@openwop/openwop-conformance 2.47.0 → 2.48.0

package/CHANGELOG.md

@@ -1,3 +1,8 @@
+## [2.48.0] — 2026-11-13 — Compensation unwind and derived adoption
+
+- **RFC 0265.** `v2-compensation-unwind`: five host legs gated on `compensation` and the `conformance-compensate-unwind` fixture (legs 3 and 5 also on `idempotency`), reading only the event log, `GET /runs/{runId}/compensation`, `GET /runs/{runId}/effects` and a replay fork. The judges live in `lib/compensation-unwind.ts`, with a self-test that includes sabotage cases.
+- **RFC 0264.** `v2-core-adoption-derived` (coherence) drives `scripts/derive-core-adoption.mjs` on fixture trees: a derived value against a hand edit, missing, stale and overdue review rows, and a renewal that only changes the date.
+
 ## [2.47.0] — 2026-11-13 — Cache-key recipe 2, telemetry export, sabotage ledger
 
 - **RFC 0260.** `v2-replay-llm-cache-key`: a server-free shape leg, an unaided implies-idempotency leg, and four host legs on `GET /runs/{runId}/effects` (key recorded, parameters in the key, stable, portable), gated on `replay.llmCacheKeyRecipe` and the `conformance-llm-cache-key` fixture. Judges in `lib/llm-cache-key-2.ts`.

package/README.md

@@ -137,7 +137,7 @@ Each scenario file records its disposition and assertion count in `<report-dir>/
 
 ## What's Covered
 
-The current suite has 670 scenario files under `src/scenarios/`. By target major ([`scenario-majors.json`](./scenario-majors.json)): 230 files run against a v2 host and 455 against a v1 host; 15 of them run at both.
+The current suite has 671 scenario files under `src/scenarios/`. By target major ([`scenario-majors.json`](./scenario-majors.json)): 231 files run against a v2 host and 455 against a v1 host; 15 of them run at both.
 
 The v2 scenarios (`src/scenarios/v2-*.test.ts`) cover, by area:
 
@@ -166,7 +166,7 @@ Three kinds of scenario share the tree:
 - **Host** checks drive a live host over HTTP.
 - **Gated** checks run only when the host advertises the family, profile or fixture they need, and otherwise record `inapplicable` or `blocked` with a reason. `--require-behavior` turns an advertised-but-unwitnessable behaviour into a failure.
 
-Current source tree: 670 scenario files. [`coverage.md`](./coverage.md) maps each spec document and every OpenAPI operation to its scenarios. [`CHANGELOG.md`](./CHANGELOG.md) records when each scenario landed.
+Current source tree: 671 scenario files. [`coverage.md`](./coverage.md) maps each spec document and every OpenAPI operation to its scenarios. [`CHANGELOG.md`](./CHANGELOG.md) records when each scenario landed.
 
 ## How the 2.x suite is built
 

package/dist/spec-artifacts.lock.json

@@ -1,5 +1,5 @@
 {
   "package": "@openwop/spec-artifacts",
-  "version": "2.47.0",
-  "stampSha256": "f03caded5ddba2a0fd12bf7b6a93995789afdd4ae5ffd56d0cfcde8701f7a657"
+  "version": "2.48.0",
+  "stampSha256": "fa47d372481a121213d9193a10a64a85ae753a0ac8301d2373d061cd70e0b57d"
 }

package/fixtures/conformance-compensate-unwind.json

@@ -0,0 +1,70 @@
+{
+  "id": "conformance-compensate-unwind",
+  "name": "Conformance: Compensate Unwind",
+  "version": "1.0",
+  "description": "RFC 0265 fixture for `v2-compensation-unwind.test.ts`: the condition an unwind exists for, caused by the suite unaided. Three effect nodes run in sequence (`e1` → `e2` → `e3`) and succeed; the last node, `fail` (`core.fail`, the always-fails node `conformance-failure` uses), then fails deterministically, so the run has committed effects and a `node-failure` trigger. Each effect node declares a node-level `compensation` whose inverse is the same reserved type with `inputMapping.inverse: true`, and `settings.compensation` asks for a `reverse-completion` unwind on `node-failure`. `core.conformance.compensable-effect` is a conformance-RESERVED typeId (same pattern as `core.conformance.side-effect`): a host that advertises `compensation` and serves this fixture MUST map it to a node it records on the Layer-2 effect ledger (`GET /runs/{runId}/effects`) as exactly one effect per execution, forward and inverse alike, and MUST run it as the inverse action when its resolved inputs carry `inverse: true`. What the effect does is irrelevant; that it is recorded once per execution is the whole contract. The suite reads the unwind through normative paths only: the event log (`compensation.requested` before `compensation.started`), `GET /runs/{runId}/compensation` (attempts in the order `e3, e2, e1`, the reverse of forward completion) and the effect ledger (three inverse records, none added by a `mode: \"replay\"` fork). Serving the fixture is OPTIONAL; a host that does not list it in discovery `fixtures[]` is `inapplicable` for every leg.",
+  "nodes": [
+    {
+      "id": "e1",
+      "typeId": "core.conformance.compensable-effect",
+      "name": "Effect 1",
+      "position": { "x": 0, "y": 0 },
+      "config": {},
+      "inputs": {},
+      "compensation": {
+        "nodeTypeId": "core.conformance.compensable-effect",
+        "inputMapping": { "inverse": true }
+      }
+    },
+    {
+      "id": "e2",
+      "typeId": "core.conformance.compensable-effect",
+      "name": "Effect 2",
+      "position": { "x": 200, "y": 0 },
+      "config": {},
+      "inputs": {},
+      "compensation": {
+        "nodeTypeId": "core.conformance.compensable-effect",
+        "inputMapping": { "inverse": true }
+      }
+    },
+    {
+      "id": "e3",
+      "typeId": "core.conformance.compensable-effect",
+      "name": "Effect 3",
+      "position": { "x": 400, "y": 0 },
+      "config": {},
+      "inputs": {},
+      "compensation": {
+        "nodeTypeId": "core.conformance.compensable-effect",
+        "inputMapping": { "inverse": true }
+      }
+    },
+    {
+      "id": "fail",
+      "typeId": "core.fail",
+      "name": "Fail",
+      "position": { "x": 600, "y": 0 },
+      "config": {},
+      "inputs": {}
+    }
+  ],
+  "edges": [
+    { "id": "e1-e2", "sourceNodeId": "e1", "targetNodeId": "e2" },
+    { "id": "e2-e3", "sourceNodeId": "e2", "targetNodeId": "e3" },
+    { "id": "e3-fail", "sourceNodeId": "e3", "targetNodeId": "fail" }
+  ],
+  "triggers": [
+    { "id": "manual", "type": "manual", "enabled": true }
+  ],
+  "variables": [],
+  "metadata": { "tags": ["conformance"] },
+  "settings": {
+    "timeout": 30000,
+    "maxRetries": 0,
+    "compensation": {
+      "orderingModel": "reverse-completion",
+      "triggers": ["node-failure"]
+    }
+  }
+}

package/fixtures.md

@@ -151,6 +151,7 @@ All fixtures MUST advertise:
 | v2 tableStorage Schema Probe | `conformance-table-schema-probe` | `storage.md` §`tableStorage` — one `core.conformance.table-schema-probe` node (conformance-RESERVED) creates a table `{ k: string, n: number }` with the host's own `ctx.storage.table`, then inserts a well-typed row (`control`), a row whose `n` is a string (`insert-mistyped`), or updates `n` to a string (`update-mistyped`). See §"The tableStorage schema probe fixture" | `completed` for `control`; `failed` (`validation_error`, `details.service: tableStorage`) for a mistyped write | ≤ 30s |
 | v2 ctx.callAI Attempt Accounting | `conformance-callai-attempt-accounting` | RFC 0248 — one `conformance.callai.echo-attempts` node (conformance-RESERVED) that makes one `ctx.callAI` call through the host's conformance mock, serves the run's `script`, and echoes the result's `attempts` (`v2-callai-attempt-accounting`) | each case run completes or fails as its script dictates | ≤ 30s |
 | v2 LLM Cache Key | `conformance-llm-cache-key` | RFC 0260 — one `conformance.callai.cache-key` node (conformance-RESERVED) making one `ctx.callAI` call through the suite's mock provider with the run's prompt and params unchanged (`v2-replay-llm-cache-key`) | completes; the call's effect record carries `cacheKey` | ≤ 30s |
+| v2 Compensate Unwind | `conformance-compensate-unwind` | RFC 0265 — three `core.conformance.compensable-effect` nodes (conformance-RESERVED) `e1 → e2 → e3`, each declaring itself as its own inverse (`inputMapping.inverse: true`), then `core.fail`; `settings.compensation` is `reverse-completion` on `node-failure` (`v2-compensation-unwind`). See §"The compensate-unwind fixture" | `failed`, then an unwind: `compensation.requested` → `compensation.started` → `compensation.completed`; three inverse records on the effect ledger | ≤ 30s |
 | v2 safeFetch SSRF Probe | `conformance-safefetch-probe` | `host-services.md` §`httpClient` — one `core.conformance.safefetch-probe` node (conformance-RESERVED) calls the host's own `ctx.http.safeFetch(url)` with the run's `url`, unchanged; completes with the response `status` only; a rejection fails the node with its code and details. See §"The safeFetch probe fixture" | `failed` (`egress_denied`, `details.reason: ssrf-blocked`) for a refused target | ≤ 60s |
 | A2A Task Roundtrip                        | `conformance-a2a-task-roundtrip`                                                                | Track 6 — host consumes the conformance suite's synthetic A2A peer; covers drift points #3 (`AUTH_REQUIRED`) and #4 (`REJECTED`). Node `core.conformance.a2a-invoke` is a **conformance-RESERVED** typeId (renamed 2026-08-16 from `core.a2a.invoke`, a multi-segment `core.*` id no host shipped and the corpus never defined): a host that consumes A2A peers MUST map it to its A2A bridge node (a host-extension node — `a2a-integration.md` §"State projection"); a host that does not consume A2A MUST NOT advertise this fixture                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `failed` or `waiting-input` (per `driftScenario` input)                             | ≤ 30s                        |
 | WASM Pack Roundtrip                       | `conformance-wasm-pack-roundtrip`                                                               | RFC 0008 — invokes `vendor.openwop.rust-hello.greet` (loaded WASM pack); exercises required exports + at least one import                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `completed`                                                                         | ≤ 10s                        |
@@ -851,6 +852,21 @@ The scope leg sends a promote with `OPENWOP_TEST_LOW_SCOPE_KEY`, a key with no `
 - **Gate**: `v2-interrupt-form-rules` runs each leg only when its fixtures are advertised. No capability or seam.
 - **Timing**: the positive suspends; the probes settle within 10 s.
 
+## The compensate-unwind fixture (RFC 0265)
+
+`conformance-compensate-unwind` is what `v2-compensation-unwind` drives. Its effect node, `core.conformance.compensable-effect`, is conformance-RESERVED. A host that advertises `compensation` and serves the fixture maps it to a node it records on the effect ledger (`GET /runs/{runId}/effects`) as exactly one effect per execution, forward and inverse alike, and runs it as the inverse action when its resolved inputs carry `inverse: true`. What the effect does is irrelevant. A host that does not advertise `compensation` MUST NOT advertise the fixture: it would refuse the workflow's `settings.compensation` with `capability_required`.
+
+- **Shape**: `e1` → `e2` → `e3` (`core.conformance.compensable-effect`, each with node-level `compensation.nodeTypeId` = the same type and `inputMapping: { inverse: true }`) → `fail` (`core.fail`). `settings.compensation`: `orderingModel: "reverse-completion"`, `triggers: ["node-failure"]`.
+- **Inputs**: none.
+- **Expected behavior**:
+  1. `e1`, `e2` and `e3` complete in order; `fail` fails; the run ends `failed`.
+  2. The log holds `compensation.requested` before the first `compensation.started`, and ends the unwind with `compensation.completed`.
+  3. `GET /runs/{runId}/compensation` reads `status: "completed"`, `plan[]` naming `e1`, `e2` and `e3`, and `attempts[]` in the order `e3, e2, e1`.
+  4. The effect ledger holds one forward record per effect node and exactly three inverse records.
+  5. A `mode: "replay"` fork records no effect the source run did not make.
+- **Advertise only if** the host advertises `compensation`. Legs 3 and 5 also need `idempotency` (the ledger); leg 5 needs `replay.modes ∋ replay`.
+- **Terminal status**: `failed`.
+
 ## NodeModule registration
 
 The fixtures reference these typeIds:
@@ -858,6 +874,7 @@ The fixtures reference these typeIds:
 | typeId                        | Required by                                            | Behavior                                                                                                                                                                                 |
 | ----------------------------- | ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `core.noop`                   | noop, multi-node, approval, clarification, cancellable | Immediate completion, no output                                                                                                                                                          |
+| `core.conformance.compensable-effect` | compensate-unwind | Conformance-RESERVED (RFC 0265). Performs one effect the host records on the Layer-2 effect ledger, one record per execution; with `inverse: true` in its resolved inputs it is the inverse action. Completes with no output. |
 | `core.identity`               | identity                                               | Echo `input.payload` to `output.payload`                                                                                                                                                 |
 | `core.delay`                  | delay, cancellable                                     | Sleep `config.delayMs` ms                                                                                                                                                                |
 | `core.fail`                   | failure                                                | Throw with `code: "example.conformance_failure"` (a vendor code under the registered `example` org; errors.md §The registry, openwop#1698), message: "Intentional conformance failure"                                                                                                |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "2.47.0",
+  "version": "2.48.0",
   "description": "Black-box conformance suite for OpenWOP hosts (v2 current; v1 scenarios retained for the frozen v1 tree).",
   "repository": {
     "type": "git",
@@ -56,6 +56,6 @@
     "@openwop/spec-artifacts": "file:../spec-artifacts"
   },
   "peerDependencies": {
-    "@openwop/spec-artifacts": "2.47.0"
+    "@openwop/spec-artifacts": "2.48.0"
   }
 }

package/requirements.json

@@ -2,11 +2,11 @@
   "$comment": "GENERATED by conformance/scripts/generate-requirement-registry.mjs — do not edit. One record per it()/test() in src/scenarios. Ids: openwop.it.<file-stem>.<title-slug>[~n] (src/lib/requirement-ids.ts). A record with id null has an interpolated title; its run-time row is keyed by the rendered title and maps here by file+line only. Renamed ids need a row in requirement-aliases.json.",
   "generatedFrom": "src/scenarios/*.test.ts",
   "counts": {
-    "files": 754,
-    "tests": 2903,
-    "withStableId": 2903,
+    "files": 756,
+    "tests": 2911,
+    "withStableId": 2911,
     "interpolatedTitles": 0,
-    "explicitIds": 2747
+    "explicitIds": 2755
   },
   "records": [
     {
@@ -29625,6 +29625,52 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-compensation-unwind.compensation-requested-precedes-the-first-compensation-started",
+      "file": "v2-compensation-unwind.test.ts",
+      "line": 162,
+      "title": "compensation.requested precedes the first compensation.started",
+      "explicitId": "openwop.requirement.0265.plan-before-inverse",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-compensation-unwind.the-projection-attempts-the-effect-nodes-in-the-reverse-of-their-forward-complet",
+      "file": "v2-compensation-unwind.test.ts",
+      "line": 170,
+      "title": "the projection attempts the effect nodes in the reverse of their forward completion order",
+      "explicitId": "openwop.requirement.0265.reverse-completion",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-compensation-unwind.the-effect-ledger-holds-exactly-one-inverse-record-per-forward-effect",
+      "file": "v2-compensation-unwind.test.ts",
+      "line": 185,
+      "title": "the effect ledger holds exactly one inverse record per forward effect",
+      "explicitId": "openwop.requirement.0265.inverse-once",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-compensation-unwind.the-projection-status-and-plan-agree-with-the-event-log",
+      "file": "v2-compensation-unwind.test.ts",
+      "line": 199,
+      "title": "the projection status and plan agree with the event log",
+      "explicitId": "openwop.requirement.0265.projection-agrees",
+      "citations": []
+    },
+    {
+      "id": "openwop.it.v2-compensation-unwind.a-replay-fork-of-the-unwound-run-performs-no-inverse-again",
+      "file": "v2-compensation-unwind.test.ts",
+      "line": 209,
+      "title": "a replay fork of the unwound run performs no inverse again",
+      "explicitId": "openwop.requirement.0265.replay-no-refire",
+      "citations": [
+        {
+          "section": "replay.md §Suppression; invariant compensation-replay-no-refire (RFC 0265 §B.5)",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-configurable-closed.the-standalone-schema-rejects-a-dotted-key-and-an-unknown-root-key-and-accepts-t",
       "file": "v2-configurable-closed.test.ts",
@@ -48408,6 +48454,163 @@
         }
       ]
     },
+    {
+      "id": "openwop.it.v2-core-adoption-derived.a-1-a-core-row-s-adoption-equals-the-value-the-bundles-derive",
+      "file": "v2-core-adoption-derived.test.ts",
+      "line": 123,
+      "title": "§A.1 a core row's adoption equals the value the bundles derive",
+      "explicitId": "openwop.requirement.0264.adoption-derived",
+      "citations": [
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": null,
+          "interpolated": true
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "the base MUST derive one multi-witness, one single-witness and one none family"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "a hand-edited adoption value MUST fail"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "the refusal MUST name the family and the derived value"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "claiming a witness the exclusions remove (old bundle, companion, unlisted origin, no record, citation) MUST fail"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "gamma MUST derive none"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "a tier-3 witness MUST make the row independent"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "the refusal MUST name independent"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "--write MUST succeed"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "--write MUST set the core rows and leave the ext row"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "the tree --write produced MUST pass --check"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": null,
+          "interpolated": true
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-core-adoption-derived.b-2-a-family-at-none-has-a-current-review-row-and-no-other-family-has-one",
+      "file": "v2-core-adoption-derived.test.ts",
+      "line": 154,
+      "title": "§B.2 a family at none has a current review row, and no other family has one",
+      "explicitId": "openwop.requirement.0264.review-row-present",
+      "citations": [
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "the base tree with one keep row for gamma MUST pass"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "a none family with no row MUST fail"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "the refusal MUST name the family"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "a missing review file MUST fail while a family is at none"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "a row for a witnessed family MUST fail"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "the refusal MUST call it stale"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "a keep row below the release minor MUST fail"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "the refusal MUST call it overdue"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "a keep row due this minor is not yet overdue"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "an unfilled skeleton row MUST fail"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "a retire row without a correction MUST fail"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "the refusal MUST name §B.4"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "a retire row naming an unknown correction MUST fail"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "a retire row naming a correction row MUST pass, past its reviewBy too"
+        }
+      ]
+    },
+    {
+      "id": "openwop.it.v2-core-adoption-derived.b-3-renewing-a-keep-row-changes-its-reason-or-plan-not-only-its-date",
+      "file": "v2-core-adoption-derived.test.ts",
+      "line": 180,
+      "title": "§B.3 renewing a keep row changes its reason or plan, not only its date",
+      "explicitId": "openwop.requirement.0264.renewal-not-date-only",
+      "citations": [
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "an unchanged row MUST pass"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "a renewal that changes only reviewBy MUST fail"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "the refusal MUST name §B.3"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "a renewal with a new reason MUST pass"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "a renewal with a new plan MUST pass"
+        },
+        {
+          "section": "RFC 0264 · scripts/derive-core-adoption.mjs",
+          "requirement": "a row with no baseline row is new, not a renewal"
+        }
+      ]
+    },
     {
       "id": "openwop.it.v2-corpus-tag-pinned.every-vendoring-consumer-in-the-cross-repo-inventory-records-a-published-corpus",
       "file": "v2-corpus-tag-pinned.test.ts",

package/scenario-majors.json

@@ -1,9 +1,9 @@
 {
   "$comment": "GENERATED by conformance/scripts/generate-scenario-majors.mjs (RFC 0168 §D.3). Do not edit; add a file to BOTH_MAJORS in the generator to target both majors.",
   "counts": {
-    "files": 670,
+    "files": 671,
     "v1": 455,
-    "v2": 230
+    "v2": 231
   },
   "majors": {
     "a2a-1-0-agent-card.test.ts": [
@@ -1392,6 +1392,9 @@
     "v2-compensation-read-projection.test.ts": [
       2
     ],
+    "v2-compensation-unwind.test.ts": [
+      2
+    ],
     "v2-configurable-closed.test.ts": [
       2
     ],

package/schemas/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.47.0",
-  "corpusTag": "v2.47.0",
+  "version": "2.48.0",
+  "corpusTag": "v2.48.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "dffb86d9287e72ee6261bd830b6920068ac78c1a0947f8d5087b47ecc19f11e5",
-    "api/v2/asyncapi.yaml": "7a8c4937c9b4f8387cc8d7cd6a5b890449b751ac2254b991f3434774798452d9",
-    "api/v2/openapi.yaml": "0c3ba86687c60e7b65add574b011c306c1ad132e1cc371c954ac1190c1f3781e",
+    "api/seams-v2.yaml": "61037c7c1d7f9859c9f39c34d6c8e2c65865036dab2d8bd4c5d8e5ff45bbb260",
+    "api/v2/asyncapi.yaml": "0d893e632e7dd72c11e17b38ec19907652265b88bc023a79ac4cbc3992ae8aea",
+    "api/v2/openapi.yaml": "fb704e969745a8886682c532f7de52f6abce67fa4bf1e58ac56a36c5e1bcd935",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "276fc1d51eb08e14e9127b9fd27761d7046ee33c12000f3a64a801322db8bf58",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -115,14 +115,14 @@
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
     "schemas/v2/budget-policy.schema.json": "1de68095db0beb5c7a4be629de26e79f62ebbe748a88d46f36e768edfd1f0d68",
-    "schemas/v2/capabilities.schema.json": "609aa5998cafb549badbae7a6d94100ee32d130ade03dc6dfa40005f40154ac1",
-    "schemas/v2/certification-bundle.schema.json": "29d0be495dfaa2265f30394de92a96ca95058f1a89f663ece97c67ea6fae94c0",
+    "schemas/v2/capabilities.schema.json": "afae0c548cf91a915c2badca77b7c89cd0c657f100c2cd1db64de896c8da2bf0",
+    "schemas/v2/certification-bundle.schema.json": "f9e233dc3584c3cef78809d518749ce37cd1ee79ebbfe58163dc67eeac7802b1",
     "schemas/v2/channel-presence-payload.schema.json": "fc03df0c20cc12a25f7ee6a47503a4c5931d79fe3d5ff24815e8fd7c1bcb9a87",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "9cf235f5d0fe662f34f7e72bfbf2a82e0743046059a9d5af7aec948e228fdb0e",
     "schemas/v2/compact-tool-descriptor.schema.json": "b5c418d72082d5b713bf318212a83397e5be98e56d25ca056302b41b8dd8273b",
     "schemas/v2/compensation-policy.schema.json": "b3c1142637f5bf980f2b0bb67adb47e8cb7abb99a0405a4b6816ccf5d9c089d6",
-    "schemas/v2/compensation-projection.schema.json": "f46977c7076347b5473faa8c4bbe73d8321c33b33c98fff2f26ee7cbada4ed98",
+    "schemas/v2/compensation-projection.schema.json": "6acb2385fab26f172eb69cdca4e0ae6a618c003cfabd89783d2d5cf028a9270e",
     "schemas/v2/configurable.schema.json": "33a6884047e2490f723733bf8b74d3b9164e00374cfea6dc3eac5a70dc368861",
     "schemas/v2/connection-pack-manifest.schema.json": "8d019de6bd0c5b14ea3b227580734ec792521493b396a850f7f9217aa7a6a547",
     "schemas/v2/connection-provider-registry.schema.json": "5b404da328a95c45808929e233ee766ebd635cf0df6f5d15d4c19354dfd7e75d",
@@ -203,14 +203,14 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "202a443678e592a515e33aad7f6ab679a07d8408809f2d4b0f59d156c84ffc65",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "9c3d53b164244ae9f238d5047681e01701c0df244172489a50509e62265514bc",
+    "spec/v1/core-standard-manifest.json": "b7c589705ad3361c40620c3b796d8a4fe4e45a25776e736b046c33029a9dd55b",
     "spec/v1/deprecations.json": "901fdab0a7212627f1838cbb06ae7b7204f0dff528299e56d3d938deecea27c1",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "08579ba52f384764f8b5849ee7d0bc97a0cb49318f6c6ccd0561707ab5f3be80",
+    "spec/v1/gaps.json": "e2b4a5721aefd6502137b16b55cd1a4edadd37e51029f25e455a44b7e29b3e06",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -218,7 +218,7 @@
     "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
     "spec/v2/README.md": "c58acd84bb67c69043d9f777cbaa16d03e4f0f0a8158d2984526b69981067a14",
     "spec/v2/core/artifact-type-packs.md": "ba5a258ac93b1aa4d74a4464c63a8f72dbbc5d24fd56f34a2c2ce9f464892799",
-    "spec/v2/core/capabilities.md": "7ab4c1ab5b0b0a95a5e35ff2db9b45c5fb6bf23844c97ffeed6d6ebda3d17c7e",
+    "spec/v2/core/capabilities.md": "2d94e45537693802032bd0750d05682f5a3f1e189fee2064f8fa969907d74271",
     "spec/v2/core/conformance.md": "2e12b5fceb9cbd1bbf4a536310fe92a4cd44947e48d0466013327c5de202a2d9",
     "spec/v2/core/connection-packs.md": "c80f95bd6a03698f35c72cdb2b46bd973f49203bbd786c26760e35fa86e6f23d",
     "spec/v2/core/conversation.md": "8d6abedf6af408a74577753bfca24719d318e2632e10b45ff5d63bdcf31a8aaa",
@@ -241,7 +241,7 @@
     "spec/v2/core/portability.md": "93b9cb8bb85448669df716effb7627236b2bb069f8c5ca7306e8971b9355abfd",
     "spec/v2/core/replay.md": "de705ad72e4878def9a0e1d215df9020c129eabae5f224b8c9b3330bd3b48c47",
     "spec/v2/core/runs.md": "f9c26490e52fa69a10c8e98c8a489e3bc8dfbe3effe334bb1793bc9b575f5efe",
-    "spec/v2/core/security-defaults.md": "18c9956cae51c3da1def80ce94741ad1fd664a8150701160c6cd0ef367c79749",
+    "spec/v2/core/security-defaults.md": "3ca0c9f973232521536024165de8815f80ad9774df5e5210c8e5bfdd4373b670",
     "spec/v2/core/storage.md": "bfcc74526d0f24539188b1c5d1567d8510e80d0b6c39fdc4d19204fcd6fd1f85",
     "spec/v2/core/telemetry.md": "5e2f30919c51195b57566a2a277663e72dffd1a56a68c19fb8b0d3260629ff7f",
     "spec/v2/core/tool-catalog.md": "d16a9004418719c48301804aefa4d7ab6f41112a4ed83727f552aa1b92b418b0",
@@ -250,7 +250,7 @@
     "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
     "spec/v2/corrections.json": "5ee76d1ee87677a86d5d9ee2f477b88fc29f9f9d37611040b9ccb08f8f30fb2d",
     "spec/v2/corrections.schema.json": "02f6a0a9531e657693be311af0f59d6432f3efcf645f56ccbf39e5b141e6b641",
-    "spec/v2/declaration.json": "7c8da768d45866b70544fad1e26c513f1dce8657c276ffa7148127d11b744811",
+    "spec/v2/declaration.json": "2d6415ee3b9a801d6a7c4de5ec1ab4d62441dded7b5a44ceb42be80f0a258ce9",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
     "spec/v2/eos-override.json": "4c72d2f6a658943b01c1de1643cf294642091933af7832f38ee5495df684cb2d",
     "spec/v2/errors.json": "8b4d2ebab569b26f608323ca4c9adaf805ab515286d26532db23fcb97541787f",
@@ -309,9 +309,9 @@
     "spec/v2/path-manifest.json": "3720e502614f301efc7556e0bfcbfa7b7ad8a37c579256ba6bca82417a2728f1",
     "spec/v2/peer-dependency-aliases.json": "cbf62f551f9295b0ac7ba6cc0466abb153563354a57b0622f3ec6e6689cba47e",
     "spec/v2/profiles.json": "b382b261c7844798575f7c1b37c934f0da19846016a2337d883d4f5ef6e05479",
-    "spec/v2/release.json": "6082692ec2549fcb02ca33f24336e7f9f417ec4ff08a14d23fc02533d8a00527",
+    "spec/v2/release.json": "8dfa992e0c12d7efda3d0e1c6a63f66790c7c1b29fbe6bb5ae81ba7321f98c39",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "c67e5764105a35d5dc575942582b7b0784c0ad2e3739fe7b5b23de28ea58408f"
+    "spec/v2/surface-baseline.json": "f1638b1acc7f7408f208c3ada6bd982ed61f9825a6e0e515fba9873808b48192"
   },
-  "corpusCommit": "aeb6ca4f976b56668c3770acd128c08ec59cfb18"
+  "corpusCommit": "37c05c6cdf6b15dded360ad23455e066e2fc2b99"
 }

package/src/lib/compensation-unwind.ts

@@ -0,0 +1,173 @@
+/**
+ * RFC 0265 — pure judges for `v2-compensation-unwind.test.ts`. The scenario runs
+ * the `conformance-compensate-unwind` fixture (three compensable effects, then a
+ * node that fails) and records the run's event log, its compensation projection
+ * and its effect ledger; these functions decide each leg from those reads, so
+ * the self-tests can fail every wrong host answer without a host.
+ *
+ * Attribution of effect-ledger rows. The ledger projection carries no
+ * forward/inverse marker (`schemas/v2/effect-ledger-projection.schema.json`:
+ * `effectId, nodeId, attempt, keying, state, at`), and a host may record an
+ * inverse under the forward node's id or under one of its own. So a row is
+ * attributed by elimination, using only what the fixture fixes:
+ *   - the FORWARD record of each effect node is that node's earliest row by `at`
+ *     (the forward runs once, deterministically, before the failure);
+ *   - rows for the failing node are neither (it performs no effect);
+ *   - every other row is an INVERSE record — the fixture has nothing else that
+ *     could put a row on the ledger.
+ * A ledger with no row for some effect node never recorded its forward effect,
+ * so the inverse count is not measurable there (RFC 0265 risk R1: the host did
+ * not map the reserved node to a ledgered effect). That is `blocked`, never a
+ * failure.
+ *
+ * @see RFCS/0265-compensation-unwind-witness.md
+ * @see spec/v2/core/security-defaults.md §Compensation
+ */
+
+import { refiredAttempts, type EffectRow } from './effect-refire.js';
+
+export interface Finding { readonly ok: boolean; readonly message: string }
+export interface Ev { readonly type?: unknown; readonly nodeId?: unknown; readonly sequence?: unknown; readonly payload?: unknown }
+export interface LedgerRow extends EffectRow { readonly effectId?: unknown; readonly state?: unknown }
+export interface Attempt { readonly nodeId?: unknown; readonly attempt?: unknown; readonly outcome?: unknown; readonly at?: unknown }
+export interface Projection { readonly status?: unknown; readonly plan?: unknown; readonly attempts?: unknown }
+
+/** The fixture's three compensable effect nodes, in forward order, and its failing node. */
+export const EFFECT_NODES: readonly string[] = ['e1', 'e2', 'e3'];
+export const FAIL_NODE = 'fail';
+
+type Rec = Record<string, unknown>;
+const isRec = (v: unknown): v is Rec => typeof v === 'object' && v !== null && !Array.isArray(v);
+const f = (ok: boolean, message: string): Finding => ({ ok, message });
+const seqOf = (e: Ev): number => (typeof e.sequence === 'number' ? e.sequence : Number.NaN);
+const nodeOf = (e: Ev): unknown => e.nodeId ?? (isRec(e.payload) ? e.payload['nodeId'] : undefined);
+const atOf = (r: LedgerRow): number => (typeof r.at === 'string' ? Date.parse(r.at) : Number.NaN);
+const bySeq = (log: readonly Ev[]): Ev[] => log.filter((e) => Number.isFinite(seqOf(e))).sort((a, b) => seqOf(a) - seqOf(b));
+
+/** Compensation events that end an unwind (asyncapi `compensation.*`). */
+export const COMPENSATION_TERMINAL = new Set(['compensation.completed', 'compensation.failed', 'compensation.manual-intervention-required']);
+/** Projection statuses an unwind can rest in (compensation-projection.schema.json). */
+export const PROJECTION_SETTLED = new Set(['completed', 'partial', 'failed', 'manual-intervention']);
+
+/**
+ * The order the effect nodes FORWARD-completed: the first `node.completed` per
+ * node, by log sequence. An inverse executed under the same node id may emit a
+ * later `node.completed`; the first one is the forward.
+ */
+export function forwardCompletionOrder(log: readonly Ev[], nodes: readonly string[] = EFFECT_NODES): string[] {
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const e of bySeq(log)) {
+    const n = nodeOf(e);
+    if (e.type === 'node.completed' && typeof n === 'string' && nodes.includes(n) && !seen.has(n)) { seen.add(n); out.push(n); }
+  }
+  return out;
+}
+
+/** Leg 1 — `compensation.requested` precedes the first `compensation.started`, and both are present. */
+export function judgePlanBeforeInverse(log: readonly Ev[]): Finding[] {
+  const ordered = bySeq(log);
+  const requested = ordered.find((e) => e.type === 'compensation.requested');
+  const started = ordered.find((e) => e.type === 'compensation.started');
+  return [
+    f(started !== undefined, 'the fixture commits three effects and then fails on a `node-failure` trigger, so an unwind is owed: the log MUST hold `compensation.started` — it holds none, so no inverse action ever began'),
+    f(requested !== undefined, 'the log MUST hold `compensation.requested` (the plan is durable) before any inverse action executes — it holds none'),
+    f(requested !== undefined && started !== undefined && seqOf(requested) < seqOf(started),
+      `\`compensation.started\` MUST follow \`compensation.requested\` (asyncapi): requested at sequence ${requested === undefined ? 'none' : seqOf(requested)}, first started at ${started === undefined ? 'none' : seqOf(started)}`),
+  ];
+}
+
+/**
+ * Leg 2 — the projection's `attempts[]` names the effect nodes in the reverse of
+ * their forward completion order. Judged on the array order of each node's
+ * first attempt; a retried inverse (a second attempt for the same node) does
+ * not reorder the plan.
+ */
+export function judgeReverseCompletion(forwardOrder: readonly string[], attempts: readonly Attempt[], nodes: readonly string[] = EFFECT_NODES): Finding[] {
+  const expected = [...forwardOrder].reverse();
+  const actual: string[] = [];
+  for (const a of attempts) {
+    if (typeof a.nodeId === 'string' && nodes.includes(a.nodeId) && !actual.includes(a.nodeId)) actual.push(a.nodeId);
+  }
+  return [
+    f(actual.length === nodes.length, `attempts[] MUST name every compensable node (${nodes.join(', ')}) — it names ${actual.length === 0 ? 'none' : actual.join(', ')}`),
+    f(JSON.stringify(actual) === JSON.stringify(expected), `orderingModel reverse-completion: attempts[] MUST run in the reverse of forward completion — forward completed ${forwardOrder.join(' → ')}, so attempts MUST read ${expected.join(', ')}; they read ${actual.join(', ') || '(none)'}`),
+  ];
+}
+
+export interface LedgerSplit {
+  /** Effect nodes with no ledger row at all (forward effect not recorded). */
+  readonly missingForward: readonly string[];
+  readonly forward: ReadonlyMap<string, LedgerRow>;
+  readonly inverse: readonly LedgerRow[];
+}
+
+/** Attribute ledger rows to forward and inverse records (see the module comment). */
+export function splitLedger(rows: readonly LedgerRow[], nodes: readonly string[] = EFFECT_NODES, failNode: string = FAIL_NODE): LedgerSplit {
+  const forward = new Map<string, LedgerRow>();
+  for (const n of nodes) {
+    const mine = rows.filter((r) => r.nodeId === n).sort((a, b) => atOf(a) - atOf(b));
+    const first = mine[0];
+    if (first !== undefined) forward.set(n, first);
+  }
+  const forwardRows = new Set<LedgerRow>(forward.values());
+  return {
+    missingForward: nodes.filter((n) => !forward.has(n)),
+    forward,
+    inverse: rows.filter((r) => !forwardRows.has(r) && r.nodeId !== failNode),
+  };
+}
+
+/**
+ * Leg 3 — exactly one inverse record per forward effect, each performed once.
+ * Call only when `split.missingForward` is empty (otherwise the leg is blocked).
+ * A second record for one inverse (an unstable identity, or a re-execution)
+ * shows as a fourth row or a repeated effect; both fail.
+ */
+export function judgeInverseOnce(split: LedgerSplit, nodes: readonly string[] = EFFECT_NODES): Finding[] {
+  const inv = split.inverse;
+  const ids = new Set(inv.map((r) => String(r.effectId)));
+  const out: Finding[] = [
+    f(inv.length === nodes.length, `the effect ledger MUST hold exactly ${nodes.length} inverse records, one per forward effect — it holds ${inv.length} beyond the forward records: ${JSON.stringify(inv).slice(0, 300)}`),
+    f(ids.size === inv.length, `each inverse effect MUST be performed once — ${inv.length} inverse record(s) carry ${ids.size} distinct effectId(s), so an inverse was recorded more than once`),
+  ];
+  // Where the host records inverses under the forward node's id, the per-node
+  // distribution is observable too; under its own ids it is not, and the count
+  // above is the whole witness.
+  const attributable = inv.filter((r) => typeof r.nodeId === 'string' && nodes.includes(r.nodeId));
+  if (attributable.length === inv.length && inv.length > 0) {
+    for (const n of nodes) {
+      const c = attributable.filter((r) => r.nodeId === n).length;
+      out.push(f(c === 1, `node ${n}'s forward effect MUST have exactly one inverse record — it has ${c}`));
+    }
+  }
+  return out;
+}
+
+/** Leg 4 — the projection agrees with the log: `completed` iff `compensation.completed`; `plan[]` names the effect nodes. */
+export function judgeProjectionAgrees(projection: Projection, log: readonly Ev[], nodes: readonly string[] = EFFECT_NODES): Finding[] {
+  const logged = log.some((e) => e.type === 'compensation.completed');
+  const status = projection.status;
+  const plan = Array.isArray(projection.plan) ? (projection.plan as unknown[]) : [];
+  const planned = [...new Set(plan.map((p) => (isRec(p) ? p['nodeId'] : undefined)).filter((n): n is string => typeof n === 'string'))].sort();
+  const want = [...nodes].sort();
+  return [
+    f((status === 'completed') === logged, `the projection's status MUST be "completed" exactly when the log holds compensation.completed — status is ${JSON.stringify(status)}, the log ${logged ? 'holds' : 'does not hold'} compensation.completed`),
+    f(JSON.stringify(planned) === JSON.stringify(want), `plan[] MUST name the three compensable nodes (${want.join(', ')}) — it names ${planned.length === 0 ? 'none' : planned.join(', ')}`),
+  ];
+}
+
+/**
+ * Leg 5 — the records a replay fork's ledger holds that the parent's never did.
+ * Every such row is newly performed work, and on a replay fork of this fixture
+ * that can only be a re-fired forward or a re-fired inverse. The two are not
+ * separable on the wire: a fork ledger keyed per run, re-firing only the
+ * inverses under the forward nodes' ids, looks exactly like one that re-fired
+ * the forwards. So the judge counts every fresh row; a re-fired forward breaks
+ * the same suppression rule (replay.md §Suppression rule 1) and is not a pass
+ * either. `refiredAttempts` treats a fork row that repeats a parent attempt's
+ * `(nodeId, attempt, at)` as inherited history.
+ */
+export function refiredOnFork(parent: readonly LedgerRow[], fork: readonly LedgerRow[]): LedgerRow[] {
+  return refiredAttempts(parent, fork);
+}

package/src/scenarios/v2-compensation-unwind.test.ts

@@ -0,0 +1,244 @@
+/**
+ * v2 — compensation behavior, witnessed through a failing fixture (RFC 0265;
+ * the rules are `spec/v2/core/security-defaults.md` §Compensation, the
+ * `compensation.*` events in `api/v2/asyncapi.yaml` and
+ * `schemas/v2/compensation-projection.schema.json`).
+ *
+ * `v2-compensation-read-projection` reads the projection on a run with nothing
+ * to unwind. This scenario makes a host unwind. The `conformance-compensate-unwind`
+ * fixture runs three compensable effects (`e1 → e2 → e3`, the conformance-RESERVED
+ * `core.conformance.compensable-effect`) and then a node that fails, under a
+ * `reverse-completion` policy triggered on `node-failure`. The suite causes that
+ * condition unaided and reads the result through normative paths only — the
+ * run's event log, `GET /runs/{runId}/compensation` and `GET /runs/{runId}/effects`.
+ * No seam is involved: the v1 legs (`compensation-behavior`, `compensation-recovery`)
+ * asked a host seam how many effects re-fired, and a host that never compensates
+ * can answer 0.
+ *
+ * One run is shared by every leg (a module-level lazy promise); judges are in
+ * `lib/compensation-unwind.ts`.
+ *   1. `0265.plan-before-inverse` — `compensation.requested` precedes the first
+ *      `compensation.started` in the log (asyncapi: "MUST follow").
+ *   2. `0265.reverse-completion`  — the projection's `attempts[]` names `e3, e2, e1`,
+ *      the reverse of the forward `node.completed` order.
+ *   3. `0265.inverse-once`        — the effect ledger holds exactly three inverse
+ *      records, one per forward effect, each performed once.
+ *   4. `0265.projection-agrees`   — the projection's `status` is `completed` exactly
+ *      when the log holds `compensation.completed`, and `plan[]` names the three
+ *      effect nodes.
+ *   5. `0265.replay-no-refire`    — a `mode: "replay"` fork adds no newly performed
+ *      effect to the fork's ledger (invariant `compensation-replay-no-refire`).
+ *
+ * Dispositions: `compensation` not advertised, or the fixture not listed ⇒
+ * `inapplicable` (every leg). Legs 3 and 5 also need the effect ledger, which
+ * idempotency.md §Witness owes only under `idempotency`; leg 5 needs
+ * `replay.modes ∋ replay` — absent ⇒ `inapplicable`. A run that cannot be
+ * created or finished, a fixture whose effects did not all complete or whose
+ * run did not fail, an unreadable projection or ledger, or a ledger with no
+ * forward record for an effect node (RFC 0265 R1: the host did not map the
+ * reserved node to a ledgered effect) ⇒ `blocked`.
+ *
+ * @see RFCS/0265-compensation-unwind-witness.md
+ * @see spec/v2/core/security-defaults.md §Compensation
+ * @see spec/v2/core/replay.md §Suppression
+ * @see conformance/fixtures.md `conformance-compensate-unwind`
+ */
+
+import { describe, it, expect } from 'vitest';
+import { driver, type OpenWOPResponse } from '../lib/driver.js';
+import { v2Discovery, gateFamily, familyAdvertised } from '../lib/v2.js';
+import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { projectBoundId } from '../lib/bound-id.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { scaledTimeoutMs } from '../lib/polling.js';
+import {
+  EFFECT_NODES, COMPENSATION_TERMINAL,
+  forwardCompletionOrder, judgePlanBeforeInverse, judgeReverseCompletion, splitLedger,
+  judgeInverseOnce, judgeProjectionAgrees, refiredOnFork,
+  type Attempt, type Ev, type Finding, type LedgerRow, type Projection,
+} from '../lib/compensation-unwind.js';
+
+const FIXTURE = 'conformance-compensate-unwind';
+const DOC = 'security-defaults.md §Compensation; asyncapi compensation.*; compensation-projection.schema.json (RFC 0265)';
+const ID_PLAN = 'openwop.requirement.0265.plan-before-inverse';
+const ID_ORDER = 'openwop.requirement.0265.reverse-completion';
+const ID_ONCE = 'openwop.requirement.0265.inverse-once';
+const ID_AGREES = 'openwop.requirement.0265.projection-agrees';
+const ID_REPLAY = 'openwop.requirement.0265.replay-no-refire';
+const RUN_TERMINAL = /^run\.(completed|failed|cancelled)$/;
+
+type Skip = readonly ['inapplicable' | 'blocked', string];
+type Rec = Record<string, unknown>;
+const isRec = (v: unknown): v is Rec => typeof v === 'object' && v !== null && !Array.isArray(v);
+async function http(fn: () => Promise<OpenWOPResponse>): Promise<OpenWOPResponse | null> { try { return await fn(); } catch { return null; } }
+const assertAll = (id: string, fs: readonly Finding[]): void => { for (const x of fs) expect(x.ok, req(id, DOC, x.message)).toBe(true); };
+const seqOf = (e: Ev): number => (typeof e.sequence === 'number' ? e.sequence : Number.NaN);
+
+async function logOf(runId: string): Promise<Ev[]> {
+  const res = await http(() => driver.get(`/runs/${projectBoundId(runId)}/events/poll?timeout=1`));
+  const body = res?.json;
+  const events = isRec(body) ? body['events'] : undefined;
+  return Array.isArray(events) ? (events as Ev[]).filter((e) => Number.isFinite(seqOf(e))).sort((a, b) => seqOf(a) - seqOf(b)) : [];
+}
+
+/**
+ * Poll until the run has a terminal run event and, if an unwind began (or, for
+ * the source run, is owed), a compensation terminal event. The compensation
+ * tail MAY follow the run's terminal event (replay.md §Refusals), so the run
+ * event alone is not the end. On the deadline the log is returned as it stands:
+ * an unwind that never finishes is for the legs to judge, not a reason to skip.
+ */
+async function settle(runId: string, unwindOwed: boolean): Promise<{ log: Ev[] } | { reason: string }> {
+  const deadline = Date.now() + scaledTimeoutMs(30_000);
+  for (;;) {
+    const log = await logOf(runId);
+    const ended = log.some((e) => typeof e.type === 'string' && RUN_TERMINAL.test(e.type));
+    const begun = unwindOwed || log.some((e) => e.type === 'compensation.requested' || e.type === 'compensation.started');
+    const unwound = log.some((e) => typeof e.type === 'string' && COMPENSATION_TERMINAL.has(e.type));
+    if (ended && (!begun || unwound)) return { log };
+    if (Date.now() > deadline) return ended ? { log } : { reason: `run ${runId} logged no terminal run event within the bound (${log.length} event(s))` };
+    await new Promise((r) => setTimeout(r, 250));
+  }
+}
+
+let disc: Promise<Rec | null> | undefined;
+const discovery = (): Promise<Rec | null> => (disc ??= v2Discovery().catch(() => null));
+
+/** The two gates every leg shares: the `compensation` record and the fixture. */
+async function gate(): Promise<Skip | null> {
+  if (!(await discovery())) return ['blocked', 'v2 discovery unreachable — /.well-known/openwop did not answer 200 JSON under OpenWOP-Version: 2.0'];
+  if (!(await gateFamily('compensation'))) return ['inapplicable', 'compensation family not advertised — no obligation (gate recorded under openwop.family.compensation)'];
+  if (!isFixtureAdvertised(FIXTURE)) return ['inapplicable', `the host does not advertise fixture ${FIXTURE} (serving it is OPTIONAL, RFC 0265 §A)`];
+  return null;
+}
+async function ledgerGate(): Promise<Skip | null> {
+  if (!(await familyAdvertised('idempotency'))) return ['inapplicable', 'the host does not advertise idempotency, so it owes no effect ledger (idempotency.md §Witness) and the inverse records cannot be read'];
+  return null;
+}
+
+interface Unwind { readonly runId: string; readonly log: Ev[]; readonly projection: OpenWOPResponse | null }
+
+/** The shared source run: start the fixture, wait out the run and its unwind, read the projection. Asserts nothing. */
+async function drive(): Promise<{ skip: Skip } | { u: Unwind }> {
+  const created = await http(() => driver.post('/runs', { workflowId: FIXTURE }));
+  const createdBody = created?.json;
+  const runId = isRec(createdBody) ? createdBody['runId'] : undefined;
+  if (created === null || created.status !== 201 || typeof runId !== 'string') return { skip: ['blocked', `POST /runs {workflowId: ${FIXTURE}} answered ${created?.status ?? 'nothing'} ${readErrorCode(created?.json) ?? ''}`.trim()] };
+  const s = await settle(runId, true);
+  if ('reason' in s) return { skip: ['blocked', s.reason] };
+  if (!s.log.some((e) => e.type === 'run.failed')) {
+    return { skip: ['blocked', `the ${FIXTURE} run did not end run.failed (its terminal node is core.fail), so the condition an unwind exists for was not caused — the host does not serve the fixture as fixtures.md specifies`] };
+  }
+  const projection = await http(() => driver.get(`/runs/${projectBoundId(runId)}/compensation`));
+  return { u: { runId, log: s.log, projection } };
+}
+let source: Promise<{ skip: Skip } | { u: Unwind }> | undefined;
+const once = (): Promise<{ skip: Skip } | { u: Unwind }> => (source ??= drive());
+
+/** The shared source run's effect ledger, read once after the unwind. */
+let ledger: Promise<{ skip: Skip } | { rows: LedgerRow[] }> | undefined;
+const sourceLedger = (runId: string): Promise<{ skip: Skip } | { rows: LedgerRow[] }> => (ledger ??= (async () => {
+  const res = await http(() => driver.get(`/runs/${projectBoundId(runId)}/effects`));
+  const body = res?.json;
+  const effects = isRec(body) ? body['effects'] : undefined;
+  if (res === null || res.status !== 200 || !Array.isArray(effects)) {
+    return { skip: ['blocked', `GET /runs/{runId}/effects answered ${res?.status ?? 'nothing'} ${readErrorCode(res?.json) ?? ''} — idempotency.md §Witness owns that contract`.trim()] as const };
+  }
+  return { rows: effects as LedgerRow[] };
+})());
+
+function projectionOf(u: Unwind): { body: Projection } | { skip: Skip } {
+  const p = u.projection;
+  const body = p?.json;
+  if (p === null || p.status !== 200 || !isRec(body)) {
+    return { skip: ['blocked', `GET /runs/{runId}/compensation answered ${p?.status ?? 'nothing'} ${readErrorCode(body) ?? ''} on the unwound run — v2-compensation-read-projection owns that obligation`.trim()] };
+  }
+  return { body };
+}
+
+describe('v2 RFC 0265 — compensation unwind through a failing fixture (host)', () => {
+  it('compensation.requested precedes the first compensation.started', async () => {
+    const g = await gate();
+    if (g) return softSkip(...g);
+    const s = await once();
+    if ('skip' in s) return softSkip(...s.skip);
+    assertAll(ID_PLAN, judgePlanBeforeInverse(s.u.log));
+  }, 120_000);
+
+  it('the projection attempts the effect nodes in the reverse of their forward completion order', async () => {
+    const g = await gate();
+    if (g) return softSkip(...g);
+    const s = await once();
+    if ('skip' in s) return softSkip(...s.skip);
+    const forward = forwardCompletionOrder(s.u.log);
+    if (forward.length !== EFFECT_NODES.length) {
+      return softSkip('blocked', `the log holds a forward node.completed for ${forward.join(', ') || 'none'} of ${EFFECT_NODES.join(', ')}, so there is no forward completion order to reverse`);
+    }
+    const p = projectionOf(s.u);
+    if ('skip' in p) return softSkip(...p.skip);
+    const attempts = Array.isArray(p.body.attempts) ? (p.body.attempts as Attempt[]) : [];
+    assertAll(ID_ORDER, judgeReverseCompletion(forward, attempts));
+  }, 120_000);
+
+  it('the effect ledger holds exactly one inverse record per forward effect', async () => {
+    const g = (await gate()) ?? (await ledgerGate());
+    if (g) return softSkip(...g);
+    const s = await once();
+    if ('skip' in s) return softSkip(...s.skip);
+    const l = await sourceLedger(s.u.runId);
+    if ('skip' in l) return softSkip(...l.skip);
+    const split = splitLedger(l.rows);
+    if (split.missingForward.length > 0) {
+      return softSkip('blocked', `the effect ledger has no record for ${split.missingForward.join(', ')}: the forward effects are absent too, so the host did not map core.conformance.compensable-effect to a ledgered effect (RFC 0265 §A, risk R1) and the inverse count cannot be measured`);
+    }
+    assertAll(ID_ONCE, judgeInverseOnce(split));
+  }, 120_000);
+
+  it('the projection status and plan agree with the event log', async () => {
+    const g = await gate();
+    if (g) return softSkip(...g);
+    const s = await once();
+    if ('skip' in s) return softSkip(...s.skip);
+    const p = projectionOf(s.u);
+    if ('skip' in p) return softSkip(...p.skip);
+    assertAll(ID_AGREES, judgeProjectionAgrees(p.body, s.u.log));
+  }, 120_000);
+
+  it('a replay fork of the unwound run performs no inverse again', async () => {
+    const g = (await gate()) ?? (await ledgerGate());
+    if (g) return softSkip(...g);
+    const replay = await familyAdvertised('replay');
+    if (!replay || !(Array.isArray(replay['modes']) && replay['modes'].includes('replay'))) return softSkip('inapplicable', 'replay.modes does not list replay, so no replay fork can be requested');
+    const s = await once();
+    if ('skip' in s) return softSkip(...s.skip);
+    const l = await sourceLedger(s.u.runId);
+    if ('skip' in l) return softSkip(...l.skip);
+    const split = splitLedger(l.rows);
+    if (split.missingForward.length > 0 || split.inverse.length === 0) {
+      return softSkip('blocked', `the source run's ledger records ${split.missingForward.length > 0 ? `no forward effect for ${split.missingForward.join(', ')}` : 'no inverse effect'}, so a fork that also records none would compare nothing against nothing (RFC 0265 R1)`);
+    }
+    const first = s.u.log[0];
+    if (first === undefined) return softSkip('blocked', 'the source run logged no event to fork from');
+    const forked = await http(() => driver.post(`/runs/${projectBoundId(s.u.runId)}:fork`, { mode: 'replay', fromSeq: first.sequence }));
+    const forkedBody = forked?.json;
+    const forkId = isRec(forkedBody) ? forkedBody['runId'] : undefined;
+    if (forked === null || forked.status !== 201 || typeof forkId !== 'string') {
+      return softSkip('blocked', `POST /runs/{runId}:fork {mode: replay} answered ${forked?.status ?? 'nothing'} ${readErrorCode(forked?.json) ?? ''} on the unwound run`.trim());
+    }
+    const settled = await settle(forkId, false);
+    if ('reason' in settled) return softSkip('blocked', settled.reason);
+    const forkLedger = await http(() => driver.get(`/runs/${projectBoundId(forkId)}/effects`));
+    const forkLedgerBody = forkLedger?.json;
+    const forkRows = isRec(forkLedgerBody) ? forkLedgerBody['effects'] : undefined;
+    if (forkLedger === null || forkLedger.status !== 200 || !Array.isArray(forkRows)) {
+      return softSkip('blocked', `GET /runs/{runId}/effects answered ${forkLedger?.status ?? 'nothing'} on the replay fork`);
+    }
+    const refired = refiredOnFork(l.rows, forkRows as LedgerRow[]);
+    expect(
+      refired.length,
+      req(ID_REPLAY, 'replay.md §Suppression; invariant compensation-replay-no-refire (RFC 0265 §B.5)', `a mode: "replay" fork MUST NOT perform an inverse action again — the fork's effect ledger records ${refired.length} effect(s) the source run never made: ${JSON.stringify(refired).slice(0, 300)}`),
+    ).toBe(0);
+  }, 180_000);
+});