@quo-systems/quo 0.2.13 → 0.2.15

package/SPEC.md

@@ -1,9 +1,11 @@
 # SPEC
 
 This is the truth of Quo, and the whole context. It assumes nothing from any
-other document. It is written for the two people who work on this repository,
-not for a reader outside it, and it ships with the package as the truth
-the source is read against.
+other document. It is the protocol and nothing else: what any ward anywhere
+must do, in any language, for its bytes to be Quo. A sentence is here only
+because a ward written in another language needs it to interoperate with
+ours. What one kit chose, and another kit may refuse, is that kit's paper and
+never this one.
 
 It carries no version and keeps no history. There is no 1.0.0 yet, so there
 is nobody holding an older Quo to be compatible with, and no changelog to
@@ -11,7 +13,6 @@ write. This file is rewritten in place to say what the tree says, and when
 the two disagree the fix is to move one of them, the same day. Where the tree
 is behind a decision, the chapter "Where the tree stands" says so; that
 chapter is the one place a gap is allowed to be named instead of closed.
-`test/repo.test.ts` holds this document to the tree where a test can.
 The package is published from 0.1.0 with no compatibility promise: this
 document may still move under anyone holding it. At 1.0.0 it is frozen
 once, and versioning starts to mean something.
@@ -76,30 +77,45 @@ Nothing crosses either of them but what is written here.
 
 ### Harbor to ward
 
-The harbor passes one object, once, at birth, and receives two pointers.
-
-```
-ground
-  seed          bytes, or a string. the ward derives its pk from it and nothing else.
-                32 bytes are the seed; anything else is SHA-256'd to 32 bytes first.
-  memory        the partition. the ward's files. opaque to the harbor. an object.
-  instantiate   (class name, stance) -> object | null
-  carry         (ward pk, bytes) -> bytes | undefined       undefined: no door was reached. a throw is read the same.
-  random        (n) -> n bytes of entropy. every key a ward mints is drawn from it.
-  wrote         () -> nothing. the ward says it after every write to its partition, and nothing else:
-                a harbor that keeps the partition saves after it, when it likes and in the order
-                it was told. a harbor that keeps nothing leaves it out.
-```
-
-Nothing else is ever passed. A harbor that needs a seventh thing has found a
-gap in Quo or a leak into the ward. The shape is `Ground` in
-`src/ward/ground.ts`, and beside it are the three pieces every harbor in this
-kit builds one out of: `maker`, the code half, which finds a class by own key
-in the first registry that holds it and remembers the object by the cells;
-`entropy`, the one line every terrain has; and `learnPk`, the empty ask, since
-a harbor learns its ward's pk the way anyone learns anything and has no second
-derivation to keep in step. They are convenience and never contract: a kit
-writes its own harbor, and may write these again.
+The harbor passes the **ground**, once, at birth, and receives two pointers.
+The ground is seven capabilities, and a kit gathers them however its
+language gathers things. What each one is, is Quo's; how they are held
+together is not.
+
+1. **The seed.** The ward derives its pk from it and from nothing else.
+   Thirty-two bytes are the seed; anything else, text or bytes of another
+   length, is SHA-256'd to thirty-two bytes first.
+2. **The partition.** The ward's files, as values, opaque to the harbor.
+3. **Instantiate.** A class name and a stance in, the being or nothing out.
+   A name the harbor does not hold is nothing, and the boot that named it
+   fails.
+4. **Carry.** A ward pk and bytes in, bytes or nothing out. Nothing means no
+   door was reached, and a throw is read the same way.
+5. **Random.** A count in, that many bytes of entropy out. Every key a ward
+   mints is drawn from it.
+6. **Wrote.** The ward says it after every write to its partition, and after
+   nothing else. A harbor that keeps the partition saves after it, when it
+   likes and in the order it was told. A harbor that keeps nothing needs it
+   not at all.
+7. **Lend.** What the device lends this ward's beings, by name. One call: a
+   name and a taker in, whether it was taken out. The harbor's root mints an
+   invitation on a being of its own ward, for this ward alone, and hands it
+   to the taker, which knocks and takes it and answers whether it did. A
+   taker that would not take is one the harbor unmints for, so nothing
+   half-lives. No is every kind of no. A harbor that lends nothing needs it
+   not at all.
+
+Seven things, and nothing else is ever passed: a harbor that needs an eighth
+has found a gap in Quo or a leak into the ward. `lend` is the whole of what
+a device offers, and it offers it as a relation and never as an object: the
+things a device can do are beings, booted by the harbor in a ward of its
+own, and a being reaches one by holding a standing at her, exactly as she
+reaches a being on another planet. The name is the harbor's namespace and no
+word of the ward, which ward may ask for which name is decided where the
+ground is built, and a stranger's ward is lent nothing. A harbor never mints:
+it holds the ask pointer of the ward it booted, so it is that ward's root,
+and the root may invite on any being of its ward. What comes back is a value
+the ward carries to her, as an invitation is carried anywhere.
 
 Returned:
 
@@ -133,9 +149,9 @@ out   her answer(asker, method?, args?) -> object | silence      the one method
 ```
 
 The stance is her cells, her standings to ask, the calls to invite,
-knock, take and remove, and boot. The ward builds it and hands it to the harbor's
-instantiate with a class name, and receives her. No method is the empty ask,
-and what she answers to it is her blueprint.
+knock, take and remove, boot, and lend. The ward builds it and hands it
+to the harbor's instantiate with a class name, and receives her. No method is
+the empty ask, and what she answers to it is her blueprint.
 
 The stance, as every being in every language receives it. Nothing more is
 ever offered, and nothing here may be missing.
@@ -156,6 +172,10 @@ stance
   boot(class, key, id?)                                -> key | null           a new being of her ward, by class name.
                                                                                with an id, her standing to her under it
 
+  lend(name, id)                                       -> id | null            a standing at what this device lends,
+                                                                               by the harbor's name for it. awaitable:
+                                                                               the ward knocks and takes it for her
+
   wanted = { time? }                                   what this one ask may spend, in milliseconds. optional,
                                                        and so is saying anything at all
 ```
@@ -165,7 +185,7 @@ Return table.
 | call                | returns    | when                                                                                                         |
 | ------------------- | ---------- | ------------------------------------------------------------------------------------------------------------ |
 | invite(id, notes?)  | invitation | she minted a fresh id; the occupant record exists from now, with those notes on it                           |
-|                     | null       | the id already names a record, occupant or standing, or is a reserved word                                   |
+|                     | null       | the id already names a record, occupant or standing, or is a reserved word, or the notes are not values      |
 | remove(id)          | nothing    | always. removing what is not there is nothing                                                                |
 | knock(inv, m, a, w) | object     | the far being answered                                                                                       |
 |                     | silence    | no ward claims the invitation, or another consumed it, or the far being chose silence                        |
@@ -181,6 +201,9 @@ Return table.
 | boot(cls, key, id?) | key        | she exists from now, with fresh cells, and a restart finds her; with an id, her maker holds her standing     |
 |                     | null       | the key is already booted, the harbor holds no such class, the class threw at birth, the id is one the maker |
 |                     |            | already holds or a reserved word, or the relation was refused; nothing of the being made is left             |
+| lend(name, id)      | id         | this device lends that name to her ward, and she holds a standing at it under the id she gave                |
+|                     | null       | it lends no such name here, the id already names a record or is a reserved word, or the relation was         |
+|                     |            | refused; nothing is left behind                                                                              |
 
 A being may make, and only the owner reaches into another. Boot touches
 nobody else: the being made has empty cells and no relation but the one her
@@ -196,8 +219,59 @@ no one yet. What the owner has that the maker does not is every ask that
 reaches into a being from outside: public, invite and knock for her, remove,
 unboot. Who may ask her to boot is her gate, as who may ask her anything is.
 
-Ask, knock, invite, take and boot are awaitable. Async where the language has it,
-blocking where it does not. Every ask she makes is a new call.
+Lend is boot's shape for what the device already has. What a device can do
+is beings, in a ward its harbor booted and roots, and `lend` is how a being
+of another ward comes to hold a standing at one: her ward asks the ground
+for the name, the harbor's root mints an invitation on that being, and her
+ward knocks with it and takes it under the id she gave. She is handed the
+id and nothing else, exactly as her maker is handed a key. From then on it
+is an ordinary standing, counted and rotated, removable by her, and told
+`removed` when the far being drops her.
+
+Boot's shape includes what boot does when it fails. A being made whose
+relation could not be made is unmade, because she is her maker's ward's own
+and that ward may take her out again. The being lent is not: she stands in
+the harbor's ward, which no other ward may reach into. So the two halves are
+one call rather than two, and the ward's half runs inside the harbor's: the
+harbor mints, hands the invitation to her ward to knock and take, and hears
+whether it was taken. A knock refused, a take that lost the id to another
+line of hers, a ward gone in between: each answers no, and the root that
+minted removes the occupant it made. Nothing half-lives on either side of
+the seam, and a refused lend costs the box nothing, which is what the table
+above promises.
+
+The invitation never reaches her, and that is the difference between this
+relation and every other one she holds. Her own invitations are hers to
+give away, because giving one away is giving her own relation away. This
+one is not hers: it is the device's, minted for her ward alone, and a value
+she could copy is a capability she could hand to anyone. So she never sees
+it. A being who wants to lend her device access to another lends it in the
+open, by offering an ask of her own that forwards to her standing, where her
+gate reads who is asking and she can stop.
+
+Null is every kind of no, and she cannot tell them apart because there is
+nothing she would do differently: this harbor lends nothing, or nothing of
+that name, or nothing of that name to her ward, or what was minted could not
+be taken. What a device has is not hers to enumerate.
+
+The ground is the harbor's, so `lend` reaches the box she is running on and
+no other. A ward that moved box is handed the new harbor's ground, and a
+standing she woke up holding names a being on the box she left, which is
+what a standing means and is why it is not a bug. A being who wants the box
+she is on asks for it again at every birth, which she cannot tell from a
+restart and does not need to.
+
+Lend is one direction, and the other one is not a second mechanism. A being
+who wants to be woken invites, hands that invitation to whoever will wake
+her inside an ask, and is woken as the occupant she named. A tick, a
+delivery, a push and a stranger's ask are one act at her door, told apart by
+the id her ward puts on them and by nothing else. Nothing reaches her that
+she did not invite, and nothing wakes her that does not hold a standing at
+her.
+
+Ask, knock, invite, take, boot and lend are awaitable. Async where the
+language has it, blocking where it does not. Every ask she makes is a new
+call.
 
 The asker has three shapes and no fourth, and nothing else ever reaches her.
 
@@ -208,7 +282,13 @@ The asker has three shapes and no fourth, and nothing else ever reaches her.
   owner.
 
 `OWNER` and `PUBLIC` are reserved words: invite and take refuse them, so no
-occupant can ever wear either name.
+occupant can ever wear either name. A kit reserves more, because a relation
+is written in two places, the ward's keys and her record, and a name either
+of them cannot hold is a relation half made and a throw where the table above
+promises a null. Which names those are is that kit's, since an id never
+crosses a door and no far ward can tell. Where the refusal happens is Quo's:
+at the mint and at the take, where every other refusal is, and never at the
+write.
 
 ## Silence, the words, error
 
@@ -226,10 +306,9 @@ a word      the ward's word.             one of nine, said only to someone the w
 ```
 
 - An **error** is an ordinary answer. Quo never reads it, never makes it,
-  and never treats it apart from any other object. The base class answers
-  `{ error: 'unknown ask' }` for an ask she did not declare or hid; the
-  owner's asks answer error objects for what they refuse; both are hers to
-  read like any object.
+  and never treats it apart from any other object. The owner's asks answer
+  error objects for what they refuse, and they are hers to read like any
+  object.
 - **Silence** names no reason, by law. It is what the door says to bytes it
   cannot admit, so that a stranger learns nothing, and what a being says
   when she chooses to say nothing. It is not blindly retryable: the far
@@ -295,18 +374,33 @@ S2  the standing is gone              she held a standing, dropped it, and asked
 S3  the wait ran out                  the ask's time was spent and no reply was read.
                                       what comes back late is not read. the number is spent.
                                       an ask still waiting at its lane when the wait ran out is never sent. the word is `late`.
-S4  the reply is not one              bytes came back that do not open, or are not signed by the ward they
+S4  the reply is not one              bytes came back over the size, or that do not open, or are not signed by the ward they
                                       were sent to, or are none of the three reply shapes. the number is spent.
                                       not Quo's bytes: silence.
 S5  the far door answered             silence, or a word, exactly as the door said it.
 ```
 
 And unreached in two: `U1` the args are not one object of values, or could
-not be sealed, so nothing left;
+not be sealed, or the method is neither a word nor absent, so nothing left.
+That last is the same rule and the same reason: a payload is written as JSON,
+which drops a field it cannot write, so a method that is not a word would
+arrive as no method at all, and no method at all is the empty ask. She would
+have asked for work, been handed a blueprint, and spent a number on it. What
+a ward cannot send it does not send;
 `U2` the harbor returned nothing, or threw, so no door was reached. The number is
 taken all the same, and the gap it leaves in the count is harmless: the door
 honours any number above its mark.
 
+S4 is strict, and strict is a price paid on purpose. A reply carries `seen`
+always, and a reply whose `seen` is neither a digest nor null is none of the
+three shapes, so an answer a far being really gave is read as silence and the
+number is spent with it. The alternative is to read the object and drop the
+field, and then two kits disagree about whether an answer arrived: one hands
+her an object, the other hands her silence, and silence is not blindly
+retryable. That is the one disagreement Quo cannot afford, and it is worth
+losing an answer from a kit that writes one field wrong. A kit that writes it
+wrong is a kit the vectors catch before it ever speaks to anyone.
+
 ### What the door says
 
 The door judges thirteen cases, in this order, and the first case met is
@@ -319,7 +413,7 @@ wrote in her cells is hers.
 
 ```
 strangers: silence, nothing written, heard false
-D1   the box does not open           wrong padlock, garbage, too short. the reply is sealed to the lid if
+D1   the box does not open           wrong padlock, garbage, too short, over the size. the reply is sealed to the lid if
                                      the bytes carried one, and is noise otherwise. a lid that will not
                                      take a seal, a small-order point, is no lid: noise.
 D2   the payload is malformed        by or next not 64 lowercase hex, method not a string, args present and
@@ -362,10 +456,17 @@ Nothing else survives a removal.
    lid the ask came with, signed by the ward key. Same bytes, same length.
    A stranger cannot tell one refusal from another, nor any of them from a
    being who chose to say nothing.
-   The door equalizes the bytes and not the time it took to write them. The
-   seven cases are cheap and alike. A word, to a key the door has bound, is
-   another length, and may be: whoever hears it has already proven who they
-   are.
+   The door equalizes the bytes and not the time it took to write them, and
+   the seven cases are not alike in time: two of them verify a signature and
+   five refuse before they would. A heir pk rides in the clear, so whoever
+   holds a copy of an invitation can time a knock signed with nothing and
+   learn whether that invitation is still unspent. What that buys them is
+   what knocking with the invitation would have told them anyway, and
+   knocking spends it, which is why the door does not pay for a signature it
+   has no reason to check. What is equal is what the door says and what it
+   writes, and those are the two a stranger could otherwise use. A word, to a
+   key the door has bound, is another length, and may be: whoever hears it
+   has already proven who they are.
 2. A refusal writes nothing. No number, no key, no heir, no cell, no bind.
    The same bytes presented again meet the same refusal, and a stranger who
    knocks a thousand times leaves no mark. This holds for the three
@@ -383,10 +484,7 @@ Nothing else survives a removal.
    own ward; unreached is the wire's nothing. A ward never answers nothing,
    so that nothing always means unreached.
 6. Nobody enforces what a being does with silence or a word. Each is one
-   value she compares against, and the base class hands them to her
-   unchanged.
-
-`test/silence.test.ts` asserts every numbered line above, by its number.
+   value she compares against, and a ward hands them to her unchanged.
 
 ## Words and values
 
@@ -394,11 +492,21 @@ Nothing else survives a removal.
 
 Everything that crosses an edge is I-JSON (RFC 7493): args, answer,
 blueprint, invitation, and whatever she caches from them. Strings are valid
-Unicode. No duplicate keys. Numbers must be representable as IEEE doubles,
-so integers are exact up to 2^53. Larger integers and exact decimals travel
-as strings, with a schema format saying so. Bytes are base64 strings.
-Nothing else is a value: no dates, no references, no functions, no native
-types. An id or a standing is never a value.
+Unicode, which is text and not code units: a surrogate stands in a pair or it
+is no string, since a lone one is a character nobody has and no encoding on a
+wire can carry. No duplicate keys. Numbers must be representable as IEEE
+doubles, so integers are exact up to 2^53, and minus zero is not one of them:
+JSON writes it as zero and reads it back as zero, so a harbor keeping objects
+would hand her a sign a harbor writing bytes would not. Larger integers and
+exact decimals travel as strings, with a schema format saying so. Bytes are
+base64 strings. Nothing else is a value: no dates, no references, no
+functions, no native types. An id or a standing is never a value.
+
+The two above are the shape of every rule here: a value is a value when every
+harbor and every kit gives back what was put in. Anything a harbor keeping
+objects would preserve and a harbor writing JSON would lose is refused where
+it is written, because the alternative is a harbor that lies to her about
+which harbor she is standing in.
 
 Args are held to the same rule before they are sealed: an ask whose args
 are not one object of values is unreached, because nothing left. Her answer
@@ -410,7 +518,7 @@ The refusal is a throw where she wrote it, which her ward turns into the
 silence it turns every throw into. She has not answered, and
 nothing was written down that a harbor would later have to lie about. This
 holds all the way down: a container read through her cells is part of her
-cells. The guard is `src/ward/cells.ts`.
+cells.
 
 ### Silence and the words
 
@@ -418,14 +526,9 @@ Two of the three kinds of "no object came back". The chapter "Silence, the
 words, error" is the whole of them; here only the values. Silence is one
 distinguished value. Null is an answer. A word is a second kind of
 distinguished value, her ward's own, nine of them, `unreached` among them.
-None is an object, and none carries anything but its name. In this kit
-silence is the symbol `quo.silence` and a word is a frozen object under the
-symbol key `quo.word` holding its name, both from `src/being/silence.ts`;
-`isWord` and `wordOf` read them, and `isUnreached` is the one word a being
-asks about most. `told` names a word and leaves everything else exactly as it
-came, so asking which word arrived is one comparison rather than two joined by
-an and: `told(out) === 'late'`. A kit in another language spells it however
-that language spells one value standing for either, and owes nothing here.
+None is an object, and none carries anything but its name. A kit spells each
+however its language spells one value standing for neither an object nor an
+absence, and the spelling is owed to nobody outside that kit.
 
 ### Blueprint, schema, digest
 
@@ -448,8 +551,7 @@ serialization of the blueprint. Same bytes from every language. This is law:
 two wards in two languages always hash one blueprint to one digest. A ward
 that cannot do this is not a ward. Because only values reach a digest, a key
 holding what is not a value is dropped before hashing and an array slot
-holding one is null, which is what crossing an edge does to them anyway. The
-reference is `src/being/digest.ts`.
+holding one is null, which is what crossing an edge does to them anyway.
 
 Two places in RFC 8785 are where languages part, and a kit is held to both by
 `vectors/framing.json`. Keys sort by **UTF-16 code unit**, not by code point
@@ -496,10 +598,12 @@ and an occupant wearing that name would be two parties with one face.
 `PUBLIC` guards nothing today, because a public asker is `{}` and carries no
 id, and it is claimed now while claiming it is free.
 
-Three more are refused for a plainer reason: `knock`, `take` and `remove`
-are the calls on `standings`, and they share that object with the ids she
-takes. A standing under one of those names would be unreachable, so invite
-and take refuse them like the ward's words.
+A kit refuses more names than those two, wherever its own spelling of the
+stance would collide with an id: a standing under a name that spelling has
+already taken would be unreachable, and invite and take refuse it like the
+ward's words. Which names collide is that kit's, because an id never crosses
+a door and a kit that spells the stance another way has no collision to
+refuse.
 
 ### Cells
 
@@ -507,9 +611,11 @@ Cells are I-JSON values. The ward may persist them. A restart is silent: she
 is constructed again with the same cells. Three keys at their root are the
 ward's, `standings`, `occupants` and `class`, and a write of hers to them is
 refused where she wrote it, like a non-value. A value nested past sixty-four
-levels, a hole in a list, an accessor, and a key named `__proto__` are
-refused the same way: JSON writes each one way and a runtime reads it
-another, so no harbor can keep them.
+levels is refused the same way, and that bound is Quo's because a far ward
+reads what a near one wrote: a kit with a deeper stack still refuses at
+sixty-four, or two kits disagree about which blueprint is a value. A kit
+refuses beside it whatever its own runtime writes one way and reads another,
+and those are its own.
 
 ```
 cells
@@ -533,7 +639,12 @@ cells
   occupant and a standing that are the same far being: all hers. `invite`
   may seed it, which is how an inviter says the terms it mints under, and
   after that it is written by nobody but her. The owner's `invite` passes
-  what it was given straight through; the ward reads none of it.
+  what it was given straight through; the ward reads none of it. What is
+  seeded is values and is kept as a copy, all the way down: notes that were
+  not values would be a record no harbor could write back, and notes shared
+  with whoever seeded them would be a hand inside her cells that writes
+  without the ward being told, so a restart would bring back something she
+  never read. Notes that are not values are no invitation.
 
 ## Relations
 
@@ -724,11 +835,22 @@ Three keys per relation over its life, one rule at the door: the key I hold
 for you may speak, and so may the key it announced last time, and each
 number once.
 
+A send that announces nothing leaves the spare standing. Every ask announces
+its next but a public one, which holds no heir and is one key for life, so
+this is a foreign kit's send and not this one's; and a caller who skipped an
+announcement still holds the key she announced before it. The door forgets no
+key it vouched for until another replaces it, and forgetting one here would
+meet that key with silence at the next ask and kill a healthy relation over a
+field. On a fresh heir the rule is the other one: nothing announced is
+`unannounced`, because there the announcement is what binds.
+
 Every key in a relation was minted by one side and its secret never left
 that side, except the heir, which the inviter gives away and which dies the
 first time it speaks. No key serves two relations. No key outlives its
-relation. A ward keeps only the last eight pks a being's side minted, which
-is enough to name the keys in play.
+relation. A ward keeps a bounded list of the pks a being's side minted, and
+how long it is, is that ward's own: nothing in Quo reads the list, so a
+shorter one costs a shorter trail for whoever is looking at the ward, and a
+kit that keeps none holds the same ward.
 
 ### The count
 
@@ -766,9 +888,8 @@ what she asked for held to what her ward allows: a number that is not a
 positive whole number falls to the default rather than refusing her, and one
 above the ceiling is the ceiling, silently, because the ceiling is not hers
 to know. Budget is granted by a ward, never minted by a being. How wide the
-default and the ceiling are is the ward's own; this ward's are thirty
-seconds by default and five minutes at the ceiling, in
-`src/ward/allowance.ts`.
+default and the ceiling are is the ward's own, and no far door can tell one
+ward's from another's.
 
 They are two numbers and not one, because the third argument is for both
 directions. A being who knows her own work asks for less on the ask she wants
@@ -848,7 +969,7 @@ is the one door a stranger may walk through, and only because she chose it.
 
 Inner: being keys, ids, cells, stances, doors, the bind table, every secret,
 every method, every arg, every answer. Nothing inner is ever readable in the
-bytes, and `test/ward.test.ts` reads every byte string that crossed to check.
+bytes, and a kit proves it by reading every byte string that crossed.
 
 Outer: ward pks, heir pks, ephemeral pks, ciphertext. That is the whole of
 what the wire sees. The one value a being holds that is outer is the
@@ -860,25 +981,20 @@ share no key learn nothing from each other.
 
 ### The wire
 
-Four algorithms, named once and never negotiated: Ed25519 signs, X25519
-agrees, SHA-256 hashes, AES-256-GCM encrypts with key and nonce derived
-together by HKDF-SHA-256 under an empty salt and the label `quo-seal`. That
-label is the message cipher's and no other: HKDF appears twice in this kit,
+Five algorithms, named once and never negotiated: Ed25519 signs, X25519
+agrees, SHA-256 hashes, AES-256-GCM encrypts, and the key and nonce it
+encrypts under are derived together by HKDF-SHA-256 under an empty salt and
+the label `quo-seal`. That
+label is the message cipher's and no other: HKDF appears twice in Quo,
 here from an agreement and again at the ward key from a seed, and the three
 labels, `quo-seal`, `quo-ward-sign`, `quo-ward-seal`, are three so that two
 derivations never answer to one name. The
 ephemeral pk is the additional authenticated data of every box. A small-order
-public key verifies nothing; an all-zero agreement is refused. All four are
-in WebCrypto, which is why the ward names no package -- on any terrain that
-carries them. SHA-256, AES-GCM and HKDF are everywhere; the two curves are
-recent, and a terrain without them is a terrain no ward runs on. The floor is
-named and probed in `test/floor.test.ts`. `crypto.subtle` is read at every use
-and never captured at load, so a page without one -- a plain http:// origin, a
-sandboxed frame -- fails at the first ask with one sentence rather than deep
-inside a key import. The arithmetic is `src/ward/arithmetic.ts`, the seal is
-`src/ward/seal.ts`, and `vectors/arithmetic.json` and `vectors/framing.json`
-hold fixed inputs and outputs so a kit in another language proves it agrees
-on the bytes.
+public key verifies nothing; an all-zero agreement is refused. SHA-256,
+AES-GCM and HKDF are everywhere; the two curves are recent, and a terrain
+without them is a terrain no ward runs on. `vectors/arithmetic.json` and
+`vectors/framing.json` hold fixed inputs and outputs so a kit in another
+language proves it agrees on the bytes.
 
 ```
 ask on the wire     box     = ephemeral X25519 pk (32) || AES-GCM( payload || signature (64) )
@@ -914,6 +1030,33 @@ opens the reply with it. A reply that does not open, or is not signed by the
 ward it was sent to, is silence. Unreached never crosses: the wire's nothing
 is it.
 
+There is one size, and it is on the bytes: a door refuses the bytes of an ask
+above **one mebibyte**, and a sender refuses the bytes of a reply above the
+same, each before anything is opened. Refusing them is bytes that said
+nothing, which is already silence, so it is D1 at the door and S4 at the
+sender, and there is no tenth word and no case of its own. The number is one
+because breadth costs bytes: an ask with a thousand args, a blueprint with a
+thousand asks and a reply with a million-element list are all one box that is
+too big, and a second number for any of them would be a second thing two kits
+must agree on for nothing. What a being holds in her cells is not this
+number's business and not Quo's: only what crosses is bounded. One mebibyte
+because an ask is a message and not a file, and what is larger is asked for
+in pieces, by a being who knows how her own work divides.
+
+The hand to a kit in another language is two things, and they are of two
+kinds. `vectors/` is the byte-level hand: fixed inputs and outputs for
+everything a stranger can observe, the arithmetic, the ward pk, the digest,
+the signed body, the sealed shapes, the invitation, the knock, and the
+frames on a socket and the one request a door takes. A kit reproduces them
+or it is not this protocol. The conformance suite is the behavioural hand,
+and it is a checklist and not a harness: one ward is one runtime and one
+language, so the beings a suite is shown with run only in the ward its kit
+wrote, and a kit ports the suite and its beings and reads them beside its
+own. No kit
+drives a foreign ward through its door, and nothing is owed
+here before 1.0.0 that does: the door's thirteen cases and the vectors are
+what two kits meet on, and the suite is what each proves alone.
+
 ## The ward
 
 ### What a ward is
@@ -946,40 +1089,31 @@ run and the next, a ward is
 nothing at all.
 
 One ward is one runtime and one language, and every being in it shares both.
-A harbor that wants two languages starts two wards at least. Under
-`src/being/`, `src/ward/`, `src/harbor/` and `src/conformance/` no runtime is
-named. The whole
-platform surface is the language plus ten globals. Six are the ward's own:
-`crypto`, `TextEncoder`, `TextDecoder`, `structuredClone`, `setTimeout` and
-`atob`. Four more came with the harbor, and are the whole of what a reach
-costs: `fetch` and `WebSocket`, the two kinds of reach; `DataView`, the frame
-id on a socket; and `clearTimeout`, the dialer's reconnect called off. That
-list is a promise, not an accident: `test/terrain.test.ts` fails the build
-both when a file names a platform and when it reaches for a global outside
-the list, and when the list names one the tree has stopped using.
-
-The package exports the emitted `dist/`, JavaScript with a declaration
-beside it, on every specifier, so plain Node imports it; the tree runs the
-source directly, and every other terrain reaches a ward through a
-bundler. `test/bundle.test.ts` bundles the three words and runs them, and
-asserts the artefact carries nothing a terrain cannot provide.
+A harbor that wants two languages starts two wards at least. A ward names no
+runtime: what it stands on is the language and whatever the terrain hands it,
+and a kit that named one would be a ward that runs in one place.
 
 The conformance suite is the ward's truth, so it has to be checkable wherever
-a ward runs. It names no runtime either: its runner is handed in, and the five
-assertions it makes are `src/conformance/assert.ts`, held to
-`node:assert/strict`'s own behaviour by `test/assert.test.ts`.
-`test/terrain/exercise.ts` is what every terrain runs -- the whole suite,
-under all three topologies, and the floor probe. Node is the reference: no
-terrain carries a count of its own, so a test added to the suite is demanded
-of every terrain at once. Five run it: Node, a browser, workerd, Deno and
-Bun. Bun is the one that is not V8, so "the language alone" is checked
-against two implementations of the language and not one.
-
-`npm run check` is Node alone, and stays fast. `npm run check:terrain` is
-every other terrain, the browser, workerd, Deno and Bun, kept apart because
-each is a binary of its own and the browser is a download and not a
-package: a fresh clone needs `npx playwright install chromium` first, and is
-told so in one sentence rather than a stack trace.
+a ward runs. It names no runtime either: its runner is handed in. It is
+written against the stance, which is Quo's, and it reaches a kit through one
+probe, which every kit writes for itself. The probe is six obligations, and a
+kit that can meet them can be put under the suite:
+
+1. Boot a being of a named class into a ward, and say which key she has.
+2. Hand over that ward's ask pointer, so the suite can pilot it as its owner.
+3. Show the ward's ledger as values: its heir table and its bind table, read
+   and never written, so the suite can see that a refusal wrote nothing and
+   that a knock bound what it should.
+4. Boot a ward from a partition it is handed, which is what proves a restart
+   and what proves an adoption.
+5. Move a ward from one harbor to another keeping its pk, which is what
+   proves that a relation survives the move.
+6. Produce a knock signed with a key nobody announced, which is the one thing
+   the suite sends through a door as a stranger would.
+
+A kit that cannot do one of these under the topology it is being run in says
+so at the call, and the chapters that need it are skipped by name rather than
+passed in silence.
 
 ### The partition
 
@@ -987,8 +1121,9 @@ Everything durable a ward has is here, every secret included, and nothing
 here is ever in a being's cells. Values only, so the harbor may persist it as
 it likes: as this process's objects, as a row, as a line of JSON on a disk. A
 reboot from its JSON is the same ward. A harbor that keeps it copies it
-through JSON and never structured-clones it: what the ward hands out is
-behind the cells guard. The shape is `src/ward/partition.ts`.
+through JSON and by no deeper copy its language offers: what the ward hands
+out is already values, behind the cells guard, and a copy that carries more
+than JSON does would carry a shape a reboot cannot give back.
 
 ```
 partition
@@ -1001,11 +1136,11 @@ partition
                           spoke: bytes came back once. sent: bytes went out once, answered or not
                           bounded, oldest out, and one that answered outlives one that never did
               answered    <ward>:<heir> | public:<ward> -> true                            knocked and answered
-              minted      the last eight pks her side minted. nothing in the ward reads it: it is there to
+              minted      the pks her side minted, bounded. nothing in the ward reads it: it is there to
                           be looked at, and a kit that keeps the list empty holds the same ward
   heirs     heir pk -> { being, id, current, announced, fresh, mark, spent }   the door's view of every occupant
-  gone      heir pk -> { current, announced }   the keys held when an id was removed, bounded, so their
-                                                holder hears `removed` and nobody else hears a thing
+  gone      heir pk -> { current, announced }   the keys held when an id was removed, bounded, oldest out,
+                                                so their holder hears `removed` and nobody else a thing
   public    the one public being's key, or null
 ```
 
@@ -1020,6 +1155,17 @@ since an answered knock is a relation she may still take. A being who knocks
 without ever taking keeps a fixed number of keys behind her, not one per
 invitation she ever met.
 
+How long each of the three bounded lists is, is the ward's own, and each says
+what a reader loses when it bites. A `gone` record past the count is a
+removed relation whose holder hears silence where she would have heard
+`removed`, which is what every stranger hears and tells her nothing she can
+act on. A knock record past the count is an invitation she cannot take, and
+she knocks again with it or asks for another. The `minted` list is looked at
+and never read, so its oldest entry going costs a name for a key already
+dead. None of the three is observable to a far ward as a number: a far side
+sees only that some old thing is unknown here, which is what it sees from a
+ward that booted onto a fresh partition.
+
 The version is one value and it does not move until 1.0.0. There is nobody
 holding a partition of another shape to tell apart: if the shape changes, a
 partition is thrown away, not migrated and not counted. A ward opening a
@@ -1092,15 +1238,15 @@ ward names every arrival on the ask `{ id: 'OWNER' }`, the third asker of the
 ward-to-being edge, and answers it as such; an owner at the door arrives as
 her id. What an owner can do is reach into a being from outside, which no
 being can: mark the public being, place a relation into a being of the
-ward, take one out of her, and take her out of the ward. Boot it shares
-with every being of the ward. The root's asks carry no allowance of
-their own. The ward is a being to her owner: the empty ask is her describe,
+ward, take one out of her, take her out of the ward, and ask her. Boot it
+shares with every being of the ward. The ward is a being to her owner: the
+empty ask is her describe,
 and each ask in it carries a description and an input naming its fields, as
 a being's asks do, so that a side renders the owner's asks the way it
 renders anyone's and holds no list of its own.
 
 ```
-ask()                                    -> { asks: [boot, public, invite, knock, remove, unboot],
+ask()                                    -> { asks: [boot, public, invite, knock, remove, unboot, ask],
                                               notes: { pk, beings: { key: { class, public, digest, absent? } } } }
 ask('boot',   { key, class })            -> { booted: key } | { error }
 ask('public', { key })                   -> { public: key } | { error }
@@ -1110,11 +1256,14 @@ ask('knock',  { being | { boot: class, key },
                                          -> { taken: id | null, answer } | { error: 'silence' | 'unreached' | ... }
 ask('remove', { being, id })             -> { removed: id } | { error }
 ask('unboot', { being })                 -> { unbooted: key, removed: [id, ...] } | { error }
+ask('ask',    { being?, method?, args?, wanted? })
+                                         -> her object | { error: 'silence' | 'threw' | 'late' | ... }
 anything else                            -> { error: 'unknown ask' }
 ```
 
-- The owner is a caller like any other: `wanted` says what its knock may
-  spend, and saying nothing is the ward's default, exactly as for a being.
+- The owner is a caller like any other: `wanted` says what its knock or its
+  ask may spend, and saying nothing is the ward's default, exactly as for a
+  being.
 - The describe runs every being's own describe as `OWNER` and hashes it; a
   being that throws or falls silent there shows a null digest. A being
   absent this run is listed with a null digest and `absent: true`.
@@ -1165,6 +1314,16 @@ anything else                            -> { error: 'unknown ask' }
   the root may ask it, for the reason only the root may invite one: from the
   door it is answered as a remove on nobody. Ownership moves by the root
   alone.
+- **The owner's ask is the third asker of the ward-to-being edge, filled in
+  by the ward.** It reaches into a being and asks her, which is strictly less
+  than unboot, and it is the only way to that asker: nothing outside the
+  ward names `OWNER`. She is judged as any arrival is, the three choices and
+  no others, and the wait is bounded like any other. She hears `threw` for a
+  throw, a word out of her, or a shape that is not hers to make, and the
+  owner hears each as an object. With no being named it is the public being,
+  asked as nobody, and unbound: a stranger's view, so a throw of hers is
+  silence, and a device serving her to strangers hears what a stranger hears
+  and no more. The ward itself is refused, and so is a name no being holds.
 
 The door is a ward function. It is not the ward's answer: it judges before
 anything is named, and a being's answer only ever receives named askers. The
@@ -1249,6 +1408,20 @@ The harbor:
 - Passes every ward the ground, once, at birth. Receives a door and an ask.
   Hands the ask to exactly one holder, by the device's own rules. That
   holder is the ward's owner.
+- Boots a ward of its own, when the device has anything to lend, and keeps
+  its ask pointer rather than handing it out, so it is that ward's root.
+  What the device can do lives there as beings, and `lend` mints an
+  invitation on one for a ward that asks, hands it to that ward to knock and
+  take, and removes what it minted where the ward did not take it. Which ward
+  may ask for which name is the harbor's own, and a stranger's ward is lent
+  nothing. Nothing else about that ward is special: it has a seed, a
+  partition, a door and beings, and every ask that reaches one of them is
+  sealed, counted and judged like any other. Those beings are where a world's
+  time comes from. A being runs only while she is answering, so every ask in
+  Quo is asked by a being or by an owner, and a world in which nobody holds a
+  clock, a line or a socket is a world where nothing happens that nobody
+  asked for. What a device has, one of its beings holds, and she begins
+  holding it at birth like anything else she does with her constructor.
 - Hands its own device's code the beings it made for a ward, by key, and the
   keys it has. This is not a path around a door. The object is already in
   that process, made there a moment ago by the harbor itself, and reaching
@@ -1286,37 +1459,28 @@ Not stressed with:
 - Fanning out, broadcasting, or forwarding to a pk other than the one it was
   given. One pk is one ward is one door.
 - Choosing a class, deciding an id, reading the keys inside a relation,
-  minting an invitation, or acting on anything a partition contains.
+  minting an invitation on a ward it does not root, or acting on anything a
+  partition contains.
 - Judging anything. A ward judges its door. The harbor delivers to it.
 - Speaking Quo. It is nobody's occupant and holds no standing anywhere. The
   harbor is not a ward and is nobody's.
 
-The memory harbor, `src/harbor/memory.ts`, is one process and no wire. It
-keeps partitions by seed, routes its own doors, and may be linked to peers,
-which stands in for a wire, and cut, which stands in for weather. It routes
-one hop: a pk that is not its own and not a direct peer's is nothing. It
-keeps no lease: two of them may hold one seed and one partition, which is
-the broken vouch every real harbor refuses, kept here so that the tests can
-show what divergence looks like. Every ward and being assertion in the tree
-is made on it first, so that the network never hides a fault in the words;
-the harbor core then passes the same suite over memory stores.
-
 What a harbor on a device keeps is a ward's three parts under one name: the
 seed, the partition, and a **ward record**, which says where the class
 bodies come from and which being is the user's. `user` is a key and nothing
 else: a label the device's own code hands back to get the being it made,
-never read to route a byte or judge an ask. That is the **store**,
-`src/harbor/store.ts`: list, load, put, save the partition when the ward wrote,
-save the record after a boot learned the pk, take a ward out as the first
-move of a migration, and keep the directory's hints, a pk to a URL, across
-a restart. A name already kept is refused. A store reads nothing it keeps
-and hands the partition back as values, never as the object it was given.
-The memory store beside the interface is the library's own; a disk, a tab
-and an edge object each have theirs, outside this tree, and every one of
-them passes `src/conformance/store.ts` untouched.
-
-Carrying bytes to a pk off the device is a **reach**, `src/harbor/reach.ts`:
-carry bytes to a pk, get bytes back or nothing. Two kinds, and no third:
+never read to route a byte or judge an ask. Wherever those three parts are
+kept is a **store**, and what a store owes is the same everywhere: list what
+it holds, load and put a ward under a name, save the partition when the ward
+said it wrote, save the record after a boot learned the pk, take a ward out
+as the first move of a migration, and keep the directory's hints, a pk at a
+URL, across a restart. A name already kept is refused. A store reads nothing
+it keeps and hands the partition back as values, never as the object it was
+given. A disk, a tab, an edge object and a process's own memory are each a
+store, and every one of them answers the same way.
+
+Carrying bytes to a pk off the device is a **reach**: carry bytes to a pk,
+get bytes back or nothing. Two kinds, and no third:
 a **request**, one URL, the bytes posted to it with the pk as the last
 segment and the reply as the answer, listener to listener; and a
 **socket**, one held line used in
@@ -1324,10 +1488,9 @@ both directions, opened by whichever side can dial, with a frame id
 matching each reply to its ask and one text frame in which a side announces
 the ward pks it holds. The framing on a socket is binary: an ask is a kind
 byte, a four-byte id, the 64-byte pk and the bytes; a reply is the kind, the
-id and the bytes; and nothing delivered is the kind and the id alone. Both
-kinds are written on the standard surface every terrain carries, fetch and
-WebSocket, and this tree holds either end of a line and never a listener:
-who accepts a socket is the terrain's business. A reach reads nothing; a
+id and the bytes; and nothing delivered is the kind and the id alone. A kit
+holds either end of a line and never a listener: who accepts a socket is the
+terrain's business. A reach reads nothing; a
 harbor opens no box but its own probe's.
 Nothing comes back only where the reach knows nothing was delivered: no such
 pk at the far end, a connection that would not open or closed before it
@@ -1335,9 +1498,8 @@ opened, a line already gone, a status from a request that says the listener
 did not take the bytes, refused on their face or with nobody behind the
 gateway. A
 reach that sent the bytes and lost the line after answers nothing at all,
-and the ward's bound ends the ask. Every reach passes
-`src/conformance/reach.ts` untouched, and the frames are pinned in
-`vectors/wire.json`.
+and the ward's bound ends the ask. The frames are pinned in
+`vectors/wire.json`, and every reach of every kind answers alike.
 
 A reach also carries the **wire suite**: which frames these are, and which
 five algorithms seal what they travel with. It is one number, it is not
@@ -1350,10 +1512,10 @@ speaks. A side meeting a suite it does not know carries nothing for it and
 closes, naming the refusal on the way out with close code 4001; a
 request door meeting one answers nothing delivered. A dialer refused that
 way waits out the ceiling before asking again, because a suite does not
-become speakable by asking sooner. Its wait returns to the first second
+become speakable by asking sooner. Its wait goes back to the shortest one
 where the far side announced and was taken, and not where the line merely
 opened: a listener that opens and then refuses would otherwise be dialed at
-a fixed two seconds for good. Absent is this suite,
+one fixed short wait for good. Absent is this suite,
 because a caller older than the header is this one. Present and different is
 refused as it is written: the number is compared as it was sent, so a suite
 is one spelling and not a family of them.
@@ -1366,8 +1528,8 @@ has to be able to say so to a kit that cannot, or the day it arrives every
 world stops answering at once and none of them can say why. A silence names
 no reason, by law. This number is the reason, said before the silence.
 
-The **harbor core**, `src/harbor/core.ts`, is what every harbor on a device
-is: the store and the reach put together under the ground. It boots every
+The **harbor core** is what every harbor on a device is: the store and the
+reach put together under the ground. It boots every
 ward the store keeps, keeps the map of ward pk to door for its own wards
 and the **directory**, pk to reach, for foreign ones, carries bytes to a
 pk and delivers bytes from the wire to one door. The directory is filled
@@ -1399,13 +1561,14 @@ silence a door owes such a box, signed by the claimed key. One rule makes a
 any listener: bytes that arrive from the wire go to an own door or to a
 socket this harbor holds for that pk, and never onward by request. So a
 harbor that cannot be dialed is reached through the one it dialed, by
-anyone who holds a hint that its pk is there. The **dialer**,
-`src/harbor/dial.ts`, is that harbor's half: one held socket to a URL, its
+anyone who holds a hint that its pk is there. The **dialer** is that harbor's
+half: one held socket to a URL, its
 own pks announced when the line opens and again whenever what this harbor
 holds changes, so a ward booted, adopted or dropped on a line already in hand
 is reachable through it without waiting for that line to fall; the listener's
 bound, dialed again
-with a wait that doubles from a second to thirty when the line drops, and
+with a wait that backs off to a ceiling when the line drops, how far being
+that harbor's own, and
 while it is dialed it is one of the harbor's fallbacks, where a pk nobody
 here knows is sent. A device that slept, a phone in a pocket, comes back
 with that wait frozen and, often, its socket closed under it by the system
@@ -1486,364 +1649,14 @@ whether an occupant is a person, a model or a program.
 9. Whatever her ward cannot name is not hers to worry about: what the ward
    does with an arrival it cannot name is the ward's.
 
-### The base class, and the raw shape
-
-A being is anything with a constructor taking the stance and an `answer`.
-The raw shape needs no import from the kit. The kit also offers a base class,
-`Being` in `src/being/being.ts`, which is a convenience and not Quo:
-
-- `static cells` are her defaults, merged at birth only where a key is
-  missing, so a restart keeps what she wrote.
-- `static asks` declares what she can be asked, name to
-  `{ description?, input?, output?, for? }`, in blueprint order.
-  `for(occupant, asker)` decides whether this asker sees the ask, and so
-  whether this asker may call it: what she shows is what she can be asked,
-  one gate for describe and for dispatch.
-- Both statics are read off the class the object was made from, and a
-  subclass that declares either **replaces** its parent's rather than adding
-  to it. That is the rule and not an oversight: a being's blueprint is
-  exactly what the class in front of you declares, in the order she chose,
-  and a merge would hand her asks she may mean to drop and an order she did
-  not write. A subclass that means to extend says so, in one spelling,
-  `static override asks = { ...Parent.asks, mine: {} }`, and the same for
-  cells. A parent that means to be subclassed at all annotates rather than
-  infers, `static override cells: JsonObject = { ... }`, since this language
-  holds a subclass's static side to its parent's and would otherwise refuse a
-  subclass declaring fewer keys than the parent happened to write.
-- `answer` is written for her. The empty ask is `describe(asker)`, which she
-  may override by hand. A named ask calls the method of that name with
-  `(args, asker)`. Anything not declared, hidden from this asker, or
-  inherited from Object's prototype is `{ error: 'unknown ask' }` and the
-  method is never entered.
-- A declared ask with no method, or one named after the base's own members,
-  fails at birth, loudly, so a boot fails and nothing half-lives. The
-  method is one on her prototype chain below Object's: a class field
-  holding a function is not there yet when the base checks, and the
-  refusal says so.
-- `occupant(asker)` is the occupant record for whoever is at the door, and
-  undefined at a public being. `invite`, `knock`, `take`, `boot`, `cells`,
-  `standings` and `occupants` reach the stance and nothing else.
-
-### Examples
-
-The smallest being. Answers whoever her ward names, describes one ask.
-
-```js
-class Echo {
-  constructor(stance) {
-    this.s = stance;
-  }
-  answer(asker, method, args) {
-    if (method === undefined) return { asks: [{ name: 'echo', input: {} }], notes: {} };
-    return { from: asker.id ?? null, ...args };
-  }
-}
-```
+### The raw shape
 
-A shop. Invites in her own time, hands the invitation out by any channel,
-and takes a guest back only if the guest offers a way.
-
-```js
-class Shop {
-  constructor(stance) {
-    this.s = stance;
-  }
-  async invite(name) {
-    const id = `g-${name}`;
-    const inv = await this.s.occupants.invite(id);
-    this.s.cells.occupants[id].notes.expireAt = 2028; // hers, not Quo's
-    return inv; // goes by mail
-  }
-  async answer(asker, method, args) {
-    if (method === undefined) return { asks: [{ name: 'hello', input: {} }], notes: {} };
-    if (asker.id === undefined) return { welcome: false }; // a stranger at the public door has no record
-    const rec = this.s.cells.occupants[asker.id];
-    if (method === 'hello' && args.invitation) {
-      const back = await this.s.standings.knock(args.invitation, 'hi');
-      if (back !== silence && !isUnreached(back))
-        await this.s.standings.take(`back-${asker.id}`, args.invitation);
-    }
-    return { welcome: rec.notes.expireAt > 2026 };
-  }
-}
-```
-
-A guest. Consumes an invitation, and only then decides to keep the shop.
-
-```js
-class Guest {
-  constructor(stance) {
-    this.s = stance;
-  }
-  async join(invitation) {
-    const mine = await this.s.occupants.invite('shop'); // so the shop can reach me
-    const out = await this.s.standings.knock(invitation, 'hello', { invitation: mine });
-    if (out === silence || isUnreached(out)) return out; // nothing was born
-    await this.s.standings.take('shop', invitation); // now, and only now
-    return out;
-  }
-  answer(asker, method) {
-    if (method === undefined) return { asks: [{ name: 'hi', input: {} }], notes: {} };
-    return { heard: method };
-  }
-}
-```
-
-A relay. Forwards every ask to one standing and never looks inside, and asks
-for a short wait because she is one door of several. Silence passes through
-her; a word does not, since a word out of a being is `threw` at the door,
-D13, so she says it as an error of her own.
-
-```js
-class Relay {
-  constructor(stance) {
-    this.s = stance;
-  }
-  async answer(asker, method, args) {
-    const out = await this.s.standings.next.ask(method, args, { time: 2000 });
-    return isWord(out) ? { error: wordOf(out) } : out; // unreached and late reach her asker as an error, not as a throw
-  }
-}
-```
-
-A watcher. Notices a standing changed shape, then decides.
-
-```js
-class Watcher {
-  constructor(stance) {
-    this.s = stance;
-  }
-  async answer(asker, method, args) {
-    if (method === undefined) return { asks: [{ name: 'poke', input: {} }], notes: {} };
-    const out = await this.s.standings.src.ask('read', args);
-    const rec = this.s.cells.standings.src;
-    if (rec.seen !== rec.digest) {
-      const bp = await this.s.standings.src.ask(); // refresh, or
-      if (!bp?.asks.some((a) => a.name === 'read')) this.s.standings.remove('src'); // walk away
-    }
-    return out;
-  }
-}
-```
-
-## The tree
-
-The repository is one TypeScript implementation of this document, run
-directly on Node's type stripping, no dependencies. Node 22.18
-or later. The package is `@quo-systems/quo`, published from 0.1.0, the
-first version under this name, and it starts over: nothing before it under
-any other name is this protocol. Before 1.0.0 every version may change the
-words, and nothing is kept for a holder of an earlier one.
-
-The tree runs as TypeScript and the package ships as JavaScript. Node
-strips types nowhere under `node_modules`, so a consumer cannot load the
-source. `npm run build` emits `dist/` from `src`
-alone, one JavaScript file and one declaration file per source file with
-every relative import rewritten, and the exports map points there, types
-beside default. The
-build runs before every gate and every publish and is never tracked;
-nothing in this repository imports it except through the package name,
-which is how a consumer does. `test/package.test.ts` is the one
-suite that meets the package as a stranger: it packs the tarball,
-installs it into an empty folder, and imports every entry point under
-plain Node. `npm pack --dry-run` shows what ships: `dist/`, the four
-source folders, the vectors, this document, the README, the licence and
-the notice, and nothing else. This document ships, decided here: it is the
-truth the source and the vectors are read against, and a kit in another
-language is written against it and nothing else. Publishing runs both
-gates first, `npm run check` and `npm run check:terrain`, and refuses on a
-failure.
-
-```
-src/being/        the Being side. types, the base class, silence, the digest.
-src/ward/         the ward. the Ground contract, door, seal, arithmetic, heirs, stance, owner, partition, cells, allowance.
-src/harbor/       the memory harbor, the store, the reach, the dialer and the harbor core.
-src/conformance/  the behaviours any ward must show, and the fixed beings they are shown with.
-test/             the suites.
-vectors/          fixed inputs and outputs: the arithmetic, Quo's own framing, the frames on the wire.
-```
-
-The hand to a kit in another language is two things, and they are of two
-kinds. `vectors/` is the byte-level hand: fixed inputs and outputs for
-everything a stranger can observe, the arithmetic, the ward pk, the digest,
-the signed body, the sealed shapes, the invitation, the knock, and the
-frames on a socket and the one request a door takes. A kit reproduces them
-or it is not this protocol. `src/conformance/` is the behavioural hand, and
-it is a checklist and not a harness: one ward is one runtime and one
-language, so the beings it is shown with run only in a TypeScript ward, and
-a kit ports the suite and its beings and reads them beside its own. Nothing
-in this tree drives a foreign ward through its door, and nothing is owed
-here before 1.0.0 that does: the door's thirteen cases and the vectors are
-what two kits meet on, and the suite is what each proves alone.
+A being is anything her language can construct with the stance and ask with
+`answer`. She needs no import from any kit, and a kit that could only make
+beings out of a base class of its own would be a kit standing between a
+being and her ward.
 
-Entry points: `@quo-systems/quo` is the Being side, `@quo-systems/quo/ward`
-is `Ward`, `@quo-systems/quo/harbor` is `MemoryHarbor`, `Harbor`, the
-store, the reach and the dialer, and `@quo-systems/quo/conformance` is
-`conform` with the store and reach suites beside it.
-
-The gate is `npm run check`: typecheck under TypeScript 7, oxlint with
-type-aware rules, markdownlint, then every suite under `node --test`. There
-is no CI; the gate runs in seconds and is run before every commit. Nothing
-red is committed except a test marked todo, which is a claim the tree does
-not yet meet and says so.
-
-### The suites
-
-The beings are fixed and the ward is what is tested. A ward kit in any
-language offers the ground, the door, and the owner's ask as written, and
-passes the same suite. Those tests are the checklist, not the mock.
-
-- `test/being.test.ts`: the base class against a stance stub. No ward, no
-  harbor. Defaults, describe, dispatch, the gate, the reserved names, the
-  digest.
-- `src/conformance/index.ts`: one suite of behaviours, written against the
-  stance and one probe: a kit hands the suite its ward's heir table and
-  bind table as values, and a forged knock, so the suite can see that a
-  refusal wrote nothing and a knock bound what it should. It reads the
-  tables and never writes them; the forged knock is the one thing it sends
-  through a door. With the beings in `src/conformance/beings.ts`: a
-  printer, a shop, two customers, one raw being with no base class, and a
-  member of an estate. Any ward must pass it, under any topology.
-- `src/conformance/estate.ts`: the estate, and the last chapter of that
-  suite. Every other chapter is a scene: three beings, one move, one answer.
-  This one is a graph under churn, which is the shape an organisation running
-  on Quo actually has -- scattered wards on scattered harbors, partners and
-  employees invited, knocking, taken, kicked, and moving to harbors of their
-  own. It keeps a model of the graph, plays legal moves against it from three
-  fixed seeds, and after every move holds two things: that the ledger every
-  ward keeps closes on both ends, and that every arc in it answers when asked
-  exactly what being that arc means. The second is held under all three
-  topologies, and that is the promise of Quo at a scale a scene cannot
-  reach: the model never learns the topology, so neither may any answer. The
-  model is the script's own bookkeeping and is never compared with itself
-  across topologies, which would hold by construction and prove nothing. A
-  relation is two arcs and never one edge:
-  the occupant is the host's, the standing is the guest's, and the model
-  keeps them apart because the ward does. A red run prints its seed and the
-  moves that got there. It is read beside one hand-written story that says in
-  prose what the model is for.
-- `test/ward.test.ts`: the conformance suite against the real ward under
-  three topologies over the memory harbor, one ward, one harbor with a ward
-  per being, two harbors; and what only a real ward can be asked: the
-  owner's asks, the door judged byte by byte, rotation and a lost reply,
-  replay, a restart, and every byte on the wire inspected for anything inner.
-- `test/public.test.ts`: the public being, what the door does and does not
-  do for her.
-- `test/silence.test.ts`: the chapter "Silence, the words, error" by its
-  numbers: the five cases and two unreacheds of her ward, the thirteen
-  cases of the door with a partition snapshot under each, seven strangers
-  met with one silence and six bound keys hearing their word, hops refused
-  at zero, and the six lines of the law of one silence.
-- `test/blueprint.test.ts`: blueprints and instantiation through a real
-  ward. What a boot leaves behind, what a restart brings back when the code
-  moved under the cells, the gate and the door, the reserved ids.
-- `test/allowance.test.ts`: the allowance. Default, ceiling, nonsense, the
-  bound, the signed body, the door's refusal, and one ask through a ward.
-- `test/seal.test.ts`: the arithmetic against `vectors/arithmetic.json`,
-  then the seal, round trip, and what it refuses; then the framing against
-  `vectors/framing.json`. The arithmetic is standard and any language has
-  it. The framing is Quo's own, and a kit that reproduces the hashes and
-  not the ward pk, the digest, the signed ask body, the two sealed shapes,
-  the invitation or the knock is not this protocol. Every seed in that file
-  is fixed, so every output is fixed. The ask body is the payload as JSON
-  and is not canonical: the vectors pin the order the type declares, and a
-  kit that emits another order interoperates, because a door verifies the
-  bytes it received, and will not reproduce the vectors. `hops` is in no
-  vector, because nothing sets it. The invitation is JSON too, and the
-  knock is pinned as the ask it is, by the heir, to the heir, announcing
-  the knocker's own key, and then proven at a real door: a ward booted on
-  the vector's seed, drawing the heir secret as its first entropy, mints
-  the invitation vector, binds the knock vector at its door, answers it,
-  spends the heir, and refuses the same bytes again.
-- `test/break.test.ts`: adversarial probes. Each states what this document
-  promises, then tries to break it.
-- `test/gaps.test.ts` and `test/gaps2.test.ts`: cases the memory harbor
-  cannot express because it is honest, in-order and lossless: a lost reply,
-  a cycle, a partition written down and read back, a long relation, one
-  seed booted twice. Each test is a claim that the ward is wrong; one that
-  will not go red is not a bug.
-- `src/conformance/store.ts`: the store suite, written against the store
-  interface alone and handed a maker of fresh stores. A fresh store keeps
-  nothing; what was put comes back as it went in, as values and not as the
-  object; a name already kept is refused; save and record touch only their
-  part and are nothing on a name not kept; take hands a ward out and frees
-  the name; hints are kept by pk and the last one wins.
-- `src/conformance/reach.ts`: the reach suite, written against the reach
-  interface alone and handed a far side it controls: a door held behind a
-  pk over there, and the far side dropped. The door's bytes come back;
-  nothing for a pk nobody holds; asks in flight at once each get their own
-  answer; what crosses is a copy both ways; and once the far side is gone,
-  nothing. It cannot assert that a reach which sent and then lost the line
-  answers nothing at all, since a suite cannot wait forever.
-- `test/harbor.test.ts`: the harbor pieces on the library's own ground,
-  no device and no wire. The store suite against the memory store; the
-  reach suite against the socket framing over two lines in one process, so
-  the frames are asserted with no network under them; the conformance
-  suite against two harbor cores over memory stores reaching each other
-  in-process, drop and adopt as the migration; a ward that moves harbor
-  keeping its pk and every relation, the rendezvous told on the line in
-  hand; a ward booted or dropped after a line opened, announced on that
-  line, and a claim on a pk nobody holds binding nothing; a restart from
-  the store with the hints; the dialer over a stubbed line, announce, a claim proven
-  at a real door before it binds and a claim nobody there holds left
-  unbound, fallback, unbind and the wait before it dials again; and the frames against
-  `vectors/wire.json`, the ask, the reply, nothing delivered and the
-  announce, so a kit reproduces the bytes on a socket; and the request
-  reach against the request record in the same file, over a fetch that
-  sees what a listener would, one POST with the suite in its header, the
-  reply as a 200 and nothing delivered as a 404. A socket to a real
-  listener and every real store pass the same suites outside this tree.
-- `test/terrain.test.ts`: the terrain census. Nothing under `src/being/`,
-  `src/ward/`, `src/harbor/` or `src/conformance/` names a runtime, and
-  nothing reaches for a global outside the ones it names; nor does the
-  census name one the tree has stopped using. It reads the source as text
-  and not as a parse: it is there to catch drift, and does not pretend to
-  stop someone determined to get around it.
-- `test/assert.test.ts`: `src/conformance/assert.ts` against
-  `node:assert/strict`, pair by pair. The suite means the same thing on
-  every terrain only if those two agree, so they are compared and not
-  trusted.
-- `test/floor.test.ts`: the five algorithms this terrain must carry, probed
-  one by one; that the arithmetic spends every one of them; and the two ways
-  a terrain can be short -- no `crypto.subtle` at all, and a subtle without
-  the curves -- each failing at the first call, in one sentence.
-- `test/package.test.ts`: the package as a stranger meets it. The tarball
-  is packed, installed into an empty folder with nothing but Node, and
-  every entry point the exports map names is imported. Every other suite
-  reaches the source through a path or a workspace link, which resolves
-  outside `node_modules`, where Node strips types; this is the one that
-  cannot.
-- `test/bundle.test.ts`: the three words bundled as a consumer must bundle
-  them, the artefact read for anything a terrain cannot provide, and then the
-  whole conformance suite run out of the bundle.
-- `test/terrain/browser.test.ts`, `test/terrain/edge.test.ts`,
-  `test/terrain/deno.test.ts` and `test/terrain/bun.test.ts`: that same
-  bundle and that same suite in a real Chromium, in workerd, in Deno and in
-  Bun, plus each terrain's floor, and, for the browser, a page whose
-  `crypto` has no `subtle`. Deno runs it a second time with every permission
-  denied but read -- no net, no environment, no write, no subprocess -- which
-  is where a ward that had quietly come to need one of them would fail, and
-  nowhere else in this repository. A terrain whose binary is absent skips and
-  names the command that installs it; it never passes quietly.
-  `test/terrain/engine.ts` runs the bundle in another engine on this machine.
-  Behind `npm run check:terrain`. `test/terrain/bundle.ts` is the
-  bundler and the reference run, `test/terrain/exercise.ts` is what every
-  terrain runs, `test/terrain/floor.ts` is the floor -- each written once, so
-  no terrain can be probed for less than another.
-- `test/world.ts`: the memory-harbor probe and the three topologies, held
-  apart from any one chapter because every terrain drives the same one. It
-  also answers the two asks the estate needs: the census, which is every
-  partition in the world as values, and a migration, which lifts a partition
-  out of one harbor and boots it from the same seed in the other -- same
-  seed, same pk, so every standing anyone holds still points at her.
-- `test/repo.test.ts`: this document, the README and the project
-  instructions against the repository: every path they name exists, every
-  source file carries its licence, the package names no host and no user,
-  the awaitable calls are marked and
-  awaited in the examples above, the allowance is decided here and off the
-  Open list, and the allowance is time alone on both sides of the door.
-
-### Where the tree stands
+## Where the tree stands
 
 The only place this document may name a gap between itself and the tree.
 Each line is a debt to close, not a note to keep.
@@ -1863,14 +1676,14 @@ Decided here, so that the answer is not rediscovered:
 
 - **Delivered, then died, is refused on repeat.** The far ward receives and
   crashes, the wire says nothing, and the near ward calls it unreached.
-  Nothing in the kit retries on its own, so a caller who asks again asks
+  No ward retries on its own, so a caller who asks again asks
   under the next number and is heard. A repeated number is refused by every
   door of this version, D10, and that is the whole answer: a repeated number
   is only ever seen by the one door it was sent to, so a kit that one day
   answers it from what the door already said interoperates with one that
-  refuses, the way one ward's ceiling never meets another's. That kit has
-  `last` on the heir to keep the reply in; nothing writes it, and nothing
-  reads it.
+  refuses, the way one ward's ceiling never meets another's. The slot for the
+  reply that kit would keep is a field on the heir, and it costs two lines to
+  cut now and a partition shape to cut after 1.0.0.
 - **Hops is the door's half, and that half is whole.** An ask carries no
   count of doors, so a chain of relays is bounded by time alone. `hops` is a
   field of the ask, a whole number and never below zero, and a door refuses
@@ -1951,10 +1764,15 @@ Decided here, so that the answer is not rediscovered:
 - **ward record**: what a harbor keeps beside a ward's seed and partition
   to boot her again: her pk, where the class bodies come from, and which
   being is the user's. The harbor's, never the ward's.
+- **size**: one mebibyte, on the bytes of an ask and on the bytes of a reply.
+  Read before anything is opened. Over it is silence, and never a word.
 - **lid**: the ephemeral X25519 pk an ask carries in front of its box. The
   reply is sealed to it and to nothing else. One per ask, never reused.
 - **edge**: one of the two seams of Quo, harbor to ward and ward to being.
   An object crosses once at birth, calls cross for the rest of the ward's
   life, and nothing else crosses.
-- **ground**: the one object a harbor passes a ward. Six things.
+- **ground**: the one object a harbor passes a ward. Seven things.
+- **lend**: a standing at one of the harbor's own beings, by the name that
+  harbor knows it under. The ward knocks and takes it for her; she is handed
+  the id and never the invitation.
 - **door**: the ward's one voice outward. Sealed bytes in, sealed bytes out.