keri-ts 2.2.4 → 2.2.6

package/esm/keri/npm/src/app/mailbox/forward-handler.js

@@ -1,23 +1,56 @@
-/** Authenticated /fwd intake: validate provider authority before storing reconstructed child bytes. */
-import { collectPayload, concatBytes, Counter, Diger, nestedPayload, parsePather, SerderACDC, SerderKERI, Vrsn_2_0, } from "cesr-ts";
-import { Roles } from "../../core/roles.js";
+/** Authenticated /fwd intake: deliver locally or re-forward for senders this host serves, else store for recipients. */
+import { collectPayload, concatBytes, Counter, Diger, nestedPayload, parseBytes, parsePather, ParserError, SerderACDC, SerderKERI, Vrsn_2_0, } from "cesr-ts";
+import { call } from "effection";
+import { readPrefixer } from "../../core/wire-fields.js";
+import { storableTopic } from "../../db/mailbox/mailboxing.js";
+import { isAcceptedGroupMember } from "../multisig/group-members.js";
 import { abortable } from "../runtime/abortable.js";
+import { authorizedStoringHost, keepsForPickup, ownTraffic } from "./agent-inbox.js";
+import { mailboxTopicKey } from "./mailboxing.js";
+import { transportMailboxTopic } from "./topic-routing.js";
 /**
- * Accepted `/fwd` route handler that stores embedded payloads in mailbox topics.
+ * Accepted `/fwd` route handler that stores embedded payloads in mailbox topics and, on a relaying host, delivers
+ * a served sender's payloads onward.
  *
  * This is the `keri-ts` mailbox-storage analogue to KERIpy's `ForwardHandler`.
  *
- * Authorization rule:
- * - the request-scoped mailbox AID passed with this message must currently be
- *   authorized for the addressed recipient
+ * Paths, in order; exactly one runs for one `/fwd`:
+ * - ingest: the recipient is a habitat of this Habery and either this host
+ *   keeps the recipient's mail for pickup (`keepsForPickup`: a local group that
+ *   authorized it as mailbox or agent), whoever the sender is and whether or
+ *   not the host relays, or the host relays and the `/fwd` sender is served.
+ *   The child goes through this runtime's own byte ingress as remote input
+ *   addressed to that habitat's endpoint, so
+ *   signature, KRAM and escrow rules apply as for any received message. This is
+ *   how an edge's group co-member hosted on the agent receives every group
+ *   message. When the host keeps mail for pickup and the child is not
+ *   `ownTraffic` (its originator is a local habitat, an agent principal of the
+ *   host, or a member of the group, i.e. the edge that would pick it up), it is
+ *   also stored once in the group's mailbox topic for its remote members: one
+ *   ingest, one stored copy. A third party's `/fwd` to the group is ingested and
+ *   stored; the edge's own is ingested only. This ingest is the only local
+ *   delivery of a pickup group's mail: the host's `MailboxPoller` never polls
+ *   its own endpoint for that group, so the stored copy is for remote members.
+ * - store: the request-scoped mailbox AID passed with this message must
+ *   currently be authorized for the addressed recipient (witness, mailbox or
+ *   agent). A recipient this host stores for is never also relayed.
+ * - relay (relaying only): the `/fwd` sender is served and the recipient is
+ *   remote. The host re-sends the child with its own Poster, as KERIA's agent
+ *   re-sends a Signify client's exn.
+ *
+ * A served sender authorized this host as its `mailbox` or `agent`, directly or
+ * through a group it is an accepted member of. Witness membership never makes a
+ * sender served.
  */
 export class ForwardHandler {
     /**
-     * Bind mailbox publication without acquiring a store.
+     * Bind mailbox publication, local ingress and optional relaying without acquiring a store.
      *
      * @param mailboxDirector Borrowed provider owner that publishes accepted forwarded payloads.
+     * @param reactor Borrowed ingress for a local recipient's child; null only outside a runtime.
+     * @param relay Borrowed Poster of a relaying host; null keeps the host from relaying or serving senders.
      */
-    constructor(mailboxDirector) {
+    constructor(mailboxDirector, reactor, relay) {
         /** Instance route identity used by exchange dispatch. */
         Object.defineProperty(this, "resource", {
             enumerable: true,
@@ -39,21 +72,40 @@ export class ForwardHandler {
             writable: true,
             value: void 0
         });
+        /**
+         * Borrowed byte ingress of this host's runtime, through which a local recipient receives the child; null (a
+         * standalone Exchanger without a runtime) never ingests and only stores.
+         */
+        Object.defineProperty(this, "reactor", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Borrowed Poster that re-sends a served sender's child to a remote recipient; null means this host never relays. */
+        Object.defineProperty(this, "relay", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         this.mailboxDirector = mailboxDirector;
+        this.reactor = reactor;
+        this.relay = relay;
     }
     /**
-     * Verify that the embedded exchange has the mailbox modifiers and one
-     * extractable forwarded payload.
+     * Verify that the exchange names a {@link ForwardAddress} and carries one forwarded message: a legacy embed that
+     * rebuilds into exactly one complete message ({@link legacyForwardedMessage}), or one SAID-bound v2 child. Any
+     * other shape is refused here, so the Exchanger rejects the `/fwd` and nothing is stored, relayed or ingested.
      *
      * @param args Signed forwarding exchange, attachment evidence and optional nested frames; children retain their own authentication requirements.
-     * @returns Whether required modifiers and one bound forwarded payload are structurally valid.
+     * @returns Whether the address and one bound forwarded message are structurally valid.
      */
     verify(args) {
-        const modifiers = args.serder.ked?.q;
-        if (typeof modifiers?.pre !== "string" || typeof modifiers?.topic !== "string")
+        if (!forwardAddress(args.serder))
             return false;
         if (args.serder.pvrsn.major < 2) {
-            return !args.nests?.length && extractForwardedMessage(args.serder, args.attachments) !== null;
+            return !args.nests?.length && legacyForwardedMessage(args.serder, args.attachments) !== null;
         }
         if (args.nests?.length !== 1)
             return false;
@@ -69,10 +121,9 @@ export class ForwardHandler {
         }
     }
     /**
-     * Store one forwarded payload when the receiving host is allowed to act as
-     * the recipient's async correspondence store.
+     * Take the one {@link ForwardPath} this `/fwd` qualifies for, or drop it.
      *
-     * Accepted host shapes:
+     * Accepted store host shapes:
      * - explicit mailbox provider authorized in `ends.`
      * - recipient witness host from the accepted KEL witness set
      * - recipient agent host authorized in `ends.`
@@ -80,31 +131,112 @@ export class ForwardHandler {
      * Controller endpoints stay excluded here because they are direct
      * correspondence destinations, not store-and-forward hosts.
      *
+     * A relayed child is admitted to the Poster with this host as source and the
+     * `/fwd` topic unchanged; the Poster's own `transportMailboxTopic` is
+     * idempotent on that already-bare topic. Admission is the end of this
+     * handler's duty: a failed onward attempt is the Poster's logged failed
+     * outcome, with no outbox and no acknowledgement back to the sender.
+     *
+     * An ingested child is dispatched inside this handler's operation, after the
+     * Exchanger has committed the `/fwd`; it is one more input to the shared
+     * protocol owners, which hold no lock or input queue. A child the recipient
+     * cannot process yet escrows as any received message does.
+     *
      * @param args Accepted exchange with borrowed attachments/children and receiving mailboxAid provenance.
-     * @returns An operation for v2 child serialization, or synchronous completion/no-op for legacy or unauthorized input.
+     * @returns An operation for v2 child serialization or local ingest, or synchronous completion/no-op otherwise.
      */
     handle(args) {
-        const modifiers = args.serder.ked?.q;
-        const recipient = typeof modifiers?.pre === "string" ? modifiers.pre : null;
-        const topic = typeof modifiers?.topic === "string" ? modifiers.topic : null;
-        const child = args.serder.pvrsn.major >= 2 ? args.nests?.[0] : undefined;
-        const forwarded = child ? null : extractForwardedMessage(args.serder, args.attachments);
+        const address = forwardAddress(args.serder);
         const mailboxAid = args.mailboxAid;
-        if (!recipient || !topic || (!child && !forwarded)) {
+        if (!address)
             return;
+        if (args.serder.pvrsn.major < 2) {
+            const message = legacyForwardedMessage(args.serder, args.attachments);
+            if (!message)
+                return;
+            const path = this.forwardPath(forwardSource(args.serder, message.frame.body), address.recipient, mailboxAid);
+            return path ? this.deliver(path, address, message.wire) : undefined;
         }
-        if (!this.canStoreRecipient(recipient, mailboxAid))
+        const child = args.nests?.[0];
+        if (!child)
             return;
-        if (child) {
-            // Mailbox LMDB accepts a finite row; collect one child, never the whole exchange stream.
-            return abortable(async (signal) => {
-                const wire = await collectPayload(nestedPayload(child, Vrsn_2_0), signal);
-                signal.throwIfAborted();
-                if (this.canStoreRecipient(recipient, mailboxAid))
+        const source = forwardSource(args.serder, child.body);
+        if (!this.forwardPath(source, address.recipient, mailboxAid))
+            return;
+        // deno-lint-ignore no-this-alias -- The operation owns this one child's delivery.
+        const self = this;
+        return call(function* () {
+            const wire = yield* collectNestedMessage(child);
+            if (!wire)
+                return;
+            // Re-read accepted authority in the same synchronous turn as delivery.
+            const current = self.forwardPath(source, address.recipient, mailboxAid);
+            if (current)
+                yield* call(() => self.deliver(current, address, wire));
+        });
+    }
+    /**
+     * Decide the path from current accepted state; see the class rules for their order.
+     *
+     * @param source Authenticated `/fwd` signer and the forwarded message's own originator.
+     * @param recipient Final recipient AID named by the `/fwd` modifiers.
+     * @param mailboxAid Receiving hosted endpoint AID, or null when the request named none.
+     * @returns The one path to take, or null to drop the `/fwd`.
+     */
+    forwardPath(source, recipient, mailboxAid) {
+        const hby = this.mailboxDirector.hby;
+        if (this.reactor && hby.habs.has(recipient)) {
+            const pickup = this.pickupHost(recipient, mailboxAid);
+            if (pickup)
+                return { kind: "ingest", store: !ownTraffic(hby, source.origin, recipient, pickup) };
+            if (this.relay && servingHost(hby, source, mailboxAid))
+                return { kind: "ingest", store: false };
+        }
+        if (this.canStoreRecipient(recipient, mailboxAid))
+            return { kind: "store" };
+        // Nothing addressed to this Habery leaves through its own Poster; it would only loop back here.
+        if (!this.relay || hby.db.prefixes.has(recipient))
+            return null;
+        const host = servingHost(hby, source, mailboxAid);
+        return host ? { kind: "relay", host } : null;
+    }
+    /**
+     * Select the local host that keeps `recipient`'s mail for pickup, or null; any local habitat without
+     * request-scoped provenance, as {@link servingHost} does.
+     *
+     * @param recipient Final recipient AID named by the `/fwd` modifiers.
+     * @param mailboxAid Receiving hosted endpoint AID, or null when the request named none.
+     * @returns The local AID that keeps the recipient's mail for pickup, or null.
+     */
+    pickupHost(recipient, mailboxAid) {
+        const hby = this.mailboxDirector.hby;
+        const hosts = mailboxAid ? [mailboxAid] : [...hby.db.prefixes];
+        return hosts.find((host) => hby.habs.has(host) && keepsForPickup(hby, recipient, host)) ?? null;
+    }
+    /**
+     * Take one decided path for complete child wire.
+     *
+     * @param path Path decided in this turn.
+     * @param address Final recipient AID and `/fwd` mailbox topic.
+     * @param wire Exactly one complete child message, signed by its originator.
+     * @returns The ingest operation for a local recipient; storage (including an ingested child's pickup copy, written
+     *   before ingest in the turn its authority was read) and Poster admission complete synchronously.
+     */
+    deliver(path, address, wire) {
+        const { recipient, topic } = address;
+        switch (path.kind) {
+            case "store":
+                this.mailboxDirector.publish(recipient, topic, wire);
+                return;
+            case "relay":
+                this.relay.send({ src: path.host, dest: recipient, topic, msg: wire });
+                return;
+            case "ingest":
+                if (path.store)
                     this.mailboxDirector.publish(recipient, topic, wire);
-            });
+                // Remote input at the recipient's own endpoint, never `local`: it must earn acceptance like any arrival.
+                return this.reactor.processBytes(wire, { mailboxAid: recipient });
         }
-        this.mailboxDirector.publish(recipient, topic, forwarded);
     }
     /** Re-read accepted authority in the same synchronous turn as provider publication. */
     canStoreRecipient(recipient, mailboxAid) {
@@ -140,13 +272,115 @@ function hostCanStoreForwardRecipient(hby, recipient, recipientKever, hostAid) {
     if (recipientKever.wits.includes(hostAid)) {
         return true;
     }
-    for (const role of [Roles.mailbox, Roles.agent]) {
-        const end = hby.db.ends.get([recipient, role, hostAid]);
-        if (end?.allowed || end?.enabled) {
-            return true;
-        }
+    return authorizedStoringHost(hby, recipient, hostAid);
+}
+/**
+ * Select the local host that serves this source, or null. This is the one served-sender rule of a relaying host:
+ * `/fwd` intake relays only for it and the `/oobis` handler resolves only for it.
+ *
+ * Without request-scoped provenance any local habitat the source authorized serves it, as the store path
+ * accepts any local store host.
+ *
+ * @param hby Borrowed local habitat collection and accepted-state database.
+ * @param source Authenticated signer and, for a `/fwd`, the forwarded message's own originator.
+ * @param mailboxAid Receiving hosted endpoint AID, or null when the request named none.
+ * @returns The local AID the source authorized, or null.
+ */
+export function servingHost(hby, source, mailboxAid) {
+    const hosts = mailboxAid ? [mailboxAid] : [...hby.db.prefixes];
+    return hosts.find((host) => hby.habs.has(host) && servesSource(hby, source, host)) ?? null;
+}
+/**
+ * Whether `hostAid` relays for this source: the sender authorized the host, or the forwarded message originates
+ * from a group the sender is an accepted member of and that group authorized the host. Witness membership of
+ * either is not consulted. Rows read: `ends.[sender, mailbox|agent, hostAid]`, then, only when the sender is an
+ * accepted member of `origin`, `ends.[origin, mailbox|agent, hostAid]`.
+ *
+ * @param hby Borrowed local habitat collection and accepted-state database.
+ * @param source Authenticated `/fwd` signer and forwarded originator.
+ * @param hostAid Local endpoint AID that would relay.
+ * @returns True when accepted end-role state makes the sender a served sender of this host.
+ */
+function servesSource(hby, source, hostAid) {
+    if (!source.sender)
+        return false;
+    if (authorizedStoringHost(hby, source.sender, hostAid))
+        return true;
+    return !!source.origin && source.origin !== source.sender
+        && isAcceptedGroupMember(hby.db, source.origin, source.sender)
+        && authorizedStoringHost(hby, source.origin, hostAid);
+}
+/**
+ * Read the `/fwd` address, or null when this host could not store or relay under it.
+ *
+ * The recipient must parse as one identifier prefix, since it becomes a Poster destination and a mailbox key. The
+ * topic must be nonempty in bare form (a forwarded delivery requires one, and the Poster refuses an empty topic as a
+ * programmer error) and storable as a mailbox key under that recipient, so a stored, ingested or relayed child never
+ * reaches the mailbox store with a key it would refuse as a fault.
+ *
+ * @param serder Forwarding exchange.
+ * @returns The usable address, or null.
+ */
+function forwardAddress(serder) {
+    const modifiers = serder.ked?.q;
+    const recipient = modifiers?.pre, topic = modifiers?.topic;
+    if (typeof recipient !== "string" || typeof topic !== "string")
+        return null;
+    // The whole string must be the prefix: a shorter qb64 followed by trailing text is not one.
+    if (readPrefixer(recipient)?.qb64 !== recipient || transportMailboxTopic(topic).length === 0)
+        return null;
+    return storableTopic(mailboxTopicKey(recipient, topic)) ? { recipient, topic } : null;
+}
+/**
+ * The `/fwd` signer and the forwarded message's own originator: a KERI message's `i`, an ACDC's issuer.
+ *
+ * @param serder Authenticated forwarding exchange.
+ * @param body Body of the one forwarded message.
+ * @returns Who the request speaks for.
+ */
+function forwardSource(serder, body) {
+    const origin = body instanceof SerderKERI ? body.pre : body instanceof SerderACDC ? body.issuer : null;
+    return { sender: serder.pre, origin };
+}
+/**
+ * The one frame `wire` parses as, or null when it is not exactly one complete CESR message with its attachments.
+ *
+ * `ParserError` is the decoder's refusal of the bytes; nothing else here reads a store or does I/O, so any other
+ * error is a fault and propagates.
+ *
+ * @param wire Candidate child wire.
+ * @returns The single parsed frame, or null.
+ */
+function oneCompleteMessage(wire) {
+    try {
+        const frames = parseBytes(wire);
+        return frames.length === 1 ? frames[0] : null;
+    }
+    catch (error) {
+        if (error instanceof ParserError)
+            return null;
+        throw error;
     }
-    return false;
+}
+/**
+ * Collect a v2 child's own wire, or null when it does not re-enclose as exactly one complete message.
+ *
+ * @param child Bound nested child, borrowed for this operation.
+ * @returns The child's complete wire, or null.
+ */
+function* collectNestedMessage(child) {
+    let payload;
+    try {
+        payload = nestedPayload(child, Vrsn_2_0);
+    }
+    catch (error) {
+        if (error instanceof ParserError)
+            return null;
+        throw error;
+    }
+    // Mailbox LMDB and Poster take one finite message; collect one child, never the whole exchange stream.
+    const wire = yield* abortable((signal) => collectPayload(payload, signal));
+    return oneCompleteMessage(wire) ? wire : null;
 }
 /**
  * Check recipient-specific store-forward authority without treating a controller endpoint as a mailbox.
@@ -167,29 +401,41 @@ function hasLocalStoreForwardHost(hby, recipient, recipientKever) {
     return false;
 }
 /**
- * Reconstruct legacy forwarded wire without assigning outer attachments to the child.
+ * Rebuild the legacy embed into its one message, or null when it is not exactly one complete message.
+ *
+ * The body is serialized from `e.evt`, followed by only the attachment material pathed to `/e/evt`; other pathed
+ * groups belong to the outer `/fwd`. The result must parse as exactly one complete message with its attachments, so
+ * an embed that is not a message, or whose pathed attachments are not that message's complete attachments, is
+ * refused here and never reaches the mailbox store, this runtime's ingress or the Poster.
  *
  * @param serder Legacy forwarding exchange containing an e.evt body.
  * @param attachments Pathed attachments; only /e/evt material belongs to the embedded message.
- * @returns Reconstructed child wire, or null without an embedded event.
+ * @returns The forwarded message, or null.
  */
-function extractForwardedMessage(serder, attachments) {
+function legacyForwardedMessage(serder, attachments) {
     const embeds = serder.ked?.e;
     const evt = embeds?.evt;
     if (!evt || typeof evt !== "object" || Array.isArray(evt)) {
         return null;
     }
-    // Rebuild the embedded event from SAD plus only the attachment material
-    // pathed to `/e/evt`; other pathed groups belong to the outer `/fwd` message.
-    const embedded = embeddedSerderRaw(evt);
-    const messageParts = [embedded];
-    for (const attachment of attachments) {
-        const atc = forwardedAttachmentForPath(attachment.raw, "/e/evt");
-        if (atc) {
-            messageParts.push(atc);
+    const parts = [];
+    try {
+        parts.push(embeddedSerderRaw(evt));
+        for (const attachment of attachments) {
+            const atc = forwardedAttachmentForPath(attachment.raw, "/e/evt");
+            if (atc)
+                parts.push(atc);
         }
     }
-    return concatBytes(...messageParts);
+    catch (error) {
+        // The embed's SAD and the pathed groups are remote input; the codec refuses what it cannot serialize or read.
+        if (error instanceof ParserError)
+            return null;
+        throw error;
+    }
+    const wire = concatBytes(...parts);
+    const frame = oneCompleteMessage(wire);
+    return frame ? { wire, frame } : null;
 }
 /**
  * Serialize one legacy embedded body according to its declared protocol.

package/esm/keri/npm/src/app/mailbox/kel-publisher.js

@@ -9,7 +9,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _KelPublisher_instances, _KelPublisher_deps, _KelPublisher_budgets, _KelPublisher_inflight, _KelPublisher_dirty, _KelPublisher_owed, _KelPublisher_statusOf, _KelPublisher_budget, _KelPublisher_attempt, _KelPublisher_derive, _KelPublisher_deriveFor, _KelPublisher_prune;
+var _KelPublisher_instances, _KelPublisher_deps, _KelPublisher_budgets, _KelPublisher_inflight, _KelPublisher_dirty, _KelPublisher_owed, _KelPublisher_repair, _KelPublisher_statusOf, _KelPublisher_budget, _KelPublisher_attempt, _KelPublisher_derive, _KelPublisher_deriveFor, _KelPublisher_prune;
 import { Deck } from "../../core/deck.js";
 import { dgKey } from "../../db/core/keys.js";
 import { doEvery } from "../runtime/doing.js";
@@ -50,12 +50,12 @@ export class KelPublisher {
             writable: true,
             value: new Deck()
         });
-        /** A failure that escapes a pass is counted and kept here; the fiber keeps running. */
-        Object.defineProperty(this, "health", {
+        /** The mailbox poller pushes what each poll said here; the next tock re-arms or repairs that entry. */
+        Object.defineProperty(this, "polls", {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: { faults: 0, last: null }
+            value: new Deck()
         });
         _KelPublisher_deps.set(this, void 0);
         _KelPublisher_budgets.set(this, new Map());
@@ -68,7 +68,7 @@ export class KelPublisher {
     }
     /**
      * Give `pre`'s entries a fresh budget and derive them on the next tock; with `mailbox`, re-arm only that mailbox's
-     * entry, and only if it timed out (the poller calls this after a successful poll).
+     * entry, and only if it timed out (what a `polled` record on {@link KelPublisher.polls} does).
      */
     prompt(pre, mailbox) {
         if (mailbox !== undefined) {
@@ -84,19 +84,6 @@ export class KelPublisher {
         }
         __classPrivateFieldGet(this, _KelPublisher_dirty, "f").add(pre);
     }
-    /**
-     * A mailbox refused the owner's poll with 403: whatever the record says it holds, it cannot authenticate
-     * the owner (it lost its state, or accepted a post it then escrowed). Forget what it was given, so the next
-     * pass posts the KEL again, and give the entry a fresh budget. The poller calls this at most once per backoff
-     * period, which is also the most this posts; a mailbox that never recovers is given up on like any other.
-     */
-    repair(pre, mailbox) {
-        const { hby } = __classPrivateFieldGet(this, _KelPublisher_deps, "f"), record = hby.db.kpub.get([pre, mailbox]);
-        if (!hby.readonly && record?.d)
-            hby.db.kpub.pin([pre, mailbox], { d: null, dt: record.dt });
-        __classPrivateFieldGet(this, _KelPublisher_budgets, "f").delete(idOf(pre, mailbox));
-        __classPrivateFieldGet(this, _KelPublisher_dirty, "f").add(pre);
-    }
     /**
      * The full check: forget records of mailboxes no longer authorized, and mark every identifier for derivation.
      * A walk of all identifiers, so a host runs it at open and every many tocks.
@@ -111,7 +98,7 @@ export class KelPublisher {
                 __classPrivateFieldGet(this, _KelPublisher_dirty, "f").add(hab.pre);
     }
     /**
-     * The fixed-tock pass: drain the cues, derive the marked identifiers and those still owed, then send up to
+     * The fixed-tock pass: drain the decks, derive the marked identifiers and those still owed, then send up to
      * {@link KelSendsPerPass} due posts, each within `timeoutMs` for the mailbox's answer. An idle pass reads no
      * store. A post is recorded when the mailbox answers 2xx; a failure is retried on the schedule until the budget
      * is used up. Never throws on a remote failure; every attempt is returned.
@@ -120,6 +107,12 @@ export class KelPublisher {
         const { clock, hby } = __classPrivateFieldGet(this, _KelPublisher_deps, "f");
         for (let cue = this.rotated.pull(); cue; cue = this.rotated.pull())
             this.prompt(cue.pre);
+        for (let cue = this.polls.pull(); cue; cue = this.polls.pull()) {
+            if (cue.kin === "polled")
+                this.prompt(cue.pre, cue.mailbox);
+            else
+                __classPrivateFieldGet(this, _KelPublisher_instances, "m", _KelPublisher_repair).call(this, cue.pre, cue.mailbox);
+        }
         if (hby.readonly)
             return [];
         const owed = [];
@@ -186,7 +179,13 @@ export class KelPublisher {
         return done ? { outcome: "settled", status } : { outcome: "timed-out", status, timeoutMs };
     }
 }
-_KelPublisher_deps = new WeakMap(), _KelPublisher_budgets = new WeakMap(), _KelPublisher_inflight = new WeakMap(), _KelPublisher_dirty = new WeakMap(), _KelPublisher_owed = new WeakMap(), _KelPublisher_instances = new WeakSet(), _KelPublisher_statusOf = function _KelPublisher_statusOf(entry) {
+_KelPublisher_deps = new WeakMap(), _KelPublisher_budgets = new WeakMap(), _KelPublisher_inflight = new WeakMap(), _KelPublisher_dirty = new WeakMap(), _KelPublisher_owed = new WeakMap(), _KelPublisher_instances = new WeakSet(), _KelPublisher_repair = function _KelPublisher_repair(pre, mailbox) {
+    const { hby } = __classPrivateFieldGet(this, _KelPublisher_deps, "f"), record = hby.db.kpub.get([pre, mailbox]);
+    if (!hby.readonly && record?.d)
+        hby.db.kpub.pin([pre, mailbox], { d: null, dt: record.dt });
+    __classPrivateFieldGet(this, _KelPublisher_budgets, "f").delete(idOf(pre, mailbox));
+    __classPrivateFieldGet(this, _KelPublisher_dirty, "f").add(pre);
+}, _KelPublisher_statusOf = function _KelPublisher_statusOf(entry) {
     const base = { pre: entry.pre, mailbox: entry.mailbox, said: entry.said };
     if (entry.published)
         return { ...base, state: "published", attempts: 0 };
@@ -304,19 +303,15 @@ _KelPublisher_deps = new WeakMap(), _KelPublisher_budgets = new WeakMap(), _KelP
 /**
  * Run the publisher on its own fiber until halted, as a fixed-tock doer: a sweep on tock 0 and every
  * `pacing.sweepTocks`, a pass on every tock, then a wait of one tock. A mailbox that hangs holds up only this
- * fiber, never the operation owners. A failure that escapes a pass is counted in `publisher.health` and the
- * loop keeps running.
+ * fiber, never the operation owners. Nothing is caught: every outcome of a post (an HTTP error status, a transport
+ * failure, no answer in time) is a `failed` publication that the pass records and retries, so what escapes a pass is a
+ * real fault (a store that cannot be read or written, a local group whose member is missing) and it ends the loop and
+ * `runAgentRuntime`. Halting the loop returns from the pass and is not a fault.
  */
 export function* kelPublisherDo(publisher, clock, pacing = KEL_PUBLISHER_PACING) {
     return yield* doEvery(clock, pacing.tockMs, function* (tock) {
-        try {
-            if (tock % pacing.sweepTocks === 0)
-                publisher.sweep();
-            yield* publisher.processDue();
-        }
-        catch (error) {
-            publisher.health.faults++;
-            publisher.health.last = { error, at: clock.now() };
-        }
+        if (tock % pacing.sweepTocks === 0)
+            publisher.sweep();
+        yield* publisher.processDue();
     });
 }