@quo-systems/quo 0.2.14 → 0.2.16

package/README.md

@@ -13,8 +13,12 @@ Nothing else is Quo.
   beings and judges its door.
 - **Being.** One ordinary object, one voice.
 
-[`SPEC.md`](SPEC.md) is the truth. It is self-contained and
+[`SPEC.md`](SPEC.md) is the truth. It is the protocol alone: what any ward in
+any language must do for its bytes to be Quo. It is self-contained and
 assumes nothing from any other document, this README included. Read it first.
+[`quo-kit.md`](quo-kit.md) is this kit: what one TypeScript
+implementation chose and another kit may refuse. It assumes the spec, and
+where the two disagree the spec wins.
 
 ## This package
 
@@ -24,12 +28,13 @@ no dependencies. The package ships JavaScript with declarations, emitted by
 types nowhere under `node_modules`.
 
 ```
+protocol/         the shelf a kit in any language reads: SPEC.md and the vectors, no code
+protocol/vectors/ fixed inputs and outputs, so another language proves its bytes
 src/being/        the Being side: what a being author imports, if anything
 src/ward/         the ward: the Ground contract, door, seal, arithmetic, heirs, stance, allowance
 src/harbor/       MemoryHarbor, and the harbor core with its store, reach and dialer
 src/conformance/  behaviours any ward must show, written against the truth
 test/             the suites
-vectors/          fixed inputs and outputs, so another language proves its bytes
 ```
 
 ## Requirements
@@ -73,29 +78,41 @@ import { conform } from '@quo-systems/quo/conformance';
 
 ## Another language
 
-The hand to a kit in another language is two things of two kinds. The
-vectors are the byte-level hand, everything a stranger can observe:
-`vectors/arithmetic.json`, the primitives the seal rests on, SHA-256,
-Ed25519, X25519, HKDF and AES-256-GCM; `vectors/framing.json`, Quo's own,
-the ward pk, the digest, the signed ask body, the sealed shapes, the
-invitation and the knock; `vectors/wire.json`, the frames on a socket and
-the one request a door takes. They import by name,
-`@quo-systems/quo/vectors/framing.json`, so a kit's own suite can read them
-from the package. A kit reproduces them or it is not this
-protocol. `src/conformance/` is the behavioural hand, and it is a checklist
-a kit ports, not a harness it runs: the beings it is shown with run only in
-a TypeScript ward. `SPEC.md` "The tree" says the whole of it.
+The hand to a kit in another language is one folder, `protocol/`, and it
+holds two things of two kinds. `SPEC.md` is the protocol, and it assumes
+nothing: a kit is written against it and against nothing else here. The
+vectors beside it are the byte-level hand, everything a stranger can
+observe: `protocol/vectors/arithmetic.json`, the primitives the seal rests
+on, SHA-256, Ed25519, X25519, HKDF and AES-256-GCM;
+`protocol/vectors/framing.json`, Quo's own, the ward pk, the digest, the
+signed ask body, the sealed shapes, the invitation and the knock;
+`protocol/vectors/wire.json`, the frames on a socket and the one request a
+door takes; and `protocol/vectors/door.json`, the door's thirteen cases,
+each one an arrival a ward will not answer, with the bytes that arrive, the
+bytes that leave and the partition's digest on both sides of the judgement.
+They import by name,
+`@quo-systems/quo/protocol/vectors/framing.json`, so a kit's own suite can
+read them from the package. A kit reproduces them or it is not this
+protocol.
+
+Nothing outside that folder is the protocol. `src/` is this kit's
+interpretation, and `src/conformance/` is a checklist a kit ports rather
+than a harness it runs: it imports the base class, the silence spelling and
+this kit's store and reach, so the beings it is shown with run only in a
+TypeScript ward. `quo-kit.md` "The three shelves" says which is which.
 
 ## Publishing
 
 Published from 0.1.0, the first version under this name, with no
 compatibility promise before 1.0.0: the words may still move. `npm pack
---dry-run` shows what ships: the emitted `dist/`, the source, the vectors,
-the spec, this file, the licence and the notice, and no tests and no
-configs. The spec ships because it is the truth the source and the vectors
-are read against. Publishing is gated from the root of the repository:
-`npm run release` there runs both gates, `check` and `check:terrain`, and
-publishes on green; `npm publish` inside this package refuses and says so.
+--dry-run` shows what ships: the emitted `dist/`, the source, the protocol
+shelf with the spec inside it, this file, the licence and the notice, and no
+tests and no configs. The spec ships because it is the truth the source and
+the vectors are read against. Publishing is gated from the root of the repository:
+`npm run release:quo` there runs both gates, `check` and `check:terrain`,
+and publishes on green; `npm publish` inside this package refuses and says
+so. This package carries the version of its own work and is bound to no
+other's: a number equal to another package's is a coincidence.
 
 ## License
 

package/dist/being/being.d.ts

@@ -13,6 +13,7 @@ export declare class Being {
     get cells(): Cells;
     get standings(): Standings;
     get occupants(): Occupants;
+    lend(name: string, id: string): Promise<string | null>;
     invite(id: string, notes?: JsonObject): Promise<Invitation | null>;
     knock(invitation: Invitation, method?: string, args?: JsonObject, wanted?: Wanted): Promise<Answer>;
     take(id: string, invitation: Invitation): Promise<string | null>;

package/dist/being/being.js

@@ -1,11 +1,11 @@
 // Names a subclass may not use for an ask, because they are the base's own.
-const RESERVED = new Set(['answer', 'describe', 'stance', 'cells', 'standings', 'occupants', 'occupant', 'invite', 'knock', 'take', 'boot', 'constructor']);
+const RESERVED = new Set(['answer', 'describe', 'stance', 'cells', 'standings', 'occupants', 'occupant', 'invite', 'knock', 'take', 'boot', 'lend', 'constructor']);
 // Whether she has a method of that name, written on her own prototype chain
 // below Object's. A name Object lends every object, `hasOwnProperty` or
 // `toString`, is not a method she wrote; and a field she assigns in her own
 // constructor is not there yet when the base checks, so an ask is a method
 // on the prototype and nothing else.
-const method = (self, name) => {
+const wrote = (self, name) => {
     for (let p = Object.getPrototypeOf(self); p !== null && p !== Object.prototype; p = Object.getPrototypeOf(p)) {
         if (Object.hasOwn(p, name))
             return typeof p[name] === 'function';
@@ -32,7 +32,7 @@ export class Being {
         for (const name of Object.keys(C.asks)) {
             if (RESERVED.has(name))
                 throw new Error(`ask '${name}' is a reserved name`);
-            if (!method(this, name))
+            if (!wrote(this, name))
                 throw new Error(`ask '${name}' has no method on the prototype`);
         }
         // Own keys only: a default named after a member of Object's prototype is
@@ -50,6 +50,11 @@ export class Being {
     get occupants() {
         return this.stance.occupants;
     }
+    // A standing at one of the things this device can do, under an id of hers.
+    // The ward knocks and takes it for her; the invitation never reaches her.
+    lend(name, id) {
+        return this.stance.lend(name, id);
+    }
     invite(id, notes) {
         return this.stance.occupants.invite(id, notes);
     }

package/dist/being/index.d.ts

@@ -1,5 +1,5 @@
 export { Being, type AskSpec } from './being.ts';
 export { silence, isSilence, answered, unreached, isUnreached, word, isWord, wordOf, told, DOOR_WORDS, isDoorWord } from './silence.ts';
 export { digest, canonical } from './digest.ts';
-export { OWNER, PUBLIC, RESERVED_IDS, isBlueprint, invitationArgs } from './types.ts';
+export { OWNER, PUBLIC, RESERVED_IDS, isBlueprint, invitationArgs, isInvitation } from './types.ts';
 export type * from './types.ts';

package/dist/being/index.js

@@ -3,4 +3,4 @@
 export { Being } from './being.js';
 export { silence, isSilence, answered, unreached, isUnreached, word, isWord, wordOf, told, DOOR_WORDS, isDoorWord } from './silence.js';
 export { digest, canonical } from './digest.js';
-export { OWNER, PUBLIC, RESERVED_IDS, isBlueprint, invitationArgs } from './types.js';
+export { OWNER, PUBLIC, RESERVED_IDS, isBlueprint, invitationArgs, isInvitation } from './types.js';

package/dist/being/types.d.ts

@@ -19,6 +19,7 @@ export type Invitation = {
     secret?: string;
 };
 export declare const invitationArgs: (inv: Invitation) => JsonObject;
+export declare const isInvitation: (v: unknown) => v is Invitation;
 export type Schema = JsonObject;
 export type Ask = {
     name: string;
@@ -79,6 +80,7 @@ export type Stance = {
     readonly cells: Cells;
     readonly occupants: Occupants;
     readonly standings: Standings;
+    lend(name: string, id: string): Promise<string | null>;
     boot(className: string, key: string, id?: string): Promise<string | null>;
 };
 export interface BeingLike {

package/dist/being/types.js

@@ -23,6 +23,23 @@ export const invitationArgs = (inv) => ({
     ...(inv.heir !== undefined ? { heir: inv.heir } : {}),
     ...(inv.secret !== undefined ? { secret: inv.secret } : {}),
 });
+// Whether a value that arrived is an invitation. The shape is the spec's, so
+// the reading of it is too, and it is one reading: a form that
+// asks a guest for one, a faculty handed one to wake her maker by, and a
+// shell that finds one in a link all ask the same question, and a kinder
+// answer in one of them is a value that fails at a door instead of at the
+// edge it came in by. A ward pk is a hundred and twenty-eight lowercase hex,
+// and a heir comes with its secret or neither comes: an invitation to a
+// public being carries no heir, and a heir with no secret opens nothing.
+export const isInvitation = (v) => {
+    if (v === null || typeof v !== 'object' || Array.isArray(v))
+        return false;
+    const o = v;
+    if (typeof o.ward !== 'string' || !/^[0-9a-f]{128}$/.test(o.ward))
+        return false;
+    const heir = typeof o.heir === 'string', secret = typeof o.secret === 'string';
+    return (heir && secret) || (!heir && !secret && !('heir' in o) && !('secret' in o));
+};
 // Whether what came back from an empty ask is a blueprint. Every describe on
 // the far side of a door is somebody else's code, so nothing may be written
 // into a standing's record as a blueprint without being read as one first: a

package/dist/conformance/beings.d.ts

@@ -132,6 +132,20 @@ export declare class Maker extends Being {
                 required: string[];
             };
         };
+        borrow: {
+            input: {
+                type: string;
+                properties: {
+                    name: {
+                        type: string;
+                    };
+                    id: {
+                        type: string;
+                    };
+                };
+                required: string[];
+            };
+        };
     };
     open({ class: className, key, id }: JsonObject): Promise<{
         made: string | null;
@@ -139,6 +153,9 @@ export declare class Maker extends Being {
     say({ id }: JsonObject): Promise<{
         said: Json;
     }>;
+    borrow({ name, id }: JsonObject): Promise<{
+        lent: string | null;
+    }>;
 }
 export declare class Member extends Being {
     static cells: {
@@ -150,8 +167,32 @@ export declare class Member extends Being {
                 type: string;
             };
         };
+        relay: {
+            input: {
+                type: string;
+                properties: {
+                    id: {
+                        type: string;
+                    };
+                    method: {
+                        type: string;
+                    };
+                    time: {
+                        type: string;
+                    };
+                };
+                required: string[];
+            };
+        };
     };
     ping(_args: JsonObject, asker: Asker): {
         pong: string | null;
     };
+    relay({ id, method, args, time }: JsonObject): Promise<{
+        said: string;
+        out: null;
+    } | {
+        said: null;
+        out: Json;
+    }>;
 }

package/dist/conformance/beings.js

@@ -3,7 +3,7 @@
 // shop, a customer on the base class, a maker, a member, and one raw being
 // with no base at all.
 import { Being } from '../being/being.js';
-import { answered, isUnreached } from '../being/silence.js';
+import { answered, isSilence, isUnreached, isWord, wordOf } from '../being/silence.js';
 import { invitationArgs } from '../being/types.js';
 // A printer. Invites whom she is told to, prints for her occupants. Her
 // blueprint lives in her cells so a test can change her shape.
@@ -135,6 +135,7 @@ export class Maker extends Being {
     static asks = {
         open: { input: { type: 'object', properties: { class: { type: 'string' }, key: { type: 'string' }, id: { type: 'string' } }, required: ['class', 'key'] } },
         say: { input: { type: 'object', properties: { id: { type: 'string' } }, required: ['id'] } },
+        borrow: { input: { type: 'object', properties: { name: { type: 'string' }, id: { type: 'string' } }, required: ['name', 'id'] } },
     };
     async open({ class: className, key, id }) {
         const made = await this.boot(className, key, id);
@@ -146,12 +147,37 @@ export class Maker extends Being {
         const standing = this.standings[id];
         return { said: standing === undefined ? null : (await standing.ask('ping')) };
     }
+    // Making's other half: a standing at something the box already has, by the
+    // name the box knows it under. She is handed the id and never the value.
+    async borrow({ name, id }) {
+        return { lent: await this.lend(name, id) };
+    }
 }
 export class Member extends Being {
     static cells = { heard: [] };
-    static asks = { ping: { input: { type: 'object' } } };
+    static asks = {
+        ping: { input: { type: 'object' } },
+        relay: { input: { type: 'object', properties: { id: { type: 'string' }, method: { type: 'string' }, time: { type: 'number' } }, required: ['id'] } },
+    };
     ping(_args, asker) {
         this.cells.heard.push({ from: asker.id ?? null });
         return { pong: asker.id ?? null };
     }
+    // She asks on one of her standings from inside her own answer, and says
+    // what came back as a word rather than as the word itself, since a word is
+    // her ward's value and never a thing that crosses. `time` is what she is
+    // willing to wait, which is the whole of what the third argument is for.
+    // Two members holding each other and relaying make a cycle, and a cycle is
+    // how a suite that owns no clock can see a wait end.
+    async relay({ id, method, args, time }) {
+        const standing = this.standings[id];
+        if (standing === undefined)
+            return { said: 'no standing', out: null };
+        const out = await standing.ask(method, (args ?? {}), time === undefined ? undefined : { time: time });
+        if (isSilence(out))
+            return { said: 'silence', out: null };
+        if (isWord(out))
+            return { said: wordOf(out), out: null };
+        return { said: null, out: out };
+    }
 }

package/dist/conformance/index.d.ts

@@ -53,6 +53,10 @@ export type World = {
     census(): Census;
     migrate(key: string): Promise<void>;
     owner(key: string): (method?: string, args?: JsonObject) => Promise<unknown>;
+} & Partial<Standing>;
+export type Standing = {
+    partition(key: string): JsonObject;
+    restart(key: string, partition?: JsonObject): Promise<void>;
 };
 export { Printer, Shop, Customer, Echo, Maker, Member };
 export declare const HEX64: RegExp;
@@ -60,8 +64,13 @@ export declare const HEX128: RegExp;
 export type Runner = (name: string, opts: {
     skip?: string | false;
 }, fn: () => Promise<void> | void) => void;
-export declare function conform(label: string, make: () => Promise<World>, { canDown, test }: {
+export type Made = {
+    lends?: Record<string, string>;
+};
+export declare function conform(label: string, make: (made?: Made) => Promise<World>, { canDown, canLend, canRestart, test }: {
     canDown?: boolean;
+    canLend?: boolean;
+    canRestart?: boolean;
     test: Runner;
 }): void;
 export { conformStore } from './store.ts';

package/dist/conformance/index.js

@@ -3,7 +3,10 @@
 //
 // A ward is handed in as a probe:
 //
-//   make()                                       -> world
+//   make({ lends })                               -> world. `lends` maps a name the box lends to the
+//                                                    class of the being it lends under it; the probe
+//                                                    stands one of each in a ward its harbor roots,
+//                                                    and every ward it boots is grounded to lend them
 //   world.boot(key, Class, cells?, { isPublic })  -> handle
 //   world.heir(invitation)                        -> { current, announced, fresh } | undefined
 //                                                    what the inviting ward holds for that heir
@@ -19,7 +22,7 @@
 //
 // Every assertion here is the truth's. Nothing here knows how a ward is built.
 import { assert } from './assert.js';
-import { silence, isSilence, isUnreached, told } from '../being/silence.js';
+import { silence, answered, isSilence, isUnreached, told } from '../being/silence.js';
 import { digest } from '../being/digest.js';
 import { Printer, Shop, Customer, Echo, Maker, Member } from './beings.js';
 import { estate } from './estate.js';
@@ -33,9 +36,15 @@ export const HEX64 = /^[0-9a-f]{64}$/; // one key, one secret, one digest
 export const HEX128 = /^[0-9a-f]{128}$/; // a ward pk: the signing pk then the padlock
 // Her ward's word, as she receives it.
 const said = (x, w) => told(x) === w;
-export function conform(label, make, { canDown = true, test }) {
+// A world whose harness stands a ward up again. The two members are optional
+// on the probe and required of a harness that says it can, so a chapter that
+// needs them says so here rather than reaching past a maybe at every line.
+const able = (w) => w;
+export function conform(label, make, { canDown = true, canLend = true, canRestart = true, test }) {
     const t = (name, fn) => test(`[${label}] ${name}`, {}, fn);
     const down = (name, fn) => test(`[${label}] ${name}`, { skip: !canDown && 'nothing to cut inside one ward' }, fn);
+    const lends = (name, fn) => test(`[${label}] ${name}`, { skip: !canLend && 'this harness stands no ward of its harbor to lend from' }, fn);
+    const kept = (name, fn) => test(`[${label}] ${name}`, { skip: !canRestart && 'this harness cannot hand a ward a partition and stand it up again' }, fn);
     async function world({ printerInvitesShop = true } = {}) {
         const w = await make();
         const printer = await w.boot('P', Printer);
@@ -166,8 +175,12 @@ export function conform(label, make, { canDown = true, test }) {
         // alice hosts here rather than the shop, because the shop's own `invite`
         // takes a tier and mints the id itself. This one is the stance's, which
         // is where the rule lives.
-        const { alice, bob } = await world();
-        for (const id of ['OWNER', 'PUBLIC', 'knock', 'take', 'remove']) {
+        const { w, alice, bob } = await world();
+        // `__proto__` is in the list because a partition cannot hold it. A kit
+        // that refuses it only where it writes her cells writes the ward's half
+        // first and then throws, which leaves one relation in two standings and a
+        // throw where this table promises a null.
+        for (const id of ['OWNER', 'PUBLIC', 'knock', 'take', 'remove', '__proto__']) {
             assert.equal(await alice.being.invite(id), null, `${id} is not hers to mint`);
             assert.equal(Object.hasOwn(alice.cells.occupants, id), false, `and nothing was written for ${id}`);
             // The other end: a guest is answered and then refused the name.
@@ -175,6 +188,9 @@ export function conform(label, make, { canDown = true, test }) {
             assert.deepEqual(await bob.being.knock(inv, 'hi'), { heard: 'hi' }, `the knock for ${id} was answered`);
             assert.equal(await bob.being.take(id, inv), null, `take refuses ${id} for the same reason`);
             assert.equal(Object.hasOwn(bob.cells.standings, id), false, `and nothing was written for ${id}`);
+            // The ward's half too, and not only hers: a standing filed here with no
+            // record of it in her cells is a lane nobody can see and nobody removes.
+            assert.equal(Object.hasOwn(w.census().binds.B.standings, id), false, `and the ward wrote no keys for ${id}`);
             assert.equal(await bob.being.take(`as-${id}`, inv), `as-${id}`, 'and an ordinary id takes the same invitation');
         }
         // And the three calls are still the calls, not records that shadowed them.
@@ -190,7 +206,7 @@ export function conform(label, make, { canDown = true, test }) {
         const { w, shop, alice } = await world();
         const ask = w.owner('S');
         const bp = (await ask());
-        assert.deepEqual(bp.asks.map((a) => a.name), ['boot', 'public', 'invite', 'knock', 'remove', 'unboot'], 'six asks, in this order');
+        assert.deepEqual(bp.asks.map((a) => a.name), ['boot', 'public', 'invite', 'knock', 'remove', 'unboot', 'ask'], 'seven asks, in this order');
         for (const a of bp.asks) {
             assert.equal(typeof a.description, 'string', `${a.name} says what it is for`);
             assert.equal(a.input.type, 'object', `${a.name} takes one object`);
@@ -228,6 +244,32 @@ export function conform(label, make, { canDown = true, test }) {
         assert.ok(gone.removed.includes('for-alice'), 'her relations went with her, and the owner is told which');
         assert.ok(said(await alice.being.standings['via-owner'].ask('hello'), 'removed'), 'and her occupant hears removed at the door');
     });
+    // The owner's seventh ask: reaching into a being and asking her. It is the
+    // third asker of the ward-to-being edge, and the ward is the only one who
+    // fills it in: nothing outside a ward names OWNER, and no side holds a
+    // being's answer to judge it again. Strictly less than the unboot beside
+    // it, which takes her out with every relation she holds.
+    t('the owner asks a being of the ward, as owner or, with no being named, as nobody at the public being', async () => {
+        const { w } = await world();
+        const ask = w.owner('S');
+        const echo = w.owner('E');
+        await w.boot('E', Echo);
+        // Named: she is asked as the owner, and hears the owner's name.
+        assert.deepEqual(await echo('ask', { being: 'E', method: 'echo', args: { x: 1 } }), { from: 'OWNER', x: 1 }, 'the ward names the asker, and the name is the owner');
+        assert.deepEqual(bp(await ask('ask', { being: 'S' })).asks.map((a) => a.name), ['hello', 'buy'], 'no method is her describe, and a gate that reads an occupant record shows the owner nothing: refund is hers to nobody here');
+        assert.deepEqual(await ask('ask', { being: 'S', method: 'hello' }), { welcome: true });
+        assert.deepEqual(await ask('ask', { being: 'S', method: 'nosuch' }), { error: 'unknown ask' }, 'her own answer, as any asker gets it');
+        // Nobody named, and nobody home: one refusal, and never a fourth word.
+        assert.deepEqual(await echo('ask', {}), { error: 'no such being' }, 'a ward with no public being has nobody to ask as nobody');
+        assert.deepEqual(await echo('public', { key: 'E' }), { public: 'E' });
+        assert.deepEqual(await echo('ask', { method: 'echo', args: { x: 2 } }), { from: null, x: 2 }, 'with no being named it is the public being, asked as nobody');
+        // What it refuses, each in an object, because the owner hears objects.
+        const pk = bp(await ask()).notes.pk;
+        assert.deepEqual(await ask('ask', { being: 'nobody' }), { error: 'no such being' });
+        assert.deepEqual(await ask('ask', { being: pk }), { error: 'no such being' }, 'the ward is a being to nobody outside, here as at invite and unboot');
+        assert.deepEqual(await ask('ask', { being: 42 }), { error: 'no such being' }, 'a name is a string or it is nothing');
+        assert.deepEqual(await ask('ask', { being: 'S', method: 42 }), { error: 'an ask is named by a word' }, 'and so is an ask');
+    });
     // The one public being, marked and unmarked through the owner. A second
     // one would leave the first holding every relation she had, reachable by
     // nobody at the bare pk and told by nobody that she had been replaced.
@@ -277,6 +319,120 @@ export function conform(label, make, { canDown = true, test }) {
         assert.deepEqual(await maker.being.say({ id: 'mine' }), { said: { pong: 'MK' } }, 'she asks through the relation, and arrives under her own key');
         assert.deepEqual(await maker.being.say({ id: 'nothing' }), { said: null });
     });
+    // The count, reached the one way a suite that owns no bytes can reach it:
+    // a caller's numbers are in her own partition, so winding them back and
+    // standing her ward up again makes her next ask carry a number the far
+    // door has already honoured. A kit with no once-only delivery answers it
+    // and passes every other chapter here clean.
+    kept('a number already honoured is repeated: the far being is not asked twice, and nothing is written for it', async () => {
+        const { w, shop, alice } = await world();
+        const inv = await shop.being.invite();
+        assert.deepEqual(await alice.being.join(inv), { welcome: true });
+        assert.deepEqual(await alice.being.buy('a hat'), { ok: true, receipt: 'receipt for a hat' });
+        const sold = shop.cells.sales.length;
+        // Her keys for the shop, wound back to the number she has just spent.
+        const kept = able(w);
+        const p = kept.partition('A');
+        const keys = p.bind.A.standings;
+        const mine = keys.shop;
+        const back = mine.seq - 1;
+        mine.seq = back;
+        await kept.restart('A', p);
+        const again = await alice.being.buy('a second hat');
+        assert.ok(said(again, 'repeated'), `a number already honoured is repeated, not ${JSON.stringify(again)}`);
+        assert.equal(shop.cells.sales.length, sold, 'and she was never asked');
+        // The count carries on from where it was: the next number is fresh.
+        assert.deepEqual(await alice.being.buy('a third hat'), { ok: true, receipt: 'receipt for a third hat' });
+    });
+    // A restart is silent by construction: the ward comes back on the same
+    // seed with the same pk, and every relation it holds still points at it.
+    // What must survive with it is what the door has honoured, or a restart is
+    // a stretch of time in which every number can be replayed.
+    kept('a restart is silent: same pk, every relation still stands, and the far door still refuses what it spent', async () => {
+        const { w, shop, alice } = await world();
+        const inv = await shop.being.invite();
+        assert.deepEqual(await alice.being.join(inv), { welcome: true });
+        assert.deepEqual(await alice.being.buy('a hat'), { ok: true, receipt: 'receipt for a hat' });
+        const pk = shop.pk;
+        const able2 = able(w);
+        const mark = JSON.stringify(able2.partition('S').heirs);
+        await able2.restart('S');
+        assert.equal(shop.pk, pk, 'a ward that came back changed its pk');
+        assert.equal(JSON.stringify(able2.partition('S').heirs), mark, 'and it came back holding what it had honoured');
+        assert.deepEqual(await alice.being.buy('a second hat'), { ok: true, receipt: 'receipt for a second hat' }, 'the relation goes on, and she was never told');
+        assert.deepEqual(alice.cells.standings.shop.id, 'shop', 'her side was not told either');
+    });
+    // Notes are the one thing on a record that a being seeds and a ward keeps
+    // without ever reading. A kit that files what it was handed rather than a
+    // copy of it leaves the seeder a hand inside her cells: it writes without
+    // the ward being told, so what a restart brings back is not what she read.
+    t('notes are values and are kept as a copy: what the seeder still holds is not what the record holds', async () => {
+        const { alice } = await world();
+        const seeded = { tier: { deep: 'gold' } };
+        assert.ok((await alice.being.invite('noted', seeded)) !== null, 'she minted with notes');
+        seeded.tier.deep = 'moved';
+        assert.deepEqual(alice.cells.occupants.noted.notes, { tier: { deep: 'gold' } }, 'the record is the copy, all the way down');
+        // And notes no harbor could write back are no invitation, for the reason
+        // every other write is refused: a record it could not keep.
+        assert.equal(await alice.being.invite('bad-notes', { n: 0 / 0 }), null);
+        assert.equal(Object.hasOwn(alice.cells.occupants, 'bad-notes'), false, 'and nothing was written for it');
+    });
+    // The wait, and the one thing a kit can get wrong that nothing else here
+    // would notice. A ward bounds every ask itself, so a relation cycle ends:
+    // A asks B, B asking back holds A's lane, and the third ask can never be
+    // answered. A kit with no bound waits for ever and hangs, and every other
+    // chapter in this suite would still pass it. The word is `late`, which
+    // promises nothing either way, and the relation lives afterwards.
+    t('the wait is bounded, so a cycle ends: the ask that cannot be answered is late, and the relation lives', async () => {
+        const { w } = await world();
+        const a = await w.boot('MA', Member);
+        const b = await w.boot('MB', Member);
+        const toB = (await b.being.invite('from-a'));
+        const toA = (await a.being.invite('from-b'));
+        assert.ok(answered(await a.being.knock(toB, 'ping')), 'a knocks b');
+        assert.equal(await a.being.take('b', toB), 'b');
+        assert.ok(answered(await b.being.knock(toA, 'ping')), 'b knocks a');
+        assert.equal(await b.being.take('a', toA), 'a');
+        // A asks B; B, answering, asks A back; A, answering that, asks B on the
+        // lane the first ask still holds. Every link is a legal ask.
+        const out = (await a.being.relay({ id: 'b', method: 'relay', args: { id: 'a', method: 'relay', args: { id: 'b', method: 'ping' }, time: 200 } }));
+        assert.equal(out.said, null, 'the outer ask was answered');
+        assert.equal(out.out?.said, 'late', 'and what it carries is the ask that could not be, said as late');
+        // The relation is not the worse for it: the lane is free again and the
+        // count moved on, which is what a bound is for.
+        const after = (await a.being.relay({ id: 'b', method: 'ping' }));
+        assert.equal(after.said, null, 'and she asks again on the same standing');
+    });
+    // Lend is boot's other half: what the device already has, reached the one
+    // way anything is reached. The being lent stands in a ward the harbor
+    // roots, so nothing here can look at her from the outside; what the ward
+    // owes is what is asserted. She is handed an id, the standing is an
+    // ordinary one, and the invitation is nowhere she can read.
+    lends('what the device lends is a being: she is handed an id, asks on an ordinary standing, and never sees the invitation', async () => {
+        const w = await make({ lends: { pen: 'Member' } });
+        const maker = await w.boot('MK', Maker);
+        assert.deepEqual(await maker.being.borrow({ name: 'pen', id: 'pen' }), { lent: 'pen' }, 'the id she gave is the id she gets');
+        // An ordinary standing from there on: she asks on it, and arrives at that
+        // being's door as somebody the far side named.
+        const said = (await maker.being.say({ id: 'pen' }));
+        assert.equal(typeof said.said?.pong, 'string', 'she arrived under an id the far being minted');
+        // The keys are the ward's. Nothing of the relation is in her cells, which
+        // is the whole difference between this standing and one she gave away.
+        const c = w.census();
+        const heir = c.binds.MK.standings.pen.heir;
+        assert.equal(typeof heir, 'string', 'the ward bound a heir for it');
+        assert.equal(JSON.stringify(c.cells.MK).includes(heir), false, 'and the invitation reached her nowhere');
+        // Null is every kind of no, and she cannot tell them apart.
+        assert.deepEqual(await maker.being.borrow({ name: 'gps', id: 'x' }), { lent: null }, 'a name this box does not lend');
+        assert.deepEqual(await maker.being.borrow({ name: 'pen', id: 'pen' }), { lent: null }, 'an id she already holds');
+        assert.deepEqual(await maker.being.borrow({ name: 'pen', id: 'OWNER' }), { lent: null }, 'a word the ward reserves');
+    });
+    lends('a harbor with nothing to lend lends nothing, and says so the same way', async () => {
+        const w = await make();
+        const maker = await w.boot('MK', Maker);
+        assert.deepEqual(await maker.being.borrow({ name: 'pen', id: 'pen' }), { lent: null });
+        assert.equal(w.census().binds.MK.standings.pen, undefined, 'and nothing was written for it');
+    });
     // The case the estate's walk reaches by weight and this reaches by hand: a
     // seat kicked after it answered and before it was taken. She holds a key
     // the door bound for her, so she is the one person who hears why, and she

package/dist/harbor/core.d.ts

@@ -1,4 +1,4 @@
-import { type WardPointers } from '../ward/ground.ts';
+import { type WardPointers, type Lend } from '../ward/ground.ts';
 import type { BeingClass, BeingLike } from '../being/types.ts';
 import { type Reach } from './reach.ts';
 import type { Kept, Store, WardRecord } from './store.ts';
@@ -33,7 +33,9 @@ export declare class Harbor {
     readonly classes: Record<string, BeingClass>;
     readonly fallbacks: Reach[];
     readonly announcers: Set<() => void>;
-    constructor(store: Store, loader?: Loader);
+    lend: Lend | undefined;
+    constructor(store: Store, loader?: Loader, lend?: Lend);
+    protected lendFor(_name: string, _record: WardRecord): Lend | undefined;
     boot(): Promise<void>;
     partitionOf(name: string): Record<string, unknown> | undefined;
     carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;