@openwop/openwop-conformance 2.45.13 → 2.45.15

package/src/lib/i18n-double.ts

@@ -0,0 +1,99 @@
+/**
+ * A scratch double for locale negotiation at major 2 (`i18n.md`): a discovery
+ * document carrying an `i18n` record and a run read that answers an error
+ * envelope localized by `Accept-Language`. Each self-test in
+ * `i18n-negotiation-witness.test.ts` turns on ONE defect to show the witness
+ * convicts it; a standalone instance lets the scenario file run against it.
+ *
+ * A test double, not a host: it executes nothing, and nothing it does is
+ * evidence about any implementation.
+ */
+
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import { unprojectBoundId } from './bound-id.js';
+
+export type I18nDefect =
+  | 'none' | 'malformed-400' | 'unsupported-406' | 'content-language-lies' | 'content-language-garbage'
+  | 'code-localized' | 'details-keys-localized' | 'details-locale-garbage';
+
+/** The tenant the double treats as the caller's. */
+export const OWN_TENANT = 'acme';
+
+const MESSAGES: Record<string, string> = { en: 'No such run', es: 'No existe tal ejecución', 'pt-BR': 'Execução inexistente' };
+
+export class I18nDouble {
+  defect: I18nDefect = 'none';
+  url = '';
+  private server: Server | undefined;
+  discovery: Record<string, unknown> = { i18n: { status: 'stable', since: '2.0', witness: 'witnessable-gated', defaultLocale: 'en', supportedLocales: ['en', 'es', 'pt-BR'] } };
+
+  async start(): Promise<string> {
+    this.server = createServer((req, res) => { this.handle(req, res); });
+    await new Promise<void>((r) => this.server!.listen(0, '127.0.0.1', r));
+    this.url = `http://127.0.0.1:${(this.server.address() as AddressInfo).port}`;
+    return this.url;
+  }
+  async stop(): Promise<void> { const s = this.server; if (s) { s.closeAllConnections(); await new Promise<void>((r) => s.close(() => r())); } }
+  reset(defect: I18nDefect): void { this.defect = defect; }
+
+  private supported(): string[] { return ((this.discovery['i18n'] as { supportedLocales?: string[] } | undefined)?.supportedLocales) ?? ['en']; }
+
+  /** RFC 9110 §12.5.4 best-effort: highest q wins, ties to order, then the language family, else the default. `null` = malformed. */
+  private negotiate(header: string | undefined): { used: string; malformed: boolean; firstRaw: string | undefined } {
+    if (header === undefined) return { used: 'en', malformed: false, firstRaw: undefined };
+    const entries: Array<{ tag: string; q: number; i: number }> = [];
+    let malformed = false;
+    header.split(',').forEach((part, i) => {
+      const [tag, ...params] = part.trim().split(';').map((s) => s.trim());
+      if (!tag || !/^[a-zA-Z]{1,8}(-[a-zA-Z0-9]{1,8})*$|^\*$/.test(tag)) { malformed = true; return; }
+      const qp = params.find((p) => p.startsWith('q='));
+      const q = qp === undefined ? 1 : Number(qp.slice(2));
+      if (Number.isNaN(q)) { malformed = true; return; }
+      entries.push({ tag, q, i });
+    });
+    entries.sort((x, y) => y.q - x.q || x.i - y.i);
+    const sup = this.supported();
+    for (const e of entries) {
+      // `*` (which Node's fetch sends by default) matches any locale: the default serves.
+      if (e.tag === '*') return { used: 'en', malformed, firstRaw: undefined };
+      const exact = sup.find((s) => s.toLowerCase() === e.tag.toLowerCase());
+      if (exact) return { used: exact, malformed, firstRaw: header.split(',')[0]?.split(';')[0]?.trim() };
+      const fam = sup.find((s) => s.toLowerCase() === (e.tag.split('-')[0] ?? '').toLowerCase());
+      if (fam) return { used: fam, malformed, firstRaw: header.split(',')[0]?.split(';')[0]?.trim() };
+    }
+    return { used: 'en', malformed, firstRaw: header.split(',')[0]?.split(';')[0]?.trim() };
+  }
+
+  private send(res: ServerResponse, status: number, body: unknown, headers: Record<string, string> = {}): void {
+    res.writeHead(status, { 'content-type': 'application/json', ...headers });
+    res.end(JSON.stringify(body));
+  }
+
+  private handle(req: IncomingMessage, res: ServerResponse): void {
+    const path = (req.url ?? '/').split('?')[0] ?? '/';
+    if (req.method === 'GET' && path === '/.well-known/openwop') return this.send(res, 200, this.discovery);
+    const m = /^\/runs\/([^/]+)$/.exec(path);
+    if (req.method !== 'GET' || !m) return this.send(res, 404, { error: 'not_found', message: `no route ${req.method} ${path}` });
+
+    const header = req.headers['accept-language'];
+    const n = this.negotiate(typeof header === 'string' ? header : undefined);
+    if (n.malformed && this.defect === 'malformed-400') return this.send(res, 400, { error: 'validation_error', message: 'bad Accept-Language' });
+    if (typeof header === 'string' && !n.malformed && n.firstRaw !== undefined && n.used === 'en' && !header.toLowerCase().startsWith('en') && this.defect === 'unsupported-406') {
+      return this.send(res, 406, { error: 'not_acceptable', message: 'locale not supported' });
+    }
+    const localized = n.used !== 'en';
+    let cl: string | undefined = typeof header === 'string' ? n.used : undefined;
+    if (this.defect === 'content-language-lies' && n.firstRaw !== undefined) cl = n.firstRaw;
+    if (this.defect === 'content-language-garbage' && cl !== undefined) cl = 'en_US!';
+
+    let id: string;
+    try { id = unprojectBoundId(m[1]!); } catch { return this.send(res, 400, { error: 'validation_error', message: 'bad id projection' }); }
+    const tenant = id.includes('/') ? id.split('/')[0] : OWN_TENANT;
+    const foreign = tenant !== OWN_TENANT;
+    const code = this.defect === 'code-localized' && localized ? (foreign ? 'inquilino_distinto' : 'no_encontrado') : (foreign ? 'id_tenant_mismatch' : 'not_found');
+    const details: Record<string, unknown> = this.defect === 'details-keys-localized' && localized ? { recurso: 'run' } : { resource: 'run' };
+    if (localized) details['locale'] = this.defect === 'details-locale-garbage' ? 'spanish!' : n.used;
+    return this.send(res, foreign ? 403 : 404, { error: code, message: MESSAGES[n.used] ?? MESSAGES['en'], details }, cl === undefined ? {} : { 'content-language': cl });
+  }
+}

package/src/lib/i18n-negotiation-witness.ts

@@ -0,0 +1,173 @@
+/**
+ * The locale-negotiation witness (`i18n.md` §`Accept-Language`, §Fallback,
+ * §Error envelopes, §The `i18n` record), shared by every major that states
+ * those rules. What differs between majors (the run path, how an id becomes a
+ * path segment, how a family is advertised) is the profile row.
+ *
+ * Four legs:
+ *   shape        the advertised `i18n` record: BCP 47 tags, and
+ *                `supportedLocales` contains `defaultLocale`;
+ *   unsupported  an `Accept-Language` the host does not support is answered
+ *                exactly as the same request without it, and a
+ *                `Content-Language`, when sent, names the default locale;
+ *   malformed    a malformed `Accept-Language` never yields `400` and is
+ *                answered exactly as the same request without it;
+ *   errorCode    the `error` code and the `details` keys are identical under
+ *                the default and a negotiated locale.
+ *
+ * The probe is a read of a run id no host minted. Its answer is not pinned
+ * (`404 not_found`, or at major 2 `403 id_tenant_mismatch` when the tenant
+ * segment is not the caller's): every live leg compares against the same
+ * request sent with no `Accept-Language`, so what is witnessed is that the
+ * header changes nothing a client routes on.
+ *
+ * Each leg OBSERVES and returns findings; it asserts nothing. The scenario maps
+ * findings to requirement ids, and `i18n-negotiation-witness.test.ts` proves
+ * every leg against `i18n-double.ts` with one defect turned on.
+ */
+
+import { randomBytes } from 'node:crypto';
+import { driver, type OpenWOPResponse } from './driver.js';
+import { readErrorCode } from './error-envelope.js';
+import type { MajorProfile } from './major-profile.js';
+
+export interface I18nFinding { readonly ok: boolean; readonly doc: string; readonly message: string }
+export type I18nOutcome =
+  | { readonly kind: 'skip'; readonly disposition: 'inapplicable' | 'blocked'; readonly reason: string }
+  | { readonly kind: 'observed'; readonly findings: readonly I18nFinding[] };
+
+/** BCP 47 well-formedness as `capabilities.schema.json` §i18n pins it. */
+export const BCP47 = /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]{2,8}){0,3}$/;
+/** A registered code (snake_case) or a vendor code (`errors.md`; the v2 envelope's vendor grammar). */
+const ERROR_CODE = /^(?:[a-z][a-z0-9_]*|(?!openwop\.)[a-z][a-z0-9]*(?:-[a-z0-9]+)*\.[a-z][a-z0-9_]*)$/;
+
+const isRecord = (v: unknown): v is Record<string, unknown> => v !== null && typeof v === 'object' && !Array.isArray(v);
+const f = (ok: boolean, doc: string, message: string): I18nFinding => ({ ok, doc, message });
+const lower = (s: string): string => s.toLowerCase();
+const primary = (tag: string): string => lower(tag.split('-')[0] ?? tag);
+
+export interface I18nAdverts {
+  readonly record: Record<string, unknown> | null;
+  /** `i18n.defaultLocale`, or `en` when omitted (`i18n.md` §The `i18n` record). */
+  readonly defaultLocale: string;
+  readonly supportedLocales: readonly string[];
+}
+
+export function i18nAdverts(profile: MajorProfile, doc: unknown): I18nAdverts {
+  const record = profile.family(doc, 'i18n');
+  const dl = record?.['defaultLocale'];
+  const sl = record?.['supportedLocales'];
+  return {
+    record,
+    defaultLocale: typeof dl === 'string' ? dl : 'en',
+    supportedLocales: Array.isArray(sl) ? sl.filter((t): t is string => typeof t === 'string') : [],
+  };
+}
+
+const gate = (a: I18nAdverts): I18nOutcome | null =>
+  a.record === null ? { kind: 'skip', disposition: 'inapplicable', reason: 'the host does not advertise i18n — it serves one locale and ignores Accept-Language (i18n.md §The i18n record)' } : null;
+
+/** Leg 1, shape: judged from the discovery record alone. */
+export function shapeLeg(a: I18nAdverts): I18nOutcome {
+  const g = gate(a); if (g) return g;
+  const rec = a.record!;
+  const doc = 'i18n.md §Language tags + §The i18n record';
+  const findings: I18nFinding[] = [];
+  const dl = rec['defaultLocale'];
+  const sl = rec['supportedLocales'];
+  if (dl !== undefined) findings.push(f(typeof dl === 'string' && BCP47.test(dl), doc, `i18n.defaultLocale MUST be a BCP 47 tag (got ${JSON.stringify(dl)})`));
+  if (sl !== undefined) {
+    findings.push(f(Array.isArray(sl), doc, 'i18n.supportedLocales MUST be an array when present'));
+    for (const t of Array.isArray(sl) ? sl : []) findings.push(f(typeof t === 'string' && BCP47.test(t), doc, `every i18n.supportedLocales entry MUST be a BCP 47 tag (got ${JSON.stringify(t)})`));
+    // The schema states the containment "when both are present"; tags compare case-insensitively.
+    if (typeof dl === 'string' && Array.isArray(sl)) {
+      findings.push(f(sl.some((t) => typeof t === 'string' && lower(t) === lower(dl)), doc, `i18n.supportedLocales MUST contain defaultLocale ${dl} (got ${JSON.stringify(sl)})`));
+    }
+  }
+  if (findings.length === 0) return { kind: 'skip', disposition: 'inapplicable', reason: 'the i18n record carries neither defaultLocale nor supportedLocales — nothing to judge' };
+  return { kind: 'observed', findings };
+}
+
+/** A read of a run id no host minted. */
+export function probePath(profile: MajorProfile): string {
+  const opaque = `never-minted-${randomBytes(8).toString('hex')}`;
+  return `${profile.runsPath}/${profile.idSegment(profile.major >= 2 ? `conformance-i18n/${opaque}` : `openwop-conformance-i18n-${opaque}`)}`;
+}
+
+/** A syntactically valid tag the host does not list. */
+export function unsupportedTag(supported: readonly string[]): string {
+  const have = new Set(supported.map(lower));
+  return ['tlh', 'kl-GL', 'mi-NZ', 'eu-ES'].find((c) => !have.has(lower(c)) && !have.has(primary(c))) ?? 'tlh';
+}
+
+const get = (path: string, acceptLanguage?: string): Promise<OpenWOPResponse> =>
+  driver.get(path, acceptLanguage === undefined ? {} : { headers: { 'Accept-Language': acceptLanguage } });
+
+/** The baseline answer must be an error a client can route on, or nothing can be compared. */
+function baselineSkip(base: OpenWOPResponse): I18nOutcome | null {
+  if (base.status >= 400 && base.status < 500 && readErrorCode(base.json) !== undefined) return null;
+  return { kind: 'skip', disposition: 'blocked', reason: `the probe read answered ${base.status} without a 4xx error envelope, so there is no baseline to compare a negotiated answer against` };
+}
+
+/** Leg 2, unsupported: an unsupported locale changes nothing a client routes on, and Content-Language never lies. */
+export async function unsupportedLeg(profile: MajorProfile, a: I18nAdverts): Promise<I18nOutcome> {
+  const g = gate(a); if (g) return g;
+  const path = probePath(profile);
+  const base = await get(path);
+  const b = baselineSkip(base); if (b) return b;
+  const tag = unsupportedTag(a.supportedLocales);
+  const res = await get(path, tag);
+  const findings: I18nFinding[] = [
+    f(res.status === base.status && res.status !== 400 && res.status !== 406, 'i18n.md §Accept-Language ("MUST NOT reject a request because it does not support the requested locale")', `Accept-Language: ${tag} (unsupported) MUST be answered as the same request without it (${base.status}); got ${res.status}`),
+    f(readErrorCode(res.json) === readErrorCode(base.json), 'i18n.md §Accept-Language + §Error envelopes', `the unsupported-locale answer MUST carry the same error code (${String(readErrorCode(base.json))}); got ${String(readErrorCode(res.json))}`),
+  ];
+  const cl = res.headers.get('content-language');
+  if (cl !== null) {
+    findings.push(
+      f(BCP47.test(cl.trim()), 'i18n.md §Language tags', `Content-Language MUST be a BCP 47 tag (got ${JSON.stringify(cl)})`),
+      f(primary(cl.trim()) === primary(a.defaultLocale), 'i18n.md §Fallback rules 3–4', `for an unsupported Accept-Language the host uses its default; Content-Language MUST name the locale actually used (${a.defaultLocale}), never another (got ${cl})`),
+    );
+  }
+  return { kind: 'observed', findings };
+}
+
+/** Leg 3, malformed: a malformed header never fails the request. */
+export async function malformedLeg(profile: MajorProfile, a: I18nAdverts): Promise<I18nOutcome> {
+  const g = gate(a); if (g) return g;
+  const path = probePath(profile);
+  const base = await get(path);
+  const b = baselineSkip(base); if (b) return b;
+  const res = await get(path, ';;;not===a,,language q=;');
+  return { kind: 'observed', findings: [
+    f(res.status !== 400, 'i18n.md §Accept-Language ("A malformed value MUST NOT cause 400")', `a malformed Accept-Language MUST NOT cause 400 (got ${res.status})`),
+    f(res.status === base.status && readErrorCode(res.json) === readErrorCode(base.json), 'i18n.md §Accept-Language ("the host proceeds in its default locale")', `a malformed Accept-Language MUST be answered as the request without it (${base.status} ${String(readErrorCode(base.json))}); got ${res.status} ${String(readErrorCode(res.json))}`),
+  ] };
+}
+
+/** `details` keys, less `locale`, which a host MAY add when it localizes the message. */
+const detailsKeys = (json: unknown): string[] => {
+  const d = isRecord(json) ? json['details'] : undefined;
+  return isRecord(d) ? Object.keys(d).filter((k) => k !== 'locale').sort() : [];
+};
+
+/** Leg 4, errorCode: the machine-readable parts of an error envelope are locale-invariant. */
+export async function errorCodeLeg(profile: MajorProfile, a: I18nAdverts): Promise<I18nOutcome> {
+  const g = gate(a); if (g) return g;
+  const path = probePath(profile);
+  const base = await get(path, a.defaultLocale);
+  const b = baselineSkip(base); if (b) return b;
+  const negotiated = a.supportedLocales.find((t) => lower(t) !== lower(a.defaultLocale)) ?? a.defaultLocale;
+  const res = await get(path, negotiated);
+  const code = readErrorCode(res.json);
+  const doc = 'i18n.md §Error envelopes';
+  const findings: I18nFinding[] = [
+    f(res.status === base.status, doc, `the status MUST NOT change with the negotiated locale (${a.defaultLocale} → ${base.status}; ${negotiated} → ${res.status})`),
+    f(typeof code === 'string' && ERROR_CODE.test(code), doc, `the error code is a registered identifier, never translated (got ${String(code)} under ${negotiated})`),
+    f(code === readErrorCode(base.json), doc, `the error code MUST be the same identifier in every locale (${a.defaultLocale} → ${String(readErrorCode(base.json))}; ${negotiated} → ${String(code)})`),
+    f(JSON.stringify(detailsKeys(res.json)) === JSON.stringify(detailsKeys(base.json)), doc, `details keys are schema field names and are not localized (${a.defaultLocale} → ${JSON.stringify(detailsKeys(base.json))}; ${negotiated} → ${JSON.stringify(detailsKeys(res.json))})`),
+  ];
+  const d = isRecord(res.json) ? res.json['details'] : undefined;
+  const loc = isRecord(d) ? d['locale'] : undefined;
+  if (loc !== undefined) findings.push(f(typeof loc === 'string' && BCP47.test(loc), 'i18n.md §Language tags ("every locale field — is a BCP 47 tag")', `details.locale MUST be a BCP 47 tag (got ${JSON.stringify(loc)})`));
+  return { kind: 'observed', findings };
+}

package/src/lib/localized-content-witness.ts

@@ -0,0 +1,49 @@
+/**
+ * The localized-content advertisement-coherence judge (`i18n.md` §Localized
+ * content, "Advertisement"; `capabilities.schema.json` §content), shared by
+ * every major that states it. Pure: it reads a discovery document and asserts
+ * nothing; the scenario maps the findings to requirement ids and
+ * `localized-content-witness.test.ts` proves each rule in both directions.
+ *
+ * A host advertising `content`:
+ *   1. advertises `i18n`;
+ *   2. has `content.baseLocale` equal to `i18n.defaultLocale` (`en` when omitted);
+ *   3. lists every locale of `baseLocale ∪ content.supportedLocales` in
+ *      `i18n.supportedLocales`;
+ *   4. does not list `baseLocale` in `content.supportedLocales` (stated by the
+ *      schema's `supportedLocales` description).
+ *
+ * Tags compare case-insensitively (`i18n.md` §Language tags).
+ */
+
+import type { MajorProfile } from './major-profile.js';
+
+export interface ContentFinding { readonly ok: boolean; readonly doc: string; readonly message: string }
+export type ContentOutcome =
+  | { readonly kind: 'skip'; readonly disposition: 'inapplicable' | 'blocked'; readonly reason: string }
+  | { readonly kind: 'observed'; readonly findings: readonly ContentFinding[] };
+
+const strings = (v: unknown): string[] => (Array.isArray(v) ? v.filter((t): t is string => typeof t === 'string') : []);
+const f = (ok: boolean, doc: string, message: string): ContentFinding => ({ ok, doc, message });
+const DOC = 'i18n.md §Localized content ("Advertisement")';
+
+export function coherenceLeg(profile: MajorProfile, discovery: unknown): ContentOutcome {
+  const content = profile.family(discovery, 'content');
+  if (content === null) return { kind: 'skip', disposition: 'inapplicable', reason: 'the host does not advertise content' };
+  const i18n = profile.family(discovery, 'i18n');
+  const findings: ContentFinding[] = [f(i18n !== null, DOC, 'a host advertising content MUST advertise i18n')];
+  if (i18n === null) return { kind: 'observed', findings };
+
+  const base = typeof content['baseLocale'] === 'string' ? (content['baseLocale'] as string) : undefined;
+  const supported = strings(content['supportedLocales']);
+  const def = typeof i18n['defaultLocale'] === 'string' ? (i18n['defaultLocale'] as string) : 'en';
+  // An i18n record without supportedLocales serves its default alone.
+  const i18nSet = new Set((i18n['supportedLocales'] === undefined ? [def] : strings(i18n['supportedLocales'])).map((t) => t.toLowerCase()));
+
+  findings.push(f(base !== undefined && base.toLowerCase() === def.toLowerCase(), DOC, `content.baseLocale MUST equal i18n.defaultLocale (got baseLocale ${String(base)}, defaultLocale ${def})`));
+  const resolvable = [...(base === undefined ? [] : [base]), ...supported];
+  const missing = resolvable.filter((t) => !i18nSet.has(t.toLowerCase()));
+  findings.push(f(missing.length === 0, DOC, `every locale in baseLocale ∪ content.supportedLocales MUST be in i18n.supportedLocales (missing ${JSON.stringify(missing)})`));
+  findings.push(f(base === undefined || !supported.some((t) => t.toLowerCase() === base.toLowerCase()), 'capabilities.schema.json §content.supportedLocales', `content.supportedLocales MUST NOT contain baseLocale ${String(base)} (got ${JSON.stringify(supported)})`));
+  return { kind: 'observed', findings };
+}

package/src/lib/model-capability-insufficient-witness.ts

@@ -0,0 +1,121 @@
+/**
+ * The model-capability refusal witness (`host-services.md` §modelCapabilities;
+ * RFC 0031 §B step 4 + §D), shared by every major that serves the
+ * `conformance-model-capability-insufficient` fixture.
+ *
+ * The fixture's one node declares `requiredModelCapabilities:
+ * ['nonexistent-capability-9b3f']` and no `fallbackModel`, so no model can meet
+ * it and no substitution is possible. A host advertising `modelCapabilities`
+ * MUST then "emit `model.capability-insufficient` and fail the run with
+ * `capability_not_provided`", and MUST NOT dispatch.
+ *
+ * Two legs over ONE run:
+ *   refusal      the run ends `failed` / `capability_not_provided`; the log
+ *                carries the insufficient event, before `node.failed`, with a
+ *                payload valid against `run-event-payloads#/$defs/modelCapabilityInsufficient`
+ *                and `fallbackAttempted` not `true` (no fallback was declared);
+ *   no-dispatch  the log carries no `node.completed`, `provider.usage` or
+ *                envelope-reliability event — the node never ran.
+ *
+ * Two halves: {@link drive} observes and asserts nothing; {@link judgeRefusal}
+ * and {@link judgeNoDispatch} are pure, proven in
+ * `model-capability-insufficient-witness.test.ts`.
+ */
+
+import { driver } from './driver.js';
+import { readErrorCode } from './error-envelope.js';
+import { isFixtureAdvertised } from './fixtures.js';
+import type { MajorProfile } from './major-profile.js';
+import { v2RefValidator } from './v2.js';
+
+export const INSUFFICIENT_FIXTURE = 'conformance-model-capability-insufficient';
+const DOC = 'host-services.md §modelCapabilities';
+const isRecord = (v: unknown): v is Record<string, unknown> => v !== null && typeof v === 'object' && !Array.isArray(v);
+
+export interface InsufficientFinding { readonly ok: boolean; readonly doc: string; readonly message: string }
+export interface InsufficientSkip { readonly kind: 'skip'; readonly disposition: 'inapplicable' | 'blocked'; readonly reason: string }
+export interface ObservedEvent { readonly type: string; readonly sequence: number; readonly payload: Record<string, unknown> | undefined }
+export interface InsufficientObservation {
+  readonly createStatus: number;
+  readonly createCode: string | undefined;
+  readonly terminalStatus: string | undefined;
+  readonly errorCode: string | undefined;
+  /** The run's events, ordered by `sequence`. */
+  readonly events: readonly ObservedEvent[];
+}
+
+/** This major's name for an era-1 event; the era-1 name when the codemap has no row (the judge then looks for both). */
+const nameAt = (profile: MajorProfile, era1: string): string => profile.eventType(era1) ?? era1;
+
+/** One fixture run, observed. Asserts nothing. */
+export async function drive(profile: MajorProfile, discovery: unknown, opts: { timeoutMs?: number; pollMs?: number } = {}): Promise<InsufficientSkip | InsufficientObservation> {
+  if (profile.family(discovery, 'modelCapabilities') === null) return { kind: 'skip', disposition: 'inapplicable', reason: 'the host does not advertise modelCapabilities — the dispatch gate binds only a host that does' };
+  if (!isFixtureAdvertised(INSUFFICIENT_FIXTURE)) return { kind: 'skip', disposition: 'inapplicable', reason: `fixture ${INSUFFICIENT_FIXTURE} is not advertised — the host claims no workflow whose node requires a capability no model offers` };
+  const created = await driver.post(profile.runsPath, { workflowId: INSUFFICIENT_FIXTURE });
+  const runId = isRecord(created.json) ? created.json['runId'] : undefined;
+  if ((created.status !== 201 && created.status !== 202) || typeof runId !== 'string') {
+    return { createStatus: created.status, createCode: readErrorCode(created.json), terminalStatus: undefined, errorCode: undefined, events: [] };
+  }
+  const base = `${profile.runsPath}/${profile.idSegment(runId)}`;
+  const deadline = Date.now() + (opts.timeoutMs ?? 20_000);
+  let snap: Record<string, unknown> = {};
+  for (;;) {
+    const r = await driver.get(base);
+    snap = isRecord(r.json) ? r.json : {};
+    if (['completed', 'failed', 'cancelled'].includes(String(snap['status'])) || Date.now() > deadline) break;
+    await new Promise((res) => setTimeout(res, opts.pollMs ?? 500));
+  }
+  const poll = await driver.get(`${base}/events/poll?timeout=1`);
+  const raw = isRecord(poll.json) && Array.isArray(poll.json['events']) ? (poll.json['events'] as unknown[]) : [];
+  const events = raw.filter(isRecord).map((e) => ({
+    type: String(e['type']),
+    sequence: typeof e['sequence'] === 'number' ? e['sequence'] : Number.MAX_SAFE_INTEGER,
+    payload: isRecord(e['payload']) ? e['payload'] : undefined,
+  })).sort((a, b) => a.sequence - b.sequence);
+  const err = isRecord(snap['error']) ? snap['error'] : undefined;
+  return {
+    createStatus: created.status,
+    createCode: undefined,
+    terminalStatus: typeof snap['status'] === 'string' ? snap['status'] : undefined,
+    errorCode: typeof err?.['code'] === 'string' ? err['code'] : undefined,
+    events,
+  };
+}
+
+const f = (ok: boolean, message: string): InsufficientFinding => ({ ok, doc: DOC, message });
+
+/** Leg 1, refusal. Pure. */
+export function judgeRefusal(profile: MajorProfile, o: InsufficientObservation): InsufficientFinding[] {
+  const created = f(o.createStatus === 201 || o.createStatus === 202, `a create of the advertised fixture MUST be accepted; the refusal is at dispatch, not at create (got ${o.createStatus}${o.createCode ? ` ${o.createCode}` : ''})`);
+  if (!created.ok) return [created];
+  const insufficientType = nameAt(profile, 'model.capability.insufficient');
+  const nodeFailedType = nameAt(profile, 'node.failed');
+  const idx = o.events.findIndex((e) => e.type === insufficientType);
+  const failedIdx = o.events.findIndex((e) => e.type === nodeFailedType);
+  const ev = idx >= 0 ? o.events[idx] : undefined;
+  const out = [
+    created,
+    f(o.terminalStatus === 'failed', `a run whose node requires a capability no model offers MUST end failed (got ${String(o.terminalStatus)})`),
+    f(o.errorCode === 'capability_not_provided', `the run's error.code MUST be capability_not_provided (got ${String(o.errorCode)})`),
+    f(ev !== undefined, `the host MUST emit ${insufficientType} (types seen: ${JSON.stringify(o.events.map((e) => e.type))})`),
+  ];
+  if (ev === undefined) return out;
+  out.push(f(failedIdx < 0 || idx < failedIdx, `${insufficientType} MUST precede ${nodeFailedType} (cause before effect; at ${idx} vs ${failedIdx})`));
+  if (profile.major >= 2) {
+    const r = v2RefValidator('run-event-payloads.schema.json#/$defs/modelCapabilityInsufficient')(ev.payload ?? {});
+    out.push(f(r.ok, `the ${insufficientType} payload MUST validate against run-event-payloads#/$defs/modelCapabilityInsufficient${r.ok ? '' : ` (${r.errors})`}`));
+  }
+  out.push(f(ev.payload?.['fallbackAttempted'] !== true, `fallbackAttempted MUST NOT be true: the fixture declares no fallbackModel, so no fallback was attempted (got ${JSON.stringify(ev.payload?.['fallbackAttempted'])})`));
+  return out;
+}
+
+/** What a refused dispatch MUST NOT emit, by era-1 name. */
+export const NOT_AFTER_REFUSAL = ['node.completed', 'provider.usage', 'envelope.retry.attempted', 'envelope.retry.exhausted', 'envelope.refusal', 'envelope.truncated', 'envelope.nlToFormat.engaged', 'envelope.recovery.applied'] as const;
+
+/** Leg 2, no-dispatch. Pure. Looks for each event by this major's name AND its era-1 name. */
+export function judgeNoDispatch(profile: MajorProfile, o: InsufficientObservation): InsufficientFinding[] {
+  if (o.createStatus !== 201 && o.createStatus !== 202) return [f(false, `a create of the advertised fixture MUST be accepted (got ${o.createStatus})`)];
+  const forbidden = new Set<string>(NOT_AFTER_REFUSAL.flatMap((n) => [n, nameAt(profile, n)]));
+  const leaked = o.events.filter((e) => forbidden.has(e.type)).map((e) => e.type);
+  return [f(leaked.length === 0, `a refused dispatch MUST NOT emit node completion, provider usage or envelope-reliability events — the node never ran (got ${JSON.stringify(leaked)})`)];
+}