@openwop/openwop-conformance 2.37.0 → 2.38.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.38.0] — 2026-09-24 — two RFCs add legs, and six rows that could not pass on a conforming host now can
+
+- **Two rows the 2026-09-24 public v2-reference cut could not explain now say why, and one leg gets the time a tunnel needs.** `v2-mrtr-rounds-ceiling`'s `.refused` leg recorded only `expected 400 to be 422` on that cut, but passes on every loopback run of the host. Its failure message now carries the host's error code, how many `tools/call` the suite's MCP fake served, and the response body. Those facts separate "the host refused a round the fake answered" from "a round the tunnel failed to carry". `v2-oauth-client-pkce-state-iss`'s state leg gets a 120 s per-test timeout instead of 30 s: it makes eight sequential round trips through the AS double's tunnel, and on that cut it alone timed out while its shorter sibling legs passed. No assertion, requirement or window changes.
+- **`v2-a2ui-v09-surface`'s two §C.11 fork legs could never pass on a conforming host.** Both recorded a surface on the suspended `conformance-approval` run and then forked at `fromSeq: sequence + 1`. The surface is the last event of that run, so `sequence + 1` names no event, and `spec/v2/core/runs.md` §Fork requires `422 fork_point_invalid` for a `fromSeq` not in the source log. The two ids affected were `openwop.it.v2-a2ui-v09-surface.recorded-as-recorded` and `openwop.requirement.0209.legacy-readable`. Each leg now records one more envelope: an `updateDataModel` on the same live surface (version 2), or a second version-1 surface (legacy). It then forks at the sequence the host reported for that envelope, so the surface is fixed history (`sequence < fromSeq`) and the fork point exists. What the fork must carry is unchanged. New suite self-test `src/lib/fork-point-recorded.test.ts` refuses any scenario whose `fromSeq` is arithmetic on another sequence (`fromSeq: x + 1`). It is sabotage-proved: restoring the old file makes it fail and name both lines (`:220`, `:237`). No other scenario has the pattern.
+- **RFC 0212 — canonical JSON is JCS over I-JSON, and the certification digest no longer depends on the machine's locale.** New `src/lib/jcs.ts` is the suite's one canonicalizer: `canonicalJSON` (RFC 8785, refuses non-finite numbers, non-JSON values and lone surrogates) and `parseIJson` (refuses duplicate names and integer literals beyond ±(2^53 − 1), which `JSON.parse` would silently resolve). `certification-bundle-v3.ts` re-exports it and sorts `witnessSha256` rows by UTF-16 code units (was `localeCompare`); `cli.ts` reads the discovery document and a `--verify` bundle through `parseIJson` and drops its private copy; `llm-cache-key-recipe.ts` sorts `tools[]` by code units. New `vectors/jcs-v1.json`, server-free scenario `jcs-vectors` (both majors), coherence test `v2-bundle-witness-preimage` (every committed v3 bundle re-derives from the prose preimage; count asserted), and `semantic-request-digest-v2.json` gains `tools-code-unit-order` / `-reversed`. No committed bundle's digest changed. **Behavior change:** `--certify` now refuses (exit 2) a host whose discovery document is not I-JSON (a duplicate member name or an integer literal beyond ±(2^53 − 1)), and `verifyBundleV3` turns a non-I-JSON value into a `witness-digest` / `discovery-digest` / `signature-invalid` rejection instead of hashing coerced bytes (self-tested, sabotage-checked).
+- **A public front that carries a PATH no longer sends every delivery to "addressed elsewhere".** `lib/front-mux.ts` (2.37.0) nonce-paths each suite fixture behind the operator's single front, and `lib/scoped-receiver.ts` (#1526) put the webhook receiver on it. Both matched only request paths STARTING with `/fx/`. A tunnel forwards the whole path, and `cut-public.sh` fronts the receiver at `${RX_URL}/hook`, so the pinned listener saw `/hook/fx/<nonce>` and answered every delivery as a stranger's. Measured on the 2026-09-24 public v2-reference cut on suite 2.37.1 (reported by openwop-75): `0171.webhook-delivery-shape`, `0173.webhook-durable-delivery` (+ `.dead-letter`) and `0187.bound-id-kinds.webhook-emitted` failed, deterministically on any path-bearing front and invisibly on loopback, where there is no front. `routeFronted` now strips the front's own path before matching (`frontPath` / `withoutFrontPath`), which also gives the pinned owner its own fronted traffic without the prefix; `scoped-receiver`'s `foreign()` count reads the same stripped path. New host-free legs use a path-bearing front for the webhook receiver (own delivery, sibling routing) and the A2A peer (a scenario-owned fake and the owner's own card); removing the strip reds all three.
+- **`0206.delivery-extended-locale` could never execute: `v2-content-locale-keys` gated on a `supported` field the v2 `content` record cannot carry.** The gate was `content === null || content['supported'] !== true`. The v2 `content` record in `schemas/v2/capabilities.schema.json` is `additionalProperties: false` with no `supported` property — at major 2 presence of the record is the claim (RFC 0169 §A.2) — so on every schema-valid host — MyndHyve's committed record (`content: {baseLocale, supportedLocales}`, suite 2.35.1, which predates the scenario) included — the row would record `inapplicable` for a reason that was not true, even on a host advertising `es-419`. The gate is now presence (`familyAdvertised`); the rest of the scenario is unchanged. New suite self-test `src/lib/v2-family-gate-no-supported.test.ts` refuses any `v2-*` scenario comparing `supported` to a boolean, pins the premise (no v2 capability record declares `supported`), and is sabotage-proved: restoring the old line reds it naming `v2-content-locale-keys.test.ts:55`. A sweep of every `v2-*` scenario and the libraries they call found no second instance — the other `supported` reads are error-body arrays (`details.supported`, `error.data.supported`) and `lib/toolCatalog.ts` already resolves through `familyAdvertised` at major 2. On a current bundle the row stays `inapplicable` (no committed host advertises a tag outside the RFC 0103 subset), now for the stated reason.
+- **Suite `2.38.0`**: 558 scenario files. `@openwop/spec-artifacts` moves in lockstep at the same exact pin.
+
+## [2.37.1] — 2026-09-24 — records that say why, and identities a host must remember minted fresh per run
+
+- **`0213.in-flight-loser-outcome` no longer blocks a host that replays every loser.** `v2-idempotency-in-flight` ended with `softSkip('blocked', …)` when all five same-key creates succeeded. RFC 0213 §B explicitly permits that outcome: a loser MAY wait and receive the winner's final outcome, marked `OpenWOP-Idempotent-Replay: true`. The file's own header already promised `partial-witness`. Blocking denied certification (RFC 0168 §E.1) to every host fast enough, or serial enough, that no loser was ever in flight. It was measured on the v2-reference host with the published 2.37.0 (loopback rehearsal: all 5 answers were successes, 4 of them marked replays). The note is now `inapplicable`, which at major 2 records the row as a partial witness after the leg's assertions. Certification counts it, and the acceptance predicate still refuses it, because the 409 branch was never observed.
+- **A failing assertion reaches the record with its message and its case name, and the per-`it` row of a multi-leg requirement survives.** MEASURED, `v2-run-bulk-cancel.test.ts` on a tier-2 host, both rows from ONE run: `openwop.floor.v2-run-bulk-cancel` `executed-fail`, 10 assertions, detail "one or more assertions in the file failed"; `openwop.requirement.0170.run-bulk-cancel` `executed-pass`, 3 assertions. No case name, no message, nothing else in the record for that file — the host operator could not diagnose it and hand-probed production. Two independent faults. (1) `fileDisposition`'s `executed-fail` detail was that FIXED STRING; it is now `failureDetail(...)` — the failing case titles (first three, then `+N more`) plus the first failure's message — and `resolveItRecord` names the leg in the per-`it` row's detail too. `setup.ts` collects `task.name` + the first error in `afterEach`. (2) The file has two `it`s that both hand `req()` one module-level `const ID`; leg 1 passed with 3 assertions and leg 2 failed on its 7th, and leg 2's row hit `recordRequirement`'s one-disposition-per-run throw, which `setup.ts`'s "never fail a test for bookkeeping" `catch` swallowed — so the verdict reached neither the in-memory ledger nor the JSONL sink. `recordRequirement` gains `fold`, used only by the per-`it` path: the surviving row is the LEAST certifiable leg (the rank `readLedgerFile` already applies across workers), carrying that leg's detail, with the legs' assertion counts summed; a scenario that classifies ITSELF twice still throws. 27 scenario files share one explicit id across several `it`s, so this was never one file's bug — `scripts/check-req-only.mjs` rule (d) now resolves a `const` handed to `req()` (it compared only call-site literals and was blind to the form nearly every scenario uses) and no longer flags the shared-id pattern the fold makes safe. **Why 7 of the 10 assertions looked unattributed, stated rather than gated:** they were not. All ten carry `req(ID, …)`, and attribution is per-`it`, not per-assertion — `req()` sets one `explicitId` that `setup.ts` takes once per test, and `assertionCount` counts `expect` calls whatever their message. The 3-vs-10 was the discarded leg, not a missing id. (The suite does hold 1,281 `expect`s with no message at all, against 4,824 carrying `req(...)`; they cost the reader a sentence, never the row its id, and the case name now carries alongside vitest's own diff. The reasoning is recorded in `check-req-only.mjs` rather than turned into a 1,281-site sweep.) Sabotage, host-free: one assertion flipped in `v2-payload-seats-0186.test.ts` (3 `it`s, one shared `const ID`, same shape as the bulk-cancel file) reproduces the reported pair exactly at `origin/main` — scenario row `executed-fail` / "one or more assertions in the file failed", requirement row `executed-pass`, failing leg absent — and after the fix the requirement row is `executed-fail` naming `"§A.3 ApprovalData.onTimeout is a closed enum and the def stays closed"` with the full `req()` message, and the file row names the case and quotes it.
+- **Four webhook scenarios stop registering one byte-identical destination, and a zero that is provably unmeasured stops convicting the host.** `v2-bound-id-kinds`, `v2-webhook-delivery-shape`, `v2-webhook-durable-delivery` and `webhook-signed-delivery` each bound `OPENWOP_WEBHOOK_RECEIVER_PORT` and registered `resolveRegistrationUrl(...)`, which returns `OPENWOP_WEBHOOK_RECEIVER_URL` VERBATIM — so on a tunnelled cut all four subscriptions pointed at ONE URL. A webhook subscription is durable host-side state that keeps delivering, and RETRYING, after the file that made it has finished, so whichever receiver held the port read the leftovers as its own traffic — and `v2-webhook-durable-delivery` answers 500 BY DESIGN. Both symptoms were already recorded in the tree as workarounds: `v2-webhook-delivery-shape`'s receiver carried "the tunnel forwards to the PINNED port — held by the other receiver, which answers 500 by design — so this file's `deliveries` stays empty, its legs soft-skip, and the rows resolve `executed-pass`", and `v2-webhook-durable-delivery` filters by subscription because "a tier-2 host measured 6 attempts against a maxAttempts of 5". New `src/lib/scoped-receiver.ts` composes the two halves the tree already had rather than reimplementing either: ROUTING is openwop#1520's `front-mux` (each receiver registers its handler under its nonce and calls `routeFronted` first, so several can be alive behind one front), IDENTITY is the nonce made UNCONDITIONAL — `frontedEndpoint` omits it for the pinned-port owner, which is enough for a live listener and not for a subscription that outlives its exercise. A retry for a finished exercise now addresses a nonce nobody serves, is answered 404, and is counted `foreign()` instead of absorbed. `unservedDestination()` does the same for a leg that needs the mint and no delivery (`v2-bound-id-kinds` leg 1). Zeroes: where other traffic DID reach the listener, the path from host to process demonstrably works and the absence is of this exercise's IDENTITY, so the leg records `blocked` with `noDeliveryCause(...)` naming the address, the nonce and the foreign count — `blocked` denies certification exactly as a failure does (RFC 0168 §E.1), and a genuinely mis-wired front produces no traffic at all and still fails. `src/lib/scoped-receiver.test.ts` pins it host-free (8 cases: distinct destinations, the nonce surviving a front, a sibling's traffic routed to the sibling, a finished exercise's retry refused, a nonce-less stranger refused, own traffic delivered prefix-stripped, and both readings of a zero); removing the nonce from the destination reds 3 of them. The `receiverBinding` source guard in `webhook-receiver.test.ts` is rewritten to accept either shape and gains two cases: the shared helper must itself bind through `receiverBinding()`, and no listed scenario may mint its destination with `resolveRegistrationUrl`. Not witnessed against a host: no tunnelled cut was available, and no timeout or window was widened.
+- **Two RFC 0213 requirement ids were cited from one `it()`, so the winner id was recorded on no host.** `v2-idempotency-in-flight.test.ts` cited `0213.in-flight-one-winner` and `0213.in-flight-loser-outcome` from a single `it`. The ledger keys on the id and `setup.ts` takes ONE `explicitId` per test, so only the last one cited got a row: the winner clause — "of concurrent same-key requests a host MUST process exactly one" — was measured on every host that ran the file and recorded on none of them, and nothing said so. Found by `check-req-only.mjs` rule (d) the moment it learned to resolve a `const` handed to `req()`, which is the same sharpening this cycle made for the attribution fix; the rule had compared only call-site literals, so the violation was invisible when the file was written. Split into two `it`s over ONE race: the record is in flight only while the winning create is being handled, so driving the race twice would measure two unrelated races and halve the chance that either overlaps, so it is driven once and memoised and both legs await the same result (the `v2-subject-link-record` pattern). No assertion, gate or timeout changed. The no-overlap soft-skip now lands on the loser id it is ABOUT, so the winner clause keeps its verdict instead of losing it to that return — a strictly better row on a host with no overlap, which is every host that answers create in milliseconds. That soft-skip's DISPOSITION is openwop#1525's, taken verbatim on merge: `inapplicable` (→ `executed-pass` + `partial-witness`), not `blocked`, because §B permits a loser to wait and receive a marked final outcome and `blocked` would deny certification to a host that did nothing wrong. The two changes compose — #1525 fixed what the row says, this one fixed which id says it.
+- **A third fixed dedup key, and the source guard that would have caught it.** `trigger-stream-cdc-sources.test.ts` handed the bridge seam the literal `'events:3:99001'` and then asserted `deliveredCount === 1 || outcome === 'delivered'` — the identical defect as the bullet below, one file over, and it survived that sweep because NOTHING WAS CHECKING. §F.5 reuses §C-1's dedup window verbatim and that window is a >=24h FLOOR, so the second run of the file against the same host, any time that day, hands the bridge broker coordinates it has already delivered; a conformant host collapses the exercise into the first run's outcome and the assertion convicts it. Cold host passes, warm host fails. New `freshStreamDedupKey()` mints the OFFSET and keeps `(topic, partition)` — not `freshDedupKey`, because §F.5 says a stream event's key SHOULD derive from `(topic, partition, offset)` and the leg's own `req()` message asserts over exactly that keying; an opaque token would make the message describe something the call no longer does. The repetition §C-1 is about happens INSIDE the seam's `scenario: 'dedup'`, so the clause is untouched. New `src/lib/trigger-dedup-key.test.ts` pins it host-free and guards the CALL SITES, which is where a regression would reappear: no file that drives `driveDelivery` may spell a `dedupKey` as a literal. Sabotage, both spellings: reintroducing the literal as `dedupKey: 'events:3:99001'` (the original defect) and as `const dedupKey = 'events:3:99001'` each red the guard, naming the file and line. The first draft of that guard matched only the property form and the `const` sabotage PASSED it — the regex is one alternation over `[:=]` for that reason, recorded here because a guard that misses the spelling a reader would reach for is not a guard. Files that mention `dedupKey` without driving the seam are excluded deliberately: in `trigger-bridge-shape` it is a field in an offline AJV sample, durable nowhere.
+- **The identity enumeration, re-run against the merged tree, and what it did NOT find.** Every other class was already per-exercise or is covered elsewhere, so no second mechanism is added for any of them: Layer-1 `Idempotency-Key`s are minted fresh at all four call sites (`idempotency`, `idempotencyRetry`, `v2-idempotency-key-grammar`, `pause-resume`); the whole host-surface family (`kv`, `blob`, `table`, `search`, `vector`, `sql`, `queueBus`) already mints its key / table / index / namespace / stream per exercise; `v2-subject-link-record` already mints its `externalId`; `replay-fanout-suppression` binds an EPHEMERAL port rather than the pinned one, so its destination is distinct by construction; and the scenario-owned A2A peers and MCP servers are `front-mux`'s (openwop#1520), which nonce-paths each fake behind the one public front. One row was rehearsed rather than fixed: `v2-webhook-message-id-stable` came back `executed-pass` on a loopback run against the PUBLISHED 2.37.0 with its `0201.message-id-stable` requirement row classified — no unclassified return. One run is not proof and the single scenario is being re-run before the public cut, but it is consistent with openwop#1513 and #1520 having already covered it, so NO mechanism is added for it here: not reproduced on 2.37.0, plausibly covered by `front-mux` / `effect-receiver`. **Owed, not fixed here:** `lib/oauth-as-double.ts` derives its ISSUER identity from `resolvePublicFront(frontEnv, local)`, and three files — `v2-oauth-mcp-reach-discovery`, `v2-oauth-client-pkce-state-iss`, `v2-credential-interrupt` — start a double on the same default `OPENWOP_OAUTH_AS_URL`, so on a tunnelled cut all three advertise ONE issuer and only the holder of the pinned port is reached. That is the front-mux shape for a fake front-mux does not cover, and it sits on the public-front routing another session is changing in the same cycle (openwop#1524, the per-instance `kid` in `lib/oidc-issuer.ts`), so it is stated rather than touched. Unreproduced: no tunnelled cut was available, so it is read off the code.
+- **Two more fixed identities against state a host is REQUIRED to remember.** `trigger-bridge-delivery` handed the bridge the literal `'conformance-dedup-key'`, and `trigger-bridge.md` §C-1 makes the dedup window a >=24h FLOOR — so the second run of the file against the same host, any time that day, hands it a key already delivered; a conformant host collapses the exercise into the first run's outcome, emits zero `delivered` attempts under this run's id, and the `=== 1` convicts it. Cold host passes, warm host fails. `freshDedupKey()` mints one per exercise; the repetition §C-1 is about happens inside `driveDelivery`'s `scenario: 'dedup'`, so the clause is untouched. `auth-subject-link` provisioned the literal `externalId` `'idp-op-8f3a'` into the OPERATOR's SCIM directory and then DEACTIVATED it, so a second run asserts "authenticates before deactivation" against a subject the host is correct to refuse; minted per exercise now. The SCIM leg is opt-in on two env vars that no cut sets, so it is read off the code and unwitnessed — stated rather than claimed.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.37.1` because `2.37.0` is published. Published on the `v2.37.1` corpus tag.
+
 ## [2.37.0] — 2026-09-23 — rows that measured nothing now measure: a suite fake reachable through the public front, one effect identity per leg, the MRTR key that can tell
 
 - **Every synthetic OIDC issuer publishes its own `kid`, so two scenarios at one issuer URL no longer collide in a host's JWKS cache.** `lib/oidc-issuer.ts` generated a fresh key per `createSyntheticOIDCIssuer` instance but named it `openwop-conformance-key-${rotationCounter}` with a per-instance counter — so EVERY instance published `openwop-conformance-key-1`. `v2-oidc-id-token-audience` and `v2-lane-exp-only-bound` both publish at `OPENWOP_TEST_OIDC_ISSUER_URL`; a host that caches JWKS by `kid` (RFC 7517 §4.5: a kid identifies one key) verified the second scenario's tokens against the first scenario's cached key and refused its VALID control as `invalid_signature`. Reported and measured by openwop-app-ce on openwop-app, suite 2.36.1: `v2-lane-exp-only-bound` 4/4 red in a full run (control included), 4/4 green filtered — an order-dependent red that reads as a host failure on RFC 0210's rows. The kid is now `openwop-conformance-key-<per-instance hex>-<rotation>`. New self-test: a kid-caching verifier (re-fetch only on an unknown kid) must accept both instances' valid tokens at one URL; reverting to the shared kid reds it.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.37.0 @openwop/spec-artifacts@2.37.0
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.38.0 @openwop/spec-artifacts@2.38.0
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```
@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 557 scenario files under `src/scenarios/`.
+The current suite has 558 scenario files under `src/scenarios/`.
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
@@ -481,7 +481,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 557 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 558 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/cli.js

@@ -45,6 +45,7 @@ import { deriveRung, emittedByNewerSuite } from './lib/durability-evidence.js';
 import { deriveRequirementDispositions } from './lib/scenario-disposition.js';
 import { scrubEvidence, evidenceSecretsFromEnv, verifyBundleV2 } from './lib/certification-bundle-verify.js';
 import { publicKeyFromPrivate, signBundleV3, verifierSign, verifyBundleV3, witnessDigest } from './lib/certification-bundle-v3.js';
+import { canonicalJSON, parseIJson } from './lib/jcs.js';
 import { deriveProfiles, isCoreStandard, agentPlatformStatus, DEPRECATED_PROFILE_ALIASES, PROFILE_FLOOR_SCENARIOS, } from './lib/profiles.js';
 import { setV2ProfileFloors, v2ProfileFloorFiles } from './lib/requirement-registry.js';
 import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2ProfileIds } from './lib/v2-profiles.js';
@@ -301,21 +302,6 @@ function suiteVersion() {
     const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
     return typeof pkg.version === 'string' ? pkg.version : '0.0.0';
 }
-/**
- * Deterministic canonical-JSON serialization (RFC 8785 spirit): object keys
- * sorted lexicographically at every level, arrays preserved in order. Used to
- * compute `discovery.sha256` so a verifier can re-derive the same digest from
- * a live `/.well-known/openwop` fetch regardless of incidental key order.
- */
-function canonicalJSON(value) {
-    if (value === null || typeof value !== 'object')
-        return JSON.stringify(value);
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJSON).join(',')}]`;
-    const obj = value;
-    const keys = Object.keys(obj).sort();
-    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJSON(obj[k])}`).join(',')}}`;
-}
 /**
  * The full set of profiles a discovery document derives — the closed
  * `deriveProfiles` catalog plus the two operational annexes
@@ -474,7 +460,11 @@ async function runCertify(args, baseUrl, apiKey) {
             process.stderr.write(`openwop-conformance --certify: GET ${discoveryUrl} returned HTTP ${resp.status}.\n`);
             process.exit(2);
         }
-        document = (await resp.json());
+        // RFC 0212 §B — read the TEXT through the I-JSON parser: `resp.json()`
+        // keeps the last of two duplicate names and rounds an out-of-range integer,
+        // and `discovery.sha256` would then attest to a document other verifiers
+        // read differently.
+        document = parseIJson(await resp.text());
     }
     catch (err) {
         process.stderr.write(`openwop-conformance --certify: failed to fetch ${discoveryUrl}: ${String(err)}\n`);
@@ -887,10 +877,10 @@ async function main() {
         }
         let bundle;
         try {
-            bundle = JSON.parse(readFileSync(args.verifyPath, 'utf8'));
+            bundle = parseIJson(readFileSync(args.verifyPath, 'utf8'));
         }
         catch (e) {
-            process.stderr.write(`openwop-conformance --verify: ${args.verifyPath} is not readable JSON — ${e.message}\n`);
+            process.stderr.write(`openwop-conformance --verify: ${args.verifyPath} is not readable I-JSON (RFC 0212 §B) — ${e.message}\n`);
             process.exit(3);
         }
         const hostKey = args.verifyHostKeyPath !== undefined ? readFileSync(args.verifyHostKeyPath, 'utf8') : undefined;

package/dist/lib/certification-bundle-v3.js

@@ -21,16 +21,14 @@ import { createHash, createPrivateKey, createPublicKey, sign as edSign, verify a
 import { profileDerivable } from './profiles.js';
 import { checkRungClaim } from './durability-evidence.js';
 import { profilesDeniedByObservedRelaxation, profilesRelaxedBy, v2RegistryAvailable } from './v2-profiles.js';
+import { canonicalJSON, codeUnitCompare, JcsRefusal } from './jcs.js';
 export const SIGNATURE_OVER = ['witnessSha256', 'host.build', 'suite.version', 'discovery.sha256'];
-/** Deterministic JSON: keys sorted at every level, no whitespace. */
-export function canonicalJSON(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJSON).join(',')}]`;
-    if (value !== null && typeof value === 'object') {
-        return `{${Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${canonicalJSON(value[k])}`).join(',')}}`;
-    }
-    return JSON.stringify(value);
-}
+/**
+ * RFC 0212 §A — the bytes every attestation and digest here covers are RFC 8785
+ * (JCS), and a non-I-JSON value is refused, never coerced. Re-exported so
+ * existing importers keep one name for one algorithm.
+ */
+export { canonicalJSON } from './jcs.js';
 /**
  * RFC 0148 §C — the digest over the reporter record (the requirement rows),
  * and, from 2.35.0, the operator's declared relaxations when there are any.
@@ -44,9 +42,16 @@ export function canonicalJSON(value) {
  * committed bundles digest unchanged, pinned in durability-evidence.test.ts),
  * and `{ rows, relaxations }` otherwise. An older verifier fails closed on a
  * 2.35.0 bundle that declares relaxations — `witness-digest`, never a pass.
+ *
+ * RFC 0212 §C — rows sort by `id` in UTF-16 code-unit order. This was
+ * `localeCompare` in the process default locale: a bundle cut on a machine
+ * whose locale is Czech, Slovak, Lithuanian or Hawaiian digested differently
+ * from the same bundle anywhere else (Czech sorts `ch` after `h`). Every
+ * committed bundle's ids are `[a-z0-9.-]`, where the two orders coincide, so no
+ * stored digest changes (v2-bundle-witness-preimage.test.ts pins that).
  */
 export function witnessDigest(rows, relaxations) {
-    const canonicalRows = [...rows].sort((a, b) => a.id.localeCompare(b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }),
+    const canonicalRows = [...rows].sort((a, b) => codeUnitCompare(a.id, b.id)).map((r) => ({ id: r.id, scenario: r.scenario, result: r.result, ...(r.assertions === undefined ? {} : { assertions: r.assertions }), ...(r.detail === undefined ? {} : { detail: r.detail }),
         // ONLY WHEN PRESENT: every bundle cut before 2.34.0 has no `evidence` and digests byte-identically.
         ...(r.evidence === undefined ? {} : { evidence: r.evidence }) }));
     const preimage = relaxations !== undefined && relaxations.length > 0 ? { rows: canonicalRows, relaxations } : canonicalRows;
@@ -97,6 +102,24 @@ export function optedOutFromRows(rows) {
     }
     return [...names].sort();
 }
+/**
+ * RFC 0212 §B — a verifier that meets non-I-JSON in a value it must
+ * re-canonicalize MUST fail verification. The canonicalizer throws; a verifier
+ * returns a verdict, so the refusal becomes a rejection of the named kind rather
+ * than an exception out of `verifyBundleV3` (a library caller that parsed the
+ * bundle with `JSON.parse` can still hand it a lone surrogate).
+ */
+function refusedAs(rejections, kind, what, fn) {
+    try {
+        return fn();
+    }
+    catch (e) {
+        if (!(e instanceof JcsRefusal))
+            throw e;
+        rejections.push({ kind, detail: `${what} is not I-JSON, so it has no canonical bytes (RFC 0212 §B): ${e.message}` });
+        return undefined;
+    }
+}
 export function verifyBundleV3(bundle, opts = {}) {
     const rejections = [];
     if (bundle.bundleVersion !== '3')
@@ -117,8 +140,8 @@ export function verifyBundleV3(bundle, opts = {}) {
     for (const k of Object.keys(expected))
         if (bundle.results?.totals?.[k] !== expected[k])
             rejections.push({ kind: 'totals-mismatch', detail: `totals.${k} is ${String(bundle.results?.totals?.[k])} but the rows count ${expected[k]}` });
-    const digest = witnessDigest(rows, bundle.host?.relaxations);
-    if (bundle.witnessSha256 !== digest)
+    const digest = refusedAs(rejections, 'witness-digest', 'the rows or declared relaxations', () => witnessDigest(rows, bundle.host?.relaxations));
+    if (digest !== undefined && bundle.witnessSha256 !== digest)
         rejections.push({ kind: 'witness-digest', detail: `witnessSha256 ${String(bundle.witnessSha256).slice(0, 12)} does not equal the digest of the rows and declared relaxations (${digest.slice(0, 12)})` });
     const assertions = rows.reduce((n, r) => n + (r.assertions ?? 0), 0);
     if (bundle.assertionCount !== assertions)
@@ -137,8 +160,9 @@ export function verifyBundleV3(bundle, opts = {}) {
         rejections.push({ kind: 'signature-over', detail: `signature.over must be ${JSON.stringify(SIGNATURE_OVER)}` });
     else if (opts.hostPublicKeyPem) {
         const key = createPublicKey(opts.hostPublicKeyPem);
-        signatureVerified = edVerify(null, attestationPayload(bundle), key, fromBase64url(sig.sig));
-        if (!signatureVerified)
+        const payload = refusedAs(rejections, 'signature-invalid', 'the attested members', () => attestationPayload(bundle));
+        signatureVerified = payload !== undefined && edVerify(null, payload, key, fromBase64url(sig.sig));
+        if (payload !== undefined && !signatureVerified)
             rejections.push({ kind: 'signature-invalid', detail: 'the attestation does not verify under the host key' });
     }
     // Independent tier
@@ -151,8 +175,9 @@ export function verifyBundleV3(bundle, opts = {}) {
         else if (vs.keyId === sig?.keyId || vs.keyId === bundle.host?.signingKeyId)
             rejections.push({ kind: 'independent-self-signed', detail: 'the verifier key must be distinct from the host key (RFC 0148 R5)' });
         else if (opts.verifierPublicKeyPem) {
-            verifierSignatureVerified = edVerify(null, attestationPayload(bundle), createPublicKey(opts.verifierPublicKeyPem), fromBase64url(vs.sig));
-            if (!verifierSignatureVerified)
+            const payload = refusedAs(rejections, 'verifier-signature-invalid', 'the attested members', () => attestationPayload(bundle));
+            verifierSignatureVerified = payload !== undefined && edVerify(null, payload, createPublicKey(opts.verifierPublicKeyPem), fromBase64url(vs.sig));
+            if (payload !== undefined && !verifierSignatureVerified)
                 rejections.push({ kind: 'verifier-signature-invalid', detail: 'the verifier attestation does not verify' });
         }
         else
@@ -196,8 +221,11 @@ export function verifyBundleV3(bundle, opts = {}) {
     const document = bundle.discovery?.document;
     let derivabilityChecked = false;
     if (document !== undefined) {
-        const digest = createHash('sha256').update(canonicalJSON(document)).digest('hex');
-        if (digest !== bundle.discovery?.sha256) {
+        const digest = refusedAs(rejections, 'discovery-digest', 'discovery.document', () => createHash('sha256').update(canonicalJSON(document)).digest('hex'));
+        if (digest === undefined) {
+            // Already rejected as non-I-JSON; nothing derivable from a document with no canonical bytes.
+        }
+        else if (digest !== bundle.discovery?.sha256) {
             rejections.push({ kind: 'discovery-digest', detail: `discovery.document hashes to ${digest.slice(0, 12)} but discovery.sha256 is ${String(bundle.discovery?.sha256).slice(0, 12)} — the captured document is not the one the signature attests to` });
         }
         else {

package/dist/lib/jcs.js

@@ -0,0 +1,274 @@
+/**
+ * RFC 0212 — canonical JSON is RFC 8785 (JCS), and the input MUST be I-JSON.
+ *
+ * Every signature and digest in the corpus is over these bytes: pack
+ * signatures (`ed25519-canonical-json`), the certification-bundle attestation,
+ * `discovery.sha256`, `witnessSha256`, and the RFC 0150 semantic request digest.
+ * `conformance/vectors/jcs-v1.json` is the normative test of this module and of
+ * any other-language implementation.
+ *
+ * Two entry points, because two of the refusals are invisible after a parse:
+ *
+ *   - `canonicalJSON(value)` — the VALUE boundary. Refuses what a native value
+ *     can still show: non-finite numbers, non-JSON values (undefined, functions,
+ *     bigint, symbols, class instances such as Date) and lone surrogates.
+ *   - `parseIJson(text)` — the TEXT boundary. `JSON.parse` keeps the last of two
+ *     duplicate names and rounds `9007199254740993` to `…992` silently; both are
+ *     refused here, before coercion. Read a document you will re-canonicalize
+ *     through this, not `JSON.parse`.
+ *
+ * Why not `Object.keys(v).sort()` + `JSON.stringify` with no checks (the code
+ * this replaces): it is JCS for well-formed input — the default sort IS UTF-16
+ * code-unit order and ES number/string serialization IS JCS §3.2.2 — but it
+ * turns NaN into `null`, emits the text `undefined`, and signs a rounded
+ * integer. Each of those is a document two verifiers read differently with no
+ * error on either side.
+ */
+export class JcsRefusal extends Error {
+    kind;
+    constructor(kind, message) {
+        super(`RFC 0212 §B refusal (${kind}): ${message}`);
+        this.name = 'JcsRefusal';
+        this.kind = kind;
+    }
+}
+/** A JSON number literal, matched in place (sticky) so parsing stays linear. */
+const NUMBER = /-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?/y;
+/** ±(2^53 − 1), for the integer-literal refusal at the text boundary. */
+const MAX_EXACT_BIG = 2n ** 53n - 1n;
+/**
+ * RFC 8785 §3.2.3 — compare by UTF-16 code units. Explicit rather than the
+ * `Array.prototype.sort` default so the rule is visible at every call site, and
+ * never `localeCompare`: collation is locale-dependent (Czech sorts `ch` after
+ * `h`; English puts `a` before `A` and ignores `-`), so a digest computed with
+ * it depends on the machine that computed it.
+ */
+export function codeUnitCompare(a, b) {
+    const n = Math.min(a.length, b.length);
+    for (let i = 0; i < n; i += 1) {
+        const d = a.charCodeAt(i) - b.charCodeAt(i);
+        if (d !== 0)
+            return d;
+    }
+    return a.length - b.length;
+}
+function assertWellFormed(s, where) {
+    for (let i = 0; i < s.length; i += 1) {
+        const u = s.charCodeAt(i);
+        if (u >= 0xd800 && u <= 0xdbff) {
+            const next = s.charCodeAt(i + 1);
+            if (next >= 0xdc00 && next <= 0xdfff) {
+                i += 1;
+                continue;
+            }
+            throw new JcsRefusal('lone-surrogate', `lone high surrogate U+${u.toString(16).toUpperCase()} in ${where}`);
+        }
+        if (u >= 0xdc00 && u <= 0xdfff)
+            throw new JcsRefusal('lone-surrogate', `lone low surrogate U+${u.toString(16).toUpperCase()} in ${where}`);
+    }
+}
+function serializeNumber(n) {
+    if (!Number.isFinite(n))
+        throw new JcsRefusal('non-finite', `${String(n)} is not a JSON number`);
+    // No magnitude check here: a double is already exact, and JCS serializes it
+    // (RFC 8785 Appendix B includes 9007199254740994). The integer-range refusal
+    // is about a LITERAL that no double holds, which only the text shows — see
+    // `parseIJson`.
+    return Object.is(n, -0) ? '0' : String(n);
+}
+function isPlainObject(v) {
+    const proto = Object.getPrototypeOf(v);
+    return proto === Object.prototype || proto === null;
+}
+/** RFC 8785 serialization of an I-JSON value. Throws `JcsRefusal` instead of coercing. */
+export function canonicalJSON(value) {
+    if (value === null)
+        return 'null';
+    switch (typeof value) {
+        case 'boolean': return value ? 'true' : 'false';
+        case 'number': return serializeNumber(value);
+        case 'string':
+            assertWellFormed(value, 'a string');
+            return JSON.stringify(value);
+        case 'object': break;
+        default: throw new JcsRefusal('not-json', `a ${typeof value} is not a JSON value`);
+    }
+    if (Array.isArray(value)) {
+        const parts = [];
+        for (let i = 0; i < value.length; i += 1) {
+            if (!(i in value))
+                throw new JcsRefusal('not-json', 'a sparse array hole is not a JSON value');
+            parts.push(canonicalJSON(value[i]));
+        }
+        return `[${parts.join(',')}]`;
+    }
+    if (!isPlainObject(value))
+        throw new JcsRefusal('not-json', `a ${value.constructor?.name ?? 'non-plain'} object is not a JSON value`);
+    const obj = value;
+    const keys = Object.keys(obj).sort(codeUnitCompare);
+    return `{${keys.map((k) => { assertWellFormed(k, 'a member name'); return `${JSON.stringify(k)}:${canonicalJSON(obj[k])}`; }).join(',')}}`;
+}
+/**
+ * Parse JSON text, refusing what `JSON.parse` would silently accept or change:
+ * duplicate member names, integer literals outside ±(2^53 − 1), literals that
+ * overflow to ±Infinity, and lone surrogates. Members are defined, not
+ * assigned, so a member named `__proto__` is data, not a prototype write.
+ */
+export function parseIJson(text) {
+    let i = 0;
+    const fail = (m) => { throw new JcsRefusal('not-json', `${m} at offset ${i}`); };
+    const ws = () => { while (i < text.length && (text[i] === ' ' || text[i] === '\t' || text[i] === '\n' || text[i] === '\r'))
+        i += 1; };
+    const str = () => {
+        if (text[i] !== '"')
+            fail('expected a string');
+        i += 1;
+        let out = '';
+        for (;;) {
+            if (i >= text.length)
+                fail('unterminated string');
+            const c = text[i];
+            i += 1;
+            if (c === '"')
+                break;
+            if (c === '\\') {
+                const e = text[i];
+                i += 1;
+                switch (e) {
+                    case '"':
+                        out += '"';
+                        break;
+                    case '\\':
+                        out += '\\';
+                        break;
+                    case '/':
+                        out += '/';
+                        break;
+                    case 'b':
+                        out += '\b';
+                        break;
+                    case 'f':
+                        out += '\f';
+                        break;
+                    case 'n':
+                        out += '\n';
+                        break;
+                    case 'r':
+                        out += '\r';
+                        break;
+                    case 't':
+                        out += '\t';
+                        break;
+                    case 'u': {
+                        const h = text.slice(i, i + 4);
+                        if (!/^[0-9a-fA-F]{4}$/.test(h))
+                            fail('bad \\u escape');
+                        out += String.fromCharCode(parseInt(h, 16));
+                        i += 4;
+                        break;
+                    }
+                    default: fail('bad escape');
+                }
+            }
+            else {
+                if (c.charCodeAt(0) < 0x20)
+                    fail('raw control character in a string');
+                out += c;
+            }
+        }
+        assertWellFormed(out, 'a string');
+        return out;
+    };
+    const num = () => {
+        NUMBER.lastIndex = i;
+        const m = NUMBER.exec(text);
+        if (m === null)
+            return fail('bad number');
+        i += m[0].length;
+        if (m[2] === undefined && m[3] === undefined) {
+            const b = BigInt(m[0]);
+            if (b > MAX_EXACT_BIG || b < -MAX_EXACT_BIG)
+                throw new JcsRefusal('integer-out-of-range', `integer literal ${m[0]} is outside ±(2^53 − 1)`);
+        }
+        const v = Number(m[0]);
+        if (!Number.isFinite(v))
+            throw new JcsRefusal('non-finite', `${m[0]} overflows to a non-finite number`);
+        return v;
+    };
+    const val = () => {
+        ws();
+        const c = text[i];
+        if (c === '{') {
+            i += 1;
+            const obj = {};
+            ws();
+            if (text[i] === '}') {
+                i += 1;
+                return obj;
+            }
+            for (;;) {
+                ws();
+                const k = str();
+                if (Object.prototype.hasOwnProperty.call(obj, k))
+                    throw new JcsRefusal('duplicate-name', `duplicate member name ${JSON.stringify(k)}`);
+                ws();
+                if (text[i] !== ':')
+                    fail('expected :');
+                i += 1;
+                Object.defineProperty(obj, k, { value: val(), enumerable: true, writable: true, configurable: true });
+                ws();
+                const d = text[i];
+                i += 1;
+                if (d === '}')
+                    return obj;
+                if (d !== ',')
+                    fail('expected , or }');
+            }
+        }
+        if (c === '[') {
+            i += 1;
+            const arr = [];
+            ws();
+            if (text[i] === ']') {
+                i += 1;
+                return arr;
+            }
+            for (;;) {
+                arr.push(val());
+                ws();
+                const d = text[i];
+                i += 1;
+                if (d === ']')
+                    return arr;
+                if (d !== ',')
+                    fail('expected , or ]');
+            }
+        }
+        if (c === '"')
+            return str();
+        if (text.startsWith('true', i)) {
+            i += 4;
+            return true;
+        }
+        if (text.startsWith('false', i)) {
+            i += 5;
+            return false;
+        }
+        if (text.startsWith('null', i)) {
+            i += 4;
+            return null;
+        }
+        if (c === '-' || (c !== undefined && c >= '0' && c <= '9'))
+            return num();
+        return fail('unexpected token');
+    };
+    const v = val();
+    ws();
+    if (i !== text.length)
+        fail('trailing data');
+    return v;
+}
+/** JCS bytes of a JSON text, with every §B refusal applied. */
+export function canonicalizeText(text) {
+    return canonicalJSON(parseIJson(text));
+}

package/dist/lib/requirement-ledger.js

@@ -47,10 +47,26 @@ const journal = [];
  * dispositions throws: RFC 0148 §A says **exactly one** disposition per
  * requirement, and a silent last-write-wins would let a later soft-skip
  * overwrite an earlier real failure — the failure mode in reverse.
+ *
+ * `extras.fold` is the one exception, for the per-`it` rows `setup.ts` records
+ * when several `it` legs witness ONE requirement id; see its docblock below.
+ */
+/**
+ * How certifiable each disposition is, least first. `readLedgerFile` has always
+ * resolved a cross-worker disagreement this way — "one worker said it failed"
+ * outranks "another said it passed", and an unresolvable disagreement must never
+ * round toward certification. `fold` below applies the SAME rule in-worker.
  */
+const CERTIFIABILITY_RANK = {
+    'executed-fail': 0,
+    blocked: 1,
+    'executed-pass': 2,
+    skipped: 3,
+    inapplicable: 4,
+};
 export function recordRequirement(requirementId, disposition, detail, extras) {
     const prior = ledger.get(requirementId);
-    if (prior !== undefined && prior.disposition !== disposition) {
+    if (prior !== undefined && prior.disposition !== disposition && extras?.fold !== true) {
         throw new Error(`RFC 0148 §A: ${requirementId} already recorded as '${prior.disposition}', now '${disposition}'. ` +
             'Exactly one disposition per requirement per run.');
     }
@@ -58,7 +74,7 @@ export function recordRequirement(requirementId, disposition, detail, extras) {
         throw new Error(`RFC 0148 §A: ${requirementId} recorded as '${disposition}' without a reason. ` +
             'Anything other than executed-pass MUST say why, or the ledger records an outcome nobody can act on.');
     }
-    const entry = {
+    let entry = {
         requirementId,
         disposition,
         ...(detail === undefined ? {} : { detail }),
@@ -66,6 +82,27 @@ export function recordRequirement(requirementId, disposition, detail, extras) {
         ...(extras?.scenarioFile === undefined ? {} : { scenarioFile: extras.scenarioFile }),
         ...(extras?.evidence === undefined || disposition !== 'executed-pass' ? {} : { evidence: extras.evidence }),
     };
+    if (prior !== undefined && extras?.fold === true) {
+        // The least-certifiable leg wins the disposition and keeps its own detail;
+        // a tie keeps whichever side actually said something. Counts sum, because
+        // both legs really did assert against the target for this one requirement.
+        const keepPrior = CERTIFIABILITY_RANK[prior.disposition] <= CERTIFIABILITY_RANK[disposition];
+        const winner = keepPrior ? prior : entry;
+        const loser = keepPrior ? entry : prior;
+        const count = (prior.assertionCount ?? 0) + (extras?.assertionCount ?? 0);
+        const keptDetail = winner.detail ?? loser.detail;
+        const hasCount = prior.assertionCount !== undefined || extras?.assertionCount !== undefined;
+        entry = {
+            requirementId,
+            disposition: winner.disposition,
+            ...(keptDetail === undefined ? {} : { detail: keptDetail }),
+            ...(hasCount ? { assertionCount: count } : {}),
+            ...(winner.scenarioFile === undefined ? {} : { scenarioFile: winner.scenarioFile }),
+            // `evidence` is only meaningful on a pass; a fold that lands anywhere
+            // else drops it, exactly as the constructor above does.
+            ...(winner.disposition === 'executed-pass' && winner.evidence !== undefined ? { evidence: winner.evidence } : {}),
+        };
+    }
     ledger.set(requirementId, entry);
     journal.push(entry);
     // File sink (RFC 0148 acceptance item 2, S6). The in-memory map lives in a
@@ -114,7 +151,11 @@ export function readLedgerFile(path) {
         if (typeof e.requirementId !== 'string' || !DISPOSITIONS.includes(e.disposition))
             continue;
         const prior = merged.get(e.requirementId);
-        if (prior === undefined || rank[e.disposition] < rank[prior.disposition])
+        // `<=`, not `<`: a per-`it` FOLD (2.37.0) appends the cumulative row after
+        // the leg rows it folded, so on an equal disposition the LAST line is the
+        // one carrying the summed `assertionCount`. For genuinely duplicate lines
+        // the two are identical and the choice is a no-op.
+        if (prior === undefined || rank[e.disposition] <= rank[prior.disposition])
             merged.set(e.requirementId, e);
     }
     return [...merged.values()].sort((a, b) => a.requirementId.localeCompare(b.requirementId));