@openwop/openwop-conformance 2.43.1 → 2.44.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.44.0] — 2026-09-28 — three run-failure codes registered, a webhook retry bound hosts can advertise, and RFC 0219 Accepted
+
+- **RFC 0219 is `Accepted`** (corpus only; no scenario change). The flip changes the packed `@openwop/spec-artifacts` tree through `spec/v1/gaps.json`: 0219 gap G6 is closed (SDK 2.5.0 sends the header), G7 is declared (`no-floor-no-refusal` needs a host with no `minClientVersion`), and G8 is transferred to #1763 (CORS).
+- **The 2.44.0 cycle opens.** RFC 0226 (`Active`) changes the packed `@openwop/spec-artifacts` tree after `v2.43.2` was tagged: `spec/v2/errors.json` gains `node_config_invalid` (422), `sandbox_invocation_error` (422) and `mcp_error` (502), `since` 2.44, and `capability_not_provided`'s `meaning` widens. The generated `schemas/v2/error-envelope.schema.json` and the `errors.md` table follow (108 → 111 codes). A minor, not a patch: the registry gains members. No scenario changes: `openwop.requirement.errors.event-code-registered` already reads every run-failure code against the registry, so a host emitting the three codes passes it once they are registered.
+- **RFC 0225 (`Active`; window waived by steward override of RFC 0147 §A.6): a webhook host may advertise `retryPolicy.maxElapsedMs`** (#1736). `lib/webhook-retry-window.ts` waits for an advertised bound plus a 30 s grace (the env var can still only raise it; 1 h ceiling). `v2-webhook-durable-delivery`'s dead-letter leg convicts only past that bound, on its existing row `0173.webhook-durable-delivery.dead-letter`. Without the member the leg stays `blocked`, as before.
+- **Suite `2.44.0`**. `@openwop/spec-artifacts` moves in lockstep at the same exact pin.
+
+## [2.43.2] — 2026-09-28 — three Class 3 corrections, and a failing scenario hook no longer hides its test
+
+- **The 2.43.2 cycle opens.** #1724 changes the packed `@openwop/spec-artifacts` tree (`spec/v2/core/interrupt.md`, `spec/v1/gaps.json`) after `v2.43.1` was tagged. No scenario changes in this entry: `approval.rejected` goes from SHOULD to MAY (Class 3), and no leg asserted the SHOULD.
+- **The replay outcome key uses the execution ordinal** (#1718, Class 3). New `v2-replay-suppression-ordinal.test.ts` (target major 2), row `openwop.requirement.replay.suppression-execution-ordinal`, fixture `conformance-replay-ordinal-loop` (start → effect → wait → effect). The suite cancels the source after `effect`'s first execution, then forks `mode: "replay"`. `effect`'s second execution has no recorded outcome for n = 2 and MUST fail closed with `replay_source_missing`; a host keyed on `(nodeId, attempt)`, or on the latest outcome, completes it instead. `inapplicable` unless the host runs cycles and advertises the fixture. No host witnesses it yet.
+- **Suite `2.43.2`**. `@openwop/spec-artifacts` moves in lockstep at the same exact pin.
+- **A scenario hook that fails no longer hides its test** (#1753). vitest runs a file's `afterEach` hooks in stack order, so a scenario's own cleanup runs before the runner's recorder. If it threw or timed out, the recorder never saw the test and the file row read "no test executed and no disposition recorded" (`blocked`). `setup.ts`'s `afterAll` now recovers such tests from vitest's task results (`unrecordedTests` in `lib/scenario-disposition.ts`, self-test `lib/unrecorded-tests.test.ts`), so the row is `executed-fail` and names the error.
+- **A fork has no ancestry parent** (Class 3). New `v2-run-fork-ancestry.test.ts` (target major 2), row `openwop.requirement.0040.fork-has-no-ancestry-parent`. It is gated on `replay` and on `multiAgent.executionModel.crossHostCausation.ancestryEndpointSupported`, and records `inapplicable` without them. It creates a `conformance-noop` run and checks its ancestry `parent` is `null` as a control. It then makes a branch fork at `fromSeq: 0`, checks the `201` names the source as `sourceRunId`, and asserts the fork's ancestry `parent` is `null` (`runs.md` §Diff and ancestry). It is a file of its own so that most v2 hosts, which do not advertise ancestry, do not get a `partial-witness` row on `v2-run-fork-refusals`. Measured on the v2 reference host (openwop-examples #124) with a temporary ancestry advertisement: `executed-pass`. With its previous `cause: "core.subWorkflow"` line restored the row fails, and a host reporting a parent for every run fails the control. As shipped, with nothing advertised, it records `inapplicable`. openwop-app also derives ancestry from the `parentRunId` its forks set, so it fails this row wherever it advertises ancestry.
+
 ## [2.43.1] — 2026-09-28 — major-1 certification works again, RFC 0223's routed and timed-out rejects are witnessed, and four Class 3 corrections
 
 - **`v2-manifest-hatch-carried`'s agent fixture is schema-valid.** Its `agents[0]` had neither `systemPrompt` nor `systemPromptRef`, and `agent-manifest` (v1 and v2) requires exactly one. A conforming host therefore had to refuse the pack for a reason unrelated to the `x-` hatch, and `0177.manifest-hatch-carried.agents-x-field` could not pass on any host. The fixture now carries `systemPrompt`. Validated against `schemas/v2/agent-manifest.schema.json`: invalid before, valid after. Reported by MyndHyve.

package/README.md

@@ -11,7 +11,7 @@
 # --legacy-peer-deps is REQUIRED, not optional: the exact peer pin is what npm's
 # default resolver refuses. npm 10.9 fails outright with
 # "Cannot read properties of null (reading 'edgesOut')" — use npm >= 11.
-npm install --legacy-peer-deps @openwop/openwop-conformance@2.43.1 @openwop/spec-artifacts@2.43.1
+npm install --legacy-peer-deps @openwop/openwop-conformance@2.44.0 @openwop/spec-artifacts@2.44.0
 # or run without install:
 npx @openwop/openwop-conformance --base-url https://api.example.com --api-key hk_test_...
 ```
@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 571 scenario files under `src/scenarios/`.
+The current suite has 573 scenario files under `src/scenarios/`.
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
@@ -481,7 +481,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 571 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 573 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/lib/scenario-disposition.js

@@ -142,6 +142,36 @@ testName) {
         return { disposition: 'blocked', detail: 'unclassified return: the test passed with zero assertions and recorded no reason — RFC 0148 §A resolves it to blocked, never to a pass' };
     return { disposition: 'skipped', detail: 'vitest skipped the test (ctx.skip / it.skip) without a recorded gate reason' };
 }
+/**
+ * The tests the per-test recorder never saw, as file states and failures.
+ *
+ * vitest runs a file's `afterEach` hooks in stack order, so a scenario's own
+ * `afterEach` (unregistering webhooks, closing a receiver) runs BEFORE the
+ * recorder `setup.ts` registers. If that hook throws or times out, vitest
+ * fails the test and skips the remaining hooks, so the recorder never runs.
+ * The file then has no recorded state, and its row read "no test executed and
+ * no disposition recorded" (`blocked`). That row gives no reason and hides a
+ * real failure. One tier-2 cut of `v2-webhook-message-id-stable` produced it
+ * on 2026-09-28.
+ *
+ * Only tests that finished `pass` or `fail` are recovered. A skipped test
+ * never reaches the recorder either way, and the existing rules already cover it.
+ */
+export function unrecordedTests(tests, recordedIds) {
+    const states = [];
+    const failures = [];
+    for (const t of tests) {
+        if (recordedIds.has(t.id))
+            continue;
+        if (t.state === 'pass')
+            states.push('pass');
+        else if (t.state === 'fail') {
+            states.push('fail');
+            failures.push({ name: t.name, message: `the test or its afterEach hook failed before the runner recorded it: ${t.message ?? 'no message'}` });
+        }
+    }
+    return { states, failures };
+}
 /**
  * The `executed-fail` detail for a file row: WHICH cases failed, and what the
  * first one said.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.43.1",
-  "stampSha256": "596087154d2220f81b333dc0567ed6a0ed90fbbd0ddf2e8981012800d954885b"
+  "version": "2.44.0",
+  "stampSha256": "37326a214e400e23aba6d56c45d06915c32f0187bd4fe637888e0e14221c9767"
 }

package/fixtures/conformance-replay-ordinal-loop.json

@@ -0,0 +1,31 @@
+{
+  "id": "conformance-replay-ordinal-loop",
+  "name": "Conformance: Replay outcome keyed on the execution ordinal",
+  "version": "1.0",
+  "description": "openwop#1718. start → effect (a side-effecting node) → wait (core.delay) → back to effect, bounded by settings.maxLoopbackIterations 2, so effect executes twice. The suite cancels the source run inside wait, after effect's first execution completed and before its second, then forks mode:\"replay\" at effect's first node.started. In the fork, effect's first execution resolves from the recorded outcome for n = 1, and its second execution has no recorded outcome for n = 2, so it MUST fail closed with replay_source_missing (replay.md §Suppression rule 2). A host keying on (nodeId, attempt) or selecting the latest outcome resolves the second execution from the first and completes it. core.conformance.side-effect is the reserved side-effecting typeId (see conformance-replay-side-effect). Advertised only by a host that runs cycles and suppresses side effects in replay.",
+  "nodes": [
+    { "id": "start", "typeId": "core.noop", "name": "Start", "position": { "x": 0, "y": 0 }, "config": {}, "inputs": {} },
+    { "id": "effect", "typeId": "core.conformance.side-effect", "name": "Side Effect", "position": { "x": 200, "y": 0 }, "config": {}, "inputs": {} },
+    {
+      "id": "wait",
+      "typeId": "core.delay",
+      "name": "Wait",
+      "position": { "x": 400, "y": 0 },
+      "config": {},
+      "inputs": { "delayMs": { "type": "variable", "variableName": "delayMs" } }
+    }
+  ],
+  "edges": [
+    { "id": "start-effect", "sourceNodeId": "start", "targetNodeId": "effect", "triggerRule": "any_success" },
+    { "id": "effect-wait", "sourceNodeId": "effect", "targetNodeId": "wait" },
+    { "id": "wait-effect", "sourceNodeId": "wait", "targetNodeId": "effect", "triggerRule": "any_success" }
+  ],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [
+    { "name": "delayMs", "type": "number", "defaultValue": 3000 }
+  ],
+  "metadata": { "tags": ["conformance", "replay"] },
+  "settings": { "timeout": 0, "maxLoopbackIterations": 2 }
+}

package/fixtures.md

@@ -61,6 +61,7 @@ All fixtures MUST advertise:
 | Idempotent                                | `conformance-idempotent`                                                                        | Verifies `Idempotency-Key` cache                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `completed`                                                                         | ≤ 5s                         |
 | Cancellable                               | `conformance-cancellable`                                                                       | Verifies `:cancel` endpoint mid-run                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `cancelled` after cancel                                                            | ≤ 60s (input-controlled)     |
 | Replay Side-Effect Suppression            | `conformance-replay-side-effect`                                                                | RFC 0140. Verifies a `mode:"replay"` fork does NOT re-fire a side-effecting node                                                                                                                                                                                                                                                                                                                                                                                                                                        | fork `failed` (`error.code='replay_source_missing'`)                                | ≤ 60s (input-controlled)     |
+| Replay ordinal loop | `conformance-replay-ordinal-loop` | openwop#1718 — a side-effecting node executed twice in a loop; a replay fork keys each execution by its ordinal `n` | `cancelled` (source); fork: execution 2 fails `replay_source_missing` | ~3 s + fork |
 | Capability Missing                        | `conformance-capability-missing`                                                                | Verifies dispatch refusal on unsatisfied `requires`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `failed` (`error.code='capability_not_provided'`)                                   | ≤ 5s                         |
 | Prompt End-to-End                         | `conformance-prompt-end-to-end`                                                                 | RFC 0027 + RFC 0029 end-to-end. Single `mock-ai` node with `config.systemPromptRef` set; host MUST emit `agent.promptResolved` + `prompt.composed` events during dispatch, then complete. Capability-gated on `capabilities.prompts.supported`.                                                                                                                                                                                                                                                                                                                                                                                                           | `completed`                                                                         | ≤ 10s                        |
 | Prompt All Four Kinds                     | `conformance-prompt-all-four-kinds`                                                             | RFC 0027 §A four-kind dispatch coverage with a MULTI-ENTRY `fewShotPromptRefs[]` array. Single `mock-ai` node with one ref per singular-kind slot (`systemPromptRef`, `userPromptRef`, `schemaHintPromptRef`) + two distinct templateIds in `fewShotPromptRefs[]`; host MUST emit 5 `agent.promptResolved` events (one per slot) AND 5 `prompt.composed` events. Multi-entry few-shot is the regression pin for `fewShotPromptRefs[slotIndex]` per-index resolution — a host that hard-codes `[0]` would emit the same template twice in the few-shot events and fail the per-templateId assertion. Capability-gated on `capabilities.prompts.supported`. | `completed`                                                                         | ≤ 10s                        |
@@ -303,6 +304,17 @@ The `messages`-mode stream fixture (AI token streaming) is covered by the determ
   3. Server emits `run.cancelled` within 5s.
   4. Subsequent `GET /v1/runs/{runId}` MUST return `status: "cancelled"`.
 
+### `conformance-replay-ordinal-loop`
+
+- **Purpose**: witness that a replay fork keys a side-effecting node's recorded outcome on `(sourceRunId, nodeId, n)`, where `n` counts the node's `node.started` events through this execution (`spec/v2/core/replay.md` §Suppression rule 2, openwop#1718).
+- **Shape**: `start` (`core.noop`) → `effect` (`core.conformance.side-effect`, `any_success`) → `wait` (`core.delay`) → `effect` (`any_success`); `settings.maxLoopbackIterations: 2`, so `effect` executes twice.
+- **Inputs**: `delayMs` (integer, default 3000), long enough to cancel inside `wait`.
+- **Expected behavior**:
+  1. The source run completes `effect`'s first execution. The client cancels it inside `wait`, before the second execution.
+  2. The client forks `mode: "replay"` at `effect`'s first `node.started`.
+  3. In the fork, execution 1 (n = 1) resolves from the recorded outcome. Execution 2 (n = 2) has none, so it MUST fail closed with `replay_source_missing` and MUST NOT complete.
+- **Advertise only if** the host runs cycles and maps `core.conformance.side-effect` to a side-effecting node (see `conformance-replay-side-effect`).
+
 ### `conformance-replay-side-effect`
 
 - **Purpose**: verify RFC 0140 — a `mode:"replay"` fork MUST NOT re-perform a side-effecting node's effect.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.43.1",
+  "version": "2.44.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.43.1"
+    "@openwop/spec-artifacts": "2.44.0"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 646,
-    "tests": 2488,
-    "withStableId": 2488,
+    "files": 648,
+    "tests": 2490,
+    "withStableId": 2490,
     "interpolatedTitles": 0,
-    "explicitIds": 2370
+    "explicitIds": 2372
   },
   "records": [
     {
@@ -33075,6 +33075,24 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-replay-suppression-ordinal.a-replay-fork-resolves-each-execution-of-a-looped-side-effecting-node-by-its-own",
+      "file": "v2-replay-suppression-ordinal.test.ts",
+      "line": 73,
+      "title": "a replay fork resolves each execution of a looped side-effecting node by its own ordinal, failing closed where none was recorded",
+      "explicitId": "openwop.requirement.replay.suppression-execution-ordinal",
+      "citations": [
+        {
+          "section": "spec/v2/core/replay.md §Suppression",
+          "requirement": "only the execution with a recorded outcome (n = 1) may complete in the fork; execution 2 has none and MUST NOT complete"
+        },
+        {
+          "section": null,
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-revocation-honored.a-revoked-next-request-credential-is-refused-on-the-next-request-with-credential",
       "file": "v2-revocation-honored.test.ts",
@@ -33322,6 +33340,38 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-run-fork-ancestry.a-branch-fork-is-not-a-composition-child-its-ancestry-parent-is-null",
+      "file": "v2-run-fork-ancestry.test.ts",
+      "line": 51,
+      "title": "a branch fork is not a composition child: its ancestry parent is null",
+      "explicitId": "openwop.requirement.0040.fork-has-no-ancestry-parent",
+      "citations": [
+        {
+          "section": "spec/v2/core/runs.md §Diff and ancestry",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/runs.md §Diff and ancestry",
+          "requirement": "the control: a run created by POST /runs was dispatched by no parent, so its ancestry parent MUST be null"
+        },
+        {
+          "section": "spec/v2/core/runs.md §Fork",
+          "requirement": "the fork's lineage is carried by the 201: sourceRunId MUST name the source"
+        },
+        {
+          "section": "spec/v2/core/runs.md §Diff and ancestry",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/runs.md §Diff and ancestry",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-run-fork-prefix.a-replay-fork-inherits-exactly-0-fromseq-the-event-at-fromseq-is-re-executed-nev",
       "file": "v2-run-fork-prefix.test.ts",
@@ -34359,6 +34409,11 @@
           "section": "runs.md §Create",
           "requirement": "POST /runs MUST answer 201 for the noop fixture"
         },
+        {
+          "section": "webhooks.md §Delivery (RFC 0225 maxElapsedMs)",
+          "requirement": null,
+          "interpolated": true
+        },
         {
           "section": "runs.md §Create",
           "requirement": "POST /runs MUST answer 201 for the noop fixture"
@@ -34381,7 +34436,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.the-dead-letter-read-is-served-and-its-records-carry-no-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 480,
+      "line": 486,
       "title": "the dead-letter read is served and its records carry no payload",
       "explicitId": "openwop.requirement.0188.dead-letter-read",
       "citations": [
@@ -34394,7 +34449,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.after-unregister-the-dead-letter-read-answers-404-not-found-as-for-a-subscriptio",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 501,
+      "line": 507,
       "title": "after unregister, the dead-letter read answers 404 not_found, as for a subscription that never existed",
       "explicitId": "openwop.requirement.0217.dead-letter-read-after-unregister",
       "citations": [
@@ -34421,7 +34476,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-dead-letter-record-carries-no-delivered-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 534,
+      "line": 540,
       "title": "a dead-letter record carries no delivered payload",
       "explicitId": "openwop.requirement.0188.dead-letter-content-free",
       "citations": [
@@ -34804,7 +34859,7 @@
     {
       "id": "openwop.it.v2-webhook-unregister-stops-delivery.no-attempt-for-an-unregistered-subscription-starts-after-the-204-while-its-contr",
       "file": "v2-webhook-unregister-stops-delivery.test.ts",
-      "line": 85,
+      "line": 86,
       "title": "no attempt for an unregistered subscription starts after the 204, while its control keeps being retried",
       "explicitId": "openwop.requirement.0215.unregister-stops-delivery",
       "citations": [

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 571,
+    "files": 573,
     "v1": 452,
-    "v2": 134
+    "v2": 136
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1521,6 +1521,9 @@
     "v2-relaxation-recorded.test.ts": [
       2
     ],
+    "v2-replay-suppression-ordinal.test.ts": [
+      2
+    ],
     "v2-revocation-honored.test.ts": [
       2
     ],
@@ -1539,6 +1542,9 @@
     "v2-run-diff-identical.test.ts": [
       2
     ],
+    "v2-run-fork-ancestry.test.ts": [
+      2
+    ],
     "v2-run-fork-prefix.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.43.1",
-  "corpusTag": "v2.43.1",
+  "version": "2.44.0",
+  "corpusTag": "v2.44.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "69464bc0e1e71ef3b543a73d4fa4f67202343d2603c80af8033f6c3619ef1b30",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "a0a51b581511aaec7f86c67e8157988e580564f569343556dfce3c5329926ce2",
-    "api/v2/asyncapi.yaml": "0ad04a46c6985d782a7cc3645ded70fd973fcda86ef244086419274062855c09",
-    "api/v2/openapi.yaml": "95bf518a2290e614e2ba750dfe5233f8df242fafdd31dd84beafbdd512c0e810",
+    "api/seams-v2.yaml": "7efbc96aa7d5fb2d501f90585cc7fbb10da6a0ff41289b52cf6ddadf04dc852a",
+    "api/v2/asyncapi.yaml": "ac39be9e90e1daf84cb12cc268be3152c6b50f6852129ac42820db43bb26f41d",
+    "api/v2/openapi.yaml": "a8b2fdc24b017cf146985dd2360da4e794a87deb83b98fc51c54a1363fc5e391",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -116,7 +116,7 @@
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
-    "schemas/v2/capabilities.schema.json": "ae6f60641d6ed680351b2710df945257c401f1ed83534f7e44fa2e651dc401ab",
+    "schemas/v2/capabilities.schema.json": "a76db7fbb18a98821c0ee4dfe51f615e59bb26c3d458bafd373fd3b6f7af4afe",
     "schemas/v2/certification-bundle.schema.json": "82ce31a1ed6c7e21b0ba88ff62a7b8b768fc3b176b1d06fce023203830b94725",
     "schemas/v2/channel-presence-payload.schema.json": "4eeb224910e6f7eee3ab5e7c3899559c25c83a26d0022e0ad195c4672611977a",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
@@ -142,7 +142,7 @@
     "schemas/v2/envelopes/schema.request.schema.json": "be2c5f7aa881cdd252ccff47ac02193659e1393633a1541f4297383205d384a2",
     "schemas/v2/envelopes/schema.response.schema.json": "d049a081267c06c28879c331b147f3ed821b14ccfd93005c67aff64db0a8c68e",
     "schemas/v2/envelopes/ui.a2ui-surface.schema.json": "e92a2548ba65454c9e0a34f72ea6768d18f59e61fa5da7668d0b2d5baddaddc8",
-    "schemas/v2/error-envelope.schema.json": "d1a6862930e7c3fbc8ec334ef17953ac7b716525c6c82769edf89d0809d0c94b",
+    "schemas/v2/error-envelope.schema.json": "34f467d5775618f740059dab0aa49bf26247101feb0cdae3403560b6baf5eda9",
     "schemas/v2/eval-summary.schema.json": "2f384daf05b8f3b4f604688cae504d6d9971ba41b8c771e55fe9a17e09e86b7a",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
     "schemas/v2/form-content-pack-manifest.schema.json": "a1942a124e250a6e9fbdb6b811c5a125e78fbcbcaa46dfc71d0636f24710a339",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "29f21e0fb2c7a232a92a5c19b4cba3a86bc3b5e16f06780452f0421c66c6ec38",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "0c23e7ab67fa69cda05de86da9dee127e62d82045137fcecc1684d3201feaa97",
+    "spec/v1/core-standard-manifest.json": "5ea51250e81a3bf70637811cdb3bacfa7d35609dc49ce1a4889f0cff9fb35c85",
     "spec/v1/deprecations.json": "46df807fb4adf0aae24671c20f69975cf3496e3bc3a521cb7e6ea556bdce563c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "dfdb7a8344316ec6b72e2e249736306cb19155f61180c5f13a44f57d51e803e8",
+    "spec/v1/gaps.json": "07b0f5a206a015336307dd343b75adec647f06a9bae59ee08dbbfac851c503d5",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "2efcd9064b2bc65a84a3b3d281aa86a91efd002690c1f4f14e8335c4a18194d1",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -221,7 +221,7 @@
     "spec/v2/core/conformance.md": "0cfceb926eed87055550a5c23e640210c795fc8cf9dd1b2544db0e2b3842c564",
     "spec/v2/core/connection-packs.md": "1ee129d792c537bfe82393ccb92555d8e6ddc342b1aa781a13f101b27ec38171",
     "spec/v2/core/conversation.md": "354fa57c73d11062e523a44aa75a6353c5c81aefaf306d30c42416a228c82c86",
-    "spec/v2/core/errors.md": "bcb62944d8a482b1b6d5ac08a692ad7e4aaadf6165746c7ba7fa39157be2a300",
+    "spec/v2/core/errors.md": "6d5a67389de84556f81e2558a30d83959c9283c8c5481ce7c759021e486d84fd",
     "spec/v2/core/events.md": "604abb6f9e2259a04103e1cb76d728712c3701c0d84dd915d4dc2949c912ee5e",
     "spec/v2/core/form-content-packs.md": "02931227899676fd4581a27017be2a6c4953904717be9b81c29d12f87ab3917d",
     "spec/v2/core/headers.md": "5cb1624fa63acc81992b6a6d842ec392cf7271aaf2f65d1f83c8c4fa286e6730",
@@ -230,32 +230,32 @@
     "spec/v2/core/idempotency.md": "2084d756789c1faf5121593fb39e67ca36a4c227178e175004742e403178ea49",
     "spec/v2/core/identity.md": "2dceb1c2697015e4a4fa8a9b28f4fbd25fa44a76ca5a919c752e2a8163c819db",
     "spec/v2/core/interop.md": "e72e25dff864c83b2980d7366b34054cffa072af0225821199f260f6228d260e",
-    "spec/v2/core/interrupt.md": "b4376fbbaaa0c7b0ca5df04d40049b487753f6736f8e54ed7d75b7f8563b2f72",
+    "spec/v2/core/interrupt.md": "4c825634acac72900ebd3c5ac5941f55648fa33d2df92913ef16371dcb700a34",
     "spec/v2/core/node-pack-runtimes.md": "e1088cb69b8c3c67256c494063328916c2980ab1aa97a7063de25bab82fdb1e5",
     "spec/v2/core/oauth.md": "c96483a44b62978c596945fbb7d7c863cf6056cd980fdb4cf4e97555e3e10b72",
     "spec/v2/core/overview.md": "4087f171b00a3907551f508fec32fb9b0b3ccec8c0ac1b0c7c6d32cd2c0e3ff8",
     "spec/v2/core/packs.md": "b472a583211d466d6ab8e00c414c225b246e678043fe6283a710c899fadde913",
     "spec/v2/core/persistence.md": "711874f74cb08b03cd118d683056db10a063517762fcea73ec70feb5d983e6a4",
     "spec/v2/core/portability.md": "87c4327f674f714fda6217fd79b99d2ba219ad47dc02f9751bb56c200fb2c17a",
-    "spec/v2/core/replay.md": "22cc8dc94cd145201f1269028fb0cb2abae2d988ee748205582edd59afd1da4d",
-    "spec/v2/core/runs.md": "157600d7dd2554856bba29e231e46489b5097cc0c0a0e74073549d410897a78b",
+    "spec/v2/core/replay.md": "4d379494057746c6883f6047972e93e621863b998ed291b9a691d3aa57c1ff43",
+    "spec/v2/core/runs.md": "55e21292ae4b41d0d104199a6c2634ecb3f787c4a671f9ebc37084be38ceef03",
     "spec/v2/core/security-defaults.md": "153884da7a2d54c30c81b5e649cfdef31e151b3a2a19dee1bc5a16c35d60a3aa",
     "spec/v2/core/tool-catalog.md": "d16a9004418719c48301804aefa4d7ab6f41112a4ed83727f552aa1b92b418b0",
     "spec/v2/core/versioning.md": "e3b3ab6d76e51035039a32173e9b412628a52c8fe7b16687ff58a2d0d983faa0",
-    "spec/v2/core/webhooks.md": "6fc2fb7d9a993a682765ebc68e5c5bb215046ee599234ca7a660465279444eff",
+    "spec/v2/core/webhooks.md": "2fcb502be558014fd20b342687e0f078a5388fc430b2f99d883c0e73ddf7789f",
     "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
     "spec/v2/corrections.json": "59f647f4d22477f6c2b06dcf913b682dde5d51dd5e607a5d0cf648ab60864d6e",
     "spec/v2/corrections.schema.json": "46bbffb954d13bd9995aebc912ceeb2544f7064331abf25fd6ab85c81a5cec94",
-    "spec/v2/declaration.json": "7765c86f7a3fbdd5a80c6778fb22335f099dcc4caddf9747fb144c1f318a17f1",
+    "spec/v2/declaration.json": "aba200967c28190c6889c27dcfb01fd02919d0c023b88693e9ffc57e9488021a",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
-    "spec/v2/errors.json": "dc1a846abe3e888acb0ce4a33cf9d1fb98e41fcc8b49f42b3682fd65deca2eb2",
+    "spec/v2/errors.json": "fa650cbbdf25a140fdaf82ec5269f95b4585ac4bdde1fa6b0b3ffe48a3f7943c",
     "spec/v2/errors.schema.json": "47404ad53e6147cf9017b813483712466573e419fb33e6c4b6c12d3e7deba1bc",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
     "spec/v2/event-codemap.schema.json": "b173f2a9bcc0bf9b62a474ce3b91e1431d597e64fd1560fc58662cd8606eaf9c",
     "spec/v2/ext/README.md": "e2731ebb5156ece1840ed3b96e7a347f6345e73071ff4e54df0f21c1585c5027",
     "spec/v2/ext/a2uiSurface/README.md": "5518c7f355262eb7cc584422f4ff8e548f066b211878f969274a3a578127622d",
-    "spec/v2/ext/brand/README.md": "4f9db1715219070fc57e06cc9b066f13aa130dd50f4869722d908e6e15720787",
-    "spec/v2/ext/canvas/README.md": "0e91b68566d2be90319feedfaebe2cd2db0bd8f72fb59c958fa723c05e38023f",
+    "spec/v2/ext/brand/README.md": "82989c018d7965bab029bcce7a67b1d76ffc433d08971a4cac91befcccc09438",
+    "spec/v2/ext/canvas/README.md": "00ca0856e3a0146f1eeaec87209d450e2900ed2748dc7520cc60250a0d3ffbeb",
     "spec/v2/ext/chat/README.md": "f59b6706162abbfff96f8bccd4c0e1aeed721047cf62e9af58c875727a38d716",
     "spec/v2/ext/coordination/README.md": "c7fe0884f52405fdd02c5f9ec309ac6b585685ee06ec5f338fff7acf03c07148",
     "spec/v2/ext/dataIntegration/README.md": "286dec8aa29e4d3225cbd8b3a361f5a438c3288e759966b9415ecbb99c576e70",
@@ -263,12 +263,12 @@
     "spec/v2/ext/grpc-transport/README.md": "6ba378e3c6d1f2e3269b392cfdf0c40565ee9bfa259d1baaa9ee1d350e38e792",
     "spec/v2/ext/kanban/README.md": "bfc386dc0f874a4afa1e3ec6a2f99084b547dcce9bd363da3b8ebd8786b9c184",
     "spec/v2/ext/knowledge/README.md": "cbe1f945a757791dedac0fd542a68c86c5b457778b831d58d9ae44a2baa270f2",
-    "spec/v2/ext/launchStudio/README.md": "c732bb855252c31ee1e971cbc2936f2ca29b234c111d548c648095634507babb",
-    "spec/v2/ext/messaging/README.md": "484cfa3091f89261dbdd48372afba441d3e6c16c3169a861b0ed7fc8c2902780",
+    "spec/v2/ext/launchStudio/README.md": "a941ef1d2401438a412eaea48d2d6ca807a032b44ea08719fea33120daf088a0",
+    "spec/v2/ext/messaging/README.md": "949f350e35294f52ad490e42699f8c560cd154549516fbaa1805f06312b7f342",
     "spec/v2/ext/portability/README.md": "c59423ee446638b748a911b9e97e803c4786157be6120f656f0a060586bc7b82",
     "spec/v2/ext/provider-idempotency/README.md": "9d1bccef0ec16a19a3370ae79c2f5a1726ce0d1d25a51352907f288a2ccb15d7",
     "spec/v2/ext/provider-idempotency/registry.json": "5b5fecad604fb4ab38da39f5abe697a4e57b05406c398f8afeb377331b2bd965",
-    "spec/v2/ext/restTransport/README.md": "acda51f1a973308841861a119def691db972f310c7b7250ab14f248e9c968585",
+    "spec/v2/ext/restTransport/README.md": "c875fd7ae4818a5d5e93ab9b21e569de8700bb07c4dafacd60a46a46e4022ddb",
     "spec/v2/ext/sandbox-runtime-notes/README.md": "0d1290fb1e20b2e35c0b15051541ab6546e4e2a6f693b4f912cb3f7d6a65e92c",
     "spec/v2/ext/webResearch/README.md": "b675e6f6646128d781b661f754c2393eed86e5935d16c3a22df582a5ce025b9b",
     "spec/v2/facets/a2a.schema.json": "b68bf5e29e455e46c2ad7cfcccf5963730ec2310ff9db81884550d8df30fd6ef",
@@ -286,7 +286,7 @@
     "spec/v2/facets/sandbox.schema.json": "e75f54486d387b2d089791aa93b5093cd1450f1920753a0f97fc23acdfe978ed",
     "spec/v2/facets/schemaVersions.schema.json": "890d3416c4b66511d51f329abc68e6f467f4338f16807e489fe682999b2b56b9",
     "spec/v2/facets/supportedEnvelopes.schema.json": "644f22cc2236e30a611b5b7f1ba0458ff1925d68b94c514d9672583224e126bd",
-    "spec/v2/facets/webhooks.schema.json": "2fac635ee5fbc10a14a1a46cf512a11bac660bfbabe0aea79f6c7b657ecb9e4e",
+    "spec/v2/facets/webhooks.schema.json": "54b576f1d150e28e1642693d846ce471c118e9c521bdf3924185305fbd1d0de4",
     "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
     "spec/v2/harness-trust-anchors.json": "6007b92eae16a070fbc3777424efb0abfe865fda89d096963109b96282b91205",
     "spec/v2/harness-trust-anchors.schema.json": "372b5d92337c893d3449eff3f6bfd009ac09fdac285296d8bdbe0a08fff9e34c",
@@ -298,9 +298,9 @@
     "spec/v2/path-manifest.json": "17298a245c5da9a70aa7ab0b7f2db4277e06209d6fcdd7187a8b4cea179c08f3",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "e52aaf9f10896088b2fcca2586ab05a477043275e7a3a48b769ffb4865e37c4a",
+    "spec/v2/release.json": "a93ba35569a8a8bbc68243fbaef446363e5d5d5d0b8c1235ec68d0eed5ab6363",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "d5b4e6c55a1d4bbe54241f9d0d020e7f9857f29912bb9f2ef910087b276be7e6"
+    "spec/v2/surface-baseline.json": "0d60d3d34ddc8f1290a2fc3a6be2e5ef5cfa211cde0918d8702ec4dd299d5549"
   },
-  "corpusCommit": "a99d0e2a2fd3000cff23cade553a6a45ad8f17a9"
+  "corpusCommit": "8bb20a89a81544aaf90b3a375fc6b1f4ffef3a33"
 }

package/src/lib/scenario-disposition.ts

@@ -153,6 +153,46 @@ export interface TestFailure {
   readonly message?: string;
 }
 
+/** A finished `it` as vitest's own task tree reports it. */
+export interface FinishedTest {
+  readonly id: string;
+  readonly name: string;
+  readonly state: string | undefined;
+  readonly message?: string;
+}
+
+/**
+ * The tests the per-test recorder never saw, as file states and failures.
+ *
+ * vitest runs a file's `afterEach` hooks in stack order, so a scenario's own
+ * `afterEach` (unregistering webhooks, closing a receiver) runs BEFORE the
+ * recorder `setup.ts` registers. If that hook throws or times out, vitest
+ * fails the test and skips the remaining hooks, so the recorder never runs.
+ * The file then has no recorded state, and its row read "no test executed and
+ * no disposition recorded" (`blocked`). That row gives no reason and hides a
+ * real failure. One tier-2 cut of `v2-webhook-message-id-stable` produced it
+ * on 2026-09-28.
+ *
+ * Only tests that finished `pass` or `fail` are recovered. A skipped test
+ * never reaches the recorder either way, and the existing rules already cover it.
+ */
+export function unrecordedTests(
+  tests: readonly FinishedTest[],
+  recordedIds: ReadonlySet<string>,
+): { states: FileTestState[]; failures: TestFailure[] } {
+  const states: FileTestState[] = [];
+  const failures: TestFailure[] = [];
+  for (const t of tests) {
+    if (recordedIds.has(t.id)) continue;
+    if (t.state === 'pass') states.push('pass');
+    else if (t.state === 'fail') {
+      states.push('fail');
+      failures.push({ name: t.name, message: `the test or its afterEach hook failed before the runner recorded it: ${t.message ?? 'no message'}` });
+    }
+  }
+  return { states, failures };
+}
+
 /**
  * The `executed-fail` detail for a file row: WHICH cases failed, and what the
  * first one said.

package/src/lib/webhook-retry-window.ts

@@ -22,12 +22,35 @@
  * default, or not a number, is ignored, so no operator can shrink the window to
  * hide a slow retry. A raised window is still bounded, so a host that never
  * retries still fails; it only fails later.
+ *
+ * RFC 0225 (suite 2.44.0): a host MAY advertise `retryPolicy.maxElapsedMs`,
+ * the longest from a delivery's first attempt to its dead-lettering. When it
+ * does, the wait is that bound plus a 30 s grace (the env var can still only
+ * raise it; clamped to the 1 h maximum), and a row convicts only once the wait
+ * has passed the advertised bound — the host's own promise, not a deadline the
+ * suite chose.
  */
 export const RETRY_WAIT_FLOOR_MS = 20_000;
 export const DEFAULT_RETRY_WAIT_CAP_MS = 90_000;
 /** A typo guard, not a policy: an hour per wait is longer than any retry schedule worth certifying in one sitting. */
 export const MAX_RETRY_WAIT_CAP_MS = 3_600_000;
 export const RETRY_WAIT_ENV = 'OPENWOP_WEBHOOK_RETRY_WAIT_MS';
+/** RFC 0225: slack past an advertised `maxElapsedMs` for delivery latency and the sink write. */
+export const ADVERTISED_BOUND_GRACE_MS = 30_000;
+
+export interface AdvertisedRetryPolicy { readonly backoff?: string; readonly maxAttempts?: number; readonly maxElapsedMs?: unknown }
+
+/** The advertised `retryPolicy.maxElapsedMs` (RFC 0225), or null when absent or not a positive integer. */
+export function advertisedMaxElapsedMs(policy: AdvertisedRetryPolicy | null): number | null {
+  const v = policy?.maxElapsedMs;
+  return typeof v === 'number' && Number.isInteger(v) && v >= 1 ? v : null;
+}
+
+/** Whether a wait of `waitedMs` reached past the host's advertised bound plus the grace — the only point a row may convict. */
+export function pastAdvertisedBound(policy: AdvertisedRetryPolicy | null, waitedMs: number): boolean {
+  const bound = advertisedMaxElapsedMs(policy);
+  return bound !== null && waitedMs >= bound + ADVERTISED_BOUND_GRACE_MS;
+}
 
 export function retryWaitCapMs(env: Record<string, string | undefined> = process.env): number {
   const raw = Number(env[RETRY_WAIT_ENV]);
@@ -39,8 +62,10 @@ export function retryWaitCapMs(env: Record<string, string | undefined> = process
  * The floor stays 20 s so a host that advertises nothing is measured exactly as
  * before; an advertised `exponential` / `fixed` backoff widens it to the cap.
  */
-export function retryWaitFor(policy: { backoff?: string } | null, capMs: number): number {
+export function retryWaitFor(policy: AdvertisedRetryPolicy | null, capMs: number): number {
   if (policy === null) return RETRY_WAIT_FLOOR_MS;
+  const bound = advertisedMaxElapsedMs(policy);
+  if (bound !== null) return Math.min(MAX_RETRY_WAIT_CAP_MS, Math.max(bound + ADVERTISED_BOUND_GRACE_MS, capMs));
   const backoff = String(policy.backoff ?? '');
   return backoff === 'exponential' || backoff === 'fixed' ? capMs : RETRY_WAIT_FLOOR_MS;
 }
@@ -49,7 +74,7 @@ export function retryWaitFor(policy: { backoff?: string } | null, capMs: number)
 export function windowClosedNote(seen: number, maxAttempts: number, waitedMs: number, capMs: number): string {
   const raised = capMs > DEFAULT_RETRY_WAIT_CAP_MS;
   return `${seen} of the advertised ${maxAttempts} attempts arrived inside the ${waitedMs}ms this scenario waits, and the delivery is not in the sink yet. `
-    + 'webhooks.retryPolicy carries only { maxAttempts, backoff } — no interval — so the suite cannot tell a slow conformant schedule from a host that stopped retrying, and it does not convict on a deadline it chose. '
+    + 'webhooks.retryPolicy advertises no maxElapsedMs (RFC 0225), so the suite cannot tell a slow conformant schedule from a host that stopped retrying, and it does not convict on a deadline it chose. A host can advertise retryPolicy.maxElapsedMs to have its own bound used. '
     + (raised
       ? `${RETRY_WAIT_ENV} is already raised to ${capMs}ms; set it above the SUM of this host's backoff intervals (at most ${MAX_RETRY_WAIT_CAP_MS}ms).`
       : `Set ${RETRY_WAIT_ENV} above the SUM of this host's backoff intervals (default ${DEFAULT_RETRY_WAIT_CAP_MS}ms; it can be raised, never lowered) and re-run.`);

package/src/scenarios/v2-replay-suppression-ordinal.test.ts

@@ -0,0 +1,108 @@
+/**
+ * `spec/v2/core/replay.md` §Suppression rule 2 — a replay fork resolves a
+ * side-effecting node's outcome keyed on `(sourceRunId, nodeId, n)`, where `n`
+ * counts the node's `node.started` events through this execution, including
+ * retries, later visits and the fork's inherited prefix (openwop#1718, suite
+ * 2.43.2, target major 2).
+ *
+ * The rule said `(nodeId, attempt)`. In a run where a node executes more than
+ * once (a loop back over an edge), that key names no single execution: a host
+ * counting attempts per execution resolves every visit from the first visit's
+ * outcome, and one selecting the latest recorded outcome does the same when
+ * only one exists.
+ *
+ * Construction (`conformance-replay-ordinal-loop`): start → effect → wait →
+ * effect, so `effect` executes twice. The suite cancels the source inside
+ * `wait`, after `effect`'s first execution completed and before its second, and
+ * forks `mode: "replay"` at `effect`'s first `node.started`. In the fork:
+ *   - `effect` execution 1 (n = 1) has a recorded outcome and resolves from it;
+ *   - `effect` execution 2 (n = 2) has none, so it MUST fail closed with
+ *     `replay_source_missing` (rule 3) and MUST NOT complete.
+ * Only the fail-closed half is asserted as the discriminator: a host keyed on
+ * the wrong ordinal completes execution 2 from execution 1's outcome.
+ *
+ * Gated on `replay` and on the fixture, which only a host that runs cycles and
+ * suppresses side effects advertises. No such host is known today (the v2
+ * reference host does not loop), so the row has a negative control only — see
+ * RFC 0140's gap register.
+ *
+ * @see spec/v2/core/replay.md §Suppression
+ * @see RFCS/0140-replay-side-effect-suppression.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { gateFamily } from '../lib/v2.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { scaledTimeoutMs } from '../lib/polling.js';
+
+const ID = 'openwop.requirement.replay.suppression-execution-ordinal';
+const DOC = 'spec/v2/core/replay.md §Suppression';
+const FIXTURE = 'conformance-replay-ordinal-loop';
+const EFFECT = 'effect';
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+interface Ev { readonly sequence?: unknown; readonly type?: unknown; readonly nodeId?: unknown; readonly payload?: { readonly nodeId?: unknown; readonly error?: { readonly code?: unknown } } }
+
+const enc = (id: string): string => encodeURIComponent(id);
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> { try { return await fn(); } catch { return null; } }
+const nodeOf = (e: Ev): unknown => e.nodeId ?? e.payload?.nodeId;
+
+async function logOf(runId: string): Promise<Ev[]> {
+  const res = await http(() => driver.get(`/runs/${enc(runId)}/events/poll?timeout=1&streamMode=debug`));
+  const events = (res?.json as { events?: unknown } | null)?.events;
+  return Array.isArray(events) ? (events as Ev[]).filter((e) => typeof e.sequence === 'number').sort((a, b) => (a.sequence as number) - (b.sequence as number)) : [];
+}
+async function statusOf(runId: string): Promise<string | null> {
+  const res = await http(() => driver.get(`/runs/${enc(runId)}`));
+  return res?.status === 200 ? String((res.json as { status?: unknown } | null)?.status ?? '') : null;
+}
+async function until(check: () => Promise<boolean>, ms: number): Promise<boolean> {
+  const deadline = Date.now() + ms;
+  for (;;) {
+    if (await check()) return true;
+    if (Date.now() > deadline) return false;
+    await new Promise((r) => setTimeout(r, 200));
+  }
+}
+
+describe('v2 replay-suppression-ordinal (replay.md §Suppression rule 2, openwop#1718)', () => {
+  it('a replay fork resolves each execution of a looped side-effecting node by its own ordinal, failing closed where none was recorded', async () => {
+    if (!(await gateFamily('replay'))) return softSkip('inapplicable', 'replay family not advertised (gate recorded under openwop.family.replay)');
+    if (!isFixtureAdvertised(FIXTURE)) return softSkip('inapplicable', `fixture ${FIXTURE} is not advertised — the host does not run cycles with a side-effecting node`);
+
+    const created = await http(() => driver.post('/runs', { workflowId: FIXTURE, inputs: { delayMs: 3000 } }));
+    const runId = (created?.json as { runId?: unknown } | null)?.runId;
+    if (created === null || created.status !== 201 || typeof runId !== 'string') return softSkip('blocked', `POST /runs (${FIXTURE}) answered ${created?.status ?? 'nothing'} ${readErrorCode(created?.json) ?? ''}`.trim());
+
+    // Cancel inside `wait`: effect's first execution completed, its second not yet started.
+    const firstDone = await until(async () => (await logOf(runId)).some((e) => e.type === 'node.completed' && nodeOf(e) === EFFECT), scaledTimeoutMs(10_000));
+    if (!firstDone) return softSkip('blocked', `the source run never completed ${EFFECT}'s first execution`);
+    await http(() => driver.post(`/runs/${enc(runId)}/cancel`, {}));
+    if (!(await until(async () => TERMINAL.has((await statusOf(runId)) ?? ''), scaledTimeoutMs(10_000)))) return softSkip('blocked', 'the cancelled source run did not settle');
+    const source = await logOf(runId);
+    const effectStarts = source.filter((e) => e.type === 'node.started' && nodeOf(e) === EFFECT);
+    const effectDone = source.filter((e) => e.type === 'node.completed' && nodeOf(e) === EFFECT);
+    if (effectStarts.length !== 1 || effectDone.length !== 1) return softSkip('blocked', `the source was cancelled with ${effectStarts.length} starts and ${effectDone.length} completions of ${EFFECT}, not exactly one of each — the second execution cannot be isolated`);
+
+    const fromSeq = effectStarts[0]!.sequence as number;
+    const fork = await http(() => driver.post(`/runs/${enc(runId)}:fork`, { mode: 'replay', fromSeq }));
+    const forkId = (fork?.json as { runId?: unknown } | null)?.runId;
+    if (fork === null || fork.status !== 201 || typeof forkId !== 'string') return softSkip('blocked', `POST /runs/{runId}:fork answered ${fork?.status ?? 'nothing'} ${readErrorCode(fork?.json) ?? ''} — forkRun owns that contract`.trim());
+    await until(async () => TERMINAL.has((await statusOf(forkId)) ?? ''), scaledTimeoutMs(20_000));
+    const forked = await logOf(forkId);
+    const forkEffect = forked.filter((e) => nodeOf(e) === EFFECT);
+
+    expect(
+      forkEffect.filter((e) => e.type === 'node.completed').length,
+      req(ID, DOC, 'only the execution with a recorded outcome (n = 1) may complete in the fork; execution 2 has none and MUST NOT complete'),
+    ).toBeLessThanOrEqual(1);
+    expect(
+      forkEffect.some((e) => e.type === 'node.failed' && e.payload?.error?.code === 'replay_source_missing'),
+      req(ID, `${DOC} rules 2–3`, `the second execution of ${EFFECT} (n = 2) has no recorded source outcome and MUST fail closed with replay_source_missing — a host keyed on (nodeId, attempt), or on the latest outcome, resolves it from the first execution instead`),
+    ).toBe(true);
+  }, 90_000);
+});

package/src/scenarios/v2-run-fork-ancestry.test.ts

@@ -0,0 +1,83 @@
+/**
+ * `spec/v2/core/runs.md` §Diff and ancestry — a fork has no ancestry parent
+ * (suite 2.43.2, target major 2; gated on `replay` and on
+ * `multiAgent.executionModel.crossHostCausation.ancestryEndpointSupported`;
+ * one run created plus one branch fork).
+ *
+ * `getRunAncestry`'s `parent` is the run that dispatched this one, and `cause`
+ * names the composition mechanism it used (`core.subWorkflow`,
+ * `core.dispatch`, `mcp-tool-call`, `a2a-message`). A fork is not dispatched:
+ * its lineage is `sourceRunId` on the fork `201` and `parentRunId` on the
+ * snapshot, and its ancestry `parent` MUST be `null`. A host that reuses its
+ * fork link as an ancestry parent reports `cause: core.subWorkflow` for a run
+ * no parent dispatched, and fails here.
+ *
+ * The source run's own ancestry is the control: it was created by `POST /runs`,
+ * so its `parent` is `null` too. Without it a host answering `null` for every
+ * run would pass the fork leg without being measured on it, and one answering
+ * non-null for every run would fail it for the wrong reason.
+ *
+ * Its own file, not a leg of `v2-run-fork-refusals`: the ancestry gate is
+ * absent on most v2 hosts, and an `inapplicable` leg would turn that file's
+ * row into a `partial-witness` pass on every one of them.
+ *
+ * @see spec/v2/core/runs.md §Diff and ancestry
+ * @see spec/v2/core/runs.md §Fork
+ * @see schemas/v2/run-ancestry-response.schema.json
+ * @see RFCS/0040-multi-agent-cross-host-causation.md §C
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, gateFamily, familyAdvertised } from '../lib/v2.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+
+const ID = 'openwop.requirement.0040.fork-has-no-ancestry-parent';
+const DOC = 'spec/v2/core/runs.md §Diff and ancestry';
+const NOOP = 'conformance-noop';
+const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
+
+async function discovery(): Promise<Record<string, unknown> | null> { try { return await v2Discovery(); } catch { return null; } }
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> { try { return await fn(); } catch { return null; } }
+const enc = (id: string): string => encodeURIComponent(id);
+async function status(runId: string): Promise<string | null> {
+  const res = await http(() => driver.get(`/runs/${enc(runId)}`));
+  return res?.status === 200 ? String((res.json as { status?: unknown } | null)?.status ?? '') : null;
+}
+
+describe('v2 run-fork-ancestry (runs.md §Diff and ancestry)', () => {
+  it('a branch fork is not a composition child: its ancestry parent is null', async () => {
+    if (!(await discovery())) return softSkip('blocked', 'v2 discovery unreachable');
+    if (!(await gateFamily('replay'))) return softSkip('inapplicable', 'replay family not advertised (gate recorded under openwop.family.replay) — forkRun is gated on replay (runs.md §Surface)');
+    const chc = ((await familyAdvertised('multiAgent'))?.['executionModel'] as { crossHostCausation?: { ancestryEndpointSupported?: unknown } } | undefined)?.crossHostCausation;
+    if (chc?.ancestryEndpointSupported !== true) return softSkip('inapplicable', 'multiAgent.executionModel.crossHostCausation.ancestryEndpointSupported not advertised — getRunAncestry is gated on it (runs.md §Surface)');
+
+    const created = await http(() => driver.post('/runs', { workflowId: NOOP }));
+    if (created === null) return softSkip('blocked', 'POST /runs unreachable (fetch failed)');
+    const runId = (created.json as { runId?: unknown } | null)?.runId;
+    if (created.status !== 201 || typeof runId !== 'string') return softSkip('blocked', `POST /runs answered ${created.status} ${readErrorCode(created.json) ?? ''}`.trim());
+    const t0 = Date.now(); let settled: string | null = null;
+    while (Date.now() - t0 < 10_000) { settled = await status(runId); if (settled !== null && TERMINAL.has(settled)) break; await new Promise((r) => setTimeout(r, 250)); }
+    if (settled === null || !TERMINAL.has(settled)) return softSkip('blocked', 'the noop run did not settle within 10 s');
+
+    const own = await http(() => driver.get(`/runs/${enc(runId)}/ancestry`));
+    if (own === null) return softSkip('blocked', 'GET /runs/{runId}/ancestry unreachable (fetch failed)');
+    expect(own.status, req(ID, DOC, `a host advertising ancestryEndpointSupported MUST serve getRunAncestry — got ${own.status} ${readErrorCode(own.json) ?? ''}`.trim())).toBe(200);
+    expect((own.json as { parent?: unknown } | null)?.parent, req(ID, DOC, 'the control: a run created by POST /runs was dispatched by no parent, so its ancestry parent MUST be null')).toBeNull();
+
+    const fork = await http(() => driver.post(`/runs/${enc(runId)}:fork`, { mode: 'branch', fromSeq: 0 }));
+    if (fork === null) return softSkip('blocked', 'POST /runs/{runId}:fork unreachable (fetch failed)');
+    if (fork.status === 404) return softSkip('blocked', 'POST /runs/{runId}:fork answered 404 with replay advertised — forkRun is not mounted');
+    const forkId = (fork.json as { runId?: unknown } | null)?.runId;
+    if (fork.status !== 201 || typeof forkId !== 'string') return softSkip('blocked', `a branch fork at fromSeq 0 answered ${fork.status} ${readErrorCode(fork.json) ?? ''} — no fork to read the ancestry of`.trim());
+    expect((fork.json as { sourceRunId?: unknown }).sourceRunId, req(ID, 'spec/v2/core/runs.md §Fork', 'the fork\'s lineage is carried by the 201: sourceRunId MUST name the source')).toBe(runId);
+
+    const anc = await http(() => driver.get(`/runs/${enc(forkId)}/ancestry`));
+    if (anc === null) return softSkip('blocked', 'GET /runs/{fork}/ancestry unreachable (fetch failed)');
+    expect(anc.status, req(ID, DOC, `getRunAncestry on a fork MUST answer 200 — got ${anc.status} ${readErrorCode(anc.json) ?? ''}`.trim())).toBe(200);
+    const parent = (anc.json as { parent?: unknown } | null)?.parent;
+    expect(parent, req(ID, DOC, `a fork is not dispatched, so its ancestry parent MUST be null — got ${JSON.stringify(parent)}. Its lineage is sourceRunId and the snapshot's parentRunId; ancestry's cause names a composition mechanism no fork used`)).toBeNull();
+  }, 30_000);
+});

package/src/scenarios/v2-webhook-durable-delivery.test.ts

@@ -35,7 +35,7 @@ import { absenceIsUnmeasured, noDeliveryCause, startScopedReceiver, type ScopedR
 import { readErrorCode } from '../lib/error-envelope.js';
 import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
-import { retryWaitCapMs, retryWaitFor, windowClosedNote } from '../lib/webhook-retry-window.js';
+import { pastAdvertisedBound, retryWaitCapMs, retryWaitFor, windowClosedNote } from '../lib/webhook-retry-window.js';
 
 export const REQUIRES_HOST_CALLBACK = 'the host POSTs and retries webhook deliveries to the suite-owned scoped receiver behind OPENWOP_WEBHOOK_RECEIVER_URL';
 
@@ -143,10 +143,10 @@ async function waitFor(pred: () => boolean, timeoutMs: number): Promise<boolean>
  * `webhooks.retryPolicy` first, `triggerBridge.retryPolicy` second for the
  * v1 overlap the schema explicitly preserves.
  */
-function advertisedRetryPolicy(doc: Record<string, unknown>): { maxAttempts?: number; backoff?: string } | null {
-  const read = (holder: unknown): { maxAttempts?: number; backoff?: string } | null => {
+function advertisedRetryPolicy(doc: Record<string, unknown>): { maxAttempts?: number; backoff?: string; maxElapsedMs?: unknown } | null {
+  const read = (holder: unknown): { maxAttempts?: number; backoff?: string; maxElapsedMs?: unknown } | null => {
     const rp = holder && typeof holder === 'object' ? (holder as { retryPolicy?: unknown }).retryPolicy : undefined;
-    return rp && typeof rp === 'object' ? (rp as { maxAttempts?: number; backoff?: string }) : null;
+    return rp && typeof rp === 'object' ? (rp as { maxAttempts?: number; backoff?: string; maxElapsedMs?: unknown }) : null;
   };
   return read(doc['webhooks']) ?? read(doc['triggerBridge']);
 }
@@ -314,8 +314,8 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
     // exactly RETRY_WAIT_CAP_MS — a host loses by the width of one delivery.
     // The obvious fix is to derive the wait from the intervals, and it cannot
     // be built: `spec/v2/facets/webhooks.schema.json` `retryPolicy` is
-    // `additionalProperties: false` over exactly { maxAttempts, backoff }.
-    // THE BASE INTERVAL IS NOT ON THE WIRE, so the suite cannot compute the
+    // `additionalProperties: false` over { maxAttempts, backoff } (RFC 0225 adds
+    // an OPTIONAL total `maxElapsedMs`, not the intervals). THE BASE INTERVAL IS NOT ON THE WIRE, so the suite cannot compute the
     // time to the Nth attempt, and any cap I pick is 2.0.1's 20-second
     // deadline again with a bigger literal.
     //
@@ -447,6 +447,12 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
     // sink still FAILS below; so does a delivery that was never retried.
     const seen = ours().length;
     if (inSink === false && policy?.maxAttempts !== undefined && attempts.length > 1 && seen < policy.maxAttempts) {
+      // RFC 0225: a host that advertised maxElapsedMs promised the sink by then.
+      // Past that bound (plus the grace) the empty sink is a conviction, not a
+      // window the suite closed early.
+      if (pastAdvertisedBound(policy, retryWaitMs(doc))) {
+        expect(inSink, req('openwop.requirement.0173.webhook-durable-delivery.dead-letter', 'webhooks.md §Delivery (RFC 0225 maxElapsedMs)', `a host advertising retryPolicy.maxElapsedMs (${String(policy.maxElapsedMs)} ms) MUST dead-letter an exhausted delivery within it — ${seen} of ${policy.maxAttempts} attempts arrived and the sink is empty after ${retryWaitMs(doc)} ms`)).toBe(true);
+      }
       return blockedDespiteAssertions(windowClosedNote(seen, policy.maxAttempts, retryWaitMs(doc), RETRY_WAIT_CAP_MS));
     }
     expect(create.status, req('openwop.requirement.0173.webhook-durable-delivery.dead-letter', 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);

package/src/scenarios/v2-webhook-message-id-stable.test.ts

@@ -89,7 +89,7 @@ describe('RFC 0201 §C.10 — webhook-id is stable across retries, distinct acro
       return m;
     };
     const expectedKeys = subs.length * EVENTS.length;
-    const window = retryWaitFor((g.facet['retryPolicy'] as { backoff?: string } | undefined) ?? null, CAP_MS);
+    const window = retryWaitFor((g.facet['retryPolicy'] as { backoff?: string; maxElapsedMs?: unknown } | undefined) ?? null, CAP_MS);
     await waitFor(() => {
       const m = byKey();
       return m.size >= expectedKeys && [...m.values()].every((a) => a.length >= 2);

package/src/scenarios/v2-webhook-unregister-stops-delivery.test.ts

@@ -8,7 +8,8 @@
  *
  * Absence is not evidence on its own (architect review, 2026-09-25). "No retry
  * arrived after the 204" proves nothing about a host whose next retry falls
- * outside the window, and `webhooks.retryPolicy` carries no interval, so the
+ * outside the window, and `webhooks.retryPolicy` carries no interval (RFC 0225's
+ * optional `maxElapsedMs` bounds the total, not the next retry), so the
  * suite cannot compute when that is. The leg therefore runs a CONTROL:
  *
  *   - two subscriptions on one receiver, both filtering `run.completed`, both
@@ -64,10 +65,10 @@ afterEach(async () => {
   if (receiver) { const rx = receiver; receiver = null; await rx.close(); }
 });
 
-function advertisedRetryPolicy(doc: Record<string, unknown>): { maxAttempts?: number; backoff?: string } | null {
-  const read = (holder: unknown): { maxAttempts?: number; backoff?: string } | null => {
+function advertisedRetryPolicy(doc: Record<string, unknown>): { maxAttempts?: number; backoff?: string; maxElapsedMs?: unknown } | null {
+  const read = (holder: unknown): { maxAttempts?: number; backoff?: string; maxElapsedMs?: unknown } | null => {
     const rp = holder && typeof holder === 'object' ? (holder as { retryPolicy?: unknown }).retryPolicy : undefined;
-    return rp && typeof rp === 'object' ? (rp as { maxAttempts?: number; backoff?: string }) : null;
+    return rp && typeof rp === 'object' ? (rp as { maxAttempts?: number; backoff?: string; maxElapsedMs?: unknown }) : null;
   };
   return read(doc['webhooks']) ?? read(doc['triggerBridge']);
 }

package/src/setup.ts

@@ -36,7 +36,7 @@ import { basename, join } from 'node:path';
 import { existsSync, readFileSync } from 'node:fs';
 import { PKG_ROOT_PATH } from './lib/paths.js';
 import { recordRequirement, hasRequirement, journalLength, journalSince } from './lib/requirement-ledger.js';
-import { requirementIdForFile, resolveFileRecord, resolveItRecord, type FileTestState, type TestFailure } from './lib/scenario-disposition.js';
+import { requirementIdForFile, resolveFileRecord, resolveItRecord, unrecordedTests, type FileTestState, type FinishedTest, type TestFailure } from './lib/scenario-disposition.js';
 import { softSkipDisposition, softSkipDispositionSince, softSkipMark } from './lib/soft-skip.js';
 import { ItIdAllocator, takeExplicitRequirementId } from './lib/requirement-ids.js';
 import { SPEC_COHERENCE_SCENARIOS, SPEC_COHERENCE_DETAIL } from './lib/spec-coherence.js';
@@ -250,6 +250,8 @@ const _fileStates = new Map<string, FileTestState[]>();
 const _fileAssertions = new Map<string, number>();
 /** Per file: the failing cases, so the file row can NAME them (2.37.0). */
 const _fileFailures = new Map<string, TestFailure[]>();
+/** Task ids the per-test recorder saw, so `afterAll` can recover the ones a throwing scenario hook hid (`unrecordedTests`). */
+const _fileRecorded = new Map<string, Set<string>>();
 const _ledgerMarks = new Map<string, number>();
 // Per-`it` recording (v2 charter Phase 1, suite 1.153.0 — the durable G8 fix
 // named in scenario-disposition.ts). Each test gets its own ledger row under
@@ -296,6 +298,20 @@ function registeredExplicitId(file: string, title: string): string | null {
   return _registry.get(`${file}\u0000${title}`) ?? null;
 }
 
+/** Every `it` under a suite or file task, with the state vitest settled on. */
+function _finishedTests(node: unknown): FinishedTest[] {
+  const out: FinishedTest[] = [];
+  const walk = (n: unknown): void => {
+    const t = n as { id?: string; name?: string; type?: string; tasks?: unknown[]; result?: { state?: string; errors?: Array<{ message?: string }> } };
+    if (t.type === 'test' && typeof t.id === 'string') {
+      const message = t.result?.errors?.[0]?.message;
+      out.push({ id: t.id, name: t.name ?? '', state: t.result?.state, ...(message === undefined ? {} : { message }) });
+    }
+    for (const c of t.tasks ?? []) walk(c);
+  };
+  walk(node);
+  return out;
+}
 function _fileOf(task: { file?: { filepath?: string; name?: string } } | undefined): string | null {
   const f = task?.file?.filepath ?? task?.file?.name;
   return typeof f === 'string' && f.length > 0 ? basename(f) : null;
@@ -414,6 +430,9 @@ afterEach(({ task }) => {
   if (file === null) return;
   if (!_ledgerMarks.has(file)) _ledgerMarks.set(file, 0);
   const state = task.result?.state;
+  const seen = _fileRecorded.get(file) ?? new Set<string>();
+  seen.add(task.id);
+  _fileRecorded.set(file, seen);
   const arr = _fileStates.get(file) ?? [];
   arr.push(state === 'pass' ? 'pass' : state === 'fail' ? 'fail' : 'skip');
   _fileStates.set(file, arr);
@@ -506,7 +525,10 @@ afterAll(({}, suite) => {
   const s = suite as unknown as { filepath?: string; name?: string; file?: { filepath?: string; name?: string } };
   const file = _fileOf({ file: s.file ?? s });
   if (file === null || !file.endsWith('.test.ts')) return;
-  const states = _fileStates.get(file) ?? [];
+  // A scenario hook that threw before the recorder ran hid its test; recover it from vitest's own results.
+  const hidden = unrecordedTests(_finishedTests(s.file ?? s), _fileRecorded.get(file) ?? new Set());
+  const states = [...(_fileStates.get(file) ?? []), ...hidden.states];
+  if (hidden.failures.length > 0) _fileFailures.set(file, [...(_fileFailures.get(file) ?? []), ...hidden.failures]);
   // Did a behaviorGate in this file record inapplicable/skipped for its profile?
   const mark = _ledgerMarks.get(file) ?? 0;
   const since = journalSince(mark);
@@ -550,6 +572,7 @@ afterAll(({}, suite) => {
   _fileStates.delete(file);
   _fileAssertions.delete(file);
   _fileFailures.delete(file);
+  _fileRecorded.delete(file);
   _ledgerMarks.delete(file);
   _itAllocators.delete(file);
   _itMarks.delete(file);