keri-ts 2.2.3 → 2.2.5

package/esm/keri/npm/src/app/runtime/agent-runtime.js

@@ -8,7 +8,6 @@ import { DatabaseNotOpenError } from "../../core/errors.js";
 import { Kevery } from "../../core/kel/eventing.js";
 import { Kramer } from "../../core/mailbox/kraming.js";
 import { CREDENTIAL_MAILBOX_TOPIC, DELEGATE_MAILBOX_TOPIC, RECEIPT_MAILBOX_TOPIC, REPLAY_MAILBOX_TOPIC, REPLY_MAILBOX_TOPIC, } from "../../core/mailbox/mailbox-topics.js";
-import { Roles } from "../../core/roles.js";
 import { Revery } from "../../core/routing.js";
 import { openOwner } from "../../db/core/store-owner.js";
 import { Mailboxer } from "../../db/mailbox/mailboxing.js";
@@ -20,12 +19,12 @@ import { Authenticator } from "../bootstrap/authenticating.js";
 import { loadOobiHandlers, Oobiery, oobiTerminalState } from "../bootstrap/oobiery.js";
 import { publishPendingTel } from "../credentials/tel-publishing.js";
 import { Poster } from "../delivery/forwarding.js";
+import { relayEndpoint, relayOnlyHttpClient } from "../delivery/relaying.js";
 import { ReplyStreams } from "../delivery/reply-streams.js";
 import { Respondant } from "../delivery/respondant.js";
 import { Exchanger, RouteRefuser } from "../exchanges/exchanging.js";
 import { loadChallengeHandlers } from "../identity/challenging.js";
 import { Anchorer, loadDelegationHandlers } from "../identity/delegating.js";
-import { SignerNotHeldError } from "../identity/keeping.js";
 import { loadIpexHandlers } from "../ipex/ipexing.js";
 import { ForwardHandler } from "../mailbox/forward-handler.js";
 import { KEL_PUBLISHER_PACING, KelPublisher, kelPublisherDo } from "../mailbox/kel-publisher.js";
@@ -44,10 +43,9 @@ import { QueryReplies } from "../queries/query-replies.js";
 import { WitnessInquisitor } from "../queries/witness-inquisitor.js";
 import { Receiptor } from "../witness/receipting.js";
 import { cueDo } from "./cue-runtime.js";
-import { doEvery, PROTOCOL_PACING } from "./doing.js";
+import { doEveryOnWrite, PROTOCOL_PACING } from "./doing.js";
 import { IpexAuxiliaries } from "./ipex-auxiliaries.js";
 import { composeOwners, operationOwnersDo, OWNER_PACING, } from "./operation-owners.js";
-import { SignerConditions } from "./signer-conditions.js";
 import { signalerChangeSink } from "./workflow-contract.js";
 import { observeUntil } from "./workflow-contract.js";
 /**
@@ -67,12 +65,18 @@ import { observeUntil } from "./workflow-contract.js";
  * @throws Dependency mismatch/acquisition errors propagate after owned resource cleanup.
  */
 export function* createAgentRuntime(hby, http, clock, options = {}) {
+    // An edge reaches only its relay: every component below, and `runtime.http`, gets the guarded client.
+    if (options.relay)
+        http = relayOnlyHttpClient(http, hby, options.relay);
     const injectedSignaler = options.signaler ?? options.notifier?.signaler;
     if ((options.notifier && options.notifier.signator !== hby.signator)
         || (options.noter && options.notifier && options.noter !== options.notifier.noter)
         || (options.signaler && options.notifier && options.signaler !== options.notifier.signaler)) {
         throw new RangeError("AgentRuntime notification services require its exact Signator, Noter and Signaler");
     }
+    if (options.relaying && !options.mailboxer && !options.enableMailboxStore) {
+        throw new RangeError("Relaying requires a mailbox store for /fwd intake");
+    }
     const mailboxer = options.mailboxer
         ?? (options.enableMailboxStore ? (yield* openRuntimeMailboxer(hby)) : null);
     const ownsMailboxer = options.mailboxer === undefined && mailboxer !== null;
@@ -146,11 +150,11 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         })
         : null;
     const replies = new QueryReplies(cues);
-    const protocol = new ProtocolProcessor(kvy, revery, exc, vdr?.tvy ?? null, vdr?.vry ?? null, registry, protocolCues, cues, replies, ipex ?? undefined);
+    const protocol = new ProtocolProcessor(kvy, revery, exc, vdr?.tvy ?? null, vdr?.vry ?? null, registry, protocolCues, cues, replies, ipex ?? undefined, options.relaying === true);
     const reactor = new Reactor(protocol);
     loadChallengeHandlers(hby.db, exc);
     loadDelegationHandlers(hby, exc, notifier);
-    loadOobiHandlers(hby, exc, notifier);
+    loadOobiHandlers(hby, exc, notifier, options.relaying === true);
     const mux = loadMultisigHandlers(hby, exc, { notifier, registry: protocol.registry, messageKevery: protocol.kvy });
     loadIpexHandlers(hby, exc, {
         notifier,
@@ -158,8 +162,9 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         grantWalk: options.grantWalk,
     });
     // Construction adopts stored copies an earlier handler-less Exchanger left unescrowed.
+    const changes = options.operationStores?.changes ?? (signaler ? signalerChangeSink(signaler) : undefined);
     const registryRoot = options.registryRoots !== "refuse" && acdc
-        ? new RegistryRoot(hby, acdc, notifier, options.operationStores?.changes ?? (signaler ? signalerChangeSink(signaler) : undefined))
+        ? new RegistryRoot(hby, acdc, notifier, changes)
         : null;
     if (registryRoot)
         exc.addHandler(registryRoot);
@@ -175,7 +180,7 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         }
     });
     const postman = yield* resource(function* (provide) {
-        const postman = new Poster(hby, mailboxer, protocol, http, clock);
+        const postman = new Poster(hby, mailboxer, protocol, http, clock, options.relay ?? null);
         try {
             yield* provide(postman);
         }
@@ -185,7 +190,7 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
     });
     const respondant = new Respondant(hby, postman);
     if (mailboxer) {
-        exc.addHandler(new ForwardHandler(mailboxDirector));
+        exc.addHandler(new ForwardHandler(mailboxDirector, reactor, options.relaying ? postman : null));
     }
     for (const route of exc.routes.keys()) {
         if (route === ForwardHandler.resource) {
@@ -206,20 +211,7 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         changes: signaler ? signalerChangeSink(signaler) : undefined,
         retry: options.kelPublishRetry,
     });
-    const signerConditions = new SignerConditions();
-    const mailboxPoller = new MailboxPoller(hby, mailboxDirector, http, clock, {
-        signerConditions,
-        onPolled: (pre, mailbox) => kelPublisher.prompt(pre, mailbox),
-        onUnauthorized: (pre, mailbox) => kelPublisher.repair(pre, mailbox),
-        timeouts: options.mailboxPolling,
-    });
-    // A mailbox role accepted from a reply (a group member's approved add, an OOBI) is acted on at the next tock.
-    revery.onEndRole = (cid, role) => {
-        if (role !== Roles.mailbox)
-            return;
-        kelPublisher.prompt(cid);
-        mailboxPoller.prompt(cid);
-    };
+    const mailboxPoller = new MailboxPoller(hby, mailboxDirector, http, clock, options.relay ?? null, { polls: kelPublisher.polls, timeouts: options.mailboxPolling });
     for (const topic of [
         DELEGATE_MAILBOX_TOPIC,
         CREDENTIAL_MAILBOX_TOPIC,
@@ -230,7 +222,7 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         mailboxDirector.registerTopic(topic);
     }
     const querying = yield* resource(function* (provide) {
-        const inquisitor = new WitnessInquisitor(hby, protocol, http, clock);
+        const inquisitor = new WitnessInquisitor(hby, protocol, http, clock, options.relay ?? null);
         try {
             yield* provide(inquisitor);
         }
@@ -239,17 +231,9 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         }
     });
     const delegating = new Anchorer(hby, postman, querying, protocol, http, clock);
-    // Group receipting reaches TCP-only witnesses as `WitnessReceiptor` does, as KERIpy's Counselor does.
-    const groupReceiptor = new Receiptor(hby, protocol, http, clock);
-    const counselor = new Counselor(hby, {
-        receipt: (pre, options) => groupReceiptor.receipt(pre, { ...options, allowTcp: true }),
-        get: (pre, options) => groupReceiptor.get(pre, options),
-    }, clock, signaler ? signalerChangeSink(signaler) : undefined, { anchorer: delegating, querying }, {
-        rotated: (cue) => {
-            kelPublisher.rotated.push(cue);
-            owned?.rootReplicator?.prompt(cue.pre);
-        },
-    }, options.counselorReceiptRetry, groupEventForwarding(hby, postman));
+    // Only a runtime with operations owners and a registry root has a root replicator to drain this deck.
+    const groupChanges = registryRoot && ipex ? new Deck() : undefined;
+    const counselor = new Counselor(hby, new Receiptor(hby, protocol, http, clock), clock, signaler ? signalerChangeSink(signaler) : undefined, { anchorer: delegating, querying }, kelPublisher.rotated, groupChanges, options.counselorReceiptRetry, groupEventForwarding(hby, postman));
     const owned = acdc && ipex
         ? composeOwners({
             hby,
@@ -264,21 +248,26 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
             registryRoot,
             mux,
             counselor,
+            groupChanges,
             retry: options.operationRetry,
             queryResendMs: options.issuanceQueryResendMs,
             changes: signaler ? signalerChangeSink(signaler) : undefined,
         }, options.operationStores)
         : null;
-    const oobiery = new Oobiery(hby, protocol, revery, http, cues);
+    const oobiery = new Oobiery(hby, protocol, revery, http, cues, options.relay ? { relay: options.relay, postman, clock } : null);
     oobiery.registerReplyRoutes(revery.rtr);
+    if (options.relay && !relayEndpoint(hby, options.relay))
+        oobiery.resolve(options.relay.oobi);
     const authenticator = new Authenticator(hby, http);
     return {
         hby,
         mailboxer,
+        relaying: options.relaying === true,
         noter,
         notifier,
         signaler,
         cues,
+        changes: changes ?? null,
         reactor,
         protocol,
         replies,
@@ -296,7 +285,6 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         delegating,
         counselor,
         kelPublisher,
-        signerConditions,
         ownerPacing: options.ownerPacing ?? OWNER_PACING,
         publisherPacing: options.publisherPacing ?? KEL_PUBLISHER_PACING,
         protocolPacing: options.protocolPacing ?? PROTOCOL_PACING,
@@ -618,6 +606,11 @@ export { runtimeTurn } from "./runtime-turn.js";
  * delegation and ordinary query sending. The finalizer halts children in reverse
  * order; store ownership remains with the composition scope.
  *
+ * Each loop is a plain spawned fixed-tock doer. A loop that signs for a local habitat reads `Hab.canSign()` on its
+ * tock and skips a habitat that cannot sign yet (a store opened without its signer); a later `Manager.hold` lets
+ * that habitat act on the next tock. A `SignerNotHeldError` that still escapes a loop is a fault: the loop ends
+ * and the failure ends this operation.
+ *
  * @param runtime Borrowed composed runtime; caller owns its worker and store lifetime.
  * @param options Optional default query/cue signer, remote pollMailbox switch
  * (default true) and command-owned queryCues Deck. Wire queryCues before starting
@@ -628,24 +621,25 @@ export function* runAgentRuntime(runtime, options = {}) {
     runtime.querying.configure({ hab: options.hab });
     const pacing = runtime.protocolPacing;
     const telReceiptor = runtime.vdr ? new Receiptor(runtime.hby, runtime.protocol, runtime.http, runtime.clock) : null;
-    // A loop that needs a signer the host released waits for it; it never ends the runtime (see `surviving`).
-    const alive = (loop, make) => spawn(() => surviving(runtime, loop, make));
-    const stopHoldWatch = runtime.hby.mgr.onHold(() => runtime.signerConditions.held());
     const tasks = [
-        yield* alive("querying", () => runtime.querying.deliverDo()),
-        yield* alive("postman", () => runtime.postman.deliverDo()),
+        yield* spawn(() => runtime.querying.deliverDo(pacing.tockMs)),
+        yield* spawn(() => runtime.postman.deliverDo(pacing.tockMs)),
         ...(runtime.vdr && telReceiptor
             ? [
-                yield* alive("tel-publication", () => doEvery(runtime.clock, pacing.tockMs, () => publishPendingTel(runtime.hby, runtime.vdr.publication, telReceiptor, runtime.http, runtime.clock))),
+                yield* spawn(() => doEveryOnWrite(runtime.clock, pacing, {
+                    get writeActivity() {
+                        return runtime.hby.db.writeActivity + runtime.vdr.publication.reger.writeActivity;
+                    },
+                }, () => publishPendingTel(runtime.hby, runtime.vdr.publication, telReceiptor, runtime.http, runtime.clock))),
             ]
             : []),
-        yield* alive("cues", () => cueDo(runtime, options, pacing)),
-        yield* alive("escrows", () => runtime.protocol.escrowDo(runtime.clock)),
-        yield* alive("oobi", () => runtime.oobiery.oobiDo(runtime.clock, pacing)),
-        yield* alive("authentication", () => runtime.authenticator.authDo(runtime.clock, pacing)),
+        yield* spawn(() => cueDo(runtime, options, pacing)),
+        yield* spawn(() => runtime.protocol.escrowDo(runtime.clock, pacing)),
+        yield* spawn(() => runtime.oobiery.oobiDo(runtime.clock, pacing)),
+        yield* spawn(() => runtime.authenticator.authDo(runtime.clock, pacing)),
         ...(runtime.signaler
             ? [
-                yield* alive("signals", () => runtime.signaler.signalDo(runtime.clock, pacing)),
+                yield* spawn(() => runtime.signaler.signalDo(runtime.clock, pacing)),
             ]
             : []),
         ...(options.pollMailbox ?? true
@@ -655,12 +649,12 @@ export function* runAgentRuntime(runtime, options = {}) {
                 }),
             ]
             : []),
-        yield* alive("delegation", () => doEvery(runtime.clock, pacing.tockMs, () => runtime.delegating.processAllOnce())),
-        yield* alive("counselor", () => doEvery(runtime.clock, pacing.tockMs, () => runtime.counselor.processOnce())),
-        yield* alive("kel-publisher", () => kelPublisherDo(runtime.kelPublisher, runtime.clock, runtime.publisherPacing)),
+        yield* spawn(() => doEveryOnWrite(runtime.clock, pacing, runtime.hby.db, () => runtime.delegating.processAllOnce())),
+        yield* spawn(() => doEveryOnWrite(runtime.clock, pacing, runtime.hby.db, () => runtime.counselor.processOnce(), () => runtime.counselor.holdsForwards)),
+        yield* spawn(() => kelPublisherDo(runtime.kelPublisher, runtime.clock, runtime.publisherPacing)),
         ...(runtime.operations && runtime.ipex
             ? [
-                yield* alive("operation-owners", () => operationOwnersDo({
+                yield* spawn(() => operationOwnersDo({
                     operations: runtime.operations,
                     rootReplicator: runtime.rootReplicator,
                     ipex: runtime.ipex,
@@ -673,29 +667,8 @@ export function* runAgentRuntime(runtime, options = {}) {
         return yield* suspend();
     }
     finally {
-        stopHoldWatch();
         for (const task of tasks.reverse()) {
             yield* task.halt();
         }
     }
 }
-/** How long a loop waits for a held signer before trying again, in milliseconds. */
-const SIGNER_RETRY_MS = 1_000;
-/**
- * Run a background loop so that a signer the host released does not end the runtime: the loop's
- * `SignerNotHeldError` is recorded in `runtime.signerConditions`, the loop waits for a signer to be held (or a
- * second) and starts again. Every other failure still ends it.
- */
-function* surviving(runtime, loop, make) {
-    while (true) {
-        try {
-            return yield* make();
-        }
-        catch (error) {
-            if (!(error instanceof SignerNotHeldError))
-                throw error;
-            runtime.signerConditions.report(`runtime:${loop}`, error.pub, runtime.clock.now());
-            yield* runtime.signerConditions.waitForHold(runtime.clock, SIGNER_RETRY_MS);
-        }
-    }
-}

package/esm/keri/npm/src/app/runtime/cue-runtime.js

@@ -1,3 +1,4 @@
+import { Roles } from "../../core/roles.js";
 import { doEvery, PROTOCOL_PACING } from "./doing.js";
 /**
  * Use an explicitly selected or sole local habitat; never guess among hosted identities.
@@ -13,11 +14,28 @@ function resolveCueHab(runtime, hab) {
     const first = habitats.next();
     return first.done || !habitats.next().done ? null : first.value;
 }
+/**
+ * Hand an accepted mailbox end role to the KEL publisher and the mailbox poller, so both look at its controller on
+ * their next tock rather than at their next sweep. Other roles concern neither.
+ *
+ * @param runtime Borrowed composed runtime containing the publisher and poller.
+ * @param cue The committed end-role fact from `Revery`.
+ */
+export function promptForEndRole(runtime, cue) {
+    if (cue.role !== Roles.mailbox)
+        return;
+    runtime.kelPublisher.prompt(cue.cid);
+    runtime.mailboxPoller.prompt(cue.cid);
+}
 /**
  * Route one initial cue batch to its concrete owners before removing source records.
  *
- * Transfer query instructions to the sender, stream cues to mailbox correlation
- * and produced responder messages to Poster. No network delivery runs inline.
+ * Transfer query instructions to the sender (a relaying runtime skips one identical to a request already queued),
+ * stream cues to mailbox correlation,
+ * accepted mailbox end roles to the KEL publisher and poller, and produced responder
+ * messages to Poster. No network delivery runs inline.
+ * A responder cue whose signing habitat cannot sign yet moves to the tail and is
+ * tried again on a later pass; the cues behind it still go now.
  * Saved key-state facts transfer once to the command's optional query Deck;
  * its noticer never competes with this worker over the runtime source Deck.
  * Admission and source removal run synchronously within this finite batch.
@@ -33,14 +51,36 @@ export function* processCuesOnce(runtime, { hab, queryCues } = {}) {
         const cue = runtime.cues.peekHead();
         if (!cue)
             break;
+        if (cue.kin === "kramRefused") {
+            // Pulled first: a faulty sink must not wedge the head of the Deck.
+            runtime.cues.pull();
+            runtime.changes?.push({ kind: "kramRefused", id: cue.said, refusal: cue });
+            continue;
+        }
+        if (cue.kin === "endRoleSaved") {
+            runtime.cues.pull();
+            promptForEndRole(runtime, cue);
+            continue;
+        }
         if (cue.kin === "query") {
-            runtime.querying.enqueueCue(cue, interpreter);
+            // A relaying host serves many edges asking about the same subjects; one queued request per query suffices.
+            if (runtime.relaying)
+                runtime.querying.enqueueCueOnce(cue, interpreter);
+            else
+                runtime.querying.enqueueCue(cue, interpreter);
         }
         else if (cue.kin === "stream") {
             runtime.mailboxDirector.retainQueryCue(cue);
         }
-        else if (interpreter && runtime.respondant.enqueueCue(interpreter, runtime.cues, hab)) {
-            continue;
+        else if (interpreter) {
+            const outcome = runtime.respondant.enqueueCue(interpreter, runtime.cues, hab);
+            if (outcome === "taken")
+                continue;
+            if (outcome === "unsignable") {
+                // Kept for a later pass, behind the cues that can go now; `count` bounds this pass.
+                runtime.cues.append(runtime.cues.pull());
+                continue;
+            }
         }
         runtime.cues.pull();
         if (cue.kin === "keyStateSaved")

package/esm/keri/npm/src/app/runtime/doing.js

@@ -3,10 +3,13 @@ import { waitOnClock } from "./workflow-contract.js";
 export const PROTOCOL_TOCK_MS = 31.25;
 /** Tocks between full sweeps of a loop that has one: 1920 tocks of 31.25 ms is a minute. */
 export const PROTOCOL_SWEEP_TOCKS = 1920;
+/** Tocks between passes of a write-driven loop when the store did not change: 32 tocks of 31.25 ms is one second. */
+export const PROTOCOL_IDLE_TOCKS = 32;
 /** The production pacing of the protocol-facing background loops. */
 export const PROTOCOL_PACING = Object.freeze({
     tockMs: PROTOCOL_TOCK_MS,
     sweepTocks: PROTOCOL_SWEEP_TOCKS,
+    idleTocks: PROTOCOL_IDLE_TOCKS,
 });
 /** Run `pass` forever: pass 0, wait `tockMs` on `clock`, pass 1, and so on. A thrown error ends the doer. */
 export function* doEvery(clock, tockMs, pass) {
@@ -15,3 +18,25 @@ export function* doEvery(clock, tockMs, pass) {
         yield* waitOnClock(clock, tockMs);
     }
 }
+/**
+ * A fixed-tock doer for a loop whose work lives in store rows: pass 0, then a pass only on a tock after the
+ * store's write counter moved (a pass's own writes included, so it repeats until the store is quiet),
+ * after `busy()` says work is held in memory, or every `idleTocks`-th tock for what only time releases
+ * (timeouts, retry delays). A tock with nothing new costs a counter read, which touches no store, and no table scan. Rows written by
+ * another loop are seen on the next tock; time-driven work waits at most `idleTocks` tocks.
+ */
+export function* doEveryOnWrite(clock, pacing, db, pass, busy = () => false) {
+    const idle = pacing.idleTocks ?? PROTOCOL_IDLE_TOCKS;
+    let seen = -1;
+    for (let tock = 0;; tock++) {
+        if (tock % idle === 0 || db.writeActivity !== seen || busy()) {
+            try {
+                yield* pass(tock);
+            }
+            finally {
+                seen = db.writeActivity;
+            }
+        }
+        yield* waitOnClock(clock, pacing.tockMs);
+    }
+}

package/esm/keri/npm/src/app/runtime/operation-owners.js

@@ -14,28 +14,6 @@ export const OWNER_PACING = Object.freeze({
     tockMs: OWNER_TOCK_MS,
     sweepTocks: OWNER_SWEEP_TOCKS,
 });
-/**
- * Failures of the owner loop itself. A failure of one operation (a delivery that throws, an unreadable stored
- * Grant) ends that operation as `failed` and is never recorded here; this records only what escaped an owner
- * pass, which the loop survives so that the other owners keep running. `faults` counts them and `last` keeps
- * the latest. Nothing clears it: a host reads it and decides.
- */
-export class OwnerHealth {
-    constructor() {
-        Object.defineProperty(this, "faults", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: 0
-        });
-        Object.defineProperty(this, "last", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: null
-        });
-    }
-}
 /** Construct the owners over their in-memory tables; the derivation store defaults to the registry database. */
 export function composeOwners(parts, stores = {}) {
     const { hby, acdc, exc, protocol, reactor, postman, receiptor, ipex, clock, registryRoot, mux, counselor } = parts;
@@ -82,7 +60,6 @@ export function composeOwners(parts, stores = {}) {
             retry: parts.retry,
             changes,
         }),
-        health: new OwnerHealth(),
         unblinding: new UnblindingOperations({
             hby,
             exc,
@@ -95,7 +72,9 @@ export function composeOwners(parts, stores = {}) {
             changes,
         }),
     };
-    const rootReplicator = registryRoot ? new RootReplicator({ root: registryRoot, postman, clock, changes }) : null;
+    const rootReplicator = registryRoot
+        ? new RootReplicator({ root: registryRoot, postman, clock, changes, changed: parts.groupChanges })
+        : null;
     return { operations, rootReplicator };
 }
 /**
@@ -106,47 +85,38 @@ export function composeOwners(parts, stores = {}) {
  * Idle cost, per tock: four constant-time table checks, one in-memory walk of the Unblind owners for an owed
  * reply, one drain of each DH owner's cue deck, and the replicator's emptiness checks. The replicator's
  * rotation check (the establishment SAID of each local group, one keyed read per local identifier) runs on
- * tock 0 and every `pacing.sweepTocks`. No owner reads a protocol store. Only the first pass, once, scans the
- * pending exchange escrow for resumable Grants.
+ * tock 0 and every `pacing.sweepTocks`. No owner reads a protocol store on an ordinary tock. The issuance owner
+ * scans the pending exchange escrow on its first pass and then every `ISSUANCE_SWEEP_MS`, for resumable Grants and
+ * for group Grants whose custodian's final proof a member follows without signing; nothing else walks it per tock.
  *
- * A failure that escapes an owner pass is recorded in `operations.health` and the loop keeps running, so
- * one owner's fault never stops the others. The owners run one after another, so a delivery that does not return holds the others up until it fails or
- * its Grant deadline passes; operations already bound each delivery by that deadline.
+ * Nothing is caught here. Every remote, network or validation outcome an owner meets is already a typed result
+ * below this loop: a failed delivery is retried by its operation, and an operation that cannot go on ends `failed`
+ * or `expired` alone. What escapes a pass is a real fault (a store that cannot be read or written, corrupt or
+ * missing durable state such as a `MissingDurableStateError`, a `SignerNotHeldError` past a `canSign`
+ * gate), and it ends the loop and with it `runAgentRuntime`. Halting the loop is not a fault: Effection halts a
+ * pass by returning from it, so no error is thrown. The owners run one after another, so a delivery that does not
+ * return holds the others up until it fails or its Grant deadline passes; operations already bound each delivery by
+ * that deadline.
  */
 export function* operationOwnersDo(owners, pacing = OWNER_PACING) {
-    const { operations, rootReplicator, ipex, clock } = owners, { health } = operations;
-    const guarded = function* (owner, pass) {
-        try {
-            yield* pass();
-        }
-        catch (error) {
-            health.faults++;
-            health.last = {
-                owner,
-                error: error instanceof Error ? error.message : String(error),
-                at: new Date(clock.now()).toISOString(),
-            };
-        }
-    };
+    const { operations, rootReplicator, ipex, clock } = owners;
     return yield* doEvery(clock, pacing.tockMs, function* (tock) {
         if (operations.issuance.active())
-            yield* guarded("issuance", () => operations.issuance.processOnce());
+            yield* operations.issuance.processOnce();
         if (operations.groupIpex.active())
-            yield* guarded("groupIpex", () => operations.groupIpex.processOnce());
+            yield* operations.groupIpex.processOnce();
         if (operations.presentation.active())
-            yield* guarded("presentation", () => operations.presentation.processOnce());
+            yield* operations.presentation.processOnce();
         if (operations.unblinding.active())
-            yield* guarded("unblinding", () => operations.unblinding.processOnce());
+            yield* operations.unblinding.processOnce();
         if (rootReplicator) {
-            yield* guarded("replicator", function* () {
-                for (const dh of ipex.dhkeOwners()) {
-                    while (dh.replicated.length)
-                        rootReplicator.replicate(dh.replicated.pull());
-                }
-                if (tock % pacing.sweepTocks === 0)
-                    rootReplicator.sweep();
-                yield* rootReplicator.processDue();
-            });
+            for (const dh of ipex.dhkeOwners()) {
+                while (dh.replicated.length)
+                    rootReplicator.replicate(dh.replicated.pull());
+            }
+            if (tock % pacing.sweepTocks === 0)
+                rootReplicator.sweep();
+            yield* rootReplicator.processDue();
         }
     });
 }

package/esm/keri/npm/src/app/runtime/workflow-contract.js

@@ -24,22 +24,25 @@ export class MemoryChangeSink {
         });
     }
     push(change) {
-        this.changes.push({ kind: change.kind, id: change.id });
+        this.changes.push(change.kind === "kramRefused" ? change : { kind: change.kind, id: change.id });
     }
 }
 /**
  * Back a sink with the host's transient `Signaler`. Publishing needs no polling:
  * `push` is a synchronous append that collapses repeats of one workflow into a
- * single signal (collapse key `kind:id`). Delivery is pull-based, though: the
+ * single signal (collapse key `kind:id`). A {@link KramRefusedChange} adds its refusal fields to the signal
+ * attributes, so a resent message collapses by SAID. Delivery is pull-based, though: the
  * Signaler has no subscriber hook, so the consumer must read `signaler.list()`.
  * A closed or failing Signaler drops the change instead of throwing: a hint must
  * never break the workflow that published it.
  */
 export function signalerChangeSink(signaler) {
     return {
-        push: ({ kind, id }) => {
+        push: (change) => {
+            const { kind, id } = change;
             try {
-                signaler.push({ id }, `/workflow/${kind}`, { ckey: `${kind}:${id}` });
+                const attrs = change.kind === "kramRefused" ? { id, ...change.refusal } : { id };
+                signaler.push(attrs, `/workflow/${kind}`, { ckey: `${kind}:${id}` });
             }
             catch {
                 // Dropped on purpose; consumers re-read status and tolerate a missed hint.

package/esm/keri/npm/src/app/transport/http-client.js

@@ -4,6 +4,25 @@ import { ValidationError } from "../../core/errors.js";
 import { abortable } from "../runtime/abortable.js";
 import { collectBytes } from "./byte-source.js";
 import { TransportError } from "./transport-error.js";
+/**
+ * Whether {@link FetchHttpClient.open} can request `url` at all: an absolute HTTP(S) URL without embedded
+ * credentials. Anything else is refused by construction, before any I/O, so a caller holding a URL from a remote
+ * party can refuse it at intake instead of queuing work that can never succeed.
+ *
+ * @param url Candidate request URL.
+ * @returns False for an unparseable URL, a non-HTTP(S) scheme, or a URL carrying a user name or password.
+ */
+export function isRequestableHttpUrl(url) {
+    let endpoint;
+    try {
+        endpoint = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return (endpoint.protocol === "http:" || endpoint.protocol === "https:") && !endpoint.username
+        && !endpoint.password;
+}
 /**
  * Native requests and signals that a pending `fetch` still needs. WebKit links an in-flight fetch to
  * its abort signal only weakly: once the `Request`, or an `AbortSignal.any` composite, is garbage
@@ -78,8 +97,7 @@ export class FetchHttpClient {
                 : new TransportError(`${message} for ${url}`, { cause });
             try {
                 signal.throwIfAborted();
-                const endpoint = new URL(url);
-                if (!["http:", "https:"].includes(endpoint.protocol) || endpoint.username || endpoint.password) {
+                if (!isRequestableHttpUrl(url)) {
                     throw new ValidationError("HTTP output requires an HTTP(S) URL without credentials");
                 }
                 // Construction errors are caller errors, before native network classification.

package/esm/keri/npm/src/app/transport/message-source.js

@@ -53,7 +53,8 @@ export function* processMessages(source, protocol, kvy, options = {}) {
                 signal.throwIfAborted();
                 if (result.done)
                     return;
-                yield* protocol.dispatch(result.value, options, kvy);
+                // Only the intake choices: nothing a caller adds to its options can mark live input as retained history.
+                yield* protocol.dispatch(result.value, { local: options.local, mailboxAid: options.mailboxAid, escrows: options.escrows }, kvy);
             }
         }
         finally {