@openwop/openwop-conformance 2.39.5 → 2.40.1

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.40.1] — 2026-09-26 — three declared-unwitnessable rows are reached and say why
+
+- **Three Falsifiability rows declared non-executable now have a leg that records the reason** (RFC 0174 §B.1 rule 4, second branch: "the suite must reach the leg and record a reason"). Each RFC's table declares one of these rows unwitnessable, but no suite leg referenced it, so no bundle could account for it. Each of RFCs 0197, 0205 and 0209 was held from `Accepted` by that one row. No leg can record `executed-pass` without observing the requirement.
+  - `openwop.requirement.0197.retired-not-emitted` (`v2-capability-maturity-bounded`, new describe) is **conditional, not constant**. It reads `spec/v1/deprecations.json`, `spec/v2/migrations.json` and `spec/v2/release.json` from the shipped corpus. While no `v2-minor` row with `retirement.persistence: "persisted"` is due, it records `inapplicable` with RFC 0197 §A.3's reason; that is today's state, with 0 rows. Once one is due, it locates the member by the schema's `x-openwop-retired-in` annotation (a property name, or a `const` / single-`enum` value). It then drives a `conformance-noop` run and fails on any event that carries the member. A due row whose member it cannot locate records `blocked`. The branches no host can reach yet are self-tested in `src/lib/v2-retired-members.test.ts` (due / not-due / advertised-class / unannotated / caught emission / clean event).
+  - `openwop.requirement.0205.export-alias-equivalence` (`v2-artifact-a2a-shape`, new describe) records `inapplicable` on every host, before any request, with RFC 0205 §C.11's verdict: consumer matching logic and a pack-author call, neither on the wire.
+  - `openwop.requirement.0209.render-needs-root` (`v2-a2ui-v09-surface`, new describe) records `inapplicable` on every host, before any request or seam gate, with RFC 0209 §C.9's verdict. It names the reference-impl witness: openwop-app `frontend/react/src/chat/a2ui/__tests__/a2ui-v09-render-needs-root.test.tsx` (openwop-app#4121).
+- **Version moved ahead of publication.** `@openwop/openwop-conformance` and its exact-pinned peer `@openwop/spec-artifacts` move to `2.40.1` because `2.40.0` is tagged. Not tagged, not published. 561 scenario files, unchanged, so this is a patch.
+
+## [2.40.0] — 2026-09-26 — RFC 0215: one subscription's dead receiver cannot hold another's delivery, and unregistering stops the retries
+
+- **Two new scenarios, gated on `webhooks` (RFC 0215, `Active` 2026-09-25).** `v2-webhook-delivery-isolation` (`openwop.requirement.0215.no-head-of-line`) holds 8 subscriptions' attempts unanswered, then checks that a ninth subscription's attempt still starts. The 8 filter `run.started` and the ninth `run.completed` of a 2 s `conformance-delay` run, so contention exists before the healthy delivery falls due and the host's dispatch order cannot decide the row. It fails when the held attempts were still open at the due time and the healthy one waited for the host to release one. It records `partial-witness` when the host's own delivery timeout closed them first. `v2-webhook-unregister-stops-delivery` (`openwop.requirement.0215.unregister-stops-delivery`) answers `500` to two subscriptions on one run, unregisters one after its first attempt, and fails if that one is attempted more than 5 s after the `204`. It passes only when the other, the control, was retried after that point: a silence counts only when a retry demonstrably would have come. Sabotage on the v2 reference host: a sequential worker and a 5-slot pool each fail the first scenario, and an attempt that falls back to a cached subscription after the delete fails the second.
+- **Suite `2.40.0`**: 561 scenario files, a minor because two are added. `@openwop/spec-artifacts` moves in lockstep at the same exact pin, and ships the new `webhooks.md` §Durability text and the two invariant rows' threat-model home.
+
 ## [2.39.5] — 2026-09-26 — RFC 0213 §B has a deterministic witness, and a host front whose URLs follow the request origin verifies
 
 - **RFC 0213 §B has a deterministic witness: `0213.in-flight-refused-under-hold`.** On a host whose create answers in milliseconds the unaided `v2-idempotency-in-flight` leg records `partial-witness` — same-key creates never overlap. The new leg arms the seams-profile seam `armIdempotencyHold` (`POST /conformance/seams/sample/test/idempotency/hold`, host-sample-test-seams.md §26), which holds the caller's next real create's claim in flight; a concurrent same-key create MUST then be refused `409 idempotency_in_flight` by the host's own path (no retry timing in `details`), and the held create still wins. Seams not advertised ⇒ `inapplicable`; advertised but the path unserved ⇒ `blocked`.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.39.5 @openwop/spec-artifacts@2.39.5
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.40.1 @openwop/spec-artifacts@2.40.1
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```
@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 559 scenario files under `src/scenarios/`.
+The current suite has 561 scenario files under `src/scenarios/`.
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
@@ -481,7 +481,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 559 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 561 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.5",
-  "stampSha256": "db86d304e8d1c9042e51cc62a10c3d952826f9f3d8eddbcee08c29128c4e4252"
+  "version": "2.40.1",
+  "stampSha256": "1fb5733bb565913ac21afc3e5179ea3cb4d1b98ab39f543fb3c70f9a936453bd"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.39.5",
+  "version": "2.40.1",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.39.5"
+    "@openwop/spec-artifacts": "2.40.1"
   }
 }

package/requirement-aliases.json

@@ -167,6 +167,8 @@
     "openwop.it.v2-security-defaults-table.the-obligation-table-has-a-witness-column-and-no-row-is-unwitnessable": "openwop.requirement.0173.security-defaults-table",
     "openwop.it.v2-spec-artifacts-digest.the-corpus-gate-script-exits-0": "openwop.requirement.0168.spec-artifacts-digest",
     "openwop.it.v2-threat-model-template.the-corpus-gate-script-exits-0": "openwop.requirement.0173.threat-model-template",
-    "openwop.it.v2-witness-required.the-corpus-gate-script-exits-0": "openwop.requirement.0168.witness-required"
+    "openwop.it.v2-witness-required.the-corpus-gate-script-exits-0": "openwop.requirement.0168.witness-required",
+    "openwop.it.bundle-maturity-gate.the-committed-corpus-is-green-and-the-report-names-the-overstated-families-and-t": "openwop.it.bundle-maturity-gate.the-committed-corpus-is-green-and-the-gate-states-when-c-7-binds",
+    "openwop.it.bundle-maturity-gate.the-same-committed-bundle-re-labelled-onto-the-rfc-s-suite-fails-naming-every-ov": "openwop.it.bundle-maturity-gate.the-superseded-myndhyve-bundle-re-labelled-onto-the-rfc-s-suite-fails-naming-eve"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 633,
-    "tests": 2425,
-    "withStableId": 2425,
+    "files": 635,
+    "tests": 2430,
+    "withStableId": 2430,
     "interpolatedTitles": 0,
-    "explicitIds": 2305
+    "explicitIds": 2310
   },
   "records": [
     {
@@ -27218,7 +27218,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-version-2-envelope-carrying-a-version-1-body-is-refused-the-positive-is-admitt",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 129,
+      "line": 137,
       "title": "a version-2 envelope carrying a version-1 body is refused; the positive is admitted; above the floor is refused; below it follows envelopeStrictness",
       "explicitId": "openwop.requirement.0209.version-selects-branch",
       "citations": [
@@ -27262,7 +27262,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.no-first-createsurface-a-message-after-deletesurface-and-a-second-createsurface",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 155,
+      "line": 163,
       "title": "no first createSurface, a message after deleteSurface, and a second createSurface are each refused; the valid steps are admitted",
       "explicitId": "openwop.requirement.0209.fold-guarded",
       "citations": [
@@ -27276,7 +27276,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-createsurface-catalogid-differing-from-the-payload-catalogid-is-refused",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 180,
+      "line": 188,
       "title": "a createSurface.catalogId differing from the payload catalogId is refused",
       "explicitId": "openwop.requirement.0209.catalog-equality",
       "citations": [
@@ -27294,7 +27294,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-message-whose-surfaceid-differs-from-the-payload-surfaceid-is-refused",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 194,
+      "line": 202,
       "title": "a message whose surfaceId differs from the payload surfaceId is refused",
       "explicitId": "openwop.it.v2-a2ui-v09-surface.surface-id-equality",
       "citations": [
@@ -27312,7 +27312,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-recorded-version-2-surface-is-returned-byte-equal-on-poll-and-carried-by-a-for",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 210,
+      "line": 218,
       "title": "a recorded version-2 surface is returned byte-equal on poll and carried by a fork at a later fromSeq",
       "explicitId": "openwop.it.v2-a2ui-v09-surface.recorded-as-recorded",
       "citations": [
@@ -27349,7 +27349,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.a-version-1-surface-recorded-at-floor-1-is-returned-byte-equal-on-poll-and-carri",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 237,
+      "line": 245,
       "title": "a version-1 surface recorded at floor 1 is returned byte-equal on poll and carried by a fork",
       "explicitId": "openwop.requirement.0209.legacy-readable",
       "citations": [
@@ -27386,7 +27386,7 @@
     {
       "id": "openwop.it.v2-a2ui-v09-surface.one-untrusted-update-taints-a-trusted-surface-a-later-trusted-update-does-not-la",
       "file": "v2-a2ui-v09-surface.test.ts",
-      "line": 261,
+      "line": 269,
       "title": "one untrusted update taints a trusted surface, a later trusted update does not launder it, and the approval does not advance; an all-trusted surface does",
       "explicitId": "openwop.requirement.0209.taint-sticky",
       "citations": [
@@ -27397,6 +27397,19 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-a2ui-v09-surface.records-why-render-needs-root-has-no-server-side-witness-and-where-its-witness-l",
+      "file": "v2-a2ui-v09-surface.test.ts",
+      "line": 308,
+      "title": "records why render-needs-root has no server-side witness, and where its witness lives",
+      "explicitId": "openwop.requirement.0209.render-needs-root",
+      "citations": [
+        {
+          "section": "RFC 0209 §C.9",
+          "requirement": "a renderer does not render a surface before its root component exists"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-advertised-fixtures-exist.a-sampled-advertised-fixture-is-actually-creatable-not-just-listed",
       "file": "v2-advertised-fixtures-exist.test.ts",
@@ -27467,7 +27480,7 @@
     {
       "id": "openwop.it.v2-artifact-a2a-shape.a-getartifact-answered-as-application-a2a-json-validates-against-artifact-schema",
       "file": "v2-artifact-a2a-shape.test.ts",
-      "line": 80,
+      "line": 87,
       "title": "a getArtifact answered as application/a2a+json validates against artifact.schema.json",
       "explicitId": "openwop.requirement.0205.artifact-a2a-shape",
       "citations": [
@@ -27491,7 +27504,7 @@
     {
       "id": "openwop.it.v2-artifact-a2a-shape.the-artifactid-of-an-application-a2a-json-body-equals-the-artifactid-path-segmen",
       "file": "v2-artifact-a2a-shape.test.ts",
-      "line": 92,
+      "line": 99,
       "title": "the artifactId of an application/a2a+json body equals the {artifactId} path segment",
       "explicitId": "openwop.requirement.0205.artifact-id-matches-path",
       "citations": [
@@ -27508,7 +27521,7 @@
     {
       "id": "openwop.it.v2-artifact-a2a-shape.the-url-of-a-url-part-answers-no-2xx-to-a-second-tenant-or-to-no-credential",
       "file": "v2-artifact-a2a-shape.test.ts",
-      "line": 103,
+      "line": 110,
       "title": "the url of a url Part answers no 2xx to a second tenant or to no credential",
       "explicitId": "openwop.requirement.0205.artifact-url-part-scoped",
       "citations": [
@@ -27524,6 +27537,19 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-artifact-a2a-shape.records-why-export-alias-equivalence-has-no-wire-witness",
+      "file": "v2-artifact-a2a-shape.test.ts",
+      "line": 132,
+      "title": "records why export-alias-equivalence has no wire witness",
+      "explicitId": "openwop.requirement.0205.export-alias-equivalence",
+      "citations": [
+        {
+          "section": "RFC 0205 §C.11",
+          "requirement": "an export alias and its media type name one format"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-assurance-downgrade-audited.an-identity-below-the-lane-floor-is-refused-with-sender-constraint-missing",
       "file": "v2-assurance-downgrade-audited.test.ts",
@@ -27912,7 +27938,7 @@
     {
       "id": "openwop.it.v2-capability-maturity-bounded.no-family-record-advertises-stable-above-its-corpus-declaration-row",
       "file": "v2-capability-maturity-bounded.test.ts",
-      "line": 69,
+      "line": 92,
       "title": "no family record advertises `stable` above its corpus declaration row",
       "explicitId": "openwop.requirement.0197.maturity-not-overstated",
       "citations": [
@@ -27933,6 +27959,20 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-capability-maturity-bounded.no-run-emits-a-persisted-member-the-release-has-retired",
+      "file": "v2-capability-maturity-bounded.test.ts",
+      "line": 134,
+      "title": "no run emits a persisted member the release has retired",
+      "explicitId": "openwop.requirement.0197.retired-not-emitted",
+      "citations": [
+        {
+          "section": "RFC 0197 §A.3",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-capability-record-shape.every-family-record-carries-status-since-and-witness-from-the-wire-legal-sets",
       "file": "v2-capability-record-shape.test.ts",
@@ -33150,6 +33190,47 @@
         }
       ]
     },
+    {
+      "id": "openwop.requirement.0215.no-head-of-line",
+      "file": "v2-webhook-delivery-isolation.test.ts",
+      "line": 109,
+      "title": null,
+      "explicitId": "openwop.requirement.0215.no-head-of-line",
+      "citations": [
+        {
+          "section": "webhooks.md §Surfaces",
+          "requirement": "POST /webhooks MUST answer 201 { webhookId }"
+        },
+        {
+          "section": "webhooks.md §Surfaces",
+          "requirement": "the 201 body MUST carry `webhookId`"
+        },
+        {
+          "section": "runs.md §Create",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "webhooks.md §Durability (RFC 0215 §A.1, §A.2)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "webhooks.md §Durability (RFC 0215 §A.1, §A.2)",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "webhooks.md §Durability (RFC 0215 §A.1, §A.2)",
+          "requirement": "the held subscriptions' attempts MUST have been dispatched"
+        },
+        {
+          "section": "webhooks.md §Durability (RFC 0215 §A.1, §A.2)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-webhook-delivery-shape.a-major-2-subscriber-receives-the-v2-rendering-the-delivery-validates-and-run-st",
       "file": "v2-webhook-delivery-shape.test.ts",
@@ -33640,6 +33721,37 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-webhook-unregister-stops-delivery.no-attempt-for-an-unregistered-subscription-starts-after-the-204-while-its-contr",
+      "file": "v2-webhook-unregister-stops-delivery.test.ts",
+      "line": 83,
+      "title": "no attempt for an unregistered subscription starts after the 204, while its control keeps being retried",
+      "explicitId": "openwop.requirement.0215.unregister-stops-delivery",
+      "citations": [
+        {
+          "section": "webhooks.md §Surfaces",
+          "requirement": "POST /webhooks MUST answer 201 { webhookId }"
+        },
+        {
+          "section": "webhooks.md §Surfaces",
+          "requirement": "the 201 body MUST carry `webhookId`"
+        },
+        {
+          "section": "runs.md §Create",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "webhooks.md §Surfaces",
+          "requirement": "DELETE /webhooks/{webhookId} MUST answer 204 for the caller's own subscription"
+        },
+        {
+          "section": "webhooks.md §Durability (RFC 0215 §B)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-well-known-one-resource.a-header-less-get-and-an-openwop-version-2-0-get-are-two-representations-of-one",
       "file": "v2-well-known-one-resource.test.ts",
@@ -36589,10 +36701,10 @@
       ]
     },
     {
-      "id": "openwop.it.bundle-maturity-gate.the-committed-corpus-is-green-and-the-report-names-the-overstated-families-and-t",
+      "id": "openwop.it.bundle-maturity-gate.the-committed-corpus-is-green-and-the-gate-states-when-c-7-binds",
       "file": "bundle-maturity-gate.test.ts",
-      "line": 76,
-      "title": "the committed corpus is green, and the report NAMES the overstated families and the gap row",
+      "line": 85,
+      "title": "the committed corpus is green, and the gate states when §C.7 binds",
       "explicitId": "openwop.requirement.0197.bundle-maturity-bound",
       "citations": [
         {
@@ -36600,14 +36712,6 @@
           "requirement": null,
           "interpolated": true
         },
-        {
-          "section": "spec/v2/core/capabilities.md §8 (RFC 0197 §C.7)",
-          "requirement": "a \"reported\" disposition that printed nothing would be indistinguishable from a clean tree; the report MUST name the gap row that owes the re-cut"
-        },
-        {
-          "section": "spec/v2/core/capabilities.md §8 (RFC 0197 §C.7)",
-          "requirement": "the report MUST name the families by key, not just count them — a number nobody can act on is not a report"
-        },
         {
           "section": "spec/v2/core/capabilities.md §8 (RFC 0197 §C.7)",
           "requirement": "the gate MUST state which suite version makes §C.7 binding, so \"reported\" has a visible end date"
@@ -36615,10 +36719,10 @@
       ]
     },
     {
-      "id": "openwop.it.bundle-maturity-gate.the-same-committed-bundle-re-labelled-onto-the-rfc-s-suite-fails-naming-every-ov",
+      "id": "openwop.it.bundle-maturity-gate.the-superseded-myndhyve-bundle-re-labelled-onto-the-rfc-s-suite-fails-naming-eve",
       "file": "bundle-maturity-gate.test.ts",
-      "line": 86,
-      "title": "the same committed bundle re-labelled onto the RFC’s suite FAILS, naming every overstated family",
+      "line": 93,
+      "title": "the superseded MyndHyve bundle re-labelled onto the RFC’s suite FAILS, naming every overstated family",
       "explicitId": "openwop.requirement.0197.bundle-maturity-bound",
       "citations": [
         {
@@ -36640,7 +36744,7 @@
     {
       "id": "openwop.it.bundle-maturity-gate.the-count-is-derived-promoting-one-family-in-the-declaration-drops-38-to-37",
       "file": "bundle-maturity-gate.test.ts",
-      "line": 95,
+      "line": 102,
       "title": "the count is DERIVED — promoting one family in the declaration drops 38 to 37",
       "explicitId": "openwop.requirement.0197.bundle-maturity-bound",
       "citations": [
@@ -36658,7 +36762,7 @@
     {
       "id": "openwop.it.bundle-maturity-gate.a-bundle-whose-suite-is-below-the-rfc-s-is-reported-not-failed-even-with-the-sam",
       "file": "bundle-maturity-gate.test.ts",
-      "line": 103,
+      "line": 110,
       "title": "a bundle whose suite is BELOW the RFC’s is reported, not failed, even with the same 38",
       "explicitId": "openwop.requirement.0197.bundle-maturity-bound",
       "citations": [
@@ -36674,6 +36778,14 @@
         {
           "section": "spec/v2/core/capabilities.md §8 (RFC 0197 §C.7)",
           "requirement": "the reported row must cite COMPATIBILITY.md §2.3 — an old pass stays a measurement at the suite that measured it"
+        },
+        {
+          "section": "spec/v2/core/capabilities.md §8 (RFC 0197 §C.7)",
+          "requirement": "a \"reported\" disposition that printed nothing would be indistinguishable from a clean tree; the report MUST name the gap row that owes the re-cut"
+        },
+        {
+          "section": "spec/v2/core/capabilities.md §8 (RFC 0197 §C.7)",
+          "requirement": "the report MUST name the families by key, not just count them — a number nobody can act on is not a report"
         }
       ]
     },

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 559,
+    "files": 561,
     "v1": 449,
-    "v2": 119
+    "v2": 121
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1557,6 +1557,9 @@
     "v2-version-header-honored.test.ts": [
       2
     ],
+    "v2-webhook-delivery-isolation.test.ts": [
+      2
+    ],
     "v2-webhook-delivery-shape.test.ts": [
       2
     ],
@@ -1578,6 +1581,9 @@
     "v2-webhook-standard-webhooks-delivery.test.ts": [
       2
     ],
+    "v2-webhook-unregister-stops-delivery.test.ts": [
+      2
+    ],
     "v2-well-known-one-resource.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.5",
-  "corpusTag": "v2.39.5",
+  "version": "2.40.1",
+  "corpusTag": "v2.40.1",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "ed925b14e1e3e6f82ec0d0c844c035ae1a3b0dbcf10b3e53b96106327298f5cb",
-    "api/v2/asyncapi.yaml": "a3ba4c688bd4ee33400ef23718eac3d03bc333df2b3d74644adc6f0b2b3a5b2e",
-    "api/v2/openapi.yaml": "e4dd5dafff70be8c64de8344c3ae5dd5525515a069fef6f421a226813a305344",
+    "api/seams-v2.yaml": "23c87c259cbe4b6d087faa9f358684921d400a11330bde6b27c8cacbf0b16d78",
+    "api/v2/asyncapi.yaml": "3629ae4718168e424aee3e93b3c785df904a12229a2c58c0eec0ecaf9f8f5b2e",
+    "api/v2/openapi.yaml": "74d9beac93b861a3d191ee5e87ce047a907171df6ecdb3fcb0854d28e8df119c",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "a2f4f866565b5da642b36384a235bf57a293366b7f9faeb0e7f62c3132337932",
+    "spec/v1/core-standard-manifest.json": "77d77c3ee245f8f7855a530a3aa610a0a7c00a26df6c97962f1600c93e8b13c1",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "9424f94441ba5c4d1a8027e1f59be832f46af1a67ff0ca140adca9bb501ee993",
+    "spec/v1/gaps.json": "45483b0932d4b2a80b0781419abc697f7d363be46bddfd8163a48364b8f76a36",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -240,7 +240,7 @@
     "spec/v2/core/security-defaults.md": "500471a8db7af9b776ac40b4a9a278c9f3d45e1c1dead880114e7fadc7bee37d",
     "spec/v2/core/tool-catalog.md": "35f1a3fd509db0fc0490ddf400686fe94dc4b20c98064d5ebe776da516153e60",
     "spec/v2/core/versioning.md": "0aded71d090c8358c3ce17763c120cfc1cc42531a5eaa1b8a2a7016ed9594069",
-    "spec/v2/core/webhooks.md": "9c9169d775875f72982ed3506c1bfe27546ad05806d114af103dd7c28d4d5122",
+    "spec/v2/core/webhooks.md": "95880896e37e5b7096693a75203cf0ed70cefa09959230e17b45aa9193078eff",
     "spec/v2/core/workflow-chain-packs.md": "ee45d3fede3bb6f0cc6abcf0d6c929c7cd213a0fbe862b738a998f929c4d1102",
     "spec/v2/corrections.json": "cc74ffde74384b0f261a4f625871d922e8661d654d647a8534e21036595cb280",
     "spec/v2/corrections.schema.json": "4ac595b9a6d7f66d53de03fe0edbe0dc58de46426932387bfdc0ceb3cf949a3e",
@@ -292,9 +292,9 @@
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "c3d35fbfae242c3fa3a504edb08fbdbc7ee9dd003250ea7225a0f6641dc614b9",
+    "spec/v2/release.json": "c24fde3d12b1732d9f0162ef0a0596ebd24501935cd28801eb892fbb6ec57949",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "4273f2b75cfde4c620c995b5a4c334cfc15d936dfa7f5b6fa0aa4bf257e8b8b5"
+    "spec/v2/surface-baseline.json": "72d51a1bd81cbe3cee07f9ad0ab7b481b60d4e74e651704e9b3242c49c93ec11"
   },
-  "corpusCommit": "718fae2de800b73f48a59237cfb843578b0433f1"
+  "corpusCommit": "470ee4d7a2cb94ddb893d82d57ade4d95644d74b"
 }

package/src/lib/v2-retired-members.ts

@@ -0,0 +1,119 @@
+/**
+ * RFC 0197 §A.3 — which persisted-class v2 members are retired at the release
+ * the suite ships, and whether an emitted event carries one.
+ *
+ * A persisted-class retirement keeps the member in the READER schema,
+ * annotated `x-openwop-retired-in: "2.N"`, and forbids only its EMISSION after
+ * `2.N`. The deprecations register says WHICH rows are persisted-class and
+ * when they fall due; the annotation in the v2 schema says WHAT the member is
+ * (a property name, or a `const` / single-member `enum` value). This module
+ * joins the two so `v2-capability-maturity-bounded`'s `retired-not-emitted`
+ * leg can scan real events for it.
+ *
+ * Pure (the caller passes the parsed register and a schema loader) so the
+ * self-test drives the due / not-due / unlocatable branches with fixtures —
+ * the register is empty today, so the host leg cannot reach them yet.
+ *
+ * @see RFCS/0197-v2-surfaces-retired-never-reshaped.md §A.3
+ * @see scripts/check-removal-dates.mjs (the corpus gate that requires the annotation on a due persisted row)
+ */
+
+type Json = Record<string, unknown>;
+
+export interface PersistedRetirement {
+  readonly id: string;
+  readonly removeIn: string;
+  readonly due: boolean;
+  /** `schemas/v2/…` source files the row cites, relative to the contract root. */
+  readonly schemaFiles: readonly string[];
+}
+
+export interface RetiredMember {
+  readonly rowId: string;
+  readonly removeIn: string;
+  readonly schemaFile: string;
+  /** `property`: an object key; `value`: a string value. */
+  readonly kind: 'property' | 'value';
+  readonly name: string;
+}
+
+export interface RetiredEmission {
+  readonly rowId: string;
+  readonly member: string;
+  readonly eventType: string;
+  readonly path: string;
+}
+
+const minorOf = (v: string): number | null => {
+  const m = /^2\.(\d+)(?:\.\d+)?$/.exec(v.trim());
+  return m ? Number(m[1]) : null;
+};
+
+const triggersOf = (e: Json): string[] => {
+  const t = e['removalTrigger'];
+  return Array.isArray(t) ? t.filter((x): x is string => typeof x === 'string') : typeof t === 'string' ? [t] : [];
+};
+
+/** Every `v2-minor` row whose `retirement.persistence` is `persisted`, and whether `release` has reached its `removeIn`. */
+export function persistedRetirements(deprecations: unknown, release: string): PersistedRetirement[] {
+  const entries = ((deprecations as { entries?: unknown } | null)?.entries ?? []) as Json[];
+  const rel = minorOf(release);
+  const out: PersistedRetirement[] = [];
+  for (const e of Array.isArray(entries) ? entries : []) {
+    if (!triggersOf(e).includes('v2-minor')) continue;
+    const r = e['retirement'] as Json | undefined;
+    if ((r?.['persistence'] ?? 'advertised') !== 'persisted') continue;
+    const removeIn = String(e['removeIn'] ?? '');
+    const at = minorOf(removeIn);
+    const sources = (Array.isArray(e['sources']) ? e['sources'] : []) as Json[];
+    out.push({
+      id: String(e['id'] ?? '(no id)'),
+      removeIn,
+      due: rel !== null && at !== null && rel >= at,
+      schemaFiles: sources.map((s) => String(s['file'] ?? '')).filter((f) => /^schemas\/v2\//.test(f)),
+    });
+  }
+  return out;
+}
+
+/** The members a due row's schema annotates `x-openwop-retired-in: <removeIn>`. */
+export function retiredMembers(row: PersistedRetirement, loadSchema: (file: string) => unknown): RetiredMember[] {
+  const out: RetiredMember[] = [];
+  for (const file of row.schemaFiles) {
+    const walk = (node: unknown, parentKey: string | null, grandKey: string | null): void => {
+      if (Array.isArray(node)) { for (const n of node) walk(n, null, parentKey); return; }
+      if (node === null || typeof node !== 'object') return;
+      const o = node as Json;
+      if (o['x-openwop-retired-in'] === row.removeIn) {
+        if (typeof o['const'] === 'string') out.push({ rowId: row.id, removeIn: row.removeIn, schemaFile: file, kind: 'value', name: o['const'] });
+        else if (Array.isArray(o['enum']) && o['enum'].length === 1 && typeof o['enum'][0] === 'string') out.push({ rowId: row.id, removeIn: row.removeIn, schemaFile: file, kind: 'value', name: o['enum'][0] });
+        else if (grandKey === 'properties' && parentKey !== null) out.push({ rowId: row.id, removeIn: row.removeIn, schemaFile: file, kind: 'property', name: parentKey });
+      }
+      for (const [k, v] of Object.entries(o)) walk(v, k, parentKey);
+    };
+    walk(loadSchema(file), null, null);
+  }
+  return out;
+}
+
+/** Every place an event carries a retired member: a key named for a `property` member, or a string equal to a `value` member. */
+export function findRetiredEmissions(events: readonly unknown[], members: readonly RetiredMember[]): RetiredEmission[] {
+  const hits: RetiredEmission[] = [];
+  for (const ev of events) {
+    const eventType = String((ev as Json | null)?.['type'] ?? '(untyped)');
+    const walk = (node: unknown, path: string): void => {
+      if (typeof node === 'string') {
+        for (const m of members) if (m.kind === 'value' && node === m.name) hits.push({ rowId: m.rowId, member: m.name, eventType, path });
+        return;
+      }
+      if (Array.isArray(node)) { node.forEach((n, i) => walk(n, `${path}[${i}]`)); return; }
+      if (node === null || typeof node !== 'object') return;
+      for (const [k, v] of Object.entries(node as Json)) {
+        for (const m of members) if (m.kind === 'property' && k === m.name) hits.push({ rowId: m.rowId, member: m.name, eventType, path: `${path}.${k}` });
+        walk(v, `${path}.${k}`);
+      }
+    };
+    walk(ev, '$');
+  }
+  return hits;
+}

package/src/scenarios/v2-a2ui-v09-surface.test.ts

@@ -19,6 +19,14 @@
  * Every refusal leg carries an admitted control in the same run, so a host that
  * refuses everything fails as surely as one that refuses nothing.
  *
+ * The last describe accounts for §C.9's `render-needs-root`, whose
+ * Falsifiability verdict is `unwitnessable`: the guarantee is render-side, and
+ * a server-oriented suite cannot observe a renderer. It records `inapplicable`
+ * on EVERY host, before any request and before the seam gate, and names where
+ * the real witness lives: a reference-app client probe, `tier: reference-impl`,
+ * following the `a2ui-surface-no-code-exec` precedent. It never asserts and
+ * cannot become a pass.
+ *
  * @see RFCS/0209-v2-a2ui-surfaces-are-a2ui-v0-9.md
  * @see spec/v2/ext/a2uiSurface/README.md
  * @see spec/v2/core/events.md §"The envelope-kind catalog"
@@ -295,3 +303,10 @@ describe('RFC 0209 §C.12 — trust is sticky across the fold (seam-gated)', ()
     }
   });
 });
+
+describe('RFC 0209 §C.9 — no render before root (declared unwitnessable here; reference-impl witness)', () => {
+  it('records why render-needs-root has no server-side witness, and where its witness lives', () => {
+    req('openwop.requirement.0209.render-needs-root', 'RFC 0209 §C.9', 'a renderer does not render a surface before its root component exists');
+    return softSkip('inapplicable', 'unwitnessable by this suite (RFC 0209 §C.9 Falsifiability verdict): a render-side guarantee, and a server-oriented suite cannot observe a renderer. The fold guard the server CAN observe is openwop.requirement.0209.fold-guarded, above. The render half is witnessed as a reference-app client probe (tier: reference-impl, the a2ui-surface-no-code-exec precedent): openwop/openwop-app frontend/react/src/chat/a2ui/__tests__/a2ui-v09-render-needs-root.test.tsx (openwop-app#4121, ADR 0749). Removing the `if (!state.renderable)` guard in frontend/react/src/chat/a2ui/v09/A2uiV09Surface.tsx turns 2 of its 4 cases red. This row records that the suite reached the requirement, and it is not a pass.');
+  });
+});

package/src/scenarios/v2-artifact-a2a-shape.test.ts

@@ -21,6 +21,13 @@
  * The server-free legs (the schemas against A2A v1.0.1) are corpus rows in
  * `src/coherence/a2a-parts-schemas.test.ts`.
  *
+ * The last describe accounts for §C.11's `export-alias-equivalence`, whose
+ * Falsifiability verdict is `unwitnessable`. It records `inapplicable` with that
+ * verdict's reason on EVERY host, before any request, and never asserts. The
+ * row exists so a bundle says the suite reached the requirement and why it
+ * cannot observe it (`check-accepted-predicate` rule 4, second branch). It is
+ * not a witness and cannot become one.
+ *
  * @see RFCS/0205-run-artifacts-and-turns-speak-a2a-parts.md
  * @see spec/v2/core/runs.md §"Annotations, artifacts, eval summary"
  */
@@ -120,3 +127,10 @@ describe('RFC 0205 §A.3 — a url Part does not resolve beyond the caller\'s au
     }
   });
 });
+
+describe('RFC 0205 §C.11 — an export alias and its media type name one format (declared unwitnessable)', () => {
+  it('records why export-alias-equivalence has no wire witness', () => {
+    req('openwop.requirement.0205.export-alias-equivalence', 'RFC 0205 §C.11', 'an export alias and its media type name one format');
+    return softSkip('inapplicable', 'unwitnessable on the wire (RFC 0205 §C.11 Falsifiability verdict): the equivalence binds a consumer\'s format-matching logic and the pack author\'s host.artifactTypes.export call, and neither is on the wire. The advertised spellings are readable, but a mismatch between them is legal, so no host response can falsify the row. No wire witness exists; this row records that the suite reached the requirement, and it is not a pass.');
+  });
+});

package/src/scenarios/v2-capability-maturity-bounded.test.ts

@@ -27,21 +27,44 @@
  * document and 38 families fail. That run is the sabotage proof, recorded in
  * the RFC 0197 gates PR.
  *
+ * The second describe is RFC 0197 §A.3's emission leg,
+ * `openwop.requirement.0197.retired-not-emitted`. Its Falsifiability verdict
+ * is "unwitnessable until the first persisted-class retirement row exists", so
+ * the leg is CONDITIONAL, never vacuous. It reads the deprecations register
+ * the suite ships, and while that has no due `v2-minor` row with
+ * `retirement.persistence: "persisted"`, it records `inapplicable` with the
+ * RFC's own reason. It must record a reason: rule 4 of
+ * `check-accepted-predicate` accepts a declared non-executable row only when a
+ * bundle row gives one. Once such a row is due, the leg drives a run and fails
+ * on any event that carries a member the v2 schema annotates
+ * `x-openwop-retired-in`. It never records `executed-pass` without scanning
+ * events. The branches the host leg cannot reach today are self-tested in
+ * `lib/v2-retired-members.test.ts`.
+ *
  * @see spec/v2/core/capabilities.md §8
  * @see spec/v2/declaration.json
- * @see RFCS/0197-v2-surfaces-retired-never-reshaped.md §C
+ * @see RFCS/0197-v2-surfaces-retired-never-reshaped.md §A.3, §C
  */
 
 import { describe, it, expect } from 'vitest';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { v2Discovery } from '../lib/v2.js';
+import { driver } from '../lib/driver.js';
+import { persistedRetirements, retiredMembers, findRetiredEmissions } from '../lib/v2-retired-members.js';
 import { SCHEMAS_DIR, SPEC_V2_DIR } from '../lib/paths.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 
 const DOC = 'spec/v2/core/capabilities.md §8';
 const ID = 'openwop.requirement.0197.maturity-not-overstated';
+const RETIRED_ID = 'openwop.requirement.0197.retired-not-emitted';
+const RETIRED_DOC = 'RFC 0197 §A.3';
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+function readJson(path: string): unknown {
+  return existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : null;
+}
 
 interface DeclarationFamily { key: string; maturity?: { technical?: string } }
 
@@ -106,3 +129,41 @@ describe('v2 capability-maturity-bounded (RFC 0197 §C.7)', () => {
     expect(records.length, req(ID, DOC, `the scenario asserted over ${records.length} family record(s)${undeclared.length > 0 ? `; ${undeclared.length} carry no declaration row and are left to v2-capabilities-root-closed: ${undeclared.join(', ')}` : ''}`)).toBeGreaterThan(0);
   });
 });
+
+describe('v2 retired-not-emitted (RFC 0197 §A.3) — conditional on a due persisted-class retirement', () => {
+  it('no run emits a persisted member the release has retired', async () => {
+    if (SPEC_V2_DIR === null) return softSkip('blocked', 'spec/v2/ is not present in this layout — the retirement register cannot be read, and a register that cannot be read is not an absence');
+    const deprecations = readJson(join(SPEC_V2_DIR, '..', 'v1', 'deprecations.json'));
+    const migrations = readJson(join(SPEC_V2_DIR, 'migrations.json')) as { rows?: unknown[] } | null;
+    const release = (readJson(join(SPEC_V2_DIR, 'release.json')) as { version?: unknown } | null)?.version;
+    if (deprecations === null || typeof release !== 'string') return softSkip('blocked', 'spec/v1/deprecations.json or spec/v2/release.json is missing from the shipped corpus — the retirement register cannot be read');
+    const rows = persistedRetirements(deprecations, release);
+    const due = rows.filter((r) => r.due);
+    const census = `corpus ${release}: ${rows.length} persisted-class v2-minor retirement row(s), ${(migrations?.rows ?? []).length} v2→v2 migration row(s)`;
+    if (due.length === 0) {
+      return softSkip('inapplicable', `unwitnessable until the first persisted-class retirement row is due (RFC 0197 §A.3 Falsifiability): ${census}${rows.length > 0 ? `, none due yet (${rows.map((r) => `${r.id} removeIn ${r.removeIn}`).join(', ')})` : ''} — no retired member exists for a post-2.N event to carry. Before one does, a scenario would be vacuous, and a row that cannot fail is not a witness. This leg asserts the moment such a row falls due.`);
+    }
+    const contractRoot = join(SPEC_V2_DIR, '..', '..');
+    const members = due.flatMap((r) => retiredMembers(r, (file) => readJson(join(contractRoot, file))));
+    const unlocated = due.filter((r) => !members.some((m) => m.rowId === r.id));
+    if (unlocated.length > 0) return softSkip('blocked', `due persisted-class retirement row(s) whose member carries no x-openwop-retired-in annotation the suite can read: ${unlocated.map((r) => `${r.id} (${r.schemaFiles.join(', ') || 'no schemas/v2 source'})`).join('; ')}. Without the member there is nothing to scan for, and scanning for nothing is not a pass (check-removal-dates owns the missing annotation)`);
+    const create = await driver.post('/runs', { workflowId: 'conformance-noop' });
+    const runId = String((create.json as { runId?: unknown } | null)?.runId ?? '');
+    if (create.status !== 201 || runId === '') return softSkip('blocked', `POST /runs {workflowId: conformance-noop} answered ${create.status} — no post-${due[0]!.removeIn} run to read events from`);
+    const deadline = Date.now() + 20_000;
+    for (;;) {
+      const res = await driver.get(`/runs/${encodeURIComponent(runId)}`);
+      if (res.status === 200 && TERMINAL.has(String((res.json as { status?: unknown } | null)?.status ?? ''))) break;
+      if (Date.now() > deadline) return softSkip('blocked', `conformance-noop run ${runId} did not reach a terminal status within 20 s`);
+      await new Promise((r) => setTimeout(r, 200));
+    }
+    const poll = await driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`);
+    const events = (poll.json as { events?: unknown } | null)?.events;
+    if (poll.status !== 200 || !Array.isArray(events) || events.length === 0) return softSkip('blocked', `the event poll for run ${runId} answered ${poll.status} with no events — there is nothing emitted to scan`);
+    const hits = findRetiredEmissions(events, members);
+    expect(
+      hits.map((h) => `${h.member} (${h.rowId}, retired in ${members.find((m) => m.rowId === h.rowId)?.removeIn}) in ${h.eventType} at ${h.path}`),
+      req(RETIRED_ID, RETIRED_DOC, `a host MUST NOT emit a persisted member after the minor that retired it; scanned ${events.length} event(s) for ${members.length} retired member(s): ${members.map((m) => `${m.kind} ${m.name}`).join(', ')}`),
+    ).toEqual([]);
+  });
+});

package/src/scenarios/v2-webhook-delivery-isolation.test.ts

@@ -0,0 +1,200 @@
+/**
+ * RFC 0215 §A — `webhook-delivery-isolation` (suite 2.40.0, target major 2; gated on `webhooks`).
+ *
+ * `spec/v2/core/webhooks.md` §Durability: a host MUST NOT make the start of an
+ * attempt to one subscription wait for an attempt to a DIFFERENT subscription to
+ * finish, and MUST sustain that while at least 8 subscriptions have attempts
+ * outstanding that their receivers have not answered (§A.1 + §A.2, one
+ * observation at the floor, so one requirement id).
+ *
+ * The shape (architect review, 2026-09-25): contention first, then the healthy
+ * delivery falls due — so the dispatch order the host chooses cannot decide the
+ * row. The RFC's first draft registered 9 subscriptions on one event and read a
+ * healthy attempt that beat the held ones as `partial-witness`; this file
+ * removes that case instead of recording it.
+ *
+ *   - 8 HELD subscriptions filter `run.started`. Their receiver accepts each
+ *     attempt and never answers, until the leg ends.
+ *   - 1 HEALTHY subscription filters `run.completed`, and answers 204.
+ *   - One `conformance-delay` run of `DELAY_MS`. `run.started` makes the held
+ *     attempts due at t0; `run.completed` makes the healthy one due at
+ *     t0 + DELAY_MS, by which time 8 attempts are outstanding.
+ *
+ * Verdicts, each on a positive observation:
+ *   - pass — the healthy attempt ARRIVED while all 8 held attempts were open.
+ *   - fail — the healthy attempt arrived only once fewer than 8 were open (the
+ *     host released one to make room), or never within the window, AND the held
+ *     attempts had stayed open until the run was terminal: the contention the
+ *     floor names existed when the healthy delivery fell due, and it waited.
+ *   - partial-witness — the host's own delivery timeout closed held attempts
+ *     before the run was terminal. Contention was not sustained when the
+ *     healthy delivery fell due, so this run of the leg cannot judge §A. The
+ *     timeout is the host's to choose; a host with a timeout shorter than
+ *     DELAY_MS is simply not measured by this instrument.
+ *   - blocked — fewer than 8 held attempts ever arrived AND the healthy one
+ *     never did either: nothing reached the suite, which says nothing about
+ *     isolation (`noDeliveryCause`).
+ *
+ * A bounded pool of k < 9 opens k held attempts, queues the rest and the
+ * healthy one, and releases a slot only at its timeout — so it FAILS: its held
+ * attempts were open when the run completed, and the healthy attempt waited for
+ * one to close. That is the openwop-app WHD-1 defect (RFC 0215 §Motivation 1).
+ *
+ * @see spec/v2/core/webhooks.md §Durability
+ * @see RFCS/0215-webhook-delivery-isolation.md §A
+ * @see SECURITY/invariants.yaml `webhook-delivery-isolation`
+ */
+
+import { afterEach, describe, it, expect } from 'vitest';
+import type { ServerResponse } from 'node:http';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { absenceIsUnmeasured, noDeliveryCause, startScopedReceiver, type ScopedReceiver } from '../lib/scoped-receiver.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { RETRY_WAIT_FLOOR_MS } from '../lib/webhook-retry-window.js';
+
+const ID = 'openwop.requirement.0215.no-head-of-line';
+const DOC = 'webhooks.md §Durability (RFC 0215 §A.1, §A.2)';
+const FIXTURE = 'conformance-delay';
+/** §A.2's floor. Changing it is a spec change, not a tuning knob. */
+const FLOOR = 8;
+/**
+ * How long after `run.started` the healthy delivery falls due. Short, so a host
+ * whose delivery timeout is a few seconds still holds its 8 attempts open when
+ * it does; long enough that the held attempts are dispatched first on any host
+ * that dispatches at all.
+ */
+const DELAY_MS = 2_000;
+/** How long the leg waits for the healthy attempt once the run is terminal. */
+const WINDOW_MS = RETRY_WAIT_FLOOR_MS;
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+interface Held { readonly webhookId: string; readonly res: ServerResponse; readonly openedAt: number; closedAt: number | null }
+
+let receiver: ScopedReceiver | null = null;
+const registered: string[] = [];
+let release: (() => void) | null = null;
+afterEach(async () => {
+  release?.();
+  release = null;
+  // RFC 0215 §B is what makes this cleanup work on a conforming host; on any
+  // host it stops this file's subscriptions outliving the exercise.
+  for (const id of registered.splice(0)) await driver.delete(`/webhooks/${encodeURIComponent(id)}`).catch(() => undefined);
+  if (receiver) { const rx = receiver; receiver = null; await rx.close(); }
+});
+
+async function waitTerminal(runId: string, timeoutMs: number): Promise<number | null> {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const res = await driver.get(`/runs/${encodeURIComponent(runId)}`);
+    const status = res.status === 200 ? String((res.json as { status?: unknown } | null)?.status ?? '') : '';
+    if (TERMINAL.has(status)) return Date.now();
+    if (Date.now() > deadline) return null;
+    await new Promise((r) => setTimeout(r, 100));
+  }
+}
+
+async function waitFor(pred: () => boolean, timeoutMs: number): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (pred()) return true;
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  return pred();
+}
+
+describe('RFC 0215 §A — one subscription\'s receiver does not hold another\'s delivery (gated on webhooks)', () => {
+  it(`a healthy subscription's attempt starts while ${FLOOR} other subscriptions' attempts are unanswered`, async () => {
+    let doc: Record<string, unknown> | null = null;
+    try { doc = await v2Discovery(); } catch { /* recorded below */ }
+    if (doc === null) return softSkip('blocked', 'discovery unreachable');
+    if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
+    if (!(Array.isArray(doc['fixtures']) && (doc['fixtures'] as unknown[]).includes(FIXTURE))) {
+      return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run whose completion falls due after its start`);
+    }
+
+    const held = new Map<string, Held>();
+    let healthyId: string | null = null;
+    let healthyAt: number | null = null;
+    let openAtHealthy = -1;
+    const openCount = (): number => [...held.values()].filter((h) => h.closedAt === null).length;
+
+    const rx = await startScopedReceiver((hit, res) => {
+      const webhookId = String(hit.headers['openwop-webhook-id'] ?? hit.headers['x-openwop-webhook-id'] ?? '');
+      if (webhookId !== '' && webhookId === healthyId) {
+        if (healthyAt === null) { healthyAt = Date.now(); openAtHealthy = openCount(); }
+        res.writeHead(204); res.end();
+        return;
+      }
+      if (webhookId === '' || held.has(webhookId) || !registered.includes(webhookId)) {
+        // A retry of a held attempt, or a stranger: answered, not counted as a new held attempt.
+        res.writeHead(204); res.end();
+        return;
+      }
+      const h: Held = { webhookId, res, openedAt: Date.now(), closedAt: null };
+      held.set(webhookId, h);
+      // The HOST closing the socket before we answer is the host abandoning the attempt.
+      res.on('close', () => { if (h.closedAt === null) h.closedAt = Date.now(); });
+    });
+    receiver = rx;
+    release = () => {
+      for (const h of held.values()) {
+        if (h.closedAt !== null) continue;
+        h.closedAt = Date.now();
+        try { h.res.writeHead(204); h.res.end(); } catch { /* host already gone */ }
+      }
+    };
+
+    const register = async (events: string[]): Promise<string | null> => {
+      const reg = await driver.post('/webhooks', { url: rx.url, events });
+      if (reg.status === 400 && readErrorCode(reg.json) === 'webhook_url_rejected' && !rx.tunnelled) return null;
+      expect(reg.status, req(ID, 'webhooks.md §Surfaces', 'POST /webhooks MUST answer 201 { webhookId }')).toBe(201);
+      const id = (reg.json as { webhookId?: unknown } | null)?.webhookId;
+      expect(typeof id, req(ID, 'webhooks.md §Surfaces', 'the 201 body MUST carry `webhookId`')).toBe('string');
+      registered.push(id as string);
+      return id as string;
+    };
+    for (let i = 0; i < FLOOR; i += 1) {
+      if ((await register(['run.started'])) === null) {
+        return blockedDespiteAssertions('host SSRF guard rejected the loopback receiver (webhooks.md §Egress requires it); set OPENWOP_WEBHOOK_RECEIVER_URL to a public https tunnel in front of the suite receiver');
+      }
+    }
+    healthyId = await register(['run.completed']);
+    if (healthyId === null) return blockedDespiteAssertions('host SSRF guard rejected the loopback receiver');
+
+    const create = await driver.post('/runs', { workflowId: FIXTURE, inputs: { delayMs: DELAY_MS } });
+    expect(create.status, req(ID, 'runs.md §Create', `POST /runs MUST answer 201 for ${FIXTURE}`)).toBe(201);
+    const runId = (create.json as { runId: string }).runId;
+    const terminalAt = await waitTerminal(runId, DELAY_MS + 30_000);
+    if (terminalAt === null) return blockedDespiteAssertions(`${FIXTURE} run ${runId} did not reach a terminal status — the healthy delivery never fell due`);
+    const openAtTerminal = openCount();
+    const everOpened = held.size;
+    await waitFor(() => healthyAt !== null, WINDOW_MS);
+    const earliestClose = Math.min(...[...held.values()].map((h) => h.closedAt ?? Infinity));
+    const detail = `${everOpened} held attempt(s) arrived; ${openAtTerminal} were still open when the run was seen terminal; `
+      + (healthyAt === null ? `the healthy attempt did not arrive within ${WINDOW_MS}ms of that` : `the healthy attempt arrived ${healthyAt - terminalAt}ms after it, with ${openAtHealthy} held open`);
+
+    if (healthyAt === null && everOpened === 0) {
+      if (absenceIsUnmeasured(rx)) return blockedDespiteAssertions(noDeliveryCause(rx, 'webhook attempt'));
+      return blockedDespiteAssertions(`no attempt for any of the ${FLOOR + 1} subscriptions arrived — ${noDeliveryCause(rx, 'webhook attempt')}`);
+    }
+    if (healthyAt !== null && openAtHealthy >= FLOOR) {
+      expect(openAtHealthy, req(ID, DOC, `an attempt to one subscription MUST NOT wait for attempts to other subscriptions — ${detail}`)).toBeGreaterThanOrEqual(FLOOR);
+    } else if (openAtTerminal >= FLOOR) {
+      // The healthy attempt waited (or never came), and the contention §A.2
+      // names was present when it fell due.
+      expect.fail(req(ID, DOC, `with ${FLOOR} subscriptions' attempts unanswered, a further subscription's attempt MUST still start; it waited for the host to release one — ${detail}`));
+    } else if (everOpened >= FLOOR || earliestClose < terminalAt) {
+      // Contention was not sustained to the due time. Either the host's own
+      // delivery timeout released the held attempts early (its choice), or it
+      // never opened FLOOR of them at once. The second is the defect, the first
+      // is not, and they differ in WHEN the first held attempt closed.
+      expect(everOpened, req(ID, DOC, 'the held subscriptions\' attempts MUST have been dispatched')).toBeGreaterThan(0);
+      return softSkip('skipped', `partial-witness: the host closed held attempts ${Number.isFinite(earliestClose) ? `${terminalAt - earliestClose}ms ` : ''}before the run was terminal (its delivery timeout is shorter than this leg's ${DELAY_MS}ms delay), so ${FLOOR} attempts were not outstanding when the healthy delivery fell due — ${detail}`);
+    } else {
+      expect.fail(req(ID, DOC, `the host never had ${FLOOR} subscriptions' attempts outstanding at once, and the healthy attempt waited — a bounded dispatcher below the floor — ${detail}`));
+    }
+  }, DELAY_MS + 30_000 + RETRY_WAIT_FLOOR_MS + 30_000);
+});

package/src/scenarios/v2-webhook-unregister-stops-delivery.test.ts

@@ -0,0 +1,176 @@
+/**
+ * RFC 0215 §B — `webhook-unregister-stops-delivery` (suite 2.40.0, target major 2; gated on `webhooks`).
+ *
+ * `spec/v2/core/webhooks.md` §Durability: after `unregisterWebhook` answers
+ * `204`, a host MUST NOT start any further attempt for that subscription,
+ * including attempts already scheduled for retry. An attempt the host had begun
+ * sending before the `204` MAY complete.
+ *
+ * Absence is not evidence on its own (architect review, 2026-09-25). "No retry
+ * arrived after the 204" proves nothing about a host whose next retry falls
+ * outside the window, and `webhooks.retryPolicy` carries no interval, so the
+ * suite cannot compute when that is. The leg therefore runs a CONTROL:
+ *
+ *   - two subscriptions on one receiver, both filtering `run.completed`, both
+ *     answered `500` on every attempt, so both have a retry scheduled;
+ *   - the TARGET is unregistered the moment its first attempt has been
+ *     answered; the CONTROL is left alone;
+ *   - the control's retries are what the target's would have been — same
+ *     event, same moment, same policy.
+ *
+ * Verdicts:
+ *   - pass — the control was retried after `204 + GRACE_MS` and the target
+ *     was not: a retry that would have come did not.
+ *   - fail — an attempt for the target arrived after `204 + GRACE_MS`.
+ *   - partial-witness — neither had an attempt after `204 + GRACE_MS` within
+ *     the window: the schedule finished inside the grace, or runs past the
+ *     window. Nothing was contradicted and nothing was shown.
+ *   - inapplicable — `retryPolicy.maxAttempts: 1`: there is no retry to stop.
+ *
+ * GRACE_MS is an instrument setting, not a spec number: webhooks.md states the
+ * in-flight allowance as "an attempt the host had begun sending", and the
+ * receiver keys on ARRIVAL, so the grace only has to cover transit of a request
+ * already on the wire (RFC 0215 Unresolved question 3).
+ *
+ * @see spec/v2/core/webhooks.md §Durability
+ * @see RFCS/0215-webhook-delivery-isolation.md §B
+ * @see SECURITY/invariants.yaml `webhook-unregister-stops-delivery`
+ */
+
+import { afterEach, describe, it, expect } from 'vitest';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, gateFamily } from '../lib/v2.js';
+import { absenceIsUnmeasured, noDeliveryCause, startScopedReceiver, type ScopedReceiver } from '../lib/scoped-receiver.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { retryWaitCapMs, retryWaitFor } from '../lib/webhook-retry-window.js';
+
+const ID = 'openwop.requirement.0215.unregister-stops-delivery';
+const DOC = 'webhooks.md §Durability (RFC 0215 §B)';
+const FIXTURE = 'conformance-noop';
+const GRACE_MS = 5_000;
+/** Once the control has been retried past the grace, how long to keep listening for the target's matching retry. */
+const SETTLE_MS = 5_000;
+const CAP_MS = retryWaitCapMs();
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+let receiver: ScopedReceiver | null = null;
+const registered: string[] = [];
+afterEach(async () => {
+  for (const id of registered.splice(0)) await driver.delete(`/webhooks/${encodeURIComponent(id)}`).catch(() => undefined);
+  if (receiver) { const rx = receiver; receiver = null; await rx.close(); }
+});
+
+function advertisedRetryPolicy(doc: Record<string, unknown>): { maxAttempts?: number; backoff?: string } | null {
+  const read = (holder: unknown): { maxAttempts?: number; backoff?: string } | null => {
+    const rp = holder && typeof holder === 'object' ? (holder as { retryPolicy?: unknown }).retryPolicy : undefined;
+    return rp && typeof rp === 'object' ? (rp as { maxAttempts?: number; backoff?: string }) : null;
+  };
+  return read(doc['webhooks']) ?? read(doc['triggerBridge']);
+}
+
+async function waitFor(pred: () => boolean, timeoutMs: number): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (pred()) return true;
+    await new Promise((r) => setTimeout(r, 100));
+  }
+  return pred();
+}
+
+describe('RFC 0215 §B — unregistering stops the attempts (gated on webhooks)', () => {
+  it('no attempt for an unregistered subscription starts after the 204, while its control keeps being retried', async () => {
+    let doc: Record<string, unknown> | null = null;
+    try { doc = await v2Discovery(); } catch { /* recorded below */ }
+    if (doc === null) return softSkip('blocked', 'discovery unreachable');
+    if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
+    if (!(Array.isArray(doc['fixtures']) && (doc['fixtures'] as unknown[]).includes(FIXTURE))) {
+      return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run to deliver`);
+    }
+    const policy = advertisedRetryPolicy(doc);
+    if (policy?.maxAttempts === 1) return softSkip('inapplicable', 'webhooks.retryPolicy.maxAttempts is 1 — the host schedules no retry, so there is none for unregistering to stop');
+    const windowMs = retryWaitFor(policy, CAP_MS);
+
+    const arrivals = new Map<string, number[]>();
+    let targetId: string | null = null;
+    let unregisteredAt: number | null = null;
+    let unregisterStatus = 0;
+    let unregistering: Promise<void> | null = null;
+
+    const rx = await startScopedReceiver((hit, res) => {
+      const webhookId = String(hit.headers['openwop-webhook-id'] ?? hit.headers['x-openwop-webhook-id'] ?? '');
+      const list = arrivals.get(webhookId) ?? [];
+      list.push(Date.now());
+      arrivals.set(webhookId, list);
+      res.writeHead(500);
+      res.end();
+      // Unregister the target once its first attempt has been ANSWERED, so the
+      // host has a retry scheduled and nothing of its own in flight.
+      if (webhookId === targetId && unregistering === null) {
+        unregistering = (async () => {
+          const del = await driver.delete(`/webhooks/${encodeURIComponent(webhookId)}`);
+          unregisterStatus = del.status;
+          if (del.status === 204) {
+            unregisteredAt = Date.now();
+            const i = registered.indexOf(webhookId);
+            if (i >= 0) registered.splice(i, 1);
+          }
+        })();
+      }
+    });
+    receiver = rx;
+
+    const register = async (): Promise<string | null> => {
+      const reg = await driver.post('/webhooks', { url: rx.url, events: ['run.completed'] });
+      if (reg.status === 400 && readErrorCode(reg.json) === 'webhook_url_rejected' && !rx.tunnelled) return null;
+      expect(reg.status, req(ID, 'webhooks.md §Surfaces', 'POST /webhooks MUST answer 201 { webhookId }')).toBe(201);
+      const id = (reg.json as { webhookId?: unknown } | null)?.webhookId;
+      expect(typeof id, req(ID, 'webhooks.md §Surfaces', 'the 201 body MUST carry `webhookId`')).toBe('string');
+      registered.push(id as string);
+      return id as string;
+    };
+    const controlId = await register();
+    targetId = await register();
+    if (controlId === null || targetId === null) {
+      return blockedDespiteAssertions('host SSRF guard rejected the loopback receiver (webhooks.md §Egress requires it); set OPENWOP_WEBHOOK_RECEIVER_URL to a public https tunnel in front of the suite receiver');
+    }
+    const target = targetId;
+
+    const create = await driver.post('/runs', { workflowId: FIXTURE });
+    expect(create.status, req(ID, 'runs.md §Create', `POST /runs MUST answer 201 for ${FIXTURE}`)).toBe(201);
+    const runId = (create.json as { runId: string }).runId;
+    const deadline = Date.now() + 30_000;
+    for (;;) {
+      const r = await driver.get(`/runs/${encodeURIComponent(runId)}`);
+      if (r.status === 200 && TERMINAL.has(String((r.json as { status?: unknown } | null)?.status ?? ''))) break;
+      if (Date.now() > deadline) return blockedDespiteAssertions(`${FIXTURE} run ${runId} did not reach a terminal status — no run.completed to deliver`);
+      await new Promise((r2) => setTimeout(r2, 250));
+    }
+
+    const firstTarget = await waitFor(() => (arrivals.get(target)?.length ?? 0) > 0, windowMs);
+    if (!firstTarget) {
+      if (absenceIsUnmeasured(rx)) return blockedDespiteAssertions(noDeliveryCause(rx, 'run.completed attempt'));
+      return blockedDespiteAssertions(`the target subscription's first attempt never arrived, so there was nothing to unregister after — ${noDeliveryCause(rx, 'run.completed attempt')}`);
+    }
+    await waitFor(() => unregistering !== null, 5_000);
+    if (unregistering !== null) await unregistering;
+    expect(unregisterStatus, req(ID, 'webhooks.md §Surfaces', 'DELETE /webhooks/{webhookId} MUST answer 204 for the caller\'s own subscription')).toBe(204);
+    const cutoff = (unregisteredAt as number | null ?? Date.now()) + GRACE_MS;
+
+    const after = (id: string): number[] => (arrivals.get(id) ?? []).filter((t) => t > cutoff);
+    await waitFor(() => after(controlId).length > 0 || after(target).length > 0, windowMs);
+    if (after(controlId).length > 0) await new Promise((r) => setTimeout(r, SETTLE_MS));
+
+    const targetLate = after(target);
+    const controlLate = after(controlId);
+    const detail = `target ${target}: ${arrivals.get(target)?.length ?? 0} attempt(s), ${targetLate.length} after the 204 + ${GRACE_MS}ms; control ${controlId}: ${arrivals.get(controlId)?.length ?? 0} attempt(s), ${controlLate.length} after that point`;
+    expect(
+      targetLate.length,
+      req(ID, DOC, `after unregisterWebhook answers 204 the host MUST NOT start another attempt for that subscription, including retries already scheduled — ${detail}`),
+    ).toBe(0);
+    if (controlLate.length === 0) {
+      return softSkip('skipped', `partial-witness: the control subscription was not retried after the 204 + ${GRACE_MS}ms within ${windowMs}ms either, so the target's silence shows nothing — the schedule finished inside the grace or runs past the window (raise OPENWOP_WEBHOOK_RETRY_WAIT_MS above the host's backoff sum) — ${detail}`);
+    }
+  }, CAP_MS * 2 + 90_000);
+});