@openwop/openwop-conformance 2.34.1 → 2.35.0

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.34.1",
-  "corpusTag": "v2.34.0",
+  "version": "2.35.0",
+  "corpusTag": "v2.35.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "d26d906b044e53fbb6ba742be90c853b9dcf14af4005bb6376e354d618fbdd5a",
-    "api/v2/asyncapi.yaml": "eda3679b6902a3ab931e2dab55a04f6b6bb2b9b664748de38d8a104e53e93c76",
-    "api/v2/openapi.yaml": "313fc72043a3730fbb98fdf47f4539773564bf9c5bed54f1f180efb50cf57410",
+    "api/seams-v2.yaml": "3ce63e8b7bd3b93b7bae997821d4f7f591da89c1045e76c28e7c3bd81561cae9",
+    "api/v2/asyncapi.yaml": "91a2b046c8cc3d24d4fca8e74da170f972e03115fa5a467f4f1a7db7113427a4",
+    "api/v2/openapi.yaml": "ddc0f56e92487f650fd8e5828cf61451617d7eefe425bd47d88d72675e008ab1",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -28,7 +28,7 @@
     "schemas/ai-envelope.schema.json": "78167a5767809286071bfcfcdfeceed0ed04c8b9f8c13079019d70eff4f351c1",
     "schemas/annotation-create.schema.json": "567e8327777968e0ddab8e1547b4acd7beda734cf9d1fc6cde17037d8d9540d4",
     "schemas/annotation.schema.json": "b26d22f9a97e1ae7c195e8799964aca804e78452a079ca3a0d61ea013907ce91",
-    "schemas/artifact-type-pack-manifest.schema.json": "13932ea58e819e01b3a0cc7a65590b70683dd5fe9208fc06c64c339943d3c4ce",
+    "schemas/artifact-type-pack-manifest.schema.json": "67895666b7201bb82e846f3e1fb86ddd07aa3a6a89ece9f98462a7bc8f35ee96",
     "schemas/audit-verify-result.schema.json": "e8fd013fb610ba5db27ab0113ec2eb18e7da5f9310dd3de2dd3dc87a259c21fe",
     "schemas/budget-policy.schema.json": "3d4fe30ae129fe136ab9ece395f2a2a42a76360786b1b9a1d5f1cbc753eb5b39",
     "schemas/capabilities.schema.json": "b413e0235cad412081df09234237e0f322a85903b7411b91aaff54032e946671",
@@ -112,10 +112,10 @@
     "schemas/v2/ai-envelope.schema.json": "0dc7dfbf032a37239ffd81fc2d67f999a40782ff5074866a56e414164cdee809",
     "schemas/v2/annotation-create.schema.json": "ec32c22a243b343eeb6956a23be2d76ba5b50c8018ec3ec9d6efa5a1d9b0c792",
     "schemas/v2/annotation.schema.json": "eb4813cdaa8e325412cfcaeeee5c8a28f3751c946dec64e546c7ba0ad3aad8d4",
-    "schemas/v2/artifact-type-pack-manifest.schema.json": "f77d8dcc3112afec8b2a8e67e56752d5811deb2c2455b0d6d4c6489eb4c4a829",
+    "schemas/v2/artifact-type-pack-manifest.schema.json": "abb60653f2f29925fb430fa04fa03fa67e14af47c1f8c5c07db324576fc17fa9",
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
-    "schemas/v2/capabilities.schema.json": "e62d44f23c21c8f64b273fcdb083636e801c0de976cbd1f93333f99928dd1025",
+    "schemas/v2/capabilities.schema.json": "304cdcebb291b633abaac9faf91bfb62377125e7d53434cc78f1789d4315e52f",
     "schemas/v2/certification-bundle.schema.json": "46a5a07670f2457bf1b7af8f6df1f4f76edb3ff7e64d1b6ed85738270c95668e",
     "schemas/v2/channel-presence-payload.schema.json": "1c20ad810cb311d47aa0b95d928490826b2468fd161f884cd29e867053e6782f",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
@@ -201,7 +201,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "40069d5976eeb6ba1384a648e57e5cfd673db3fce36175115fb8293bee9664d4",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "0c1aaddf25eefbbe473d543067838a4a8eed8d3e5c00b55ce0ca98eabbc1ce66",
+    "spec/v1/core-standard-manifest.json": "ea55ec7d5a86d574479c545f3cb62ea6689ae91e4411c4ba6b27c22ca4d1f980",
     "spec/v1/deprecations.json": "307083ce29c23fd406015951f99a30d78d6187ff061d38dc9732f62191b40f3f",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -214,29 +214,29 @@
     "spec/v1/operation-path-manifest.json": "5f5f4e3842669371730ebbd1aace3fb794192615f0018dc144f484ba5db82ac3",
     "spec/v1/spec-gaps.json": "eb3bfcb9c7d05c9a6845d4a40ec9493cfaa5a671932daf1af561310136fdabe8",
     "spec/v2/README.md": "8dbfc17b10f373dba95bdd2e8fec0580f35b380a834d304be3e24e7498170185",
-    "spec/v2/core/capabilities.md": "4c4e5577caf4ae20c84fe59d580de4c6599e76783471d3b59f9730fc3807de71",
-    "spec/v2/core/conformance.md": "e5cb403f6ea6633eebc8ee4fa7bde5bf023bf4aee7c959b849e7105d37ab1f8b",
+    "spec/v2/core/capabilities.md": "8ffa639da1504d57df235e8685095d78fe9591ee3ef7e99fea359e9df99a54b4",
+    "spec/v2/core/conformance.md": "f224d49c5376ad39ea8a972cf623d5212a5fe140fd46ee83f234f92f6548ee0e",
     "spec/v2/core/connection-packs.md": "466bdb9dde79d85615ad8281dacfb7bf923ca22d7fb3ed219749e59574c753ed",
     "spec/v2/core/conversation.md": "e425887c4ba199b8cdc5c99e792689f7bd7d46de492f28670de2e402fa6d9506",
     "spec/v2/core/errors.md": "0dff4a0ae102a86f6a17a9a3b16a203292588a0f422ed19d1c0d9213995aa01d",
-    "spec/v2/core/events.md": "c98742f5a310eee8287ca8135493502152e88b479200a6544bb3340fed1e4efe",
+    "spec/v2/core/events.md": "e90f860b48b87b5fbd3824029009c3044a7446715484c55d68cc4ec005a03a25",
     "spec/v2/core/form-content-packs.md": "af3517dd7125106088249c0e32220b0b9fc3e9304c10378a6327cc8ad84b6bf1",
     "spec/v2/core/headers.md": "14cdf4ae9ee7d80eebfd426d7c3552e577baea0300915cd4bb3a68e8588195a8",
     "spec/v2/core/host-services.md": "3753f1e034d325bb4bd5751ae6d321fbb16700d4e28032ab4e273d25eb134fc4",
     "spec/v2/core/idempotency.md": "e4edae1834101fd331379d84de77eaa9cead49383529c31f8bcd18322f67c965",
     "spec/v2/core/identity.md": "e44f34f7c2db1f12babb19ca8ee1e5b1401a89f38fd5c90d0c4b74c95f6e5d42",
     "spec/v2/core/interop.md": "6bd581556b9ab1a1509c01b9a1ec2bcb9e4a8300e68fb01570704417e70f20b9",
-    "spec/v2/core/interrupt.md": "3a926d84b942d4ee7daccc4443c93dc29f6a69f2936ba813182f2c1336db2cbb",
+    "spec/v2/core/interrupt.md": "18bcdfee975b3d9c336bc9b1845176f5c158274f7b66bb1870c2d7b49d9cfcdc",
     "spec/v2/core/overview.md": "7dc00ace32d4e4ce929a383651f0029fc4b7091ec87487b1bf26ead1be209e0e",
     "spec/v2/core/packs.md": "1c0919059760f9a3940a93264a76b7e30f9a0f6f27ff19753cc88f15753d8088",
     "spec/v2/core/persistence.md": "9785e536362ec2000dab7fee9847543240d40a907745efc70cf2c8b4c1b8344e",
-    "spec/v2/core/replay.md": "b980a66e2543107240e3dc4f58131b9f4ff52478737e79ade6d5777b26ad1119",
-    "spec/v2/core/runs.md": "136319842bacbbb300178980e4b83444917d5b193cc5fdd92e39a4902ba8d3c0",
+    "spec/v2/core/replay.md": "02d2757bd263a3e7e06dd6af0da9d58dff37202941f84b6fc097c083a8186146",
+    "spec/v2/core/runs.md": "05fba9b83bbfcca4bc531f9623bff7bf79d5f587170ed5e8b26cd536a950b2eb",
     "spec/v2/core/security-defaults.md": "2a54ceaa4cef02c26ee0fbcf44f822ceeea79537c7d5a51ed300f21aa4fea576",
     "spec/v2/core/versioning.md": "56c1e273c790bcb0a2c3c760ffc7595afc9f5d4a745965e57f36aefcd456da76",
-    "spec/v2/core/webhooks.md": "46c1311c1897236f9bf9db5025c8af31dd84cd19208da3e5e9ff69eec9436965",
+    "spec/v2/core/webhooks.md": "dca6ec657a7489d6469c2acb20f656e0bf9542dfc9144520f5441d83575c8025",
     "spec/v2/core/workflow-chain-packs.md": "df78b76dd79f2267fb6b72c08e0911e5f9d5bb1925c6efdd6deda62fe8a51dc8",
-    "spec/v2/declaration.json": "0f35205af96f29cacced435d1b606e9e8292c74a5509444bec78f17d315d63bf",
+    "spec/v2/declaration.json": "3a5960e97782d64ace047e5a1edd4ae5a7b956bdc94ff7bcfd9f4c270740340c",
     "spec/v2/declaration.schema.json": "c86e3083fb9789c1958ecb4576cc6f71aa90e6f339521139238543ed08211dd4",
     "spec/v2/errors.json": "296117235d21ce4a393371c2f80caf03a4ae93d1f80a89f87cd3f56902cf5b01",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
@@ -265,7 +265,7 @@
     "spec/v2/facets/auth.schema.json": "73440c944ad12c41aab0618aeb799a90a0b59e97fc685527f248afb7d015381a",
     "spec/v2/facets/envelopeStrictness.schema.json": "28be0a27f880bd45ec1222a16155f5e9167bbca57bf0322970fe1eb2654562aa",
     "spec/v2/facets/heartbeat.schema.json": "81d7fa1895a8b0241bd07cf00a7e7905bef0fd14eb3427325261c62eee5746a6",
-    "spec/v2/facets/interrupt.schema.json": "c76c58c0abd99de619f8c8afad246568f5bc9cce3b7a0d097d16d87eba84be3a",
+    "spec/v2/facets/interrupt.schema.json": "3cc228b9bee48922b22bd6b0bee1a3244dc83d377a616cfb523435368da11ebb",
     "spec/v2/facets/mcp.schema.json": "f56609fe24ba6160ad29ae31aa16043354ff005e5cb6a0f3871c4d226087cc08",
     "spec/v2/facets/packs.schema.json": "d544a280419c0052ce0f3c3b378f7aa04085cadc31df52a3c8f43da600b131b1",
     "spec/v2/facets/replay.schema.json": "0a5aefb0108c708c6794fadd533cf256709704c4f16dbf44cd63fa8980c78018",
@@ -279,8 +279,8 @@
     "spec/v2/path-manifest.json": "c123c9fd77dc1b3f9c2e9346ace80cdae007e6511138894956abda01e61ec1c6",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "eaf652e3a01f02a1d9c4eee7d7ea2c2a0396fe5694b5dce4cb01ca2af2891cc5",
+    "spec/v2/release.json": "5b9a956506b011835f1bd2fec54064d9cc8657d8a45a371314850da377d69069",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "ffc0f6bf6bfe378c1e69f94386373687b15cfdb6"
+  "corpusCommit": "a7ff2254a6ed9cbd47e327a95eb280e4aaf23699"
 }

package/src/cli.ts

@@ -724,7 +724,7 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
       discovery: { url: discoveryUrl, sha256, protocolVersions, preferredVersion, document },
       claimedProfiles: claimed3,
       results: { totals: totals3, requirements: rows3 },
-      witnessSha256: witnessDigest(rows3),
+      witnessSha256: witnessDigest(rows3, relaxations),
       assertionCount: rows3.reduce((n, r) => n + (r.assertions ?? 0), 0),
       ...(nonPass.length ? { detail: { nonPass: nonPass.map((r) => ({ id: r.id, result: r.result, reason: r.detail ?? '' })) } } : {}),
       // RFC 0158 §D: claimed ONLY when these rows support it. The verifier
@@ -959,6 +959,8 @@ async function main(): Promise<never> {
       `certified: ${verdict.certifiedProfiles.length > 0 ? verdict.certifiedProfiles.join(', ') : '(none)'}`,
       // RFC 0158 §D/§E: the rung is a CLAIM; a claim the signed rows do not support is a rejection below.
       `rung:      ${bundle.durability?.rung ?? '(none claimed)'}`,
+      // 2.35.0: derived from the signed `skipped` rows; checked against the signed discovery document.
+      `opted out: ${verdict.optedOut.length > 0 ? verdict.optedOut.join(', ') : '(none)'}`,
       '',
       'What this command does NOT do:',
       '  · It does not re-run anything. A host that measured itself wrongly, and signed',

package/src/lib/certification-bundle-v3.ts

@@ -87,12 +87,26 @@ export function canonicalJSON(value: unknown): string {
   return JSON.stringify(value);
 }
 
-/** RFC 0148 §C — the digest over the reporter record (the requirement rows). */
-export function witnessDigest(rows: readonly BundleV3Requirement[]): string {
+/**
+ * RFC 0148 §C — the digest over the reporter record (the requirement rows),
+ * and, from 2.35.0, the operator's declared relaxations when there are any.
+ *
+ * Why relaxations are in here: the attestation covers exactly
+ * `{ witnessSha256, host.build, suite.version, discovery.sha256 }`, so a
+ * `host.relaxations[]` beside the rows was UNSIGNED — strip it after signing
+ * and the verifier re-derives the relaxed profile as certified, on a bundle
+ * that still verifies. Included ONLY WHEN NON-EMPTY: the preimage is the rows
+ * array exactly as before for every bundle that declares nothing (all
+ * committed bundles digest unchanged, pinned in durability-evidence.test.ts),
+ * and `{ rows, relaxations }` otherwise. An older verifier fails closed on a
+ * 2.35.0 bundle that declares relaxations — `witness-digest`, never a pass.
+ */
+export function witnessDigest(rows: readonly BundleV3Requirement[], relaxations?: readonly BundleV3Relaxation[]): string {
   const canonicalRows = [...rows].sort((a, b) => a.id.localeCompare(b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }),
     // ONLY WHEN PRESENT: every bundle cut before 2.34.0 has no `evidence` and digests byte-identically.
     ...(r.evidence === undefined ? {} : { evidence: r.evidence }) }));
-  return createHash('sha256').update(canonicalJSON(canonicalRows), 'utf8').digest('hex');
+  const preimage = relaxations !== undefined && relaxations.length > 0 ? { rows: canonicalRows, relaxations } : canonicalRows;
+  return createHash('sha256').update(canonicalJSON(preimage), 'utf8').digest('hex');
 }
 
 /** The bytes the attestation covers. */
@@ -138,6 +152,22 @@ export interface V3Verdict {
    * checked. Read it before quoting a verdict.
    */
   readonly derivabilityChecked: boolean;
+  /**
+   * 2.35.0 — the profiles and families the operator opted out of, derived from
+   * the SIGNED `skipped` rows `behaviorGate` writes (`openwop.profile.<name>`,
+   * where a family is `family.<key>`). Derived rather than read from a root
+   * member because a root member would sit outside the attestation.
+   */
+  readonly optedOut: string[];
+}
+
+const OPT_OUT_ROW = 'openwop.profile.';
+/** The opt-outs a bundle's signed rows record. */
+export function optedOutFromRows(rows: ReadonlyArray<{ readonly id: string; readonly result: string; readonly detail?: string }>): string[] {
+  return rows
+    .filter((r) => r.id.startsWith(OPT_OUT_ROW) && r.result === 'skipped' && (r.detail ?? '').includes('OPENWOP_OPTED_OUT_PROFILES'))
+    .map((r) => r.id.slice(OPT_OUT_ROW.length))
+    .sort();
 }
 
 export function verifyBundleV3(bundle: BundleV3, opts: VerifyV3Options = {}): V3Verdict {
@@ -154,8 +184,8 @@ export function verifyBundleV3(bundle: BundleV3, opts: VerifyV3Options = {}): V3
   const count = (d: BundleV3Result): number => rows.filter((r) => r.result === d).length;
   const expected = { executedPass: count('executed-pass'), executedFail: count('executed-fail'), skipped: count('skipped'), inapplicable: count('inapplicable'), blocked: count('blocked') };
   for (const k of Object.keys(expected) as (keyof typeof expected)[]) if (bundle.results?.totals?.[k] !== expected[k]) rejections.push({ kind: 'totals-mismatch', detail: `totals.${k} is ${String(bundle.results?.totals?.[k])} but the rows count ${expected[k]}` });
-  const digest = witnessDigest(rows);
-  if (bundle.witnessSha256 !== digest) rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows (${digest.slice(0, 12)})` });
+  const digest = witnessDigest(rows, bundle.host?.relaxations);
+  if (bundle.witnessSha256 !== digest) rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows and declared relaxations (${digest.slice(0, 12)})` });
   const assertions = rows.reduce((n, r) => n + (r.assertions ?? 0), 0);
   if (bundle.assertionCount !== assertions) rejections.push({ kind: 'assertion-count', detail: `assertionCount is ${String(bundle.assertionCount)} but the rows sum to ${assertions}` });
   const nonPass = rows.filter((r) => r.result !== 'executed-pass');
@@ -243,6 +273,20 @@ export function verifyBundleV3(bundle: BundleV3, opts: VerifyV3Options = {}): V3
         derivabilityChecked = false;
       } else {
         derivabilityChecked = true;
+        // RFC 0148 §B: "A host MUST NOT both advertise and opt out of the same
+        // profile." The suite refuses that at run time (behaviorGate throws),
+        // so a bundle that records both was edited after the run or emitted by
+        // something else. Both inputs are signed — the rows through
+        // witnessSha256, the document through discovery.sha256 — so the
+        // contradiction is checkable offline, and it is bundle-wide: an opt-out
+        // list that is false makes every `skipped` row in the bundle suspect.
+        const root = document as unknown as Record<string, unknown>;
+        for (const name of optedOutFromRows(rows)) {
+          const advertised = name.startsWith('family.')
+            ? (() => { const v = root[name.slice('family.'.length)]; return typeof v === 'object' && v !== null && !Array.isArray(v); })()
+            : profileDerivable(document as DiscoveryPayload, name, targetMajor);
+          if (advertised) rejections.push({ kind: 'opted-out-but-advertised', detail: `${name} is recorded as an operator opt-out, but the captured discovery document advertises it — a host MUST NOT both advertise and opt out of the same profile (RFC 0148 §B)` });
+        }
         for (const p of bundle.claimedProfiles ?? []) {
           // §B(1) binds the CERTIFICATION, not the listing: a profile a bundle
           // names without certifying makes no claim for derivability to falsify.
@@ -268,5 +312,6 @@ export function verifyBundleV3(bundle: BundleV3, opts: VerifyV3Options = {}): V3
     verifierSignatureVerified,
     certifiedProfiles: bundleWide.length > 0 ? [] : certifiedProfiles.filter((p) => !scoped.has(p)),
     derivabilityChecked,
+    optedOut: optedOutFromRows(rows),
   };
 }

package/src/lib/durability-watch.ts

@@ -29,7 +29,7 @@
  * Readers are injected so the ordering itself is testable without a host.
  */
 export interface Observation { readonly readable: boolean; readonly runStarted: number; readonly nodeStarted: number; readonly restored: number }
-export interface Watch { readonly resumedAfterMs: number | null; readonly last: Observation; readonly completedUnresumed: boolean; readonly waitedMs: number }
+export interface Watch { readonly resumedAfterMs: number | null; readonly last: Observation; readonly completedUnresumed: boolean; readonly waitedMs: number; readonly transportErrors: number }
 export interface WatchIo {
   readStatus(): Promise<string | null>;
   readLog(): Promise<Observation>;
@@ -37,17 +37,41 @@ export interface WatchIo {
   sleep(ms: number): Promise<void>;
 }
 
+const UNREADABLE: Observation = { readable: false, runStarted: 0, nodeStarted: 0, restored: 0 };
+
+/**
+ * A TRANSPORT failure is an unreadable observation, never a verdict (2.34.2).
+ *
+ * The kill rows are the one place the suite causes the host to disappear, and a
+ * seam may kill at a point AFTER it has answered - `during-execution` dies at
+ * the first `node.started`, which can land seconds later. `waitBack()` already
+ * treated a refused connection as "down, keep waiting"; these two reads did
+ * not, so a process that died mid-watch threw `fetch failed` out of the
+ * scenario and failed the row - for recovering. Measured on a tier-1 host at
+ * its production image, behind a port proxy that accepts and then closes: four
+ * of five RFC 0158 rows `executed-fail` on `UND_ERR_SOCKET: other side closed`,
+ * twice. A status that cannot be read is `null`; a log that cannot be read is
+ * `readable: false` - both already mean "conclude nothing, poll again", and the
+ * budget still bounds the wait, so a host that never comes back still fails.
+ */
+async function orNull<T>(read: () => Promise<T>, fallback: T): Promise<{ value: T; failed: boolean }> {
+  try { return { value: await read(), failed: false }; } catch { return { value: fallback, failed: true }; }
+}
+
 export async function watchForResumption(io: WatchIo, budgetMs: number, resumed: (o: Observation) => boolean, pollMs = 500): Promise<Watch> {
   const t0 = io.now();
   let completedUnresumed = false;
+  let transportErrors = 0;
   for (;;) {
-    const status = await io.readStatus();   // FIRST
-    const last = await io.readLog();        // SECOND — never older than the status it is judged against
+    const st = await orNull(() => io.readStatus(), null);   // FIRST
+    const lg = await orNull(() => io.readLog(), UNREADABLE); // SECOND — never older than the status it is judged against
+    if (st.failed || lg.failed) transportErrors++;
+    const status = st.value; const last = lg.value;
     const waitedMs = io.now() - t0;
     const isResumed = last.readable && resumed(last);
     if (status === 'completed' && last.readable && !isResumed) completedUnresumed = true;
-    if (isResumed) return { resumedAfterMs: waitedMs, last, completedUnresumed, waitedMs };
-    if (waitedMs >= budgetMs) return { resumedAfterMs: null, last, completedUnresumed, waitedMs };
+    if (isResumed) return { resumedAfterMs: waitedMs, last, completedUnresumed, waitedMs, transportErrors };
+    if (waitedMs >= budgetMs) return { resumedAfterMs: null, last, completedUnresumed, waitedMs, transportErrors };
     await io.sleep(pollMs);
   }
 }

package/src/lib/scenario-disposition.ts

@@ -104,12 +104,26 @@ export function resolveItRecord(
   gate: { disposition: 'inapplicable' | 'skipped'; detail?: string } | undefined,
   noted: { kind: 'inapplicable' | 'skipped' | 'blocked'; reason: string; conclusive?: true } | null,
   firstError?: string,
+  /**
+   * 2.35.0, major 2 (`conformance.md` §Bundle v3): a requirement the test did
+   * not observe records `blocked` even when the test asserted setup facts
+   * first. At major 1 a `blocked` note after assertions stays a
+   * `partial-witness` pass unless the leg used `blockedDespiteAssertions`.
+   *
+   * Why the rule changed: a `partial-witness` row is refused by the acceptance
+   * predicate but COUNTED by certification, so a profile could certify on a
+   * requirement nobody observed. Swept before the change: all 24 major-2
+   * sites were "requirement unobserved" (unreachable, control silent, window
+   * closed), none an optional extra. Scoped to major 2 because the 146 v1-side
+   * sites were not measured and v1 bundles are read through its EOS.
+   */
+  blockedStands = false,
 ): { disposition: Disposition; detail?: string } {
   if (state === 'fail') return { disposition: 'executed-fail', detail: `the test executed and failed: ${(firstError ?? 'no message').slice(0, 300)}` };
   if (state === 'pass' && assertionCalls > 0) {
     // `blockedDespiteAssertions` (soft-skip.ts): the leg says its setup
     // assertions are not the requirement, and the requirement went unobserved.
-    if (noted !== null && noted.kind === 'blocked' && noted.conclusive === true) return { disposition: 'blocked', detail: noted.reason };
+    if (noted !== null && noted.kind === 'blocked' && (noted.conclusive === true || blockedStands)) return { disposition: 'blocked', detail: noted.reason };
     // A leg that asserted AND THEN soft-skipped is only a partial witness, and
     // the file-level record has always said so (`resolveFileRecord` below).
     // This `it`-level record dropped the note — and the `it`-level rows are the
@@ -148,12 +162,12 @@ export function fileDisposition(
       return { disposition: 'inapplicable', detail: 'every test returned early through behaviorGate with zero assertions: profile not advertised in the captured discovery set' };
     }
     if (assertionCount === 0 && gateReason === 'skipped') {
-      return { disposition: 'skipped', detail: 'every test returned early through behaviorGate with zero assertions: operator opted the profile out (OPENWOP_OPTED_OUT_PROFILES)' };
+      return { disposition: 'skipped', detail: 'every test returned early through behaviorGate with zero assertions: operator opted the profile or family out (OPENWOP_OPTED_OUT_PROFILES)' };
     }
     return { disposition: 'executed-pass' };
   }
   if (gateReason === 'inapplicable') return { disposition: 'inapplicable', detail: 'every test skipped: profile not advertised in the captured discovery set (behaviorGate)' };
-  if (gateReason === 'skipped') return { disposition: 'skipped', detail: 'every test skipped: operator opted the profile out (OPENWOP_OPTED_OUT_PROFILES)' };
+  if (gateReason === 'skipped') return { disposition: 'skipped', detail: 'every test skipped: operator opted the profile or family out (OPENWOP_OPTED_OUT_PROFILES)' };
   return {
     disposition: 'blocked',
     detail:

package/src/lib/terminal-shape.ts

@@ -0,0 +1,30 @@
+/**
+ * RFC 0194 §A — the shape a run's log must have around its terminal event.
+ *
+ * Exactly one terminal run event, and after it no forward execution: no second
+ * terminal event, no run.started / run.resumed / run.resume-started /
+ * run.paused / run.restored-from-snapshot, no node.* and no interrupt.*.
+ * `compensation.*` and `run.dead-lettered` MAY follow (a compensating host
+ * unwinds after a cancelled parent — compensation.md §"Cancellation of the
+ * parent"); vendor-prefixed types are not constrained.
+ *
+ * Pure, so a scenario can add a leg under RFC 0194's ids cheaply, and so the
+ * rule is pinned without a host.
+ */
+export const TERMINAL_RUN_EVENTS: ReadonlySet<string> = new Set(['run.completed', 'run.failed', 'run.cancelled']);
+const FORWARD_RUN_EVENTS: ReadonlySet<string> = new Set(['run.started', 'run.resumed', 'run.resume-started', 'run.paused', 'run.restored-from-snapshot']);
+
+/** The first violation of §A.1–§A.2 in `types` (log order), or null when the shape holds. */
+export function terminalShapeViolation(types: readonly string[]): string | null {
+  const terminals = types.map((t, i) => [t, i] as const).filter(([t]) => TERMINAL_RUN_EVENTS.has(t));
+  if (terminals.length === 0) return 'the log carries no terminal run event (run.completed / run.failed / run.cancelled)';
+  if (terminals.length > 1) return `the log carries ${terminals.length} terminal run events (${terminals.map(([t, i]) => `${t}@${i}`).join(', ')}) — exactly one is allowed`;
+  const at = terminals[0]![1];
+  for (let i = at + 1; i < types.length; i++) {
+    const t = types[i]!;
+    if (FORWARD_RUN_EVENTS.has(t) || t.startsWith('node.') || t.startsWith('interrupt.')) {
+      return `${t} at index ${i} follows the terminal event ${types[at]} at index ${at} — only compensation.* and run.dead-lettered may`;
+    }
+  }
+  return null;
+}

package/src/scenarios/v2-bound-id-kinds.test.ts

@@ -27,17 +27,45 @@
  * @see RFCS/0187-host-found-bindings.md §A
  */
 import { describe, it, expect } from 'vitest';
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery, gateFamily } from '../lib/v2.js';
 import { readErrorCode } from '../lib/error-envelope.js';
 import { softSkip } from '../lib/soft-skip.js';
-import { resolveRegistrationUrl } from '../lib/webhook-receiver.js';
+import { receiverBinding, resolveRegistrationUrl } from '../lib/webhook-receiver.js';
+import { scaledTimeoutMs } from '../lib/polling.js';
 import { req } from '../lib/requirement-ids.js';
 import { projectBoundId, BOUND_ID } from '../lib/bound-id.js';
 
 const DOC = 'spec/v2/core/identity.md §5 (RFC 0187 §A)';
 const WEBHOOK_ID = 'openwop.requirement.0187.bound-id-kinds.webhook';
 const PER_KIND = 'openwop.requirement.0187.bound-id-kinds.per-kind';
+/**
+ * 2.35.0 (openwop#1450). The mint leg above reads the id a host RETURNS; a
+ * subscriber identifies its deliveries by the id the host EMITS in the
+ * delivery headers. A tier-2 host bound the first and left the second bare,
+ * and this file stayed green — the defect surfaced only as a durability
+ * failure in another file, whose delivery filter keys on the header.
+ */
+const WEBHOOK_EMITTED = 'openwop.requirement.0187.bound-id-kinds.webhook-emitted';
+
+type Delivery = { body: string; headers: Record<string, string | string[] | undefined> };
+/** The suite's receiver, bound the way every webhook scenario binds it (pinned port / public front honoured). */
+async function startReceiver(): Promise<{ server: Server; url: string; deliveries: Delivery[] }> {
+  const deliveries: Delivery[] = [];
+  const server = createServer((request: IncomingMessage, res: ServerResponse) => {
+    const chunks: Buffer[] = [];
+    request.on('data', (c: Buffer) => chunks.push(c));
+    request.on('end', () => { deliveries.push({ body: Buffer.concat(chunks).toString('utf8'), headers: request.headers }); res.writeHead(204); res.end(); });
+  });
+  const pinned = Number(process.env['OPENWOP_WEBHOOK_RECEIVER_PORT'] ?? '');
+  const bindPort = Number.isInteger(pinned) && pinned > 0 && pinned < 65536 ? pinned : 0;
+  const binding = receiverBinding();
+  await new Promise<void>((resolve) => server.listen(bindPort, binding.bind, () => resolve()));
+  const addr = server.address();
+  return { server, url: `http://${binding.advertise}:${typeof addr === 'object' && addr ? addr.port : 0}/hook`, deliveries };
+}
+const header = (d: Delivery, name: string): string | undefined => { const v = d.headers[name]; return Array.isArray(v) ? v[0] : v; };
 
 async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> {
   try { return await fn(); } catch { return null; }
@@ -74,6 +102,11 @@ describe('v2 bound-id kinds (identity.md §5, RFC 0187 §A)', () => {
     expect(reg.status, req(WEBHOOK_ID, 'webhooks.md §Surfaces', 'POST /webhooks MUST answer 201 { webhookId }')).toBe(201);
     const webhookId = (reg.json as { webhookId?: unknown } | null)?.webhookId;
     expectBound(webhookId, 'webhookId', 'POST /webhooks 201', WEBHOOK_ID);
+    // Never leave the subscription behind, whatever happens below (a leaked
+    // subscription is delivered to for the rest of the run and skews every
+    // later webhook file's attribution).
+    let deleted = false;
+    try {
     if (typeof webhookId !== 'string' || !BOUND_ID.test(webhookId)) return softSkip('blocked', `the mint answered ${JSON.stringify(webhookId)}, which is not a tenant-bound id — the projection and 403 legs have no bound id to drive (the grammar failure is recorded by the assertion above)`);
 
     // The 403 check §5 exists for: a bound id whose tenant is not the caller's.
@@ -86,10 +119,61 @@ describe('v2 bound-id kinds (identity.md §5, RFC 0187 §A)', () => {
 
     // The accept side: the RFC 0184 projection on a tenant-bound parameter that is not runId.
     const del = await http(() => driver.delete(`/webhooks/${projectBoundId(webhookId)}`));
+    deleted = del?.status === 204;
     expect(
       del?.status ?? null,
       req(WEBHOOK_ID, DOC, `DELETE /webhooks/{webhookId} MUST accept the ~-projected spelling of the id it minted (RFC 0184 §A: every tenant-bound path parameter) — got ${del?.status ?? 'no response'} ${readErrorCode(del?.json) ?? ''}`.trim()),
     ).toBe(204);
+    } finally {
+      if (!deleted && typeof webhookId === 'string') await http(() => driver.delete(`/webhooks/${projectBoundId(webhookId)}`));
+    }
+  });
+
+  it('subscriptionId: the webhookId a host EMITS on a delivery is the one it minted', async () => {
+    const doc = await v2Discovery();
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable');
+    if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised — nothing is delivered (gate recorded under openwop.family.webhooks)');
+    const rx = await startReceiver();
+    let webhookId: string | null = null;
+    try {
+      const registration = resolveRegistrationUrl(rx.url);
+      const reg = await http(() => driver.post('/webhooks', { url: registration.url, events: ['run.completed'] }));
+      if (reg === null) return softSkip('blocked', 'POST /webhooks unreachable (fetch failed)');
+      if (reg.status === 400 && readErrorCode(reg.json) === 'webhook_url_rejected') {
+        return softSkip('blocked', `host SSRF guard rejected the suite receiver ${registration.url} (webhooks.md §SSRF requires it) — set OPENWOP_WEBHOOK_RECEIVER_URL to a public https front for the receiver to witness what the host emits`);
+      }
+      const minted = (reg.json as { webhookId?: unknown } | null)?.webhookId;
+      if (reg.status !== 201 || typeof minted !== 'string') return softSkip('blocked', `POST /webhooks answered ${reg.status} without a webhookId — the mint leg above owns that obligation; this leg needs an id to compare`);
+      webhookId = minted;
+      const create = await http(() => driver.post('/runs', { workflowId: 'conformance-noop' }));
+      const runId = (create?.json as { runId?: unknown } | null)?.runId;
+      if (create === null || create.status !== 201 || typeof runId !== 'string') return softSkip('blocked', `POST /runs answered ${create?.status ?? 'no response'} — no run, so no delivery to read`);
+      // Select the delivery by the RUN in the body, never by the header under
+      // test: filtering on the header is exactly how a bare header hid in the
+      // durability scenario (openwop#1450).
+      const ours = (): Delivery[] => rx.deliveries.filter((d) => { try { return (JSON.parse(d.body) as { runId?: unknown }).runId === runId; } catch { return false; } });
+      const deadline = Date.now() + scaledTimeoutMs(20_000);
+      while (ours().length === 0 && Date.now() < deadline) await new Promise((r) => setTimeout(r, 250));
+      const delivery = ours()[0];
+      if (delivery === undefined) return softSkip('blocked', `no delivery for run ${runId} reached the suite receiver within ${scaledTimeoutMs(20_000)}ms — what the host emits was not observed`);
+      expect(
+        header(delivery, 'openwop-webhook-id'),
+        req(WEBHOOK_EMITTED, 'webhooks.md §Headers (RFC 0187 §A.1)', `the delivery's OpenWOP-Webhook-Id MUST equal the tenant-bound webhookId the host minted (${minted}) — a subscriber identifies its deliveries by the header, not by the 201 it received once`),
+      ).toBe(minted);
+      // The X-openwop-* family is required only of a host advertising BOTH
+      // majors (webhooks.md: dual emission through the overlap). A v2-only host
+      // sends none, and failing it for that would be the suite's error.
+      const both = Array.isArray(doc.protocolVersions) && doc.protocolVersions.some((v) => typeof v === 'string' && v.startsWith('1.'));
+      if (both) {
+        expect(
+          header(delivery, 'x-openwop-webhook-id'),
+          req(WEBHOOK_EMITTED, 'webhooks.md §Headers (dual emission, RFC 0176 §D.2)', `a host advertising both majors MUST send X-openwop-Webhook-Id with the same value as OpenWOP-Webhook-Id (${minted})`),
+        ).toBe(minted);
+      }
+    } finally {
+      if (webhookId !== null) await http(() => driver.delete(`/webhooks/${projectBoundId(webhookId as string)}`));
+      await new Promise<void>((ok) => rx.server.close(() => ok()));
+    }
   });
 
   it('interruptId: the id a suspension puts on the wire is bound', async () => {
@@ -140,11 +224,17 @@ describe('v2 bound-id kinds (identity.md §5, RFC 0187 §A)', () => {
     if (reg === null || reg.status !== 201) return softSkip('blocked', `POST /webhooks answered ${reg?.status ?? 'no response'} — no subscription to read a sink for`);
     const webhookId = (reg.json as { webhookId?: unknown } | null)?.webhookId;
     if (typeof webhookId !== 'string') return softSkip('blocked', 'the mint returned no webhookId');
+    // This leg only READS the sink; it must not leave its subscription behind
+    // (measured: it left one on every run until 2.35.0).
+    try {
     const res = await http(() => driver.get(`/webhooks/${projectBoundId(webhookId)}/dead-letters`));
     if (res === null) return softSkip('blocked', 'GET /webhooks/{webhookId}/dead-letters unreachable (fetch failed)');
     expect(res.status, req(PER_KIND, 'RFC 0188 §A.1', 'a host advertising webhooks.deadLetter MUST serve the dead-letter read (200)')).toBe(200);
     const rows = ((res.json as { deliveries?: Array<Record<string, unknown>> } | null)?.deliveries ?? []);
     if (rows.length === 0) return softSkip('inapplicable', 'the subscription has no dead-lettered delivery in this run — the read is served and the shape is unwitnessed here; v2-webhook-durable-delivery drives an exhaustion and asserts the record');
     for (const r of rows) expectBound(r['deliveryId'], 'deliveryId', 'GET /webhooks/{webhookId}/dead-letters', PER_KIND);
+    } finally {
+      await http(() => driver.delete(`/webhooks/${projectBoundId(webhookId)}`));
+    }
   });
 });

package/src/scenarios/v2-callback-url-guarded.test.ts

@@ -0,0 +1,53 @@
+/**
+ * RFC 0196 §A.3 — a host that advertises `interrupt.callbackDelivery` holds
+ * `createRun.callbackUrl` to the `webhooks.md` §SSRF guard at create time
+ * (`spec/v2/core/interrupt.md` §Callback delivery). Target major 2.
+ *
+ * `callbackUrl` is an outbound request to a URL the CALLER chooses — the
+ * surface the SSRF guard exists for. Measured on three hosts before the RFC:
+ * one ignored it, one refused it, one delivered to it with no guard at all.
+ *
+ * Gated on the facet: a host that does not advertise delivery has no egress
+ * here to guard (it SHOULD refuse the member, which this file does not assert).
+ * No committed host advertises the facet today, so this row is witnessed on
+ * none; it is written so the first host that does is held to it.
+ *
+ * @see spec/v2/core/interrupt.md §Callback delivery
+ * @see RFCS/0196-callbackurl-and-embedded-ipv4-egress.md §A.3
+ */
+import { describe, expect, it } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.requirement.0196.callback-url-guarded';
+const DOC = 'spec/v2/core/interrupt.md §Callback delivery (RFC 0196 §A.3)';
+const FIXTURE = 'conformance-approval';
+const PROBES = [
+  { url: 'https://127.0.0.1/openwop-callback-probe', cls: 'loopback (IPv4)' },
+  { url: 'https://169.254.169.254/latest/meta-data/', cls: 'cloud metadata' },
+  { url: 'https://[::ffff:7f00:1]/openwop-callback-probe', cls: 'loopback as IPv4-mapped IPv6 (hex)' },
+];
+
+describe('v2 callbackUrl egress guard (RFC 0196 §A.3)', () => {
+  it('a host advertising callback delivery refuses a callbackUrl its egress guard would refuse', async () => {
+    if (!(await v2Discovery())) return softSkip('blocked', 'v2 discovery unreachable');
+    const fam = await gateFamily('interrupt');
+    if (!fam) return softSkip('inapplicable', 'interrupt family not advertised (gate recorded under openwop.family.interrupt)');
+    if (fam['callbackDelivery'] !== true) return softSkip('inapplicable', 'the host does not advertise interrupt.callbackDelivery — it delivers nothing to callbackUrl, so there is no egress to guard (RFC 0196 §A.2: it SHOULD refuse the member)');
+    const workflowId = isFixtureAdvertised(FIXTURE) ? FIXTURE : 'conformance-noop';
+    const accepted: string[] = [];
+    const wrong: string[] = [];
+    for (const p of PROBES) {
+      const r = await driver.post('/runs', { workflowId, callbackUrl: p.url });
+      if (r.status === 201) { accepted.push(`${p.cls} (${p.url})`); const id = (r.json as { runId?: unknown } | null)?.runId; if (typeof id === 'string') await driver.post(`/runs/${encodeURIComponent(id)}/cancel`, {}).catch(() => undefined); continue; }
+      const field = (r.json as { details?: { field?: unknown } } | null)?.details?.field;
+      if (r.status !== 400 || readErrorCode(r.json) !== 'validation_error' || field !== 'callbackUrl') wrong.push(`${p.cls}: ${r.status} ${readErrorCode(r.json) ?? ''} field=${String(field)}`);
+    }
+    expect(accepted, req(ID, DOC, 'a host advertising interrupt.callbackDelivery MUST refuse at createRun a callbackUrl the webhooks.md §SSRF registration guard would refuse')).toEqual([]);
+    expect(wrong, req(ID, DOC, 'the refusal MUST be 400 validation_error naming details.field "callbackUrl"')).toEqual([]);
+  });
+});

package/src/scenarios/v2-durability-recovery.test.ts

@@ -127,6 +127,12 @@ type SeamState =
  * would terminate a host that never claimed the rung.
  */
 async function probeSeam(): Promise<SeamState> {
+  // 2.34.2: the rows before this one KILLED the host. A row whose watch ran out
+  // its budget can hand over a host that is still restarting, and a bare GET
+  // then threw `fetch failed` and failed a row that never touched the kill -
+  // four rows of one measured cut were contaminated by the first. Wait for the
+  // service to answer at all (immediately, when it is up), then probe.
+  await waitBack(scaledTimeoutMs(RESUME_WINDOW_MS));
   const r = await driver.get(KILL_SEAM);
   if (r.status === 404 || r.status === 405) {
     return { kind: 'absent', why: `no RFC 0158 durability seam at ${KILL_SEAM} (HTTP ${r.status}) — §E: the seam advertises nothing and a host that never runs the durability exercises exposes no such route, so this host claims no durable-execution rung` };
@@ -236,7 +242,10 @@ async function declaredBoundMs(fired: unknown): Promise<{ ms: number; declared:
   // interval against a bound that does not govern the staged run.
   const governing = (fired as { recoveryBoundMs?: unknown } | null)?.recoveryBoundMs;
   if (typeof governing === 'number' && Number.isFinite(governing) && governing > 0) return { ms: governing, declared: true, recoveryClass };
-  const r = await driver.get('/host/durability/bound');
+  // A seam may answer and THEN die (during-execution dies at the first
+  // node.started), so this read can meet a closed socket: wait the restart out
+  // once and read again rather than fail the row on transport (2.34.2).
+  const r = await driver.get('/host/durability/bound').catch(async () => { await waitBack(scaledTimeoutMs(RESUME_WINDOW_MS)); return driver.get('/host/durability/bound'); });
   const bound = (r.json as { bound?: unknown } | null)?.bound;
   return r.status === 200 && typeof bound === 'number' && Number.isFinite(bound) && bound > 0
     ? { ms: bound, declared: true, recoveryClass }

package/src/scenarios/v2-relaxation-recorded.test.ts

@@ -58,7 +58,7 @@ function bundle(opts: { relaxations?: BundleV3Relaxation[]; certified: boolean;
       { id: 'openwop-discovery-core', evidenceTier: 'self', witnessCount: 1, certified: true },
     ],
     results: { totals: { executedPass: ROWS.length, executedFail: 0, skipped: 0, inapplicable: 0, blocked: 0 }, requirements: ROWS },
-    witnessSha256: witnessDigest(ROWS),
+    witnessSha256: witnessDigest(ROWS, opts.relaxations),
     assertionCount: ROWS.reduce((n, r) => n + (r.assertions ?? 0), 0),
   };
   return { ...unsigned, signature: signBundleV3(unsigned, hostPem, 'host-key-1') };
@@ -105,6 +105,18 @@ describe('RFC 0173 §A.2 — relaxation-recorded (unaided, fixture bundle)', ()
       honest.rejections.map((r) => r.kind),
       req('openwop.requirement.0173.relaxation-recorded', 'security-defaults.md §Relaxations', 'a relaxation recorded against an unclaimed profile is not a rejection — recording is the obligation, claiming is the defect'),
     ).not.toContain('relaxed-profile-certified');
+
+    // 2.35.0: the declaration is SIGNED. `host.relaxations[]` sits outside the
+    // attestation, so until the witness digest covered it a relaxation could be
+    // deleted after signing and the relaxed profile re-derived as certified on a
+    // bundle that still verified. Strip it from the honest bundle and re-verify.
+    const signed = bundle({ relaxations: [RELAXED], certified: false });
+    const stripped = { ...signed, host: { ...signed.host } };
+    delete (stripped.host as { relaxations?: unknown }).relaxations;
+    expect(
+      verifyBundleV3(stripped).rejections.map((r) => r.kind),
+      req('openwop.requirement.0173.relaxation-recorded', 'conformance.md §Bundle v3', 'a relaxation removed after signing MUST be detected — the declaration is covered by witnessSha256, so the stripped bundle fails `witness-digest`'),
+    ).toContain('witness-digest');
   });
 
   // Until 2.33.0 every leg above used the FIXTURE profile `openwop-webhooks`, and