@openwop/openwop-conformance 2.39.3 → 2.39.5

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.39.5] — 2026-09-26 — RFC 0213 §B has a deterministic witness, and a host front whose URLs follow the request origin verifies
+
+- **RFC 0213 §B has a deterministic witness: `0213.in-flight-refused-under-hold`.** On a host whose create answers in milliseconds the unaided `v2-idempotency-in-flight` leg records `partial-witness` — same-key creates never overlap. The new leg arms the seams-profile seam `armIdempotencyHold` (`POST /conformance/seams/sample/test/idempotency/hold`, host-sample-test-seams.md §26), which holds the caller's next real create's claim in flight; a concurrent same-key create MUST then be refused `409 idempotency_in_flight` by the host's own path (no retry timing in `details`), and the held create still wins. Seams not advertised ⇒ `inapplicable`; advertised but the path unserved ⇒ `blocked`.
+- **`OPENWOP_HOST_PUBLIC_URL` verifies a host whose advertised URLs follow the request origin (fixes #1567).** 2.39.4 required the discovery document fetched through the declared front to be byte-identical to the one fetched over `--base-url`. A host that derives `agentCardUrl`, MCP `serverUrls` and similar values from the REQUEST origin embeds the loopback origin in one and the front's origin in the other, so the check could never pass on exactly the hosts it exists for. On the v2-reference public cut on suite 2.39.4 it was the only blocked row (`0199.credential-interrupt`), and it denied certification of an otherwise 397-pass / 0-fail bundle (openwop-1f). Both origins are now replaced by one placeholder in both documents before the structural comparison, because a host with a public base may embed either origin in either response. Everything else must still match, so a front serving another host is still refused. Checked against real v2-reference discovery fetched both ways (a local boot with a public base); two new self-tests cover the measured shape, and removing the normalisation fails the regression test.
+- **The RFC 0170 credential mint/revoke seams are in the seams contract.** `v2-revocation-honored` drives `POST …/auth/credential/mint` and `…/auth/credential/revoke`. RFC 0170 §B.3 names them, and the v2 reference host has served them. Until now neither `api/seams-v2.yaml` nor `host-sample-test-seams.md` defined them, so a host advertising `openwop-conformance-seams-v2` could not know it owed them, and under `--require-behavior` their absence was a hard fail. openwop-app's seams-on in-memory boot hit exactly that on 2026-09-25. Added as `mintLaneCredential` / `revokeLaneCredential`, in the shape the reference host already serves (not a new shape), with the prose bullet beside the RFC 0199 seams. The scenario's `seamAbsent` message now names the contract instead of calling the seam unspecified. No committed bundle changes: MyndHyve's and openwop-app's do not advertise the seams profile (the row is `inapplicable`), and v2-reference's passes it.
+- **RFC 0215 gaps G3 and G6 close in the contract peer.** `@openwop/spec-artifacts`' `spec/v1/gaps.json` records the prior-art survey and the threat-model home (`threat-model-secret-leakage.md` §4.12). No scenario change.
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.39.5` because `2.39.4` is tagged. Not tagged, not published.
+
+## [2.39.4] — 2026-09-25 — RFC 0199 can be witnessed behind a public front, and the pinned-port claim is race-free
+
+- **`0199.credential-interrupt` can be witnessed on a host with a public front: `OPENWOP_HOST_PUBLIC_URL`.** RFC 0199 §C.2 requires `connectUrl` to be an https URL "on the host's own origin". The leg compared it to `--base-url`, but a certification cut drives the host over loopback, which can never be the https origin a user agent is sent to. So the v2 reference host, which implements all of §C, could never advertise `oauth.credentialInterrupt` in a cut, and RFC 0199's four credential rows never ran. New `src/lib/host-public-origin.ts` reads an operator-declared front for the host, validated like every other suite front (https, publicly resolvable). It counts as the host's own origin only once the discovery document fetched through it equals the one over `--base-url`; otherwise the leg records `blocked`, so a front pointing at another host can never let a `connectUrl` on that host's origin pass. Unset, behaviour is unchanged (`--base-url`'s origin, and no fetch). Self-test: 5 cases, including a front that serves a different host.
+- **The synthetic OIDC issuer binds a local port the operator names, not the port parsed from the URL the host trusts.** `v2-lane-exp-only-bound`, `v2-oidc-id-token-audience` and `auth-oidc-user-bearer` bound `127.0.0.1` at the port parsed from `OPENWOP_TEST_OIDC_ISSUER_URL`. For a remote host that URL is a public https front with no port, so the suite bound :80, and a non-root operator got `EACCES`. This was measured by openwop-app-ce on 2026-09-25 against a remote openwop-app instance. No remote host could execute the RFC 0200 / RFC 0210 issuer rows, so none could certify. New `issuerListenPort()` (`lib/oidc-issuer.ts`) reads `OPENWOP_TEST_OIDC_ISSUER_PORT` when set: the local port the front forwards to, the same split the webhook receiver has always had (`_URL` + `_PORT`). Unset, the old rule is unchanged. A malformed value is refused rather than silently falling back. The variable is added to `PINNED_PORT_ENVS`, so a multi-worker `--certify` that pins it is refused. Host-free legs in `oidc-issuer.test.ts` and `pinned-ports.test.ts` go red with the fix removed.
+- **The shared pinned-port listener's claim is taken before the first await.** In 2.39.3 a scoped receiver read the shared listener's promise and awaited it; if the last holder closed in that window it dropped the count to zero and shut the server, and the starting receiver then counted itself onto a closed listener — its deliveries could never arrive. The claim (a per-port entry's `refs`) is now incremented synchronously, and released if the bind fails. New self-test `a sibling that is STARTING while the last holder closes still gets a live listener` reproduces the race (ECONNREFUSED before the fix; sabotage-proven by moving the claim back after the await). Found in review of #1559; it was NOT the cause of the 2.39.3 public-cut failures — a pinned-port loopback A/B on 2.39.3 matched the ephemeral rehearsal exactly (376 / 7 / 4, no new non-pass), which points those at tunnel/load starvation.
+- **`--certify` refuses pinned fixture ports unless `--max-workers 1`.** Every fixture reached through an operator's public front listens on a pinned `*_PORT`, and the registry that routes a nonce-pathed request to its exercise lives in one vitest worker. With more than one worker, only one can own each port, and an exercise in another worker loses the host's traffic. `cut-bundle.sh` always passed `--max-workers 1`, but nothing enforced it: an openwop-app production cut run with 2 workers recorded `0173.webhook-durable-delivery` and `0187.bound-id-kinds.webhook-emitted` as timeouts for deliveries the host had made, and the same host passed both single-worker (measured by openwop-app-ce, 2026-09-25). The CLI now exits 2 before running (`src/lib/pinned-ports.ts`, with a self-test), naming the pinned variables it found, including the OAuth doubles' runtime-derived ports.
+- **`v2-webhook-durable-delivery` refuses only as many attempts as the host's advertised policy allows.** The receiver refused 2 attempts regardless, but `webhooks.retryPolicy.maxAttempts` is schema-valid from 1, so a host honestly advertising `maxAttempts: 2` never reached its 204 and failed a leg it conformed to. It now refuses `maxAttempts − 1`, capped at 2, with a minimum of 1. A host with no policy is measured as before, and `maxAttempts: 1` still refuses the first attempt, so a host that never retries still fails (webhooks.md §Durability: best-effort delivery is not a conforming mode).
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.39.4` because `2.39.3` is tagged and published. Not tagged, not published.
+
 ## [2.39.3] — 2026-09-25 — a pinned receiver port is shared, and tenant B really is tenant B
 
 - **A pinned receiver port is shared, never re-bound — the public-cut hang behind three RFC 0214 legs.** On a public cut `OPENWOP_WEBHOOK_RECEIVER_PORT` is pinned (the port the front forwards to), and `lib/scoped-receiver.ts` had every receiver call `server.listen` on it. A second receiver alive at the same time — the §B redirect and §A after-Delete legs start two, and the §A/§C delivery receiver stays open until `afterAll` — hit `EADDRINUSE` with no `error` listener attached, so its `listen` promise never settled and the leg hung to vitest's timeout: `v2-a2a-push-delivery` §A-delete, §B-redirect and §D-fork on both the 2.39.0 and 2.39.2 public cuts of the v2 reference host. Loopback binds ephemeral ports, which is why no rehearsal showed it. All receivers on a pinned port now share one ref-counted listener (routing was already per nonce); a bind failure now rejects at once with a message naming the port; `close()` no longer waits on keep-alive sockets. Three lib self-tests pin it (two concurrent receivers; close one, the sibling keeps serving; a squatted port rejects in < 5 s) — reverting to per-receiver `listen` fails the first two in milliseconds.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.39.3 @openwop/spec-artifacts@2.39.3
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.39.5 @openwop/spec-artifacts@2.39.5
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```

package/dist/cli.js

@@ -31,6 +31,7 @@
  *   1   one or more scenarios failed
  *   2   suite couldn't start (missing required args, etc)
  */
+import { pinnedPortWorkerConflict } from './lib/pinned-ports.js';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve as resolvePath, join } from 'node:path';
@@ -855,6 +856,13 @@ async function runCertify(args, baseUrl, apiKey) {
 }
 async function main() {
     const args = parseArgs(process.argv.slice(2));
+    // Refused before anything runs: a pinned-port certification that is not
+    // single-worker loses the host's traffic to a worker nobody reads (lib/pinned-ports.ts).
+    const pinnedConflict = pinnedPortWorkerConflict(process.env, args.maxWorkers, args.certify !== undefined);
+    if (pinnedConflict !== null) {
+        process.stderr.write(`openwop-conformance: ${pinnedConflict}\n`);
+        process.exit(2);
+    }
     if (args.help) {
         process.stdout.write(HELP_TEXT);
         process.exit(0);

package/dist/lib/pinned-ports.js

@@ -0,0 +1,44 @@
+/**
+ * A certification run with pinned fixture ports MUST be single-worker.
+ *
+ * Every suite fixture reached through an operator's public front listens on a
+ * pinned port (`*_PORT`), and the fixture registry that routes a nonce-pathed
+ * request to the exercise that minted it (`front-mux.ts`, `scoped-receiver.ts`)
+ * lives in ONE vitest worker's memory. With two workers only one can own each
+ * pinned port; an exercise in the other worker is unreachable, or its traffic is
+ * answered by a registry nobody reads. `cut-bundle.sh` has always passed
+ * `--max-workers 1`, and `effect-receiver.ts` assumes it — but nothing enforced
+ * it. Measured 2026-09-25: an openwop-app production cut run with
+ * `--max-workers 2` recorded `0173.webhook-durable-delivery` and
+ * `0187.bound-id-kinds.webhook-emitted` as test timeouts while the host had in
+ * fact delivered; the same host passed both single-worker. A certification that
+ * silently loses the host's traffic convicts the host, so the CLI refuses it.
+ */
+/** Every pinned-port variable a suite fixture honours. The OAuth doubles derive
+ *  theirs from `<FRONT>_URL` at runtime, so they are listed rather than grepped. */
+export const PINNED_PORT_ENVS = [
+    'OPENWOP_WEBHOOK_RECEIVER_PORT',
+    'OPENWOP_A2A_FAKE_PEER_PORT',
+    'OPENWOP_MCP_FAKE_SERVER_PORT',
+    'OPENWOP_OAUTH_AS_PORT',
+    'OPENWOP_OAUTH_AS2_PORT',
+    'OPENWOP_OAUTH_RESOURCE_PORT',
+    'OPENWOP_OTEL_COLLECTOR_PORT',
+    'OPENWOP_OTEL_COLLECTOR_GRPC_PORT',
+    // 2.39.4: the synthetic OIDC issuer's local bind port (`issuerListenPort`,
+    // oidc-issuer.ts). Two scenarios stand an issuer up on it.
+    'OPENWOP_TEST_OIDC_ISSUER_PORT',
+];
+/**
+ * The refusal message when a `--certify` run pins fixture ports without being
+ * single-worker, or `null` when the run is acceptable. `maxWorkers` undefined is
+ * vitest's default — one worker per CPU — so it is refused too.
+ */
+export function pinnedPortWorkerConflict(env, maxWorkers, certifying) {
+    if (!certifying)
+        return null;
+    const pinned = PINNED_PORT_ENVS.filter((k) => (env[k] ?? '').trim() !== '');
+    if (pinned.length === 0 || maxWorkers === 1)
+        return null;
+    return `--certify with pinned fixture ports (${pinned.join(', ')}) requires --max-workers 1 (got ${maxWorkers === undefined ? "vitest's default, one per CPU" : maxWorkers}): a pinned port is owned by one worker, so an exercise in another worker cannot receive the host's traffic and its rows would convict the host of a delivery it made`;
+}

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.3",
-  "stampSha256": "16b07c57b04e10df5de4d4bcf3cfbac8fbda75c1410aac9348f14a823ba31f68"
+  "version": "2.39.5",
+  "stampSha256": "db86d304e8d1c9042e51cc62a10c3d952826f9f3d8eddbcee08c29128c4e4252"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.39.3",
+  "version": "2.39.5",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.39.3"
+    "@openwop/spec-artifacts": "2.39.5"
   }
 }

package/requirements.json

@@ -3,10 +3,10 @@
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
     "files": 633,
-    "tests": 2424,
-    "withStableId": 2424,
+    "tests": 2425,
+    "withStableId": 2425,
     "interpolatedTitles": 0,
-    "explicitIds": 2304
+    "explicitIds": 2305
   },
   "records": [
     {
@@ -5706,7 +5706,7 @@
     {
       "id": "openwop.it.auth-oidc-user-bearer.host-claiming-oidc-profile-advertises-required-fields",
       "file": "auth-oidc-user-bearer.test.ts",
-      "line": 92,
+      "line": 93,
       "title": "host claiming OIDC profile advertises required fields",
       "explicitId": "openwop.it.auth-oidc-user-bearer.host-claiming-oidc-profile-advertises-required-fields",
       "citations": [
@@ -28290,7 +28290,7 @@
     {
       "id": "openwop.it.v2-credential-interrupt.a-node-with-no-credential-suspends-on-a-credential-interrupt-with-a-closed-crede",
       "file": "v2-credential-interrupt.test.ts",
-      "line": 108,
+      "line": 109,
       "title": "a node with no credential suspends on a credential interrupt with a closed CredentialData, status waiting-input",
       "explicitId": null,
       "citations": [
@@ -28327,7 +28327,7 @@
     {
       "id": "openwop.it.v2-credential-interrupt.a-caller-resolve-of-authorized-is-refused-while-no-credential-resolves-and-a-res",
       "file": "v2-credential-interrupt.test.ts",
-      "line": 128,
+      "line": 135,
       "title": "a caller resolve of authorized is refused while no credential resolves, and a resume value cannot carry a credential",
       "explicitId": null,
       "citations": [
@@ -28358,7 +28358,7 @@
     {
       "id": "openwop.it.v2-credential-interrupt.connecturl-is-not-pre-authenticated-and-begins-the-grant-only-for-the-initiating",
       "file": "v2-credential-interrupt.test.ts",
-      "line": 145,
+      "line": 152,
       "title": "connectUrl is not pre-authenticated and begins the grant only for the initiating Subject",
       "explicitId": null,
       "citations": [
@@ -28391,7 +28391,7 @@
     {
       "id": "openwop.it.v2-credential-interrupt.the-grant-completes-through-connecturl-the-host-resolves-the-interrupt-itself-an",
       "file": "v2-credential-interrupt.test.ts",
-      "line": 168,
+      "line": 175,
       "title": "the grant completes through connectUrl, the host resolves the interrupt itself and the run continues",
       "explicitId": null,
       "citations": [
@@ -28423,7 +28423,7 @@
     {
       "id": "openwop.it.v2-credential-interrupt.declined-fails-the-node-with-connector-auth-declined",
       "file": "v2-credential-interrupt.test.ts",
-      "line": 188,
+      "line": 195,
       "title": "declined fails the node with connector_auth_declined",
       "explicitId": null,
       "citations": [
@@ -28450,7 +28450,7 @@
     {
       "id": "openwop.it.v2-credential-interrupt.a-terminal-refresh-failure-emits-connector-auth-expired-then-suspends-with-reaso",
       "file": "v2-credential-interrupt.test.ts",
-      "line": 203,
+      "line": 210,
       "title": "a terminal refresh failure emits connector.auth-expired, then suspends with reason expired",
       "explicitId": null,
       "citations": [
@@ -28487,7 +28487,7 @@
     {
       "id": "openwop.it.v2-credential-interrupt.without-oauth-credentialinterrupt-a-terminal-refresh-failure-fails-the-node-conn",
       "file": "v2-credential-interrupt.test.ts",
-      "line": 231,
+      "line": 238,
       "title": "without oauth.credentialInterrupt, a terminal refresh failure fails the node connector_auth_expired and raises no interrupt",
       "explicitId": null,
       "citations": [
@@ -29279,7 +29279,7 @@
     {
       "id": "openwop.it.v2-idempotency-in-flight.concurrent-same-key-creates-yield-exactly-one-run",
       "file": "v2-idempotency-in-flight.test.ts",
-      "line": 101,
+      "line": 105,
       "title": "concurrent same-key creates yield exactly one run",
       "explicitId": "openwop.requirement.0213.in-flight-one-winner",
       "citations": [
@@ -29298,7 +29298,7 @@
     {
       "id": "openwop.it.v2-idempotency-in-flight.each-loser-is-a-marked-replay-of-a-final-outcome-or-409-idempotency-in-flight-wi",
       "file": "v2-idempotency-in-flight.test.ts",
-      "line": 109,
+      "line": 113,
       "title": "each loser is a marked replay of a final outcome, or 409 idempotency_in_flight with no retry timing in details",
       "explicitId": "openwop.requirement.0213.in-flight-loser-outcome",
       "citations": [
@@ -29324,6 +29324,38 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-idempotency-in-flight.while-the-seam-holds-the-claim-a-same-key-create-is-refused-409-idempotency-in-f",
+      "file": "v2-idempotency-in-flight.test.ts",
+      "line": 138,
+      "title": "while the seam holds the claim, a same-key create is refused 409 idempotency_in_flight by the host and the held create still wins",
+      "explicitId": "openwop.requirement.0213.in-flight-refused-under-hold",
+      "citations": [
+        {
+          "section": "spec/v2/core/idempotency.md Concurrency",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/errors.md §Retry timing",
+          "requirement": "retry timing MUST NOT travel in details"
+        },
+        {
+          "section": "spec/v2/core/idempotency.md Concurrency",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/idempotency.md Concurrency",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/idempotency.md Concurrency",
+          "requirement": "after the held create completes, a same-key create is a marked replay of the one run"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-idempotency-key-grammar.a-22-character-key-inside-the-grammar-is-accepted",
       "file": "v2-idempotency-key-grammar.test.ts",
@@ -29585,7 +29617,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-inside-the-advertised-window-is-accepted-the-control-the-two-refusa",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 150,
+      "line": 149,
       "title": "a credential inside the advertised window is accepted — the control the two refusals rest on",
       "explicitId": "openwop.requirement.0210.exp-only-control-accepted",
       "citations": [
@@ -29599,7 +29631,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-whose-total-lifetime-exceeds-the-window-is-refused-401-and-so-is-on",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 165,
+      "line": 164,
       "title": "a credential whose TOTAL lifetime exceeds the window is refused 401, and so is one carrying no iat",
       "explicitId": "openwop.requirement.0210.exp-only-lifetime-bound",
       "citations": [
@@ -29618,7 +29650,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.the-over-lifetime-refusal-names-credential-lifetime-exceeded-not-a-generic-unaut",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 200,
+      "line": 199,
       "title": "the over-lifetime refusal names credential_lifetime_exceeded, not a generic unauthenticated",
       "explicitId": "openwop.requirement.0210.credential-lifetime-code",
       "citations": [
@@ -29632,7 +29664,7 @@
     {
       "id": "openwop.it.v2-lane-exp-only-bound.a-credential-whose-remaining-lifetime-exceeds-the-window-is-refused-though-its-t",
       "file": "v2-lane-exp-only-bound.test.ts",
-      "line": 218,
+      "line": 217,
       "title": "a credential whose REMAINING lifetime exceeds the window is refused, though its total lifetime does not",
       "explicitId": "openwop.requirement.0210.exp-only-remaining-bound",
       "citations": [
@@ -31179,7 +31211,7 @@
     {
       "id": "openwop.it.v2-oidc-id-token-audience.a-same-audience-id-token-is-admissible-and-one-minted-for-another-relying-party",
       "file": "v2-oidc-id-token-audience.test.ts",
-      "line": 75,
+      "line": 74,
       "title": "a same-audience ID token is admissible, and one minted for another relying party is audience_mismatch",
       "explicitId": "openwop.requirement.0200.id-token-aud",
       "citations": [
@@ -33188,7 +33220,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-failed-attempt-is-retried-and-the-event-is-delivered-at-least-once",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 238,
+      "line": 256,
       "title": "a failed attempt is retried and the event is delivered at least once",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery",
       "citations": [
@@ -33220,7 +33252,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.an-exhausted-delivery-is-dead-lettered-never-dropped",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 339,
+      "line": 358,
       "title": "an exhausted delivery is dead-lettered, never dropped",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery.dead-letter",
       "citations": [
@@ -33254,7 +33286,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.the-dead-letter-read-is-served-and-its-records-carry-no-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 433,
+      "line": 452,
       "title": "the dead-letter read is served and its records carry no payload",
       "explicitId": "openwop.requirement.0188.dead-letter-read",
       "citations": [
@@ -33267,7 +33299,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-dead-letter-record-carries-no-delivered-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 454,
+      "line": 473,
       "title": "a dead-letter record carries no delivered payload",
       "explicitId": "openwop.requirement.0188.dead-letter-content-free",
       "citations": [

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.3",
-  "corpusTag": "v2.39.3",
+  "version": "2.39.5",
+  "corpusTag": "v2.39.5",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "e51c61c5d0fe876b5851e6583a08a61e0563d44985654299db98dbcc5d7ff6ce",
-    "api/v2/asyncapi.yaml": "150a48f15f5c3b984aff61055304f30299a75f5b9561ff1b4c788c4a40b64325",
-    "api/v2/openapi.yaml": "c3969b2fbfde19dfd9a42af4a67da8d34cf3135ad8314fe7211173a37d58ed96",
+    "api/seams-v2.yaml": "ed925b14e1e3e6f82ec0d0c844c035ae1a3b0dbcf10b3e53b96106327298f5cb",
+    "api/v2/asyncapi.yaml": "a3ba4c688bd4ee33400ef23718eac3d03bc333df2b3d74644adc6f0b2b3a5b2e",
+    "api/v2/openapi.yaml": "e4dd5dafff70be8c64de8344c3ae5dd5525515a069fef6f421a226813a305344",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "796de9d8793ff2243fee9c5ffe3b9adc49b0f2e663147b965043de92594352e9",
+    "spec/v1/core-standard-manifest.json": "a2f4f866565b5da642b36384a235bf57a293366b7f9faeb0e7f62c3132337932",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "76b986a5d12be1c5dc9368bc79c6d8aa99a5e916b3cca3fc3eb6a84577f1f32a",
+    "spec/v1/gaps.json": "9424f94441ba5c4d1a8027e1f59be832f46af1a67ff0ca140adca9bb501ee993",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -292,9 +292,9 @@
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "a8988f480ec268554cdc9cb0a6019172c89aa09cd588f81bfd6166ab5c65a260",
+    "spec/v2/release.json": "c3d35fbfae242c3fa3a504edb08fbdbc7ee9dd003250ea7225a0f6641dc614b9",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "7a67a1a935db83145b1fffad3828e09c38f89170d360d2a793ae0634c3164c11"
+    "spec/v2/surface-baseline.json": "4273f2b75cfde4c620c995b5a4c334cfc15d936dfa7f5b6fa0aa4bf257e8b8b5"
   },
-  "corpusCommit": "c62b05884b9b83f4016890582e8606e3bc74ad6a"
+  "corpusCommit": "718fae2de800b73f48a59237cfb843578b0433f1"
 }

package/src/cli.ts

@@ -32,6 +32,7 @@
  *   2   suite couldn't start (missing required args, etc)
  */
 
+import { pinnedPortWorkerConflict } from './lib/pinned-ports.js';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve as resolvePath, join } from 'node:path';
@@ -907,6 +908,13 @@ async function runCertify(args: ParsedArgs, baseUrl: string, apiKey: string): Pr
 
 async function main(): Promise<never> {
   const args = parseArgs(process.argv.slice(2));
+  // Refused before anything runs: a pinned-port certification that is not
+  // single-worker loses the host's traffic to a worker nobody reads (lib/pinned-ports.ts).
+  const pinnedConflict = pinnedPortWorkerConflict(process.env, args.maxWorkers, args.certify !== undefined);
+  if (pinnedConflict !== null) {
+    process.stderr.write(`openwop-conformance: ${pinnedConflict}\n`);
+    process.exit(2);
+  }
 
   if (args.help) {
     process.stdout.write(HELP_TEXT);

package/src/lib/host-public-origin.ts

@@ -0,0 +1,91 @@
+/**
+ * The origin a USER AGENT reaches the host under test on — for rows whose
+ * normative text is about the host's own origin rather than the suite's
+ * transport (RFC 0199 §C.2: `connectUrl` "MUST be an `https` URL on the host's
+ * own origin").
+ *
+ * Until 2.39.4 those rows compared against `--base-url`. A certification cut
+ * drives the host over loopback (`http://127.0.0.1:…`), which can never be the
+ * https origin a user agent is sent to — so a host with a public front could not
+ * pass, and the v2 reference host, which implements all of §C, advertised none of
+ * it (it needs an https public base to advertise `oauth.credentialInterrupt`).
+ *
+ * `OPENWOP_HOST_PUBLIC_URL` names that front, validated like every other suite
+ * front (`resolvePublicFront`: https, publicly resolvable). A declared front is
+ * EVIDENCE only once it is shown to serve THIS host: the discovery document
+ * fetched through it must equal the one fetched over `--base-url`. Otherwise the
+ * rows that depend on it record `blocked` with that cause — a front pointing at
+ * some other host must not let a `connectUrl` on that other origin pass.
+ *
+ * Unset, this returns `--base-url`'s origin exactly as before: no behaviour
+ * changes for a run that does not declare a front.
+ */
+import { resolvePublicFront } from './webhook-receiver.js';
+
+export const HOST_FRONT_ENV = 'OPENWOP_HOST_PUBLIC_URL';
+
+export type HostOrigin =
+  | { readonly ok: true; readonly origin: string; readonly declared: boolean }
+  | { readonly ok: false; readonly reason: string };
+
+type Fetcher = (url: string) => Promise<{ status: number; text: string }>;
+
+const defaultFetch: Fetcher = async (url) => {
+  const res = await fetch(url, { headers: { accept: 'application/json', 'OpenWOP-Version': '2.0' }, signal: AbortSignal.timeout(15_000) });
+  return { status: res.status, text: await res.text() };
+};
+
+/**
+ * Replace every occurrence of either origin with one placeholder, in every
+ * string value. A host that derives its advertised URLs (`agentCardUrl`, MCP
+ * `serverUrls`, …) from the REQUEST origin embeds `http://127.0.0.1:…` in the
+ * document fetched over loopback and the tunnel origin in the one fetched
+ * through the front — so byte equality could never hold on exactly the hosts
+ * this helper exists for (measured on the v2-reference public cut on suite
+ * 2.39.4, openwop-1f: the only blocked row). A host with a public base may also
+ * embed EITHER origin in EITHER response, so both origins are normalised in both
+ * documents. Everything else must still match: a front serving another host
+ * differs in far more than its origin.
+ */
+function withoutOrigins(v: unknown, origins: readonly string[]): unknown {
+  if (typeof v === 'string') return origins.reduce((acc, o) => acc.split(o).join('<origin>'), v);
+  if (Array.isArray(v)) return v.map((x) => withoutOrigins(x, origins));
+  if (v !== null && typeof v === 'object') return Object.fromEntries(Object.entries(v as Record<string, unknown>).map(([k, x]) => [k, withoutOrigins(x, origins)]));
+  return v;
+}
+
+/** Key-order-independent JSON equality — the two fetches may serialise differently. */
+function canonical(v: unknown): string {
+  if (Array.isArray(v)) return `[${v.map(canonical).join(',')}]`;
+  if (v !== null && typeof v === 'object') return `{${Object.keys(v as Record<string, unknown>).sort().map((k) => `${JSON.stringify(k)}:${canonical((v as Record<string, unknown>)[k])}`).join(',')}}`;
+  return JSON.stringify(v);
+}
+
+/**
+ * Resolve the host's own origin. `baseUrl` is the suite's `--base-url`; `fetcher`
+ * is injectable so the self-test can run without a host.
+ */
+export async function hostPublicOrigin(baseUrl: string, fetcher: Fetcher = defaultFetch): Promise<HostOrigin> {
+  const base = new URL(baseUrl);
+  const front = resolvePublicFront(HOST_FRONT_ENV, base.origin);
+  if (!front.tunnelled) return { ok: true, origin: base.origin, declared: false };
+  const frontOrigin = new URL(front.url).origin;
+  const path = '/.well-known/openwop';
+  let viaFront: { status: number; text: string };
+  let viaBase: { status: number; text: string };
+  try {
+    [viaFront, viaBase] = await Promise.all([fetcher(`${frontOrigin}${path}`), fetcher(`${base.origin}${path}`)]);
+  } catch (e) {
+    return { ok: false, reason: `${HOST_FRONT_ENV}=${frontOrigin} could not be fetched (${(e as Error).message}) — the declared front is not shown to serve the host under test` };
+  }
+  if (viaFront.status !== 200 || viaBase.status !== 200) {
+    return { ok: false, reason: `discovery answered ${viaFront.status} through ${HOST_FRONT_ENV}=${frontOrigin} and ${viaBase.status} over --base-url — the declared front is not shown to serve the host under test` };
+  }
+  let same = false;
+  const origins = [frontOrigin, base.origin];
+  try { same = canonical(withoutOrigins(JSON.parse(viaFront.text), origins)) === canonical(withoutOrigins(JSON.parse(viaBase.text), origins)); } catch { same = false; }
+  if (!same) {
+    return { ok: false, reason: `the discovery document through ${HOST_FRONT_ENV}=${frontOrigin} differs from the one over --base-url beyond their origins — the front does not serve the host under test, so an origin claim through it would witness some other host` };
+  }
+  return { ok: true, origin: frontOrigin, declared: true };
+}

package/src/lib/oidc-issuer.ts

@@ -152,6 +152,33 @@ function signCompact(
   return base64UrlEncode(signature);
 }
 
+/**
+ * The LOCAL port a scenario binds the synthetic issuer's JWKS/discovery
+ * listener on (2.39.4).
+ *
+ * `OPENWOP_TEST_OIDC_ISSUER_URL` is the URL the HOST is told to trust — for a
+ * remote host a public https front (a tunnel), which carries no port. Until
+ * 2.39.4 every scenario bound `127.0.0.1` at the port PARSED from that URL, so a
+ * tunnelled issuer (`https://x.trycloudflare.com`) bound :80 and a non-root
+ * operator got EACCES: measured by openwop-app-ce on 2026-09-25 against a remote
+ * openwop-app instance. No remote host could then execute the RFC 0200 / 0210
+ * issuer rows, and none could certify. The webhook receiver has always
+ * separated the two (`OPENWOP_WEBHOOK_RECEIVER_URL` + `_PORT`); this is the same
+ * split: `OPENWOP_TEST_OIDC_ISSUER_PORT`, when set, is the local port the
+ * operator's front forwards to. Unset, the old rule stands unchanged (the URL's
+ * port, else 80), so a loopback operator whose URL names its port is unaffected.
+ */
+export function issuerListenPort(issuerUrl: string): number {
+  const raw = process.env['OPENWOP_TEST_OIDC_ISSUER_PORT']?.trim();
+  if (raw !== undefined && raw !== '') {
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < 1 || n > 65535) throw new Error(`OPENWOP_TEST_OIDC_ISSUER_PORT must be an integer port 1..65535 (got ${JSON.stringify(raw)})`);
+    return n;
+  }
+  const parsed = new URL(issuerUrl);
+  return parsed.port ? Number.parseInt(parsed.port, 10) : 80;
+}
+
 export function createSyntheticOIDCIssuer(
   opts: SyntheticOIDCIssuerOptions,
 ): SyntheticOIDCIssuer {

package/src/lib/pinned-ports.ts

@@ -0,0 +1,48 @@
+/**
+ * A certification run with pinned fixture ports MUST be single-worker.
+ *
+ * Every suite fixture reached through an operator's public front listens on a
+ * pinned port (`*_PORT`), and the fixture registry that routes a nonce-pathed
+ * request to the exercise that minted it (`front-mux.ts`, `scoped-receiver.ts`)
+ * lives in ONE vitest worker's memory. With two workers only one can own each
+ * pinned port; an exercise in the other worker is unreachable, or its traffic is
+ * answered by a registry nobody reads. `cut-bundle.sh` has always passed
+ * `--max-workers 1`, and `effect-receiver.ts` assumes it — but nothing enforced
+ * it. Measured 2026-09-25: an openwop-app production cut run with
+ * `--max-workers 2` recorded `0173.webhook-durable-delivery` and
+ * `0187.bound-id-kinds.webhook-emitted` as test timeouts while the host had in
+ * fact delivered; the same host passed both single-worker. A certification that
+ * silently loses the host's traffic convicts the host, so the CLI refuses it.
+ */
+
+/** Every pinned-port variable a suite fixture honours. The OAuth doubles derive
+ *  theirs from `<FRONT>_URL` at runtime, so they are listed rather than grepped. */
+export const PINNED_PORT_ENVS = [
+  'OPENWOP_WEBHOOK_RECEIVER_PORT',
+  'OPENWOP_A2A_FAKE_PEER_PORT',
+  'OPENWOP_MCP_FAKE_SERVER_PORT',
+  'OPENWOP_OAUTH_AS_PORT',
+  'OPENWOP_OAUTH_AS2_PORT',
+  'OPENWOP_OAUTH_RESOURCE_PORT',
+  'OPENWOP_OTEL_COLLECTOR_PORT',
+  'OPENWOP_OTEL_COLLECTOR_GRPC_PORT',
+  // 2.39.4: the synthetic OIDC issuer's local bind port (`issuerListenPort`,
+  // oidc-issuer.ts). Two scenarios stand an issuer up on it.
+  'OPENWOP_TEST_OIDC_ISSUER_PORT',
+] as const;
+
+/**
+ * The refusal message when a `--certify` run pins fixture ports without being
+ * single-worker, or `null` when the run is acceptable. `maxWorkers` undefined is
+ * vitest's default — one worker per CPU — so it is refused too.
+ */
+export function pinnedPortWorkerConflict(
+  env: Readonly<Record<string, string | undefined>>,
+  maxWorkers: number | undefined,
+  certifying: boolean,
+): string | null {
+  if (!certifying) return null;
+  const pinned = PINNED_PORT_ENVS.filter((k) => (env[k] ?? '').trim() !== '');
+  if (pinned.length === 0 || maxWorkers === 1) return null;
+  return `--certify with pinned fixture ports (${pinned.join(', ')}) requires --max-workers 1 (got ${maxWorkers === undefined ? "vitest's default, one per CPU" : maxWorkers}): a pinned port is owned by one worker, so an exercise in another worker cannot receive the host's traffic and its rows would convict the host of a delivery it made`;
+}

package/src/lib/scoped-receiver.ts

@@ -111,9 +111,16 @@ export interface ScopedReceiver {
  *
  * Unpinned, each receiver keeps a listener of its own (ephemeral port).
  */
-interface Listener { server: Server; port: number; origin: string; members: Set<Member>; refs: number }
+interface Listener { server: Server; port: number; origin: string; members: Set<Member> }
 interface Member { nonce: string; foreign: number }
-const sharedByPort = new Map<string, Promise<Listener>>();
+/**
+ * A pinned port's shared listener and its claim count. The claim is taken
+ * SYNCHRONOUSLY, before the first await (2.39.4): a sibling that read the entry
+ * and was still awaiting the bind used to be invisible to a closing holder, which
+ * dropped the count to zero and shut the server under it.
+ */
+interface Shared { listening: Promise<Listener>; refs: number }
+const sharedByPort = new Map<string, Shared>();
 
 function handlerFor(members: Set<Member>) {
   return (request: IncomingMessage, res: ServerResponse): void => {
@@ -144,7 +151,7 @@ async function listen(port: number, binding: { bind: string; advertise: string }
   });
   const addr = server.address();
   if (typeof addr !== 'object' || addr === null) throw new Error('receiver address unavailable');
-  return { server, port: addr.port, origin: `http://${binding.advertise}:${addr.port}`, members, refs: 0 };
+  return { server, port: addr.port, origin: `http://${binding.advertise}:${addr.port}`, members };
 }
 
 function shut(server: Server): Promise<void> {
@@ -179,22 +186,26 @@ export async function startScopedReceiver(
   const isPinned = Number.isInteger(pinned) && pinned > 0 && pinned < 65536;
   const binding = receiverBinding();
   let listener: Listener;
+  let shared: Shared | undefined;
   let key: string | undefined;
   if (isPinned) {
     key = `${binding.bind}:${pinned}`;
-    let p = sharedByPort.get(key);
-    if (!p) {
-      p = listen(pinned, binding);
-      sharedByPort.set(key, p);
-      p.catch(() => { if (sharedByPort.get(key!) === p) sharedByPort.delete(key!); });
+    shared = sharedByPort.get(key);
+    if (!shared) {
+      const listening = listen(pinned, binding);
+      shared = { listening, refs: 0 };
+      sharedByPort.set(key, shared);
+      const entry = shared;
+      listening.catch(() => { if (sharedByPort.get(key!) === entry) sharedByPort.delete(key!); });
     }
-    listener = await p;
+    shared.refs += 1; // claimed before any await — a closing sibling now sees this receiver
+    try { listener = await shared.listening; }
+    catch (err) { shared.refs -= 1; throw err; }
   } else {
     listener = await listen(0, binding);
   }
   const member: Member = { nonce, foreign: 0 };
   listener.members.add(member);
-  listener.refs += 1;
   registerBehindFront(WEBHOOK_FRONT_ENV, nonce, own);
   const front = resolvePublicFront(WEBHOOK_FRONT_ENV, listener.origin);
   let closed = false;
@@ -211,9 +222,11 @@ export async function startScopedReceiver(
       closed = true;
       unregisterBehindFront(WEBHOOK_FRONT_ENV, nonce);
       listener.members.delete(member);
-      listener.refs -= 1;
-      if (listener.refs > 0) return;
-      if (key !== undefined && sharedByPort.get(key) !== undefined) sharedByPort.delete(key);
+      if (shared !== undefined) {
+        shared.refs -= 1;
+        if (shared.refs > 0) return;
+        if (key !== undefined && sharedByPort.get(key) === shared) sharedByPort.delete(key);
+      }
       await shut(listener.server);
     },
   };

package/src/scenarios/auth-oidc-user-bearer.test.ts

@@ -46,6 +46,7 @@ import { isFixtureAdvertised } from '../lib/fixtures.js';
 import {
   createSyntheticOIDCIssuer,
   type SyntheticOIDCIssuer,
+  issuerListenPort,
 } from '../lib/oidc-issuer.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
@@ -174,8 +175,7 @@ describe('auth-oidc-user-bearer: harness-driven token validation', () => {
 
     // Bind the harness's JWKS + discovery endpoints so the host can
     // fetch them when validating tokens.
-    const parsed = new URL(harnessUrl);
-    const port = parsed.port ? Number.parseInt(parsed.port, 10) : 80;
+    const port = issuerListenPort(harnessUrl);
 
     server = createServer((reqBody, res) => {
       if (!issuer) {

package/src/scenarios/v2-credential-interrupt.test.ts

@@ -27,6 +27,7 @@
 import { describe, it, expect, afterAll } from 'vitest';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { loadEnv } from '../lib/env.js';
+import { hostPublicOrigin } from '../lib/host-public-origin.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { softSkip, seamAbsent } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
@@ -121,7 +122,13 @@ describe('RFC 0199 §C — v2-credential-interrupt (gated on oauth + provider sy
     expect([data['provider'], data['reason']], req(id, DOC, 'data names the provider and reason missing')).toEqual([PROVIDER, 'missing']);
     const connect = new URL(String(data['connectUrl']));
     expect(connect.protocol, req(id, DOC, 'connectUrl MUST be https')).toBe('https:');
-    expect(connect.origin, req(id, `${DOC} (connectUrl is host-owned)`, `connectUrl MUST be on the host's own origin (${new URL(loadEnv().baseUrl).origin})`)).toBe(new URL(loadEnv().baseUrl).origin);
+    // The host's own origin is where a USER AGENT reaches it: --base-url, or the
+    // operator-declared OPENWOP_HOST_PUBLIC_URL once shown to serve this host
+    // (lib/host-public-origin.ts, 2.39.4). A declared front that is not shown to
+    // serve it records `blocked`, never a pass on some other origin.
+    const own = await hostPublicOrigin(loadEnv().baseUrl);
+    if (!own.ok) return softSkip('blocked', own.reason);
+    expect(connect.origin, req(id, `${DOC} (connectUrl is host-owned)`, `connectUrl MUST be on the host's own origin (${own.origin}${own.declared ? ', declared via OPENWOP_HOST_PUBLIC_URL and verified to serve this host' : ''})`)).toBe(own.origin);
     await driver.post(`/runs/${encodeURIComponent(runId)}:cancel`, {}, auth(r.bearer));
   });
 

package/src/scenarios/v2-idempotency-in-flight.test.ts

@@ -39,10 +39,14 @@ import { v2Discovery } from '../lib/v2.js';
 import { readErrorCode } from '../lib/error-envelope.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
+import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
 
 const DOC = 'spec/v2/core/idempotency.md Concurrency';
 const ID_ONE = 'openwop.requirement.0213.in-flight-one-winner';
 const ID_LOSER = 'openwop.requirement.0213.in-flight-loser-outcome';
+const ID_HELD = 'openwop.requirement.0213.in-flight-refused-under-hold';
+const HOLD_SEAM = `${SEAMS_PREFIX}/sample/test/idempotency/hold`;
+const HOLD_MS = 4000;
 const FIXTURE = 'conformance-delay';
 const N = 5;
 
@@ -129,4 +133,31 @@ describe('v2 idempotency-in-flight (idempotency.md Concurrency, RFC 0213 §B)',
     // on a row shared with the winner clause.)
     if (r.refusals.length === 0) return softSkip('inapplicable', `no loser was refused in flight — all ${N} answers were successes (each loser a marked replay, which §B permits), so the 409 branch did not run on this host`);
   }, 60_000);
+  // The deterministic §B witness (host-sample-test-seams.md §26): the seam only
+  // ARMS a hold on the next real create; the 409 is the host's own in-flight branch.
+  it('while the seam holds the claim, a same-key create is refused 409 idempotency_in_flight by the host and the held create still wins', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'v2 discovery unreachable');
+    if (!seamsProfileAdvertised(doc)) return softSkip('inapplicable', 'the held-claim leg is driven through the seams profile (RFC 0213 §B) — seams profile not advertised; the unaided leg above is this host\'s witness');
+    const key = `openwopconf-held-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+    const armed = await http(() => driver.post(HOLD_SEAM, { key, holdMs: HOLD_MS }));
+    if (armed === null) return softSkip('blocked', `${HOLD_SEAM} unreachable (fetch failed)`);
+    if (armed.status === 404 || armed.status === 405 || armed.status === 403) return softSkip('blocked', `the host advertises the seams profile but does not serve ${HOLD_SEAM} (answered ${armed.status}) — the held-claim leg cannot run`);
+    if (armed.status !== 201) return softSkip('blocked', `${HOLD_SEAM} answered ${armed.status} ${JSON.stringify(armed.json)} — the seam contract (api/seams-v2.yaml armIdempotencyHold) is 201 { key, holdMs }`);
+    const body = { workflowId: 'conformance-noop' };
+    const winner = http(() => driver.post('/runs', body, { headers: { 'Idempotency-Key': key } }));
+    await new Promise((ok) => setTimeout(ok, 750));
+    const loser = await http(() => driver.post('/runs', body, { headers: { 'Idempotency-Key': key } }));
+    const won = await winner;
+    if (loser === null || won === null) return softSkip('blocked', 'POST /runs unreachable (fetch failed)');
+    expect({ status: loser.status, code: readErrorCode(loser.json) }, req(ID_HELD, DOC, `a same-key create while the claim is in flight MUST be refused 409 idempotency_in_flight (got ${loser.status} ${String(readErrorCode(loser.json))})`)).toEqual({ status: 409, code: 'idempotency_in_flight' });
+    const details = (loser.json as { details?: Record<string, unknown> } | null)?.details ?? {};
+    expect(Object.keys(details).filter((k) => /^retryAfter/i.test(k)), req(ID_HELD, 'spec/v2/core/errors.md §Retry timing', 'retry timing MUST NOT travel in details')).toEqual([]);
+    const ra = loser.headers.get('retry-after');
+    if (ra !== null) expect(parsesRetryAfter(ra), req(ID_HELD, DOC, `a Retry-After that is present MUST parse (got ${ra})`)).toBe(true);
+    expect(won.status >= 200 && won.status < 300, req(ID_HELD, DOC, `the held create MUST complete as the one winner (got ${won.status})`)).toBe(true);
+    const replay = await http(() => driver.post('/runs', body, { headers: { 'Idempotency-Key': key } }));
+    if (replay === null) return softSkip('blocked', 'POST /runs unreachable after the hold (fetch failed)');
+    expect({ replay: replay.headers.get('openwop-idempotent-replay'), runId: (replay.json as { runId?: unknown } | null)?.runId }, req(ID_HELD, DOC, 'after the held create completes, a same-key create is a marked replay of the one run')).toEqual({ replay: 'true', runId: (won.json as { runId?: unknown } | null)?.runId });
+  }, 30_000);
 });

package/src/scenarios/v2-lane-exp-only-bound.test.ts

@@ -60,7 +60,7 @@ import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
 import { v2Discovery, familyAdvertised } from '../lib/v2.js';
-import { createSyntheticOIDCIssuer, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
+import { createSyntheticOIDCIssuer, issuerListenPort, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
 
 export const HOST_CALLBACK_NOT_REQUIRED =
   'the suite stands up the synthetic OIDC issuer and the host fetches its JWKS; no request returns to the suite\'s own API, so no host-reachable callback is needed';
@@ -120,7 +120,6 @@ async function gate(): Promise<Gate | { readonly kind: 'inapplicable' | 'blocked
   const audience = process.env['OPENWOP_TEST_OIDC_AUDIENCE']?.trim() ?? 'openwop-conformance';
   if (issuer === null) {
     const made = createSyntheticOIDCIssuer({ issuer: url, audience, algorithm: 'RS256' });
-    const parsed = new URL(url);
     const srv = createServer((r, res) => {
       if (r.url === '/.well-known/jwks.json') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.jwksJson); return; }
       if (r.url === '/.well-known/openid-configuration') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.discoveryJson); return; }
@@ -128,7 +127,7 @@ async function gate(): Promise<Gate | { readonly kind: 'inapplicable' | 'blocked
     });
     await new Promise<void>((resolve, reject) => {
       srv.once('error', reject);
-      srv.listen(parsed.port ? Number.parseInt(parsed.port, 10) : 80, '127.0.0.1', () => resolve());
+      srv.listen(issuerListenPort(url), '127.0.0.1', () => resolve());
     });
     server = srv;
     issuer = made;

package/src/scenarios/v2-oidc-id-token-audience.test.ts

@@ -34,7 +34,7 @@ import { driver } from '../lib/driver.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { createSyntheticOIDCIssuer, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
+import { createSyntheticOIDCIssuer, issuerListenPort, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
 import { prmGate } from '../lib/protected-resource.js';
 
 export const HOST_CALLBACK_NOT_REQUIRED =
@@ -56,7 +56,6 @@ async function harness(audience: string): Promise<{ url: string; issuer: Synthet
   if (!url) return null;
   if (issuer !== null) return { url, issuer };
   const made = createSyntheticOIDCIssuer({ issuer: url, audience, algorithm: 'RS256' });
-  const parsed = new URL(url);
   const srv = createServer((r, res) => {
     if (r.url === '/.well-known/jwks.json') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.jwksJson); return; }
     if (r.url === '/.well-known/openid-configuration') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.discoveryJson); return; }
@@ -64,7 +63,7 @@ async function harness(audience: string): Promise<{ url: string; issuer: Synthet
   });
   await new Promise<void>((resolve, reject) => {
     srv.once('error', reject);
-    srv.listen(parsed.port ? Number.parseInt(parsed.port, 10) : 80, '127.0.0.1', () => resolve());
+    srv.listen(issuerListenPort(url), '127.0.0.1', () => resolve());
   });
   server = srv;
   issuer = made;

package/src/scenarios/v2-revocation-honored.test.ts

@@ -47,7 +47,7 @@ describe('v2 revocation-honored (RFC 0170 §B.3 — seam-gated)', () => {
     for (const lane of nextRequest) {
       const minted = await http(() => driver.post(MINT, { lane }));
       if (minted === null) return softSkip('blocked', `${MINT} unreachable (fetch failed)`);
-      if (minted.status === 404 || minted.status === 403) return seamAbsent(`${MINT} not mounted (${minted.status}) — the per-lane revoke seam RFC 0170 §B.3 names is not specified in host-sample-test-seams.md and this host does not serve it`);
+      if (minted.status === 404 || minted.status === 403) return seamAbsent(`${MINT} not mounted (${minted.status}) — the host advertises the seams profile but does not serve the RFC 0170 §B.3 credential mint/revoke seams (api/seams-v2.yaml mintLaneCredential / revokeLaneCredential; host-sample-test-seams.md)`);
       const credential = (minted.json as { credential?: unknown } | undefined)?.credential;
       expect(typeof credential, req('openwop.requirement.0170.revocation-honored', DOC, `the mint seam MUST answer { credential } for lane ${lane}`)).toBe('string');
 

package/src/scenarios/v2-webhook-durable-delivery.test.ts

@@ -208,6 +208,24 @@ function retryWaitMs(doc: Record<string, unknown>): number {
  */
 const FAIL_FIRST = 2;
 
+/**
+ * How many attempts THIS host's advertised policy leaves room to refuse
+ * (suite 2.39.4). The constant above assumed at least three attempts, but
+ * `webhooks.retryPolicy.maxAttempts` is schema-valid from 1, so a host that
+ * honestly advertised `maxAttempts: 2` was refused twice, never reached its
+ * 204, and failed a leg it conformed to. The receiver now refuses
+ * `maxAttempts − 1` attempts, at most FAIL_FIRST and at least 1. A host with no
+ * advertised policy is measured exactly as before (FAIL_FIRST), and
+ * `maxAttempts: 1` still refuses the first attempt, so a host that never
+ * retries still fails: webhooks.md §Durability says best-effort delivery is
+ * not a conforming mode.
+ */
+function failFirstFor(policy: { maxAttempts?: number } | null): number {
+  const m = policy?.maxAttempts;
+  if (typeof m !== 'number' || !Number.isInteger(m)) return FAIL_FIRST;
+  return Math.max(1, Math.min(FAIL_FIRST, m - 1));
+}
+
 const WAIT_SLACK_MS = 30_000;
 /** One `retryWaitMs` wait (the retry leg). */
 const RETRY_TEST_TIMEOUT_MS = RETRY_WAIT_CAP_MS + WAIT_SLACK_MS;
@@ -241,7 +259,8 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
     if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
     if (!fixtureAdvertised(doc, FIXTURE)) return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run to deliver`);
 
-    const receiver = await startReceiver(FAIL_FIRST); // 500, 500, then 204
+    const failFirst = failFirstFor(advertisedRetryPolicy(doc));
+    const receiver = await startReceiver(failFirst); // 500 × failFirst, then 204
     active = receiver;
     const sub = await register(receiver);
     if (sub === null) return softSkip('blocked', 'registration refused (reason recorded above)');
@@ -287,8 +306,8 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
     // inside our window this records `blocked`, NOT `executed-fail` — suite
     // 2.0.3, and this is the third time this file has had to learn it.
     //
-    // The receiver answers 204 only on attempt `FAIL_FIRST + 1`, so reaching it
-    // costs the SUM of the first FAIL_FIRST backoff intervals, not the largest
+    // The receiver answers 204 only on attempt `failFirst + 1`, so reaching it
+    // costs the SUM of the first failFirst backoff intervals, not the largest
     // one. On an exponential-from-30s policy that is 30 + 60 = 90 s, which is
     // exactly RETRY_WAIT_CAP_MS — a host loses by the width of one delivery.
     // The obvious fix is to derive the wait from the intervals, and it cannot
@@ -312,7 +331,7 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
     // only in a changelog.
     if (!retried) {
       const policyNote = advertisedRetryPolicy(doc);
-      return softSkip('blocked', `the retry was observed (${attempts.length} attempts) but the receiver's 204 did not land inside the ${retryWaitMs(doc)}ms window: it answers 204 only on attempt ${FAIL_FIRST + 1}, which costs the SUM of the first ${FAIL_FIRST} backoff intervals, and webhooks.retryPolicy carries only { maxAttempts, backoff${policyNote ? `: ${String(policyNote.backoff)}` : ''} } — the base interval is not advertised, so the suite cannot derive how long to wait. Unmeasured, not unmet (RFC 0148 §A).`);
+      return softSkip('blocked', `the retry was observed (${attempts.length} attempts) but the receiver's 204 did not land inside the ${retryWaitMs(doc)}ms window: it answers 204 only on attempt ${failFirst + 1}, which costs the SUM of the first ${failFirst} backoff intervals, and webhooks.retryPolicy carries only { maxAttempts, backoff${policyNote ? `: ${String(policyNote.backoff)}` : ''} } — the base interval is not advertised, so the suite cannot derive how long to wait. Unmeasured, not unmet (RFC 0148 §A).`);
     }
     // Backoff: the retry MUST NOT be a tight loop — consecutive attempts for one
     // key are spaced. Only asserted when the host advertises a non-`none` backoff.