@quo-systems/quo 0.2.8 → 0.2.10

package/dist/being/being.js

@@ -1,10 +1,23 @@
 // Names a subclass may not use for an ask, because they are the base's own.
 const RESERVED = new Set(['answer', 'describe', 'stance', 'cells', 'standings', 'occupants', 'occupant', 'invite', 'knock', 'take', 'boot', 'constructor']);
+// Whether she has a method of that name, written on her own prototype chain
+// below Object's. A name Object lends every object, `hasOwnProperty` or
+// `toString`, is not a method she wrote; and a field she assigns in her own
+// constructor is not there yet when the base checks, so an ask is a method
+// on the prototype and nothing else.
+const method = (self, name) => {
+    for (let p = Object.getPrototypeOf(self); p !== null && p !== Object.prototype; p = Object.getPrototypeOf(p)) {
+        if (Object.hasOwn(p, name))
+            return typeof p[name] === 'function';
+    }
+    return false;
+};
 export class Being {
     // Her cells' defaults. Merged in at birth, only where a key is missing, so
     // a restart keeps what she wrote.
     static cells = {};
-    // What she can be asked. Declaration order is blueprint order.
+    // What she can be asked. Declaration order is blueprint order, except a
+    // name that reads as an array index, which the language lists first.
     static asks = {};
     stance;
     constructor(stance) {
@@ -13,11 +26,13 @@ export class Being {
         for (const name of Object.keys(C.asks)) {
             if (RESERVED.has(name))
                 throw new Error(`ask '${name}' is a reserved name`);
-            if (typeof this[name] !== 'function')
-                throw new Error(`ask '${name}' has no method`);
+            if (!method(this, name))
+                throw new Error(`ask '${name}' has no method on the prototype`);
         }
+        // Own keys only: a default named after a member of Object's prototype is
+        // still hers, and still missing until she writes it.
         for (const [k, v] of Object.entries(C.cells))
-            if (!(k in stance.cells))
+            if (!Object.hasOwn(stance.cells, k))
                 stance.cells[k] = structuredClone(v);
     }
     get cells() {
@@ -29,8 +44,8 @@ export class Being {
     get occupants() {
         return this.stance.occupants;
     }
-    invite(id) {
-        return this.stance.occupants.invite(id);
+    invite(id, notes) {
+        return this.stance.occupants.invite(id, notes);
     }
     knock(invitation, method, args, wanted) {
         return this.stance.standings.knock(invitation, method, args, wanted);
@@ -38,13 +53,14 @@ export class Being {
     take(id, invitation) {
         return this.stance.standings.take(id, invitation);
     }
-    // A new being of her ward, by class name, under a key she chooses.
-    boot(className, key) {
-        return this.stance.boot(className, key);
+    // A new being of her ward, by class name, under a key she chooses. With an
+    // id, she holds a standing to the being she made, who knows her by her key.
+    boot(className, key, id) {
+        return this.stance.boot(className, key, id);
     }
     // The occupant record for whoever is at the door. Undefined at a public being.
     occupant(asker) {
-        return asker.id === undefined ? undefined : this.cells.occupants[asker.id];
+        return asker.id !== undefined && Object.hasOwn(this.cells.occupants, asker.id) ? this.cells.occupants[asker.id] : undefined;
     }
     // Her blueprint for this asker. Override to shape it by hand.
     describe(asker) {
@@ -72,7 +88,7 @@ export class Being {
         // lookup would also find every name on Object's prototype: `valueOf`
         // would answer with her stance, `toString` with a string, and neither is
         // an ask she wrote. Only her own keys are asks, which is what describe
-        // has always shown. What she shows is what she can be asked.
+        // shows. What she shows is what she can be asked.
         const spec = typeof method === 'string' && Object.hasOwn(C.asks, method) ? C.asks[method] : undefined;
         if (!spec || (spec.for && !spec.for(this.occupant(asker), asker)))
             return { error: 'unknown ask' };

package/dist/being/digest.js

@@ -5,15 +5,19 @@
 // happened to be holding.
 const absent = (v) => v === undefined || typeof v === 'function' || typeof v === 'symbol';
 // JCS for I-JSON values: sorted keys, no whitespace, JSON escaping. Numbers
-// are serialized as ES does, which is what RFC 8785 specifies.
-export const canonical = (v) => Array.isArray(v)
-    ? `[${v.map((slot) => (absent(slot) ? 'null' : canonical(slot))).join(',')}]`
-    : v !== null && typeof v === 'object'
-        ? `{${Object.keys(v)
+// are serialized as ES does, which is what RFC 8785 specifies. A hole in a
+// list is null, as JSON writes it.
+export const canonical = (v) => {
+    if (Array.isArray(v))
+        return `[${Array.from(v, (slot) => (absent(slot) ? 'null' : canonical(slot))).join(',')}]`;
+    if (v !== null && typeof v === 'object') {
+        return `{${Object.keys(v)
             .filter((k) => !absent(v[k]))
             .sort()
             .map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`)
-            .join(',')}}`
-        : JSON.stringify(v);
+            .join(',')}}`;
+    }
+    return JSON.stringify(v);
+};
 const hex = (bytes) => Array.from(new Uint8Array(bytes), (b) => b.toString(16).padStart(2, '0')).join('');
 export const digest = async (blueprint) => hex(await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(canonical(blueprint))));

package/dist/being/types.d.ts

@@ -70,14 +70,14 @@ export type Standings = {
     readonly [id: string]: Standing | undefined;
 };
 export type Occupants = {
-    invite(id: string): Promise<Invitation | null>;
+    invite(id: string, notes?: JsonObject): Promise<Invitation | null>;
     remove(id: string): void;
 };
 export type Stance = {
     readonly cells: Cells;
     readonly occupants: Occupants;
     readonly standings: Standings;
-    boot(className: string, key: string): string | null;
+    boot(className: string, key: string, id?: string): Promise<string | null>;
 };
 export interface BeingLike {
     answer(asker: Asker, method?: string, args?: JsonObject): Reply | Promise<Reply>;

package/dist/conformance/estate.js

@@ -22,7 +22,7 @@
 // harbors, and that is where the promise of Quo is held: a being never learns
 // where the other one is, so every answer, after every move, under every
 // topology, is the answer the model wrote without knowing the topology
-// either. Held forty times a run, it is the promise at a scale a scene
+// either. Held after every one of sixty moves, it is the promise at a scale a scene
 // cannot reach, and it is what makes a migration honest: if no answer can
 // tell the topology apart, moving a ward between harbors cannot be felt.
 // The model itself is the script's own bookkeeping and takes nothing from a
@@ -241,8 +241,6 @@ export function estate(label, make, { canDown, test }) {
                     return `${who}'s ward moves harbor`;
                 });
                 // weather: the host's door is gone. unreached, never silence, and the
-                // relation is exactly where it was when it comes back.
-                // weather: the host's door is gone. unreached, never silence, and the
                 // relation is exactly where it was when it comes back. The move is on
                 // the list under every topology even where there is nothing to cut,
                 // because the list is the script: a move missing in one world would

package/dist/conformance/index.js

@@ -12,7 +12,7 @@
 //   handle.being                                  the object, as the test drives it
 //   handle.cells                                  her cells, as the ward keeps them
 //   handle.down = true | false                    her door is unreachable (needs canDown)
-//   handle.minted.has(pk)                         every pk her side ever minted
+//   handle.minted.has(pk)                         the last eight pks her side minted
 //   handle.forgeKnock(invitation)                 make her side knock with a key of its own, unannounced
 //   world.census()                                every partition in the world, as values
 //   world.migrate(key)                            her ward moves to another harbor, same seed, same pk

package/dist/harbor/core.d.ts

@@ -28,6 +28,8 @@ export declare class Harbor {
     readonly reaches: Map<string, Bound>;
     readonly down: Set<string>;
     readonly refused: Map<string, number>;
+    readonly faults: Map<string, number>;
+    readonly unbooted: string[];
     readonly classes: Record<string, BeingClass>;
     readonly fallbacks: Reach[];
     readonly announcers: Set<() => void>;

package/dist/harbor/core.js

@@ -17,6 +17,7 @@
 // that arrive from the wire go to an own door or a held socket and never
 // onward by request or by fallback; that one rule is the rendezvous.
 import { Ward } from '../ward/ward.js';
+import { silence } from '../being/silence.js';
 import { request } from './reach.js';
 import { openReply, wardSignPk } from '../ward/seal.js';
 import { concat, sealingPair, KEY } from '../ward/arithmetic.js';
@@ -25,6 +26,12 @@ export const DEFAULT_CODE = 'classes/index.ts';
 // How long a probe waits for the door behind a claim. A claim that answers
 // nothing in this time is not bound; the next announce is another chance.
 const PROBE = 10_000;
+// How many pks one announce may claim, and how many are proven at once.
+const ANNOUNCE = 64;
+const PROVING = 8;
+// How many times each reach has announced: a proof from an older announce
+// binds nothing when it lands.
+const announces = new WeakMap();
 export class Harbor {
     store;
     loader;
@@ -33,7 +40,10 @@ export class Harbor {
     reaches = new Map(); // the directory: foreign ward pk -> reach
     down = new Set(); // pks this harbor will not reach right now: weather, for a test
     refused = new Map(); // own ward pk -> arrivals its door would not admit. what a terrain does with it is its own
+    faults = new Map(); // ward name -> saves the store refused. what a terrain does with it is its own
+    unbooted = []; // the wards the store keeps that would not host this run, by name
     classes = {}; // classes handed in-process, beside the loader's
+    #saving = new Map();
     // The dialers' sockets, in the order they were dialed: where a pk nobody
     // here knows is sent, because the listener a harbor dialed is a rendezvous
     // and may hold that pk for someone else. It is a list because a harbor may
@@ -58,16 +68,62 @@ export class Harbor {
         this.store = store;
         this.loader = loader;
     }
-    // Boot every ward the store keeps, and learn the hints.
+    // Boot every ward the store keeps, and learn the hints. One ward that will
+    // not host, a partition this kit cannot read or a loader that throws, is
+    // named in `unbooted` and takes nobody else down with it.
     async boot() {
         for (const name of await this.store.list()) {
-            const kept = await this.store.load(name);
-            if (kept)
-                await this.host(name, kept);
+            try {
+                const kept = await this.store.load(name);
+                if (kept)
+                    await this.host(name, kept);
+            }
+            catch {
+                this.unbooted.push(name);
+            }
         }
         for (const [pk, url] of Object.entries(await this.store.hints()))
             this.hint(pk, url);
     }
+    // ---- saving
+    // The ward wrote. Its partition is saved once the line is free, and once
+    // for every burst of writes, in the order the writes came.
+    #wrote(name) {
+        const s = this.#saving.get(name);
+        if (!s || s.gone)
+            return;
+        s.dirty = true;
+        if (s.timer === undefined)
+            s.timer = setTimeout(() => void this.#flush(name), 0);
+    }
+    async #flush(name) {
+        const s = this.#saving.get(name);
+        if (!s)
+            return;
+        if (s.timer !== undefined) {
+            clearTimeout(s.timer);
+            s.timer = undefined;
+        }
+        if (s.running)
+            return s.running;
+        s.running = (async () => {
+            while (s.dirty && !s.gone) {
+                s.dirty = false;
+                try {
+                    await this.store.save(name, s.memory);
+                }
+                catch {
+                    this.faults.set(name, (this.faults.get(name) ?? 0) + 1);
+                }
+            }
+        })();
+        try {
+            await s.running;
+        }
+        finally {
+            s.running = null;
+        }
+    }
     // ---- the directory
     // Bytes to one of this harbor's own doors, and the one bit the door says
     // beside its reply, counted.
@@ -103,8 +159,8 @@ export class Harbor {
         return bound?.held ? bound.reach.carry(pk, bytes) : undefined;
     }
     hint(pk, url) {
-        if (this.reaches.get(pk)?.held)
-            return; // a socket in hand beats a hint
+        if (this.reaches.has(pk))
+            return; // a reach proven at a door beats a hint, held or reached through a dialed line
         this.reaches.set(pk, { reach: request(url), held: false });
     }
     async remember(pk, url) {
@@ -119,8 +175,8 @@ export class Harbor {
     // signed by the ward key. Only the holder of that ward's seed can write
     // that reply, the lid is fresh so nothing replays, and a box that does not
     // open writes nothing at the ward. This is the one box a harbor ever opens,
-    // the one it sealed itself, and it reads nothing from it but that the
-    // signature is the claimed key's.
+    // the one it sealed itself, and it reads nothing from it but that it is
+    // the silence a door owes such a box, signed by the claimed key.
     async prove(pk, reach) {
         if (!/^[0-9a-f]{128}$/.test(pk))
             return false;
@@ -139,19 +195,32 @@ export class Harbor {
     }
     // Bind what the far side claims, each pk proven at its door first. Both
     // sides bind this way: the listener the dialer's claims, the dialer the
-    // listener's, since a claim is a claim whichever end made it.
+    // listener's, since a claim is a claim whichever end made it. An announce
+    // names at most this many pks, and they are proven a few at a time: a
+    // side that announced a thousand would otherwise cost a thousand keys, a
+    // thousand frames and a thousand waits at once, on its word alone.
     async bind(pks, reach, held) {
         // An announce is the whole of what that side holds now, so a pk this
-        // reach was bound for and no longer claims is unbound at once: a ward
+        // reach was bound for and does not claim now is unbound at once: a ward
         // that left a dialer is not reachable through it, proof or no proof.
+        // And it is the newest word: a proof still in flight from an earlier
+        // announce on this reach binds nothing when it lands, since the side
+        // has spoken again since.
+        const said = (announces.get(reach) ?? 0) + 1;
+        announces.set(reach, said);
         for (const [pk, b] of this.reaches)
             if (b.reach === reach && !pks.includes(pk))
                 this.reaches.delete(pk);
-        await Promise.all(pks.map(async (pk) => {
+        const claimed = [...new Set(pks)].slice(0, ANNOUNCE);
+        const prove = async (pk) => {
             if (this.doors.has(pk) || !(await this.prove(pk, reach)))
                 return;
+            if (announces.get(reach) !== said)
+                return; // a newer announce has spoken since
             this.reaches.set(pk, { reach, held });
-        }));
+        };
+        for (let i = 0; i < claimed.length; i += PROVING)
+            await Promise.all(claimed.slice(i, i + PROVING).map(prove));
     }
     unbind(reach) {
         for (const [pk, b] of this.reaches)
@@ -168,12 +237,16 @@ export class Harbor {
         return hosted;
     }
     // Stop serving a ward and take it out of the store: what was kept comes
-    // back, for another harbor to put. The partition is written first, because
-    // a being driven in-process changes it without passing a door.
+    // back, for another harbor to put. The partition is written first, and
+    // never again under this name: whoever still holds the old pointers holds
+    // a ward that saves nothing and answers its owner silence.
     async drop(name) {
         const h = this.wards.get(name);
         if (h) {
             await h.save();
+            const s = this.#saving.get(name);
+            if (s)
+                s.gone = true;
             this.wards.delete(name);
             this.doors.delete(h.pk);
             this.#announce(); // this harbor no longer claims it: a listener unbinds a pk an announce stops naming
@@ -189,12 +262,13 @@ export class Harbor {
     async host(name, kept) {
         const { seed, partition: memory } = kept;
         const classes = await this.loader(kept.record);
-        const objects = new Map(); // cells -> the object instantiate made. a side's hand, never the ward's
+        const objects = new WeakMap(); // cells -> the object instantiate made. a side's hand, never the ward's; it follows the cells out when she is unbooted
         const ground = {
             seed,
             memory,
             instantiate: (className, stance) => {
-                const C = classes[className] ?? this.classes[className];
+                // Own keys only: `constructor` is a name Object lends every registry.
+                const C = Object.hasOwn(classes, className) ? classes[className] : Object.hasOwn(this.classes, className) ? this.classes[className] : undefined;
                 if (!C)
                     return null;
                 const obj = new C(stance);
@@ -203,19 +277,34 @@ export class Harbor {
             },
             carry: (pk, bytes) => this.carry(pk, new Uint8Array(bytes)),
             random: (n) => globalThis.crypto.getRandomValues(new Uint8Array(n)),
+            wrote: () => this.#wrote(name),
         };
+        const saving = { memory, dirty: false, running: null, timer: undefined, gone: false };
+        this.#saving.set(name, saving);
         const w = await Ward(ground);
-        const save = () => this.store.save(name, memory);
-        const after = (f) => async (...a) => {
-            try {
-                return await f(...a);
-            }
-            finally {
+        // A save the caller may wait for: what the ward wrote so far is in the
+        // store when this resolves, or the fault is counted. After a call through
+        // a pointer the store is current, so a restart right after it finds
+        // everything; a refusal at the door wrote nothing and saves nothing.
+        const save = async () => {
+            if (saving.gone)
+                return;
+            saving.dirty = true;
+            await this.#flush(name);
+        };
+        const door = async (bytes) => {
+            const r = await w.door(bytes);
+            if (r.heard)
                 await save();
-            }
+            return r;
+        };
+        const ask = async (method, args) => {
+            if (saving.gone)
+                return silence;
+            const out = await w.ask(method, args);
+            await save();
+            return out;
         };
-        const door = after(w.door);
-        const ask = after(w.ask);
         const bp = (await w.ask()); // learned by asking, as anyone learns anything
         const beings = memory.beings;
         const being = (key) => {

package/dist/harbor/dial.js

@@ -1,12 +1,12 @@
 import { REFUSED, Socket } from './reach.js';
 export function dial(harbor, url) {
     const d = { url, socket: null, wake: () => { }, close: () => { } };
-    let stopped = false, wait = 1000, timer;
+    let stopped = false, wait = 1000, timer, line; // the line in hand, open or still opening: close() closes it either way
     const connect = () => {
         timer = undefined; // no wait pending: this is the dial it was waiting for
         if (stopped)
             return;
-        const line = new WebSocket(url.replace(/\/$/, '').replace(/^http/, 'ws'));
+        line = new WebSocket(url.replace(/\/$/, '').replace(/^http/, 'ws'));
         const s = new Socket(line, (pk, bytes) => harbor.deliver(pk, bytes), (far) => {
             // A line that opened is not a line that works. The wait goes back to
             // a second here, where the far side has answered and been taken, and
@@ -37,6 +37,8 @@ export function dial(harbor, url) {
         // the line already in hand, and a dropped one stops being claimed at once.
         const say = () => s.announce([...harbor.doors.keys()]);
         line.addEventListener('open', () => {
+            if (stopped)
+                return s.close(); // closed while it was opening: it opens into nothing
             d.socket = s;
             harbor.announcers.add(say);
             say();
@@ -57,7 +59,7 @@ export function dial(harbor, url) {
     d.close = () => {
         stopped = true;
         clearTimeout(timer);
-        d.socket?.close();
+        line?.close(); // open or opening: a line closed while connecting fires close and never open
     };
     connect();
     return d;

package/dist/harbor/memory.d.ts

@@ -16,7 +16,7 @@ export declare class MemoryHarbor {
     cut: boolean;
     readonly partitions: Map<string, Record<string, unknown>>;
     readonly wards: Map<string, Booted>;
-    readonly objects: Map<object, unknown>;
+    readonly objects: WeakMap<object, unknown>;
     route(farPk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
     link(harbor: MemoryHarbor): void;
     boot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>): Promise<Booted>;

package/dist/harbor/memory.js

@@ -8,7 +8,7 @@ export class MemoryHarbor {
     cut = false;
     partitions = new Map(); // seed -> memory. the harbor keeps it and reads nothing
     wards = new Map(); // seed -> pointers
-    objects = new Map(); // cells -> being object. what instantiate constructed. a hand for tests, never the ward's
+    objects = new WeakMap(); // cells -> being object. what instantiate constructed. a hand for tests, never the ward's; it follows the cells out when she is unbooted
     // the directory: its own doors, else a peer it is linked to. Quo says nothing about how.
     async route(farPk, bytes) {
         if (this.down.has(farPk))
@@ -43,7 +43,8 @@ export class MemoryHarbor {
             seed,
             memory,
             instantiate: (name, stance) => {
-                const C = classes[name];
+                // Own keys only: `constructor` is a name Object lends every registry.
+                const C = Object.hasOwn(classes, name) ? classes[name] : undefined;
                 if (!C)
                     return null;
                 const obj = new C(stance);

package/dist/harbor/reach.js

@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 // Reach: carrying bytes to a pk off the device. One interface, two
-// implementations, as quo-harbor.md names them:
+// implementations:
 //
-//   request   a URL, the quo. route of a world. POST the bytes to
-//             `<url>/<pk>`, get bytes back. Listener to listener.
+//   request   a URL. POST the bytes to `<url>/<pk>`, get bytes back.
+//             Listener to listener.
 //   socket    a held WebSocket at `<url>`, opened by whichever side can
 //             dial, used in both directions with a frame id. Each side
 //             announces the ward pks it holds when the socket opens, and the
@@ -34,8 +34,12 @@ export function request(url) {
             catch {
                 return undefined; // the connection never opened: nothing was delivered
             }
-            if (res.status === 404)
-                return undefined; // the listener holds no reach for that pk
+            // A status that says the listener did not take the bytes is nothing
+            // delivered: no reach for that pk, a request it refused on its face, a
+            // gateway with nobody behind it. Any other failure is a listener that
+            // took them and failed after, which is sent and no word since.
+            if (res.status === 404 || (res.status >= 400 && res.status < 500) || res.status === 502 || res.status === 503 || res.status === 504)
+                return undefined;
             if (!res.ok)
                 return never();
             return new Uint8Array(await res.arrayBuffer());
@@ -68,6 +72,11 @@ export const SUITE = 1;
 // the refusal names itself on the way out, and the far side may read it.
 export const REFUSED = 4001;
 const OPEN = 1; // WebSocket.OPEN, on every terrain
+// How many asks a socket keeps a resolver for. An ask the far side never
+// answers is ended by the ward's bound, and its resolver stays until the
+// line closes; a far side that answers nothing for long enough would grow
+// the map for as long as this side asks, so the oldest goes when it is full.
+const PENDING = 4096;
 // One held socket, either side of it. `deliver` is what this side does with
 // an ask that arrives for a pk: its own door, or a socket it holds for that
 // pk, and nothing else. `onAnnounce` learns the far side's pks; `onClose`
@@ -81,7 +90,17 @@ export class Socket {
     constructor(line, deliver, onAnnounce, onClose) {
         this.line = line;
         line.binaryType = 'arraybuffer';
-        this.#open = line.readyState === OPEN ? Promise.resolve() : new Promise((ok, no) => (line.addEventListener('open', ok), line.addEventListener('error', no)));
+        // A line that opens is a reach; one that errors, or closes before it
+        // opened, is a reach that failed, and an ask waiting on the handshake is
+        // nothing delivered.
+        this.#open =
+            line.readyState === OPEN
+                ? Promise.resolve()
+                : new Promise((ok, no) => {
+                    line.addEventListener('open', ok);
+                    line.addEventListener('error', no);
+                    line.addEventListener('close', () => no(new Error('closed before it opened')));
+                });
         this.#open.catch(() => { }); // a handshake refused is a reach that failed, not a process that dies
         line.addEventListener('message', (e) => {
             if (typeof e.data === 'string') {
@@ -109,7 +128,11 @@ export class Socket {
             const kind = buf[0], id = new DataView(buf.buffer, buf.byteOffset, buf.byteLength).getUint32(1);
             if (kind === ASK) {
                 const pk = hex(buf.subarray(5, 69));
-                void deliver(pk, new Uint8Array(buf.subarray(69))).then((back) => {
+                // A deliver that rejects has delivered nothing this side can vouch
+                // for, and a listener does not die of it: the far side hears none.
+                void deliver(pk, new Uint8Array(buf.subarray(69)))
+                    .then((back) => back, () => undefined)
+                    .then((back) => {
                     const head = new Uint8Array(5);
                     head[0] = back === undefined ? NONE : REPLY;
                     new DataView(head.buffer).setUint32(1, id);
@@ -150,6 +173,8 @@ export class Socket {
         new DataView(head.buffer).setUint32(1, id);
         head.set(unhex(pk), 5);
         return new Promise((ok) => {
+            if (this.pending.size >= PENDING)
+                this.pending.delete(this.pending.keys().next().value); // the oldest, which the ward's bound ended long ago
             this.pending.set(id, ok);
             this.line.send(concat(head, bytes));
         });

package/dist/ward/allowance.js

@@ -5,7 +5,7 @@
 // is held to the ward's ceiling. The door reads it before anything is done
 // under it and refuses a budget already gone, as one silence like every other
 // refusal there. The sender bounds the whole of her ask to the same number,
-// and a wait that ran out is silence, never unreached.
+// and a wait that ran out is the word late, never silence and never unreached.
 //
 // Each ask is bounded on its own. The time an arriving call has left does not
 // bound the asks a being makes while answering it: attributing her onward ask
@@ -24,7 +24,13 @@ export const CEILING = { time: 300_000 };
 // is thirty seconds, silently, because the ceiling is not hers to know.
 // Asking for nothing at all is the default, which is the whole point.
 export function allow(wanted, ceiling = CEILING, base = DEFAULT) {
-    const whole = (n, fallback) => (typeof n === 'number' && Number.isFinite(n) && n > 0 ? Math.floor(n) : fallback);
+    // Floored first, then tested: a fraction of a millisecond is not a budget,
+    // and falls to the default like every other number that is not a positive
+    // whole one.
+    const whole = (n, fallback) => {
+        const w = typeof n === 'number' ? Math.floor(n) : NaN;
+        return Number.isFinite(w) && w > 0 ? w : fallback;
+    };
     return { time: Math.min(whole(wanted?.time, base.time), ceiling.time) };
 }
 // Whether a budget has anything left to spend. A door reads this on arrival.

package/dist/ward/arithmetic.js

@@ -8,7 +8,6 @@
 // runs on. `test/floor.test.ts` names the floor and probes for it. Subtle is
 // asynchronous, so everything here is.
 //
-// Ported from an earlier kit's arithmetic. Same bytes, same vectors.
 // `crypto.subtle` is read at every use and never captured at load. A browser
 // on a plain http:// origin has `crypto` without `subtle`, and a terrain may
 // install one after this module is first imported; a reference taken here
@@ -60,7 +59,12 @@ export function sameBytes(a, b) {
         diff |= a[at] ^ b[at];
     return diff === 0;
 }
-// The eight small-order points. A public key among them verifies nothing.
+// The eight small-order points of Ed25519, in their canonical encoding. A
+// public key among them verifies nothing. An encoding whose y coordinate is
+// not reduced, y at or above the field's prime p, names one of the same
+// points under another spelling, and a terrain's verify may accept a zero
+// signature under it; the field has room for the spelling, so it is refused
+// before the list is read.
 const SMALL_ORDER = [
     '0100000000000000000000000000000000000000000000000000000000000000',
     'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
@@ -71,7 +75,11 @@ const SMALL_ORDER = [
     '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85',
     'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',
 ].map(unhex);
-export const smallOrder = (pk) => SMALL_ORDER.some((p) => sameBytes(p, pk));
+// y >= p, read little-endian with the sign bit masked off: the top byte is
+// 0x7f under the mask, every middle byte is 0xff, and the low byte is at
+// least 0xed, which is p's.
+const unreduced = (pk) => (pk[31] & 0x7f) === 0x7f && pk[0] >= 0xed && pk.subarray(1, 31).every((b) => b === 0xff);
+export const smallOrder = (pk) => unreduced(pk) || SMALL_ORDER.some((p) => sameBytes(p, pk));
 const key32 = (value, what) => {
     if (!(value instanceof Uint8Array) || value.length !== KEY)
         throw new Error(`${what} is not a 32-byte key`);

package/dist/ward/cells.d.ts

@@ -1,3 +1,5 @@
 import type { Cells } from '../being/types.ts';
+export declare const DEPTH = 64;
 export declare const cellFault: (v: unknown, path: string) => string | null;
-export declare const guardCells: (cells: Cells) => Cells;
+export declare const guardCells: (cells: Cells, wrote?: () => void) => Cells;
+export declare const unguarded: (cells: Cells) => Cells;