@interop/wallet-core 0.51.0 → 0.53.0

package/README.md

@@ -65,10 +65,6 @@ The subpaths:
   [`@interop/data-integrity-core`](https://npm.im/@interop/data-integrity-core)
   and is re-exported here.
 
-- **`@interop/wallet-core/display`** -- pure verifiable-credential derivation /
-  display helpers and credential input parsing. Raw values out (ISO strings,
-  `Date`, booleans); date formatting, i18n, and UI concerns stay in the app.
-
 - **`@interop/wallet-core/webvh`** -- the account's did:webvh identity: the
   hosted DID log, its per-client update-key rotation, the client enrollment
   entries, the one-entry client-revocation edit (verification methods, update
@@ -145,13 +141,13 @@ The subpaths:
 
 - **`@interop/wallet-core/unlock`** -- standing unlock credentials: every unlock
   method (passphrase, passkey PRF, recovery code) as a standing credential in
-  the recovery-code posture, with self-enrolling login. The credential-derived
-  client identity and binding MAC key, the update-key ladder
+  the recovery-code configuration, with self-enrolling login. The
+  credential-derived client identity and binding MAC key, the update-key ladder
   (latent-and-consumed did:webvh update authority from a random seed carried in
   the unlock record, the current rung recovered from the log itself), the unlock
   record codec (shell / bridge delegation / ladder members under a
   credential-authenticated binding, with the bridge-only re-mint), the merged
-  document-posture edit (a verbatim `keyAgreement` entry or a
+  document-inventory edit (a verbatim `keyAgreement` entry or a
   `publicKeyCommitment` entry for a low-entropy-derived key), and the
   self-enrolling continuation with its composed completion.
 
@@ -192,10 +188,10 @@ import {
 ```
 
 The `sync` and `space` subpaths are re-exported from the package root as well.
-Every other subpath (`identity`, `request`, `display`, `webvh`, `keys`,
-`clients`, `descriptors`, `keyring`, `enrollment`, `recovery`) is
-import-directly-only, so consumers of the root never pull the signing / KMS /
-document-loader dependency graph.
+Every other subpath (`identity`, `request`, `webvh`, `keys`, `clients`,
+`descriptors`, `keyring`, `enrollment`, `recovery`) is import-directly-only, so
+consumers of the root never pull the signing / KMS / document-loader dependency
+graph.
 
 ## Contribute
 

package/dist/clientAnnex/credentialAnchoredGenesis.d.ts

@@ -15,7 +15,7 @@
  * 2. The ladder-anchored did:webvh genesis
  *    (`ensureLadderAnchoredDidWebvh`): the entry signed by ladder rung 0, `updateKeys` = [rung 0], `nextKeyHashes`
  *    = [hash(rung 0), hash(rung 1)], the ladder VM and the credential's
- *    `keyAgreement` posture folded in, `portable` unchanged. There is no KMS
+ *    `keyAgreement` inventory folded in, `portable` unchanged. There is no KMS
  *    stage: the keystore is DEFERRED to the first durable enrollment (a
  *    ladder-anchored account has no consumer for the convenience VM, and a
  *    keystore under an evaporating identity would orphan).
@@ -52,7 +52,7 @@ import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import type { WebvhIdStore } from '../webvh/didWebvh.js';
 import type { UnlockKeyAgreementPublication } from '../unlock/standingWebvh.js';
 import { type UserKey } from '../keys/index.js';
-import type { ResourceLogPinStore } from '../resourceLog/index.js';
+import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import { type AccountGenesisResult } from '../genesis/accountGenesis.js';
 /**
  * The key set a credential-anchored signup mints locally before anything

package/dist/clientAnnex/credentialAnchoredGenesis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentialAnchoredGenesis.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAwB,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;AAC/E,OAAO,EAGL,KAAK,OAAO,EAEb,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;GAQG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC;IACnE,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;CAC3B,CAAC,CAED;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,6BAA6B,CAAA;IAC3C,iBAAiB,EAAE,kBAAkB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0FhC"}
+{"version":3,"file":"credentialAnchoredGenesis.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAwB,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;AAC/E,OAAO,EAGL,KAAK,OAAO,EAEb,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;GAQG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC;IACnE,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;CAC3B,CAAC,CAED;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,6BAA6B,CAAA;IAC3C,iBAAiB,EAAE,kBAAkB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0FhC"}

package/dist/clientAnnex/credentialAnchoredGenesis.js

@@ -15,7 +15,7 @@
  * 2. The ladder-anchored did:webvh genesis
  *    (`ensureLadderAnchoredDidWebvh`): the entry signed by ladder rung 0, `updateKeys` = [rung 0], `nextKeyHashes`
  *    = [hash(rung 0), hash(rung 1)], the ladder VM and the credential's
- *    `keyAgreement` posture folded in, `portable` unchanged. There is no KMS
+ *    `keyAgreement` inventory folded in, `portable` unchanged. There is no KMS
  *    stage: the keystore is DEFERRED to the first durable enrollment (a
  *    ladder-anchored account has no consumer for the convenience VM, and a
  *    keystore under an evaporating identity would orphan).

package/dist/clientAnnex/forget.d.ts

@@ -16,7 +16,7 @@
  * so it can sign no roster append (the entry-proof rule), and its WAS
  * invocations stop verifying (the current-key-set rule), so the collection
  * fan-out cannot run either -- while a ladder-signed append is licensed only
- * at a posture-changing document version, which a not-last-client removal is
+ * at a inventory-changing document version, which a not-last-client removal is
  * not. So:
  *
  * 1. **The roster rotation**, PRE-edit, signed by the still-enrolled
@@ -31,7 +31,7 @@
  *    residue could open.
  * 3. **The removal entry** ({@link forgetWebvhClient}): one atomic
  *    ladder-signed entry through the bridge takes the client's whole document
- *    footprint out. The app's local wipe runs after this ceremony returns, so
+ *    inventory out. The app's local wipe runs after this ceremony returns, so
  *    a tear anywhere before the entry reads as "not forgotten" and a re-click
  *    resumes.
  *
@@ -60,6 +60,7 @@
 import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { CollectionEncryption } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
+import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import type { RevokedClientKeys } from '../webvh/revokeClient.js';
 import { type CascadeCollections, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
 import type { UnlockLogStore } from '../unlock/standingWebvh.js';
@@ -88,9 +89,18 @@ export interface DurableClientForgetResult {
  * @param options {object}
  * @param options.logStore {UnlockLogStore}   the credential's delegated
  *   `did.jsonl` bridge store; also serves the ceremony's public pre-edit
- *   read. The caller is expected to have verified the account log under its
- *   own chain-head pins in the same session (the ceremony re-reads through
- *   the seam and checks `expectedDid`, but carries no pin store itself)
+ *   read
+ * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
+ *   pins. Every read the ceremony makes -- the pre-edit read the roster
+ *   rotation's recipient document comes from, and the removal entry's own
+ *   read inside its conflict-retry loop -- is checked against the pinned
+ *   head, so a served truncated prefix is refused (`ResourceLogContinuityError`,
+ *   `rollback`) before any roster append or log publish, and the pin
+ *   advances to the head the removal entry publishes. Without it the
+ *   ceremony checks `expectedDid` only
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
  * @param options.ladderSeed {Uint8Array}   the credential's ladder seed
  * @param options.forgottenClient {RevokedClientKeys}   this client's public
  *   halves; an `updateKeyMultibase` the log does not authorize (stale, or the
@@ -117,8 +127,10 @@ export interface DurableClientForgetResult {
  * @param options.collections {CascadeCollections}   the fan-out's work
  * @returns {Promise<DurableClientForgetResult>}
  */
-export declare function forgetDurableClient({ logStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections }: {
+export declare function forgetDurableClient({ logStore, pinStore, logId, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections }: {
     logStore: UnlockLogStore;
+    pinStore?: ResourceLogPinStore;
+    logId?: string;
     ladderSeed: Uint8Array;
     forgottenClient: RevokedClientKeys;
     forgottenKeyAgreementKeyMultibase: string;

package/dist/clientAnnex/forget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forget.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAGxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAKzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACZ,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,yBAAyB,CAAA;IACtC,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;CAChC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAoGrC"}
+{"version":3,"file":"forget.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAGxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAKzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACZ,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,yBAAyB,CAAA;IACtC,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;CAChC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAwGrC"}

package/dist/clientAnnex/forget.js

@@ -10,9 +10,18 @@ import { forgetWebvhClient, LastDurableClientForgetError } from './ladderAnchore
  * @param options {object}
  * @param options.logStore {UnlockLogStore}   the credential's delegated
  *   `did.jsonl` bridge store; also serves the ceremony's public pre-edit
- *   read. The caller is expected to have verified the account log under its
- *   own chain-head pins in the same session (the ceremony re-reads through
- *   the seam and checks `expectedDid`, but carries no pin store itself)
+ *   read
+ * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
+ *   pins. Every read the ceremony makes -- the pre-edit read the roster
+ *   rotation's recipient document comes from, and the removal entry's own
+ *   read inside its conflict-retry loop -- is checked against the pinned
+ *   head, so a served truncated prefix is refused (`ResourceLogContinuityError`,
+ *   `rollback`) before any roster append or log publish, and the pin
+ *   advances to the head the removal entry publishes. Without it the
+ *   ceremony checks `expectedDid` only
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
  * @param options.ladderSeed {Uint8Array}   the credential's ladder seed
  * @param options.forgottenClient {RevokedClientKeys}   this client's public
  *   halves; an `updateKeyMultibase` the log does not authorize (stale, or the
@@ -39,7 +48,7 @@ import { forgetWebvhClient, LastDurableClientForgetError } from './ladderAnchore
  * @param options.collections {CascadeCollections}   the fan-out's work
  * @returns {Promise<DurableClientForgetResult>}
  */
-export async function forgetDurableClient({ logStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections }) {
+export async function forgetDurableClient({ logStore, pinStore, logId, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections }) {
     // The pre-edit read, doing double duty: the last-client refusal must fire
     // BEFORE the rotation (or a refused forget would already have retired this
     // client's wrap), and the rotation's recipient resolver needs the pre-edit
@@ -48,7 +57,9 @@ export async function forgetDurableClient({ logStore, ladderSeed, forgottenClien
         // readPublishedLog only calls getIdResourceRaw, so the narrow seam is
         // safe.
         idStore: logStore,
-        expectedDid
+        expectedDid,
+        ...(pinStore ? { pinStore } : {}),
+        ...(logId !== undefined ? { logId } : {})
     });
     if (!published) {
         throw new Error('did:webvh: did.jsonl is missing; nothing to forget from.');
@@ -118,7 +129,9 @@ export async function forgetDurableClient({ logStore, ladderSeed, forgottenClien
         ladderSeed,
         forgottenClient,
         ...(knownLatentHashes ? { knownLatentHashes } : {}),
-        expectedDid
+        expectedDid,
+        ...(pinStore ? { pinStore } : {}),
+        ...(logId !== undefined ? { logId } : {})
     });
     return {
         rotated,

package/dist/clientAnnex/forget.js.map

@@ -1 +1 @@
-{"version":3,"file":"forget.js","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AA8DA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAGpE,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAIpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAoB5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EAkBZ;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,sEAAsE;QACtE,QAAQ;QACR,OAAO,EAAE,QAAwB;QACjC,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAA;IAC7E,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IACrE,IACE,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;QACnC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,4BAA4B,EAAE,CAAA;IAC1C,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,IAAwE,CAAA;IAC5E,IAAI,OAAO,GAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAChE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;YACxD,wBAAwB,EAAE,iCAAiC;SAC5D,CAAC,CAAA;QACF,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACnC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;QACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,YAAY,CAC3C,CAAA;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBACrC,KAAK,EAAE,WAAW;gBAClB,QAAQ,EAAE,SAAS,CAAC,GAAG;gBACvB,iBAAiB,EAAE,YAAY;aAChC,CAAC,CAAA;YACF,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;YACtC,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB,EAAE,yBAAyB;YAChD,aAAa;SACd,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,gBAAgB,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;QACnE,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC1C,aAAa,EACX,OAAO,WAAW,CAAC,aAAa,KAAK,UAAU;gBAC7C,CAAC,CAAC,MAAM,WAAW,CAAC,aAAa,EAAE;gBACnC,CAAC,CAAC,WAAW,CAAC,aAAa;YAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACP,gBAAgB,EAAE,OAAO,CAAC,UAAU;YACpC,qBAAqB,EAAE,yBAAyB;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;QACtC,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,eAAe;QACf,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW;KACZ,CAAC,CAAA;IAEF,OAAO;QACL,OAAO;QACP,WAAW,EAAE,OAAO;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC"}
+{"version":3,"file":"forget.js","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AA8DA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAIpE,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAIpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAoB5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EAoBZ;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,sEAAsE;QACtE,QAAQ;QACR,OAAO,EAAE,QAAwB;QACjC,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAA;IAC7E,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IACrE,IACE,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;QACnC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,4BAA4B,EAAE,CAAA;IAC1C,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,IAAwE,CAAA;IAC5E,IAAI,OAAO,GAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAChE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;YACxD,wBAAwB,EAAE,iCAAiC;SAC5D,CAAC,CAAA;QACF,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACnC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;QACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,YAAY,CAC3C,CAAA;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBACrC,KAAK,EAAE,WAAW;gBAClB,QAAQ,EAAE,SAAS,CAAC,GAAG;gBACvB,iBAAiB,EAAE,YAAY;aAChC,CAAC,CAAA;YACF,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;YACtC,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB,EAAE,yBAAyB;YAChD,aAAa;SACd,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,gBAAgB,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;QACnE,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC1C,aAAa,EACX,OAAO,WAAW,CAAC,aAAa,KAAK,UAAU;gBAC7C,CAAC,CAAC,MAAM,WAAW,CAAC,aAAa,EAAE;gBACnC,CAAC,CAAC,WAAW,CAAC,aAAa;YAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACP,gBAAgB,EAAE,OAAO,CAAC,UAAU;YACpC,qBAAqB,EAAE,yBAAyB;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;QACtC,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,eAAe;QACf,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IAEF,OAAO;QACL,OAAO;QACP,WAAW,EAAE,OAAO;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC"}

package/dist/clientAnnex/forgetLast.d.ts

@@ -14,15 +14,15 @@
  * POST at all). So:
  *
  * 1. **The install entry** ({@link installLadderVmWebvh}): the ladder VM
- *    joins the document while the client's whole footprint stays -- the
+ *    joins the document while the client's whole inventory stays -- the
  *    both-present transitional state. This is the ceremony's
- *    posture-changing document version under the ceremony-tail license.
+ *    inventory-changing document version under the ceremony-tail license.
  * 2. **The roster rotation**, ladder-signed, anchored at the install entry,
  *    HTTP-invoked under the still-standing client: the user key rotates off
  *    this client's wrap in ONE append (the license's one-shot shape), read
  *    back through the credential's standing wrap. Because the append's
  *    signer is the ladder VM -- a key the post-removal document still lists
- *    -- the roster log needs no seal completer afterwards, which matters on
+ *    -- the roster log needs no seal repair afterwards, which matters on
  *    an account where no enrolled client's login sweep will ever run again.
  * 3. **The collection fan-out**, still under this client's invocation
  *    authority: every encrypted collection re-epochs onto the fresh key.
@@ -51,18 +51,25 @@
  *    management zcaps are granted to the account DID, which only an enrolled
  *    client can invoke) -- which is why the stage must run before the
  *    removal entry. The pass walks every entry and reports each one's fate,
- *    but the ceremony does not carry a failure past this point: a `failed`
- *    entry refuses the removal entry ({@link RecordRemintFailedError},
- *    naming the records the pass could not reach), since after the removal
- *    nothing could ever re-sign that record's bridge. The client stays
+ *    but the ceremony does not carry an unsettled entry past this point: a
+ *    `failed` or `pending-entry` outcome refuses the removal entry
+ *    ({@link RecordRemintFailedError}, naming the records the pass left
+ *    unreached), since after the removal nothing could ever re-sign that
+ *    record's bridge. The client stays
  *    enrolled, and a re-run reaches the entry again.
- * 6. **The record re-bind seam** (`onBeforeRemoval`): the caller re-signs
- *    the LOGIN credential's bridge and `delegatedClients` sibling with the
- *    ladder VM and re-seals its unlock record with the credential in hand
- *    (a full re-wrap, proof verified rather than settled) -- the one record
- *    stage 5 need not reach.
+ * 6. **The record re-bind seam** (`onBeforeRemoval`, required): the caller
+ *    re-signs the LOGIN credential's bridge and `delegatedClients` sibling
+ *    with the ladder VM and re-seals its unlock record with the credential
+ *    in hand (a full re-wrap, proof verified rather than settled). Stage 5
+ *    deliberately skips that credential (its record is re-sealed with the
+ *    credential in hand rather than through a management zcap), so the
+ *    seam is the only thing that ever re-signs the login credential's own
+ *    bridge with the ladder VM. Without it the removal entry would leave
+ *    every bridge signed by the struck key on an account with no durable
+ *    client -- an account nothing can write to -- which is why a call that
+ *    omits the seam is refused before any read.
  * 7. **The removal entry** ({@link forgetLastWebvhClient}): the client's
- *    whole document footprint out while the installed ladder VM keeps the
+ *    whole document inventory out while the installed ladder VM keeps the
  *    account anchored. The app's local wipe runs after this ceremony
  *    returns.
  *
@@ -89,7 +96,7 @@ import type { ZcapClient } from '@interop/ezcap';
 import type { CollectionEncryption, IDelegatedZcap } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import { type RevokedClientKeys } from '../webvh/revokeClient.js';
-import type { ResourceLogPinStore } from '../resourceLog/index.js';
+import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import { type CascadeCollections, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
 import type { UnlockLogStore } from '../unlock/standingWebvh.js';
 import type { AccountPointer } from '../keyring/record.js';
@@ -159,10 +166,16 @@ export interface LastDurableClientForgetResult {
     rosterDescriptor?: CollectionEncryption;
 }
 /**
- * The record re-mint stage could not reach every other unlock method's
- * record, so the removal entry was refused: `failed` names the entries whose
- * re-mint threw (each carrying its cause), and `unlockMethods` is the whole
- * stage report. The forgotten client is still enrolled and every stage
+ * The record re-mint stage could not settle every other unlock method's
+ * record, so the removal entry was refused: `failed` names the entries the
+ * pass left unreached -- those whose re-mint threw (each carrying its cause)
+ * and those it skipped as pending-shaped (the entry's identity members name
+ * a credential other than the one its record is sealed to) -- and
+ * `unlockMethods` is the whole stage report. A pending-shaped entry blocks
+ * for the same reason a failed one does: its bridge is left signed by the
+ * key the removal entry strikes, and on a client-less account no login will
+ * ever heal it. The mender is a durable login, which is exactly what the
+ * removal would end. The forgotten client is still enrolled and every stage
  * before this one has landed, so a re-run resumes at the re-mint. Matched
  * on `name` (the errors cross app-injected seams that may resolve to another
  * copy of this package).
@@ -185,11 +198,15 @@ export declare class RecordRemintFailedError extends Error {
  *
  * @param options {object}
  * @param options.logStore {UnlockLogStore}   the credential's delegated
- *   `did.jsonl` bridge store; also serves the ceremony's public reads. The
- *   caller is expected to have verified the account log under its own
- *   chain-head pins in the same session (the ceremony re-reads through the
- *   seam and checks `expectedDid`, but carries no account-log pin store
- *   itself)
+ *   `did.jsonl` bridge store; also serves the ceremony's public reads
+ * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
+ *   pins, the account log's slot derived from `annex.accountSpaceId`. Every
+ *   account-log read the ceremony makes -- the pre-install read, and the
+ *   install and removal entries' own reads inside their conflict-retry
+ *   loops -- is checked against the pinned head, so a served truncated
+ *   prefix is refused (`ResourceLogContinuityError`, `rollback`) before any
+ *   roster append or log publish, and each entry advances the pin to the
+ *   head it publishes. Without it the ceremony checks `expectedDid` only
  * @param options.ladderSeed {Uint8Array}   the login credential's ladder seed
  * @param options.forgottenClient {RevokedClientKeys}   this client's public
  *   halves; an `updateKeyMultibase` the log does not authorize (stale, or the
@@ -204,7 +221,7 @@ export declare class RecordRemintFailedError extends Error {
  * @param options.rosterStoreFor {Function}   `({ did, log }) => store` --
  *   builds the `key-map/user-key.jsonl` roster store whose appends are
  *   SIGNED BY THE LADDER VM and whose controller view resolves from the
- *   supplied post-install log (the posture-changing anchor the ceremony-tail
+ *   supplied post-install log (the inventory-changing anchor the ceremony-tail
  *   license admits), while its HTTP requests invoke under the still-standing
  *   client
  * @param options.credentialKeyAgreementKey {IKeyAgreementKey}   the standing
@@ -238,20 +255,24 @@ export declare class RecordRemintFailedError extends Error {
  *   re-seals through their management zcaps, invoked as the still-standing
  *   client. Omitted, the stage is skipped and the result carries no
  *   `unlockMethods` report -- the residue decision 0004's amendment stated.
- *   Supplied, an entry the pass could not re-mint refuses the removal entry
+ *   Supplied, an entry the pass could not re-mint -- or skipped as
+ *   pending-shaped -- refuses the removal entry
  *   (`RecordRemintFailedError`)
- * @param [options.onBeforeRemoval] {Function}
+ * @param options.onBeforeRemoval {Function}
  *   `({ did, doc, log }) => Promise<void>` -- the record re-bind seam: runs
  *   after the record re-mint stage, immediately before the removal entry,
  *   with the post-install published state. The caller re-signs the login
  *   credential's bridge and `delegatedClients` sibling with the ladder VM
- *   and re-seals its unlock record here. Must be idempotent (a resumed run
- *   invokes it again)
+ *   and re-seals its unlock record here -- the only stage that reaches the
+ *   login credential's record, which the `unlockMethods` pass skips. Must
+ *   be idempotent (a resumed run invokes it again). Required: a call
+ *   without it throws a `TypeError` before any read
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {Promise<LastDurableClientForgetResult>}
  */
-export declare function forgetLastDurableClient({ logStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now }: {
+export declare function forgetLastDurableClient({ logStore, pinStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now }: {
     logStore: UnlockLogStore;
+    pinStore?: ResourceLogPinStore;
     ladderSeed: Uint8Array;
     forgottenClient: RevokedClientKeys;
     forgottenKeyAgreementKeyMultibase: string;
@@ -281,7 +302,7 @@ export declare function forgetLastDurableClient({ logStore, ladderSeed, forgotte
         pinStore?: ResourceLogPinStore;
     };
     unlockMethods?: UnlockMethodsRemintReach;
-    onBeforeRemoval?: (published: {
+    onBeforeRemoval: (published: {
         did: string;
         doc: object;
         log: DIDLog;

package/dist/clientAnnex/forgetLast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,OAAO,KAAK,EAAU,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAGxE,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAElE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAA;AAO1C,OAAO,EASL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,uBAAuB,GAAG,uBAAuB;IAE/D,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,8BAA8B,CAAA;IAC1C,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CACjC,6BAA6B,CAAC,eAAe,CAAC,CAC/C,CAAA;gBAEW,EACV,aAAa,EACd,EAAE;QACD,aAAa,EAAE,WAAW,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC,CAAA;KAC3E;CAeF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAgB,EACjB,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,yBAAyB,CAAA;IAC/B,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,YAAY,EAAE,MAAM,CAAA;SACrB,KAAK,qBAAqB,CAAA;QAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrD,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B,CAAA;IACD,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACxC,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE;QAC5B,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAqKzC"}
+{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AACH,OAAO,KAAK,EAAU,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAA;AAO1C,OAAO,EASL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,uBAAuB,GAAG,uBAAuB;IAE/D,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,8BAA8B,CAAA;IAC1C,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAeD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CACjC,6BAA6B,CAAC,eAAe,CAAC,CAC/C,CAAA;gBAEW,EACV,aAAa,EACd,EAAE;QACD,aAAa,EAAE,WAAW,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC,CAAA;KAC3E;CAeF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAgB,EACjB,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,yBAAyB,CAAA;IAC/B,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,YAAY,EAAE,MAAM,CAAA;SACrB,KAAK,qBAAqB,CAAA;QAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrD,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B,CAAA;IACD,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACxC,eAAe,EAAE,CAAC,SAAS,EAAE;QAC3B,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAgMzC"}

package/dist/clientAnnex/forgetLast.js

@@ -1,7 +1,8 @@
 import { readPublishedLog, relationIds } from '../webvh/didWebvh.js';
+import { accountLogPinId } from '../webvh/verifyLog.js';
 import { clientRemovalTarget } from '../webvh/revokeClient.js';
 import { delegationProofKeyId } from '../webvh/standingZcap.js';
-import { vmFragmentOf } from '../resourceLog/index.js';
+import { vmFragmentOf } from '@interop/vh-resource-log';
 import { cascadeCollectionsToUserKey, readUserKeyRoster, rosterRecipientKid, rotateUserKeyRoster } from '../keys/index.js';
 import { readLogOrThrow } from '../unlock/standingWebvh.js';
 import { recordSignerFromAgent } from '../keyring/record.js';
@@ -11,10 +12,28 @@ import { ladderVmAgent, ladderVmZcapClient } from './zcap.js';
 import { forgetLastWebvhClient, installLadderVmWebvh } from './ladderAnchored.js';
 import { clientAnnexDidParts, clientAnnexLogPinId, delegatedClientsDelegationMinter, delegatedClientsPointer, ensureGenerationDelegationCurrent, generationDelegationHistory, mintGenerationDelegation, revokeTreatingAlreadyRevokedAsSuccess } from './log.js';
 /**
- * The record re-mint stage could not reach every other unlock method's
- * record, so the removal entry was refused: `failed` names the entries whose
- * re-mint threw (each carrying its cause), and `unlockMethods` is the whole
- * stage report. The forgotten client is still enrolled and every stage
+ * The re-mint outcomes that withhold the removal entry: a record the pass
+ * could not reach, and a pending-shaped entry it deliberately did not write
+ * (re-minting one would seal a half-retired credential a fresh bridge into
+ * the standing credential's record). Both leave a bridge the removal entry
+ * would rot for good on an account that will never see a durable login
+ * again.
+ */
+const REMINT_BLOCKING_OUTCOMES = [
+    'failed',
+    'pending-entry'
+];
+/**
+ * The record re-mint stage could not settle every other unlock method's
+ * record, so the removal entry was refused: `failed` names the entries the
+ * pass left unreached -- those whose re-mint threw (each carrying its cause)
+ * and those it skipped as pending-shaped (the entry's identity members name
+ * a credential other than the one its record is sealed to) -- and
+ * `unlockMethods` is the whole stage report. A pending-shaped entry blocks
+ * for the same reason a failed one does: its bridge is left signed by the
+ * key the removal entry strikes, and on a client-less account no login will
+ * ever heal it. The mender is a durable login, which is exactly what the
+ * removal would end. The forgotten client is still enrolled and every stage
  * before this one has landed, so a re-run resumes at the re-mint. Matched
  * on `name` (the errors cross app-injected seams that may resolve to another
  * copy of this package).
@@ -23,8 +42,8 @@ export class RecordRemintFailedError extends Error {
     failed;
     unlockMethods;
     constructor({ unlockMethods }) {
-        const failed = unlockMethods.outcomes.filter(outcome => outcome.outcome === 'failed');
-        super('did:webvh: the last-client forget could not re-mint the record of ' +
+        const failed = unlockMethods.outcomes.filter(outcome => REMINT_BLOCKING_OUTCOMES.includes(outcome.outcome));
+        super('did:webvh: the last-client forget could not settle the record of ' +
             `${failed.length} other unlock method(s) (` +
             failed.map(outcome => `"${outcome.label}"`).join(', ') +
             '); the removal entry was not published. The client stays enrolled; ' +
@@ -45,11 +64,15 @@ export class RecordRemintFailedError extends Error {
  *
  * @param options {object}
  * @param options.logStore {UnlockLogStore}   the credential's delegated
- *   `did.jsonl` bridge store; also serves the ceremony's public reads. The
- *   caller is expected to have verified the account log under its own
- *   chain-head pins in the same session (the ceremony re-reads through the
- *   seam and checks `expectedDid`, but carries no account-log pin store
- *   itself)
+ *   `did.jsonl` bridge store; also serves the ceremony's public reads
+ * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
+ *   pins, the account log's slot derived from `annex.accountSpaceId`. Every
+ *   account-log read the ceremony makes -- the pre-install read, and the
+ *   install and removal entries' own reads inside their conflict-retry
+ *   loops -- is checked against the pinned head, so a served truncated
+ *   prefix is refused (`ResourceLogContinuityError`, `rollback`) before any
+ *   roster append or log publish, and each entry advances the pin to the
+ *   head it publishes. Without it the ceremony checks `expectedDid` only
  * @param options.ladderSeed {Uint8Array}   the login credential's ladder seed
  * @param options.forgottenClient {RevokedClientKeys}   this client's public
  *   halves; an `updateKeyMultibase` the log does not authorize (stale, or the
@@ -64,7 +87,7 @@ export class RecordRemintFailedError extends Error {
  * @param options.rosterStoreFor {Function}   `({ did, log }) => store` --
  *   builds the `key-map/user-key.jsonl` roster store whose appends are
  *   SIGNED BY THE LADDER VM and whose controller view resolves from the
- *   supplied post-install log (the posture-changing anchor the ceremony-tail
+ *   supplied post-install log (the inventory-changing anchor the ceremony-tail
  *   license admits), while its HTTP requests invoke under the still-standing
  *   client
  * @param options.credentialKeyAgreementKey {IKeyAgreementKey}   the standing
@@ -98,25 +121,44 @@ export class RecordRemintFailedError extends Error {
  *   re-seals through their management zcaps, invoked as the still-standing
  *   client. Omitted, the stage is skipped and the result carries no
  *   `unlockMethods` report -- the residue decision 0004's amendment stated.
- *   Supplied, an entry the pass could not re-mint refuses the removal entry
+ *   Supplied, an entry the pass could not re-mint -- or skipped as
+ *   pending-shaped -- refuses the removal entry
  *   (`RecordRemintFailedError`)
- * @param [options.onBeforeRemoval] {Function}
+ * @param options.onBeforeRemoval {Function}
  *   `({ did, doc, log }) => Promise<void>` -- the record re-bind seam: runs
  *   after the record re-mint stage, immediately before the removal entry,
  *   with the post-install published state. The caller re-signs the login
  *   credential's bridge and `delegatedClients` sibling with the ladder VM
- *   and re-seals its unlock record here. Must be idempotent (a resumed run
- *   invokes it again)
+ *   and re-seals its unlock record here -- the only stage that reaches the
+ *   login credential's record, which the `unlockMethods` pass skips. Must
+ *   be idempotent (a resumed run invokes it again). Required: a call
+ *   without it throws a `TypeError` before any read
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {Promise<LastDurableClientForgetResult>}
  */
-export async function forgetLastDurableClient({ logStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now = Date.now() }) {
+export async function forgetLastDurableClient({ logStore, pinStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now = Date.now() }) {
+    // The seam is the only stage that re-signs the login credential's bridge
+    // with the ladder VM; a run without it would land the removal entry over
+    // a record the struck key signed, on an account nothing could then write
+    // to. Refused before any read, so nothing is published.
+    if (typeof onBeforeRemoval !== 'function') {
+        throw new TypeError('forgetLastDurableClient requires onBeforeRemoval: the login ' +
+            "credential's record is re-bound only through that seam");
+    }
     // The pre-install read and the two guards: a client with no remaining
     // presence means the removal entry already landed (the finish-the-wipe
     // state the app's next login maps -- nothing here can still invoke), and
     // an account with another enrolled durable client belongs to the ordinary
     // forget ceremony.
-    const before = await readLogOrThrow({ store: logStore, expectedDid });
+    // The account log's pin slot, shared by every read and entry below.
+    const pinned = pinStore
+        ? { pinStore, logId: accountLogPinId({ spaceId: annex.accountSpaceId }) }
+        : {};
+    const before = await readLogOrThrow({
+        store: logStore,
+        expectedDid,
+        ...pinned
+    });
     const preTarget = await clientRemovalTarget({
         published: before,
         client: forgottenClient
@@ -141,7 +183,8 @@ export async function forgetLastDurableClient({ logStore, ladderSeed, forgottenC
     const install = await installLadderVmWebvh({
         store: logStore,
         ladderSeed,
-        expectedDid
+        expectedDid,
+        ...pinned
     });
     // Stage 2: the roster rotation off this client's wrap, ladder-signed and
     // anchored at the install entry, then stage 3, the collection fan-out --
@@ -223,31 +266,34 @@ export async function forgetLastDurableClient({ logStore, ladderSeed, forgottenC
             now
         });
         // The one pass that will ever reach these records on a client-less
-        // account: a record it could not re-seal would be left with a bridge the
+        // account: a record it could not re-seal -- or deliberately did not
+        // write, the pending-shaped entry -- would be left with a bridge the
         // removal entry rots for good, so the removal is refused instead. The
         // stages already landed are idempotent and the client still stands, so
         // the re-run resumes here.
-        if (remint.outcomes.some(outcome => outcome.outcome === 'failed')) {
+        if (remint.outcomes.some(outcome => REMINT_BLOCKING_OUTCOMES.includes(outcome.outcome))) {
             throw new RecordRemintFailedError({ unlockMethods: remint });
         }
     }
-    // Stage 6: the record re-bind seam, while the removal has not landed (a
+    // Stage 6: the record re-bind seam -- the login credential's record, the
+    // one stage 5 skipped -- while the removal has not landed (a
     // ladder-VM-signed bridge verifies from the install entry on, and the old
     // client-signed one keeps verifying until the removal -- so a tear on
     // either side of this callback leaves a working login).
-    await onBeforeRemoval?.({
+    await onBeforeRemoval({
         did: install.did,
         doc: install.doc,
         log: install.log
     });
-    // Stage 7: the removal entry -- the client's whole footprint out, the
+    // Stage 7: the removal entry -- the client's whole inventory out, the
     // installed ladder VM keeping the account anchored.
     const removed = await forgetLastWebvhClient({
         store: logStore,
         ladderSeed,
         forgottenClient,
         ...(knownLatentHashes ? { knownLatentHashes } : {}),
-        expectedDid
+        expectedDid,
+        ...pinned
     });
     return {
         installed: install.installed,