@openwop/openwop-conformance 2.46.22 → 2.46.24

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## [2.46.24] — 2026-10-25 — RFC 0250 Accepted
+
+- **No assertion changes.** RFC 0250's G6 closes on openwop-app's certified cut `f94471e98` (all six `0250.*` legs `executed-pass`), so the packed `spec/v1/gaps.json` changes.
+
+## [2.46.23] — 2026-10-24 — RFC 0250 Active: opt-in host-event replay
+
+- **New scenario `v2-host-event-strict-replay`.** The legs are `0250.shape` (server-free), `resume-backlog`, `ephemeral-not-replayed`, `cursor-refused`, `refusal-uniform` and `legacy-unchanged`. The suite emits durable D1, D2, ephemeral E and durable D3 through the RFC 0241 trigger, then reconnects with `replay=required` from D1 and emits D4 live. Judges are in `lib/host-event-replay-witness.ts`; their self-tests fail each wrong host answer, including a foreign cursor answered differently (an oracle).
+- **Gating.** The legs need `hostEvents.replay` and both `host-test.*` types listed. The uniform leg also needs `OPENWOP_TEST_TENANT_B_API_KEY`; if it is unset, the leg records `blocked`.
+- **Host impact:** none today. No host advertises `hostEvents.replay`.
+
 ## [2.46.22] — 2026-10-24 — RFCs 0249 and 0096 Accepted
 
 - **No assertion changes.** RFC 0249's G1 closes on openwop-app's certified cut `34bfefddc` (all nine `0249.*` legs `executed-pass`), so the packed `spec/v1/gaps.json` changes.

package/README.md

@@ -137,7 +137,7 @@ Each scenario file records its disposition and assertion count in `<report-dir>/
 
 ## What's Covered
 
-The current suite has 660 scenario files under `src/scenarios/`. By target major ([`scenario-majors.json`](./scenario-majors.json)): 220 files run against a v2 host and 455 against a v1 host; 15 of them run at both.
+The current suite has 661 scenario files under `src/scenarios/`. By target major ([`scenario-majors.json`](./scenario-majors.json)): 221 files run against a v2 host and 455 against a v1 host; 15 of them run at both.
 
 The v2 scenarios (`src/scenarios/v2-*.test.ts`) cover, by area:
 
@@ -166,7 +166,7 @@ Three kinds of scenario share the tree:
 - **Host** checks drive a live host over HTTP.
 - **Gated** checks run only when the host advertises the family, profile or fixture they need, and otherwise record `inapplicable` or `blocked` with a reason. `--require-behavior` turns an advertised-but-unwitnessable behaviour into a failure.
 
-Current source tree: 660 scenario files. [`coverage.md`](./coverage.md) maps each spec document and every OpenAPI operation to its scenarios. [`CHANGELOG.md`](./CHANGELOG.md) records when each scenario landed.
+Current source tree: 661 scenario files. [`coverage.md`](./coverage.md) maps each spec document and every OpenAPI operation to its scenarios. [`CHANGELOG.md`](./CHANGELOG.md) records when each scenario landed.
 
 ## How the 2.x suite is built
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.46.22",
-  "stampSha256": "11e059e1a1c48160deaba56d5bf202e58a424b6c37b29ab787b2c3df02e14912"
+  "version": "2.46.24",
+  "stampSha256": "780a696bf1b4d4b304151fb6e6ca825ae849c004429bc85d7f80228a616ea797"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.46.22",
+  "version": "2.46.24",
   "description": "Black-box conformance suite for OpenWOP hosts (v2 current; v1 scenarios retained for the frozen v1 tree).",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.46.22"
+    "@openwop/spec-artifacts": "2.46.24"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 748,
-    "tests": 2834,
-    "withStableId": 2834,
+    "files": 749,
+    "tests": 2840,
+    "withStableId": 2840,
     "interpolatedTitles": 0,
-    "explicitIds": 2707
+    "explicitIds": 2713
   },
   "records": [
     {
@@ -31928,6 +31928,71 @@
       "explicitId": "openwop.requirement.0236.host-event.tenant-isolation",
       "citations": []
     },
+    {
+      "id": "openwop.it.v2-host-event-strict-replay.the-replay-facet-member-validates-and-its-negatives-are-refused",
+      "file": "v2-host-event-strict-replay.test.ts",
+      "line": 127,
+      "title": "the replay facet member validates, and its negatives are refused",
+      "explicitId": "openwop.requirement.0250.shape",
+      "citations": [
+        {
+          "section": "hostEvents.schema.json §replay (RFC 0250)",
+          "requirement": "a positive retention MUST validate"
+        },
+        {
+          "section": "hostEvents.schema.json §replay (RFC 0250)",
+          "requirement": "a zero retention MUST be refused"
+        },
+        {
+          "section": "hostEvents.schema.json §replay (RFC 0250)",
+          "requirement": "minRetentionSeconds is required"
+        },
+        {
+          "section": "hostEvents.schema.json §replay (RFC 0250)",
+          "requirement": "the member is closed (the Draft mode const was dropped)"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-host-event-strict-replay.a-resumed-stream-delivers-the-backlog-after-the-cursor-then-live-in-order",
+      "file": "v2-host-event-strict-replay.test.ts",
+      "line": 138,
+      "title": "a resumed stream delivers the backlog after the cursor, then live, in order",
+      "explicitId": "openwop.requirement.0250.resume-backlog",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-host-event-strict-replay.an-ephemeral-event-is-not-replayed",
+      "file": "v2-host-event-strict-replay.test.ts",
+      "line": 146,
+      "title": "an ephemeral event is not replayed",
+      "explicitId": "openwop.requirement.0250.ephemeral-not-replayed",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-host-event-strict-replay.an-unknown-cursor-is-refused-409-host-event-resync-required-before-any-sse-byte",
+      "file": "v2-host-event-strict-replay.test.ts",
+      "line": 154,
+      "title": "an unknown cursor is refused 409 host_event_resync_required before any SSE byte",
+      "explicitId": "openwop.requirement.0250.cursor-refused",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-host-event-strict-replay.a-foreign-or-ephemeral-cursor-is-refused-byte-identically-to-an-unknown-one",
+      "file": "v2-host-event-strict-replay.test.ts",
+      "line": 160,
+      "title": "a foreign or ephemeral cursor is refused byte-identically to an unknown one",
+      "explicitId": "openwop.requirement.0250.refusal-uniform",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-host-event-strict-replay.without-replay-required-an-unknown-cursor-keeps-its-existing-answer",
+      "file": "v2-host-event-strict-replay.test.ts",
+      "line": 180,
+      "title": "without replay=required an unknown cursor keeps its existing answer",
+      "explicitId": "openwop.requirement.0250.legacy-unchanged",
+      "citations": []
+    },
     {
       "id": "openwop.it.v2-i18n-negotiation.the-advertised-i18n-record-is-well-formed-and-lists-its-default-locale",
       "file": "v2-i18n-negotiation.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 660,
+    "files": 661,
     "v1": 455,
-    "v2": 220
+    "v2": 221
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1509,6 +1509,9 @@
     "v2-host-event-delivery.test.ts": [
       2
     ],
+    "v2-host-event-strict-replay.test.ts": [
+      2
+    ],
     "v2-i18n-negotiation.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.46.22",
-  "corpusTag": "v2.46.22",
+  "version": "2.46.24",
+  "corpusTag": "v2.46.24",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "e509737646754f61866e3eb5646ad293fda2110e71d3b2542dafed901d1d97eb",
-    "api/v2/asyncapi.yaml": "665cb9540a8b8765a8cdd6bbcc1421b1c51b52e0eff5106e63ff99bbaa15a99b",
-    "api/v2/openapi.yaml": "88e204c54cba6b11d44eff7a3c18528e218ffde01b1167702691522fef017fa7",
+    "api/seams-v2.yaml": "320f8d121cb19c16fe19dbe3ee0783c64951a117af461b6e371c74f1e1607dfa",
+    "api/v2/asyncapi.yaml": "51c944d2fb8fcf4169b5cda25bd83378f281e26a8ddda8942eccc6926c55c8a9",
+    "api/v2/openapi.yaml": "723c3df7a711a282a1b827fe024cadc365862f49da1f2800e358dac6584360c5",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "276fc1d51eb08e14e9127b9fd27761d7046ee33c12000f3a64a801322db8bf58",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -117,7 +117,7 @@
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
     "schemas/v2/budget-policy.schema.json": "1de68095db0beb5c7a4be629de26e79f62ebbe748a88d46f36e768edfd1f0d68",
-    "schemas/v2/capabilities.schema.json": "9d5b222dcd2003141b7f09e9b836744a1b63defc01bffea5d10c1da7747bc2d8",
+    "schemas/v2/capabilities.schema.json": "6ca940cc38ec7f4b582def52c18337fd1e9ea03d627a5446766230a19af1a8ab",
     "schemas/v2/certification-bundle.schema.json": "5cfa7fb5247160333e33a58b60d42bcd4e5269d8391d6a112d301e14828892ed",
     "schemas/v2/channel-presence-payload.schema.json": "fc03df0c20cc12a25f7ee6a47503a4c5931d79fe3d5ff24815e8fd7c1bcb9a87",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
@@ -144,7 +144,7 @@
     "schemas/v2/envelopes/schema.request.schema.json": "be2c5f7aa881cdd252ccff47ac02193659e1393633a1541f4297383205d384a2",
     "schemas/v2/envelopes/schema.response.schema.json": "d049a081267c06c28879c331b147f3ed821b14ccfd93005c67aff64db0a8c68e",
     "schemas/v2/envelopes/ui.a2ui-surface.schema.json": "e92a2548ba65454c9e0a34f72ea6768d18f59e61fa5da7668d0b2d5baddaddc8",
-    "schemas/v2/error-envelope.schema.json": "0b15d6a3a2baad6bf314a66a4a8da4756460574887b929b3b06cb23a6c02f0bd",
+    "schemas/v2/error-envelope.schema.json": "f8eff3b5affa29513935632d99ad2d717e76791dc853152d03afa9d907cd5338",
     "schemas/v2/eval-summary.schema.json": "d07f4d116c5410997a81d0bc5387545fb61933a6333c360a26ab8a71c749336b",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
     "schemas/v2/form-content-pack-manifest.schema.json": "a1942a124e250a6e9fbdb6b811c5a125e78fbcbcaa46dfc71d0636f24710a339",
@@ -212,14 +212,14 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "22444c22bb88c568339ef512553f9fc38146e22b566d11ab8608f655d688d19c",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "b2ce72fe0aa6de2c3c2de0ae613cfde7154528d9445699548d89b5546c2cecc7",
+    "spec/v1/core-standard-manifest.json": "c2bf78d9853dd41eefebc4e6408feb7abbec4bc52b8e675570512fd5056f20a3",
     "spec/v1/deprecations.json": "e723bc11d7272c71789ad1303bb7f21809a8a024abf57594f9d5c35dc199ece9",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "563f4f0d436770e6994c039d4181a8eb48394a213bbab9e71197863a1e8546b7",
+    "spec/v1/gaps.json": "21d53eee36f47b3cd44ba54802acc5cdc810d242d1fd929b1e76167da8566957",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -231,8 +231,8 @@
     "spec/v2/core/conformance.md": "3ca291e63bc70a6ef829ae8759ad0ded3741ea7aa507bbbdffc57de443ab2ae2",
     "spec/v2/core/connection-packs.md": "c80f95bd6a03698f35c72cdb2b46bd973f49203bbd786c26760e35fa86e6f23d",
     "spec/v2/core/conversation.md": "8d6abedf6af408a74577753bfca24719d318e2632e10b45ff5d63bdcf31a8aaa",
-    "spec/v2/core/errors.md": "e932dd663ec7434480038ca9cdbe8fe37f6e422350ce95574522af4006b8a356",
-    "spec/v2/core/events.md": "c3dcece6f1b1aa43e1e01c5ece23b2df075a505d5f6c2f37de0801aeaa486b62",
+    "spec/v2/core/errors.md": "39845bf7a65f9accaae63f84091eee5978b61bbe35d753e35138a9bbc0a2ad98",
+    "spec/v2/core/events.md": "fd1d95f77565b0b0a747544f4f2126bd02ae4f7cf837ead1da4d89e580b7f694",
     "spec/v2/core/execution.md": "4218dbb397534940f83ca5d46561f02bf8f3fdf68d2ae7fefe7f2eb2ed771103",
     "spec/v2/core/form-content-packs.md": "02931227899676fd4581a27017be2a6c4953904717be9b81c29d12f87ab3917d",
     "spec/v2/core/headers.md": "dae37c2b3980099272e5b9581107c0410d6b23aac95ea6c5a0890c34f0e51c8f",
@@ -258,10 +258,10 @@
     "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
     "spec/v2/corrections.json": "3a8d93e33865b692d26a3b6bfd3819766e206b2e0c2a69669baa4bf833d05a49",
     "spec/v2/corrections.schema.json": "46bbffb954d13bd9995aebc912ceeb2544f7064331abf25fd6ab85c81a5cec94",
-    "spec/v2/declaration.json": "5ccdcf9865ca02022c01a551583e1f343a4b7c73fd228049f1be620858a60ad5",
+    "spec/v2/declaration.json": "c914e17b8be18ffd186dbd63556c5a06816562b949029413ba46f556e1cd0d54",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
     "spec/v2/eos-override.json": "4c72d2f6a658943b01c1de1643cf294642091933af7832f38ee5495df684cb2d",
-    "spec/v2/errors.json": "33f9b4e450c51dfb1046bb00b327ee88163fb53360b0b43bcd204061ec966a13",
+    "spec/v2/errors.json": "6ae05aec11be85711f207122d2b978a27f1b06cb3ba5a31b6b9b0fc5af4776e5",
     "spec/v2/errors.schema.json": "47404ad53e6147cf9017b813483712466573e419fb33e6c4b6c12d3e7deba1bc",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
     "spec/v2/event-codemap.schema.json": "b173f2a9bcc0bf9b62a474ce3b91e1431d597e64fd1560fc58662cd8606eaf9c",
@@ -292,7 +292,7 @@
     "spec/v2/facets/connections.schema.json": "f998bb206a5814183bb4720cc34fa43b7ab64d61e39a79437b009c589ce8b78e",
     "spec/v2/facets/envelopeStrictness.schema.json": "28be0a27f880bd45ec1222a16155f5e9167bbca57bf0322970fe1eb2654562aa",
     "spec/v2/facets/heartbeat.schema.json": "81d7fa1895a8b0241bd07cf00a7e7905bef0fd14eb3427325261c62eee5746a6",
-    "spec/v2/facets/hostEvents.schema.json": "973ff452cb91356b4c625d0b06c8d2ef335e18183de09e1afde8acead22290b3",
+    "spec/v2/facets/hostEvents.schema.json": "8834c2fde7bc2ba9eb433f22c9d6ec3f9739f44049eecdbf0a05baf2bfa0bb7d",
     "spec/v2/facets/interrupt.schema.json": "2110ef32c3f880bf706475ef4cf8ddf97ff06871b8e6003a5edbcf4439f1fb70",
     "spec/v2/facets/limits.schema.json": "218fcbd34dd2cdf7548c29c8c76e1a6aea2b7d7df1ba32fbe201bd40917bc66f",
     "spec/v2/facets/mcp.schema.json": "7060657dfcff170f079beed160e3db7c1d3cc4410cd3cf64863baf6459f781cd",
@@ -307,7 +307,7 @@
     "spec/v2/facets/uiPlugins.schema.json": "1fd3f8440cfb6e4422553a7c4b5f091eb3e10a40da0d43e8b977a18929116758",
     "spec/v2/facets/webhooks.schema.json": "54b576f1d150e28e1642693d846ce471c118e9c521bdf3924185305fbd1d0de4",
     "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
-    "spec/v2/generated/error-codes.md": "e8441e944d2a8856a9112c1de8175e5bfae8bb36b8f389dce9dfa838702c21b6",
+    "spec/v2/generated/error-codes.md": "c024fb18264724cd0d88f33d9b3d509b8fc8c3f16a18f120f2fea069dc04a43d",
     "spec/v2/harness-trust-anchors.json": "6007b92eae16a070fbc3777424efb0abfe865fda89d096963109b96282b91205",
     "spec/v2/harness-trust-anchors.schema.json": "372b5d92337c893d3449eff3f6bfd009ac09fdac285296d8bdbe0a08fff9e34c",
     "spec/v2/id-field-bindings.json": "97e96b6c35c405d0408b5a877c5859714dbbf4507853de9aab381163371ac098",
@@ -318,9 +318,9 @@
     "spec/v2/path-manifest.json": "20f598f56df460ad3ed50aba3d6bc2933ea16a3c96ce125da1c5dd6989d4155c",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "b382b261c7844798575f7c1b37c934f0da19846016a2337d883d4f5ef6e05479",
-    "spec/v2/release.json": "322b7088bd2832238392a88f4201c4841c42a928971941a9e11958bac3ddfb2e",
+    "spec/v2/release.json": "c7708b05e5fdced4ffab715f549f3dc5c9f8947739907eb93f1a2fba401ce0d2",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "570b381e6199689e5c9f9daca49d8d056e45d7d55d64f3bac3808ed2605492d6"
+    "spec/v2/surface-baseline.json": "e8fa9e1445ee9f65a4448a6daf31386a63a2ed1393ac7cc8aadb874bd8bb7646"
   },
-  "corpusCommit": "297d53ea4225c9675007b5561add94e692b20e6f"
+  "corpusCommit": "cff9ff17f18b589a3cea7fe96b0d00d751d82c2a"
 }

package/src/lib/host-event-replay-witness.ts

@@ -0,0 +1,86 @@
+/**
+ * RFC 0250 — pure judges for `v2-host-event-strict-replay.test.ts`. The
+ * scenario emits durable and ephemeral host events through the RFC 0241
+ * trigger, reconnects with `replay=required`, and records what came back;
+ * these functions decide each leg, so the self-tests can fail every wrong
+ * host answer without a host.
+ *
+ * The rules are the `hostEvents.replay` description in
+ * `spec/v2/facets/hostEvents.schema.json` (normative text of the `hostEvents`
+ * family) and `events.md` §Host events.
+ *
+ * @see RFCS/0250-opt-in-host-event-replay-and-resync.md
+ */
+
+import { readErrorCode } from './error-envelope.js';
+
+export interface ReplayFinding { readonly ok: boolean; readonly message: string }
+
+/** One SSE frame as the stream delivered it. */
+export interface ReplayFrame { readonly id: string | null; readonly event: string; readonly data: string }
+
+/** One HTTP answer to a `replay=required` request. `null`: no answer arrived (a stream that opened and never ended). */
+export type RefusalAnswer = { readonly status: number; readonly contentType: string | null; readonly text: string; readonly json: unknown } | null;
+
+const f = (ok: boolean, message: string): ReplayFinding => ({ ok, message });
+export const RESYNC = 'host_event_resync_required';
+
+/**
+ * Resume: after cursor `d1`, exactly `after` (in emit order) arrives, never `d1` itself.
+ * Frames the suite did not cause (heartbeats, other tests' events) are ignored; only the
+ * ids the scenario knows are judged.
+ */
+export function judgeResume(frames: readonly ReplayFrame[], d1: string, after: readonly string[], ephemeral: string): ReplayFinding[] {
+  const known = new Set([d1, ephemeral, ...after]);
+  const seen = frames.map((x) => x.id).filter((id): id is string => id !== null && known.has(id));
+  const durable = seen.filter((id) => id !== ephemeral && id !== d1);
+  return [
+    f(!seen.includes(d1), `the cursor event MUST NOT be replayed (eventId ${d1} came back)`),
+    f(after.every((id) => durable.includes(id)), `every durable event after the cursor MUST be replayed or delivered live (missing: ${after.filter((id) => !durable.includes(id)).join(', ') || 'none'})`),
+    f(durable.length === after.length, `each durable event MUST arrive exactly once (got ${durable.length} for ${after.length})`),
+    f(JSON.stringify(durable) === JSON.stringify(after), `durable events MUST arrive in commit order, then live (got [${durable.join(', ')}], want [${after.join(', ')}])`),
+  ];
+}
+
+/**
+ * No ephemeral event is replayed. An ephemeral frame has no `id:` line (events.md §Host events),
+ * so it is found by the `eventId` inside its `data:` envelope, never by `id:`.
+ */
+export function judgeNoEphemeralReplay(frames: readonly ReplayFrame[], ephemeral: string): ReplayFinding[] {
+  return [f(!frames.some((x) => x.id === ephemeral || x.data.includes(ephemeral)), `an ephemeral event MUST NOT be replayed (eventId ${ephemeral} came back)`)];
+}
+
+/** An unresumable cursor is refused 409 host_event_resync_required, before any SSE byte. */
+export function judgeRefused(a: RefusalAnswer, what: string): ReplayFinding[] {
+  if (a === null) return [f(false, `${what}: the host opened a stream instead of refusing — a cursor it cannot resume MUST be refused 409 before any SSE byte`)];
+  return [
+    f(a.status === 409, `${what}: MUST be refused 409 (got ${a.status})`),
+    f(readErrorCode(a.json) === RESYNC, `${what}: the refusal MUST carry ${RESYNC} (got ${String(readErrorCode(a.json))})`),
+    f(!(a.contentType ?? '').includes('text/event-stream'), `${what}: the refusal MUST come before any SSE byte (content-type ${a.contentType ?? 'none'})`),
+  ];
+}
+
+/**
+ * An unauthenticated `replay=required` naming a real cursor is never resumed: the host answers
+ * its authentication failure (401) or the uniform refusal (409), never a stream of that tenant's
+ * events. Found by openwop-app (ADR 0973): an unauthenticated caller resolved to a default tenant.
+ */
+export function judgeUnauthenticatedNotResumed(a: RefusalAnswer): ReplayFinding[] {
+  if (a === null) return [f(false, 'an unauthenticated replay=required with a real cursor opened a stream — it MUST be refused (401, or the uniform 409)')];
+  return [f((a.status === 401 || a.status === 409) && !(a.contentType ?? '').includes('text/event-stream'), `an unauthenticated replay=required with a real cursor MUST be refused 401 or 409, never resumed (got ${a.status})`)];
+}
+
+/** Every refusal is byte-identical, so a refusal is not an oracle for another tenant's events. */
+export function judgeUniform(answers: ReadonlyArray<{ what: string; a: RefusalAnswer }>): ReplayFinding[] {
+  const base = answers[0];
+  if (base === undefined) return [f(false, 'no refusal was recorded')];
+  return answers.slice(1).map(({ what, a }) => f(
+    a !== null && base.a !== null && a.status === base.a.status && a.text === base.a.text,
+    `${what} MUST be answered byte-identically to ${base.what} (status ${a?.status ?? 'stream'} vs ${base.a?.status ?? 'stream'}; bodies ${a !== null && base.a !== null && a.text === base.a.text ? 'equal' : 'differ'})`,
+  ));
+}
+
+/** Without `replay=required`, an unknown cursor keeps its old answer: not the new refusal. */
+export function judgeLegacy(status: number | null): ReplayFinding[] {
+  return [f(status !== null && status !== 409, `without replay=required an unknown Last-Event-ID MUST keep its existing behaviour, not ${RESYNC} (got ${status ?? 'no answer'})`)];
+}

package/src/scenarios/v2-host-event-strict-replay.test.ts

@@ -0,0 +1,186 @@
+/**
+ * v2 — opt-in strict host-event replay (RFC 0250; the rules are the
+ * `hostEvents.replay` description in `spec/v2/facets/hostEvents.schema.json`
+ * and `events.md` §Host events).
+ *
+ * Server-free (always on):
+ *   1. `0250.shape` — the `replay` facet member validates; a zero retention,
+ *      an unknown member and the old `mode` member are refused.
+ *
+ * Host legs — gated on `hostEvents.replay` and the RFC 0241 trigger
+ * (`host-test.durable-triggered` and `host-test.ephemeral-triggered` listed).
+ * One sequence per worker: emit durable D1, D2, ephemeral E, durable D3 with
+ * no stream open, then reconnect with `replay=required` and `Last-Event-ID: D1`
+ * and emit D4 while the stream is open. Judges in
+ * `lib/host-event-replay-witness.ts`.
+ *   2. `0250.resume-backlog` — exactly D2, D3, D4 arrive, in that order, never
+ *      D1: the backlog, then live, with no gap at the handoff.
+ *   3. `0250.ephemeral-not-replayed` — E does not come back.
+ *   4. `0250.cursor-refused` — an unknown cursor is `409
+ *      host_event_resync_required` before any SSE byte.
+ *   5. `0250.refusal-uniform` — E's id and a second tenant's real durable id
+ *      (`OPENWOP_TEST_TENANT_B_API_KEY`) are refused byte-identically to the
+ *      unknown cursor, so a refusal is no oracle; and an unauthenticated
+ *      request naming D1 is refused (401 or the uniform 409), never resumed.
+ *   6. `0250.legacy-unchanged` — without `replay=required`, an unknown cursor
+ *      is not answered with the new refusal.
+ *
+ * Retention across process replacement and expiry are not caused here: losing
+ * an event inside the retention window is a violation of leg 2 however it
+ * happens, and the suite cannot replace a host's process.
+ *
+ * @see RFCS/0250-opt-in-host-event-replay-and-resync.md
+ */
+
+import { describe, it, expect } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { driver } from '../lib/driver.js';
+import { v2Discovery, familyAdvertised, v2RefValidator } from '../lib/v2.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { subscribe } from '../lib/sse.js';
+import { advertisedTypes, testTypeListed, TEST_TYPES } from '../lib/host-event-witness.js';
+import {
+  judgeLegacy, judgeNoEphemeralReplay, judgeRefused, judgeUnauthenticatedNotResumed, judgeResume, judgeUniform,
+  type RefusalAnswer, type ReplayFinding, type ReplayFrame,
+} from '../lib/host-event-replay-witness.js';
+
+const DOC = 'hostEvents.schema.json §replay, events.md §Host events (RFC 0250)';
+const ID_SHAPE = 'openwop.requirement.0250.shape';
+const ID_RESUME = 'openwop.requirement.0250.resume-backlog';
+const ID_EPHEMERAL = 'openwop.requirement.0250.ephemeral-not-replayed';
+const ID_REFUSED = 'openwop.requirement.0250.cursor-refused';
+const ID_UNIFORM = 'openwop.requirement.0250.refusal-uniform';
+const ID_LEGACY = 'openwop.requirement.0250.legacy-unchanged';
+
+const TRIGGER = '/host/events/test';
+const V2 = { 'OpenWOP-Version': '2.0' };
+const STREAM_MS = 4_000;
+const REFUSAL_MS = 4_000;
+const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));
+
+type Skip = { skip: [Parameters<typeof softSkip>[0], string] };
+async function gate(): Promise<Skip | { ok: true }> {
+  let doc: Record<string, unknown> | null;
+  try { doc = await v2Discovery(); } catch { doc = null; }
+  if (!doc) return { skip: ['blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 JSON under OpenWOP-Version: 2.0'] };
+  const record = await familyAdvertised('hostEvents');
+  if (record === null) return { skip: ['inapplicable', 'the host does not advertise hostEvents'] };
+  const replay = record['replay'];
+  if (replay === null || typeof replay !== 'object') return { skip: ['inapplicable', 'the host does not advertise hostEvents.replay'] };
+  const types = advertisedTypes(record);
+  if (testTypeListed(types, 'durable') === null || testTypeListed(types, 'ephemeral') === null) {
+    return { skip: ['inapplicable', `hostEvents.types lists ${TEST_TYPES.durable} and ${TEST_TYPES.ephemeral} not both, so the suite cannot cause the sequence (RFC 0241 §B.1)`] };
+  }
+  return { ok: true };
+}
+
+async function emit(delivery: 'durable' | 'ephemeral', bearer?: string): Promise<string | null> {
+  try {
+    const res = await driver.post(TRIGGER, { delivery }, bearer === undefined ? {} : { authenticated: false, headers: { Authorization: `Bearer ${bearer}` } });
+    const id = (res.json as { eventId?: unknown } | undefined)?.eventId;
+    return res.status === 202 && typeof id === 'string' ? id : null;
+  } catch {
+    return null;
+  }
+}
+
+/** A `replay=required` request expected to be refused; `null` when a stream opened instead. */
+async function refusalFor(cursor: string, anonymous = false): Promise<RefusalAnswer> {
+  try {
+    const r = await driver.get('/host/events?replay=required', { headers: { ...V2, 'Last-Event-ID': cursor }, timeoutMs: REFUSAL_MS, ...(anonymous ? { authenticated: false } : {}) });
+    return { status: r.status, contentType: r.headers.get('content-type'), text: r.text, json: r.json };
+  } catch {
+    return null;
+  }
+}
+
+interface Sequence {
+  readonly blockedAt?: string;
+  readonly d1?: string; readonly after?: string[]; readonly e?: string;
+  readonly frames?: ReplayFrame[];
+}
+let seq: Promise<Sequence> | undefined;
+function sequence(): Promise<Sequence> {
+  seq ??= drive();
+  return seq;
+}
+async function drive(): Promise<Sequence> {
+  const d1 = await emit('durable'); if (d1 === null) return { blockedAt: `${TRIGGER} did not accept durable D1` };
+  const d2 = await emit('durable'); if (d2 === null) return { blockedAt: `${TRIGGER} did not accept durable D2` };
+  const e = await emit('ephemeral'); if (e === null) return { blockedAt: `${TRIGGER} did not accept ephemeral E` };
+  const d3 = await emit('durable'); if (d3 === null) return { blockedAt: `${TRIGGER} did not accept durable D3` };
+  const sub = subscribe('/host/events?replay=required', { timeoutMs: STREAM_MS, extraHeaders: V2, lastEventId: d1 });
+  await sleep(800);
+  const d4 = await emit('durable');
+  const res = await sub;
+  if (d4 === null) return { blockedAt: `${TRIGGER} did not accept durable D4 while the resumed stream was open` };
+  if (res.status !== 200) return { blockedAt: `the replay=required stream with cursor D1 answered ${res.status}` };
+  return { d1, after: [d2, d3, d4], e, frames: res.events.map((x) => ({ id: x.id, event: x.event, data: x.data })) };
+}
+
+const expectAll = (id: string, findings: readonly ReplayFinding[]): void => {
+  for (const x of findings) expect(x.ok, req(id, DOC, x.message)).toBe(true);
+};
+
+describe('v2 RFC 0250 — hostEvents.replay shape (server-free)', () => {
+  it('the replay facet member validates, and its negatives are refused', () => {
+    const v = v2RefValidator('capabilities.schema.json#/properties/hostEvents/properties/replay');
+    const S = 'hostEvents.schema.json §replay (RFC 0250)';
+    expect(v({ minRetentionSeconds: 3600 }).ok, req(ID_SHAPE, S, 'a positive retention MUST validate')).toBe(true);
+    expect(v({ minRetentionSeconds: 0 }).ok, req(ID_SHAPE, S, 'a zero retention MUST be refused')).toBe(false);
+    expect(v({}).ok, req(ID_SHAPE, S, 'minRetentionSeconds is required')).toBe(false);
+    expect(v({ minRetentionSeconds: 60, mode: 'required-cursor-v1' }).ok, req(ID_SHAPE, S, 'the member is closed (the Draft mode const was dropped)')).toBe(false);
+  });
+});
+
+describe('v2 RFC 0250 — strict replay (host)', () => {
+  it('a resumed stream delivers the backlog after the cursor, then live, in order', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    const s = await sequence();
+    if (s.frames === undefined) return softSkip('blocked', s.blockedAt ?? 'the sequence did not complete');
+    expectAll(ID_RESUME, judgeResume(s.frames, s.d1!, s.after!, s.e!));
+  }, 30_000);
+
+  it('an ephemeral event is not replayed', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    const s = await sequence();
+    if (s.frames === undefined) return softSkip('blocked', s.blockedAt ?? 'the sequence did not complete');
+    expectAll(ID_EPHEMERAL, judgeNoEphemeralReplay(s.frames, s.e!));
+  }, 30_000);
+
+  it('an unknown cursor is refused 409 host_event_resync_required before any SSE byte', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    expectAll(ID_REFUSED, judgeRefused(await refusalFor(`conformance-unknown-${randomBytes(8).toString('hex')}`), 'an unknown cursor'));
+  }, 15_000);
+
+  it('a foreign or ephemeral cursor is refused byte-identically to an unknown one', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    const tenantB = process.env['OPENWOP_TEST_TENANT_B_API_KEY']?.trim();
+    if (!tenantB) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY (a credential bound to a second tenant) is not set');
+    if (tenantB === process.env['OPENWOP_API_KEY']) return softSkip('blocked', 'OPENWOP_TEST_TENANT_B_API_KEY equals OPENWOP_API_KEY — the leg needs a second tenant');
+    const s = await sequence();
+    if (s.e === undefined) return softSkip('blocked', s.blockedAt ?? 'the sequence did not complete');
+    const foreign = await emit('durable', tenantB);
+    if (foreign === null) return softSkip('blocked', `${TRIGGER} as tenant B did not accept a durable event`);
+    const unknown = await refusalFor(`conformance-unknown-${randomBytes(8).toString('hex')}`);
+    const answers = [
+      { what: 'an unknown cursor', a: unknown },
+      { what: "another tenant's real durable cursor", a: await refusalFor(foreign) },
+      { what: "an ephemeral event's id", a: await refusalFor(s.e) },
+    ];
+    const anonymous = await refusalFor(s.d1!, true);
+    expectAll(ID_UNIFORM, [...answers.flatMap(({ what, a }) => judgeRefused(a, what)), ...judgeUniform(answers), ...judgeUnauthenticatedNotResumed(anonymous)]);
+  }, 30_000);
+
+  it('without replay=required an unknown cursor keeps its existing answer', async () => {
+    const g = await gate();
+    if ('skip' in g) return softSkip(...g.skip);
+    const r = await subscribe('/host/events', { timeoutMs: 1_500, extraHeaders: V2, lastEventId: `conformance-unknown-${randomBytes(8).toString('hex')}` });
+    expectAll(ID_LEGACY, judgeLegacy(r.status === 0 ? null : r.status));
+  }, 15_000);
+});