@quo-systems/quo 0.2.13 → 0.2.15

package/src/conformance/beings.ts

@@ -3,7 +3,7 @@
 // shop, a customer on the base class, a maker, a member, and one raw being
 // with no base at all.
 import { Being } from '../being/being.ts';
-import { answered, isUnreached } from '../being/silence.ts';
+import { answered, isSilence, isUnreached, isWord, wordOf } from '../being/silence.ts';
 import { invitationArgs } from '../being/types.ts';
 import type { Ask, Asker, Blueprint, Invitation, Json, JsonObject, OccupantRecord, Reply, Stance } from '../being/types.ts';
 
@@ -138,6 +138,7 @@ export class Maker extends Being {
   static override asks = {
     open: { input: { type: 'object', properties: { class: { type: 'string' }, key: { type: 'string' }, id: { type: 'string' } }, required: ['class', 'key'] } },
     say: { input: { type: 'object', properties: { id: { type: 'string' } }, required: ['id'] } },
+    borrow: { input: { type: 'object', properties: { name: { type: 'string' }, id: { type: 'string' } }, required: ['name', 'id'] } },
   };
   async open({ class: className, key, id }: JsonObject) {
     const made = await this.boot(className as string, key as string, id as string | undefined);
@@ -148,13 +149,35 @@ export class Maker extends Being {
     const standing = this.standings[id as string];
     return { said: standing === undefined ? null : ((await standing.ask('ping')) as Json) };
   }
+  // Making's other half: a standing at something the box already has, by the
+  // name the box knows it under. She is handed the id and never the value.
+  async borrow({ name, id }: JsonObject) {
+    return { lent: await this.lend(name as string, id as string) };
+  }
 }
 
 export class Member extends Being {
   static override cells = { heard: [] as JsonObject[] };
-  static override asks = { ping: { input: { type: 'object' } } };
+  static override asks = {
+    ping: { input: { type: 'object' } },
+    relay: { input: { type: 'object', properties: { id: { type: 'string' }, method: { type: 'string' }, time: { type: 'number' } }, required: ['id'] } },
+  };
   ping(_args: JsonObject, asker: Asker) {
     (this.cells.heard as JsonObject[]).push({ from: asker.id ?? null });
     return { pong: asker.id ?? null };
   }
+  // She asks on one of her standings from inside her own answer, and says
+  // what came back as a word rather than as the word itself, since a word is
+  // her ward's value and never a thing that crosses. `time` is what she is
+  // willing to wait, which is the whole of what the third argument is for.
+  // Two members holding each other and relaying make a cycle, and a cycle is
+  // how a suite that owns no clock can see a wait end.
+  async relay({ id, method, args, time }: JsonObject) {
+    const standing = this.standings[id as string];
+    if (standing === undefined) return { said: 'no standing', out: null };
+    const out = await standing.ask(method as string | undefined, (args ?? {}) as JsonObject, time === undefined ? undefined : { time: time as number });
+    if (isSilence(out)) return { said: 'silence', out: null };
+    if (isWord(out)) return { said: wordOf(out), out: null };
+    return { said: null, out: out as Json };
+  }
 }

package/src/conformance/estate.ts

@@ -76,31 +76,31 @@ function ledger(c: Census, before: Census | undefined, where: string, g?: Graph)
   // is caught late, if the sweep happens to ask the affected arc, or never.
   if (g) {
     for (const s of g.seats) {
-      const heir = c.wards[c.binds[s.host]!.ward]!.heirs[s.inv.heir!];
+      const heir = c.wards[c.binds[s.host].ward].heirs[s.inv.heir!];
       if (!s.live) {
         assert.ok(!heir, at(`${s.host} kicked ${s.id} and the heir is still held`));
-        assert.ok(!(s.id in c.binds[s.host]!.occupants), at(`${s.host} kicked ${s.id} and still holds the occupant`));
+        assert.ok(!(s.id in c.binds[s.host].occupants), at(`${s.host} kicked ${s.id} and still holds the occupant`));
         continue;
       }
       assert.ok(heir, at(`${s.host}'s live seat ${s.id} has no heir`));
-      assert.equal(heir!.id, s.id, at(`the heir for ${s.host}/${s.id} is filed under ${heir!.id}`));
+      assert.equal(heir.id, s.id, at(`the heir for ${s.host}/${s.id} is filed under ${heir.id}`));
       // A seat nobody has knocked is a heir that has never spoken: fresh, and
       // at zero. One that answered has spoken, so it is neither.
-      assert.equal(heir!.fresh, !s.answered, at(`${s.host}/${s.id} is ${s.answered ? 'answered' : 'unknocked'} and its heir says fresh=${heir!.fresh}`));
-      assert.equal(heir!.mark === 0, !s.answered, at(`${s.host}/${s.id} is ${s.answered ? 'answered' : 'unknocked'} and its heir is at ${heir!.mark}`));
+      assert.equal(heir.fresh, !s.answered, at(`${s.host}/${s.id} is ${s.answered ? 'answered' : 'unknocked'} and its heir says fresh=${heir.fresh}`));
+      assert.equal(heir.mark === 0, !s.answered, at(`${s.host}/${s.id} is ${s.answered ? 'answered' : 'unknocked'} and its heir is at ${heir.mark}`));
     }
     for (const h of g.holds) {
-      const standing = c.binds[h.owner]!.standings[h.id];
+      const standing = c.binds[h.owner].standings[h.id];
       if (!h.live) {
         assert.ok(!standing, at(`${h.owner} dropped ${h.id} and the standing is still there`));
         continue;
       }
       assert.ok(standing, at(`${h.owner}'s live standing ${h.id} is gone from the bind table`));
-      assert.equal(standing!.heir, h.seat.inv.heir, at(`${h.owner}/${h.id} names a heir that is not the seat it was born on`));
+      assert.equal(standing.heir, h.seat.inv.heir, at(`${h.owner}/${h.id} names a heir that is not the seat it was born on`));
       // The count she has spent, against the number the far door honoured.
       // Her side is never behind: she takes a number, then it crosses.
-      const far = c.wards[c.binds[h.seat.host]!.ward]!.heirs[h.seat.inv.heir!];
-      if (far) assert.ok(standing!.seq >= far.mark, at(`${h.owner}/${h.id} counted ${standing!.seq} and the far door has honoured ${far.mark}`));
+      const far = c.wards[c.binds[h.seat.host].ward].heirs[h.seat.inv.heir!];
+      if (far) assert.ok(standing.seq >= far.mark, at(`${h.owner}/${h.id} counted ${standing.seq} and the far door has honoured ${far.mark}`));
     }
     // Every seat and hold the model knows about, and no relation the ward
     // holds that the model never made.

package/src/conformance/index.ts

@@ -3,7 +3,10 @@
 //
 // A ward is handed in as a probe:
 //
-//   make()                                       -> world
+//   make({ lends })                               -> world. `lends` maps a name the box lends to the
+//                                                    class of the being it lends under it; the probe
+//                                                    stands one of each in a ward its harbor roots,
+//                                                    and every ward it boots is grounded to lend them
 //   world.boot(key, Class, cells?, { isPublic })  -> handle
 //   world.heir(invitation)                        -> { current, announced, fresh } | undefined
 //                                                    what the inviting ward holds for that heir
@@ -19,7 +22,7 @@
 //
 // Every assertion here is the truth's. Nothing here knows how a ward is built.
 import { assert } from './assert.ts';
-import { silence, isSilence, isUnreached, told } from '../being/silence.ts';
+import { silence, answered, isSilence, isUnreached, told } from '../being/silence.ts';
 import { digest } from '../being/digest.ts';
 import type { Asker, BeingClass, Cells, Invitation, Json, JsonObject, Reply, Stance } from '../being/types.ts';
 import { Printer, Shop, Customer, Echo, Maker, Member } from './beings.ts';
@@ -56,6 +59,25 @@ export type World = {
   // this one. `key` says which ward: a being of it, and never the ward's pk,
   // because a topology may put every being behind a ward of its own.
   owner(key: string): (method?: string, args?: JsonObject) => Promise<unknown>;
+  // The partition of the ward a being lives in, as values, and that ward
+  // booted again from one. Together they are the obligation "a ward can be
+  // written down and stood up again from what was written", which is what a
+  // restart is and what a migration rides on, and they are what lets this
+  // suite reach the count, the span and the mark without a hand to build
+  // bytes with: rewind a caller's own numbers in her partition, stand her
+  // ward up again, and her next ask carries a number the far door has
+  // already honoured. What `restart` is given it keeps; given nothing it
+  // keeps what the ward had.
+  // They are `Standing`, below, and optional here: required in prose and of
+  // any harness that says it can, which is the shape every obligation in this
+  // suite has. A harness that cannot says `canRestart: false` at the call and
+  // skips the chapters that need it, rather than writing a member that lies.
+} & Partial<Standing>;
+
+// What a harness that can stand a ward up again offers.
+export type Standing = {
+  partition(key: string): JsonObject;
+  restart(key: string, partition?: JsonObject): Promise<void>;
 };
 
 export { Printer, Shop, Customer, Echo, Maker, Member };
@@ -70,14 +92,27 @@ export const HEX128 = /^[0-9a-f]{128}$/; // a ward pk: the signing pk then the p
 // Her ward's word, as she receives it.
 const said = (x: unknown, w: string): boolean => told(x) === w;
 
+// A world whose harness stands a ward up again. The two members are optional
+// on the probe and required of a harness that says it can, so a chapter that
+// needs them says so here rather than reaching past a maybe at every line.
+const able = (w: World): World & Standing => w as World & Standing;
+
 // The runner is handed in. Node passes `node:test`; a browser and an edge
 // worker pass a shim of their own. The suite is the ward's truth, and the
 // ward's truth must be checkable wherever a ward runs, not only here.
 export type Runner = (name: string, opts: { skip?: string | false }, fn: () => Promise<void> | void) => void;
 
-export function conform(label: string, make: () => Promise<World>, { canDown = true, test }: { canDown?: boolean; test: Runner }) {
+// What the probe is asked to build. `lends` is the box's half of the ground's
+// seventh member: a name the harbor lends, and the class of the being it
+// lends under it. A harness that stands none is handed nothing and grounds
+// its wards to lend nothing, which is what a harbor with nothing to lend is.
+export type Made = { lends?: Record<string, string> };
+
+export function conform(label: string, make: (made?: Made) => Promise<World>, { canDown = true, canLend = true, canRestart = true, test }: { canDown?: boolean; canLend?: boolean; canRestart?: boolean; test: Runner }) {
   const t = (name: string, fn: () => Promise<void> | void) => test(`[${label}] ${name}`, {}, fn);
   const down = (name: string, fn: () => Promise<void> | void) => test(`[${label}] ${name}`, { skip: !canDown && 'nothing to cut inside one ward' }, fn);
+  const lends = (name: string, fn: () => Promise<void> | void) => test(`[${label}] ${name}`, { skip: !canLend && 'this harness stands no ward of its harbor to lend from' }, fn);
+  const kept = (name: string, fn: () => Promise<void> | void) => test(`[${label}] ${name}`, { skip: !canRestart && 'this harness cannot hand a ward a partition and stand it up again' }, fn);
 
   async function world({ printerInvitesShop = true } = {}) {
     const w = await make();
@@ -220,8 +255,12 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     // alice hosts here rather than the shop, because the shop's own `invite`
     // takes a tier and mints the id itself. This one is the stance's, which
     // is where the rule lives.
-    const { alice, bob } = await world();
-    for (const id of ['OWNER', 'PUBLIC', 'knock', 'take', 'remove']) {
+    const { w, alice, bob } = await world();
+    // `__proto__` is in the list because a partition cannot hold it. A kit
+    // that refuses it only where it writes her cells writes the ward's half
+    // first and then throws, which leaves one relation in two standings and a
+    // throw where this table promises a null.
+    for (const id of ['OWNER', 'PUBLIC', 'knock', 'take', 'remove', '__proto__']) {
       assert.equal(await alice.being.invite(id), null, `${id} is not hers to mint`);
       assert.equal(Object.hasOwn(alice.cells.occupants, id), false, `and nothing was written for ${id}`);
 
@@ -230,6 +269,9 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
       assert.deepEqual(await bob.being.knock(inv, 'hi'), { heard: 'hi' }, `the knock for ${id} was answered`);
       assert.equal(await bob.being.take(id, inv), null, `take refuses ${id} for the same reason`);
       assert.equal(Object.hasOwn(bob.cells.standings, id), false, `and nothing was written for ${id}`);
+      // The ward's half too, and not only hers: a standing filed here with no
+      // record of it in her cells is a lane nobody can see and nobody removes.
+      assert.equal(Object.hasOwn(w.census().binds.B!.standings, id), false, `and the ward wrote no keys for ${id}`);
       assert.equal(await bob.being.take(`as-${id}`, inv), `as-${id}`, 'and an ordinary id takes the same invitation');
     }
     // And the three calls are still the calls, not records that shadowed them.
@@ -245,12 +287,12 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     const { w, shop, alice } = await world();
     const ask = w.owner('S');
     const bp = (await ask()) as { asks: { name: string; description?: string; input?: JsonObject }[]; notes: { pk: string; beings: JsonObject } };
-    assert.deepEqual(bp.asks.map((a) => a.name), ['boot', 'public', 'invite', 'knock', 'remove', 'unboot'], 'six asks, in this order');
+    assert.deepEqual(bp.asks.map((a) => a.name), ['boot', 'public', 'invite', 'knock', 'remove', 'unboot', 'ask'], 'seven asks, in this order');
     for (const a of bp.asks) {
       assert.equal(typeof a.description, 'string', `${a.name} says what it is for`);
       assert.equal((a.input as { type: string }).type, 'object', `${a.name} takes one object`);
     }
-    assert.match(bp.notes.pk as string, HEX128);
+    assert.match(bp.notes.pk, HEX128);
     assert.equal(typeof bp.notes.beings, 'object');
     assert.deepEqual(await ask('nosuch'), { error: 'unknown ask' });
 
@@ -289,6 +331,36 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     assert.ok(said(await alice.being.standings['via-owner']!.ask('hello'), 'removed'), 'and her occupant hears removed at the door');
   });
 
+  // The owner's seventh ask: reaching into a being and asking her. It is the
+  // third asker of the ward-to-being edge, and the ward is the only one who
+  // fills it in: nothing outside a ward names OWNER, and no side holds a
+  // being's answer to judge it again. Strictly less than the unboot beside
+  // it, which takes her out with every relation she holds.
+  t('the owner asks a being of the ward, as owner or, with no being named, as nobody at the public being', async () => {
+    const { w } = await world();
+    const ask = w.owner('S');
+    const echo = w.owner('E');
+    await w.boot('E', Echo);
+
+    // Named: she is asked as the owner, and hears the owner's name.
+    assert.deepEqual(await echo('ask', { being: 'E', method: 'echo', args: { x: 1 } }), { from: 'OWNER', x: 1 }, 'the ward names the asker, and the name is the owner');
+    assert.deepEqual(bp(await ask('ask', { being: 'S' })).asks.map((a) => a.name), ['hello', 'buy'], 'no method is her describe, and a gate that reads an occupant record shows the owner nothing: refund is hers to nobody here');
+    assert.deepEqual(await ask('ask', { being: 'S', method: 'hello' }), { welcome: true });
+    assert.deepEqual(await ask('ask', { being: 'S', method: 'nosuch' }), { error: 'unknown ask' }, 'her own answer, as any asker gets it');
+
+    // Nobody named, and nobody home: one refusal, and never a fourth word.
+    assert.deepEqual(await echo('ask', {}), { error: 'no such being' }, 'a ward with no public being has nobody to ask as nobody');
+    assert.deepEqual(await echo('public', { key: 'E' }), { public: 'E' });
+    assert.deepEqual(await echo('ask', { method: 'echo', args: { x: 2 } }), { from: null, x: 2 }, 'with no being named it is the public being, asked as nobody');
+
+    // What it refuses, each in an object, because the owner hears objects.
+    const pk = (bp(await ask()) as unknown as { notes: { pk: string } }).notes.pk;
+    assert.deepEqual(await ask('ask', { being: 'nobody' }), { error: 'no such being' });
+    assert.deepEqual(await ask('ask', { being: pk }), { error: 'no such being' }, 'the ward is a being to nobody outside, here as at invite and unboot');
+    assert.deepEqual(await ask('ask', { being: 42 }), { error: 'no such being' }, 'a name is a string or it is nothing');
+    assert.deepEqual(await ask('ask', { being: 'S', method: 42 }), { error: 'an ask is named by a word' }, 'and so is an ask');
+  });
+
   // The one public being, marked and unmarked through the owner. A second
   // one would leave the first holding every relation she had, reachable by
   // nobody at the bare pk and told by nobody that she had been replaced.
@@ -341,6 +413,131 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     assert.deepEqual(await maker.being.say({ id: 'nothing' }), { said: null });
   });
 
+  // The count, reached the one way a suite that owns no bytes can reach it:
+  // a caller's numbers are in her own partition, so winding them back and
+  // standing her ward up again makes her next ask carry a number the far
+  // door has already honoured. A kit with no once-only delivery answers it
+  // and passes every other chapter here clean.
+  kept('a number already honoured is repeated: the far being is not asked twice, and nothing is written for it', async () => {
+    const { w, shop, alice } = await world();
+    const inv = await shop.being.invite();
+    assert.deepEqual(await alice.being.join(inv), { welcome: true });
+    assert.deepEqual(await alice.being.buy('a hat'), { ok: true, receipt: 'receipt for a hat' });
+    const sold = (shop.cells.sales as JsonObject[]).length;
+
+    // Her keys for the shop, wound back to the number she has just spent.
+    const kept = able(w);
+    const p = kept.partition('A');
+    const keys = ((p.bind as JsonObject).A as JsonObject).standings as JsonObject;
+    const mine = keys.shop as JsonObject;
+    const back = (mine.seq as number) - 1;
+    mine.seq = back;
+    await kept.restart('A', p);
+
+    const again = await alice.being.buy('a second hat');
+    assert.ok(said(again, 'repeated'), `a number already honoured is repeated, not ${JSON.stringify(again)}`);
+    assert.equal((shop.cells.sales as JsonObject[]).length, sold, 'and she was never asked');
+    // The count carries on from where it was: the next number is fresh.
+    assert.deepEqual(await alice.being.buy('a third hat'), { ok: true, receipt: 'receipt for a third hat' });
+  });
+
+  // A restart is silent by construction: the ward comes back on the same
+  // seed with the same pk, and every relation it holds still points at it.
+  // What must survive with it is what the door has honoured, or a restart is
+  // a stretch of time in which every number can be replayed.
+  kept('a restart is silent: same pk, every relation still stands, and the far door still refuses what it spent', async () => {
+    const { w, shop, alice } = await world();
+    const inv = await shop.being.invite();
+    assert.deepEqual(await alice.being.join(inv), { welcome: true });
+    assert.deepEqual(await alice.being.buy('a hat'), { ok: true, receipt: 'receipt for a hat' });
+    const pk = shop.pk;
+    const able2 = able(w);
+    const mark = JSON.stringify(able2.partition('S').heirs);
+
+    await able2.restart('S');
+    assert.equal(shop.pk, pk, 'a ward that came back changed its pk');
+    assert.equal(JSON.stringify(able2.partition('S').heirs), mark, 'and it came back holding what it had honoured');
+    assert.deepEqual(await alice.being.buy('a second hat'), { ok: true, receipt: 'receipt for a second hat' }, 'the relation goes on, and she was never told');
+    assert.deepEqual(alice.cells.standings.shop!.id, 'shop', 'her side was not told either');
+  });
+
+  // Notes are the one thing on a record that a being seeds and a ward keeps
+  // without ever reading. A kit that files what it was handed rather than a
+  // copy of it leaves the seeder a hand inside her cells: it writes without
+  // the ward being told, so what a restart brings back is not what she read.
+  t('notes are values and are kept as a copy: what the seeder still holds is not what the record holds', async () => {
+    const { alice } = await world();
+    const seeded = { tier: { deep: 'gold' } } as unknown as JsonObject;
+    assert.ok((await alice.being.invite('noted', seeded)) !== null, 'she minted with notes');
+    (seeded.tier as JsonObject).deep = 'moved';
+    assert.deepEqual(alice.cells.occupants.noted!.notes, { tier: { deep: 'gold' } }, 'the record is the copy, all the way down');
+    // And notes no harbor could write back are no invitation, for the reason
+    // every other write is refused: a record it could not keep.
+    assert.equal(await alice.being.invite('bad-notes', { n: 0 / 0 } as unknown as JsonObject), null);
+    assert.equal(Object.hasOwn(alice.cells.occupants, 'bad-notes'), false, 'and nothing was written for it');
+  });
+
+  // The wait, and the one thing a kit can get wrong that nothing else here
+  // would notice. A ward bounds every ask itself, so a relation cycle ends:
+  // A asks B, B asking back holds A's lane, and the third ask can never be
+  // answered. A kit with no bound waits for ever and hangs, and every other
+  // chapter in this suite would still pass it. The word is `late`, which
+  // promises nothing either way, and the relation lives afterwards.
+  t('the wait is bounded, so a cycle ends: the ask that cannot be answered is late, and the relation lives', async () => {
+    const { w } = await world();
+    const a = await w.boot<Member>('MA', Member);
+    const b = await w.boot<Member>('MB', Member);
+    const toB = (await b.being.invite('from-a'))!;
+    const toA = (await a.being.invite('from-b'))!;
+    assert.ok(answered(await a.being.knock(toB, 'ping')), 'a knocks b');
+    assert.equal(await a.being.take('b', toB), 'b');
+    assert.ok(answered(await b.being.knock(toA, 'ping')), 'b knocks a');
+    assert.equal(await b.being.take('a', toA), 'a');
+
+    // A asks B; B, answering, asks A back; A, answering that, asks B on the
+    // lane the first ask still holds. Every link is a legal ask.
+    const out = (await a.being.relay({ id: 'b', method: 'relay', args: { id: 'a', method: 'relay', args: { id: 'b', method: 'ping' }, time: 200 } })) as { said: string | null; out: { said: string | null } | null };
+    assert.equal(out.said, null, 'the outer ask was answered');
+    assert.equal(out.out?.said, 'late', 'and what it carries is the ask that could not be, said as late');
+
+    // The relation is not the worse for it: the lane is free again and the
+    // count moved on, which is what a bound is for.
+    const after = (await a.being.relay({ id: 'b', method: 'ping' })) as { said: string | null };
+    assert.equal(after.said, null, 'and she asks again on the same standing');
+  });
+
+  // Lend is boot's other half: what the device already has, reached the one
+  // way anything is reached. The being lent stands in a ward the harbor
+  // roots, so nothing here can look at her from the outside; what the ward
+  // owes is what is asserted. She is handed an id, the standing is an
+  // ordinary one, and the invitation is nowhere she can read.
+  lends('what the device lends is a being: she is handed an id, asks on an ordinary standing, and never sees the invitation', async () => {
+    const w = await make({ lends: { pen: 'Member' } });
+    const maker = await w.boot<Maker>('MK', Maker);
+    assert.deepEqual(await maker.being.borrow({ name: 'pen', id: 'pen' }), { lent: 'pen' }, 'the id she gave is the id she gets');
+    // An ordinary standing from there on: she asks on it, and arrives at that
+    // being's door as somebody the far side named.
+    const said = (await maker.being.say({ id: 'pen' })) as { said: { pong: string | null } | null };
+    assert.equal(typeof said.said?.pong, 'string', 'she arrived under an id the far being minted');
+    // The keys are the ward's. Nothing of the relation is in her cells, which
+    // is the whole difference between this standing and one she gave away.
+    const c = w.census();
+    const heir = c.binds.MK!.standings.pen!.heir;
+    assert.equal(typeof heir, 'string', 'the ward bound a heir for it');
+    assert.equal(JSON.stringify(c.cells.MK).includes(heir!), false, 'and the invitation reached her nowhere');
+    // Null is every kind of no, and she cannot tell them apart.
+    assert.deepEqual(await maker.being.borrow({ name: 'gps', id: 'x' }), { lent: null }, 'a name this box does not lend');
+    assert.deepEqual(await maker.being.borrow({ name: 'pen', id: 'pen' }), { lent: null }, 'an id she already holds');
+    assert.deepEqual(await maker.being.borrow({ name: 'pen', id: 'OWNER' }), { lent: null }, 'a word the ward reserves');
+  });
+
+  lends('a harbor with nothing to lend lends nothing, and says so the same way', async () => {
+    const w = await make();
+    const maker = await w.boot<Maker>('MK', Maker);
+    assert.deepEqual(await maker.being.borrow({ name: 'pen', id: 'pen' }), { lent: null });
+    assert.equal(w.census().binds.MK!.standings.pen, undefined, 'and nothing was written for it');
+  });
+
   // The case the estate's walk reaches by weight and this reaches by hand: a
   // seat kicked after it answered and before it was taken. She holds a key
   // the door bound for her, so she is the one person who hears why, and she

package/src/conformance/reach.ts

@@ -47,7 +47,7 @@ export function conformReach(label: string, make: () => Promise<FarSide>, { test
   t('asks in flight at once each get their own answer', async () => {
     const far = await make();
     try {
-      await far.hold(pk('aa'), async (b) => (await wait(b[0]! * 10), bytes(b[0]!)));
+      await far.hold(pk('aa'), async (b) => (await wait(b[0] * 10), bytes(b[0])));
       const out = await Promise.all([far.reach.carry(pk('aa'), bytes(3)), far.reach.carry(pk('aa'), bytes(1)), far.reach.carry(pk('aa'), bytes(2))]);
       assert.deepEqual(out, [bytes(3), bytes(1), bytes(2)]);
     } finally {

package/src/harbor/core.ts

@@ -8,16 +8,18 @@
 // edge harbor is this over an object's storage. None of them is in this
 // tree, and every one of them passes the conformance suite untouched.
 //
-// The directory is filled three ways, in this order: the harbor's own
+// The directory is filled four ways, in this order: the harbor's own
 // doors; a socket a dialer holds to it, bound once the door behind the
-// dialer's claim has proved it holds the key, and unbound at close; a hint
-// from a link. And one fallback: a dialer with nothing in its
+// dialer's claim has proved it holds the key, and unbound at close; the
+// claims of a listener this harbor dialed, proved the same way and reached
+// through that line; and a hint, a pk at a URL, kept in the store. A hint
+// never displaces a reach proved at a door. And one fallback: a dialer with nothing in its
 // directory for a pk sends down the socket it holds, because the listener
 // it dialed is the rendezvous and may hold that pk on another socket. Bytes
 // that arrive from the wire go to an own door or a held socket and never
 // onward by request or by fallback; that one rule is the rendezvous.
 import { Ward } from '../ward/ward.ts';
-import { maker, entropy as random, learnPk, type Ground, type WardPointers } from '../ward/ground.ts';
+import { maker, entropy as random, learnPk, type Ground, type WardPointers, type Lend } from '../ward/ground.ts';
 import type { BeingClass, BeingLike } from '../being/types.ts';
 import { silence } from '../being/silence.ts';
 import { request, type Reach } from './reach.ts';
@@ -102,9 +104,22 @@ export class Harbor {
     for (const say of this.announcers) say();
   }
 
-  constructor(store: Store, loader: Loader = async () => ({})) {
+  // What this device lends the beings of the wards it hosts, by name. One
+  // for the harbor, and `lendFor` says which ward may ask it: every ward,
+  // unless a terrain says a stranger's ward is lent nothing.
+  // Set at birth or once the harbor's own ward is standing, which is the
+  // usual order: a terrain puts that ward up first, then boots the rest on a
+  // ground that can reach it.
+  lend: Lend | undefined;
+
+  constructor(store: Store, loader: Loader = async () => ({}), lend?: Lend) {
     this.store = store;
     this.loader = loader;
+    this.lend = lend;
+  }
+
+  protected lendFor(_name: string, _record: WardRecord): Lend | undefined {
+    return this.lend;
   }
 
   // Boot every ward the store keeps, and learn the hints. One ward that will
@@ -112,6 +127,10 @@ export class Harbor {
   // named in `unbooted` and takes nobody else down with it.
   async boot(): Promise<void> {
     for (const name of await this.store.list()) {
+      // A ward this harbor already hosts is not booted twice. A terrain that
+      // keeps a ward of its own puts it up before this runs, so that a being
+      // born in any other ward can lend from her first line.
+      if (this.wards.has(name)) continue;
       try {
         const kept = await this.store.load(name);
         if (kept) await this.host(name, kept);
@@ -335,6 +354,8 @@ export class Harbor {
       random,
       wrote: () => this.#wrote(name),
     };
+    const lend = this.lendFor(name, kept.record);
+    if (lend) ground.lend = lend;
     const saving: Saving = { memory, dirty: false, running: null, timer: undefined, gone: false };
     this.#saving.set(name, saving);
     // A ward that will not be born leaves nothing behind: a partition of a

package/src/harbor/index.ts

@@ -8,7 +8,7 @@ export { Harbor, DEFAULT_CODE, type Hosted, type Bound, type Loader } from './co
 export { dial, type Dialer } from './dial.ts';
 export { MemoryStore, values, type Store, type Kept, type WardRecord } from './store.ts';
 export { request, Socket, SUITE, REFUSED, type Reach, type Carry, type Line, type Announce } from './reach.ts';
-export type { Ground, WardPointers } from '../ward/ground.ts';
+export type { Ground, WardPointers, Lend } from '../ward/ground.ts';
 // What a harbor builds a ground out of. Convenience, never contract: a kit
 // writing its own harbor may write these three again.
 export { maker, entropy, learnPk } from '../ward/ground.ts';

package/src/harbor/memory.ts

@@ -5,7 +5,7 @@
 // reads no partition, opens no byte. Several memory harbors may be linked,
 // which stands in for a wire, and cut, which stands in for weather.
 import type { BeingClass, BeingLike } from '../being/types.ts';
-import { maker, entropy, learnPk, type Ground, type WardPointers } from '../ward/ground.ts';
+import { maker, entropy, learnPk, type Ground, type WardPointers, type Lend } from '../ward/ground.ts';
 import { hex } from '../ward/arithmetic.ts';
 
 export type Booted = WardPointers & { pk: string };
@@ -42,18 +42,21 @@ export class MemoryHarbor {
   }
 
   // boot by seed. the harbor gets a door and an ask, and learns the pk by asking.
-  async boot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>): Promise<Booted> {
+  // `lend` is what this device lends the ward's beings, and a test's stand-in
+  // for a real terrain's: left out, every name answers null.
+  async boot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, lend?: Lend): Promise<Booted> {
     this.partitions.set(seed, {});
-    return this.reboot(seed, Ward, classes);
+    return this.reboot(seed, Ward, classes, lend);
   }
 
   // a restart: same seed, same partition, fresh ward. the ward's files are the harbor's to keep.
-  async reboot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>): Promise<Booted> {
+  async reboot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, lend?: Lend): Promise<Booted> {
     const memory = this.partitions.get(seed);
     if (!memory) throw new Error(`no partition for ${seed}`);
     const ground: Ground = {
       seed,
       memory,
+      ...(lend ? { lend } : {}),
       // One objects map for the whole harbor, not one per ward: every ward
       // here is in this process and a test reaches any being of any of them.
       instantiate: maker(this.objects, classes),

package/src/harbor/reach.ts

@@ -66,7 +66,7 @@ const ASK = 0,
   REPLY = 1,
   NONE = 2;
 
-// The wire suite: which frames these are and which four algorithms seal what
+// The wire suite: which frames these are and which five algorithms seal what
 // they carry. One value, and it is not negotiated. It rides in the handshake
 // and never on an ask, so an ask stays bytes nobody can tell from noise, and
 // a line still learns before it carries anything whether the far side speaks

package/src/ward/cells.ts

@@ -22,40 +22,82 @@ import type { Cells, Json } from '../being/types.ts';
 // reply from ending a walk in a stack overflow instead of a refusal.
 export const DEPTH = 64;
 
+// How many values one written out may come to. Depth alone does not bound
+// what a value costs to keep: one subvalue may sit under two keys, and
+// nesting that forty levels deep is inside the depth bound and is a trillion
+// values once written down. What is walked here is the object graph, which is
+// small; what a harbor keeps is the tree it expands to, which is not. So the
+// walk counts the tree while it proves the graph, and refuses a value nobody
+// could write down. This is a bound on what a being holds, so it is this
+// kit's number and no word of the spec.
+export const BREADTH = 1 << 20;
+
+// Text a harbor can write down: every surrogate in a pair. A lone one is a
+// code unit with no character, which JSON escapes and UTF-8 cannot encode at
+// all, so a harbor that keeps strings as bytes loses it and one that keeps
+// the object does not. I-JSON says a string is text, and this is that rule
+// where the value is written rather than where it is read.
+const WELL_FORMED = /^(?:[^\uD800-\uDFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF])*$/;
+
 // I-JSON, all the way down. A number that JSON cannot write is not a number
 // a harbor can keep, a key on the prototype is not a key she wrote, and a
 // hole in a list, or a key named `__proto__`, is a thing JSON writes one way
 // and a runtime reads another.
-function fault(v: unknown, path: string, seen: Set<object>, depth: number): string | null {
-  if (v === null || typeof v === 'boolean' || typeof v === 'string') return null;
-  if (typeof v === 'number') return Number.isFinite(v) ? null : `${path} is ${String(v)}, which no harbor can write down`;
+//
+// A fault is a sentence; anything else is the count of values under this one,
+// itself included. A value already counted is a value already proven, so a
+// graph that shares is walked once per node rather than once per path.
+function walk(v: unknown, path: string, seen: Set<object>, sized: Map<object, number>, depth: number): string | number {
+  if (v === null || typeof v === 'boolean') return 1;
+  if (typeof v === 'string') return WELL_FORMED.test(v) ? 1 : `${path} carries a lone surrogate, which is no text a harbor can write down`;
+  if (typeof v === 'number') {
+    if (!Number.isFinite(v)) return `${path} is ${String(v)}, which no harbor can write down`;
+    // Minus zero is a number JSON writes as `0` and reads back as `0`. A
+    // harbor that keeps values would hand her the sign she wrote and one that
+    // writes JSON would not, and she is never told which she is standing in.
+    return Object.is(v, -0) ? `${path} is minus zero, which comes back as zero from every harbor that writes JSON` : 1;
+  }
   if (typeof v !== 'object') return `${path} is a ${typeof v}, which is not a value`;
   if (seen.has(v)) return `${path} refers back to itself`;
+  const counted = sized.get(v);
+  if (counted !== undefined) return counted;
   if (depth >= DEPTH) return `${path} is nested past ${DEPTH} levels, which no harbor can keep`;
   seen.add(v);
   try {
+    let size = 1;
+    const under = (where: string, x: unknown): string | null => {
+      const r = walk(x, where, seen, sized, depth + 1);
+      if (typeof r === 'string') return r;
+      size += r;
+      return size > BREADTH ? `${path} writes out to more than ${BREADTH} values, which no harbor can keep` : null;
+    };
     if (Array.isArray(v)) {
       for (let i = 0; i < v.length; i += 1) {
         if (!(i in v)) return `${path}[${i}] is a hole, which no harbor can write down`;
-        const f = fault(v[i], `${path}[${i}]`, seen, depth + 1);
+        const f = under(`${path}[${i}]`, v[i]);
         if (f) return f;
       }
-      return null;
+      sized.set(v, size);
+      return size;
     }
     const proto = Object.getPrototypeOf(v);
     if (proto !== Object.prototype && proto !== null) return `${path} is a ${(v).constructor?.name ?? 'object'}, which is not a value`;
     for (const k of Object.keys(v)) {
       if (k === '__proto__') return `${path}.__proto__ is a key no harbor can keep`;
-      const f = fault((v as Record<string, unknown>)[k], `${path}.${k}`, seen, depth + 1);
+      const f = under(`${path}.${k}`, (v as Record<string, unknown>)[k]);
       if (f) return f;
     }
-    return null;
+    sized.set(v, size);
+    return size;
   } finally {
     seen.delete(v);
   }
 }
 
-export const cellFault = (v: unknown, path: string): string | null => fault(v, path, new Set(), 0);
+export const cellFault = (v: unknown, path: string): string | null => {
+  const out = walk(v, path, new Set(), new Map(), 0);
+  return typeof out === 'string' ? out : null;
+};
 
 // The three keys at the root of her cells that are the ward's: it writes
 // them, she reads them, and a write of hers there is refused like a non-value.
@@ -69,6 +111,13 @@ const wrapped = new WeakMap<object, object>();
 const targets = new WeakMap<object, object>();
 const guards = new WeakSet();
 
+// A name no partition can hold, wherever it appears. It is here beside the
+// guard that refuses it, because the ward refuses it too: a relation named
+// this one would be written into the bind table and then throw on her cells,
+// which is half a relation and a throw where a null is promised. One rule,
+// one place, read by the guard and by the stance.
+export const unkeepable = (k: string): boolean => k === '__proto__';
+
 // A key a write may land on: a string that is not `__proto__`, and not one
 // of the ward's at the root. A symbol key is a thing JSON never writes.
 const refuse: (why: string) => never = (why) => {
@@ -76,7 +125,7 @@ const refuse: (why: string) => never = (why) => {
 };
 function keyFault(t: object, k: string | symbol, v: unknown, path: string, root: boolean): void {
   if (typeof k !== 'string') refuse(`${path} takes no symbol key`);
-  if (k === '__proto__') refuse(`${path}.__proto__ is a key no harbor can keep`);
+  if (unkeepable(k)) refuse(`${path}.__proto__ is a key no harbor can keep`);
   if (root && WARDS.has(k)) refuse(`${path}.${k} is the ward's to write`);
   // A list grows by one at its end, or it has holes JSON cannot write. A
   // push sets the slot at its length and then the length: both pass. A
@@ -138,4 +187,4 @@ function guard<T extends object>(target: T, path: string, wrote: () => void, roo
 export const guardCells = (cells: Cells, wrote: () => void = () => {}): Cells => guard(cells as unknown as Record<string, Json>, 'cells', wrote, true) as unknown as Cells;
 // The cells behind the guard, for the ward alone: the one writer of the
 // three keys that are its own.
-export const unguarded = (cells: Cells): Cells => (targets.get(cells as unknown as object) ?? cells) as Cells;
+export const unguarded = (cells: Cells): Cells => (targets.get(cells) ?? cells) as Cells;