@quo-systems/quo 0.1.0

package/src/ward/owner.ts

@@ -0,0 +1,122 @@
+// SPDX-License-Identifier: Apache-2.0
+// The owner's asks. The root owner holds the ask pointer; every other owner
+// is an occupant of the ward itself, invited by the root. Five asks:
+// describe, boot, invite, knock, remove. The knock is a being's knock made
+// for her, and the standing is written into her cells under the id the
+// owner gave; remove takes a relation out of her by id, the mirror of it.
+import { isSilence, isUnreached } from '../being/silence.ts';
+import { digest } from '../being/digest.ts';
+import { OWNER } from '../being/types.ts';
+import type { Asker, Invitation, Json, JsonObject, Wanted } from '../being/types.ts';
+
+export type OwnerSide = {
+  pk: string;
+  doors: Map<
+    string,
+    {
+      key: string;
+      being: { answer: (...a: never[]) => unknown };
+      cells: { class?: string; occupants: Record<string, unknown>; standings: Record<string, unknown> };
+      stance: { occupants: { invite(id: string): Promise<Invitation | null>; remove(id: string): void }; standings: { knock(inv: Invitation, m?: string, a?: JsonObject, w?: Wanted): Promise<unknown>; take(id: string, inv: Invitation): Promise<string | null>; remove(id: string): void } };
+    }
+  >;
+  publicKey(): string | null;
+  instantiate(key: string, className: string, isPublic?: boolean): { key: string } | null;
+};
+
+export const OWNER_ASKS = ['boot', 'invite', 'knock', 'remove'] as const;
+
+export async function ownerAnswer(w: OwnerSide, asker: Asker, method: string | undefined, args: JsonObject): Promise<Json> {
+  // Every name the owner gives is a word. Coerced instead of checked, an
+  // object passed where a name belongs becomes the string "[object Object]",
+  // and two owners who each got the shape wrong would be handed one being.
+  const word = (v: unknown): string | null => (typeof v === 'string' ? v : null);
+
+  if (method === undefined) return describe(w);
+  if (method === 'boot') {
+    // A ward may have one public being, and no more. Marking a second would
+    // leave the first holding every relation she had, reachable by nobody at
+    // the bare pk, and told by nobody that she had been replaced.
+    if (args.public === true && w.publicKey() !== null) return { error: 'a ward has one public being' };
+    const key = word(args.key),
+      className = word(args.class);
+    if (key === null || className === null) return { error: 'no such class, or key taken' };
+    const door = w.instantiate(key, className, args.public === true);
+    return door ? { booted: door.key } : { error: 'no such class, or key taken' };
+  }
+  if (method === 'invite') {
+    // On the ward itself, only the root may invite: an occupant of the ward
+    // is an owner, and ownership is minted by the ask pointer alone. An owner
+    // at the door asking to invite on the ward is refused, so that a carried
+    // key can pilot but never hand piloting on.
+    const being = word(args.being),
+      id = word(args.id);
+    if (being === null || id === null) return { error: 'no such being' };
+    if (being === w.pk && asker.id !== OWNER) return { error: 'no such being' };
+    const door = w.doors.get(being);
+    return door ? await door.stance.occupants.invite(id) : { error: 'no such being' };
+  }
+  if (method === 'knock') {
+    const b = args.being as string | { boot: unknown; key: unknown };
+    let door = typeof b === 'string' ? w.doors.get(b) : undefined;
+    if (!door && b && typeof b === 'object') {
+      // new or existing: the owner names a being of theirs, and a key already
+      // booted is a being of theirs, not a class that failed to instantiate.
+      const key = word(b.key),
+        className = word(b.boot);
+      if (key === null || className === null) return { error: 'no such being' };
+      const made = w.instantiate(key, className);
+      door = made ? w.doors.get(made.key) : w.doors.get(key);
+    }
+    const id = word(args.id);
+    // Never for the ward itself, for the reason invite refuses it: the ward
+    // is a being to nobody outside, and holds no relation of its own. A
+    // standing written into its cells would be the owner's reach dressed as
+    // a being's, and no ask of the ward's could ever use it.
+    if (!door || id === null || door.key === w.pk) return { error: 'no such being' };
+    const inv = args.invitation as Invitation;
+    // The owner is a caller like any other and may say what this knock may
+    // spend. Saying nothing is the ward's default, as it is for a being.
+    const out = await door.stance.standings.knock(inv, args.method as string | undefined, (args.args as JsonObject) ?? {}, args.wanted as Wanted | undefined);
+    if (isSilence(out) || isUnreached(out)) return { error: isUnreached(out) ? 'unreached' : 'silence' };
+    return { taken: await door.stance.standings.take(id, inv), answer: out as Json };
+  }
+  if (method === 'remove') {
+    // The mirror of knock: a relation out of a being, by id, occupant or
+    // standing, since the two share one namespace. On the ward itself the
+    // id is an owner, and only the root may unseat one, for the reason only
+    // the root may invite one: ownership moves by the root alone.
+    const being = word(args.being),
+      id = word(args.id);
+    if (being === null || id === null) return { error: 'no such being' };
+    if (being === w.pk && asker.id !== OWNER) return { error: 'no such being' };
+    const door = w.doors.get(being);
+    if (!door) return { error: 'no such being' };
+    if (Object.hasOwn(door.cells.occupants, id)) door.stance.occupants.remove(id);
+    else if (Object.hasOwn(door.cells.standings, id)) door.stance.standings.remove(id);
+    else return { error: 'nothing to remove' };
+    return { removed: id };
+  }
+  return { error: 'unknown ask' };
+}
+
+// The ward's describe for its owner: its beings, their classes, a digest each,
+// as she would describe herself to the owner.
+async function describe(w: OwnerSide): Promise<Json> {
+  const beings: Record<string, Json> = {};
+  for (const [key, door] of w.doors) {
+    if (key === w.pk) continue;
+    let d: string | null = null;
+    try {
+      const bp = await (door.being.answer as (a: unknown) => unknown)({ id: OWNER });
+      d = isSilence(bp) || isUnreached(bp) ? null : await digest(bp as Json);
+    } catch {
+      // she threw where she was asked. there is no blueprint, and d stays null.
+    }
+    beings[key] = { class: door.cells.class ?? null, public: w.publicKey() === key, digest: d };
+  }
+  return {
+    asks: OWNER_ASKS.map((name) => ({ name, input: { type: 'object' } })),
+    notes: { pk: w.pk, beings },
+  };
+}

package/src/ward/partition.ts

@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: Apache-2.0
+// The partition. The ward's cells, all the way down. Values only, so the
+// harbor may persist it as it likes. Everything durable a ward has is here,
+// every secret included. Nothing here is ever in a being's cells.
+import type { Cells } from '../being/types.ts';
+
+// The shape of everything below. A ward stamps what it writes and refuses
+// what it cannot read: the partition outlives the ward that wrote it, and a
+// ward that guessed at a shape it did not know would not fail, it would answer
+// wrongly on relations it had silently misread.
+//
+// One value, and it does not move until 1.0.0. Before a release there is
+// nobody holding a partition of another shape to tell apart: if the types
+// below change, the partition is thrown away, not migrated to and not counted.
+// A number that climbed with every change would be a changelog, and the only
+// question asked here is answered by equality — is this a partition this ward
+// can read. At 1.0.0 this changes once, and from then on it means something.
+export const VERSION = 'pre-1.0.0';
+
+// Every version this ward can read, newest last. Today it is one, and the
+// seam below is what makes it able to be more than one later: a partition
+// written under an older readable version is carried forward by `upgrade`
+// before the ward touches it. The seam is here before 1.0.0 because after
+// 1.0.0 there is nowhere to put it. A partition holds every secret and every
+// relation a world has, so the first shape change after the freeze cannot be
+// answered by throwing it away, and a ward that meets a shape it has no seam
+// for refuses to boot with everything still inside it.
+export const READS: readonly string[] = [VERSION];
+
+// Carry a partition written under an older readable version forward to this
+// one. There is nothing to carry today, because READS has one member. Each
+// step added here is from one member of READS to the next.
+function upgrade(p: Partition): Partition {
+  return p;
+}
+
+// One occupant, as the door knows her: by the heir pk her invitation carried.
+// `current` is the pk that may speak now. `announced` is the pk `current`
+// vouched for on its last call, and may speak next. Both may speak until one
+// does, so a lost reply after a rotation strands nobody. `fresh` is true
+// until the knock: the heir is a key the inviter handed out, and it dies the
+// moment it is used.
+export type Heir = {
+  being: string; // the key of the being who minted the id
+  id: string; // her id for the occupant
+  current: string; // pk hex
+  announced: string | null; // pk hex
+  fresh: boolean;
+  // Once-only delivery. The highest number honoured, and which numbers below
+  // it are already spent. Durable, because a door that forgets what it
+  // honoured honours it again after a restart.
+  mark: number;
+  spent: number[];
+  // Reserved, and nothing writes it. A door refuses a number at or below the
+  // span, which is right for an accident and for an interception. A kit that
+  // grows retry may want the other answer, giving back what it already said
+  // rather than one silence, and that answer has to live somewhere durable.
+  // The slot is cut now because a Heir that grows a field after 1.0.0 is a
+  // partition shape change, and this is the cheapest thing in this file.
+  last?: { seq: number; reply: string };
+};
+
+// One standing, as the caller's ward keeps it: where to send, how to seal,
+// which key to sign with, and the key it has announced for next time.
+export type StandingKeys = {
+  ward: string; // the far ward's pk, 128 hex: signing pk then padlock
+  heir: string | null; // the heir pk this standing was born on. null: the far ward's public being
+  current: string; // seed hex of the signing key that speaks now
+  next: string | null; // seed hex of the key announced on the last call, if any
+  seq: number; // the last number she spoke under. the next call is this plus one
+};
+
+export type Bind = {
+  standings: Record<string, StandingKeys>; // id -> keys
+  occupants: Record<string, string>; // id -> heir pk
+  knocks: Record<string, { current: string; next: string | null; spoke: boolean; sent: boolean; seq: number }>; // <ward pk>:<heir pk>, or public:<ward pk> -> her keys for a knock, before take. spoke: bytes came back once. sent: bytes went out once, answered or not
+  answered: Record<string, true>; // <ward pk>:<heir pk>, or public:<ward pk>: knocked and answered
+  minted: string[]; // the last eight pks her side minted. inner. a test reads it
+};
+
+export type Partition = {
+  version: string;
+  beings: Record<string, Cells & { class?: string }>; // key -> her cells
+  bind: Record<string, Bind>; // key -> her bind table
+  heirs: Record<string, Heir>; // heir pk -> occupant, across every being of the ward
+  public: string | null; // the one public being's key
+};
+
+// The one place a ward reads state that another ward wrote. A fresh
+// memory becomes a partition of this version; anything already written must
+// say it is this version, and a ward that cannot read it does not boot. Birth is
+// where a ward is allowed to be loud: silence is the door's word, for asks
+// that were made, and no ask has been made yet.
+export function open(memory: Record<string, unknown>): Partition {
+  const p = memory as Partition;
+  if (Object.keys(memory).length > 0 && p.version !== VERSION) {
+    if (!READS.includes(p.version)) throw new Error(`partition is version ${p.version}, this ward reads ${READS.join(', ')}`);
+    upgrade(p).version = VERSION;
+  }
+  p.version ??= VERSION;
+  p.beings ??= {};
+  p.bind ??= {};
+  p.heirs ??= {};
+  p.public ??= null;
+  return p;
+}
+
+// One record, reached by a key a being or an owner chose. A bare lookup finds
+// every name on Object's prototype, so `__proto__` answers with the prototype
+// itself: read, it is there where nothing was put; written, it reaches every
+// object alive in the runtime. Own keys only, both ways, and a write that
+// names one of those lands on the record where it belongs.
+export const at = <T>(rec: Record<string, T>, key: string): T | undefined => (Object.hasOwn(rec, key) ? rec[key] : undefined);
+export const put = <T>(rec: Record<string, T>, key: string, value: T): T => {
+  Object.defineProperty(rec, key, { value, writable: true, enumerable: true, configurable: true });
+  return value;
+};
+export const drop = (rec: Record<string, unknown>, key: string): void => {
+  if (Object.hasOwn(rec, key)) delete rec[key];
+};
+
+export const emptyCells = (): Cells => ({ standings: {}, occupants: {} });
+export const emptyBind = (): Bind => ({ standings: {}, occupants: {}, knocks: {}, answered: {}, minted: [] });

package/src/ward/seal.ts

@@ -0,0 +1,133 @@
+// SPDX-License-Identifier: Apache-2.0
+// The seal. What a ward does to bytes on the way out and on the way in.
+//
+// A being's key is one 32-byte seed: an Ed25519 pair. It signs, it never
+// seals. The ward's key is one seed too, giving both an Ed25519 pair to sign
+// replies and an X25519 padlock every ask is sealed to. Beings never own a
+// padlock: asks are sealed to the ward, replies to the ephemeral key of the
+// ask they answer.
+//
+//   ask on the wire     box = eph X pk || AESGCM( payload || signature )     sealed to the ward padlock
+//                       payload = JSON { to, by, next, seq, time, hops?, method?, args }  signed by `by`
+//
+// Nothing rides outside the box. `to` names the heir this ask is for, and it
+// is inside with everything else: a heir is the one name in a relation that
+// never rotates, so on the outside it would be a handle an intermediary could
+// hold forever, and the same handle anyone who ever saw the invitation
+// already has. What a harbor needs to route is the ward pk, which it carries
+// itself. The door opens every ask with its own padlock and reads `to` after,
+// so nothing was ever gained by having it in the clear.
+//   reply on the wire   box = eph X pk || AESGCM( reply || signature )       sealed to the ask's eph pk
+//                       reply = JSON { object, seen } | { silence: true }    signed by the ward key
+import type { Json, JsonObject } from '../being/types.ts';
+import { KEY, SIGNATURE, box, concat, hex, sha256, sign, signingPair, sealingPair, unbox, unhex, verify } from './arithmetic.ts';
+
+const utf8 = new TextEncoder();
+const text = new TextDecoder();
+
+export type WardKey = { sign: Uint8Array; padlock: Uint8Array; signPk: Uint8Array; padlockPk: Uint8Array; pk: string };
+
+// The ward's key from its seed. Its pk on the wire is the signing pk then the padlock, 128 hex.
+export async function wardKey(seed: string | Uint8Array): Promise<WardKey> {
+  const raw = typeof seed === 'string' ? utf8.encode(seed) : seed;
+  const seed32 = raw.length === KEY ? raw : await sha256(raw);
+  const s = await signingPair(seed32);
+  const p = await sealingPair(seed32);
+  return { sign: s.secret, padlock: p.secret, signPk: s.pk, padlockPk: p.pk, pk: hex(s.pk) + hex(p.pk) };
+}
+export const wardSignPk = (pk: string): Uint8Array => unhex(pk.slice(0, KEY * 2));
+export const wardPadlock = (pk: string): Uint8Array => unhex(pk.slice(KEY * 2));
+export const isWardPk = (pk: unknown): pk is string => typeof pk === 'string' && /^[0-9a-f]{128}$/.test(pk);
+
+// A being's relation key: a seed, and the pk it signs as.
+export async function beingKey(seed: Uint8Array): Promise<{ seed: string; pk: string }> {
+  return { seed: hex(seed), pk: hex((await signingPair(seed)).pk) };
+}
+
+// time is the allowance: what this ask may still spend. It rides inside the
+// signed body, so a budget caught on the road cannot be widened by whoever
+// caught it.
+// hops is reserved and nothing sets it. An ask carries no count of doors
+// today, so a chain of relays is bounded by time alone. A relay chain that
+// ever wants a count needs every door on it to refuse at zero, and a door
+// written after the count was invented cannot make the doors before it
+// enforce anything. So the field is named and refused here now, while it
+// costs two lines: a door of this version already counts as a correct
+// participant in a chain nobody has designed yet.
+export type AskPayload = { by: string; next: string | null; seq: number; time: number; hops?: number; method?: string; args: JsonObject };
+// What is actually sealed: the payload with the heir it is for, or null for
+// the public being. `to` is signed with the rest, so it cannot be moved.
+type Sealed = AskPayload & { to: string | null };
+export type ReplyPayload = { object: Json; seen: string | null } | { silence: true };
+
+// Seal an ask. Returns the bytes and the ephemeral secret the reply will be sealed to.
+export async function sealAsk(to: string | null, payload: AskPayload, signer: Uint8Array, padlock: Uint8Array, seed: Uint8Array): Promise<{ bytes: Uint8Array; ephemeral: Uint8Array }> {
+  const body = utf8.encode(JSON.stringify({ to, ...payload } satisfies Sealed));
+  const inside = concat([body, await sign(body, signer)]);
+  const { bytes, ephemeral } = await box(inside, padlock, seed);
+  return { bytes, ephemeral: ephemeral.secret };
+}
+
+// Open an ask at the door. Null when it does not open or does not parse.
+// Verification is the door's own step, because only the door knows which key may speak.
+export async function openAsk(bytes: Uint8Array, padlockSecret: Uint8Array): Promise<{ to: string | null; payload: AskPayload; body: Uint8Array; signature: Uint8Array; ephemeralPk: Uint8Array } | null> {
+  try {
+    if (!(bytes instanceof Uint8Array) || bytes.length < 1) return null;
+    const inside = await unbox(bytes, padlockSecret);
+    if (inside.length <= SIGNATURE) return null;
+    const body = inside.subarray(0, inside.length - SIGNATURE);
+    const signature = inside.subarray(inside.length - SIGNATURE);
+    const payload = JSON.parse(text.decode(body)) as Sealed;
+    // The heir, or null for the public being. Absent is not null: a payload
+    // that never named one is malformed, like any other missing field.
+    const to = payload.to;
+    if (to !== null && !(typeof to === 'string' && /^[0-9a-f]{64}$/.test(to))) return null;
+    if (typeof payload.by !== 'string' || !/^[0-9a-f]{64}$/.test(payload.by)) return null;
+    if (payload.next !== null && !(typeof payload.next === 'string' && /^[0-9a-f]{64}$/.test(payload.next))) return null;
+    if (payload.method !== undefined && typeof payload.method !== 'string') return null; // a name, or the empty ask. never a number, never an object.
+    if (payload.args !== undefined && (payload.args === null || typeof payload.args !== 'object' || Array.isArray(payload.args))) return null; // args are one object, or absent. a string or a list is not an ask.
+    if (!Number.isSafeInteger(payload.seq) || payload.seq < 1) return null; // her count for this relation. one and up, and a whole number.
+    // The allowance. A whole number, and one that has already run out is not an
+    // ask this door will open: it is refused as the bytes it is, above.
+    if (!Number.isSafeInteger(payload.time) || payload.time <= 0) return null;
+    // The hop count, if this ask carries one: a whole number, never below
+    // zero. Absent is the ordinary ask and always will be.
+    if (payload.hops !== undefined && (!Number.isSafeInteger(payload.hops) || payload.hops < 0)) return null;
+    return { to, payload, body, signature, ephemeralPk: bytes.subarray(0, KEY) };
+  } catch {
+    return null;
+  }
+}
+export const verifyAsk = (a: { body: Uint8Array; signature: Uint8Array }, pk: string): Promise<boolean> => verify(a.body, a.signature, unhex(pk));
+
+// Seal a reply to the ephemeral pk of the ask it answers, signed by the ward.
+export async function sealReply(reply: ReplyPayload, ephemeralPk: Uint8Array, wardSign: Uint8Array, seed: Uint8Array): Promise<Uint8Array> {
+  const body = utf8.encode(JSON.stringify(reply));
+  return (await box(concat([body, await sign(body, wardSign)]), ephemeralPk, seed)).bytes;
+}
+
+// Open a reply with the ephemeral secret kept from the ask, and verify it
+// came from the ward it was sent to. Null is silence: it did not open, it
+// lied, or it is not a reply. Every ward on the wire is somebody else's code,
+// so the shape is checked here and nowhere later: a reply is `{ silence }`
+// or `{ object, seen }` with an object present and seen a digest or null.
+// Anything else is bytes that said nothing, and her ward never hands her a
+// throw or an absent value for what a stranger wrote.
+export async function openReply(bytes: unknown, ephemeralSecret: Uint8Array, signPk: Uint8Array): Promise<ReplyPayload | null> {
+  try {
+    if (!(bytes instanceof Uint8Array)) return null;
+    const inside = await unbox(bytes, ephemeralSecret);
+    if (inside.length <= SIGNATURE) return null;
+    const body = inside.subarray(0, inside.length - SIGNATURE);
+    if (!(await verify(body, inside.subarray(inside.length - SIGNATURE), signPk))) return null;
+    const reply = JSON.parse(text.decode(body)) as unknown;
+    if (reply === null || typeof reply !== 'object' || Array.isArray(reply)) return null;
+    const r = reply as Record<string, unknown>;
+    if (r.silence === true) return { silence: true };
+    if (!Object.hasOwn(r, 'object') || r.object === undefined) return null;
+    if (r.seen !== null && !(typeof r.seen === 'string' && /^[0-9a-f]{64}$/.test(r.seen))) return null;
+    return { object: r.object as Json, seen: r.seen };
+  } catch {
+    return null;
+  }
+}

package/src/ward/stance.ts

@@ -0,0 +1,264 @@
+// SPDX-License-Identifier: Apache-2.0
+// The one stance builder. Used for every being the ward boots. Nothing
+// outer is in what she holds: ids in, values out, keys in the bind table.
+import { silence, isSilence, isUnreached } from '../being/silence.ts';
+import { digest } from '../being/digest.ts';
+import { RESERVED_IDS } from '../being/types.ts';
+import type { Answer, Cells, Invitation, JsonObject, Silence, Stance, Standing, Standings, Unreached, Wanted } from '../being/types.ts';
+import { at, put, drop, type Bind, type StandingKeys } from './partition.ts';
+import { allow, within, LATE } from './allowance.ts';
+import { isWardPk, type ReplyPayload } from './seal.ts';
+
+// What the stance needs from its ward, and no more.
+export type Inside = {
+  pk: string;
+  mintKey(bind: Bind): Promise<{ seed: string; pk: string }>; // a fresh signing key, recorded as minted
+  openHeir(heir: string, being: string, id: string): void;
+  closeHeir(heir: string): void;
+  // one send for every destination. the far door's reply, silence, or unreached.
+  // signs as keys.current, announces keys.next (minting one if asked), and rotates keys on an answer.
+  send(bind: Bind, keys: StandingKeys, announce: boolean, method: string | undefined, args: JsonObject, wanted: Wanted | undefined): Promise<ReplyPayload | Silence | Unreached>;
+};
+
+// An invitation as it travels: the far ward's pk, the heir pk, the heir's secret seed. Or just the ward, for its public being.
+export type SealedInvitation = { ward: string; heir?: string; secret?: string };
+
+// The three calls on `standings` share the object with the ids she takes, so
+// a standing named after one of them would be unreachable: `standings.knock`
+// is the call, whatever record sits under that name. One namespace means one
+// list: these are refused at invite and at take, beside the ward's own words.
+const CALLS = ['knock', 'take', 'remove'];
+const reserved = (id: string): boolean => RESERVED_IDS.includes(id) || CALLS.includes(id);
+
+export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bind): Stance {
+  // The name of one relation, as her side files it. A relation is a ward and
+  // a heir, never a heir alone: the heir pk is outer, it rides in the clear on
+  // every lid, and anyone who reads one can quote it back inside an invitation
+  // naming a ward of their own. Filed under the heir alone, that invitation
+  // would share her knock record with the relation the heir really belongs to:
+  // it would sign with that relation's key, and an answer to it would set the
+  // answered flag the other relation is taken on. Both halves, always.
+  const nameOf = (inv: SealedInvitation) => (inv.heir === undefined ? `public:${inv.ward}` : `${inv.ward}:${inv.heir}`);
+  const valid = (inv: unknown): inv is SealedInvitation => {
+    const i = inv as SealedInvitation;
+    if (!i || typeof i !== 'object' || !isWardPk(i.ward)) return false;
+    if (i.heir === undefined) return i.secret === undefined;
+    return typeof i.heir === 'string' && typeof i.secret === 'string' && /^[0-9a-f]{64}$/.test(i.heir) && /^[0-9a-f]{64}$/.test(i.secret);
+  };
+
+  // One relation, one ask at a time. The rotation is a conversation: a send
+  // reads the key that speaks now, announces the next, and moves to it once
+  // the far door has answered. Two sends interleaving on one relation read
+  // each other's half-written keys and the two sides diverge, which no later
+  // ask can repair. So each relation has a lane, and a send waits for the one
+  // before it. Beings may still ask concurrently: the lanes are per relation,
+  // and a slow relation never holds up another.
+  const lanes = new Map<string, Promise<unknown>>();
+  const lane = <T>(name: string, run: () => Promise<T>): Promise<T> => {
+    const mine = (lanes.get(name) ?? Promise.resolve()).then(run, run);
+    const quiet = mine.then(
+      () => {},
+      () => {},
+    );
+    lanes.set(name, quiet);
+    void quiet.then(() => {
+      if (lanes.get(name) === quiet) lanes.delete(name); // the lane is idle. nothing to remember.
+    });
+    return mine;
+  };
+
+  // Every ask a being makes, bounded. The bound is outside the lane on
+  // purpose: an ask that waits its turn behind a relation that comes back
+  // round never reaches a send, and a bound that only watched the wire would
+  // never see it hang. A bound that ran out is silence, never unreached:
+  // unreached promises nothing was delivered and is safe to ask again, and a
+  // wait that gave up knows no such thing.
+  //
+  // The bell rings before the work is reached, too: an ask that was still
+  // waiting its turn when the wait ran out is never sent. Sent then, it would
+  // be a fresh ask nobody is waiting on, the far being would do the work, and
+  // what came back would be read into her cells behind a silence she was
+  // already handed. So the work is given the bell, and reads it at the lane.
+  const bounded = async (wanted: Wanted | undefined, work: (live: () => boolean) => Promise<Answer>): Promise<Answer> => {
+    let late = false;
+    const out = await within(allow(wanted).time, work(() => !late), () => {
+      late = true;
+    });
+    return out === LATE ? silence : out;
+  };
+
+  const send = async (keys: StandingKeys, method: string | undefined, args: JsonObject, wanted: Wanted | undefined, rec?: Cells['standings'][string]): Promise<Answer> => {
+    const r = await inside.send(bind, keys, true, method, args, wanted);
+    if (isSilence(r) || isUnreached(r)) return r;
+    if ('silence' in r) return silence;
+    if (rec && method !== undefined && r.seen !== null) rec.seen = r.seen; // the digest rode along
+    return r.object;
+  };
+
+  const knocking = async (inv: SealedInvitation, method: string | undefined, args: JsonObject, wanted: Wanted | undefined): Promise<Answer> => {
+    const name = nameOf(inv);
+    // her own key for this relation, minted once: rotation two. reused if she knocks again.
+    const k = (bind.knocks[name] ??= { current: (await inside.mintKey(bind)).seed, next: null, spoke: false, sent: false, seq: 0 });
+    // the first knock on a heir speaks as the heir, the key the inviter handed out, and announces her own.
+    // once bytes have come back, the heir is spent whatever they said, and her own key speaks.
+    // She sent once as the heir and nothing came back. Either the door heard,
+    // spent the heir and rotated to the key she announced, or nothing arrived
+    // and the heir still stands. Only the far door knows, and it will not say.
+    //
+    // So she asks, and the asking tells her. Under her own key: if the door
+    // heard, that key is the one it admits, and she is answered. If it did
+    // not, the key means nothing there, the ask is refused, and a refusal at
+    // that door writes nothing — the heir is untouched and still speaks. Then
+    // she knocks as the heir, as she would have. One extra round trip in the
+    // one case where a reply was lost, and the relation is not stranded.
+    //
+    // No stranger gains anything by it: whoever holds the invitation could
+    // always knock as the heir, and her own key is admitted only where the
+    // door already bound it to her.
+    if (inv.heir !== undefined && !k.spoke && k.sent) {
+      const own: StandingKeys = { ward: inv.ward, heir: inv.heir, current: k.current, next: k.next, seq: k.seq };
+      const r = await inside.send(bind, own, true, method, args, wanted);
+      k.seq = own.seq;
+      k.current = own.current;
+      k.next = own.next;
+      if (isUnreached(r)) return r; // still nothing. she knows no more than before.
+      if (!isSilence(r) && !('silence' in r)) {
+        k.spoke = true; // it was heard the first time, and this is the answer
+        bind.answered[name] = true;
+        return r.object;
+      }
+      // Refused. The door never heard her, so the heir is still hers to spend.
+    }
+
+    const first = inv.heir !== undefined && !k.spoke;
+    const keys: StandingKeys = first ? { ward: inv.ward, heir: inv.heir!, current: inv.secret!, next: k.current, seq: k.seq } : { ward: inv.ward, heir: inv.heir ?? null, current: k.current, next: k.next, seq: k.seq };
+    const r = await inside.send(bind, keys, true, method, args, wanted);
+    k.sent = true; // bytes went out. whether they arrived is the far door's to know.
+    // The number she spoke under, and the key she announced, kept whoever
+    // answered and kept when nobody did. A reply lost on the way back is a
+    // door that has already honoured the number: she must not offer it twice,
+    // or a road that drops one reply silences the relation for good.
+    k.seq = keys.seq;
+    if (!first) {
+      k.current = keys.current;
+      k.next = keys.next;
+    }
+    if (isUnreached(r)) return r; // nothing came back. she does not know whether it was heard.
+    k.spoke = true;
+    if (isSilence(r) || 'silence' in r) return silence;
+    bind.answered[name] = true;
+    return r.object;
+  };
+
+  // The id she took this relation under, if she took it. One relation is one
+  // ward and one heir whichever door it is reached by, so the standing and the
+  // invitation answer to the same name.
+  const keyName = (k: StandingKeys) => (k.heir === null ? `public:${k.ward}` : `${k.ward}:${k.heir}`);
+  const takenAs = (name: string): string | undefined => Object.keys(bind.standings).find((id) => keyName(bind.standings[id]) === name);
+
+  const calls = {
+    knock: async (inv: Invitation, method?: string, args: JsonObject = {}, wanted?: Wanted): Promise<Answer> => {
+      if (!valid(inv)) return silence;
+      // She may knock again, and after take that knock is an ask: the relation
+      // has one home, so it answers on the standing's lane, under the
+      // standing's keys and its count. A second lane here would speak for the
+      // same relation, and the two would refuse each other.
+      const id = takenAs(nameOf(inv));
+      if (id !== undefined) return bounded(wanted, (live) => lane(`ask:${id}`, () => (live() ? asking(id, bind.standings[id], cells.standings[id], method, args, wanted) : Promise.resolve(silence))));
+      return bounded(wanted, (live) => lane(`knock:${nameOf(inv)}`, () => (live() ? knocking(inv, method, args, wanted) : Promise.resolve(silence))));
+    },
+    // Take consumes. Until now the relation lived in the knock record, under
+    // the ward and the heir; from now it lives in the standing, under her id.
+    // It never lives in both: two records seeded from one relation are two
+    // lanes speaking for one line of keys and one count, and whichever spoke
+    // last holds it while the other is refused. She would read that refusal as
+    // the far being falling quiet, which is a thing a sovereign being may do,
+    // so the loss would look exactly like an answer she is owed nothing of.
+    // One relation, one home, and the invitation is spent: knocking it again
+    // is another consumed it, and taking it again births nothing.
+    //
+    // So it is spoken on the relation's lane, like every other word spoken
+    // for it. A take reads the count and the keys a knock writes, and copies
+    // them into the standing. Off the lane it reads them between a knock's
+    // send and its answer: the standing is born holding a number the far door
+    // is about to honour and a key it is about to rotate past, and her first
+    // ask on it is refused. The relation she took correctly would be dead
+    // because a second knock on the same invitation was careless.
+    take: async (id: string, inv: Invitation): Promise<string | null> => {
+      if (!valid(inv)) return null;
+      const name = nameOf(inv);
+      return lane(`knock:${name}`, () => {
+        if (!bind.answered[name]) return Promise.resolve(null);
+        // Standings and occupants are one namespace — invite and take each
+        // refuse a name the other holds — so a word reserved in one is
+        // reserved in both.
+        if (reserved(id) || at(cells.standings, id) || at(cells.occupants, id)) return Promise.resolve(null);
+        const k = bind.knocks[name];
+        put(bind.standings, id, { ward: inv.ward, heir: inv.heir ?? null, current: k.current, next: k.next, seq: k.seq }); // the count carries over: the standing goes on where the knock left off
+        put(cells.standings, id, { id, digest: null, blueprint: null, seen: null });
+        delete bind.knocks[name];
+        delete bind.answered[name];
+        return Promise.resolve(id);
+      });
+    },
+    remove: (id: string): void => {
+      drop(cells.standings, id);
+      drop(bind.standings, id);
+    },
+  };
+
+  const standingAt = (id: string): Standing => ({
+    id,
+    // The keys are read now, not when the lane reaches this ask: an ask
+    // issued while the standing stood is answered even if she drops it in
+    // the next line. Waiting for the lane is not a reason to lose it.
+    ask: (method?: string, args: JsonObject = {}, wanted?: Wanted): Promise<Answer> => {
+      const keys = at(bind.standings, id);
+      if (!keys) return Promise.resolve(silence as Answer); // she dropped it between one line and the next
+      const rec = at(cells.standings, id);
+      return bounded(wanted, (live) => lane(`ask:${id}`, () => (live() ? asking(id, keys, rec, method, args, wanted) : Promise.resolve(silence))));
+    },
+  });
+
+  const asking = async (id: string, keys: StandingKeys, rec: Cells['standings'][string] | undefined, method: string | undefined, args: JsonObject, wanted: Wanted | undefined): Promise<Answer> => {
+    const out = await send(keys, method, args, wanted, rec);
+    if (method === undefined && !isSilence(out) && !isUnreached(out)) {
+      const here = at(cells.standings, id);
+      if (here) {
+        here.blueprint = out as never;
+        here.digest = here.seen = await digest(out);
+      }
+    }
+    return out;
+  };
+
+  const standings = new Proxy(calls, {
+    // Own keys only: `in` would also find every name on Object's prototype,
+    // and a standing she took as `constructor` or `toString` would answer with
+    // Object's, not hers.
+    get: (t, id) => (typeof id === 'string' && Object.hasOwn(t, id) ? t[id as keyof typeof t] : typeof id === 'string' && at(cells.standings, id) ? standingAt(id) : undefined),
+  }) as unknown as Standings;
+
+  return {
+    cells,
+    occupants: {
+      // rotation one: the ward mints the occupant's first key and gives the secret away.
+      // it keeps the pk beside the id and nothing else. the invitation IS the key.
+      invite: async (id: string): Promise<Invitation | null> => {
+        if (reserved(id) || at(cells.occupants, id) || at(cells.standings, id)) return null;
+        put(cells.occupants, id, { id, notes: {} });
+        const k = await inside.mintKey(bind);
+        inside.openHeir(k.pk, key, id);
+        put(bind.occupants, id, k.pk);
+        return { ward: inside.pk, heir: k.pk, secret: k.seed };
+      },
+      remove: (id: string): void => {
+        drop(cells.occupants, id);
+        const heir = at(bind.occupants, id);
+        drop(bind.occupants, id);
+        if (heir) inside.closeHeir(heir); // the heir dies with the id
+      },
+    },
+    standings,
+  };
+}