keri-ts 0.11.0 → 2.0.0

package/esm/keri/npm/src/acdc/messaging.js

@@ -100,6 +100,8 @@ export function regcept(issuer, options = {}) {
 /** Create an ACDC v2 blindable registry update (`bup`) message. */
 export function blindate(regid, prior, blid, options = {}) {
     const { sn = 1, stamp, pvrsn = Vrsn_2_0, gvrsn = Vrsn_2_0, kind = Kinds.json } = options;
+    if (BigInt(sn) < 1n)
+        throw new ValidationError(`ACDC blindable update sequence number must be positive: ${sn}`);
     return new SerderACDC({
         sad: {
             v: versionString({ pvrsn, gvrsn, kind }),

package/esm/keri/npm/src/acdc/observing.js

@@ -1,17 +1,19 @@
-/** Explicit public registry intake; this TypeScript integration is beyond frozen KERIpy 927. */
-import { Diger, Ilks, ParserError, ResourceLimitError } from "cesr-ts";
-import { DatabaseNotOpenError } from "../core/errors.js";
+/** Public v2 registry intake with event-local opening preflight and durable retention. */
+import { bytesEqual, Diger, Ilks, ParserError } from "cesr-ts";
+import { DatabaseNotOpenError, DatabaseOperationError } from "../core/errors.js";
 import { RegistryEventer } from "./regengine.js";
-import { validateRip, validateUpdate } from "./regeventing.js";
+import { validateRegistrySourceLocators, validateRip, validateUpdate, vetBlind, } from "./regeventing.js";
+import { publicOpeningAttachment } from "./registering.js";
 /**
  * Borrow accepted public KEL state and one registry store without habitats, aliases or handles.
  * Reconstruct the engine's issuer from stored inception after reopen. Intake uses the engine's
- * full tuple/witness anchor policy, distinct from digest-only observer vetting. Each accepted
+ * exact registry-seal and historical witness policy shared with observer vetting. Each accepted
  * event commits independently; a later failure preserves the already accepted prefix.
- * Parsed evidence stays borrowed. This installs no automatic parser or runtime route.
+ * Parsed evidence stays borrowed. Composition supplies this owner to v2 protocol dispatch;
+ * no local habitat, alias or application disclosure custody is created by public intake.
  */
 export class RegistryObserver {
-    constructor(db, store, { maxEvents = 16384 } = {}) {
+    constructor(db, store) {
         Object.defineProperty(this, "db", {
             enumerable: true,
             configurable: true,
@@ -24,34 +26,36 @@ export class RegistryObserver {
             writable: true,
             value: store
         });
-        Object.defineProperty(this, "maxEvents", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        if (!Number.isSafeInteger(maxEvents) || maxEvents < 1) {
-            throw new RangeError("Registry maxEvents must be positive and safe.");
-        }
-        this.maxEvents = maxEvents;
     }
     /** Stage parsed events before inception, otherwise delegate ordinary validation and acceptance. */
-    processEvent(serder) {
+    processEvent(serder, locators = {}) {
         const result = serder.ilk === Ilks.rip ? validateRip(serder) : validateUpdate(serder, serder.regid ?? "");
         if (result.kind === "reject")
             return result;
         const event = result.event;
+        const openings = [...locators.bsqs ?? [], ...locators.bsss ?? []], opening = openings[0];
+        if (openings.length > 1 || (opening && event.ilk !== Ilks.bup))
+            return { kind: "reject", reason: "disclosure" };
+        if (opening) {
+            if (!vetBlind(opening, serder.sad.b))
+                return { kind: "reject", reason: "disclosure" };
+            const old = this.store.opening(event.said), stored = this.store.event(event.said);
+            if ((old && !bytesEqual(old, publicOpeningAttachment(opening)))
+                || (stored && !bytesEqual(stored.raw, serder.raw)))
+                return { kind: "reject", reason: "disclosure" };
+        }
         // Unknown registry routing cannot rely on a stored RIP to validate its qualified SAID.
         try {
             if (new Diger({ qb64: event.regid }).qb64 !== event.regid)
                 return { kind: "reject", reason: "registry" };
         }
         catch (error) {
-            if (!(error instanceof ParserError) || error instanceof ResourceLimitError)
+            if (!(error instanceof ParserError))
                 throw error;
             return { kind: "reject", reason: "registry" };
         }
-        this.checkOrdinal(event.sn);
+        if (event.sn > BigInt(Number.MAX_SAFE_INTEGER))
+            return { kind: "reject", reason: "ordinalRange" };
         let engine = this.engine(event.regid);
         if (engine && !(engine instanceof RegistryEventer))
             return engine;
@@ -61,15 +65,22 @@ export class RegistryObserver {
             engine ??= new RegistryEventer(this.db, event.issuer, this.store, event.regid);
         }
         if (engine) {
-            this.checkStored(event.regid, engine);
-            return engine.processEvent(serder);
+            const decision = engine.processEvent(serder, locators);
+            if (decision.kind !== "reject" && opening)
+                this.store.retainOpening(serder, opening);
+            return decision;
         }
+        if (!validateRegistrySourceLocators(serder, this.db, null, locators))
+            return { kind: "reject", reason: "anchor" };
         // Issuer/anchor discovery is impossible until RIP arrives; the existing anchor escrow owns this body.
         const baser = this.store.baser;
-        baser.initializeStorage();
+        if (baser.readonly)
+            throw new DatabaseOperationError("Cannot write readonly registry storage.");
         return baser.env.transactionSync(() => {
             this.store.putEvent(serder);
             this.store.escrowMissingAnchor(event.regid, Number(event.sn), event.said);
+            if (opening)
+                this.store.retainOpening(serder, opening);
             return { kind: "escrow", reason: "inception", event };
         });
     }
@@ -78,9 +89,21 @@ export class RegistryObserver {
         const engine = this.engine(regid);
         if (!(engine instanceof RegistryEventer))
             return;
-        this.checkStored(regid, engine);
         engine.processEscrows();
     }
+    /**
+     * Retry registries named by durable dependency escrows, including foreign registries after reopen.
+     * Finish both table cursors before acceptance writes; local aliases do not determine pending work.
+     */
+    processAllEscrows() {
+        const registries = new Set();
+        for (const table of [this.store.baser.maes, this.store.baser.ooes]) {
+            for (const [keys] of table.getAllItemIter())
+                registries.add(keys[0]);
+        }
+        for (const regid of registries)
+            this.processEscrows(regid);
+    }
     /** Stored inception is durable issuer identity, including while its anchor is still absent. */
     engine(regid) {
         if (!this.store.baser.env)
@@ -103,20 +126,4 @@ export class RegistryObserver {
         }
         return new RegistryEventer(this.db, result.event.issuer, this.store, regid);
     }
-    /** Bound chain length before processing; this does not bound queued rows, scans or native allocation. */
-    checkOrdinal(sn) {
-        if (sn >= BigInt(this.maxEvents))
-            throw new ResourceLimitError("Registry evidence exceeds configured event limit.");
-    }
-    /** A tighter observer must not advance previously staged rows beyond its own finite ceiling. */
-    checkStored(regid, engine) {
-        this.checkOrdinal(engine.sn);
-        for (const escrow of [this.store.baser.maes, this.store.baser.ooes]) {
-            for (const [, sn] of escrow?.getTopItemIter(regid) ?? []) {
-                if (!Number.isSafeInteger(sn) || sn < 0)
-                    throw new RangeError("Unsafe observer escrow ordinal.");
-                this.checkOrdinal(BigInt(sn));
-            }
-        }
-    }
 }

package/esm/keri/npm/src/acdc/regbasing.js

@@ -1,13 +1,12 @@
 /** Public ACDC registry database layout and joined LMDB lifecycle. */
 import { b, Diger, NumberPrimitive, Saider, SerderACDC } from "cesr-ts";
-import { DatabaseNotOpenError, DatabaseOperationError } from "../core/errors.js";
+import { DatabaseNotOpenError } from "../core/errors.js";
 import { LMDBer } from "../db/core/lmdber.js";
-import { B64OnIoSetSuber, CatCesrSuber, CesrOnSuber, CesrSuber, SerderSuber } from "../db/subing.js";
+import { B64OnIoSetSuber, BytesSuber, CatCesrSuber, CesrOnSuber, CesrSuber, SerderSuber } from "../db/subing.js";
 /**
  * Own one environment for public registry TEL bodies, accepted ordinals and heads.
  * Mirrors frozen KERIpy RegBaser's typed tables; opening neither verifies
- * evidence nor migrates rows. Absent anchor/escrow tables stay null until an
- * explicit storage write initializes them, preserving readonly old layouts.
+ * evidence nor migrates rows. Every current store has anchor and escrow tables.
  * Construction stays closed; callers own reopen and joined close.
  */
 export class RegBaser extends LMDBer {
@@ -15,15 +14,10 @@ export class RegBaser extends LMDBer {
     hasTable(name) {
         if (!this.env)
             throw new DatabaseNotOpenError("Registry environment is closed.");
-        return this.env.getBinary(b(name)) !== undefined;
-    }
-    /** Explicit writable initialization; never called by opening or reading a store. */
-    initializeStorage() {
-        if (this.readonly)
-            throw new DatabaseOperationError("Cannot initialize readonly registry storage.");
-        this.ancs ??= new CatCesrSuber(this, { subkey: "ancs.", ctor: [NumberPrimitive, Diger] });
-        this.maes ??= new B64OnIoSetSuber(this, { subkey: "maes." });
-        this.ooes ??= new B64OnIoSetSuber(this, { subkey: "ooes." });
+        // Native lmdb-js exposes its C-string terminator in root metadata keys;
+        // the Deno backend also supports the unterminated representation.
+        return this.env.getBinary(b(name)) !== undefined
+            || this.env.getBinary(b(`${name}\0`)) !== undefined;
     }
     constructor(options = {}) {
         super(options, {
@@ -54,26 +48,33 @@ export class RegBaser extends LMDBer {
             writable: true,
             value: void 0
         });
-        /** Event-SAID -> earliest verified KEL source couple, when this table exists. */
+        /** Event-SAID -> one deliberately published counted BSQ/BSS opening; never private custody. */
+        Object.defineProperty(this, "openings", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Event-SAID -> earliest verified KEL source couple, in the current store. */
         Object.defineProperty(this, "ancs", {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: null
+            value: void 0
         });
         /** Insertion-ordered missing-anchor event-SAID tuples by registry and ordinal. */
         Object.defineProperty(this, "maes", {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: null
+            value: void 0
         });
         /** Insertion-ordered out-of-order event-SAID tuples by registry and ordinal. */
         Object.defineProperty(this, "ooes", {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: null
+            value: void 0
         });
     }
     /** Rebind the same environment's typed tables after every joined reopen. */
@@ -85,11 +86,10 @@ export class RegBaser extends LMDBer {
             this.evts = new SerderSuber(this, { subkey: "evts.", ctor: SerderACDC });
             this.tels = new CesrOnSuber(this, { subkey: "tels.", ctor: Saider });
             this.heads = new CesrSuber(this, { subkey: "heds.", ctor: Saider });
-            this.ancs = this.hasTable("ancs.")
-                ? new CatCesrSuber(this, { subkey: "ancs.", ctor: [NumberPrimitive, Diger] })
-                : null;
-            this.maes = this.hasTable("maes.") ? new B64OnIoSetSuber(this, { subkey: "maes." }) : null;
-            this.ooes = this.hasTable("ooes.") ? new B64OnIoSetSuber(this, { subkey: "ooes." }) : null;
+            this.openings = new BytesSuber(this, { subkey: "openings." });
+            this.ancs = new CatCesrSuber(this, { subkey: "ancs.", ctor: [NumberPrimitive, Diger] });
+            this.maes = new B64OnIoSetSuber(this, { subkey: "maes." });
+            this.ooes = new B64OnIoSetSuber(this, { subkey: "ooes." });
             return true;
         }
         catch (error) {

package/esm/keri/npm/src/acdc/regengine.js

@@ -1,12 +1,11 @@
-/** Internal local TEL acceptance; registry facades own instance naming and scheduling. */
-import { Diger, Ilks, makeBlindState, makeBoundState, NumberPrimitive, SerderACDC, } from "cesr-ts";
-import { DatabaseNotOpenError, ValidationError } from "../core/errors.js";
-import { blindate } from "./messaging.js";
-import { validateRip, validateUpdate, verifyRegistryAnchor, } from "./regeventing.js";
-import { FailedSchemaValidationError, MissingSchemaError, validateSchema } from "./scheming.js";
+/** Shared TEL validation, accepted-state publication, anchoring and retry for local and foreign registries. */
+import { Diger, Ilks, NumberPrimitive, } from "cesr-ts";
+import { DatabaseNotOpenError, DatabaseOperationError } from "../core/errors.js";
+import { consoleLogger } from "../core/logger.js";
+import { findRegistryAnchor, validateRegistrySourceLocators, validateRip, validateUpdate, verifyRegistryAnchor, } from "./regeventing.js";
 /**
  * Borrow the issuer's accepted KEL and registry store; no keys or handles are acquired.
- * Event processing is internal until the registry facade is available.
+ * The local facade and foreign observer share this accepted-state engine.
  * Publication is atomic; binding this instance happens only after successful commit.
  */
 export class RegistryEventer {
@@ -36,101 +35,23 @@ export class RegistryEventer {
             value: regk
         });
     }
+    /** Validated accepted head metadata; local construction may inspect it without duplicating acceptance checks. */
+    get acceptedHeadEvent() {
+        return this.regk ? this.acceptedHead(this.regk) : null;
+    }
     /** Read the accepted head only after validating its body and ordinal marker. */
     get head() {
-        const event = this.regk ? this.acceptedHead(this.regk) : null;
+        const event = this.acceptedHeadEvent;
         return event ? this.store.head(event.regid) : null;
     }
     /** Accepted TEL ordinal, retaining -1n for a staged but unaccepted inception. */
     get sn() {
-        return this.regk ? this.acceptedHead(this.regk)?.sn ?? -1n : -1n;
+        return this.acceptedHeadEvent?.sn ?? -1n;
     }
     /** Return an accepted inception; a corrupt marker/body pair throws. */
     get regser() {
         return this.regk ? this.acceptedAt(this.regk, 0) : null;
     }
-    /** Validate credential membership and issuer before deriving its next blinded registry update. */
-    blind(acdc, state, options = {}) {
-        if (!(acdc instanceof SerderACDC) || !acdc.verify()) {
-            throw new ValidationError("Registry blinding requires a self-verifying ACDC.");
-        }
-        if (acdc.regid !== this.regk)
-            throw new ValidationError("Credential belongs to another registry.");
-        if (acdc.issuer !== this.issuer)
-            throw new ValidationError("Credential belongs to another issuer.");
-        const schema = validateSchema(acdc, this.db);
-        if (schema.kind === "missing")
-            throw new MissingSchemaError(schema.said);
-        if (schema.kind === "invalid")
-            throw new FailedSchemaValidationError(schema.reason);
-        return this.blindTarget(acdc.said, state, options);
-    }
-    /** Commit a grant SAID without requiring the grant's issuer to control this presentation registry. */
-    present(grant, state = "presented", options = {}) {
-        const target = typeof grant === "string" ? grant : grant.said;
-        try {
-            new Diger({ qb64: target ?? "" });
-        }
-        catch (cause) {
-            throw new ValidationError("Presentation target must be a valid grant SAID.", { cause });
-        }
-        return this.blindTarget(target, state, options);
-    }
-    /** Empty target/state disclose a vacuous step; downstream verification retains the preceding binding. */
-    vacate(options = {}) {
-        return this.blindTarget("", "", options);
-    }
-    /** Derive and stage a validated target; presentation/vacuous callers own their target checks. */
-    blindTarget(target, state, options) {
-        const tip = this.effectiveFrontier();
-        if (!tip)
-            throw new ValidationError("Registry must be anchored before updates.");
-        if ("blinder" in options)
-            throw new ValidationError("Caller-supplied blinder overrides are unsupported.");
-        const sn = tip.sn + 1n;
-        if (sn > BigInt(Number.MAX_SAFE_INTEGER))
-            throw new RangeError("Unsafe registry update ordinal.");
-        const { raw, salt, tier, bound, bsn, bd, ...wire } = options;
-        const inputs = { raw, salt, tier, sn, acdc: target, state };
-        const blinder = bound ? makeBoundState({ ...inputs, bsn, bd }) : makeBlindState(inputs);
-        const serder = blindate(tip.regid, tip.said, blinder.d.nonce, { ...wire, sn });
-        const decision = this.processEvent(serder);
-        if (decision.kind === "reject")
-            throw new ValidationError(`Registry update rejected: ${decision.reason}`);
-        return [blinder, serder];
-    }
-    /** Extend an accepted head through exactly one staged successor at each ordinal, without mutation. */
-    effectiveFrontier() {
-        let tip = this.regk ? this.acceptedHead(this.regk) : null;
-        while (tip) {
-            const sn = tip.sn + 1n;
-            if (sn > BigInt(Number.MAX_SAFE_INTEGER))
-                return tip;
-            const saids = new Set();
-            for (const escrow of [this.store.baser.maes, this.store.baser.ooes]) {
-                for (const [said] of escrow?.get(tip.regid, Number(sn)) ?? [])
-                    saids.add(said);
-            }
-            let successor = null;
-            for (const said of saids) {
-                const body = this.store.event(said);
-                if (!body)
-                    continue;
-                if (body.said !== said)
-                    throw new Error("Corrupt staged registry event.");
-                const result = validateUpdate(body, tip.regid);
-                if (result.kind !== "valid" || result.event.sn !== sn || result.event.prior !== tip.said)
-                    continue;
-                if (successor)
-                    throw new ValidationError("Registry has conflicting staged successors.");
-                successor = result.event;
-            }
-            if (!successor)
-                return tip;
-            tip = successor;
-        }
-        return null;
-    }
     /** Retry newly visible anchors, then advance the contiguous accepted chain. */
     processEscrows() {
         this.processMissingAnchors();
@@ -161,10 +82,13 @@ export class RegistryEventer {
             return { kind: "reject", reason: "prior" };
         if ((number === undefined) !== (diger === undefined))
             return { kind: "reject", reason: "anchor" };
+        if (number && diger && !verifyRegistryAnchor(event, { db: this.db, issuer: this.issuer, number, diger })) {
+            return { kind: "reject", reason: "anchor" };
+        }
+        // Already accepted TEL history is immutable; explicit claims still verify before duplicate success.
+        if (occupied?.kind === "duplicate")
+            return this.processEvent(serder);
         if (number && diger) {
-            if (!verifyRegistryAnchor(event, { db: this.db, issuer: this.issuer, number, diger })) {
-                return { kind: "reject", reason: "anchor" };
-            }
             this.store.putAnchor(said, number, diger);
         }
         else {
@@ -185,7 +109,7 @@ export class RegistryEventer {
             const sn = head.sn + 1n;
             if (sn > BigInt(Number.MAX_SAFE_INTEGER))
                 return;
-            const candidates = this.store.baser.ooes?.get(this.regk, Number(sn)).map(([said]) => said) ?? [];
+            const candidates = this.store.baser.ooes.get(this.regk, Number(sn)).map(([said]) => said);
             candidates.sort((a, b) => this.compareAnchors(a, b));
             let advanced = false;
             for (const said of candidates) {
@@ -207,8 +131,8 @@ export class RegistryEventer {
         if (this.regk === null)
             return;
         const slots = new Map();
-        // Finish the read cursor before writes. Shared scan credit belongs to the resource-policy phase.
-        for (const [, sn, [said]] of this.store.baser.maes?.getTopItemIter(this.regk) ?? []) {
+        // Finish the read cursor before writes.
+        for (const [, sn, [said]] of this.store.baser.maes.getTopItemIter(this.regk)) {
             if (!Number.isSafeInteger(sn) || sn < 0)
                 throw new RangeError("Unsafe registry escrow ordinal.");
             const candidates = slots.get(sn) ?? [];
@@ -228,16 +152,38 @@ export class RegistryEventer {
             for (const event of candidates) {
                 const result = this.processEvent(event.serder);
                 if (result.kind === "reject" || result.kind === "duplicate") {
-                    this.store.clearEscrows(this.regk, sn, event.said);
+                    const removed = this.store.clearEscrows(this.regk, sn, event.said);
+                    if (removed && result.kind === "reject") {
+                        consoleLogger.warn("RegistryEventer ejected registry candidate from escrow", {
+                            family: "registry",
+                            said: event.said,
+                            regk: this.regk,
+                            sn,
+                            reason: result.reason,
+                        });
+                    }
                 }
             }
         }
     }
-    /** Prune unrecoverable candidates; corrupt records and storage failures still propagate. */
+    /**
+     * Prune unrecoverable candidates and report completed removals; accepted duplicates stay quiet.
+     * @param said Candidate event SAID loaded from the current escrow snapshot.
+     * @param sn TEL ordinal under which the candidate was indexed.
+     * @returns The validated candidate, or null after obsolete or invalid membership cleanup.
+     */
     replayCandidate(said, sn) {
         const serder = this.store.event(said);
         if (!serder) {
-            this.store.clearEscrows(this.regk, sn, said);
+            if (this.store.clearEscrows(this.regk, sn, said)) {
+                consoleLogger.warn("RegistryEventer ejected registry candidate from escrow", {
+                    family: "registry",
+                    said,
+                    regk: this.regk,
+                    sn,
+                    reason: "missingEvent",
+                });
+            }
             return null;
         }
         if (serder.said !== said)
@@ -245,6 +191,7 @@ export class RegistryEventer {
         const result = serder.ilk === Ilks.rip
             ? validateRip(serder, this.issuer)
             : validateUpdate(serder, this.regk);
+        let reason = result.kind === "reject" ? result.reason : "registryOrOrdinal";
         if (result.kind === "valid") {
             const event = result.event;
             if (event.regid === this.regk && event.sn === BigInt(sn)) {
@@ -252,9 +199,19 @@ export class RegistryEventer {
                 const prior = sn > 0 ? this.acceptedAt(event.regid, sn - 1) : null;
                 if (!existing && (!prior || prior.said === event.prior))
                     return event;
+                reason = existing?.kind === "duplicate" ? null : existing?.kind === "reject" ? existing.reason : "prior";
             }
         }
-        this.store.clearEscrows(this.regk, sn, said);
+        const removed = this.store.clearEscrows(this.regk, sn, said);
+        if (removed && reason !== null) {
+            consoleLogger.warn("RegistryEventer ejected registry candidate from escrow", {
+                family: "registry",
+                said,
+                regk: this.regk,
+                sn,
+                reason,
+            });
+        }
         return null;
     }
     /** Earliest verified anchor wins; digest then event SAID break ties using code-point order. */
@@ -273,20 +230,23 @@ export class RegistryEventer {
         return left < right ? -1 : left > right ? 1 : 0;
     }
     /** Accept one parsed event, then advance ready successors without recursive replay. */
-    processEvent(serder) {
-        const decision = this.processOne(serder);
+    processEvent(serder, locators = {}) {
+        const decision = this.processOne(serder, locators);
         if (decision.kind === "accept")
             this.processQueued();
         return decision;
     }
     /** Decide and persist one event; callers own subsequent chain progression. */
-    processOne(serder) {
+    processOne(serder, locators = {}) {
         if (this.regk === null || serder.ilk === Ilks.rip)
-            return this.processInception(serder);
+            return this.processInception(serder, locators);
         const result = validateUpdate(serder, this.regk);
         if (result.kind === "reject")
             return result;
         const event = result.event;
+        if (!validateRegistrySourceLocators(serder, this.db, this.issuer, locators)) {
+            return { kind: "reject", reason: "anchor" };
+        }
         // Preserve protocol precision until the existing ordinal storage seam can represent it.
         if (event.sn > BigInt(Number.MAX_SAFE_INTEGER))
             return { kind: "reject", reason: "ordinalRange" };
@@ -299,7 +259,8 @@ export class RegistryEventer {
         const env = this.store.baser.env;
         if (!env)
             throw new DatabaseNotOpenError("Registry acceptance requires an open backing store.");
-        this.store.baser.initializeStorage();
+        if (this.store.baser.readonly)
+            throw new DatabaseOperationError("Cannot write readonly registry storage.");
         return env.transactionSync(() => {
             const prior = this.acceptedAt(event.regid, Number(event.sn) - 1);
             if (prior && prior.said !== event.prior)
@@ -326,11 +287,14 @@ export class RegistryEventer {
         });
     }
     /** Validate, anchor and accept one inception, or retain its body in anchor escrow. */
-    processInception(serder) {
+    processInception(serder, locators) {
         const result = validateRip(serder, this.issuer);
         if (result.kind === "reject")
             return result;
         const event = result.event;
+        if (!validateRegistrySourceLocators(serder, this.db, this.issuer, locators)) {
+            return { kind: "reject", reason: "anchor" };
+        }
         if (this.regk !== null && this.regk !== event.regid)
             return { kind: "reject", reason: "registry" };
         const previous = this.acceptedEvent(event);
@@ -342,8 +306,8 @@ export class RegistryEventer {
         const env = this.store.baser.env;
         if (!env)
             throw new DatabaseNotOpenError("Registry acceptance requires an open backing store.");
-        // Bind named tables before the rollback-capable event transaction owns their rows.
-        this.store.baser.initializeStorage();
+        if (this.store.baser.readonly)
+            throw new DatabaseOperationError("Cannot write readonly registry storage.");
         const decision = env.transactionSync(() => {
             const previous = this.acceptedEvent(event);
             if (previous)
@@ -414,19 +378,24 @@ export class RegistryEventer {
         this.store.baser.maes.rem(event.regid, Number(event.sn));
         this.store.baser.ooes.rem(event.regid, Number(event.sn));
     }
-    /** Keep an already verified anchor or discover the earliest fully witnessed seal. */
+    /** Keep a valid first pair; recovery-invalidated pending anchors must rediscover current-branch authority. */
     discoverAnchor(event) {
-        if (this.store.anchor(event.said))
-            return;
-        const anchor = this.db.fetchLastSealingEventByEventSeal(this.issuer, {
-            i: event.regid,
-            s: event.serder.sad.n,
-            d: event.said,
-        });
+        const current = this.store.anchor(event.said);
+        if (current) {
+            if (verifyRegistryAnchor(event, {
+                db: this.db,
+                issuer: this.issuer,
+                number: current[0],
+                diger: current[1],
+            }))
+                return;
+            this.store.baser.ancs.rem(event.said);
+        }
+        const anchor = findRegistryAnchor(this.db, this.issuer, event.serder);
         if (!anchor)
             return;
-        const number = NumberPrimitive.fromNum(BigInt(anchor.sn));
-        const diger = new Diger({ qb64: anchor.said });
+        const number = NumberPrimitive.fromNum(BigInt(anchor[0]));
+        const diger = new Diger({ qb64: anchor[1] });
         if (verifyRegistryAnchor(event, { db: this.db, issuer: this.issuer, number, diger })) {
             this.store.putAnchor(event.said, number, diger);
         }