keri-ts 2.2.4 → 2.2.6

package/esm/keri/npm/src/app/ipex/issuance.js

@@ -22,6 +22,7 @@
  * | holder: pending Grant, no root held                                       | `awaitingExchangeConsent`                |
  * | pending Grant past its deadline                                           | `expired`                                |
  * | holder: root held, not committed otherwise; issuer: update accepted       | `active`, `rootRetained` (adopted)       |
+ * | group member: root copy received or the custodian's final proof stored    | `active`, `awaitingAnchor` (followed)    |
  * | issuer: pending Grant, update not accepted                                | `interrupted`                            |
  * | root held and the registry committed to another exchange                  | `interrupted`                            |
  * | holder: Grant accepted, no accepted Admit                                 | `active`, `awaitingAdmitConsent`         |
@@ -54,9 +55,12 @@
  * `{kind: "issuance", id: <grant>}` and the embedder records it.
  *
  * A local group issues and receives through the same table, status and wait: its consent calls and per-operation
- * steps are in `group-issuance.ts` and run inside the same `processOnce`. A group exchange is not resumed after a
- * restart (its frozen coordinator and custodian are not stored): a group pending Grant with no root reads
- * `awaitingExchangeConsent`, and a member consents again with the same call.
+ * steps are in `group-issuance.ts` and run inside the same `processOnce`. A group exchange in progress is not
+ * resumed after a restart (its frozen coordinator and custodian are not stored): a group pending Grant with no root
+ * reads `awaitingExchangeConsent`, and a member consents again with the same call. The custodian that retained the
+ * root is adopted once the stores allow it, and a member the group completed without is followed: the same sweep
+ * that finds resumable Grants begins the proof-only follow of each group Grant whose custodian's final proof is
+ * stored, signing nothing, so a restart begins it again.
  *
  * Collaborators are narrow concrete owners (ADR-0013); no `AgentRuntime`.
  */
@@ -65,27 +69,29 @@ import { call, race } from "effection";
 import { RegistryAuthor } from "../../acdc/authoring.js";
 import { RegistryCustody } from "../../acdc/custody.js";
 import { grantTransactionId, registryUncommitted, resumableExchange } from "../../acdc/dhking.js";
-import { ValidationError } from "../../core/errors.js";
+import { QUERY_RESEND_MS } from "../../acdc/query-resend.js";
+import { KramRefusedError, ValidationError } from "../../core/errors.js";
 import { CREDENTIAL_MAILBOX_TOPIC } from "../../core/mailbox/mailbox-topics.js";
 import { timestampMicros } from "../../time/mod.js";
 import { groupSigningMembers, isLocalGroupHab, localGroupMember } from "../multisig/group-members.js";
 import { remoteGroupMembers } from "../multisig/multisig-messaging.js";
 import { DeliveryOutbox, } from "../runtime/delivery-outbox.js";
 import { observeUntil, waitOnClock } from "../runtime/workflow-contract.js";
-import { deriveGroupCustody, GroupIssuance, GroupParty, registerGroupRoutes, stepGroup, } from "./group-issuance.js";
+import { awaitsGroupProof, beginGroupProofFollow, deriveGroupCustody, GroupIssuance, GroupParty, registerGroupRoutes, stepGroup, storedGroupProof, } from "./group-issuance.js";
 import { IpexAdmitter } from "./ipex-admitting.js";
-import { exchangeWire, IpexDiscloser, storedExchangeWire } from "./ipex-discloser.js";
+import { exchangeWire, IpexDiscloser, storedExchangeWire, } from "./ipex-discloser.js";
 /**
- * Milliseconds between resends of the issuer query. Each resend is a new query (new date, SAID and signatures):
- * the peer's KRAM caches every query it accepts, so an identical resend is a replay it drops, which would
- * strand a peer that took the first query and then lost it before consenting (a process that ended, or a
- * retained query that outlived its window).
+ * Milliseconds between the first resends of the issuer query, which the holder may have lost before consenting (a
+ * process that ended, or a retained query that outlived its window). A single-signer issuer re-dates every resend
+ * (new date, SAID and signatures): the peer's KRAM caches every query it accepts, so an identical resend would be
+ * a replay it drops. A group cannot re-date (re-signing needs the members), so it resends the same bytes, doubling
+ * this interval up to a cap and stopping once the query is older than the multi-key acceptance window.
  */
-export const ISSUANCE_QUERY_RESEND_MS = 1000;
+export const ISSUANCE_QUERY_RESEND_MS = QUERY_RESEND_MS;
 /**
- * Milliseconds between scans of the pending exchange escrow for Grants a restarted process can finish. The scan
- * repeats because what makes a Grant resumable can arrive after the restart (an issuer's update accepted once the
- * other members approve it).
+ * Milliseconds between scans of the pending exchange escrow for Grants a restarted process can finish and group
+ * Grants whose final proof a member follows. The scan repeats because what makes a Grant resumable can arrive after
+ * the restart (an issuer's update accepted once the other members approve it), and a custodian's proof arrives late.
  */
 export const ISSUANCE_SWEEP_MS = 5_000;
 /** The key of one party's operation on a Grant. */
@@ -219,23 +225,27 @@ export class IssuanceOperations {
     remember(grant, ended) {
         this.ended.set(partyKey(grant, ended.role), ended);
     }
-    /** Whether a pass has work: a live operation, or the one-time scan for resumable Grants has not run. */
+    /** Whether a pass has work: a live operation, an adoption still owed, or a sweep of the pending Grants is due. */
     active() {
         return this.live.size > 0 || this.stale.length > 0 || this.deps.clock.now() >= this.nextSweep;
     }
     /**
      * Advance every live operation by one pass. Each pass is bounded by the operation's Grant deadline.
-     * The first pass also adopts the pending Grants the stores prove resumable ({@link resumableGrants});
-     * that signs and sends nothing.
+     * Every {@link ISSUANCE_SWEEP_MS} a pass also scans the pending exchange escrow once ({@link sweptGrants}): it
+     * adopts the Grants the stores prove resumable and begins the proof-only follow of the group Grants whose
+     * custodian's proof is stored. Neither signs nor sends anything.
      */
     *processOnce() {
         if (this.deps.clock.now() >= this.nextSweep) {
             this.nextSweep = this.deps.clock.now() + ISSUANCE_SWEEP_MS;
             const known = new Set(this.stale.map(({ grant, role }) => partyKey(grant, role)));
-            this.stale.push(...resumableGrants(this.deps).filter(({ grant, role }) => {
+            const swept = sweptGrants(this.deps, (grant, role) => {
                 const key = partyKey(grant, role);
-                return !this.live.has(key) && !known.has(key) && !this.refused.has(key) && !this.ended.has(key);
-            }));
+                return this.live.has(key) || known.has(key) || this.refused.has(key) || this.ended.has(key);
+            });
+            this.stale.push(...swept.resumable);
+            for (const found of swept.follows)
+                this.follow(found);
         }
         for (const found of [...this.stale]) {
             if (yield* this.settle(found))
@@ -249,6 +259,10 @@ export class IssuanceOperations {
                 const left = op.expires === null ? null : op.expires - BigInt(this.deps.clock.now()) * 1000n;
                 if (left !== null && left <= 0n)
                     this.end(op, "expired", EXPIRED);
+                // A habitat that cannot sign yet waits for its signer; only its Grant deadline ends the operation meanwhile.
+                // A proof-only follow signs nothing, so it proceeds without one.
+                else if (!op.hab.canSign() && op.group?.mode !== "proofOnly")
+                    continue;
                 else if ((yield* race([this.advance(op), ...(left === null ? [] : [this.timer(Number(left) / 1000)])])) === "expired")
                     this.end(op, "expired", EXPIRED);
             }
@@ -263,7 +277,8 @@ export class IssuanceOperations {
     /** End a live operation: release its DH approval, remember why until the process ends, tell the sink. */
     end(op, state, reason) {
         this.release(op);
-        this.ended.set(partyKey(op.grant, op.role), { role: op.role, state, reason });
+        const deadline = state === "expired" ? op.deadline : null;
+        this.ended.set(partyKey(op.grant, op.role), { role: op.role, state, reason, ...(deadline && { deadline }) });
         this.deps.changes?.push({ kind: "issuance", id: op.grant });
     }
     /**
@@ -277,6 +292,14 @@ export class IssuanceOperations {
             this.end(op, "abandoned", reason);
         return bound.map(op => op.grant);
     }
+    /** Grants of the live operations, and of those found resumable and not yet adopted, whose habitat is `pre`. */
+    grantsOf(pre) {
+        const grants = [...this.live.values()].filter(op => op.hab.pre === pre).map(op => op.grant);
+        for (const found of this.stale)
+            if (found.hab.pre === pre)
+                grants.push(found.grant);
+        return [...new Set(grants)];
+    }
     /** Drop the live entry and the DH approval; a missing approval means the owner already closed. */
     release(op) {
         this.live.delete(partyKey(op.grant, op.role));
@@ -324,6 +347,24 @@ export class IssuanceOperations {
         }
         return true;
     }
+    /**
+     * Begin the proof-only follow a sweep found, under the stored proof's election; it signs nothing, so it needs no
+     * unlocked Keeper. A refusal means the stores no longer support it: the Grant then reads from them and is not tried
+     * again in this process. Any other failure is this Grant's alone and ends it `failed`, as for an adoption.
+     */
+    follow(found) {
+        const key = partyKey(found.grant, found.role);
+        try {
+            beginGroupProofFollow(this, found.grant, found.role, found.election.coordinator.said);
+        }
+        catch (error) {
+            this.refused.add(key);
+            if (!(error instanceof ValidationError)) {
+                this.ended.set(key, { role: found.role, state: "failed", reason: message(error) });
+                this.deps.changes?.push({ kind: "issuance", id: found.grant });
+            }
+        }
+    }
     /** Rebuild the live entry of a resumable Grant from the stored Grant and the held roots. */
     *adopt({ hab, grant, role }) {
         const group = isLocalGroupHab(this.deps.hby, hab);
@@ -345,7 +386,7 @@ export class IssuanceOperations {
             peer: wires ? retained.serder.sad.ri : retained.serder.pre,
             registry: credential.regid,
             expires,
-            issuer: wires ? { credential, ...wires, query: null, sent: true, nextQuery: 0 } : undefined,
+            issuer: wires ? { credential, ...wires, query: null, sent: true, supportMark: null, nextQuery: 0 } : undefined,
             phase: "rootRetained",
             outbox: new DeliveryOutbox(this.deps.retry),
             finished: false,
@@ -442,7 +483,8 @@ export class IssuanceOperations {
     }
     /**
      * Record one group operation the user consented to ({@link approveGroupIssuance},
-     * {@link approveGroupIssuanceExchange}, {@link followGroupIssuanceProof}). A holder approves DH here, with its
+     * {@link approveGroupIssuanceExchange}), or a proof-only follow, which needs no consent ({@link beginGroupProofFollow},
+     * begun by the sweep or by {@link followGroupIssuanceProof}). A holder approves DH here, with its
      * consent; an issuer approves once the group has authenticated the Grant.
      */
     beginGroup(group) {
@@ -482,6 +524,7 @@ export class IssuanceOperations {
                 dest: op.peer,
                 msg: concatBytes(this.discloser.proofSupport(issuer.raw, op.hab), issuer.grantWire),
             });
+            issuer.supportMark = this.discloser.proofSupportMark(issuer.raw, op.hab);
             issuer.sent = true;
         }
         while (op.dh.outgoing.length) {
@@ -551,7 +594,11 @@ export class IssuanceOperations {
         yield* op.dh.finish(op.xid);
         if (!this.deps.exc.complete(op.grant))
             throw new ValidationError("Issued Grant remains unaccepted");
-        this.enqueue(op, { src: op.hab.pre, dest: op.peer, msg: this.discloser.proofSupport(issuer.raw, op.hab) });
+        // The Grant send already carried the support; proving added the anchoring event and the registry update.
+        const support = issuer.supportMark
+            ? this.discloser.proofSupportSince(issuer.raw, op.hab, issuer.supportMark)
+            : this.discloser.proofSupport(issuer.raw, op.hab);
+        this.enqueue(op, { src: op.hab.pre, dest: op.peer, msg: support });
         op.finished = true;
     }
 }
@@ -559,6 +606,20 @@ export class IssuanceOperations {
 function reached(clock, expires) {
     return expires !== null && BigInt(clock.now()) * 1000n >= expires;
 }
+/**
+ * Refuse a Grant whose exchange deadline has passed with the KRAM lifetime refusal that names that deadline,
+ * so a caller learns why the Grant can no longer be acted on rather than that it is unknown. The deadline
+ * outlives the Grant's KRAM cache row and its ejection from escrow ({@link Exchanger.exchangeExpiry}). Returns
+ * when the Grant has no known deadline or is still inside it; the caller then raises its own refusal.
+ *
+ * @throws KramRefusedError (reason `lifetime`) once the deadline has passed.
+ */
+function refuseLapsedGrant(deps, grant) {
+    const deadline = deps.exc.exchangeExpiry(grant);
+    if (deadline && reached(deps.clock, timestampMicros(deadline))) {
+        throw new KramRefusedError(grant, { kind: "drop", reason: "lifetime", deadline });
+    }
+}
 /**
  * Whether a restarted process can complete this Grant without a new key exchange: it is pending inside its
  * deadline, `hab` is the party `role` names, and {@link resumableExchange} finds the roots. An issuer
@@ -585,23 +646,43 @@ function grantParties(hby, grant) {
     return issuer || holder ? { serder, issuer, holder } : null;
 }
 /**
- * Every pending Grant the stores prove a restarted process can finish: one scan of the pending exchange
- * escrow, made once when the owner first runs. A pure read.
+ * One scan of the pending exchange escrow, made every {@link ISSUANCE_SWEEP_MS}: each local party of a pending Grant
+ * that `skip` does not exclude (the owner skips what it holds live, ended, refused or already found) is either
+ * resumable, or a group member that follows the custodian's stored proof ({@link followable}). A pure read.
  */
-function resumableGrants(deps) {
-    const found = [];
+function sweptGrants(deps, skip) {
+    const swept = { resumable: [], follows: [] };
     for (const [[grant]] of [...deps.hby.db.epse.getTopItemIter()]) {
         const parties = grantParties(deps.hby, grant);
         if (!parties)
             continue;
-        if (parties.issuer && resumable(deps, parties.issuer, grant, "issuer")) {
-            found.push({ hab: parties.issuer, grant, role: "issuer" });
-        }
-        if (parties.holder && resumable(deps, parties.holder, grant, "holder")) {
-            found.push({ hab: parties.holder, grant, role: "holder" });
+        for (const [hab, role] of [[parties.issuer, "issuer"], [parties.holder, "holder"]]) {
+            if (!hab || skip(grant, role))
+                continue;
+            if (resumable(deps, hab, grant, role)) {
+                swept.resumable.push({ hab, grant, role });
+                continue;
+            }
+            const election = followable(deps, hab, grant, role, parties.serder);
+            if (election)
+                swept.follows.push({ hab, grant, role, election });
         }
     }
-    return found;
+    return swept;
+}
+/**
+ * The election under which the local member of group `hab` follows `grant` to its final proof, or null: the party's
+ * side is not complete, the Grant is inside its exchange deadline, and the custodian's proof is stored
+ * ({@link storedGroupProof}). Only the proof decides it, never the member's weight: a member that should sign is not
+ * followed, because the proof exists only once the key exchange no longer wants any signature.
+ */
+function followable(deps, hab, grant, role, serder) {
+    if (!isLocalGroupHab(deps.hby, hab) || partyComplete(deps, grant, role))
+        return null;
+    const deadline = deps.exc.exchangeDeadline(serder), expires = deadline ? timestampMicros(deadline) : null;
+    if (expires === null || reached(deps.clock, expires))
+        return null;
+    return storedGroupProof(deps, hab, grant);
 }
 /** The terminal reading of a pending Grant no process can complete: ended by a restart, or by another exchange. */
 function orphaned(deps, hab, grant) {
@@ -641,7 +722,8 @@ function requireIndividual(deps, hab) {
 }
 /**
  * The exact unanchored pending Grant a local party may consent to, with its deadline. Refuses a group
- * identifier, an issuance already begun, a Grant that is not this party's, and an issuer without its registry.
+ * identifier, an issuance already begun, a Grant that is not this party's, and an issuer without its registry;
+ * a Grant past its deadline is refused with `KramRefusedError`.
  */
 function selectGrant(ops, hab, grant, role, group = false) {
     const { deps } = ops;
@@ -655,6 +737,7 @@ function selectGrant(ops, hab, grant, role, group = false) {
     if (!retained || !(credential instanceof SerderACDC) || !credential.regid
         || (role === "issuer" ? retained.serder.pre : retained.serder.sad.ri) !== hab.pre
         || retained.sourceSeals?.length || retained.ptds?.length || retained.essrs?.length) {
+        refuseLapsedGrant(deps, grant);
         throw new ValidationError("Select the exact unanchored pending issuance Grant for this local party");
     }
     const reg = deps.rgy.regs.get(credential.regid);
@@ -689,12 +772,15 @@ function* grantWires(retained) {
  *
  * @throws ValidationError for a Grant that is not this identifier's exact
  * unanchored pending issuance, an unmanaged registry, a group identifier, or
- * an issuance already begun or completed.
+ * an issuance already begun or completed; its subclass `KramRefusedError`
+ * (reason `lifetime`, with the deadline) for a Grant past its exchange deadline.
  */
 export function* beginIssuance(ops, grant, auths) {
     const { deps } = ops, hab = grantParties(deps.hby, grant)?.issuer;
-    if (!hab)
+    if (!hab) {
+        refuseLapsedGrant(deps, grant);
         throw new ValidationError("Select the exact unanchored pending issuance Grant for this local party");
+    }
     const { retained, credential, deadline, expires } = selectGrant(ops, hab, grant, "issuer");
     const { raw, grantWire } = yield* grantWires(retained);
     const dh = deps.dhkes.dhke(hab), xid = dh.approve(grant), query = dh.start(grant);
@@ -708,7 +794,7 @@ export function* beginIssuance(ops, grant, auths) {
         peer: retained.serder.sad.ri,
         registry: credential.regid,
         expires,
-        issuer: { credential, raw, grantWire, query, auths, sent: false, nextQuery: 0 },
+        issuer: { credential, raw, grantWire, query, auths, sent: false, supportMark: null, nextQuery: 0 },
         phase: "exchangingKeys",
         outbox: new DeliveryOutbox(ops.deps.retry),
         finished: false,
@@ -730,14 +816,18 @@ export function* proposeIssuance(ops, draft, auths) {
  * operation holds reads `interrupted` (or `expired` once the Grant deadline has passed); that is a
  * statement, not a write.
  *
+ * @throws KramRefusedError (reason `lifetime`, with the deadline) when the Grant's deadline has passed and the
+ * stores no longer hold what a status needs: KRAM pruned its cache row, or the escrow sweep ejected the Grant.
  * @throws ValidationError when `grant` is not a v2 Grant this runtime's identifiers are party to.
  */
 export function issuanceStatus(ops, grant, party = {}) {
     const { deps } = ops, parties = grantParties(deps.hby, grant);
     const chosen = chooseParty(parties, party);
     const ended = ops.endedOf(grant, chosen), live = ops.liveOf(grant, chosen);
-    if (ended)
-        return { state: ended.state, role: ended.role, reason: ended.reason };
+    if (ended) {
+        const { state, role, reason, deadline } = ended;
+        return { state, role, reason, ...(deadline && { deadline }) };
+    }
     if (live && !reached(deps.clock, live.expires)) {
         return {
             state: "active",
@@ -747,8 +837,10 @@ export function issuanceStatus(ops, grant, party = {}) {
             ...(live.outbox.failure && { failure: live.outbox.failure }),
         };
     }
-    if (!parties)
+    if (!parties) {
+        refuseLapsedGrant(deps, grant);
         throw new ValidationError("No issuance was begun for this Grant");
+    }
     const { serder, issuer, holder } = parties, db = deps.hby.db;
     if (partyComplete(deps, grant, chosen)) {
         const admitted = !!db.erpy.get([grant]);
@@ -763,16 +855,22 @@ export function issuanceStatus(ops, grant, party = {}) {
     // A group issuer's partial Grant has no accepted lifetime until its members' contributions authenticate it.
     const lifetime = deps.exc.exchangeDeadline(serder) ?? undefined;
     const deadline = lifetime, expires = lifetime ? timestampMicros(lifetime) : null;
-    if (!group && (!deadline || expires === null))
+    if (!group && (!deadline || expires === null)) {
+        // KRAM pruned the Grant's cache row at its deadline, before the escrow sweep ejected the Grant.
+        refuseLapsedGrant(deps, grant);
         throw new ValidationError("No issuance was begun for this Grant");
+    }
     if (reached(deps.clock, expires)) {
         const credential = deps.exc.retainedInput(grant)?.nests?.[0]?.body;
         const registry = credential instanceof SerderACDC ? credential.regid : undefined;
         const late = role === "holder" && registry && deps.rgy.store.headEvent(registry)?.ilk === "bup";
-        return { state: "expired", role, reason: late ? EXPIRED_LATE : EXPIRED };
+        return { state: "expired", role, reason: late ? EXPIRED_LATE : EXPIRED, deadline };
     }
     if (resumable(deps, hab, grant, role))
         return { state: "active", role, phase: "rootRetained", deadline };
+    // The group completed without this member: the owner follows the custodian's proof once it is stored.
+    if (group && awaitsGroupProof(deps, hab, grant))
+        return { state: "active", role, phase: "awaitingAnchor", deadline };
     if ((role === "holder" || group) && !heldRoot(deps, hab, grant)) {
         // A group issuer's Grant may still be a partial one that only its members' contributions authenticate.
         if (!group && !deps.exc.retainedInput(grant, { pending: true })) {
@@ -892,11 +990,16 @@ export function* waitForIssuance(ops, grant, { timeoutMs, clock = ops.deps.clock
  * The holder's consent to the DH exchange for one pending Grant addressed to a local identifier. Approves DH and records the
  * consent; `processOnce` then answers the issuer's query, waits for its registry update and finishes the Grant.
  * Admitting the credential is a separate consent ({@link admitIssuance}).
+ *
+ * @throws KramRefusedError (reason `lifetime`, with the deadline) for a Grant past its exchange deadline, and
+ * ValidationError for any other Grant this holder cannot consent to.
  */
 export function approveIssuanceExchange(ops, grant) {
     const { deps } = ops, hab = grantParties(deps.hby, grant)?.holder;
-    if (!hab)
+    if (!hab) {
+        refuseLapsedGrant(deps, grant);
         throw new ValidationError("Select the exact unanchored pending issuance Grant for this local party");
+    }
     const { retained, credential, deadline, expires } = selectGrant(ops, hab, grant, "holder");
     const dh = deps.dhkes.dhke(hab), xid = dh.approve(grant);
     ops.begin({

package/esm/keri/npm/src/app/ipex/pending-presentations.js

@@ -49,7 +49,9 @@ export function pendingPresentations(ops, { hab } = {}) {
 /**
  * The accepted v2 Applies addressed to a local identifier (to `hab` when given) that no exchange has answered
  * (no `erpy` pointer) and whose deadline has not passed; with `includeAnswered`, the answered ones too. Mutates
- * nothing. A group member lists the Applies of its group once the group has accepted them.
+ * nothing. A group member lists the Applies of its group once the group has accepted them. The deadline is the
+ * Apply's own stamp plus the exchange window once KRAM has pruned its cache row, so an expired Apply stays
+ * omitted after the prune.
  */
 export function pendingApplies(deps, { hab, includeAnswered = false } = {}) {
     const { hby, exc, clock } = deps, found = [];
@@ -65,7 +67,7 @@ export function pendingApplies(deps, { hab, includeAnswered = false } = {}) {
         const answer = hby.db.erpy.get([apply])?.qb64 ?? null;
         if (answer && !includeAnswered)
             continue;
-        const deadline = exc.exchangeDeadline(serder), expiry = deadline ? timestampMicros(deadline) : null;
+        const deadline = exc.exchangeExpiry(apply), expiry = deadline ? timestampMicros(deadline) : null;
         if (!answer && expiry !== null && now >= expiry)
             continue;
         const q = serder.sad?.q;

package/esm/keri/npm/src/app/ipex/presenting.js

@@ -47,7 +47,6 @@ import { DeliveryOutbox } from "../runtime/delivery-outbox.js";
 import { observeUntil, waitOnClock } from "../runtime/workflow-contract.js";
 import { proposeGroupIpex, proposeGroupIpexAfter as groupIpexAfter, } from "./group-ipex.js";
 import { IpexDiscloser, storedExchangeWire, } from "./ipex-discloser.js";
-import { prepareAcdcV2GroupIpex } from "./ipex-grouping.js";
 /** How long delivery failures may last on an exchange with no deadline (an Apply, an Agree) before it reads `failed`. */
 export const PRESENTATION_RETRY_BOUND_MS = 600_000;
 const EXPIRED = "The presentation reached its original exchange deadline";
@@ -220,7 +219,7 @@ export function* proposeGroupPresentation(deps, groupIpex, { hab, selection, opt
     const { presentationRegistry, ...body } = options;
     const gvrsn = body.gvrsn ?? undefined;
     const discloser = discloserFor(deps, hab, selection.derive);
-    let prepared = yield* discloser.prepareGrantBody(hab.pre, selection, body);
+    const prepared = yield* discloser.prepareGrantBody(hab.pre, selection, body);
     if (!presentationRegistry) {
         return yield* proposeGroupIpex(groupIpex, { hab, exn: prepared.exn, nests: prepared.nests, gvrsn, deliver });
     }
@@ -237,26 +236,12 @@ export function* proposeGroupPresentation(deps, groupIpex, { hab, selection, opt
     // The Grant SAID is frozen before the update is anchored; only its nested proof is extended afterwards.
     const [proof, update] = reg.present(prepared.exn, "presented", { stamp: body.stamp });
     const proposed = yield* proposeRegistryEvent(proposals, hab, update, proof, counsel);
-    const exn = prepared.exn;
     return groupIpexAfter(groupIpex, {
         hab,
-        exn,
+        exn: prepared.exn,
         gvrsn,
         deliver,
-        prerequisite: {
-            anchor: registryEventRef(update, proposed.event),
-            *proceed() {
-                const seal = deps.rgy.store.anchor(update.said);
-                if (!seal)
-                    throw new ValidationError("The presentation update is accepted but its anchor is unavailable");
-                prepared = yield* discloser.attachPresentationProof(prepared, proof, { s: seal[0], d: seal[1] });
-                const candidate = concatBytes(Counter.makeGVC(gvrsn ?? Vrsn_2_0), prepared.exn.raw, Counter.enclose({ qb64: prepared.nests, version: gvrsn ?? Vrsn_2_0 }));
-                const own = yield* prepareAcdcV2GroupIpex(deps.hby, groupIpex.deps.protocol, hab, candidate);
-                if (!own)
-                    throw new ValidationError("ACDC v2 group disclosure awaits authenticating dependencies.");
-                return own;
-            },
-        },
+        prerequisite: { anchor: registryEventRef(update, proposed.event), grant: prepared, opening: proof },
     });
 }
 /**

package/esm/keri/npm/src/app/ipex/receive-issuance.js

@@ -48,7 +48,8 @@ export function* admitAndDeliver(deps, input) {
  * wait for the issuer to finish it, then admit and deliver ({@link admitAndDeliver}).
  *
  * @throws ValidationError for a Grant that is not addressed to a local identifier, one this runtime issued, or a
- * group identifier.
+ * group identifier; its subclass `KramRefusedError` (reason `lifetime`, with the deadline) for a Grant whose
+ * deadline passed before the stores could say more (its cache row pruned or the Grant ejected from escrow).
  */
 export function* receiveIssuance(ops, input) {
     const { grant, timeoutMs } = input, { deps } = ops;

package/esm/keri/npm/src/app/ipex/unblinding-workflow.js

@@ -28,9 +28,10 @@
  */
 import { bytesEqual, collectPayload, framePayload, parseBytes, SerderKERI, Vrsn_2_0 } from "cesr-ts";
 import { call, race } from "effection";
+import { QUERY_RESEND_MS, ThresholdQueryResend } from "../../acdc/query-resend.js";
 import { Unblind } from "../../acdc/unblinding.js";
 import { ValidationError } from "../../core/errors.js";
-import { singleKeyQueryWindow } from "../../core/mailbox/kram-policy.js";
+import { multiKeyQueryWindow, singleKeyQueryWindow } from "../../core/mailbox/kram-policy.js";
 import { timestampMicros } from "../../time/mod.js";
 import { groupSigningMembers, isLocalGroupHab, localGroupMember } from "../multisig/group-members.js";
 import { MULTISIG_QRY_ROUTE, MULTISIG_RPY_ROUTE, multisigExnBody } from "../multisig/grouping.js";
@@ -38,8 +39,13 @@ import { remoteGroupMembers } from "../multisig/multisig-messaging.js";
 import { envelopeFromFrame } from "../protocol/parsering.js";
 import { DeliveryOutbox } from "../runtime/delivery-outbox.js";
 import { observeUntil, waitOnClock } from "../runtime/workflow-contract.js";
-/** Milliseconds between resends of the unchanged disclosee query, as `tufa ipex unblind` does. */
-export const UNBLIND_QUERY_RESEND_MS = 1000;
+/**
+ * Milliseconds between the first resends of the disclosee query, as `tufa ipex unblind` does. A single-signer
+ * requester sends the signed bytes unchanged while they are timely and re-dates them once older than the
+ * single-key window. A group requester cannot re-date (re-signing needs the members), so it resends the same
+ * bytes, doubling this interval up to a cap and stopping once the query is older than the multi-key window.
+ */
+export const UNBLIND_QUERY_RESEND_MS = QUERY_RESEND_MS;
 /** The key of one party's operation on a Grant. */
 export function unblindingKey(grant, role) {
     return `${role}:${grant}`;
@@ -96,6 +102,13 @@ class GroupUnblind {
             writable: true,
             value: false
         });
+        /** The frozen threshold query a requester resends unchanged, with its backoff schedule. */
+        Object.defineProperty(this, "resend", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new ThresholdQueryResend()
+        });
     }
 }
 const EXPIRED = "The presentation reached its original exchange deadline";
@@ -186,14 +199,16 @@ export class UnblindingOperations {
     }
     /**
      * Whether a pass has work: a live operation, or an owner holds an authenticated peer query whose reply is
-     * owed (an in-memory walk of the owners, no store read).
+     * owed (an in-memory walk of the owners, no store read). Finding what is owed reprocesses held queries, which
+     * answers them (signs), so an owner whose habitat cannot sign yet is skipped here as it is in `adopt`.
      */
     active() {
         if (this.live.size > 0)
             return true;
-        for (const owner of this.deps.unblinds.unblindOwners())
-            if (owner.awaitingReply().length)
+        for (const owner of this.deps.unblinds.unblindOwners()) {
+            if (owner.hab.canSign() && owner.awaitingReply().length)
                 return true;
+        }
         return false;
     }
     /** Advance every live operation by one pass, each bounded by its Grant deadline. */
@@ -208,6 +223,9 @@ export class UnblindingOperations {
                 const left = op.expires - BigInt(deps.clock.now()) * 1000n;
                 if (left <= 0n)
                     this.end(op, "expired", this.expiry(op));
+                // A habitat that cannot sign yet waits for its signer; only its Grant deadline ends the operation meanwhile.
+                else if (!op.hab.canSign())
+                    continue;
                 else if ((yield* race([this.advance(op), this.timer(Number(left) / 1000)])) === "expired") {
                     this.end(op, "expired", this.expiry(op));
                 }
@@ -233,6 +251,10 @@ export class UnblindingOperations {
     adopt() {
         const { deps } = this;
         for (const owner of deps.unblinds.unblindOwners()) {
+            // Finding what is owed reprocesses held queries, which answers them (signs); an owner whose habitat cannot
+            // sign yet is asked on a later pass.
+            if (!owner.hab.canSign())
+                continue;
             for (const { xid, grant } of owner.awaitingReply()) {
                 if (this.live.has(unblindingKey(grant, "responder")))
                     continue;
@@ -297,6 +319,10 @@ export class UnblindingOperations {
             this.end(op, "abandoned", reason);
         return bound.map(op => op.grant);
     }
+    /** Grants of the live Unblind operations whose habitat is `pre`. */
+    grantsOf(pre) {
+        return [...new Set([...this.live.values()].filter(op => op.hab.pre === pre).map(op => op.grant))];
+    }
     /** Drop the live entry and the owner's approval and frozen messages; delivered bytes stay the peer's. */
     release(op) {
         this.live.delete(unblindingKey(op.grant, op.role));
@@ -396,7 +422,7 @@ export class UnblindingOperations {
                     yield* broadcast(message.msg);
             }
             else if (message.kin === "query")
-                op.query = message.msg;
+                g.resend.set(message.msg);
             else if (!g.finished) {
                 yield* owner.finish(xid); // Validate exact evidence; no issuer-state admission policy here.
                 g.finished = true;
@@ -415,10 +441,12 @@ export class UnblindingOperations {
                 yield* owner.finish(xid);
             return this.finishedStep(op);
         }
-        // A threshold query cannot be re-dated by one member: it is resent unchanged.
-        if (op.query && deps.clock.now() >= op.nextQuery) {
-            yield* send(op.peer, op.query);
-            op.nextQuery = deps.clock.now() + UNBLIND_QUERY_RESEND_MS;
+        // A threshold query cannot be re-dated by one member: it is resent unchanged, with backoff, while the
+        // discloser can still accept it. The operation keeps waiting past that, to its own deadline.
+        const now = deps.clock.now();
+        if (g.resend.ready(now) && g.resend.fresh(now, multiKeyQueryWindow(deps.hby.db, Unblind.Route))) {
+            yield* send(op.peer, g.resend.query);
+            g.resend.sent(now, UNBLIND_QUERY_RESEND_MS);
         }
         return "stepped";
     }