nervur 0.18.0 → 0.19.1

package/src/conformance/index.ts

@@ -99,7 +99,7 @@ export { Printer, Shop, Customer, Echo, Maker, Member };
 // expects instead of importing ours, and nothing under `src/conformance`
 // reaches into `src/ward` for anything.
 export const HEX64 = /^[0-9a-f]{64}$/; // one key, one secret, one digest
-export const HEX128 = /^[0-9a-f]{128}$/; // a ward pk: the signing pk then the padlock
+const HEX128 = /^[0-9a-f]{128}$/; // a ward pk: the signing pk then the padlock
 // Her ward's word, as she receives it.
 const said = (x: unknown, w: string): boolean => told(x) === w;
 
@@ -116,10 +116,10 @@ const picky = (w: World): World & Refusing => w as World & Refusing;
 // ward's truth must be checkable wherever a ward runs, not only here.
 export type Runner = (name: string, opts: { skip?: string | false }, fn: () => Promise<void> | void) => void;
 
-// What the probe is asked to build. `lends` is the box's half of the ground's
-// seventh member: a name the harbor lends, and the class of the being it
-// lends under it. A harness that stands none is handed nothing and grounds
-// its wards to lend nothing, which is what a harbor with nothing to lend is.
+// What the probe is asked to build. `lends` is the box's own ward: a name
+// the box lends, and the class of the lent being it stands under it. A harness
+// that stands none hands its wards no box, which is what a harbor with
+// nothing to lend is.
 export type Made = { lends?: Record<string, string> };
 
 // `canRefuse` is the one flag that is off unless a harness says otherwise. A
@@ -291,7 +291,7 @@ export function conform(label: string, make: (made?: Made) => Promise<World>, {
       assert.equal(Object.hasOwn(bob.cells.standings, id), false, `and nothing was written for ${id}`);
       // The ward's half too, and not only hers: a standing filed here with no
       // record of it in her cells is a lane nobody can see and nobody removes.
-      assert.equal(Object.hasOwn(w.census().binds.B!.standings, id), false, `and the ward wrote no keys for ${id}`);
+      assert.equal(Object.hasOwn(w.census().binds.B.standings, id), false, `and the ward wrote no keys for ${id}`);
       assert.equal(await bob.being.take(`as-${id}`, inv), `as-${id}`, 'and an ordinary id takes the same invitation');
     }
     // And the three calls are still the calls, not records that shadowed them.
@@ -478,7 +478,7 @@ export function conform(label: string, make: (made?: Made) => Promise<World>, {
     assert.equal(shop.pk, pk, 'a ward that came back changed its pk');
     assert.equal(JSON.stringify(able2.partition('S').heirs), mark, 'and it came back holding what it had honoured');
     assert.deepEqual(await alice.being.buy('a second hat'), { ok: true, receipt: 'receipt for a second hat' }, 'the relation goes on, and she was never told');
-    assert.deepEqual(alice.cells.standings.shop!.id, 'shop', 'her side was not told either');
+    assert.deepEqual(alice.cells.standings.shop.id, 'shop', 'her side was not told either');
   });
 
   // Notes are the one thing on a record that a being seeds and a ward keeps
@@ -490,10 +490,10 @@ export function conform(label: string, make: (made?: Made) => Promise<World>, {
     const seeded = { tier: { deep: 'gold' } } as unknown as JsonObject;
     assert.ok((await alice.being.invite('noted', seeded)) !== null, 'she minted with notes');
     (seeded.tier as JsonObject).deep = 'moved';
-    assert.deepEqual(alice.cells.occupants.noted!.notes, { tier: { deep: 'gold' } }, 'the record is the copy, all the way down');
+    assert.deepEqual(alice.cells.occupants.noted.notes, { tier: { deep: 'gold' } }, 'the record is the copy, all the way down');
     // And notes no harbor could write back are no invitation, for the reason
     // every other write is refused: a record it could not keep.
-    assert.equal(await alice.being.invite('bad-notes', { n: 0 / 0 } as unknown as JsonObject), null);
+    assert.equal(await alice.being.invite('bad-notes', { n: 0 / 0 }), null);
     assert.equal(Object.hasOwn(alice.cells.occupants, 'bad-notes'), false, 'and nothing was written for it');
   });
 
@@ -527,10 +527,12 @@ export function conform(label: string, make: (made?: Made) => Promise<World>, {
   });
 
   // Lend is boot's other half: what the device already has, reached the one
-  // way anything is reached. The being lent stands in a ward the harbor
-  // roots, so nothing here can look at her from the outside; what the ward
-  // owes is what is asserted. She is handed an id, the standing is an
-  // ordinary one, and the invitation is nowhere she can read.
+  // way anything is reached. The device is one standing the ward holds at
+  // the box's being, and a lend is an ask on it; the being lent stands in
+  // a ward the harbor roots, so nothing here can look at her from the
+  // outside, and what the ward owes is what is asserted. She is handed an
+  // id, the standing is an ordinary one, and the invitation is nowhere she
+  // can read.
   lends('what the device lends is a being: she is handed an id, asks on an ordinary standing, and never sees the invitation', async () => {
     const w = await make({ lends: { pen: 'Member' } });
     const maker = await w.boot<Maker>('MK', Maker);
@@ -542,7 +544,7 @@ export function conform(label: string, make: (made?: Made) => Promise<World>, {
     // The keys are the ward's. Nothing of the relation is in her cells, which
     // is the whole difference between this standing and one she gave away.
     const c = w.census();
-    const heir = c.binds.MK!.standings.pen!.heir;
+    const heir = c.binds.MK.standings.pen.heir;
     assert.equal(typeof heir, 'string', 'the ward bound a heir for it');
     assert.equal(JSON.stringify(c.cells.MK).includes(heir!), false, 'and the invitation reached her nowhere');
     // Null is every kind of no, and she cannot tell them apart.
@@ -555,7 +557,7 @@ export function conform(label: string, make: (made?: Made) => Promise<World>, {
     const w = await make();
     const maker = await w.boot<Maker>('MK', Maker);
     assert.deepEqual(await maker.being.borrow({ name: 'pen', id: 'pen' }), { lent: null });
-    assert.equal(w.census().binds.MK!.standings.pen, undefined, 'and nothing was written for it');
+    assert.equal(w.census().binds.MK.standings.pen, undefined, 'and nothing was written for it');
   });
 
   // The case the estate's walk reaches by weight and this reaches by hand: a
@@ -700,6 +702,7 @@ export function conform(label: string, make: (made?: Made) => Promise<World>, {
     const names = (x: unknown) => bp(x).asks.map((a) => a.name);
     assert.deepEqual(names(await alice.being.learn()), ['hello', 'buy', 'refund']);
     assert.deepEqual(names(await bob.being.learn()), ['hello', 'buy']);
+    assert.deepEqual(await alice.being.standings.shop!.ask('refund'), { ok: true }, 'and what she is shown she can ask');
   });
 
   t('the digest is per relation: two occupants, two digests of one being, both true', async () => {

package/src/harbor/box.ts

@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: Apache-2.0
+// The box as one being. A harbor boots a ward of its own and one being in
+// it, the box's own, who holds a standing at every lent being the box
+// offers, under the name each is lent as, and keeps the roll of the wards
+// the box hosts. Every hosted ward is handed one invitation on her at boot
+// and takes it as its own standing; from then on the device is one
+// standing, what it offers is her describe, and a lend is the ask `offer`
+// on her.
+//
+// The harbor works in acts and holds no memory of its own. Act one boots the
+// box's ward on the plain ground, no box, because it is the box; her lent
+// beings come up, and the root places her standings and nothing else. Act
+// two asks her who is hosted and boots each with one invitation. Everything
+// the device is lives in her ward as a lent being's cells, placed through
+// asks and read from no file.
+//
+// A runtime that needs her to be more, a resolver of names or a carrier of
+// her lent beings' asks for a screen, extends her and overrides the asks.
+import { Being, isInvitation, OWNER } from '../being/index.ts';
+import { BOX } from '../being/lent.ts';
+import type { Asker, BeingClass, Invitation, JsonObject, OccupantRecord } from '../being/index.ts';
+import { OFFER, RETRACT, type WardPointers } from '../ward/ground.ts';
+
+// A ward as its root holds it: the ask pointer is all the acts need.
+export type Root = Pick<WardPointers, 'ask'>;
+
+export { BOX } from '../being/lent.ts';
+
+// The name of the box's own ward, one per harbor: the seed a memory harbor
+// boots it under, and the name a store keeps it by.
+export const BOX_SEED = 'box';
+
+// A ward the box vouches for: invited by the root at act two, with the one
+// note that says so. A screen or a model the root lets in has no such note
+// and is shown nothing of the lend seam.
+const ward = (occ: OccupantRecord | undefined) => occ?.notes.ward === true;
+const root = (_occ: OccupantRecord | undefined, asker: Asker) => asker.id === OWNER;
+
+export const BOX_ASKS = {
+  [OFFER]: { description: 'an invitation on the being lent under this name', input: { type: 'object', properties: { name: { type: 'string' } }, required: ['name'] }, for: ward },
+  [RETRACT]: { description: 'an offer under this name that was not taken, by its heir', input: { type: 'object', properties: { name: { type: 'string' }, heir: { type: 'string' } }, required: ['name', 'heir'] }, for: ward },
+  host: { description: 'a ward this box hosts from now', input: { type: 'object', properties: { seed: { type: 'string' } }, required: ['seed'] }, for: root },
+  roll: { description: 'the wards this box hosts', input: { type: 'object' }, for: root },
+};
+
+export class Box extends Being {
+  static override cells: JsonObject = { hosted: [], offers: {} };
+  static override asks = BOX_ASKS;
+
+  // Offer: the being under the name, asked to offer, answers her own
+  // invitation. A subclass that lends under more names than it holds
+  // standings, a contract's digest for one, resolves the name first and
+  // calls this with the standing's own.
+  async offer(args: JsonObject): Promise<JsonObject> {
+    const at = this.standings[args.name as string];
+    if (!at) return { error: 'lends none' };
+    const out = await at.ask(OFFER);
+    return isInvitation(out) ? out : { error: 'not offered' };
+  }
+
+  async retract(args: JsonObject): Promise<JsonObject> {
+    const at = this.standings[args.name as string];
+    if (!at) return { error: 'lends none' };
+    const out = await at.ask(RETRACT, { heir: args.heir as string });
+    return out !== null && typeof out === 'object' && !Array.isArray(out) ? out : { retracted: null };
+  }
+
+  // A ward on the roll, and its one invitation on her. She mints it the first
+  // time and keeps it, and hands the same one at every later boot until it
+  // is spent: a ward that could not take the box at birth, the box down or
+  // the knock lost, takes it at the next, as the spec promises. A ward that
+  // holds the standing already ignores it, and a spent heir opens no door,
+  // so handing it again costs nothing. The value never leaves her ward: it
+  // is read by the root alone and rides in the ground and nowhere else.
+  async host(args: JsonObject): Promise<JsonObject> {
+    const hosted = ((this.cells.hosted as string[] | undefined) ??= []);
+    const offers = ((this.cells.offers as Record<string, Invitation> | undefined) ??= {});
+    if (typeof args.seed !== 'string') return { error: 'a seed is a word' };
+    if (!hosted.includes(args.seed)) hosted.push(args.seed);
+    if (!Object.hasOwn(offers, args.seed)) {
+      const inv = await this.invite(args.seed, { ward: true });
+      if (inv !== null) offers[args.seed] = inv;
+    }
+    return { hosted: [...hosted], invitation: offers[args.seed] ?? null };
+  }
+
+  roll(): JsonObject {
+    return { hosted: [...((this.cells.hosted as string[] | undefined) ?? [])] };
+  }
+}
+
+// Act one's second half, on a box ward already booted: the box's being and
+// each lent being booted by key, and her standing placed at each under its
+// key by the root. A ward woken from its memory already holds all of it,
+// and a key already booted is refused and costs nothing, so this is run at
+// every boot and does the right thing at each.
+export async function stand(box: Root, lent: Record<string, BeingClass>, own = 'Box'): Promise<void> {
+  const up = async (key: string, cls: string) => {
+    const out = (await box.ask('boot', { key, class: cls })) as { booted?: string; error?: string };
+    return out.booted === key;
+  };
+  await up(BOX, own);
+  for (const name of Object.keys(lent)) {
+    const fresh = await up(name, lent[name].name);
+    if (!fresh) continue;
+    await hold(box, name);
+  }
+}
+
+// The box's standing at one lent being of her ward, under that being's key,
+// placed by the root: the lent being invites the box's being as `box`, and
+// she knocks. Refused where either already holds the relation.
+export async function hold(box: Root, key: string): Promise<boolean> {
+  const inv = await box.ask('invite', { being: key, id: BOX });
+  if (!isInvitation(inv)) return false;
+  const out = (await box.ask('knock', { being: BOX, id: key, invitation: inv as unknown as JsonObject })) as { taken?: unknown };
+  return out?.taken === key;
+}
+
+// One invitation on the box's being for the ward named, and the ward on the
+// roll: the same one at every boot, minted once by her and kept by her.
+export async function offerTo(box: Root, seed: string): Promise<Invitation | undefined> {
+  const out = (await box.ask('ask', { being: BOX, method: 'host', args: { seed } })) as { invitation?: unknown };
+  return isInvitation(out?.invitation) ? out.invitation : undefined;
+}
+
+// Who the box hosts, asked of the box's being.
+export async function roll(box: Root): Promise<string[]> {
+  const out = (await box.ask('ask', { being: BOX, method: 'roll' })) as { hosted?: string[] };
+  return out.hosted ?? [];
+}

package/src/harbor/core.ts

@@ -19,8 +19,8 @@
 // that arrive from the wire go to an own door or a held socket and never
 // onward by request or by fallback; that one rule is the rendezvous.
 import { Ward } from '../ward/ward.ts';
-import { maker, entropy as random, learnPk, type Ground, type WardPointers, type Lend } from '../ward/ground.ts';
-import type { BeingClass, BeingLike } from '../being/types.ts';
+import { maker, entropy as random, learnPk, type Ground, type WardPointers } from '../ward/ground.ts';
+import type { BeingClass, BeingLike, Invitation } from '../being/types.ts';
 import { silence } from '../being/silence.ts';
 import { request, type Reach } from './reach.ts';
 import { isWardPk, openReply, wardSignPk } from '../ward/seal.ts';
@@ -149,22 +149,21 @@ export class Harbor {
     for (const say of this.announcers) say();
   }
 
-  // What this device lends the beings of the wards it hosts, by name. One
-  // for the harbor, and `lendFor` says which ward may ask it: every ward,
-  // unless a terrain says a stranger's ward is lent nothing.
-  // Set at birth or once the harbor's own ward is standing, which is the
-  // usual order: a terrain puts that ward up first, then boots the rest on a
-  // ground that can reach it.
-  lend: Lend | undefined;
+  // The box, as one invitation per ward: what this device hands a ward it
+  // boots so that the ward takes the box's being as a standing. Set once
+  // the harbor's own ward is standing, which is the usual order: a terrain
+  // puts that ward up first, then boots the rest on a ground that can reach
+  // it. A terrain says which ward is handed one by overriding `boxFor`, and
+  // a stranger's ward is handed none.
+  offering: ((name: string) => Promise<Invitation | undefined>) | undefined;
 
-  constructor(store: Store, loader: Loader = async () => ({}), lend?: Lend) {
+  constructor(store: Store, loader: Loader = async () => ({})) {
     this.store = store;
     this.loader = loader;
-    this.lend = lend;
   }
 
-  protected lendFor(_name: string, _record: WardRecord): Lend | undefined {
-    return this.lend;
+  protected boxFor(name: string, _record: WardRecord): Promise<Invitation | undefined> {
+    return this.offering?.(name) ?? Promise.resolve(undefined);
   }
 
   // Boot every ward the store keeps, and learn the hints. One ward that will
@@ -237,7 +236,7 @@ export class Harbor {
     const moved: string[] = [];
     for (const row of s.kept.keys()) {
       const was = s.kept.get(row);
-      const now = rowsOf(s.memory, [row])[0]![1];
+      const now = rowsOf(s.memory, [row])[0][1];
       if (JSON.stringify(was) === JSON.stringify(now)) continue;
       restoreRow(s.memory as unknown as Partition, row, was);
       moved.push(row);
@@ -283,7 +282,7 @@ export class Harbor {
   // rows where the store already has them.
   #settle(name: string, s: Saving): void {
     for (const [row, value] of s.under) {
-      const now = rowsOf(s.memory, [row])[0]![1];
+      const now = rowsOf(s.memory, [row])[0][1];
       if (JSON.stringify(value) === JSON.stringify(now)) s.kept.set(row, value);
       else s.dirty.add(row);
     }
@@ -546,13 +545,14 @@ export class Harbor {
     const objects = new WeakMap<object, BeingLike>(); // cells -> the object instantiate made. a side's hand, never the ward's; it follows the cells out when she is unbooted
     const ground: Ground = {
       seed,
-      memory,
       // This ward's own classes first, then the harbor's: a ward that names a
       // class of its own is answered with hers.
       instantiate: maker(objects, classes, this.classes),
       carry: (pk, bytes) => this.carry(pk, new Uint8Array(bytes)),
       random,
-      wrote: (row) => this.#wrote(name, row),
+      memory: {
+        rows: memory,
+        told: (row) => this.#wrote(name, row),
       // What the ward wrote is in the store when this resolves, and it says
       // whether the store took it. The ward calls it at the end of every
       // arrival, before it seals, so a call through a pointer has already
@@ -566,7 +566,7 @@ export class Harbor {
       // A ward on its way out keeps nothing and refuses nothing: an arrival
       // racing an unhost is not a store saying no, and saying so would be a
       // lie in the one direction that matters.
-      keep: async () => {
+      kept: async () => {
         const s = this.#saving.get(name);
         if (!s || s.gone) return true;
         const ok = await this.#flush(name);
@@ -585,7 +585,7 @@ export class Harbor {
       // ward back. The ward is the one that knows, because a being reaching
       // another being of her own ward goes to that ward's door directly and
       // the harbor never sees that call at all.
-      calling: () => {
+      during: () => {
         const s = this.#saving.get(name);
         if (!s) return () => {};
         s.calls += 1;
@@ -603,9 +603,10 @@ export class Harbor {
           else this.#settle(name, s);
         };
       },
+      },
     };
-    const lend = this.lendFor(name, kept.record);
-    if (lend) ground.lend = lend;
+    const box = await this.boxFor(name, kept.record);
+    if (box) ground.box = box;
     // What the store holds for this ward at birth is what it was just handed
     // or just read, row by row. It is copied once here so that a being whose
     // very first write of this run is refused is put back too, rather than
@@ -633,7 +634,7 @@ export class Harbor {
     // here. It answers nothing, because a caller inside the process reads
     // the fault off the harbor and an arrival is the only thing that needs a
     // verdict of its own.
-    const save = async (): Promise<void> => void (await ground.keep?.());
+    const save = async (): Promise<void> => void (await ground.memory.kept());
     const door = (bytes: Uint8Array) => w.door(bytes);
     const ask = async (method?: string, args?: Record<string, unknown>) => {
       if (saving.gone) return silence;

package/src/harbor/index.ts

@@ -11,7 +11,10 @@ export { MemoryStore, values, rowsOf, type Store, type Kept, type WardRecord } f
 // a being, and the partition back from the rows it was cut into.
 export { HEAD, fromRows, rowsIn } from '../ward/partition.ts';
 export { request, Socket, SUITE, REFUSED, type Reach, type Carry, type Line, type Announce } from './reach.ts';
-export type { Ground, WardPointers, Lend } from '../ward/ground.ts';
+export type { Ground, WardPointers, Memory } from '../ward/ground.ts';
+export { BOX, OFFER, RETRACT, volatile } from '../ward/ground.ts';
+// The box as one being, and the acts a harbor runs to stand it.
+export { Box, BOX_SEED, BOX_ASKS, stand, hold, offerTo, roll } from './box.ts';
 // What a harbor builds a ground out of. Convenience, never contract: a kit
 // writing its own harbor may write these three again.
 export { maker, entropy, learnPk } from '../ward/ground.ts';

package/src/harbor/memory.ts

@@ -4,9 +4,17 @@
 // keeping TWO pointers. Routes one ward pk to one door. Knows no being,
 // reads no partition, opens no byte. Several memory harbors may be linked,
 // which stands in for a wire, and cut, which stands in for weather.
-import type { BeingClass, BeingLike } from '../being/types.ts';
-import { maker, entropy, learnPk, type Ground, type WardPointers, type Lend } from '../ward/ground.ts';
+//
+// It works in acts, as every harbor does. `up` is act one: the box's own
+// ward on the plain ground, the box's being and the lent beings in it.
+// `host` is act two for one ward: on the roll, and handed one invitation
+// on the box's being. A
+// ward booted with `boot` alone is handed no box and lends nothing, which is
+// what a suite of the ward wants.
+import type { BeingClass, BeingLike, Invitation } from '../being/types.ts';
+import { maker, entropy, learnPk, volatile, type Ground, type WardPointers } from '../ward/ground.ts';
 import { hex } from '../ward/arithmetic.ts';
+import { Box, BOX_SEED, stand, offerTo, roll } from './box.ts';
 
 export type Booted = WardPointers & { pk: string };
 export type WardFactory = (ground: Ground) => Promise<WardPointers>;
@@ -47,22 +55,22 @@ export class MemoryHarbor {
     harbor.peers.add(this);
   }
 
-  // boot by seed. the harbor gets a door and an ask, and learns the pk by asking.
-  // `lend` is what this device lends the ward's beings, and a test's stand-in
-  // for a real terrain's: left out, every name answers null.
-  async boot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, lend?: Lend): Promise<Booted> {
+  // boot by seed. the harbor gets a door and an ask, and learns the pk by
+  // asking. `box` is the invitation on this device's box being, for this
+  // ward: left out, the ward holds no box and every lend is null.
+  async boot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, box?: Invitation): Promise<Booted> {
     this.partitions.set(seed, {});
-    return this.reboot(seed, Ward, classes, lend);
+    return this.reboot(seed, Ward, classes, box);
   }
 
   // a restart: same seed, same partition, fresh ward. the ward's files are the harbor's to keep.
-  async reboot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, lend?: Lend): Promise<Booted> {
-    const memory = this.partitions.get(seed);
-    if (!memory) throw new Error(`no partition for ${seed}`);
+  async reboot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, box?: Invitation): Promise<Booted> {
+    const rows = this.partitions.get(seed);
+    if (!rows) throw new Error(`no partition for ${seed}`);
     const ground: Ground = {
       seed,
-      memory,
-      ...(lend ? { lend } : {}),
+      memory: volatile(rows),
+      ...(box ? { box } : {}),
       // One objects map for the whole harbor, not one per ward: every ward
       // here is in this process and a test reaches any being of any of them.
       instantiate: maker(this.objects, classes),
@@ -80,4 +88,36 @@ export class MemoryHarbor {
     this.wards.set(seed, booted);
     return booted;
   }
+
+  // Act one. The box's own ward, the box's being and the lent beings named,
+  // each booted under its name and held by her under it. Run again on a
+  // harbor whose box ward stands, it changes nothing.
+  async up(Ward: WardFactory, lent: Record<string, BeingClass> = {}): Promise<Booted> {
+    const classes: Record<string, BeingClass> = { Box };
+    for (const C of Object.values(lent)) classes[C.name] = C;
+    const box = this.wards.get(BOX_SEED) ?? (await this.boot(BOX_SEED, Ward, classes));
+    await stand(box, lent);
+    return box;
+  }
+
+  get box(): Booted | undefined {
+    return this.wards.get(BOX_SEED);
+  }
+
+  // Act two, one ward: on the roll and handed one invitation on the box's being.
+  // A harbor with no box ward up hosts as `boot` does, with nothing.
+  async host(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>): Promise<Booted> {
+    const box = this.box;
+    const inv = box ? await offerTo(box, seed) : undefined;
+    return this.partitions.has(seed) ? this.reboot(seed, Ward, classes, inv) : this.boot(seed, Ward, classes, inv);
+  }
+
+  // Act two, whole: the box's being says who is hosted, and each comes up.
+  async hosted(Ward: WardFactory, classes: Record<string, BeingClass>): Promise<string[]> {
+    const box = this.box;
+    if (!box) return [];
+    const seeds = await roll(box);
+    for (const seed of seeds) await this.host(seed, Ward, classes);
+    return seeds;
+  }
 }

package/src/harbor/reach.ts

@@ -20,6 +20,7 @@
 // A reach that sent the bytes and lost the line afterwards answers nothing
 // at all, and the ward's own bound ends the ask.
 import { concat, hex, unhex } from '../ward/arithmetic.ts';
+import { readJson } from '../ward/json.ts';
 
 export type Carry = (pk: string, bytes: Uint8Array) => Promise<Uint8Array | undefined>;
 export type Reach = { carry: Carry; close(): void };
@@ -136,7 +137,8 @@ export class Socket implements Reach {
     line.addEventListener('message', (e) => {
       if (typeof e.data === 'string') {
         try {
-          const m = JSON.parse(e.data) as { announce?: unknown; suite?: unknown };
+          const m = readJson(e.data) as { announce?: unknown; suite?: unknown };
+          if (m === null || typeof m !== 'object') return;
           // Absent is this suite: a side that says nothing says one.
           if (m.suite !== undefined && m.suite !== SUITE) {
             this.far = [];
@@ -153,9 +155,13 @@ export class Socket implements Reach {
         return;
       }
       const buf = e.data instanceof ArrayBuffer ? new Uint8Array(e.data) : ArrayBuffer.isView(e.data) ? new Uint8Array(e.data.buffer, e.data.byteOffset, e.data.byteLength) : undefined;
+      // A frame that is none of the three is not a frame: an unknown kind, an
+      // ask too short to hold a pk, a nothing with bytes after its id. It is
+      // dropped, and tells no ask waiting on its id that nothing was delivered.
       if (!buf || buf.length < 5) return;
       const kind = buf[0],
         id = new DataView(buf.buffer, buf.byteOffset, buf.byteLength).getUint32(1);
+      if (kind > NONE || (kind === ASK && buf.length < 69) || (kind === NONE && buf.length !== 5)) return;
       if (kind === ASK) {
         const pk = hex(buf.subarray(5, 69));
         // A deliver that rejects has delivered nothing this side can vouch

package/src/harbor/store.ts

@@ -46,7 +46,7 @@ export const values = (p: Record<string, unknown>): Record<string, unknown> => J
 export const rowsOf = (partition: Record<string, unknown>, rows: readonly string[]): [string, Record<string, unknown> | undefined][] =>
   rows.map((row) => {
     const value = rowOf(partition as unknown as Partition, row);
-    return [row, value === undefined ? undefined : (values(value) as Record<string, unknown>)];
+    return [row, value === undefined ? undefined : (values(value))];
   });
 
 // One store's copy, brought up to date with the rows it was told about.

package/src/vector/cases.ts

@@ -18,9 +18,10 @@
 import { Ward } from '../ward/ward.ts';
 import * as seal from '../ward/seal.ts';
 import { hex } from '../ward/arithmetic.ts';
+import { digest } from '../being/digest.ts';
 import type { Json, JsonObject } from '../being/types.ts';
 import type { Booted } from '../harbor/memory.ts';
-import { world, sealed, bound, secret, rnd, partitionDigest, Caller } from './world.ts';
+import { world, sealed, bound, secret, rnd, drawn, partitionDigest, Caller } from './world.ts';
 import type { World, Hand, Sealed } from './world.ts';
 
 export type DoorRecord = {
@@ -33,9 +34,9 @@ export type DoorRecord = {
   ask: string; // hex, exactly as the bytes arrive
   reply: string; // hex, exactly as they leave
   opens: Json | null; // what the reply opens to where the hand holds the lid's secret
-  before: string; // the partition's digest before the door judged
-  after: string; //  and after. equal is `nothing written`
-  wrote: boolean; // the two digests differ. a refusal never sets it
+  draws: number; // how many words of the stream were spent before the arrival
+  blueprint?: JsonObject; // the shape `seen` is the digest of, where a reply carries one
+  wrote: boolean; // the partition changed while the door judged. a refusal never sets it
 };
 
 // `pin` is where the case's own setup ends and the arrival begins. A record
@@ -50,21 +51,43 @@ export type Case = { case: string; name: string; state: string; ward: string; ar
 
 // Stand one case: its world, its setup, its ask. What comes back is enough
 // to knock, and enough for a verifier to check the hand before the door.
-export async function stand(c: Case): Promise<{ w: World; before: string; arrival: Arrival }> {
+export async function stand(c: Case): Promise<{ w: World; before: string; draws: number; arrival: Arrival }> {
   const w = await world();
   let before = await partitionDigest(w.b, c.ward);
   const arrival = await c.arrive(w, async () => {
     before = await partitionDigest(w.b, c.ward);
   });
-  return { w, before, arrival };
+  // Where the stream stands now, which is where the door is about to draw
+  // from. A kit that stood this case its own way sets its stream here.
+  return { w, before, draws: drawn(), arrival };
+}
+
+// The blueprint a reply's `seen` was taken over. The host is the only being
+// in this world whose shape reaches a stranger, and the asker is the id her
+// heir was opened for, so there is one blueprint to find and it is checked
+// against the digest before it is written down.
+async function shown(w: World, seen: string): Promise<JsonObject | undefined> {
+  for (const id of Object.keys(w.host.cells.occupants)) {
+    const bp = w.host.describe({ id }) as unknown as JsonObject;
+    if ((await digest(bp)) === seen) return bp;
+  }
+  return undefined;
 }
 
 async function record(c: Case): Promise<DoorRecord> {
-  const { w, before, arrival } = await stand(c);
+  const { w, before, draws, arrival } = await stand(c);
   const judged = await arrival.door.door(arrival.ask.bytes);
   const after = await partitionDigest(w.b, c.ward);
   const opens = arrival.ask.open ? ((await arrival.ask.open(judged.bytes)) as Json | null) : null;
-  return { case: c.case, name: c.name, state: c.state, ward: c.ward, kind: arrival.kind, heard: judged.heard, ask: hex(arrival.ask.bytes), reply: hex(judged.bytes), opens, before, after, wrote: before !== after };
+  // A reply that carries `seen` carries a being's shape on the wire, which is
+  // the one place in this corpus where what a being answers reaches a
+  // stranger. So the blueprint that digest is taken over is written down
+  // beside it: a kit stands a being that answers exactly this to the empty
+  // ask, and its door's bytes are these bytes. Every other record is the
+  // door alone and needs no being at all.
+  const seen = opens !== null && typeof opens === 'object' && !Array.isArray(opens) ? (opens).seen : undefined;
+  const blueprint = typeof seen === 'string' ? await shown(w, seen) : undefined;
+  return { case: c.case, name: c.name, state: c.state, ward: c.ward, kind: arrival.kind, heard: judged.heard, draws, ask: hex(arrival.ask.bytes), reply: hex(judged.bytes), opens, ...(blueprint ? { blueprint } : {}), wrote: before !== after };
 }
 
 // One after another and never at once: the cases share one stream, and two
@@ -142,10 +165,15 @@ export const cases: Case[] = [
     name: 'she is not there',
     state: 'the ward restarted without her class: her heirs stand and she does not',
     ward: 'B',
+    // Under the key she bound: the heir was spent by her knock and admits
+    // nothing now, so an arrival signed with its secret would be D6 and not
+    // this case. Her own key is what the door holds for her, and it is the
+    // key that hears the word.
     arrive: async (w, pin) => {
+      const b = await bound(w);
       const WB = await w.b.reboot('B', Ward, { Caller });
       await pin();
-      return at(WB, w.inv.heir!, 'word', { signer: secret(w.inv), next: 'a'.repeat(64) });
+      return at(WB, b.inv.heir!, 'word', { signer: b.own });
     },
   },
   {

package/src/vector/stand.ts

@@ -18,6 +18,7 @@
 // world runs on.
 import { SUITE } from '../harbor/reach.ts';
 import { hex } from '../ward/arithmetic.ts';
+import { readJson } from '../ward/json.ts';
 import { caseNamed, stand } from './cases.ts';
 import type { World } from './world.ts';
 import { partitionDigest } from './world.ts';
@@ -44,7 +45,7 @@ export class Stand {
     if (method === 'POST' && p === '/stand') {
       let named: { case?: unknown; name?: unknown };
       try {
-        named = JSON.parse(new TextDecoder().decode(body)) as typeof named;
+        named = readJson(body) as typeof named;
       } catch {
         return NONE;
       }