nervur 0.18.0 → 0.19.1

package/dist/harbor/core.js

@@ -78,20 +78,19 @@ export class Harbor {
         for (const say of this.announcers)
             say();
     }
-    // What this device lends the beings of the wards it hosts, by name. One
-    // for the harbor, and `lendFor` says which ward may ask it: every ward,
-    // unless a terrain says a stranger's ward is lent nothing.
-    // Set at birth or once the harbor's own ward is standing, which is the
-    // usual order: a terrain puts that ward up first, then boots the rest on a
-    // ground that can reach it.
-    lend;
-    constructor(store, loader = async () => ({}), lend) {
+    // The box, as one invitation per ward: what this device hands a ward it
+    // boots so that the ward takes the box's being as a standing. Set once
+    // the harbor's own ward is standing, which is the usual order: a terrain
+    // puts that ward up first, then boots the rest on a ground that can reach
+    // it. A terrain says which ward is handed one by overriding `boxFor`, and
+    // a stranger's ward is handed none.
+    offering;
+    constructor(store, loader = async () => ({})) {
         this.store = store;
         this.loader = loader;
-        this.lend = lend;
     }
-    lendFor(_name, _record) {
-        return this.lend;
+    boxFor(name, _record) {
+        return this.offering?.(name) ?? Promise.resolve(undefined);
     }
     // Boot every ward the store keeps, and learn the hints. One ward that will
     // not host, a partition this kit cannot read or a loader that throws, is
@@ -498,73 +497,75 @@ export class Harbor {
         const objects = new WeakMap(); // cells -> the object instantiate made. a side's hand, never the ward's; it follows the cells out when she is unbooted
         const ground = {
             seed,
-            memory,
             // This ward's own classes first, then the harbor's: a ward that names a
             // class of its own is answered with hers.
             instantiate: maker(objects, classes, this.classes),
             carry: (pk, bytes) => this.carry(pk, new Uint8Array(bytes)),
             random,
-            wrote: (row) => this.#wrote(name, row),
-            // What the ward wrote is in the store when this resolves, and it says
-            // whether the store took it. The ward calls it at the end of every
-            // arrival, before it seals, so a call through a pointer has already
-            // waited for the store when it comes back: a restart right after one
-            // finds everything, and a refusal is that arrival's own answer rather
-            // than a number counted behind it. A ward that wrote nothing has
-            // nothing to save, so asking it what it holds is free, which is what
-            // makes the ask pointer the way to find out rather than an expensive
-            // one.
-            //
-            // A ward on its way out keeps nothing and refuses nothing: an arrival
-            // racing an unhost is not a store saying no, and saying so would be a
-            // lie in the one direction that matters.
-            keep: async () => {
-                const s = this.#saving.get(name);
-                if (!s || s.gone)
-                    return true;
-                const ok = await this.#flush(name);
-                // A refusal is heard once, by the first arrival to ask after it: the
-                // save that met it may have been a timer's, which had nobody to tell.
-                // Under a call it is left standing, so the call that carried the
-                // refused write is refused too, and the outermost arrival hears it.
-                const no = !ok || s.fault;
-                s.fault = false; // heard. the next arrival is answered by the store and not by what happened before it
-                return !no;
-            },
-            // The ward says a call is in flight, and says when it ends. The harbor
-            // goes on writing under it; what it does not do is take a save made
-            // there as the point a refused ward is put back to, and a refusal that
-            // lands under a call waits here for the call to end before it puts the
-            // ward back. The ward is the one that knows, because a being reaching
-            // another being of her own ward goes to that ward's door directly and
-            // the harbor never sees that call at all.
-            calling: () => {
-                const s = this.#saving.get(name);
-                if (!s)
-                    return () => { };
-                s.calls += 1;
-                let lowered = false;
-                return () => {
-                    if (lowered)
-                        return;
-                    lowered = true;
-                    s.calls -= 1;
-                    if (s.calls > 0 || s.gone)
-                        return;
-                    // The moment the ward is whole again: the point catches up with the
-                    // call that just ended, or a put back that was owed is done now, so
-                    // a being stands at what is kept before her next word rather than
-                    // at the next save.
-                    if (s.back)
-                        void this.#flush(name);
-                    else
-                        this.#settle(name, s);
-                };
+            memory: {
+                rows: memory,
+                told: (row) => this.#wrote(name, row),
+                // What the ward wrote is in the store when this resolves, and it says
+                // whether the store took it. The ward calls it at the end of every
+                // arrival, before it seals, so a call through a pointer has already
+                // waited for the store when it comes back: a restart right after one
+                // finds everything, and a refusal is that arrival's own answer rather
+                // than a number counted behind it. A ward that wrote nothing has
+                // nothing to save, so asking it what it holds is free, which is what
+                // makes the ask pointer the way to find out rather than an expensive
+                // one.
+                //
+                // A ward on its way out keeps nothing and refuses nothing: an arrival
+                // racing an unhost is not a store saying no, and saying so would be a
+                // lie in the one direction that matters.
+                kept: async () => {
+                    const s = this.#saving.get(name);
+                    if (!s || s.gone)
+                        return true;
+                    const ok = await this.#flush(name);
+                    // A refusal is heard once, by the first arrival to ask after it: the
+                    // save that met it may have been a timer's, which had nobody to tell.
+                    // Under a call it is left standing, so the call that carried the
+                    // refused write is refused too, and the outermost arrival hears it.
+                    const no = !ok || s.fault;
+                    s.fault = false; // heard. the next arrival is answered by the store and not by what happened before it
+                    return !no;
+                },
+                // The ward says a call is in flight, and says when it ends. The harbor
+                // goes on writing under it; what it does not do is take a save made
+                // there as the point a refused ward is put back to, and a refusal that
+                // lands under a call waits here for the call to end before it puts the
+                // ward back. The ward is the one that knows, because a being reaching
+                // another being of her own ward goes to that ward's door directly and
+                // the harbor never sees that call at all.
+                during: () => {
+                    const s = this.#saving.get(name);
+                    if (!s)
+                        return () => { };
+                    s.calls += 1;
+                    let lowered = false;
+                    return () => {
+                        if (lowered)
+                            return;
+                        lowered = true;
+                        s.calls -= 1;
+                        if (s.calls > 0 || s.gone)
+                            return;
+                        // The moment the ward is whole again: the point catches up with the
+                        // call that just ended, or a put back that was owed is done now, so
+                        // a being stands at what is kept before her next word rather than
+                        // at the next save.
+                        if (s.back)
+                            void this.#flush(name);
+                        else
+                            this.#settle(name, s);
+                    };
+                },
             },
         };
-        const lend = this.lendFor(name, kept.record);
-        if (lend)
-            ground.lend = lend;
+        const box = await this.boxFor(name, kept.record);
+        if (box)
+            ground.box = box;
         // What the store holds for this ward at birth is what it was just handed
         // or just read, row by row. It is copied once here so that a being whose
         // very first write of this run is refused is put back too, rather than
@@ -593,7 +594,7 @@ export class Harbor {
         // here. It answers nothing, because a caller inside the process reads
         // the fault off the harbor and an arrival is the only thing that needs a
         // verdict of its own.
-        const save = async () => void (await ground.keep?.());
+        const save = async () => void (await ground.memory.kept());
         const door = (bytes) => w.door(bytes);
         const ask = async (method, args) => {
             if (saving.gone)

package/dist/harbor/index.d.ts

@@ -4,5 +4,7 @@ export { dial, type Dialer } from './dial.ts';
 export { MemoryStore, values, rowsOf, type Store, type Kept, type WardRecord } from './store.ts';
 export { HEAD, fromRows, rowsIn } from '../ward/partition.ts';
 export { request, Socket, SUITE, REFUSED, type Reach, type Carry, type Line, type Announce } from './reach.ts';
-export type { Ground, WardPointers, Lend } from '../ward/ground.ts';
+export type { Ground, WardPointers, Memory } from '../ward/ground.ts';
+export { BOX, OFFER, RETRACT, volatile } from '../ward/ground.ts';
+export { Box, BOX_SEED, BOX_ASKS, stand, hold, offerTo, roll } from './box.ts';
 export { maker, entropy, learnPk } from '../ward/ground.ts';

package/dist/harbor/index.js

@@ -11,6 +11,9 @@ export { MemoryStore, values, rowsOf } from './store.js';
 // a being, and the partition back from the rows it was cut into.
 export { HEAD, fromRows, rowsIn } from '../ward/partition.js';
 export { request, Socket, SUITE, REFUSED } from './reach.js';
+export { BOX, OFFER, RETRACT, volatile } from '../ward/ground.js';
+// The box as one being, and the acts a harbor runs to stand it.
+export { Box, BOX_SEED, BOX_ASKS, stand, hold, offerTo, roll } from './box.js';
 // What a harbor builds a ground out of. Convenience, never contract: a kit
 // writing its own harbor may write these three again.
 export { maker, entropy, learnPk } from '../ward/ground.js';

package/dist/harbor/memory.d.ts

@@ -1,5 +1,5 @@
-import type { BeingClass, BeingLike } from '../being/types.ts';
-import { type Ground, type WardPointers, type Lend } from '../ward/ground.ts';
+import type { BeingClass, BeingLike, Invitation } from '../being/types.ts';
+import { type Ground, type WardPointers } from '../ward/ground.ts';
 export type Booted = WardPointers & {
     pk: string;
 };
@@ -20,6 +20,10 @@ export declare class MemoryHarbor {
     random: Ground['random'];
     route(farPk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
     link(harbor: MemoryHarbor): void;
-    boot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, lend?: Lend): Promise<Booted>;
-    reboot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, lend?: Lend): Promise<Booted>;
+    boot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, box?: Invitation): Promise<Booted>;
+    reboot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, box?: Invitation): Promise<Booted>;
+    up(Ward: WardFactory, lent?: Record<string, BeingClass>): Promise<Booted>;
+    get box(): Booted | undefined;
+    host(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>): Promise<Booted>;
+    hosted(Ward: WardFactory, classes: Record<string, BeingClass>): Promise<string[]>;
 }

package/dist/harbor/memory.js

@@ -1,5 +1,6 @@
-import { maker, entropy, learnPk } from '../ward/ground.js';
+import { maker, entropy, learnPk, volatile } from '../ward/ground.js';
 import { hex } from '../ward/arithmetic.js';
+import { Box, BOX_SEED, stand, offerTo, roll } from './box.js';
 export class MemoryHarbor {
     doors = new Map(); // ward pk -> door
     down = new Set(); // ward pks this harbor cannot reach right now
@@ -36,22 +37,22 @@ export class MemoryHarbor {
         this.peers.add(harbor);
         harbor.peers.add(this);
     }
-    // boot by seed. the harbor gets a door and an ask, and learns the pk by asking.
-    // `lend` is what this device lends the ward's beings, and a test's stand-in
-    // for a real terrain's: left out, every name answers null.
-    async boot(seed, Ward, classes, lend) {
+    // boot by seed. the harbor gets a door and an ask, and learns the pk by
+    // asking. `box` is the invitation on this device's box being, for this
+    // ward: left out, the ward holds no box and every lend is null.
+    async boot(seed, Ward, classes, box) {
         this.partitions.set(seed, {});
-        return this.reboot(seed, Ward, classes, lend);
+        return this.reboot(seed, Ward, classes, box);
     }
     // a restart: same seed, same partition, fresh ward. the ward's files are the harbor's to keep.
-    async reboot(seed, Ward, classes, lend) {
-        const memory = this.partitions.get(seed);
-        if (!memory)
+    async reboot(seed, Ward, classes, box) {
+        const rows = this.partitions.get(seed);
+        if (!rows)
             throw new Error(`no partition for ${seed}`);
         const ground = {
             seed,
-            memory,
-            ...(lend ? { lend } : {}),
+            memory: volatile(rows),
+            ...(box ? { box } : {}),
             // One objects map for the whole harbor, not one per ward: every ward
             // here is in this process and a test reaches any being of any of them.
             instantiate: maker(this.objects, classes),
@@ -69,4 +70,35 @@ export class MemoryHarbor {
         this.wards.set(seed, booted);
         return booted;
     }
+    // Act one. The box's own ward, the box's being and the lent beings named,
+    // each booted under its name and held by her under it. Run again on a
+    // harbor whose box ward stands, it changes nothing.
+    async up(Ward, lent = {}) {
+        const classes = { Box };
+        for (const C of Object.values(lent))
+            classes[C.name] = C;
+        const box = this.wards.get(BOX_SEED) ?? (await this.boot(BOX_SEED, Ward, classes));
+        await stand(box, lent);
+        return box;
+    }
+    get box() {
+        return this.wards.get(BOX_SEED);
+    }
+    // Act two, one ward: on the roll and handed one invitation on the box's being.
+    // A harbor with no box ward up hosts as `boot` does, with nothing.
+    async host(seed, Ward, classes) {
+        const box = this.box;
+        const inv = box ? await offerTo(box, seed) : undefined;
+        return this.partitions.has(seed) ? this.reboot(seed, Ward, classes, inv) : this.boot(seed, Ward, classes, inv);
+    }
+    // Act two, whole: the box's being says who is hosted, and each comes up.
+    async hosted(Ward, classes) {
+        const box = this.box;
+        if (!box)
+            return [];
+        const seeds = await roll(box);
+        for (const seed of seeds)
+            await this.host(seed, Ward, classes);
+        return seeds;
+    }
 }

package/dist/harbor/reach.js

@@ -20,6 +20,7 @@
 // A reach that sent the bytes and lost the line afterwards answers nothing
 // at all, and the ward's own bound ends the ask.
 import { concat, hex, unhex } from '../ward/arithmetic.js';
+import { readJson } from '../ward/json.js';
 const never = () => new Promise(() => { }); // sent, and no word since: the ward's bound decides
 // A request reach to one listener.
 export function request(url) {
@@ -111,7 +112,9 @@ export class Socket {
         line.addEventListener('message', (e) => {
             if (typeof e.data === 'string') {
                 try {
-                    const m = JSON.parse(e.data);
+                    const m = readJson(e.data);
+                    if (m === null || typeof m !== 'object')
+                        return;
                     // Absent is this suite: a side that says nothing says one.
                     if (m.suite !== undefined && m.suite !== SUITE) {
                         this.far = [];
@@ -129,9 +132,14 @@ export class Socket {
                 return;
             }
             const buf = e.data instanceof ArrayBuffer ? new Uint8Array(e.data) : ArrayBuffer.isView(e.data) ? new Uint8Array(e.data.buffer, e.data.byteOffset, e.data.byteLength) : undefined;
+            // A frame that is none of the three is not a frame: an unknown kind, an
+            // ask too short to hold a pk, a nothing with bytes after its id. It is
+            // dropped, and tells no ask waiting on its id that nothing was delivered.
             if (!buf || buf.length < 5)
                 return;
             const kind = buf[0], id = new DataView(buf.buffer, buf.byteOffset, buf.byteLength).getUint32(1);
+            if (kind > NONE || (kind === ASK && buf.length < 69) || (kind === NONE && buf.length !== 5))
+                return;
             if (kind === ASK) {
                 const pk = hex(buf.subarray(5, 69));
                 // A deliver that rejects has delivered nothing this side can vouch

package/dist/harbor/store.js

@@ -18,7 +18,7 @@ export const values = (p) => JSON.parse(JSON.stringify(p));
 // is the store dropping what it holds for her.
 export const rowsOf = (partition, rows) => rows.map((row) => {
     const value = rowOf(partition, row);
-    return [row, value === undefined ? undefined : values(value)];
+    return [row, value === undefined ? undefined : (values(value))];
 });
 // One store's copy, brought up to date with the rows it was told about.
 const keep = (row, partition, rows) => {

package/dist/vector/cases.d.ts

@@ -1,4 +1,4 @@
-import type { Json } from '../being/types.ts';
+import type { Json, JsonObject } from '../being/types.ts';
 import type { Booted } from '../harbor/memory.ts';
 import type { World, Sealed } from './world.ts';
 export type DoorRecord = {
@@ -11,8 +11,8 @@ export type DoorRecord = {
     ask: string;
     reply: string;
     opens: Json | null;
-    before: string;
-    after: string;
+    draws: number;
+    blueprint?: JsonObject;
     wrote: boolean;
 };
 export type Pin = () => Promise<void>;
@@ -34,6 +34,7 @@ export type Case = {
 export declare function stand(c: Case): Promise<{
     w: World;
     before: string;
+    draws: number;
     arrival: Arrival;
 }>;
 export declare function doorCases(): Promise<DoorRecord[]>;

package/dist/vector/cases.js

@@ -18,7 +18,8 @@
 import { Ward } from '../ward/ward.js';
 import * as seal from '../ward/seal.js';
 import { hex } from '../ward/arithmetic.js';
-import { world, sealed, bound, secret, rnd, partitionDigest, Caller } from './world.js';
+import { digest } from '../being/digest.js';
+import { world, sealed, bound, secret, rnd, drawn, partitionDigest, Caller } from './world.js';
 // Stand one case: its world, its setup, its ask. What comes back is enough
 // to knock, and enough for a verifier to check the hand before the door.
 export async function stand(c) {
@@ -27,14 +28,36 @@ export async function stand(c) {
     const arrival = await c.arrive(w, async () => {
         before = await partitionDigest(w.b, c.ward);
     });
-    return { w, before, arrival };
+    // Where the stream stands now, which is where the door is about to draw
+    // from. A kit that stood this case its own way sets its stream here.
+    return { w, before, draws: drawn(), arrival };
+}
+// The blueprint a reply's `seen` was taken over. The host is the only being
+// in this world whose shape reaches a stranger, and the asker is the id her
+// heir was opened for, so there is one blueprint to find and it is checked
+// against the digest before it is written down.
+async function shown(w, seen) {
+    for (const id of Object.keys(w.host.cells.occupants)) {
+        const bp = w.host.describe({ id });
+        if ((await digest(bp)) === seen)
+            return bp;
+    }
+    return undefined;
 }
 async function record(c) {
-    const { w, before, arrival } = await stand(c);
+    const { w, before, draws, arrival } = await stand(c);
     const judged = await arrival.door.door(arrival.ask.bytes);
     const after = await partitionDigest(w.b, c.ward);
     const opens = arrival.ask.open ? (await arrival.ask.open(judged.bytes)) : null;
-    return { case: c.case, name: c.name, state: c.state, ward: c.ward, kind: arrival.kind, heard: judged.heard, ask: hex(arrival.ask.bytes), reply: hex(judged.bytes), opens, before, after, wrote: before !== after };
+    // A reply that carries `seen` carries a being's shape on the wire, which is
+    // the one place in this corpus where what a being answers reaches a
+    // stranger. So the blueprint that digest is taken over is written down
+    // beside it: a kit stands a being that answers exactly this to the empty
+    // ask, and its door's bytes are these bytes. Every other record is the
+    // door alone and needs no being at all.
+    const seen = opens !== null && typeof opens === 'object' && !Array.isArray(opens) ? (opens).seen : undefined;
+    const blueprint = typeof seen === 'string' ? await shown(w, seen) : undefined;
+    return { case: c.case, name: c.name, state: c.state, ward: c.ward, kind: arrival.kind, heard: judged.heard, draws, ask: hex(arrival.ask.bytes), reply: hex(judged.bytes), opens, ...(blueprint ? { blueprint } : {}), wrote: before !== after };
 }
 // One after another and never at once: the cases share one stream, and two
 // of them in flight together would draw from it in whatever order the
@@ -108,10 +131,15 @@ export const cases = [
         name: 'she is not there',
         state: 'the ward restarted without her class: her heirs stand and she does not',
         ward: 'B',
+        // Under the key she bound: the heir was spent by her knock and admits
+        // nothing now, so an arrival signed with its secret would be D6 and not
+        // this case. Her own key is what the door holds for her, and it is the
+        // key that hears the word.
         arrive: async (w, pin) => {
+            const b = await bound(w);
             const WB = await w.b.reboot('B', Ward, { Caller });
             await pin();
-            return at(WB, w.inv.heir, 'word', { signer: secret(w.inv), next: 'a'.repeat(64) });
+            return at(WB, b.inv.heir, 'word', { signer: b.own });
         },
     },
     {

package/dist/vector/stand.js

@@ -18,6 +18,7 @@
 // world runs on.
 import { SUITE } from '../harbor/reach.js';
 import { hex } from '../ward/arithmetic.js';
+import { readJson } from '../ward/json.js';
 import { caseNamed, stand } from './cases.js';
 import { partitionDigest } from './world.js';
 const CORS = {
@@ -39,7 +40,7 @@ export class Stand {
         if (method === 'POST' && p === '/stand') {
             let named;
             try {
-                named = JSON.parse(new TextDecoder().decode(body));
+                named = readJson(body);
             }
             catch {
                 return NONE;

package/dist/vector/world.d.ts

@@ -5,6 +5,7 @@ import { Being } from '../being/being.ts';
 import type { Answer, Asker, BeingClass, Blueprint, Invitation, JsonObject, Reply, Wanted } from '../being/types.ts';
 export declare function splitmix64(seed: bigint): () => Uint8Array;
 export declare const STREAM_SEED = 20250901n;
+export declare const drawn: () => number;
 export declare const rnd: (n?: number) => Uint8Array;
 export declare const must: (ok: boolean, what: string) => void;
 export declare const P: (h: MemoryHarbor, seed: string) => Partition;

package/dist/vector/world.js

@@ -8,7 +8,7 @@
 // Nothing here draws from the device. A door's reply is sealed under a fresh
 // ephemeral key and a fresh nonce, so the bytes are fixed only where the
 // entropy is, and every draw in this file comes from one written-down stream.
-// That is what lets `protocol/vectors/door.json` be a corpus and not a
+// That is what lets `quo/vectors/door.json` be a corpus and not a
 // sample, and what lets a kit stand in vector mode for a verifier that holds
 // no key: the spec's chapter of that name is the contract this file keeps.
 import { MemoryHarbor } from '../harbor/memory.js';
@@ -20,10 +20,10 @@ import { silence, unreached, isSilence, isUnreached, told } from '../being/silen
 import { digest } from '../being/digest.js';
 // ---- the stream
 //
-// SplitMix64. Sixteen lines a kit in any language writes from this comment
-// alone: the state starts at the seed, every draw adds the golden gamma
-// 0x9e3779b97f4a7c15, mixes with two xor-shift-multiplies, and the sixty-four
-// bit result is spent eight bytes at a time, least significant first. It is
+// SplitMix64, written out in the spec's vector-mode chapter with both
+// multipliers and all three shifts, because a kit that reproduces it by
+// recognising it is a kit that guessed. This is that, and it moves only
+// when that does. It is
 // not a cipher and is not meant to be one. Its whole job is that the bytes
 // this file produces are the same bytes twice.
 const GAMMA = 0x9e3779b97f4a7c15n;
@@ -46,13 +46,23 @@ export function splitmix64(seed) {
 // stream to when it reproduces `door.json`.
 export const STREAM_SEED = 20250901n;
 let draw = splitmix64(STREAM_SEED);
+// How many sixty-four bit words have been spent since the stream was reset.
+// A record carries this number at the moment of its arrival, so a kit that
+// built the door's state its own way sets its stream here and draws what
+// this one would have drawn. It is the whole of what the setup's history is
+// worth to a stranger: not how the world was made, but where the stream
+// stands when the door is about to answer.
+let spent = 0;
+export const drawn = () => spent;
 // Entropy, from the stream and never from the device. Every signer secret,
 // every ephemeral seed, every byte of noise and every key a ward in this
 // world mints comes through here, in the order the code asks for it.
 export const rnd = (n = 32) => {
     const out = new Uint8Array(n);
-    for (let i = 0; i < n; i += 8)
+    for (let i = 0; i < n; i += 8) {
         out.set(draw().subarray(0, Math.min(8, n - i)), i);
+        spent += 1;
+    }
     return out;
 };
 // A claim the world stands on. It throws, because a world that is not the
@@ -149,6 +159,7 @@ export const classes = { Host, Caller };
 let counted = 1000;
 export async function world() {
     draw = splitmix64(STREAM_SEED); // a fresh world is a fresh stream: two runs, one corpus
+    spent = 0;
     counted = 1000;
     const a = new MemoryHarbor(), b = new MemoryHarbor();
     a.random = rnd;

package/dist/ward/arithmetic.js

@@ -59,8 +59,10 @@ export function sameBytes(a, b) {
         diff |= a[at] ^ b[at];
     return diff === 0;
 }
-// The eight small-order points of Ed25519, in their canonical encoding. A
-// public key among them verifies nothing. An encoding whose y coordinate is
+// The eight small-order points of Ed25519, in their canonical encoding, and
+// the two points with x = 0 spelled with the sign bit set, which a decoder
+// that ignores the bit reads as the same point. A public key among them
+// verifies nothing. An encoding whose y coordinate is
 // not reduced, y at or above the field's prime p, names one of the same
 // points under another spelling, and a terrain's verify may accept a zero
 // signature under it; the field has room for the spelling, so it is refused
@@ -74,6 +76,8 @@ const SMALL_ORDER = [
     'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a',
     '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85',
     'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',
+    '0100000000000000000000000000000000000000000000000000000000000080',
+    'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff',
 ].map(unhex);
 // y >= p, read little-endian with the sign bit masked off: the top byte is
 // 0x7f under the mask, every middle byte is 0xff, and the low byte is at

package/dist/ward/ground.d.ts

@@ -1,15 +1,21 @@
 import type { Stance, BeingLike, BeingClass, Invitation } from '../being/types.ts';
-export type Lend = (name: string, take: (invitation: Invitation) => Promise<boolean>) => Promise<boolean>;
+export type Memory = {
+    readonly rows: Record<string, unknown>;
+    told(row: string): void;
+    kept(): Promise<boolean>;
+    during(): () => void;
+};
+export declare const volatile: (rows?: Record<string, unknown>) => Memory;
+export { BOX } from '../being/lent.ts';
+export declare const OFFER = "offer";
+export declare const RETRACT = "retract";
 export type Ground = {
     seed: string | Uint8Array;
-    memory: Record<string, unknown>;
+    random(n: number): Uint8Array;
+    memory: Memory;
     instantiate(className: string, stance: Stance): BeingLike | null;
-    wrote?: (row: string) => void;
-    keep?: () => Promise<boolean>;
-    calling?: () => () => void;
     carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
-    random(n: number): Uint8Array;
-    lend?: Lend;
+    box?: Invitation;
 };
 export type WardPointers = {
     door(bytes: Uint8Array): Promise<{