@openwop/openwop-conformance 2.45.8 → 2.45.10

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # `@openwop/openwop-conformance` Changelog
 
+## [2.45.10] — 2026-10-03 — RFC 0232 Active: a seam-free path for the run-less trigger leg
+
+- **`trigger-bridge-delivery` leg 4 splits in two (RFC 0232, decided question 1 (a)).** Both ids stay in the `openwop-trigger-bridge` floor; the old title-derived id is aliased to the first.
+  - `openwop.requirement.0083.trigger-delivery.runless-attempt-content-free`: on the seam, as before. New: where the host advertises `inboundSigning` and `triggerBridge.deadLetter`, the leg posts a body carrying a canary with a bad signature to a `required` subscription and reads `GET /v1/trigger-subscriptions/{id}/dead-letters`. The record must be present with `reason: "verification_failed"`, carry no canary, signature or signing key, carry a schema-valid dead-lettered `attempt`, carry no `stateChange`, and have `expiresAt − deadLetteredAt` equal to `retentionDays`. Both paths run where both are offered.
+  - `openwop.requirement.0083.trigger-delivery.runless-state-change-content-free`: seam-only. **Without the seam it records `inapplicable`** (was: the combined leg recorded seam-absent). No wire surface causes a subscription state change.
+- **New scenario `trigger-dead-letter-read`** (major 1; `inapplicable` unless the host advertises `triggerBridge.deadLetter` and `inboundSigning`): `openwop.requirement.0232.trigger-dead-letters.paging` (limit clamped, `nextCursor` continues), `.cursor-bound` (another subscription's cursor `400 validation_error`), `.tenant-bound` (another tenant's read `404`, as for an unknown id; needs `OPENWOP_TEST_TENANT_B_API_KEY`, `blocked` without it).
+- **Sabotage.** `lib/trigger-dead-letter-witness.test.ts`, eleven cases against the pure judge and the committed page schema. Each defect fails only its rule. No host serves the read yet, so there is no live proof.
+- **Host impact.** A host serving the seams: unchanged, except leg 4 is two rows. A host with no seams that advertises `openwop-trigger-bridge` (openwop-app's production): leg 4b records `inapplicable`, and leg 4a stays `blocked` until the host advertises and serves `triggerBridge.deadLetter`.
+- **The 2.45.10 cycle opened** with RFC 0232's filing; its gap register changes the packed `spec/v1/gaps.json`.
+
+## [2.45.9] — 2026-10-02 — a trigger leg that observed nothing is inapplicable, not blocked
+
+- **Fix: `trigger-stream-cdc-sources` no longer records `blocked` on a host that serves neither `stream` nor `change`.** The ingest leg skipped both sources on such a host and then passed with zero assertions and no reason. RFC 0148 §A records that as `blocked`, and a `blocked` row denies a major-1 bundle (RFC 0168 §E.1). It now records `inapplicable`, with the reason. The dedup leg's pre-RFC 0127 branch said `blocked` for the same condition and now says `inapplicable`. An unwired seam is still `blocked`, and a host that advertises either source and refuses it still fails.
+  - **Found by** openwop-app's 2.45.8 seam-free run, ahead of its RFC 0230 certified cut. My own harness run with the seams on recorded the same row, so the seams play no part in it.
+  - **Proof.** On openwop-app's in-process harness, the row was `blocked` before the change and is `inapplicable` with the reason after it. All nine tests pass.
+
 ## [2.45.8] — 2026-10-02 — RFC 0229 Accepted on MyndHyve's production cut; a v2 witness for tableStorage schema enforcement
 
 - **The 2.45.8 cycle opens.** RFC 0229's and RFC 0228's gap registers change the packed `spec/v1/gaps.json`.

package/README.md

@@ -135,7 +135,7 @@ Exit code is non-zero on any failed assertion. `--certify` distinguishes: `0`
 
 ## What's Covered
 
-The current suite has 591 scenario files under `src/scenarios/`.
+The current suite has 592 scenario files under `src/scenarios/`.
 - 2026-09-29 (suite 2.45.0, openwop#1763): NEW `v2-cors-preflight.test.ts` — `headers.md` §Cross-origin preflight. For every operation it preflights with `Origin`, the method, and the operation's declared request headers (plus `authorization` / `content-type` where they apply, from `spec/v2/path-manifest.json`), and reads the answer as the Fetch standard's CORS-preflight check does. Self-gated: `inapplicable` when no operation's preflight grants `OPENWOP_CORS_ORIGIN` (default `https://conformance.invalid`).
 - 2026-09-23 (suite 2.37.0 cycle, RFC 0213): NEW `v2-sse-last-event-id-cursor.test.ts` (a `Last-Event-ID` past the log is an exclusive cursor; a malformed id, when refused, is `400 validation_error`; the cursor never changes the answer for an unknown or foreign-tenant run — public test of `event-cursor-after-authorization`), `v2-idempotency-in-flight.test.ts` (five concurrent same-key creates yield one run; each loser is a marked replay or `409 idempotency_in_flight` with no retry timing in `details`; `partial-witness` when no loser was refused in flight) and `v2-interrupt-resolve-terminal.test.ts` (a run-scoped resolve after cancel or completion is `409 interrupt_already_resolved`, never `interrupt_cancelled`). All three sit off the core-standard floor until measured on the three bundle hosts.
 - 2026-09-03 (suite `1.157.0 -> 1.158.0`, gap G17): NEW `idempotency-concurrent-claim.test.ts` — drives the new `host-sample-test-seams.md` §25 concurrent duplicate-delivery seam for the RFC 0150 §B / `idempotency.md` §"Concurrent duplicates (Layer 2)" atomic-claim MUST, which is unconditional and had no witness of any kind. Asserts every executor mints the SAME `logicalInvocationId` **before** asserting `delivered === 1` — without the identity check a host passes by minting different ids and never colliding, one effect because nothing raced. Not profile-gated and so not opt-out-able (the obligation is unconditional); an unmounted seam records `blocked`, which is not certifiable. Graduates `layer2-invocation-claim-atomic` reference-impl -> protocol.
@@ -482,7 +482,7 @@ Server-required (added in 1.7.0):
 | ------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Redaction** | [`capabilities.md`](../spec/v1/capabilities.md) §"Secrets" + NFR-7 + §"aiProviders" | Vendor-neutral assertions that the server doesn't leak secret material. Three scenario groups: (a) discovery shape contract — `secrets` + `aiProviders` advertisements are well-formed regardless of `secrets.supported`; when `supported === true`, scopes MUST be non-empty + `resolution === 'host-managed'`; `byok ⊆ supported`. (b) bearer-token redaction — invalid Bearer canary in `Authorization` header is not echoed in the 401 response body. (c) credentialRef echo control — gated on `secrets.supported === true`; canary planted in `configurable.ai.credentialRef` MUST NOT appear in any RunEvent payload (poll-based capture; transport-agnostic). Uses runtime-built canary fixtures (`lib/canaries.ts`) that defeat static secret scanners. 6 scenarios. |
 
-Current source tree: 591 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
+Current source tree: 592 scenario files. Use [`coverage.md`](./coverage.md) for current grade/gap tracking.
 
 ## Remaining Gaps
 

package/coverage.md

@@ -251,6 +251,7 @@ Every OpenAPI operation should have:
 | `createAnnotation`                                                                          | `feedback-record-and-list.test.ts`, `feedback-on-terminal-run.test.ts`, `feedback-correction-redaction.test.ts` (RFC 0056); gated on `capabilities.feedback.supported`, soft-skip on `501`                                                                                                                                                                                                                                                    | `feedback-unsupported-501.test.ts` (501 when unadvertised), `feedback-cross-tenant-isolation.test.ts`, `feedback-fork-not-copied.test.ts`                                                                                                                                                 | Capability-gated; full cross-tenant proof needs a multi-tenant auth seam (soft-skips, like `kv-cross-tenant-isolation`).                                                                                            |
 | `listAnnotations`                                                                           | `feedback-record-and-list.test.ts`, `feedback-cross-tenant-isolation.test.ts` (RFC 0056)                                                                                                                                                                                                                                                                                                                                                      | `feedback-correction-redaction.test.ts` (redacted listing), `feedback-fork-not-copied.test.ts` (fork list empty)                                                                                                                                                                          | Gated on `capabilities.feedback.supported`.                                                                                                                                                                         |
 | `createTriggerSubscription`                                                                 | `trigger-ingestion.test.ts` (RFC 0099) — always-on schema legs (`TriggerEvent` / `TriggerSubscriptionRegistration` shape, the §F.1 one-of, `AttachmentRef.ref`, content-free `trigger.delivery.attempted`) + a capability-gated behavioral leg (`triggerBridge.ingestion`) driving the `POST /v1/host/sample/trigger-bridge/ingest` seam for SSRF refusal + content-redaction                                                                  | `trigger-ingestion.test.ts` covers the `trigger-ingestion-ssrf` + `trigger-ingestion-content-redaction` SECURITY invariants (schema-layer always-on + gated behavioral)                                                                                                                   | Gated on `capabilities.triggerBridge.ingestion`; soft-skips when unadvertised or seam unwired. Reference-host wiring at `Active → Accepted` (openwop-app ADR 0033 external-event-triggers item).                    |
+| `listTriggerDeadLetters` | `trigger-bridge-delivery.test.ts` leg 4a (RFC 0232 §C: the refused post's record is content-free, schema-valid, carries no `stateChange`, and matches `retentionDays`) + `trigger-dead-letter-read.test.ts` (§B paging, cursor and tenant rules); both gated on `triggerBridge.deadLetter` with `inboundSigning` |
 | `getA2ATaskState`                                                                           | `a2a-task-roundtrip.test.ts` (RFC 0100) — always-on `A2ATaskState` + `a2a` capability shape legs + a capability-gated durable-`tasks/get`-after-disconnect leg (`a2a.durableTasks`) driving the `/v1/host/sample/a2a/tasks/*` seam                                                                                                                                                                                                             | `a2a-task-roundtrip.test.ts` covers the `a2a-push-egress-ssrf` SECURITY invariant (schema-layer always-on `PushConfig` + gated push-SSRF behavioral)                                                                                                                                      | Host-extension read seam (non-normative; the normative read stays the A2A `tasks/get` JSON-RPC method). Gated on `a2a.durableTasks` / `a2a.pushNotifications`; soft-skips otherwise. Reference host at `Active → Accepted`. |
 | `diffRun`                                                                                   | `run-diff.test.ts` (RFC 0054); soft-skips on 404 when the endpoint is unimplemented                                                                                                                                                                                                                                                                                                                                                           | Self-diff `divergedAtSeq: null`/empty (determinism floor), two-fixture divergence with `eventDiffs[0].seq === divergedAtSeq`, response-shape + `stateDiff` redaction-safety, `400` (missing `against`) + `404` (nonexistent `against`)                                                    | Add a bespoke deterministically-divergent fork fixture for `divergedAtSeq === N`-at-a-chosen-seq; full cross-principal `403` needs a multi-principal harness.                                                       |
 | `resolveInterruptByRun`                                                                     | `interrupt-approval.test.ts`, `interrupt-clarification.test.ts`, `approval-payload.test.ts`, `interruptRace.test.ts`                                                                                                                                                                                                                                                                                                                          | Invalid action, unknown node, race cases                                                                                                                                                                                                                                                  | Add auth-required and quorum profile scenarios.                                                                                                                                                                     |

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.8",
-  "stampSha256": "59536621c519684607bda9bfb0f0ddbb5a31cdf2b3f9131a856a9dfde93a6f39"
+  "version": "2.45.10",
+  "stampSha256": "cfba8c0d8fc447d57a70ace7ffcb054ba3ee9402be6268f1b40c99e0517791e8"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.45.8",
+  "version": "2.45.10",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.45.8"
+    "@openwop/spec-artifacts": "2.45.10"
   }
 }

package/requirement-aliases.json

@@ -8,6 +8,7 @@
     "openwop.it.era-key-stamped-v1.a-run-the-host-just-created-carries-eventlogschemaversion": "openwop.requirement.version-negotiation.era-key-stamped",
     "openwop.it.pause-resume.pause-on-an-already-paused-run-is-a-no-op-200-202-idempotent": "openwop.it.pause-resume.pause-on-an-already-paused-run-returns-409-with-details-runstatus-paused-unless",
     "openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-retries-to-dead-letter-and-links-delivery-run-causation": "openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-a-repeated-delivery-is-effectively-once",
+    "openwop.it.trigger-bridge-delivery.keeps-the-run-less-trigger-events-content-free": "openwop.requirement.0083.trigger-delivery.runless-attempt-content-free",
     "openwop.it.v2-advertised-fixtures-exist.a-sampled-advertised-fixture-is-actually-creatable-not-just-listed": "openwop.requirement.0168.advertised-fixtures-exist",
     "openwop.it.v2-advertised-path-space-served.a-host-advertising-major-2-reaches-the-surfaces-it-already-serves-under-v1": "openwop.requirement.0172.advertised-path-space-served",
     "openwop.it.v2-alias-covers-reword.the-corpus-gate-script-exits-0": "openwop.requirement.0168.alias-covers-reword",

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 666,
-    "tests": 2545,
-    "withStableId": 2545,
+    "files": 667,
+    "tests": 2549,
+    "withStableId": 2549,
     "interpolatedTitles": 0,
-    "explicitIds": 2421
+    "explicitIds": 2426
   },
   "records": [
     {
@@ -26311,7 +26311,7 @@
     {
       "id": "openwop.it.trigger-bridge-delivery.de-dups-by-dedupkey-a-repeated-delivery-is-effectively-once",
       "file": "trigger-bridge-delivery.test.ts",
-      "line": 158,
+      "line": 171,
       "title": "de-dups by dedupKey: a repeated delivery is effectively-once",
       "explicitId": "openwop.requirement.0083.trigger-delivery.dedup",
       "citations": [
@@ -26347,7 +26347,7 @@
     {
       "id": "openwop.it.trigger-bridge-delivery.dead-letters-an-exhausted-or-refused-delivery-without-starting-a-run",
       "file": "trigger-bridge-delivery.test.ts",
-      "line": 182,
+      "line": 195,
       "title": "dead-letters an exhausted or refused delivery without starting a run",
       "explicitId": "openwop.requirement.0083.trigger-delivery.dead-letter",
       "citations": [
@@ -26380,7 +26380,7 @@
     {
       "id": "openwop.it.trigger-bridge-delivery.links-delivery-run-causation-on-run-started",
       "file": "trigger-bridge-delivery.test.ts",
-      "line": 205,
+      "line": 218,
       "title": "links delivery→run causation on run.started",
       "explicitId": "openwop.requirement.0083.trigger-delivery.causation",
       "citations": [
@@ -26414,12 +26414,41 @@
       ]
     },
     {
-      "id": "openwop.it.trigger-bridge-delivery.keeps-the-run-less-trigger-events-content-free",
+      "id": "openwop.it.trigger-bridge-delivery.keeps-a-dead-lettered-run-less-attempt-content-free",
       "file": "trigger-bridge-delivery.test.ts",
-      "line": 234,
-      "title": "keeps the run-less trigger events content-free",
-      "explicitId": null,
-      "citations": []
+      "line": 247,
+      "title": "keeps a dead-lettered run-less attempt content-free",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.runless-attempt-content-free",
+      "citations": [
+        {
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §F.6",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §C (RFC 0232 §B–§C)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.trigger-bridge-delivery.keeps-a-run-less-subscription-state-change-content-free",
+      "file": "trigger-bridge-delivery.test.ts",
+      "line": 278,
+      "title": "keeps a run-less subscription state change content-free",
+      "explicitId": "openwop.requirement.0083.trigger-delivery.runless-state-change-content-free",
+      "citations": [
+        {
+          "section": "trigger-bridge.md §B",
+          "requirement": "exhaustion MUST record ≥1 trigger.subscription.state.changed"
+        }
+      ]
     },
     {
       "id": "openwop.it.trigger-bridge-shape.a-conforming-subscription-validates",
@@ -26584,6 +26613,92 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.trigger-dead-letter-read.clamps-limit-and-continues-a-short-page-with-nextcursor",
+      "file": "trigger-dead-letter-read.test.ts",
+      "line": 68,
+      "title": "clamps limit and continues a short page with nextCursor",
+      "explicitId": "openwop.requirement.0232.trigger-dead-letters.paging",
+      "citations": [
+        {
+          "section": "trigger-bridge.md §C",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §C",
+          "requirement": "a page MUST NOT exceed limit"
+        },
+        {
+          "section": "trigger-bridge.md §C",
+          "requirement": "with two dead letters and limit 1, the page MUST carry nextCursor"
+        },
+        {
+          "section": "trigger-bridge.md §C",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §C",
+          "requirement": "the next page MUST carry the second dead letter"
+        },
+        {
+          "section": "trigger-bridge.md §C",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.trigger-dead-letter-read.refuses-a-cursor-minted-for-another-subscription",
+      "file": "trigger-dead-letter-read.test.ts",
+      "line": 84,
+      "title": "refuses a cursor minted for another subscription",
+      "explicitId": "openwop.requirement.0232.trigger-dead-letters.cursor-bound",
+      "citations": [
+        {
+          "section": "trigger-bridge.md §C",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §C",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §C",
+          "requirement": "the refusal MUST carry validation_error"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.trigger-dead-letter-read.answers-another-tenant-s-read-of-a-subscription-404-as-for-an-id-never-minted",
+      "file": "trigger-dead-letter-read.test.ts",
+      "line": 97,
+      "title": "answers another tenant's read of a subscription 404, as for an id never minted",
+      "explicitId": "openwop.requirement.0232.trigger-dead-letters.tenant-bound",
+      "citations": [
+        {
+          "section": "trigger-bridge.md §C",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §C",
+          "requirement": "a foreign read MUST NOT disclose a record"
+        },
+        {
+          "section": "trigger-bridge.md §C",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "trigger-bridge.md §C",
+          "requirement": "a foreign id MUST be answered exactly as an unknown one"
+        }
+      ]
+    },
     {
       "id": "openwop.it.trigger-ingestion.the-canonical-email-triggerevent-fixture-validates",
       "file": "trigger-ingestion.test.ts",
@@ -26916,7 +27031,7 @@
     {
       "id": "openwop.it.trigger-stream-cdc-sources.stream-dedup-the-same-broker-coordinates-delivered-twice-are-effectively-once-c",
       "file": "trigger-stream-cdc-sources.test.ts",
-      "line": 201,
+      "line": 210,
       "title": "stream dedup — the same broker coordinates delivered twice are effectively-once (§C-1 floor)",
       "explicitId": "openwop.it.trigger-stream-cdc-sources.stream-dedup-the-same-broker-coordinates-delivered-twice-are-effectively-once-c",
       "citations": [

package/scenario-majors.json

@@ -1,8 +1,8 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 591,
-    "v1": 454,
+    "files": 592,
+    "v1": 455,
     "v2": 152
   },
   "majors": {
@@ -1263,6 +1263,9 @@
     "trigger-bridge-shape.test.ts": [
       1
     ],
+    "trigger-dead-letter-read.test.ts": [
+      1
+    ],
     "trigger-ingestion.test.ts": [
       1
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,19 +1,19 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.8",
-  "corpusTag": "v2.45.8",
+  "version": "2.45.10",
+  "corpusTag": "v2.45.10",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
-    "api/openapi.yaml": "ad37a5a5c732ad46100fc03c3f4243fdd4f2976e330f02a8791b6b5b10a8a0c1",
+    "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "9d9fd7ed63a5514f48eb525b85400bdf3672c228b378fd976142514296cbf7b8",
-    "api/v2/asyncapi.yaml": "e68b4dbe4a0426d8887e3d38dcc67fdbe1a8a4e25360abc44e30fca2323e0d77",
-    "api/v2/openapi.yaml": "eec20ade7ef2d68836e0f91fb756afa63a27dd89c2b8f8daae26c2dbb16be91c",
+    "api/seams-v2.yaml": "448d60e189059fe6bd4953b8c47f6941f89053707f45621d4e32b8bef0773670",
+    "api/v2/asyncapi.yaml": "8db5aa748cd4f6481055d48d0a6d66d596f20e712d2004aa86de79b4c34e9bd9",
+    "api/v2/openapi.yaml": "e3b1ed5954b8e9acd6c68cd2a924603afcebb686d07fb5a26e929b01b7f6599b",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
-    "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
+    "schemas/README.md": "bd1c00fae7b6fda506a75aff841bbdc438d4ce092642a72041203bee999b88de",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
     "schemas/a2ui-surface-delta-frame.schema.json": "970d434e4fdcb925de64aaace91eb83bfbcfd8f76757a9ce9f339eda5fb3f4e8",
     "schemas/agent-deployment-transition.schema.json": "1ac987fed0f380fa5b4e9a40e8e13316e5ae42d03a0ff42db4be6273e1bfe9f4",
@@ -31,7 +31,7 @@
     "schemas/artifact-type-pack-manifest.schema.json": "60342fcb15eb7f3ab46271f0641409a30d3a4a8f318b1020c53070886b191252",
     "schemas/audit-verify-result.schema.json": "0d3a3088ac1c32f9df66d346c33d7adbd8037940dba040e14ea847565a1a14bd",
     "schemas/budget-policy.schema.json": "3d4fe30ae129fe136ab9ece395f2a2a42a76360786b1b9a1d5f1cbc753eb5b39",
-    "schemas/capabilities.schema.json": "a7e5910bf10e6d8238e909fee5b81e405846f91688cccf1bb0d13fb081336a33",
+    "schemas/capabilities.schema.json": "195a9bdfaeb8f3d425eaee3400bb3edca90a510f4c34b2fcb81a5685ada307ad",
     "schemas/certification-bundle-v2.schema.json": "2f85530dd04824a15810c94e96869362dee1e78396eca21fdd18e5501416bb7d",
     "schemas/channel-presence-payload.schema.json": "f9d0ef4219814c2b765baf3e68cbe5eea2cb42379f516a93a0459dcd5f7db47e",
     "schemas/channel-written-payload.schema.json": "54723a56bc5a35232f64544ca686ac1ac959a5fb05b32b2401facca6b3ef51a3",
@@ -82,7 +82,7 @@
     "schemas/residency.schema.json": "b45fdc91ae88091251914dbd6787a1e2ce687580b91d31a759217b7a1f0010c0",
     "schemas/run-ancestry-response.schema.json": "963a5763b03216aa72fc2854560c778e53994f8cb06ea9a4053e541273c87f5c",
     "schemas/run-diff-response.schema.json": "d9d196730b5d5d8a04a591d21a8fc6b44be7fa134f11827ff7e4f1a86d47e83d",
-    "schemas/run-event-payloads.schema.json": "2094f19da1189f93392df6e728d7e17ad5bb1257b5fc44bb5e2036537658f12c",
+    "schemas/run-event-payloads.schema.json": "0812a7e89c37990f4e3d26a63b9c821ef1612893164f0378554bb702672f8513",
     "schemas/run-event.schema.json": "c70c06932b9831295042836213e617c8e946f20ddd49cf4e889b74d89d2175a8",
     "schemas/run-options.schema.json": "f8241ece6ddc6527de9160d811d42c231b4f77b935f2e107b3c05608545c59ab",
     "schemas/run-orchestrator-decided-event.schema.json": "17a43a3c44680a24d411141357a867b3caed6107d56de88fe2e062eaf93fa2c1",
@@ -94,9 +94,10 @@
     "schemas/subject.schema.json": "89679e35c7ec586adf6dd4adaff0bfa5453648d067fb2a43d7a2f7b2d016e10c",
     "schemas/suspend-request.schema.json": "7a90b622d5c619e3ffb5da696d272d6505e2780ab92ab631ac1b900f5daea908",
     "schemas/tool-descriptor.schema.json": "7f6adbae63003c1f1311f6a436f7f286542be62aa19a27b46730f2c2810857f7",
+    "schemas/trigger-dead-letter-page.schema.json": "1a471a975d66839f0a79f0a6d733de92cdbe2ac7111ff867d084b7795a9bc842",
     "schemas/trigger-event.schema.json": "59d63b79dca3593f45d281776cbfe43ae4d85ee25519b82ad59f162a9efb592c",
     "schemas/trigger-subscription-registration.schema.json": "2ca680ca6ffdb3cfc5de7bb8b8db8c3ec8eab4b88b7c9f7fe5edaecc7cf61ad0",
-    "schemas/trigger-subscription.schema.json": "4f7b067f20032073b140c4bb15dc9a9914c4f6421a252ff1ff261cbdd8edf270",
+    "schemas/trigger-subscription.schema.json": "e8cddab88f73a7a79bb3b78a60a480a00e16966b76f0e18c21a2aef09b6420ac",
     "schemas/ui-plugin-message.schema.json": "346638babf1f8ea7b161cde75c0038b518cd2cc5bf0631772e20a9b74c96b5dd",
     "schemas/v2/a2a-task-state.schema.json": "1810363e2d9bddb5997923bdac4044cc17c6f46ec5a40515d2ff21d9c82c1ad9",
     "schemas/v2/a2ui-surface-delta-frame.schema.json": "6889c5da3fe7e76cb614038c0eea6774776fa640448558b258eb87fb50cb9b64",
@@ -116,7 +117,7 @@
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
     "schemas/v2/budget-policy.schema.json": "1de68095db0beb5c7a4be629de26e79f62ebbe748a88d46f36e768edfd1f0d68",
-    "schemas/v2/capabilities.schema.json": "8d151a098a3cf7285fcadec8c1f192bed963ed6da3146e62d25155eb18afba9a",
+    "schemas/v2/capabilities.schema.json": "4503d383c2b5efff532a79dabc79d17b5f6494c88d5b385bd3ca5f1a4e3f7647",
     "schemas/v2/certification-bundle.schema.json": "82ce31a1ed6c7e21b0ba88ff62a7b8b768fc3b176b1d06fce023203830b94725",
     "schemas/v2/channel-presence-payload.schema.json": "4eeb224910e6f7eee3ab5e7c3899559c25c83a26d0022e0ad195c4672611977a",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
@@ -171,7 +172,7 @@
     "schemas/v2/residency.schema.json": "3fd23c9732beb140504e81560fc426eb6764d547e56da5fb92c5a5c7bf04db3a",
     "schemas/v2/run-ancestry-response.schema.json": "334c17f2062dea62726ca1d07b8be3f169cdc422af843c1def5fb317039814c9",
     "schemas/v2/run-diff-response.schema.json": "8bdb2045c274580038bd74781f7d062f5049839797c164a89de4ed89edc53a74",
-    "schemas/v2/run-event-payloads.schema.json": "b2aa55840c0817c703417fd746ba85f72be7268b92f450143dfc1faf2f8fa119",
+    "schemas/v2/run-event-payloads.schema.json": "fc1af4245dec98f7be86d20ad339e3409d0b2aaaa301dace083f734999c470b7",
     "schemas/v2/run-event.schema.json": "2f0d7416bd376c56affe97b6b2b49981532e8e9ff45c0a162cf806c78b3e7fb7",
     "schemas/v2/run-list-response.schema.json": "c2dbc34768dcf64528914a213aa3cb55952e8e3e90a64b04a9423b2a19749d38",
     "schemas/v2/run-options.schema.json": "f0e9f494d80086c2ed2cf9fe87df54e5b4e66601699c4a1089f4edbc7ba58867",
@@ -185,9 +186,10 @@
     "schemas/v2/subject.schema.json": "094e981fb20052a911393e219ea5f2065d8b8417b65080a70c5ea99fd960a8fe",
     "schemas/v2/suspend-request.schema.json": "368d9932efb08f85b4520cac44b3c553876209f55bada93b5fcac93cc890b411",
     "schemas/v2/tool-descriptor.schema.json": "8c98fb5e93bc649dff859d3d1dde8075db929efd6c49c496252d0a88cccc73e1",
+    "schemas/v2/trigger-dead-letter-page.schema.json": "571f8c39b64571bff20d391a6e6e829d4ce470ab790b2b7f810cc4aa40edcbc1",
     "schemas/v2/trigger-event.schema.json": "710ecca8b3ecdad3a532a96768177f062192b24a589a4f798c7eb24bab64b30a",
     "schemas/v2/trigger-subscription-registration.schema.json": "5f7959f3e13f49399783e47f73101d6af95e5abccea1af2f0014ccbe3e51006c",
-    "schemas/v2/trigger-subscription.schema.json": "1f5c286f68577d531ef9445ab2493f8d69ac9ee42313d28d758a0f00dd0fab36",
+    "schemas/v2/trigger-subscription.schema.json": "06abe021712a4bfc5a107a067053cd3cc9704f47ae7066d8449a508c368a0ab2",
     "schemas/v2/ui-plugin-message.schema.json": "879d65867c01656b3962d64283e66364dcb8f626ad26c5fcf2d2d55a79ae0ce9",
     "schemas/v2/webhook-dead-letter-page.schema.json": "543f5ccc26d8f777684a037172ab7b9fdf70735e5394eeb42e5fa6569503f528",
     "schemas/v2/webhook-delivery.schema.json": "4e8ab3b722ad1731adf0548c1217f0de62da40de14e8abf77533aee4ace4c079",
@@ -204,17 +206,17 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "0b2f28808ffe0b9d98a187775038c3406bb70919747a788a6e4f866e293ae6d3",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "e7939af18e6c8d189f60e47df9fadd2da93c4ae96109a023283687dc7ba83b9f",
+    "spec/v1/core-standard-manifest.json": "819828fb2f978fa9e4a994652bbe16c797d36a8c4393d57d1432c8a53f2120ab",
     "spec/v1/deprecations.json": "a3293072ea951857395d05f0437264e88965f1e9019ff61c55bacfa9c1aaa17c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "fa1b564fe59db6a708b9488d15aab445919fcc3621e8cf8121901b90b7b4c234",
+    "spec/v1/gaps.json": "7eab313ec80c40285e3290113f5d3fea90ea6f8bc385ef6fd15d415f52540035",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
-    "spec/v1/operation-path-manifest.json": "fada0342815fb129c1ae61f1829bd6e34417717408ce86fcc54280f373c19e74",
+    "spec/v1/operation-path-manifest.json": "f988f7ebf58ff192e999e2a71192066052f837acc03c91d047d6050ca21a83b0",
     "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
     "spec/v2/README.md": "ddea90d7cf14aefffe1a43eeeecd4222dadad1d1e5ac64dceb073990eb93d9ef",
     "spec/v2/core/artifact-type-packs.md": "f734740cc3963f86c9f273a7dace26291bba2855161ddd3540618131a2c8d13e",
@@ -226,7 +228,7 @@
     "spec/v2/core/events.md": "c1a20e3aa6736119ea07aa2cf66faa808a1874d2cde4933033b65506d1742883",
     "spec/v2/core/execution.md": "8a0c9db1bbfb97c008ab9328b7333c1cc3318196e78bfbefb49e781bdf4f9d44",
     "spec/v2/core/form-content-packs.md": "02931227899676fd4581a27017be2a6c4953904717be9b81c29d12f87ab3917d",
-    "spec/v2/core/headers.md": "21d6c8220c3ac75b10e31c4cf6179abb539e2558af5006e40228d8c383ed5c92",
+    "spec/v2/core/headers.md": "1e601c31d2c8bcb7628b7efe2b65fb53d9c79db2a60a4235c333cf85290bb0c0",
     "spec/v2/core/host-services.md": "73f26ea32891044131d63f9861d2cbddccb5d08bf76e29e47afef9bb5b646791",
     "spec/v2/core/i18n.md": "882904b7d59f992ab1e5f7346167161a54cf665b8fee47e64a3862cf9133a580",
     "spec/v2/core/idempotency.md": "adbd317a6ebb57c2759c076297b31f67def9e391576bccd0bbea787b13e85872",
@@ -245,11 +247,11 @@
     "spec/v2/core/storage.md": "dc94b985847c1341c7a064f04a6010f0fdbe6c3ab3e555d4362878c81d764c18",
     "spec/v2/core/tool-catalog.md": "d16a9004418719c48301804aefa4d7ab6f41112a4ed83727f552aa1b92b418b0",
     "spec/v2/core/versioning.md": "b7acb0d8b77425cb53ea700e47ba790bf7506de600c398690e6ec5bb9c7a220e",
-    "spec/v2/core/webhooks.md": "b0c08a3511b9319da7b0f7d83cddb15758acfc92e4c58c3604ac0f6b1ab13242",
+    "spec/v2/core/webhooks.md": "daf6ec03092f4b3fde1eb74a5e2e801ec48db5139a13fcc0fd7fb4a004635ae3",
     "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
     "spec/v2/corrections.json": "3a8d93e33865b692d26a3b6bfd3819766e206b2e0c2a69669baa4bf833d05a49",
     "spec/v2/corrections.schema.json": "46bbffb954d13bd9995aebc912ceeb2544f7064331abf25fd6ab85c81a5cec94",
-    "spec/v2/declaration.json": "45ca70a0d74fdade13192565cb3b35e446ffab537f2caaf23da73a4050b3c6ac",
+    "spec/v2/declaration.json": "8e5eab46ea448725b806a2395f80f5c36fa582a308f80eb09931a633a595eae1",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
     "spec/v2/errors.json": "83f048b0a06952b4af6f125fb66c4212acab51056b411390f1010acd6ab9cdc0",
     "spec/v2/errors.schema.json": "47404ad53e6147cf9017b813483712466573e419fb33e6c4b6c12d3e7deba1bc",
@@ -295,17 +297,17 @@
     "spec/v2/generated/error-codes.md": "f171c0ca1be40221f9b4fbfcbce73c728c315a1e8feb8dd6bf738d6ca9e29526",
     "spec/v2/harness-trust-anchors.json": "6007b92eae16a070fbc3777424efb0abfe865fda89d096963109b96282b91205",
     "spec/v2/harness-trust-anchors.schema.json": "372b5d92337c893d3449eff3f6bfd009ac09fdac285296d8bdbe0a08fff9e34c",
-    "spec/v2/id-field-bindings.json": "9f6fd280250447e26a6704811c352bb8f2ff6c4bd242befe3da0ba38962370e9",
+    "spec/v2/id-field-bindings.json": "cc315f9a7aa5ec552860c1a790e105502fb737dc10b57aa5641bdd7405d6b638",
     "spec/v2/interop-map.json": "02255dafe7eb55f61ca7f9ae7c21f079d1848a6756991343088975ac9d184b8d",
     "spec/v2/interop-map.schema.json": "0017c882df34ee215e2e0729de051490e09d43aac3d2c949285698ed51832f12",
     "spec/v2/migrations.json": "651954938a1e154c0b6f1e3dd6e105889d30de3bb65789f21de7f77a12869e9e",
     "spec/v2/migrations.schema.json": "b91ade6320ad1b1185c9495b9424f3aa63438ed8e412c45171c227d82c0afd86",
-    "spec/v2/path-manifest.json": "27c2307b84376b2f22bea4e2213fc7e33ef3bf8fd1d18039f7955edb00dc9c9a",
+    "spec/v2/path-manifest.json": "36363105280139dad095dc4f64b5b272121e9759cdcf6de011358dd1c1a90540",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "a9e139b57c3bcf8e888dfe58aef34a9b72813d2c30132364df3e21fe3a27d628",
+    "spec/v2/release.json": "044530e75b4cdec6747c1bcebe799ebc62f1f6c2a1e722369b35b2854e54049f",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "7d6134b5693b3fb25afa7e54715f00cf0bf419e0bcb5b8802571a263c4ef019d"
+    "spec/v2/surface-baseline.json": "99ddcf9eb0d06967879ce7f6e54c49fe19bfabc9ee50f00f78699b401108bfd5"
   },
-  "corpusCommit": "c5b85d858212ed6497ae6b2ae7584e5e2d77d016"
+  "corpusCommit": "8817d7c027047bbf1aa8d9385122137396f1bdca"
 }

package/src/lib/trigger-dead-letter-witness.ts

@@ -0,0 +1,143 @@
+/**
+ * The trigger dead-letter read witness (RFC 0232), leg 4's normative-surface
+ * path in `trigger-bridge-delivery.test.ts`.
+ *
+ * A dead-lettered trigger delivery started no run, so it is on no run's log.
+ * On a host that serves no test seam, the only place the suite can see it is
+ * `GET /v1/trigger-subscriptions/{id}/dead-letters`. The suite causes one
+ * unaided: it posts a body carrying a canary with a bad signature to a
+ * `required` subscription (RFC 0230 leg 2), then reads the subscription's
+ * dead letters.
+ *
+ * Two halves: {@link readDeadLetters} observes and asserts nothing; {@link judge}
+ * is pure, so each defect it convicts is proven in `trigger-dead-letter-witness.test.ts`.
+ *
+ * Not witnessed here: a record's `stateChange`. No wire surface causes a
+ * subscription state change on a host without the seam (RFC 0232 gap G2), so
+ * that half of leg 4 stays seam-witnessed.
+ */
+
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { driver } from './driver.js';
+import { SCHEMAS_DIR } from './paths.js';
+
+export interface DeadLetterFacet {
+  readonly retentionDays: number;
+  readonly maxPageSize: number;
+}
+
+/** The advertised `triggerBridge.deadLetter` facet, or null when the host does not advertise it. */
+export function deadLetterFacet(discovery: unknown): DeadLetterFacet | null {
+  const d = discovery as { triggerBridge?: unknown; capabilities?: { triggerBridge?: unknown } } | null | undefined;
+  const tb = (d?.triggerBridge ?? d?.capabilities?.triggerBridge) as { deadLetter?: unknown } | undefined;
+  const f = tb?.deadLetter as { retentionDays?: unknown; maxPageSize?: unknown } | undefined;
+  if (f === undefined || f === null || typeof f !== 'object') return null;
+  if (typeof f.retentionDays !== 'number' || typeof f.maxPageSize !== 'number') return null;
+  return { retentionDays: f.retentionDays, maxPageSize: f.maxPageSize };
+}
+
+/** A canary no conforming record can contain: it only ever travels in the refused body. */
+export function freshCanary(): string {
+  return `openwop-canary-${randomBytes(9).toString('hex')}`;
+}
+
+export interface DeadLetterRead {
+  readonly status: number;
+  readonly json: unknown;
+}
+
+/** GET one page of a subscription's dead letters. Asserts nothing. */
+export async function readDeadLetters(subscriptionId: string, query: { limit?: number; cursor?: string } = {}): Promise<DeadLetterRead> {
+  const qs = new URLSearchParams();
+  if (query.limit !== undefined) qs.set('limit', String(query.limit));
+  if (query.cursor !== undefined) qs.set('cursor', query.cursor);
+  const suffix = qs.toString() === '' ? '' : `?${qs.toString()}`;
+  const res = await driver.get(`/v1/trigger-subscriptions/${encodeURIComponent(subscriptionId)}/dead-letters${suffix}`);
+  return { status: res.status, json: res.json };
+}
+
+let pageValidator: ((v: unknown) => boolean) & { errors?: unknown } | undefined;
+/** Validate a page against `trigger-dead-letter-page.schema.json` (v1), resolving the event payload `$ref`s. */
+export function validatePage(page: unknown): { ok: boolean; errors: string } {
+  if (pageValidator === undefined) {
+    const ajv = addFormats(new Ajv2020({ strict: false }));
+    const load = (n: string): Record<string, unknown> => JSON.parse(readFileSync(join(SCHEMAS_DIR, n), 'utf8')) as Record<string, unknown>;
+    const payloads = load('run-event-payloads.schema.json');
+    // Both carry `https://openwop.dev/spec/v1/…` ids, so the page's relative
+    // `run-event-payloads.schema.json#/$defs/…` refs resolve to this schema.
+    ajv.addSchema(payloads);
+    pageValidator = ajv.compile(load('trigger-dead-letter-page.schema.json'));
+  }
+  const ok = pageValidator(page) === true;
+  return { ok, errors: ok ? '' : JSON.stringify(pageValidator.errors ?? []).slice(0, 400) };
+}
+
+/** What the suite posted, so the judge can look for it in the record. */
+export interface RefusedPost {
+  readonly subscriptionId: string;
+  readonly canary: string;
+  readonly signature: string;
+  readonly signingSecret: string;
+  readonly retentionDays: number;
+}
+
+export type DeadLetterRule = 'page-valid' | 'present' | 'content-free' | 'attempt-shape' | 'no-state-change' | 'retention';
+
+export interface DeadLetterFinding {
+  readonly rule: DeadLetterRule;
+  readonly ok: boolean;
+  readonly message: string;
+}
+
+const DAY_MS = 86_400_000;
+/** One minute of slack either way: hosts round timestamps. */
+const RETENTION_SLACK_MS = 60_000;
+
+/**
+ * Judge one read against the refused post that should have produced a record.
+ * Pure. `validate` defaults to {@link validatePage}; the unit tests pass it in.
+ */
+export function judge(read: DeadLetterRead, post: RefusedPost, validate: (page: unknown) => { ok: boolean; errors: string } = validatePage): DeadLetterFinding[] {
+  const out: DeadLetterFinding[] = [];
+  if (read.status !== 200) {
+    out.push({ rule: 'page-valid', ok: false, message: `a host advertising triggerBridge.deadLetter MUST serve the read (answered ${read.status})` });
+    return out;
+  }
+  const v = validate(read.json);
+  out.push({ rule: 'page-valid', ok: v.ok, message: `the page MUST validate against trigger-dead-letter-page.schema.json${v.ok ? '' : `: ${v.errors}`}` });
+
+  const deliveries = ((read.json as { deliveries?: unknown } | undefined)?.deliveries ?? []) as Array<Record<string, unknown>>;
+  const mine = Array.isArray(deliveries)
+    ? deliveries.filter((r) => r !== null && typeof r === 'object' && r['reason'] === 'verification_failed' && r['subscriptionId'] === post.subscriptionId)
+    : [];
+  out.push({ rule: 'present', ok: mine.length >= 1, message: `the refused delivery MUST appear with reason "verification_failed" (saw ${Array.isArray(deliveries) ? deliveries.length : 0} record(s), ${mine.length} matching)` });
+
+  // Content-free: the canary, the signature and the secret appear nowhere in
+  // ANY record on the page, not just the matched one — a host that leaked them
+  // into a record it mis-labelled is still leaking them.
+  const text = JSON.stringify(read.json ?? null);
+  const leaked = [['the canary from the refused body', post.canary], ['the signature', post.signature], ['the signing secret', post.signingSecret]]
+    .filter(([, needle]) => needle !== '' && text.includes(needle as string)).map(([what]) => what);
+  const secretKey = post.signingSecret.replace(/^whsec_/, '');
+  if (secretKey !== '' && secretKey !== post.signingSecret && text.includes(secretKey)) leaked.push('the signing key');
+  out.push({ rule: 'content-free', ok: leaked.length === 0, message: `a record MUST NOT carry inbound content or credentials (found ${leaked.join(', ') || 'none'})` });
+
+  const rec = mine[0];
+  if (rec !== undefined) {
+    const attempt = rec['attempt'] as Record<string, unknown> | undefined;
+    const attemptOk = attempt !== undefined && attempt !== null && typeof attempt === 'object'
+      && attempt['outcome'] === 'dead-lettered' && attempt['subscriptionId'] === post.subscriptionId;
+    out.push({ rule: 'attempt-shape', ok: attemptOk, message: `attempt MUST be the dead-lettered trigger.delivery.attempted payload for this subscription (got ${JSON.stringify(attempt ?? null).slice(0, 200)})` });
+    out.push({ rule: 'no-state-change', ok: !('stateChange' in rec), message: 'a delivery refused by verification MUST NOT carry a stateChange (a refused event MUST NOT change the subscription\'s state)' });
+    const from = Date.parse(String(rec['deadLetteredAt']));
+    const to = Date.parse(String(rec['expiresAt']));
+    const want = post.retentionDays * DAY_MS;
+    const retentionOk = Number.isFinite(from) && Number.isFinite(to) && Math.abs((to - from) - want) <= RETENTION_SLACK_MS;
+    out.push({ rule: 'retention', ok: retentionOk, message: `expiresAt − deadLetteredAt MUST match retentionDays (${post.retentionDays}); got ${Number.isFinite(to - from) ? `${((to - from) / DAY_MS).toFixed(4)} days` : 'unparseable timestamps'}` });
+  }
+  return out;
+}

package/src/scenarios/trigger-bridge-delivery.test.ts

@@ -6,15 +6,17 @@
  * under `OPENWOP_REQUIRE_BEHAVIOR=true`. The always-on wire-shape coverage lives
  * in `trigger-bridge-shape.test.ts`.
  *
- * Four legs, each its own requirement (RFC 0230 split the one combined `it`):
+ * Five legs, each its own requirement (RFC 0230 split the one combined `it`;
+ * RFC 0232 split the fourth):
  *
  *   1. DEDUP (§C-1) — a repeated delivery is effectively-once.
  *   2. DEAD-LETTER (§C-2 + RFC 0053) — an exhausted/refused delivery starts no run.
  *   3. CAUSATION (§C / RFC 0040) — a delivered run carries the delivery as
  *      `run.started.causationId`.
- *   4. RUN-LESS CONTENT-FREENESS (SR-1) — the run-less `trigger.*` events
- *      (a dead-lettered attempt, `trigger.subscription.state.changed`) carry no
- *      inbound content.
+ *   4a. RUN-LESS ATTEMPT (SR-1) — a dead-lettered `trigger.delivery.attempted`
+ *      carries no inbound content.
+ *   4b. RUN-LESS STATE CHANGE (SR-1) — a `trigger.subscription.state.changed`
+ *      carries no inbound content.
  *
  * TWO WITNESS PATHS, and a host is measured on EVERY path it offers (2.45.8).
  * The SEAM path drives `POST /v1/host/sample/trigger-bridge/deliver` and reads
@@ -31,18 +33,24 @@
  * certify, and an uncertified bundle supplies no acceptance evidence
  * (RFC 0174 §B.1).
  *
- * Leg 4 has no normative-surface path — the run-less events are on no run's
- * log — so it stays seam-witnessed and records seam-absent otherwise; it
- * remains in the floor (the floor never narrows).
+ * The run-less events are on no run's log. Leg 4a's normative-surface path is
+ * RFC 0232's read: on a host advertising `inboundSigning` AND
+ * `triggerBridge.deadLetter`, it posts a canary with a bad signature and reads
+ * the subscription's dead letters (`lib/trigger-dead-letter-witness.ts`).
+ * Leg 4b has no such path: no wire surface causes a subscription state change
+ * (a refused post must not change state; nothing pauses a subscription), so it
+ * is seam-witnessed and, on a host without the seam, records `inapplicable`
+ * (RFC 0232 Unresolved question 1, decided (a)). Both stay in the floor.
  *
  * Spec references:
  *   - spec/v1/trigger-bridge.md (§C, §F.2, §F.6)
- *   - RFCS/0083-durable-trigger-and-channel-bridge-profile.md, RFCS/0230-inbound-webhook-ingest-contract.md
+ *   - RFCS/0083-durable-trigger-and-channel-bridge-profile.md, RFCS/0230-inbound-webhook-ingest-contract.md,
+ *     RFCS/0232-trigger-dead-letter-read.md
  *   - spec/v1/profiles.md (§openwop-trigger-bridge)
  */
 
 import { describe, it, expect } from 'vitest';
-import { seamAbsent } from '../lib/soft-skip.js';
+import { seamAbsent, softSkip } from '../lib/soft-skip.js';
 import { behaviorGate } from '../lib/behavior-gate.js';
 import {
   isTriggerBridgeProfileAdvertised,
@@ -59,11 +67,16 @@ import { queryTestEvents, requireEvents, isEventLogSeamAvailable, resetTestSeam
 import { req } from '../lib/requirement-ids.js';
 import { noteObservation } from '../lib/row-observation.js';
 import { driver } from '../lib/driver.js';
+import { deadLetterFacet, freshCanary, judge as judgeDeadLetters, readDeadLetters } from '../lib/trigger-dead-letter-witness.js';
 
 const R_DEDUP = 'openwop.requirement.0083.trigger-delivery.dedup';
 const R_DEAD_LETTER = 'openwop.requirement.0083.trigger-delivery.dead-letter';
 const R_CAUSATION = 'openwop.requirement.0083.trigger-delivery.causation';
-const R_RUNLESS = 'openwop.requirement.0083.trigger-delivery.runless-content-free';
+const R_RUNLESS_ATTEMPT = 'openwop.requirement.0083.trigger-delivery.runless-attempt-content-free';
+const R_RUNLESS_STATE = 'openwop.requirement.0083.trigger-delivery.runless-state-change-content-free';
+
+/** The bad signature every refused-post probe sends. */
+const BAD_SIGNATURE = 'v1,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';
 
 const CONTENT_FREE_FORBIDDEN = ['body', 'headers', 'payload', 'secret', 'credentials', 'token', 'apiKey'];
 
@@ -191,7 +204,7 @@ describe('trigger-bridge-delivery (RFC 0083 §C)', () => {
     const sub = await registerSignedWebhook('required');
     if ('reason' in sub) throw new Error(req(R_DEAD_LETTER, 'trigger-bridge.md §F.6', `an inboundSigning host MUST return the §B binding on webhook registration: ${sub.reason}`));
     const body = JSON.stringify({ conformance: 'dead-letter' });
-    const bad = await signedIngest(sub, body, { signature: 'v1,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=' });
+    const bad = await signedIngest(sub, body, { signature: BAD_SIGNATURE });
     expect(bad.status, req(R_DEAD_LETTER, 'trigger-bridge.md §F.6', `a bad signature under required verification MUST answer 401 (got ${bad.status})`)).toBe(401);
     expect(bad.json?.runId, req(R_DEAD_LETTER, 'trigger-bridge.md §F.2', 'a required-verification failure MUST NOT start a run')).toBeUndefined();
     const read = await driver.get(`/v1/trigger-subscriptions/${encodeURIComponent(sub.subscriptionId)}`);
@@ -231,17 +244,53 @@ describe('trigger-bridge-delivery (RFC 0083 §C)', () => {
     notePaths(paths.seam, true, deliveredEvent === undefined ? '; on the normative-surface path the delivered attempt event is not on the run log, so equality was not checked there' : '');
   });
 
-  it('keeps the run-less trigger events content-free', async () => {
+  it('keeps a dead-lettered run-less attempt content-free', async () => {
     if (!behaviorGate('openwop-trigger-bridge', await isTriggerBridgeProfileAdvertised())) return;
-    // No normative-surface path: a dead-lettered attempt and a state change are
-    // on no run's log, so only the seam can read them (RFC 0230 §Conformance).
-    if (!(await isEventLogSeamAvailable())) return seamAbsent('the run-less trigger events are readable only through the event-log seam, which is absent');
+    const seam = await isEventLogSeamAvailable();
+    const disco = await driver.get('/.well-known/openwop');
+    const facet = disco.status === 200 ? deadLetterFacet(disco.json) : null;
+    const normative = facet !== null && (await inboundSigningAdvertised());
+    if (!seam && !normative) return seamAbsent('a dead-lettered attempt is on no run\'s log; it is readable through the event-log seam or the RFC 0232 read (triggerBridge.deadLetter with inboundSigning), and the host offers neither');
+
+    if (seam) {
+      const exhaust = await driveDelivery({ scenario: 'exhaust', source: 'webhook' });
+      if (exhaust === null) return seamAbsent(SEAM_UNWIRED);
+      const exKey = exhaust.runId ?? '__exhaust__';
+      const attempts = requireEvents(await queryTestEvents(exKey, { type: 'trigger.delivery.attempted' }), 'trigger.delivery.attempted (exhaust)');
+      for (const e of attempts) expectContentFree(R_RUNLESS_ATTEMPT, e.payload, 'trigger.delivery.attempted');
+      await resetTestSeam();
+    }
+    if (!normative) return notePaths(true, false);
+
+    // Normative-surface path (RFC 0232 §E): cause a dead letter unaided, then read it.
+    const sub = await registerSignedWebhook('required');
+    if ('reason' in sub) throw new Error(req(R_RUNLESS_ATTEMPT, 'trigger-bridge.md §F.6', `an inboundSigning host MUST return the §B binding on webhook registration: ${sub.reason}`));
+    const canary = freshCanary();
+    const bad = await signedIngest(sub, JSON.stringify({ conformance: 'runless-attempt', canary }), { signature: BAD_SIGNATURE });
+    expect(bad.status, req(R_RUNLESS_ATTEMPT, 'trigger-bridge.md §F.6', `a bad signature under required verification MUST answer 401 (got ${bad.status})`)).toBe(401);
+    const read = await readDeadLetters(sub.subscriptionId);
+    for (const f of judgeDeadLetters(read, { subscriptionId: sub.subscriptionId, canary, signature: BAD_SIGNATURE, signingSecret: sub.signingSecret, retentionDays: facet!.retentionDays })) {
+      expect(f.ok, req(R_RUNLESS_ATTEMPT, 'trigger-bridge.md §C (RFC 0232 §B–§C)', f.message)).toBe(true);
+    }
+    notePaths(seam, true, ' (RFC 0232 dead-letter read)');
+  });
+
+  it('keeps a run-less subscription state change content-free', async () => {
+    if (!behaviorGate('openwop-trigger-bridge', await isTriggerBridgeProfileAdvertised())) return;
+    // Seam-only. No wire surface causes a subscription state change: a refused
+    // post MUST NOT change state, retry exhaustion needs a delivery the host
+    // fails repeatedly, and nothing pauses a subscription (RFC 0232 G2). On a
+    // host without the seam no party can cause the condition, so the row is
+    // `inapplicable`, not a defect (RFC 0232 Unresolved question 1, decided (a)).
+    if (!(await isEventLogSeamAvailable())) {
+      return softSkip('inapplicable', 'no wire surface causes a trigger subscription state change on a host without the event-log seam (RFC 0232 §E, gap G2)');
+    }
     const exhaust = await driveDelivery({ scenario: 'exhaust', source: 'webhook' });
-    if (exhaust === null) return seamAbsent('host advertises openwop-trigger-bridge but the delivery seam is unwired');
+    if (exhaust === null) return seamAbsent(SEAM_UNWIRED);
     const exKey = exhaust.runId ?? '__exhaust__';
-    for (const type of ['trigger.delivery.attempted', 'trigger.subscription.state.changed'] as const) {
-      for (const e of requireEvents(await queryTestEvents(exKey, { type }), `${type} (exhaust)`)) expectContentFree(R_RUNLESS, e.payload, type);
-    }
+    const changes = requireEvents(await queryTestEvents(exKey, { type: 'trigger.subscription.state.changed' }), 'trigger.subscription.state.changed (exhaust)');
+    expect(changes.length >= 1, req(R_RUNLESS_STATE, 'trigger-bridge.md §B', 'exhaustion MUST record ≥1 trigger.subscription.state.changed')).toBe(true);
+    for (const e of changes) expectContentFree(R_RUNLESS_STATE, e.payload, 'trigger.subscription.state.changed');
     await resetTestSeam();
   });
 });

package/src/scenarios/trigger-dead-letter-read.test.ts

@@ -0,0 +1,112 @@
+/**
+ * Trigger dead-letter read — the §B rules (RFC 0232) — behavioral.
+ *
+ * Gated on `triggerBridge.deadLetter` together with
+ * `triggerBridge.ingestion.inboundSigning` (the suite causes a dead letter
+ * unaided by posting a bad signature to a `required` subscription). A host that
+ * advertises neither records `inapplicable`.
+ *
+ * The record's content rules (§C) are leg 4a of `trigger-bridge-delivery`,
+ * which is in the `openwop-trigger-bridge` floor. These are the read's own
+ * rules, each its own requirement:
+ *
+ *   1. PAGING — `limit` is clamped, and a page that stops short carries
+ *      `nextCursor`.
+ *   2. CURSOR — a cursor minted for one subscription is refused on another,
+ *      `400 validation_error`.
+ *   3. TENANT — another tenant's credential reading this subscription's id gets
+ *      `404 not_found`, exactly as for an id the host never minted. Needs
+ *      `OPENWOP_TEST_TENANT_B_API_KEY`; without it the row is `blocked`.
+ *
+ * Spec references:
+ *   - spec/v1/trigger-bridge.md §C (Run-less transitions are recorded)
+ *   - spec/v2/core/webhooks.md §Inbound triggers
+ *   - RFCS/0232-trigger-dead-letter-read.md §B
+ */
+
+import { describe, it, expect } from 'vitest';
+import { softSkip } from '../lib/soft-skip.js';
+import { driver } from '../lib/driver.js';
+import { loadEnv } from '../lib/env.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { req } from '../lib/requirement-ids.js';
+import { inboundSigningAdvertised, registerSignedWebhook, signedIngest, type SignedWebhookSubscription } from '../lib/triggerBridge.js';
+import { deadLetterFacet, readDeadLetters, type DeadLetterFacet } from '../lib/trigger-dead-letter-witness.js';
+
+const R_PAGING = 'openwop.requirement.0232.trigger-dead-letters.paging';
+const R_CURSOR = 'openwop.requirement.0232.trigger-dead-letters.cursor-bound';
+const R_TENANT = 'openwop.requirement.0232.trigger-dead-letters.tenant-bound';
+
+const BAD_SIGNATURE = 'v1,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';
+
+/** The facet, or null with the reason the row is `inapplicable`. */
+async function gate(): Promise<{ facet: DeadLetterFacet } | { reason: string }> {
+  const disco = await driver.get('/.well-known/openwop');
+  const facet = disco.status === 200 ? deadLetterFacet(disco.json) : null;
+  if (facet === null) return { reason: 'the host does not advertise triggerBridge.deadLetter' };
+  if (!(await inboundSigningAdvertised())) return { reason: 'triggerBridge.deadLetter is advertised without inboundSigning, so the suite cannot cause a dead letter unaided' };
+  return { facet };
+}
+
+/** A `required` subscription with `n` refused posts dead-lettered on it. */
+async function withRefused(id: string, n: number): Promise<SignedWebhookSubscription> {
+  const sub = await registerSignedWebhook('required');
+  if ('reason' in sub) throw new Error(req(id, 'trigger-bridge.md §F.6', `an inboundSigning host MUST return the §B binding on webhook registration: ${sub.reason}`));
+  for (let i = 0; i < n; i++) {
+    const bad = await signedIngest(sub, JSON.stringify({ conformance: 'dead-letter-read', i }), { signature: BAD_SIGNATURE });
+    expect(bad.status, req(id, 'trigger-bridge.md §F.6', `a bad signature under required verification MUST answer 401 (got ${bad.status})`)).toBe(401);
+  }
+  return sub;
+}
+
+function deliveriesOf(json: unknown): unknown[] {
+  const d = (json as { deliveries?: unknown } | undefined)?.deliveries;
+  return Array.isArray(d) ? d : [];
+}
+
+describe('trigger-dead-letter-read (RFC 0232 §B)', () => {
+  it('clamps limit and continues a short page with nextCursor', async () => {
+    const g = await gate();
+    if ('reason' in g) return softSkip('inapplicable', g.reason);
+    const sub = await withRefused(R_PAGING, 2);
+    const first = await readDeadLetters(sub.subscriptionId, { limit: 1 });
+    expect(first.status, req(R_PAGING, 'trigger-bridge.md §C', `a host advertising triggerBridge.deadLetter MUST serve the read (got ${first.status})`)).toBe(200);
+    expect(deliveriesOf(first.json).length, req(R_PAGING, 'trigger-bridge.md §C', 'a page MUST NOT exceed limit')).toBe(1);
+    const cursor = (first.json as { nextCursor?: unknown } | undefined)?.nextCursor;
+    expect(typeof cursor === 'string' && cursor.length > 0, req(R_PAGING, 'trigger-bridge.md §C', 'with two dead letters and limit 1, the page MUST carry nextCursor')).toBe(true);
+    const second = await readDeadLetters(sub.subscriptionId, { limit: 1, cursor: cursor as string });
+    expect(second.status, req(R_PAGING, 'trigger-bridge.md §C', `the page's own cursor MUST be accepted (got ${second.status})`)).toBe(200);
+    expect(deliveriesOf(second.json).length, req(R_PAGING, 'trigger-bridge.md §C', 'the next page MUST carry the second dead letter')).toBe(1);
+    const big = await readDeadLetters(sub.subscriptionId, { limit: g.facet.maxPageSize + 1 });
+    expect(big.status, req(R_PAGING, 'trigger-bridge.md §C', `a limit above maxPageSize MUST be clamped, not refused (got ${big.status})`)).toBe(200);
+  });
+
+  it('refuses a cursor minted for another subscription', async () => {
+    const g = await gate();
+    if ('reason' in g) return softSkip('inapplicable', g.reason);
+    const a = await withRefused(R_CURSOR, 2);
+    const page = await readDeadLetters(a.subscriptionId, { limit: 1 });
+    const cursor = (page.json as { nextCursor?: unknown } | undefined)?.nextCursor;
+    expect(typeof cursor === 'string' && cursor.length > 0, req(R_CURSOR, 'trigger-bridge.md §C', `with two dead letters and limit 1, the page MUST carry nextCursor (read answered ${page.status})`)).toBe(true);
+    const b = await withRefused(R_CURSOR, 1);
+    const cross = await readDeadLetters(b.subscriptionId, { cursor: cursor as string });
+    expect(cross.status, req(R_CURSOR, 'trigger-bridge.md §C', `a cursor minted for another subscription MUST be refused 400 (got ${cross.status})`)).toBe(400);
+    expect(readErrorCode(cross.json), req(R_CURSOR, 'trigger-bridge.md §C', 'the refusal MUST carry validation_error')).toBe('validation_error');
+  });
+
+  it("answers another tenant's read of a subscription 404, as for an id never minted", async () => {
+    const g = await gate();
+    if ('reason' in g) return softSkip('inapplicable', g.reason);
+    const other = process.env['OPENWOP_TEST_TENANT_B_API_KEY'];
+    if (!other) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY (a credential bound to a second tenant) is not set — the cross-tenant read cannot run');
+    if (other.trim() === loadEnv().apiKey) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY equals OPENWOP_API_KEY — the second credential must resolve to a DIFFERENT tenant, or the leg measures nothing');
+    const sub = await withRefused(R_TENANT, 1);
+    const path = (id: string): string => `/v1/trigger-subscriptions/${encodeURIComponent(id)}/dead-letters`;
+    const foreign = await driver.get(path(sub.subscriptionId), { headers: { Authorization: `Bearer ${other}` } });
+    expect(foreign.status, req(R_TENANT, 'trigger-bridge.md §C', `another tenant's read MUST answer 404 (got ${foreign.status})`)).toBe(404);
+    expect(JSON.stringify(foreign.json ?? null).includes('verification_failed'), req(R_TENANT, 'trigger-bridge.md §C', 'a foreign read MUST NOT disclose a record')).toBe(false);
+    const unknown = await driver.get(path(`${sub.subscriptionId}-never-minted`));
+    expect(unknown.status, req(R_TENANT, 'trigger-bridge.md §C', `an id the host never minted MUST answer 404 (got ${unknown.status})`)).toBe(404);
+    expect(readErrorCode(foreign.json), req(R_TENANT, 'trigger-bridge.md §C', 'a foreign id MUST be answered exactly as an unknown one')).toBe(readErrorCode(unknown.json));
+  });
+});

package/src/scenarios/trigger-stream-cdc-sources.test.ts

@@ -166,9 +166,18 @@ describe.skipIf(HTTP_SKIP)('trigger-stream-cdc: behavioral ingestion + dedup (ca
       },
     ];
 
+    // Post every source first, so a host that serves neither is recorded before any assertion.
+    const served: { body: Record<string, unknown>; res: Awaited<ReturnType<typeof driver.post>> }[] = [];
     for (const body of bodies) {
       const res = await driver.post('/v1/host/sample/trigger-bridge/ingest', body);
-      if ((res.status === 404 || res.status === 405 || res.status === 400 || res.status === 422) && !advertisesNew) continue; // pre-0127 host — soft-skip this source
+      if ((res.status === 404 || res.status === 405 || res.status === 400 || res.status === 422) && !advertisesNew) continue; // pre-0127 host: this source is not served
+      served.push({ body, res });
+    }
+    // Until 2.45.9 a host that advertises neither source and refuses both passed this leg with zero
+    // assertions and no reason, which RFC 0148 §A records as `blocked` and which denies a major-1 bundle.
+    if (served.length === 0) return softSkip('inapplicable', 'triggerBridge.ingestion.externalSources lists neither stream nor change, and the host refused both (a pre-RFC 0127 host)');
+
+    for (const { body, res } of served) {
       expect(
         res.status < 400,
         req('openwop.it.trigger-stream-cdc-sources.a-stream-and-a-change-event-each-ingest-to-a-run-with-a-schema-valid-envelope-an', 
@@ -220,7 +229,7 @@ describe.skipIf(HTTP_SKIP)('trigger-stream-cdc: behavioral ingestion + dedup (ca
     const dedupKey = freshStreamDedupKey();
     const first = await driveDelivery({ scenario: 'dedup', dedupKey, source: 'stream' });
     if (first === null) return softSkip('blocked', 'precondition not met — `first === null` returned early (delivery seam unwired — soft-skip) (seam, prior step, or fixture unavailable)'); // delivery seam unwired — soft-skip
-    if (first.outcome === undefined && !external.includes('stream')) return softSkip('blocked', 'precondition not met — `first.outcome === undefined && !external.includes(\'stream\')` returned early (pre-0127 host — soft-skip) (seam, prior step, or fixture unavailable)'); // pre-0127 host — soft-skip
+    if (first.outcome === undefined && !external.includes('stream')) return softSkip('inapplicable', 'triggerBridge.ingestion.externalSources does not list stream, and the delivery seam reported no outcome for a stream source (a pre-RFC 0127 host)');
     expect(
       first.deliveredCount === 1 || first.outcome === 'delivered',
       req('openwop.it.trigger-stream-cdc-sources.stream-dedup-the-same-broker-coordinates-delivered-twice-are-effectively-once-c',