@openwop/openwop-conformance 2.42.2 → 2.42.4

package/src/scenarios/v2-sse-last-event-id.test.ts

@@ -69,6 +69,13 @@ describe('v2 sse-last-event-id (events.md §SSE frames)', () => {
     expect(ids.every((n) => n !== null), req(ID, DOC, `every frame MUST carry id: = its sequence (frames without a parseable id: ${ids.filter((n) => n === null).length} of ${ids.length})`)).toBe(true);
     const seqs = ids as number[];
     expect([...seqs].sort((a, b) => a - b), req(ID, DOC, 'frames MUST arrive in log order')).toEqual(seqs);
+    // unfailable-leg audit wave 2, 2026-09-27: with a single frame, `first` ===
+    // `last` and the mid-stream resume leg compared two empty sets — a host
+    // that ignored Last-Event-ID on a resume with backlog could not fail it. A
+    // completed run's log holds at least `run.started` (events.md: it carries
+    // the owner block) and its terminal event (§The terminal event), and debug
+    // mode streams every event, so ≥2 frames is required, not assumed.
+    expect(seqs.length, req(ID, DOC, `a completed run's debug stream MUST carry at least run.started and its terminal event (got ${seqs.length} frame(s))`)).toBeGreaterThanOrEqual(2);
     const first = seqs[0]!; const last = seqs[seqs.length - 1]!;
 
     const resumed = await subscribe(path, { timeoutMs: 8_000, extraHeaders: V2, lastEventId: String(first) });

package/src/scenarios/v2-version-header-honored.test.ts

@@ -145,10 +145,29 @@ describe('v2-version-header-honored (RFC 0172 §A.3)', () => {
     // A refusal is a correct answer and ends the check: the host has told the
     // truth about not serving major 2.
     if (asked.status === 406) {
+      // unfailable-leg audit wave 2, 2026-09-27: this branch asserted only the
+      // status it had just branched on (`406 === 406`), so ANY 406 passed — a
+      // host that lists `2.x` in protocolVersions[] and still refuses it
+      // (§1.3 row 1: MUST serve a listed major), or one answering 406 with a
+      // bare `{}` body. The refusal is now held to §1.3 row 2 exactly as the
+      // retired-host branch above is: code `protocol_version_unsupported`,
+      // `details.protocolVersions[]` echoing the list, and major 2 NOT listed.
+      let refusal: unknown;
+      try {
+        refusal = JSON.parse(asked.body);
+      } catch {
+        refusal = undefined;
+      }
+      const echoed406 = (refusal as { details?: { protocolVersions?: unknown } } | undefined)?.details?.protocolVersions;
       expect(
-        asked.status,
-        req(ID, DOC, 'a host that does not serve major 2 MUST refuse with 406 protocol_version_unsupported, which it did'),
-      ).toBe(406);
+        {
+          status: asked.status,
+          code: readErrorCode(refusal),
+          echoed: Array.isArray(echoed406) ? [...echoed406].map(String).sort() : echoed406,
+          listsMajor2: majors.has('2'),
+        },
+        req(ID, DOC, `a host that does not serve major 2 MUST refuse OpenWOP-Version: 2.0 with 406 protocol_version_unsupported and details.protocolVersions[] echoing [${advertised.join(', ')}]; a host that LISTS a 2.x member MUST serve it (§1.3 row 1), not refuse it`),
+      ).toEqual({ status: 406, code: 'protocol_version_unsupported', echoed: [...advertised].sort(), listsMajor2: false });
       return softSkip('inapplicable', 'the host refused major 2 with the specified 406 — a correct answer, and there is no second representation to compare bytes against');
     }
     if (asked.status !== 200) {

package/src/scenarios/v2-webhook-delivery-isolation.test.ts

@@ -26,11 +26,13 @@
  *     host released one to make room), or never within the window, AND the held
  *     attempts had stayed open until the run was terminal: the contention the
  *     floor names existed when the healthy delivery fell due, and it waited.
- *   - partial-witness — the host's own delivery timeout closed held attempts
- *     before the run was terminal. Contention was not sustained when the
- *     healthy delivery fell due, so this run of the leg cannot judge §A. The
- *     timeout is the host's to choose; a host with a timeout shorter than
- *     DELAY_MS is simply not measured by this instrument.
+ *   - blocked (unjudged) — the host had all 8 held attempts open at once, but
+ *     its own delivery timeout closed them before the run was terminal.
+ *     Contention was not sustained when the healthy delivery fell due, so this
+ *     run of the leg cannot judge §A. The timeout is the host's to choose; a
+ *     host with a timeout shorter than DELAY_MS is simply not measured by this
+ *     instrument. If fewer than 8 were EVER open at once (a serial or small
+ *     pool), it fails instead (2026-09-26, unfailable-leg audit).
  *   - blocked — fewer than 8 held attempts ever arrived AND the healthy one
  *     never did either: nothing reached the suite, which says nothing about
  *     isolation (`noDeliveryCause`).
@@ -121,6 +123,10 @@ describe('RFC 0215 §A — one subscription\'s receiver does not hold another\'s
     let healthyId: string | null = null;
     let healthyAt: number | null = null;
     let openAtHealthy = -1;
+    // The most held attempts ever open at once. Sampled at each held arrival:
+    // the open count only rises there (closes only lower it), so the max over
+    // arrivals is the true peak.
+    let peakOpen = 0;
     const openCount = (): number => [...held.values()].filter((h) => h.closedAt === null).length;
 
     const rx = await startScopedReceiver((hit, res) => {
@@ -137,6 +143,7 @@ describe('RFC 0215 §A — one subscription\'s receiver does not hold another\'s
       }
       const h: Held = { webhookId, res, openedAt: Date.now(), closedAt: null };
       held.set(webhookId, h);
+      peakOpen = Math.max(peakOpen, openCount());
       // The HOST closing the socket before we answer is the host abandoning the attempt.
       res.on('close', () => { if (h.closedAt === null) h.closedAt = Date.now(); });
     });
@@ -175,7 +182,7 @@ describe('RFC 0215 §A — one subscription\'s receiver does not hold another\'s
     const everOpened = held.size;
     await waitFor(() => healthyAt !== null, WINDOW_MS);
     const earliestClose = Math.min(...[...held.values()].map((h) => h.closedAt ?? Infinity));
-    const detail = `${everOpened} held attempt(s) arrived; ${openAtTerminal} were still open when the run was seen terminal; `
+    const detail = `${everOpened} held attempt(s) arrived (at most ${peakOpen} open at once); ${openAtTerminal} were still open when the run was seen terminal; `
       + (healthyAt === null ? `the healthy attempt did not arrive within ${WINDOW_MS}ms of that` : `the healthy attempt arrived ${healthyAt - terminalAt}ms after it, with ${openAtHealthy} held open`);
 
     if (healthyAt === null && everOpened === 0) {
@@ -193,8 +200,21 @@ describe('RFC 0215 §A — one subscription\'s receiver does not hold another\'s
       // delivery timeout released the held attempts early (its choice), or it
       // never opened FLOOR of them at once. The second is the defect, the first
       // is not, and they differ in WHEN the first held attempt closed.
-      expect(everOpened, req(ID, DOC, 'the held subscriptions\' attempts MUST have been dispatched')).toBeGreaterThan(0);
-      return softSkip('skipped', `partial-witness: the host closed held attempts ${Number.isFinite(earliestClose) ? `${terminalAt - earliestClose}ms ` : ''}before the run was terminal (its delivery timeout is shorter than this leg's ${DELAY_MS}ms delay), so ${FLOOR} attempts were not outstanding when the healthy delivery fell due — ${detail}`);
+      //
+      // Unfailable-leg audit (2026-09-26): this branch asserted everOpened > 0
+      // and then `softSkip('skipped')`, which records `executed-pass` with a
+      // `partial-witness:` detail. A serial dispatcher (pool of 1) with a
+      // sub-2s delivery timeout landed here and passed — every held attempt
+      // arrived eventually (everOpened reached FLOOR), one at a time, while the
+      // healthy attempt queued behind them: head-of-line blocking. peakOpen
+      // separates the two cases the comment above names: below FLOOR the host
+      // never had FLOOR attempts outstanding at once, which is the defect; at
+      // FLOOR the host's timeout released them early, which is unjudged.
+      expect(
+        peakOpen,
+        req(ID, DOC, `a host MUST sustain ${FLOOR} subscriptions' attempts outstanding at once — at most ${peakOpen} were ever open together, so the held attempts were dispatched below the floor — ${detail}`),
+      ).toBeGreaterThanOrEqual(FLOOR);
+      return blockedDespiteAssertions(`unjudged: ${FLOOR} held attempts were open at once, but the host closed held attempts ${Number.isFinite(earliestClose) ? `${terminalAt - earliestClose}ms ` : ''}before the run was terminal (its delivery timeout is shorter than this leg's ${DELAY_MS}ms delay), so ${FLOOR} attempts were not outstanding when the healthy delivery fell due — ${detail}`);
     } else {
       expect.fail(req(ID, DOC, `the host never had ${FLOOR} subscriptions' attempts outstanding at once, and the healthy attempt waited — a bounded dispatcher below the floor — ${detail}`));
     }

package/src/scenarios/v2-webhook-durable-delivery.test.ts

@@ -348,6 +348,22 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
             req('openwop.requirement.0173.webhook-durable-delivery', 'webhooks.md §Durability', `retry attempts for ${key} MUST be spaced by the advertised ${policy.backoff} backoff (attempt ${i + 1} followed attempt ${i} after ${times[i]! - times[i - 1]!}ms)`),
           ).toBeGreaterThan(0);
         }
+        // Unfailable-leg audit (2026-09-26): `> 0 ms` alone let a host advertising
+        // `backoff: exponential` that retried in a tight loop (any constant
+        // spacing, even a few ms) pass. An exponential backoff MUST widen, so with
+        // three or more attempts the second gap is at least 1.5x the first (not
+        // 2x: jitter tolerance). Only the first two gaps are compared, so a host
+        // whose schedule hits its cap later is not convicted. `fixed` gets no
+        // equivalent: its base interval is not on the wire (see the comment above
+        // the `!retried` branch), so there is no floor to measure against.
+        if (policy.backoff === 'exponential' && times.length >= 3) {
+          const gap1 = times[1]! - times[0]!;
+          const gap2 = times[2]! - times[1]!;
+          expect(
+            gap2,
+            req('openwop.requirement.0173.webhook-durable-delivery', 'webhooks.md §Durability', `retry attempts for ${key} MUST follow the advertised exponential backoff — the second gap (${gap2}ms) MUST be at least 1.5x the first (${gap1}ms); a constant spacing is not exponential`),
+          ).toBeGreaterThanOrEqual(1.5 * gap1);
+        }
       }
     } else {
       softSkip('inapplicable', 'no advertised retryPolicy.backoff other than none — the spacing leg is not asserted');
@@ -443,6 +459,14 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
       ).toBeLessThanOrEqual(policy.maxAttempts);
     }
     if (inSink === null) {
+      // partial-witness-ok: the retry half of §Durability is observed above
+      // (retried, and capped at maxAttempts). The sink half has no read on a
+      // host without the webhooks.deadLetter facet (RFC 0188 §A.5 makes the read
+      // a 404, not an obligation), so it is unwitnessable here BY DESIGN. It is
+      // not a harness gap that `blocked` would honestly name: a bundle-fatal
+      // `blocked` would deny certification to every conforming host that
+      // declines the optional read. Reviewed in the unfailable-leg audit wave 2
+      // (2026-09-27); the acceptance predicate still refuses this row.
       return softSkip('inapplicable', 'host does not advertise the webhooks.deadLetter facet — RFC 0188 §A.5 makes the read a 404 rather than an obligation, so the sink half of §Durability is unwitnessable here (the retry half above passed)');
     }
     expect(

package/src/scenarios/v2-webhook-endpoint-verification.test.ts

@@ -38,9 +38,10 @@
 import { afterEach, describe, it, expect } from 'vitest';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { v2Validator } from '../lib/v2.js';
-import { hitHeader, mintWhsec, startModalReceiver, verifyStandardWebhooks } from '../lib/webhook-receiver.js';
+import { scaledTimeoutMs } from '../lib/polling.js';
+import { hitHeader, mintWhsec, startModalReceiver, verifyStandardWebhooks, type ModalHit } from '../lib/webhook-receiver.js';
 import {
   STANDARD_WEBHOOKS_ALG,
   deliveriesFor,
@@ -53,6 +54,9 @@ import {
 } from '../lib/standard-webhooks.js';
 
 const REFUSED = ['no-echo', 'wrong-echo', 'redirect'] as const;
+/** A second echo subscription, registered AFTER the refused modes (routed as `echo`, told apart by this trailing segment). */
+const LATE_CONTROL = 'late-control';
+const isLateControl = (h: ModalHit): boolean => h.path.split('?')[0]!.endsWith(`/echo/${LATE_CONTROL}`);
 
 let closeReceiver: (() => Promise<void>) | null = null;
 afterEach(async () => {
@@ -80,10 +84,18 @@ describe('RFC 0201 §D — endpoint verification refuses without consent (opted-
       const res = await registerSw(body(mode));
       refused.set(mode, { status: res.status, code: readErrorCode(res.json), id: (res.json as { webhookId?: unknown } | null)?.webhookId });
     }
+    // Unfailable-leg audit, 2026-09-26: the persisted-nothing check synced only
+    // on the FIRST echo subscription plus a 1 s grace, so a host that answered
+    // 400 but kept the rows, delivering serially in registration order, could
+    // land those deliveries after the window. A second echo control registered
+    // AFTER the refused modes sits behind them in that order.
+    const late = await registerSw({ ...body('echo'), url: `${rx.urlFor('echo').url}/${LATE_CONTROL}` });
 
     const ID = 'openwop.requirement.0201.endpoint-verification';
     expect(ok.status, req(ID, 'RFC 0201 §D.14', `an endpoint that echoes the challenge MUST be registered 201 (got ${ok.status} ${readErrorCode(ok.json) ?? ''})`)).toBe(201);
     const echoId = (ok.json as { webhookId: string }).webhookId;
+    expect(late.status, req(ID, 'RFC 0201 §D.14', `a second echoing endpoint (the late control) MUST be registered 201 (got ${late.status} ${readErrorCode(late.json) ?? ''})`)).toBe(201);
+    const lateId = (late.json as { webhookId: string }).webhookId;
     for (const [mode, r] of refused) {
       expect(r.status, req(ID, 'RFC 0201 §D.14', `a ${mode} endpoint MUST be refused 400 before any 201 (got ${r.status})`)).toBe(400);
       expect(r.code, req(ID, 'RFC 0201 §D.14', `a ${mode} refusal MUST carry webhook_endpoint_unverified`)).toBe('webhook_endpoint_unverified');
@@ -91,7 +103,7 @@ describe('RFC 0201 §D — endpoint verification refuses without consent (opted-
 
     const validate = v2Validator('webhook-verification');
     for (const mode of ['echo', ...REFUSED]) {
-      const vr = rx.hits.filter((h) => h.mode === mode && h.verification);
+      const vr = rx.hits.filter((h) => h.mode === mode && h.verification && !isLateControl(h));
       expect(vr.length, req(ID, 'RFC 0201 §D.13–§D.14', `the host MUST send exactly one verification request to the ${mode} endpoint and MUST NOT retry it (saw ${vr.length})`)).toBe(1);
       const h = vr[0]!;
       expect(h.method, req(ID, 'RFC 0201 §D.13', 'the verification request MUST be a POST')).toBe('POST');
@@ -113,12 +125,19 @@ describe('RFC 0201 §D — endpoint verification refuses without consent (opted-
     // delivery; by then any persisted refused subscription would have one too.
     const run = await driveRun();
     expect(run.status, req(ID, 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
-    await waitFor(() => deliveriesFor(rx.hits, echoId, run.runId).length > 0, 15_000);
+    await waitFor(() => deliveriesFor(rx.hits, echoId, run.runId).length > 0 && deliveriesFor(rx.hits, lateId, run.runId).length > 0, 15_000);
     expect(deliveriesFor(rx.hits, echoId, run.runId).length, req(ID, 'webhooks.md §Durability', 'the verified subscription MUST receive run.completed — the sync point for the persisted-nothing check')).toBeGreaterThan(0);
-    await new Promise((r) => setTimeout(r, 1_000));
+    // The late control is a SYNC POINT, not a requirement: a public receiver
+    // front that drops its extra path segment would starve it through no fault
+    // of the host. Unobserved ⇒ the persisted-nothing check is unjudged, never
+    // failed and never passed.
+    if (deliveriesFor(rx.hits, lateId, run.runId).length === 0) {
+      return blockedDespiteAssertions(`the late-control subscription (${lateId}) received no run.completed within the wait — the second sync point for the persisted-nothing check is missing, so that check is unjudged`);
+    }
+    await new Promise((r) => setTimeout(r, scaledTimeoutMs(3_000)));
     for (const mode of REFUSED) {
       const late = rx.hits.filter((h) => h.mode === mode && !h.verification);
       expect(late.length, req(ID, 'RFC 0201 §D.14', `a refused (${mode}) registration MUST persist no subscription — it received ${late.length} later request(s)`)).toBe(0);
     }
-  }, 60_000);
+  }, 75_000);
 });

package/src/scenarios/v2-webhook-message-id-stable.test.ts

@@ -31,7 +31,7 @@
 import { afterEach, describe, it, expect } from 'vitest';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { hitHeader, mintWhsec, startModalReceiver, STANDARD_WEBHOOKS_ID, type ModalHit } from '../lib/webhook-receiver.js';
 import { retryWaitCapMs, retryWaitFor } from '../lib/webhook-retry-window.js';
 import {
@@ -108,11 +108,19 @@ describe('RFC 0201 §C.10 — webhook-id is stable across retries, distinct acro
         req(ID, 'RFC 0201 §C.10', `webhook-id MUST be identical on every attempt of one (webhookId, runId, sequence) — ${attempts.length} attempts of ${key} carried ${ids.size} value(s)`),
       ).toHaveLength(1);
     }
+    // Unfailable-leg audit, 2026-09-26: the distinctness half asserted only
+    // `keys.size >= 2`, so a host coalescing the two subscriptions (or keeping a
+    // per-subscription constant id with one delivery each) passed on a partial
+    // set. Distinctness is judged only over the full expected set; fewer keys
+    // is unmeasured, and the retry-stability assertions above already ran.
+    if (keys.size < expectedKeys) {
+      return blockedDespiteAssertions(`only ${keys.size} of ${expectedKeys} expected deliveries (${subs.length} subscriptions × ${EVENTS.join(' + ')}) arrived inside the ${window}ms window — distinctness across deliveries cannot be judged on a partial set`);
+    }
     const perKey = [...keys.entries()].map(([key, a]) => ({ key, id: hitHeader(a[0]!, 'webhook-id') ?? '' }));
     for (const { key, id } of perKey) {
       expect(STANDARD_WEBHOOKS_ID.test(id), req(ID, 'RFC 0201 §C.10', `webhook-id MUST match ^[A-Za-z0-9_-]{16,128}$ (${key}: ${JSON.stringify(id)})`)).toBe(true);
     }
-    expect(keys.size, req(ID, 'RFC 0201 §C.10', `two opted-in subscriptions on ${EVENTS.join(' + ')} MUST yield ${expectedKeys} distinct deliveries of one run`)).toBeGreaterThanOrEqual(2);
+    expect(keys.size, req(ID, 'RFC 0201 §C.10', `two opted-in subscriptions on ${EVENTS.join(' + ')} MUST yield ${expectedKeys} distinct deliveries of one run`)).toBe(expectedKeys);
     expect(
       new Set(perKey.map((k) => k.id)).size,
       req(ID, 'RFC 0201 §C.10', `webhook-id MUST differ between distinct deliveries, by event and by subscription — ${perKey.length} deliveries carried ${new Set(perKey.map((k) => k.id)).size} distinct id(s)`),

package/src/scenarios/v2-webhook-unregister-stops-delivery.test.ts

@@ -171,8 +171,13 @@ describe('RFC 0215 §B — unregistering stops the attempts (gated on webhooks)'
       targetLate.length,
       req(ID, DOC, `after unregisterWebhook answers 204 the host MUST NOT start another attempt for that subscription, including retries already scheduled — ${detail}`),
     ).toBe(0);
+    // unfailable-leg audit wave 2, 2026-09-27: a plain softSkip after the
+    // `targetLate === 0` assert recorded a partial-witness `executed-pass`, so a
+    // host that KEPT delivering to an unregistered subscription — but whose
+    // retries fell outside the window — certified. Without a late control
+    // attempt the target's silence proves nothing: `blocked`.
     if (controlLate.length === 0) {
-      return softSkip('skipped', `partial-witness: the control subscription was not retried after the 204 + ${GRACE_MS}ms within ${windowMs}ms either, so the target's silence shows nothing — the schedule finished inside the grace or runs past the window (raise OPENWOP_WEBHOOK_RETRY_WAIT_MS above the host's backoff sum) — ${detail}`);
+      return blockedDespiteAssertions(`the control subscription was not retried after the 204 + ${GRACE_MS}ms within ${windowMs}ms either, so the target's silence shows nothing — the schedule finished inside the grace or runs past the window (raise OPENWOP_WEBHOOK_RETRY_WAIT_MS above the host's backoff sum) — ${detail}`);
     }
   }, CAP_MS * 2 + 90_000);
 });

package/src/scenarios/version-negotiation.test.ts

@@ -74,7 +74,18 @@ describe('version-negotiation: Capabilities advertises a protocolVersion', () =>
       'capabilities.md §3 + version-negotiation.md',
       'Capabilities.protocolVersion MUST be a non-empty string',
     )).toBe('string');
-    expect(String(caps.protocolVersion).length).toBeGreaterThan(0);
+    // unfailable-leg audit wave 2, 2026-09-27: only non-emptiness was checked,
+    // so `v1.0`, `1.0.0`, `1` and `banana` passed. RFC 0149 §C constrains
+    // protocolVersion to ASCII `<major>.<minor>` with no leading zeros —
+    // capabilities.schema.json `protocolVersion.pattern` (the same grammar
+    // lib/profiles.ts PROTOCOL_VERSION_GRAMMAR applies to the core predicate).
+    expect(
+      typeof caps.protocolVersion === 'string' && /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/.test(caps.protocolVersion),
+      req('openwop.it.version-negotiation.get-well-known-openwop-returns-capabilities-with-protocolversion-string',
+        'RFC 0149 §C; capabilities.schema.json protocolVersion.pattern',
+        `Capabilities.protocolVersion MUST be ASCII <major>.<minor> with no leading zeros (got ${JSON.stringify(caps.protocolVersion)})`,
+      ),
+    ).toBe(true);
   });
 });
 

package/src/scenarios/webhook-signed-delivery.test.ts

@@ -118,6 +118,8 @@ export const REQUIRES_HOST_CALLBACK = 'the host POSTs a signed webhook delivery
 interface DeliveredRequest {
   readonly headers: Record<string, string>;
   readonly body: string;
+  /** Suite clock (ms) when the receiver recorded the delivery. */
+  readonly receivedAtMs: number;
 }
 
 async function startReceiver(): Promise<ScopedReceiver & { received: DeliveredRequest[] }> {
@@ -141,7 +143,7 @@ async function startReceiver(): Promise<ScopedReceiver & { received: DeliveredRe
       if (typeof v === 'string') headers[k.toLowerCase()] = v;
       else if (Array.isArray(v)) headers[k.toLowerCase()] = v.join(',');
     }
-    received.push({ headers, body: hit.body });
+    received.push({ headers, body: hit.body, receivedAtMs: Date.now() });
     res.writeHead(204);
     res.end();
   });
@@ -352,10 +354,23 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
     ).toBe(sub.webhookId);
 
     const timestamp = first.headers['x-openwop-timestamp'];
+    // unfailable-leg audit wave 2, 2026-09-27: this only required a non-empty
+    // string, so an ISO-8601 date, a milliseconds value, or a stale constant
+    // passed "MUST be a Unix-seconds integer" (the HMAC below signs whatever
+    // string was sent, so it could not catch it). Now: digits only (≤ 11 —
+    // seconds, not ms) and within the ±5 min window webhooks.md §"Verification
+    // recipe" tells every subscriber to enforce (a delivery outside it is
+    // rejected by a conforming subscriber, so the host's "when the dispatcher
+    // signed the body" value must fall inside it at receipt).
     expect(
-      typeof timestamp === 'string' && timestamp.length > 0,
-      req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'webhooks.md §"Delivery headers"', 'X-openwop-Timestamp MUST be a Unix-seconds integer string'),
+      typeof timestamp === 'string' && /^\d{1,11}$/.test(timestamp),
+      req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'webhooks.md §"Delivery headers"', `X-openwop-Timestamp MUST be a Unix-seconds integer string (got ${JSON.stringify(timestamp)})`),
     ).toBe(true);
+    const skewSeconds = Math.abs(Number(timestamp) - first.receivedAtMs / 1000);
+    expect(
+      skewSeconds,
+      req('openwop.it.webhook-signed-delivery.host-posts-run-events-to-subscriber-with-valid-x-openwop-signature', 'webhooks.md §"Delivery headers"; §"Verification recipe" step 1 (±5 minutes)', `X-openwop-Timestamp MUST be the signing time — within ±300 s of receipt (off by ${Math.round(skewSeconds)} s)`),
+    ).toBeLessThan(300);
 
     const signature = first.headers['x-openwop-signature'] ?? '';
     expect(