@openwop/spec-artifacts 2.42.6 → 2.42.8

package/spec/v2/core/persistence.md

@@ -1,6 +1,6 @@
 # Persistence and Coexistence
 
-> **Status: Stable · RFC 0176 (§A–§B, §D–§E), 0171 §A, 0170 §A.3, 0158 §A–§D.**
+> **Status: Stable.**
 > **Normative home:** `eventLog`.
 
 ## Why this exists
@@ -9,11 +9,16 @@ How a v2 host reads what a v1 host wrote, what happens to a run in flight at the
 
 ## The codemap is data
 
-`spec/v2/event-codemap.json`, shipped in `@openwop/spec-artifacts`, is the only authority for the v1→v2 event-type mapping; every row is `decided` (RFC 0171 §A). A host MUST NOT carry a private mapping. A vendor-prefixed v1 type the codemap does not name MUST be read under its own name unchanged, where "vendor-prefixed" means the first segment is an org registered in the `extensions` object of `spec/v2/declaration.json` (events.md §Rules; RFC 0171 §A.1 — `openwop.` is the only reserved prefix). An unregistered first segment is not a vendor prefix and falls to the refusal below. An org is registered by pull request against the corpus and takes effect on the `@openwop/spec-artifacts` release that carries it; a shipped entry is append-only, because deregistering an org would convert every log already written under it from pass-through to refusal (RFC 0180).
+`spec/v2/event-codemap.json`, shipped in `@openwop/spec-artifacts`, is the only authority for the v1→v2 event-type mapping. Every row is `decided`.
+
+- A host MUST NOT carry a private mapping.
+- A vendor-prefixed v1 type the codemap does not name MUST be read under its own name, unchanged.
+- "Vendor-prefixed" means the first segment is an org registered in the `extensions` object of `spec/v2/declaration.json` ([events.md §Rules](events.md)). `openwop.` is the only reserved prefix. An unregistered first segment is not a vendor prefix and falls to the refusal in §"The reader rule".
+- An org is registered by pull request against the corpus and takes effect on the `@openwop/spec-artifacts` release that carries it. A shipped entry is append-only: deregistering an org would turn every log already written under it from pass-through into refusal.
 
 ## The era key
 
-`eventLogSchemaVersion` is the era key and is required on every run snapshot (`schemas/v2/run-snapshot.schema.json`).
+`eventLogSchemaVersion` is the era key. It is required on every run snapshot (`schemas/v2/run-snapshot.schema.json`).
 
 | Value | Meaning |
 | --- | --- |
@@ -24,112 +29,92 @@ How a v2 host reads what a v1 host wrote, what happens to a run in flight at the
 
 Discovery MUST advertise the value the host writes for new runs and nothing else; a host MUST hold one constant for this axis.
 
-**Absent stays era `2` forever; it is never backfilled.** A host MUST NOT rewrite
-historical rows to add an explicit `2`, and a reader MUST NOT require one. A host with more than one creation
-path MUST begin stamping `3` on **all** of them in the same change: an unstamped
-path's runs read as era `2`, a silent wrong read.
+Absent stays era `2` forever; it is never backfilled.
+
+- A host MUST NOT rewrite historical rows to add an explicit `2`, and a reader MUST NOT require one.
+- A host with more than one creation path MUST begin stamping `3` on all of them in the same change. An unstamped path's runs read as era `2` — a silent wrong read.
 
-**The snapshot field is required on the wire, and MAY be synthesized.**
-For an era-`2` run with nothing stored, the host MUST supply `2` from the
-absent-⇒-`2` rule rather than fail the read. The field therefore cannot falsify
-era handling on its own; the reader and writer rules below carry the obligation.
+The snapshot field is required on the wire, and MAY be synthesized: for an era-`2` run with nothing stored, the host MUST supply `2` from the absent-⇒-`2` rule rather than fail the read. The field alone therefore cannot falsify era handling; the reader and writer rules carry the obligation.
 
 ## The `eventLog` family
 
-`eventLog` is the capability record by which a host advertises the era contract
-above. A host that advertises `eventLog` MUST stamp `eventLogSchemaVersion` on
-every run it creates, MUST serve the cursor contract in events.md §"Poll" over
-that log, and MUST NOT emit an event `type` the codemap does not name. The
-record carries no separate storage claim: it asserts that the era key, the
-codemap and the poll cursor are implemented as written here, which is why its
-floor scenarios are the era-key and cursor witnesses rather than tests of a
-surface of its own. Its `crossEngineOrdering` facet is a replay property and is
-normed in replay.md §"Cross-engine ordering".
+`eventLog` is the capability record by which a host advertises the era contract above. A host that advertises `eventLog`:
+
+- MUST stamp `eventLogSchemaVersion` on every run it creates;
+- MUST serve the cursor contract of [events.md §"Poll"](events.md) over that log;
+- MUST NOT emit an event `type` the codemap does not name.
+
+The record carries no separate storage claim: it asserts that the era key, the codemap and the poll cursor are implemented as written here. Its `crossEngineOrdering` facet is a replay property, specified in [replay.md §"Cross-engine ordering"](replay.md).
 
 ## The reader rule
 
 A v2 host reading a run in era `2` MUST translate every event through the codemap at the storage boundary:
 
-- `type` is mapped; the payload is projected per RFC 0171 §B.
+- `type` is mapped, and the payload projected with it.
 - `sequence` MUST be preserved verbatim, including `0`.
 - `eventId`, `timestamp`, `causationId`, and vendor fields pass through.
-- A type the codemap does not name and that carries no reserved vendor prefix MUST fail the read with `event_type_unmapped` (`spec/v2/errors.json`, `500`). A malformed row MUST fail the read rather than default any field.
+- A type the codemap does not name and that carries no reserved vendor prefix MUST fail the read with `event_type_unmapped` (`spec/v2/errors.json`, `500`).
+- A malformed row MUST fail the read rather than default any field.
+
+The rule binds every reader: poll, SSE, fork, replay divergence, debug bundle, summary memory.
 
-The rule binds every reader: poll, SSE, fork, replay divergence, debug bundle, summary memory. The translation is a read projection. A host MUST NOT rewrite era-`2` rows in place; a background backfill that stamps `3` and rewrites `type` under the same `(runId, sequence)` key is permitted only as an atomic per-run operation with the original preserved, because the fork prefix must stay byte-equivalent to the translated parent (replay.md, RFC 0041 §C).
+The translation is a read projection. A host MUST NOT rewrite era-`2` rows in place. The one exception is a background backfill that stamps `3` and rewrites `type` under the same `(runId, sequence)` key: it is permitted only as an atomic per-run operation with the original preserved, because the fork prefix must stay byte-equivalent to the translated parent ([replay.md](replay.md)).
 
 ### The writer rule
 
-The era key is fixed when the run is created and fixes the log's vocabulary for
-the run's lifetime. An append to a run in era `2` MUST use v1 vocabulary — the
-name the codemap maps *from*, not the v2 name it maps to. A host that upgrades
-mid-flight MUST NOT begin writing v2 names into a log the reader translates as
-era `2`: the reader would map an already-mapped name a second time, or fail the
-read with `event_type_unmapped` on a name the codemap does not carry on its v1
-side. A run created after the upgrade is era `3` and is written in v2
-vocabulary, untranslated.
+The era key is fixed when the run is created and fixes the log's vocabulary for the run's lifetime.
 
-A writer that emits a property a closed def cannot seat (RFC 0185 §B) MUST
-mark the row with what it could not seat, so the refusal names the writer
-instead of surfacing as an unexplained read failure (RFC 0187 §D.1).
+- An append to a run in era `2` MUST use v1 vocabulary — the name the codemap maps *from*, not the v2 name it maps to.
+- A host that upgrades mid-flight MUST NOT begin writing v2 names into a log the reader translates as era `2`. The reader would map an already-mapped name a second time, or fail with `event_type_unmapped` on a name absent from the codemap's v1 side.
+- A run created after the upgrade is era `3` and is written in v2 vocabulary, untranslated.
+- A writer that emits a property a closed def cannot seat MUST mark the row with what it could not seat, so the refusal names the writer instead of surfacing as an unexplained read failure.
 
-This binds every writer for as long as an era-`2` run stays open (§"Runs pinned
-to v1"); its witness is `v2-era-2-append-vocabulary`.
+This binds every writer for as long as an era-`2` run stays open (§"Runs pinned to v1"). Its witness is `v2-era-2-append-vocabulary`.
 
 ### The v1 wire of an era-`3` log
 
-Through the overlap (`versioning.md` §5) an era-`3` log, stored in v2
-vocabulary, must still read on `/v1/…` exactly as before the cut.
+Through the overlap ([versioning.md §5](versioning.md)), an era-`3` log, stored in v2 vocabulary, must still read on `/v1/…` exactly as before the cut. A host serving both majors:
 
-A host serving both majors MUST therefore map an era-`3` log's `type` back to
-its v1 spelling on the v1 read path, through the **same codemap row, inverted**.
-The inverse is exact only while `spec/v2/event-codemap.json` is a bijection; a
-host MUST verify that at load and, if a row folds two v1 names onto one v2 name,
-MUST refuse to serve the v1 representation rather than guess a spelling.
-
-A type with NO codemap row — v2-only vocabulary, anything RFC 0185/0186 seated
-— has no v1 spelling to invert to. A host MUST emit it unchanged on the v1 read
-path, MUST NOT drop the row, and MUST NOT refuse the read for it (RFC 0187
-§B.1).
+- MUST map an era-`3` log's `type` back to its v1 spelling on the v1 read path, through the same codemap row, inverted.
+- MUST verify at load that `spec/v2/event-codemap.json` is a bijection, since only then is the inverse exact. If a row folds two v1 names onto one v2 name, the host MUST refuse to serve the v1 representation rather than guess a spelling.
+- MUST emit a type with no codemap row (v2-only vocabulary, which has no v1 spelling) unchanged on the v1 read path, MUST NOT drop the row, and MUST NOT refuse the read for it.
 
 ### The seat
 
-The adapter MUST sit at the storage boundary every reader passes through — the storage interface's event-list method, not a wrapper some call sites bypass. A host leg MUST name its seat in its ADR.
+- The adapter MUST sit at the storage boundary every reader passes through — the storage interface's event-list method, not a wrapper some call sites bypass.
+- A host leg MUST name its seat in its ADR.
 
-The seat is a **claims-check** (conformance.md §Witness class): discharged by that disclosure and by audit, never by the wire. The rule binds **every** reader, including the ones the suite has no name for; `run-event.schema.json` records why three passing legs do not discharge it.
+The seat is a claims-check ([conformance.md §Witness class](conformance.md)): it is discharged by that disclosure and by audit, never by the wire. It binds every reader, including ones the suite has no name for; `run-event.schema.json` records why passing legs do not discharge it.
 
 ## Runs pinned to v1
 
 A non-terminal run a v2 host inherits carries `version.pinned` events naming change ids. The host MUST continue it or cancel it, never follow a pin silently.
 
-| Condition | Requirement |
-| --- | --- |
-| Every pinned change id is still implemented | The run MUST continue under the reader rule; the pin is honored verbatim and `version.pinned` is never rewritten. |
-| Any pinned change id is no longer implemented | The host MUST cancel the run with `run.cancelled` reason `v1_pin_unsupported` and `cancelledBy: "v2-cutover"`; the certification bundle reports the count. |
-| Suspended on an interrupt at the cut | The run continues under the row above; its token drains per §"Everything else a v1 host persisted". |
+- **Every pinned change id is still implemented** — the run MUST continue under the reader rule. The pin is honored verbatim and `version.pinned` is never rewritten.
+- **Any pinned change id is no longer implemented** — the host MUST cancel the run with `run.cancelled` reason `v1_pin_unsupported` and `cancelledBy: "v2-cutover"`. The certification bundle reports the count.
+- **Suspended on an interrupt at the cut** — the run continues under the rules above; its token drains per §"Everything else a v1 host persisted".
 
-"Drain" is retired as the only path. Multi-region skew is read-side only: after the cut a v2 region MUST NOT accept an era-`2` write for a run it has already stamped `3` (RFC 0176 §B.3). Discovery's `minClientVersion` rule is RFC 0172 row `C5.8`.
+Multi-region skew is read-side only: after the cut, a v2 region MUST NOT accept an era-`2` write for a run it has already stamped `3`. Discovery's `minClientVersion` rule is in [versioning.md §1.5](versioning.md).
 
 ## Everything else a v1 host persisted
 
-| Artifact | Requirement |
-| --- | --- |
-| Certification bundles | Never upgraded. A v1 bundle substantiates no new certification after 2026-11-10; every host produces a fresh v2-rc bundle before the cut (conformance.md). |
-| Webhook deliveries | Dual-emitted, and queued deliveries drained, per webhooks.md §"Dual emission through the overlap". |
-| Interrupt resume tokens | Drained: a token that is **not** `ow2.`-prefixed is a v1 token and resolves under `kid: legacy` until `expiresAt`; new tokens carry the `ow2.` prefix (identity.md). The rule is written over the prefix, never a segment count. |
-| Layer-1 and Layer-2 records (idempotency, idempotent responses, invocation claims and logs, effect-escape ledger, dispatch outbox, envelope correlations) | Unchanged; keyed on ids the cut does not rename. `GET /runs/{runId}/effects` and `GET /runs/{runId}/compensation` are new reads over them (security-defaults.md). |
-| Owner stamps | A run without a Subject MUST be legacy-stamped at first v2 read and MUST NOT be rewritten later (RFC 0170 §A.3). A host's stored owner fields are projected to the Subject; the projection is the host's to name. |
-| Audit log | Never upgraded (RFC 0170). |
+- **Certification bundles** — never upgraded. A v1 bundle substantiates no new certification after 2026-11-10; every host produces a fresh v2-rc bundle before the cut ([conformance.md](conformance.md)).
+- **Webhook deliveries** — dual-emitted, and queued deliveries drained, per [webhooks.md §"Dual emission through the overlap"](webhooks.md).
+- **Interrupt resume tokens** — drained. A token that is not `ow2.`-prefixed is a v1 token and resolves under `kid: legacy` until `expiresAt`; new tokens carry the `ow2.` prefix ([identity.md](identity.md)). The rule is written over the prefix, never a segment count.
+- **Layer-1 and Layer-2 records** (idempotency, idempotent responses, invocation claims and logs, effect-escape ledger, dispatch outbox, envelope correlations) — unchanged; keyed on ids the cut does not rename. `GET /runs/{runId}/effects` and `GET /runs/{runId}/compensation` are new reads over them ([security-defaults.md](security-defaults.md)).
+- **Owner stamps** — a run without a Subject MUST be legacy-stamped at first v2 read and MUST NOT be rewritten later. A host's stored owner fields are projected to the Subject; the projection is the host's to name.
+- **Audit log** — never upgraded.
 
 ## Per-store disposition
 
-A host's ADR MUST name every store it persists and give each one disposition from the closed set below.
+A host's ADR MUST name every store it persists and give each one disposition from the closed set below. A host MUST NOT decide a store's disposition during the migration.
 
 | Disposition | Meaning |
 | --- | --- |
 | `unchanged` | Rows keep their shape and keys; a v2 reader consumes them as they are. |
-| `translated` | Rows are read through the codemap at the storage boundary; never rewritten in place except the atomic per-run backfill. |
-| `drained` | Rows complete under their own v1 contract until exhausted or expired; no new rows of the v1 shape are written. |
-| `legacy-stamped` | A missing v2 field is given its legacy value at first v2 read and never rewritten. |
+| `translated` | Read through the codemap at the storage boundary; rewritten in place only by the atomic per-run backfill. |
+| `drained` | Rows complete under their own v1 contract until exhausted or expired; no new v1-shaped rows are written. |
+| `legacy-stamped` | A missing v2 field gets its legacy value at first v2 read and is never rewritten. |
 | `never-upgraded` | Rows remain v1 evidence only; v2 evidence is produced fresh. |
 | `not-persisted` | Nothing to migrate. |
 
@@ -146,20 +131,16 @@ Template — one row per store:
 | certification bundles | v1 bundles | `never-upgraded` |
 | host-internal tables | outside the wire | `unchanged` |
 
-The reference hosts' dispositions are recorded in RFC 0176; a host MUST NOT decide a store's disposition during the migration.
-
 ## Durable acceptance and recovery
 
-RFC 0158 §A–§D.
+- **Acceptance** — a host that returns success for work it accepted MUST have made the intent to perform it durable in the same transaction as the work record. A wakeup, hint, or in-process dispatch MUST NOT be the only record. The host MUST resume accepted-but-unstarted work after the accepting process dies, without client action.
+- **Liveness** — a host MUST distinguish how long a unit of work may legitimately run from the interval in which a live worker demonstrates liveness, and MUST NOT use the duration bound as the sole liveness signal.
+- **Recovery bound** — a host MUST declare the longest interval between an instance ceasing to make progress and another becoming eligible to resume its work. It MUST derive the bound from the mechanism that enforces it: one bound per enforcing mechanism, never a single aggregate. Any length is conformant; an undeclared or unenforced bound is not.
+- **Duplicates** — duplicate delivery of accepted work MUST NOT produce duplicate external effects. The host MUST dedupe on an identity that survives redelivery ([idempotency.md](idempotency.md)).
+- **Poison work** — work that fails deterministically MUST reach a terminal, operator-visible state within a bounded number of attempts.
 
-| Clause | Requirement |
-| --- | --- |
-| Acceptance (§A) | A host that returns success for work it accepted MUST have made the intent to perform it durable in the same transaction as the work record; a wakeup, hint, or in-process dispatch MUST NOT be the only record. It MUST resume accepted-but-unstarted work after the accepting process dies, without client action. |
-| Liveness (§B.3) | A host MUST distinguish how long a unit of work may legitimately run from the interval in which a live worker demonstrates liveness, and MUST NOT use the duration bound as the sole liveness signal. |
-| Recovery bound (§B.4–6) | A host MUST declare the longest interval between an instance ceasing to make progress and another becoming eligible to resume its work, and MUST derive it from the mechanism that enforces it — one bound per enforcing mechanism, never a single aggregate. Any length is conformant; an undeclared or unenforced bound is not. |
-| Duplicates (§C.7) | Duplicate delivery of accepted work MUST NOT produce duplicate external effects; the host MUST dedupe on an identity that survives redelivery (idempotency.md). |
-| Poison work (§C.8) | Work that fails deterministically MUST reach a terminal, operator-visible state within a bounded number of attempts. |
+A host MAY claim a qualification rung (`durable-single-instance`, `durable-multi-instance`, `multi-region-qualified`; cumulative) only with the evidence [RFC 0158 §D](https://github.com/openwop/openwop/blob/main/RFCS/0158-durable-execution-and-disaster-recovery-qualification.md) names for it, and MUST NOT claim one from tests in which no process was terminated. A rung is evidence, not a capability: discovery carries none, and the certification bundle publishes the rung and its bounds ([conformance.md §Bundle v3](conformance.md)).
 
-A host MAY claim a qualification rung (`durable-single-instance`, `durable-multi-instance`, `multi-region-qualified`; cumulative) only with the evidence named for it, and MUST NOT claim one from tests in which no process was terminated (§D.9). A rung is evidence, not a capability: discovery carries none, and the rung and its bounds are published in the certification bundle (conformance.md §Bundle v3).
+See also: [overview.md](overview.md), [events.md](events.md), [replay.md](replay.md), [identity.md](identity.md), [webhooks.md](webhooks.md).
 
-See also: overview.md, events.md, replay.md, identity.md, webhooks.md.
+*Sources: RFC 0041, RFC 0158, RFC 0170, RFC 0171, RFC 0172, RFC 0176, RFC 0180, RFC 0185, RFC 0186, RFC 0187.*

package/spec/v2/core/portability.md

@@ -0,0 +1,44 @@
+# Portability
+
+> **Status: Stable.**
+> **Normative home:** `portability`.
+
+## Why this exists
+
+A tenant's reusable estate moves between hosts as one export bundle, and lands on the destination under the importing caller's identity. This document states the bundle and the rules an importer follows. An adapter that turns another platform's export into a bundle is host tooling.
+
+## The export bundle
+
+An `ExportBundle` (`schemas/v2/export-bundle.schema.json`) carries `bundleVersion: "2"`, a `source` (its origin and an informational `originPrincipal`) and `items[]`. Each item has:
+
+- a `kind`: `agent`, `pack`, `prompt-template`, `connection-ref`, `schedule`, `roster` or `org-chart`;
+- a bundle-local `ref` and optional `dependsOn` edges;
+- a `payload` shaped by that kind's own schema.
+
+## The `portability` record
+
+- **`export`** — the host emits a bundle for the caller's tenant or workspace, optionally limited to some `kinds`.
+- **`import`** — the host applies a bundle.
+- **`kinds`** — the item kinds the host exports and imports.
+- **`dryRun`** — import offers a plan preview that writes nothing. A host advertising `import` MUST advertise `dryRun: true`.
+
+## Import rules
+
+- **No credential material.** A bundle MUST NOT contain credential values: a `connection-ref` item carries only references and provider ids. The importer MUST report unbound references in `secretsToRebind` and MUST NOT invent or transfer secret material. A host MUST reject with `422` an imported bundle whose payload carries a literal credential value.
+- **Dry run.** When `import` is advertised, import MUST offer a dry run. A dry run MUST NOT write, and MUST return the plan it would execute: creates, updates, skips, conflicts and unbound credential references.
+- **Idempotent.** Import MUST be idempotent: re-applying a bundle resolves each item to `skipped` or `updated`, never to a duplicate create.
+- **Ordered.** Items MUST be applied in `dependsOn` topological order. A cycle is a `422`.
+- **Re-owned.** Every imported entity MUST be re-owned to the caller's Subject at the destination ([identity.md](identity.md) §1). `source.originPrincipal` is informational and MUST NOT grant any access. Host-scoped handles are re-minted as [identity.md](identity.md) §5 requires.
+- **Executable behavior.** An imported agent or pack that is executable behavior SHOULD pass through the host's install policy ([RFC 0043](https://github.com/openwop/openwop/blob/main/RFCS/0043-registry-and-extension-policy.md)), and MAY be staged as a proposal ([RFC 0096](https://github.com/openwop/openwop/blob/main/RFCS/0096-reviewable-learning-skill-proposal-lifecycle.md)) instead of being activated.
+
+Applying an import returns an outcome per item — `created`, `updated`, `skipped` or `failed` — plus `secretsToRebind`.
+
+## The `import.applied` event
+
+An applied import emits `import.applied` (`schemas/v2/run-event-payloads.schema.json`). A host MUST NOT emit it unless it advertises `portability`. It carries counts and references only, never item payloads or secret values.
+
+## Routes
+
+No protocol path is defined for export or import: a host serves them on routes of its own. A host-private migration from an anonymous sandbox into a signed-in tenant fits this contract, because its response is a subset of the import outcome.
+
+*Sources: RFC 0043, RFC 0096, RFC 0098.*

package/spec/v2/core/replay.md

@@ -1,6 +1,6 @@
 # Replay and Fork
 
-> **Status: Stable · RFC 0140, 0041, 0173 §C, 0176 §A.5.**
+> **Status: Stable.**
 > **Normative home:** `eventLog`, `replay`, `nondeterminismPolicy`.
 
 ## Why this exists
@@ -9,14 +9,23 @@
 
 ## The surface
 
-A host that advertises `replay` (capabilities.md) serves `forkRun` (`api/v2/openapi.yaml`, `POST /runs/{runId}:fork`) and `getEffectSeamManifest` (`GET /host/effect-seams`). The `replay` facet (`spec/v2/facets/replay.schema.json`) is `{ modes[], retention?, effectSeamsManifest }`; `modes` enumerates `replay | branch` (the `forkRun` `mode` values); `effectSeamsManifest` is the constant `/host/effect-seams`. There is no `sideEffectSuppression` field: suppression is the only conforming replay behavior (RFC 0173 §B, row `C6.2`) and `none` is not a value.
+A host that advertises `replay` ([capabilities.md](capabilities.md)) serves `forkRun` (`api/v2/openapi.yaml`, `POST /runs/{runId}:fork`) and `getEffectSeamManifest` (`GET /host/effect-seams`).
 
-The request body, `fromSeq` defaults and `201` response are runs.md §Fork. Events with `sequence < fromSeq` are fixed history; events `>= fromSeq` are re-executed.
+The `replay` facet (`spec/v2/facets/replay.schema.json`) is `{ modes[], retention?, effectSeamsManifest }`:
 
-| Rule | Requirement |
-| --- | --- |
-| `fromSeq` out of range | `400`; a sequence absent from the source log is `422`. A `fromSeq` greater than the sequence of the source run's terminal run event MUST be refused `422 fork_point_invalid` — the fork would inherit a terminal event and then execute (RFC 0194 §C; binds only where a compensation tail follows the terminal event). |
-| Source run not visible to the caller | `404`. |
+- `modes` enumerates `replay | branch` (the `forkRun` `mode` values);
+- `effectSeamsManifest` is the constant `/host/effect-seams`.
+
+Suppression is the only conforming replay behavior; no field turns it off, and `none` is not a value.
+
+The request body, `fromSeq` defaults and `201` response are [runs.md §Fork](runs.md). Events with `sequence < fromSeq` are fixed history; events `>= fromSeq` are re-executed.
+
+Refusals:
+
+- `fromSeq` out of range — `400`.
+- A sequence absent from the source log — `422`.
+- A `fromSeq` greater than the sequence of the source run's terminal run event MUST be refused `422 fork_point_invalid`: the fork would inherit a terminal event and then execute. This binds only where a compensation tail follows the terminal event.
+- Source run not visible to the caller — `404`.
 
 ## Modes
 
@@ -26,13 +35,13 @@ The request body, `fromSeq` defaults and `201` response are runs.md §Fork. Even
 
 ## Byte-equivalence of the prefix
 
-The replay contract is observable-output-sequence determinism, not bit-equivalent execution (RFC 0041 §C):
+The replay contract is observable-output-sequence determinism, not bit-equivalent execution:
 
-1. The events at indices `[0, fromSeq)` MUST be byte-equivalent between source and replay, modulo per-region clock fields (RFC 0036 §E) and ULID time-component entropy when ULIDs are minted fresh. The event at `fromSeq` is governed by §Divergence.
+1. The events at indices `[0, fromSeq)` MUST be byte-equivalent between source and replay, modulo per-region clock fields and ULID time-component entropy when ULIDs are minted fresh. The event at `fromSeq` is governed by §Divergence.
 2. `variables`, `channels`, and `status` of the run snapshot at each index in that range MUST be byte-equivalent.
 3. The bytes on the wire of underlying tool and LLM calls MAY differ, provided the observable state at each index is byte-equivalent.
 
-A host MUST cache the observable result (return value, workflow-state effects, emitted events), not merely the tool-call boundary. The cache key for LLM-calling nodes is the RFC 0041 content-addressed key; for other tool-calling nodes it MUST be content-addressable, never a host-internal sequence number or timestamp.
+A host MUST cache the observable result (return value, workflow-state effects, emitted events), not merely the tool-call boundary. The cache key for LLM-calling nodes is the content-addressed invocation key defined in [RFC 0041](https://github.com/openwop/openwop/blob/main/RFCS/0041-multi-agent-replay-under-nondeterminism.md); for other tool-calling nodes it MUST be content-addressable, never a host-internal sequence number or timestamp.
 
 ## Determinism caveats (`replay` mode)
 
@@ -40,23 +49,27 @@ A host MUST cache the observable result (return value, workflow-state effects, e
 2. `ctx.interrupt(K)` MUST short-circuit to the persisted `interrupt.resolved` value.
 3. `ctx.getVersion` pins from the source run are fixed history; the replay MUST take the recorded branch.
 4. Nodes MUST consume time via `ctx.now()` where available; direct clock reads make replay non-deterministic.
-5. Recorded-fact events such as `memory.written` (RFC 0057) are fixed history. A replay MUST re-emit them verbatim from the log and MUST NOT regenerate their identifiers or timestamps — never a new `memoryId`. A `branch` MAY perform its own memory writes with fresh identifiers.
-6. Approver eligibility recorded on a resume event is fixed history; a host MUST NOT re-resolve membership during replay (RFC 0104).
+5. Recorded-fact events such as `memory.written` are fixed history. A replay MUST re-emit them verbatim from the log and MUST NOT regenerate their identifiers or timestamps — never a new `memoryId`. A `branch` MAY perform its own memory writes with fresh identifiers.
+6. Approver eligibility recorded on a resume event is fixed history; a host MUST NOT re-resolve membership during replay.
 
 ## Divergence
 
-When a replayed node produces an event different from the source at the same sequence, the host MUST continue, MUST emit `replay.diverged` `{ originalEventId, replayEventId, divergencePoint }`, and MUST surface it in `debug` stream mode and as OTel attribute `openwop.replay.diverged: true`.
+When a replayed node produces an event different from the source at the same sequence, the host:
 
-| Code (`spec/v2/errors.json`) | Where | Condition |
-| --- | --- | --- |
-| `replay_diverged_at_refusal` | fork fails, `409` | The source obtained a valid envelope and the replay a refusal, or the reverse. The host MUST NOT substitute silently; it MUST emit `replay.diverged-at-refusal` naming the node and both envelope kinds and fail the replay with this code (RFC 0041 §B). |
-| `replay_source_missing` | `node.failed` payload; the fork request still returns `201` | A side-effecting node reached with no recorded source outcome for `(nodeId, attempt)` (§Suppression). |
-| `replay_memory_snapshot_unavailable` | fork refused, `409` | The host cannot serve memory state as-of `fromSeq`. It MUST refuse rather than substitute current memory; `details.fromSeq` SHOULD name the index (RFC 0039 §B). |
-| `replay_context_summary_unavailable` | fork refused, `409` | The host advertises `multiAgent.executionModel.contextBudget.summarization` and cannot serve, as-of `fromSeq`, a summary artifact (`context.summarized.summaryRef`) the replay would reuse. It MUST refuse rather than re-summarize; `details.fromSeq` SHOULD name the index (RFC 0111). |
+- MUST continue;
+- MUST emit `replay.diverged` `{ originalEventId, replayEventId, divergencePoint }`;
+- MUST surface it in `debug` stream mode and as OTel attribute `openwop.replay.diverged: true`.
+
+Divergence codes (`spec/v2/errors.json`):
+
+- **`replay_diverged_at_refusal`** (fork fails, `409`) — the source obtained a valid envelope and the replay a refusal, or the reverse. The host MUST NOT substitute silently; it MUST emit `replay.diverged-at-refusal` naming the node and both envelope kinds and fail the replay with this code.
+- **`replay_source_missing`** (`node.failed` payload; the fork request still returns `201`) — a side-effecting node reached with no recorded source outcome for `(nodeId, attempt)` (§Suppression).
+- **`replay_memory_snapshot_unavailable`** (fork refused, `409`) — the host cannot serve memory state as-of `fromSeq`. It MUST refuse rather than substitute current memory; `details.fromSeq` SHOULD name the index.
+- **`replay_context_summary_unavailable`** (fork refused, `409`) — the host advertises `multiAgent.executionModel.contextBudget.summarization` and cannot serve, as-of `fromSeq`, a summary artifact (`context.summarized.summaryRef`) the replay would reuse. It MUST refuse rather than re-summarize; `details.fromSeq` SHOULD name the index.
 
 ## Suppression
 
-Suppression is an obligation of the `replay` surface (RFC 0173 §A.1, §B): advertising `replay` binds it, and a host that cannot suppress MUST NOT advertise `replay`. A relaxation is an operator setting recorded in the certification bundle (security-defaults.md).
+Suppression is an obligation of the `replay` surface: advertising `replay` binds it, and a host that cannot suppress MUST NOT advertise `replay`. A relaxation is an operator setting recorded in the certification bundle (security-defaults.md).
 
 For a fork with `mode: replay`:
 
@@ -69,53 +82,54 @@ For a fork with `mode: replay`:
 
 Pure nodes and LLM calls served from the invocation log MUST re-execute live; otherwise divergence detection is vacuous.
 
-**Fan-out.** A host that projects its log outward — webhook delivery, A2A push, outbound streams, analytics or audit sinks — MUST NOT deliver events a replay re-emits as fixed history, and a fork of either mode MUST NOT inherit its source's A2A push configs. Replay-ness MUST be read from the run, never from the event type; the fork's own log MUST still carry the re-emitted events (webhooks.md).
+**Fan-out.** A host that projects its log outward — webhook delivery, A2A push, outbound streams, analytics or audit sinks — MUST NOT deliver events a replay re-emits as fixed history, and a fork of either mode MUST NOT inherit its source's A2A push configs. Replay-ness MUST be read from the run, never from the event type; the fork's own log MUST still carry the re-emitted events ([webhooks.md](webhooks.md)).
 
 **Branch.** A branch re-fires effects for sequences `>= fromSeq`; those are effects the operator asked for. A host MAY suppress branch effects and MUST NOT report that as replay suppression. A host SHOULD surface the re-fire in operator-facing fork UI.
 
 ### The effect-seam manifest
 
-A host advertising `replay` MUST publish `schemas/v2/effect-seam-manifest.schema.json`-shaped data at `GET /host/effect-seams` (RFC 0173 §C.1): `{ manifestVersion: "1", host: { name, build }, seams[] }`, one row per outbound effect path its node runtime can reach, `{ seam, kind, guarded: true, guardedBy, branchReFires?, note? }`. The host owns the list. The suite drives one seam of each kind it can reach and observes no re-fire (`effect-seam-manifest`, conformance.md).
+A host advertising `replay` MUST publish `schemas/v2/effect-seam-manifest.schema.json`-shaped data at `GET /host/effect-seams`: `{ manifestVersion: "1", host: { name, build }, seams[] }`, one row per outbound effect path its node runtime can reach, `{ seam, kind, guarded: true, guardedBy, branchReFires?, note? }`. The host owns the list. The suite drives one seam of each kind it can reach and observes no re-fire (`effect-seam-manifest`, [conformance.md](conformance.md)).
+
+`kind` names the outbound wire mechanism the seam leaves the host by — not the suite's driving mechanism, and not the business purpose. It MUST be one of `http`, `smtp`, `queue`, `storage`, `provider-sdk`, `webhook-fanout`, `other`.
 
-`kind` names the outbound **wire mechanism** the seam leaves the host by — not the suite's driving mechanism, and not the business purpose. It MUST be one of `http`, `smtp`, `queue`, `storage`, `provider-sdk`, `webhook-fanout`, `other`. Two seams that a host guards through one code path but that leave by different mechanisms are different `kind`s; two that leave by the same mechanism for different business reasons are one. `other` is the escape for a mechanism this list does not name — raw TCP, gRPC, a filesystem write, a device SDK — and a row using it MUST carry `note` naming that mechanism.
+- Two seams a host guards through one code path but that leave by different mechanisms are different `kind`s; two that leave by the same mechanism for different business reasons are one.
+- `other` is the escape for a mechanism this list does not name — raw TCP, gRPC, a filesystem write, a device SDK. A row using it MUST carry `note` naming that mechanism.
 
-**Completeness outranks driveability.** Every outbound effect path the node runtime can reach MUST be listed, including one the suite cannot drive (typically `smtp` or `other`), which the scenario records `inapplicable` naming the mechanism. A host MUST NOT omit a seam because the suite cannot drive it, and MUST NOT relabel it as a `kind` the suite can drive. The manifest is a self-declaration whose false negatives are found by audit — negative-existence, not a witness.
+**Completeness outranks driveability.** Every outbound effect path the node runtime can reach MUST be listed, including one the suite cannot drive (typically `smtp` or `other`); the scenario records that one `inapplicable`, naming the mechanism. A host MUST NOT omit a seam because the suite cannot drive it, and MUST NOT relabel it as a `kind` the suite can drive. The manifest is a self-declaration whose false negatives are found by audit, not a witness.
 
 ## Replay-from-event-log internals
 
 1. Load the source run's events with `sequence < fromSeq` through the storage boundary, where an era-`2` log is translated (persistence.md).
 2. Fold them to a projected state.
 3. Initialize the new run with that state, copy-on-write into its own log.
-4. For `replay`, resolve side-effecting nodes from the source run's recorded outcomes keyed on `(sourceRunId, nodeId, attempt)`; LLM invocations additionally consult the invocation log via the RFC 0041 content-addressed key.
+4. For `replay`, resolve side-effecting nodes from the source run's recorded outcomes keyed on `(sourceRunId, nodeId, attempt)`; LLM invocations additionally consult the invocation log via the content-addressed invocation key.
 5. For `branch`, executor invocations create new invocation-log entries keyed on the new `runId`.
 
 ## Forking a v1 run
 
-A v2 host MUST fork a run created before the cut (era `2`, persistence.md). The fork's prefix MUST be byte-equivalent to the *translated* parent — the parent as read through the codemap, not its stored bytes — and `run.started` on the fork MUST carry the legacy Subject (`issuer: urn:openwop:legacy`, identity.md) where the parent had none (RFC 0176 §A.5, scenario `fork-a-v1-run`). A backfill of an era-`2` log is permitted only atomically per run with the original preserved, so this obligation stays checkable.
+A v2 host MUST fork a run created before the cut (era `2`, [persistence.md](persistence.md)). The `fork-a-v1-run` scenario witnesses this.
+
+- The fork's prefix MUST be byte-equivalent to the *translated* parent — the parent as read through the codemap, not its stored bytes.
+- `run.started` on the fork MUST carry the legacy Subject (`issuer: urn:openwop:legacy`, [identity.md](identity.md)) where the parent had none.
+- A backfill of an era-`2` log is permitted only atomically per run with the original preserved, so this obligation stays checkable.
 
 ## Cross-engine ordering
 
-When a host advertises both `idempotency.multiRegion` and
-`eventLog.crossEngineOrdering`, a fork served by a region other than the one
-that wrote the run MUST produce the same observable state at the `fromSeq`
-boundary as a fork served by the writing region: `status`, `variables`, and the
-projected event log up to `fromSeq` MUST be byte-equivalent across regions.
-Per-region wall-clock and entropy fields in events AFTER the boundary MAY
-differ. A host that advertises one of the two and not the other keeps the
-single-region contract above; a host that advertises neither is single-region
-and the cross-region claim does not apply.
+When a host advertises both `idempotency.multiRegion` and `eventLog.crossEngineOrdering`, a fork served by a region other than the one that wrote the run MUST produce the same observable state at the `fromSeq` boundary as a fork served by the writing region:
+
+- `status`, `variables`, and the projected event log up to `fromSeq` MUST be byte-equivalent across regions.
+- Per-region wall-clock and entropy fields in events after the boundary MAY differ.
+
+A host that advertises only one of the two keeps the single-region contract above; a host that advertises neither is single-region and the cross-region claim does not apply.
 
 ## Retention
 
 A host advertising `replay` MUST document retention for source snapshots, source logs, the invocation records replay depends on, and forked runs; `retention.days` MAY advertise the window. When the range `fromSeq` needs has expired, the host MUST reject the fork with `410` or `422`; `details` SHOULD carry `sourceRunId`, `fromSeq`, and the boundary.
 
-See also: events.md, runs.md, persistence.md, security-defaults.md.
-
 ## Declared nondeterminism
 
-`nondeterminismPolicy` is the host's statement of which nondeterministic sources it
-declares rather than suppresses. A host advertising `nondeterminismPolicy.declared`
-MUST record every declared source in the run's event log at the point it is read, so
-a fork replays the recorded value rather than re-drawing it; a source the host neither
-declares nor suppresses is a replay defect, not a policy choice.
+`nondeterminismPolicy` is the host's statement of which nondeterministic sources it declares rather than suppresses. A host advertising `nondeterminismPolicy.declared` MUST record every declared source in the run's event log at the point it is read, so a fork replays the recorded value rather than re-drawing it. A source the host neither declares nor suppresses is a replay defect, not a policy choice.
+
+See also: events.md, runs.md, persistence.md, security-defaults.md.
 
+*Sources: RFC 0036, RFC 0039, RFC 0041, RFC 0057, RFC 0104, RFC 0111, RFC 0140, RFC 0173, RFC 0176, RFC 0194.*