@zackbart/connecta 0.38.0 → 0.40.0

package/dist/credential-contract.d.ts

@@ -10,6 +10,12 @@ export interface CredentialMetadata {
     /** Backward-compatible metadata for the reserved single credential field. */
     lastFour?: string;
     updatedAt: string;
+    /**
+     * Opaque and unique to the save this metadata describes. Credential
+     * verification is recorded only against it, so a vault that omits it
+     * stores credentials that are never shown as verified.
+     */
+    revision?: string;
     /** Per-field masked metadata for named multi-value credentials. */
     fields?: Record<string, CredentialFieldMetadata>;
 }
@@ -20,6 +26,15 @@ export interface CredentialVault {
     set(connectorId: string, value: string, updatedBy: string, owner?: string): Promise<CredentialMetadata>;
     setAll(connectorId: string, values: ConnectorCredentialValues, updatedBy: string, owner?: string): Promise<CredentialMetadata>;
     delete(connectorId: string, owner?: string): Promise<void>;
+    /**
+     * The values and metadata of one save, read together so neither can come
+     * from a later save. Without it, a Test of the stored credential records
+     * no verification.
+     */
+    snapshot?(connectorId: string, owner?: string): Promise<{
+        values: ConnectorCredentialValues;
+        metadata: CredentialMetadata;
+    } | null>;
     /**
      * Encrypt downstream OAuth state (tokens, a registered client, a PKCE
      * verifier) before it enters storage. `purpose` is the storage key the value
@@ -37,6 +52,14 @@ export interface CredentialVault {
      * exposes the vault or this key through a connector context or guest API.
      */
     requestStateKey?(): Promise<Uint8Array>;
+    /**
+     * Host-only HMAC-SHA-256 signing key for stored remote catalog,
+     * negotiation-verdict and connector-health keys, so those partitions are
+     * deployment-keyed. Must be stable across the deployment's processes,
+     * purpose-specific, and never stored. Without it, those keys use a random
+     * per-process key, and such entries are reused only within one process.
+     */
+    storageDigestKey?(): Promise<CryptoKey>;
     /** Reverse `seal` for the same connector, purpose, and owner; rejects otherwise. */
     open?(connectorId: string, purpose: string, sealed: string, owner?: string): Promise<string>;
 }

package/dist/credential-reads.js

@@ -0,0 +1,17 @@
+const readers = new WeakMap();
+/** `canonical` is the base class's own prototype methods, never the instance's. */
+export function registerCredentialReads(vault, canonical, memo) {
+    readers.set(vault, { canonical, memo });
+}
+/** A `fresh` reader always reads storage and records what it saw. */
+export function credentialReads(vault, reads, fresh = false) {
+    const reader = readers.get(vault);
+    return {
+        getAll: (connectorId, owner) => reader && vault.getAll === reader.canonical.getAll
+            ? reader.memo.getAll(connectorId, owner, reads, fresh)
+            : vault.getAll(connectorId, owner),
+        metadata: (connectorId, owner) => reader && vault.metadata === reader.canonical.metadata
+            ? reader.memo.metadata(connectorId, owner, reads, fresh)
+            : vault.metadata(connectorId, owner),
+    };
+}

package/dist/credential-verification.js

@@ -0,0 +1,53 @@
+// The last verification of a connector's operator-managed credential: a typed,
+// payload-free observation stored per connector and owner (the connector's
+// `ctx.storage` is already partitioned by both). Credential tests and saves
+// write it; the operator page only reads it (INV-10).
+import { classifyCallError } from "./errors.js";
+import { verificationKeys } from "./storage/keys.js";
+const FAILURES = ["rejected", "scope", "unreachable", "timeout", "failed"];
+const OUTCOMES = ["ok", "unverified", "rejected", "scope", "unreachable", "timeout", "failed"];
+/** Each typed code that names a class; every other code is `failed`. */
+const CLASS_OF = {
+    auth_required: "rejected",
+    downstream_oauth_required: "rejected",
+    provider_permission_denied: "scope",
+    timeout: "timeout",
+    unavailable: "unreachable",
+    rate_limited: "unreachable",
+};
+/** A thrown failure's class, read from its typed code alone, never its text. */
+export const credentialFailureClass = (error) => CLASS_OF[classifyCallError(error).code] ?? "failed";
+/** A hook's answer as an outcome. Only its typed fields count; `message` never does. */
+export const credentialTestOutcome = (result) => result?.ok === true ? "ok" : FAILURES.includes(result?.failure) ? result.failure : "failed";
+/** A checked copy, or undefined: nothing here trusts stored bytes. */
+function checkedVerification(value) {
+    const { outcome, observedAt } = (value ?? {});
+    return OUTCOMES.includes(outcome) &&
+        typeof observedAt === "string" &&
+        observedAt.length < 64 &&
+        !Number.isNaN(Date.parse(observedAt))
+        ? { outcome: outcome, observedAt }
+        : undefined;
+}
+/**
+ * The stored observation, or undefined when there is none or it cannot be
+ * read. With `credential`, only one made about that vault credential (its
+ * `updatedAt`) counts: a replacement saved since is unverified.
+ */
+export async function readVerification(storage, credential) {
+    try {
+        const stored = JSON.parse((await storage.get(verificationKeys.record)) ?? "null");
+        return credential === undefined || stored?.credential === credential ? checkedVerification(stored) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Record an outcome, bound to the vault credential's `updatedAt` when it is about one; `null` removes the record. */
+export async function writeVerification(storage, outcome, credential) {
+    if (!outcome)
+        return void (await storage.delete(verificationKeys.record));
+    const record = { outcome, observedAt: new Date().toISOString() };
+    await storage.set(verificationKeys.record, JSON.stringify({ ...record, credential }));
+    return record;
+}

package/dist/credentials.d.ts

@@ -11,15 +11,22 @@ export declare class CredentialVault implements Vault {
     private readonly key;
     private readonly handoffKey;
     private readonly retryKey;
+    private readonly digestKey;
     constructor(storage: KVStorage, encryptionKey: string);
     signOAuthHandoff(payload: string): Promise<string>;
     requestStateKey(): Promise<Uint8Array>;
+    storageDigestKey(): Promise<CryptoKey>;
     verifyOAuthHandoff(payload: string, signature: string): Promise<boolean>;
     private additionalData;
     private read;
     get(connectorId: string, field?: string, owner?: string): Promise<string | null>;
     getAll(connectorId: string, owner?: string): Promise<ConnectorCredentialValues | null>;
     metadata(connectorId: string, owner?: string): Promise<CredentialMetadata | null>;
+    /** The values and metadata of one save, from a single envelope read. */
+    snapshot(connectorId: string, owner?: string): Promise<{
+        values: ConnectorCredentialValues;
+        metadata: CredentialMetadata;
+    } | null>;
     set(connectorId: string, value: string, updatedBy: string, owner?: string): Promise<CredentialMetadata>;
     setAll(connectorId: string, values: ConnectorCredentialValues, updatedBy: string, owner?: string): Promise<CredentialMetadata>;
     delete(connectorId: string, owner?: string): Promise<void>;

package/dist/credentials.js

@@ -1,6 +1,7 @@
 import { advanceCatalogRevision } from "./catalog-revision.js";
-import { deriveOAuthHandoffKey, deriveRequestStateKey } from "./oauth-sealing.js";
+import { deriveOAuthHandoffKey, deriveRequestStateKey, deriveStorageDigestKey } from "./oauth-sealing.js";
 import { credentialKeys } from "./storage/keys.js";
+import { registerCredentialReads } from "./credential-reads.js";
 const KEY_BYTES = 32;
 const IV_BYTES = 12;
 const MAX_CREDENTIAL_BYTES = 16_384;
@@ -50,7 +51,7 @@ function parseEnvelope(raw) {
         throw new Error("Stored credential is invalid or corrupted");
     }
 }
-function parsePlaintext(raw) {
+function parsePlaintext(raw, iv) {
     try {
         const parsed = JSON.parse(raw);
         const values = typeof parsed.value === "string" ? { value: parsed.value } : parsed.values;
@@ -66,6 +67,7 @@ function parsePlaintext(raw) {
             values: { ...values },
             updatedAt: parsed.updatedAt,
             updatedBy: parsed.updatedBy,
+            revision: typeof parsed.revision === "string" ? parsed.revision : iv,
         };
     }
     catch {
@@ -91,6 +93,28 @@ function validateValues(values) {
     }
     return normalized;
 }
+function metadataOf(credential) {
+    if (!credential)
+        return null;
+    const fields = Object.fromEntries(Object.entries(credential.values).map(([field, value]) => [
+        field,
+        {
+            configured: true,
+            // Only reveal the tail on values comfortably longer than four chars;
+            // for a short secret those four would be half of it.
+            ...(value.length >= 12 ? { lastFour: value.slice(-4) } : {}),
+            updatedAt: credential.updatedAt,
+        },
+    ]));
+    const single = fields.value;
+    return {
+        configured: true,
+        ...(single?.lastFour ? { lastFour: single.lastFour } : {}),
+        updatedAt: credential.updatedAt,
+        revision: credential.revision,
+        fields,
+    };
+}
 /**
  * Encrypted, connector-scoped credential vault over the deployment's existing
  * KVStorage. Only ciphertext enters storage; the AES-GCM key remains an environment
@@ -102,6 +126,7 @@ export class CredentialVault {
     key;
     handoffKey;
     retryKey;
+    digestKey;
     constructor(storage, encryptionKey) {
         this.storage = storage;
         const raw = base64ToBytes(encryptionKey.trim());
@@ -110,7 +135,16 @@ export class CredentialVault {
         }
         this.handoffKey = deriveOAuthHandoffKey(raw);
         this.retryKey = deriveRequestStateKey(raw);
+        this.digestKey = deriveStorageDigestKey(raw);
         this.key = crypto.subtle.importKey("raw", raw, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+        // The base class's original methods, so an override is never replaced.
+        registerCredentialReads(this, canonicalReads, {
+            getAll: async (connectorId, owner, reads, fresh) => {
+                const credential = await this.read(connectorId, owner, { reads, fresh });
+                return credential ? { ...credential.values } : null;
+            },
+            metadata: async (connectorId, owner, reads, fresh) => metadataOf(await this.read(connectorId, owner, { reads, fresh })),
+        });
     }
     async signOAuthHandoff(payload) {
         return bytesToBase64(new Uint8Array(await crypto.subtle.sign("HMAC", await this.handoffKey, encoder.encode(payload))));
@@ -118,6 +152,9 @@ export class CredentialVault {
     async requestStateKey() {
         return new Uint8Array(await this.retryKey);
     }
+    storageDigestKey() {
+        return this.digestKey;
+    }
     async verifyOAuthHandoff(payload, signature) {
         try {
             return await crypto.subtle.verify("HMAC", await this.handoffKey, base64ToBytes(signature), encoder.encode(payload));
@@ -129,8 +166,11 @@ export class CredentialVault {
     additionalData(connectorId, owner) {
         return encoder.encode(owner ? `connecta:credential:principal:${owner}:${connectorId}:v1` : `connecta:credential:${connectorId}:v1`);
     }
-    async read(connectorId, owner) {
-        const raw = await this.storage.get(storageKey(connectorId, owner));
+    async read(connectorId, owner, memo) {
+        const key = storageKey(connectorId, owner);
+        const raw = memo
+            ? await memo.reads.readPromise(this.storage, key, () => this.storage.get(key), memo.fresh)
+            : await this.storage.get(key);
         if (!raw)
             return null;
         const envelope = parseEnvelope(raw);
@@ -140,7 +180,7 @@ export class CredentialVault {
                 iv: base64ToBytes(envelope.iv),
                 additionalData: this.additionalData(connectorId, owner),
             }, await this.key, base64ToBytes(envelope.ciphertext));
-            return parsePlaintext(decoder.decode(plaintext));
+            return parsePlaintext(decoder.decode(plaintext), envelope.iv);
         }
         catch {
             throw new Error("Stored credential could not be decrypted");
@@ -155,26 +195,12 @@ export class CredentialVault {
         return credential ? { ...credential.values } : null;
     }
     async metadata(connectorId, owner) {
+        return metadataOf(await this.read(connectorId, owner));
+    }
+    /** The values and metadata of one save, from a single envelope read. */
+    async snapshot(connectorId, owner) {
         const credential = await this.read(connectorId, owner);
-        if (!credential)
-            return null;
-        const fields = Object.fromEntries(Object.entries(credential.values).map(([field, value]) => [
-            field,
-            {
-                configured: true,
-                // Only reveal the tail on values comfortably longer than four chars;
-                // for a short secret those four would be half of it.
-                ...(value.length >= 12 ? { lastFour: value.slice(-4) } : {}),
-                updatedAt: credential.updatedAt,
-            },
-        ]));
-        const single = fields.value;
-        return {
-            configured: true,
-            ...(single?.lastFour ? { lastFour: single.lastFour } : {}),
-            updatedAt: credential.updatedAt,
-            fields,
-        };
+        return credential && { values: { ...credential.values }, metadata: metadataOf(credential) };
     }
     async set(connectorId, value, updatedBy, owner) {
         // `await` (not a bare promise return) so a validation throw inside setAll
@@ -188,6 +214,7 @@ export class CredentialVault {
             values: normalized,
             updatedAt: new Date().toISOString(),
             updatedBy,
+            revision: crypto.randomUUID(),
         };
         const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
         const ciphertext = await crypto.subtle.encrypt({
@@ -203,7 +230,9 @@ export class CredentialVault {
         };
         await this.storage.set(storageKey(connectorId, owner), JSON.stringify(envelope));
         advanceCatalogRevision(this);
-        return (await this.metadata(connectorId, owner));
+        // What this write stored, never a re-read: a concurrent save may already
+        // have replaced it, and its revision must not be reported as this one's.
+        return metadataOf(plaintext);
     }
     async delete(connectorId, owner) {
         await this.storage.delete(storageKey(connectorId, owner));
@@ -238,6 +267,12 @@ export class CredentialVault {
         }
     }
 }
+// Captured once at definition: a later subclass, instance or prototype
+// override of either method is always called itself (credential-reads.ts).
+const canonicalReads = {
+    getAll: CredentialVault.prototype.getAll,
+    metadata: CredentialVault.prototype.metadata,
+};
 export function encryptedCredentialVault(storage, encryptionKey) {
     return new CredentialVault(storage, encryptionKey);
 }

package/dist/describe-config.d.ts

@@ -1,6 +1,6 @@
 import { CONFIG_DEFAULTS } from "./config-defaults.js";
 import type { ConnectaConfig, ResolvedConfig } from "./config.js";
-import type { ResolvedPool } from "./membership.js";
+import { type ResolvedPool } from "./membership.js";
 import type { ConnectorAuthDescription, ConnectorDescription, ConnectorToolDescription, DescribedEndpoint, IdentityReference } from "./types.js";
 /** Where a limit's value came from. */
 export type ConfigValueSource = "default" | "config";
@@ -100,11 +100,21 @@ export interface ConnectaConfigDescription {
     };
     /** Whether the default /mcp endpoint refuses every write, and exact classification overrides from deployment code. */
     readOnly: boolean;
-    /** The principals plain `/mcp` admits, resolved, in declaration order. Empty on an open deployment. */
+    /**
+     * The people plain `/mcp` serves the whole catalog, resolved, in declaration
+     * order. Empty on an open deployment. Every other person reaches plain
+     * `/mcp` only through exactly one pool's `members`, which it then serves.
+     */
     maintainers: Array<{
         namespace: string;
         id: string;
     }>;
+    /** Non-maintainer people listed in several pools, whom plain `/mcp` refuses. */
+    peopleInSeveralPools: Array<{
+        namespace: string;
+        id: string;
+        pools: string[];
+    }>;
     classification: Record<string, Record<string, "read" | "write" | "hidden">>;
     /** Inbound auth providers in the order they are tried. */
     auth: Array<{

package/dist/describe-config.js

@@ -15,6 +15,7 @@ import { resolveBranding } from "./branding.js";
 import { CONFIG_DEFAULTS } from "./config-defaults.js";
 import { describedEndpoint, describedHref, describedOrigin, describedTools, describedUrl } from "./described.js";
 import { connectorGuideRequired, connectorGuideSummary } from "./skills.js";
+import { peopleInSeveralPools } from "./membership.js";
 import { CONNECTA_VERSION } from "./version.js";
 const str = (value) => (typeof value === "string" ? value : undefined);
 const num = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
@@ -235,6 +236,7 @@ export function describeConfig(input) {
         },
         readOnly: config.readOnly,
         maintainers: input.maintainers.map(({ namespace, id }) => ({ namespace: String(namespace), id: String(id) })),
+        peopleInSeveralPools: peopleInSeveralPools(input.pools, input.maintainers),
         classification: structuredClone(config.classification ?? {}),
         auth: config.auth.map((provider) => ({
             kind: String(provider.kind),

package/dist/discovery-health.js

@@ -0,0 +1,199 @@
+// Bounded per-connector discovery health, shared across requests (INV-7).
+//
+// One hung or failing connector would otherwise add its whole probe deadline
+// to every unscoped search, every time. A failed discovery leaves a record:
+// the connector-health family's `discovery` key, a typed code, when it was
+// seen, and when to try again (INV-6: never downstream text, tools or
+// credentials). Unscoped search skips a connector whose record is current and
+// reports it as unavailable in `catalogErrors` with `retryAfterMs`; it never
+// serves tools from the failed or interrupted walk (INV-8). Scoped search,
+// describe and calls still reach the connector.
+//
+// Records sit beside the catalog cache, in its store and owner partition:
+// principal, subject, caller identity and pool, origin, the admitted endpoint,
+// the connector's value-free described configuration and the package version
+// (INV-4, INV-5). Each record
+// also carries the connector's catalog invalidation generation as it was when
+// written. A credential change, OAuth connect or disconnect, or operator
+// invalidation rotates that generation, so every partition's record lapses at
+// once, in every isolate. A record is a bounded observation: it grants and
+// starts nothing (INV-10).
+//
+// After its retry time a record lingers, so exactly one request can claim the
+// next probe by compare-and-set as it dispatches it; the others keep skipping
+// until that probe settles or its lease lapses. A success, or an auth failure that proves the
+// connector answers, clears the record. A fast failure is not recorded:
+// asking again costs the next search nothing. Caller cancellation and a probe cut
+// short by the discovery budget record nothing.
+import { Effect } from "effect";
+import { healthAddress } from "./connector-health.js";
+export { bindDiscoveryEndpoint } from "./connector-health.js";
+import { classificationCode, classifyCallError } from "./errors.js";
+import { failureRecord, logFailure } from "./operator-record.js";
+import { causeError } from "./runtime/run.js";
+import { Storage } from "./runtime/services.js";
+import { storageCompareAndSet, storageGetMany, storageSet } from "./runtime/storage.js";
+import { connectorHealthKeys, CONNECTOR_HEALTH_LINGER_MS } from "./storage/keys.js";
+/** How long unscoped search skips a connector after a failed discovery. */
+const DISCOVERY_RETRY_MS = 60_000;
+/**
+ * A retryable failure slower than this is recorded; a faster one is cheap to
+ * ask again. A timeout, or a downstream that names its own wait, always is.
+ */
+const SLOW_FAILURE_MS = 1_000;
+function parseFact(raw) {
+    if (raw === null)
+        return undefined;
+    try {
+        const value = JSON.parse(raw);
+        const code = classificationCode(value.code);
+        if (value.v !== 1 ||
+            !code ||
+            !Number.isFinite(value.observedAt) ||
+            !Number.isFinite(value.retryAt) ||
+            !(value.generation === null || typeof value.generation === "string"))
+            return undefined;
+        return { v: 1, code, observedAt: value.observedAt, retryAt: value.retryAt, generation: value.generation };
+    }
+    catch {
+        return undefined;
+    }
+}
+function encodeFact(fact) {
+    return { raw: JSON.stringify(fact), expiresAtMs: Math.ceil(fact.retryAt + CONNECTOR_HEALTH_LINGER_MS) };
+}
+/**
+ * Each connector's verdict for this discovery, in `ids` order. With `skip`, a
+ * record of the current generation comes back as `skip`: current until its
+ * `retryAt`, claimable at dispatch once that has passed. Without `skip` every
+ * connector is probed and the slot only settles the record afterwards. A
+ * storage failure is a probe with no slot: health never fails discovery.
+ */
+export function readDiscoveryHealth(registry, ids, baseUrl, requestScope, options) {
+    return Effect.gen(function* () {
+        // Authored static catalogs never hang, so discovery keeps no health for them.
+        const addresses = yield* Effect.forEach(ids, (id) => registry.getConnector(id)?.staticTools
+            ? Effect.succeed(undefined)
+            : healthAddress(registry, id, baseUrl, requestScope), {
+            concurrency: "unbounded",
+        });
+        const verdicts = ids.map(() => ({}));
+        // One getMany per store: every record and its generation in one round trip.
+        const stores = new Map();
+        addresses.forEach((address, index) => {
+            if (!address)
+                return;
+            const indexes = stores.get(address.storage) ?? [];
+            indexes.push(index);
+            stores.set(address.storage, indexes);
+        });
+        for (const [storage, indexes] of stores) {
+            const keys = indexes.flatMap((index) => [
+                connectorHealthKeys.discovery(ids[index], addresses[index].digest),
+                addresses[index].generationKey,
+            ]);
+            const values = yield* storageGetMany(keys).pipe(Effect.provideService(Storage, storage), Effect.catchCause((cause) => Effect.sync(() => {
+                const first = addresses[indexes[0]];
+                logFailure(first.logger, "discovery health read failed", failureRecord({}, causeError(cause)));
+                return undefined;
+            })));
+            if (!values)
+                continue;
+            for (const [position, index] of indexes.entries()) {
+                const address = addresses[index];
+                const slot = {
+                    storage,
+                    key: keys[position * 2],
+                    logger: address.logger,
+                    generation: values[position * 2 + 1] ?? null,
+                    raw: values[position * 2] ?? null,
+                };
+                const fact = parseFact(slot.raw);
+                verdicts[index] =
+                    !options.skip || !fact || fact.generation !== slot.generation
+                        ? { slot }
+                        : { slot, skip: { code: fact.code, retryAt: fact.retryAt } };
+            }
+        }
+        return verdicts;
+    });
+}
+/**
+ * Claim the probe of a record whose retry time has passed, as the probe is
+ * dispatched: one compare-and-set against the record this request read, with
+ * a lease to the absolute time `leaseUntil`, past the claimant's whole
+ * discovery budget. Others keep skipping until the lease lapses or the probe
+ * settles. False when another request holds it, or the record changed.
+ */
+export function claimDiscoveryProbe(slot, leaseUntil) {
+    return Effect.suspend(() => {
+        const fact = parseFact(slot.raw);
+        if (!fact)
+            return Effect.succeed(slot.raw === null);
+        const claim = encodeFact({ ...fact, retryAt: leaseUntil });
+        return storageCompareAndSet(slot.key, slot.raw, claim.raw, { expiresAtMs: claim.expiresAtMs }).pipe(Effect.provideService(Storage, slot.storage), Effect.map((claimed) => {
+            if (claimed)
+                slot.raw = claim.raw;
+            return claimed;
+        }), Effect.catchCause(() => Effect.succeed(false)));
+    });
+}
+const REACHABLE_CODES = new Set([
+    "auth_required",
+    "downstream_oauth_required",
+    "provider_permission_denied",
+]);
+/**
+ * Settle one probed connector's record. `ok` and an auth failure clear a
+ * record this request saw; a recordable failure writes a fresh one. A
+ * cancelled or budget-cut probe passes `undefined` and leaves the record as
+ * it is, so a claim it held lapses on its own.
+ */
+export function settleDiscoveryHealth(slot, outcome) {
+    return Effect.suspend(() => {
+        let fact;
+        if (!outcome.ok) {
+            const classified = outcome.timedOut ? undefined : classifyCallError(outcome.failure, "catalog_lookup_failed");
+            const code = outcome.timedOut ? "timeout" : classificationCode(classified.code);
+            if (classified && REACHABLE_CODES.has(classified.code)) {
+                fact = undefined;
+            }
+            else if (code &&
+                (outcome.timedOut ||
+                    (classified.retryable && (outcome.elapsedMs >= SLOW_FAILURE_MS || classified.retryAfterMs !== undefined)))) {
+                const now = Date.now();
+                const window = classified?.retryAfterMs !== undefined
+                    ? Math.min(DISCOVERY_RETRY_MS, Math.max(1_000, classified.retryAfterMs))
+                    : DISCOVERY_RETRY_MS;
+                fact = { v: 1, code, observedAt: now, retryAt: now + window, generation: slot.generation };
+            }
+            else {
+                // A deterministic refusal is not a health fact, and a fast failure
+                // costs the next search nothing to ask again; leave the record.
+                return Effect.succeed({ slot });
+            }
+        }
+        if (!fact) {
+            if (slot.raw === null)
+                return Effect.succeed({ slot });
+            // Clear only the record this request saw: a newer failure stays.
+            return storageCompareAndSet(slot.key, slot.raw, null).pipe(Effect.provideService(Storage, slot.storage), Effect.map((cleared) => {
+                if (cleared)
+                    slot.raw = null;
+                return { slot };
+            }), Effect.catchCause((cause) => Effect.sync(() => {
+                logFailure(slot.logger, "discovery health write failed", failureRecord({}, causeError(cause)));
+                return { slot };
+            })));
+        }
+        const encoded = encodeFact(fact);
+        const skip = { code: fact.code, retryAt: fact.retryAt };
+        return storageSet(slot.key, encoded.raw, { expiresAtMs: encoded.expiresAtMs }).pipe(Effect.provideService(Storage, slot.storage), Effect.map(() => {
+            slot.raw = encoded.raw;
+            return { slot, skip };
+        }), Effect.catchCause((cause) => Effect.sync(() => {
+            logFailure(slot.logger, "discovery health write failed", failureRecord({}, causeError(cause)));
+            return { slot, skip };
+        })));
+    });
+}

package/dist/downstream-input.js

@@ -210,6 +210,7 @@ export class DownstreamElicitation {
                     kind: "downstream",
                     principal,
                     endpoint,
+                    pool: self.options.registry.resultIdentity().pool,
                     connector: pending.connector,
                     address: String(args.address),
                     target: pending.address,
@@ -370,6 +371,7 @@ export class DownstreamElicitation {
                     state.kind !== "downstream" ||
                     state.principal !== principal ||
                     state.endpoint !== endpoint ||
+                    state.pool !== registry.resultIdentity().pool ||
                     state.connector !== wrapper.connector ||
                     typeof state.address !== "string" ||
                     typeof state.target !== "string" ||