nervur 0.18.0 → 0.19.0

package/dist/harbor/core.js

@@ -78,20 +78,19 @@ export class Harbor {
         for (const say of this.announcers)
             say();
     }
-    // What this device lends the beings of the wards it hosts, by name. One
-    // for the harbor, and `lendFor` says which ward may ask it: every ward,
-    // unless a terrain says a stranger's ward is lent nothing.
-    // Set at birth or once the harbor's own ward is standing, which is the
-    // usual order: a terrain puts that ward up first, then boots the rest on a
-    // ground that can reach it.
-    lend;
-    constructor(store, loader = async () => ({}), lend) {
+    // The box, as one invitation per ward: what this device hands a ward it
+    // boots so that the ward takes the box's being as a standing. Set once
+    // the harbor's own ward is standing, which is the usual order: a terrain
+    // puts that ward up first, then boots the rest on a ground that can reach
+    // it. A terrain says which ward is handed one by overriding `boxFor`, and
+    // a stranger's ward is handed none.
+    offering;
+    constructor(store, loader = async () => ({})) {
         this.store = store;
         this.loader = loader;
-        this.lend = lend;
     }
-    lendFor(_name, _record) {
-        return this.lend;
+    boxFor(name, _record) {
+        return this.offering?.(name) ?? Promise.resolve(undefined);
     }
     // Boot every ward the store keeps, and learn the hints. One ward that will
     // not host, a partition this kit cannot read or a loader that throws, is
@@ -498,73 +497,75 @@ export class Harbor {
         const objects = new WeakMap(); // cells -> the object instantiate made. a side's hand, never the ward's; it follows the cells out when she is unbooted
         const ground = {
             seed,
-            memory,
             // This ward's own classes first, then the harbor's: a ward that names a
             // class of its own is answered with hers.
             instantiate: maker(objects, classes, this.classes),
             carry: (pk, bytes) => this.carry(pk, new Uint8Array(bytes)),
             random,
-            wrote: (row) => this.#wrote(name, row),
-            // What the ward wrote is in the store when this resolves, and it says
-            // whether the store took it. The ward calls it at the end of every
-            // arrival, before it seals, so a call through a pointer has already
-            // waited for the store when it comes back: a restart right after one
-            // finds everything, and a refusal is that arrival's own answer rather
-            // than a number counted behind it. A ward that wrote nothing has
-            // nothing to save, so asking it what it holds is free, which is what
-            // makes the ask pointer the way to find out rather than an expensive
-            // one.
-            //
-            // A ward on its way out keeps nothing and refuses nothing: an arrival
-            // racing an unhost is not a store saying no, and saying so would be a
-            // lie in the one direction that matters.
-            keep: async () => {
-                const s = this.#saving.get(name);
-                if (!s || s.gone)
-                    return true;
-                const ok = await this.#flush(name);
-                // A refusal is heard once, by the first arrival to ask after it: the
-                // save that met it may have been a timer's, which had nobody to tell.
-                // Under a call it is left standing, so the call that carried the
-                // refused write is refused too, and the outermost arrival hears it.
-                const no = !ok || s.fault;
-                s.fault = false; // heard. the next arrival is answered by the store and not by what happened before it
-                return !no;
-            },
-            // The ward says a call is in flight, and says when it ends. The harbor
-            // goes on writing under it; what it does not do is take a save made
-            // there as the point a refused ward is put back to, and a refusal that
-            // lands under a call waits here for the call to end before it puts the
-            // ward back. The ward is the one that knows, because a being reaching
-            // another being of her own ward goes to that ward's door directly and
-            // the harbor never sees that call at all.
-            calling: () => {
-                const s = this.#saving.get(name);
-                if (!s)
-                    return () => { };
-                s.calls += 1;
-                let lowered = false;
-                return () => {
-                    if (lowered)
-                        return;
-                    lowered = true;
-                    s.calls -= 1;
-                    if (s.calls > 0 || s.gone)
-                        return;
-                    // The moment the ward is whole again: the point catches up with the
-                    // call that just ended, or a put back that was owed is done now, so
-                    // a being stands at what is kept before her next word rather than
-                    // at the next save.
-                    if (s.back)
-                        void this.#flush(name);
-                    else
-                        this.#settle(name, s);
-                };
+            memory: {
+                rows: memory,
+                told: (row) => this.#wrote(name, row),
+                // What the ward wrote is in the store when this resolves, and it says
+                // whether the store took it. The ward calls it at the end of every
+                // arrival, before it seals, so a call through a pointer has already
+                // waited for the store when it comes back: a restart right after one
+                // finds everything, and a refusal is that arrival's own answer rather
+                // than a number counted behind it. A ward that wrote nothing has
+                // nothing to save, so asking it what it holds is free, which is what
+                // makes the ask pointer the way to find out rather than an expensive
+                // one.
+                //
+                // A ward on its way out keeps nothing and refuses nothing: an arrival
+                // racing an unhost is not a store saying no, and saying so would be a
+                // lie in the one direction that matters.
+                kept: async () => {
+                    const s = this.#saving.get(name);
+                    if (!s || s.gone)
+                        return true;
+                    const ok = await this.#flush(name);
+                    // A refusal is heard once, by the first arrival to ask after it: the
+                    // save that met it may have been a timer's, which had nobody to tell.
+                    // Under a call it is left standing, so the call that carried the
+                    // refused write is refused too, and the outermost arrival hears it.
+                    const no = !ok || s.fault;
+                    s.fault = false; // heard. the next arrival is answered by the store and not by what happened before it
+                    return !no;
+                },
+                // The ward says a call is in flight, and says when it ends. The harbor
+                // goes on writing under it; what it does not do is take a save made
+                // there as the point a refused ward is put back to, and a refusal that
+                // lands under a call waits here for the call to end before it puts the
+                // ward back. The ward is the one that knows, because a being reaching
+                // another being of her own ward goes to that ward's door directly and
+                // the harbor never sees that call at all.
+                during: () => {
+                    const s = this.#saving.get(name);
+                    if (!s)
+                        return () => { };
+                    s.calls += 1;
+                    let lowered = false;
+                    return () => {
+                        if (lowered)
+                            return;
+                        lowered = true;
+                        s.calls -= 1;
+                        if (s.calls > 0 || s.gone)
+                            return;
+                        // The moment the ward is whole again: the point catches up with the
+                        // call that just ended, or a put back that was owed is done now, so
+                        // a being stands at what is kept before her next word rather than
+                        // at the next save.
+                        if (s.back)
+                            void this.#flush(name);
+                        else
+                            this.#settle(name, s);
+                    };
+                },
             },
         };
-        const lend = this.lendFor(name, kept.record);
-        if (lend)
-            ground.lend = lend;
+        const box = await this.boxFor(name, kept.record);
+        if (box)
+            ground.box = box;
         // What the store holds for this ward at birth is what it was just handed
         // or just read, row by row. It is copied once here so that a being whose
         // very first write of this run is refused is put back too, rather than
@@ -593,7 +594,7 @@ export class Harbor {
         // here. It answers nothing, because a caller inside the process reads
         // the fault off the harbor and an arrival is the only thing that needs a
         // verdict of its own.
-        const save = async () => void (await ground.keep?.());
+        const save = async () => void (await ground.memory.kept());
         const door = (bytes) => w.door(bytes);
         const ask = async (method, args) => {
             if (saving.gone)

package/dist/harbor/index.d.ts

@@ -4,5 +4,7 @@ export { dial, type Dialer } from './dial.ts';
 export { MemoryStore, values, rowsOf, type Store, type Kept, type WardRecord } from './store.ts';
 export { HEAD, fromRows, rowsIn } from '../ward/partition.ts';
 export { request, Socket, SUITE, REFUSED, type Reach, type Carry, type Line, type Announce } from './reach.ts';
-export type { Ground, WardPointers, Lend } from '../ward/ground.ts';
+export type { Ground, WardPointers, Memory } from '../ward/ground.ts';
+export { BOX, OFFER, RETRACT, volatile } from '../ward/ground.ts';
+export { Box, BOX_SEED, BOX_ASKS, stand, hold, offerTo, roll } from './box.ts';
 export { maker, entropy, learnPk } from '../ward/ground.ts';

package/dist/harbor/index.js

@@ -11,6 +11,9 @@ export { MemoryStore, values, rowsOf } from './store.js';
 // a being, and the partition back from the rows it was cut into.
 export { HEAD, fromRows, rowsIn } from '../ward/partition.js';
 export { request, Socket, SUITE, REFUSED } from './reach.js';
+export { BOX, OFFER, RETRACT, volatile } from '../ward/ground.js';
+// The box as one being, and the acts a harbor runs to stand it.
+export { Box, BOX_SEED, BOX_ASKS, stand, hold, offerTo, roll } from './box.js';
 // What a harbor builds a ground out of. Convenience, never contract: a kit
 // writing its own harbor may write these three again.
 export { maker, entropy, learnPk } from '../ward/ground.js';

package/dist/harbor/memory.d.ts

@@ -1,5 +1,5 @@
-import type { BeingClass, BeingLike } from '../being/types.ts';
-import { type Ground, type WardPointers, type Lend } from '../ward/ground.ts';
+import type { BeingClass, BeingLike, Invitation } from '../being/types.ts';
+import { type Ground, type WardPointers } from '../ward/ground.ts';
 export type Booted = WardPointers & {
     pk: string;
 };
@@ -20,6 +20,10 @@ export declare class MemoryHarbor {
     random: Ground['random'];
     route(farPk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
     link(harbor: MemoryHarbor): void;
-    boot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, lend?: Lend): Promise<Booted>;
-    reboot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, lend?: Lend): Promise<Booted>;
+    boot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, box?: Invitation): Promise<Booted>;
+    reboot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, box?: Invitation): Promise<Booted>;
+    up(Ward: WardFactory, lent?: Record<string, BeingClass>): Promise<Booted>;
+    get box(): Booted | undefined;
+    host(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>): Promise<Booted>;
+    hosted(Ward: WardFactory, classes: Record<string, BeingClass>): Promise<string[]>;
 }

package/dist/harbor/memory.js

@@ -1,5 +1,6 @@
-import { maker, entropy, learnPk } from '../ward/ground.js';
+import { maker, entropy, learnPk, volatile } from '../ward/ground.js';
 import { hex } from '../ward/arithmetic.js';
+import { Box, BOX_SEED, stand, offerTo, roll } from './box.js';
 export class MemoryHarbor {
     doors = new Map(); // ward pk -> door
     down = new Set(); // ward pks this harbor cannot reach right now
@@ -36,22 +37,22 @@ export class MemoryHarbor {
         this.peers.add(harbor);
         harbor.peers.add(this);
     }
-    // boot by seed. the harbor gets a door and an ask, and learns the pk by asking.
-    // `lend` is what this device lends the ward's beings, and a test's stand-in
-    // for a real terrain's: left out, every name answers null.
-    async boot(seed, Ward, classes, lend) {
+    // boot by seed. the harbor gets a door and an ask, and learns the pk by
+    // asking. `box` is the invitation on this device's box being, for this
+    // ward: left out, the ward holds no box and every lend is null.
+    async boot(seed, Ward, classes, box) {
         this.partitions.set(seed, {});
-        return this.reboot(seed, Ward, classes, lend);
+        return this.reboot(seed, Ward, classes, box);
     }
     // a restart: same seed, same partition, fresh ward. the ward's files are the harbor's to keep.
-    async reboot(seed, Ward, classes, lend) {
-        const memory = this.partitions.get(seed);
-        if (!memory)
+    async reboot(seed, Ward, classes, box) {
+        const rows = this.partitions.get(seed);
+        if (!rows)
             throw new Error(`no partition for ${seed}`);
         const ground = {
             seed,
-            memory,
-            ...(lend ? { lend } : {}),
+            memory: volatile(rows),
+            ...(box ? { box } : {}),
             // One objects map for the whole harbor, not one per ward: every ward
             // here is in this process and a test reaches any being of any of them.
             instantiate: maker(this.objects, classes),
@@ -69,4 +70,35 @@ export class MemoryHarbor {
         this.wards.set(seed, booted);
         return booted;
     }
+    // Act one. The box's own ward, the box's being and the lent beings named,
+    // each booted under its name and held by her under it. Run again on a
+    // harbor whose box ward stands, it changes nothing.
+    async up(Ward, lent = {}) {
+        const classes = { Box };
+        for (const C of Object.values(lent))
+            classes[C.name] = C;
+        const box = this.wards.get(BOX_SEED) ?? (await this.boot(BOX_SEED, Ward, classes));
+        await stand(box, lent);
+        return box;
+    }
+    get box() {
+        return this.wards.get(BOX_SEED);
+    }
+    // Act two, one ward: on the roll and handed one invitation on the box's being.
+    // A harbor with no box ward up hosts as `boot` does, with nothing.
+    async host(seed, Ward, classes) {
+        const box = this.box;
+        const inv = box ? await offerTo(box, seed) : undefined;
+        return this.partitions.has(seed) ? this.reboot(seed, Ward, classes, inv) : this.boot(seed, Ward, classes, inv);
+    }
+    // Act two, whole: the box's being says who is hosted, and each comes up.
+    async hosted(Ward, classes) {
+        const box = this.box;
+        if (!box)
+            return [];
+        const seeds = await roll(box);
+        for (const seed of seeds)
+            await this.host(seed, Ward, classes);
+        return seeds;
+    }
 }

package/dist/harbor/store.js

@@ -18,7 +18,7 @@ export const values = (p) => JSON.parse(JSON.stringify(p));
 // is the store dropping what it holds for her.
 export const rowsOf = (partition, rows) => rows.map((row) => {
     const value = rowOf(partition, row);
-    return [row, value === undefined ? undefined : values(value)];
+    return [row, value === undefined ? undefined : (values(value))];
 });
 // One store's copy, brought up to date with the rows it was told about.
 const keep = (row, partition, rows) => {

package/dist/vector/cases.d.ts

@@ -1,4 +1,4 @@
-import type { Json } from '../being/types.ts';
+import type { Json, JsonObject } from '../being/types.ts';
 import type { Booted } from '../harbor/memory.ts';
 import type { World, Sealed } from './world.ts';
 export type DoorRecord = {
@@ -11,8 +11,8 @@ export type DoorRecord = {
     ask: string;
     reply: string;
     opens: Json | null;
-    before: string;
-    after: string;
+    draws: number;
+    blueprint?: JsonObject;
     wrote: boolean;
 };
 export type Pin = () => Promise<void>;
@@ -34,6 +34,7 @@ export type Case = {
 export declare function stand(c: Case): Promise<{
     w: World;
     before: string;
+    draws: number;
     arrival: Arrival;
 }>;
 export declare function doorCases(): Promise<DoorRecord[]>;

package/dist/vector/cases.js

@@ -18,7 +18,8 @@
 import { Ward } from '../ward/ward.js';
 import * as seal from '../ward/seal.js';
 import { hex } from '../ward/arithmetic.js';
-import { world, sealed, bound, secret, rnd, partitionDigest, Caller } from './world.js';
+import { digest } from '../being/digest.js';
+import { world, sealed, bound, secret, rnd, drawn, partitionDigest, Caller } from './world.js';
 // Stand one case: its world, its setup, its ask. What comes back is enough
 // to knock, and enough for a verifier to check the hand before the door.
 export async function stand(c) {
@@ -27,14 +28,36 @@ export async function stand(c) {
     const arrival = await c.arrive(w, async () => {
         before = await partitionDigest(w.b, c.ward);
     });
-    return { w, before, arrival };
+    // Where the stream stands now, which is where the door is about to draw
+    // from. A kit that stood this case its own way sets its stream here.
+    return { w, before, draws: drawn(), arrival };
+}
+// The blueprint a reply's `seen` was taken over. The host is the only being
+// in this world whose shape reaches a stranger, and the asker is the id her
+// heir was opened for, so there is one blueprint to find and it is checked
+// against the digest before it is written down.
+async function shown(w, seen) {
+    for (const id of Object.keys(w.host.cells.occupants)) {
+        const bp = w.host.describe({ id });
+        if ((await digest(bp)) === seen)
+            return bp;
+    }
+    return undefined;
 }
 async function record(c) {
-    const { w, before, arrival } = await stand(c);
+    const { w, before, draws, arrival } = await stand(c);
     const judged = await arrival.door.door(arrival.ask.bytes);
     const after = await partitionDigest(w.b, c.ward);
     const opens = arrival.ask.open ? (await arrival.ask.open(judged.bytes)) : null;
-    return { case: c.case, name: c.name, state: c.state, ward: c.ward, kind: arrival.kind, heard: judged.heard, ask: hex(arrival.ask.bytes), reply: hex(judged.bytes), opens, before, after, wrote: before !== after };
+    // A reply that carries `seen` carries a being's shape on the wire, which is
+    // the one place in this corpus where what a being answers reaches a
+    // stranger. So the blueprint that digest is taken over is written down
+    // beside it: a kit stands a being that answers exactly this to the empty
+    // ask, and its door's bytes are these bytes. Every other record is the
+    // door alone and needs no being at all.
+    const seen = opens !== null && typeof opens === 'object' && !Array.isArray(opens) ? (opens).seen : undefined;
+    const blueprint = typeof seen === 'string' ? await shown(w, seen) : undefined;
+    return { case: c.case, name: c.name, state: c.state, ward: c.ward, kind: arrival.kind, heard: judged.heard, draws, ask: hex(arrival.ask.bytes), reply: hex(judged.bytes), opens, ...(blueprint ? { blueprint } : {}), wrote: before !== after };
 }
 // One after another and never at once: the cases share one stream, and two
 // of them in flight together would draw from it in whatever order the
@@ -108,10 +131,15 @@ export const cases = [
         name: 'she is not there',
         state: 'the ward restarted without her class: her heirs stand and she does not',
         ward: 'B',
+        // Under the key she bound: the heir was spent by her knock and admits
+        // nothing now, so an arrival signed with its secret would be D6 and not
+        // this case. Her own key is what the door holds for her, and it is the
+        // key that hears the word.
         arrive: async (w, pin) => {
+            const b = await bound(w);
             const WB = await w.b.reboot('B', Ward, { Caller });
             await pin();
-            return at(WB, w.inv.heir, 'word', { signer: secret(w.inv), next: 'a'.repeat(64) });
+            return at(WB, b.inv.heir, 'word', { signer: b.own });
         },
     },
     {

package/dist/vector/world.d.ts

@@ -5,6 +5,7 @@ import { Being } from '../being/being.ts';
 import type { Answer, Asker, BeingClass, Blueprint, Invitation, JsonObject, Reply, Wanted } from '../being/types.ts';
 export declare function splitmix64(seed: bigint): () => Uint8Array;
 export declare const STREAM_SEED = 20250901n;
+export declare const drawn: () => number;
 export declare const rnd: (n?: number) => Uint8Array;
 export declare const must: (ok: boolean, what: string) => void;
 export declare const P: (h: MemoryHarbor, seed: string) => Partition;

package/dist/vector/world.js

@@ -8,7 +8,7 @@
 // Nothing here draws from the device. A door's reply is sealed under a fresh
 // ephemeral key and a fresh nonce, so the bytes are fixed only where the
 // entropy is, and every draw in this file comes from one written-down stream.
-// That is what lets `protocol/vectors/door.json` be a corpus and not a
+// That is what lets `quo/vectors/door.json` be a corpus and not a
 // sample, and what lets a kit stand in vector mode for a verifier that holds
 // no key: the spec's chapter of that name is the contract this file keeps.
 import { MemoryHarbor } from '../harbor/memory.js';
@@ -20,10 +20,10 @@ import { silence, unreached, isSilence, isUnreached, told } from '../being/silen
 import { digest } from '../being/digest.js';
 // ---- the stream
 //
-// SplitMix64. Sixteen lines a kit in any language writes from this comment
-// alone: the state starts at the seed, every draw adds the golden gamma
-// 0x9e3779b97f4a7c15, mixes with two xor-shift-multiplies, and the sixty-four
-// bit result is spent eight bytes at a time, least significant first. It is
+// SplitMix64, written out in the spec's vector-mode chapter with both
+// multipliers and all three shifts, because a kit that reproduces it by
+// recognising it is a kit that guessed. This is that, and it moves only
+// when that does. It is
 // not a cipher and is not meant to be one. Its whole job is that the bytes
 // this file produces are the same bytes twice.
 const GAMMA = 0x9e3779b97f4a7c15n;
@@ -46,13 +46,23 @@ export function splitmix64(seed) {
 // stream to when it reproduces `door.json`.
 export const STREAM_SEED = 20250901n;
 let draw = splitmix64(STREAM_SEED);
+// How many sixty-four bit words have been spent since the stream was reset.
+// A record carries this number at the moment of its arrival, so a kit that
+// built the door's state its own way sets its stream here and draws what
+// this one would have drawn. It is the whole of what the setup's history is
+// worth to a stranger: not how the world was made, but where the stream
+// stands when the door is about to answer.
+let spent = 0;
+export const drawn = () => spent;
 // Entropy, from the stream and never from the device. Every signer secret,
 // every ephemeral seed, every byte of noise and every key a ward in this
 // world mints comes through here, in the order the code asks for it.
 export const rnd = (n = 32) => {
     const out = new Uint8Array(n);
-    for (let i = 0; i < n; i += 8)
+    for (let i = 0; i < n; i += 8) {
         out.set(draw().subarray(0, Math.min(8, n - i)), i);
+        spent += 1;
+    }
     return out;
 };
 // A claim the world stands on. It throws, because a world that is not the
@@ -149,6 +159,7 @@ export const classes = { Host, Caller };
 let counted = 1000;
 export async function world() {
     draw = splitmix64(STREAM_SEED); // a fresh world is a fresh stream: two runs, one corpus
+    spent = 0;
     counted = 1000;
     const a = new MemoryHarbor(), b = new MemoryHarbor();
     a.random = rnd;

package/dist/ward/ground.d.ts

@@ -1,15 +1,21 @@
 import type { Stance, BeingLike, BeingClass, Invitation } from '../being/types.ts';
-export type Lend = (name: string, take: (invitation: Invitation) => Promise<boolean>) => Promise<boolean>;
+export type Memory = {
+    readonly rows: Record<string, unknown>;
+    told(row: string): void;
+    kept(): Promise<boolean>;
+    during(): () => void;
+};
+export declare const volatile: (rows?: Record<string, unknown>) => Memory;
+export { BOX } from '../being/lent.ts';
+export declare const OFFER = "offer";
+export declare const RETRACT = "retract";
 export type Ground = {
     seed: string | Uint8Array;
-    memory: Record<string, unknown>;
+    random(n: number): Uint8Array;
+    memory: Memory;
     instantiate(className: string, stance: Stance): BeingLike | null;
-    wrote?: (row: string) => void;
-    keep?: () => Promise<boolean>;
-    calling?: () => () => void;
     carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
-    random(n: number): Uint8Array;
-    lend?: Lend;
+    box?: Invitation;
 };
 export type WardPointers = {
     door(bytes: Uint8Array): Promise<{

package/dist/ward/ground.js

@@ -1,8 +1,30 @@
-// ---- what every harbor builds a ground out of. Three pieces, because every
-// harbor in this tree writes the same three and the protocol keeps the harbors
-// themselves apart: what a memory harbor and a real one differ on is the
-// route and the store, and nothing here. A second kit writes its own harbor
-// and may write these again; they are convenience, never contract.
+// The body that keeps nothing: the process is the memory.
+export const volatile = (rows = {}) => ({ rows, told: () => { }, kept: () => Promise.resolve(true), during: () => () => { } });
+// The device is one standing. What a box can do is beings, in a ward its
+// harbor booted and roots, and one being there, the box's own, holds a
+// standing at each of them under the name it is lent as. The ground carries
+// one invitation on her, minted for this ward alone; the ward takes it at
+// boot under `BOX`, as its own first being, and from then on the device is
+// reached the way anything is reached: what it offers is her describe, and a
+// lend is the ask `OFFER` on that standing, naming what a being wants.
+//
+// She answers the lent being's own invitation, minted by that being on herself,
+// and the ward knocks and takes it in the being's name. No root mints for a
+// lend, and the invitation never reaches the being: it is the device's, a
+// value she could copy is one she could hand to anyone, so the ward holds
+// it and hands her the id. Which ward may have which name is the box's own
+// gate, reading who asks, and a stranger's ward holds no standing at her.
+//
+// A harbor with no box leaves it out, and every lend is null. A ward that
+// could not take it at boot, the box down or the invitation spent, boots all
+// the same, lends nothing this run, and tries again at the next.
+export { BOX } from '../being/lent.js';
+export const OFFER = 'offer';
+// A lend that was offered and not taken leaves nothing: the ward says so to
+// the box, naming the heir, and the lent being removes what she minted.
+export const RETRACT = 'retract';
+// ---- what every harbor builds a ground out of. Convenience, never contract:
+// a second kit writes its own harbor and may write these again.
 // The code half of a ground, and the map back to what it made. A class is
 // found by own key only, since `constructor` is a name Object lends every
 // registry, and the first registry holding the name wins, so a ward's own
@@ -18,17 +40,13 @@ export const maker = (objects, ...registries) => (className, stance) => {
     objects.set(stance.cells, obj);
     return obj;
 };
-// Entropy, from the one place every terrain that runs Quo has it. Every key a
-// ward mints is drawn from this, so a harbor that wants another source hands
-// its own and nothing here has to know.
+// Entropy, from the one place every terrain that runs Quo has it.
 export const entropy = (n) => globalThis.crypto.getRandomValues(new Uint8Array(n));
 // A ward's pk, learned the way anyone learns anything: by asking. The empty
 // ask on the ask pointer is the ward's own describe and its notes carry the
 // pk. A harbor has no other way to it and wants none: the ward mints it from
 // the seed, and a harbor that read it off the seed itself would be a second
-// derivation to keep in step with the first. A ward that answers anything
-// else is not one this harbor can route to, and says so here rather than
-// leaving an undefined pk in a directory.
+// derivation to keep in step with the first.
 export async function learnPk(w) {
     const notes = (await w.ask());
     const pk = notes?.notes?.pk;

package/dist/ward/heirs.js

@@ -1,6 +1,8 @@
 import { GONE } from './partition.js';
-// How wide the span is, is the ward's own — wider is more forgiving of a
-// rough road, and no peer can tell the difference except by being refused.
+// How wide the span is, is the spec's and never a ward's. Wider is more
+// forgiving of a rough road, and that is exactly why it is not a ward's to
+// choose: a peer tells two doors apart by being refused at one and answered
+// at the other, which is one relation dying over one number.
 const SPAN = 64;
 export class Heirs {
     #p;

package/dist/ward/index.d.ts

@@ -1,5 +1,6 @@
 export { Ward } from './ward.ts';
-export type { Ground, WardPointers, Lend } from './ground.ts';
+export type { Ground, WardPointers, Memory } from './ground.ts';
+export { BOX, OFFER, RETRACT, volatile } from './ground.ts';
 export type { Partition, Heir, Bind, StandingKeys } from './partition.ts';
 export { GONE, MINTED, KNOCKS } from './partition.ts';
 export type { AskPayload, ReplyPayload } from './seal.ts';

package/dist/ward/index.js

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // nervur/ward — one function. Every ward is the same ward.
 export { Ward } from './ward.js';
+export { BOX, OFFER, RETRACT, volatile } from './ground.js';
 // The three bounds on what a partition may hold, for a kit that must keep
 // the same ones and for a test that pins them.
 export { GONE, MINTED, KNOCKS } from './partition.js';

package/dist/ward/partition.js

@@ -250,7 +250,7 @@ export const restoreRow = (p, row, value) => {
         drop(p.beings ?? {}, row);
         // Her bind goes with her: a being the store never kept has no relation
         // anybody is standing on, so there is nothing to leave forward.
-        drop((p.bind ?? {}), row);
+        drop(p.bind ?? {}, row);
         return;
     }
     // Behind the guard and never through it: a being's cells in a partition
@@ -267,7 +267,7 @@ export const restoreRow = (p, row, value) => {
         for (const [k, v] of Object.entries(kept))
             put(held, k, v);
     };
-    into((p.beings ?? {}), (value.cells ?? emptyCells()));
+    into(p.beings ?? {}, (value.cells ?? emptyCells()));
 };
 // The partition back from its rows. A head that is absent is a partition
 // nobody has written, and `open` makes an empty one of it.

package/dist/ward/seal.js

@@ -26,7 +26,7 @@ export const SIZE = 1024 * 1024;
 // designs and no separation at all: one secret would be doing two jobs with
 // nothing said about it, and a second kit would have to reproduce a
 // construction nobody named. HKDF-SHA-256 under a label is the separation
-// said out loud, and it is what `protocol/vectors/framing.json` pins.
+// said out loud, and it is what `quo/vectors/framing.json` pins.
 //
 // Bytes are key material and text is not. A seed handed in as bytes of the
 // key length is taken as it stands, which is what a harbor mints; anything