@openwop/spec-artifacts 2.43.0 → 2.43.2

package/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.43.0",
-  "corpusTag": "v2.43.0",
+  "version": "2.43.2",
+  "corpusTag": "v2.43.2",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "69464bc0e1e71ef3b543a73d4fa4f67202343d2603c80af8033f6c3619ef1b30",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "c6d9d70e74a4c883a016a69da438fb6c87f56822334a1d45bd682c6d68bdac32",
-    "api/v2/asyncapi.yaml": "0b72bbd3f0f25172e3080a027a801d68d4a4130188addf2879fe92759d352de6",
-    "api/v2/openapi.yaml": "fdbc6bcf064de81e2c8bf3d7a896ccbc39d8b12f71f9b8c4727f825f1ae31af0",
+    "api/seams-v2.yaml": "987123ecfbfbc906c5655538b9380021ac0bcbfd93a467a67818e855d624ed0e",
+    "api/v2/asyncapi.yaml": "76474704b7a8e829588abec30d31f09e11557ee5daacad301c3be7e77affe7ce",
+    "api/v2/openapi.yaml": "f4af9e7fddad438d3a70753af29e5738ea48d15d1abd214a3fbeec97260cea9d",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -171,7 +171,7 @@
     "schemas/v2/residency.schema.json": "3fd23c9732beb140504e81560fc426eb6764d547e56da5fb92c5a5c7bf04db3a",
     "schemas/v2/run-ancestry-response.schema.json": "334c17f2062dea62726ca1d07b8be3f169cdc422af843c1def5fb317039814c9",
     "schemas/v2/run-diff-response.schema.json": "8bdb2045c274580038bd74781f7d062f5049839797c164a89de4ed89edc53a74",
-    "schemas/v2/run-event-payloads.schema.json": "b7b497c0a0fa41f279750138227d3378fc83ca894fb33e4b0a4fe7c685b84bc4",
+    "schemas/v2/run-event-payloads.schema.json": "f8518f366ad4379356eaf94063817ea0e75975873b883f75e42d98bef6eb4565",
     "schemas/v2/run-event.schema.json": "2f0d7416bd376c56affe97b6b2b49981532e8e9ff45c0a162cf806c78b3e7fb7",
     "schemas/v2/run-list-response.schema.json": "c2dbc34768dcf64528914a213aa3cb55952e8e3e90a64b04a9423b2a19749d38",
     "schemas/v2/run-options.schema.json": "f0e9f494d80086c2ed2cf9fe87df54e5b4e66601699c4a1089f4edbc7ba58867",
@@ -183,7 +183,7 @@
     "schemas/v2/self-hosted-runner-result-frame.schema.json": "8e739a721f350226f3ffb4af752b4fe0a72016042a7b6f42e16c0487c3c58983",
     "schemas/v2/subject-link.schema.json": "1fc941d6c14af886534009f2ffa6611e2035eb07e30b1df918c50d6bafff026c",
     "schemas/v2/subject.schema.json": "094e981fb20052a911393e219ea5f2065d8b8417b65080a70c5ea99fd960a8fe",
-    "schemas/v2/suspend-request.schema.json": "29c9cfa6978342f0175e250607e6eddb5e4058ea0c4adacc1965e1f3bb4dc9ee",
+    "schemas/v2/suspend-request.schema.json": "368d9932efb08f85b4520cac44b3c553876209f55bada93b5fcac93cc890b411",
     "schemas/v2/tool-descriptor.schema.json": "8c98fb5e93bc649dff859d3d1dde8075db929efd6c49c496252d0a88cccc73e1",
     "schemas/v2/trigger-event.schema.json": "710ecca8b3ecdad3a532a96768177f062192b24a589a4f798c7eb24bab64b30a",
     "schemas/v2/trigger-subscription-registration.schema.json": "04bc314a07c7e8b565577cb8df5821d968ce2af915900dfdccd4a24e928d20db",
@@ -204,49 +204,49 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "29f21e0fb2c7a232a92a5c19b4cba3a86bc3b5e16f06780452f0421c66c6ec38",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "4c43eec4ac5a43b026949f9d9c65d6b92f7b79706a185c4a147e232b1be0c945",
+    "spec/v1/core-standard-manifest.json": "0be2c8da837ddb170866303ab4640c8e8a8b2554d8c2bb9ac3d1bd9780bede5a",
     "spec/v1/deprecations.json": "46df807fb4adf0aae24671c20f69975cf3496e3bc3a521cb7e6ea556bdce563c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "2d4e4772cd647b471f989bdb6416ca902b11e10d17dc7f84825bb9f2eef1314c",
+    "spec/v1/gaps.json": "7eefa3aa02e978a41e1e5948818961718d23cb0cbe29a4a491524360feb9fd6f",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "2efcd9064b2bc65a84a3b3d281aa86a91efd002690c1f4f14e8335c4a18194d1",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
     "spec/v1/operation-path-manifest.json": "fada0342815fb129c1ae61f1829bd6e34417717408ce86fcc54280f373c19e74",
     "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
     "spec/v2/README.md": "4fa067d377580495e60baf08a4eafc3214b8ca48d8fb270bf91fc5066fad7186",
-    "spec/v2/core/capabilities.md": "3d1a1975cb688244ca18cd194f56f3a995cc81a9155277dbaeeaa51eabb3a0c7",
-    "spec/v2/core/conformance.md": "e7bd7d54062f28801071165a1b92edbeee3774bb3710f31eed75817139b66d95",
-    "spec/v2/core/connection-packs.md": "3168d2c8f1a59417a7256a678f4203570be434f64dead6b11fdec86b352686df",
-    "spec/v2/core/conversation.md": "6db43d8160bc45d3944aa1151816a6f0fd1669d59d7f822267a2d6cc9db22990",
-    "spec/v2/core/errors.md": "7931c9411e50b5ebfbc20d15aaf0e7b1a5b3e0ddc558b931e432da49ce09152c",
-    "spec/v2/core/events.md": "234338deb97be648731e8ab2126a90b7b8ad0a7070d98ffc85ee4689ff059791",
-    "spec/v2/core/form-content-packs.md": "41d40afe0a3760bcd792a4c406e16f28b0ab0aa7b0925323110d3fa2730d5400",
+    "spec/v2/core/capabilities.md": "ad728e8a761153b55d036ece55043ff62d0982121e2e629e5e7cdf560fca3c03",
+    "spec/v2/core/conformance.md": "0cfceb926eed87055550a5c23e640210c795fc8cf9dd1b2544db0e2b3842c564",
+    "spec/v2/core/connection-packs.md": "1ee129d792c537bfe82393ccb92555d8e6ddc342b1aa781a13f101b27ec38171",
+    "spec/v2/core/conversation.md": "354fa57c73d11062e523a44aa75a6353c5c81aefaf306d30c42416a228c82c86",
+    "spec/v2/core/errors.md": "bcb62944d8a482b1b6d5ac08a692ad7e4aaadf6165746c7ba7fa39157be2a300",
+    "spec/v2/core/events.md": "604abb6f9e2259a04103e1cb76d728712c3701c0d84dd915d4dc2949c912ee5e",
+    "spec/v2/core/form-content-packs.md": "02931227899676fd4581a27017be2a6c4953904717be9b81c29d12f87ab3917d",
     "spec/v2/core/headers.md": "5cb1624fa63acc81992b6a6d842ec392cf7271aaf2f65d1f83c8c4fa286e6730",
     "spec/v2/core/host-services.md": "15923cceb95cba148a32e0944f6a2d1d25e9cc36b0c169b67ee42d483bcac800",
     "spec/v2/core/i18n.md": "846c6d2878fc8454c2ae0a1576f6b6e6c8958d47187a6c96cc5826ca3c3e2e91",
-    "spec/v2/core/idempotency.md": "21830b7d23dd03e9e8ba4b0de253dd001fc960f166310d6b6b60b1c33cf60b30",
-    "spec/v2/core/identity.md": "acb7f739729c69a1f40dcaa5b1d873ba9f32993c17bfd297f5fa56351cf47c69",
-    "spec/v2/core/interop.md": "3cfa2af70ae6ba1f4b4268447d46d1d2f5fb65f7917f15bad159d9779d25b1a6",
-    "spec/v2/core/interrupt.md": "5e6fe9767228638095d5a2210307e1febfcefda808f4a400f2c7c528b929c445",
-    "spec/v2/core/node-pack-runtimes.md": "d52966319c53aaa03575025915b73b470a42832c039c41d73aff6931758630cb",
-    "spec/v2/core/oauth.md": "57f167d899993b6959c243e4102819f4014b365299b9b2b253decd2781e6b8b7",
-    "spec/v2/core/overview.md": "3dbc8c0cf7474b31816b1a12412c1edf5597066c38edcdbca4dd2e465880f65b",
-    "spec/v2/core/packs.md": "e46bf8cd34ac9566fe1e5601f67e7a17fce9639b8676e0f5278a10c6ca70ab29",
-    "spec/v2/core/persistence.md": "bba672ed3bf6d83af6e4e65c0f4f480fc21fe12207811e321306af2108d9010d",
-    "spec/v2/core/portability.md": "a35fbe66b8b5ccf63cf0216157d4b61d4c47f6dc8e757c830569ddf244e21e8a",
-    "spec/v2/core/replay.md": "a5be4e05242f25f8b5a8a4fb31bd359d5abb4bf34fa8e536403a8ee5779ab876",
-    "spec/v2/core/runs.md": "72a94c27d884036d84290e9b108702e98b0c6b2fb598213bbda44fba9c9f860d",
-    "spec/v2/core/security-defaults.md": "e77cf97290ffb0c201706ea10cc0883d717d034353ae0632067838ef227d3749",
-    "spec/v2/core/tool-catalog.md": "6b54b8ce221107de19c718f374a720123c6a5f55db4054e6625f73d06e0a442f",
-    "spec/v2/core/versioning.md": "2bfe16a72a909c46b4585fab39dc9e94c97506ed95df6b1b527f97b4cd3684ef",
-    "spec/v2/core/webhooks.md": "78fe97ab5bdee20218183efe32abf5ba1996705d757cb37c8d6a4d808c44199f",
-    "spec/v2/core/workflow-chain-packs.md": "35a957f1dd22016febd76bf2c4dfb79cda58b95d8efd8893b5e5babda9f79cf3",
+    "spec/v2/core/idempotency.md": "2084d756789c1faf5121593fb39e67ca36a4c227178e175004742e403178ea49",
+    "spec/v2/core/identity.md": "2dceb1c2697015e4a4fa8a9b28f4fbd25fa44a76ca5a919c752e2a8163c819db",
+    "spec/v2/core/interop.md": "e72e25dff864c83b2980d7366b34054cffa072af0225821199f260f6228d260e",
+    "spec/v2/core/interrupt.md": "2c8a4026930ec40ba47d7415dd02b6eda997a03d7a084e5084fec6f1261aba1c",
+    "spec/v2/core/node-pack-runtimes.md": "e1088cb69b8c3c67256c494063328916c2980ab1aa97a7063de25bab82fdb1e5",
+    "spec/v2/core/oauth.md": "c96483a44b62978c596945fbb7d7c863cf6056cd980fdb4cf4e97555e3e10b72",
+    "spec/v2/core/overview.md": "4087f171b00a3907551f508fec32fb9b0b3ccec8c0ac1b0c7c6d32cd2c0e3ff8",
+    "spec/v2/core/packs.md": "b472a583211d466d6ab8e00c414c225b246e678043fe6283a710c899fadde913",
+    "spec/v2/core/persistence.md": "711874f74cb08b03cd118d683056db10a063517762fcea73ec70feb5d983e6a4",
+    "spec/v2/core/portability.md": "87c4327f674f714fda6217fd79b99d2ba219ad47dc02f9751bb56c200fb2c17a",
+    "spec/v2/core/replay.md": "4d379494057746c6883f6047972e93e621863b998ed291b9a691d3aa57c1ff43",
+    "spec/v2/core/runs.md": "55e21292ae4b41d0d104199a6c2634ecb3f787c4a671f9ebc37084be38ceef03",
+    "spec/v2/core/security-defaults.md": "153884da7a2d54c30c81b5e649cfdef31e151b3a2a19dee1bc5a16c35d60a3aa",
+    "spec/v2/core/tool-catalog.md": "d16a9004418719c48301804aefa4d7ab6f41112a4ed83727f552aa1b92b418b0",
+    "spec/v2/core/versioning.md": "e3b3ab6d76e51035039a32173e9b412628a52c8fe7b16687ff58a2d0d983faa0",
+    "spec/v2/core/webhooks.md": "6fc2fb7d9a993a682765ebc68e5c5bb215046ee599234ca7a660465279444eff",
+    "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
     "spec/v2/corrections.json": "59f647f4d22477f6c2b06dcf913b682dde5d51dd5e607a5d0cf648ab60864d6e",
     "spec/v2/corrections.schema.json": "46bbffb954d13bd9995aebc912ceeb2544f7064331abf25fd6ab85c81a5cec94",
-    "spec/v2/declaration.json": "48cf54bc5ab04c00df3079b3fee701802de35a5a211dbfaf62c6a16bd4d3cd06",
+    "spec/v2/declaration.json": "184b83919e56d2f12bda73c7772905810a441cbab53fc42ad0b3135937fac3e5",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
     "spec/v2/errors.json": "dc1a846abe3e888acb0ce4a33cf9d1fb98e41fcc8b49f42b3682fd65deca2eb2",
     "spec/v2/errors.schema.json": "47404ad53e6147cf9017b813483712466573e419fb33e6c4b6c12d3e7deba1bc",
@@ -254,23 +254,23 @@
     "spec/v2/event-codemap.schema.json": "b173f2a9bcc0bf9b62a474ce3b91e1431d597e64fd1560fc58662cd8606eaf9c",
     "spec/v2/ext/README.md": "e2731ebb5156ece1840ed3b96e7a347f6345e73071ff4e54df0f21c1585c5027",
     "spec/v2/ext/a2uiSurface/README.md": "5518c7f355262eb7cc584422f4ff8e548f066b211878f969274a3a578127622d",
-    "spec/v2/ext/brand/README.md": "4f9db1715219070fc57e06cc9b066f13aa130dd50f4869722d908e6e15720787",
-    "spec/v2/ext/canvas/README.md": "9a08469f1cbde2b0d6594ce76f8cce94b9fb5415979ef5e2ecb732f311c86bae",
-    "spec/v2/ext/chat/README.md": "07e9ca34b3e5fc222ace1c2af60375266e001d1695da87f38f56b58f17aeaead",
+    "spec/v2/ext/brand/README.md": "82989c018d7965bab029bcce7a67b1d76ffc433d08971a4cac91befcccc09438",
+    "spec/v2/ext/canvas/README.md": "0e91b68566d2be90319feedfaebe2cd2db0bd8f72fb59c958fa723c05e38023f",
+    "spec/v2/ext/chat/README.md": "f59b6706162abbfff96f8bccd4c0e1aeed721047cf62e9af58c875727a38d716",
     "spec/v2/ext/coordination/README.md": "c7fe0884f52405fdd02c5f9ec309ac6b585685ee06ec5f338fff7acf03c07148",
-    "spec/v2/ext/dataIntegration/README.md": "a18e179cf88eb5d3e2fe2e017018141747a64a984d25a4f4ed32d776ea62e26d",
+    "spec/v2/ext/dataIntegration/README.md": "286dec8aa29e4d3225cbd8b3a361f5a438c3288e759966b9415ecbb99c576e70",
     "spec/v2/ext/entities/README.md": "956d4a9a2aedb8cb9c79ce8145580480920474cc6943f0e33ede32d7b20414dc",
     "spec/v2/ext/grpc-transport/README.md": "6ba378e3c6d1f2e3269b392cfdf0c40565ee9bfa259d1baaa9ee1d350e38e792",
-    "spec/v2/ext/kanban/README.md": "df179bea93a35c7a9d2556f2abefe2d53e05e33730b0b8cb2a9facab0e394ed2",
-    "spec/v2/ext/knowledge/README.md": "ab50dff74a1f285f890fab93f2d3a85f41032fff9191e4623ce9cbaed6d12124",
-    "spec/v2/ext/launchStudio/README.md": "ed33abe5bb000288e1be52f2b7a88175c7666a4390a599a6a77844eab564cabe",
-    "spec/v2/ext/messaging/README.md": "484cfa3091f89261dbdd48372afba441d3e6c16c3169a861b0ed7fc8c2902780",
+    "spec/v2/ext/kanban/README.md": "bfc386dc0f874a4afa1e3ec6a2f99084b547dcce9bd363da3b8ebd8786b9c184",
+    "spec/v2/ext/knowledge/README.md": "cbe1f945a757791dedac0fd542a68c86c5b457778b831d58d9ae44a2baa270f2",
+    "spec/v2/ext/launchStudio/README.md": "a941ef1d2401438a412eaea48d2d6ca807a032b44ea08719fea33120daf088a0",
+    "spec/v2/ext/messaging/README.md": "949f350e35294f52ad490e42699f8c560cd154549516fbaa1805f06312b7f342",
     "spec/v2/ext/portability/README.md": "c59423ee446638b748a911b9e97e803c4786157be6120f656f0a060586bc7b82",
     "spec/v2/ext/provider-idempotency/README.md": "9d1bccef0ec16a19a3370ae79c2f5a1726ce0d1d25a51352907f288a2ccb15d7",
     "spec/v2/ext/provider-idempotency/registry.json": "5b5fecad604fb4ab38da39f5abe697a4e57b05406c398f8afeb377331b2bd965",
-    "spec/v2/ext/restTransport/README.md": "acda51f1a973308841861a119def691db972f310c7b7250ab14f248e9c968585",
+    "spec/v2/ext/restTransport/README.md": "a8115faefeab01b7c85d516de60ebfc99b8e89552d16ba654456224518447b28",
     "spec/v2/ext/sandbox-runtime-notes/README.md": "0d1290fb1e20b2e35c0b15051541ab6546e4e2a6f693b4f912cb3f7d6a65e92c",
-    "spec/v2/ext/webResearch/README.md": "3ec0fa2c798bcfe16a545c6b47a624c44b776561ff46fa754711e5f6677826f8",
+    "spec/v2/ext/webResearch/README.md": "b675e6f6646128d781b661f754c2393eed86e5935d16c3a22df582a5ce025b9b",
     "spec/v2/facets/a2a.schema.json": "b68bf5e29e455e46c2ad7cfcccf5963730ec2310ff9db81884550d8df30fd6ef",
     "spec/v2/facets/aiProviders.schema.json": "81fb39b6698564d9d07a0d10525ecb6360c152fe3f3a5ea0439112509ca130e2",
     "spec/v2/facets/auditLogIntegrity.schema.json": "9a7f81320c8f940c6f4129bc7dd895a4063231c5458a717a08c2cbf9bb886c46",
@@ -298,9 +298,9 @@
     "spec/v2/path-manifest.json": "17298a245c5da9a70aa7ab0b7f2db4277e06209d6fcdd7187a8b4cea179c08f3",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "8bd257db47f63fdc4759ed13f34df309d80cd69ee83b96a24aed8bb3a9810b1d",
+    "spec/v2/release.json": "ec99d76b53fba89d3d8788206c649a782774b55acf5284b75cab38b79ecf1d61",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "d47f26c3194de0e0d42a731ecaeeae1c2adfdea8c09314792d15c02b50d62efb"
+    "spec/v2/surface-baseline.json": "3d3d0fc7c0b48e7d7339e5d8ada0640487908f37220b2de65ccc9bff093f876a"
   },
-  "corpusCommit": "49be1aa2be9d835a80f934ce98dc4cebf0af46a4"
+  "corpusCommit": "6612868966f2ecb9672d0a64382cb7067491c004"
 }

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.43.0
+  version: 2.43.2
   description: 'The OpenWOP conformance seams profile (`openwop-conformance-seams-v2`): test-only operations in their own
     path space, `/conformance/seams/…`. The profile is versioned and validated against the canonical v2 schemas with no tolerance
     path. It is not a capability: a host advertises the profile, never a `testSeams` flag.
@@ -801,6 +801,62 @@ paths:
           $ref: '#/components/responses/ValidationError'
         '401':
           $ref: '#/components/responses/Unauthenticated'
+  /conformance/seams/sample/webhooks/rotation-overlap:
+    post:
+      tags:
+      - Seams
+      operationId: shortenRotationOverlap
+      summary: Shorten the rotation overlap in progress on one subscription — RFC 0201 §E.20 witness
+      description: 'Sets the subscription''s `previousSecretExpiresAt` to the time the request was received plus `overlapSeconds`,
+        and reports the stored value. The seam MUST write the same stored expiry `rotateWebhookSecret` wrote and the production
+        signer reads; the signer MUST NOT branch on the seam, so which secret signs after the new expiry is production''s
+        decision. It changes only the overlap in progress and MUST NOT lengthen it: an expiry at or after the current one,
+        no overlap in progress, or a subscription that did not opt into `standard-webhooks-1` answers `400 validation_error`.
+        Tenant checks are those of `rotateWebhookSecret` (`403 id_tenant_mismatch` before the lookup; `404` when unknown).
+        OPTIONAL, and never served outside the seams profile; consumed by `v2-webhook-secret-rotation` when the advertised
+        overlap outlasts the wait cap. An unserved seam leaves that leg a partial witness, never `blocked`.'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+              - webhookId
+              - overlapSeconds
+              properties:
+                webhookId:
+                  $ref: ../schemas/v2/ids.schema.json#/$defs/subscriptionId
+                overlapSeconds:
+                  type: integer
+                  minimum: 1
+                  maximum: 60
+      responses:
+        '200':
+          description: The overlap is shortened.
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                required:
+                - webhookId
+                - previousSecretExpiresAt
+                properties:
+                  webhookId:
+                    $ref: ../schemas/v2/ids.schema.json#/$defs/subscriptionId
+                  previousSecretExpiresAt:
+                    type: string
+                    format: date-time
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
   /conformance/seams/sample/webhooks/receive:
     post:
       tags:

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.43.0
+  version: 2.43.2
   description: 'OpenWOP v2 event streams over SSE. The run-events channel''s address is the OpenAPI path key, and the server
     pathname is empty (bare origin). `streamMode` is a stream mode from the closed set, or a comma-separated combination of
     them; `values` never combines. `hostEvents` has a default address, `/host/events`; a host MAY declare another under `heartbeat.deliveryChannel`.

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.43.0
+  version: 2.43.2
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: 'The OpenWOP v2 REST API. Paths are unversioned and served at the bare origin; a client selects a version with
     the `OpenWOP-Version` header from the host''s `protocolVersions[]`. Conformance seams and test-mode operations are not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.43.0",
+  "version": "2.43.2",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {

package/schemas/v2/run-event-payloads.schema.json

@@ -948,7 +948,8 @@
       "properties": {
         "code": {
           "type": "string",
-          "minLength": 1
+          "minLength": 1,
+          "description": "A registered code from spec/v2/errors.json or a vendor code (errors.md §The registry, corrected by openwop#1698): the producer rule binds run.failed, node.failed and the snapshot error exactly as it binds an error response. Kept an open string on purpose — a consumer MUST accept an unknown code (overview.md §0) — so this schema does not enforce the rule; the suite's event-code-registered leg does."
         },
         "message": {
           "type": "string",

package/schemas/v2/suspend-request.schema.json

@@ -27,7 +27,7 @@
     },
     "key": {
       "type": "string",
-      "description": "Deterministic key used to short-circuit on re-entry after process death. If two interrupt() calls in the same run emit the same key, the second returns the cached result of the first. Recommended: ${runId}:${nodeId}:${interruptCount}.",
+      "description": "The deterministic re-entry key of ONE invocation of an interrupt (interrupt.md §Re-entry and resume values; corrected 2026-09-28 by openwop#1697). A host MUST derive it from at least the run, the node and the node's visit index; the spelling is host-defined. Recommended: ${runId}:${nodeId}:${interruptCount}, where interruptCount is the visit index — the number of interrupts this node raised in this run whose resolution was consumed before the current execution of the node began (plus an ordinal when one execution raises several). A replay or recovery of the same execution re-derives the same key and returns the recorded resume value; a later execution of the node (a loop back over an edge) derives a new key and raises a new interrupt.requested.",
       "minLength": 1,
       "maxLength": 256
     },
@@ -299,7 +299,7 @@
             "approve",
             "escalate"
           ],
-          "description": "RFC 0186 §A.3 — the disposition applied when `timeoutMs` elapses with no resolution. Every gate with a timer needs one; two production hosts recorded it as a bare key on `approval.requested` (280 rows on one) because the seat did not exist. `escalate` pairs with a host-defined escalation target. A `timeoutMs` of `0` means no timer, and `onTimeout` is then meaningless. Absent means `reject` (RFC 0223; interrupt.md §Rejection): the gate fails closed, the node and run fail with `approval_rejected` unless an edge routes the failure. No JSON-Schema `default` is declared, because a validator that fills defaults would write a value the host never recorded."
+          "description": "RFC 0186 §A.3, corrected by RFC 0223 (openwop#1696) — a hint recorded with the gate; it does not choose the outcome. Whatever it holds, when a non-zero `timeoutMs` elapses with no resolution the host MUST resolve the gate rejected (`action: timeout`, `decision: rejected`, `reason: timeout`) and the node and run fail with `approval_rejected` unless an edge routes the failure (interrupt.md §Rejection). A timeout never grants a gate: a host MUST treat `approve` as `reject` and SHOULD NOT emit it (RFC 0093 ruled fail-open non-conformant; the value stays in the enum only so recorded payloads validate). `escalate` MAY notify a host-defined target but MUST NOT extend or grant the gate. Absent means `reject`. A `timeoutMs` of `0` means no timer. Two production hosts recorded this as a bare key on `approval.requested` (280 rows on one) before the seat existed. No JSON-Schema `default` is declared, because a validator that fills defaults would write a value the host never recorded."
         },
         "description": {
           "type": "string"

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.43.0"
+      "version": "2.43.2"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -421,5 +421,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "17d0bdd9a9fd20dcd7df1c5312e9e00e77ee641ca24970d4c6ec6130d0fbf4ae"
+  "digest": "a8b5948aab2aa9da287f28920d6106d784d33e41a441146ee50a5cf79022d6f6"
 }

package/spec/v1/gaps.json

@@ -7271,6 +7271,23 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0140.10",
+      "rfc": "0140",
+      "local": "G10",
+      "section": "§Conformance",
+      "surface": "`openwop.requirement.replay.suppression-execution-ordinal` (openwop#1718) has no witness on any host, positive or negative. `conformance-replay-ordinal-loop` needs a host that both runs cycles and suppresses a side-effecting node in replay. The v2 reference host does neither for this fixture: it does not loop, it does not execute `core.conformance.side-effect`, and its `effectOutcome` (`store.ts:586` at openwop-examples `f56f092`) selects the latest outcome regardless of ordinal, which would fail the row if it looped. openwop-app does not index by ordinal (`nodeAttempts` is never reset), and MyndHyve does not seed `replaySourceOutcomes` from the prefix.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "host-loops-with-replay-suppression",
+      "sources": [
+        {
+          "file": "RFCS/registers/0140-replay-side-effect-suppression.gaps.md",
+          "token": "G10"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.0141.0",
       "rfc": "0141",
@@ -9804,6 +9821,57 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0171.6",
+      "rfc": "0171",
+      "local": "G6",
+      "section": "§B.1",
+      "surface": "openwop-app emits error codes on `run.failed` / `node.failed` that are neither registered nor vendor codes (22 codes measured at openwop-app `0cfb264c9`, e.g. `invalid_config`, `host_capability_missing`); `errors.md` §The registry binds them since openwop#1698.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "openwop-app-code-remap",
+      "sources": [
+        {
+          "file": "RFCS/registers/0171-v2-wire-envelope.gaps.md",
+          "token": "G6"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0171.7",
+      "rfc": "0171",
+      "local": "G7",
+      "section": "§B.1",
+      "surface": "MyndHyve emitted about 56 UPPER_CASE run-failure codes that were neither registered nor vendor codes.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0171-v2-wire-envelope.gaps.md",
+          "token": "G7"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0171.8",
+      "rfc": "0171",
+      "local": "G8",
+      "section": "§B.1",
+      "surface": "The v2 reference host emitted unregistered run-failure codes that were not vendor codes.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0171-v2-wire-envelope.gaps.md",
+          "token": "G8"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.0172.1",
       "rfc": "0172",
@@ -13085,6 +13153,23 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0220.5",
+      "rfc": "0220",
+      "local": "G5",
+      "section": "§B",
+      "surface": "`canvas` has no tier-2 path yet. MyndHyve serves the canvas host service (myndhyve #547), but its claim depends on the `vendor.myndhyve.canvas` pack. The only v2-admissible version (1.0.1, `registry/v2/`) is signed with `signing.scheme: ed25519-canonical-json` (RFC 0177 §A), and MyndHyve's pack publish route and resolver do not implement that scheme. The v1-tree 1.0.0 pins `engines.openwop <2.0.0`, which a v2 host MUST refuse. This is a general v2 pack-signing gap at the host, not canvas-specific.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "transferred",
+      "target": "myndhyve/services/workflow-runtime",
+      "sources": [
+        {
+          "file": "RFCS/registers/0220-ext-families-graduate-on-evidence.gaps.md",
+          "token": "G5"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.0221.1",
       "rfc": "0221",
@@ -13141,11 +13226,11 @@
       "rfc": "0223",
       "local": "G1",
       "section": "§Conformance",
-      "surface": "The routed case (a rejected gate followed over an `all_complete` or `any_failed` edge) has no witness: no registered fixture has a gate with an outgoing edge, and widening `conformance-approval` would force every host to re-register it.",
+      "surface": "The routed case (a rejected gate followed over an `all_complete` or `any_failed` edge) had no witness.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "transferred",
-      "target": "openwop#1700",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
@@ -13158,11 +13243,11 @@
       "rfc": "0223",
       "local": "G2",
       "section": "§Conformance",
-      "surface": "The timeout disposition has no witness: no registered fixture carries a gate with a short `timeoutMs`, and the suite cannot make a host's timer fire.",
+      "surface": "The timeout disposition had no witness.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "transferred",
-      "target": "openwop#1700",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
@@ -13175,11 +13260,11 @@
       "rfc": "0223",
       "local": "G3",
       "section": "§Implementation notes",
-      "surface": "The v2 reference host does not record `action` on `interrupt.resolved`, does not emit `approval.rejected`, fails the run directly rather than through the scheduler, and has no timeout disposition.",
+      "surface": "The v2 reference host did not record `action` on `interrupt.resolved`, did not emit `approval.rejected`, failed the run directly rather than through the scheduler, and had no timeout disposition.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "externally-gated",
-      "target": "openwop-examples-v2-reference-followup",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
@@ -13209,11 +13294,11 @@
       "rfc": "0223",
       "local": "G5",
       "section": "§Implementation notes",
-      "surface": "MyndHyve fails the gate with the unregistered `APPROVAL_REJECTED`.",
+      "surface": "MyndHyve failed the gate with the unregistered `APPROVAL_REJECTED`.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "externally-gated",
-      "target": "myndhyve-next-cut",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
@@ -13243,11 +13328,11 @@
       "rfc": "0223",
       "local": "G7",
       "section": "§Unresolved questions",
-      "surface": "`onTimeout: approve` re-legalises the fail-open timeout RFC 0093 ruled non-conformant; this RFC defines only the absent and `reject` cases.",
+      "surface": "`onTimeout: approve` re-legalised the fail-open timeout RFC 0093 ruled non-conformant.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "transferred",
-      "target": "openwop#1696",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
@@ -13260,11 +13345,11 @@
       "rfc": "0223",
       "local": "G8",
       "section": "§A",
-      "surface": "A gate re-entered over a reject loop collides with the one-interrupt-per-key rule (`interrupt.md` §Re-entry); v2 has no per-iteration key derivation.",
+      "surface": "A gate re-entered over a reject loop collided with the one-interrupt-per-key rule (`interrupt.md` §Re-entry); v2 had no per-iteration key derivation.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "transferred",
-      "target": "openwop#1697",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
@@ -13289,6 +13374,40 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0223.9",
+      "rfc": "0223",
+      "local": "G9",
+      "section": "§Conformance",
+      "surface": "`openwop.requirement.0223.reject-loopback-reasks` (openwop #1697) has no positive witness on any host. The v2 reference host does not run cycles. MyndHyve runs request-changes loops over condition edges on a successful gate output, and does not route a failed node over `any_failed` (its Cloud Run executor has no `triggerRule` handling), so the row stays `inapplicable` there. openwop-app rejects cycles. The row exists and is negatively controlled: registering the fixture on a host that does not loop records `executed-fail`.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "host-routes-failed-gate-over-cycle",
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G9"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.10",
+      "rfc": "0223",
+      "local": "G10",
+      "section": "§Conformance",
+      "surface": "`openwop.requirement.0223.timeout-rejects` and `0223.timeout-never-grants` had no certified witness, and have no MyndHyve witness: its `core.approvalGate` has no timeout configuration.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G10"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.0224.1",
       "rfc": "0224",

package/spec/v2/core/capabilities.md

@@ -467,4 +467,4 @@ A profile is a predicate over the declaration file, published in `spec/v2/profil
 
 Rows `C2.1`–`C2.10` are `spec/v1/migrations.json` entries. `openwop.codemod.discovery-document-v2` transforms `C2.2`–`C2.8`: it drops a family with `supported: false` and promotes a dotted-only declared family to its plain key. Certification bundles naming `openwop-core` are never upgraded; they remain valid v1 evidence at their version.
 
-*Sources: RFC 0144, RFC 0169, RFC 0175, RFC 0176, RFC 0179, RFC 0197. Each family's owning RFC is its `owningRfc` in [`declaration.json`](../declaration.json).*
+*Sources: RFCs 0144, 0169, 0175, 0176, 0179, 0197. Each family's owning RFC is its `owningRfc` in [`declaration.json`](../declaration.json).*

package/spec/v2/core/conformance.md

@@ -145,4 +145,4 @@ This proves the arithmetic and that recovery ran once inside the bound. It does
 
 An RFC whose acceptance criteria are corpus gates rather than host scenarios records the evidence label **corpus gate — no host tier** in its `Updated` line. For such an RFC the accepted-predicate check reads `(corpus)` rows from `evidence/corpus-ledger.json` and MUST NOT require a host bundle.
 
-*Sources: RFC 0158, RFC 0168, RFC 0212, RFC 0216.*
+*Sources: RFCs 0158, 0168, 0212, 0216.*

package/spec/v2/core/connection-packs.md

@@ -35,4 +35,4 @@ A host advertising `connections.packsSupported` MUST resolve a connector's `auth
 
 Both codes are in `spec/v2/errors.json`: `connection_provider_conflict` (two claimants for one bare id) and `connection_provider_unresolved` (no definition for the referenced id).
 
-*Sources: RFC 0095, RFC 0177.*
+*Sources: RFCs 0095, 0177.*

package/spec/v2/core/conversation.md

@@ -23,4 +23,4 @@ A host advertising `channelPresence` MUST report present members as a subset of
 
 A host that stamps model provenance on an agent turn MUST advertise `conversationTurnModelProvenance`. The stamp is non-secret and non-PII (provider and model identifiers only), and a host MUST NOT place prompt or completion content in it.
 
-*Sources: RFC 0101, RFC 0109, RFC 0110.*
+*Sources: RFCs 0101, 0109, 0110.*

package/spec/v2/core/errors.md

@@ -8,9 +8,9 @@ Every error a v2 host returns is a row in one registry. A client routes on `erro
 
 ## The registry
 
-`spec/v2/errors.json` holds one row per code: `{ code, httpStatus, retriable, details, since, deprecated? }` plus the provenance fields `statusSource` and `source`, and an optional one-line `meaning`. `spec/v2/errors.schema.json` defines the row. It registers **108** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
+`spec/v2/errors.json` holds one row per code, defined by `spec/v2/errors.schema.json`. It registers **108** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
 
-- A host MUST return a registered code, or a vendor code, in every error response.
+- A host MUST emit a registered code, or a vendor code, wherever it emits an error code: the `error` of every error response, and `error.code` on `run.failed`, `node.failed` and the snapshot's `error` (overview.md §0). A recorded event re-emitted by replay or `:fork` is carried as recorded ([replay.md](replay.md)).
 - A vendor code MUST match `^(?!openwop\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\.[a-z][a-z0-9_]*$`, with its first segment an org registered in `spec/v2/declaration.json`. `openwop.` is reserved.
 - The registry grows by [overview.md](overview.md) §0.
 
@@ -160,4 +160,4 @@ Code | Status
 `pack_registry_unreachable` | 503
 `runner_unavailable` | 503
 
-*Sources: RFC 0171, RFC 0213.*
+*Sources: RFCs 0171, 0213.*

package/spec/v2/core/events.md

@@ -188,4 +188,4 @@ An absent `kinds` is not an empty catalog and is not an unrestricted one: a host
 - **`feedback.targets`** names the resources an annotation may be attached to. A host MUST refuse an annotation whose target is outside the advertised set, and MUST NOT write it to the replayable run event log.
 - **`providerUsage.costEstimates`** advertises that the host stamps a derived cost on the `provider.usage` event. That figure is an estimate from the host's own rate table; a consumer MUST NOT treat it as a billed amount.
 
-*Sources: RFC 0171, RFC 0172, RFC 0176, RFC 0185, RFC 0194, RFC 0213.*
+*Sources: RFCs 0171, 0172, 0176, 0185, 0194, 0213.*

package/spec/v2/core/form-content-packs.md

@@ -40,4 +40,4 @@ A form instantiated from a pack advertised through `forms.contentPacks` MUST be
 
 The five spec-reserved `format` values are the core set. A host that recognizes a format SHOULD apply it; one that does not MUST ignore it and accept plain text. A host MUST ignore `format` on any type other than `text` or `longtext`.
 
-*Sources: RFC 0137, RFC 0177.*
+*Sources: RFCs 0137, 0177.*

package/spec/v2/core/idempotency.md

@@ -68,4 +68,4 @@ Layer 1 deduplicates the caller's request; Layer 2 deduplicates the run's effect
 - `multiRegion` is the behavioural claim. When a host advertises it, both layers MUST hold across regions: an `Idempotency-Key` replayed into a second region MUST resolve to the first region's response rather than starting new work, and effect identity MUST collapse a duplicate effect wherever it is observed.
 - A host that does not advertise `multiRegion` makes no cross-region promise, and a client MUST NOT infer one from `crossRegion` alone.
 
-*Sources: RFC 0170, RFC 0171, RFC 0173, RFC 0213.*
+*Sources: RFCs 0170, 0171, 0173, 0213.*

package/spec/v2/core/identity.md

@@ -222,4 +222,4 @@ Every code below is a row with `retriable: false` and no `details` contract; the
 
 The identity invariants are registered in `SECURITY/invariants.yaml` with their scenarios. An invariant without a witness is demoted from `protocol` tier.
 
-*Sources: RFC 0132, RFC 0165, RFC 0170, RFC 0176, RFC 0184, RFC 0200, RFC 0210.*
+*Sources: RFCs 0132, 0165, 0170, 0176, 0184, 0200, 0210.*

package/spec/v2/core/interop.md

@@ -162,4 +162,4 @@ A receiver prefers the in-message value, ignores a malformed one, and MUST NOT d
 
 `SECURITY/threat-model-interop.md` is the threat model for this document; its invariants are rows of `SECURITY/invariants.yaml`. Peer identity and authorization at the boundary are governed by security-defaults.md; a peer MUST NOT gain authority the caller's Subject does not hold.
 
-*Sources: RFC 0175, RFC 0198, RFC 0207, RFC 0208, RFC 0211, RFC 0214.*
+*Sources: RFCs 0175, 0198, 0207, 0208, 0211, 0214.*

package/spec/v2/core/interrupt.md

@@ -5,7 +5,7 @@
 
 ## Why this exists
 
-`interrupt` is the one primitive by which a run waits for something outside itself: a human decision, an answer, an external event, a conversation turn. Every kind shares one payload shape, one pair of events, one resolve contract and one token scheme, so a client that can resolve an approval can resolve anything.
+`interrupt` is how a run waits for something outside itself: a decision, an answer, an event, a conversation turn. Every kind shares one payload shape, event pair, resolve contract and token scheme, so a client that resolves an approval can resolve anything.
 
 ## Payload
 
@@ -35,8 +35,11 @@ Per-kind rules:
 
 ### Re-entry and resume values
 
-`key` is the deterministic re-entry key.
+`key` is the deterministic re-entry key of one invocation. A host MUST derive it from at least the run, the node and the node's visit index: the number of that node's interrupts in this run whose resolution was consumed before this execution began. Its spelling is host-defined.
 
+- A replay or recovery of the same execution MUST re-derive the same key.
+- A later execution of the node, reached over an edge, MUST derive a different key, MUST raise a new `interrupt.requested`, and MUST NOT return an earlier visit's `resumeValue`.
+- Two interrupts raised in one execution MUST have distinct keys.
 - A host MUST invoke an interrupt with key `K` at most once for the lifetime of the run.
 - On recovery the engine MUST consult the event log, find the prior `interrupt.resolved`, and return the persisted `resumeValue` without emitting a second `interrupt.requested`.
 - An in-memory cache MAY serve in-process replays but MUST NOT replace the event log for cross-process replays.
@@ -51,7 +54,7 @@ Every kind uses two registered types ([events.md](events.md)):
 - `interrupt.requested` — the payload is the `InterruptPayload` verbatim.
 - `interrupt.resolved` — the closed payload is `interruptResolved`. Resolving an approval-kind interrupt MUST record the applied `action` there, with the field §Approval requires.
 
-The kind-specific `approval.*` and `clarification.*` types remain registered. Their payload definitions in `schemas/v2/run-event-payloads.schema.json` are `$ref` aliases of `interruptRequested` and `interruptResolved`, so there is one shape per direction. A host emitting `interrupt.requested` SHOULD also emit the kind-specific type until its consumers migrate.
+The kind-specific `approval.*` and `clarification.*` types remain registered. Their payload definitions in `schemas/v2/run-event-payloads.schema.json` are `$ref` aliases of `interruptRequested` and `interruptResolved`. A host emitting `interrupt.requested` SHOULD also emit the kind-specific type until its consumers migrate.
 
 Both events are durable and appear in the `updates` and `debug` stream modes. While suspended, `RunSnapshot.currentNodeId` names the node and `status` is `waiting-approval`, `waiting-input` or `waiting-external`.
 
@@ -115,18 +118,18 @@ The token grammar and the `interrupt.tokenAlgs[]` / `kid` check are [identity.md
 
 ### Rejection
 
-A `reject` exits the suspend. The host MUST record `action: "reject"` and `decision: "rejected"` on `interrupt.resolved`, and SHOULD also emit `approval.rejected`. The resume value is returned to the node that raised the interrupt (§Re-entry and resume values).
+A `reject` exits the suspend. The host MUST record `action: "reject"` and `decision: "rejected"` on `interrupt.resolved`, and MAY also emit `approval.rejected`. The resume value returns to the raising node (§Re-entry and resume values).
 
-- A node that does not turn the rejection into an output MUST fail with `approval_rejected` ([errors.md](errors.md)) and `retryable: false` on the `node.failed` error, and MUST NOT be retried.
+- A node that does not turn the rejection into an output MUST fail with `approval_rejected` and `retryable: false` on the `node.failed` error, and MUST NOT be retried.
 - A rejected gate is a failed source. It MUST NOT satisfy an `all_success`, `any_success` or `none_failed` edge. The run continues past it only over an edge whose `triggerRule` admits a failed source (`all_complete` or `any_failed`).
 - When no such edge exists, the run MUST terminate `failed` with `run.failed.error.code` `approval_rejected` and `failedNodeId` naming the gate.
 - The gate resolves rejected on one eligible `reject` under `single-veto`, or when rejects exceed half of `requiredApprovals` under `majority`. A vote that does not decide the gate MUST NOT emit `interrupt.resolved`.
-- When a non-zero `timeoutMs` elapses with no resolution and `onTimeout` is absent or `reject`, the host MUST resolve the gate rejected, recording `action: "timeout"`, `decision: "rejected"` and `reason: "timeout"`, and MUST apply the rules above. A host MUST NOT accept `timeout` on a resume request.
+- When a non-zero `timeoutMs` elapses with no resolution, the host MUST resolve the gate rejected, recording `action: "timeout"`, `decision: "rejected"` and `reason: "timeout"`, whatever `onTimeout` holds, and MUST apply the rules above. A timeout MUST NOT grant a gate. A host MUST treat `onTimeout: "approve"` as `reject` and SHOULD NOT emit it. `escalate` MAY notify a host-defined target but MUST NOT extend or grant the gate. A host MUST NOT accept `timeout` on a resume request.
 - On replay the failure MUST be derived from the recorded `interrupt.resolved`, never re-decided.
 
 ## Approver enforcement
 
-Enforcement is an obligation of the fields, not a discovery flag. The facet `spec/v2/facets/interrupt.schema.json` carries `tokenAlgs[]` (REQUIRED) and `refKinds[]` ⊆ `principal`, `group`, `role`.
+The facet `spec/v2/facets/interrupt.schema.json` carries `tokenAlgs[]` (REQUIRED) and `refKinds[]` ⊆ `principal`, `group`, `role`.
 
 - **`approversList`** (explicit principals) binds everywhere: a host advertising `interrupt` MUST refuse a resolver not in the list.
 - **`approverGroupRefs`** binds only where `refKinds` includes `group`: the host MUST surface the field unchanged and MUST resolve and enforce its members as eligible approvers.
@@ -136,10 +139,10 @@ Enforcement is an obligation of the fields, not a discovery flag. The facet `spe
 
 Eligibility binds every writer of the suspension record, not every route. A host whose durable store is writable by a principal other than the engine MUST enforce the same eligibility at the store, or MUST NOT expose the record to that principal for write.
 
-Refs are opaque to the engine; the host resolves them against its own identity model. Membership MUST be resolved at decision time and MUST NOT be re-resolved during replay or `forkRun`: the recorded eligibility decision is fixed history ([replay.md](replay.md)).
+Refs are opaque to the engine; the host resolves them. Membership MUST be resolved at decision time and MUST NOT be re-resolved during replay or `forkRun`: the recorded eligibility decision is fixed history ([replay.md](replay.md)).
 
 ## During the v1 overlap
 
 The v1 interrupt-token drain is [identity.md](identity.md) §4.
 
-*Sources: RFC 0170, RFC 0171, RFC 0173, RFC 0187, RFC 0196, RFC 0223.*
+*Sources: RFCs 0170, 0171, 0173, 0187, 0196, 0223.*

package/spec/v2/core/node-pack-runtimes.md

@@ -31,4 +31,4 @@ It has no `packages[]`, `headers`, `variables` or `_meta`, so it carries no inst
 - A host SHOULD NOT treat `name` as a verified identity: an inline record carries no proof of namespace ownership.
 - A host that authenticates to the server does so through the node's `requiredCredentials` or `auth`.
 
-*Sources: RFC 0008, RFC 0203.*
+*Sources: RFCs 0008, 0203.*

package/spec/v2/core/oauth.md

@@ -63,4 +63,4 @@ Then:
 - `declined` fails the node with `connector_auth_declined`.
 - A host that binds a node to one credential reference (for example, a connection) reads "resolves" as that reference resolving with the node's scopes, carries it as `credentialRef`, and still completes `connectUrl` only for the initiating Subject.
 
-*Sources: RFC 0046, RFC 0047, RFC 0199.*
+*Sources: RFCs 0046, 0047, 0199.*

package/spec/v2/core/overview.md

@@ -96,4 +96,4 @@ These rules bind any public conformance statement:
 
 Every MUST, SHOULD, and MAY in `core/` is a requirement with an id in `requirements.json` and a `witness` from `witnessable-unaided | witnessable-gated | seam-gated | claims-check | negative-existence`. A seam-gated MUST is governed by [`conformance.md`](conformance.md) §"Witness class".
 
-*Sources: RFC 0155, RFC 0167, RFC 0168, RFC 0169, RFC 0171, RFC 0174, RFC 0190, RFC 0197.*
+*Sources: RFCs 0155, 0167, 0168, 0169, 0171, 0174, 0190, 0197.*

package/spec/v2/core/packs.md

@@ -26,12 +26,12 @@ Each conjunct keeps its own refusal code. A mechanical ceiling bump is not a ver
 
 ## The `packs` capability
 
-A host advertises `packs` when it serves the registry surface above. The record is the advertisement:
+A host advertises `packs` when it serves the registry surface above:
 
 - A host MUST NOT advertise `packs` unless it resolves pack references through a registry reachable from its discovery document.
-- A client MUST treat an absent record as "this host installs no packs", not as an unknown.
+- A client MUST treat an absent record as "no registry resolution", not as an unknown. It says nothing about pack validation or execution, which `sandbox` and §"The engine range" bind.
 
-`testMode` is DEPRECATED and MUST NOT be relied on by a client (see §"During the v1 overlap"). A host mounting a test catalog SHOULD advertise the seams profile instead, and MUST NOT treat `testMode` as a second way to claim one.
+`testMode` is DEPRECATED and MUST NOT be relied on by a client (§"During the v1 overlap"). A host mounting a test catalog SHOULD advertise the seams profile instead, and MUST NOT treat `testMode` as a second way to claim one.
 
 ## The registry tree
 
@@ -118,4 +118,4 @@ A registry MUST validate submissions against vendored copies of these schemas pi
 - The v1 registry tree is frozen through the overlap, behind the v2 tree.
 - `testMode` advertises the v1 `/v1/packs-test/*` mirror, a conformance seam ([conformance.md §"The seams profile"](conformance.md)). It remains advertisable through the overlap and is removed at 3.0.
 
-*Sources: RFC 0177, RFC 0212, RFC 0222.*
+*Sources: RFCs 0177, 0212, 0222.*

package/spec/v2/core/persistence.md

@@ -143,4 +143,4 @@ A host MAY claim a qualification rung (`durable-single-instance`, `durable-multi
 
 See also: [overview.md](overview.md), [events.md](events.md), [replay.md](replay.md), [identity.md](identity.md), [webhooks.md](webhooks.md).
 
-*Sources: RFC 0041, RFC 0158, RFC 0170, RFC 0171, RFC 0172, RFC 0176, RFC 0180, RFC 0185, RFC 0186, RFC 0187.*
+*Sources: RFCs 0041, 0158, 0170, 0171, 0172, 0176, 0180, 0185, 0186, 0187.*

package/spec/v2/core/portability.md

@@ -41,4 +41,4 @@ An applied import emits `import.applied` (`schemas/v2/run-event-payloads.schema.
 
 No protocol path is defined for export or import: a host serves them on routes of its own. A host-private migration from an anonymous sandbox into a signed-in tenant fits this contract, because its response is a subset of the import outcome.
 
-*Sources: RFC 0043, RFC 0096, RFC 0098.*
+*Sources: RFCs 0043, 0096, 0098.*

package/spec/v2/core/replay.md

@@ -63,7 +63,7 @@ When a replayed node produces an event different from the source at the same seq
 Divergence codes (`spec/v2/errors.json`):
 
 - **`replay_diverged_at_refusal`** (fork fails, `409`) — the source obtained a valid envelope and the replay a refusal, or the reverse. The host MUST NOT substitute silently; it MUST emit `replay.diverged-at-refusal` naming the node and both envelope kinds and fail the replay with this code.
-- **`replay_source_missing`** (`node.failed` payload; the fork request still returns `201`) — a side-effecting node reached with no recorded source outcome for `(nodeId, attempt)` (§Suppression).
+- **`replay_source_missing`** (`node.failed` payload; the fork request still returns `201`) — a side-effecting node reached with no recorded source outcome (§Suppression).
 - **`replay_memory_snapshot_unavailable`** (fork refused, `409`) — the host cannot serve memory state as-of `fromSeq`. It MUST refuse rather than substitute current memory; `details.fromSeq` SHOULD name the index.
 - **`replay_context_summary_unavailable`** (fork refused, `409`) — the host advertises `multiAgent.executionModel.contextBudget.summarization` and cannot serve, as-of `fromSeq`, a summary artifact (`context.summarized.summaryRef`) the replay would reuse. It MUST refuse rather than re-summarize; `details.fromSeq` SHOULD name the index.
 
@@ -74,7 +74,7 @@ Suppression is an obligation of the `replay` surface: advertising `replay` binds
 For a fork with `mode: replay`:
 
 1. A node that performs an external side effect — any operation observable outside the run's own event log — MUST NOT perform it.
-2. The host MUST resolve the node's outcome from the source run's recorded terminal outcome for the same `(nodeId, attempt)`, keyed on `(sourceRunId, nodeId, attempt)` and never on the fork's own `runId` (the Layer-2 key includes `runId`, so it cannot span a fork).
+2. The host MUST resolve the node's outcome from the source run's recorded terminal outcome keyed on `(sourceRunId, nodeId, n)`, never on the fork's own `runId`, where `n` counts the node's `node.started` events through this execution, including retries, later visits and the fork's inherited prefix.
 3. Absent a recorded outcome, the host MUST fail the node closed with `replay_source_missing`, MUST NOT perform the effect, and MUST NOT substitute a synthesized or empty success.
 4. A node whose pack manifest declares `role: "side-effect"` MUST be treated as side-effecting; a host classifier MAY add nodes and MUST NOT remove any. A throwing seam satisfies rule 1 only.
 5. The guarantee is whole-run and requires both classification before execution and a default-deny guard at every effect seam.
@@ -102,7 +102,7 @@ A host advertising `replay` MUST publish `schemas/v2/effect-seam-manifest.schema
 1. Load the source run's events with `sequence < fromSeq` through the storage boundary, where an era-`2` log is translated (persistence.md).
 2. Fold them to a projected state.
 3. Initialize the new run with that state, copy-on-write into its own log.
-4. For `replay`, resolve side-effecting nodes from the source run's recorded outcomes keyed on `(sourceRunId, nodeId, attempt)`; LLM invocations additionally consult the invocation log via the content-addressed invocation key.
+4. For `replay`, resolve side-effecting nodes from the source run's recorded outcomes keyed on `(sourceRunId, nodeId, n)`; LLM invocations additionally consult the invocation log via the content-addressed invocation key.
 5. For `branch`, executor invocations create new invocation-log entries keyed on the new `runId`.
 
 ## Forking a v1 run
@@ -132,4 +132,4 @@ A host advertising `replay` MUST document retention for source snapshots, source
 
 See also: events.md, runs.md, persistence.md, security-defaults.md.
 
-*Sources: RFC 0036, RFC 0039, RFC 0041, RFC 0057, RFC 0104, RFC 0111, RFC 0140, RFC 0173, RFC 0176, RFC 0194.*
+*Sources: RFCs 0036, 0039, 0041, 0057, 0104, 0111, 0140, 0173, 0176, 0194.*

package/spec/v2/core/runs.md

@@ -63,7 +63,7 @@ The `createRun` body is closed (`unevaluatedProperties: false`). Its fields:
 The `201` response is `{ runId, status, eventsUrl, statusUrl? }`. `status` is one of `pending`, `running`, `waiting-approval`, `waiting-input`, `waiting-external`.
 
 - `eventsUrl` and `statusUrl` MUST resolve under the origin the request was made to — a relative path, or an absolute URL on the same origin — and MUST NOT downgrade the scheme. A link naming a different host, or `http://` on an `https://` origin, is non-conformant.
-- The base that minted `runId` MUST resolve it: `GET /runs/{runId}` and `GET /runs/{runId}/events/poll` at that base MUST answer `200` for the returned id, percent-encoded per [identity.md](identity.md) §5. (A front door that decodes `%2F` before routing makes every tenant-bound id unreachable.)
+- The base that minted `runId` MUST resolve it: `GET /runs/{runId}` and `GET /runs/{runId}/events/poll` at that base MUST answer `200` for the returned id, percent-encoded per [identity.md](identity.md) §5.
 
 ### Refusals
 
@@ -191,7 +191,7 @@ Per-entry errors ([errors.md](errors.md)):
 `drainPolicy` is one of:
 
 - `drain-current-node` (default) — the executing node reaches a terminal first.
-- `immediate` — the run is snapshotted between events. The executing attempt is cut: it has no terminal node event, a host MUST NOT record `node.failed` (or any terminal node event) for it, and the resumed run's `node.started` begins a fresh attempt. `run.paused` itself records the interruption; its payload MAY carry `interruptedNodeId` and `interruptedAttempt` so a `debug` consumer can see which attempt was cut.
+- `immediate` — the run is snapshotted between events. The executing attempt is cut: it has no terminal node event, a host MUST NOT record `node.failed` (or any terminal node event) for it, and the resumed run's `node.started` begins a fresh attempt. `run.paused` itself records the interruption; its payload MAY carry `interruptedNodeId` and `interruptedAttempt`.
 
 `resumeRun` accepts `{ reason? }`, answers `202 { runId, status: 'running', resumedAt? }`, and emits `run.resumed`.
 
@@ -224,6 +224,8 @@ The `201` response is `{ runId, sourceRunId, fromSeq?, mode, status, eventsUrl }
 
 `getRunAncestry` returns `schemas/v2/run-ancestry-response.schema.json` (`runId`, `hostId`, `parent` or `null`). A client walks the chain one hop at a time via `parent.wellKnownUrl`.
 
+`parent` is the dispatching run, `cause` its composition mechanism. A fork is not dispatched (its lineage is `parentRunId`): its `parent` MUST be `null`.
+
 ## Annotations, artifacts, eval summary
 
 ### Annotations
@@ -264,4 +266,4 @@ A host that does not advertise `dataResidency` MAY ignore or reject a `residency
 
 A non-terminal run inherited from v1 continues, or is cancelled `v1_pin_unsupported`, per [persistence.md](persistence.md) §"Runs pinned to v1".
 
-*Sources: RFC 0170, RFC 0171, RFC 0176, RFC 0182.*
+*Sources: RFCs 0170, 0171, 0176, 0182.*

package/spec/v2/core/security-defaults.md

@@ -142,4 +142,4 @@ Rows `C6.1`–`C6.9` are `spec/v1/migrations.json` entries.
 
 See also: identity.md, replay.md, webhooks.md, capabilities.md, conformance.md.
 
-*Sources: RFC 0150, RFC 0163, RFC 0164, RFC 0170, RFC 0173, RFC 0214, RFC 0218, RFC 0224.*
+*Sources: RFCs 0150, 0163, 0164, 0170, 0173, 0214, 0218, 0224.*

package/spec/v2/core/tool-catalog.md

@@ -42,4 +42,4 @@ A host advertising `toolCatalog.compactView` MUST answer `?view=compact` on both
 
 A host advertising `toolCatalog.sessionLifecycle` MAY bracket calls with content-free `tool.session.opened` and `tool.session.closed`; a consumer MUST tolerate their absence.
 
-*Sources: RFC 0078, RFC 0112, RFC 0204.*
+*Sources: RFCs 0078, 0112, 0204.*

package/spec/v2/core/versioning.md

@@ -192,4 +192,4 @@ Every vendor namespace — capability records ([capabilities.md](capabilities.md
 
 Rows `C5.1`–`C5.9` are `spec/v1/migrations.json` entries (`C5.2` is owned by `events.md`). The persisted-data disposition for each is `not-persisted`, except `C5.1` (legacy-stamped) and `C5.7` (never-upgraded).
 
-*Sources: RFC 0167, RFC 0168, RFC 0172, RFC 0176, RFC 0179, RFC 0181, RFC 0193, RFC 0219.*
+*Sources: RFCs 0167, 0168, 0172, 0176, 0179, 0181, 0193, 0219.*

package/spec/v2/core/webhooks.md

@@ -124,4 +124,4 @@ At delivery time a host MUST re-resolve the hostname, validate every resolved ad
 
 See also: events.md, replay.md, persistence.md, security-defaults.md.
 
-*Sources: RFC 0053, RFC 0165, RFC 0171, RFC 0173, RFC 0176, RFC 0188, RFC 0196, RFC 0201, RFC 0215, RFC 0217.*
+*Sources: RFCs 0053, 0165, 0171, 0173, 0176, 0188, 0196, 0201, 0215, 0217.*

package/spec/v2/core/workflow-chain-packs.md

@@ -36,4 +36,4 @@ Fragment edges carry the same `condition` and `triggerRule` shapes as a top-leve
 
 A host MUST carry both fields through expansion verbatim and MUST honor them on expanded edges as on authored ones. [form-content-packs.md](form-content-packs.md) reuses this operator set for field visibility.
 
-*Sources: RFC 0133, RFC 0177.*
+*Sources: RFCs 0133, 0177.*

package/spec/v2/declaration.json

@@ -1803,8 +1803,8 @@
       "extensionName": "brand",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
-        "adoption": "none"
+        "technical": "stable",
+        "adoption": "single-witness"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1822,7 +1822,7 @@
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
-        "adoption": "none"
+        "adoption": "single-witness"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1840,7 +1840,7 @@
       "witness": "claims-check",
       "maturity": {
         "technical": "stable",
-        "adoption": "single-witness"
+        "adoption": "multi-witness"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1875,8 +1875,8 @@
       "extensionName": "data-integration",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
-        "adoption": "none"
+        "technical": "stable",
+        "adoption": "single-witness"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1912,7 +1912,7 @@
       "witness": "claims-check",
       "maturity": {
         "technical": "stable",
-        "adoption": "single-witness"
+        "adoption": "multi-witness"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1930,7 +1930,7 @@
       "witness": "claims-check",
       "maturity": {
         "technical": "stable",
-        "adoption": "single-witness"
+        "adoption": "multi-witness"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1947,8 +1947,8 @@
       "extensionName": "launch-studio",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
-        "adoption": "none"
+        "technical": "stable",
+        "adoption": "multi-witness"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1965,8 +1965,8 @@
       "extensionName": "messaging",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
-        "adoption": "none"
+        "technical": "stable",
+        "adoption": "single-witness"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1984,7 +1984,7 @@
       "witness": "claims-check",
       "maturity": {
         "technical": "stable",
-        "adoption": "single-witness"
+        "adoption": "multi-witness"
       },
       "facets": [],
       "floorScenarios": [],

package/spec/v2/ext/brand/README.md

@@ -1,14 +1,14 @@
 # `brand` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `brand` names a host service for brand artifacts: themes and personas. It is a discovery-only reservation: v2 defines no portable operations or payload contract for it.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `claims-check` |
-| **technical:** | `experimental` |
-| **adoption:** | `none` |
+| **technical:** | `stable` |
+| **adoption:** | `single-witness` |
 | **peer-dependency id** | `brand` |
 | **advertised as** | `extensions.<org>.brand` |
 | **declared facets** | none defined |

package/spec/v2/ext/canvas/README.md

@@ -8,7 +8,7 @@
 | --- | --- |
 | **witness:** | `claims-check` |
 | **technical:** | `experimental` |
-| **adoption:** | `none` |
+| **adoption:** | `single-witness` |
 | **peer-dependency id** | `canvas` |
 | **advertised as** | `extensions.<org>.canvas` |
 | **declared facets** | none defined |

package/spec/v2/ext/chat/README.md

@@ -8,7 +8,7 @@
 | --- | --- |
 | **witness:** | `claims-check` |
 | **technical:** | `stable` |
-| **adoption:** | `single-witness` |
+| **adoption:** | `multi-witness` |
 | **peer-dependency id** | `chat` |
 | **advertised as** | `extensions.<org>.chat` |
 | **declared facets** | none defined |

package/spec/v2/ext/dataIntegration/README.md

@@ -1,14 +1,14 @@
 # `dataIntegration` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `dataIntegration` names typed data-source operations: fetches from configured external sources, transforms and run-scoped variables. It is a discovery-only reservation: v2 defines no portable operations or payload contract for it.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `claims-check` |
-| **technical:** | `experimental` |
-| **adoption:** | `none` |
+| **technical:** | `stable` |
+| **adoption:** | `single-witness` |
 | **peer-dependency id** | `dataIntegration` |
 | **advertised as** | `extensions.<org>.data-integration` |
 | **declared facets** | none defined |

package/spec/v2/ext/kanban/README.md

@@ -8,7 +8,7 @@
 | --- | --- |
 | **witness:** | `claims-check` |
 | **technical:** | `stable` |
-| **adoption:** | `single-witness` |
+| **adoption:** | `multi-witness` |
 | **peer-dependency id** | `kanban` |
 | **advertised as** | `extensions.<org>.kanban` |
 | **declared facets** | none defined |

package/spec/v2/ext/knowledge/README.md

@@ -8,7 +8,7 @@
 | --- | --- |
 | **witness:** | `claims-check` |
 | **technical:** | `stable` |
-| **adoption:** | `single-witness` |
+| **adoption:** | `multi-witness` |
 | **peer-dependency id** | `knowledge` |
 | **advertised as** | `extensions.<org>.knowledge` |
 | **declared facets** | none defined |

package/spec/v2/ext/launchStudio/README.md

@@ -1,14 +1,14 @@
 # `launchStudio` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `launchStudio` names launch-studio operations for the multi-canvas launch workflow. It is a discovery-only reservation: v2 defines no portable operations or payload contract for it.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `claims-check` |
-| **technical:** | `experimental` |
-| **adoption:** | `none` |
+| **technical:** | `stable` |
+| **adoption:** | `multi-witness` |
 | **peer-dependency id** | `launchStudio` |
 | **advertised as** | `extensions.<org>.launch-studio` |
 | **declared facets** | none defined |

package/spec/v2/ext/messaging/README.md

@@ -1,14 +1,14 @@
 # `messaging` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `messaging` names outbound chat-egress dispatch through host-owned connectors. It is a discovery-only reservation: v2 defines no portable operations or payload contract for it.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `claims-check` |
-| **technical:** | `experimental` |
-| **adoption:** | `none` |
+| **technical:** | `stable` |
+| **adoption:** | `single-witness` |
 | **peer-dependency id** | `messaging` |
 | **advertised as** | `extensions.<org>.messaging` |
 | **declared facets** | none defined |

package/spec/v2/ext/restTransport/README.md

@@ -32,12 +32,14 @@ For each coding listed in `contentEncodings`, a request that names only that cod
 
 A client MUST NOT infer anything else from the record.
 
+The claim describes what a client receives at the host's advertised base URL, so a CDN or proxy in front of the host is part of it. A front that drops or rewrites a coding the origin produces makes the claim false. This is the most common way it goes wrong in deployment: one host's CDN served `zstd` as identity while its origin produced `zstd`. A host behind a front should list only the codings measured through that front.
+
 ## Conformance
 
 `conformance/src/scenarios/v2-ext-rest-transport.test.ts` (major 2) records the witness under `openwop.family.restTransport`:
 
 - **Conditional GET:** runs the `conformance-approval` fixture to `waiting-approval`. It checks for a strong `ETag`, a `304` with no body on a matching `If-None-Match`, and a changed `ETag` once the run completes.
-- **Codings:** for each advertised coding, the decoded body is byte-identical to the identity body.
+- **Codings:** for each advertised coding, the decoded body is byte-identical to the identity body. The probe goes through the base URL it is given, so it measures any front in the path.
 
 A host without the claim records `inapplicable`. A host that makes the claim but lacks the fixture records `blocked`.
 

package/spec/v2/ext/webResearch/README.md

@@ -8,7 +8,7 @@
 | --- | --- |
 | **witness:** | `claims-check` |
 | **technical:** | `stable` |
-| **adoption:** | `single-witness` |
+| **adoption:** | `multi-witness` |
 | **peer-dependency id** | `webResearch` |
 | **advertised as** | `extensions.<org>.web-research` |
 | **declared facets** | none defined |

package/spec/v2/release.json

@@ -1,6 +1,6 @@
 {
   "$comment": "RFC 0172 §D.1 — the one release identity the v2 artifacts derive from. `version` is the next corpus tag `v<version>` (the publish workflow's coordinated-release tag pattern `v*`; RFC 0172's `openwop/v2.<minor>.<patch>` spelling is amended to this at its flip). api/v2/*.yaml info.version, the suite's 2.x version and @openwop/spec-artifacts read it. Bumped by the release PR that cuts the tag, never by hand elsewhere.",
-  "version": "2.43.0",
-  "corpusTag": "v2.43.0",
-  "updated": "2026-09-27"
+  "version": "2.43.2",
+  "corpusTag": "v2.43.2",
+  "updated": "2026-09-28"
 }

package/spec/v2/surface-baseline.json

@@ -4,7 +4,7 @@
     "schemas/v2/**/*.json",
     "spec/v2/path-manifest.json"
   ],
-  "release": "2.43.0",
+  "release": "2.43.2",
   "kinds": {
     "union": [
       "channel",