keri-ts 0.11.0 → 2.0.0

package/esm/keri/npm/src/vdr/eventing.js

@@ -9,16 +9,34 @@
  * - normal remote-processing outcomes are returned as typed decisions instead
  *   of being represented by Python control-flow exceptions.
  */
-import { Dater, Diger, Ilks, Prefixer, SerderKERI, TraitDex, Verfer, Vrsn_2_0, } from "cesr-ts";
-import { CueDeck } from "../core/cue-admission.js";
-import { Deck, DeckFullError } from "../core/deck.js";
-import { ValidationError } from "../core/errors.js";
-import { Kever } from "../core/kever.js";
-import { state as registryState, vcstate as credentialState } from "../core/protocol-vdr-eventing.js";
+import { Dater, Diger, Ilks, ParserError, Prefixer, SerderKERI, TraitDex, Verfer, } from "cesr-ts";
+import { Deck } from "../core/deck.js";
+import { DatabaseOperationError, ValidationError } from "../core/errors.js";
+import { acceptEscrow, dropEscrow, keepEscrow } from "../core/kel/kever-decisions.js";
+import { Kever } from "../core/kel/kever.js";
+import { consoleLogger } from "../core/logger.js";
+import { projectRegistrySeal, state as registryState, vcstate as credentialState, } from "../core/protocol-vdr-eventing.js";
+import { acceptReplyDecision, unverifiedReplyDecision, } from "../core/routing.js";
 import { dgKey } from "../db/core/keys.js";
-import { CapturedTelReplay } from "../db/tel-replay.js";
-import { encodeDateTimeToDater, makeNowIso8601 } from "../time/mod.js";
+import { encodeDateTimeToDater, makeNowIso8601, timestampMicros } from "../time/mod.js";
+import { backerThreshold, resolveBackerState } from "./backer-state.js";
+import { credentialRecord } from "./credential-tsn-record.js";
+import { qualifiedPrefix, registryRecord } from "./registry-tsn-record.js";
+import { verifyTelAnchor } from "./tel-anchor.js";
 import { prepareTsnQuery } from "./tsn-query.js";
+/** Carry an existing pending decision across Tever's constructor-only boundary. */
+class PendingTelInception extends Error {
+    /** @param decision Recoverable inception outcome retained in its existing protocol escrow. */
+    constructor(decision) {
+        super(decision.reason);
+        Object.defineProperty(this, "decision", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: decision
+        });
+    }
+}
 function okSaid(serder) {
     if (!serder.said) {
         throw new ValidationError("TEL event missing SAID.");
@@ -110,6 +128,55 @@ function stringListField(data, field) {
     const value = data[field];
     return Array.isArray(value) && value.every((item) => typeof item === "string") ? [...value] : [];
 }
+/**
+ * Validate VCP identity, ordinal, backer policy and configuration without writes.
+ * Existing constructor overrides retain their KERIpy semantics: an explicit true
+ * or a signed configuration trait enables the corresponding registry policy.
+ */
+export function validateRegistryInception(serder, noBackers, estOnly) {
+    if (serder.ilk !== Ilks.vcp)
+        throw new ValidationError(`Expected vcp got ${String(serder.ilk)}.`);
+    const ked = okKed(serder);
+    const issuer = stringField(ked, "ii");
+    if (!issuer)
+        throw new ValidationError("Registry inception missing ii.");
+    const prefixer = new Prefixer({ qb64: okPre(serder) });
+    const sn = okSn(serder);
+    if (sn !== 0)
+        throw new ValidationError(`Invalid vcp sn=${sn}.`);
+    const baks = stringListField(ked, "b");
+    if (!unique(baks))
+        throw new ValidationError(`Invalid duplicate baks=${baks}.`);
+    const toad = backerThreshold(ked.bt);
+    if (toad === null)
+        throw new ValidationError("Invalid registry backer threshold.");
+    validateBackerThreshold(toad, baks);
+    const cnfg = stringListField(ked, "c");
+    const backerless = (noBackers ?? false) || cnfg.includes(TraitDex.NoBackers);
+    if (backerless && baks.length > 0)
+        throw new ValidationError("NoBackers registry may not configure baks.");
+    return {
+        issuer,
+        prefixer,
+        baks,
+        toad,
+        noBackers: backerless,
+        estOnly: (estOnly ?? false) || cnfg.includes(TraitDex.EstOnly),
+    };
+}
+/** Enforce the same exact quorum bounds for inception, rotation and endorsement admission. */
+function validateBackerThreshold(toad, baks) {
+    if (!Number.isSafeInteger(toad) || toad < 0)
+        throw new ValidationError("Invalid registry backer threshold.");
+    if (baks.length === 0) {
+        if (toad !== 0)
+            throw new ValidationError(`Invalid toad=${toad} for empty backer set.`);
+    }
+    else if (toad < 1 || toad > baks.length) {
+        throw new ValidationError(`Invalid toad=${toad} for baks=${baks}.`);
+    }
+}
+/** Leave untrusted fields unknown until each lookup checks the fields it consumes. */
 function sealRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
@@ -123,9 +190,9 @@ function serderForTel(reger, pre, said) {
 /**
  * Registry transaction event verifier.
  *
- * `Tever` owns accepted TEL state for one registry. It writes durable TEL
- * artifacts through `Reger`; `Tevery` owns routing, cache insertion, and escrow
- * replay.
+ * `Tever` carries registry state and evaluates/writes one private admission
+ * candidate through `Reger`. Input policy is supplied for that admission rather
+ * than cached. `Tevery` owns transactions, accepted cache publication, cues and replay.
  */
 export class Tever {
     constructor(options) {
@@ -141,18 +208,6 @@ export class Tever {
             writable: true,
             value: void 0
         });
-        Object.defineProperty(this, "local", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "cues", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
         Object.defineProperty(this, "version", {
             enumerable: true,
             configurable: true,
@@ -233,8 +288,6 @@ export class Tever {
         });
         this.db = options.db;
         this.reger = options.reger;
-        this.local = options.local ?? false;
-        this.cues = options.cues ?? new Deck();
         if (options.rsr) {
             this.version = { major: 1, minor: 0 };
             this.reload(options.rsr);
@@ -248,8 +301,16 @@ export class Tever {
         }
         this.version = options.serder.pvrsn;
         this.regk = options.regk ?? okPre(options.serder);
-        this.incept(options.serder);
-        this.config(options.serder, options.noBackers, options.estOnly);
+        const inception = validateRegistryInception(options.serder, options.noBackers, options.estOnly);
+        this.pre = inception.issuer;
+        this.prefixer = inception.prefixer;
+        this.sn = 0;
+        this.baks = inception.baks;
+        this.toad = inception.toad;
+        this.noBackers = inception.noBackers;
+        this.estOnly = inception.estOnly;
+        this.ilk = Ilks.vcp;
+        this.serder = options.serder;
         const checked = this.valAnchorBigs({
             serder: options.serder,
             seqner: options.seqner ?? null,
@@ -257,9 +318,10 @@ export class Tever {
             bigers: options.bigers ?? [],
             toad: this.toad,
             baks: this.baks,
+            local: options.local ?? false,
         });
         if (checked.kind !== "accept") {
-            throw new ValidationError(checked.reason);
+            throw new PendingTelInception(checked.decision);
         }
         this.logEvent({
             pre: this.prefixer.qb64,
@@ -288,7 +350,10 @@ export class Tever {
         this.prefixer = new Prefixer({ qb64: regk });
         this.sn = parseInt(rsr.s ?? "0", 16);
         this.ilk = (rsr.et ?? Ilks.vcp);
-        this.toad = parseInt(rsr.bt ?? "0", 16);
+        const toad = backerThreshold(rsr.bt);
+        if (toad === null)
+            throw new DatabaseOperationError("Stored registry backer threshold is invalid.");
+        this.toad = toad;
         this.baks = [...(rsr.b ?? [])];
         this.noBackers = (rsr.c ?? []).includes(TraitDex.NoBackers);
         this.estOnly = (rsr.c ?? []).includes(TraitDex.EstOnly);
@@ -332,7 +397,7 @@ export class Tever {
         const [number, diger] = anchor;
         const eilk = this.noBackers ? (digs.length === 1 ? Ilks.iss : Ilks.rev) : (digs.length === 1 ? Ilks.bis : Ilks.brv);
         const ked = okKed(serder);
-        const ra = this.noBackers ? {} : sealRecord(ked.ra) ?? {};
+        const ra = this.noBackers ? {} : projectRegistrySeal(ked.ra);
         return credentialState(vci, said, vcsn, this.regk, eilk, { s: Number(number.num), d: diger.qb64 }, {
             ra,
             dts: typeof ked.dt === "string" ? ked.dt : undefined,
@@ -343,9 +408,9 @@ export class Tever {
         const count = this.reger.tels.cntOn(vci, 0);
         return count === 0 ? null : count - 1;
     }
-    /** Apply TEL input; the internal recorder preserves owned-cue publication failures through router catches. */
-    update(args, recordCueFailure) {
-        let cueFailure;
+    /** Apply TEL input; the internal recorder preserves publication failures through router catches. */
+    update(args, recordPublicationFailure) {
+        let publicationFailure;
         try {
             const serder = args.serder;
             const ilk = telIlk(serder);
@@ -357,60 +422,21 @@ export class Tever {
                 return this.issue(serder, sn, args);
             }
             if (ilk === Ilks.rev || ilk === Ilks.brv) {
-                return this.revoke(serder, sn, args, this.cues instanceof CueDeck
-                    ? (error) => {
-                        cueFailure = { error };
-                        recordCueFailure?.(error);
-                    }
-                    : undefined);
+                return this.revoke(serder, sn, args, (error) => {
+                    publicationFailure = { error };
+                    recordPublicationFailure?.(error);
+                });
             }
             return reject(`Unsupported TEL ilk=${ilk}.`, serder, this.regk);
         }
         catch (error) {
-            if (cueFailure && cueFailure.error === error)
+            if (publicationFailure && publicationFailure.error === error)
+                throw error;
+            if (!(error instanceof ValidationError) && !(error instanceof ParserError))
                 throw error;
             return reject(error instanceof Error ? error.message : String(error), args.serder, this.regk);
         }
     }
-    incept(serder) {
-        const ked = okKed(serder);
-        const pre = stringField(ked, "ii");
-        if (!pre) {
-            throw new ValidationError("Registry inception missing ii.");
-        }
-        this.pre = pre;
-        this.prefixer = new Prefixer({ qb64: okPre(serder) });
-        this.sn = okSn(serder);
-        if (this.sn !== 0) {
-            throw new ValidationError(`Invalid vcp sn=${this.sn}.`);
-        }
-        this.cuts = [];
-        this.adds = [];
-        const baks = stringListField(ked, "b");
-        if (!unique(baks)) {
-            throw new ValidationError(`Invalid duplicate baks=${baks}.`);
-        }
-        this.baks = baks;
-        const toad = parseInt(stringField(ked, "bt") ?? "0", 16);
-        this.validateToad(toad, baks);
-        this.toad = toad;
-        this.ilk = Ilks.vcp;
-        this.serder = serder;
-    }
-    config(serder, noBackers, estOnly) {
-        const cnfg = stringListField(okKed(serder), "c");
-        this.noBackers = noBackers ?? false;
-        this.estOnly = estOnly ?? false;
-        if (cnfg.includes(TraitDex.NoBackers)) {
-            this.noBackers = true;
-        }
-        if (cnfg.includes(TraitDex.EstOnly)) {
-            this.estOnly = true;
-        }
-        if (this.noBackers && this.baks.length > 0) {
-            throw new ValidationError("NoBackers registry may not configure baks.");
-        }
-    }
     updateRotation(serder, sn, args) {
         if (this.noBackers) {
             return reject("Backerless registry cannot rotate TEL backers.", serder, this.regk);
@@ -426,6 +452,7 @@ export class Tever {
             bigers: args.wigers ?? [],
             toad: rotated.toad,
             baks: rotated.baks,
+            local: args.local ?? false,
         });
         if (checked.kind !== "accept") {
             return checked.decision;
@@ -474,12 +501,16 @@ export class Tever {
         }
         const next = this.baks.filter((bak) => !cuts.includes(bak));
         next.push(...adds);
-        const toad = parseInt(stringField(ked, "bt") ?? "0", 16);
+        const toad = backerThreshold(ked.bt);
+        if (toad === null)
+            return reject("Invalid registry backer threshold.", serder, this.regk);
         try {
-            this.validateToad(toad, next);
+            validateBackerThreshold(toad, next);
         }
         catch (error) {
-            return reject(error instanceof Error ? error.message : String(error), serder, this.regk);
+            if (!(error instanceof ValidationError) && !(error instanceof ParserError))
+                throw error;
+            return reject(error.message, serder, this.regk);
         }
         return { kind: "rotated", toad, baks: next, cuts, adds };
     }
@@ -508,10 +539,11 @@ export class Tever {
         if (this.noBackers) {
             return reject("Backer issue is invalid against backerless registry.", serder, this.regk);
         }
-        const state = this.getBackerState(okKed(serder), serder);
-        if (state.kind === "reject") {
-            return state;
-        }
+        const state = resolveBackerState(this.reger, this.regk, okKed(serder).ra);
+        if (state.kind === "reject")
+            return reject(state.reason, serder, this.regk);
+        if (state.kind === "missing")
+            return escrow("outOfOrder", state.reason, serder, this.regk);
         const checked = this.valAnchorBigs({
             serder,
             seqner: args.seqner ?? null,
@@ -519,6 +551,7 @@ export class Tever {
             bigers: args.wigers ?? [],
             toad: state.toad,
             baks: state.baks,
+            local: args.local ?? false,
         });
         if (checked.kind !== "accept") {
             return checked.decision;
@@ -533,7 +566,7 @@ export class Tever {
         });
         return accept(serder, this.regk);
     }
-    revoke(serder, sn, args, recordCueFailure) {
+    revoke(serder, sn, args, recordPublicationFailure) {
         const vci = okPre(serder);
         const prior = digestForTel(this.reger, vci, sn - 1);
         if (prior === null) {
@@ -553,16 +586,17 @@ export class Tever {
                 this.escrowALEvent(serder, args.seqner ?? null, args.saider ?? null);
                 return escrow("anchorless", "Missing KEL anchor for TEL revoke.", serder, this.regk);
             }
-            this.logRevoked(serder, sn, args, undefined, recordCueFailure);
+            this.logRevoked(serder, sn, args, undefined, recordPublicationFailure);
             return accept(serder, this.regk);
         }
         if (this.noBackers) {
             return reject("Backer revoke is invalid against backerless registry.", serder, this.regk);
         }
-        const state = this.getBackerState(okKed(serder), serder);
-        if (state.kind === "reject") {
-            return state;
-        }
+        const state = resolveBackerState(this.reger, this.regk, okKed(serder).ra);
+        if (state.kind === "reject")
+            return reject(state.reason, serder, this.regk);
+        if (state.kind === "missing")
+            return escrow("outOfOrder", state.reason, serder, this.regk);
         const checked = this.valAnchorBigs({
             serder,
             seqner: args.seqner ?? null,
@@ -570,66 +604,45 @@ export class Tever {
             bigers: args.wigers ?? [],
             toad: state.toad,
             baks: state.baks,
+            local: args.local ?? false,
         });
         if (checked.kind !== "accept") {
             return checked.decision;
         }
-        this.logRevoked(serder, sn, args, checked.bigers, recordCueFailure);
+        this.logRevoked(serder, sn, args, checked.bigers, recordPublicationFailure);
         return accept(serder, this.regk);
     }
-    /** Admit the actual revocation cue before accepted TEL writes; publication follows the existing log boundary. */
-    logRevoked(serder, sn, args, bigers, recordCueFailure) {
-        let prepared;
+    /** Persist accepted revocation evidence; Tevery publishes its cue after commit. */
+    logRevoked(serder, sn, args, bigers, recordPublicationFailure) {
         try {
-            try {
-                const cue = { kin: "revoked", serder };
-                prepared = this.cues instanceof CueDeck ? this.cues.prepare([cue]) : undefined;
-                if (!prepared)
-                    this.cues.checkSpace();
-                this.logEvent({
-                    pre: okPre(serder),
-                    sn,
-                    serder,
-                    seqner: args.seqner ?? null,
-                    saider: args.saider ?? null,
-                    bigers,
-                });
-                if (prepared)
-                    prepared.publish();
-                else
-                    this.cues.push(cue);
-            }
-            finally {
-                prepared?.release();
-            }
+            this.logEvent({
+                pre: okPre(serder),
+                sn,
+                serder,
+                seqner: args.seqner ?? null,
+                saider: args.saider ?? null,
+                bigers,
+            });
         }
         catch (error) {
-            recordCueFailure?.(error);
+            recordPublicationFailure?.(error);
             throw error;
         }
     }
-    validateToad(toad, baks) {
-        if (baks.length === 0) {
-            if (toad !== 0) {
-                throw new ValidationError(`Invalid toad=${toad} for empty backer set.`);
-            }
-        }
-        else if (toad < 1 || toad > baks.length) {
-            throw new ValidationError(`Invalid toad=${toad} for baks=${baks}.`);
-        }
-    }
     valAnchorBigs(args) {
         const verfers = args.baks.map((bak) => new Verfer({ qb64: bak }));
-        const verified = Kever.verifyIndexedSignatures(args.serder.raw, args.bigers, verfers).sigers;
+        const verified = Kever.verifyIndexedSignatures(args.serder.raw, 
+        // Every arrival and retry verifies the union against this exact historical cohort.
+        [...this.reger.tibs.get(dgKey(okPre(args.serder), okSaid(args.serder))), ...args.bigers], verfers).sigers;
         if (!this.verifyAnchor(args.serder, args.seqner, args.saider)) {
             this.escrowALEvent(args.serder, args.seqner, args.saider, verified, [...args.baks]);
             const decision = escrow("anchorless", "Missing KEL anchor for TEL event.", args.serder, this.regk);
             return { kind: "escrow", decision, reason: decision.reason };
         }
-        if (!this.local && args.baks.length > 0) {
-            this.validateToad(args.toad, args.baks);
+        if (!args.local && args.baks.length > 0) {
+            validateBackerThreshold(args.toad, args.baks);
             if (verified.length < args.toad) {
-                this.escrowPWEvent(args.serder, args.seqner, args.saider, verified);
+                this.escrowPWEvent(args.serder, args.seqner, args.saider, verified, args.baks);
                 const decision = escrow("partialWitness", `TEL event does not satisfy backer threshold ${args.toad}.`, args.serder, this.regk);
                 return { kind: "escrow", decision, reason: decision.reason };
             }
@@ -637,38 +650,19 @@ export class Tever {
         return { kind: "accept", bigers: verified };
     }
     verifyAnchor(serder, seqner, saider) {
-        if (!seqner || !saider) {
-            return false;
-        }
-        const anchorSaid = this.db.kels.getLast(this.pre, Number(seqner.num));
-        if (!anchorSaid || anchorSaid !== saider.qb64) {
-            return false;
-        }
-        const anchor = this.db.getEvtSerder(this.pre, anchorSaid);
-        if (!anchor || anchor.said !== saider.qb64) {
-            return false;
-        }
-        const anchorKed = okKed(anchor);
-        const seals = Array.isArray(anchorKed.a) ? anchorKed.a : [];
-        if (seals.length !== 1) {
-            return false;
-        }
-        const seal = sealRecord(seals[0]);
-        return seal?.i === serder.pre
-            && seal?.s === serder.snh
-            && seal?.d === serder.said;
+        return verifyTelAnchor(this.db, this.pre, serder, seqner, saider);
     }
     /** Retain partial-witness evidence with its qualified source ordinal. */
-    escrowPWEvent(serder, seqner, saider, bigers = []) {
+    escrowPWEvent(serder, seqner, saider, bigers = [], baks = []) {
         const pre = okPre(serder);
         const said = okSaid(serder);
         const key = dgKey(pre, said);
         if (seqner && saider) {
             this.reger.ancs.put(key, [seqner, new Diger({ qb64: saider.qb64 })]);
         }
-        if (bigers.length > 0) {
-            this.reger.tibs.pin(key, [...bigers]);
-        }
+        this.reger.tibs.pin(key, [...bigers]);
+        this.reger.baks.rem(key);
+        this.reger.baks.put(key, [...baks]);
         this.reger.tvts.put(key, serder.raw);
         this.reger.twes.put(pre, okSn(serder), said);
     }
@@ -680,9 +674,7 @@ export class Tever {
         if (seqner && saider) {
             this.reger.ancs.put(key, [seqner, new Diger({ qb64: saider.qb64 })]);
         }
-        if (bigers.length > 0) {
-            this.reger.tibs.pin(key, [...bigers]);
-        }
+        this.reger.tibs.pin(key, [...bigers]);
         if (baks.length > 0) {
             this.reger.baks.rem(key);
             this.reger.baks.put(key, [...baks]);
@@ -690,21 +682,6 @@ export class Tever {
         this.reger.tvts.put(key, serder.raw);
         this.reger.taes.put(pre, okSn(serder), said);
     }
-    getBackerState(ked, serder) {
-        const ra = sealRecord(ked.ra);
-        const regi = typeof ra?.i === "string" ? ra.i : null;
-        const regd = typeof ra?.d === "string" ? ra.d : null;
-        if (!regi || !regd || regi !== this.prefixer.qb64) {
-            return reject("Backer TEL event registry anchor mismatch.", serder, this.regk);
-        }
-        const rserder = serderForTel(this.reger, regi, regd);
-        if (!rserder) {
-            return reject("Backer TEL event references missing registry state.", serder, this.regk);
-        }
-        const toad = parseInt(stringField(okKed(rserder), "bt") ?? "0", 16);
-        const baks = this.reger.baks.get(dgKey(regi, regd));
-        return { kind: "backers", toad, baks };
-    }
     /** Persist accepted TEL evidence and the exact qualified source seal. */
     logEvent(args) {
         const said = okSaid(args.serder);
@@ -714,9 +691,7 @@ export class Tever {
         }
         // Keep the qualified Number; widening it here would alter v2 replay evidence.
         this.reger.ancs.put(key, [args.seqner, new Diger({ qb64: args.saider.qb64 })]);
-        if (args.bigers && args.bigers.length > 0) {
-            this.reger.tibs.pin(key, [...args.bigers]);
-        }
+        this.reger.tibs.pin(key, [...(args.bigers ?? [])]);
         if (args.baks && args.baks.length > 0) {
             this.reger.baks.rem(key);
             this.reger.baks.put(key, [...args.baks]);
@@ -727,14 +702,20 @@ export class Tever {
     }
 }
 /**
- * TEL event router and escrow reprocessor.
+ * TEL event and transaction-state notice processor.
  *
  * `Tevery` owns registry-key routing, expected sequence checks, accepted
  * `Tever` cache persistence, and replay of anchorless/out-of-order TEL
- * escrows.
+ * escrows, plus TSN reply admission and dependency retries.
  */
 export class Tevery {
     constructor(options) {
+        Object.defineProperty(this, "rvy", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         Object.defineProperty(this, "db", {
             enumerable: true,
             configurable: true,
@@ -765,6 +746,7 @@ export class Tevery {
             writable: true,
             value: void 0
         });
+        this.rvy = options.rvy;
         this.db = options.db;
         this.reger = options.reger;
         this.local = options.local ?? false;
@@ -787,79 +769,131 @@ export class Tevery {
             this.tevers.set(state.i, new Tever({
                 db: this.db,
                 reger: this.reger,
-                local: this.local,
-                cues: this.cues,
                 rsr: state,
             }));
             this.registries.add(state.i);
         }
     }
+    /** Decide and persist under one owned writer, then publish accepted cache state and cues. */
     processEvent(args) {
-        let cueFailure;
+        if (this.reger.inWriteTransaction) {
+            throw new Error("Tevery must own the TEL transaction; process events outside caller-owned writers");
+        }
+        let accepted;
+        let publicationFailure;
+        let decision;
         try {
-            const serder = args.serder;
-            const ilk = telIlk(serder);
-            const pre = okPre(serder);
-            const sn = okSn(serder);
-            const regk = Tevery.registryKey(serder);
-            if (!this.lax) {
-                if (this.local && !this.registries.has(regk)) {
-                    return reject(`Nonlocal TEL event regk=${regk} in local mode.`, serder, regk);
+            decision = this.reger.env.transactionSync(() => {
+                const serder = args.serder;
+                const ilk = telIlk(serder);
+                const pre = okPre(serder);
+                const sn = okSn(serder);
+                const regk = Tevery.registryKey(serder);
+                if (!this.lax) {
+                    if (this.local && !this.registries.has(regk)) {
+                        return reject(`Nonlocal TEL event regk=${regk} in local mode.`, serder, regk);
+                    }
+                    if (!this.local && this.registries.has(regk)) {
+                        return reject(`Local TEL event regk=${regk} in nonlocal mode.`, serder, regk);
+                    }
                 }
-                if (!this.local && this.registries.has(regk)) {
-                    return reject(`Local TEL event regk=${regk} in nonlocal mode.`, serder, regk);
+                // Work on a private candidate from accepted storage, never a shared cached state machine.
+                const stored = this.reger.states.get(regk);
+                const tever = stored ? new Tever({ db: this.db, reger: this.reger, rsr: stored }) : undefined;
+                if (!tever) {
+                    if (ilk !== Ilks.vcp) {
+                        this.escrowOOEvent(serder, args.seqner ?? null, args.saider ?? null, args.wigers ?? []);
+                        return escrow("outOfOrder", "TEL event arrived before registry inception.", serder, regk);
+                    }
+                    try {
+                        const next = new Tever({
+                            serder,
+                            seqner: args.seqner ?? null,
+                            saider: args.saider ?? null,
+                            bigers: args.wigers ?? [],
+                            db: this.db,
+                            reger: this.reger,
+                            regk,
+                            local: this.local,
+                        });
+                        this.reger.states.pin(regk, next.state());
+                        accepted = next;
+                        return accept(serder, regk);
+                    }
+                    catch (error) {
+                        // Constructor admission persists missing evidence in its real protocol escrow.
+                        if (error instanceof PendingTelInception)
+                            return error.decision;
+                        throw error;
+                    }
                 }
-            }
-            const tever = this.tevers.get(regk);
-            if (!tever) {
-                if (ilk !== Ilks.vcp) {
-                    this.escrowOOEvent(serder, args.seqner ?? null, args.saider ?? null);
-                    return escrow("outOfOrder", "TEL event arrived before registry inception.", serder, regk);
+                if (ilk === Ilks.vcp)
+                    return this.processAcceptedDuplicate(args, regk);
+                const expected = ilk === Ilks.vrt ? tever.sn + 1 : (tever.vcSn(pre) ?? -1) + 1;
+                if (sn > expected) {
+                    this.escrowOOEvent(serder, args.seqner ?? null, args.saider ?? null, args.wigers ?? []);
+                    return escrow("outOfOrder", `TEL event sn=${sn} expected=${expected}.`, serder, regk);
                 }
-                const next = new Tever({
-                    serder,
-                    seqner: args.seqner ?? null,
-                    saider: args.saider ?? null,
-                    bigers: args.wigers ?? [],
-                    db: this.db,
-                    reger: this.reger,
-                    regk,
-                    local: this.local,
-                    cues: this.cues,
+                if (sn < expected)
+                    return this.processAcceptedDuplicate(args, regk);
+                const result = tever.update({ ...args, local: this.local }, (error) => {
+                    publicationFailure = { error };
                 });
-                this.cacheTever(regk, next);
-                return accept(serder, regk);
-            }
-            if (ilk === Ilks.vcp) {
-                return duplicate("Registry inception already accepted.", serder, regk);
-            }
-            const expected = ilk === Ilks.vrt ? tever.sn + 1 : (tever.vcSn(pre) ?? -1) + 1;
-            if (sn > expected) {
-                this.escrowOOEvent(serder, args.seqner ?? null, args.saider ?? null);
-                return escrow("outOfOrder", `TEL event sn=${sn} expected=${expected}.`, serder, regk);
-            }
-            if (sn < expected) {
-                return duplicate(`TEL event sn=${sn} older than expected=${expected}.`, serder, regk);
-            }
-            const decision = tever.update(args, (error) => {
-                cueFailure = { error };
+                if (result.kind === "escrow" && result.escrow === "outOfOrder") {
+                    this.escrowOOEvent(serder, args.seqner ?? null, args.saider ?? null, args.wigers ?? []);
+                }
+                if (result.kind === "accept" && ilk === Ilks.vrt) {
+                    this.reger.states.pin(regk, tever.state());
+                    accepted = tever;
+                }
+                return result;
             });
-            if (decision.kind === "accept" && ilk === Ilks.vrt) {
-                this.cacheTever(regk, tever);
-            }
-            return decision;
         }
         catch (error) {
-            if (error instanceof DeckFullError || (cueFailure && cueFailure.error === error))
+            if (publicationFailure && publicationFailure.error === error)
+                throw error;
+            if (!(error instanceof ValidationError) && !(error instanceof ParserError))
                 throw error;
             return reject(error instanceof Error ? error.message : String(error), args.serder);
         }
+        if (accepted)
+            this.tevers.set(accepted.regk, accepted);
+        if (decision.kind === "accept" && (decision.ilk === Ilks.rev || decision.ilk === Ilks.brv)) {
+            // Keep publication outside semantic error conversion and after the writer has committed.
+            this.cues.push({ kin: "revoked", serder: args.serder });
+        }
+        return decision;
     }
-    /** Serve legacy TEL replay or an ordered TSN pair with independent receiver verification.
+    /** Add valid late backer receipts to an exact accepted event without reapplying its business state. */
+    processAcceptedDuplicate(args, regk) {
+        const { serder } = args;
+        const pre = okPre(serder), sn = okSn(serder), said = okSaid(serder);
+        if (this.reger.tels.getOn(pre, sn)?.qb64 !== said) {
+            return reject("TEL event conflicts with the accepted coordinate.", serder, regk);
+        }
+        if (args.wigers?.length && serder.ilk !== Ilks.iss && serder.ilk !== Ilks.rev) {
+            const seal = serder.ilk === Ilks.vcp || serder.ilk === Ilks.vrt
+                ? { i: pre, s: serder.snh, d: said }
+                : okKed(serder).ra;
+            const state = resolveBackerState(this.reger, regk, seal);
+            if (state.kind !== "backers") {
+                throw new DatabaseOperationError("Accepted TEL event has no accepted backer cohort.");
+            }
+            const key = dgKey(pre, said);
+            const verified = Kever.verifyIndexedSignatures(serder.raw, [...this.reger.tibs.get(key), ...args.wigers], state.baks.map((bak) => new Verfer({ qb64: bak }))).sigers;
+            this.reger.tibs.pin(key, verified);
+        }
+        return duplicate("TEL event already accepted.", serder, regk);
+    }
+    /**
+     * Serve legacy TEL replay or an ordered TSN pair with independent receiver verification.
      * Actual 714 leaves query signature validation TODO. Requester material identifies the destination;
-     * optional KRAM and sender policy remain separate. Replay output uses the reference's default v2 genus.
+     * optional KRAM and sender policy remain separate. Replay uses the parsed request genus;
+     * direct callers default to the body-declared context and may select another genus explicitly.
+     *
+     * @param args TEL query body, authenticated source and nontransferable cigar evidence.
      */
-    processQuery({ serder, source, cigars }) {
+    processQuery({ serder, source, cigars, gvrsn }) {
         if (serder.route === "tsn") {
             const result = prepareTsnQuery({ serder, source, cigars }, this.tevers);
             if (result.kind === "drop")
@@ -874,26 +908,336 @@ export class Tevery {
         if (!dest)
             return { kind: "drop", reason: "missingAuthentication" };
         const query = serder.ked?.q;
-        if (!query || typeof query.ri !== "string" || !query.ri || typeof query.src !== "string" || !query.src
-            || typeof query.i !== "string")
+        if (!query || typeof query !== "object" || Array.isArray(query)
+            || !("ri" in query) || typeof query.ri !== "string" || !query.ri
+            || !("src" in query) || typeof query.src !== "string" || !query.src
+            || !("i" in query) || typeof query.i !== "string")
             return { kind: "drop", reason: "invalidQuery" };
-        const management = this.reger.replay(query.ri, { gvrsn: Vrsn_2_0, genusify: true });
-        const credential = query.i ? this.reger.replay(query.i, { gvrsn: Vrsn_2_0, genusify: true }) : null;
-        const messages = CapturedTelReplay.pair(management, credential);
-        if (!messages)
+        const selected = gvrsn ?? serder.gvrsn ?? serder.pvrsn;
+        const settings = { gvrsn: selected, genusify: selected.major >= 2 };
+        const management = this.reger.replay(query.ri, settings);
+        const credential = query.i ? this.reger.replay(query.i, settings) : null;
+        if (!management && !credential)
             return;
+        const messages = {
+            *[Symbol.iterator]() {
+                if (management)
+                    yield* management;
+                if (credential)
+                    yield* credential;
+            },
+        };
         this.cues.push({
             kin: "replay",
             querySaid: serder.said ?? undefined,
             src: query.src,
             dest,
-            messages,
+            msgs: messages,
+        });
+    }
+    /** Register both semantic TSN routes against this processor, as KERIpy Tevery does. */
+    registerReplyRoutes(router) {
+        this.replyVerifier();
+        router.addRoute("/tsn/registry/{aid}", this, "RegistryTxnState");
+        router.addRoute("/tsn/credential/{aid}", this, "CredentialTxnState");
+    }
+    /** TEL-only processors have no implicit reply verifier or TSN capability. */
+    replyVerifier() {
+        if (!this.rvy)
+            throw new TypeError("Transaction-state notice processing requires Revery.");
+        return this.rvy;
+    }
+    /** Admit a registry TSN using independent attester proof, accepted trust and current TEL correspondence. */
+    processReplyRegistryTxnState({ serder, diger, route, aid, cigars = [], tsgs = [] }) {
+        const rvy = this.replyVerifier();
+        const record = registryRecord(serder.ked?.a);
+        const stamp = serder.ked?.dt;
+        if (!record || !qualifiedPrefix(aid) || typeof stamp !== "string" || timestampMicros(stamp) === null
+            || route !== `/tsn/registry/${aid}`
+            || serder.said !== diger.qb64 || !serder.verify()) {
+            return unverifiedReplyDecision("Invalid registry transaction-state notice.");
+        }
+        const regk = record.i, issuer = record.ii, sn = Number.parseInt(record.s, 16);
+        const previous = this.reger.txnsb.current([regk, aid]);
+        const disposeIncoming = () => {
+            if (previous?.qb64 !== diger.qb64)
+                rvy.removeReply(diger);
+        };
+        const reject = (reason) => {
+            disposeIncoming();
+            return unverifiedReplyDecision(reason);
+        };
+        const saved = this.reger.states.get(regk);
+        const stored = saved ? registryRecord(saved.asDict()) : null;
+        if (saved && !stored)
+            throw new Error("Corrupt stored registry state.");
+        if (stored && (stored.ii !== issuer || BigInt(`0x${stored.s}`) > BigInt(sn))) {
+            return reject("Mismatched issuer or stale registry state.");
+        }
+        const kever = this.db.getKever(issuer, { refresh: true });
+        let queryCues = [];
+        const escrow = (typ, query, proof) => {
+            const isNew = !this.reger.txnsb.hasStateNotice(typ, regk, aid, diger);
+            const cues = !isNew || !query
+                ? []
+                : typ === "registry-mae"
+                    ? [{ kin: "query", pre: issuer, src: aid, route: "logs", q: {} }]
+                    : [{ kin: "query", pre: issuer, src: aid, route: "tels", q: { ri: regk, i: "" } }];
+            if (proof)
+                rvy.writeReply(proof);
+            const added = this.reger.txnsb.escrowStateNotice({
+                typ,
+                pre: regk,
+                aid,
+                serder,
+                diger,
+                dater: new Dater({ qb64: encodeDateTimeToDater(stamp) }),
+                cigars,
+                tsgs,
+            });
+            if (added !== isNew)
+                throw new Error("Registry escrow membership changed before publication");
+            // Broker now owns copied pending proof; retain prior accepted BADA evidence in Baser.
+            disposeIncoming();
+            if (queryCues.length)
+                rvy.cues.extend(queryCues);
+            if (cues.length)
+                rvy.cues.extend(cues);
+            return {
+                kind: "unverified",
+                reason: "dependencyPending",
+                family: typ,
+                message: "Registry state dependency unavailable.",
+            };
+        };
+        if (!kever)
+            return escrow("registry-mae", true);
+        const watchers = new Set();
+        for (const [, habitat] of this.db.getHabItemIter()) {
+            for (const watcher of habitat.watchers ?? [])
+                watchers.add(watcher);
+        }
+        const trusted = aid === issuer || watchers.has(aid)
+            || (!!stored && (stored.c.includes(TraitDex.NoBackers) ? kever.wits : stored.b).includes(aid));
+        if (!trusted && stored)
+            return reject("Untrusted registry state attester.");
+        if (previous && (!this.db.sdts.get([previous.qb64]) || !this.db.rpys.get([previous.qb64]))) {
+            throw new Error("Corrupt prior registry reply evidence.");
+        }
+        const proof = rvy.decideReply({
+            serder,
+            saider: diger,
+            route,
+            aid,
+            cigars,
+            tsgs,
+            osaider: previous?.qb64 === diger.qb64 ? null : previous,
+            retainPrevious: true,
+            externalEscrow: true,
+        });
+        queryCues = proof.cues;
+        if (proof.kind !== "accept") {
+            if (proof.reason === "proofPending")
+                return escrow("registry-mae", false, proof);
+            rvy.writeReply(proof);
+            if (queryCues.length)
+                rvy.cues.extend(queryCues);
+            return reject("Unverified registry state attester.");
+        }
+        const accepted = this.reger.tels.getOn(regk, sn);
+        if (!accepted)
+            return escrow("registry-ooo", true, proof);
+        const raw = this.reger.tvts.get(dgKey(regk, accepted.qb64));
+        if (!raw || !stored || stored.d !== accepted.qb64)
+            throw new Error("Corrupt accepted registry TEL state.");
+        const event = new SerderKERI({ raw });
+        if (!event.verify() || event.said !== accepted.qb64 || event.pre !== regk || event.sn !== sn) {
+            throw new Error("Corrupt accepted registry TEL body.");
+        }
+        if (!trusted || accepted.qb64 !== record.d)
+            return reject("Registry state does not match accepted TEL.");
+        // Receiver-generated record time is descriptive; configuration and state fields must agree.
+        const fields = ["vn", "i", "s", "d", "ii", "et", "bt", "b", "c"];
+        if (fields.some((key) => JSON.stringify(record[key]) !== JSON.stringify(stored[key]))) {
+            return reject("Registry state metadata mismatch.");
+        }
+        const dater = new Dater({ qb64: encodeDateTimeToDater(stamp) });
+        const cues = [{ kin: "txnStateSaved", record }];
+        rvy.writeReply(proof);
+        this.reger.txnsb.updateReply(aid, serder, diger, dater);
+        if (previous?.qb64 !== diger.qb64)
+            rvy.removeReply(previous);
+        if (queryCues.length)
+            rvy.cues.extend(queryCues);
+        if (cues.length)
+            rvy.cues.extend(cues);
+        return acceptReplyDecision();
+    }
+    /** Admit a credential TSN against its own proof, registry dependency and current TEL/anchor commitments. */
+    processReplyCredentialTxnState({ serder, diger, route, aid, cigars = [], tsgs = [] }) {
+        const rvy = this.replyVerifier();
+        const record = credentialRecord(serder.ked?.a);
+        const stamp = serder.ked?.dt;
+        if (!record || !qualifiedPrefix(aid) || typeof stamp !== "string" || timestampMicros(stamp) === null
+            || route !== `/tsn/credential/${aid}` || serder.said !== diger.qb64 || !serder.verify())
+            return unverifiedReplyDecision("Invalid credential transaction-state notice.");
+        const vci = record.i, regk = record.ri, sn = Number.parseInt(record.s, 16);
+        const previous = this.reger.txnsb.current([vci, aid]);
+        const disposeIncoming = () => {
+            if (previous?.qb64 !== diger.qb64)
+                rvy.removeReply(diger);
+        };
+        const reject = (reason) => {
+            disposeIncoming();
+            return unverifiedReplyDecision(reason);
+        };
+        const saved = this.reger.states.get(regk);
+        const stored = saved ? registryRecord(saved.asDict()) : null;
+        if (saved && !stored)
+            throw new Error("Corrupt stored registry state.");
+        const issuer = stored?.ii ?? aid;
+        let queryCues = [];
+        const escrow = (typ, query, proof) => {
+            const isNew = !this.reger.txnsb.hasStateNotice(typ, vci, aid, diger);
+            const cues = !isNew || !query
+                ? []
+                : typ === "credential-mae"
+                    ? [{ kin: "query", pre: issuer, src: aid, route: "logs", q: {} }]
+                    : [{
+                            kin: "query",
+                            pre: issuer,
+                            src: aid,
+                            route: "tels",
+                            q: { ri: regk, i: typ === "credential-mre" ? "" : vci },
+                        }];
+            if (proof)
+                rvy.writeReply(proof);
+            const added = this.reger.txnsb.escrowStateNotice({
+                typ,
+                pre: vci,
+                aid,
+                serder,
+                diger,
+                dater: new Dater({ qb64: encodeDateTimeToDater(stamp) }),
+                cigars,
+                tsgs,
+            });
+            if (added !== isNew)
+                throw new Error("Credential escrow membership changed before publication");
+            disposeIncoming();
+            if (queryCues.length)
+                rvy.cues.extend(queryCues);
+            if (cues.length)
+                rvy.cues.extend(cues);
+            return {
+                kind: "unverified",
+                reason: "dependencyPending",
+                family: typ,
+                message: "Credential state dependency unavailable.",
+            };
+        };
+        const regsn = record.ra.s === undefined ? 0 : Number.parseInt(record.ra.s, 16);
+        if (!stored || Number.parseInt(stored.s, 16) < regsn)
+            return escrow("credential-mre", true);
+        const tever = new Tever({ db: this.db, reger: this.reger, rsr: stored });
+        if (!tever.serder.verify() || tever.serder.said !== stored.d
+            || this.reger.tels.getOn(regk, tever.sn)?.qb64 !== stored.d)
+            throw new Error("Corrupt accepted registry TEL state.");
+        const kever = this.db.getKever(issuer, { refresh: true });
+        if (!kever)
+            return escrow("credential-mae", true);
+        const watchers = new Set();
+        for (const [, habitat] of this.db.getHabItemIter()) {
+            for (const watcher of habitat.watchers ?? [])
+                watchers.add(watcher);
+        }
+        if (aid !== issuer && !watchers.has(aid)
+            && !(stored.c.includes(TraitDex.NoBackers) ? kever.wits : stored.b).includes(aid)) {
+            return reject("Untrusted credential state attester.");
+        }
+        if (previous && (!this.db.sdts.get([previous.qb64]) || !this.db.rpys.get([previous.qb64]))) {
+            throw new Error("Corrupt prior credential reply evidence.");
+        }
+        const proof = rvy.decideReply({
+            serder,
+            saider: diger,
+            route,
+            aid,
+            cigars,
+            tsgs,
+            osaider: previous?.qb64 === diger.qb64 ? null : previous,
+            retainPrevious: true,
+            externalEscrow: true,
         });
+        queryCues = proof.cues;
+        if (proof.kind !== "accept") {
+            if (proof.reason === "proofPending")
+                return escrow("credential-mae", false, proof);
+            rvy.writeReply(proof);
+            if (queryCues.length)
+                rvy.cues.extend(queryCues);
+            return reject("Unverified credential state attester.");
+        }
+        const accepted = this.reger.tels.getOn(vci, sn);
+        if (!accepted)
+            return escrow("credential-ooo", true, proof);
+        const current = tever.vcState(vci);
+        const raw = this.reger.tvts.get(dgKey(vci, accepted.qb64));
+        if (!raw || !current)
+            throw new Error("Corrupt accepted credential TEL state.");
+        const event = new SerderKERI({ raw });
+        if (!event.verify() || event.pre !== vci || event.sn !== sn || event.said !== accepted.qb64) {
+            throw new Error("Corrupt accepted credential TEL body.");
+        }
+        if (Tevery.registryKey(event) !== regk)
+            return reject("Credential belongs to a different registry.");
+        const fields = ["vn", "i", "s", "d", "ri", "dt", "et"];
+        if (accepted.qb64 !== record.d || fields.some((key) => JSON.stringify(record[key]) !== JSON.stringify(current[key]))
+            || ["s", "d"].some((key) => record.a[key] !== current.a[key])
+            || ["i", "s", "d"].some((key) => record.ra[key] !== current.ra[key]))
+            return reject("Credential state does not match current accepted TEL and anchors.");
+        const cues = [{ kin: "txnStateSaved", record }];
+        rvy.writeReply(proof);
+        this.reger.txnsb.updateReply(aid, serder, diger, new Dater({ qb64: encodeDateTimeToDater(stamp) }));
+        if (previous?.qb64 !== diger.qb64)
+            rvy.removeReply(previous);
+        if (queryCues.length)
+            rvy.cues.extend(queryCues);
+        if (cues.length)
+            rvy.cues.extend(cues);
+        return acceptReplyDecision();
     }
+    /**
+     * Retry TEL dependencies, then each complete captured TSN family horizon.
+     * Pages bound materialization; new rows beyond the captured horizon wait for a
+     * later sweep. The synchronous turn can outlast an asynchronous caller deadline.
+     */
     processEscrows() {
         this.processEscrowAnchorless();
         this.processEscrowOutOfOrders();
+        this.retryDependencyEscrow("partialWitness", this.reger.twes);
+        if (!this.rvy)
+            return;
+        for (const typ of ["registry-mae", "registry-ooo", "credential-mre", "credential-mae", "credential-ooo"]) {
+            let done = false;
+            while (!done) {
+                const page = this.reger.txnsb.retryStateNotices(typ, (args) => {
+                    const decision = typ.startsWith("registry-")
+                        ? this.processReplyRegistryTxnState(args)
+                        : this.processReplyCredentialTxnState(args);
+                    if (decision.kind === "accept")
+                        return acceptEscrow();
+                    if (decision.reason === "dependencyPending") {
+                        // The new family owns the retained evidence; removing this index is not rejection.
+                        return decision.family === typ ? keepEscrow("recoverableError") : acceptEscrow();
+                    }
+                    return dropEscrow("processingError", decision.message);
+                });
+                done = page.done;
+            }
+        }
     }
+    /** Retry out-of-order TEL events; report terminal removal after its index write succeeds. */
     processEscrowOutOfOrders() {
         const entries = [...this.reger.oots.getAllItemIter()];
         for (const [keys, sn, dig] of entries) {
@@ -902,7 +1246,15 @@ export class Tevery {
             const raw = this.reger.tvts.get(key);
             const couple = this.reger.ancs.get(key);
             if (raw === null || couple === null) {
-                this.reger.oots.remOn(pre, sn, dig);
+                if (this.reger.oots.remOn(pre, sn, dig)) {
+                    consoleLogger.warn("Tevery ejected out-of-order TEL event from escrow", {
+                        family: "outOfOrder",
+                        pre,
+                        sn,
+                        said: dig,
+                        reason: raw === null ? "missingEvent" : "missingSourceSeal",
+                    });
+                }
                 continue;
             }
             const [seqner, saider] = couple;
@@ -915,11 +1267,25 @@ export class Tevery {
             if (decision.kind === "escrow" && decision.escrow === "outOfOrder") {
                 continue;
             }
-            this.reger.oots.remOn(pre, sn, dig);
+            const removed = this.reger.oots.remOn(pre, sn, dig);
+            if (removed && decision.kind === "reject") {
+                consoleLogger.warn("Tevery ejected out-of-order TEL event from escrow", {
+                    family: "outOfOrder",
+                    pre,
+                    sn,
+                    said: dig,
+                    reason: decision.reason,
+                });
+            }
         }
     }
+    /** Retry anchorless TEL events; missing source seals remain pending rather than being ejected. */
     processEscrowAnchorless() {
-        const entries = [...this.reger.taes.getAllItemIter()];
+        this.retryDependencyEscrow("anchorless", this.reger.taes);
+    }
+    /** Retry each retained body with its accumulated proofs; commit before removing the old family index. */
+    retryDependencyEscrow(family, table) {
+        const entries = [...table.getAllItemIter()];
         for (const [keys, sn, dig] of entries) {
             const pre = keys[0] ?? "";
             const key = dgKey(pre, dig);
@@ -927,7 +1293,15 @@ export class Tevery {
             const couple = this.reger.ancs.get(key);
             if (raw === null || couple === null) {
                 if (raw === null) {
-                    this.reger.taes.remOn(pre, sn, dig);
+                    if (table.remOn(pre, sn, dig)) {
+                        consoleLogger.warn("Tevery ejected TEL dependency escrow", {
+                            family,
+                            pre,
+                            sn,
+                            said: dig,
+                            reason: "missingEvent",
+                        });
+                    }
                 }
                 continue;
             }
@@ -938,10 +1312,19 @@ export class Tevery {
                 saider,
                 wigers: this.reger.tibs.get(key),
             });
-            if (decision.kind === "escrow" && decision.escrow === "anchorless") {
+            if (decision.kind === "escrow" && decision.escrow === family) {
                 continue;
             }
-            this.reger.taes.remOn(pre, sn, dig);
+            const removed = table.remOn(pre, sn, dig);
+            if (removed && decision.kind === "reject") {
+                consoleLogger.warn("Tevery ejected TEL dependency escrow", {
+                    family,
+                    pre,
+                    sn,
+                    said: dig,
+                    reason: decision.reason,
+                });
+            }
         }
     }
     static registryKey(serder) {
@@ -960,7 +1343,7 @@ export class Tevery {
             case Ilks.bis:
             case Ilks.brv: {
                 const ra = sealRecord(okKed(serder).ra);
-                const regk = typeof ra?.i === "string" ? ra.i : null;
+                const regk = ra && "i" in ra && typeof ra.i === "string" ? ra.i : null;
                 if (!regk) {
                     throw new ValidationError("Backer TEL event missing ra.i.");
                 }
@@ -968,15 +1351,14 @@ export class Tevery {
             }
         }
     }
-    cacheTever(regk, tever) {
-        this.tevers.set(regk, tever);
-        this.reger.states.pin(regk, tever.state());
-    }
     /** Preserve the original source seal while waiting for earlier TEL events. */
-    escrowOOEvent(serder, seqner, saider) {
+    escrowOOEvent(serder, seqner, saider, bigers = []) {
         const pre = okPre(serder);
         const said = okSaid(serder);
         const key = dgKey(pre, said);
+        // The historical roster may be unavailable. Retain candidates, then verify
+        // their union in valAnchorBigs before any threshold or acceptance decision.
+        this.reger.tibs.put(key, bigers);
         this.reger.tvts.put(key, serder.raw);
         if (seqner && saider) {
             this.reger.ancs.put(key, [seqner, new Diger({ qb64: saider.qb64 })]);