@openwop/openwop-conformance 2.34.1 → 2.34.2

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.34.2] — 2026-09-21 — a host that died on schedule failed the rows that were watching it recover
+
+- **The RFC 0158 kill rows read the host through two calls that did not survive the host dying.** `waitBack()` treated a refused connection as "down, keep waiting"; the watch's `readStatus` / `readLog` called `driver.get` bare. A seam may answer and *then* die — `during-execution` dies at the first `node.started`, seconds after its response — so `waitBack` saw a 200 from the still-living process, the process died mid-watch, and `fetch failed` escaped the scenario as an **`executed-fail` — for recovering.** Measured by a tier-1 host at its exact production image under a real restart supervisor, behind a port proxy that accepts and then closes: four of five rows `executed-fail` on `UND_ERR_SOCKET: other side closed`, reproduced twice; the one that passed was the row whose kill lands before the seam answers.
+- **A transport failure inside the watch is now an unreadable observation, never a verdict:** a status that cannot be read is `null`, a log that cannot be read is `readable: false` — both already meant "conclude nothing, poll again" — and the budget still bounds the wait, so a host that never comes back still records no resumption. `Watch.transportErrors` counts them. Unit-tested in `lib/durability-watch.test.ts` (dies after answering and comes back → resumption observed; never comes back → none; an unreadable read never latches completed-un-re-executed).
+- **One kill no longer contaminates the rest of the run.** Every seam row now waits for the host to answer at all before probing the seam, and the bound read retries once across a restart. Suite setup retried discovery twice back-to-back, giving a restarting host about a millisecond: each file set up during the restart logged "discovery unreadable" and recorded its fixture gates `blocked`. Setup now waits out a transport failure (refused / reset / closed) for up to 45 s, 1 s apart, without spending an attempt; an HTTP answer and a 20 s timeout still count as attempts, so a host that is up and wrong is not retried into looking right.
+- False FAIL only. Suite patch; corpus release stays `2.34.0`. Reported by openwop-app.
+
 ## [2.34.1] — 2026-09-21 — a 90 s window convicted a host for retrying at its production pace
 
 - **`v2-webhook-durable-delivery` capped every wait at a hard 90 s, and a conformant host with a slower schedule could not advertise `webhooks.deadLetter` without failing its bundle.** A host retrying at 15 / 30 / 60 / 120 s with `maxAttempts: 5` makes its attempts at t0, +15, +45, +105, +225 s. The dead-letter leg waited for a second attempt, waited 90 s more, and read the sink ~120 s before that host exhausts: **`0173.webhook-durable-delivery.dead-letter` → `executed-fail`, "an exhausted delivery MUST be routed to the sink, not dropped"**, about a delivery still in flight; `0188.dead-letter-content-free` → `blocked`, which denies certification. To pass, the host would have had to cut its production retry window from ~225 s to ~75 s for every real subscriber — the instrument choosing the host's durability. Reported by a tier-2 host from its own constants *before* advertising the facet; reproduced on the reference host configured to the same schedule.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.34.1 @openwop/spec-artifacts@2.34.1
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.34.2 @openwop/spec-artifacts@2.34.2
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.34.1",
-  "stampSha256": "3f491c227a43a26ab8f77081df1443d066b404d3af64e50c5e9786d8f03462e5"
+  "version": "2.34.2",
+  "stampSha256": "f4c6cce1906546565c17cc8c80b081aea9aff2d0a3338ad45d92b4836875d979"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.34.1",
+  "version": "2.34.2",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.34.1"
+    "@openwop/spec-artifacts": "2.34.2"
   }
 }

package/requirements.json

@@ -26650,7 +26650,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.accepted-work-survives-a-kill-before-dispatch-and-dispatches-on-resume",
       "file": "v2-durability-recovery.test.ts",
-      "line": 283,
+      "line": 292,
       "title": "accepted work survives a kill before dispatch and dispatches on resume",
       "explicitId": "openwop.requirement.0158.kill-after-accept",
       "citations": [
@@ -26664,7 +26664,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.work-executing-at-a-real-process-death-is-never-reported-complete-and-resumes",
       "file": "v2-durability-recovery.test.ts",
-      "line": 337,
+      "line": 346,
       "title": "work executing at a real process death is never reported complete, and resumes",
       "explicitId": "openwop.requirement.0158.kill-during-execution",
       "citations": [
@@ -26683,7 +26683,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.the-same-accepted-work-delivered-twice-fires-each-effect-exactly-once",
       "file": "v2-durability-recovery.test.ts",
-      "line": 393,
+      "line": 402,
       "title": "the same accepted work delivered twice fires each effect exactly once",
       "explicitId": "openwop.requirement.0158.duplicate-delivery",
       "citations": [
@@ -26702,7 +26702,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.the-declared-recovery-bound-is-derived-from-the-mechanism-that-enforces-it",
       "file": "v2-durability-recovery.test.ts",
-      "line": 467,
+      "line": 476,
       "title": "the declared recovery bound is derived from the mechanism that enforces it",
       "explicitId": "openwop.requirement.0158.bound-is-derived",
       "citations": [
@@ -26716,7 +26716,7 @@
     {
       "id": "openwop.it.v2-durability-recovery.deterministically-failing-work-reaches-a-terminal-state-and-stops-being-retried",
       "file": "v2-durability-recovery.test.ts",
-      "line": 498,
+      "line": 507,
       "title": "deterministically failing work reaches a terminal state and stops being retried",
       "explicitId": "openwop.requirement.0158.poison-exhaustion",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.34.1",
+  "version": "2.34.2",
   "corpusTag": "v2.34.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
@@ -201,7 +201,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "40069d5976eeb6ba1384a648e57e5cfd673db3fce36175115fb8293bee9664d4",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "0c1aaddf25eefbbe473d543067838a4a8eed8d3e5c00b55ce0ca98eabbc1ce66",
+    "spec/v1/core-standard-manifest.json": "67e8053f7355380ba2b7a1b3f56dfb761de38565ee9cdd9a86302307cb956736",
     "spec/v1/deprecations.json": "307083ce29c23fd406015951f99a30d78d6187ff061d38dc9732f62191b40f3f",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -282,5 +282,5 @@
     "spec/v2/release.json": "eaf652e3a01f02a1d9c4eee7d7ea2c2a0396fe5694b5dce4cb01ca2af2891cc5",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "ffc0f6bf6bfe378c1e69f94386373687b15cfdb6"
+  "corpusCommit": "1a06f6f3c070c043a959f82ed3e91e22d26c658e"
 }

package/src/lib/durability-watch.ts

@@ -29,7 +29,7 @@
  * Readers are injected so the ordering itself is testable without a host.
  */
 export interface Observation { readonly readable: boolean; readonly runStarted: number; readonly nodeStarted: number; readonly restored: number }
-export interface Watch { readonly resumedAfterMs: number | null; readonly last: Observation; readonly completedUnresumed: boolean; readonly waitedMs: number }
+export interface Watch { readonly resumedAfterMs: number | null; readonly last: Observation; readonly completedUnresumed: boolean; readonly waitedMs: number; readonly transportErrors: number }
 export interface WatchIo {
   readStatus(): Promise<string | null>;
   readLog(): Promise<Observation>;
@@ -37,17 +37,41 @@ export interface WatchIo {
   sleep(ms: number): Promise<void>;
 }
 
+const UNREADABLE: Observation = { readable: false, runStarted: 0, nodeStarted: 0, restored: 0 };
+
+/**
+ * A TRANSPORT failure is an unreadable observation, never a verdict (2.34.2).
+ *
+ * The kill rows are the one place the suite causes the host to disappear, and a
+ * seam may kill at a point AFTER it has answered - `during-execution` dies at
+ * the first `node.started`, which can land seconds later. `waitBack()` already
+ * treated a refused connection as "down, keep waiting"; these two reads did
+ * not, so a process that died mid-watch threw `fetch failed` out of the
+ * scenario and failed the row - for recovering. Measured on a tier-1 host at
+ * its production image, behind a port proxy that accepts and then closes: four
+ * of five RFC 0158 rows `executed-fail` on `UND_ERR_SOCKET: other side closed`,
+ * twice. A status that cannot be read is `null`; a log that cannot be read is
+ * `readable: false` - both already mean "conclude nothing, poll again", and the
+ * budget still bounds the wait, so a host that never comes back still fails.
+ */
+async function orNull<T>(read: () => Promise<T>, fallback: T): Promise<{ value: T; failed: boolean }> {
+  try { return { value: await read(), failed: false }; } catch { return { value: fallback, failed: true }; }
+}
+
 export async function watchForResumption(io: WatchIo, budgetMs: number, resumed: (o: Observation) => boolean, pollMs = 500): Promise<Watch> {
   const t0 = io.now();
   let completedUnresumed = false;
+  let transportErrors = 0;
   for (;;) {
-    const status = await io.readStatus();   // FIRST
-    const last = await io.readLog();        // SECOND — never older than the status it is judged against
+    const st = await orNull(() => io.readStatus(), null);   // FIRST
+    const lg = await orNull(() => io.readLog(), UNREADABLE); // SECOND — never older than the status it is judged against
+    if (st.failed || lg.failed) transportErrors++;
+    const status = st.value; const last = lg.value;
     const waitedMs = io.now() - t0;
     const isResumed = last.readable && resumed(last);
     if (status === 'completed' && last.readable && !isResumed) completedUnresumed = true;
-    if (isResumed) return { resumedAfterMs: waitedMs, last, completedUnresumed, waitedMs };
-    if (waitedMs >= budgetMs) return { resumedAfterMs: null, last, completedUnresumed, waitedMs };
+    if (isResumed) return { resumedAfterMs: waitedMs, last, completedUnresumed, waitedMs, transportErrors };
+    if (waitedMs >= budgetMs) return { resumedAfterMs: null, last, completedUnresumed, waitedMs, transportErrors };
     await io.sleep(pollMs);
   }
 }

package/src/scenarios/v2-durability-recovery.test.ts

@@ -127,6 +127,12 @@ type SeamState =
  * would terminate a host that never claimed the rung.
  */
 async function probeSeam(): Promise<SeamState> {
+  // 2.34.2: the rows before this one KILLED the host. A row whose watch ran out
+  // its budget can hand over a host that is still restarting, and a bare GET
+  // then threw `fetch failed` and failed a row that never touched the kill -
+  // four rows of one measured cut were contaminated by the first. Wait for the
+  // service to answer at all (immediately, when it is up), then probe.
+  await waitBack(scaledTimeoutMs(RESUME_WINDOW_MS));
   const r = await driver.get(KILL_SEAM);
   if (r.status === 404 || r.status === 405) {
     return { kind: 'absent', why: `no RFC 0158 durability seam at ${KILL_SEAM} (HTTP ${r.status}) — §E: the seam advertises nothing and a host that never runs the durability exercises exposes no such route, so this host claims no durable-execution rung` };
@@ -236,7 +242,10 @@ async function declaredBoundMs(fired: unknown): Promise<{ ms: number; declared:
   // interval against a bound that does not govern the staged run.
   const governing = (fired as { recoveryBoundMs?: unknown } | null)?.recoveryBoundMs;
   if (typeof governing === 'number' && Number.isFinite(governing) && governing > 0) return { ms: governing, declared: true, recoveryClass };
-  const r = await driver.get('/host/durability/bound');
+  // A seam may answer and THEN die (during-execution dies at the first
+  // node.started), so this read can meet a closed socket: wait the restart out
+  // once and read again rather than fail the row on transport (2.34.2).
+  const r = await driver.get('/host/durability/bound').catch(async () => { await waitBack(scaledTimeoutMs(RESUME_WINDOW_MS)); return driver.get('/host/durability/bound'); });
   const bound = (r.json as { bound?: unknown } | null)?.bound;
   return r.status === 200 && typeof bound === 'number' && Number.isFinite(bound) && bound > 0
     ? { ms: bound, declared: true, recoveryClass }

package/src/setup.ts

@@ -50,6 +50,17 @@ import { takeNotedEvidence } from './lib/durability-evidence.js';
 // vacuous `inapplicable`. Measured 2026-09-05 on a host answering in 200 ms.
 const SUITE_INIT_TIMEOUT_MS = 20_000;
 const SUITE_INIT_ATTEMPTS = 2;
+/**
+ * 2.34.2: a TRANSPORT failure (refused, reset, closed) is retried for up to
+ * this long, 1 s apart, before discovery is declared unreadable. Two
+ * back-to-back attempts gave a host restarted by the RFC 0158 kill rows about
+ * a millisecond to come back: every file set up while it was restarting logged
+ * "discovery unreadable" and recorded its fixture gates `blocked`, so one kill
+ * contaminated the rest of the run. An HTTP answer is not retried here - a host
+ * that answers 500 is up and its answer stands. A timeout (the 20 s abort) is
+ * not a transport failure either and still counts as an attempt.
+ */
+const SUITE_INIT_RESTART_WINDOW_MS = 45_000;
 
 async function loadHostFixtures(): Promise<void> {
   const baseUrl = process.env.OPENWOP_BASE_URL?.trim();
@@ -67,6 +78,7 @@ async function loadHostFixtures(): Promise<void> {
   if (targetMajor() === 2) headers['OpenWOP-Version'] = '2.0';
 
   let lastFailure = 'unknown';
+  const initStarted = Date.now();
   for (let attempt = 1; attempt <= SUITE_INIT_ATTEMPTS; attempt += 1) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), SUITE_INIT_TIMEOUT_MS);
@@ -82,6 +94,11 @@ async function loadHostFixtures(): Promise<void> {
       return;
     } catch (err) {
       lastFailure = `${(err as Error).message ?? 'unknown'} on attempt ${attempt}`;
+      const aborted = (err as Error).name === 'AbortError';
+      if (!aborted && Date.now() - initStarted < SUITE_INIT_RESTART_WINDOW_MS) {
+        attempt -= 1; // a restarting host: wait, and do not spend an attempt on it
+        await new Promise((r) => setTimeout(r, 1_000));
+      }
     } finally {
       clearTimeout(timer);
     }