keri-ts 0.11.0 → 2.0.0

package/esm/keri/npm/src/core/{eventing.js → kel/eventing.js}

@@ -1,15 +1,15 @@
 import { Cigar, Dater, Diger, Ilks, NumberPrimitive, Prefixer, SealSource, Siger, Verfer, } from "cesr-ts";
-import { dgKey, snKey } from "../db/core/keys.js";
-import { encodeDateTimeToDater, makeNowIso8601 } from "../time/mod.js";
-import { CueDeck } from "./cue-admission.js";
-import { Deck } from "./deck.js";
-import { ValidationError } from "./errors.js";
+import { dgKey, snKey } from "../../db/core/keys.js";
+import { encodeDateTimeToDater, makeNowIso8601 } from "../../time/mod.js";
+import { Deck } from "../deck.js";
+import { ValidationError } from "../errors.js";
+import { consoleLogger } from "../logger.js";
+import { normalizeMbxTopicCursor } from "../mailbox/mailbox-topics.js";
+import { reply as replyEvent } from "../protocol-eventing.js";
+import { KeyStateRecord, ObservedRecord } from "../records.js";
+import { acceptReplyDecision, unverifiedReplyDecision } from "../routing.js";
 import { acceptEscrow, acceptQuery, acceptReceipt, dropEscrow, dropQuery, dropReceipt, escrowQuery, escrowReceipt, ignoreReceipt, keepEscrow, logEscrowDecision, } from "./kever-decisions.js";
 import { Kever } from "./kever.js";
-import { normalizeMbxTopicCursor } from "./mailbox-topics.js";
-import { reply as replyEvent } from "./protocol-eventing.js";
-import { KeyStateRecord, ObservedRecord } from "./records.js";
-import { acceptReplyDecision, unverifiedReplyDecision } from "./routing.js";
 import { deriveRotatedWitnessSet, hasUniqueWitnesses } from "./witnesses.js";
 /** Normalize one dispatch ordinal into the number primitive expected by DB seal tuples. */
 function normalizeSealOrdinal(seqner) {
@@ -118,7 +118,8 @@ export class Kevery {
      * The returned decision is the normal typed outcome for remote processing.
      * The owning native writer covers decision, admission and durable effects;
      * accepted live state and cues publish only after that commit returns.
-     * An already active writer remains caller-owned, including its publication boundary.
+     * Caller-owned native writers are refused before evaluation or effects: this
+     * processor must own the commit that precedes live state/cue publication.
      * Exceptions are reserved for invariant/corruption cases during application.
      */
     processEvent(envelope) {
@@ -126,36 +127,35 @@ export class Kevery {
     }
     settleEventDecision(input, escrow) {
         const env = this.db.env;
-        let prepared;
-        try {
-            const write = () => {
-                // Replay hydration may repair an existing delegation source hint; it belongs to this writer too.
-                const envelope = typeof input === "function" ? input() : input;
-                if (!envelope) {
-                    if (escrow)
-                        this.removeEscrow(escrow.kind, escrow.pre, escrow.on, escrow.said);
-                    return null;
-                }
-                const decision = this.decideEvent(envelope);
-                // A still-pending replay keeps its existing row and emits no additional cues.
-                if (escrow && decision.kind === "escrow" && decision.reason === escrow.kind)
-                    return decision;
-                prepared = this.prepareDecision(decision);
-                prepared?.write();
+        if (this.db.inWriteTransaction) {
+            throw new Error("Kevery must own the KEL transaction; process events outside caller-owned writers");
+        }
+        let metadata;
+        const write = () => {
+            // Replay hydration may repair an existing delegation source hint; it belongs to this writer too.
+            const envelope = typeof input === "function" ? input() : input;
+            if (!envelope) {
                 if (escrow)
                     this.removeEscrow(escrow.kind, escrow.pre, escrow.on, escrow.said);
+                return null;
+            }
+            const decision = this.decideEvent(envelope);
+            // A still-pending replay keeps its existing row and emits no additional cues.
+            if (escrow && decision.kind === "escrow" && decision.reason === escrow.kind) {
+                this.writeSourceSealRepairs(decision);
                 return decision;
-            };
-            // Nested callers retain their existing caller-owned commit/publication contract.
-            const decision = env.env.writeTxn
-                ? write()
-                : env.transactionSync(write);
-            prepared?.publish();
+            }
+            metadata = this.eventMetadata(decision);
+            this.writeEventDecision(decision, metadata);
+            if (escrow)
+                this.removeEscrow(escrow.kind, escrow.pre, escrow.on, escrow.said);
             return decision;
-        }
-        finally {
-            prepared?.release();
-        }
+        };
+        const decision = env.transactionSync(write);
+        this.publishEventState(metadata?.accepted);
+        if (metadata?.cues.length)
+            this.cues.extend(metadata.cues);
+        return decision;
     }
     /**
      * Process one query message through the KEL-owned query/reply path.
@@ -201,9 +201,10 @@ export class Kevery {
      *   state or route criteria
      * - `drop` means the query is malformed or unsupported and should not become
      *   query-not-found escrow
+     *
+     * @param envelope Parsed signed query and its attached authentication evidence.
      */
     decideQuery(envelope) {
-        this.cues.checkSpace();
         const route = envelope.serder.route;
         const query = envelope.serder.ked?.q;
         const pre = typeof query?.i === "string" ? query.i : null;
@@ -255,7 +256,7 @@ export class Kevery {
                         pre,
                         src,
                         dest,
-                        messages,
+                        msgs: messages,
                     }]);
             }
             case "ksn": {
@@ -269,8 +270,12 @@ export class Kevery {
                 return acceptQuery([{
                         kin: "reply",
                         querySaid: envelope.serder.said ?? undefined,
-                        route: "/ksn",
-                        serder: replyEvent(`/ksn/${src}`, kever.state().asDict()),
+                        // KERIpy answers in the query's own protocol version and serialization kind.
+                        serder: replyEvent(`/ksn/${src}`, kever.state().asDict(), {
+                            pre,
+                            pvrsn: envelope.serder.pvrsn,
+                            kind: envelope.serder.kind,
+                        }),
                         src,
                         dest,
                     }]);
@@ -525,7 +530,7 @@ export class Kevery {
         if (!serder) {
             return dropReceipt("staleReceipt");
         }
-        const wits = this.resolveAcceptedEventWitnesses(pre, said, serder);
+        const wits = this.db.acceptedEventWitnesses(serder);
         return wits
             ? { kind: "accept", event: { pre, said, serder, wits } }
             : escrowReceipt("missingReceiptedEvent");
@@ -563,7 +568,7 @@ export class Kevery {
         if (!replaySerder) {
             return dropReceipt("staleReceipt");
         }
-        const wits = this.resolveAcceptedEventWitnesses(pre, replaySaid, replaySerder);
+        const wits = this.db.acceptedEventWitnesses(replaySerder);
         return wits
             ? {
                 kind: "accept",
@@ -625,10 +630,7 @@ export class Kevery {
             return {
                 kind: "reject",
                 code: "invalidPre",
-                message: `Invalid pre=${pre} for event ${said}.`,
-                context: {
-                    cause: error instanceof Error ? error.message : String(error),
-                },
+                message: `Invalid pre=${pre} for event ${said}: ${error instanceof Error ? error.message : String(error)}`,
             };
         }
         const local = envelope.local ?? this.local;
@@ -669,91 +671,81 @@ export class Kevery {
         }
         return kever.evaluateUpdate(init);
     }
-    /**
-     * Apply one previously decided outcome to the durable DB/runtime state.
-     *
-     * Ownership rule:
-     * - `Kever` decides acceptance/rejection criteria
-     * - `Kevery` owns durable mutation, escrow routing, duplicate logging, and
-     *   post-acceptance cue emission
-     * - explicit decide/apply callers own synchronous writer and commit/publication ordering
-     */
-    applyDecision(decision) {
-        const prepared = this.prepareDecision(decision);
-        try {
-            prepared?.write();
-            prepared?.publish();
-        }
-        finally {
-            prepared?.release();
-        }
-    }
-    /** Admit concrete cues and fix FEL metadata under the caller's synchronous writer ownership. */
-    prepareDecision(decision) {
-        // Ordinary Runtime decks retain their existing refusal/retry boundary until ownership is fully ported.
-        if (!(this.cues instanceof CueDeck)) {
-            this.cues.checkSpace(("cues" in decision ? decision.cues?.length ?? 0 : 0)
-                + (decision.kind === "accept" ? 4 : decision.kind === "duplicate" ? 1 : 0));
-        }
+    /** Describe finalized log coordinates, clone notices and accepted state without executable effects. */
+    eventMetadata(decision) {
         if (decision.kind === "reject")
-            return;
+            return { cues: [] };
         if (decision.kind === "accept") {
             const kever = this.kevers.get(decision.transition.pre);
             const target = !kever || decision.transition.mode === "create"
-                ? Kever.fromTransition(decision.transition, { db: this.db, cues: this.cues })
+                ? Kever.fromTransition(decision.transition, { db: this.db })
                 : kever;
-            const logged = target.prepareLogEvent(decision.transition.log);
-            const transition = this.applyFirstSeenState(decision.transition, logged.fn, logged.dater.dts);
+            const firstSeen = this.db.prepareKelEventLog(decision.transition.log);
+            const transition = this.applyFirstSeenState(decision.transition, firstSeen.fn, firstSeen.dater.dts);
             const group = !!this.db.getHab(transition.pre)?.mid;
-            const cues = [...logged.cues, ...(decision.cues ?? []), ...this.acceptanceCues(transition, group)];
-            // Hold exact cue objects/backing and slots before accepted-event writes.
-            this.cues.checkSpace(cues.length);
-            const prepared = this.cues instanceof CueDeck ? this.cues.prepare(cues) : undefined;
             return {
-                write: () => {
-                    target.logEvent(transition.log, logged);
-                    this.db.pinState(transition.pre, transition.state);
-                    this.db.udes.rem(dgKey(transition.pre, transition.said));
-                    this.repairAnchoredDelegationSourceSeals(transition.log.serder);
-                },
-                publish: () => {
-                    target.applyTransition(transition);
-                    this.kevers.set(transition.pre, target);
-                    if (group) {
-                        this.db.prefixes.add(transition.pre);
-                        this.db.groups.add(transition.pre);
-                    }
-                    if (prepared)
-                        prepared.publish();
-                    else
-                        this.emitDecisionCues(cues);
-                },
-                release: () => prepared?.release(),
+                cues: [
+                    ...this.logNoticeCues(decision.transition.log, firstSeen),
+                    ...(decision.cues ?? []),
+                    ...this.acceptanceCues(transition, group),
+                ],
+                log: { event: transition.log, firstSeen, delegated: target.delegated },
+                accepted: { target, transition, group },
             };
         }
         const kever = decision.kind === "duplicate" ? this.kevers.get(decision.log?.serder.pre ?? "") : undefined;
-        const logged = decision.kind === "duplicate" && decision.log && kever
-            ? kever.prepareLogEvent(decision.log)
+        const log = decision.kind === "duplicate" && decision.log && kever
+            ? { event: decision.log, firstSeen: this.db.prepareKelEventLog(decision.log), delegated: kever.delegated }
             : undefined;
-        const cues = [...(logged?.cues ?? []), ...(decision.cues ?? [])];
-        this.cues.checkSpace(cues.length);
-        const prepared = cues.length && this.cues instanceof CueDeck ? this.cues.prepare(cues) : undefined;
         return {
-            write: () => {
-                if (decision.kind === "escrow")
-                    this.persistEscrowInstruction(decision.instruction);
-                else if (decision.log && kever && logged)
-                    kever.logEvent(decision.log, logged);
-            },
-            publish: () => {
-                if (prepared)
-                    prepared.publish();
-                else
-                    this.emitDecisionCues(cues);
-            },
-            release: () => prepared?.release(),
+            cues: [...(log ? this.logNoticeCues(log.event, log.firstSeen) : []), ...(decision.cues ?? [])],
+            log,
         };
     }
+    /** Persist the decision and its concrete log metadata before publication. */
+    writeEventDecision(decision, metadata) {
+        this.writeSourceSealRepairs(decision);
+        if (metadata.log) {
+            const { event, firstSeen, delegated } = metadata.log;
+            this.db.writeKelEventLog(event, firstSeen, delegated);
+        }
+        if (metadata.accepted) {
+            const { transition } = metadata.accepted;
+            this.db.pinState(transition.pre, transition.state);
+            this.db.udes.rem(dgKey(transition.pre, transition.said));
+            this.repairAnchoredDelegationSourceSeals(transition.log.serder);
+        }
+        else if (decision.kind === "escrow")
+            this.persistEscrowInstruction(decision.instruction);
+    }
+    /** Publish accepted cache state; cue publication remains explicit at the processing owner. */
+    publishEventState(accepted) {
+        if (!accepted)
+            return;
+        const { target, transition, group } = accepted;
+        target.applyTransition(transition);
+        this.kevers.set(transition.pre, target);
+        if (group) {
+            this.db.prefixes.add(transition.pre);
+            this.db.groups.add(transition.pre);
+        }
+    }
+    /** Apply concrete delegation-hint discoveries only under the processing owner's write phase. */
+    writeSourceSealRepairs(decision) {
+        for (const { pre, said, sourceSeal } of decision.sourceSealRepairs ?? []) {
+            const key = dgKey(pre, said);
+            if (sourceSeal)
+                this.db.aess.pin(key, [sourceSeal.s, sourceSeal.d]);
+            else
+                this.db.aess.rem(key);
+        }
+    }
+    /** Describe a clone-order anomaly; storage metadata does not publish protocol work. */
+    logNoticeCues(log, prepared) {
+        if (prepared.fn === null || !log.frc || prepared.fn === Number(log.frc.f.num))
+            return [];
+        return [{ kin: "noticeBadCloneFN", serder: log.serder, fn: prepared.fn, firner: log.frc.f, dater: log.frc.dt }];
+    }
     /** Reprocess one pass of out-of-order escrowed events. */
     processEscrowOutOfOrders() {
         this.processOrdinalEscrow("ooo");
@@ -777,11 +769,12 @@ export class Kevery {
                 continue;
             }
             const decision = this.reprocessEscrowedWitnessReceipt(pre, sn, said, new Siger({ qb64: wigerQb64 }));
-            logEscrowDecision("Kevery UWE", decision);
             switch (decision.kind) {
                 case "accept":
                 case "drop":
-                    this.db.uwes.remOn([pre], sn, couple);
+                    if (this.db.uwes.remOn([pre], sn, couple)) {
+                        logEscrowDecision(`Kevery UWE pre=${pre} sn=${sn} said=${said}`, decision);
+                    }
                     break;
                 case "keep":
                     break;
@@ -811,11 +804,12 @@ export class Kevery {
             const [diger, prefixer, cigar] = triple;
             const hydrated = new Cigar(cigar, new Verfer({ qb64: prefixer.qb64 }));
             const decision = this.reprocessEscrowedNonTransReceipt(pre, sn, diger, hydrated);
-            logEscrowDecision("Kevery URE", decision);
             switch (decision.kind) {
                 case "accept":
                 case "drop":
-                    this.db.ures.rem([pre, snh], triple);
+                    if (this.db.ures.rem([pre, snh], triple)) {
+                        logEscrowDecision(`Kevery URE pre=${pre} sn=${sn} said=${diger.qb64}`, decision);
+                    }
                     break;
                 case "keep":
                     break;
@@ -845,11 +839,12 @@ export class Kevery {
             }
             const sn = parseInt(snh, 16);
             const decision = this.reprocessEscrowedTransferableReceipt(pre, sn, quintuple);
-            logEscrowDecision("Kevery VRE", decision);
             switch (decision.kind) {
                 case "accept":
                 case "drop":
-                    this.db.vres.rem([pre, snh], quintuple);
+                    if (this.db.vres.rem([pre, snh], quintuple)) {
+                        logEscrowDecision(`Kevery VRE pre=${pre} sn=${sn} said=${quintuple[0].qb64}`, decision);
+                    }
                     break;
                 case "keep":
                     break;
@@ -894,13 +889,15 @@ export class Kevery {
                 continue;
             }
             const decision = this.reprocessEscrowedQuery(requester, qsaid);
-            logEscrowDecision("Kevery QNF", decision);
             switch (decision.kind) {
                 case "accept":
-                case "drop":
-                    this.db.qnfs.rem([requester, qsaid], escrowedSaid);
+                case "drop": {
+                    const removed = this.db.qnfs.rem([requester, qsaid], escrowedSaid);
                     this.clearEscrowedQueryMaterial(requester, qsaid);
+                    if (removed)
+                        logEscrowDecision(`Kevery QNF requester=${requester} said=${qsaid}`, decision);
                     break;
+                }
                 case "keep":
                     break;
             }
@@ -934,8 +931,9 @@ export class Kevery {
      * Why `Kevery` owns this route:
      * - trust-source policy depends on KEL state and configured watchers
      * - accepted replies must stay consistent with the accepted event log at `sn`
-     * - successful acceptance emits `keyStateSaved`, which drives follow-on query
-     *   continuation work
+     * - successful validation/persistence emits `keyStateSaved`, supplying the
+     *   remote notice target for query workflows; ordinary KEL acceptance does not
+     *   imply receipt of such a notice
      */
     processReplyKeyStateNotice(args) {
         if (!this.rvy) {
@@ -973,7 +971,7 @@ export class Kevery {
         if (osaider?.qb64 === args.diger.qb64) {
             osaider = null;
         }
-        const reply = this.rvy.prepareReply({
+        const reply = this.rvy.decideReply({
             serder: args.serder,
             saider: args.diger,
             route: args.route,
@@ -982,38 +980,25 @@ export class Kevery {
             cigars: args.cigars,
             tsgs: args.tsgs,
         });
-        try {
-            if (reply.decision.kind === "unverified") {
-                reply.applyProofs();
-                reply.publishQueries();
-                return unverifiedReplyDecision(`Unverified key state notice reply ${args.serder.said ?? "<unknown>"}.`);
-            }
-            const ldig = this.db.kels.getLast(pre, sn);
-            if (ldig && ldig !== said) {
-                throw new ValidationError(`Mismatch key state at sn=${sn} with accepted event log for ${pre}.`);
-            }
-            const saider = new Diger({ qb64: said });
-            const dater = new Dater({ qb64: encodeDateTimeToDater(dt) });
-            const cues = [{ kin: "keyStateSaved", ksn }];
-            this.cues.checkSpace();
-            const child = this.cues instanceof CueDeck ? this.cues.prepare(cues) : undefined;
-            try {
-                reply.applyProofs();
-                this.updateKeyState(args.aid, ksn, saider, dater);
-                reply.publishQueries();
-                if (child)
-                    child.publish();
-                else
-                    this.cues.extend(cues);
-                return acceptReplyDecision();
-            }
-            finally {
-                child?.release();
-            }
-        }
-        finally {
-            reply.release();
-        }
+        if (reply.kind === "unverified") {
+            this.rvy.writeReply(reply);
+            if (reply.cues.length)
+                this.rvy.cues.extend(reply.cues);
+            return unverifiedReplyDecision(`Unverified key state notice reply ${args.serder.said ?? "<unknown>"}.`);
+        }
+        const ldig = this.db.kels.getLast(pre, sn);
+        if (ldig && ldig !== said) {
+            throw new ValidationError(`Mismatch key state at sn=${sn} with accepted event log for ${pre}.`);
+        }
+        const saider = new Diger({ qb64: said });
+        const dater = new Dater({ qb64: encodeDateTimeToDater(dt) });
+        const cues = [{ kin: "keyStateSaved", ksn }];
+        this.rvy.writeReply(reply);
+        this.updateKeyState(args.aid, ksn, saider, dater);
+        if (reply.cues.length)
+            this.rvy.cues.extend(reply.cues);
+        this.cues.extend(cues);
+        return acceptReplyDecision();
     }
     /**
      * Process one `/watcher/{aid}/add` or `/watcher/{aid}/cut` reply.
@@ -1093,32 +1078,18 @@ export class Kevery {
             cues.push({ kin: "notice", serder });
         if (local && (state.b ?? []).some((wit) => this.db.getHab(wit) !== null))
             cues.push({ kin: "witness", serder });
-        cues.push({ kin: "keyStateSaved", ksn: state });
         return cues;
     }
-    /** Forward decision-carried cues into the shared runtime cue deck. */
-    emitDecisionCues(cues) {
-        this.cues.extend(cues ?? []);
-    }
-    /** Admit concrete query output before repairing replay source seals or publishing its cues. */
+    /** Repair replay source seals before publishing query output. */
     publishQueryCues(serder, cues = []) {
-        this.cues.checkSpace(cues.length);
-        const batch = cues.length && this.cues instanceof CueDeck ? this.cues.prepare(cues) : undefined;
-        try {
-            if (serder.route === "logs") {
-                const query = serder.ked?.q;
-                const kever = typeof query?.i === "string" ? this.db.getKever(query.i) : undefined;
-                if (kever)
-                    this.repairReplaySourceSeal(kever);
-            }
-            if (batch)
-                batch.publish();
-            else
-                this.emitDecisionCues(cues);
-        }
-        finally {
-            batch?.release();
+        if (serder.route === "logs") {
+            const query = serder.ked?.q;
+            const kever = typeof query?.i === "string" ? this.db.getKever(query.i) : undefined;
+            if (kever)
+                this.repairReplaySourceSeal(kever);
         }
+        if (cues.length)
+            this.cues.extend(cues);
     }
     /**
      * Persist one missing-state query so later runtime turns can retry it.
@@ -1201,16 +1172,10 @@ export class Kevery {
         }
         const serder = this.db.evts.get(dgkey);
         if (!serder) {
-            return dropEscrow("missingEscrowedEvent", {
-                message: `QNF Missing escrowed evt at dig = ${qsaid}`,
-                context: { requester, qsaid },
-            });
+            return dropEscrow("missingEscrowedEvent", `QNF Missing escrowed evt at dig = ${qsaid}`);
         }
         if (serder.ilk !== Ilks.qry) {
-            return dropEscrow("malformedEscrowedQuery", {
-                message: `QNF Escrowed event at dig = ${qsaid} is not a query.`,
-                context: { requester, qsaid, ilk: serder.ilk },
-            });
+            return dropEscrow("malformedEscrowedQuery", `QNF Escrowed event at dig = ${qsaid} is not a query.`);
         }
         const sigers = this.db.sigs.get(dgkey);
         // The durable `rcts.` contract is KERIpy-style `(Prefixer, Cigar)`, but
@@ -1219,10 +1184,7 @@ export class Kevery {
         // into verifier context here.
         const cigars = this.db.rcts.get(dgkey).map(([prefixer, cigar]) => new Cigar(cigar, new Verfer({ qb64: prefixer.qb64 })));
         if (sigers.length === 0 && cigars.length === 0) {
-            return dropEscrow("missingEscrowedEndorsements", {
-                message: `QNF Missing escrowed evt sigs at dig = ${qsaid}`,
-                context: { requester, qsaid },
-            });
+            return dropEscrow("missingEscrowedEndorsements", `QNF Missing escrowed evt sigs at dig = ${qsaid}`);
         }
         let source;
         if (sigers.length > 0) {
@@ -1230,14 +1192,7 @@ export class Kevery {
                 source = new Prefixer({ qb64: requester });
             }
             catch (error) {
-                return dropEscrow("malformedEscrowedQuery", {
-                    message: `QNF Failed to reconstruct escrowed query requester at dig = ${qsaid}`,
-                    context: {
-                        requester,
-                        qsaid,
-                        cause: error instanceof Error ? error.message : String(error),
-                    },
-                });
+                return dropEscrow("malformedEscrowedQuery", `QNF Failed to reconstruct requester=${requester} at dig=${qsaid}: ${error instanceof Error ? error.message : String(error)}`, error);
             }
         }
         const decision = this.decideQuery({
@@ -1251,15 +1206,9 @@ export class Kevery {
                 this.publishQueryCues(serder, decision.cues);
                 return acceptEscrow();
             case "escrow":
-                return keepEscrow("queryNotFound", {
-                    message: `QNF Query still waiting on continuation state at dig = ${qsaid}`,
-                    context: { requester, qsaid, queryReason: decision.reason },
-                });
+                return keepEscrow("queryNotFound", `QNF Query still waiting on continuation state at dig=${qsaid}: ${decision.reason}`);
             case "drop":
-                return dropEscrow("malformedEscrowedQuery", {
-                    message: `QNF Dropping escrowed query at dig = ${qsaid} after live query validation failed.`,
-                    context: { requester, qsaid, liveReason: decision.reason },
-                });
+                return dropEscrow("malformedEscrowedQuery", `QNF Dropping escrowed query at dig=${qsaid}: ${decision.reason}.`);
         }
     }
     /**
@@ -1474,7 +1423,7 @@ export class Kevery {
             }
             const witnessIndex = event.wits.indexOf(verfer.qb64);
             if (witnessIndex >= 0) {
-                // A detached non-transferable receipt from a current witness is
+                // A detached non-transferable receipt from an event-authorized witness is
                 // promoted to an indexed witness signature before storage.
                 this.db.wigs.add(dgkey, wigerFromCigar(cigar, witnessIndex, verfer));
                 continue;
@@ -1495,7 +1444,7 @@ export class Kevery {
                 continue;
             }
             // Witness receipt verification assigns the verifier from the receipted
-            // event's current witness list, not from detached receipt material.
+            // event's historical witness list, not from detached receipt material.
             const verfer = new Verfer({ qb64: verferQb64 });
             if (verfer.transferable || !verfer.verify(wiger.raw, event.serder.raw)) {
                 continue;
@@ -1617,66 +1566,24 @@ export class Kevery {
         const acceptedSaid = this.db.kels.getLast(pre, sn);
         const snh = sn.toString(16);
         if (!acceptedSaid) {
-            return keepEscrow("missingReceiptedEvent", {
-                message: `${scope} Missing receipted evt at pre=${pre} sn=${snh}`,
-                context: { pre, sn, said, scope },
-            });
+            return keepEscrow("missingReceiptedEvent", `${scope} Missing receipted evt at pre=${pre} sn=${snh}`);
         }
         if (acceptedSaid !== said) {
-            return dropEscrow("invalidReceiptDigest", {
-                message: `${scope} Bad escrowed receipt dig at pre=${pre} sn=${snh}`,
-                context: { pre, sn, said, acceptedSaid, scope },
-            });
+            return dropEscrow("invalidReceiptDigest", `${scope} Bad escrowed receipt dig at pre=${pre} sn=${snh}`);
         }
         const serder = this.db.getEvtSerder(pre, said);
         if (!serder) {
-            return dropEscrow("invalidReceiptedEventReference", {
-                message: `${scope} Invalid receipted evt reference at pre=${pre} sn=${snh}`,
-                context: { pre, sn, said, acceptedSaid, scope },
-            });
+            return dropEscrow("invalidReceiptedEventReference", `${scope} Invalid receipted evt reference at pre=${pre} sn=${snh}`);
         }
-        const wits = this.resolveAcceptedEventWitnesses(pre, said, serder);
+        const wits = this.db.acceptedEventWitnesses(serder);
         if (!wits) {
-            return keepEscrow("missingReceiptedEvent", {
-                message: `${scope} Kever not ready for receipted evt at pre=${pre} sn=${snh}`,
-                context: { pre, sn, said, scope },
-            });
+            return keepEscrow("missingReceiptedEvent", `${scope} Kever not ready for receipted evt at pre=${pre} sn=${snh}`);
         }
         return {
             kind: "accept",
             event: { pre, said, serder, wits },
         };
     }
-    /**
-     * Resolve the witness list used for accepted-event receipt processing.
-     *
-     * Order of preference:
-     * - witness state already logged with the accepted event in `wits.`
-     * - backers carried directly on inception/delegated inception events
-     * - current live key state for later event types
-     *
-     * KERIpy note:
-     * - accepted-event receipt handling is a different seam from
-     *   `_processEscrowFindUnver()`
-     * - partial-witness replay deliberately recomputes the witness list from the
-     *   escrowed event and current state instead of trusting this projection
-     *
-     * Translation note:
-     * - this helper is intentionally about accepted-event receipt handling only
-     * - if a maintainer is looking for the partial-witness replay logic, the
-     *   right seam is `resolvePartialWitnessEscrowWitnesses()`
-     */
-    resolveAcceptedEventWitnesses(pre, said, serder) {
-        const stored = this.db.wits.get(dgKey(pre, said)).map((wit) => wit.qb64);
-        if (stored.length > 0) {
-            return stored;
-        }
-        if (serder.ilk === Ilks.icp || serder.ilk === Ilks.dip) {
-            return [...serder.backs];
-        }
-        const kever = this.db.getKever(pre);
-        return kever ? [...kever.wits] : null;
-    }
     /**
      * Rebuild one partial-witness escrow event's witness list for receipt replay.
      *
@@ -1698,10 +1605,7 @@ export class Kevery {
             const wits = [...serder.backs];
             return hasUniqueWitnesses(wits)
                 ? { kind: "accept", wits }
-                : dropEscrow("duplicateWitnesses", {
-                    message: `PWE Invalid wits = ${JSON.stringify(wits)} has duplicates for evt = ${JSON.stringify(serder.ked)}.`,
-                    context: { pre: serder.pre, said: serder.said, wits },
-                });
+                : dropEscrow("duplicateWitnesses", `PWE Invalid wits = ${JSON.stringify(wits)} has duplicates for evt = ${JSON.stringify(serder.ked)}.`);
         }
         const kever = this.db.getKever(serder.pre ?? "");
         if (serder.ilk === Ilks.rot || serder.ilk === Ilks.drt) {
@@ -1714,25 +1618,12 @@ export class Kevery {
             if (derived.kind === "accept") {
                 return { kind: "accept", wits: derived.value.wits };
             }
-            return dropEscrow(derived.reason, {
-                message: `PWE Invalid witness cuts/adds for evt = ${JSON.stringify(serder.ked)}.`,
-                context: {
-                    pre: serder.pre,
-                    said: serder.said,
-                    reason: derived.reason,
-                    cuts: [...serder.cuts],
-                    adds: [...serder.adds],
-                    currentWits: [...kever.wits],
-                },
-            });
+            return dropEscrow(derived.reason, `PWE Invalid witness cuts/adds for evt = ${JSON.stringify(serder.ked)}.`);
         }
         // For non-establishment events, partial-witness replay expects current key
         // state to be available already; otherwise the escrowed state is corrupt.
         if (!kever) {
-            return dropEscrow("processingError", {
-                message: `PWE Missing current key state for receipted evt at pre=${serder.pre ?? ""}.`,
-                context: { pre: serder.pre, said: serder.said, ilk: serder.ilk },
-            });
+            return dropEscrow("processingError", `PWE Missing current key state for receipted evt at pre=${serder.pre ?? ""}.`);
         }
         return { kind: "accept", wits: [...kever.wits] };
     }
@@ -1761,10 +1652,7 @@ export class Kevery {
             }
             const serder = this.db.getEvtSerder(pre, candidateSaid);
             if (!serder) {
-                return dropEscrow("missingEscrowedEvent", {
-                    message: `PWE Missing escrowed evt at dig = ${candidateSaid}`,
-                    context: { pre, sn, said: candidateSaid },
-                });
+                return dropEscrow("missingEscrowedEvent", `PWE Missing escrowed evt at dig = ${candidateSaid}`);
             }
             const witnessState = this.resolvePartialWitnessEscrowWitnesses(serder);
             if (witnessState.kind === "continue") {
@@ -1777,55 +1665,28 @@ export class Kevery {
                 const verfer = cigar.verfer;
                 const receiptorPre = verfer?.qb64;
                 if (!verfer || !receiptorPre) {
-                    return dropEscrow("missingEscrowArtifact", {
-                        message: `PWE Missing verifier context for escrowed receipt at pre=${pre} sn=${sn.toString(16)}.`,
-                        context: { pre, sn, said },
-                    });
+                    return dropEscrow("missingEscrowArtifact", `PWE Missing verifier context for escrowed receipt at pre=${pre} sn=${sn.toString(16)}.`);
                 }
                 const witnessIndex = witnessState.wits.indexOf(receiptorPre);
                 if (witnessIndex < 0) {
                     continue;
                 }
                 if (!verfer.verify(cigar.raw, serder.raw)) {
-                    return dropEscrow("invalidReceiptSignature", {
-                        message: `PWE Bad escrowed witness receipt wig at pre=${pre} sn=${sn.toString(16)}.`,
-                        context: { pre, sn, said, receiptor: receiptorPre },
-                    });
+                    return dropEscrow("invalidReceiptSignature", `PWE Bad escrowed witness receipt wig at pre=${pre} sn=${sn.toString(16)}.`);
                 }
                 this.db.wigs.add(dgKey(pre, serder.said ?? said), wigerFromCigar(cigar, witnessIndex, verfer));
                 return acceptEscrow();
             }
             if (!wiger) {
-                return dropEscrow("missingEscrowArtifact", {
-                    message: `PWE Missing escrowed witness signature material at pre=${pre} sn=${sn.toString(16)}.`,
-                    context: { pre, sn, said },
-                });
+                return dropEscrow("missingEscrowArtifact", `PWE Missing escrowed witness signature material at pre=${pre} sn=${sn.toString(16)}.`);
             }
             const verferQb64 = witnessState.wits[wiger.index];
             if (!verferQb64) {
-                return dropEscrow("invalidWitnessIndex", {
-                    message: `PWE Bad escrowed witness receipt index=${wiger.index} at pre=${pre} sn=${sn.toString(16)}`,
-                    context: {
-                        pre,
-                        sn,
-                        said,
-                        witnessIndex: wiger.index,
-                        wits: witnessState.wits,
-                    },
-                });
+                return dropEscrow("invalidWitnessIndex", `PWE Bad escrowed witness receipt index=${wiger.index} at pre=${pre} sn=${sn.toString(16)}`);
             }
             const verfer = new Verfer({ qb64: verferQb64 });
             if (!verfer.verify(wiger.raw, serder.raw)) {
-                return dropEscrow("invalidReceiptSignature", {
-                    message: `PWE Bad escrowed witness receipt wig at pre=${pre} sn=${sn.toString(16)}.`,
-                    context: {
-                        pre,
-                        sn,
-                        said,
-                        witnessIndex: wiger.index,
-                        witness: verferQb64,
-                    },
-                });
+                return dropEscrow("invalidReceiptSignature", `PWE Bad escrowed witness receipt wig at pre=${pre} sn=${sn.toString(16)}.`);
             }
             this.db.wigs.add(dgKey(pre, serder.said ?? said), new Siger({
                 code: wiger.code,
@@ -1856,10 +1717,7 @@ export class Kevery {
         }
         const decision = this.processEscrowFindUnver(pre, sn, said, { wiger });
         return decision.kind === "continue"
-            ? keepEscrow("missingReceiptedEvent", {
-                message: `UWE Missing witness receipted evt at pre=${pre} sn=${sn.toString(16)}`,
-                context: { pre, sn, said },
-            })
+            ? keepEscrow("missingReceiptedEvent", `UWE Missing witness receipted evt at pre=${pre} sn=${sn.toString(16)}`)
             : decision;
     }
     /**
@@ -1882,10 +1740,7 @@ export class Kevery {
         }
         const verfer = cigar.verfer;
         if (!verfer) {
-            return dropEscrow("missingEscrowArtifact", {
-                message: `URE Missing escrowed receipt verifier at pre=${pre} sn=${sn.toString(16)}.`,
-                context: { pre, sn, said },
-            });
+            return dropEscrow("missingEscrowArtifact", `URE Missing escrowed receipt verifier at pre=${pre} sn=${sn.toString(16)}.`);
         }
         const partialDecision = this.processEscrowFindUnver(pre, sn, said, {
             cigar,
@@ -1899,10 +1754,7 @@ export class Kevery {
         }
         const { event } = lookup;
         if (!verfer.verify(cigar.raw, event.serder.raw)) {
-            return dropEscrow("invalidReceiptSignature", {
-                message: `URE Bad escrowed receipt sig at pre=${pre} sn=${sn.toString(16)} receipter=${verfer.qb64}`,
-                context: { pre, sn, said, receiptor: verfer.qb64 },
-            });
+            return dropEscrow("invalidReceiptSignature", `URE Bad escrowed receipt sig at pre=${pre} sn=${sn.toString(16)} receipter=${verfer.qb64}`);
         }
         const dgkey = dgKey(event.pre, event.said);
         const witnessIndex = event.wits.indexOf(verfer.qb64);
@@ -1943,69 +1795,24 @@ export class Kevery {
         const { event } = lookup;
         const estSaid = this.db.kels.getLast(prefixer.qb64, Number(snumber.num));
         if (!estSaid) {
-            return keepEscrow("missingReceiptorEstablishment", {
-                message: `VRE Missing receiptor establishment evt at pre=${prefixer.qb64} sn=${snumber.num.toString(16)}`,
-                context: {
-                    pre,
-                    sn,
-                    said,
-                    receiptor: prefixer.qb64,
-                    receiptorSn: snumber.num.toString(16),
-                },
-            });
+            return keepEscrow("missingReceiptorEstablishment", `VRE Missing receiptor establishment evt at pre=${prefixer.qb64} sn=${snumber.num.toString(16)}`);
         }
         if (estSaid !== ssaider.qb64) {
-            return dropEscrow("invalidReceiptorSeal", {
-                message: `VRE Bad chit seal at sn = ${snumber.num.toString(16)} for receipt from pre = ${prefixer.qb64}`,
-                context: {
-                    pre,
-                    sn,
-                    said,
-                    receiptor: prefixer.qb64,
-                    estSaid,
-                    sealSaid: ssaider.qb64,
-                },
-            });
+            return dropEscrow("invalidReceiptorSeal", `VRE Bad chit seal at sn = ${snumber.num.toString(16)} for receipt from pre = ${prefixer.qb64}`);
         }
         const estEvent = this.db.getEvtSerder(prefixer.qb64, estSaid);
         if (!estEvent) {
-            return dropEscrow("invalidReceiptorEstablishment", {
-                message: `VRE Invalid seal est. event dig = ${ssaider.qb64} for receipt from pre = ${prefixer.qb64}`,
-                context: { pre, sn, said, receiptor: prefixer.qb64, estSaid },
-            });
+            return dropEscrow("invalidReceiptorEstablishment", `VRE Invalid seal est. event dig = ${ssaider.qb64} for receipt from pre = ${prefixer.qb64}`);
         }
         if (estEvent.verfers.length === 0) {
-            return dropEscrow("missingReceiptorKeys", {
-                message: `VRE Invalid seal est. event dig = ${ssaider.qb64} for receipt from pre = ${prefixer.qb64} no keys`,
-                context: { pre, sn, said, receiptor: prefixer.qb64, estSaid },
-            });
+            return dropEscrow("missingReceiptorKeys", `VRE Invalid seal est. event dig = ${ssaider.qb64} for receipt from pre = ${prefixer.qb64} no keys`);
         }
         if (siger.index >= estEvent.verfers.length) {
-            return dropEscrow("receiptorIndexOutOfRange", {
-                message: `VRE Index = ${siger.index} too large for keys`,
-                context: {
-                    pre,
-                    sn,
-                    said,
-                    receiptor: prefixer.qb64,
-                    estSaid,
-                    sigerIndex: siger.index,
-                    keyCount: estEvent.verfers.length,
-                },
-            });
+            return dropEscrow("receiptorIndexOutOfRange", `VRE Index=${siger.index} exceeds key count=${estEvent.verfers.length} for receiptor=${prefixer.qb64} at dig=${said}.`);
         }
         const verfer = estEvent.verfers[siger.index];
         if (!verfer.verify(siger.raw, event.serder.raw)) {
-            return dropEscrow("invalidReceiptSignature", {
-                message: `VRE Bad escrowed trans receipt sig at pre=${pre} sn=${sn.toString(16)} receipter=${prefixer.qb64}`,
-                context: {
-                    pre,
-                    sn,
-                    said,
-                    receiptor: prefixer.qb64,
-                    sigerIndex: siger.index,
-                },
-            });
+            return dropEscrow("invalidReceiptSignature", `VRE Bad escrowed trans receipt sig at pre=${pre} sn=${sn.toString(16)} receipter=${prefixer.qb64}`);
         }
         const dgkey = dgKey(event.pre, event.said);
         this.db.vrcs.add(dgkey, [
@@ -2025,23 +1832,16 @@ export class Kevery {
     escrowReplayExpiry(scope, pre, said, timeoutMs) {
         const dater = this.db.dtss.get(dgKey(pre, said));
         if (!dater) {
-            return dropEscrow("missingDater", {
-                message: `${scope} Missing escrowed event datetime at dig = ${said}`,
-                context: { pre, said, scope },
-            });
+            return dropEscrow("missingDater", `${scope} Missing escrowed event datetime at dig = ${said}`);
         }
         return Date.now() - new Date(dater.dts).getTime() > timeoutMs
-            ? dropEscrow("stale", {
-                message: `${scope} Stale event escrow at dig = ${said}`,
-                context: { pre, said, scope },
-            })
+            ? dropEscrow("stale", `${scope} Stale event escrow at dig = ${said}`)
             : null;
     }
     /** Build a Kever-init envelope shared across decide/apply helpers. */
     makeKeverEventInit(envelope, local) {
         return {
             db: this.db,
-            cues: this.cues,
             serder: envelope.serder,
             sigers: [...envelope.sigers],
             wigers: [...envelope.wigers],
@@ -2289,7 +2089,9 @@ export class Kevery {
      *
      * Stored artifacts mirror the KERIpy event escrow model:
      * - `dtss.` for local escrow insertion time
-     * - `sigs.` / `wigs.` / `wits.` for verified attachment state
+     * - `sigs.` / `wigs.` for retained attachment candidates; early escrows may
+     *   precede their verification
+     * - `wits.` for the derived witness cohort when available
      * - `evts.` for the escrowed event body
      * - `udes.` for delegation or source-seal context when present
      * - `esrs.` for local/remote source provenance
@@ -2436,11 +2238,28 @@ export class Kevery {
      *
      * Event-escrow replay differs from receipt/query/reply replay:
      * - the escrowed event is reconstructed back into a normal event envelope
-     * - the same native writer and prepared decision path as live intake is reused
+     * - the same native writer and explicit processing path as live intake is reused
      * - escrow movement/removal commits with event effects before state/cue publication
+     *
+     * @param currentEscrow Family currently retaining the event.
+     * @param pre Event AID in qualified Base64 form.
+     * @param on Event sequence number, or null for a set-keyed family.
+     * @param said Event digest identifying its stored body and detached proofs.
      */
     replayEscrowEntry(currentEscrow, pre, on, said) {
-        this.settleEventDecision(() => this.rehydrateEscrowEnvelope(currentEscrow, pre, said), { kind: currentEscrow, pre, on, said });
+        const decision = this.settleEventDecision(() => this.rehydrateEscrowEnvelope(currentEscrow, pre, said), { kind: currentEscrow, pre, on, said });
+        // The transaction above has committed the removal. Acceptance and movement
+        // to another dependency family are ordinary recovery, not ejections.
+        if (decision === null || decision.kind === "reject") {
+            consoleLogger.warn("KEL escrow removed", {
+                family: currentEscrow,
+                pre,
+                sn: on,
+                said,
+                reason: decision?.code ?? "missingEscrowedEvent",
+                detail: decision?.message ?? "Stored event body is missing.",
+            });
+        }
     }
     /** Remove one stored escrow pointer from its current bucket. */
     removeEscrow(escrow, pre, on, said) {