@quo-systems/quo 0.2.13 → 0.2.15

package/src/ward/door.ts

@@ -22,10 +22,13 @@ export type Judged = { bytes: Uint8Array; heard: boolean };
 const SILENCE: ReplyPayload = { silence: true };
 const said = (quo: DoorWord): ReplyPayload => ({ quo });
 
-// One arrival at one being, already named. Catches every throw. `bound` says
-// whether the asker is a key this door holds: she hears `threw`; a stranger
-// at the public being hears silence, because her insides are hers.
-export async function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload> {
+// One arrival at one being, already named: the three choices, D11, D12 and
+// D13, and nothing else. Catches every throw. `bound` says whether the asker
+// is a key this door holds, or the ward's own owner: she hears `threw`; a
+// stranger at the public being hears silence, because her insides are hers.
+// Every caller that reaches a being's answer goes through here, the owner's
+// `ask` included, so the three choices are written once.
+export async function answered(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload> {
   const threw = bound ? said('threw') : SILENCE;
   let out: Awaited<ReturnType<BeingLike['answer']>>;
   try {
@@ -44,10 +47,18 @@ export async function arrive(door: Door, asker: Asker, method: string | undefine
   // said, or the door itself would fail to write her reply after the number
   // was spent. It is threw, like a word out of her.
   if (cellFault(out, 'answer') !== null) return threw;
-  if (method === undefined) return { object: out, seen: null };
-  // The digest rides along, it is not the answer. She has already answered:
-  // a describe that will not run costs the digest, and nothing else.
-  return { object: out, seen: await seen(door, asker) };
+  return { object: out, seen: null };
+}
+
+// What crosses the wire: her answer, with her digest for this asker beside
+// it. The digest rides along, it is not the answer. She has already
+// answered: a describe that will not run costs the digest, and nothing else.
+// The owner does not take one, because the owner asks for a describe when it
+// wants one and nothing is sealed on its behalf.
+export async function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload> {
+  const reply = await answered(door, asker, method, args, bound);
+  if (method === undefined || !('object' in reply)) return reply;
+  return { object: reply.object, seen: await seen(door, asker) };
 }
 
 // Her digest for this asker, or null when her describe threw or fell silent.
@@ -55,7 +66,14 @@ export async function arrive(door: Door, asker: Asker, method: string | undefine
 export async function seen(door: Door, asker: Asker): Promise<string | null> {
   try {
     const bp = await door.being.answer(asker);
-    return isSilence(bp) || isWord(bp) ? null : await digest(bp);
+    if (isSilence(bp) || isWord(bp)) return null;
+    // Held to the same rule as her answer, and for the same reason plus one:
+    // the digest is a walk, and a walk over a graph that shares or turns back
+    // on itself is not a digest but a hang or a throw. A blueprint that could
+    // not cross is a blueprint with no digest, which is what she has when her
+    // describe says nothing.
+    if (cellFault(bp, 'blueprint') !== null) return null;
+    return await digest(bp);
   } catch {
     return null;
   }

package/src/ward/ground.ts

@@ -1,8 +1,31 @@
 // SPDX-License-Identifier: Apache-2.0
-// The ground. The one object a harbor passes a ward at birth. Six things,
-// never a seventh. Everything a runtime differs on arrives here, which is
-// why the ward itself knows no runtime.
-import type { Stance, BeingLike, BeingClass } from '../being/types.ts';
+// The ground. The one object a harbor passes a ward at birth: seven things
+// the ward uses. Everything a runtime differs on arrives here, which is why
+// the ward itself knows no runtime.
+import type { Stance, BeingLike, BeingClass, Invitation } from '../being/types.ts';
+
+// What the device lends this ward's beings, by name. What a box can do is
+// beings, in a ward its harbor booted and roots, and this is how a being of
+// another ward comes to hold a standing at one: the harbor asks its own root
+// to invite on that being, and hands the invitation to the taker.
+//
+// The taker is the ward's half, and it is inside this call rather than after
+// it so that nothing half-lives. The harbor minted, so the harbor is the only
+// one who can unmint: a ward that could not knock, or could not take, says so
+// by answering false, and the root that minted removes the occupant it made.
+// A lend that failed leaves no heir open at that being and no relation bound
+// to a ward that does not hold it, which is the promise `boot` keeps with
+// `unmake` and the same promise here.
+//
+// False is every kind of no, and they are one answer because a being would do
+// nothing different for any of them: this harbor lends nothing, or nothing of
+// that name, or nothing of that name to this ward, or the ward did not take
+// what was minted.
+//
+// The invitation never reaches the being. It is the device's capability, and
+// a value she could copy is one she could hand to anyone, so it lives in this
+// call and nowhere else.
+export type Lend = (name: string, take: (invitation: Invitation) => Promise<boolean>) => Promise<boolean>;
 
 export type Ground = {
   seed: string | Uint8Array; // the ward derives its pk from it and nothing else
@@ -20,19 +43,24 @@ export type Ground = {
   // undefined is a promise, not a shrug: no door was reached, and nothing was
   // delivered. The ward hands it to a being as unreached, which is the one
   // answer that says asking again is safe, so a harbor may only return it
-  // when it knows the bytes never arrived — no reach for that pk, a socket
+  // when it knows the bytes never arrived: no reach for that pk, a socket
   // that would not open, a link that is down.
   //
   // A harbor that sent the bytes and then gave up waiting knows no such
   // thing: the far door may have heard and be working still. It must not
   // answer at all in that case. The ward bounds every ask itself, and an
-  // answer that never comes is silence, which promises nothing. So a harbor
-  // may hold a shorter patience than the ward's for its own reasons — a
-  // socket it wants back, a queue it will not grow — and the two bounds never
-  // need to read each other: whichever ends first ends the ask, and each says
-  // only what it can honestly say.
+  // answer that never comes inside that bound is `late`, which promises
+  // nothing either way. So a harbor may hold a shorter patience than the
+  // ward's for its own reasons, a socket it wants back or a queue it will
+  // not grow, and the two bounds never need to read each other: whichever
+  // ends first ends the ask, and each says only what it can honestly say.
   carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
   random(n: number): Uint8Array; // entropy. every key a ward mints is drawn from it
+  // A standing at one of the harbor's own beings, by the name that harbor
+  // knows it under. Built per ward, so which ward may ask for which name is
+  // the harbor's own decision and a stranger's ward is lent nothing. A harbor
+  // with nothing to lend leaves it out, and every name answers false.
+  lend?: Lend;
 };
 
 // What a ward hands back. Two pointers. The door answers bytes, always, and
@@ -46,7 +74,7 @@ export type WardPointers = {
 };
 
 // ---- what every harbor builds a ground out of. Three pieces, because every
-// harbor in this tree writes the same three and the spec keeps the harbors
+// harbor in this tree writes the same three and the protocol keeps the harbors
 // themselves apart: what a memory harbor and a real one differ on is the
 // route and the store, and nothing here. A second kit writes its own harbor
 // and may write these again; they are convenience, never contract.

package/src/ward/heirs.ts

@@ -103,6 +103,12 @@ export class Heirs {
       return;
     }
     if (by === h.announced) h.current = by;
-    h.announced = next;
+    // A send that announced nothing leaves the spare standing. This kit
+    // announces on every send but a public one, which holds no heir and
+    // reaches none of this; a kit that skips one is a kit whose own next is
+    // still the key it announced last time, and forgetting it here would meet
+    // that key with silence and kill a healthy relation. Nothing is dropped
+    // that was vouched for until something replaces it.
+    if (next !== null) h.announced = next;
   }
 }

package/src/ward/index.ts

@@ -1,11 +1,11 @@
 // SPDX-License-Identifier: Apache-2.0
 // @quo-systems/quo/ward — one function. Every ward is the same ward.
 export { Ward } from './ward.ts';
-export type { Ground, WardPointers } from './ground.ts';
+export type { Ground, WardPointers, Lend } from './ground.ts';
 export type { Partition, Heir, Bind, StandingKeys } from './partition.ts';
-// The two bounds on what a partition may hold, for a kit that must keep the
-// same ones and for a test that pins them.
-export { GONE, MINTED } from './partition.ts';
+// The three bounds on what a partition may hold, for a kit that must keep
+// the same ones and for a test that pins them.
+export { GONE, MINTED, KNOCKS } from './partition.ts';
 export type { AskPayload, ReplyPayload } from './seal.ts';
 // The seal and the arithmetic, for a kit in another language to check its
 // bytes against, and for tests that speak to a door directly.

package/src/ward/owner.ts

@@ -3,17 +3,17 @@
 // is an occupant of the ward itself, invited by the root. The ward is a
 // being to her owner: the empty ask is her describe, and it carries her asks
 // with a description and an input each, so a side renders them as it
-// renders any being's. Six asks: boot, public, invite, knock, remove and
-// unboot, which is boot's inverse and takes her relations with her. The
-// knock is a being's knock made for her, and the standing is written into
-// her cells under the id the owner gave; remove takes a relation out of her
-// by id, the mirror of it.
+// renders any being's. Seven asks: boot, public, invite, knock, remove and
+// unboot, which is boot's inverse and takes her relations with her, and ask,
+// which reaches into a being and asks her. The knock is a being's knock made
+// for her, and the standing is written into her cells under the id the owner
+// gave; remove takes a relation out of her by id, the mirror of it.
 import { isSilence, isWord, wordOf } from '../being/silence.ts';
 import { OWNER } from '../being/types.ts';
 import type { Ask, Asker, Invitation, Json, JsonObject, Wanted } from '../being/types.ts';
 import { put } from './partition.ts';
-import { seen } from './door.ts';
-import { within, DEFAULT, LATE } from './allowance.ts';
+import { seen, answered } from './door.ts';
+import { within, allow, DEFAULT, LATE } from './allowance.ts';
 import type { Resident } from './ward.ts';
 
 export type OwnerSide = {
@@ -39,6 +39,11 @@ export const OWNER_ASKS: Ask[] = [
   },
   { name: 'remove', description: 'take a relation out of a being of the ward by id, occupant or standing; on the ward pk it unseats an owner, and only the root may', input: { type: 'object', properties: { being: str, id: str }, required: ['being', 'id'] } },
   { name: 'unboot', description: 'take a being out of the ward, with every relation she holds; her occupants hear removed, and the ward itself is refused', input: { type: 'object', properties: { being: str }, required: ['being'] } },
+  {
+    name: 'ask',
+    description: 'ask a being of the ward, as the owner; with no being it is the public being asked as nobody, which is what a stranger would hear',
+    input: { type: 'object', properties: { being: str, method: str, args: { type: 'object' }, wanted: { type: 'object', properties: { time: { type: 'number' } } } } },
+  },
 ];
 
 export async function ownerAnswer(w: OwnerSide, asker: Asker, method: string | undefined, args: JsonObject): Promise<Json> {
@@ -92,7 +97,7 @@ export async function ownerAnswer(w: OwnerSide, asker: Asker, method: string | u
     const notes = args.notes;
     const door = w.doors.get(being);
     if (!door) return { error: 'no such being' };
-    return await door.stance.occupants.invite(id, notes !== null && typeof notes === 'object' && !Array.isArray(notes) ? (notes as JsonObject) : undefined);
+    return await door.stance.occupants.invite(id, notes !== null && typeof notes === 'object' && !Array.isArray(notes) ? (notes) : undefined);
   }
   if (method === 'knock') {
     const b = args.being as string | { boot: unknown; key: unknown };
@@ -121,7 +126,7 @@ export async function ownerAnswer(w: OwnerSide, asker: Asker, method: string | u
     const out = await door.stance.standings.knock(inv, args.method as string | undefined, (args.args as JsonObject) ?? {}, args.wanted as Wanted | undefined);
     if (isSilence(out)) return { error: 'silence' };
     if (isWord(out)) return { error: wordOf(out) }; // the owner hears objects: the word is the error's name
-    return { taken: await door.stance.standings.take(id, inv), answer: out as Json };
+    return { taken: await door.stance.standings.take(id, inv), answer: out };
   }
   if (method === 'remove') {
     // The mirror of knock: a relation out of a being, by id, occupant or
@@ -152,6 +157,36 @@ export async function ownerAnswer(w: OwnerSide, asker: Asker, method: string | u
     const removed = w.unboot(being);
     return removed === null ? { error: 'no such being' } : { unbooted: being, removed };
   }
+  if (method === 'ask') {
+    // The owner's other power: to reach into a being and ask her. It is
+    // strictly less than unboot, which takes her out with every relation she
+    // holds, and it is the third asker of the ward-to-being edge finally
+    // filled in by the ward rather than minted by whoever holds the pointer.
+    // Bounded, judged and named here, so no side outside the ward ever holds
+    // a being's answer and writes the door's discipline again beside it.
+    const being = args.being === undefined ? null : named(args.being);
+    if (args.being !== undefined && being === null) return { error: 'no such being' };
+    // A method is a name or it is the empty ask. Coerced instead of checked,
+    // a shape passed where a name belongs becomes a string she never declared,
+    // and she would answer `unknown ask` to something nobody asked.
+    if (args.method !== undefined && typeof args.method !== 'string') return { error: 'an ask is named by a word' };
+    // No being named is the in-process twin of bytes for nobody: the public
+    // being, asked as nobody, unbound, so a throw of hers is silence. Her
+    // insides are not a stranger's to read, and a device serving her to
+    // strangers must hear what a stranger hears and not one word more.
+    const key = being ?? w.publicKey();
+    const door = key === null ? undefined : w.doors.get(key);
+    if (!door || door.key === w.pk) return { error: 'no such being' };
+    const bound = being !== null;
+    // The owner is a caller like any other: wanted says what this ask may
+    // spend, and saying nothing is the ward's default. A wait that ran out is
+    // late, the same word a being would hear, said as the object an owner hears.
+    const out = await within(allow(args.wanted as Wanted | undefined).time, answered(door, bound ? { id: OWNER } : {}, args.method, (args.args as JsonObject) ?? {}, bound));
+    if (out === LATE) return { error: 'late' };
+    if ('quo' in out) return { error: out.quo };
+    if (!('object' in out)) return { error: 'silence' };
+    return out.object;
+  }
   return { error: 'unknown ask' };
 }
 
@@ -166,7 +201,7 @@ async function describe(w: OwnerSide): Promise<Json> {
   // answers its owner: the harbor learns the pk by this very ask at boot, so
   // an unbounded wait here is a ward no restart can bring back.
   const asked = [...w.doors].filter(([key]) => key !== w.pk);
-  const digests = await Promise.all(asked.map(async ([, door]) => (await within(DEFAULT.time, seen(door, { id: OWNER }))) as string | null | typeof LATE));
+  const digests = await Promise.all(asked.map(async ([, door]) => (await within(DEFAULT.time, seen(door, { id: OWNER })))));
   for (const [i, [key, door]] of asked.entries()) {
     const d = digests[i];
     put(beings, key, { class: door.cells.class ?? null, public: w.publicKey() === key, digest: d === LATE ? null : d });

package/src/ward/seal.ts

@@ -37,6 +37,15 @@ export type WardKey = { sign: Uint8Array; padlock: Uint8Array; signPk: Uint8Arra
 const WARD_SIGN = new TextEncoder().encode('quo-ward-sign');
 const WARD_SEAL = new TextEncoder().encode('quo-ward-seal');
 
+// The one size in Quo: one mebibyte of bytes each way. It is read before
+// anything is opened, so bytes above it are never decrypted, never parsed and
+// never allocated against. Refusing them is bytes that said nothing, which is
+// already silence, so there is no tenth word and no new door case. Breadth
+// costs bytes, so this one number bounds every other breadth on the wire, and
+// what a being holds is not the protocol's business. An ask is a message and
+// not a file; what is larger is asked for in pieces.
+export const SIZE = 1024 * 1024;
+
 // The ward's key from its seed. Its pk on the wire is the signing pk then the padlock, 128 hex.
 //
 // One seed, two curves, and each secret derived from it under its own label.
@@ -101,7 +110,7 @@ export async function sealAsk(to: string | null, payload: AskPayload, signer: Ui
 // Verification is the door's own step, because only the door knows which key may speak.
 export async function openAsk(bytes: Uint8Array, padlockSecret: Uint8Array): Promise<{ to: string | null; payload: AskPayload; body: Uint8Array; signature: Uint8Array; ephemeralPk: Uint8Array } | null> {
   try {
-    if (!(bytes instanceof Uint8Array) || bytes.length < 1) return null;
+    if (!(bytes instanceof Uint8Array) || bytes.length < 1 || bytes.length > SIZE) return null;
     const inside = await unbox(bytes, padlockSecret);
     if (inside.length <= SIGNATURE) return null;
     const body = inside.subarray(0, inside.length - SIGNATURE);
@@ -146,7 +155,7 @@ export async function sealReply(reply: ReplyPayload, ephemeralPk: Uint8Array, wa
 // throw or an absent value for what a stranger wrote.
 export async function openReply(bytes: unknown, ephemeralSecret: Uint8Array, signPk: Uint8Array): Promise<ReplyPayload | null> {
   try {
-    if (!(bytes instanceof Uint8Array)) return null;
+    if (!(bytes instanceof Uint8Array) || bytes.length > SIZE) return null;
     const inside = await unbox(bytes, ephemeralSecret);
     if (inside.length <= SIGNATURE) return null;
     const body = inside.subarray(0, inside.length - SIGNATURE);

package/src/ward/stance.ts

@@ -1,14 +1,14 @@
 // SPDX-License-Identifier: Apache-2.0
 // The one stance builder. Used for every being the ward boots. Nothing
 // outer is in what she holds: ids in, values out, keys in the bind table.
-import { silence, isSilence, isWord, word, wordOf } from '../being/silence.ts';
+import { silence, isSilence, isWord, unreached, word, wordOf } from '../being/silence.ts';
 import { digest } from '../being/digest.ts';
 import { RESERVED_IDS, isBlueprint } from '../being/types.ts';
 import type { Answer, Cells, Invitation, JsonObject, Silence, Stance, Standing, Standings, Wanted, Word } from '../being/types.ts';
 import { at, put, drop, prune, type Bind, type StandingKeys } from './partition.ts';
 import { allow, within, LATE } from './allowance.ts';
 import { isHex, isWardPk, type ReplyPayload } from './seal.ts';
-import { cellFault } from './cells.ts';
+import { cellFault, unkeepable } from './cells.ts';
 
 // What the stance needs from its ward, and no more.
 export type Inside = {
@@ -29,6 +29,11 @@ export type Inside = {
   instantiate(className: string, key: string): string | null;
   // mint an occupant on a being of this ward, for the being who made her.
   relate(key: string, id: string): Promise<Invitation | null>;
+  // an invitation to one of the harbor's own beings, by the harbor's name for
+  // it, handed to the taker and never returned. false where this box lends
+  // nothing of that name to this ward, or where the taker did not take it, in
+  // which case the harbor has already removed what it minted.
+  lend(name: string, take: (invitation: Invitation) => Promise<boolean>): Promise<boolean>;
   // take a being of this ward out again, with every relation she holds.
   unmake(key: string): void;
   // the bind table was written: a record put, dropped or moved on.
@@ -43,9 +48,22 @@ export type SealedInvitation = { ward: string; heir?: string; secret?: string };
 // is the call, whatever record sits under that name. One namespace means one
 // list: these are refused at invite and at take, beside the ward's own words.
 const CALLS = ['knock', 'take', 'remove'];
-const reserved = (id: string): boolean => RESERVED_IDS.includes(id) || CALLS.includes(id);
 
 export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bind): Stance {
+  // A word the ward refuses at every mint and every take. The two the
+  // protocol names, and the ones this kit adds because its own spelling took
+  // them: the calls a standing already answers to, and a name no partition
+  // can hold. That last one is refused here rather than by the cells guard,
+  // because the guard throws and this table promises a null.
+  // A method is a word or it is nothing at all. The seal writes a payload as
+  // JSON, which drops a key whose value it cannot write, so a symbol or a
+  // function here would leave as an ask with no method: the empty ask. She
+  // would have asked for work, been handed a blueprint, and spent a number on
+  // it. Nothing that cannot be sent is sent, and what never left is unreached,
+  // which is the one answer that says asking again is safe. This is the same
+  // rule args are already held to.
+  const named = (method: unknown): boolean => method === undefined || typeof method === 'string';
+  const reserved = (id: string): boolean => RESERVED_IDS.includes(id) || CALLS.includes(id) || unkeepable(id);
   // The name of one relation, as her side files it. A relation is a ward and
   // a heir, never a heir alone: the heir pk is outer, it rides in the clear on
   // every lid, and anyone who reads one can quote it back inside an invitation
@@ -224,6 +242,7 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
   const calls = {
     knock: async (inv: Invitation, method?: string, args: JsonObject = {}, wanted?: Wanted): Promise<Answer> => {
       if (gone()) return word('dropped');
+      if (!named(method)) return unreached();
       if (!valid(inv)) return word('invitation'); // S1. nothing is sent
       // She may knock again, and after take that knock is an ask: the relation
       // has one home, so it answers on the standing's lane, under the
@@ -283,6 +302,7 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
     // the next line. Waiting for the lane is not a reason to lose it.
     ask: (method?: string, args: JsonObject = {}, wanted?: Wanted): Promise<Answer> => {
       if (gone()) return Promise.resolve(word('dropped') as Answer);
+      if (!named(method)) return Promise.resolve(unreached() as Answer);
       const keys = at(bind.standings, id);
       if (!keys) return Promise.resolve(word('dropped') as Answer); // S2. she dropped it between one line and the next
       const rec = at(cells.standings, id);
@@ -349,6 +369,12 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
       // it keeps the pk beside the id and nothing else. the invitation IS the key.
       invite: async (id: string, notes?: JsonObject): Promise<Invitation | null> => {
         if (gone() || reserved(id) || at(cells.occupants, id) || at(cells.standings, id)) return null;
+        // Notes are values, like everything else the partition keeps, and a
+        // spread copies one level: an object inside them would stay the
+        // caller's, a handle into her cells that writes past the guard and
+        // never says `wrote`, so what a restart brought back would not be
+        // what she read. Held to the rule and copied whole, or no invitation.
+        if (notes !== undefined && cellFault(notes, 'notes') !== null) return null;
         // The key first, and nothing written until it exists: a record put
         // before the mint would be a record a remove in the meantime drops
         // with no heir to close, and the heir opened after it would name an
@@ -357,7 +383,7 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
         if (reserved(id) || at(cells.occupants, id) || at(cells.standings, id)) return null; // taken while the key was minted
         // The notes are the terms the inviter minted under, hers to read on her
         // gate. She may write more later; nobody outside ever writes them.
-        put(cells.occupants, id, { id, notes: notes ? { ...notes } : {} });
+        put(cells.occupants, id, { id, notes: notes ? (JSON.parse(JSON.stringify(notes)) as JsonObject) : {} });
         inside.openHeir(k.pk, key, id);
         put(bind.occupants, id, k.pk);
         inside.wrote();
@@ -373,5 +399,35 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
       },
     },
     standings,
+    // A standing at one of the things this device can do. The same three
+    // moves her boot makes, with the harbor's root doing the inviting instead
+    // of a being of this ward: ask the ground for the name, knock with what
+    // comes back, take it under the id she gave. She is handed the id.
+    //
+    // The invitation never reaches her, and that is the difference between
+    // this relation and every other she holds. Her own invitations are hers
+    // to give away, because giving one away is giving away her own relation.
+    // This one is the device's, minted for this ward alone, and a value she
+    // could copy is a capability she could hand to anyone. A being who wants
+    // to lend her device access to another does it in the open, by an ask of
+    // her own that forwards to this standing, where her gate reads who is
+    // asking and she can stop.
+    lend: async (name: string, id: string): Promise<string | null> => {
+      if (gone() || typeof name !== 'string' || typeof id !== 'string') return null;
+      if (reserved(id) || at(cells.standings, id) || at(cells.occupants, id)) return null;
+      // Her half runs inside the harbor's call, so a knock that was refused
+      // and a take that lost the id both end with the harbor removing what it
+      // minted. Nothing half-lives here either.
+      const took = await inside.lend(name, async (inv) => {
+        // Read again: the ground was awaited, and a line of hers in between
+        // may have taken the id. Nothing is written for a relation she cannot
+        // hold, and the invitation goes back unspent.
+        if (gone() || reserved(id) || at(cells.standings, id) || at(cells.occupants, id)) return false;
+        const out = await calls.knock(inv);
+        if (isSilence(out) || isWord(out)) return false;
+        return (await calls.take(id, inv)) === id;
+      });
+      return took ? id : null;
+    },
   };
 }

package/src/ward/ward.ts

@@ -198,7 +198,7 @@ class Self implements BeingLike {
   #boot(key: string, make: (stance: Stance) => BeingLike | null): Resident | null {
     const cells = guardCells(at(this.p.beings, key) ?? emptyCells(), () => this.#wrote());
     const bind = at(this.p.bind, key) ?? emptyBind();
-    const stance = buildStance(
+    const stance: Stance = buildStance(
       {
         pk: this.pk,
         // This stance, not merely this key: unboot and boot again under the
@@ -219,6 +219,11 @@ class Self implements BeingLike {
         // never came about takes her out again.
         relate: async (k, id) => (await this.doors.get(k)?.stance.occupants.invite(id)) ?? null,
         unmake: (k) => void this.#unboot(k),
+        // What this device lends this ward's beings. The ward knocks and takes
+        // inside the harbor's own call and reads nothing in the value: which
+        // names there are, which ward may ask for one, and what becomes of one
+        // she did not take, is the harbor's and no word of the ward.
+        lend: async (name, take) => (await this.g.lend?.(name, take)) ?? false,
         wrote: () => this.#wrote(),
       },
       key,