@openwop/openwop-conformance 2.42.1 → 2.42.3

package/src/scenarios/v2-era-2-append-vocabulary.test.ts

@@ -28,7 +28,7 @@
 import { describe, it, expect } from 'vitest';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery } from '../lib/v2.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
 import { codemapV1toV2, era2Gate, eventsOf, pollEvents, seedEra2Log, v1FixtureLog, type ReadEvent } from '../lib/era2-seed.js';
@@ -76,12 +76,31 @@ describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () =>
       return softSkip('blocked', `seedEra2Log reported success but the log reads back empty (0 events) — the seam's return value is not evidence that a log exists, and without a seeded era-2 log the writer rule is unwitnessed here`);
     }
 
+    // unfailable-leg audit, 2026-09-26: cancel was the ONLY write driven, and
+    // it appends run.cancelled (and node.cancelled) — names the codemap spells
+    // identically in v1 and v2. A host writing v2 names into an era-2 log
+    // therefore produced the same rows as one writing v1 names, and the leg
+    // recorded executed-pass either way. The discriminator needs a type the
+    // codemap RENAMES. Best effort first: pause then resume the seeded run
+    // through the core :pause / :resume operations (runs.md §Pause and
+    // resume), which gives a host that records the resume transition a chance
+    // to append `run.resuming` (v1) — read back as `run.resume-started` (v2).
+    // Neither answer is asserted: the resume transition's event set is not
+    // pinned to a renamed type, and a seeded run's pause is host latitude. If
+    // no renamed type is appended, the leg records `blocked` below, not a pass.
+    const enc = encodeURIComponent(runId);
+    const paused = await http(() => driver.post(`/runs/${enc}:pause`, { reason: 'conformance', drainPolicy: 'immediate' }));
+    const resumed = paused?.status === 202 ? await http(() => driver.post(`/runs/${enc}:resume`, { reason: 'conformance' })) : null;
+
     // One canonical mutation so the HOST's own writer appends. Cancel is the
     // universally available terminal transition; a host that refuses it on a
-    // seeded run records `blocked` rather than a pass.
-    const cancelled = await http(() => driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {}));
-    if (cancelled === null || (cancelled.status !== 200 && cancelled.status !== 202 && cancelled.status !== 204)) {
-      return softSkip('blocked', `POST /runs/{runId}/cancel answered ${cancelled?.status ?? 'no response'} on a seeded era-2 run — no canonical mutation drove the host's writer, so the append is unwitnessed`);
+    // seeded run records `blocked` rather than a pass — unless the pause and
+    // resume above were both accepted, which already drove the host's writer.
+    const cancelled = await http(() => driver.post(`/runs/${enc}/cancel`, {}));
+    const cancelOk = cancelled !== null && (cancelled.status === 200 || cancelled.status === 202 || cancelled.status === 204);
+    const pauseResumeOk = paused?.status === 202 && resumed?.status === 202;
+    if (!cancelOk && !pauseResumeOk) {
+      return softSkip('blocked', `POST /runs/{runId}/cancel answered ${cancelled?.status ?? 'no response'} on a seeded era-2 run (pause ${paused?.status ?? 'no response'}, resume ${resumed?.status ?? 'not attempted'}) — no canonical mutation drove the host's writer, so the append is unwitnessed`);
     }
 
     const after = await pollEvents(runId);
@@ -128,6 +147,19 @@ describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () =>
         req(ID, DOC, `the appended rows continue the seeded sequence space without a gap or restart (expected ${i}, got ${String(seqs[i])})`),
       ).toBe(i);
     }
+
+    // unfailable-leg audit, 2026-09-26: the vocabulary is only observable
+    // through a type the codemap renames. An appended row that reads back under
+    // a RENAMED v2 name (v2 ≠ v1) through a successful translated read is the
+    // positive witness: the stored spelling was the v1 one the reader maps
+    // from. When every appended type is spelled the same in both vocabularies,
+    // the rows above hold for a v1-writing and a v2-writing host alike, so the
+    // writer rule is unobserved — `blocked`, not a pass.
+    const renamedV2 = new Set([...codemapV1toV2()].filter(([v1, v2]) => v1 !== v2).map(([, v2]) => v2));
+    const appendedTypes = rows.slice(seedCount).map((r) => String(r.type ?? ''));
+    if (!appendedTypes.some((t) => renamedV2.has(t))) {
+      return blockedDespiteAssertions(`every type the host appended to the era-2 log (${appendedTypes.join(', ') || 'none'}) is spelled identically in v1 and v2 (spec/v2/event-codemap.json), so a host writing v2 names reads back the same as one writing v1 names — the writer rule is unobserved. The leg needs a canonical mutation that appends a renamed type (e.g. run.resuming → run.resume-started); pause ${paused?.status ?? 'no response'} / resume ${resumed?.status ?? 'not attempted'} on the seeded run appended none, and the seed seam (api/seams-v2.yaml seedEra2EventLog) cannot seed a paused or interrupt-suspended era-2 run to resume.`);
+    }
   });
 
   it('the run keeps the era it was created with; an append does not promote it to era 3', async () => {
@@ -139,16 +171,27 @@ describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () =>
     if (!seeded.ok) return softSkip(seeded.kind, seeded.reason);
     const runId = seeded.runId;
 
-    await http(() => driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {}));
+    // unfailable-leg audit, 2026-09-26: the cancel's answer was ignored, so a
+    // host that refused it (no append at all) still had its unappended run's
+    // era read as the witness of "an append does not promote".
+    const cancelled = await http(() => driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {}));
+    if (cancelled === null || (cancelled.status !== 200 && cancelled.status !== 202 && cancelled.status !== 204)) {
+      return softSkip('blocked', `POST /runs/{runId}/cancel answered ${cancelled?.status ?? 'no response'} on a seeded era-2 run — nothing was appended, so whether an append promotes the era is unwitnessed`);
+    }
 
     const snap = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`));
     if (snap === null || snap.status !== 200) {
       return softSkip('blocked', `GET /runs/{runId} answered ${snap?.status ?? 'no response'} — the era key cannot be read back`);
     }
     const era = (snap.json as { eventLogSchemaVersion?: unknown } | null)?.eventLogSchemaVersion;
+    // unfailable-leg audit, 2026-09-26: `era === undefined` was accepted, so a
+    // host that dropped the era key from the snapshot passed. runs.md §getRun
+    // and persistence.md make eventLogSchemaVersion REQUIRED on every v2 run
+    // snapshot (schemas/v2/run-snapshot.schema.json `required`); absent ⇒ 2 is
+    // the STORAGE rule, not a wire latitude.
     expect(
-      era === undefined || era === 2,
-      req(ID, DOC, `the era key is fixed at run creation: a run seeded in era 2 and then appended to MUST still read as era 2 (got ${String(era)}) — promoting it to 3 would strand the seeded rows in a vocabulary the reader no longer translates`),
-    ).toBe(true);
+      era,
+      req(ID, DOC, `the era key is fixed at run creation: a run seeded in era 2 and then appended to MUST still read as era 2 (got ${String(era)}) — promoting it to 3 would strand the seeded rows in a vocabulary the reader no longer translates, and the snapshot MUST carry eventLogSchemaVersion (runs.md §getRun)`),
+    ).toBe(2);
   });
 });

package/src/scenarios/v2-interop-trace-context.test.ts

@@ -327,6 +327,29 @@ describe('RFC 0207 — the receiver rule (host as MCP server / A2A server)', ()
     try {
       expect(r.error, req(A2A_MALFORMED, DOC, `a malformed traceparent MUST be ignored, never a request failure — SendMessage answered error ${JSON.stringify(r.error)}`)).toBeUndefined();
       expect(r.result, req(A2A_MALFORMED, DOC, 'SendMessage MUST answer a normal result')).toBeDefined();
+      // unfailable-leg audit, 2026-09-26: only the JSON-RPC envelope was held,
+      // so a host that accepted SendMessage but failed (or rejected) the task
+      // because it could not parse the traceparent passed. "Ignored" means the
+      // task proceeds as if no traceparent were sent — the A2A sibling of the
+      // MCP leg's isError check. Read the returned Task (result.task or a bare
+      // Task) and, when it names an id, GetTask once more after a beat so a
+      // failure recorded just after the response is seen too. A Message result
+      // carries no task state and is not a failure.
+      const FAILED = new Set(['TASK_STATE_FAILED', 'TASK_STATE_REJECTED', 'failed', 'rejected']);
+      const stateOf = (res: Record<string, unknown> | undefined): string | undefined => {
+        const task = (res?.['task'] ?? res) as { status?: { state?: unknown } } | undefined;
+        const st = task?.status?.state;
+        return typeof st === 'string' ? st : undefined;
+      };
+      const first = stateOf(r.result);
+      expect(first !== undefined && FAILED.has(first), req(A2A_MALFORMED, DOC, `a malformed traceparent MUST be ignored — the task SendMessage returned is ${String(first)}; the malformed value failed the task instead of starting a new trace`)).toBe(false);
+      const id = ((r.result?.['task'] as { id?: unknown } | undefined)?.id ?? r.result?.['id']) as unknown;
+      if (typeof id === 'string') {
+        await sleep(500);
+        const again = await a2aCall(t.url, 'GetTask', { id }, {}).catch(() => null);
+        const later = again?.error === undefined ? stateOf(again?.result) : undefined;
+        expect(later !== undefined && FAILED.has(later), req(A2A_MALFORMED, DOC, `a malformed traceparent MUST be ignored — GetTask shows the task ${String(later)} after the SendMessage that carried it`)).toBe(false);
+      }
     } finally {
       await cancelTask(t.url, r);
     }

package/src/scenarios/v2-mcp-tasks.test.ts

@@ -37,6 +37,7 @@ import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { loadEnv } from '../lib/env.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
+import { scaledTimeoutMs } from '../lib/polling.js';
 
 export const HOST_CALLBACK_NOT_REQUIRED = 'the suite is the MCP client: every leg POSTs JSON-RPC to the mount the host advertises in mcp.serverUrls; nothing harness-hosted is handed to the host';
 
@@ -343,9 +344,21 @@ describe('RFC 0198 — v2-mcp-tasks (MCP Tasks on the server mount; disconnect c
     expect(key, req(ID_TASK_UPDATE_APPROVER_CHECKED, 'interop-map.json mcp.tasks.status', `the approvers task is input_required (got ${JSON.stringify(t.error ?? t.result)})`)).toBeDefined();
     const u = await call(m.url, 'tasks/update', { taskId, inputResponses: { [key!]: { action: 'accept', content: { action: 'accept' } } } });
     expect(u.error === undefined || u.error.code === INVALID_PARAMS, req(ID_TASK_UPDATE_APPROVER_CHECKED, 'interop-map.json mcp.tasks.methods tasks/update', `a non-approver's update is acknowledged or -32602, never an internal error (got ${JSON.stringify(u.error)})`)).toBe(true);
-    await new Promise((ok) => setTimeout(ok, 750));
-    expect(await runStatus(unproject(taskId)), req(ID_TASK_UPDATE_APPROVER_CHECKED, `${DOC}; interrupt.md §Approver enforcement; RFC 0198 §E.7`, 'the interrupt stays open: the run is still waiting-approval')).toBe('waiting-approval');
-    expect((await events(unproject(taskId))).filter((e) => e.type === 'interrupt.resolved').length, req(ID_TASK_UPDATE_APPROVER_CHECKED, 'interrupt.md §Approver enforcement', 'no interrupt.resolved is recorded')).toBe(0);
+    // Unfailable-leg audit, 2026-09-26: the negative evidence was read once
+    // after a fixed 750 ms, so a host applying the non-approver's update
+    // asynchronously after that passed. It is now held for a scaled ~3 s: the
+    // run must stay waiting-approval with zero interrupt.resolved on every read.
+    const holdUntil = Date.now() + scaledTimeoutMs(3_000);
+    let status: unknown;
+    let resolvedCount = 0;
+    for (;;) {
+      status = await runStatus(unproject(taskId));
+      resolvedCount = (await events(unproject(taskId))).filter((e) => e.type === 'interrupt.resolved').length;
+      if (status !== 'waiting-approval' || resolvedCount !== 0 || Date.now() >= holdUntil) break;
+      await new Promise((ok) => setTimeout(ok, 250));
+    }
+    expect(status, req(ID_TASK_UPDATE_APPROVER_CHECKED, `${DOC}; interrupt.md §Approver enforcement; RFC 0198 §E.7`, 'the interrupt stays open: the run is still waiting-approval')).toBe('waiting-approval');
+    expect(resolvedCount, req(ID_TASK_UPDATE_APPROVER_CHECKED, 'interrupt.md §Approver enforcement', 'no interrupt.resolved is recorded')).toBe(0);
     await call(m.url, 'tasks/cancel', { taskId });
   });
 

package/src/scenarios/v2-mrtr-rounds-ceiling.test.ts

@@ -97,5 +97,16 @@ describe('RFC 0175 §E.1 — mrtr-rounds-ceiling (gated on mcp + mrtr)', () => {
       served.length,
       req('openwop.requirement.0175.mrtr-rounds-ceiling.refused', 'interop.md §The MCP round ceiling', `the host MUST NOT issue a retry beyond the ceiling — the server saw ${served.length} tools/call for a ceiling of ${String(maxRounds)}`),
     ).toBeLessThanOrEqual((maxRounds as number) + 1);
+    // unfailable-leg audit, 2026-09-26: only the upper bound was enforced, so a
+    // host that answered 422 mcp_mrtr_rounds_exceeded at round 1 (or refused
+    // every MRTR tool result outright) passed. Under the fake's counting, call
+    // k (k = 1..maxRounds+1) answers the k-th input_required; a host honouring
+    // the ceiling answers the first maxRounds of them (maxRounds retries) and
+    // refuses the (maxRounds + 1)-th — exactly maxRounds + 1 tools/call. Fewer
+    // means the refusal came BEFORE the ceiling.
+    expect(
+      served.length,
+      req('openwop.requirement.0175.mrtr-rounds-ceiling.refused', 'interop.md §The MCP round ceiling', `the refusal MUST come at the ceiling, not before: rounds 1..${String(maxRounds)} are within maxRounds and MUST be answered, so the server MUST see ${rounds} tools/call (the initial call + ${String(maxRounds)} retries) — it saw ${served.length}`),
+    ).toBeGreaterThanOrEqual(rounds);
   });
 });

package/src/scenarios/v2-poll-cursor-v2.test.ts

@@ -14,7 +14,7 @@ import { describe, it, expect } from 'vitest';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery } from '../lib/v2.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 
 const DOC = 'spec/v2/core/events.md §Poll';
@@ -32,19 +32,24 @@ async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse
   try { return await fn(); } catch { return null; }
 }
 
-async function terminalRun(): Promise<{ runId: string } | { reason: string }> {
+async function terminalRun(): Promise<{ runId: string; terminal: boolean } | { reason: string }> {
   if (!(await discovery())) return { reason: 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0' };
   const created = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID }));
   if (created === null) return { reason: 'POST /runs unreachable (fetch failed)' };
   const runId = (created.json as { runId?: unknown } | undefined)?.runId;
   if (created.status !== 201 || typeof runId !== 'string') return { reason: `POST /runs {workflowId: ${NOOP_WORKFLOW_ID}} answered ${created.status} ${readErrorCode(created.json) ?? ''} — the smallest valid create was refused (fixture not seeded?)`.trim() };
+  // unfailable-leg audit, 2026-09-26: the helper used to return the run even
+  // when the deadline lapsed with it still running, so the shape leg could not
+  // hold a host to isTerminal:true. It now reports whether it actually saw a
+  // terminal snapshot status.
   const deadline = Date.now() + TIMEOUT_MS;
+  let terminal = false;
   while (Date.now() < deadline) {
     const snap = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`));
-    if (snap !== null && TERMINAL.has(String((snap.json as { status?: unknown } | undefined)?.status))) break;
+    if (snap !== null && TERMINAL.has(String((snap.json as { status?: unknown } | undefined)?.status))) { terminal = true; break; }
     await new Promise((r) => setTimeout(r, 250));
   }
-  return { runId };
+  return { runId, terminal };
 }
 
 async function poll(runId: string, query: string): Promise<OpenWOPResponse | null> {
@@ -60,6 +65,7 @@ describe('v2 poll-cursor-v2 (RFC 0171 §E.2)', () => {
   it('the response is the closed { runId, events, lastSequence, status, isTerminal }', async () => {
     const r = await terminalRun();
     if ('reason' in r) return softSkip('blocked', r.reason);
+    if (!r.terminal) return softSkip('blocked', `the ${NOOP_WORKFLOW_ID} run did not reach a terminal snapshot status within ${TIMEOUT_MS} ms — isTerminal/status/lastSequence cannot be held to a settled log`);
     const res = await poll(r.runId, '');
     if (res === null) return softSkip('blocked', 'GET /runs/{runId}/events/poll unreachable (fetch failed)');
     expect(res.status, req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, 'pollRunEvents MUST answer 200')).toBe(200);
@@ -70,8 +76,25 @@ describe('v2 poll-cursor-v2 (RFC 0171 §E.2)', () => {
     expect(Number.isInteger(body?.lastSequence) && (body?.lastSequence as number) >= -1, req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, 'lastSequence is the highest sequence in the log (−1 when empty)')).toBe(true);
     expect(typeof body?.status, req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, 'status is the snapshot status')).toBe('string');
     expect(typeof body?.isTerminal, req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, 'isTerminal is a boolean')).toBe('boolean');
+    // unfailable-leg audit, 2026-09-26: status and isTerminal were checked only
+    // for type, so a host answering isTerminal:false (or status "running") for
+    // a run whose snapshot is terminal passed. The run was observed terminal
+    // above, so the poll MUST say so.
+    expect(TERMINAL.has(String(body?.status)), req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, `status is the snapshot status: the run was observed terminal, so status MUST be one of ${[...TERMINAL].join('/')}; got ${String(body?.status)}`)).toBe(true);
+    expect(body?.isTerminal, req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, 'isTerminal is whether the run is terminal: the run was observed terminal, so isTerminal MUST be true')).toBe(true);
+    // unfailable-leg audit, 2026-09-26: the old check was max(seqs) ≤
+    // lastSequence, so a host answering max+1 (or any larger number) passed.
+    // lastSequence is the highest sequence IN THE LOG; a cursor-less poll
+    // carries the whole log, so once the log is confirmed quiescent (a second
+    // whole-log read returns the same sequences) lastSequence MUST equal the
+    // highest returned sequence, or −1 when the log is empty.
     const seqs = sequences(body);
-    if (seqs.length > 0) expect(Math.max(...seqs), req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, 'lastSequence MUST equal the highest sequence returned when the response carries the whole log')).toBeLessThanOrEqual(body?.lastSequence as number);
+    const settled = await poll(r.runId, '');
+    const seqsAfter = settled !== null && settled.status === 200 ? sequences(settled.json) : null;
+    if (seqsAfter === null || seqsAfter.join(',') !== seqs.join(',')) {
+      return blockedDespiteAssertions(`the event log grew between two whole-log reads (before: [${seqs.join(',')}], after: [${seqsAfter?.join(',') ?? 'unreadable'}]) — a run at terminal STATUS is still appending, so lastSequence cannot be compared to a settled log. Re-run against a quiescent log.`);
+    }
+    expect(body?.lastSequence, req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, `lastSequence MUST equal the highest sequence in the log (−1 when empty); the whole-log poll returned [${seqs.join(', ')}]`)).toBe(seqs.length > 0 ? Math.max(...seqs) : -1);
   });
 
   it('omitting the cursor returns from the first event (sequence 0)', async () => {

package/src/scenarios/v2-profiles-derived-only.test.ts

@@ -28,8 +28,13 @@ async function discovery(): Promise<Record<string, unknown> | null> {
   try { return await v2Discovery(); } catch { return null; }
 }
 
+// Unfailable-leg audit, 2026-09-26: this checked `status` alone, so a bare
+// `{status}` object passed as a capability record. capabilities.md §2 makes
+// `status`, `since` and `witness` all REQUIRED, so all three are checked.
 function isRecord(v: unknown): v is Record<string, unknown> {
-  return v !== null && typeof v === 'object' && !Array.isArray(v) && typeof (v as Record<string, unknown>)['status'] === 'string';
+  if (v === null || typeof v !== 'object' || Array.isArray(v)) return false;
+  const r = v as Record<string, unknown>;
+  return typeof r['status'] === 'string' && typeof r['since'] === 'string' && typeof r['witness'] === 'string';
 }
 
 /** RFC 0169 §C.1 — the predicate, evaluated over the document alone. */
@@ -60,7 +65,9 @@ describe('v2 profiles-derived-only (RFC 0169 §C.1, §C.3)', () => {
           expect(isRecord(doc[f]), req('openwop.requirement.0169.profiles-derived-only.derivable', DOC, `profile ${p.id} lists family ${f}; the host advertises it, so it MUST be one capability record {status, since, witness, …}`)).toBe(true);
         }
       }
-      expect(typeof derive(doc, p), req('openwop.requirement.0169.profiles-derived-only.derivable', DOC, `profile ${p.id} MUST be decidable from the document alone`)).toBe('boolean');
+      // Unfailable-leg audit, 2026-09-26: a `typeof derive(...) === 'boolean'`
+      // assertion stood here; `derive` always returns a boolean, so it passed
+      // every host. Decidability is carried by the record check above.
     }
     const core = rows.find((p) => p.id === 'openwop-discovery-core');
     if (core !== undefined) {

package/src/scenarios/v2-webhook-delivery-isolation.test.ts

@@ -26,11 +26,13 @@
  *     host released one to make room), or never within the window, AND the held
  *     attempts had stayed open until the run was terminal: the contention the
  *     floor names existed when the healthy delivery fell due, and it waited.
- *   - partial-witness — the host's own delivery timeout closed held attempts
- *     before the run was terminal. Contention was not sustained when the
- *     healthy delivery fell due, so this run of the leg cannot judge §A. The
- *     timeout is the host's to choose; a host with a timeout shorter than
- *     DELAY_MS is simply not measured by this instrument.
+ *   - blocked (unjudged) — the host had all 8 held attempts open at once, but
+ *     its own delivery timeout closed them before the run was terminal.
+ *     Contention was not sustained when the healthy delivery fell due, so this
+ *     run of the leg cannot judge §A. The timeout is the host's to choose; a
+ *     host with a timeout shorter than DELAY_MS is simply not measured by this
+ *     instrument. If fewer than 8 were EVER open at once (a serial or small
+ *     pool), it fails instead (2026-09-26, unfailable-leg audit).
  *   - blocked — fewer than 8 held attempts ever arrived AND the healthy one
  *     never did either: nothing reached the suite, which says nothing about
  *     isolation (`noDeliveryCause`).
@@ -121,6 +123,10 @@ describe('RFC 0215 §A — one subscription\'s receiver does not hold another\'s
     let healthyId: string | null = null;
     let healthyAt: number | null = null;
     let openAtHealthy = -1;
+    // The most held attempts ever open at once. Sampled at each held arrival:
+    // the open count only rises there (closes only lower it), so the max over
+    // arrivals is the true peak.
+    let peakOpen = 0;
     const openCount = (): number => [...held.values()].filter((h) => h.closedAt === null).length;
 
     const rx = await startScopedReceiver((hit, res) => {
@@ -137,6 +143,7 @@ describe('RFC 0215 §A — one subscription\'s receiver does not hold another\'s
       }
       const h: Held = { webhookId, res, openedAt: Date.now(), closedAt: null };
       held.set(webhookId, h);
+      peakOpen = Math.max(peakOpen, openCount());
       // The HOST closing the socket before we answer is the host abandoning the attempt.
       res.on('close', () => { if (h.closedAt === null) h.closedAt = Date.now(); });
     });
@@ -175,7 +182,7 @@ describe('RFC 0215 §A — one subscription\'s receiver does not hold another\'s
     const everOpened = held.size;
     await waitFor(() => healthyAt !== null, WINDOW_MS);
     const earliestClose = Math.min(...[...held.values()].map((h) => h.closedAt ?? Infinity));
-    const detail = `${everOpened} held attempt(s) arrived; ${openAtTerminal} were still open when the run was seen terminal; `
+    const detail = `${everOpened} held attempt(s) arrived (at most ${peakOpen} open at once); ${openAtTerminal} were still open when the run was seen terminal; `
       + (healthyAt === null ? `the healthy attempt did not arrive within ${WINDOW_MS}ms of that` : `the healthy attempt arrived ${healthyAt - terminalAt}ms after it, with ${openAtHealthy} held open`);
 
     if (healthyAt === null && everOpened === 0) {
@@ -193,8 +200,21 @@ describe('RFC 0215 §A — one subscription\'s receiver does not hold another\'s
       // delivery timeout released the held attempts early (its choice), or it
       // never opened FLOOR of them at once. The second is the defect, the first
       // is not, and they differ in WHEN the first held attempt closed.
-      expect(everOpened, req(ID, DOC, 'the held subscriptions\' attempts MUST have been dispatched')).toBeGreaterThan(0);
-      return softSkip('skipped', `partial-witness: the host closed held attempts ${Number.isFinite(earliestClose) ? `${terminalAt - earliestClose}ms ` : ''}before the run was terminal (its delivery timeout is shorter than this leg's ${DELAY_MS}ms delay), so ${FLOOR} attempts were not outstanding when the healthy delivery fell due — ${detail}`);
+      //
+      // Unfailable-leg audit (2026-09-26): this branch asserted everOpened > 0
+      // and then `softSkip('skipped')`, which records `executed-pass` with a
+      // `partial-witness:` detail. A serial dispatcher (pool of 1) with a
+      // sub-2s delivery timeout landed here and passed — every held attempt
+      // arrived eventually (everOpened reached FLOOR), one at a time, while the
+      // healthy attempt queued behind them: head-of-line blocking. peakOpen
+      // separates the two cases the comment above names: below FLOOR the host
+      // never had FLOOR attempts outstanding at once, which is the defect; at
+      // FLOOR the host's timeout released them early, which is unjudged.
+      expect(
+        peakOpen,
+        req(ID, DOC, `a host MUST sustain ${FLOOR} subscriptions' attempts outstanding at once — at most ${peakOpen} were ever open together, so the held attempts were dispatched below the floor — ${detail}`),
+      ).toBeGreaterThanOrEqual(FLOOR);
+      return blockedDespiteAssertions(`unjudged: ${FLOOR} held attempts were open at once, but the host closed held attempts ${Number.isFinite(earliestClose) ? `${terminalAt - earliestClose}ms ` : ''}before the run was terminal (its delivery timeout is shorter than this leg's ${DELAY_MS}ms delay), so ${FLOOR} attempts were not outstanding when the healthy delivery fell due — ${detail}`);
     } else {
       expect.fail(req(ID, DOC, `the host never had ${FLOOR} subscriptions' attempts outstanding at once, and the healthy attempt waited — a bounded dispatcher below the floor — ${detail}`));
     }

package/src/scenarios/v2-webhook-durable-delivery.test.ts

@@ -348,6 +348,22 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
             req('openwop.requirement.0173.webhook-durable-delivery', 'webhooks.md §Durability', `retry attempts for ${key} MUST be spaced by the advertised ${policy.backoff} backoff (attempt ${i + 1} followed attempt ${i} after ${times[i]! - times[i - 1]!}ms)`),
           ).toBeGreaterThan(0);
         }
+        // Unfailable-leg audit (2026-09-26): `> 0 ms` alone let a host advertising
+        // `backoff: exponential` that retried in a tight loop (any constant
+        // spacing, even a few ms) pass. An exponential backoff MUST widen, so with
+        // three or more attempts the second gap is at least 1.5x the first (not
+        // 2x: jitter tolerance). Only the first two gaps are compared, so a host
+        // whose schedule hits its cap later is not convicted. `fixed` gets no
+        // equivalent: its base interval is not on the wire (see the comment above
+        // the `!retried` branch), so there is no floor to measure against.
+        if (policy.backoff === 'exponential' && times.length >= 3) {
+          const gap1 = times[1]! - times[0]!;
+          const gap2 = times[2]! - times[1]!;
+          expect(
+            gap2,
+            req('openwop.requirement.0173.webhook-durable-delivery', 'webhooks.md §Durability', `retry attempts for ${key} MUST follow the advertised exponential backoff — the second gap (${gap2}ms) MUST be at least 1.5x the first (${gap1}ms); a constant spacing is not exponential`),
+          ).toBeGreaterThanOrEqual(1.5 * gap1);
+        }
       }
     } else {
       softSkip('inapplicable', 'no advertised retryPolicy.backoff other than none — the spacing leg is not asserted');

package/src/scenarios/v2-webhook-endpoint-verification.test.ts

@@ -38,9 +38,10 @@
 import { afterEach, describe, it, expect } from 'vitest';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { v2Validator } from '../lib/v2.js';
-import { hitHeader, mintWhsec, startModalReceiver, verifyStandardWebhooks } from '../lib/webhook-receiver.js';
+import { scaledTimeoutMs } from '../lib/polling.js';
+import { hitHeader, mintWhsec, startModalReceiver, verifyStandardWebhooks, type ModalHit } from '../lib/webhook-receiver.js';
 import {
   STANDARD_WEBHOOKS_ALG,
   deliveriesFor,
@@ -53,6 +54,9 @@ import {
 } from '../lib/standard-webhooks.js';
 
 const REFUSED = ['no-echo', 'wrong-echo', 'redirect'] as const;
+/** A second echo subscription, registered AFTER the refused modes (routed as `echo`, told apart by this trailing segment). */
+const LATE_CONTROL = 'late-control';
+const isLateControl = (h: ModalHit): boolean => h.path.split('?')[0]!.endsWith(`/echo/${LATE_CONTROL}`);
 
 let closeReceiver: (() => Promise<void>) | null = null;
 afterEach(async () => {
@@ -80,10 +84,18 @@ describe('RFC 0201 §D — endpoint verification refuses without consent (opted-
       const res = await registerSw(body(mode));
       refused.set(mode, { status: res.status, code: readErrorCode(res.json), id: (res.json as { webhookId?: unknown } | null)?.webhookId });
     }
+    // Unfailable-leg audit, 2026-09-26: the persisted-nothing check synced only
+    // on the FIRST echo subscription plus a 1 s grace, so a host that answered
+    // 400 but kept the rows, delivering serially in registration order, could
+    // land those deliveries after the window. A second echo control registered
+    // AFTER the refused modes sits behind them in that order.
+    const late = await registerSw({ ...body('echo'), url: `${rx.urlFor('echo').url}/${LATE_CONTROL}` });
 
     const ID = 'openwop.requirement.0201.endpoint-verification';
     expect(ok.status, req(ID, 'RFC 0201 §D.14', `an endpoint that echoes the challenge MUST be registered 201 (got ${ok.status} ${readErrorCode(ok.json) ?? ''})`)).toBe(201);
     const echoId = (ok.json as { webhookId: string }).webhookId;
+    expect(late.status, req(ID, 'RFC 0201 §D.14', `a second echoing endpoint (the late control) MUST be registered 201 (got ${late.status} ${readErrorCode(late.json) ?? ''})`)).toBe(201);
+    const lateId = (late.json as { webhookId: string }).webhookId;
     for (const [mode, r] of refused) {
       expect(r.status, req(ID, 'RFC 0201 §D.14', `a ${mode} endpoint MUST be refused 400 before any 201 (got ${r.status})`)).toBe(400);
       expect(r.code, req(ID, 'RFC 0201 §D.14', `a ${mode} refusal MUST carry webhook_endpoint_unverified`)).toBe('webhook_endpoint_unverified');
@@ -91,7 +103,7 @@ describe('RFC 0201 §D — endpoint verification refuses without consent (opted-
 
     const validate = v2Validator('webhook-verification');
     for (const mode of ['echo', ...REFUSED]) {
-      const vr = rx.hits.filter((h) => h.mode === mode && h.verification);
+      const vr = rx.hits.filter((h) => h.mode === mode && h.verification && !isLateControl(h));
       expect(vr.length, req(ID, 'RFC 0201 §D.13–§D.14', `the host MUST send exactly one verification request to the ${mode} endpoint and MUST NOT retry it (saw ${vr.length})`)).toBe(1);
       const h = vr[0]!;
       expect(h.method, req(ID, 'RFC 0201 §D.13', 'the verification request MUST be a POST')).toBe('POST');
@@ -113,12 +125,19 @@ describe('RFC 0201 §D — endpoint verification refuses without consent (opted-
     // delivery; by then any persisted refused subscription would have one too.
     const run = await driveRun();
     expect(run.status, req(ID, 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
-    await waitFor(() => deliveriesFor(rx.hits, echoId, run.runId).length > 0, 15_000);
+    await waitFor(() => deliveriesFor(rx.hits, echoId, run.runId).length > 0 && deliveriesFor(rx.hits, lateId, run.runId).length > 0, 15_000);
     expect(deliveriesFor(rx.hits, echoId, run.runId).length, req(ID, 'webhooks.md §Durability', 'the verified subscription MUST receive run.completed — the sync point for the persisted-nothing check')).toBeGreaterThan(0);
-    await new Promise((r) => setTimeout(r, 1_000));
+    // The late control is a SYNC POINT, not a requirement: a public receiver
+    // front that drops its extra path segment would starve it through no fault
+    // of the host. Unobserved ⇒ the persisted-nothing check is unjudged, never
+    // failed and never passed.
+    if (deliveriesFor(rx.hits, lateId, run.runId).length === 0) {
+      return blockedDespiteAssertions(`the late-control subscription (${lateId}) received no run.completed within the wait — the second sync point for the persisted-nothing check is missing, so that check is unjudged`);
+    }
+    await new Promise((r) => setTimeout(r, scaledTimeoutMs(3_000)));
     for (const mode of REFUSED) {
       const late = rx.hits.filter((h) => h.mode === mode && !h.verification);
       expect(late.length, req(ID, 'RFC 0201 §D.14', `a refused (${mode}) registration MUST persist no subscription — it received ${late.length} later request(s)`)).toBe(0);
     }
-  }, 60_000);
+  }, 75_000);
 });

package/src/scenarios/v2-webhook-message-id-stable.test.ts

@@ -31,7 +31,7 @@
 import { afterEach, describe, it, expect } from 'vitest';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { hitHeader, mintWhsec, startModalReceiver, STANDARD_WEBHOOKS_ID, type ModalHit } from '../lib/webhook-receiver.js';
 import { retryWaitCapMs, retryWaitFor } from '../lib/webhook-retry-window.js';
 import {
@@ -108,11 +108,19 @@ describe('RFC 0201 §C.10 — webhook-id is stable across retries, distinct acro
         req(ID, 'RFC 0201 §C.10', `webhook-id MUST be identical on every attempt of one (webhookId, runId, sequence) — ${attempts.length} attempts of ${key} carried ${ids.size} value(s)`),
       ).toHaveLength(1);
     }
+    // Unfailable-leg audit, 2026-09-26: the distinctness half asserted only
+    // `keys.size >= 2`, so a host coalescing the two subscriptions (or keeping a
+    // per-subscription constant id with one delivery each) passed on a partial
+    // set. Distinctness is judged only over the full expected set; fewer keys
+    // is unmeasured, and the retry-stability assertions above already ran.
+    if (keys.size < expectedKeys) {
+      return blockedDespiteAssertions(`only ${keys.size} of ${expectedKeys} expected deliveries (${subs.length} subscriptions × ${EVENTS.join(' + ')}) arrived inside the ${window}ms window — distinctness across deliveries cannot be judged on a partial set`);
+    }
     const perKey = [...keys.entries()].map(([key, a]) => ({ key, id: hitHeader(a[0]!, 'webhook-id') ?? '' }));
     for (const { key, id } of perKey) {
       expect(STANDARD_WEBHOOKS_ID.test(id), req(ID, 'RFC 0201 §C.10', `webhook-id MUST match ^[A-Za-z0-9_-]{16,128}$ (${key}: ${JSON.stringify(id)})`)).toBe(true);
     }
-    expect(keys.size, req(ID, 'RFC 0201 §C.10', `two opted-in subscriptions on ${EVENTS.join(' + ')} MUST yield ${expectedKeys} distinct deliveries of one run`)).toBeGreaterThanOrEqual(2);
+    expect(keys.size, req(ID, 'RFC 0201 §C.10', `two opted-in subscriptions on ${EVENTS.join(' + ')} MUST yield ${expectedKeys} distinct deliveries of one run`)).toBe(expectedKeys);
     expect(
       new Set(perKey.map((k) => k.id)).size,
       req(ID, 'RFC 0201 §C.10', `webhook-id MUST differ between distinct deliveries, by event and by subscription — ${perKey.length} deliveries carried ${new Set(perKey.map((k) => k.id)).size} distinct id(s)`),