-JSON response — matches MCP's `streamable-http` transport in single-response mode. **Does NOT support** stdio transport (which is what most `modelcontextprotocol/servers` references default to) or SSE-streamed responses; an operator collecting interop evidence today runs a custom `StreamableHTTPServerTransport`-style server that returns a single JSON body per request. Adding SSE-frame parsing is tracked in `docs/PROTOCOL-GAP-CLOSURE-PLAN.md` Track 6. Assertions relax to shape-only. When both this and `OPENWOP_MCP_FAKE_SERVER` are set, the real URL wins. Phase 3 T3.4 interop-evidence path.                                                                                                               |
 | `OPENWOP_A2A_FAKE_PEER=true`              | Boots the synthetic A2A peer for `a2a-task-roundtrip.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |

package/dist/lib/scenario-disposition.js

@@ -100,6 +100,10 @@ export function resolveItRecord(state, assertionCalls, gate, noted, firstError)
     if (state === 'fail')
         return { disposition: 'executed-fail', detail: `the test executed and failed: ${(firstError ?? 'no message').slice(0, 300)}` };
     if (state === 'pass' && assertionCalls > 0) {
+        // `blockedDespiteAssertions` (soft-skip.ts): the leg says its setup
+        // assertions are not the requirement, and the requirement went unobserved.
+        if (noted !== null && noted.kind === 'blocked' && noted.conclusive === true)
+            return { disposition: 'blocked', detail: noted.reason };
         // A leg that asserted AND THEN soft-skipped is only a partial witness, and
         // the file-level record has always said so (`resolveFileRecord` below).
         // This `it`-level record dropped the note — and the `it`-level rows are the

package/dist/lib/soft-skip.js

@@ -74,6 +74,32 @@ export function seamAbsent(reason) {
     }
     return softSkip('blocked', reason);
 }
+/**
+ * `blocked` that STANDS even though the test already asserted something.
+ *
+ * A plain `softSkip` after an assertion records `executed-pass` with a
+ * `partial-witness:` detail (`resolveItRecord`): the acceptance predicate
+ * refuses such a row, but certification counts it as a pass. That is right for
+ * a leg that finished its requirement and skipped an optional extra. It is
+ * wrong for a leg whose REQUIREMENT went unobserved after setup assertions it
+ * could not avoid — a helper like `register()` asserts `201` before the leg has
+ * observed anything. Use this only there: the row records `blocked`, which
+ * denies certification (RFC 0168 §E.1) without convicting the host.
+ *
+ * Opt-in and per-call on purpose. Honouring every note-after-assertion as
+ * `blocked` would downgrade legs that legitimately completed; that is a suite-
+ * wide semantic change, not a patch. First use: `v2-webhook-durable-delivery`'s
+ * dead-letter leg when the retry window closes before exhaustion (2.34.1).
+ */
+export function blockedDespiteAssertions(reason) {
+    const file = currentFile();
+    if (file === null)
+        return undefined;
+    const arr = notes.get(file) ?? [];
+    arr.push({ kind: 'blocked', reason, seq: ++seq, conclusive: true });
+    notes.set(file, arr);
+    return undefined;
+}
 const RANK = { blocked: 0, skipped: 1, inapplicable: 2 };
 function fold(arr) {
     if (arr.length === 0)
@@ -84,7 +110,7 @@ function fold(arr) {
             uniq.push(n);
     const kind = [...uniq].sort((a, b) => RANK[a.kind] - RANK[b.kind])[0].kind;
     const reason = uniq.map((n) => (uniq.length > 1 ? `[${n.kind}] ${n.reason}` : n.reason)).join('; ');
-    return { kind, reason };
+    return uniq.some((n) => n.conclusive === true) ? { kind, reason, conclusive: true } : { kind, reason };
 }
 /**
  * The noted disposition for a file, worst-first when mixed (`blocked` beats

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.34.0",
-  "stampSha256": "68cccf1a2b742ba8666acfa944d92ef209dd5cef3a7b067b06a5d36dbac31d03"
+  "version": "2.34.1",
+  "stampSha256": "3f491c227a43a26ab8f77081df1443d066b404d3af64e50c5e9786d8f03462e5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.34.0",
+  "version": "2.34.1",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.34.0"
+    "@openwop/spec-artifacts": "2.34.1"
   }
 }

package/requirements.json

@@ -29507,7 +29507,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-failed-attempt-is-retried-and-the-event-is-delivered-at-least-once",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 234,
+      "line": 235,
       "title": "a failed attempt is retried and the event is delivered at least once",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery",
       "citations": [
@@ -29538,10 +29538,18 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.an-exhausted-delivery-is-dead-lettered-never-dropped",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 322,
+      "line": 323,
       "title": "an exhausted delivery is dead-lettered, never dropped",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery.dead-letter",
       "citations": [
+        {
+          "section": "webhooks.md §Durability",
+          "requirement": "an exhausted delivery MUST be routed to the sink, not dropped"
+        },
+        {
+          "section": "runs.md §Create",
+          "requirement": "POST /runs MUST answer 201 for the noop fixture"
+        },
         {
           "section": "runs.md §Create",
           "requirement": "POST /runs MUST answer 201 for the noop fixture"
@@ -29564,7 +29572,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.the-dead-letter-read-is-served-and-its-records-carry-no-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 379,
+      "line": 417,
       "title": "the dead-letter read is served and its records carry no payload",
       "explicitId": "openwop.requirement.0188.dead-letter-read",
       "citations": [
@@ -29577,10 +29585,14 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-dead-letter-record-carries-no-delivered-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 400,
+      "line": 438,
       "title": "a dead-letter record carries no delivered payload",
       "explicitId": "openwop.requirement.0188.dead-letter-content-free",
       "citations": [
+        {
+          "section": "RFC 0188 §B.1",
+          "requirement": "a dead-letter record MUST NOT carry the delivered body, headers or subscription secret"
+        },
         {
           "section": "RFC 0188 §B.1",
           "requirement": null,

package/schemas/CORPUS-STAMP.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.34.0",
+  "version": "2.34.1",
   "corpusTag": "v2.34.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
@@ -201,7 +201,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "40069d5976eeb6ba1384a648e57e5cfd673db3fce36175115fb8293bee9664d4",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "fce628a67bffe5923a01fd1bda89c44dc1fb5a679a609079b89030b5da7f116c",
+    "spec/v1/core-standard-manifest.json": "0c1aaddf25eefbbe473d543067838a4a8eed8d3e5c00b55ce0ca98eabbc1ce66",
     "spec/v1/deprecations.json": "307083ce29c23fd406015951f99a30d78d6187ff061d38dc9732f62191b40f3f",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -229,7 +229,7 @@
     "spec/v2/core/interrupt.md": "3a926d84b942d4ee7daccc4443c93dc29f6a69f2936ba813182f2c1336db2cbb",
     "spec/v2/core/overview.md": "7dc00ace32d4e4ce929a383651f0029fc4b7091ec87487b1bf26ead1be209e0e",
     "spec/v2/core/packs.md": "1c0919059760f9a3940a93264a76b7e30f9a0f6f27ff19753cc88f15753d8088",
-    "spec/v2/core/persistence.md": "b4f37792dddc651ec554ef92ce873c4fa14ad62be4500547a5078863609e16e5",
+    "spec/v2/core/persistence.md": "9785e536362ec2000dab7fee9847543240d40a907745efc70cf2c8b4c1b8344e",
     "spec/v2/core/replay.md": "b980a66e2543107240e3dc4f58131b9f4ff52478737e79ade6d5777b26ad1119",
     "spec/v2/core/runs.md": "136319842bacbbb300178980e4b83444917d5b193cc5fdd92e39a4902ba8d3c0",
     "spec/v2/core/security-defaults.md": "2a54ceaa4cef02c26ee0fbcf44f822ceeea79537c7d5a51ed300f21aa4fea576",
@@ -282,5 +282,5 @@
     "spec/v2/release.json": "eaf652e3a01f02a1d9c4eee7d7ea2c2a0396fe5694b5dce4cb01ca2af2891cc5",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "9ccc722c0600fc4b01a2a80bad95c9a1a4a88ee5"
+  "corpusCommit": "ffc0f6bf6bfe378c1e69f94386373687b15cfdb6"
 }

package/src/lib/scenario-disposition.ts

@@ -102,11 +102,14 @@ export function resolveItRecord(
   state: FileTestState,
   assertionCalls: number,
   gate: { disposition: 'inapplicable' | 'skipped'; detail?: string } | undefined,
-  noted: { kind: 'inapplicable' | 'skipped' | 'blocked'; reason: string } | null,
+  noted: { kind: 'inapplicable' | 'skipped' | 'blocked'; reason: string; conclusive?: true } | null,
   firstError?: string,
 ): { disposition: Disposition; detail?: string } {
   if (state === 'fail') return { disposition: 'executed-fail', detail: `the test executed and failed: ${(firstError ?? 'no message').slice(0, 300)}` };
   if (state === 'pass' && assertionCalls > 0) {
+    // `blockedDespiteAssertions` (soft-skip.ts): the leg says its setup
+    // assertions are not the requirement, and the requirement went unobserved.
+    if (noted !== null && noted.kind === 'blocked' && noted.conclusive === true) return { disposition: 'blocked', detail: noted.reason };
     // A leg that asserted AND THEN soft-skipped is only a partial witness, and
     // the file-level record has always said so (`resolveFileRecord` below).
     // This `it`-level record dropped the note — and the `it`-level rows are the

package/src/lib/soft-skip.ts

@@ -43,7 +43,7 @@ export type SoftSkipKind = 'inapplicable' | 'skipped' | 'blocked';
 /** Detail marker the runner writes for a zero-assertion file that noted nothing. */
 export const UNCLASSIFIED_RETURN_DETAIL = 'every test returned early with zero assertions and no recorded reason — unclassified return; RFC 0148 §A resolves it to blocked (add softSkip(kind, reason) at the early return)';
 
-interface Note { readonly kind: SoftSkipKind; readonly reason: string; readonly seq: number }
+interface Note { readonly kind: SoftSkipKind; readonly reason: string; readonly seq: number; readonly conclusive?: true }
 
 const notes = new Map<string, Note[]>();
 let seq = 0;
@@ -83,15 +83,41 @@ export function seamAbsent(reason: string): undefined {
   return softSkip('blocked', reason);
 }
 
+/**
+ * `blocked` that STANDS even though the test already asserted something.
+ *
+ * A plain `softSkip` after an assertion records `executed-pass` with a
+ * `partial-witness:` detail (`resolveItRecord`): the acceptance predicate
+ * refuses such a row, but certification counts it as a pass. That is right for
+ * a leg that finished its requirement and skipped an optional extra. It is
+ * wrong for a leg whose REQUIREMENT went unobserved after setup assertions it
+ * could not avoid — a helper like `register()` asserts `201` before the leg has
+ * observed anything. Use this only there: the row records `blocked`, which
+ * denies certification (RFC 0168 §E.1) without convicting the host.
+ *
+ * Opt-in and per-call on purpose. Honouring every note-after-assertion as
+ * `blocked` would downgrade legs that legitimately completed; that is a suite-
+ * wide semantic change, not a patch. First use: `v2-webhook-durable-delivery`'s
+ * dead-letter leg when the retry window closes before exhaustion (2.34.1).
+ */
+export function blockedDespiteAssertions(reason: string): undefined {
+  const file = currentFile();
+  if (file === null) return undefined;
+  const arr = notes.get(file) ?? [];
+  arr.push({ kind: 'blocked', reason, seq: ++seq, conclusive: true });
+  notes.set(file, arr);
+  return undefined;
+}
+
 const RANK: Record<SoftSkipKind, number> = { blocked: 0, skipped: 1, inapplicable: 2 };
 
-function fold(arr: readonly Note[]): { kind: SoftSkipKind; reason: string } | null {
+function fold(arr: readonly Note[]): { kind: SoftSkipKind; reason: string; conclusive?: true } | null {
   if (arr.length === 0) return null;
   const uniq: Note[] = [];
   for (const n of arr) if (!uniq.some((u) => u.kind === n.kind && u.reason === n.reason)) uniq.push(n);
   const kind = [...uniq].sort((a, b) => RANK[a.kind] - RANK[b.kind])[0]!.kind;
   const reason = uniq.map((n) => (uniq.length > 1 ? `[${n.kind}] ${n.reason}` : n.reason)).join('; ');
-  return { kind, reason };
+  return uniq.some((n) => n.conclusive === true) ? { kind, reason, conclusive: true } : { kind, reason };
 }
 
 /**
@@ -113,7 +139,7 @@ export function softSkipMark(): number {
  * The noted disposition for a file counting only notes written AFTER `mark`
  * — the notes of the test that is ending. Same fold as the file rule.
  */
-export function softSkipDispositionSince(file: string, mark: number): { kind: SoftSkipKind; reason: string } | null {
+export function softSkipDispositionSince(file: string, mark: number): { kind: SoftSkipKind; reason: string; conclusive?: true } | null {
   return fold((notes.get(file) ?? []).filter((n) => n.seq > mark));
 }
 

package/src/lib/webhook-retry-window.ts

@@ -0,0 +1,56 @@
+/**
+ * How long a webhook scenario waits for a host's retry schedule to play out.
+ *
+ * The advertised `webhooks.retryPolicy` facet is closed over exactly
+ * `{ maxAttempts, backoff }`: a host has NO way to put its intervals on the
+ * wire, so the suite cannot derive how long exhaustion takes and has to choose
+ * a window. Every window it has chosen so far has convicted a durable host:
+ *
+ *   2.0.1   a hard 20 s failed a host whose first backoff was 30 s.
+ *   2.34.1  a hard 90 s cap fails a host retrying at 15 / 30 / 60 / 120 s with
+ *           `maxAttempts: 5` — attempts at t0, +15, +45, +105, +225 s. The
+ *           dead-letter leg read the sink ~120 s before that host exhausts, and
+ *           recorded `executed-fail` ("MUST be routed to the sink, not dropped")
+ *           about a host that delivers, retries five times and dead-letters
+ *           correctly. To pass it would have had to cut its PRODUCTION retry
+ *           window from ~225 s to ~75 s for every real subscriber. Reported by a
+ *           tier-2 host before it advertised the facet, from its own constants.
+ *
+ * An instrument must not choose a host's durability. So the cap is
+ * OPERATOR-RAISABLE — the shape `OPENWOP_DURABILITY_OBSERVATION_CEILING_MS`
+ * already has for RFC 0158's kill rows — and NEVER LOWERABLE: a value below the
+ * default, or not a number, is ignored, so no operator can shrink the window to
+ * hide a slow retry. A raised window is still bounded, so a host that never
+ * retries still fails; it only fails later.
+ */
+export const RETRY_WAIT_FLOOR_MS = 20_000;
+export const DEFAULT_RETRY_WAIT_CAP_MS = 90_000;
+/** A typo guard, not a policy: an hour per wait is longer than any retry schedule worth certifying in one sitting. */
+export const MAX_RETRY_WAIT_CAP_MS = 3_600_000;
+export const RETRY_WAIT_ENV = 'OPENWOP_WEBHOOK_RETRY_WAIT_MS';
+
+export function retryWaitCapMs(env: Record<string, string | undefined> = process.env): number {
+  const raw = Number(env[RETRY_WAIT_ENV]);
+  if (!Number.isFinite(raw) || raw < DEFAULT_RETRY_WAIT_CAP_MS) return DEFAULT_RETRY_WAIT_CAP_MS;
+  return Math.min(Math.floor(raw), MAX_RETRY_WAIT_CAP_MS);
+}
+
+/**
+ * The floor stays 20 s so a host that advertises nothing is measured exactly as
+ * before; an advertised `exponential` / `fixed` backoff widens it to the cap.
+ */
+export function retryWaitFor(policy: { backoff?: string } | null, capMs: number): number {
+  if (policy === null) return RETRY_WAIT_FLOOR_MS;
+  const backoff = String(policy.backoff ?? '');
+  return backoff === 'exponential' || backoff === 'fixed' ? capMs : RETRY_WAIT_FLOOR_MS;
+}
+
+/** What a row says when its window closed before the host's schedule did. Computed, so the numbers a host reads are the ones the run used. */
+export function windowClosedNote(seen: number, maxAttempts: number, waitedMs: number, capMs: number): string {
+  const raised = capMs > DEFAULT_RETRY_WAIT_CAP_MS;
+  return `${seen} of the advertised ${maxAttempts} attempts arrived inside the ${waitedMs}ms this scenario waits, and the delivery is not in the sink yet. `
+    + 'webhooks.retryPolicy carries only { maxAttempts, backoff } — no interval — so the suite cannot tell a slow conformant schedule from a host that stopped retrying, and it does not convict on a deadline it chose. '
+    + (raised
+      ? `${RETRY_WAIT_ENV} is already raised to ${capMs}ms; set it above the SUM of this host's backoff intervals (at most ${MAX_RETRY_WAIT_CAP_MS}ms).`
+      : `Set ${RETRY_WAIT_ENV} above the SUM of this host's backoff intervals (default ${DEFAULT_RETRY_WAIT_CAP_MS}ms; it can be raised, never lowered) and re-run.`);
+}

package/src/scenarios/v2-webhook-durable-delivery.test.ts

@@ -34,8 +34,9 @@ import { v2Discovery, gateFamily } from '../lib/v2.js';
 import { projectBoundId } from '../lib/bound-id.js';
 import { receiverBinding, resolveRegistrationUrl } from '../lib/webhook-receiver.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
+import { retryWaitCapMs, retryWaitFor, windowClosedNote } from '../lib/webhook-retry-window.js';
 
 const FIXTURE = 'conformance-noop';
 const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
@@ -167,14 +168,14 @@ function advertisedRetryPolicy(doc: Record<string, unknown>): { maxAttempts?: nu
  * which covers a 30 s first attempt with room for the second. The cap is
  * deliberate: unbounded waiting would let a host that never retries hold the
  * suite open instead of failing.
+ *
+ * 2.34.1: and 90 s was the same defect again, one schedule further out — see
+ * `lib/webhook-retry-window.ts`. The cap is now operator-RAISABLE through
+ * `OPENWOP_WEBHOOK_RETRY_WAIT_MS` and never lowerable; still bounded.
  */
-const RETRY_WAIT_FLOOR_MS = 20_000;
-const RETRY_WAIT_CAP_MS = 90_000;
+const RETRY_WAIT_CAP_MS = retryWaitCapMs();
 function retryWaitMs(doc: Record<string, unknown>): number {
-  const policy = advertisedRetryPolicy(doc);
-  if (policy === null) return RETRY_WAIT_FLOOR_MS;
-  const backoff = String(policy.backoff ?? '');
-  return backoff === 'exponential' || backoff === 'fixed' ? RETRY_WAIT_CAP_MS : RETRY_WAIT_FLOOR_MS;
+  return retryWaitFor(advertisedRetryPolicy(doc), RETRY_WAIT_CAP_MS);
 }
 
 /**
@@ -330,8 +331,26 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
     const sub = await register(receiver.url);
     if (sub === null) return softSkip('blocked', 'registration refused (reason recorded above)');
 
+    // The row id is the FIRST thing this leg names: `register()` asserts under
+    // the base `0173.webhook-durable-delivery` id, and a leg that returned before
+    // any `.dead-letter` req() ran recorded its outcome under THAT id, leaving
+    // `.dead-letter` with no row in the bundle at all (measured, 2.34.1 draft).
+    req('openwop.requirement.0173.webhook-durable-delivery.dead-letter', 'webhooks.md §Durability', 'an exhausted delivery MUST be routed to the sink, not dropped');
     const create = await driver.post('/runs', { workflowId: FIXTURE });
-    expect(create.status, req('openwop.requirement.0173.webhook-durable-delivery.dead-letter', 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
+    // 2.34.1 — NO OBLIGATION IS ASSERTED UNTIL THE WINDOW QUESTION IS ANSWERED. A leg
+    // that asserts and THEN soft-skips records `executed-pass` with a
+    // `partial-witness:` detail (`resolveItRecord`), which certifies. The first
+    // draft of this fix asserted `create.status` and the retry, then
+    // soft-skipped `blocked` on a closed window, and so turned a false FAIL into
+    // a pass that never looked at the sink — caught by measuring it: five rows
+    // `executed-pass`, 106 s, on a host whose first delivery exhausts at 225 s.
+    // So everything is OBSERVED first, the one inconclusive case returns with
+    // zero assertions (a real `blocked`, which denies certification), and only
+    // then are the obligations asserted, in their original order. A failure the
+    // observations already show still fails: the create check fires at once.
+    if (create.status !== 201) {
+      expect(create.status, req('openwop.requirement.0173.webhook-durable-delivery.dead-letter', 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
+    }
     const runId = (create.json as { runId: string }).runId;
     await waitTerminal(runId, 10_000);
     // Filter by the delivery's own SUBSCRIPTION, not just its run. A host that
@@ -344,19 +363,11 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
     const ours = () => receiver.attempts.filter((a) => a.runId === runId && a.webhookId === sub.webhookId);
     await waitFor(() => ours().length > 1, retryWaitMs(doc));
     const attempts = ours();
-    expect(
-      attempts.length,
-      req('openwop.requirement.0173.webhook-durable-delivery.dead-letter', 'webhooks.md §Durability', 'a delivery that keeps failing MUST be retried before it can be exhausted (one attempt is a drop)'),
-    ).toBeGreaterThan(1);
     const policy = advertisedRetryPolicy(doc);
-    if (policy?.maxAttempts !== undefined) {
+    if (policy?.maxAttempts !== undefined && attempts.length > 1) {
       // Give the policy time to exhaust, then the host MUST stop.
       await waitFor(() => ours().length >= policy.maxAttempts!, retryWaitMs(doc));
       await new Promise((r) => setTimeout(r, 1_000));
-      expect(
-        ours().length,
-        req('openwop.requirement.0173.webhook-durable-delivery.dead-letter', 'webhooks.md §Durability', `retries MUST stop at the advertised retryPolicy.maxAttempts (${policy.maxAttempts}) — exhaustion routes to the dead-letter sink, not to an unbounded loop`),
-      ).toBeLessThanOrEqual(policy.maxAttempts);
     }
     // The sink itself. Until RFC 0188 this was an UNCONDITIONAL soft-skip on
     // every host — `webhooks.md` §Durability said the sink was "inspectable for
@@ -364,14 +375,41 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
     // every bundle recorded "exhaustion was observed, routing to the sink was
     // not". The read exists now; read it before deleting the subscription.
     const fam = await gateFamily('webhooks');
-    if (!fam?.['deadLetter']) {
-      await driver.delete(`/webhooks/${encodeURIComponent(sub.webhookId)}`);
-      return softSkip('inapplicable', 'host does not advertise the webhooks.deadLetter facet — RFC 0188 §A.5 makes the read a 404 rather than an obligation, so the sink half of §Durability is unwitnessable here (the retry half above passed)');
+    let inSink: boolean | null = null;
+    if (fam?.['deadLetter']) {
+      const sink = await driver.get(`/webhooks/${projectBoundId(sub.webhookId)}/dead-letters`);
+      inSink = sink.status === 200 && ((sink.json as { deliveries?: unknown[] } | null)?.deliveries ?? []).some((r) => (r as Record<string, unknown>)['runId'] === runId);
     }
-    const sink = await driver.get(`/webhooks/${projectBoundId(sub.webhookId)}/dead-letters`);
     await driver.delete(`/webhooks/${encodeURIComponent(sub.webhookId)}`);
+    // "Routed to the sink, not dropped" is a claim about an EXHAUSTED delivery,
+    // and until 2.34.1 it was asserted whether or not exhaustion had been
+    // observed: a host retrying at 15 / 30 / 60 / 120 s had made 4 of its 5
+    // attempts when the 90 s window closed, and this row said it had dropped a
+    // delivery still in flight. Retried, fewer attempts than advertised, and
+    // nothing in the sink is a window that closed early OR a host that stopped
+    // retrying — indistinguishable without an interval on the wire — so it is
+    // `blocked`, never a conviction. Reached maxAttempts with nothing in the
+    // sink still FAILS below; so does a delivery that was never retried.
+    const seen = ours().length;
+    if (inSink === false && policy?.maxAttempts !== undefined && attempts.length > 1 && seen < policy.maxAttempts) {
+      return blockedDespiteAssertions(windowClosedNote(seen, policy.maxAttempts, retryWaitMs(doc), RETRY_WAIT_CAP_MS));
+    }
+    expect(create.status, req('openwop.requirement.0173.webhook-durable-delivery.dead-letter', 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
+    expect(
+      attempts.length,
+      req('openwop.requirement.0173.webhook-durable-delivery.dead-letter', 'webhooks.md §Durability', 'a delivery that keeps failing MUST be retried before it can be exhausted (one attempt is a drop)'),
+    ).toBeGreaterThan(1);
+    if (policy?.maxAttempts !== undefined) {
+      expect(
+        ours().length,
+        req('openwop.requirement.0173.webhook-durable-delivery.dead-letter', 'webhooks.md §Durability', `retries MUST stop at the advertised retryPolicy.maxAttempts (${policy.maxAttempts}) — exhaustion routes to the dead-letter sink, not to an unbounded loop`),
+      ).toBeLessThanOrEqual(policy.maxAttempts);
+    }
+    if (inSink === null) {
+      return softSkip('inapplicable', 'host does not advertise the webhooks.deadLetter facet — RFC 0188 §A.5 makes the read a 404 rather than an obligation, so the sink half of §Durability is unwitnessable here (the retry half above passed)');
+    }
     expect(
-      sink.status === 200 && ((sink.json as { deliveries?: unknown[] } | null)?.deliveries ?? []).some((r) => (r as Record<string, unknown>)['runId'] === runId),
+      inSink,
       req('openwop.requirement.0173.webhook-durable-delivery.dead-letter', 'webhooks.md §Durability', 'an exhausted delivery MUST be routed to the sink, not dropped — the half no bundle could witness before RFC 0188 served a read'),
     ).toBe(true);
   }, DEAD_LETTER_TEST_TIMEOUT_MS);
@@ -424,10 +462,14 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
     active = receiver.server;
     const sub = await register(receiver.url);
     if (sub === null) return softSkip('blocked', 'registration refused (reason recorded above)');
+    // Same two traps as the leg above (2.34.1): `register()` asserts under the base
+    // id, so name this row first; and every `blocked` after it must STAND rather
+    // than fold into a partial-witness pass that certifies.
+    req('openwop.requirement.0188.dead-letter-content-free', 'RFC 0188 §B.1', 'a dead-letter record MUST NOT carry the delivered body, headers or subscription secret');
     const create = await driver.post('/runs', { workflowId: FIXTURE });
     if (create.status !== 201) {
       await driver.delete(`/webhooks/${encodeURIComponent(sub.webhookId)}`);
-      return softSkip('blocked', `POST /runs answered ${create.status} — no delivery to exhaust`);
+      return blockedDespiteAssertions(`POST /runs answered ${create.status} — no delivery to exhaust`);
     }
     const runId = (create.json as { runId: string }).runId;
     await waitTerminal(runId, 10_000);
@@ -441,12 +483,16 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
 
     const sink = await driver.get(`/webhooks/${projectBoundId(sub.webhookId)}/dead-letters`);
     await driver.delete(`/webhooks/${encodeURIComponent(sub.webhookId)}`);
-    if (sink.status !== 200) return softSkip('blocked', `the dead-letter read answered ${sink.status}`);
+    if (sink.status !== 200) return blockedDespiteAssertions(`the dead-letter read answered ${sink.status}`);
     const rows = ((sink.json as { deliveries?: Array<Record<string, unknown>> } | null)?.deliveries ?? []);
     // An empty sink is NOT a pass. Recording one as a pass is exactly the
     // vacuous witness this leg used to produce; say so instead.
     if (rows.length === 0) {
-      return softSkip('blocked', 'the exhausted delivery did not reach the sink inside the retry window — §B.1 is a claim about a real record and there is none here to read');
+      const seen = ours().length;
+      const why = policy?.maxAttempts !== undefined && seen < policy.maxAttempts
+        ? windowClosedNote(seen, policy.maxAttempts, retryWaitMs(doc), RETRY_WAIT_CAP_MS)
+        : `the delivery made ${seen} attempt(s) and is not in the sink`;
+      return blockedDespiteAssertions(`§B.1 is a claim about a real record and there is none here to read — ${why}`);
     }
     expect(
       rows.every((r) => r['body'] === undefined && r['headers'] === undefined && r['secret'] === undefined),