nervur 0.19.2 → 0.20.0

package/src/ward/ward.ts

@@ -1,410 +1,276 @@
 // SPDX-License-Identifier: Apache-2.0
-// A ward that is its own ward. Booted by a harbor with one object, the
-// ground, and hands back two pointers: the door and the ask. Boots itself as
-// the first being in its own map, and every being it later instantiates gets
-// a stance built by the same code. Mints every key, seals every ask that
-// leaves, opens every one that arrives.
-import { silence, isSilence, unreached, isWord, word } from '../being/silence.ts';
-import { OWNER, isInvitation } from '../being/types.ts';
-import type { Asker, BeingLike, Cells, Invitation, JsonObject, Reply, Stance, Wanted, Word } from '../being/types.ts';
-import { BOX, OFFER, RETRACT, type Ground, type WardPointers } from './ground.ts';
-import { at, drop, open, put, emptyBind, emptyCells, HEAD, MINTED, type Bind, type Partition, type StandingKeys } from './partition.ts';
-import { Heirs } from './heirs.ts';
-import { makeDoor, type Door } from './door.ts';
-import { buildStance } from './stance.ts';
-import { ownerAnswer } from './owner.ts';
-import { allow, within, LATE } from './allowance.ts';
-import { beingKey, openReply, sealAsk, wardKey, wardPadlock, wardSignPk, type ReplyPayload, type WardKey } from './seal.ts';
-import { unhex } from './arithmetic.ts';
-import { guardCells, unguarded, cellFault } from './cells.ts';
+// The ward: one door, one partition, and the beings behind the door. It
+// unpacks from its seed, its memory and a catalogue of classes, the
+// ward-being first and every other being from her own row, and it stands
+// what is behind its door for `quo/`.
+import { readValue, writeValue } from '../crypto/index.ts';
+import { Door, readInvitation, WardKey, type Behind, type Choice, type Invitation, type Payload } from '../quo/index.ts';
+import type { Carrier, Clock, Entropy, Rows } from '../contract/index.ts';
+import { digest, isSilence, isWord, OWNER, silence, WARD, word, type Answer, type Asker, type BeingClass, type BeingLike, type JsonObject, type Reply } from '../being/index.ts';
+import { Partition, PartitionRelations, type BeingRow } from './partition.ts';
+import { DEPTH, WardStance, type Inside } from './stance.ts';
+import { WardBeing, type Steward, type WardBeingStance } from './ward-being.ts';
 
-// One being of the ward as the ward holds her: her door, her bind table, her
-// stance and her cells. The owner's asks see this and nothing more. Not
-// `Booted`, which is a harbor's word for a ward it started: this is a ward's
-// word for a being living in it, and the two are one module apart.
-export type Resident = Door & { bind: Bind; stance: Stance; cells: Cells & { class?: string } };
+// Where a ward finds a class by the name its row keeps.
+export interface Catalogue {
+  classOf(name: string): BeingClass | undefined;
+}
+
+export type WardParts = {
+  readonly seed: Uint8Array | string;
+  readonly memory: Rows;
+  readonly catalogue: Catalogue;
+  readonly entropy: Entropy;
+  readonly clock: Clock;
+  readonly carrier: Carrier;
+  // The ward-being: `WardBeing`, or a being that extends it.
+  readonly root?: (stance: WardBeingStance) => WardBeing;
+  // An invitation on the dock, taken by the ward-being under `dock` when
+  // she holds no such standing yet.
+  readonly dock?: Invitation;
+};
 
-// The ward. One call in, two pointers out. Async because keys are derived.
-export async function Ward(ground: Ground): Promise<WardPointers> {
-  const w = await Self.boot(ground);
-  return { door: w.door, ask: w.ask };
+// The standing every hosted ward's ward-being holds on the dock.
+export const DOCK = 'dock';
+
+// A ward-being that lends to her own ward's beings, as the dock does.
+export interface Lender {
+  offer(contract: string): Promise<Invitation | null>;
+  withdraw(contract: string, heir: string): Promise<void>;
 }
+const lends = (being: unknown): being is Lender => typeof (being as Partial<Lender>).offer === 'function';
 
-class Self implements BeingLike {
-  readonly key: WardKey;
-  readonly pk: string;
-  readonly g: Ground;
-  readonly p: Partition;
-  readonly heirs: Heirs;
-  readonly doors = new Map<string, Resident>();
-  readonly #birthing = new Set<string>(); // keys whose constructor is running: taken, though no door and no row say so yet
-  readonly door: WardPointers['door'];
-  readonly ask: WardPointers['ask'];
+type Birth = 'booted' | 'key taken' | 'no such class' | 'threw at birth';
+type Resident = { being: BeingLike; row: BeingRow; stance: WardStance };
 
-  // Birth, in order: the ward as its own first being, the box taken, and
-  // only then every being the partition names constructed again. A being
-  // who takes what her box lends does it at her birth, so the box must be
-  // hers to ask before she is born, or a restart would be the one birth at
-  // which the device lends nothing.
-  static async boot(ground: Ground): Promise<Self> {
-    const w = new Self(ground, await wardKey(ground.seed));
-    await w.#takeBox();
-    w.#reborn();
-    return w;
+class RootStance extends WardStance implements WardBeingStance {
+  readonly steward: Steward;
+  constructor(inside: Inside, row: BeingRow, steward: Steward) {
+    super(inside, WARD, row);
+    this.steward = steward;
   }
+}
+
+export class Ward implements Behind, Inside {
+  readonly key: WardKey;
+  readonly partition: Partition;
+  readonly door: Door;
+  readonly clock: Clock;
+  readonly #parts: WardParts;
+  readonly #residents = new Map<string, Resident>();
+  readonly #birthing = new Set<string>();
 
-  // The device, taken as one standing under `BOX` by the ward's own being,
-  // once: a ward woken from its partition already holds it. A knock that is
-  // not answered leaves the ward up and lending nothing this run.
-  async #takeBox(): Promise<void> {
-    const inv = this.g.box;
-    const mine = this.doors.get(this.pk)?.stance;
-    if (!inv || !mine || mine.standings[BOX]) return;
-    const out = await mine.standings.knock(inv);
-    if (isSilence(out) || isWord(out)) return;
-    await mine.standings.take(BOX, inv);
+  private constructor(parts: WardParts, key: WardKey) {
+    this.#parts = parts;
+    this.key = key;
+    this.clock = parts.clock;
+    this.partition = new Partition(parts.memory);
+    this.door = new Door(key, new PartitionRelations(this.partition), this, parts.entropy.drawer);
   }
 
-  // What this device lends this ward's beings: the box's being, asked to
-  // offer a name, answers the lent being's own invitation, and the taker knocks
-  // and takes it. The ward reads nothing in the value but that it is one.
-  async #lend(name: string, take: (inv: Invitation) => Promise<boolean>): Promise<boolean> {
-    const box = this.doors.get(this.pk)?.stance.standings[BOX];
-    if (!box) return false;
-    const inv = await box.ask(OFFER, { name });
-    if (!isInvitation(inv)) return false;
-    const took = await take(inv);
-    if (!took) await box.ask(RETRACT, { name, heir: inv.heir ?? null });
-    return took;
+  // The ward-being first, then every being her row names. A class the
+  // catalogue lacks, or one that throws, leaves that being absent and her
+  // row as it was.
+  static async unpack(parts: WardParts): Promise<Ward> {
+    const ward = new Ward(parts, await WardKey.from(parts.seed));
+    if (!ward.partition.being(WARD)) {
+      ward.partition.beings[WARD] = { class: '', cells: {}, occupants: {}, standings: {} };
+      ward.partition.told(WARD);
+      ward.partition.toldHead();
+    }
+    const own = ward.partition.being(WARD)!;
+    const stance = new RootStance(ward, own, ward.#steward);
+    const being = parts.root ? parts.root(stance) : new WardBeing(stance);
+    own.class = being.constructor.name;
+    ward.#residents.set(WARD, { being, row: own, stance });
+    if (parts.dock && !Object.hasOwn(own.standings, DOCK)) await stance.standings.take(DOCK, parts.dock);
+    for (const [key, row] of Object.entries(ward.partition.beings)) {
+      const C = key === WARD ? undefined : parts.catalogue.classOf(row.class);
+      if (C) ward.#bear(key, row, C);
+    }
+    return ward;
   }
 
-  private constructor(ground: Ground, key: WardKey) {
-    this.g = ground;
-    this.key = key;
-    this.pk = key.pk;
-    this.p = open(ground.memory.rows); // the partition: the ward's own state, and every being's row
-    // Opening is itself a write: a memory nobody has written comes back with
-    // a version stamped on it and the ward's own tables under it. A ward that
-    // said nothing here would have every being of it kept and the head that
-    // says which version they are written under kept by nobody, so the next
-    // boot would read a partition of no version and refuse it.
-    this.#wrote(HEAD);
-    this.heirs = new Heirs(this.p, () => this.#wrote(HEAD));
-    this.door = makeDoor(
-      key,
-      this.heirs,
-      this.doors,
-      () => this.p.public,
-      (n) => ground.random(n),
-      () => this.#keep(),
-    ); // pointer one
-    this.#boot(this.pk, () => this); // the ward's ward is itself
-    // pointer two. the owner. the same answer every named asker gets, asker filled in as owner.
-    this.ask = async (method, args = {}) => {
-      try {
-        const out = await this.answer({ id: OWNER }, method, args as JsonObject);
-        // The same question the door asks, in the same place: after she has
-        // answered and before the owner holds the answer. Silence is what a
-        // failed ask says here, so a store that refused is silence, and the
-        // owner reads it as it reads every other ask that did not take.
-        if (!(await this.#keep().catch(() => false))) return silence;
-        return isSilence(out) || isWord(out) ? silence : out;
-      } catch {
-        return silence;
-      }
-    };
+  get pk(): string {
+    return this.key.pk;
   }
 
-  #reborn(): void {
-    // a restart is silent: every being in the cells is constructed again, unasked.
-    // A throw on a boot the owner asked for is that boot's error, and nothing
-    // half-lives. This boot nobody asked for, and there is nobody to hand an
-    // error to. Any constructor may throw, a default that is not a value, an
-    // author's mistake, a shape she does not recognise after an upgrade, and
-    // let through here it is one being taking down the ward and every other
-    // being in it, on a restart. She is absent instead: no door, so silence
-    // at the door, and her cells sit untouched, waiting for the run that can
-    // read them. Her row stays hers: nobody boots another class over it, the
-    // owner sees her as absent, and the owner may unboot her.
-    for (const [k, c] of Object.entries(this.p.beings)) {
-      const className = c.class;
-      if (k === this.pk || !className) continue;
-      try {
-        this.#boot(k, (stance) => this.g.instantiate(className, stance));
-      } catch {
-        /* she is not here this run. the ward is, and so is everyone else. */
-      }
-    }
+  get draw() {
+    return this.#parts.entropy.drawer;
   }
 
-  // ---- the ward as a being. asked only by its owners: the root, through
-  // the ask pointer, and its occupants, through the door, whom only the root
-  // can invite. A stranger cannot be a named asker here, because the door
-  // names nobody the ward did not bind.
-  async answer(asker: Asker, method?: string, args: JsonObject = {}): Promise<Reply> {
-    // Nobody is not an owner. The door names nobody the ward did not bind, so
-    // the only way here unnamed is a partition that says the ward is its own
-    // public being, which no owner ask will write. Silence, not an error
-    // object: an unnamed asker is a stranger, and a stranger hears one thing.
-    if (asker.id === undefined) return silence;
-    return ownerAnswer(
-      {
-        pk: this.pk,
-        doors: this.doors,
-        absent: () => this.#absent(),
-        publicKey: () => this.p.public,
-        instantiate: (className, key) => this.#instantiate(className, key),
-        unboot: (key) => this.#unboot(key),
-        setPublic: (key) => {
-          this.p.public = key;
-          this.#wrote(HEAD);
-        },
-      },
-      asker,
-      method,
-      args,
-    );
+  get wardBeing(): WardBeing {
+    return this.#residents.get(WARD)!.being as WardBeing;
   }
 
-  // ---- ward functions. on the object. no stance reaches them.
+  // The unsealed ask: the ward-being, asked by whoever holds this ward.
+  async root(method?: string, args: JsonObject = {}): Promise<Answer> {
+    return this.#kept(WARD, () => this.#answer(WARD, { id: OWNER }, method, args));
+  }
 
-  // The partition was written, and which row of it: a being by her key, or
-  // the head. The harbor is told, and nothing more: what it does with the
-  // word is its own, and the ward never learns. Every write says its row,
-  // because a harbor told only that something moved must keep all of it, and
-  // a being's row is the one part of a partition that grows without limit.
-  #wrote(row: string): void {
-    this.g.memory.told(row);
+  // A being's answer, kept. Where the memory refuses, what she wrote is
+  // put back and her answer is silence. What her relations stand on is not
+  // put back: a relation's keys move only as far as its standing follows.
+  async #kept(key: string, work: () => Promise<Answer>): Promise<Answer> {
+    const row = this.partition.being(key);
+    const before = row && JSON.stringify(row.cells);
+    const out = await work();
+    if (await this.partition.kept()) return out;
+    if (row && before !== undefined) {
+      for (const k of Object.keys(row.cells)) delete row.cells[k];
+      for (const [k, v] of Object.entries(JSON.parse(before) as JsonObject)) Object.defineProperty(row.cells, k, { value: v, enumerable: true, writable: true, configurable: true });
+      this.partition.told(key);
+    }
+    return silence;
   }
 
-  // Whether what was written is kept, asked once at the end of an arrival
-  // and never during one. A harbor that keeps nothing was never going to
-  // refuse anything, so its silence here is yes: a ward driven with no store
-  // under it answers exactly as it did before a harbor could say no.
-  async #keep(): Promise<boolean> {
-    return this.g.memory.kept();
+  // Behind: the zero head reaches the public being, a heir the being that
+  // invited it.
+  get zero(): boolean {
+    const key = this.partition.head.public;
+    return key !== null && this.#residents.has(key);
   }
 
-  // The rows no door holds this run: beings whose class threw at birth or
-  // is not the harbor's to give. Key to class.
-  #absent(): Record<string, string | null> {
-    const out: Record<string, string | null> = {};
-    for (const [k, c] of Object.entries(this.p.beings)) if (k !== this.pk && !this.doors.has(k)) put(out, k, c.class ?? null);
-    return out;
+  async answer(heir: string | null, p: Payload): Promise<Choice> {
+    const bound = heir === null ? undefined : this.partition.head.bind[heir];
+    const key = heir === null ? this.partition.head.public : bound?.being;
+    const asker: Asker = bound ? { id: bound.id } : {};
+    const args = p.args === undefined ? {} : readValue(p.args, DEPTH + 1);
+    if (key === null || key === undefined || typeof args !== 'object' || args === null || Array.isArray(args)) return { silence: true };
+    const out = await this.#kept(key, () => this.#answer(key, asker, p.method, args));
+    const object = isSilence(out) || isWord(out) ? undefined : writeValue(out, DEPTH);
+    if (object === undefined) return { silence: true };
+    const being = this.#residents.get(key)?.being;
+    const seen = p.method === undefined || !being?.describe ? null : await digest(being.describe(asker));
+    return { object, seen };
   }
 
-  // A new being under a key nobody holds. A key with a row in the partition
-  // is booted, whether a door holds it this run or not: an absent being's
-  // row is hers, with every relation in it, and no class is booted over it.
-  // A throw at birth is that boot's refusal and nothing half-lives; the
-  // ward says which, since the owner hears objects.
-  #instantiate(className: string, key: string): Resident | 'threw' | null {
-    // The three refusals are read before the constructor runs, and the
-    // constructor can reach the stance and boot: a class that boots its own
-    // key from inside itself would pass all three, since neither its door nor
-    // its row exists yet, and the two objects would then share one row. A key
-    // being born is a key taken, for as long as the birth lasts.
-    if (typeof key !== 'string' || typeof className !== 'string' || !key || this.doors.has(key) || at(this.p.beings, key) || this.#birthing.has(key)) return null;
-    let door: Resident | null;
-    this.#birthing.add(key);
+  // Every path that reaches a being's answer. A throw, a word out of her,
+  // or nothing at all is silence.
+  async #answer(key: string, asker: Asker, method: string | undefined, args: JsonObject): Promise<Answer> {
+    const resident = this.#residents.get(key);
+    if (!resident) return silence;
+    let out: Reply;
     try {
-      door = this.#boot(key, (stance) => this.g.instantiate(className, stance));
+      out = await resident.being.answer(asker, method, args);
     } catch {
-      return 'threw';
-    } finally {
-      this.#birthing.delete(key);
+      return silence;
     }
-    if (!door) return null;
-    unguarded(door.cells).class = className; // so a restart finds her. the ward's key, written behind her guard
-    this.#wrote(key);
-    return door;
+    return out === undefined || isWord(out) ? silence : out;
   }
 
-  // The inverse of boot, and the only way a being leaves a ward. Her
-  // relations go first and by the same calls she would have used herself,
-  // so every occupant hears `removed` at the door from the keys it kept,
-  // rather than meeting a being who is simply not there any more. What is
-  // left after that is her cells and her bind table, and they go with her:
-  // a row naming a being no door holds would be read on the next restart
-  // and boot her again. An absent being leaves the same way: she has no
-  // stance to speak for her, so the ward closes her heirs itself.
-  #unboot(key: string): string[] | null {
-    if (key === this.pk) return null;
-    const door = this.doors.get(key);
-    const cells = door?.cells ?? at(this.p.beings, key);
-    if (!cells) return null;
-    const ids = (r: unknown) => (r !== null && typeof r === 'object' ? Object.keys(r) : []);
-    const occupants = ids(cells.occupants),
-      standings = ids(cells.standings);
-    if (door) {
-      for (const id of occupants) door.stance.occupants.remove(id);
-      for (const id of standings) door.stance.standings.remove(id);
-    } else {
-      const bind = at(this.p.bind, key);
-      for (const heir of Object.values(bind?.occupants ?? {})) this.heirs.close(heir);
-    }
-    // A ward whose public being is gone answers arrivals for no heir with
-    // silence, as a ward that never had one does.
-    if (this.p.public === key) this.p.public = null;
-    drop(this.p.beings, key);
-    drop(this.p.bind, key);
-    this.doors.delete(key);
-    this.#wrote(key); // she is gone, and her row goes with her
-    this.#wrote(HEAD); // her heirs were closed, and the public being may have been her
-    return [...occupants, ...standings];
+  // Inside: what every stance of this ward stands on.
+
+  // One path through a door for every ask, this ward's own included.
+  async send(pk: string, bytes: Uint8Array): Promise<Uint8Array | null> {
+    if (pk === this.pk) return (await this.door.arrive(bytes)).bytes;
+    return this.#parts.carrier.carry(pk, bytes);
+  }
+
+  // A lend: the ward-being lends herself, as the dock does, or asks the dock
+  // through her standing.
+  async offer(contract: string): Promise<Invitation | null> {
+    const own = this.#residents.get(WARD)!;
+    if (lends(own.being)) return own.being.offer(contract);
+    const out = await own.stance.standings.get(DOCK)?.ask('lend', { contract });
+    return readInvitation((out as { invitation?: unknown } | undefined)?.invitation);
+  }
+
+  async retract(contract: string, heir: string): Promise<void> {
+    const own = this.#residents.get(WARD)!;
+    if (lends(own.being)) return own.being.withdraw(contract, heir);
+    await own.stance.standings.get(DOCK)?.ask('retract', { contract, heir });
   }
 
-  // Nothing is written until there is somebody to write it for: a class the
-  // harbor does not know makes no being, and a boot that made nobody must
-  // leave the partition as it found it.
-  //
-  // `make` is who to build with the stance this raises. Two callers and two
-  // makers: the ground's `instantiate` for a being of the ward, and the ward
-  // itself, which is the first being in its own map and is already made.
-  #boot(key: string, make: (stance: Stance) => BeingLike | null): Resident | null {
-    const cells = guardCells(at(this.p.beings, key) ?? emptyCells(), () => this.#wrote(key));
-    const bind = at(this.p.bind, key) ?? emptyBind();
-    const stance: Stance = buildStance(
-      {
-        pk: this.pk,
-        // This stance, not merely this key: unboot and boot again under the
-        // same key makes a new being, and the old stance is not hers.
-        live: () => this.doors.get(key)?.stance === stance,
-        mintKey: (b) => this.#mintKey(b, key),
-        openHeir: (heir, being, id) => this.heirs.open(heir, being, id),
-        closeHeir: (heir) => this.heirs.close(heir),
-        send: (b, keys, method, args, wanted) => this.#send(b, keys, method, args, wanted, key),
-        // A throw at birth is null to her, not a throw in her method: she asked
-        // for a being and got none, and her own answer is still hers to give.
-        instantiate: (className, k) => {
-          const made = this.#instantiate(className, k);
-          return made && made !== 'threw' ? made.key : null;
-        },
-        // The two halves of a maker's way back, each the ward's own call: the
-        // being made mints an occupant for her maker, and a relation that
-        // never came about takes her out again.
-        relate: async (k, id) => (await this.doors.get(k)?.stance.occupants.invite(id)) ?? null,
-        unmake: (k) => void this.#unboot(k),
-        lend: (name, take) => this.#lend(name, take),
-        wrote: () => this.#wrote(key),
-      },
-      key,
-      cells,
-      bind,
-    );
-    const being = make(stance);
-    if (!being || typeof being.answer !== 'function') return null; // a being is anything with an answer, and nothing without one
-    put(this.p.beings, key, cells);
-    put(this.p.bind, key, bind);
-    const door: Resident = { key, cells, bind, stance, being };
-    this.doors.set(key, door);
-    this.#wrote(key);
-    return door;
+  live(key: string, row: BeingRow): boolean {
+    return this.#residents.get(key)?.row === row;
   }
 
-  async #mintKey(bind: Bind, row: string): Promise<{ seed: string; pk: string }> {
-    const k = await beingKey(this.g.random(32));
-    // The last few she minted, and no more. A relation rotates on every ask,
-    // so a list of all of them is a partition that grows for as long as she
-    // keeps talking and can never be written down. Nothing is read from this
-    // but the keys of the moment.
-    bind.minted.push(k.pk);
-    if (bind.minted.length > MINTED) bind.minted.splice(0, bind.minted.length - MINTED);
-    this.#wrote(row);
-    return k;
+  // A being boots another of this ward. With an id, the new being invites
+  // her maker under the maker's key, and the maker takes it under id; a
+  // relation that could not be made unmakes the new being.
+  async boot(maker: string, className: string, key: string, id?: string): Promise<string | null> {
+    if ((await this.#make(key, className)) !== 'booted') return null;
+    if (id === undefined) return key;
+    const invitation = await this.#residents.get(key)!.stance.occupants.invite(maker);
+    const taken = invitation ? await this.#residents.get(maker)?.stance.standings.take(id, invitation) : null;
+    if (taken) return key;
+    this.#unboot(key);
+    return null;
   }
 
-  // One send for every door, the ward's own included. Mine: never leaves.
-  // Not mine: carry. Signs as the standing's current key, announces its
-  // next, seals to the far ward, opens the reply with the ephemeral secret,
-  // and rotates to the announced key once the far door has answered under
-  // the current one.
-  async #send(bind: Bind, keys: StandingKeys, method: string | undefined, args: JsonObject, wanted: Wanted | undefined, row: string): Promise<ReplyPayload | typeof silence | Word> {
-    // The harbor is told a call is in flight for as long as this one lasts,
-    // and told again when it ends. Everything this ward writes between the
-    // two is half of a relation: the count taken here, the key rotated when
-    // the reply opens, and whatever the being writes on either side of her
-    // own ask. A harbor may write those rows down; what it may not do is put
-    // the ward back to them.
-    const lower = this.g.memory.during();
+  async #make(key: string, className: string): Promise<Birth> {
+    if (key === '' || key === WARD || this.partition.being(key) || this.#birthing.has(key)) return 'key taken';
+    const C = this.#parts.catalogue.classOf(className);
+    if (!C) return 'no such class';
+    this.#birthing.add(key);
     try {
-      return await this.#sent(bind, keys, method, args, wanted, row);
+      const row: BeingRow = { class: className, cells: {}, occupants: {}, standings: {} };
+      this.partition.beings[key] = row;
+      if (!this.#bear(key, row, C)) {
+        delete this.partition.beings[key];
+        return 'threw at birth';
+      }
+      this.partition.told(key);
+      return 'booted';
     } finally {
-      lower?.();
+      this.#birthing.delete(key);
     }
   }
 
-  async #sent(bind: Bind, keys: StandingKeys, method: string | undefined, args: JsonObject, wanted: Wanted | undefined, row: string): Promise<ReplyPayload | typeof silence | Word> {
-    // What she asked for, held to what this ward allows. Asking for nothing is
-    // the default, and asking for more than the ceiling is the ceiling: budget
-    // is granted by a ward, never minted by a being.
-    const budget = allow(wanted);
-    const by = (await beingKey(unhex(keys.current))).pk;
-    // A public being is reached without a heir, and the door keeps nothing for
-    // whoever asked: no key it vouched for, so nothing to announce and nothing
-    // to rotate to. A standing on her signs with one key for life. Every other
-    // ask announces its next: there is no send that does not.
-    if (keys.next === null && keys.heir !== null) keys.next = (await this.#mintKey(bind, row)).seed;
-    const next = keys.next === null ? null : (await beingKey(unhex(keys.next))).pk;
-    // Her count for this relation, one higher every call and never reused. The
-    // far door honours each number once. One relation sends one at a time, so
-    // the numbers leave in the order they were taken.
-    const seq = (keys.seq += 1);
-    // Named here, before the bytes go out, and not at the end with the keys.
-    // The far door honours a number once, and it honours it before this side
-    // hears anything back: a reply that is lost, a wait that ran out, a road
-    // that took the bytes and said nothing, all end this call before the end
-    // of it is reached. A count named only there is a count a restart forgets
-    // while the door remembers, and she then speaks a number that door has
-    // already spent, which it refuses as the replay it cannot tell it from.
-    // So the rule is the send and not the reply: what she spoke under is
-    // written down because she spoke it.
-    this.#wrote(row);
-    // Args that will not go through the seal are args that never left. A
-    // being holds three answers and a throw is not one of them, so an ask
-    // that cannot be sealed is told what is true of it: no door was reached.
-    // One object of values, by the rule her cells keep and the far door
-    // reads: a Date would arrive as a string, a function would not arrive at
-    // all, a list or a string would be refused as a stranger's bytes, and
-    // she would never know the far being was asked something other than
-    // what she said.
-    if (args === null || typeof args !== 'object' || Array.isArray(args) || cellFault(args, 'args') !== null) return unreached();
-    let sealed;
+  #bear(key: string, row: BeingRow, C: BeingClass): boolean {
+    const stance = new WardStance(this, key, row);
     try {
-      sealed = await sealAsk(keys.heir, { by, next, seq, time: budget.time, method, args }, unhex(keys.current), wardPadlock(keys.ward), this.g.random(32));
+      this.#residents.set(key, { being: new C(stance), row, stance });
+      return true;
     } catch {
-      return unreached();
+      this.#residents.delete(key);
+      return false;
     }
-    const { bytes, ephemeral } = sealed;
-    // The wait is bounded here, and again around the lane in the stance. Two
-    // bounds and not one, because they end two different things: the stance's
-    // ends the wait a being is held in, and this one ends the occupancy of the
-    // relation's lane. A being holds three answers and a wait that does not
-    // end is none of them, and a lane nobody ever leaves is a relation the
-    // next ask never reaches. Only a bound on the wire breaks the second, and
-    // taking it out would leave one quiet far side holding the lane for good.
-    // What comes back late is not read.
-    //
-    // A wait that ran out is `late`, never unreached. Unreached promises
-    // nothing was delivered and is safe to retry; a bound that expired knows
-    // no such thing, because the far door may have heard and be working still.
-    //
-    // A harbor answers bytes or nothing. One that throws instead has answered
-    // nothing in a louder voice, and is read as nothing: no door was reached.
-    const carried = (keys.ward === this.pk ? this.door(new Uint8Array(bytes)).then((r) => r.bytes) : this.g.carry(keys.ward, bytes)).then(
-      (b) => b,
-      () => undefined,
-    );
-    const out = await within(budget.time, carried);
-    if (out === LATE) return word('late');
-    if (out === undefined) return unreached(); // nothing came back. no door was reached.
-    const reply = await openReply(out, ephemeral, wardSignPk(keys.ward));
-    if (!reply) return silence; // did not open, or not from that ward: not Quo's bytes
-    if ('object' in reply && keys.next !== null) {
-      keys.current = keys.next; // the far door holds `next` as announced. move to it.
-      keys.next = null;
+  }
+
+  #unboot(key: string): boolean {
+    const row = key === WARD ? undefined : this.partition.being(key);
+    if (!row) return false;
+    for (const { heir } of Object.values(row.occupants)) {
+      this.door.remove(heir);
+      delete this.partition.head.bind[heir];
     }
-    this.#wrote(row); // the count moved, and the keys may have
-    return reply;
+    if (this.partition.head.public === key) this.partition.head.public = null;
+    delete this.partition.beings[key];
+    this.#residents.delete(key);
+    this.partition.toldHead();
+    this.partition.told(key);
+    return true;
   }
+
+  // What the ward-being asks of her ward.
+  readonly #steward: Steward = {
+    pk: () => this.pk,
+    classOf: (name) => this.#parts.catalogue.classOf(name),
+    beings: () => {
+      const out: ReturnType<Steward['beings']> = {};
+      for (const [key, row] of Object.entries(this.partition.beings)) {
+        if (key !== WARD) out[key] = { class: row.class, public: this.partition.head.public === key, absent: !this.#residents.has(key) };
+      }
+      return out;
+    },
+    boot: (key, className) => this.#make(key, className),
+    unboot: (key) => this.#unboot(key),
+    publish: (key) => {
+      if (key !== null && (key === WARD || !this.partition.being(key))) return false;
+      this.partition.head.public = key;
+      this.partition.toldHead();
+      return true;
+    },
+    invite: (being, id, notes): Promise<Invitation | null> => {
+      const resident = being === WARD ? undefined : this.#residents.get(being);
+      return resident ? resident.stance.occupants.invite(id, notes) : Promise.resolve(null);
+    },
+    ask: (being, method, args) => {
+      const key = being ?? this.partition.head.public;
+      if (key === null || key === WARD) return Promise.resolve(word('unreached'));
+      return this.#answer(key, being === null ? {} : { id: OWNER }, method, args);
+    },
+  };
 }