@openwop/openwop-conformance 2.44.4 → 2.44.6

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.44.6] — 2026-09-29 — RFC 0228 registers the v1 host-service codes, RFC 0227 moves the generated error table out of the core budget, and the last core families get v2 homes
+
+- **`0171.error-registry-prose-parity` is re-pointed (RFC 0227).** The `errors.md` status table moved to `spec/v2/generated/error-codes.md`, which the packed `@openwop/spec-artifacts` now ships. The row now requires that `errors.md` links the generated table, that the table holds every registered code, and that every count either document states equals the registry. No scenario is added or removed.
+- **The 2.44.6 cycle opens.** RFC 0228 goes `Active`: nine error codes are registered (`storage_limit_exceeded`, `egress_denied`, `upstream_unavailable`, `budget_exhausted`, `budget_model_denied`, `service_unavailable`, `run_expired`, `provider_policy_denied`, `eval_gate_unmet`) and `token_budget_exceeded` narrows to memory distillation. The v2 homes now name the codes their refusals return.
+- **New scenario `v2-unadvertised-operation-not-found`** (major 2): an unadvertised `/prompts` or `/content/settings` operation answers `404 not_found`, not v1's `501`. A host that still answers `501` fails it.
+- **`multiAgent` levels 2–6** are restated in `spec/v2/core/execution.md`, with per-event rules in `run-event-payloads.schema.json` descriptions. **`aiProviders`' narrowed facets** (`openwop.migration.C2.11`) and **`subWorkflow`'s v1 parent-link fields** (`openwop.migration.C4.18`) are recorded as retired, each with a codemod.
+- **`v2-interop-map-coherent`** gets a 180 s per-test timeout: its ~12 sabotaged sub-runs exceeded 30 s whenever the machine was loaded.
+
+## [2.44.5] — 2026-09-29 — a replay short-circuit raises no new interrupt request, and the hold node's outputs are pinned
+
+- **The 2.44.5 cycle opens.** Class 3 and editorial follow-ups to 2.44.4 change the packed `@openwop/spec-artifacts` tree (`replay.md`, `fixtures.md`). No scenario is added or removed.
+- **`core.conformance.hold`'s outputs are pinned, and `0223.replay-derives-rejection` cites its MUST.** The hold node's outputs are exactly its resolved inputs, `delayMs` included, under the same keys (`fixtures.md`), so hosts converge. The leg's requirement text now cites `replay.md` §Determinism caveats rule 2, which says a replay short-circuit raises no new `interrupt.requested` (clarified, Class 3).
+
 ## [2.44.4] — 2026-09-29 — six more core families get v2 normative homes, replay derives a rejection and counts terminals, and the replay fixtures wait on a pure hold node
 
 - **`0223.replay-derives-rejection`: replay derives a rejection, never re-decides it** (#1756). Two new legs in `v2-approval-reject-disposition` (target major 2), gated on `replay` advertising mode `replay` and on each fixture. The leg forks `mode: "replay"` at the gate's recorded `interrupt.resolved`, so the prefix holds the request and suspension and the fork must supply the resolution. It asserts four things. (i) No new `interrupt.requested` / `approval.requested` for the gate at or after `fromSeq`; this is the discriminator. (ii) The fork's `interrupt.resolved` carries the source's `decision`, `action` and `reason`. (iii) The fork fails the same way: `approval_rejected`, `failedNodeId: gate`, a non-retryable `node.failed`. (iv) Leg A only: a resolve answers `409 interrupt_already_resolved`. Leg B uses `conformance-approval-timeout-approve` and compares the fork's `resolvedBy` with the source's (a host subject or absent, RFC 0183), rather than requiring it absent. `interruptId` equality is not asserted. Forking at the gate's `node.started` was rejected: a host may re-emit the recorded request as history, which cannot be told from a new one. Measured on the v2 reference host (openwop-examples `b6302cd`): both legs `executed-pass`. With its replay derivation disabled, both fail.

package/README.md

@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 573 scenario files under `src/scenarios/`.
+The current suite has 574 scenario files under `src/scenarios/`.
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
 - 2026-08-19 (suite `1.137.0 → 1.138.0`): NEW `durability-poison-exhaustion.test.ts` — RFC 0158 §C.8, the FIRST row of that RFC's conformance table to land. Asserts what `failure-path.test.ts` cannot: not just that deterministically failing work reaches terminal, but that attempts STOP — counted on the log, re-counted after a scaled quiet window, asserted unchanged. A host still redelivering records more. Seam-gated on the existing event-log seam (`blocked` = unobservable, not unmet) and outside every profile floor.
@@ -481,7 +481,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 573 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 574 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.44.4",
-  "stampSha256": "0075c7ff983e3ad3d67935b7bb2287d624fee7b6517ccea44f89071741bdda9b"
+  "version": "2.44.6",
+  "stampSha256": "057afc21b70afb9d32deb6b8611fcb0bb6cfc332dd459749c9569dd0f26b4315"
 }

package/fixtures.md

@@ -590,7 +590,7 @@ The fixtures reference these typeIds:
 | `core.delay`                  | delay, cancellable                                     | Sleep `config.delayMs` ms                                                                                                                                                                |
 | `core.fail`                   | failure                                                | Throw with `code: "example.conformance_failure"` (a vendor code under the registered `example` org; errors.md §The registry, openwop#1698), message: "Intentional conformance failure"                                                                                                |
 | `core.approvalGate`           | approval                                               | Call `ctx.interrupt({kind: 'approval', ...})`                                                                                                                                            |
-| `core.conformance.hold` | replay-side-effect, replay-ordinal-loop | Conformance-RESERVED (openwop#1769). Completes after `inputs.delayMs` with its inputs as outputs and performs nothing observable outside the run's own event log. A host advertising a fixture that uses it MUST NOT classify it side-effecting (`replay.md` §Suppression rule 1) and MUST re-execute it live in a replay. |
+| `core.conformance.hold` | replay-side-effect, replay-ordinal-loop | Conformance-RESERVED (openwop#1769). Completes after `inputs.delayMs`; its outputs are exactly its resolved inputs, `delayMs` included, under the same keys. It performs nothing observable outside the run's own event log. A host advertising a fixture that uses it MUST NOT classify it side-effecting (`replay.md` §Suppression rule 1) and MUST re-execute it live in a replay. |
 | `core.clarificationGate`      | clarification                                          | Call `ctx.interrupt({kind: 'clarification', ...})`                                                                                                                                       |
 | `conformance.requiresMissing` | capability-missing                                     | Declares `requires: ['conformance.never-provided']`; engine MUST refuse dispatch. Opt-in fixture registration is recommended so production deployments don't expose the fixture surface. |
 | `conformance.artifact.emit` | artifact-emit | Opt-in (RFC 0205). Produce one artifact of `config.artifactType` with payload `config.data`; emit `artifact.created` naming it; readable through `getArtifact`. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.44.4",
+  "version": "2.44.6",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.44.4"
+    "@openwop/spec-artifacts": "2.44.6"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 648,
-    "tests": 2492,
-    "withStableId": 2492,
+    "files": 649,
+    "tests": 2494,
+    "withStableId": 2494,
     "interpolatedTitles": 0,
-    "explicitIds": 2372
+    "explicitIds": 2373
   },
   "records": [
     {
@@ -34085,6 +34085,42 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-unadvertised-operation-not-found.get-prompts-answers-404-not-found-when-prompts-endpointssupported-is-not-adverti",
+      "file": "v2-unadvertised-operation-not-found.test.ts",
+      "line": 43,
+      "title": "GET /prompts answers 404 not_found when prompts.endpointsSupported is not advertised",
+      "explicitId": "openwop.requirement.0228.unadvertised-prompts-not-found",
+      "citations": [
+        {
+          "section": "spec/v2/core/errors.md §Unadvertised operations",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/errors.md §Unadvertised operations",
+          "requirement": "the 404 for an unadvertised gated operation MUST carry the registered code not_found"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-unadvertised-operation-not-found.get-content-settings-answers-404-not-found-when-content-is-not-advertised",
+      "file": "v2-unadvertised-operation-not-found.test.ts",
+      "line": 54,
+      "title": "GET /content/settings answers 404 not_found when content is not advertised",
+      "explicitId": "openwop.requirement.0228.unadvertised-content-not-found",
+      "citations": [
+        {
+          "section": "spec/v2/core/errors.md §Unadvertised operations",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "spec/v2/core/errors.md §Unadvertised operations",
+          "requirement": "the 404 for an unadvertised gated operation MUST carry the registered code not_found"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-unmapped-type-refused.poll-over-a-log-with-an-unmapped-unprefixed-type-fails-with-500-event-type-unmap",
       "file": "v2-unmapped-type-refused.test.ts",
@@ -42628,20 +42664,28 @@
       ]
     },
     {
-      "id": "openwop.it.v2-error-registry-prose-parity.errors-md-states-the-registry-count-it-was-generated-from-and-renders-every-code",
+      "id": "openwop.it.v2-error-registry-prose-parity.errors-md-states-the-registry-count-and-links-the-generated-table-which-renders",
       "file": "v2-error-registry-prose-parity.test.ts",
-      "line": 35,
-      "title": "errors.md states the registry count it was generated from and renders every code",
+      "line": 40,
+      "title": "errors.md states the registry count and links the generated table, which renders every code",
       "explicitId": "openwop.requirement.0171.error-registry-prose-parity",
       "citations": [
         {
           "section": "spec/v2/core/errors.md",
+          "requirement": "errors.md MUST link the generated code table (spec/v2/generated/error-codes.md), so a reader of the spec reaches every registered code"
+        },
+        {
+          "section": "spec/v2/generated/error-codes.md",
+          "requirement": "the generated code table MUST exist beside the registry it restates"
+        },
+        {
+          "section": "spec/v2/generated/error-codes.md",
           "requirement": null,
           "interpolated": true
         },
         {
           "section": "spec/v2/core/errors.md",
-          "requirement": "errors.md states the registry size at least once, so the claim is checkable"
+          "requirement": "errors.md and the generated table state the registry size, so the claim is checkable"
         },
         {
           "section": "spec/v2/core/errors.md",
@@ -42653,7 +42697,7 @@
     {
       "id": "openwop.it.v2-error-registry-prose-parity.approval-rejected-is-a-registered-422-not-retriable-and-interrupt-md-rejection-n",
       "file": "v2-error-registry-prose-parity.test.ts",
-      "line": 67,
+      "line": 83,
       "title": "approval_rejected is a registered 422, not retriable, and interrupt.md §Rejection names it",
       "explicitId": "openwop.requirement.0223.code-registered",
       "citations": [
@@ -42829,21 +42873,10 @@
     {
       "id": "openwop.it.v2-interop-map-coherent.the-map-agrees-with-the-v2-wire-and-the-gate-refuses-each-defect-it-exists-to-ca",
       "file": "v2-interop-map-coherent.test.ts",
-      "line": 62,
+      "line": 65,
       "title": "the map agrees with the v2 wire, and the gate refuses each defect it exists to catch",
-      "explicitId": "openwop.requirement.0208.map-coherent",
-      "citations": [
-        {
-          "section": "RFCS/0208 §A; spec/v2/core/interop.md §\"The operation mappings\"",
-          "requirement": null,
-          "interpolated": true
-        },
-        {
-          "section": "RFCS/0208 §A; spec/v2/core/interop.md §\"The operation mappings\"",
-          "requirement": null,
-          "interpolated": true
-        }
-      ]
+      "explicitId": null,
+      "citations": []
     },
     {
       "id": "openwop.it.v2-lane-exp-only-schema.exp-only-validates-on-a-jwt-lane-and-is-refused-on-api-key-and-session-and-only",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 573,
+    "files": 574,
     "v1": 452,
-    "v2": 136
+    "v2": 137
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1584,6 +1584,9 @@
     "v2-tool-catalog-annotations.test.ts": [
       2
     ],
+    "v2-unadvertised-operation-not-found.test.ts": [
+      2
+    ],
     "v2-unmapped-type-refused.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.44.4",
-  "corpusTag": "v2.44.4",
+  "version": "2.44.6",
+  "corpusTag": "v2.44.6",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "69464bc0e1e71ef3b543a73d4fa4f67202343d2603c80af8033f6c3619ef1b30",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "0c5a5ce153d5ac87b89f331f1e13ac25389937f966adbd3207bdfcc17e7ef8f5",
-    "api/v2/asyncapi.yaml": "d195115d983cadc6ae08d617de1a1c2f09073b22b0e5309ddd9119319164c566",
-    "api/v2/openapi.yaml": "d928ce4c62122954da1fecd5a79baff89957e65d4cc54606868bed92127b70c6",
+    "api/seams-v2.yaml": "14204b626e15260475291b01b6c939f883a28f389378bcc3be7826f0c3533e47",
+    "api/v2/asyncapi.yaml": "776ffe2877d564f87f11e1b7b7bbef63318962da3d59b0d9491979dc26889f2d",
+    "api/v2/openapi.yaml": "b9025ba5ccd9c5c18fd2dbb695c1f196207aca89509da1d4bbf46094ebf5b898",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -106,7 +106,7 @@
     "schemas/v2/agent-inventory-response.schema.json": "a10aaa896b8d0bc0f6159232095c4ee120947d51bf5b993181b9a576d3c98759",
     "schemas/v2/agent-manifest.schema.json": "0e6927f1d19ca404dffeb545faf81fa5b1acbaeb1c99b48dd5179071316407ce",
     "schemas/v2/agent-org-chart.schema.json": "113b079e1dce95908467cbef7f83e076fdb82aab5b0678fc1a43e32bfc9cbadf",
-    "schemas/v2/agent-ref.schema.json": "a86e98f7ffcbc4d7da145633e3010842e05e23e153d53c431d28dd72da0ec9de",
+    "schemas/v2/agent-ref.schema.json": "e0aedf6b3c3325024d3f0a6a8a2c3ffc26e61a0dfb992a3f757df54a1d42a060",
     "schemas/v2/agent-roster-entry.schema.json": "72132a80a3eb305e83727fbf6e105d7bd1790b481231d6ff864fd18d5554fc27",
     "schemas/v2/agent-roster-response.schema.json": "f646b8a5af9ee884e1a86a9c84ec29f10dd3dbb275711ce79db27bee981d4a1d",
     "schemas/v2/ai-envelope.schema.json": "0dc7dfbf032a37239ffd81fc2d67f999a40782ff5074866a56e414164cdee809",
@@ -115,8 +115,8 @@
     "schemas/v2/artifact-type-pack-manifest.schema.json": "acbbf14d32da4e0cb81254bbd6cc48fc10083890572044ddef71c59a0f65c185",
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
-    "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
-    "schemas/v2/capabilities.schema.json": "a76db7fbb18a98821c0ee4dfe51f615e59bb26c3d458bafd373fd3b6f7af4afe",
+    "schemas/v2/budget-policy.schema.json": "1de68095db0beb5c7a4be629de26e79f62ebbe748a88d46f36e768edfd1f0d68",
+    "schemas/v2/capabilities.schema.json": "d0b72f589b4e29ef69bd26e38a309aca1db2965c8441cae56c1dcc12c8d7152f",
     "schemas/v2/certification-bundle.schema.json": "82ce31a1ed6c7e21b0ba88ff62a7b8b768fc3b176b1d06fce023203830b94725",
     "schemas/v2/channel-presence-payload.schema.json": "4eeb224910e6f7eee3ab5e7c3899559c25c83a26d0022e0ad195c4672611977a",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
@@ -130,7 +130,7 @@
     "schemas/v2/conversation-turn.schema.json": "75bb6a4a03072a958feb5b34e2a1f40471e9e3996a81fa430b65717f0773c9a4",
     "schemas/v2/credential-provenance.schema.json": "f86b09e94b1c524dec7d1c6353965665ae8891e9517faef6e742d639c5578c99",
     "schemas/v2/credential-reference.schema.json": "ea699ce30f58fb2c32d4279158b3f730f70be7b2dc8c3037693a76e66eb3e001",
-    "schemas/v2/debug-bundle.schema.json": "0bfa4b1d91fefbc12c95670dba9d5eacb72b879bb9a5c074e821ca9ed0fee6fd",
+    "schemas/v2/debug-bundle.schema.json": "f2b72cd658a2072e24031fcd916ba3eb8afe5618c540ea0e7e5cc79ef29d5cab",
     "schemas/v2/dispatch-config.schema.json": "5718c1ed7d95672e618bcb1f1da8e38180e144b12151307afc3aba1314dfcef0",
     "schemas/v2/effect-ledger-projection.schema.json": "0d118d385a43921118a76888449c5c3c5618eab1b80914b84a0a1b48d18822c1",
     "schemas/v2/effect-seam-manifest.schema.json": "197ef9944ab027a50d1b9352f317cbbc12c8ad955fdb14650fb90477052ffef0",
@@ -142,7 +142,7 @@
     "schemas/v2/envelopes/schema.request.schema.json": "be2c5f7aa881cdd252ccff47ac02193659e1393633a1541f4297383205d384a2",
     "schemas/v2/envelopes/schema.response.schema.json": "d049a081267c06c28879c331b147f3ed821b14ccfd93005c67aff64db0a8c68e",
     "schemas/v2/envelopes/ui.a2ui-surface.schema.json": "e92a2548ba65454c9e0a34f72ea6768d18f59e61fa5da7668d0b2d5baddaddc8",
-    "schemas/v2/error-envelope.schema.json": "34f467d5775618f740059dab0aa49bf26247101feb0cdae3403560b6baf5eda9",
+    "schemas/v2/error-envelope.schema.json": "fb85e2020a91e0c1590a78f57bbf3bbf1cffbc1bc60e1ae692265a77e9d937ff",
     "schemas/v2/eval-summary.schema.json": "2f384daf05b8f3b4f604688cae504d6d9971ba41b8c771e55fe9a17e09e86b7a",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
     "schemas/v2/form-content-pack-manifest.schema.json": "a1942a124e250a6e9fbdb6b811c5a125e78fbcbcaa46dfc71d0636f24710a339",
@@ -157,21 +157,21 @@
     "schemas/v2/localized-content-section.schema.json": "b52cfe36c857c2800f71c480dcd7323e1a29783ecdc9f2440bc8e75a5a034346",
     "schemas/v2/memory-entry.schema.json": "290576ae84f4fef4cdf975932b87963283b11c50ea3d2654b32cd96aa6537c3d",
     "schemas/v2/memory-list-options.schema.json": "f66703bccb68efb28391c273abb66aa117ee5b5ce475c477846ed700c336afcd",
-    "schemas/v2/node-pack-manifest.schema.json": "d8daf0d01bb0d7a5aec16d15fc55e39daa99356e62522773a6f73d35f78ac1ef",
+    "schemas/v2/node-pack-manifest.schema.json": "6e25106c647d58ff6b11c198a83de7f1f988e47c8e3bf9f28ac5f84eef900f5d",
     "schemas/v2/orchestrator-decision.schema.json": "2da17538e84cfbe70151eb118f1ccf670cff58b8697148e394074d32ac4af6b4",
     "schemas/v2/org-chart-responsibility-view.schema.json": "8a2565e4cdc6737a3946a70799f93642808b92f9c8d56dcdff3a0782053b89a1",
     "schemas/v2/pack-lockfile.schema.json": "2685417702c105146b780cd99154296a46578fbb10d81c8c713348ee26fea898",
     "schemas/v2/part.schema.json": "08b75eaec9a0b4a8cedca7bab732dd906b52b0749eaa444ec1ac015aa43519a5",
     "schemas/v2/prompt-kind.schema.json": "67251c937a5a91fb97c0422050e808dc0c162a9b8561366814cf87b0a7f62e00",
     "schemas/v2/prompt-pack-manifest.schema.json": "752407469475396ad250085437a6cc6bd56a017ac6d3e52196aecc65dda4e51a",
-    "schemas/v2/prompt-ref.schema.json": "11538fa36a7a652c93100cac4f1857eb4130137b546e3d94890618636d44b729",
-    "schemas/v2/prompt-template.schema.json": "494fc83028cb3af5dbb8a943d0e83b2348f7775e9fa02369162bcb58a6f81559",
+    "schemas/v2/prompt-ref.schema.json": "8288495bf353fbc158cef6525d16dd1dcd9373941d15ec072044f05d143355d0",
+    "schemas/v2/prompt-template.schema.json": "63825b39807e4ee85d41b9ad296ff2a0dd7bd2076d91e76a6c15a337e3e3bb84",
     "schemas/v2/proposal.schema.json": "a5c582ce1e854e5fe10412ebed00e537961ee827bbaca506ca374b200a685992",
     "schemas/v2/registry-version-manifest.schema.json": "940cfd82511690cd6f2539e5676b185e7812628d0707c283fd7ffb33b6e54afd",
     "schemas/v2/residency.schema.json": "3fd23c9732beb140504e81560fc426eb6764d547e56da5fb92c5a5c7bf04db3a",
     "schemas/v2/run-ancestry-response.schema.json": "334c17f2062dea62726ca1d07b8be3f169cdc422af843c1def5fb317039814c9",
     "schemas/v2/run-diff-response.schema.json": "8bdb2045c274580038bd74781f7d062f5049839797c164a89de4ed89edc53a74",
-    "schemas/v2/run-event-payloads.schema.json": "f8518f366ad4379356eaf94063817ea0e75975873b883f75e42d98bef6eb4565",
+    "schemas/v2/run-event-payloads.schema.json": "b2aa55840c0817c703417fd746ba85f72be7268b92f450143dfc1faf2f8fa119",
     "schemas/v2/run-event.schema.json": "2f0d7416bd376c56affe97b6b2b49981532e8e9ff45c0a162cf806c78b3e7fb7",
     "schemas/v2/run-list-response.schema.json": "c2dbc34768dcf64528914a213aa3cb55952e8e3e90a64b04a9423b2a19749d38",
     "schemas/v2/run-options.schema.json": "f0e9f494d80086c2ed2cf9fe87df54e5b4e66601699c4a1089f4edbc7ba58867",
@@ -202,56 +202,56 @@
     "schemas/workload-identity.schema.json": "64ed93e12cc9f0657e56ff9b8f045e5d68d397df5276d103c07f42c7f34f0579",
     "schemas/workspace-file-create.schema.json": "70a23b92c2958c0165d7d29aea9020a045dc7816af82c80c5f50d0aac19c4856",
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
-    "spec/v1/alias-detectors.json": "29f21e0fb2c7a232a92a5c19b4cba3a86bc3b5e16f06780452f0421c66c6ec38",
+    "spec/v1/alias-detectors.json": "0b2f28808ffe0b9d98a187775038c3406bb70919747a788a6e4f866e293ae6d3",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "8f01c8ce3e66e4ff879e28da7f0de8bb8e2f3f85e5855cae17f0563c902328e5",
-    "spec/v1/deprecations.json": "46df807fb4adf0aae24671c20f69975cf3496e3bc3a521cb7e6ea556bdce563c",
+    "spec/v1/core-standard-manifest.json": "3e1d14b773b99f5b1d0d96167df2a938e662c96aa37f1561b8c9aa59cbd65561",
+    "spec/v1/deprecations.json": "a3293072ea951857395d05f0437264e88965f1e9019ff61c55bacfa9c1aaa17c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "11c35393ad666899fe8a668c45fa69f79d20361ab57e84949dce3bc2f528d5c3",
+    "spec/v1/gaps.json": "8475d4f9a3ba3767d30d8e7d7a0b86ec3042718de0ab85a10d149b91360bc67d",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
-    "spec/v1/migrations.json": "ca57b7ce335a681aaa78573ce229e9c3d7d75859f03e087ae93bbfc889359127",
+    "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
     "spec/v1/operation-path-manifest.json": "fada0342815fb129c1ae61f1829bd6e34417717408ce86fcc54280f373c19e74",
     "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
     "spec/v2/README.md": "ddea90d7cf14aefffe1a43eeeecd4222dadad1d1e5ac64dceb073990eb93d9ef",
-    "spec/v2/core/artifact-type-packs.md": "e143bfd6f98d4867855bb57090a6b854e98d4b0a6202b9b3734cb45366f99854",
-    "spec/v2/core/capabilities.md": "ad728e8a761153b55d036ece55043ff62d0982121e2e629e5e7cdf560fca3c03",
-    "spec/v2/core/conformance.md": "0cfceb926eed87055550a5c23e640210c795fc8cf9dd1b2544db0e2b3842c564",
+    "spec/v2/core/artifact-type-packs.md": "f734740cc3963f86c9f273a7dace26291bba2855161ddd3540618131a2c8d13e",
+    "spec/v2/core/capabilities.md": "04feda1747ca8f97443176cbf82d7d69891322a7bbf9a9bed88f519b8fb574fe",
+    "spec/v2/core/conformance.md": "3ca291e63bc70a6ef829ae8759ad0ded3741ea7aa507bbbdffc57de443ab2ae2",
     "spec/v2/core/connection-packs.md": "1ee129d792c537bfe82393ccb92555d8e6ddc342b1aa781a13f101b27ec38171",
     "spec/v2/core/conversation.md": "354fa57c73d11062e523a44aa75a6353c5c81aefaf306d30c42416a228c82c86",
-    "spec/v2/core/errors.md": "6d5a67389de84556f81e2558a30d83959c9283c8c5481ce7c759021e486d84fd",
-    "spec/v2/core/events.md": "8a2767691f604b2adf76399edeeaccfc151c697fc9717dc17cf7dd57372a8c22",
-    "spec/v2/core/execution.md": "299c4d548e16e5a0809957a47cbd34b56a38de82b8c9b3a5d036b2c7abca09c6",
+    "spec/v2/core/errors.md": "91f46acc9c9a5532a98cf62c69285d68575c100ff6064f0b1bf94731a087e34a",
+    "spec/v2/core/events.md": "c1a20e3aa6736119ea07aa2cf66faa808a1874d2cde4933033b65506d1742883",
+    "spec/v2/core/execution.md": "8a0c9db1bbfb97c008ab9328b7333c1cc3318196e78bfbefb49e781bdf4f9d44",
     "spec/v2/core/form-content-packs.md": "02931227899676fd4581a27017be2a6c4953904717be9b81c29d12f87ab3917d",
     "spec/v2/core/headers.md": "5cb1624fa63acc81992b6a6d842ec392cf7271aaf2f65d1f83c8c4fa286e6730",
-    "spec/v2/core/host-services.md": "aa8b269e6348bdcb797da1a23c82f9df95c2133a7b947253799f6eaf88ccd3f1",
-    "spec/v2/core/i18n.md": "2d5a67bd3b9b956d1144acab2fbc3646cdb50b3621f97d772087eaa953798286",
-    "spec/v2/core/idempotency.md": "2084d756789c1faf5121593fb39e67ca36a4c227178e175004742e403178ea49",
-    "spec/v2/core/identity.md": "582eddbf2e1bad41911e886bd08524683837045404f7b8f6bceccf61792b2765",
-    "spec/v2/core/interop.md": "e72e25dff864c83b2980d7366b34054cffa072af0225821199f260f6228d260e",
-    "spec/v2/core/interrupt.md": "c1e13179e792bf8099b2d1c7891542646bb1d4cdee1757590f190833cae6047c",
+    "spec/v2/core/host-services.md": "18389b55286875922c26e13fbcd6c787fca2568f68b7e6f65176f1938404a218",
+    "spec/v2/core/i18n.md": "882904b7d59f992ab1e5f7346167161a54cf665b8fee47e64a3862cf9133a580",
+    "spec/v2/core/idempotency.md": "adbd317a6ebb57c2759c076297b31f67def9e391576bccd0bbea787b13e85872",
+    "spec/v2/core/identity.md": "f61dc646f56fc1c07016c3acec9e8eb8c51051c55ecbedc986de793669fb6e6b",
+    "spec/v2/core/interop.md": "fb1d72bb76afda1c2b4394daf019982c207dbb490087ab141daf6eb2446e2eef",
+    "spec/v2/core/interrupt.md": "10f15dfe30baa0fc748aea0a067f9b271bea316fde6b598d78f77edc296f698a",
     "spec/v2/core/node-pack-runtimes.md": "e1088cb69b8c3c67256c494063328916c2980ab1aa97a7063de25bab82fdb1e5",
-    "spec/v2/core/oauth.md": "c96483a44b62978c596945fbb7d7c863cf6056cd980fdb4cf4e97555e3e10b72",
+    "spec/v2/core/oauth.md": "c069ae4f9aae2eafe14c07c0bf709aa7ade0dcc821973d740400d49d901f7061",
     "spec/v2/core/overview.md": "d7000fbcd2f59280870fc592f5d5ea28a5195b9eb209029f09c5de59e0f2bf9c",
-    "spec/v2/core/packs.md": "935fc2f633c68fa98ad6c9cdb083dd556e955b1a15eff32f4773d13329a57238",
-    "spec/v2/core/persistence.md": "711874f74cb08b03cd118d683056db10a063517762fcea73ec70feb5d983e6a4",
-    "spec/v2/core/portability.md": "87c4327f674f714fda6217fd79b99d2ba219ad47dc02f9751bb56c200fb2c17a",
-    "spec/v2/core/replay.md": "f406d71fb690b2e71f4b86ff799a49e6f1a0662c98fc59bcfe517d100eb6117c",
-    "spec/v2/core/runs.md": "8a1d71fb9305fd0df31150bfbbd892f96b8aab553400a36196212f7d0a24906d",
-    "spec/v2/core/security-defaults.md": "153884da7a2d54c30c81b5e649cfdef31e151b3a2a19dee1bc5a16c35d60a3aa",
-    "spec/v2/core/storage.md": "598ad4f3775c297c698a20daf72a7d15a6836c1231ddbca5961865c704f765b5",
+    "spec/v2/core/packs.md": "0d1516c4b08fe67b85759feb9ccbafdd766216435a4a0a7e58e27e6f9fe6b6cc",
+    "spec/v2/core/persistence.md": "249a1de353f421cdf92b9006a13a10afdb002f4029eb6a13520cc95252edb2ec",
+    "spec/v2/core/portability.md": "ab13a6ca43544b9a6a91edfb377ec680c768d14be841c84fb79125b231426891",
+    "spec/v2/core/replay.md": "4a8b53325e18aa53400ece81168c76b4402b932e5e304a391754f293b126eabf",
+    "spec/v2/core/runs.md": "18261bf0fff85101ee9547dd2cd9f06055f2095609dfd23e0f8fdbd1f1d2d0d0",
+    "spec/v2/core/security-defaults.md": "887d8c4bc592094e3b931c23f1c2175c18ebbd47528b074016f9d2091bc513b2",
+    "spec/v2/core/storage.md": "dc94b985847c1341c7a064f04a6010f0fdbe6c3ab3e555d4362878c81d764c18",
     "spec/v2/core/tool-catalog.md": "d16a9004418719c48301804aefa4d7ab6f41112a4ed83727f552aa1b92b418b0",
-    "spec/v2/core/versioning.md": "e3b3ab6d76e51035039a32173e9b412628a52c8fe7b16687ff58a2d0d983faa0",
-    "spec/v2/core/webhooks.md": "3f8730e0d15a5e4244e302adb910a0b6f745fbfa8e80920c14118117811ba881",
+    "spec/v2/core/versioning.md": "b7acb0d8b77425cb53ea700e47ba790bf7506de600c398690e6ec5bb9c7a220e",
+    "spec/v2/core/webhooks.md": "7b2606b2ebbeafd84ca052a5c4d2f392cade0b482fbb063acb0aeb38675f6ede",
     "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
     "spec/v2/corrections.json": "59f647f4d22477f6c2b06dcf913b682dde5d51dd5e607a5d0cf648ab60864d6e",
     "spec/v2/corrections.schema.json": "46bbffb954d13bd9995aebc912ceeb2544f7064331abf25fd6ab85c81a5cec94",
-    "spec/v2/declaration.json": "edace8c4ec7e32aba44828f459e2ae8933dc88ec8129f16549bca6279e3ca24c",
+    "spec/v2/declaration.json": "24866c15908b3b70d96339dd852187ba908ddf65f90fad1d566ba6df5881aa48",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
-    "spec/v2/errors.json": "fa650cbbdf25a140fdaf82ec5269f95b4585ac4bdde1fa6b0b3ffe48a3f7943c",
+    "spec/v2/errors.json": "83f048b0a06952b4af6f125fb66c4212acab51056b411390f1010acd6ab9cdc0",
     "spec/v2/errors.schema.json": "47404ad53e6147cf9017b813483712466573e419fb33e6c4b6c12d3e7deba1bc",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
     "spec/v2/event-codemap.schema.json": "b173f2a9bcc0bf9b62a474ce3b91e1431d597e64fd1560fc58662cd8606eaf9c",
@@ -275,7 +275,8 @@
     "spec/v2/ext/sandbox-runtime-notes/README.md": "0d1290fb1e20b2e35c0b15051541ab6546e4e2a6f693b4f912cb3f7d6a65e92c",
     "spec/v2/ext/webResearch/README.md": "b675e6f6646128d781b661f754c2393eed86e5935d16c3a22df582a5ce025b9b",
     "spec/v2/facets/a2a.schema.json": "b68bf5e29e455e46c2ad7cfcccf5963730ec2310ff9db81884550d8df30fd6ef",
-    "spec/v2/facets/aiProviders.schema.json": "81fb39b6698564d9d07a0d10525ecb6360c152fe3f3a5ea0439112509ca130e2",
+    "spec/v2/facets/agents.schema.json": "5e4d76d298fb1371b0e47a3b6fcf99ef65ae139d619d25d021d334c42583c4f1",
+    "spec/v2/facets/aiProviders.schema.json": "4eb911c2403b8f618325194855a1326680fbda2549dfbfe86a70dd2743f8fb12",
     "spec/v2/facets/auditLogIntegrity.schema.json": "9a7f81320c8f940c6f4129bc7dd895a4063231c5458a717a08c2cbf9bb886c46",
     "spec/v2/facets/auth.schema.json": "7d98bc81a0f7d307460d039eebfebd21388091bfe1d538762583940f94c0bd2a",
     "spec/v2/facets/envelopeStrictness.schema.json": "28be0a27f880bd45ec1222a16155f5e9167bbca57bf0322970fe1eb2654562aa",
@@ -291,6 +292,7 @@
     "spec/v2/facets/supportedEnvelopes.schema.json": "644f22cc2236e30a611b5b7f1ba0458ff1925d68b94c514d9672583224e126bd",
     "spec/v2/facets/webhooks.schema.json": "54b576f1d150e28e1642693d846ce471c118e9c521bdf3924185305fbd1d0de4",
     "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
+    "spec/v2/generated/error-codes.md": "f171c0ca1be40221f9b4fbfcbce73c728c315a1e8feb8dd6bf738d6ca9e29526",
     "spec/v2/harness-trust-anchors.json": "6007b92eae16a070fbc3777424efb0abfe865fda89d096963109b96282b91205",
     "spec/v2/harness-trust-anchors.schema.json": "372b5d92337c893d3449eff3f6bfd009ac09fdac285296d8bdbe0a08fff9e34c",
     "spec/v2/id-field-bindings.json": "9f6fd280250447e26a6704811c352bb8f2ff6c4bd242befe3da0ba38962370e9",
@@ -301,9 +303,9 @@
     "spec/v2/path-manifest.json": "17298a245c5da9a70aa7ab0b7f2db4277e06209d6fcdd7187a8b4cea179c08f3",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "8b868146a0b8fef709478ed80a75a204c980d0c761463e0602c921c6b25fd0d8",
+    "spec/v2/release.json": "2ede31076d576d9077dabf9ecd08f338da8108db5ad71e20110161957a64d024",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "d074465ed4ee594016bfb842fc3161d278394e84740133daf4fd93d1b3b0c4d8"
+    "spec/v2/surface-baseline.json": "5d3653a5a96dac46d6b97b833319f3168934c656ca7e4374798593b149477ddf"
   },
-  "corpusCommit": "95fbb4c9963f9da47eb0e870bf402bad3f4db29d"
+  "corpusCommit": "d5297a740c848b3881e4d9a034cc32e4a8b9b1f7"
 }

package/src/scenarios/v2-approval-reject-disposition.test.ts

@@ -278,7 +278,7 @@ describe('RFC 0223 — v2-approval-reject-disposition (gated on interrupt + conf
 
   // ── openwop#1756: replay derives the rejection, never re-decides it ──────────
   const REPLAY_ID = R('replay-derives-rejection');
-  const REPLAY_DOC = `${DOC}, last bullet; spec/v2/core/replay.md §Determinism`;
+  const REPLAY_DOC = `${DOC}, last bullet; spec/v2/core/replay.md §Determinism caveats rule 2 (short-circuit, raising no new interrupt.requested)`;
   interface SeqEv extends Ev { readonly sequence?: number }
   async function debugLog(runId: string): Promise<SeqEv[]> {
     const res = await http(() => driver.get(`/runs/${enc(runId)}/events/poll?timeout=1&streamMode=debug`));

package/src/scenarios/v2-unadvertised-operation-not-found.test.ts

@@ -0,0 +1,64 @@
+/**
+ * v2 — an operation gated on an unadvertised family or facet answers
+ * `404 not_found` (suite 2.45; RFC 0228 §H; `spec/v2/core/errors.md`
+ * §Unadvertised operations).
+ *
+ * v1 answered these `501 capability_not_provided`. The registry holds
+ * `capability_not_provided` at `422`, and a bare `501` carries no registered
+ * code, so v2 answers the route that is absent the way it answers any other
+ * absent route. Both legs are unaided: the suite reads discovery and probes a
+ * read the host does not advertise.
+ *
+ *   prompts   (hosts whose `prompts` record omits `endpointsSupported`, or
+ *             that do not advertise `prompts`) `GET /prompts` answers
+ *             `404 not_found`.
+ *   content   (hosts that do not advertise `content`) `GET /content/settings`
+ *             answers `404 not_found`.
+ *
+ * A host that advertises the facet records the leg `inapplicable`.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+
+const DOC = 'spec/v2/core/errors.md §Unadvertised operations';
+const UNREACHABLE = 'v2 discovery unreachable — /.well-known/openwop did not answer 200 with a JSON body under OpenWOP-Version: 2.0';
+
+async function discovery(): Promise<Record<string, unknown> | null> {
+  try { return await v2Discovery(); } catch { return null; }
+}
+async function get(path: string): Promise<OpenWOPResponse | null> {
+  try { return await driver.get(path); } catch { return null; }
+}
+const record = (doc: Record<string, unknown>, key: string): Record<string, unknown> | null => {
+  const r = doc[key];
+  return r !== null && typeof r === 'object' && !Array.isArray(r) ? (r as Record<string, unknown>) : null;
+};
+
+describe('v2 unadvertised operations answer 404 not_found (RFC 0228 §H)', () => {
+  it('GET /prompts answers 404 not_found when prompts.endpointsSupported is not advertised', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREACHABLE);
+    if (record(doc, 'prompts')?.['endpointsSupported'] === true) return softSkip('inapplicable', 'the host advertises prompts.endpointsSupported — the /prompts* surface is served');
+    const res = await get('/prompts');
+    if (res === null) return softSkip('blocked', 'GET /prompts unreachable (fetch failed)');
+    const ID = 'openwop.requirement.0228.unadvertised-prompts-not-found';
+    expect(res.status, req(ID, DOC, `an operation gated on prompts.endpointsSupported, which the host does not advertise, MUST answer 404 (got ${res.status}; v1's 501 is not a v2 answer)`)).toBe(404);
+    expect(readErrorCode(res.json), req(ID, DOC, 'the 404 for an unadvertised gated operation MUST carry the registered code not_found')).toBe('not_found');
+  });
+
+  it('GET /content/settings answers 404 not_found when content is not advertised', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', UNREACHABLE);
+    if (record(doc, 'content') !== null) return softSkip('inapplicable', 'the host advertises content — the /content/* surface is served');
+    const res = await get('/content/settings');
+    if (res === null) return softSkip('blocked', 'GET /content/settings unreachable (fetch failed)');
+    const ID = 'openwop.requirement.0228.unadvertised-content-not-found';
+    expect(res.status, req(ID, DOC, `an operation gated on content, which the host does not advertise, MUST answer 404 (got ${res.status}; v1's 501 is not a v2 answer)`)).toBe(404);
+    expect(readErrorCode(res.json), req(ID, DOC, 'the 404 for an unadvertised gated operation MUST carry the registered code not_found')).toBe('not_found');
+  });
+});