@openwop/openwop-conformance 2.37.0 → 2.38.0

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 628,
-    "tests": 2401,
-    "withStableId": 2401,
+    "files": 632,
+    "tests": 2415,
+    "withStableId": 2415,
     "interpolatedTitles": 0,
-    "explicitIds": 2291
+    "explicitIds": 2304
   },
   "records": [
     {
@@ -5956,7 +5956,7 @@
     {
       "id": "openwop.it.auth-subject-link.subjectlinking-true-is-only-claimed-alongside-both-saml-and-scim-profiles",
       "file": "auth-subject-link.test.ts",
-      "line": 61,
+      "line": 62,
       "title": "subjectLinking:true is only claimed alongside both SAML and SCIM profiles",
       "explicitId": "openwop.it.auth-subject-link.subjectlinking-true-is-only-claimed-alongside-both-saml-and-scim-profiles",
       "citations": [
@@ -5969,7 +5969,7 @@
     {
       "id": "openwop.it.auth-subject-link.advertising-both-profiles-requires-subjectlinking-true-a-subjectlinkkey-rfc-0164",
       "file": "auth-subject-link.test.ts",
-      "line": 76,
+      "line": 77,
       "title": "advertising BOTH profiles REQUIRES subjectLinking:true + a subjectLinkKey (RFC 0164 — the vulnerable shape fails, never inapplicable)",
       "explicitId": "openwop.it.auth-subject-link.advertising-both-profiles-requires-subjectlinking-true-a-subjectlinkkey-rfc-0164",
       "citations": [
@@ -5987,7 +5987,7 @@
     {
       "id": "openwop.it.auth-subject-link.a-scim-deactivation-fail-closes-the-linked-saml-identity",
       "file": "auth-subject-link.test.ts",
-      "line": 106,
+      "line": 107,
       "title": "a SCIM deactivation fail-closes the linked SAML identity",
       "explicitId": "openwop.it.auth-subject-link.a-scim-deactivation-fail-closes-the-linked-saml-identity",
       "citations": [
@@ -6012,7 +6012,7 @@
     {
       "id": "openwop.it.auth-subject-link.a-mutable-pii-link-key-email-never-produces-a-cross-lane-pass",
       "file": "auth-subject-link.test.ts",
-      "line": 152,
+      "line": 169,
       "title": "a mutable/PII link key (email) never produces a cross-lane pass",
       "explicitId": "openwop.it.auth-subject-link.a-mutable-pii-link-key-email-never-produces-a-cross-lane-pass",
       "citations": [
@@ -6029,7 +6029,7 @@
     {
       "id": "openwop.it.auth-subject-link.a-scim-deactivation-does-not-deny-a-saml-login-whose-run-subject-is-legacy-issue",
       "file": "auth-subject-link.test.ts",
-      "line": 202,
+      "line": 219,
       "title": "a SCIM deactivation does not deny a SAML login whose run subject is legacy-issued",
       "explicitId": null,
       "citations": []
@@ -15228,6 +15228,97 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.jcs-vectors.the-vector-set-is-present-and-non-trivial",
+      "file": "jcs-vectors.test.ts",
+      "line": 59,
+      "title": "the vector set is present and non-trivial",
+      "explicitId": "openwop.it.jcs-vectors.the-vector-set-is-present-and-non-trivial",
+      "citations": [
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": "the vectors MUST cover RFC 8785 Appendix B numbers, documents and every §B refusal kind"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.jcs-vectors.number-s-serializes-per-rfc-8785-appendix-b",
+      "file": "jcs-vectors.test.ts",
+      "line": 66,
+      "title": "number %s serializes per RFC 8785 Appendix B",
+      "explicitId": "openwop.it.jcs-vectors.number-s-serializes-per-rfc-8785-appendix-b",
+      "citations": [
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": "numbers MUST serialize as ECMAScript Number::toString (RFC 8785 §3.2.2.3)"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.jcs-vectors.document-s-canonicalizes-and-hashes",
+      "file": "jcs-vectors.test.ts",
+      "line": 70,
+      "title": "document %s canonicalizes and hashes",
+      "explicitId": "openwop.it.jcs-vectors.document-s-canonicalizes-and-hashes",
+      "citations": [
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.jcs-vectors.text-s-is-refused-not-coerced",
+      "file": "jcs-vectors.test.ts",
+      "line": 78,
+      "title": "text %s is refused, not coerced",
+      "explicitId": "openwop.it.jcs-vectors.text-s-is-refused-not-coerced",
+      "citations": [
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.jcs-vectors.a-non-i-json-native-value-is-refused-at-the-value-boundary",
+      "file": "jcs-vectors.test.ts",
+      "line": 83,
+      "title": "a non-I-JSON native value is refused at the value boundary",
+      "explicitId": "openwop.it.jcs-vectors.a-non-i-json-native-value-is-refused-at-the-value-boundary",
+      "citations": [
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.jcs-vectors.member-names-and-certification-rows-sort-by-utf-16-code-units-not-by-locale",
+      "file": "jcs-vectors.test.ts",
+      "line": 99,
+      "title": "member names and certification rows sort by UTF-16 code units, not by locale",
+      "explicitId": "openwop.it.jcs-vectors.member-names-and-certification-rows-sort-by-utf-16-code-units-not-by-locale",
+      "citations": [
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0212 · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": "witnessSha256 rows MUST sort by id in UTF-16 code-unit order; a locale-sensitive comparator MUST NOT be used"
+        }
+      ]
+    },
     {
       "id": "openwop.it.kv-atomic-increment.capabilities-kvstorage-is-either-absent-or-a-well-formed-object",
       "file": "kv-atomic-increment.test.ts",
@@ -24404,9 +24495,26 @@
       ]
     },
     {
-      "id": "openwop.it.semantic-digest-vectors.message-order-is-semantic-reversing-changes-the-digest",
+      "id": "openwop.it.semantic-digest-vectors.tool-order-uses-utf-16-code-units-where-a-locale-comparator-disagrees",
       "file": "semantic-digest-vectors.test.ts",
       "line": 113,
+      "title": "tool order uses UTF-16 code units, where a locale comparator disagrees",
+      "explicitId": "openwop.it.semantic-digest-vectors.tool-order-uses-utf-16-code-units-where-a-locale-comparator-disagrees",
+      "citations": [
+        {
+          "section": "RFC 0212 §D · RFC 0150 §C",
+          "requirement": "tools[] MUST sort by name in UTF-16 code-unit order"
+        },
+        {
+          "section": "RFC 0212 §D · RFC 0150 §C",
+          "requirement": "getWeather (0x57) MUST precede get_weather (0x5F)"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.semantic-digest-vectors.message-order-is-semantic-reversing-changes-the-digest",
+      "file": "semantic-digest-vectors.test.ts",
+      "line": 121,
       "title": "message order IS semantic — reversing changes the digest",
       "explicitId": "openwop.it.semantic-digest-vectors.message-order-is-semantic-reversing-changes-the-digest",
       "citations": [
@@ -24419,7 +24527,7 @@
     {
       "id": "openwop.it.semantic-digest-vectors.the-two-unicode-forms-do-not-collide-because-jcs-does-not-apply-nfc",
       "file": "semantic-digest-vectors.test.ts",
-      "line": 120,
+      "line": 128,
       "title": "the two Unicode forms do not collide, because JCS does not apply NFC",
       "explicitId": "openwop.it.semantic-digest-vectors.the-two-unicode-forms-do-not-collide-because-jcs-does-not-apply-nfc",
       "citations": [
@@ -24432,7 +24540,7 @@
     {
       "id": "openwop.it.semantic-digest-vectors.each-field-v1-excluded-now-changes-the-digest",
       "file": "semantic-digest-vectors.test.ts",
-      "line": 133,
+      "line": 141,
       "title": "each field v1 excluded now changes the digest",
       "explicitId": "openwop.it.semantic-digest-vectors.each-field-v1-excluded-now-changes-the-digest",
       "citations": [
@@ -25733,7 +25841,7 @@
     {
       "id": "openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation",
       "file": "trigger-bridge-delivery.test.ts",
-      "line": 54,
+      "line": 55,
       "title": "de-dups by dedupKey, retries to dead-letter, and links delivery→run causation",
       "explicitId": "openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation",
       "citations": [
@@ -26494,7 +26602,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.a-message-carrying-taskid-without-contextid-is-answered-with-the-task-s-contexti",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 134,
+      "line": 135,
       "title": "a message carrying taskId without contextId is answered with the task's contextId",
       "explicitId": null,
       "citations": [
@@ -26525,7 +26633,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.a-message-whose-contextid-is-not-its-task-s-is-refused-invalid-parameters-and-ch",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 148,
+      "line": 149,
       "title": "a message whose contextId is not its task's is refused invalid-parameters and changes nothing",
       "explicitId": null,
       "citations": [
@@ -26552,7 +26660,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.a-message-to-a-retained-terminal-task-is-refused-unsupportedoperationerror-and-a",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 163,
+      "line": 164,
       "title": "a message to a retained terminal task is refused UnsupportedOperationError, and appends no event",
       "explicitId": null,
       "citations": [
@@ -26579,7 +26687,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.an-unknown-task-and-another-tenant-s-task-are-answered-by-the-same-tasknotfounde",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 178,
+      "line": 179,
       "title": "an unknown task and another tenant's task are answered by the same TaskNotFoundError",
       "explicitId": null,
       "citations": [
@@ -26612,7 +26720,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.task-status-state-is-the-map-s-projection-of-the-run-status-at-every-observed-st",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 200,
+      "line": 201,
       "title": "Task.status.state is the map's projection of the run status at every observed state",
       "explicitId": null,
       "citations": [
@@ -26635,7 +26743,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.the-json-rpc-error-codes-the-suite-can-cause-are-the-a2a-1-0-1-codes",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 225,
+      "line": 226,
       "title": "the JSON-RPC error codes the suite can cause are the A2A 1.0.1 codes",
       "explicitId": null,
       "citations": [
@@ -26658,7 +26766,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.a-row-whose-requires-facet-is-not-advertised-is-refused-with-the-row-s-error",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 239,
+      "line": 240,
       "title": "a row whose requires facet is not advertised is refused with the row's error",
       "explicitId": null,
       "citations": [
@@ -26673,10 +26781,34 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-a2a-operation-map.a-host-not-advertising-a2a-pushnotifications-refuses-all-four-push-config-operat",
+      "file": "v2-a2a-operation-map.test.ts",
+      "line": 253,
+      "title": "a host not advertising a2a.pushNotifications refuses all four push-config operations with PushNotificationNotSupportedError",
+      "explicitId": null,
+      "citations": [
+        {
+          "section": "spec/v2/core/interop.md §\"The operation mappings\" (RFC 0208)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "a2a.operations GetTask",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-a2a-operation-map.listtasks-returns-only-what-listruns-returns-to-the-same-subject-tenant-and-cont",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 252,
+      "line": 280,
       "title": "ListTasks returns only what listRuns returns to the same Subject; tenant and contextId never select",
       "explicitId": null,
       "citations": [
@@ -26713,7 +26845,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.an-a2a-error-s-data-is-an-array-carrying-one-errorinfo-with-the-map-row-s-reason",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 285,
+      "line": 313,
       "title": "an A2A error's data is an array carrying one ErrorInfo with the map row's reason and the A2A domain",
       "explicitId": null,
       "citations": [
@@ -26747,7 +26879,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.no-response-on-the-card-s-json-rpc-interface-url-is-the-openwop-error-envelope",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 306,
+      "line": 334,
       "title": "no response on the card's JSON-RPC interface URL is the OpenWOP error envelope",
       "explicitId": null,
       "citations": [
@@ -26765,7 +26897,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.versionnotsupportederror-carries-errorinfo-version-not-supported-and-supportedve",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 326,
+      "line": 354,
       "title": "VersionNotSupportedError carries ErrorInfo VERSION_NOT_SUPPORTED, and supportedVersions is a comma-joined subset of the card",
       "explicitId": null,
       "citations": [
@@ -26789,7 +26921,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.an-http-json-interface-answers-an-a2a-error-with-google-rpc-status-carrying-the",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 344,
+      "line": 372,
       "title": "an HTTP+JSON interface answers an A2A error with google.rpc.Status carrying the ErrorInfo",
       "explicitId": null,
       "citations": [
@@ -26808,7 +26940,7 @@
     {
       "id": "openwop.it.v2-a2a-operation-map.a-run-suspended-on-a-credential-interrupt-projects-to-task-state-auth-required-n",
       "file": "v2-a2a-operation-map.test.ts",
-      "line": 359,
+      "line": 387,
       "title": "a run suspended on a credential interrupt projects to TASK_STATE_AUTH_REQUIRED, naming the provider and carrying connectUrl",
       "explicitId": null,
       "citations": [
@@ -26844,7 +26976,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-version-2-envelope-carrying-a-version-1-body-is-refused-the-positive-is-admitt",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 128,
+      "line": 129,
       "title": "a version-2 envelope carrying a version-1 body is refused; the positive is admitted; above the floor is refused; below it follows envelopeStrictness",
       "explicitId": "openwop.requirement.0209.version-selects-branch",
       "citations": [
@@ -26888,7 +27020,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.no-first-createsurface-a-message-after-deletesurface-and-a-second-createsurface",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 154,
+      "line": 155,
       "title": "no first createSurface, a message after deleteSurface, and a second createSurface are each refused; the valid steps are admitted",
       "explicitId": "openwop.requirement.0209.fold-guarded",
       "citations": [
@@ -26902,7 +27034,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-createsurface-catalogid-differing-from-the-payload-catalogid-is-refused",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 179,
+      "line": 180,
       "title": "a createSurface.catalogId differing from the payload catalogId is refused",
       "explicitId": "openwop.requirement.0209.catalog-equality",
       "citations": [
@@ -26920,7 +27052,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-message-whose-surfaceid-differs-from-the-payload-surfaceid-is-refused",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 193,
+      "line": 194,
       "title": "a message whose surfaceId differs from the payload surfaceId is refused",
       "explicitId": "openwop.it.v2-a2ui-v09-surface.surface-id-equality",
       "citations": [
@@ -26938,7 +27070,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-recorded-version-2-surface-is-returned-byte-equal-on-poll-and-carried-by-a-for",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 209,
+      "line": 210,
       "title": "a recorded version-2 surface is returned byte-equal on poll and carried by a fork at a later fromSeq",
       "explicitId": "openwop.it.v2-a2ui-v09-surface.recorded-as-recorded",
       "citations": [
@@ -26951,6 +27083,16 @@
           "section": "RFC 0209 §C.11",
           "requirement": "the run's poll MUST return the recorded surface payload byte-equal — no surface is regenerated"
         },
+        {
+          "section": "RFC 0209 §C.9",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "api/seams-v2.yaml emitA2uiSurface",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "RFC 0209 §C.11",
           "requirement": null,
@@ -26965,7 +27107,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-version-1-surface-recorded-at-floor-1-is-returned-byte-equal-on-poll-and-carri",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 228,
+      "line": 237,
       "title": "a version-1 surface recorded at floor 1 is returned byte-equal on poll and carried by a fork",
       "explicitId": "openwop.requirement.0209.legacy-readable",
       "citations": [
@@ -26983,6 +27125,16 @@
           "requirement": null,
           "interpolated": true
         },
+        {
+          "section": "api/seams-v2.yaml emitA2uiSurface",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0209 §C.11",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "RFC 0209 §C.11",
           "requirement": "a fork at a later fromSeq MUST carry the version-1 surface unchanged"
@@ -26992,7 +27144,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.one-untrusted-update-taints-a-trusted-surface-a-later-trusted-update-does-not-la",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 247,
+      "line": 261,
       "title": "one untrusted update taints a trusted surface, a later trusted update does not launder it, and the approval does not advance; an all-trusted surface does",
       "explicitId": "openwop.requirement.0209.taint-sticky",
       "citations": [
@@ -27265,7 +27417,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.subscriptionid-the-webhookid-a-host-emits-on-a-delivery-is-the-one-it-minted",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 132,
+      "line": 140,
       "title": "subscriptionId: the webhookId a host EMITS on a delivery is the one it minted",
       "explicitId": "openwop.requirement.0187.bound-id-kinds.webhook-emitted",
       "citations": [
@@ -27284,7 +27436,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.interruptid-the-id-a-suspension-puts-on-the-wire-is-bound",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 179,
+      "line": 192,
       "title": "interruptId: the id a suspension puts on the wire is bound",
       "explicitId": null,
       "citations": []
@@ -27292,7 +27444,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.effectid-every-row-get-runs-runid-effects-serves-is-bound",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 200,
+      "line": 213,
       "title": "effectId: every row GET /runs/{runId}/effects serves is bound",
       "explicitId": "openwop.requirement.0187.bound-id-kinds.per-kind",
       "citations": [
@@ -27305,7 +27457,7 @@
     {
       "id": "openwop.it.v2-bound-id-kinds.deliveryid-every-record-in-the-dead-letter-read-carries-a-bound-id-in-the-caller",
       "file": "v2-bound-id-kinds.test.ts",
-      "line": 215,
+      "line": 228,
       "title": "deliveryId: every record in the dead-letter read carries a bound id in the caller's tenant",
       "explicitId": "openwop.requirement.0187.bound-id-kinds.per-kind",
       "citations": [
@@ -27815,7 +27967,7 @@
     {
       "id": "openwop.it.v2-content-locale-keys.an-advertised-extended-content-locale-is-written-and-delivered",
       "file": "v2-content-locale-keys.test.ts",
-      "line": 51,
+      "line": 56,
       "title": "an advertised extended content locale is written and delivered",
       "explicitId": "openwop.requirement.0206.delivery-extended-locale",
       "citations": [
@@ -28883,10 +29035,10 @@
       ]
     },
     {
-      "id": "openwop.it.v2-idempotency-in-flight.concurrent-same-key-creates-yield-one-run-each-loser-is-a-marked-replay-of-a-fin",
+      "id": "openwop.it.v2-idempotency-in-flight.concurrent-same-key-creates-yield-exactly-one-run",
       "file": "v2-idempotency-in-flight.test.ts",
-      "line": 47,
-      "title": "concurrent same-key creates yield one run; each loser is a marked replay of a final outcome or 409 idempotency_in_flight with no retry timing in details",
+      "line": 101,
+      "title": "concurrent same-key creates yield exactly one run",
       "explicitId": "openwop.requirement.0213.in-flight-one-winner",
       "citations": [
         {
@@ -28898,7 +29050,16 @@
           "section": "spec/v2/core/idempotency.md Concurrency",
           "requirement": null,
           "interpolated": true
-        },
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-idempotency-in-flight.each-loser-is-a-marked-replay-of-a-final-outcome-or-409-idempotency-in-flight-wi",
+      "file": "v2-idempotency-in-flight.test.ts",
+      "line": 109,
+      "title": "each loser is a marked replay of a final outcome, or 409 idempotency_in_flight with no retry timing in details",
+      "explicitId": "openwop.requirement.0213.in-flight-loser-outcome",
+      "citations": [
         {
           "section": "spec/v2/core/idempotency.md Concurrency",
           "requirement": null,
@@ -30566,7 +30727,7 @@
     {
       "id": "openwop.it.v2-oauth-client-pkce-state-iss.a-callback-authenticated-as-another-subject-makes-no-token-request-and-stores-no",
       "file": "v2-oauth-client-pkce-state-iss.test.ts",
-      "line": 123,
+      "line": 129,
       "title": "a callback authenticated as another Subject makes no token request and stores nothing",
       "explicitId": null,
       "citations": [
@@ -30589,7 +30750,7 @@
     {
       "id": "openwop.it.v2-oauth-client-pkce-state-iss.a-wrong-or-missing-iss-with-authorization-response-iss-parameter-supported-makes",
       "file": "v2-oauth-client-pkce-state-iss.test.ts",
-      "line": 145,
+      "line": 151,
       "title": "a wrong or missing iss (with authorization_response_iss_parameter_supported) makes no token request",
       "explicitId": null,
       "citations": [
@@ -30613,7 +30774,7 @@
     {
       "id": "openwop.it.v2-oauth-client-pkce-state-iss.issuer-less-providers-get-redirect-uris-no-other-provider-shares",
       "file": "v2-oauth-client-pkce-state-iss.test.ts",
-      "line": 173,
+      "line": 179,
       "title": "issuer-less providers get redirect URIs no other provider shares",
       "explicitId": null,
       "citations": [
@@ -30631,7 +30792,7 @@
     {
       "id": "openwop.it.v2-oauth-client-pkce-state-iss.the-redirect-uri-is-fixed-per-provider-whatever-the-request-carries",
       "file": "v2-oauth-client-pkce-state-iss.test.ts",
-      "line": 189,
+      "line": 195,
       "title": "the redirect URI is fixed per provider whatever the request carries",
       "explicitId": null,
       "citations": [
@@ -32718,7 +32879,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-major-2-subscriber-receives-the-v2-rendering-the-delivery-validates-and-run-st",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 220,
+      "line": 217,
       "title": "a major-2 subscriber receives the v2 rendering: the delivery validates, and run.started.owner carries subject, never principal",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -32749,7 +32910,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-major-1-subscriber-still-receives-the-v1-rendering-the-v1-wire-does-not-move-m",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 240,
+      "line": 237,
       "title": "a major-1 subscriber still receives the v1 rendering — the v1 wire does not move mid-overlap",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -32767,7 +32928,7 @@
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-seeded-era-2-run-is-delivered-projected-too-the-fan-out-branch-a-fresh-run-can",
       "file": "v2-webhook-delivery-shape.test.ts",
-      "line": 264,
+      "line": 261,
       "title": "a seeded era-2 run is delivered projected too — the fan-out branch a fresh run cannot reach (seam-gated)",
       "explicitId": "openwop.requirement.0171.webhook-delivery-shape",
       "citations": [
@@ -32785,7 +32946,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-failed-attempt-is-retried-and-the-event-is-delivered-at-least-once",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 235,
+      "line": 238,
       "title": "a failed attempt is retried and the event is delivered at least once",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery",
       "citations": [
@@ -32795,7 +32956,8 @@
         },
         {
           "section": "webhooks.md §Durability",
-          "requirement": "the host MUST attempt delivery of run.completed for THIS run to the registered subscriber"
+          "requirement": null,
+          "interpolated": true
         },
         {
           "section": "webhooks.md §Durability",
@@ -32816,7 +32978,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.an-exhausted-delivery-is-dead-lettered-never-dropped",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 323,
+      "line": 339,
       "title": "an exhausted delivery is dead-lettered, never dropped",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery.dead-letter",
       "citations": [
@@ -32850,7 +33012,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.the-dead-letter-read-is-served-and-its-records-carry-no-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 417,
+      "line": 433,
       "title": "the dead-letter read is served and its records carry no payload",
       "explicitId": "openwop.requirement.0188.dead-letter-read",
       "citations": [
@@ -32863,7 +33025,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-dead-letter-record-carries-no-delivered-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 438,
+      "line": 454,
       "title": "a dead-letter record carries no delivered payload",
       "explicitId": "openwop.requirement.0188.dead-letter-content-free",
       "citations": [
@@ -33990,7 +34152,7 @@
     {
       "id": "openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature",
       "file": "webhook-signed-delivery.test.ts",
-      "line": 169,
+      "line": 168,
       "title": "host POSTs run events to subscriber with valid X-openwop-Signature",
       "explicitId": "openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature",
       "citations": [
@@ -34041,7 +34203,7 @@
     {
       "id": "openwop.it.webhook-signed-delivery.control-with-a-tunnel-wired-the-host-still-refuses-the-loopback-receiver",
       "file": "webhook-signed-delivery.test.ts",
-      "line": 410,
+      "line": 423,
       "title": "control: with a tunnel wired, the host still refuses the loopback receiver",
       "explicitId": "openwop.it.webhook-signed-delivery.control-with-a-tunnel-wired-the-host-still-refuses-the-loopback-receiver",
       "citations": [
@@ -40412,6 +40574,48 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v1-webhook-unregister-contract.the-tenantid-the-v1-prose-requires-on-unregister-is-a-required-query-parameter-o",
+      "file": "v1-webhook-unregister-contract.test.ts",
+      "line": 68,
+      "title": "the tenantId the v1 prose requires on unregister is a required query parameter of api/openapi.yaml unregisterWebhook",
+      "explicitId": "openwop.requirement.webhooks.v1-unregister-tenantid-in-contract",
+      "citations": [
+        {
+          "section": "spec/v1/webhooks.md §Unregister",
+          "requirement": "spec/v1/webhooks.md §Unregister MUST still require the tenantId query parameter — this leg is only meaningful while it does"
+        },
+        {
+          "section": "spec/v1/webhooks.md §Unregister",
+          "requirement": "api/openapi.yaml MUST define DELETE /v1/webhooks/{webhookId}"
+        },
+        {
+          "section": "spec/v1/webhooks.md §Unregister",
+          "requirement": "the v1 operation is unregisterWebhook"
+        },
+        {
+          "section": "spec/v1/webhooks.md §Unregister",
+          "requirement": "unregisterWebhook MUST declare `tenantId` as a REQUIRED query parameter — the prose requires it, and a client generated from a contract that omits it cannot issue a conforming request"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v1-webhook-unregister-contract.the-v2-twin-carries-the-tenant-in-its-id-and-does-not-grow-the-v1-query-paramete",
+      "file": "v1-webhook-unregister-contract.test.ts",
+      "line": 87,
+      "title": "the v2 twin carries the tenant in its id and does not grow the v1 query parameter",
+      "explicitId": "openwop.requirement.webhooks.v2-unregister-no-tenantid-query",
+      "citations": [
+        {
+          "section": "api/v2/openapi.yaml unregisterWebhook",
+          "requirement": "api/v2/openapi.yaml MUST define DELETE /webhooks/{webhookId}"
+        },
+        {
+          "section": "identity.md §5 (RFC 0187 §A.1)",
+          "requirement": "the v2 unregisterWebhook MUST NOT declare a tenantId parameter — v2 carries the tenant inside the tenant-bound webhookId, and a second tenant source could disagree with it"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-alias-covers-reword.the-corpus-gate-script-exits-0",
       "file": "v2-alias-covers-reword.test.ts",
@@ -40502,6 +40706,50 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-bundle-witness-preimage.every-committed-v3-bundle-re-derives-its-witnesssha256-from-the-prose-preimage",
+      "file": "v2-bundle-witness-preimage.test.ts",
+      "line": 66,
+      "title": "every committed v3 bundle re-derives its witnessSha256 from the prose preimage",
+      "explicitId": "openwop.it.v2-bundle-witness-preimage.every-committed-v3-bundle-re-derives-its-witnesssha256-from-the-prose-preimage",
+      "citations": [
+        {
+          "section": "RFC 0212 §C · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": "the spec repo MUST carry committed v3 bundles for this census to mean anything"
+        },
+        {
+          "section": "RFC 0212 §C · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": "the census MUST cover every committed v3 bundle"
+        },
+        {
+          "section": "RFC 0212 §C · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0212 §C · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-bundle-witness-preimage.the-row-comparator-is-code-unit-order-which-a-locale-collation-contradicts",
+      "file": "v2-bundle-witness-preimage.test.ts",
+      "line": 80,
+      "title": "the row comparator is code-unit order, which a locale collation contradicts",
+      "explicitId": "openwop.it.v2-bundle-witness-preimage.the-row-comparator-is-code-unit-order-which-a-locale-collation-contradicts",
+      "citations": [
+        {
+          "section": "RFC 0212 §C · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": "the fixture ids MUST order differently under code units and Czech collation, or this leg proves nothing"
+        },
+        {
+          "section": "RFC 0212 §C · spec/v2/core/conformance.md §\"Canonical JSON\"",
+          "requirement": "witnessSha256 rows MUST sort by UTF-16 code units; a locale-sensitive comparator MUST NOT be used"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-corpus-tag-pinned.every-vendoring-consumer-in-the-cross-repo-inventory-records-a-published-corpus",
       "file": "v2-corpus-tag-pinned.test.ts",
@@ -40886,7 +41134,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-schema.the-gate-refuses-an-enum-member-with-no-2-2-row-and-a-suite-map-the-table-does-n",
       "file": "v2-lane-exp-only-schema.test.ts",
-      "line": 117,
+      "line": 127,
       "title": "the gate refuses an enum member with no §2.2 row, and a suite map the table does not license",
       "explicitId": null,
       "citations": [
@@ -41152,6 +41400,24 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-push-credential-coherent.the-push-credential-exception-is-stated-wherever-the-rule-it-excepts-is-read-and",
+      "file": "v2-push-credential-coherent.test.ts",
+      "line": 71,
+      "title": "the push-credential exception is stated wherever the rule it excepts is read, and each regression is refused",
+      "explicitId": "openwop.requirement.0214.push-credential-coherent",
+      "citations": [
+        {
+          "section": "RFCS/0214 §A–§B; spec/v2/core/security-defaults.md §\"Onward hops\"; spec/v2/core/interop.md §\"A2A push delivery\"",
+          "requirement": "every clause of the RFC 0214 correction is present in the tracked corpus"
+        },
+        {
+          "section": "RFCS/0214 §A–§B; spec/v2/core/security-defaults.md §\"Onward hops\"; spec/v2/core/interop.md §\"A2A push delivery\"",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-release-identity.the-corpus-gate-script-exits-0",
       "file": "v2-release-identity.test.ts",