nervur 0.19.2 → 0.20.0

package/src/ward/stance.ts

@@ -1,433 +1,198 @@
 // SPDX-License-Identifier: Apache-2.0
-// The one stance builder. Used for every being the ward boots. Nothing
-// outer is in what she holds: ids in, values out, keys in the bind table.
-import { silence, isSilence, isWord, unreached, word, wordOf } from '../being/silence.ts';
-import { digest } from '../being/digest.ts';
-import { RESERVED_IDS, isBlueprint } from '../being/types.ts';
-import type { Answer, Cells, Invitation, JsonObject, Silence, Stance, Standing, Standings, Wanted, Word } from '../being/types.ts';
-import { at, put, drop, prune, type Bind, type StandingKeys } from './partition.ts';
-import { allow, within, LATE } from './allowance.ts';
-import { isHex, isWardPk, type ReplyPayload } from './seal.ts';
-import { cellFault, unkeepable } from './cells.ts';
-
-// What the stance needs from its ward, and no more.
-export type Inside = {
-  pk: string;
-  // Is the being this stance was built for still one of the ward's? Unboot
-  // takes her door and her rows, but a class whose code is still running
-  // holds the stance closure, and everything in it still points at live
-  // objects. Read before every call, so a being taken out reaches nothing.
-  live(): boolean;
-  mintKey(bind: Bind): Promise<{ seed: string; pk: string }>; // a fresh signing key, recorded as minted
-  openHeir(heir: string, being: string, id: string): void;
-  closeHeir(heir: string): void;
-  // one send for every destination. the far door's reply, silence, or unreached.
-  // signs as keys.current, mints and announces keys.next where the relation has
-  // a heir to rotate on, and rotates keys on an answer.
-  send(bind: Bind, keys: StandingKeys, method: string | undefined, args: JsonObject, wanted: Wanted | undefined): Promise<ReplyPayload | Silence | Word>;
-  // a new being of this ward, as the owner's boot makes one. the key, or null.
-  instantiate(className: string, key: string): string | null;
-  // mint an occupant on a being of this ward, for the being who made her.
-  relate(key: string, id: string): Promise<Invitation | null>;
-  // an invitation to one of the harbor's own beings, by the harbor's name for
-  // it, handed to the taker and never returned. false where this box lends
-  // nothing of that name to this ward, or where the taker did not take it, in
-  // which case the harbor has already removed what it minted.
-  lend(name: string, take: (invitation: Invitation) => Promise<boolean>): Promise<boolean>;
-  // take a being of this ward out again, with every relation she holds.
-  unmake(key: string): void;
-  // the bind table was written: a record put, dropped or moved on.
-  wrote(): void;
-};
-
-// An invitation as it travels: the far ward's pk, the heir pk, the heir's secret seed. Or just the ward, for its public being.
-type SealedInvitation ={ ward: string; heir?: string; secret?: string };
+// One being's stance: her cells, the ids she invited, the relations she
+// holds, and boot. Every relation she holds speaks through `quo/`'s
+// standing, one send at a time, inside her allowance.
+import { readValue, writeValue } from '../crypto/index.ts';
+import { readInvitation, Standing as Wire, freshStanding, type Door, type Draw, type Invitation, type Read } from '../quo/index.ts';
+import type { Clock } from '../contract/index.ts';
+import { OWNER, silence, word, type Answer, type JsonObject, type Occupants, type Stance, type Standing, type Standings, type Wanted } from '../being/index.ts';
+import { allow, Bell, LATE } from './allowance.ts';
+import type { BeingRow, Partition } from './partition.ts';
+import { Cells, DEPTH } from './cells.ts';
+
+export { DEPTH };
+
+// What a stance needs from its ward.
+export interface Inside {
+  readonly partition: Partition;
+  readonly door: Door;
+  readonly draw: Draw;
+  readonly clock: Clock;
+  live(key: string, row: BeingRow): boolean;
+  send(pk: string, bytes: Uint8Array): Promise<Uint8Array | null>;
+  boot(maker: string, className: string, key: string, id?: string): Promise<string | null>;
+  // An offer from the faculty the dock opened for a contract, and its
+  // retraction when the offer was not taken.
+  offer(contract: string): Promise<Invitation | null>;
+  retract(contract: string, heir: string): Promise<void>;
+}
 
-// The three calls on `standings` share the object with the ids she takes, so
-// a standing named after one of them would be unreachable: `standings.knock`
-// is the call, whatever record sits under that name. One namespace means one
-// list: these are refused at invite and at take, beside the ward's own words.
-const CALLS = ['knock', 'take', 'remove'];
+const RESERVED = new Set([OWNER]);
 
-export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bind): Stance {
-  // A word the ward refuses at every mint and every take. The two the
-  // protocol names, and the ones this kit adds because its own spelling took
-  // them: the calls a standing already answers to, and a name no partition
-  // can hold. That last one is refused here rather than by the cells guard,
-  // because the guard throws and this table promises a null.
-  // A method is a word or it is nothing at all. The seal writes a payload as
-  // JSON, which drops a key whose value it cannot write, so a symbol or a
-  // function here would leave as an ask with no method: the empty ask. She
-  // would have asked for work, been handed a blueprint, and spent a number on
-  // it. Nothing that cannot be sent is sent, and what never left is unreached,
-  // which is the one answer that says asking again is safe. This is the same
-  // rule args are already held to.
-  const named = (method: unknown): boolean => method === undefined || typeof method === 'string';
-  const reserved = (id: string): boolean => RESERVED_IDS.includes(id) || CALLS.includes(id) || unkeepable(id);
-  // The name of one relation, as her side files it. A relation is a ward and
-  // a heir, never a heir alone: the heir pk is outer, it rides in the clear on
-  // every lid, and anyone who reads one can quote it back inside an invitation
-  // naming a ward of their own. Filed under the heir alone, that invitation
-  // would share her knock record with the relation the heir really belongs to:
-  // it would sign with that relation's key, and an answer to it would set the
-  // answered flag the other relation is taken on. Both halves, always.
-  const nameOf = (inv: SealedInvitation) => (inv.heir === undefined ? `public:${inv.ward}` : `${inv.ward}:${inv.heir}`);
-  const valid = (inv: unknown): inv is SealedInvitation => {
-    const i = inv as SealedInvitation;
-    if (!i || typeof i !== 'object' || !isWardPk(i.ward)) return false;
-    if (i.heir === undefined) return i.secret === undefined;
-    return isHex(i.heir) && isHex(i.secret);
-  };
+// How many times a take asks again after its knock brought no object.
+const TAKES = 2;
 
-  // One relation, one ask at a time. The rotation is a conversation: a send
-  // reads the key that speaks now, announces the next, and moves to it once
-  // the far door has answered. Two sends interleaving on one relation read
-  // each other's half-written keys and the two sides diverge, which no later
-  // ask can repair. So each relation has a lane, and a send waits for the one
-  // before it. Beings may still ask concurrently: the lanes are per relation,
-  // and a slow relation never holds up another.
-  const lanes = new Map<string, Promise<unknown>>();
-  const lane = <T>(name: string, run: () => Promise<T>): Promise<T> => {
-    const mine = (lanes.get(name) ?? Promise.resolve()).then(run, run);
-    const quiet = mine.then(
-      () => {},
-      () => {},
-    );
-    lanes.set(name, quiet);
-    void quiet.then(() => {
-      if (lanes.get(name) === quiet) lanes.delete(name); // the lane is idle. nothing to remember.
+// One relation, one send at a time.
+class Lanes {
+  readonly #tails = new Map<string, Promise<unknown>>();
+  run<T>(name: string, work: () => Promise<T>): Promise<T> {
+    const mine = (this.#tails.get(name) ?? Promise.resolve()).then(work, work);
+    const tail = mine.catch(() => {});
+    this.#tails.set(name, tail);
+    void tail.then(() => {
+      if (this.#tails.get(name) === tail) this.#tails.delete(name);
     });
     return mine;
-  };
-
-  // Every ask a being makes, bounded. The bound is outside the lane on
-  // purpose: an ask that waits its turn behind a relation that comes back
-  // round never reaches a send, and a bound that only watched the wire would
-  // never see it hang. A bound that ran out is the word late, never
-  // unreached: unreached promises nothing was delivered and is safe to ask
-  // again, and a wait that gave up knows no such thing.
-  //
-  // The bell rings before the work is reached, too: an ask that was still
-  // waiting its turn when the wait ran out is never sent. Sent then, it would
-  // be a fresh ask nobody is waiting on, the far being would do the work, and
-  // what came back would be read into her cells behind a silence she was
-  // already handed. So the work is given the bell, and reads it at the lane.
-  const bounded = async (wanted: Wanted | undefined, work: (live: () => boolean) => Promise<Answer>): Promise<Answer> => {
-    let late = false;
-    const out = await within(allow(wanted).time, work(() => !late), () => {
-      late = true;
-    });
-    return out === LATE ? word('late') : out;
-  };
-
-  // What one send came back as, read in one place for every path that sends.
-  // A reply that opened and was signed by the far ward is the door speaking,
-  // whatever it said: an object, its silence, or a word. Bytes that were not
-  // Quo's, late and unreached are not the door speaking, and say nothing
-  // about whether it heard.
-  type Read = { answer: Answer; door: boolean; seen: string | null };
-  const read = (r: ReplyPayload | Silence | Word): Read => {
-    if (isSilence(r) || isWord(r)) return { answer: r, door: false, seen: null };
-    if ('silence' in r) return { answer: silence, door: true, seen: null };
-    if ('quo' in r) return { answer: word(r.quo), door: true, seen: null }; // the far door's word for her, sealed to her lid
-    return { answer: r.object, door: true, seen: r.seen };
-  };
-  // Whether the door spent the heir this send spoke under. An object, the
-  // door's silence and threw all mean it was honoured. A refusal word wrote
-  // nothing and says so. Anything that is not the door speaking says nothing.
-  const honoured = (r: Read): boolean => r.door && !(isWord(r.answer) && wordOf(r.answer) !== 'threw');
-  const answered = (r: Read): boolean => r.door && !isSilence(r.answer) && !isWord(r.answer);
-
-  // The ask is bounded twice with one budget, once around the lane and once
-  // around the wire, and the two bells are microseconds apart. A reply that
-  // lands between them is a reply she was already told was late: its keys are
-  // rotated, since the far door rotated too and nothing may un-rotate that,
-  // but nothing of it is written into her cells. What she was handed is the
-  // last word on what she saw.
-  const send = async (keys: StandingKeys, method: string | undefined, args: JsonObject, wanted: Wanted | undefined, rec?: Cells['standings'][string], live: () => boolean = () => true): Promise<Answer> => {
-    const r = read(await inside.send(bind, keys, method, args, wanted));
-    if (rec && method !== undefined && r.seen !== null && live()) rec.seen = r.seen; // the digest rode along
-    return r.answer;
-  };
+  }
+}
 
-  const knocking = async (inv: SealedInvitation, method: string | undefined, args: JsonObject, wanted: Wanted | undefined, live: () => boolean = () => true): Promise<Answer> => {
-    const name = nameOf(inv);
-    // Taken while this knock waited its turn: the relation lives in the
-    // standing now and speaks on its lane, under its keys and its count.
-    const taken = takenAs(name);
-    if (taken !== undefined) {
-      const keys = at(bind.standings, taken);
-      if (!keys) return word('dropped');
-      return lane(`ask:${taken}`, () => asking(taken, keys, at(cells.standings, taken), method, args, wanted, live));
-    }
-    // her own key for this relation, minted once: rotation two. reused if she knocks again.
-    const k = (bind.knocks[name] ??= { current: (await inside.mintKey(bind)).seed, next: null, spoke: false, sent: false, seq: 0 });
-    prune(bind.knocks, bind.answered); // this one is the newest, so it stays and the oldest never answered goes
-    // The first knock on a heir speaks as the heir, the key the inviter
-    // handed out, and announces her own. Once the door has honoured it the
-    // heir is spent, whatever she then said, and her own key speaks; a heir
-    // spent once stays spent.
-    //
-    // She sent once as the heir and the door did not speak: nothing came
-    // back, or bytes that were not Quo's, or the wait ran out. Either the
-    // door heard, spent the heir and rotated to the key she announced, or
-    // nothing arrived and the heir still stands. Only the far door knows,
-    // and it will not say.
-    //
-    // So she asks, and the asking tells her. Under her own key: if the door
-    // heard, that key is the one it admits, and she is answered, or told the
-    // door's word. If it did not, the key means nothing there, the ask is
-    // refused, and a refusal at that door writes nothing: the heir is
-    // untouched and still speaks. Then she knocks as the heir, as she would
-    // have. One extra round trip in the one case where a reply was lost, and
-    // the relation is not stranded.
-    //
-    // No stranger gains anything by it: whoever holds the invitation could
-    // always knock as the heir, and her own key is admitted only where the
-    // door already bound it to her.
-    if (inv.heir !== undefined && !k.spoke && k.sent) {
-      const own: StandingKeys = { ward: inv.ward, heir: inv.heir, current: k.current, next: k.next, seq: k.seq };
-      const r = read(await inside.send(bind, own, method, args, wanted));
-      k.seq = own.seq;
-      k.current = own.current;
-      k.next = own.next;
-      inside.wrote();
-      if (!r.door) {
-        // Nothing the door said. Unreached and late are hers to hear now; bytes
-        // that were not Quo's leave her where she was, and the heir is tried.
-        if (!isSilence(r.answer)) return r.answer;
-      } else if (!isSilence(r.answer)) {
-        // The door spoke to her own key, so it heard the first knock: this is
-        // the answer, or the door's word for her. Its silence alone cannot be
-        // told from a refusal, so silence is followed by the knock as the heir,
-        // which the door then refuses if it had heard, and she hears silence.
-        k.spoke = true;
-        if (answered(r)) bind.answered[name] = true;
-        return r.answer;
-      }
-    }
+const answerOf = (read: Read): Answer => {
+  if ('nothing' in read) return word('unreached');
+  if ('silence' in read) return silence;
+  if ('quo' in read) return word(read.quo);
+  return readValue(read.object, DEPTH) ?? silence;
+};
 
-    const first = inv.heir !== undefined && !k.spoke;
-    const keys: StandingKeys = first ? { ward: inv.ward, heir: inv.heir!, current: inv.secret!, next: k.current, seq: k.seq } : { ward: inv.ward, heir: inv.heir ?? null, current: k.current, next: k.next, seq: k.seq };
-    const r = read(await inside.send(bind, keys, method, args, wanted));
-    k.sent = true; // bytes went out. whether they arrived is the far door's to know.
-    // The number she spoke under, and the key she announced, kept whoever
-    // answered and kept when nobody did. A reply lost on the way back is a
-    // door that has already honoured the number: she must not offer it twice,
-    // or a road that drops one reply silences the relation for good.
-    k.seq = keys.seq;
-    if (!first) {
-      k.current = keys.current;
-      k.next = keys.next;
+export class WardStance implements Stance {
+  readonly key: string;
+  readonly occupants: Occupants;
+  readonly standings: Standings;
+  readonly #inside: Inside;
+  readonly #row: BeingRow;
+  readonly #lanes = new Lanes();
+  readonly #cells = new Cells(() => this.#told());
+
+  constructor(inside: Inside, key: string, row: BeingRow) {
+    this.key = key;
+    this.#inside = inside;
+    this.#row = row;
+    this.occupants = {
+      invite: (id, notes) => this.#invite(id, notes),
+      notes: (id) => (Object.hasOwn(row.occupants, id) ? row.occupants[id]!.notes : undefined),
+      ids: () => Object.keys(row.occupants),
+      remove: (id) => this.#removeOccupant(id),
+    };
+    this.standings = {
+      take: (id, invitation) => this.#take(id, invitation),
+      get: (id) => this.#standing(id),
+      ids: () => Object.keys(row.standings),
+      remove: (id) => this.#removeStanding(id),
+    };
+  }
+
+  get cells(): JsonObject {
+    return this.#cells.guard(this.#row.cells);
+  }
+
+  get #live(): boolean {
+    return this.#inside.live(this.key, this.#row);
+  }
+
+  boot(className: string, key: string, id?: string): Promise<string | null> {
+    return this.#live ? this.#inside.boot(this.key, className, key, id) : Promise.resolve(null);
+  }
+
+  async lend(contract: { readonly name: string }, id: string): Promise<string | null> {
+    if (!this.#free(id, this.#row.standings)) return null;
+    const invitation = await this.#inside.offer(contract.name);
+    if (invitation === null) return null;
+    const taken = await this.#take(id, invitation);
+    if (taken === null) await this.#inside.retract(contract.name, invitation.heir);
+    return taken;
+  }
+
+  #free(id: string, of: Record<string, unknown>): boolean {
+    return this.#live && typeof id === 'string' && !RESERVED.has(id) && !Object.hasOwn(of, id);
+  }
+
+  async #invite(id: string, notes: JsonObject = {}): Promise<Invitation | null> {
+    const kept = writeValue(notes, DEPTH);
+    if (!this.#free(id, this.#row.occupants) || kept === undefined) return null;
+    const { heir, invitation } = await this.#inside.door.invite();
+    if (!this.#free(id, this.#row.occupants)) {
+      this.#inside.door.remove(heir);
+      return null;
     }
-    if (honoured(r)) k.spoke = true;
-    if (answered(r)) bind.answered[name] = true;
-    inside.wrote();
-    return r.answer;
-  };
-
-  // The id she took this relation under, if she took it. One relation is one
-  // ward and one heir whichever door it is reached by, so the standing and the
-  // invitation answer to the same name.
-  const keyName = (k: StandingKeys) => (k.heir === null ? `public:${k.ward}` : `${k.ward}:${k.heir}`);
-  const takenAs = (name: string): string | undefined => Object.keys(bind.standings).find((id) => keyName(bind.standings[id]) === name);
-
-  // A being the ward has taken out reaches nothing through the stance she
-  // still holds. Her relations went with her, so every one of them reads as
-  // dropped, and nothing she asks for is made: a heir written here would name
-  // a being no door holds, and an id minted here would be handed to whoever
-  // is booted under her key next.
-  const gone = () => !inside.live();
-
-  const calls = {
-    knock: async (inv: Invitation, method?: string, args: JsonObject = {}, wanted?: Wanted): Promise<Answer> => {
-      if (gone()) return word('dropped');
-      if (!named(method)) return unreached();
-      if (!valid(inv)) return word('invitation'); // S1. nothing is sent
-      // She may knock again, and after take that knock is an ask: the relation
-      // has one home, so it answers on the standing's lane, under the
-      // standing's keys and its count. A second lane here would speak for the
-      // same relation, and the two would refuse each other.
-      const id = takenAs(nameOf(inv));
-      if (id !== undefined) return standingAt(id).ask(method, args, wanted);
-      return bounded(wanted, (live) => lane(`knock:${nameOf(inv)}`, () => (live() ? knocking(inv, method, args, wanted, live) : Promise.resolve(word('late')))));
-    },
-    // Take consumes. Until now the relation lived in the knock record, under
-    // the ward and the heir; from now it lives in the standing, under her id.
-    // It never lives in both: two records seeded from one relation are two
-    // lanes speaking for one line of keys and one count, and whichever spoke
-    // last holds it while the other is refused. She would read that refusal as
-    // the far being falling quiet, which is a thing a sovereign being may do,
-    // so the loss would look exactly like an answer she is owed nothing of.
-    // One relation, one home, and the invitation is spent: knocking it again
-    // is another consumed it, and taking it again births nothing.
-    //
-    // So it is spoken on the relation's lane, like every other word spoken
-    // for it. A take reads the count and the keys a knock writes, and copies
-    // them into the standing. Off the lane it reads them between a knock's
-    // send and its answer: the standing is born holding a number the far door
-    // is about to honour and a key it is about to rotate past, and her first
-    // ask on it is refused. The relation she took correctly would be dead
-    // because a second knock on the same invitation was careless.
-    take: async (id: string, inv: Invitation): Promise<string | null> => {
-      if (gone() || !valid(inv)) return null;
-      const name = nameOf(inv);
-      return lane(`knock:${name}`, () => {
-        if (!bind.answered[name]) return Promise.resolve(null);
-        // Standings and occupants are one namespace — invite and take each
-        // refuse a name the other holds — so a word reserved in one is
-        // reserved in both.
-        if (reserved(id) || at(cells.standings, id) || at(cells.occupants, id)) return Promise.resolve(null);
-        const k = bind.knocks[name];
-        put(bind.standings, id, { ward: inv.ward, heir: inv.heir ?? null, current: k.current, next: k.next, seq: k.seq }); // the count carries over: the standing goes on where the knock left off
-        put(cells.standings, id, { id, digest: null, blueprint: null, seen: null });
-        delete bind.knocks[name];
-        delete bind.answered[name];
-        inside.wrote();
-        return Promise.resolve(id);
-      });
-    },
-    remove: (id: string): void => {
-      if (gone()) return;
-      drop(cells.standings, id);
-      drop(bind.standings, id);
-      inside.wrote();
-    },
-  };
-
-  const standingAt = (id: string): Standing => ({
-    id,
-    // The keys are read now, not when the lane reaches this ask: an ask
-    // issued while the standing stood is answered even if she drops it in
-    // the next line. Waiting for the lane is not a reason to lose it.
-    ask: (method?: string, args: JsonObject = {}, wanted?: Wanted): Promise<Answer> => {
-      if (gone()) return Promise.resolve(word('dropped') as Answer);
-      if (!named(method)) return Promise.resolve(unreached() as Answer);
-      const keys = at(bind.standings, id);
-      if (!keys) return Promise.resolve(word('dropped') as Answer); // S2. she dropped it between one line and the next
-      const rec = at(cells.standings, id);
-      return bounded(wanted, (live) => lane(`ask:${id}`, () => (live() ? asking(id, keys, rec, method, args, wanted, live) : Promise.resolve(word('late')))));
-    },
-  });
-
-  // The record an ask writes into is the one it was issued on. A standing
-  // dropped and re-taken under the same id while the ask was in flight is
-  // another relation, and the blueprint that came back is not hers.
-  const asking = async (id: string, keys: StandingKeys, rec: Cells['standings'][string] | undefined, method: string | undefined, args: JsonObject, wanted: Wanted | undefined, live: () => boolean = () => true): Promise<Answer> => {
-    const out = await send(keys, method, args, wanted, rec, live);
-    if (method === undefined && !isSilence(out) && !isWord(out)) {
-      // A blueprint her cells cannot keep, nested past the bound or carrying
-      // a key no harbor writes, is not Quo's bytes: silence, and nothing written.
-      if (cellFault(out, 'blueprint') !== null) return silence;
-      if (rec && live() && at(cells.standings, id) === rec) {
-        // Read as a blueprint before it is kept as one. A far describe is
-        // somebody else's code and may answer anything; what is not a
-        // blueprint is not written as one, and she holds no blueprint for
-        // that relation rather than one a side would walk and break on. The
-        // answer itself is hers either way: it is returned below, unread.
-        rec.blueprint = isBlueprint(out) ? out : null;
-        rec.digest = rec.seen = await digest(out);
-      }
+    this.#row.occupants[id] = { heir, notes: JSON.parse(kept) as JsonObject };
+    this.#inside.partition.head.bind[heir] = { being: this.key, id };
+    this.#told();
+    this.#inside.partition.toldHead();
+    return invitation;
+  }
+
+  #removeOccupant(id: string): boolean {
+    if (!this.#live || !Object.hasOwn(this.#row.occupants, id)) return false;
+    const { heir } = this.#row.occupants[id]!;
+    this.#inside.door.remove(heir);
+    delete this.#row.occupants[id];
+    delete this.#inside.partition.head.bind[heir];
+    this.#told();
+    this.#inside.partition.toldHead();
+    return true;
+  }
+
+  async #take(id: string, value: Invitation): Promise<string | null> {
+    const invitation = readInvitation(value);
+    if (!invitation || !this.#free(id, this.#row.standings)) return null;
+    const wire = new Wire(invitation, freshStanding(), this.#inside.draw);
+    const read = await this.#lanes.run(`take:${id}`, async () => {
+      // A knock that brought nothing back may have bound: the standing asks
+      // under its own key, then knocks again as the same bytes.
+      let out = await this.#send(wire);
+      for (let tries = 0; tries < TAKES && ('nothing' in out || 'silence' in out); tries += 1) out = await this.#send(wire);
+      return out;
+    });
+    if (!('object' in read) || !this.#free(id, this.#row.standings)) return null;
+    this.#row.standings[id] = { invitation, state: wire.state, seen: read.seen };
+    this.#told();
+    return id;
+  }
+
+  #removeStanding(id: string): boolean {
+    if (!this.#live || !Object.hasOwn(this.#row.standings, id)) return false;
+    delete this.#row.standings[id];
+    this.#told();
+    return true;
+  }
+
+  #standing(id: string): Standing | undefined {
+    if (!Object.hasOwn(this.#row.standings, id)) return undefined;
+    return { id, ask: (method, args, wanted) => this.#ask(id, method, args, wanted) };
+  }
+
+  async #ask(id: string, method: unknown, args: JsonObject = {}, wanted?: Wanted): Promise<Answer> {
+    const text = writeValue(args, DEPTH + 1);
+    if ((method !== undefined && typeof method !== 'string') || text === undefined || Array.isArray(args)) return word('unreached');
+    const bell = new Bell(this.#inside.clock, allow(wanted));
+    try {
+      const out = await bell.race(
+        this.#lanes.run(`ask:${id}`, async (): Promise<Answer> => {
+          const row = Object.hasOwn(this.#row.standings, id) ? this.#row.standings[id] : undefined;
+          if (!this.#live || row === undefined) return word('dropped');
+          if (bell.rang) return word('late');
+          const wire = new Wire(row.invitation, row.state, this.#inside.draw);
+          const read = await bell.race(this.#send(wire, method as string | undefined, text));
+          row.state = wire.state;
+          if (read === LATE) return word('late');
+          if ('object' in read) row.seen = read.seen;
+          this.#told();
+          await this.#inside.partition.kept();
+          return answerOf(read);
+        }),
+      );
+      return out === LATE ? word('late') : out;
+    } finally {
+      bell.cancel();
     }
-    return out;
-  };
+  }
 
-  const standings = new Proxy(calls, {
-    // Own keys only: `in` would also find every name on Object's prototype,
-    // and a standing she took as `constructor` or `toString` would answer with
-    // Object's, not hers.
-    get: (t, id) => (typeof id === 'string' && Object.hasOwn(t, id) ? t[id as keyof typeof t] : typeof id === 'string' && at(cells.standings, id) ? standingAt(id) : undefined),
-  }) as unknown as Standings;
+  async #send(wire: Wire, method?: string, args?: string): Promise<Read> {
+    const sent = await wire.ask(method, args);
+    if (!sent) return { nothing: true };
+    return wire.read(sent, await this.#inside.send(wire.invitation.ward, sent.bytes));
+  }
 
-  return {
-    cells,
-    // A being may make. The ward refuses what it refuses the owner: a key
-    // already booted, a class the harbor does not hold, and a throw at birth
-    // leaves the partition as it was. Reaching into another is still the
-    // owner's alone: what a maker may have is a relation to what she made,
-    // by naming an id, and it is made the way every relation is. The being
-    // made mints an occupant for her maker under the maker's own key, so she
-    // knows who made her by that name and by nothing else; her maker knocks,
-    // takes it under the id she gave, and holds one standing like any other.
-    // Nothing half-lives: a relation that could not be made unmakes the
-    // being, who is a moment old and known to nobody.
-    boot: async (className: string, made: string, id?: string): Promise<string | null> => {
-      if (gone()) return null;
-      if (id !== undefined && (reserved(id) || at(cells.standings, id) || at(cells.occupants, id))) return null;
-      const born = inside.instantiate(className, made);
-      if (born === null || id === undefined) return born;
-      const inv = await inside.relate(born, key);
-      if (inv) {
-        const out = await calls.knock(inv);
-        if (!isSilence(out) && !isWord(out) && (await calls.take(id, inv)) === id) return born;
-      }
-      inside.unmake(born);
-      return null;
-    },
-    occupants: {
-      // rotation one: the ward mints the occupant's first key and gives the secret away.
-      // it keeps the pk beside the id and nothing else. the invitation IS the key.
-      invite: async (id: string, notes?: JsonObject): Promise<Invitation | null> => {
-        if (gone() || reserved(id) || at(cells.occupants, id) || at(cells.standings, id)) return null;
-        // Notes are values, like everything else the partition keeps, and a
-        // spread copies one level: an object inside them would stay the
-        // caller's, a handle into her cells that writes past the guard and
-        // never says `wrote`, so what a restart brought back would not be
-        // what she read. Held to the rule and copied whole, or no invitation.
-        if (notes !== undefined && cellFault(notes, 'notes') !== null) return null;
-        // The key first, and nothing written until it exists: a record put
-        // before the mint would be a record a remove in the meantime drops
-        // with no heir to close, and the heir opened after it would name an
-        // id nobody holds, for a later invite under that id to resurrect.
-        const k = await inside.mintKey(bind);
-        if (reserved(id) || at(cells.occupants, id) || at(cells.standings, id)) return null; // taken while the key was minted
-        // The notes are the terms the inviter minted under, hers to read on her
-        // gate. She may write more later; nobody outside ever writes them.
-        put(cells.occupants, id, { id, notes: notes ? (JSON.parse(JSON.stringify(notes)) as JsonObject) : {} });
-        inside.openHeir(k.pk, key, id);
-        put(bind.occupants, id, k.pk);
-        inside.wrote();
-        return { ward: inside.pk, heir: k.pk, secret: k.seed };
-      },
-      remove: (id: string): void => {
-        if (gone()) return;
-        drop(cells.occupants, id);
-        const heir = at(bind.occupants, id);
-        drop(bind.occupants, id);
-        if (heir) inside.closeHeir(heir); // the heir dies with the id
-        inside.wrote();
-      },
-    },
-    standings,
-    // A standing at one of the things this device can do. The same three
-    // moves her boot makes, with the harbor's root doing the inviting instead
-    // of a being of this ward: ask the ground for the name, knock with what
-    // comes back, take it under the id she gave. She is handed the id.
-    //
-    // The invitation never reaches her, and that is the difference between
-    // this relation and every other she holds. Her own invitations are hers
-    // to give away, because giving one away is giving away her own relation.
-    // This one is the device's, minted for this ward alone, and a value she
-    // could copy is a capability she could hand to anyone. A being who wants
-    // to lend her device access to another does it in the open, by an ask of
-    // her own that forwards to this standing, where her gate reads who is
-    // asking and she can stop.
-    lend: async (name: string, id: string): Promise<string | null> => {
-      if (gone() || typeof name !== 'string' || typeof id !== 'string') return null;
-      if (reserved(id) || at(cells.standings, id) || at(cells.occupants, id)) return null;
-      // Her half runs inside the harbor's call, so a knock that was refused
-      // and a take that lost the id both end with the harbor removing what it
-      // minted. Nothing half-lives here either.
-      const took = await inside.lend(name, async (inv) => {
-        // Read again: the ground was awaited, and a line of hers in between
-        // may have taken the id. Nothing is written for a relation she cannot
-        // hold, and the invitation goes back unspent.
-        if (gone() || reserved(id) || at(cells.standings, id) || at(cells.occupants, id)) return false;
-        const out = await calls.knock(inv);
-        if (isSilence(out) || isWord(out)) return false;
-        return (await calls.take(id, inv)) === id;
-      });
-      return took ? id : null;
-    },
-  };
+  #told(): void {
+    this.#inside.partition.told(this.key);
+  }
 }