nervur 0.18.0 → 0.19.0

package/dist/ward/stance.d.ts

@@ -17,9 +17,4 @@ export type Inside = {
     unmake(key: string): void;
     wrote(): void;
 };
-export type SealedInvitation = {
-    ward: string;
-    heir?: string;
-    secret?: string;
-};
 export declare function buildStance(inside: Inside, key: string, cells: Cells, bind: Bind): Stance;

package/dist/ward/ward.d.ts

@@ -1,5 +1,5 @@
 import type { Cells, Stance } from '../being/types.ts';
-import type { Ground, WardPointers } from './ground.ts';
+import { type Ground, type WardPointers } from './ground.ts';
 import { type Bind } from './partition.ts';
 import { type Door } from './door.ts';
 export type Resident = Door & {

package/dist/ward/ward.js

@@ -5,7 +5,8 @@
 // a stance built by the same code. Mints every key, seals every ask that
 // leaves, opens every one that arrives.
 import { silence, isSilence, unreached, isWord, word } from '../being/silence.js';
-import { OWNER } from '../being/types.js';
+import { OWNER, isInvitation } from '../being/types.js';
+import { BOX, OFFER, RETRACT } from './ground.js';
 import { at, drop, open, put, emptyBind, emptyCells, HEAD, MINTED } from './partition.js';
 import { Heirs } from './heirs.js';
 import { makeDoor } from './door.js';
@@ -30,14 +31,50 @@ class Self {
     #birthing = new Set(); // keys whose constructor is running: taken, though no door and no row say so yet
     door;
     ask;
+    // Birth, in order: the ward as its own first being, the box taken, and
+    // only then every being the partition names constructed again. A being
+    // who takes what her box lends does it at her birth, so the box must be
+    // hers to ask before she is born, or a restart would be the one birth at
+    // which the device lends nothing.
     static async boot(ground) {
-        return new Self(ground, await wardKey(ground.seed));
+        const w = new Self(ground, await wardKey(ground.seed));
+        await w.#takeBox();
+        w.#reborn();
+        return w;
+    }
+    // The device, taken as one standing under `BOX` by the ward's own being,
+    // once: a ward woken from its partition already holds it. A knock that is
+    // not answered leaves the ward up and lending nothing this run.
+    async #takeBox() {
+        const inv = this.g.box;
+        const mine = this.doors.get(this.pk)?.stance;
+        if (!inv || !mine || mine.standings[BOX])
+            return;
+        const out = await mine.standings.knock(inv);
+        if (isSilence(out) || isWord(out))
+            return;
+        await mine.standings.take(BOX, inv);
+    }
+    // What this device lends this ward's beings: the box's being, asked to
+    // offer a name, answers the lent being's own invitation, and the taker knocks
+    // and takes it. The ward reads nothing in the value but that it is one.
+    async #lend(name, take) {
+        const box = this.doors.get(this.pk)?.stance.standings[BOX];
+        if (!box)
+            return false;
+        const inv = await box.ask(OFFER, { name });
+        if (!isInvitation(inv))
+            return false;
+        const took = await take(inv);
+        if (!took)
+            await box.ask(RETRACT, { name, heir: inv.heir ?? null });
+        return took;
     }
     constructor(ground, key) {
         this.g = ground;
         this.key = key;
         this.pk = key.pk;
-        this.p = open(ground.memory); // the partition: the ward's own state, and every being's row
+        this.p = open(ground.memory.rows); // the partition: the ward's own state, and every being's row
         // Opening is itself a write: a memory nobody has written comes back with
         // a version stamped on it and the ward's own tables under it. A ward that
         // said nothing here would have every being of it kept and the head that
@@ -47,6 +84,24 @@ class Self {
         this.heirs = new Heirs(this.p, () => this.#wrote(HEAD));
         this.door = makeDoor(key, this.heirs, this.doors, () => this.p.public, (n) => ground.random(n), () => this.#keep()); // pointer one
         this.#boot(this.pk, () => this); // the ward's ward is itself
+        // pointer two. the owner. the same answer every named asker gets, asker filled in as owner.
+        this.ask = async (method, args = {}) => {
+            try {
+                const out = await this.answer({ id: OWNER }, method, args);
+                // The same question the door asks, in the same place: after she has
+                // answered and before the owner holds the answer. Silence is what a
+                // failed ask says here, so a store that refused is silence, and the
+                // owner reads it as it reads every other ask that did not take.
+                if (!(await this.#keep().catch(() => false)))
+                    return silence;
+                return isSilence(out) || isWord(out) ? silence : out;
+            }
+            catch {
+                return silence;
+            }
+        };
+    }
+    #reborn() {
         // a restart is silent: every being in the cells is constructed again, unasked.
         // A throw on a boot the owner asked for is that boot's error, and nothing
         // half-lives. This boot nobody asked for, and there is nobody to hand an
@@ -68,22 +123,6 @@ class Self {
                 /* she is not here this run. the ward is, and so is everyone else. */
             }
         }
-        // pointer two. the owner. the same answer every named asker gets, asker filled in as owner.
-        this.ask = async (method, args = {}) => {
-            try {
-                const out = await this.answer({ id: OWNER }, method, args);
-                // The same question the door asks, in the same place: after she has
-                // answered and before the owner holds the answer. Silence is what a
-                // failed ask says here, so a store that refused is silence, and the
-                // owner reads it as it reads every other ask that did not take.
-                if (!(await this.#keep().catch(() => false)))
-                    return silence;
-                return isSilence(out) || isWord(out) ? silence : out;
-            }
-            catch {
-                return silence;
-            }
-        };
     }
     // ---- the ward as a being. asked only by its owners: the root, through
     // the ask pointer, and its occupants, through the door, whom only the root
@@ -116,14 +155,14 @@ class Self {
     // because a harbor told only that something moved must keep all of it, and
     // a being's row is the one part of a partition that grows without limit.
     #wrote(row) {
-        this.g.wrote?.(row);
+        this.g.memory.told(row);
     }
     // Whether what was written is kept, asked once at the end of an arrival
     // and never during one. A harbor that keeps nothing was never going to
     // refuse anything, so its silence here is yes: a ward driven with no store
     // under it answers exactly as it did before a harbor could say no.
     async #keep() {
-        return this.g.keep ? await this.g.keep() : true;
+        return this.g.memory.kept();
     }
     // The rows no door holds this run: beings whose class threw at birth or
     // is not the harbor's to give. Key to class.
@@ -233,11 +272,7 @@ class Self {
             // never came about takes her out again.
             relate: async (k, id) => (await this.doors.get(k)?.stance.occupants.invite(id)) ?? null,
             unmake: (k) => void this.#unboot(k),
-            // What this device lends this ward's beings. The ward knocks and takes
-            // inside the harbor's own call and reads nothing in the value: which
-            // names there are, which ward may ask for one, and what becomes of one
-            // she did not take, is the harbor's and no word of the ward.
-            lend: async (name, take) => (await this.g.lend?.(name, take)) ?? false,
+            lend: (name, take) => this.#lend(name, take),
             wrote: () => this.#wrote(key),
         }, key, cells, bind);
         const being = make(stance);
@@ -274,7 +309,7 @@ class Self {
         // the reply opens, and whatever the being writes on either side of her
         // own ask. A harbor may write those rows down; what it may not do is put
         // the ward back to them.
-        const lower = this.g.calling?.();
+        const lower = this.g.memory.during();
         try {
             return await this.#sent(bind, keys, method, args, wanted, row);
         }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nervur",
-  "version": "0.18.0",
-  "description": "Nervur's kit of Quo: an object asks another object and gets an answer, without knowing where it is. Being, Ward, Harbor, with the spec inside.",
+  "version": "0.19.0",
+  "description": "Nervur's kit of Quo: an object asks another object and gets an answer, without knowing where it is. Being, Ward, Harbor.",
   "keywords": [
     "quo",
     "protocol",
@@ -43,9 +43,11 @@
   },
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
-    "check": "node --test \"test/*.test.ts\"",
-    "deep": "node --test \"test/terrain/*.test.ts\"",
-    "prepublishOnly": "test \"$NERVUR_GATED\" = 1 || { echo 'publish from the root, gated once: npm run release:nervur' >&2; exit 1; }"
+    "check": "node ../../test.mjs \"test/*.test.ts\"",
+    "experimental": "node ../../test.mjs \"experimental/*.test.ts\"",
+    "deep": "node --test --test-timeout=300000 \"test/terrain/*.test.ts\"",
+    "cover": "node --test --test-timeout=60000 --experimental-test-coverage --test-coverage-exclude=\"**/dist/**\" --test-coverage-exclude=\"**/test/**\" --test-coverage-lines=99 --test-coverage-branches=93 --test-coverage-functions=95 \"test/*.test.ts\"",
+    "prepublishOnly": "test \"$NERVUR_GATED\" = 1 || { echo 'a publish is /release, from the root, on the human'\"'\"'s word' >&2; exit 1; }"
   },
   "publishConfig": {
     "access": "public"

package/src/being/index.ts

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // nervur — the Being side. What a being author imports, if anything.
 export { Being, type AskSpec } from './being.ts';
+export { Lent, BOX, LENT_ASKS } from './lent.ts';
 export { silence, isSilence, answered, unreached, isUnreached, word, isWord, wordOf, told, DOOR_WORDS, isDoorWord } from './silence.ts';
 export { digest, canonical } from './digest.ts';
 export { OWNER, PUBLIC, RESERVED_IDS, isBlueprint, invitationArgs, isInvitation } from './types.ts';

package/src/being/lent.ts

@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: Apache-2.0
+// A lent being: a being of the box's own ward, standing for one thing the
+// device can do. What makes her one is two asks the box's being alone may
+// make, whom she knows as the occupant `box`. `offer`: she mints an
+// invitation on herself and answers it, so that a ward the box vouches for
+// may knock and take a standing at her. `retract`: an offer that was not
+// taken, named by its heir, is removed, so a refused lend leaves nothing.
+//
+// The two are the base's and never a subclass's to declare: a class says
+// her own asks and nothing of the seam she is lent through, so they are
+// answered here before her asks are read, and shown to the box alone. No
+// root mints for her, and nothing else about her is decided here.
+//
+// A convenience, not a contract: a being that answers the two the same way
+// to `box` is lendable, whatever she extends.
+import { Being } from './being.ts';
+import type { Asker, Blueprint, JsonObject, Reply } from './types.ts';
+
+// The one word for the box's being: her key in the box's ward, the id every
+// lent being knows her by, and the standing every hosted ward takes at
+// birth.
+export const BOX = 'box';
+
+export const LENT_ASKS = {
+  offer: { name: 'offer', description: 'an invitation on me, for a ward the box vouches for', input: { type: 'object' } },
+  retract: { name: 'retract', description: 'an offer that was not taken, by its heir', input: { type: 'object', properties: { heir: { type: 'string' } }, required: ['heir'] } },
+};
+
+export class Lent extends Being {
+  // The offers she has open, heir to the id she minted under.
+  #open(): Record<string, string> {
+    return ((this.cells.open as Record<string, string> | undefined) ??= {});
+  }
+
+  async offer(): Promise<JsonObject> {
+    const n = ((this.cells.lent as number | undefined) ?? 0) + 1;
+    this.cells.lent = n;
+    const id = `lent:${n}`;
+    const inv = await this.invite(id);
+    if (inv === null) return { error: 'could not mint' };
+    this.#open()[inv.heir!] = id;
+    return inv;
+  }
+
+  retract(args: JsonObject): JsonObject {
+    const open = this.#open();
+    const heir = typeof args.heir === 'string' ? args.heir : '';
+    const id = Object.hasOwn(open, heir) ? open[heir] : undefined;
+    if (id === undefined) return { retracted: null };
+    this.occupants.remove(id);
+    delete open[heir];
+    return { retracted: id };
+  }
+
+  override describe(asker: Asker): Blueprint {
+    const bp = super.describe(asker);
+    if (asker.id !== BOX) return bp;
+    return { ...bp, asks: [...bp.asks, LENT_ASKS.offer, LENT_ASKS.retract] };
+  }
+
+  override async answer(asker: Asker, method?: string, args: JsonObject = {}): Promise<Reply> {
+    if (asker.id === BOX && method === 'offer') return this.offer();
+    if (asker.id === BOX && method === 'retract') return this.retract(args);
+    return super.answer(asker, method, args);
+  }
+}

package/src/being/types.ts

@@ -43,7 +43,7 @@ export const invitationArgs = (inv: Invitation): JsonObject => ({
 
 // Whether a value that arrived is an invitation. The shape is the spec's, so
 // the reading of it is too, and it is one reading: a form that
-// asks a guest for one, a faculty handed one to wake her maker by, and a
+// asks a guest for one, a lent being handed one to wake her maker by, and a
 // shell that finds one in a link all ask the same question, and a kinder
 // answer in one of them is a value that fails at a door instead of at the
 // edge it came in by. A ward pk is a hundred and twenty-eight lowercase hex,

package/src/conformance/beings.ts

@@ -3,6 +3,7 @@
 // shop, a customer on the base class, a maker, a member, and one raw being
 // with no base at all.
 import { Being } from '../being/being.ts';
+import { Lent } from '../being/lent.ts';
 import { answered, isSilence, isUnreached, isWord, wordOf } from '../being/silence.ts';
 import { invitationArgs } from '../being/types.ts';
 import type { Ask, Asker, Blueprint, Invitation, Json, JsonObject, OccupantRecord, Reply, Stance } from '../being/types.ts';
@@ -156,9 +157,13 @@ export class Maker extends Being {
   }
 }
 
-export class Member extends Being {
-  static override cells = { heard: [] as JsonObject[] };
+// A member is also lendable: lent by a box that stands her in its own ward,
+// she offers an invitation on herself when the box's being asks, and is an
+// ordinary being to everyone else.
+export class Member extends Lent {
+  static override cells = { ...Lent.cells, heard: [] as JsonObject[] };
   static override asks = {
+    ...Lent.asks,
     ping: { input: { type: 'object' } },
     relay: { input: { type: 'object', properties: { id: { type: 'string' }, method: { type: 'string' }, time: { type: 'number' } }, required: ['id'] } },
   };
@@ -178,6 +183,6 @@ export class Member extends Being {
     const out = await standing.ask(method as string | undefined, (args ?? {}) as JsonObject, time === undefined ? undefined : { time: time as number });
     if (isSilence(out)) return { said: 'silence', out: null };
     if (isWord(out)) return { said: wordOf(out), out: null };
-    return { said: null, out: out as Json };
+    return { said: null, out: out };
   }
 }

package/src/conformance/index.ts

@@ -99,7 +99,7 @@ export { Printer, Shop, Customer, Echo, Maker, Member };
 // expects instead of importing ours, and nothing under `src/conformance`
 // reaches into `src/ward` for anything.
 export const HEX64 = /^[0-9a-f]{64}$/; // one key, one secret, one digest
-export const HEX128 = /^[0-9a-f]{128}$/; // a ward pk: the signing pk then the padlock
+const HEX128 = /^[0-9a-f]{128}$/; // a ward pk: the signing pk then the padlock
 // Her ward's word, as she receives it.
 const said = (x: unknown, w: string): boolean => told(x) === w;
 
@@ -116,10 +116,10 @@ const picky = (w: World): World & Refusing => w as World & Refusing;
 // ward's truth must be checkable wherever a ward runs, not only here.
 export type Runner = (name: string, opts: { skip?: string | false }, fn: () => Promise<void> | void) => void;
 
-// What the probe is asked to build. `lends` is the box's half of the ground's
-// seventh member: a name the harbor lends, and the class of the being it
-// lends under it. A harness that stands none is handed nothing and grounds
-// its wards to lend nothing, which is what a harbor with nothing to lend is.
+// What the probe is asked to build. `lends` is the box's own ward: a name
+// the box lends, and the class of the lent being it stands under it. A harness
+// that stands none hands its wards no box, which is what a harbor with
+// nothing to lend is.
 export type Made = { lends?: Record<string, string> };
 
 // `canRefuse` is the one flag that is off unless a harness says otherwise. A
@@ -291,7 +291,7 @@ export function conform(label: string, make: (made?: Made) => Promise<World>, {
       assert.equal(Object.hasOwn(bob.cells.standings, id), false, `and nothing was written for ${id}`);
       // The ward's half too, and not only hers: a standing filed here with no
       // record of it in her cells is a lane nobody can see and nobody removes.
-      assert.equal(Object.hasOwn(w.census().binds.B!.standings, id), false, `and the ward wrote no keys for ${id}`);
+      assert.equal(Object.hasOwn(w.census().binds.B.standings, id), false, `and the ward wrote no keys for ${id}`);
       assert.equal(await bob.being.take(`as-${id}`, inv), `as-${id}`, 'and an ordinary id takes the same invitation');
     }
     // And the three calls are still the calls, not records that shadowed them.
@@ -478,7 +478,7 @@ export function conform(label: string, make: (made?: Made) => Promise<World>, {
     assert.equal(shop.pk, pk, 'a ward that came back changed its pk');
     assert.equal(JSON.stringify(able2.partition('S').heirs), mark, 'and it came back holding what it had honoured');
     assert.deepEqual(await alice.being.buy('a second hat'), { ok: true, receipt: 'receipt for a second hat' }, 'the relation goes on, and she was never told');
-    assert.deepEqual(alice.cells.standings.shop!.id, 'shop', 'her side was not told either');
+    assert.deepEqual(alice.cells.standings.shop.id, 'shop', 'her side was not told either');
   });
 
   // Notes are the one thing on a record that a being seeds and a ward keeps
@@ -490,10 +490,10 @@ export function conform(label: string, make: (made?: Made) => Promise<World>, {
     const seeded = { tier: { deep: 'gold' } } as unknown as JsonObject;
     assert.ok((await alice.being.invite('noted', seeded)) !== null, 'she minted with notes');
     (seeded.tier as JsonObject).deep = 'moved';
-    assert.deepEqual(alice.cells.occupants.noted!.notes, { tier: { deep: 'gold' } }, 'the record is the copy, all the way down');
+    assert.deepEqual(alice.cells.occupants.noted.notes, { tier: { deep: 'gold' } }, 'the record is the copy, all the way down');
     // And notes no harbor could write back are no invitation, for the reason
     // every other write is refused: a record it could not keep.
-    assert.equal(await alice.being.invite('bad-notes', { n: 0 / 0 } as unknown as JsonObject), null);
+    assert.equal(await alice.being.invite('bad-notes', { n: 0 / 0 }), null);
     assert.equal(Object.hasOwn(alice.cells.occupants, 'bad-notes'), false, 'and nothing was written for it');
   });
 
@@ -527,10 +527,12 @@ export function conform(label: string, make: (made?: Made) => Promise<World>, {
   });
 
   // Lend is boot's other half: what the device already has, reached the one
-  // way anything is reached. The being lent stands in a ward the harbor
-  // roots, so nothing here can look at her from the outside; what the ward
-  // owes is what is asserted. She is handed an id, the standing is an
-  // ordinary one, and the invitation is nowhere she can read.
+  // way anything is reached. The device is one standing the ward holds at
+  // the box's being, and a lend is an ask on it; the being lent stands in
+  // a ward the harbor roots, so nothing here can look at her from the
+  // outside, and what the ward owes is what is asserted. She is handed an
+  // id, the standing is an ordinary one, and the invitation is nowhere she
+  // can read.
   lends('what the device lends is a being: she is handed an id, asks on an ordinary standing, and never sees the invitation', async () => {
     const w = await make({ lends: { pen: 'Member' } });
     const maker = await w.boot<Maker>('MK', Maker);
@@ -542,7 +544,7 @@ export function conform(label: string, make: (made?: Made) => Promise<World>, {
     // The keys are the ward's. Nothing of the relation is in her cells, which
     // is the whole difference between this standing and one she gave away.
     const c = w.census();
-    const heir = c.binds.MK!.standings.pen!.heir;
+    const heir = c.binds.MK.standings.pen.heir;
     assert.equal(typeof heir, 'string', 'the ward bound a heir for it');
     assert.equal(JSON.stringify(c.cells.MK).includes(heir!), false, 'and the invitation reached her nowhere');
     // Null is every kind of no, and she cannot tell them apart.
@@ -555,7 +557,7 @@ export function conform(label: string, make: (made?: Made) => Promise<World>, {
     const w = await make();
     const maker = await w.boot<Maker>('MK', Maker);
     assert.deepEqual(await maker.being.borrow({ name: 'pen', id: 'pen' }), { lent: null });
-    assert.equal(w.census().binds.MK!.standings.pen, undefined, 'and nothing was written for it');
+    assert.equal(w.census().binds.MK.standings.pen, undefined, 'and nothing was written for it');
   });
 
   // The case the estate's walk reaches by weight and this reaches by hand: a
@@ -700,6 +702,7 @@ export function conform(label: string, make: (made?: Made) => Promise<World>, {
     const names = (x: unknown) => bp(x).asks.map((a) => a.name);
     assert.deepEqual(names(await alice.being.learn()), ['hello', 'buy', 'refund']);
     assert.deepEqual(names(await bob.being.learn()), ['hello', 'buy']);
+    assert.deepEqual(await alice.being.standings.shop!.ask('refund'), { ok: true }, 'and what she is shown she can ask');
   });
 
   t('the digest is per relation: two occupants, two digests of one being, both true', async () => {

package/src/harbor/box.ts

@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: Apache-2.0
+// The box as one being. A harbor boots a ward of its own and one being in
+// it, the box's own, who holds a standing at every lent being the box
+// offers, under the name each is lent as, and keeps the roll of the wards
+// the box hosts. Every hosted ward is handed one invitation on her at boot
+// and takes it as its own standing; from then on the device is one
+// standing, what it offers is her describe, and a lend is the ask `offer`
+// on her.
+//
+// The harbor works in acts and holds no memory of its own. Act one boots the
+// box's ward on the plain ground, no box, because it is the box; her lent
+// beings come up, and the root places her standings and nothing else. Act
+// two asks her who is hosted and boots each with one invitation. Everything
+// the device is lives in her ward as a lent being's cells, placed through
+// asks and read from no file.
+//
+// A runtime that needs her to be more, a resolver of names or a carrier of
+// her lent beings' asks for a screen, extends her and overrides the asks.
+import { Being, isInvitation, OWNER } from '../being/index.ts';
+import { BOX } from '../being/lent.ts';
+import type { Asker, BeingClass, Invitation, JsonObject, OccupantRecord } from '../being/index.ts';
+import { OFFER, RETRACT, type WardPointers } from '../ward/ground.ts';
+
+// A ward as its root holds it: the ask pointer is all the acts need.
+export type Root = Pick<WardPointers, 'ask'>;
+
+export { BOX } from '../being/lent.ts';
+
+// The name of the box's own ward, one per harbor: the seed a memory harbor
+// boots it under, and the name a store keeps it by.
+export const BOX_SEED = 'box';
+
+// A ward the box vouches for: invited by the root at act two, with the one
+// note that says so. A screen or a model the root lets in has no such note
+// and is shown nothing of the lend seam.
+const ward = (occ: OccupantRecord | undefined) => occ?.notes.ward === true;
+const root = (_occ: OccupantRecord | undefined, asker: Asker) => asker.id === OWNER;
+
+export const BOX_ASKS = {
+  [OFFER]: { description: 'an invitation on the being lent under this name', input: { type: 'object', properties: { name: { type: 'string' } }, required: ['name'] }, for: ward },
+  [RETRACT]: { description: 'an offer under this name that was not taken, by its heir', input: { type: 'object', properties: { name: { type: 'string' }, heir: { type: 'string' } }, required: ['name', 'heir'] }, for: ward },
+  host: { description: 'a ward this box hosts from now', input: { type: 'object', properties: { seed: { type: 'string' } }, required: ['seed'] }, for: root },
+  roll: { description: 'the wards this box hosts', input: { type: 'object' }, for: root },
+};
+
+export class Box extends Being {
+  static override cells: JsonObject = { hosted: [], offers: {} };
+  static override asks = BOX_ASKS;
+
+  // Offer: the being under the name, asked to offer, answers her own
+  // invitation. A subclass that lends under more names than it holds
+  // standings, a contract's digest for one, resolves the name first and
+  // calls this with the standing's own.
+  async offer(args: JsonObject): Promise<JsonObject> {
+    const at = this.standings[args.name as string];
+    if (!at) return { error: 'lends none' };
+    const out = await at.ask(OFFER);
+    return isInvitation(out) ? out : { error: 'not offered' };
+  }
+
+  async retract(args: JsonObject): Promise<JsonObject> {
+    const at = this.standings[args.name as string];
+    if (!at) return { error: 'lends none' };
+    const out = await at.ask(RETRACT, { heir: args.heir as string });
+    return out !== null && typeof out === 'object' && !Array.isArray(out) ? out : { retracted: null };
+  }
+
+  // A ward on the roll, and its one invitation on her. She mints it the first
+  // time and keeps it, and hands the same one at every later boot until it
+  // is spent: a ward that could not take the box at birth, the box down or
+  // the knock lost, takes it at the next, as the spec promises. A ward that
+  // holds the standing already ignores it, and a spent heir opens no door,
+  // so handing it again costs nothing. The value never leaves her ward: it
+  // is read by the root alone and rides in the ground and nowhere else.
+  async host(args: JsonObject): Promise<JsonObject> {
+    const hosted = ((this.cells.hosted as string[] | undefined) ??= []);
+    const offers = ((this.cells.offers as Record<string, Invitation> | undefined) ??= {});
+    if (typeof args.seed !== 'string') return { error: 'a seed is a word' };
+    if (!hosted.includes(args.seed)) hosted.push(args.seed);
+    if (!Object.hasOwn(offers, args.seed)) {
+      const inv = await this.invite(args.seed, { ward: true });
+      if (inv !== null) offers[args.seed] = inv;
+    }
+    return { hosted: [...hosted], invitation: offers[args.seed] ?? null };
+  }
+
+  roll(): JsonObject {
+    return { hosted: [...((this.cells.hosted as string[] | undefined) ?? [])] };
+  }
+}
+
+// Act one's second half, on a box ward already booted: the box's being and
+// each lent being booted by key, and her standing placed at each under its
+// key by the root. A ward woken from its memory already holds all of it,
+// and a key already booted is refused and costs nothing, so this is run at
+// every boot and does the right thing at each.
+export async function stand(box: Root, lent: Record<string, BeingClass>, own = 'Box'): Promise<void> {
+  const up = async (key: string, cls: string) => {
+    const out = (await box.ask('boot', { key, class: cls })) as { booted?: string; error?: string };
+    return out.booted === key;
+  };
+  await up(BOX, own);
+  for (const name of Object.keys(lent)) {
+    const fresh = await up(name, lent[name].name);
+    if (!fresh) continue;
+    await hold(box, name);
+  }
+}
+
+// The box's standing at one lent being of her ward, under that being's key,
+// placed by the root: the lent being invites the box's being as `box`, and
+// she knocks. Refused where either already holds the relation.
+export async function hold(box: Root, key: string): Promise<boolean> {
+  const inv = await box.ask('invite', { being: key, id: BOX });
+  if (!isInvitation(inv)) return false;
+  const out = (await box.ask('knock', { being: BOX, id: key, invitation: inv as unknown as JsonObject })) as { taken?: unknown };
+  return out?.taken === key;
+}
+
+// One invitation on the box's being for the ward named, and the ward on the
+// roll: the same one at every boot, minted once by her and kept by her.
+export async function offerTo(box: Root, seed: string): Promise<Invitation | undefined> {
+  const out = (await box.ask('ask', { being: BOX, method: 'host', args: { seed } })) as { invitation?: unknown };
+  return isInvitation(out?.invitation) ? out.invitation : undefined;
+}
+
+// Who the box hosts, asked of the box's being.
+export async function roll(box: Root): Promise<string[]> {
+  const out = (await box.ask('ask', { being: BOX, method: 'roll' })) as { hosted?: string[] };
+  return out.hosted ?? [];
+}