@openwop/openwop-conformance 2.42.3 → 2.42.5

package/src/scenarios/memory-compaction-provenance-tag.test.ts

@@ -19,7 +19,7 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
@@ -90,7 +90,11 @@ describe('memory-compaction-provenance-tag: compacted-from:<id> tag follows §C
     if (listRes.status === 404) {
       // eslint-disable-next-line no-console
       console.warn('[rfc0012-tag] host does not expose memory:list at /v1/memory/{ref}; skipping tag inspection (canonical provenance signal remains the memory.compacted event itself)');
-      return softSkip('blocked', '[rfc0012-tag] host does not expose memory:list at /v1/memory/{ref}; skipping tag inspection (canonical provenance signal remains the memory.compacted event itself)');
+      // unfailable-leg audit wave 2, 2026-09-27: this return follows the seed/
+      // compact asserts, so a plain softSkip recorded a partial-witness
+      // `executed-pass` — a host whose compacted entry was never inspectable
+      // passed the tag requirement unobserved. Now `blocked`.
+      return blockedDespiteAssertions('[rfc0012-tag] host does not expose memory:list at /v1/memory/{ref}; skipping tag inspection (canonical provenance signal remains the memory.compacted event itself)');
     }
     expect(listRes.status, req('openwop.it.memory-compaction-provenance-tag.compacted-entry-carries-a-well-formed-compacted-from-tag-or-omits-it-cleanly-no', 'RFC 0012 §C', 'memory:list MUST return 200 when reachable')).toBe(200);
 
@@ -100,7 +104,11 @@ describe('memory-compaction-provenance-tag: compacted-from:<id> tag follows §C
     if (!output) {
       // eslint-disable-next-line no-console
       console.warn(`[rfc0012-tag] outputId ${outputId} not visible via memory:list; cannot inspect tags`);
-      return softSkip('blocked', '[rfc0012-tag] outputId … not visible via memory:list; cannot inspect tags');
+      // unfailable-leg audit wave 2, 2026-09-27: this return follows the seed/
+      // compact asserts, so a plain softSkip recorded a partial-witness
+      // `executed-pass` — a host whose compacted entry was never inspectable
+      // passed the tag requirement unobserved. Now `blocked`.
+      return blockedDespiteAssertions('[rfc0012-tag] outputId … not visible via memory:list; cannot inspect tags');
     }
     const tags = output.tags ?? [];
 

package/src/scenarios/orchestratorDispatch.test.ts

@@ -45,8 +45,8 @@ describe.skipIf(SKIP)('orchestratorDispatch: supervisor → dispatch → next-wo
     expect(terminal.status).toBe('completed');
 
     const events = await driver.get(`/v1/runs/${encodeURIComponent(runId)}/events`);
-    const list = (events.json as { events?: Array<{ type: string; payload?: Record<string, unknown> }> })
-      .events ?? [];
+    const list = ((events.json as { events?: Array<{ type: string; sequence?: number; nodeId?: string; payload?: Record<string, unknown> }> })
+      .events ?? []).slice().sort((a, b) => (a.sequence ?? 0) - (b.sequence ?? 0));
 
     const decisions = list.filter((e) => e.type === 'runOrchestrator.decided');
     expect(decisions.length).toBeGreaterThan(0);
@@ -64,5 +64,21 @@ describe.skipIf(SKIP)('orchestratorDispatch: supervisor → dispatch → next-wo
     expect(decision.kind).toBe('next-worker');
     expect(Array.isArray(decision.nextWorkerIds)).toBe(true);
     expect(decision.nextWorkerIds.length).toBeGreaterThanOrEqual(1);
+
+    // unfailable-leg audit wave 2, 2026-09-27: the leg is named "decided
+    // {next-worker} BETWEEN supervisor + dispatch" but never read an order —
+    // a host that emitted the decision AFTER the dispatch node had already
+    // started (or never started the dispatch node at all) passed. The
+    // next-worker decision MUST precede the dispatch node's first node.started.
+    const nodeIdOf = (e: { nodeId?: string; payload?: Record<string, unknown> }): unknown => e.nodeId ?? e.payload?.nodeId;
+    const dispatchStarted = list.find((e) => e.type === 'node.started' && nodeIdOf(e) === 'dispatch');
+    expect(
+      dispatchStarted,
+      req('openwop.it.orchestratorDispatch.emits-runorchestrator-decided-next-worker-between-supervisor-dispatch', 'RFCS/0006-orchestrator.md', 'the dispatch node MUST emit node.started after the supervisor decides next-worker'),
+    ).toBeDefined();
+    expect(
+      typeof nextWorker!.sequence === 'number' && typeof dispatchStarted?.sequence === 'number' && nextWorker!.sequence < dispatchStarted.sequence,
+      req('openwop.it.orchestratorDispatch.emits-runorchestrator-decided-next-worker-between-supervisor-dispatch', 'RFCS/0006-orchestrator.md', 'runOrchestrator.decided{next-worker} MUST precede node.started{dispatch} in event-log sequence'),
+    ).toBe(true);
   });
 });

package/src/scenarios/pack-registry.test.ts

@@ -208,7 +208,14 @@ describe('pack-registry: read-endpoint shape contracts', () => {
       'node-packs.md §"GET /v1/packs/{name}/-/{version}.sig"',
       '404 response MUST carry a string `error` field — `signature_not_available` is the canonical code',
     )).toBe('string');
-    expect((body?.error as string).length).toBeGreaterThan(0);
+    // unfailable-leg audit wave 2, 2026-09-27: any non-empty `error` string
+    // (e.g. `not_found`) previously passed; node-packs.md names
+    // `404 signature_not_available` for all four cases (missing / yanked /
+    // unsigned / storage-unwired), intentionally indistinguishable.
+    expect(body?.error, req('openwop.it.pack-registry.get-v1-packs-name-version-sig-returns-404-signature-not-available-for-nonexisten', 
+      'node-packs.md §"GET /v1/packs/{name}/-/{version}.sig"',
+      'nonexistent (name, version) MUST return 404 `signature_not_available`',
+    )).toBe('signature_not_available');
   });
 
   it('GET /v1/packs/{bad-name}/-/{version}.json returns 400 invalid_pack_name', async () => {

package/src/scenarios/production-backpressure.test.ts

@@ -42,7 +42,7 @@ import { behaviorGate } from '../lib/behavior-gate.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { capabilityFamily } from '../lib/discovery-capabilities.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 
 interface BackpressureCaps {
   supported?: boolean;
@@ -212,7 +212,10 @@ describe('production-backpressure: 503 envelope under saturation', () => {
         }
       }
       await Promise.allSettled(slotPromises);
-      return softSkip('blocked', 'precondition not met — `saturationEarlyExit` returned early (seam, prior step, or fixture unavailable)');
+      // unfailable-leg audit wave 2, 2026-09-27: this plain softSkip came
+      // AFTER up to cap-1 `create.status === 201` assertions, so the row was
+      // a partial-witness PASS although no 503 envelope was ever observed.
+      return blockedDespiteAssertions('inflight cap already saturated by parallel runs before the cap+1 probe (run with --no-file-parallelism) — 503 envelope not observed');
     }
 
     // Let SSE connections register.
@@ -233,7 +236,10 @@ describe('production-backpressure: 503 envelope under saturation', () => {
         console.warn(
           `[production-backpressure] expected 503 at cap+1=${cap + 1}, got ${blocked.status}; saturation may need tuning`,
         );
-        return softSkip('blocked', 'precondition not met — `blocked.status !== 503` returned early ([production-backpressure] expected 503 at cap+1=…, got …; saturation may need tuning) (seam, prior step, or fixture unavailable)');
+        // unfailable-leg audit wave 2, 2026-09-27: after `cap` × 201 asserts a
+        // plain softSkip recorded a partial-witness PASS — a host that never
+        // 503s at cap+1 passed the 503-envelope leg. Now `blocked`.
+        return blockedDespiteAssertions(`expected 503 at cap+1=${cap + 1}, got ${blocked.status} — saturation not reached (SSE slots may not have registered); 503 envelope not observed`);
       }
 
       const retryAfterHeader = blocked.headers.get('retry-after');
@@ -318,14 +324,14 @@ describe('production-backpressure: discovery exempt from cap', () => {
 
     const cap = prod?.backpressure?.inflightCap;
     if (cap === undefined) {
-      // Without advertised cap we can't saturate deterministically;
-      // fall back to a single discovery probe.
-      const probe = await driver.get('/.well-known/openwop');
-      expect(probe.status, req('openwop.it.production-backpressure.get-well-known-openwop-returns-200-even-when-inflight-is-saturated', 
-        'production-profile.md §Backpressure',
-        'discovery MUST answer regardless of load',
-      )).toBe(200);
-      return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `cap === undefined` returned early');
+      // unfailable-leg audit wave 2, 2026-09-27: this used to take one UNLOADED
+      // discovery probe and then soft-skip, which recorded a partial-witness PASS
+      // for "returns 200 even when inflight is saturated", although nothing was
+      // saturated. The cap is OPTIONAL, so a host without one has nothing to
+      // saturate and the requirement does not bind it: `inapplicable`, before
+      // any assertion. It is not `blocked`, which would deny certification to a
+      // conforming host for a surface it may decline.
+      return softSkip('inapplicable', 'host does not advertise production.backpressure.inflightCap — there is no cap to saturate, so discovery-under-saturation does not bind');
     }
 
     // Issue many concurrent discovery probes; all MUST succeed.

package/src/scenarios/redaction.test.ts

@@ -187,6 +187,9 @@ describe('redaction: 401 response MUST NOT echo invalid Bearer token (NFR-7)', (
 
 describe.skipIf(SKIP_NO_NOOP)('redaction: credentialRef value MUST NOT appear in event payloads (gated on secrets.supported)', () => {
   it('skips when host does NOT advertise secrets.supported', async () => {
+    // Names the row id first (the registry takes the FIRST req() in a body as
+    // the explicitId) now that the tautological assert below is gone.
+    req('openwop.it.redaction.skips-when-host-does-not-advertise-secrets-supported', 'capabilities.md', 'a credentialRef value MUST NOT appear in any RunEvent payload');
     const cap = await driver.get('/.well-known/openwop', { authenticated: false });
     const supported =
       (cap.json as { secrets?: { supported?: boolean } } | undefined)?.secrets
@@ -194,8 +197,11 @@ describe.skipIf(SKIP_NO_NOOP)('redaction: credentialRef value MUST NOT appear in
 
     if (supported !== true) {
       // Spec-allowed — this scenario only applies to hosts that opt
-      // into BYOK. Pass trivially.
-      expect(supported, req('openwop.it.redaction.skips-when-host-does-not-advertise-secrets-supported', 'capabilities.md', 'skips when host does NOT advertise secrets.supported')).not.toBe(true);
+      // into BYOK. unfailable-leg audit wave 2, 2026-09-27: a tautological
+      // `expect(supported).not.toBe(true)` inside `if (supported !== true)`
+      // turned every non-BYOK host's row into an executed PASS of the
+      // credentialRef no-leak requirement; with zero assertions the row now
+      // records `inapplicable`.
       return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `supported !== true` returned early');
     }
 

package/src/scenarios/replay-fanout-suppression.test.ts

@@ -88,7 +88,7 @@
 
 import { afterEach, describe, expect, it } from 'vitest';
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { driver } from '../lib/driver.js';
 import { forkDeclined } from '../lib/fork-availability.js';
 import { discoveryFamilies, readCapabilityFamily } from '../lib/discovery-capabilities.js';
@@ -313,7 +313,7 @@ describe('replay-fanout-suppression: a replay fork MUST NOT fan out re-emitted e
     }
     expect(replay.status, req('openwop.it.replay-fanout-suppression.delivers-for-a-live-run-suppresses-for-a-replay-fork-and-delivers-again-for-a-br', 'webhooks.md §"Register"', 'replay fork should be accepted')).toBe(201);
     const replayRunId = (replay.json as { runId: string }).runId;
-    await pollUntilTerminal(replayRunId, { timeoutMs: FORK_POLL_MS });
+    const replayTerminal = await pollUntilTerminal(replayRunId, { timeoutMs: FORK_POLL_MS });
     await quietWindow(SUPPRESSION_WINDOW_MS);
 
     expect(
@@ -342,6 +342,22 @@ describe('replay-fanout-suppression: a replay fork MUST NOT fan out re-emitted e
       ),
     ).toBeGreaterThan(0);
 
+    // unfailable-leg audit wave 2, 2026-09-27: a non-empty fork log was the
+    // only re-emission check, so a replay fork that FAILED (or never reached
+    // `run.completed`, the one event the webhook subscribes to) delivered
+    // nothing because it never re-emitted the subscribed event — and was
+    // recorded `executed-pass` for the suppression MUST NOT. The fork must
+    // terminate `completed` with `run.completed` in its own log before the
+    // absence of deliveries is evidence; otherwise `blocked`.
+    const forkReemittedCompleted = forkEventList.some((e) => e.type === 'run.completed');
+    if (replayTerminal.status !== 'completed' || !forkReemittedCompleted) {
+      const why = `replay fork ${replayRunId} terminated ${String(replayTerminal.status)}`
+        + `${forkReemittedCompleted ? '' : ' without run.completed in its event log'} — the subscribed event was never re-emitted, `
+        + 'so the absence of deliveries proves nothing';
+      recordRequirement(REQUIREMENT_ID, 'blocked', why);
+      return blockedDespiteAssertions(why);
+    }
+
     // The MUST NOT has now been exercised against wiring proven to deliver, on a
     // fork proven to have re-emitted. Recorded here rather than after leg 3,
     // because leg 3 pins the boundary and may legitimately not run.

package/src/scenarios/runner-ledger.test.ts

@@ -270,11 +270,16 @@ describe('RFC 0148 §A (S6) — the live sink, when this run was given one', ()
   it('files that finished before this one appear in the ledger file with an assertion count', () => {
     const path = process.env['OPENWOP_LEDGER_PATH'];
     if (!path || !existsSync(path)) return softSkip('blocked', 'precondition not met — `!path || !existsSync(path)` returned early (not a --certify run; nothing to inspect) (seam, prior step, or fixture unavailable)'); // not a --certify run; nothing to inspect
-    const entries = readLedgerFile(path);
     // At least the in-memory ledger of THIS worker has file-level entries for
     // earlier files (setup.ts afterAll), and each carries assertionCount.
+    //
+    // unfailable-leg audit wave 2, 2026-09-27: the leg ended with
+    // `expect(entries.length).toBeGreaterThanOrEqual(0)` — a tautology (and a
+    // bare expect with no req()) that made the leg an `executed-pass` even when
+    // `fileEntries` was empty and the loop asserted nothing. Removed; an empty
+    // set now says so instead of passing vacuously.
     const fileEntries = snapshot().filter((e) => e.requirementId.startsWith('openwop.scenario.') || e.requirementId.startsWith('openwop.floor.'));
+    if (fileEntries.length === 0) return softSkip('inapplicable', 'no file-level ledger entries recorded in this worker before this leg — nothing to inspect');
     for (const e of fileEntries) expect(typeof e.assertionCount, req('openwop.it.runner-ledger.files-that-finished-before-this-one-appear-in-the-ledger-file-with-an-assertion', 'RFC 0148 §A', 'files that finished before this one appear in the ledger file with an assertion count')).toBe('number');
-    expect(entries.length).toBeGreaterThanOrEqual(0);
   });
 });

package/src/scenarios/stream-modes.test.ts

@@ -132,6 +132,33 @@ describe.skipIf(SKIP_NO_FIXTURE)('stream-modes: debug emits at least as many eve
       'debug stream event count MUST be >= updates stream event count',
     )).toBeGreaterThanOrEqual(updatesResult.events.length);
 
+    // unfailable-leg audit wave 2, 2026-09-27: superset-by-COUNT alone passed a
+    // host whose debug stream dropped canonical types (e.g. no run.completed)
+    // as long as it padded the count with other frames (log.appended,
+    // keep-alive-ish events). The mapping table is per TYPE: every type the
+    // updates stream carried MUST appear in debug, and debug MUST carry
+    // node.started (✅ debug / — updates) — the conformance-delay fixture has
+    // one node (`wait`), so a debug stream without node.started is filtering.
+    const typeOf = (e: SseEvent): string => {
+      if (e.event !== 'message') return e.event;
+      try {
+        const t = (JSON.parse(e.data) as { type?: unknown }).type;
+        return typeof t === 'string' ? t : e.event;
+      } catch {
+        return e.event;
+      }
+    };
+    const debugTypes = new Set(debugResult.events.map(typeOf));
+    const missingFromDebug = [...new Set(updatesResult.events.map(typeOf))].filter((t) => !debugTypes.has(t));
+    expect(missingFromDebug, req('openwop.it.stream-modes.debug-stream-is-a-superset-of-updates-per-stream-modes-md-mode-mapping', 
+      'stream-modes.md §Mode-to-event mapping',
+      'every event type emitted in updates mode is also ✅ in debug mode — debug MUST carry each of them',
+    )).toEqual([]);
+    expect([...debugTypes], req('openwop.it.stream-modes.debug-stream-is-a-superset-of-updates-per-stream-modes-md-mode-mapping', 
+      'stream-modes.md §Mode-to-event mapping',
+      'debug mode MUST emit node.started (✅ debug) for the fixture\'s node',
+    )).toContain('node.started');
+
     expect(debugResult.closedBy, req('openwop.it.stream-modes.debug-stream-is-a-superset-of-updates-per-stream-modes-md-mode-mapping', 
       'stream-modes.md §debug',
       'debug stream MUST close on terminal event',

package/src/scenarios/tool-catalog-projection.test.ts

@@ -55,7 +55,7 @@ import {
   TOOL_CONTENT_FORBIDDEN,
 } from '../lib/toolCatalog.js';
 import { req } from '../lib/requirement-ids.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
 
 function loadSchema(name: string): Record<string, unknown> {
   return JSON.parse(readFileSync(join(SCHEMAS_DIR, name), 'utf8')) as Record<string, unknown>;
@@ -92,8 +92,23 @@ describe('tool-catalog-projection (RFC 0078 §B/§F)', () => {
     ).toBe(true);
 
     // ---- Leg 1: the list (§B) -------------------------------------------
-    const tools = await listTools();
-    if (tools === null) return softSkip('inapplicable', 'capability or profile not advertised by this host — gate `tools === null` returned early (host advertises the cap but doesn\'t serve the read — soft-skip the rest)'); // host advertises the cap but doesn't serve the read — soft-skip the rest
+    // unfailable-leg audit wave 2, 2026-09-27: a host that ADVERTISES the
+    // catalog but 404s the list (or answers 500 / a non-list 200, which the
+    // old `listTools` read as `[]`) previously recorded a partial-witness pass
+    // after the 401 assertion. An unserved read is now `seamAbsent` (blocked;
+    // fails under OPENWOP_REQUIRE_BEHAVIOR=true), and any other non-200 or
+    // non-list body FAILS.
+    const read = await listTools();
+    if (read.unserved) return seamAbsent(`host advertises toolCatalog but ${toolsPath()} answered ${read.status}`);
+    expect(
+      read.status,
+      req('openwop.it.tool-catalog-projection.lists-schema-valid-tooldescriptors-serves-by-id-404s-is-auth-gated-and-never-dis', 'tool-catalog.md §B', `GET ${toolsPath()} MUST return 200 to an authenticated caller on a host advertising toolCatalog`),
+    ).toBe(200);
+    expect(
+      read.tools !== null,
+      req('openwop.it.tool-catalog-projection.lists-schema-valid-tooldescriptors-serves-by-id-404s-is-auth-gated-and-never-dis', 'tool-catalog.md §B', `GET ${toolsPath()} MUST return a ToolDescriptor[]`),
+    ).toBe(true);
+    const tools = read.tools ?? [];
 
     for (const t of tools) {
       const v = validate(t);
@@ -116,12 +131,18 @@ describe('tool-catalog-projection (RFC 0078 §B/§F)', () => {
     if (tools.length > 0 && typeof tools[0]!.toolId === 'string') {
       const id = tools[0]!.toolId as string;
       const one = await getTool(id);
-      if (one.status === 200) {
-        expect(
-          one.descriptor?.toolId === id,
-          req('openwop.it.tool-catalog-projection.lists-schema-valid-tooldescriptors-serves-by-id-404s-is-auth-gated-and-never-dis', 'tool-catalog.md §B', 'GET /v1/tools/{toolId} MUST return the requested descriptor'),
-        ).toBe(true);
-      }
+      // unfailable-leg audit wave 2, 2026-09-27: the by-id check used to run
+      // only `if (one.status === 200)`, so a host that 404'd (or 500'd) the
+      // by-id read of a tool its own list returned passed. A listed tool is
+      // one the caller may see; its by-id read MUST serve it.
+      expect(
+        one.status,
+        req('openwop.it.tool-catalog-projection.lists-schema-valid-tooldescriptors-serves-by-id-404s-is-auth-gated-and-never-dis', 'tool-catalog.md §B', 'GET /v1/tools/{toolId} MUST return 200 for a toolId the caller\'s own list returned'),
+      ).toBe(200);
+      expect(
+        one.descriptor?.toolId === id,
+        req('openwop.it.tool-catalog-projection.lists-schema-valid-tooldescriptors-serves-by-id-404s-is-auth-gated-and-never-dis', 'tool-catalog.md §B', 'GET /v1/tools/{toolId} MUST return the requested descriptor'),
+      ).toBe(true);
     }
     const unknown = await getTool('__conformance_nonexistent_tool__');
     expect(
@@ -142,9 +163,11 @@ describe('tool-catalog-projection (RFC 0078 §B/§F)', () => {
 
   it('advisory (SHOULD): an unchanged catalog reads identically, sorted by toolId', async () => {
     if (!(await toolCatalogGate('openwop-tool-catalog'))) return;
-    const a = await listTools();
-    const b = await listTools();
-    if (a === null || b === null) return softSkip('inapplicable', 'the host advertises the catalog but does not serve the list read');
+    const ra = await listTools();
+    const rb = await listTools();
+    const a = ra.tools;
+    const b = rb.tools;
+    if (a === null || b === null) return softSkip('inapplicable', `the list read did not return a ToolDescriptor[] (status ${ra.status}/${rb.status}); the normative leg above records that — this advisory leg is never failed`);
     const ids = (l: ReadonlyArray<{ toolId?: unknown }>) => l.map((t) => String(t.toolId));
     const first = ids(a); const second = ids(b);
     const sorted = [...first].sort((x, y) => (x < y ? -1 : x > y ? 1 : 0));

package/src/scenarios/v2-effect-identity-business-key.test.ts

@@ -25,7 +25,8 @@ import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
 import { v2Discovery, gateFamily, v2Validator } from '../lib/v2.js';
 import { seamsProfileAdvertised, SEAMS_PREFIX } from '../lib/seams.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
+import { startEffectReceiver } from '../lib/effect-receiver.js';
 import { req } from '../lib/requirement-ids.js';
 
 const FIXTURE = 'conformance-noop';
@@ -109,11 +110,19 @@ describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)',
     if (!doc) return softSkip('blocked', 'discovery unreachable');
     if (!(await gateFamily('idempotency'))) return softSkip('inapplicable', 'idempotency family not advertised — no Layer-2 obligation (gate recorded under openwop.family.idempotency)');
     if (!seamsProfileAdvertised(doc)) return softSkip('inapplicable', 'the retry leg is driven through the suite fixture provider (RFC 0173 §D.2 G4) under the seams profile — seams profile not advertised');
-    // The seam is catalogued (api/seams-v2.yaml `forceEffectTransportRetry`). An
-    // unreachable providerUrl forces the transport retry; the witness is the
-    // host's own Layer-2 ledger (RFC 0173 §C.2), where every attempt of one
-    // effect MUST carry the same business-identity key.
-    const fired = await driver.post(`${SEAMS_PREFIX}/sample/test/idempotency/effect-retry`, { providerUrl: 'http://127.0.0.1:1/' });
+    // The seam is catalogued (api/seams-v2.yaml `forceEffectTransportRetry`), and
+    // its contract names the witness: "the suite fixture provider records the
+    // idempotency key of each attempt". Until 2.42.4 this leg handed the host an
+    // address nothing listened on (`http://127.0.0.1:1/`), so no suite-owned
+    // party ever saw a key, and the only witness was the host's own ledger — a
+    // host could record one constant providerKey while sending a fresh key on
+    // every attempt. The suite's own receiver now cuts the FIRST attempt's
+    // connection (a genuine transport failure, after recording its
+    // Idempotency-Key) and answers the second, so the keys compared below are
+    // the ones that crossed the wire.
+    const rx = await startEffectReceiver({ failFirst: 1 });
+    try {
+    const fired = await driver.post(`${SEAMS_PREFIX}/sample/test/idempotency/effect-retry`, { providerUrl: rx.url });
     if (fired.status === 404 || fired.status === 403 || fired.status === 405) {
       return softSkip('blocked', `the host advertises the seams profile but does not serve ${SEAMS_PREFIX}/sample/test/idempotency/effect-retry (answered ${fired.status}) — the cross-retry keying leg cannot be driven`);
     }
@@ -166,5 +175,30 @@ describe('RFC 0173 §B — effect-identity-business-key (gated on idempotency)',
       keyings.size,
       req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `every attempt of one effect MUST declare the same keying — ${attempts.length} attempt(s) declared ${[...keyings].join(', ')}`),
     ).toBe(1);
+    // The wire half: what the provider actually received.
+    const deadline = Date.now() + 10_000;
+    while (rx.arrivals() < 2 && Date.now() < deadline) await new Promise((r) => setTimeout(r, 100));
+    const wire = rx.all().filter((a) => a.mine);
+    if (wire.length < 2) {
+      return blockedDespiteAssertions(`the suite's fixture provider saw ${wire.length} attempt(s) at ${rx.url} (local ${rx.localUrl}${rx.tunnelled ? ', tunnelled' : ''}) while the ledger records ${attempts.length} — the host's attempts did not reach the suite's receiver, so the keys on the wire are unobserved`);
+    }
+    for (const a of wire) {
+      expect(
+        typeof a.idempotencyKey === 'string' && a.idempotencyKey.length > 0,
+        req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `every attempt MUST present an Idempotency-Key to the provider — an attempt at ${a.path} carried ${JSON.stringify(a.idempotencyKey ?? null)}`),
+      ).toBe(true);
+    }
+    const wireKeys = new Set(wire.map((a) => a.idempotencyKey));
+    expect(
+      wireKeys.size,
+      req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', `the provider MUST see the same Idempotency-Key on every attempt of one effect — ${wire.length} attempt(s) on the wire carried ${wireKeys.size} distinct key(s)`),
+    ).toBe(1);
+    expect(
+      [...wireKeys][0],
+      req('openwop.requirement.0173.effect-identity-business-key.retry', 'spec/v2/core/idempotency.md §Layer 2: effect identity', 'the key the ledger records MUST be the key the provider received — a ledger that disagrees with the wire is not a witness'),
+    ).toBe([...keys][0]);
+    } finally {
+      await rx.close();
+    }
   });
 });

package/src/scenarios/v2-era-2-append-vocabulary.test.ts

@@ -28,7 +28,7 @@
 import { describe, it, expect } from 'vitest';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery } from '../lib/v2.js';
-import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
+import { softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 import { readErrorCode } from '../lib/error-envelope.js';
 import { codemapV1toV2, era2Gate, eventsOf, pollEvents, seedEra2Log, v1FixtureLog, type ReadEvent } from '../lib/era2-seed.js';
@@ -154,11 +154,20 @@ describe('v2-era-2-append-vocabulary (RFC 0176 §A — the writer rule)', () =>
     // positive witness: the stored spelling was the v1 one the reader maps
     // from. When every appended type is spelled the same in both vocabularies,
     // the rows above hold for a v1-writing and a v2-writing host alike, so the
-    // writer rule is unobserved — `blocked`, not a pass.
+    // writer rule is unobserved.
     const renamedV2 = new Set([...codemapV1toV2()].filter(([v1, v2]) => v1 !== v2).map(([, v2]) => v2));
     const appendedTypes = rows.slice(seedCount).map((r) => String(r.type ?? ''));
     if (!appendedTypes.some((t) => renamedV2.has(t))) {
-      return blockedDespiteAssertions(`every type the host appended to the era-2 log (${appendedTypes.join(', ') || 'none'}) is spelled identically in v1 and v2 (spec/v2/event-codemap.json), so a host writing v2 names reads back the same as one writing v1 names — the writer rule is unobserved. The leg needs a canonical mutation that appends a renamed type (e.g. run.resuming → run.resume-started); pause ${paused?.status ?? 'no response'} / resume ${resumed?.status ?? 'not attempted'} on the seeded run appended none, and the seed seam (api/seams-v2.yaml seedEra2EventLog) cannot seed a paused or interrupt-suspended era-2 run to resume.`);
+      // partial-witness-ok: HOTFIX 2.42.5 (2026-09-27). 2.42.3 and 2.42.4 made this
+      // `blockedDespiteAssertions`, which is bundle-fatal (RFC 0168 §E.1). No catalogued
+      // seam lets ANY host make a seeded era-2 run append a type the codemap renames,
+      // so the row blocked on every host and no host could certify. That is the suite's
+      // gap, not a host's. The append, the read-back and the sequence rules above ARE
+      // observed. The codemap-renaming writer rule is NOT, and this partial witness says
+      // so in its detail; the acceptance predicate refuses a partial-witness row. The
+      // seams-contract addition that makes the rule witnessable is in progress
+      // (openwop-1f); when it lands, this becomes a real assertion again.
+      return softSkip('inapplicable', `partial witness — the codemap-renaming writer rule is UNWITNESSED: every type the host appended to the era-2 log (${appendedTypes.join(', ') || 'none'}) is spelled identically in v1 and v2 (spec/v2/event-codemap.json), so a host writing v2 names reads back the same as one writing v1 names — the writer rule is unobserved. The leg needs a canonical mutation that appends a renamed type (e.g. run.resuming → run.resume-started); pause ${paused?.status ?? 'no response'} / resume ${resumed?.status ?? 'not attempted'} on the seeded run appended none, and the seed seam (api/seams-v2.yaml seedEra2EventLog) cannot seed a paused or interrupt-suspended era-2 run to resume. A seams-contract addition to seed one is in progress.`);
     }
   });
 

package/src/scenarios/v2-idempotency-in-flight.test.ts

@@ -106,6 +106,12 @@ describe('v2 idempotency-in-flight (idempotency.md Concurrency, RFC 0213 §B)',
     const r = await theRace();
     if (r.kind === 'blocked') return softSkip('blocked', r.reason);
     expect(r.successes.length, req(ID_ONE, DOC, `at least one of ${N} same-key creates MUST complete (statuses: ${r.all.map((x) => x.status).join(',')})`)).toBeGreaterThan(0);
+    // unfailable-leg audit wave 2, 2026-09-27: non-string runIds were FILTERED
+    // before the distinct-count, so a host answering the winner `201 {runId}`
+    // and every loser `201 {}` (a success that names no run — possibly a second
+    // one) passed. Every success MUST name the run it created or replayed.
+    const withoutRunId = r.successes.filter((x) => typeof (x.json as { runId?: unknown } | null)?.runId !== 'string');
+    expect(withoutRunId.length, req(ID_ONE, DOC, `every same-key success MUST carry the string runId of the one run processed (${withoutRunId.length} of ${r.successes.length} did not; statuses ${withoutRunId.map((x) => x.status).join(',')})`)).toBe(0);
     const runIds = new Set(r.successes.map((x) => (x.json as { runId?: unknown } | null)?.runId).filter((x): x is string => typeof x === 'string'));
     expect(runIds.size, req(ID_ONE, DOC, `a host MUST NOT process two same-key requests: distinct runIds ${[...runIds].join(', ')}`)).toBe(1);
   }, 60_000);
@@ -115,6 +121,16 @@ describe('v2 idempotency-in-flight (idempotency.md Concurrency, RFC 0213 §B)',
     if (r.kind === 'blocked') return softSkip('blocked', r.reason);
     const unmarked = r.successes.filter((x) => x.headers.get('openwop-idempotent-replay') !== 'true');
     expect(unmarked.length, req(ID_LOSER, DOC, `exactly one success is the winner; every other MUST carry OpenWOP-Idempotent-Replay: true (${unmarked.length} of ${r.successes.length} unmarked)`)).toBe(1);
+    // unfailable-leg audit wave 2, 2026-09-27: a marked replay was never
+    // compared to the winner, so a loser answered `201` + the replay header
+    // over a DIFFERENT (or no) runId passed. §Concurrency: the loser receives
+    // "the winner's response" — the same runId.
+    const winnerRunId = (unmarked[0]?.json as { runId?: unknown } | null)?.runId;
+    const replayRunIds = r.successes.filter((x) => x !== unmarked[0]).map((x) => (x.json as { runId?: unknown } | null)?.runId);
+    expect(
+      { winnerIsString: typeof winnerRunId === 'string', mismatched: replayRunIds.filter((id) => id !== winnerRunId).map(String) },
+      req(ID_LOSER, DOC, `a loser that waits MUST receive the winner's response — every marked replay MUST carry the winner's runId (${String(winnerRunId)})`),
+    ).toEqual({ winnerIsString: true, mismatched: [] });
     for (const x of r.refusals) {
       const code = readErrorCode(x.json);
       expect({ status: x.status, code }, req(ID_LOSER, DOC, `a loser that is not a replay MUST be 409 idempotency_in_flight (got ${x.status} ${String(code)})`)).toEqual({ status: 409, code: 'idempotency_in_flight' });

package/src/scenarios/v2-mcp-tasks.test.ts

@@ -307,7 +307,16 @@ describe('RFC 0198 — v2-mcp-tasks (MCP Tasks on the server mount; disconnect c
     const f = await createTask(m.url, 'conformance-failure');
     let terminal: Rpc;
     if (f.result?.['resultType'] === 'task') terminal = await pollTask(m.url, String(f.result['taskId']), (s) => ['completed', 'failed', 'cancelled'].includes(s), 10_000);
-    else return softSkip('inapplicable', 'conformance-failure finished before the host answered, so it was answered CallToolResult (RFC 0198 §B.4) — no task to project');
+    else {
+      // unfailable-leg audit wave 2, 2026-09-27: this branch returned
+      // softSkip('inapplicable') after the input_required asserts — a
+      // partial-witness PASS at both majors even when the synchronous answer
+      // was NOT a tool-error outcome. The synchronous CallToolResult of a
+      // failed run MUST still carry isError true; the task projection itself
+      // was not observed, so the row is `blocked` (stands at major 2).
+      expect((f.result as { isError?: unknown } | undefined)?.isError, req(ID_TASK_STATUS_PROJECTION, 'RFC 0198 §B.4; ext-tasks §Task Execution Errors', `a failed run answered synchronously is a CallToolResult with isError true (got ${JSON.stringify(f.error ?? f.result)})`)).toBe(true);
+      return softSkip('blocked', 'conformance-failure finished before the host answered, so it was answered CallToolResult (RFC 0198 §B.4) — the failed-run task-status projection was not observed');
+    }
     expect([terminal.result?.['status'], (terminal.result?.['result'] as { isError?: unknown } | undefined)?.isError], req(ID_TASK_STATUS_PROJECTION, 'interop-map.json mcp.tasks.status failed; ext-tasks §Task Execution Errors', `a failed run is a tool outcome: completed with result.isError true, never failed (got ${JSON.stringify(terminal.result)})`)).toEqual(['completed', true]);
   });
 
@@ -497,13 +506,18 @@ describe('RFC 0198 — v2-mcp-tasks (MCP Tasks on the server mount; disconnect c
     const ac = new AbortController();
     const resP = fetch(m.url, { method: 'POST', signal: ac.signal, headers: headersFor('tools/call', 'conformance-cancellable', undefined, 'text/event-stream, application/json'), body: JSON.stringify(envelope('tools/call', { name: 'conformance-cancellable', arguments: { delayMs: 20_000 } }, {})) });
     const runId = await freshRun('conformance-cancellable', before, 3000);
-    expect(runId, req(ID_NO_SERVER_CANCELLED, 'interop-map.json mcp.methods tools/call', 'the tools/call started a run listRuns shows')).not.toBeNull();
     const res = await resP;
+    // unfailable-leg audit wave 2, 2026-09-27: the runId assert used to run
+    // BEFORE this content-type gate, so a JSON-answering mount (which cannot
+    // carry notifications/cancelled at all) recorded a partial-witness PASS
+    // for "carries no notifications/cancelled". The gate now precedes any
+    // assertion, so the JSON mount is cleanly inapplicable.
     if (!(res.headers.get('content-type') ?? '').includes('text/event-stream')) {
       ac.abort();
-      await driver.post(`/runs/${encodeURIComponent(runId!)}/cancel`, {});
+      if (runId !== null) await driver.post(`/runs/${encodeURIComponent(runId)}/cancel`, {});
       return softSkip('inapplicable', 'the mount answered the blocking call as JSON, not SSE — a JSON response cannot carry a notifications/cancelled frame');
     }
+    expect(runId, req(ID_NO_SERVER_CANCELLED, 'interop-map.json mcp.methods tools/call', 'the tools/call started a run listRuns shows')).not.toBeNull();
     const cancel = await driver.post(`/runs/${encodeURIComponent(runId!)}/cancel`, {});
     expect(cancel.status, req(ID_NO_SERVER_CANCELLED, 'runs.md §Cancel', `REST cancelRun is accepted (got ${cancel.status})`)).toBeLessThan(300);
     const msgs: Array<Record<string, unknown>> = [];

package/src/scenarios/v2-min-client-version.test.ts

@@ -18,7 +18,7 @@ import { describe, it, expect } from 'vitest';
 import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery, v2Validator } from '../lib/v2.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 
 const DOC = 'spec/v2/core/versioning.md §1.5';
@@ -40,6 +40,16 @@ describe('v2 min-client-version (RFC 0172 §A.5 — gated on minClientVersion)',
     expect(typeof floor === 'string' && VERSION.test(floor), req('openwop.requirement.0172.min-client-version', DOC, 'minClientVersion MUST use the <major>.<minor> grammar (axis 15, as axis 1)')).toBe(true);
     const res = await http(() => driver.get('/.well-known/openwop', { authenticated: false, headers: { 'OpenWOP-Client-Version': '0.0.1' } }));
     if (res === null) return softSkip('blocked', 'GET /.well-known/openwop with OpenWOP-Client-Version unreachable (fetch failed)');
+    // unfailable-leg audit wave 2, 2026-09-27: every non-426 answer — including
+    // a 4xx/5xx that refused the client in an unregistered form — recorded
+    // `inapplicable` AFTER the grammar assert, i.e. a partial-witness PASS of
+    // the 426 refusal row. Only a SERVED request (2xx) is the MAY exercised; any
+    // other non-426 answer is `blocked`. Not asserted as a failure:
+    // `OpenWOP-Client-Version` is not yet declared in api/v2/openapi.yaml /
+    // headers.md, so a non-2xx here is not provably a version refusal.
+    if (res.status !== 426 && (res.status < 200 || res.status >= 300)) {
+      return blockedDespiteAssertions(`the host advertises minClientVersion ${String(floor)} and answered ${res.status} to a client announcing 0.0.1 — neither served (the MAY) nor refused with the registered 426 client_version_unsupported; the refusal form was not observed`);
+    }
     if (res.status !== 426) return softSkip('inapplicable', `the host advertises minClientVersion ${String(floor)} but served a client announcing 0.0.1 (${res.status}) — refusal is a MAY; nothing further is observable`);
     expect(readErrorCode(res.json), req('openwop.requirement.0172.min-client-version', DOC, 'a 426 refusal MUST carry client_version_unsupported')).toBe('client_version_unsupported');
     const r = v2Validator('error-envelope')(res.json);

package/src/scenarios/v2-run-diff-identical.test.ts

@@ -12,7 +12,10 @@
  * `schemas/v2/run-diff-response.schema.json` and echo both ids in `a` / `b`
  * (a host answering `{}` to any pair fails there); and, when
  * `conformance-failure` is advertised, a noop-vs-failure diff MUST diverge.
- * Without that fixture the divergence control records `inapplicable`.
+ * Without that fixture the divergence control cannot run and the leg records
+ * `blocked` (`blockedDespiteAssertions`): a host answering a constant
+ * `{a, b, divergedAtSeq: null, eventDiffs: []}` to every pair would otherwise
+ * pass on the identical-logs assertions alone.
  *
  * @see spec/v2/core/runs.md §Diff and ancestry
  * @see schemas/v2/run-diff-response.schema.json
@@ -23,7 +26,7 @@ import { driver, type OpenWOPResponse } from '../lib/driver.js';
 import { v2Discovery, v2Validator } from '../lib/v2.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
 import { readErrorCode } from '../lib/error-envelope.js';
-import { softSkip } from '../lib/soft-skip.js';
+import { softSkip, blockedDespiteAssertions } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
 
 const ID = 'openwop.requirement.0170.run-diff-identical';
@@ -65,10 +68,15 @@ describe('v2 run-diff-identical (runs.md §Diff and ancestry)', () => {
     expect([d.a, d.b], req(ID, DOC, 'the response MUST name the two runs it compared')).toEqual([a.runId, b.runId]);
     expect(d.divergedAtSeq, req(ID, DOC, `identical logs MUST yield divergedAtSeq: null (got ${String(d.divergedAtSeq)}) — eventId, runId, timestamp and other run-scoped fields MUST be excluded from the comparison`)).toBeNull();
     expect(d.eventDiffs, req(ID, DOC, 'identical logs MUST yield empty eventDiffs')).toEqual([]);
-    if (!isFixtureAdvertised(FAILURE)) return softSkip('inapplicable', `${FAILURE} fixture not advertised — the divergence control (a noop-vs-failure diff MUST diverge) cannot run`);
-    const f = await createSettled(FAILURE); if ('reason' in f) return softSkip('blocked', f.reason);
+    // unfailable-leg audit wave 2, 2026-09-27: without the divergence control,
+    // these returns were plain softSkips AFTER the identical-logs asserts, so a
+    // host answering a constant `divergedAtSeq: null, eventDiffs: []` to every
+    // pair recorded a (partial-witness) pass. The identical-logs result is only
+    // evidence once a different pair is seen to diverge — else `blocked`.
+    if (!isFixtureAdvertised(FAILURE)) return blockedDespiteAssertions(`${FAILURE} fixture not advertised — the divergence control (a noop-vs-failure diff MUST diverge) cannot run, so the identical-logs result is not evidence`);
+    const f = await createSettled(FAILURE); if ('reason' in f) return blockedDespiteAssertions(f.reason);
     const dv = await http(() => driver.get(`/runs/${enc(a.runId)}:diff?against=${enc(f.runId)}`));
-    if (dv === null || dv.status !== 200) return softSkip('blocked', `the divergence control diff answered ${dv?.status ?? 'no response'}`);
+    if (dv === null || dv.status !== 200) return blockedDespiteAssertions(`the divergence control diff answered ${dv?.status ?? 'no response'}`);
     const x = dv.json as Diff;
     expect(typeof x.divergedAtSeq === 'number' && Array.isArray(x.eventDiffs) && x.eventDiffs.length > 0, req(ID, DOC, `a noop log and a failure log MUST diverge (divergedAtSeq ${String(x.divergedAtSeq)}, ${Array.isArray(x.eventDiffs) ? x.eventDiffs.length : 0} diff(s)) — the identical-logs pass above is only evidence if a different pair does not also read identical`)).toBe(true);
   }, 45_000);

package/src/scenarios/v2-run-pause-resume.test.ts

@@ -71,7 +71,10 @@ describe('v2 run-pause-resume (runs.md §Pause and resume)', () => {
     if (resume === null) return softSkip('blocked', 'POST /runs/{runId}:resume unreachable (fetch failed)');
     expect(resume.status, req(ID, DOC, `resume on a run that is not paused MUST answer 409 — got ${resume.status} ${readErrorCode(resume.json) ?? ''}`.trim())).toBe(409);
     expect(readErrorCode(resume.json), req(ID, DOC, `a resume refused because the run is terminal MUST carry run_terminal (got ${String(readErrorCode(resume.json))})`)).toBe('run_terminal');
-    if (!isFixtureAdvertised(DELAY)) return softSkip('inapplicable', `${DELAY} fixture not advertised — the positive pause/resume leg cannot run, so the two 409s above are witnessed without their control (a host answering 409 to everything would pass them)`);
+    // unfailable-leg audit wave 2, 2026-09-27: 'inapplicable' after the 409
+    // asserts resolved to a partial-witness PASS — a host answering 409 to
+    // every pause/resume passed. `blocked` stands at major 2.
+    if (!isFixtureAdvertised(DELAY)) return softSkip('blocked', `${DELAY} fixture not advertised — the positive pause/resume leg cannot run, so the two 409s above are witnessed without their control (a host answering 409 to everything would pass them)`);
   });
 
   it('a running run pauses (202 paused), refuses a second pause (409), resumes (202 running), and the log carries run.paused then run.resumed', async () => {