@openwop/openwop-conformance 2.44.6 → 2.44.8

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.44.8] — 2026-09-29 — every subscribed event of a run is delivered
+
+- **`0173.webhook-delivery-complete`: every matching event reaches a healthy receiver at least once** (#1781). A new leg in `v2-webhook-durable-delivery` (target major 2, gated on `webhooks` and `conformance-noop`) reads `webhooks.md` §Durability, "deliver each matching event at least once", across a whole run; no row did before. It registers one subscription to `run.started`, `node.started`, `node.completed` and `run.completed` with a receiver that answers `204` to everything, and runs the noop fixture. The expected set is every logged event of a subscribed type (`GET /runs/{runId}/events/poll`), keyed by `sequence`. Each must arrive at least once, deduplicated on `(webhookId, runId, sequence)`; duplicates are counted, never held against the host. The wait is `retryWaitFor`: the advertised `maxElapsedMs` plus the grace (RFC 0225), else the cap or the floor. The row convicts when some of the run's subscribed events arrived and others did not, or when nothing arrived and nothing reached the listener; nothing of this run arriving while other traffic did is `blocked`. A pass carries an `observed:` detail (counts, duplicates, slowest first arrival, wait path). The leg unregisters its subscription. Measured on the v2 reference host (openwop-examples `d0255b4b`): `executed-pass` in 255 ms; with its `run.started` fan-out removed, `executed-fail` naming `run.started (sequence 0)` after the 90 s window, and the file's other five legs stay green, which is the gap: myndhyve#560's lost `run.started` fan-out was convicted only incidentally, under the wrong MUST (#1780). Surveyed against the three hosts' code: each delivers every subscribed type and passes on its certified deployment (MyndHyve's window is its advertised 600000 ms plus the grace).
+
+## [2.44.7] — 2026-09-29 — RFC 0223 G11 and RFC 0140 G10 close on a certified cut
+
+- **The 2.44.7 cycle opens.** The packed `@openwop/spec-artifacts` gaps register changes: RFC 0223 G11 (`0223.reject-loopback-reasks`) and RFC 0140 G10 (`replay.suppression-execution-ordinal`) close on the v2 reference host's certified 2.44.6 cut. No scenario is added or removed.
+
 ## [2.44.6] — 2026-09-29 — RFC 0228 registers the v1 host-service codes, RFC 0227 moves the generated error table out of the core budget, and the last core families get v2 homes
 
 - **`0171.error-registry-prose-parity` is re-pointed (RFC 0227).** The `errors.md` status table moved to `spec/v2/generated/error-codes.md`, which the packed `@openwop/spec-artifacts` now ships. The row now requires that `errors.md` links the generated table, that the table holds every registered code, and that every count either document states equals the registry. No scenario is added or removed.

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.44.6",
-  "stampSha256": "057afc21b70afb9d32deb6b8611fcb0bb6cfc332dd459749c9569dd0f26b4315"
+  "version": "2.44.8",
+  "stampSha256": "1f667cb424fa4cd6a005d9b6766bb5ec941de708197976cdc8a638677579e0a4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.44.6",
+  "version": "2.44.8",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.44.6"
+    "@openwop/spec-artifacts": "2.44.8"
   }
 }

package/requirements.json

@@ -3,10 +3,10 @@
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
     "files": 649,
-    "tests": 2494,
-    "withStableId": 2494,
+    "tests": 2495,
+    "withStableId": 2495,
     "interpolatedTitles": 0,
-    "explicitIds": 2373
+    "explicitIds": 2374
   },
   "records": [
     {
@@ -34418,7 +34418,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-failed-attempt-is-retried-and-the-event-is-delivered-at-least-once",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 279,
+      "line": 309,
       "title": "a failed attempt is retried and the event is delivered at least once",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery",
       "citations": [
@@ -34455,7 +34455,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.an-exhausted-delivery-is-dead-lettered-never-dropped",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 400,
+      "line": 430,
       "title": "an exhausted delivery is dead-lettered, never dropped",
       "explicitId": "openwop.requirement.0173.webhook-durable-delivery.dead-letter",
       "citations": [
@@ -34494,7 +34494,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.the-dead-letter-read-is-served-and-its-records-carry-no-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 509,
+      "line": 539,
       "title": "the dead-letter read is served and its records carry no payload",
       "explicitId": "openwop.requirement.0188.dead-letter-read",
       "citations": [
@@ -34507,7 +34507,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.after-unregister-the-dead-letter-read-answers-404-not-found-as-for-a-subscriptio",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 530,
+      "line": 560,
       "title": "after unregister, the dead-letter read answers 404 not_found, as for a subscription that never existed",
       "explicitId": "openwop.requirement.0217.dead-letter-read-after-unregister",
       "citations": [
@@ -34534,7 +34534,7 @@
     {
       "id": "openwop.it.v2-webhook-durable-delivery.a-dead-letter-record-carries-no-delivered-payload",
       "file": "v2-webhook-durable-delivery.test.ts",
-      "line": 563,
+      "line": 593,
       "title": "a dead-letter record carries no delivered payload",
       "explicitId": "openwop.requirement.0188.dead-letter-content-free",
       "citations": [
@@ -34549,6 +34549,33 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-webhook-durable-delivery.every-logged-event-of-a-subscribed-type-reaches-a-healthy-receiver-at-least-once",
+      "file": "v2-webhook-durable-delivery.test.ts",
+      "line": 688,
+      "title": "every logged event of a subscribed type reaches a healthy receiver at least once within the retry bound",
+      "explicitId": "openwop.requirement.0173.webhook-delivery-complete",
+      "citations": [
+        {
+          "section": "webhooks.md §Surfaces",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "webhooks.md §Surfaces",
+          "requirement": "the 201 body MUST carry `webhookId`"
+        },
+        {
+          "section": "runs.md §Create",
+          "requirement": "POST /runs MUST answer 201 for the noop fixture"
+        },
+        {
+          "section": "webhooks.md §Durability",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-webhook-egress-refusal.a-webhook-registration-naming-a-destination-the-guard-must-refuse-is-refused-400",
       "file": "v2-webhook-egress-refusal.test.ts",

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.44.6",
-  "corpusTag": "v2.44.6",
+  "version": "2.44.8",
+  "corpusTag": "v2.44.8",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "69464bc0e1e71ef3b543a73d4fa4f67202343d2603c80af8033f6c3619ef1b30",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "14204b626e15260475291b01b6c939f883a28f389378bcc3be7826f0c3533e47",
-    "api/v2/asyncapi.yaml": "776ffe2877d564f87f11e1b7b7bbef63318962da3d59b0d9491979dc26889f2d",
-    "api/v2/openapi.yaml": "b9025ba5ccd9c5c18fd2dbb695c1f196207aca89509da1d4bbf46094ebf5b898",
+    "api/seams-v2.yaml": "e0a08989687d29d95bc10702aca5a31fcc846cf8f55ae0dd362fb4666fbdf8f3",
+    "api/v2/asyncapi.yaml": "ab568b0539dcb71c77a3a3218a433cab6fa1f3a7dd04a6b70824e2abba46a104",
+    "api/v2/openapi.yaml": "7cd9c6703ee7e27f06dea079ca41ec7f0227501f6f2b6ab30ba233bafdf1e63e",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "0b2f28808ffe0b9d98a187775038c3406bb70919747a788a6e4f866e293ae6d3",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "3e1d14b773b99f5b1d0d96167df2a938e662c96aa37f1561b8c9aa59cbd65561",
+    "spec/v1/core-standard-manifest.json": "635549fa9beb8e0ee92a31461803d1170fea36a5738d79aaaa0ef0c1ae150234",
     "spec/v1/deprecations.json": "a3293072ea951857395d05f0437264e88965f1e9019ff61c55bacfa9c1aaa17c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "8475d4f9a3ba3767d30d8e7d7a0b86ec3042718de0ab85a10d149b91360bc67d",
+    "spec/v1/gaps.json": "7ba482a850d94e185f12b69929e35054d24b72131a997d0ef70d59c10b83f7eb",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -303,9 +303,9 @@
     "spec/v2/path-manifest.json": "17298a245c5da9a70aa7ab0b7f2db4277e06209d6fcdd7187a8b4cea179c08f3",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "2ede31076d576d9077dabf9ecd08f338da8108db5ad71e20110161957a64d024",
+    "spec/v2/release.json": "623dc26d0c678f0050670e702c73cf5a1dea4b3f5a09284e920843897417527a",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "5d3653a5a96dac46d6b97b833319f3168934c656ca7e4374798593b149477ddf"
+    "spec/v2/surface-baseline.json": "2f618a23b875d663316b0aebebd07fbfc9795fa01396935d898f9b8123e5a9a6"
   },
-  "corpusCommit": "d5297a740c848b3881e4d9a034cc32e4a8b9b1f7"
+  "corpusCommit": "a6a1325b67b6dc08122aa78d3abb62ebf7959d11"
 }

package/src/scenarios/v2-webhook-durable-delivery.test.ts

@@ -8,6 +8,10 @@
  * (`spec/v2/core/webhooks.md` §Durability; security-defaults.md §Webhook
  * durability; RFC 0173 §B row C6.3).
  *
+ * The last leg (suite 2.44.8, openwop#1781) reads "deliver each matching event
+ * at least once" across a whole run, with a receiver that never fails: see
+ * `webhook-delivery-complete` below.
+ *
  * How the receiver is driven: the suite boots its own HTTP receiver (the same
  * shape `webhook-signed-delivery.test.ts` uses) in a FAILING mode — it answers
  * `500` to the first N attempts for a delivery key and `204` afterwards — so
@@ -35,7 +39,7 @@ import { absenceIsUnmeasured, noDeliveryCause, startScopedReceiver, type ScopedR
 import { readErrorCode } from '../lib/error-envelope.js';
 import { blockedDespiteAssertions, softSkip } from '../lib/soft-skip.js';
 import { req } from '../lib/requirement-ids.js';
-import { pastAdvertisedBound, retryTestTimeoutMs, retryWaitCapMs, retryWaitFor, retryWaitSelection, waitObservation, windowClosedNote } from '../lib/webhook-retry-window.js';
+import { pastAdvertisedBound, retryTestTimeoutMs, retryWaitCapMs, retryWaitFor, retryWaitSelection, waitObservation, waitPathNote, windowClosedNote } from '../lib/webhook-retry-window.js';
 import { noteObservation } from '../lib/row-observation.js';
 
 export const REQUIRES_HOST_CALLBACK = 'the host POSTs and retries webhook deliveries to the suite-owned scoped receiver behind OPENWOP_WEBHOOK_RECEIVER_URL';
@@ -43,7 +47,7 @@ export const REQUIRES_HOST_CALLBACK = 'the host POSTs and retries webhook delive
 const FIXTURE = 'conformance-noop';
 const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
 
-interface Attempt { readonly key: string; readonly runId: string | null; readonly webhookId: string; readonly status: number; readonly at: number }
+interface Attempt { readonly key: string; readonly runId: string | null; readonly webhookId: string; readonly sequence: number | null; readonly status: number; readonly at: number }
 
 /**
  * A receiver that fails the first `failFirst` attempts for each delivery key
@@ -75,7 +79,7 @@ async function startReceiver(failFirst: number): Promise<ScopedReceiver & { atte
     const n = (seen.get(key) ?? 0) + 1;
     seen.set(key, n);
     const status = n <= failFirst ? 500 : 204;
-    attempts.push({ key, runId, webhookId, status, at: Date.now() });
+    attempts.push({ key, runId, webhookId, sequence: typeof sequence === 'number' ? sequence : null, status, at: Date.now() });
     res.writeHead(status);
     res.end();
   });
@@ -275,6 +279,32 @@ async function register(rx: ScopedReceiver): Promise<{ webhookId: string } | nul
   return { webhookId: webhookId as string };
 }
 
+/**
+ * `webhook-delivery-complete` (suite 2.44.8, openwop#1781): the lifecycle types
+ * a one-node run emits. The EXPECTED deliveries are still read from the host's
+ * own log, so the suite assumes nothing about what the fixture emits.
+ */
+const COMPLETE_ID = 'openwop.requirement.0173.webhook-delivery-complete';
+const COMPLETE_TYPES = ['run.started', 'node.started', 'node.completed', 'run.completed'] as const;
+const COMPLETE_TERMINAL_WAIT_MS = 30_000;
+
+/** The run's logged events of a subscribed type, by sequence; null when the log is unreadable or carries no sequences. */
+async function subscribedLog(runId: string): Promise<Map<number, string> | null> {
+  const res = await driver.get(`/runs/${encodeURIComponent(runId)}/events/poll?timeout=1`);
+  if (res.status !== 200) return null;
+  const events = (res.json as { events?: Array<{ type?: unknown; sequence?: unknown }> } | null)?.events;
+  if (!Array.isArray(events)) return null;
+  const want = new Map<number, string>();
+  for (const e of events) {
+    if (typeof e.type !== 'string' || !(COMPLETE_TYPES as readonly string[]).includes(e.type)) continue;
+    if (typeof e.sequence !== 'number') return null;
+    want.set(e.sequence, e.type);
+  }
+  return want;
+}
+
+const bareId = (id: string): string => (id.includes('/') ? id.slice(id.indexOf('/') + 1) : id);
+
 describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () => {
   it('a failed attempt is retried and the event is delivered at least once', async () => {
     const doc = await discovery();
@@ -626,4 +656,93 @@ describe('RFC 0173 §B — webhook-durable-delivery (gated on webhooks)', () =>
       req('openwop.requirement.0188.dead-letter-content-free', 'RFC 0188 §B.1', `a dead-letter record MUST NOT carry the delivered body, headers or subscription secret — the queue is precisely the traffic the subscriber never received, so a record carrying any of it turns one read scope into a replay of that traffic for the whole retention window (read ${rows.length} record(s))`),
     ).toBe(true);
   }, DEAD_LETTER_TEST_TIMEOUT_MS);
+  /**
+   * openwop#1781: "deliver each matching event at least once" binds EVERY
+   * matching event, and no row read it that way. `v2-webhook-delivery-shape`
+   * records `blocked` on a missing delivery; `v2-webhook-standard-webhooks-delivery`
+   * fails only on a missing `run.completed`; the legs above subscribe to
+   * `run.completed` alone and drive retries after a FAILING receiver. So a host
+   * that lost part of a run's fan-out certified green. Measured on a tier-2
+   * host: its `run.started` fan-out was fire-and-forget work that Cloud Run CPU
+   * throttling starved once the appending request ended (myndhyve#560); the
+   * only row that reddened was `0215.no-head-of-line`, under the wrong MUST,
+   * and #1780 correctly stopped it convicting.
+   *
+   * One subscription to the four lifecycle types, a receiver that answers 204
+   * to everything, one noop run. Every logged event of a subscribed type must
+   * arrive at least once, deduplicated on `(webhookId, runId, sequence)` — the
+   * triple webhooks.md §Verification names. Duplicates are counted in the
+   * `observed:` detail and never held against the host: at-least-once permits
+   * them. The wait is `retryWaitFor`: the advertised `maxElapsedMs` plus the
+   * grace when the host states one (RFC 0225), else the cap or the floor. It
+   * only bounds how long a missing event is waited for; a healthy receiver
+   * needs no retry.
+   *
+   * Convicts only when some of this run's subscribed events arrived and others
+   * did not, or when nothing arrived and nothing else reached the listener (the
+   * rule the first leg applies). Nothing of this run arriving while other
+   * traffic did is `blocked`: the path works, and what is absent is this
+   * exercise's identity. Negative control: the v2 reference host with its
+   * `run.started` fan-out removed fails this leg naming `run.started`.
+   */
+  it('every logged event of a subscribed type reaches a healthy receiver at least once within the retry bound', async () => {
+    const doc = await discovery();
+    if (!doc) return softSkip('blocked', 'discovery unreachable');
+    if (!(await gateFamily('webhooks'))) return softSkip('inapplicable', 'webhooks family not advertised (gate recorded under openwop.family.webhooks)');
+    if (!fixtureAdvertised(doc, FIXTURE)) return softSkip('inapplicable', `${FIXTURE} fixture not advertised — no run to deliver`);
+
+    const receiver = await startReceiver(0); // 204 to every attempt
+    active = receiver;
+    const reg = await driver.post('/webhooks', { url: receiver.url, events: [...COMPLETE_TYPES] });
+    if (reg.status === 400 && readErrorCode(reg.json) === 'webhook_url_rejected') {
+      if (!receiver.tunnelled) return softSkip('blocked', 'host SSRF guard rejected the loopback receiver (webhooks.md §Egress requires it); set OPENWOP_WEBHOOK_RECEIVER_URL to a public https tunnel in front of the suite receiver');
+      expect.fail(`host rejected the operator-supplied public https receiver (${receiver.url}) with webhook_url_rejected — a public https destination is legitimate under webhooks.md §Egress`);
+    }
+    expect(reg.status, req(COMPLETE_ID, 'webhooks.md §Surfaces', `POST /webhooks MUST answer 201 { webhookId } for events [${COMPLETE_TYPES.join(', ')}], each a v2 event type name`)).toBe(201);
+    const webhookId = (reg.json as { webhookId?: unknown } | null)?.webhookId;
+    expect(typeof webhookId, req(COMPLETE_ID, 'webhooks.md §Surfaces', 'the 201 body MUST carry `webhookId`')).toBe('string');
+    const sub = webhookId as string;
+    try {
+      const create = await driver.post('/runs', { workflowId: FIXTURE });
+      expect(create.status, req(COMPLETE_ID, 'runs.md §Create', 'POST /runs MUST answer 201 for the noop fixture')).toBe(201);
+      const runId = (create.json as { runId: string }).runId;
+      const createdAt = Date.now();
+      const status = await waitTerminal(runId, COMPLETE_TERMINAL_WAIT_MS);
+      if (status === null || !TERMINAL.has(status)) return softSkip('blocked', `the ${FIXTURE} run did not reach a terminal status inside ${COMPLETE_TERMINAL_WAIT_MS}ms (last ${status ?? 'unreadable'}), so its event log, the expected set, is not final`);
+      const want = await subscribedLog(runId);
+      if (want === null) return softSkip('blocked', 'GET /runs/{runId}/events/poll did not yield the run\'s events with a numeric sequence, so the expected deliveries cannot be keyed (webhooks.md §Verification dedupes on sequence)');
+      if (want.size === 0) return softSkip('blocked', `the run's event log holds no event of a subscribed type [${COMPLETE_TYPES.join(', ')}]: nothing to deliver, nothing measured`);
+
+      const ours = (): Attempt[] => receiver.attempts.filter((a) => a.runId !== null && bareId(a.runId) === bareId(runId) && bareId(a.webhookId) === bareId(sub));
+      const missing = (): number[] => {
+        const got = new Set(ours().map((a) => a.sequence));
+        return [...want.keys()].filter((q) => !got.has(q)).sort((a, b) => a - b);
+      };
+      const policy = advertisedRetryPolicy(doc);
+      const selection = retryWaitSelection(policy, RETRY_WAIT_CAP_MS);
+      const deadline = Date.now() + retryWaitFor(policy, RETRY_WAIT_CAP_MS);
+      while (missing().length > 0 && Date.now() < deadline) await new Promise((r) => setTimeout(r, 250));
+
+      const arrivals = ours();
+      const firstAt = new Map<number, number>();
+      for (const a of arrivals) if (a.sequence !== null && want.has(a.sequence) && !firstAt.has(a.sequence)) firstAt.set(a.sequence, a.at);
+      const slowest = firstAt.size === 0 ? null : Math.max(...[...firstAt.values()].map((t) => t - createdAt));
+      const duplicates = arrivals.filter((a) => a.sequence !== null && want.has(a.sequence)).length - firstAt.size;
+      const lost = missing();
+      noteObservation(`${firstAt.size}/${want.size} subscribed event(s) delivered, ${duplicates} duplicate arrival(s); slowest first arrival ${slowest === null ? 'none' : `${slowest}ms after the run was created`}; ${waitPathNote(selection)}`);
+
+      if (arrivals.length === 0 && absenceIsUnmeasured(receiver)) {
+        return blockedDespiteAssertions(noDeliveryCause(receiver, 'delivery for this run'));
+      }
+      const lostList = lost.map((q) => `${want.get(q)} (sequence ${q})`).join(', ');
+      expect(
+        lost,
+        req(COMPLETE_ID, 'webhooks.md §Durability', `the host MUST deliver each matching event at least once; best-effort delivery is not a conforming mode (RFC 0173 §B). ${lost.length} of ${want.size} subscribed event(s) in this run's log never reached the healthy receiver inside ${selection.windowMs}ms: ${lostList}. ${firstAt.size > 0 ? `${firstAt.size} other(s) did arrive, so the receiver was reachable.` : noDeliveryCause(receiver, 'delivery for this run')}`),
+      ).toEqual([]);
+    } finally {
+      // Four lifecycle types on a live subscription would keep fanning every later
+      // run's events at a closed nonce, each retried to exhaustion.
+      try { await driver.delete(`/webhooks/${encodeURIComponent(sub)}`); } catch { /* best effort: the verdict is already recorded */ }
+    }
+  }, retryTestTimeoutMs(1, COMPLETE_TERMINAL_WAIT_MS + WAIT_SLACK_MS));
 });