keri-ts 2.2.4 → 2.2.6

package/esm/keri/npm/src/app/runtime/cue-runtime.js

@@ -1,3 +1,4 @@
+import { Roles } from "../../core/roles.js";
 import { doEvery, PROTOCOL_PACING } from "./doing.js";
 /**
  * Use an explicitly selected or sole local habitat; never guess among hosted identities.
@@ -13,11 +14,28 @@ function resolveCueHab(runtime, hab) {
     const first = habitats.next();
     return first.done || !habitats.next().done ? null : first.value;
 }
+/**
+ * Hand an accepted mailbox end role to the KEL publisher and the mailbox poller, so both look at its controller on
+ * their next tock rather than at their next sweep. Other roles concern neither.
+ *
+ * @param runtime Borrowed composed runtime containing the publisher and poller.
+ * @param cue The committed end-role fact from `Revery`.
+ */
+export function promptForEndRole(runtime, cue) {
+    if (cue.role !== Roles.mailbox)
+        return;
+    runtime.kelPublisher.prompt(cue.cid);
+    runtime.mailboxPoller.prompt(cue.cid);
+}
 /**
  * Route one initial cue batch to its concrete owners before removing source records.
  *
- * Transfer query instructions to the sender, stream cues to mailbox correlation
- * and produced responder messages to Poster. No network delivery runs inline.
+ * Transfer query instructions to the sender (a relaying runtime skips one identical to a request already queued),
+ * stream cues to mailbox correlation,
+ * accepted mailbox end roles to the KEL publisher and poller, and produced responder
+ * messages to Poster. No network delivery runs inline.
+ * A responder cue whose signing habitat cannot sign yet moves to the tail and is
+ * tried again on a later pass; the cues behind it still go now.
  * Saved key-state facts transfer once to the command's optional query Deck;
  * its noticer never competes with this worker over the runtime source Deck.
  * Admission and source removal run synchronously within this finite batch.
@@ -33,14 +51,36 @@ export function* processCuesOnce(runtime, { hab, queryCues } = {}) {
         const cue = runtime.cues.peekHead();
         if (!cue)
             break;
+        if (cue.kin === "kramRefused") {
+            // Pulled first: a faulty sink must not wedge the head of the Deck.
+            runtime.cues.pull();
+            runtime.changes?.push({ kind: "kramRefused", id: cue.said, refusal: cue });
+            continue;
+        }
+        if (cue.kin === "endRoleSaved") {
+            runtime.cues.pull();
+            promptForEndRole(runtime, cue);
+            continue;
+        }
         if (cue.kin === "query") {
-            runtime.querying.enqueueCue(cue, interpreter);
+            // A relaying host serves many edges asking about the same subjects; one queued request per query suffices.
+            if (runtime.relaying)
+                runtime.querying.enqueueCueOnce(cue, interpreter);
+            else
+                runtime.querying.enqueueCue(cue, interpreter);
         }
         else if (cue.kin === "stream") {
             runtime.mailboxDirector.retainQueryCue(cue);
         }
-        else if (interpreter && runtime.respondant.enqueueCue(interpreter, runtime.cues, hab)) {
-            continue;
+        else if (interpreter) {
+            const outcome = runtime.respondant.enqueueCue(interpreter, runtime.cues, hab);
+            if (outcome === "taken")
+                continue;
+            if (outcome === "unsignable") {
+                // Kept for a later pass, behind the cues that can go now; `count` bounds this pass.
+                runtime.cues.append(runtime.cues.pull());
+                continue;
+            }
         }
         runtime.cues.pull();
         if (cue.kin === "keyStateSaved")

package/esm/keri/npm/src/app/runtime/ipex-auxiliaries.js

@@ -122,7 +122,14 @@ export class IpexAuxiliaries {
         const current = this.unblinds.get(hab.pre);
         if (current?.hab === hab)
             return current;
-        const owner = new Unblind({ hab, exc: this.exc, registry: this.registry, rvy: this.rvy, kram: this.kram });
+        const owner = new Unblind({
+            hab,
+            exc: this.exc,
+            registry: this.registry,
+            rvy: this.rvy,
+            now: this.now,
+            kram: this.kram,
+        });
         current?.close();
         this.unblinds.set(hab.pre, owner);
         return owner;

package/esm/keri/npm/src/app/runtime/operation-owners.js

@@ -14,28 +14,6 @@ export const OWNER_PACING = Object.freeze({
     tockMs: OWNER_TOCK_MS,
     sweepTocks: OWNER_SWEEP_TOCKS,
 });
-/**
- * Failures of the owner loop itself. A failure of one operation (a delivery that throws, an unreadable stored
- * Grant) ends that operation as `failed` and is never recorded here; this records only what escaped an owner
- * pass, which the loop survives so that the other owners keep running. `faults` counts them and `last` keeps
- * the latest. Nothing clears it: a host reads it and decides.
- */
-export class OwnerHealth {
-    constructor() {
-        Object.defineProperty(this, "faults", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: 0
-        });
-        Object.defineProperty(this, "last", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: null
-        });
-    }
-}
 /** Construct the owners over their in-memory tables; the derivation store defaults to the registry database. */
 export function composeOwners(parts, stores = {}) {
     const { hby, acdc, exc, protocol, reactor, postman, receiptor, ipex, clock, registryRoot, mux, counselor } = parts;
@@ -82,7 +60,6 @@ export function composeOwners(parts, stores = {}) {
             retry: parts.retry,
             changes,
         }),
-        health: new OwnerHealth(),
         unblinding: new UnblindingOperations({
             hby,
             exc,
@@ -95,7 +72,9 @@ export function composeOwners(parts, stores = {}) {
             changes,
         }),
     };
-    const rootReplicator = registryRoot ? new RootReplicator({ root: registryRoot, postman, clock, changes }) : null;
+    const rootReplicator = registryRoot
+        ? new RootReplicator({ root: registryRoot, postman, clock, changes, changed: parts.groupChanges })
+        : null;
     return { operations, rootReplicator };
 }
 /**
@@ -106,47 +85,38 @@ export function composeOwners(parts, stores = {}) {
  * Idle cost, per tock: four constant-time table checks, one in-memory walk of the Unblind owners for an owed
  * reply, one drain of each DH owner's cue deck, and the replicator's emptiness checks. The replicator's
  * rotation check (the establishment SAID of each local group, one keyed read per local identifier) runs on
- * tock 0 and every `pacing.sweepTocks`. No owner reads a protocol store. Only the first pass, once, scans the
- * pending exchange escrow for resumable Grants.
+ * tock 0 and every `pacing.sweepTocks`. No owner reads a protocol store on an ordinary tock. The issuance owner
+ * scans the pending exchange escrow on its first pass and then every `ISSUANCE_SWEEP_MS`, for resumable Grants and
+ * for group Grants whose custodian's final proof a member follows without signing; nothing else walks it per tock.
  *
- * A failure that escapes an owner pass is recorded in `operations.health` and the loop keeps running, so
- * one owner's fault never stops the others. The owners run one after another, so a delivery that does not return holds the others up until it fails or
- * its Grant deadline passes; operations already bound each delivery by that deadline.
+ * Nothing is caught here. Every remote, network or validation outcome an owner meets is already a typed result
+ * below this loop: a failed delivery is retried by its operation, and an operation that cannot go on ends `failed`
+ * or `expired` alone. What escapes a pass is a real fault (a store that cannot be read or written, corrupt or
+ * missing durable state such as a `MissingDurableStateError`, a `SignerNotHeldError` past a `canSign`
+ * gate), and it ends the loop and with it `runAgentRuntime`. Halting the loop is not a fault: Effection halts a
+ * pass by returning from it, so no error is thrown. The owners run one after another, so a delivery that does not
+ * return holds the others up until it fails or its Grant deadline passes; operations already bound each delivery by
+ * that deadline.
  */
 export function* operationOwnersDo(owners, pacing = OWNER_PACING) {
-    const { operations, rootReplicator, ipex, clock } = owners, { health } = operations;
-    const guarded = function* (owner, pass) {
-        try {
-            yield* pass();
-        }
-        catch (error) {
-            health.faults++;
-            health.last = {
-                owner,
-                error: error instanceof Error ? error.message : String(error),
-                at: new Date(clock.now()).toISOString(),
-            };
-        }
-    };
+    const { operations, rootReplicator, ipex, clock } = owners;
     return yield* doEvery(clock, pacing.tockMs, function* (tock) {
         if (operations.issuance.active())
-            yield* guarded("issuance", () => operations.issuance.processOnce());
+            yield* operations.issuance.processOnce();
         if (operations.groupIpex.active())
-            yield* guarded("groupIpex", () => operations.groupIpex.processOnce());
+            yield* operations.groupIpex.processOnce();
         if (operations.presentation.active())
-            yield* guarded("presentation", () => operations.presentation.processOnce());
+            yield* operations.presentation.processOnce();
         if (operations.unblinding.active())
-            yield* guarded("unblinding", () => operations.unblinding.processOnce());
+            yield* operations.unblinding.processOnce();
         if (rootReplicator) {
-            yield* guarded("replicator", function* () {
-                for (const dh of ipex.dhkeOwners()) {
-                    while (dh.replicated.length)
-                        rootReplicator.replicate(dh.replicated.pull());
-                }
-                if (tock % pacing.sweepTocks === 0)
-                    rootReplicator.sweep();
-                yield* rootReplicator.processDue();
-            });
+            for (const dh of ipex.dhkeOwners()) {
+                while (dh.replicated.length)
+                    rootReplicator.replicate(dh.replicated.pull());
+            }
+            if (tock % pacing.sweepTocks === 0)
+                rootReplicator.sweep();
+            yield* rootReplicator.processDue();
         }
     });
 }

package/esm/keri/npm/src/app/runtime/workflow-contract.js

@@ -24,22 +24,25 @@ export class MemoryChangeSink {
         });
     }
     push(change) {
-        this.changes.push({ kind: change.kind, id: change.id });
+        this.changes.push(change.kind === "kramRefused" ? change : { kind: change.kind, id: change.id });
     }
 }
 /**
  * Back a sink with the host's transient `Signaler`. Publishing needs no polling:
  * `push` is a synchronous append that collapses repeats of one workflow into a
- * single signal (collapse key `kind:id`). Delivery is pull-based, though: the
+ * single signal (collapse key `kind:id`). A {@link KramRefusedChange} adds its refusal fields to the signal
+ * attributes, so a resent message collapses by SAID. Delivery is pull-based, though: the
  * Signaler has no subscriber hook, so the consumer must read `signaler.list()`.
  * A closed or failing Signaler drops the change instead of throwing: a hint must
  * never break the workflow that published it.
  */
 export function signalerChangeSink(signaler) {
     return {
-        push: ({ kind, id }) => {
+        push: (change) => {
+            const { kind, id } = change;
             try {
-                signaler.push({ id }, `/workflow/${kind}`, { ckey: `${kind}:${id}` });
+                const attrs = change.kind === "kramRefused" ? { id, ...change.refusal } : { id };
+                signaler.push(attrs, `/workflow/${kind}`, { ckey: `${kind}:${id}` });
             }
             catch {
                 // Dropped on purpose; consumers re-read status and tolerate a missed hint.

package/esm/keri/npm/src/app/transport/http-client.js

@@ -4,6 +4,25 @@ import { ValidationError } from "../../core/errors.js";
 import { abortable } from "../runtime/abortable.js";
 import { collectBytes } from "./byte-source.js";
 import { TransportError } from "./transport-error.js";
+/**
+ * Whether {@link FetchHttpClient.open} can request `url` at all: an absolute HTTP(S) URL without embedded
+ * credentials. Anything else is refused by construction, before any I/O, so a caller holding a URL from a remote
+ * party can refuse it at intake instead of queuing work that can never succeed.
+ *
+ * @param url Candidate request URL.
+ * @returns False for an unparseable URL, a non-HTTP(S) scheme, or a URL carrying a user name or password.
+ */
+export function isRequestableHttpUrl(url) {
+    let endpoint;
+    try {
+        endpoint = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return (endpoint.protocol === "http:" || endpoint.protocol === "https:") && !endpoint.username
+        && !endpoint.password;
+}
 /**
  * Native requests and signals that a pending `fetch` still needs. WebKit links an in-flight fetch to
  * its abort signal only weakly: once the `Request`, or an `AbortSignal.any` composite, is garbage
@@ -78,8 +97,7 @@ export class FetchHttpClient {
                 : new TransportError(`${message} for ${url}`, { cause });
             try {
                 signal.throwIfAborted();
-                const endpoint = new URL(url);
-                if (!["http:", "https:"].includes(endpoint.protocol) || endpoint.username || endpoint.password) {
+                if (!isRequestableHttpUrl(url)) {
                     throw new ValidationError("HTTP output requires an HTTP(S) URL without credentials");
                 }
                 // Construction errors are caller errors, before native network classification.

package/esm/keri/npm/src/app/transport/message-source.js

@@ -53,7 +53,8 @@ export function* processMessages(source, protocol, kvy, options = {}) {
                 signal.throwIfAborted();
                 if (result.done)
                     return;
-                yield* protocol.dispatch(result.value, options, kvy);
+                // Only the intake choices: nothing a caller adds to its options can mark live input as retained history.
+                yield* protocol.dispatch(result.value, { local: options.local, mailboxAid: options.mailboxAid, escrows: options.escrows }, kvy);
             }
         }
         finally {

package/esm/keri/npm/src/app/transport/messengering.js

@@ -7,25 +7,56 @@
  * do not select a stored framing preference or acquire workers, stores or queues.
  */
 import { ValidationError } from "../../core/errors.js";
+import { readUrl } from "../../core/wire-fields.js";
+import { isRequestableHttpUrl } from "./http-client.js";
 import { HTTPMessenger } from "./http-messenger.js";
 import { HTTPStreamMessenger } from "./http-stream-messenger.js";
 import { requireTcpDialer } from "./tcp-dialer.js";
-/** Choose HTTPS, HTTP, then TCP and reject a mismatched advertised scheme before I/O. */
-function endpointFrom(urls) {
+/**
+ * Choose HTTPS, HTTP, then TCP, refusing before I/O what no messenger can use: an unparseable URL, a scheme other than
+ * the advertised one, an HTTP(S) URL the HTTP client refuses ({@link isRequestableHttpUrl}: embedded credentials), or
+ * a TCP URL without a valid port. A refused higher-priority URL does not fall through to another transport.
+ *
+ * @param urls Resolved endpoints, keyed by their advertised scheme.
+ * @returns The selection, never a throw.
+ */
+function selectEndpoint(urls) {
     for (const scheme of ["https", "http", "tcp"]) {
         const value = urls[scheme];
         if (value === undefined)
             continue;
-        const endpoint = new URL(value);
-        if (endpoint.protocol !== `${scheme}:` || endpoint.username || endpoint.password) {
-            throw new ValidationError(`Invalid ${scheme} messenger endpoint: ${value}`);
+        const endpoint = readUrl(value);
+        if (!endpoint)
+            return { kind: "refused", reason: `Invalid ${scheme} messenger endpoint: ${value}` };
+        const usable = scheme === "tcp" ? !endpoint.username && !endpoint.password : isRequestableHttpUrl(value);
+        if (endpoint.protocol !== `${scheme}:` || !usable) {
+            return { kind: "refused", reason: `Invalid ${scheme} messenger endpoint: ${value}` };
         }
         if (scheme === "tcp" && (!endpoint.port || Number(endpoint.port) < 1 || Number(endpoint.port) > 65535)) {
-            throw new ValidationError(`TCP messenger endpoint requires a valid port: ${value}`);
+            return { kind: "refused", reason: `TCP messenger endpoint requires a valid port: ${value}` };
         }
-        return endpoint;
+        return { kind: "usable", value, endpoint };
     }
-    throw new ValidationError("No supported messenger endpoint is available.");
+    return { kind: "refused", reason: "No supported messenger endpoint is available." };
+}
+/** Select the factories' endpoint, refusing an unusable one as a caller error. */
+function endpointFrom(urls) {
+    const selection = selectEndpoint(urls);
+    if (selection.kind === "refused")
+        throw new ValidationError(selection.reason);
+    return selection.endpoint;
+}
+/**
+ * The URL the messenger factories would use for these endpoints, or null when they would refuse it. A caller holding
+ * a location another party advertised reads a refused one as no location, so it fails one delivery as unroutable
+ * instead of throwing out of the factory.
+ *
+ * @param urls Resolved endpoints, keyed by their advertised scheme.
+ * @returns The selected URL exactly as advertised, or null.
+ */
+export function messengerUrl(urls) {
+    const selection = selectEndpoint(urls);
+    return selection.kind === "usable" ? selection.value : null;
 }
 /**
  * Bind ordinary signed-message delivery to the first present HTTPS/HTTP/TCP URL.

package/esm/keri/npm/src/app/witness/ingress.js

@@ -2,6 +2,7 @@
 import { parse } from "cesr-ts";
 import { call, ensure } from "effection";
 import { rethrowCleanupFailure } from "../runtime/abortable.js";
+import { promptForEndRole } from "../runtime/cue-runtime.js";
 import { chunkBytes } from "../transport/byte-source.js";
 /** Return the active wire-message habitat or `null` when selection is ambiguous. */
 function cueHab(runtime, serviceHab) {
@@ -15,6 +16,7 @@ function cueHab(runtime, serviceHab) {
 /**
  * Route one initial witness cue batch, leaving saved key-state facts for the
  * application cue worker and its optional command-owned noticer destination.
+ * An accepted mailbox end role prompts the KEL publisher and poller as the cue worker does.
  * Respondant publishes Poster work; this ingress helper never drains Poster
  * network delivery. Query network I/O stays with the independent sender.
  *
@@ -39,6 +41,11 @@ export function* drainWitnessCues(runtime, serviceHab, cues, { deliver = true }
             cues.append(cue);
             continue;
         }
+        if (cue.kin === "endRoleSaved") {
+            cues.pull();
+            promptForEndRole(runtime, cue);
+            continue;
+        }
         if (deliver) {
             if (cue.kin === "query") {
                 runtime.querying.enqueueCue(cue, hab);

package/esm/keri/npm/src/app/witness/receipt-client.js

@@ -8,6 +8,7 @@ import { collectBytes } from "../transport/byte-source.js";
 import { buildCesrRequest, CESR_CONTENT_TYPE, KERIPY_CESR_JSON_CONTENT_TYPE } from "../transport/cesr-http.js";
 import { HTTPMessenger } from "../transport/http-messenger.js";
 import { requireTcpDialer } from "../transport/tcp-dialer.js";
+import { TransportError } from "../transport/transport-error.js";
 import { inspectReceiptMessage } from "./receipt-messages.js";
 const WitnessReceiptPollAttempts = 20;
 const WitnessReceiptPollDelayMs = 100;
@@ -51,6 +52,8 @@ function preferredWitnessTransportUrl(hab, witness) {
     return witnessHttpUrl(hab, witness) ?? witnessTcpUrl(hab, witness);
 }
 /**
+ * Deliver one message to a witness, reporting remote failure as data.
+ *
  * Send via HTTP first; an explicit protocol processor processes same-socket TCP replies.
  * Without a protocol processor TCP reports local transmission only. Actual socket/parser
  * cleanup finishes before this borrowed protocol processor can be released.
@@ -62,27 +65,51 @@ function preferredWitnessTransportUrl(hab, witness) {
  * @param clock Borrowed clock with epoch-millisecond now and millisecond timer delays.
  * @param protocol Optional same-socket reply processor; null selects transmit-only TCP.
  * @param auth Optional HTTP Authorization header value.
- * @throws Missing endpoint, peer refusal, transport/parser or cleanup failures propagate.
+ * @returns `unreachable` when the witness advertises no endpoint, refuses over HTTP, or the connection fails
+ * (`TransportError`); the caller decides whether to retry later. Parser, storage, programmer and cleanup
+ * failures still throw.
  */
-export function* sendWitnessMessage(hab, witness, bytes, http, clock, protocol, auth) {
+export function* deliverWitnessMessage(hab, witness, bytes, http, clock, protocol, auth) {
     const url = preferredWitnessTransportUrl(hab, witness);
     if (!url) {
-        throw new ValidationError(`Unable to find a valid endpoint for witness ${witness}.`);
+        return {
+            kind: "unreachable",
+            witness,
+            error: new ValidationError(`Unable to find a valid endpoint for witness ${witness}.`),
+        };
     }
-    const parsed = new URL(url);
-    if (parsed.protocol === "tcp:") {
-        yield* requireTcpDialer(http).messenger(url, clock, protocol).send(bytes, {
-            replies: Boolean(protocol),
-            local: true,
-        });
-        return;
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol === "tcp:") {
+            yield* requireTcpDialer(http).messenger(url, clock, protocol).send(bytes, {
+                replies: Boolean(protocol),
+                local: true,
+            });
+            return { kind: "delivered" };
+        }
+        const outcome = yield* new HTTPMessenger(url, http, {
+            destination: witness,
+            headers: auth ? { Authorization: auth } : undefined,
+        }).send(bytes);
+        if (outcome.kind === "refuse")
+            return { kind: "unreachable", witness, error: outcome.error };
+        return { kind: "delivered" };
+    }
+    catch (error) {
+        if (!(error instanceof TransportError))
+            throw error;
+        return { kind: "unreachable", witness, error };
     }
-    const outcome = yield* new HTTPMessenger(url, http, {
-        destination: witness,
-        headers: auth ? { Authorization: auth } : undefined,
-    }).send(bytes);
-    if (outcome.kind === "refuse")
-        throw outcome.error;
+}
+/**
+ * Send one message to a witness for callers that require delivery.
+ *
+ * @throws The delivery's remote failure (missing endpoint, peer refusal, transport) and any local failure.
+ */
+export function* sendWitnessMessage(hab, witness, bytes, http, clock, protocol, auth) {
+    const delivery = yield* deliverWitnessMessage(hab, witness, bytes, http, clock, protocol, auth);
+    if (delivery.kind === "unreachable")
+        throw delivery.error;
 }
 function isKeripyContentTypeRejection(status, contentType, responseText) {
     return status === 406

package/esm/keri/npm/src/app/witness/receipting.js

@@ -8,8 +8,12 @@ import { dgKey } from "../../db/core/keys.js";
 import { acceptedEventReplayMessage } from "../identity/habbing.js";
 import { chunkBytes } from "../transport/byte-source.js";
 import { processMessages } from "../transport/message-source.js";
-import { getWitnessReceiptEndpoint, pollWitnessReceipt, postWitnessReceiptEndpoint, sendWitnessMessage, witnessHttpUrl, witnessTcpUrl, } from "./receipt-client.js";
+import { TransportError } from "../transport/transport-error.js";
+import { deliverWitnessMessage, getWitnessReceiptEndpoint, pollWitnessReceipt, postWitnessReceiptEndpoint, witnessHttpUrl, witnessTcpUrl, } from "./receipt-client.js";
 import { buildDetachedReceiptMessage } from "./receipt-messages.js";
+function incomplete(witness, error) {
+    return { kind: "incomplete", witness, error };
+}
 /** Build one `loc/scheme` replay bundle for witness introductions. */
 function* witnessSchemeReplies(hab, eids, gvrsn) {
     const replies = eids
@@ -94,7 +98,17 @@ export class Receiptor {
         this.gvrsn = gvrsn;
     }
     /** Submit the latest or specified event to all witnesses and gather receipts. */
-    *receipt(pre, { sn, auths = {}, allowTcp = false } = {}) {
+    *receipt(pre, options = {}) {
+        const outcome = yield* this.attempt(pre, options);
+        if (outcome.kind === "incomplete")
+            throw outcome.error;
+        return outcome.result;
+    }
+    /**
+     * Submit like `receipt`, but report a witness that is unreachable, refuses, or does not receipt as
+     * `incomplete` data. Local faults (unknown local AID, missing key state, storage) still throw.
+     */
+    *attempt(pre, { sn, auths = {}, allowTcp = false } = {}) {
         return yield* call(() => this.receiptOnce(pre, { sn, auths }, allowTcp));
     }
     /**
@@ -118,11 +132,13 @@ export class Receiptor {
         const { serder, message } = acceptedEventReplayMessage(this.hby, pre, eventSn, this.gvrsn);
         const witnesses = this.hby.db.acceptedEventWitnesses(serder);
         if (witnesses.length === 0) {
-            return { witnesses: [], statuses: {} };
+            return { kind: "receipted", result: { witnesses: [], statuses: {} } };
         }
         if (serder.ilk === Ilks.rot || serder.ilk === Ilks.drt) {
             for (const witness of serder.adds) {
-                yield* this.catchup(pre, witness);
+                const caughtUp = yield* this.replayHistory(hab, witness);
+                if (caughtUp.kind === "unreachable")
+                    return incomplete(witness, caughtUp.error);
             }
         }
         const receiptGroups = new Map();
@@ -134,23 +150,35 @@ export class Receiptor {
         for (const witness of witnesses) {
             if (kever.delegated) {
                 for (const dmsg of this.hby.db.cloneDelegation(kever, this.gvrsn)) {
-                    yield* sendWitnessMessage(hab, witness, this.selected(dmsg), this.http, this.clock, this.protocol);
+                    const delivery = yield* deliverWitnessMessage(hab, witness, this.selected(dmsg), this.http, this.clock, this.protocol);
+                    if (delivery.kind === "unreachable")
+                        return incomplete(witness, delivery.error);
                 }
             }
             if (allowTcp && !witnessHttpUrl(hab, witness) && witnessTcpUrl(hab, witness)) {
-                yield* sendWitnessMessage(hab, witness, this.selected(message), this.http, this.clock, this.protocol);
+                const delivery = yield* deliverWitnessMessage(hab, witness, this.selected(message), this.http, this.clock, this.protocol);
+                if (delivery.kind === "unreachable")
+                    return incomplete(witness, delivery.error);
                 statuses[witness] = 200;
             }
             else {
                 // A single receipt attempt owns its response until parsing and collection finish.
-                let response = yield* call(() => postWitnessReceiptEndpoint(hab, witness, message, this.http, auths[witness], this.gvrsn));
-                if (response.kind === "escrow") {
-                    response = yield* pollWitnessReceipt(hab, witness, pre, eventSn, said, this.http, this.gvrsn);
+                let response;
+                try {
+                    response = yield* call(() => postWitnessReceiptEndpoint(hab, witness, message, this.http, auths[witness], this.gvrsn));
+                    if (response.kind === "escrow") {
+                        response = yield* pollWitnessReceipt(hab, witness, pre, eventSn, said, this.http, this.gvrsn);
+                    }
+                }
+                catch (error) {
+                    if (!(error instanceof TransportError))
+                        throw error;
+                    return incomplete(witness, error);
                 }
                 statuses[witness] = response.status;
                 if (response.kind !== "accepted") {
                     const detail = response.kind === "reject" ? response.message : "receipt remained escrowed";
-                    throw new ValidationError(`Witness ${witness} failed to receipt ${pre}:${eventSn.toString(16)}: ${detail}`);
+                    return incomplete(witness, new ValidationError(`Witness ${witness} failed to receipt ${pre}:${eventSn.toString(16)}: ${detail}`));
                 }
                 yield* processMessages((signal) => chunkBytes(response.body, { signal }), this.protocol, this.kvy, {
                     local: false,
@@ -161,7 +189,7 @@ export class Receiptor {
             const index = witnesses.indexOf(witness);
             const wigers = this.hby.db.wigs.get(dgKey(pre, said)).filter((siger) => siger.index === index);
             if (wigers.length === 0) {
-                throw new ValidationError(`Witness ${witness} did not receipt ${pre}:${eventSn.toString(16)}.`);
+                return incomplete(witness, new ValidationError(`Witness ${witness} did not receipt ${pre}:${eventSn.toString(16)}.`));
             }
             receiptGroups.set(witness, wigers);
         }
@@ -190,9 +218,11 @@ export class Receiptor {
                     pipelined: true,
                     genusify: true,
                 }));
-            yield* sendWitnessMessage(hab, witness, concatBytes(...parts), this.http, this.clock, this.protocol);
+            const delivery = yield* deliverWitnessMessage(hab, witness, concatBytes(...parts), this.http, this.clock, this.protocol);
+            if (delivery.kind === "unreachable")
+                return incomplete(witness, delivery.error);
         }
-        return { witnesses, statuses };
+        return { kind: "receipted", result: { witnesses, statuses } };
     }
     /**
      * Query a stored witness receipt and apply it to local state when found.
@@ -243,15 +273,27 @@ export class Receiptor {
         if (!hab) {
             throw new ValidationError(`${pre} not a valid local AID.`);
         }
+        const delivery = yield* this.replayHistory(hab, witness);
+        if (delivery.kind === "unreachable")
+            throw delivery.error;
+    }
+    /** Replay a delegated inception's delegation chain and the KEL to one witness, stopping at the first failure. */
+    *replayHistory(hab, witness) {
         const kever = hab.kever;
-        if (kever?.delegated) {
-            for (const msg of this.hby.db.cloneDelegation(kever, this.gvrsn)) {
-                yield* sendWitnessMessage(hab, witness, this.selected(msg), this.http, this.clock, this.protocol);
-            }
-        }
-        for (const msg of this.hby.db.clonePreIter(pre, 0, this.gvrsn)) {
-            yield* sendWitnessMessage(hab, witness, this.selected(msg), this.http, this.clock, this.protocol);
+        const db = this.hby.db;
+        const gvrsn = this.gvrsn;
+        const pre = hab.pre;
+        const messages = (function* () {
+            if (kever?.delegated)
+                yield* db.cloneDelegation(kever, gvrsn);
+            yield* db.clonePreIter(pre, 0, gvrsn);
+        })();
+        for (const msg of messages) {
+            const delivery = yield* deliverWitnessMessage(hab, witness, this.selected(msg), this.http, this.clock, this.protocol);
+            if (delivery.kind === "unreachable")
+                return delivery;
         }
+        return { kind: "delivered" };
     }
     /** Complete streams select their framing before the body; detached receipt headers retain their existing enclosure. */
     selected(message) {

package/esm/keri/npm/src/cli/messaging/multisig.js

@@ -16,7 +16,7 @@ import { telEventStatus, waitForIssuedCredential, waitForTelEvent, } from "../..
 import { endpointRoleAccepted, isLocalGroupHab, localGroupMember, proposeGroupEndpointRole, } from "../../app/identity/endpoint-roleing.js";
 import { MULTISIG_REV_ROUTE, MULTISIG_ROT_ROUTE, MULTISIG_VCP_ROUTE } from "../../app/multisig/grouping.js";
 import { routeForKelEvent } from "../../app/multisig/multisig-workflows.js";
-import { proposeGroupInception, proposeGroupInteraction, proposeGroupRotation, settleProposedRotation, } from "../../app/multisig/proposing.js";
+import { proposeGroupInception, proposeGroupInteraction, proposeGroupRotation, } from "../../app/multisig/proposing.js";
 import { observeUntil } from "../../app/runtime/workflow-contract.js";
 import { ValidationError } from "../../core/errors.js";
 import { isV2RegistryRoute } from "../../core/exchange/protocol-exchanging.js";
@@ -272,8 +272,9 @@ export function* multisigRotateCommand(args) {
         let delegationPhase = null;
         let rootCopies = [];
         if (accepted) {
-            // The proposer's own acceptance must commit the rotated membership as a joiner's does.
-            settleProposedRotation({ hby }, sent);
+            // Acceptance was read straight from the KEL, possibly before the Counselor's pass: follow it now, since the
+            // root copies below go to the rotated members.
+            hby.alignGroupMembers(sent.group);
             delegationPhase = yield* finishAcceptedEvent(hby, runtime, sent.event, commandArgs);
             rootCopies = yield* resealAfterRotation(hby, runtime, sent.group, sent.event.said, since);
         }