@openwop/openwop-conformance 2.42.2 → 2.42.4

package/src/scenarios/v2-effect-identity-business-key.test.ts

@@ -25,7 +25,8 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { v2Discovery, gateFamily, v2Validator } from '../lib/v2.js';
 import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
+import { startEffectReceiver } from '../lib/effect-receiver.js';
 import { req } from '../lib/requirement-ids.js';
 
 const FIXTURE = 'conformance-noop';
@@ -53,24 +54,36 @@ describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)',
     const fixtures = Array.isArray(doc['fixtures']) ? (doc['fixtures'] as unknown[]) : [];
     if (!fixtures.includes(FIXTURE)) return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run to read`);
 
+    // Unfailable-leg audit (2026-09-26): the noop fixture issues no effects, so
+    // the per-row loop asserted nothing on any host, and the trailing
+    // `softSkip('inapplicable')` (called without `return`, after four passing
+    // setup asserts) recorded `executed-pass` with a `partial-witness:` detail —
+    // a host that mis-keyed every effect passed this row. Now no expect passes
+    // before the empty-ledger check: a failing setup read still fails, and an
+    // empty but well-formed ledger returns `inapplicable` with zero assertions.
     const create = await driver.post('/runs', { workflowId: FIXTURE });
-    expect(create.status, req('openwop.requirement.0173.effect-identity-business-key', 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
+    if (create.status !== 201) {
+      expect(create.status, req('openwop.requirement.0173.effect-identity-business-key', 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
+    }
     const runId = (create.json as { runId: string }).runId;
     await waitTerminal(runId, 10_000);
 
     const res = await driver.get(`/runs/${encodeURIComponent(runId)}/effects`);
+    const check = v2Validator('effect-ledger-projection')(res.json);
+    const body = res.json as { runId?: unknown; effects?: Array<{ effectId?: unknown; keying?: unknown; providerKey?: unknown }> } | null;
+    const effects = body?.effects ?? [];
+    if (res.status === 200 && check.ok && body?.runId === runId && effects.length === 0) {
+      return softSkip('inapplicable', 'the noop fixture issued no external effect — the ledger read is well-formed but the per-row keying leg had no rows (an effect-issuing fixture would exercise it)');
+    }
     expect(
       res.status,
       req('openwop.requirement.0173.effect-identity-business-key', 'security-defaults.md §Layer-2 effect identity', 'a host advertising `idempotency` MUST serve GET /runs/{runId}/effects with 200 (RFC 0173 §B)'),
     ).toBe(200);
-    const check = v2Validator('effect-ledger-projection')(res.json);
     expect(
       check.ok,
       req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json', `the ledger projection MUST validate: ${check.errors}`),
     ).toBe(true);
-    const body = res.json as { runId?: unknown; effects?: Array<{ effectId?: unknown; keying?: unknown; providerKey?: unknown }> };
-    expect(body.runId, req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json runId', 'runId MUST echo the run read')).toBe(runId);
-    const effects = body.effects ?? [];
+    expect(body?.runId, req('openwop.requirement.0173.effect-identity-business-key', 'effect-ledger-projection.schema.json runId', 'runId MUST echo the run read')).toBe(runId);
     const ids = new Set<string>();
     for (const e of effects) {
       expect(
@@ -90,7 +103,6 @@ describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)',
         ).toBe(false);
       }
     }
-    if (effects.length === 0) softSkip('inapplicable', 'the noop fixture issued no external effect — the per-row keying leg had no rows (an effect-issuing fixture would exercise it)');
   });
 
   it('the same provider key is presented across two transport retries', async () => {
@@ -98,11 +110,19 @@ describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)',
     if (!doc) return softSkip('blocked', 'discovery unreachable');
     if (!(await gateFamily('idempotency'))) return softSkip('inapplicable', 'idempotency family not advertised — no Layer-2 obligation (gate recorded under openwop.family.idempotency)');
     if (!seamsProfileAdvertised(doc)) return softSkip('inapplicable', 'the retry leg is driven through the suite fixture provider (RFC 0173 §D.2 G4) under the seams profile — seams profile not advertised');
-    // The seam is catalogued (api/seams-v2.yaml `forceEffectTransportRetry`). An
-    // unreachable providerUrl forces the transport retry; the witness is the
-    // host's own Layer-2 ledger (RFC 0173 §C.2), where every attempt of one
-    // effect MUST carry the same business-identity key.
-    const fired = await driver.post(`${SEAMS_PREFIX}/sample/test/idempotency/effect-retry`, { providerUrl: 'http://127.0.0.1:1/' });
+    // The seam is catalogued (api/seams-v2.yaml `forceEffectTransportRetry`), and
+    // its contract names the witness: "the suite fixture provider records the
+    // idempotency key of each attempt". Until 2.42.4 this leg handed the host an
+    // address nothing listened on (`http://127.0.0.1:1/`), so no suite-owned
+    // party ever saw a key, and the only witness was the host's own ledger — a
+    // host could record one constant providerKey while sending a fresh key on
+    // every attempt. The suite's own receiver now cuts the FIRST attempt's
+    // connection (a genuine transport failure, after recording its
+    // Idempotency-Key) and answers the second, so the keys compared below are
+    // the ones that crossed the wire.
+    const rx = await startEffectReceiver({ failFirst: 1 });
+    try {
+    const fired = await driver.post(`${SEAMS_PREFIX}/sample/test/idempotency/effect-retry`, { providerUrl: rx.url });
     if (fired.status === 404 || fired.status === 403 || fired.status === 405) {
       return softSkip('blocked', `the host advertises the seams profile but does not serve ${SEAMS_PREFIX}/sample/test/idempotency/effect-retry (answered ${fired.status}) — the cross-retry keying leg cannot be driven`);
     }
@@ -117,7 +137,20 @@ describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)',
     if (attempts.length < 2) {
       return softSkip('blocked', `the seam produced ${attempts.length} ledger row(s) for effect ${String(body.effectId)} — a cross-retry assertion needs at least two attempts`);
     }
-    const keys = new Set(attempts.map((e) => String(e['providerKey'] ?? '')));
+    // Unfailable-leg audit (2026-09-26): `providerKey` is optional in the ledger
+    // schema and `?? ''` folded a missing key to '', so a host that recorded no
+    // provider key on any attempt showed "one distinct key" and passed. Every
+    // attempt now MUST carry a non-empty key. Remaining limit: the witness is
+    // still the host's own ledger; a suite-owned receiver counting the
+    // Idempotency-Key header on the wire (lib/effect-receiver.ts) is the
+    // stronger follow-up, not done here.
+    for (const a of attempts) {
+      expect(
+        typeof a['providerKey'] === 'string' && (a['providerKey'] as string).length > 0,
+        req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `every attempt of one effect MUST record the provider key it presented — attempt ${String(a['attempt'])} recorded ${JSON.stringify(a['providerKey'] ?? null)}`),
+      ).toBe(true);
+    }
+    const keys = new Set(attempts.map((e) => String(e['providerKey'])));
     expect(
       keys.size,
       req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `every attempt of one effect MUST present the same provider key across a transport retry — ${attempts.length} attempt(s) presented ${keys.size} distinct key(s)`),
@@ -142,5 +175,30 @@ describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)',
       keyings.size,
       req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `every attempt of one effect MUST declare the same keying — ${attempts.length} attempt(s) declared ${[...keyings].join(', ')}`),
     ).toBe(1);
+    // The wire half: what the provider actually received.
+    const deadline = Date.now() + 10_000;
+    while (rx.arrivals() < 2 && Date.now() < deadline) await new Promise((r) => setTimeout(r, 100));
+    const wire = rx.all().filter((a) => a.mine);
+    if (wire.length < 2) {
+      return blockedDespiteAssertions(`the suite's fixture provider saw ${wire.length} attempt(s) at ${rx.url} (local ${rx.localUrl}${rx.tunnelled ? ', tunnelled' : ''}) while the ledger records ${attempts.length} — the host's attempts did not reach the suite's receiver, so the keys on the wire are unobserved`);
+    }
+    for (const a of wire) {
+      expect(
+        typeof a.idempotencyKey === 'string' && a.idempotencyKey.length > 0,
+        req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `every attempt MUST present an Idempotency-Key to the provider — an attempt at ${a.path} carried ${JSON.stringify(a.idempotencyKey ?? null)}`),
+      ).toBe(true);
+    }
+    const wireKeys = new Set(wire.map((a) => a.idempotencyKey));
+    expect(
+      wireKeys.size,
+      req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `the provider MUST see the same Idempotency-Key on every attempt of one effect — ${wire.length} attempt(s) on the wire carried ${wireKeys.size} distinct key(s)`),
+    ).toBe(1);
+    expect(
+      [...wireKeys][0],
+      req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', 'the key the ledger records MUST be the key the provider received — a ledger that disagrees with the wire is not a witness'),
+    ).toBe([...keys][0]);
+    } finally {
+      await rx.close();
+    }
   });
 });

package/src/scenarios/v2-effect-seam-manifest.test.ts

@@ -95,15 +95,9 @@ describe('RFC 0173 §C.1 — effect-seam-manifest (gated on replay)', () => {
         ).toBe(true);
       }
     }
-    // One row per kind the host declares: the set of kinds the manifest names is
-    // the host's declaration, and each named kind is backed by at least one row.
-    const declared = new Set(rows.map((r) => String(r.kind)));
-    for (const kind of declared) {
-      expect(
-        rows.filter((r) => r.kind === kind).length,
-        req('openwop.requirement.0173.effect-seam-manifest', 'RFC 0173 §C.1', `at least one manifest row per declared kind (${kind})`),
-      ).toBeGreaterThanOrEqual(1);
-    }
+    // Unfailable-leg audit (2026-09-26): a "one row per declared kind" loop stood
+    // here, but it built the declared set FROM the rows, so every host passed it.
+    // The manifest has no kind declaration independent of its rows; removed.
     // RFC 0140 G6: a `branch` re-fire is stated as a permission, and a permission
     // for a mode the host does not offer is a claim about nothing.
     const modes = Array.isArray(replay['modes']) ? (replay['modes'] as unknown[]) : [];

package/src/scenarios/v2-era-2-append-vocabulary.test.ts

@@ -28,7 +28,7 @@
 import { describe, it, expect } from 'vitest';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery } from '../lib/v2.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
 import { codemapV1toV2, era2Gate, eventsOf, pollEvents, seedEra2Log, v1FixtureLog, type ReadEvent } from '../lib/era2-seed.js';
@@ -76,12 +76,31 @@ describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () =>
       return softSkip('blocked', `seedEra2Log reported success but the log reads back empty (0 events) — the seam's return value is not evidence that a log exists, and without a seeded era-2 log the writer rule is unwitnessed here`);
     }
 
+    // unfailable-leg audit, 2026-09-26: cancel was the ONLY write driven, and
+    // it appends run.cancelled (and node.cancelled) — names the codemap spells
+    // identically in v1 and v2. A host writing v2 names into an era-2 log
+    // therefore produced the same rows as one writing v1 names, and the leg
+    // recorded executed-pass either way. The discriminator needs a type the
+    // codemap RENAMES. Best effort first: pause then resume the seeded run
+    // through the core :pause / :resume operations (runs.md §Pause and
+    // resume), which gives a host that records the resume transition a chance
+    // to append `run.resuming` (v1) — read back as `run.resume-started` (v2).
+    // Neither answer is asserted: the resume transition's event set is not
+    // pinned to a renamed type, and a seeded run's pause is host latitude. If
+    // no renamed type is appended, the leg records `blocked` below, not a pass.
+    const enc = encodeURIComponent(runId);
+    const paused = await http(() => driver.post(`/runs/${enc}:pause`, { reason: 'conformance', drainPolicy: 'immediate' }));
+    const resumed = paused?.status === 202 ? await http(() => driver.post(`/runs/${enc}:resume`, { reason: 'conformance' })) : null;
+
     // One canonical mutation so the HOST's own writer appends. Cancel is the
     // universally available terminal transition; a host that refuses it on a
-    // seeded run records `blocked` rather than a pass.
-    const cancelled = await http(() => driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {}));
-    if (cancelled === null || (cancelled.status !== 200 && cancelled.status !== 202 && cancelled.status !== 204)) {
-      return softSkip('blocked', `POST /runs/{runId}/cancel answered ${cancelled?.status ?? 'no response'} on a seeded era-2 run — no canonical mutation drove the host's writer, so the append is unwitnessed`);
+    // seeded run records `blocked` rather than a pass — unless the pause and
+    // resume above were both accepted, which already drove the host's writer.
+    const cancelled = await http(() => driver.post(`/runs/${enc}/cancel`, {}));
+    const cancelOk = cancelled !== null && (cancelled.status === 200 || cancelled.status === 202 || cancelled.status === 204);
+    const pauseResumeOk = paused?.status === 202 && resumed?.status === 202;
+    if (!cancelOk && !pauseResumeOk) {
+      return softSkip('blocked', `POST /runs/{runId}/cancel answered ${cancelled?.status ?? 'no response'} on a seeded era-2 run (pause ${paused?.status ?? 'no response'}, resume ${resumed?.status ?? 'not attempted'}) — no canonical mutation drove the host's writer, so the append is unwitnessed`);
     }
 
     const after = await pollEvents(runId);
@@ -128,6 +147,19 @@ describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () =>
         req(ID, DOC, `the appended rows continue the seeded sequence space without a gap or restart (expected ${i}, got ${String(seqs[i])})`),
       ).toBe(i);
     }
+
+    // unfailable-leg audit, 2026-09-26: the vocabulary is only observable
+    // through a type the codemap renames. An appended row that reads back under
+    // a RENAMED v2 name (v2 ≠ v1) through a successful translated read is the
+    // positive witness: the stored spelling was the v1 one the reader maps
+    // from. When every appended type is spelled the same in both vocabularies,
+    // the rows above hold for a v1-writing and a v2-writing host alike, so the
+    // writer rule is unobserved — `blocked`, not a pass.
+    const renamedV2 = new Set([...codemapV1toV2()].filter(([v1, v2]) => v1 !== v2).map(([, v2]) => v2));
+    const appendedTypes = rows.slice(seedCount).map((r) => String(r.type ?? ''));
+    if (!appendedTypes.some((t) => renamedV2.has(t))) {
+      return blockedDespiteAssertions(`every type the host appended to the era-2 log (${appendedTypes.join(', ') || 'none'}) is spelled identically in v1 and v2 (spec/v2/event-codemap.json), so a host writing v2 names reads back the same as one writing v1 names — the writer rule is unobserved. The leg needs a canonical mutation that appends a renamed type (e.g. run.resuming → run.resume-started); pause ${paused?.status ?? 'no response'} / resume ${resumed?.status ?? 'not attempted'} on the seeded run appended none, and the seed seam (api/seams-v2.yaml seedEra2EventLog) cannot seed a paused or interrupt-suspended era-2 run to resume.`);
+    }
   });
 
   it('the run keeps the era it was created with; an append does not promote it to era 3', async () => {
@@ -139,16 +171,27 @@ describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () =>
     if (!seeded.ok) return softSkip(seeded.kind, seeded.reason);
     const runId = seeded.runId;
 
-    await http(() => driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {}));
+    // unfailable-leg audit, 2026-09-26: the cancel's answer was ignored, so a
+    // host that refused it (no append at all) still had its unappended run's
+    // era read as the witness of "an append does not promote".
+    const cancelled = await http(() => driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {}));
+    if (cancelled === null || (cancelled.status !== 200 && cancelled.status !== 202 && cancelled.status !== 204)) {
+      return softSkip('blocked', `POST /runs/{runId}/cancel answered ${cancelled?.status ?? 'no response'} on a seeded era-2 run — nothing was appended, so whether an append promotes the era is unwitnessed`);
+    }
 
     const snap = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`));
     if (snap === null || snap.status !== 200) {
       return softSkip('blocked', `GET /runs/{runId} answered ${snap?.status ?? 'no response'} — the era key cannot be read back`);
     }
     const era = (snap.json as { eventLogSchemaVersion?: unknown } | null)?.eventLogSchemaVersion;
+    // unfailable-leg audit, 2026-09-26: `era === undefined` was accepted, so a
+    // host that dropped the era key from the snapshot passed. runs.md §getRun
+    // and persistence.md make eventLogSchemaVersion REQUIRED on every v2 run
+    // snapshot (schemas/v2/run-snapshot.schema.json `required`); absent ⇒ 2 is
+    // the STORAGE rule, not a wire latitude.
     expect(
-      era === undefined || era === 2,
-      req(ID, DOC, `the era key is fixed at run creation: a run seeded in era 2 and then appended to MUST still read as era 2 (got ${String(era)}) — promoting it to 3 would strand the seeded rows in a vocabulary the reader no longer translates`),
-    ).toBe(true);
+      era,
+      req(ID, DOC, `the era key is fixed at run creation: a run seeded in era 2 and then appended to MUST still read as era 2 (got ${String(era)}) — promoting it to 3 would strand the seeded rows in a vocabulary the reader no longer translates, and the snapshot MUST carry eventLogSchemaVersion (runs.md §getRun)`),
+    ).toBe(2);
   });
 });

package/src/scenarios/v2-idempotency-in-flight.test.ts

@@ -106,6 +106,12 @@ describe('v2 idempotency-in-flight (idempotency.md Concurrency, RFC 0213 §B)',
     const r = await theRace();
     if (r.kind === 'blocked') return softSkip('blocked', r.reason);
     expect(r.successes.length, req(ID_ONE, DOC, `at least one of ${N} same-key creates MUST complete (statuses: ${r.all.map((x) => x.status).join(',')})`)).toBeGreaterThan(0);
+    // unfailable-leg audit wave 2, 2026-09-27: non-string runIds were FILTERED
+    // before the distinct-count, so a host answering the winner `201 {runId}`
+    // and every loser `201 {}` (a success that names no run — possibly a second
+    // one) passed. Every success MUST name the run it created or replayed.
+    const withoutRunId = r.successes.filter((x) => typeof (x.json as { runId?: unknown } | null)?.runId !== 'string');
+    expect(withoutRunId.length, req(ID_ONE, DOC, `every same-key success MUST carry the string runId of the one run processed (${withoutRunId.length} of ${r.successes.length} did not; statuses ${withoutRunId.map((x) => x.status).join(',')})`)).toBe(0);
     const runIds = new Set(r.successes.map((x) => (x.json as { runId?: unknown } | null)?.runId).filter((x): x is string => typeof x === 'string'));
     expect(runIds.size, req(ID_ONE, DOC, `a host MUST NOT process two same-key requests: distinct runIds ${[...runIds].join(', ')}`)).toBe(1);
   }, 60_000);
@@ -115,6 +121,16 @@ describe('v2 idempotency-in-flight (idempotency.md Concurrency, RFC 0213 §B)',
     if (r.kind === 'blocked') return softSkip('blocked', r.reason);
     const unmarked = r.successes.filter((x) => x.headers.get('openwop-idempotent-replay') !== 'true');
     expect(unmarked.length, req(ID_LOSER, DOC, `exactly one success is the winner; every other MUST carry OpenWOP-Idempotent-Replay: true (${unmarked.length} of ${r.successes.length} unmarked)`)).toBe(1);
+    // unfailable-leg audit wave 2, 2026-09-27: a marked replay was never
+    // compared to the winner, so a loser answered `201` + the replay header
+    // over a DIFFERENT (or no) runId passed. §Concurrency: the loser receives
+    // "the winner's response" — the same runId.
+    const winnerRunId = (unmarked[0]?.json as { runId?: unknown } | null)?.runId;
+    const replayRunIds = r.successes.filter((x) => x !== unmarked[0]).map((x) => (x.json as { runId?: unknown } | null)?.runId);
+    expect(
+      { winnerIsString: typeof winnerRunId === 'string', mismatched: replayRunIds.filter((id) => id !== winnerRunId).map(String) },
+      req(ID_LOSER, DOC, `a loser that waits MUST receive the winner's response — every marked replay MUST carry the winner's runId (${String(winnerRunId)})`),
+    ).toEqual({ winnerIsString: true, mismatched: [] });
     for (const x of r.refusals) {
       const code = readErrorCode(x.json);
       expect({ status: x.status, code }, req(ID_LOSER, DOC, `a loser that is not a replay MUST be 409 idempotency_in_flight (got ${x.status} ${String(code)})`)).toEqual({ status: 409, code: 'idempotency_in_flight' });

package/src/scenarios/v2-interop-trace-context.test.ts

@@ -327,6 +327,29 @@ describe('RFC 0207 — the receiver rule (host as MCP server / A2A server)', ()
     try {
       expect(r.error, req(A2A_MALFORMED, DOC, `a malformed traceparent MUST be ignored, never a request failure — SendMessage answered error ${JSON.stringify(r.error)}`)).toBeUndefined();
       expect(r.result, req(A2A_MALFORMED, DOC, 'SendMessage MUST answer a normal result')).toBeDefined();
+      // unfailable-leg audit, 2026-09-26: only the JSON-RPC envelope was held,
+      // so a host that accepted SendMessage but failed (or rejected) the task
+      // because it could not parse the traceparent passed. "Ignored" means the
+      // task proceeds as if no traceparent were sent — the A2A sibling of the
+      // MCP leg's isError check. Read the returned Task (result.task or a bare
+      // Task) and, when it names an id, GetTask once more after a beat so a
+      // failure recorded just after the response is seen too. A Message result
+      // carries no task state and is not a failure.
+      const FAILED = new Set(['TASK_STATE_FAILED', 'TASK_STATE_REJECTED', 'failed', 'rejected']);
+      const stateOf = (res: Record<string, unknown> | undefined): string | undefined => {
+        const task = (res?.['task'] ?? res) as { status?: { state?: unknown } } | undefined;
+        const st = task?.status?.state;
+        return typeof st === 'string' ? st : undefined;
+      };
+      const first = stateOf(r.result);
+      expect(first !== undefined && FAILED.has(first), req(A2A_MALFORMED, DOC, `a malformed traceparent MUST be ignored — the task SendMessage returned is ${String(first)}; the malformed value failed the task instead of starting a new trace`)).toBe(false);
+      const id = ((r.result?.['task'] as { id?: unknown } | undefined)?.id ?? r.result?.['id']) as unknown;
+      if (typeof id === 'string') {
+        await sleep(500);
+        const again = await a2aCall(t.url, 'GetTask', { id }, {}).catch(() => null);
+        const later = again?.error === undefined ? stateOf(again?.result) : undefined;
+        expect(later !== undefined && FAILED.has(later), req(A2A_MALFORMED, DOC, `a malformed traceparent MUST be ignored — GetTask shows the task ${String(later)} after the SendMessage that carried it`)).toBe(false);
+      }
     } finally {
       await cancelTask(t.url, r);
     }

package/src/scenarios/v2-mcp-tasks.test.ts

@@ -37,6 +37,7 @@ import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { loadEnv } from '../lib/env.js';
 import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
+import { scaledTimeoutMs } from '../lib/polling.js';
 
 export const HOST_CALLBACK_NOT_REQUIRED = 'the suite is the MCP client: every leg POSTs JSON-RPC to the mount the host advertises in mcp.serverUrls; nothing harness-hosted is handed to the host';
 
@@ -306,7 +307,16 @@ describe('RFC 0198 — v2-mcp-tasks (MCP Tasks on the server mount; disconnect c
     const f = await createTask(m.url, 'conformance-failure');
     let terminal: Rpc;
     if (f.result?.['resultType'] === 'task') terminal = await pollTask(m.url, String(f.result['taskId']), (s) => ['completed', 'failed', 'cancelled'].includes(s), 10_000);
-    else return softSkip('inapplicable', 'conformance-failure finished before the host answered, so it was answered CallToolResult (RFC 0198 §B.4) — no task to project');
+    else {
+      // unfailable-leg audit wave 2, 2026-09-27: this branch returned
+      // softSkip('inapplicable') after the input_required asserts — a
+      // partial-witness PASS at both majors even when the synchronous answer
+      // was NOT a tool-error outcome. The synchronous CallToolResult of a
+      // failed run MUST still carry isError true; the task projection itself
+      // was not observed, so the row is `blocked` (stands at major 2).
+      expect((f.result as { isError?: unknown } | undefined)?.isError, req(ID_TASK_STATUS_PROJECTION, 'RFC 0198 §B.4; ext-tasks §Task Execution Errors', `a failed run answered synchronously is a CallToolResult with isError true (got ${JSON.stringify(f.error ?? f.result)})`)).toBe(true);
+      return softSkip('blocked', 'conformance-failure finished before the host answered, so it was answered CallToolResult (RFC 0198 §B.4) — the failed-run task-status projection was not observed');
+    }
     expect([terminal.result?.['status'], (terminal.result?.['result'] as { isError?: unknown } | undefined)?.isError], req(ID_TASK_STATUS_PROJECTION, 'interop-map.json mcp.tasks.status failed; ext-tasks §Task Execution Errors', `a failed run is a tool outcome: completed with result.isError true, never failed (got ${JSON.stringify(terminal.result)})`)).toEqual(['completed', true]);
   });
 
@@ -343,9 +353,21 @@ describe('RFC 0198 — v2-mcp-tasks (MCP Tasks on the server mount; disconnect c
     expect(key, req(ID_TASK_UPDATE_APPROVER_CHECKED, 'interop-map.json mcp.tasks.status', `the approvers task is input_required (got ${JSON.stringify(t.error ?? t.result)})`)).toBeDefined();
     const u = await call(m.url, 'tasks/update', { taskId, inputResponses: { [key!]: { action: 'accept', content: { action: 'accept' } } } });
     expect(u.error === undefined || u.error.code === INVALID_PARAMS, req(ID_TASK_UPDATE_APPROVER_CHECKED, 'interop-map.json mcp.tasks.methods tasks/update', `a non-approver's update is acknowledged or -32602, never an internal error (got ${JSON.stringify(u.error)})`)).toBe(true);
-    await new Promise((ok) => setTimeout(ok, 750));
-    expect(await runStatus(unproject(taskId)), req(ID_TASK_UPDATE_APPROVER_CHECKED, `${DOC}; interrupt.md §Approver enforcement; RFC 0198 §E.7`, 'the interrupt stays open: the run is still waiting-approval')).toBe('waiting-approval');
-    expect((await events(unproject(taskId))).filter((e) => e.type === 'interrupt.resolved').length, req(ID_TASK_UPDATE_APPROVER_CHECKED, 'interrupt.md §Approver enforcement', 'no interrupt.resolved is recorded')).toBe(0);
+    // Unfailable-leg audit, 2026-09-26: the negative evidence was read once
+    // after a fixed 750 ms, so a host applying the non-approver's update
+    // asynchronously after that passed. It is now held for a scaled ~3 s: the
+    // run must stay waiting-approval with zero interrupt.resolved on every read.
+    const holdUntil = Date.now() + scaledTimeoutMs(3_000);
+    let status: unknown;
+    let resolvedCount = 0;
+    for (;;) {
+      status = await runStatus(unproject(taskId));
+      resolvedCount = (await events(unproject(taskId))).filter((e) => e.type === 'interrupt.resolved').length;
+      if (status !== 'waiting-approval' || resolvedCount !== 0 || Date.now() >= holdUntil) break;
+      await new Promise((ok) => setTimeout(ok, 250));
+    }
+    expect(status, req(ID_TASK_UPDATE_APPROVER_CHECKED, `${DOC}; interrupt.md §Approver enforcement; RFC 0198 §E.7`, 'the interrupt stays open: the run is still waiting-approval')).toBe('waiting-approval');
+    expect(resolvedCount, req(ID_TASK_UPDATE_APPROVER_CHECKED, 'interrupt.md §Approver enforcement', 'no interrupt.resolved is recorded')).toBe(0);
     await call(m.url, 'tasks/cancel', { taskId });
   });
 
@@ -484,13 +506,18 @@ describe('RFC 0198 — v2-mcp-tasks (MCP Tasks on the server mount; disconnect c
     const ac = new AbortController();
     const resP = fetch(m.url, { method: 'POST', signal: ac.signal, headers: headersFor('tools/call', 'conformance-cancellable', undefined, 'text/event-stream, application/json'), body: JSON.stringify(envelope('tools/call', { name: 'conformance-cancellable', arguments: { delayMs: 20_000 } }, {})) });
     const runId = await freshRun('conformance-cancellable', before, 3000);
-    expect(runId, req(ID_NO_SERVER_CANCELLED, 'interop-map.json mcp.methods tools/call', 'the tools/call started a run listRuns shows')).not.toBeNull();
     const res = await resP;
+    // unfailable-leg audit wave 2, 2026-09-27: the runId assert used to run
+    // BEFORE this content-type gate, so a JSON-answering mount (which cannot
+    // carry notifications/cancelled at all) recorded a partial-witness PASS
+    // for "carries no notifications/cancelled". The gate now precedes any
+    // assertion, so the JSON mount is cleanly inapplicable.
     if (!(res.headers.get('content-type') ?? '').includes('text/event-stream')) {
       ac.abort();
-      await driver.post(`/runs/${encodeURIComponent(runId!)}/cancel`, {});
+      if (runId !== null) await driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {});
       return softSkip('inapplicable', 'the mount answered the blocking call as JSON, not SSE — a JSON response cannot carry a notifications/cancelled frame');
     }
+    expect(runId, req(ID_NO_SERVER_CANCELLED, 'interop-map.json mcp.methods tools/call', 'the tools/call started a run listRuns shows')).not.toBeNull();
     const cancel = await driver.post(`/runs/${encodeURIComponent(runId!)}/cancel`, {});
     expect(cancel.status, req(ID_NO_SERVER_CANCELLED, 'runs.md §Cancel', `REST cancelRun is accepted (got ${cancel.status})`)).toBeLessThan(300);
     const msgs: Array<Record<string, unknown>> = [];

package/src/scenarios/v2-min-client-version.test.ts

@@ -18,7 +18,7 @@ import { describe, it, expect } from 'vitest';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery, v2Validator } from '../lib/v2.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 
 const DOC = 'spec/v2/core/versioning.md §1.5';
@@ -40,6 +40,16 @@ describe('v2 min-client-version (RFC 0172 §A.5 — gated on minClientVersion)',
     expect(typeof floor === 'string' && VERSION.test(floor), req('openwop.requirement.0172.min-client-version', DOC, 'minClientVersion MUST use the <major>.<minor> grammar (axis 15, as axis 1)')).toBe(true);
     const res = await http(() => driver.get('/.well-known/openwop', { authenticated: false, headers: { 'OpenWOP-Client-Version': '0.0.1' } }));
     if (res === null) return softSkip('blocked', 'GET /.well-known/openwop with OpenWOP-Client-Version unreachable (fetch failed)');
+    // unfailable-leg audit wave 2, 2026-09-27: every non-426 answer — including
+    // a 4xx/5xx that refused the client in an unregistered form — recorded
+    // `inapplicable` AFTER the grammar assert, i.e. a partial-witness PASS of
+    // the 426 refusal row. Only a SERVED request (2xx) is the MAY exercised; any
+    // other non-426 answer is `blocked`. Not asserted as a failure:
+    // `OpenWOP-Client-Version` is not yet declared in api/v2/openapi.yaml /
+    // headers.md, so a non-2xx here is not provably a version refusal.
+    if (res.status !== 426 && (res.status < 200 || res.status >= 300)) {
+      return blockedDespiteAssertions(`the host advertises minClientVersion ${String(floor)} and answered ${res.status} to a client announcing 0.0.1 — neither served (the MAY) nor refused with the registered 426 client_version_unsupported; the refusal form was not observed`);
+    }
     if (res.status !== 426) return softSkip('inapplicable', `the host advertises minClientVersion ${String(floor)} but served a client announcing 0.0.1 (${res.status}) — refusal is a MAY; nothing further is observable`);
     expect(readErrorCode(res.json), req('openwop.requirement.0172.min-client-version', DOC, 'a 426 refusal MUST carry client_version_unsupported')).toBe('client_version_unsupported');
     const r = v2Validator('error-envelope')(res.json);

package/src/scenarios/v2-mrtr-rounds-ceiling.test.ts

@@ -97,5 +97,16 @@ describe('RFC 0175 §E.1 — mrtr-rounds-ceiling (gated on mcp + mrtr)', () => {
       served.length,
       req('openwop.requirement.0175.mrtr-rounds-ceiling.refused', 'interop.md §The MCP round ceiling', `the host MUST NOT issue a retry beyond the ceiling — the server saw ${served.length} tools/call for a ceiling of ${String(maxRounds)}`),
     ).toBeLessThanOrEqual((maxRounds as number) + 1);
+    // unfailable-leg audit, 2026-09-26: only the upper bound was enforced, so a
+    // host that answered 422 mcp_mrtr_rounds_exceeded at round 1 (or refused
+    // every MRTR tool result outright) passed. Under the fake's counting, call
+    // k (k = 1..maxRounds+1) answers the k-th input_required; a host honouring
+    // the ceiling answers the first maxRounds of them (maxRounds retries) and
+    // refuses the (maxRounds + 1)-th — exactly maxRounds + 1 tools/call. Fewer
+    // means the refusal came BEFORE the ceiling.
+    expect(
+      served.length,
+      req('openwop.requirement.0175.mrtr-rounds-ceiling.refused', 'interop.md §The MCP round ceiling', `the refusal MUST come at the ceiling, not before: rounds 1..${String(maxRounds)} are within maxRounds and MUST be answered, so the server MUST see ${rounds} tools/call (the initial call + ${String(maxRounds)} retries) — it saw ${served.length}`),
+    ).toBeGreaterThanOrEqual(rounds);
   });
 });

package/src/scenarios/v2-poll-cursor-v2.test.ts

@@ -14,7 +14,7 @@ import { describe, it, expect } from 'vitest';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery } from '../lib/v2.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 
 const DOC = 'spec/v2/core/events.md §Poll';
@@ -32,19 +32,24 @@ async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse
   try { return await fn(); } catch { return null; }
 }
 
-async function terminalRun(): Promise<{ runId: string } | { reason: string }> {
+async function terminalRun(): Promise<{ runId: string; terminal: boolean } | { reason: string }> {
   if (!(await discovery())) return { reason: 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0' };
   const created = await http(() => driver.post('/runs', { workflowId: NOOP_WORKFLOW_ID }));
   if (created === null) return { reason: 'POST /runs unreachable (fetch failed)' };
   const runId = (created.json as { runId?: unknown } | undefined)?.runId;
   if (created.status !== 201 || typeof runId !== 'string') return { reason: `POST /runs {workflowId: ${NOOP_WORKFLOW_ID}} answered ${created.status} ${readErrorCode(created.json) ?? ''} — the smallest valid create was refused (fixture not seeded?)`.trim() };
+  // unfailable-leg audit, 2026-09-26: the helper used to return the run even
+  // when the deadline lapsed with it still running, so the shape leg could not
+  // hold a host to isTerminal:true. It now reports whether it actually saw a
+  // terminal snapshot status.
   const deadline = Date.now() + TIMEOUT_MS;
+  let terminal = false;
   while (Date.now() < deadline) {
     const snap = await http(() => driver.get(`/runs/${encodeURIComponent(runId)}`));
-    if (snap !== null && TERMINAL.has(String((snap.json as { status?: unknown } | undefined)?.status))) break;
+    if (snap !== null && TERMINAL.has(String((snap.json as { status?: unknown } | undefined)?.status))) { terminal = true; break; }
     await new Promise((r) => setTimeout(r, 250));
   }
-  return { runId };
+  return { runId, terminal };
 }
 
 async function poll(runId: string, query: string): Promise<OpenWOPResponse | null> {
@@ -60,6 +65,7 @@ describe('v2 poll-cursor-v2 (RFC 0171 §E.2)', () => {
   it('the response is the closed { runId, events, lastSequence, status, isTerminal }', async () => {
     const r = await terminalRun();
     if ('reason' in r) return softSkip('blocked', r.reason);
+    if (!r.terminal) return softSkip('blocked', `the ${NOOP_WORKFLOW_ID} run did not reach a terminal snapshot status within ${TIMEOUT_MS} ms — isTerminal/status/lastSequence cannot be held to a settled log`);
     const res = await poll(r.runId, '');
     if (res === null) return softSkip('blocked', 'GET /runs/{runId}/events/poll unreachable (fetch failed)');
     expect(res.status, req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, 'pollRunEvents MUST answer 200')).toBe(200);
@@ -70,8 +76,25 @@ describe('v2 poll-cursor-v2 (RFC 0171 §E.2)', () => {
     expect(Number.isInteger(body?.lastSequence) && (body?.lastSequence as number) >= -1, req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, 'lastSequence is the highest sequence in the log (−1 when empty)')).toBe(true);
     expect(typeof body?.status, req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, 'status is the snapshot status')).toBe('string');
     expect(typeof body?.isTerminal, req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, 'isTerminal is a boolean')).toBe('boolean');
+    // unfailable-leg audit, 2026-09-26: status and isTerminal were checked only
+    // for type, so a host answering isTerminal:false (or status "running") for
+    // a run whose snapshot is terminal passed. The run was observed terminal
+    // above, so the poll MUST say so.
+    expect(TERMINAL.has(String(body?.status)), req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, `status is the snapshot status: the run was observed terminal, so status MUST be one of ${[...TERMINAL].join('/')}; got ${String(body?.status)}`)).toBe(true);
+    expect(body?.isTerminal, req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, 'isTerminal is whether the run is terminal: the run was observed terminal, so isTerminal MUST be true')).toBe(true);
+    // unfailable-leg audit, 2026-09-26: the old check was max(seqs) ≤
+    // lastSequence, so a host answering max+1 (or any larger number) passed.
+    // lastSequence is the highest sequence IN THE LOG; a cursor-less poll
+    // carries the whole log, so once the log is confirmed quiescent (a second
+    // whole-log read returns the same sequences) lastSequence MUST equal the
+    // highest returned sequence, or −1 when the log is empty.
     const seqs = sequences(body);
-    if (seqs.length > 0) expect(Math.max(...seqs), req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, 'lastSequence MUST equal the highest sequence returned when the response carries the whole log')).toBeLessThanOrEqual(body?.lastSequence as number);
+    const settled = await poll(r.runId, '');
+    const seqsAfter = settled !== null && settled.status === 200 ? sequences(settled.json) : null;
+    if (seqsAfter === null || seqsAfter.join(',') !== seqs.join(',')) {
+      return blockedDespiteAssertions(`the event log grew between two whole-log reads (before: [${seqs.join(',')}], after: [${seqsAfter?.join(',') ?? 'unreadable'}]) — a run at terminal STATUS is still appending, so lastSequence cannot be compared to a settled log. Re-run against a quiescent log.`);
+    }
+    expect(body?.lastSequence, req('openwop.requirement.0171.poll-cursor-v2.shape', DOC, `lastSequence MUST equal the highest sequence in the log (−1 when empty); the whole-log poll returned [${seqs.join(', ')}]`)).toBe(seqs.length > 0 ? Math.max(...seqs) : -1);
   });
 
   it('omitting the cursor returns from the first event (sequence 0)', async () => {

package/src/scenarios/v2-profiles-derived-only.test.ts

@@ -28,8 +28,13 @@ async function discovery(): Promise<Record<string, unknown> | null> {
   try { return await v2Discovery(); } catch { return null; }
 }
 
+// Unfailable-leg audit, 2026-09-26: this checked `status` alone, so a bare
+// `{status}` object passed as a capability record. capabilities.md §2 makes
+// `status`, `since` and `witness` all REQUIRED, so all three are checked.
 function isRecord(v: unknown): v is Record<string, unknown> {
-  return v !== null && typeof v === 'object' && !Array.isArray(v) && typeof (v as Record<string, unknown>)['status'] === 'string';
+  if (v === null || typeof v !== 'object' || Array.isArray(v)) return false;
+  const r = v as Record<string, unknown>;
+  return typeof r['status'] === 'string' && typeof r['since'] === 'string' && typeof r['witness'] === 'string';
 }
 
 /** RFC 0169 §C.1 — the predicate, evaluated over the document alone. */
@@ -60,7 +65,9 @@ describe('v2 profiles-derived-only (RFC 0169 §C.1, §C.3)', () => {
           expect(isRecord(doc[f]), req('openwop.requirement.0169.profiles-derived-only.derivable', DOC, `profile ${p.id} lists family ${f}; the host advertises it, so it MUST be one capability record {status, since, witness, …}`)).toBe(true);
         }
       }
-      expect(typeof derive(doc, p), req('openwop.requirement.0169.profiles-derived-only.derivable', DOC, `profile ${p.id} MUST be decidable from the document alone`)).toBe('boolean');
+      // Unfailable-leg audit, 2026-09-26: a `typeof derive(...) === 'boolean'`
+      // assertion stood here; `derive` always returns a boolean, so it passed
+      // every host. Decidability is carried by the record check above.
     }
     const core = rows.find((p) => p.id === 'openwop-discovery-core');
     if (core !== undefined) {

package/src/scenarios/v2-run-diff-identical.test.ts

@@ -12,7 +12,10 @@
  * `schemas/v2/run-diff-response.schema.json` and echo both ids in `a` / `b`
  * (a host answering `{}` to any pair fails there); and, when
  * `conformance-failure` is advertised, a noop-vs-failure diff MUST diverge.
- * Without that fixture the divergence control records `inapplicable`.
+ * Without that fixture the divergence control cannot run and the leg records
+ * `blocked` (`blockedDespiteAssertions`): a host answering a constant
+ * `{a, b, divergedAtSeq: null, eventDiffs: []}` to every pair would otherwise
+ * pass on the identical-logs assertions alone.
  *
  * @see spec/v2/core/runs.md §Diff and ancestry
  * @see schemas/v2/run-diff-response.schema.json
@@ -23,7 +26,7 @@ import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery, v2Validator } from '../lib/v2.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 
 const ID = 'openwop.requirement.0170.run-diff-identical';
@@ -65,10 +68,15 @@ describe('v2 run-diff-identical (runs.md §Diff and ancestry)', () => {
     expect([d.a, d.b], req(ID, DOC, 'the response MUST name the two runs it compared')).toEqual([a.runId, b.runId]);
     expect(d.divergedAtSeq, req(ID, DOC, `identical logs MUST yield divergedAtSeq: null (got ${String(d.divergedAtSeq)}) — eventId, runId, timestamp and other run-scoped fields MUST be excluded from the comparison`)).toBeNull();
     expect(d.eventDiffs, req(ID, DOC, 'identical logs MUST yield empty eventDiffs')).toEqual([]);
-    if (!isFixtureAdvertised(FAILURE)) return softSkip('inapplicable', `${FAILURE} fixture not advertised — the divergence control (a noop-vs-failure diff MUST diverge) cannot run`);
-    const f = await createSettled(FAILURE); if ('reason' in f) return softSkip('blocked', f.reason);
+    // unfailable-leg audit wave 2, 2026-09-27: without the divergence control,
+    // these returns were plain softSkips AFTER the identical-logs asserts, so a
+    // host answering a constant `divergedAtSeq: null, eventDiffs: []` to every
+    // pair recorded a (partial-witness) pass. The identical-logs result is only
+    // evidence once a different pair is seen to diverge — else `blocked`.
+    if (!isFixtureAdvertised(FAILURE)) return blockedDespiteAssertions(`${FAILURE} fixture not advertised — the divergence control (a noop-vs-failure diff MUST diverge) cannot run, so the identical-logs result is not evidence`);
+    const f = await createSettled(FAILURE); if ('reason' in f) return blockedDespiteAssertions(f.reason);
     const dv = await http(() => driver.get(`/runs/${enc(a.runId)}:diff?against=${enc(f.runId)}`));
-    if (dv === null || dv.status !== 200) return softSkip('blocked', `the divergence control diff answered ${dv?.status ?? 'no response'}`);
+    if (dv === null || dv.status !== 200) return blockedDespiteAssertions(`the divergence control diff answered ${dv?.status ?? 'no response'}`);
     const x = dv.json as Diff;
     expect(typeof x.divergedAtSeq === 'number' && Array.isArray(x.eventDiffs) && x.eventDiffs.length > 0, req(ID, DOC, `a noop log and a failure log MUST diverge (divergedAtSeq ${String(x.divergedAtSeq)}, ${Array.isArray(x.eventDiffs) ? x.eventDiffs.length : 0} diff(s)) — the identical-logs pass above is only evidence if a different pair does not also read identical`)).toBe(true);
   }, 45_000);

package/src/scenarios/v2-run-pause-resume.test.ts

@@ -71,7 +71,10 @@ describe('v2 run-pause-resume (runs.md §Pause and resume)', () => {
     if (resume === null) return softSkip('blocked', 'POST /runs/{runId}:resume unreachable (fetch failed)');
     expect(resume.status, req(ID, DOC, `resume on a run that is not paused MUST answer 409 — got ${resume.status} ${readErrorCode(resume.json) ?? ''}`.trim())).toBe(409);
     expect(readErrorCode(resume.json), req(ID, DOC, `a resume refused because the run is terminal MUST carry run_terminal (got ${String(readErrorCode(resume.json))})`)).toBe('run_terminal');
-    if (!isFixtureAdvertised(DELAY)) return softSkip('inapplicable', `${DELAY} fixture not advertised — the positive pause/resume leg cannot run, so the two 409s above are witnessed without their control (a host answering 409 to everything would pass them)`);
+    // unfailable-leg audit wave 2, 2026-09-27: 'inapplicable' after the 409
+    // asserts resolved to a partial-witness PASS — a host answering 409 to
+    // every pause/resume passed. `blocked` stands at major 2.
+    if (!isFixtureAdvertised(DELAY)) return softSkip('blocked', `${DELAY} fixture not advertised — the positive pause/resume leg cannot run, so the two 409s above are witnessed without their control (a host answering 409 to everything would pass them)`);
   });
 
   it('a running run pauses (202 paused), refuses a second pause (409), resumes (202 running), and the log carries run.paused then run.resumed', async () => {