nervur 0.19.2 → 0.20.0

package/src/harbor/core.ts

@@ -1,699 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// The harbor core: what every harbor on a device is. It boots wards from a
-// store, keeps the map of ward pk to door for its own wards and pk to reach
-// for foreign ones, carries bytes to a pk, and hands bytes from the wire to
-// one door. It names no terrain: the store, the class loader and the lease
-// are the terrain's, handed in or laid over it. A disk harbor is this plus
-// files and a pid; a browser harbor is this plus IndexedDB and a lock; an
-// edge harbor is this over an object's storage. None of them is in this
-// tree, and every one of them passes the conformance suite untouched.
-//
-// The directory is filled four ways, in this order: the harbor's own
-// doors; a socket a dialer holds to it, bound once the door behind the
-// dialer's claim has proved it holds the key, and unbound at close; the
-// claims of a listener this harbor dialed, proved the same way and reached
-// through that line; and a hint, a pk at a URL. A hint never displaces a
-// reach proved at a door. The directory lives in memory and is kept by no
-// store: whoever learns a hint keeps it where it keeps everything, in a
-// being's cells, and hands it back at every boot. And one fallback: a dialer with nothing in its
-// directory for a pk sends down the socket it holds, because the listener
-// it dialed is the rendezvous and may hold that pk on another socket. Bytes
-// that arrive from the wire go to an own door or a held socket and never
-// onward by request or by fallback; that one rule is the rendezvous.
-import { Ward } from '../ward/ward.ts';
-import { maker, entropy as random, learnPk, type Ground, type WardPointers } from '../ward/ground.ts';
-import type { BeingClass, BeingLike, Invitation } from '../being/types.ts';
-import { silence } from '../being/silence.ts';
-import { request, type Reach } from './reach.ts';
-import { isWardPk, openReply, wardSignPk } from '../ward/seal.ts';
-import { concat, sealingPair, KEY } from '../ward/arithmetic.ts';
-import { within, LATE } from '../ward/allowance.ts';
-import type { Kept, Store, WardRecord } from './store.ts';
-import { restoreRow, rowsIn, type Partition } from '../ward/partition.ts';
-import { rowsOf } from './store.ts';
-
-// What a harbor hands its own device for one ward it serves. The two
-// pointers, and beside them what the device needs to be a device: the pk it
-// routes by, the name it is kept under, the record, a save the caller may
-// wait for.
-//
-// And the beings the harbor made. `instantiate` is in the ground, so the
-// harbor is the one that constructs every being of every ward it serves: it
-// holds those objects because it made them, and `being` and `keys` say what
-// it made. This is not a third path to a being. It is the device's own code
-// reaching its own object in its own process, the same reach a being has on
-// one she booted herself, and nothing of it crosses an edge. What a harbor
-// never does is read the partition to decide anything, and the partition is
-// not here: it holds every seed the ward has, and a side that wants to know
-// which beings there are or which one is public asks the ward, which is
-// what the ask pointer is for.
-export type Hosted = WardPointers & { pk: string; name: string; record: WardRecord; being(key: string): BeingLike | undefined; keys(): string[]; save(): Promise<void> };
-
-// One ward's saves, in a line: the ward says it wrote, the harbor writes the
-// partition once the line is free, and never twice at once, so an older
-// snapshot cannot land after a newer one. A save that fails is the harbor's
-// to count and never a door's to answer: the door answered bytes, and a
-// disk that is full is not a reason the far side may hear.
-// `dirty` holds the rows the ward has named since the last write, and never
-// what changed in them: the harbor keeps the partition and reads none of it,
-// so what a row is worth is the store's to read off the object when it
-// writes. Empty is nothing to do.
-//
-// `kept` is what the store took, row by row, as values: the copy handed to
-// the last save that succeeded, and undefined for a row that save dropped.
-// It is what a refused row is put back to. The harbor never asks a store what
-// it holds to find that out, because the one moment it would ask is from
-// inside a save the store has just refused, and a read taken there is the
-// read least likely to be true: the edge answers it with a partition missing
-// its head row, and a ward put back from that loses its heirs.
-//
-// `kept` moves only at a save taken while no call of this ward is in flight.
-// `calls` counts the calls the ward says are in flight. `fault` is a refusal
-// no arrival has heard yet, because a save taken by a timer answers nobody
-// and the refusal is the answer of an ask, never a number counted behind it.
-// `back` is a put back the ward is owed: a store that says no under a call is
-// answered no there and put back when the call ends, because rolling back
-// rows a call has written would leave that call's own keep with nothing dirty
-// and answer yes over a write that is gone. `under` is what the store took
-// while a call was in flight, row by row: when the call ends the ward is whole
-// again, so a row the store already holds unchanged becomes part of the point
-// and a row that moved since is named for one more save. Without that the
-// point would stay wherever the last quiet save left it, and a ward whose
-// beings talk to each other would be put back to before the relation.
-type Saving = {
-  memory: Record<string, unknown>;
-  dirty: Set<string>;
-  kept: Map<string, Record<string, unknown> | undefined>;
-  running: Promise<boolean> | null;
-  timer: ReturnType<typeof setTimeout> | undefined;
-  gone: boolean;
-  calls: number;
-  fault: boolean;
-  back: boolean;
-  under: Map<string, Record<string, unknown> | undefined>;
-};
-// A reach in the directory, and whether this harbor holds it as a socket a
-// dialer opened: only those, and its own doors, take bytes from the wire.
-export type Bound = { reach: Reach; held: boolean };
-// How the code half arrives: the classes a record's `code` names, loaded by
-// the terrain. The browser has a bundle and no files; a daemon has a folder.
-export type Loader = (record: WardRecord) => Promise<Record<string, BeingClass>>;
-
-export const DEFAULT_CODE = 'classes/index.ts';
-// The device's entropy, spelled once. A harbor draws it for a ward's seed at
-// birth, for the lid of every probe it sends, and it hands the same function
-// to every ward it boots as the ground's `random`.
-// How long a probe waits for the door behind a claim. A claim that answers
-// nothing in this time is not bound; the next announce is another chance.
-const PROBE = 10_000;
-// How many pks one announce may claim, and how many are proven at once.
-const ANNOUNCE = 64;
-const PROVING = 8;
-// How many times each reach has announced: a proof from an older announce
-// binds nothing when it lands.
-const announces = new WeakMap<Reach, number>();
-// The reaches that are hints, so a hint can be replaced and put down without
-// touching a reach a door proved.
-const hinted = new WeakSet<Reach>();
-
-export class Harbor {
-  readonly store: Store;
-  readonly loader: Loader;
-  readonly wards = new Map<string, Hosted>(); // name -> pointers
-  readonly doors = new Map<string, WardPointers['door']>(); // ward pk -> door
-  readonly reaches = new Map<string, Bound>(); // the directory: foreign ward pk -> reach
-  readonly down = new Set<string>(); // pks this harbor will not reach right now: weather, for a test
-  readonly refused = new Map<string, number>(); // own ward pk -> arrivals its door would not admit. what a terrain does with it is its own
-  readonly faults = new Map<string, number>(); // ward name -> saves the store refused. what a terrain does with it is its own
-  // Told every time a save is refused, with the ward's name and how many of
-  // its saves the store has now refused. The refusal is already the answer of
-  // the ask that caused it, so nobody is waiting on this; it is for the box's
-  // own record, a journal line or a counter, and a terrain that keeps none
-  // leaves it alone.
-  onFault: (name: string, faults: number) => void = () => {};
-  readonly unbooted: string[] = []; // the wards the store keeps that would not host this run, by name
-  readonly classes: Record<string, BeingClass> = {}; // classes handed in-process, beside the loader's
-  readonly #saving = new Map<string, Saving>();
-  // The dialers' sockets, in the order they were dialed: where a pk nobody
-  // here knows is sent, because the listener a harbor dialed is a rendezvous
-  // and may hold that pk for someone else. It is a list because a harbor may
-  // dial more than one, and a rendezvous is a listener and nothing more, so
-  // there is never only one of them. A pk is tried down the list until one
-  // carries it: with a single slot, a harbor holding two lines answered
-  // unreached for a pk the other line could have reached.
-  readonly fallbacks: Reach[] = [];
-  // How a dialer says what this harbor holds now. An announce is a claim and
-  // a claim is worth nothing until the door behind it answers a probe, so
-  // saying it again costs a proof and buys nothing to an impostor. What is
-  // not free is never saying it again: a ward booted, adopted or dropped
-  // after a line opened would be announced only by the next line, and a line
-  // that does not drop never opens again, so it would be unreachable through
-  // that listener for as long as the socket stayed healthy.
-  readonly announcers = new Set<() => void>();
-  #announce(): void {
-    for (const say of this.announcers) say();
-  }
-
-  // The box, as one invitation per ward: what this device hands a ward it
-  // boots so that the ward takes the box's being as a standing. Set once
-  // the harbor's own ward is standing, which is the usual order: a terrain
-  // puts that ward up first, then boots the rest on a ground that can reach
-  // it. A terrain says which ward is handed one by overriding `boxFor`, and
-  // a stranger's ward is handed none.
-  offering: ((name: string) => Promise<Invitation | undefined>) | undefined;
-
-  constructor(store: Store, loader: Loader = async () => ({})) {
-    this.store = store;
-    this.loader = loader;
-  }
-
-  protected boxFor(name: string, _record: WardRecord): Promise<Invitation | undefined> {
-    return this.offering?.(name) ?? Promise.resolve(undefined);
-  }
-
-  // Boot every ward the store keeps. One ward that will not host, a
-  // partition this kit cannot read or a loader that throws, is named in
-  // `unbooted` and takes nobody else down with it.
-  async boot(): Promise<void> {
-    for (const name of await this.store.list()) {
-      // A ward this harbor already hosts is not booted twice. A terrain that
-      // keeps a ward of its own puts it up before this runs, so that a being
-      // born in any other ward can lend from her first line.
-      if (this.wards.has(name)) continue;
-      try {
-        const kept = await this.store.load(name);
-        if (kept) await this.host(name, kept);
-      } catch {
-        this.unbooted.push(name);
-      }
-    }
-  }
-
-  // The object a ward writes into, by the name it is kept under: the
-  // partition the harbor was handed at boot and keeps so it can save it.
-  // Nothing in the harbor reads it, and it is not on `Hosted`, because a
-  // side that holds a ward would then hold every seed in it and reach any
-  // being past every door. It is here for one reader, the conformance
-  // suite, whose census is ward state read straight and whose forgeries are
-  // ward state written straight, the way `MemoryHarbor.partitions` is. A
-  // side asks the ward.
-  partitionOf(name: string): Record<string, unknown> | undefined {
-    return this.#saving.get(name)?.memory;
-  }
-
-  // ---- saving
-
-  // Every ward's writes kept and none waiting: no row named, no save armed
-  // and none in flight. A write can name a row while another ward is being
-  // saved, so this goes round until a pass finds nothing. A process about to
-  // exit waits here, since its exit is not a turn the timer is given.
-  async quiet(): Promise<void> {
-    for (;;) {
-      const busy = [...this.#saving].filter(([, s]) => !s.gone && (s.dirty.size > 0 || s.timer !== undefined || s.running !== null));
-      if (busy.length === 0) return;
-      for (const [name, s] of busy) await (s.running ?? this.#flush(name));
-    }
-  }
-
-  // The ward wrote one row. Its partition is saved once the line is free, and
-  // once for every burst of writes, with every row named in that burst.
-  #wrote(name: string, row: string): void {
-    const s = this.#saving.get(name);
-    if (!s || s.gone) return;
-    s.dirty.add(row);
-    if (s.timer === undefined) s.timer = setTimeout(() => void this.#flush(name), 0);
-  }
-  // The rows a store refused, put back in the ward's memory to what the
-  // store holds for them. A being whose row was refused would otherwise go
-  // on answering out of a memory that runs ahead of the device: her next
-  // write is a row past the same ceiling, refused again, and everything she
-  // was told between now and the reload is gone with it. Standing her at
-  // what is kept costs her the writes that were never kept, which is what
-  // the asker was told, and leaves a small write after it one the store
-  // takes.
-  //
-  // The shape is read where the shape lives. The harbor hands each row and
-  // the copy it kept to the partition, which knows which part of itself a row
-  // is; nothing here reads a being, a bind table or a head. And nothing here
-  // asks the store: what it took is what this harbor handed it, which is
-  // `kept`, and a row nobody has handed it since this ward was hosted is a
-  // row the ward has not moved, so there is nothing to put back.
-  // Every row together, and never the refused ones alone. A relation's state
-  // is spread over rows, the head for the door's heirs and a being's own row
-  // for the keys she speaks under: put one back and the door stands ahead of
-  // the knocker and the relation never speaks again. So the ward is put back
-  // to the whole point, which is what the store held at the last save taken
-  // while no call was in flight. A row that point never knew is left where it
-  // is and stays named: no save has ever taken it, so there is nothing to put
-  // it back to. The rows that moved come back, so the store is put back with
-  // them and a reload finds no half-done row.
-  #standAtKept(s: Saving): string[] {
-    if (s.gone) return [];
-    const moved: string[] = [];
-    for (const row of s.kept.keys()) {
-      const was = s.kept.get(row);
-      const now = rowsOf(s.memory, [row])[0][1];
-      if (JSON.stringify(was) === JSON.stringify(now)) continue;
-      restoreRow(s.memory as unknown as Partition, row, was);
-      moved.push(row);
-    }
-    for (const row of moved) s.dirty.delete(row);
-    return moved;
-  }
-
-  // The ward back to the point, and the store with it. The store is written
-  // because a reload reads it and not the memory: a refusal that put only the
-  // memory back would leave the rows the store did take standing ahead of the
-  // ward until the next restart, and one half of a relation ahead of the
-  // other. What goes out is what the store already took once, so it is a
-  // write the store has no reason to refuse; one that refuses it anyway is
-  // counted like any other, and there is nothing further to put back to.
-  async #putBack(name: string, s: Saving): Promise<void> {
-    // What the store took under the refused call is not a point to stand at.
-    // It is also what has to be written over: a row the ward never moved
-    // after that save comes back unchanged in memory and is still ahead of
-    // the point in the store, so the rows that go out are the ones the memory
-    // moved and the ones the store took under the call, together.
-    const under = [...s.under.keys()];
-    s.under.clear();
-    const moved = this.#standAtKept(s);
-    const rows = [...new Set([...moved, ...under])];
-    if (rows.length === 0 || s.gone) return;
-    try {
-      await this.store.save(name, s.memory, rows);
-      for (const row of rows) s.dirty.delete(row);
-    } catch {
-      // A store that will not take back what it took once is a store this
-      // ward cannot be put back in. The count says so, the memory stands at
-      // the point all the same, and the rows stay named for the next save.
-      this.#fault(name);
-    }
-  }
-
-  // The call ended and the ward is whole, so the point catches up with it. A
-  // row the store took under the call and nobody has touched since is where
-  // the ward stands, so it joins the point as it is; a row that moved after
-  // that save is named for one more, and that save is quiet and moves the
-  // point itself. Nothing is written twice for a ward whose call left its
-  // rows where the store already has them.
-  #settle(name: string, s: Saving): void {
-    for (const [row, value] of s.under) {
-      const now = rowsOf(s.memory, [row])[0][1];
-      if (JSON.stringify(value) === JSON.stringify(now)) s.kept.set(row, value);
-      else s.dirty.add(row);
-    }
-    s.under.clear();
-    if (s.dirty.size > 0) void this.#flush(name);
-  }
-
-  // One refusal, counted and told. What a terrain does with the count is its
-  // own; the arrival that caused it is told by the answer, not by this.
-  #fault(name: string): void {
-    const faults = (this.faults.get(name) ?? 0) + 1;
-    this.faults.set(name, faults);
-    try {
-      this.onFault(name, faults);
-    } catch {
-      /* a box that cannot write its own journal is not a ward's problem */
-    }
-  }
-
-  // Answers whether everything it wrote was kept. False is a store that
-  // refused, and it is the ward's answer to the arrival that caused it, not
-  // a number in a map nobody reads. A flush that had nothing to write kept
-  // everything it was given, which is true and is why a read is never
-  // refused.
-  async #flush(name: string): Promise<boolean> {
-    const s = this.#saving.get(name);
-    if (!s) return true;
-    if (s.timer !== undefined) {
-      clearTimeout(s.timer);
-      s.timer = undefined;
-    }
-    // A flush already in flight is the one that will write these rows, and
-    // its verdict is theirs: two arrivals whose writes went out together are
-    // both refused when that write was refused, because neither of them is
-    // in the store.
-    if (s.running) return s.running;
-    s.running = (async () => {
-      // A put back that was owed to a refusal under a call is done here, the
-      // first moment the ward is whole again. Nothing is written over it
-      // until it is done, because what is in memory is half of a call the
-      // store already said no to.
-      // The pen is held from the refusal to the put back that answers it.
-      // What a save would write between the two is about to be put back
-      // anyway, so writing it buys nothing and costs the one thing that
-      // matters: a store written there holds rows of two moments, one side of
-      // a call kept and the other about to be undone, and a box that goes
-      // down before the put back leaves it torn with nobody left to mend it.
-      if (s.back) {
-        if (s.calls > 0) return false; // the call that owed it is still in flight, and a put back inside one would roll back rows it is still writing
-        s.back = false;
-        await this.#putBack(name, s);
-        return false; // the verdict of the refusal that owed it, and nothing is written over a put back in the same save
-      }
-      while (s.dirty.size > 0 && !s.gone) {
-        // Taken before the write, so a row named while this one is in flight
-        // is written by the next turn of the loop and not lost with it.
-        const rows = [...s.dirty];
-        s.dirty.clear();
-        // The copy of what is about to be written, taken before the store is
-        // asked and kept only if the store takes it. It is the same values
-        // the store is about to write down, so it costs one copy of the rows
-        // of this save and nothing of the rows it does not name.
-        const writing = rowsOf(s.memory, rows);
-        try {
-          const quiet = s.calls === 0; // read before the store is asked: the point is where the ward stood when this save was taken
-          await this.store.save(name, s.memory, rows);
-          // The store took it, and a restart finds it. Whether it is a point
-          // a refused ward may be put back to is another question: a save
-          // taken under a call holds half of a relation, so it is written and
-          // is not somewhere to stand.
-          for (const [row, value] of writing) (quiet ? s.kept : s.under).set(row, value);
-        } catch {
-          this.#fault(name);
-          // A row the store would not take is a row that is not kept, so it
-          // stays named and the verdict is no. The loop ends here rather than
-          // trying again: what the next attempt writes is the same bytes to
-          // the same store, and it is the next arrival that asks for one, not
-          // this one in a circle. Whoever wrote it is told, which is the
-          // whole point, and the row waits where a reader can still see it.
-          for (const row of rows) s.dirty.add(row);
-          // The refusal waits for an arrival to hear it: a save taken by a
-          // timer answers nobody, and a ward whose row was refused between
-          // two arrivals would otherwise have the refusal counted and the
-          // next door go on saying yes. And the ward goes back to the point
-          // now, unless a call is in flight, in which case the put back is
-          // owed until that call ends.
-          s.fault = true;
-          if (s.calls > 0) {
-            s.back = true;
-            return false;
-          }
-          await this.#putBack(name, s);
-          return false;
-        }
-      }
-      return true;
-    })();
-    try {
-      return await s.running;
-    } finally {
-      s.running = null;
-    }
-  }
-
-  // ---- the directory
-
-  // Bytes to one of this harbor's own doors, and the one bit the door says
-  // beside its reply, counted.
-  async #own(pk: string, door: WardPointers['door'], bytes: Uint8Array): Promise<Uint8Array> {
-    const r = await door(bytes);
-    if (!r.heard) this.refused.set(pk, (this.refused.get(pk) ?? 0) + 1);
-    return new Uint8Array(r.bytes);
-  }
-
-  async carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined> {
-    if (this.down.has(pk)) return undefined;
-    const door = this.doors.get(pk);
-    if (door) return this.#own(pk, door, bytes);
-    const bound = this.reaches.get(pk);
-    if (bound) return bound.reach.carry(pk, bytes);
-    for (const reach of this.fallbacks) {
-      const back = await reach.carry(pk, bytes);
-      if (back !== undefined) return back;
-    }
-    return undefined; // nobody here knows it, and no listener we dialed holds it
-  }
-
-  async deliver(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined> {
-    if (this.down.has(pk)) return undefined;
-    const door = this.doors.get(pk);
-    if (door) return this.#own(pk, door, bytes);
-    const bound = this.reaches.get(pk);
-    return bound?.held ? bound.reach.carry(pk, bytes) : undefined;
-  }
-
-  // A hint, taken on the word of whoever gives it. A hint already standing
-  // for the pk is replaced, since a URL is the one part of a ward that moves;
-  // a reach proven at a door is never displaced by one.
-  hint(pk: string, url: string): void {
-    const standing = this.reaches.get(pk);
-    if (standing && !hinted.has(standing.reach)) return; // a reach proven at a door beats a hint, held or reached through a dialed line
-    const reach = request(url);
-    hinted.add(reach);
-    this.reaches.set(pk, { reach, held: false });
-  }
-
-  // A hint kept only once the door behind it has proven it holds the pk's
-  // key, the same probe an announce is proven by. A URL that answers for
-  // another ward, or for nobody, is refused and nothing is kept: whoever
-  // hands a harbor a hint could otherwise point one ward's asks at a place
-  // that drops them. True is kept.
-  async learn(pk: string, url: string): Promise<boolean> {
-    const standing = this.reaches.get(pk);
-    if (standing && !hinted.has(standing.reach)) return true; // already reached, and proven at a door
-    const reach = request(url);
-    if (!(await this.prove(pk, reach))) return false;
-    this.hint(pk, url);
-    return true;
-  }
-
-  // A hint put down. A reach proven at a door is the line's, and goes when
-  // the line does, never by a word from here.
-  forget(pk: string): void {
-    const standing = this.reaches.get(pk);
-    if (standing && hinted.has(standing.reach)) this.reaches.delete(pk);
-  }
-
-  // An announce is a claim, and a claim binds nothing until proven: anyone
-  // who can reach a listener could otherwise name a pk that is not theirs and
-  // take its reachability. The proof is the door itself, as it already is. A
-  // lid this harbor minted and noise after it is a box that does not open,
-  // and the door answers one such box with silence sealed to the lid and
-  // signed by the ward key. Only the holder of that ward's seed can write
-  // that reply, the lid is fresh so nothing replays, and a box that does not
-  // open writes nothing at the ward. This is the one box a harbor ever opens,
-  // the one it sealed itself, and it reads nothing from it but that it is
-  // the silence a door owes such a box, signed by the claimed key.
-  async prove(pk: string, reach: Reach): Promise<boolean> {
-    if (!isWardPk(pk)) return false;
-    try {
-      const lid = await sealingPair(random(KEY));
-      const back = await within(PROBE, reach.carry(pk, concat([lid.pk, random(KEY)])));
-      if (back === LATE || back === undefined) return false;
-      const reply = await openReply(back, lid.secret, wardSignPk(pk));
-      return reply !== null && 'silence' in reply;
-    } catch {
-      return false;
-    }
-  }
-
-  // Bind what the far side claims, each pk proven at its door first. Both
-  // sides bind this way: the listener the dialer's claims, the dialer the
-  // listener's, since a claim is a claim whichever end made it. An announce
-  // names at most this many pks, and they are proven a few at a time: a
-  // side that announced a thousand would otherwise cost a thousand keys, a
-  // thousand frames and a thousand waits at once, on its word alone.
-  async bind(pks: string[], reach: Reach, held: boolean): Promise<void> {
-    // An announce is the whole of what that side holds now, so a pk this
-    // reach was bound for and does not claim now is unbound at once: a ward
-    // that left a dialer is not reachable through it, proof or no proof.
-    // And it is the newest word: a proof still in flight from an earlier
-    // announce on this reach binds nothing when it lands, since the side
-    // has spoken again since.
-    const said = (announces.get(reach) ?? 0) + 1;
-    announces.set(reach, said);
-    for (const [pk, b] of this.reaches) if (b.reach === reach && !pks.includes(pk)) this.reaches.delete(pk);
-    const claimed = [...new Set(pks)].slice(0, ANNOUNCE);
-    const prove = async (pk: string) => {
-      if (this.doors.has(pk)) return;
-      // A line already held for this pk is not displaced by another line that
-      // proves the same pk. A proof says only that the ward is reachable that
-      // way, and a relay that forwards to the real ward proves as well as the
-      // ward's own line does: taking the binding would add a hop the relay
-      // chooses, and can drop. The first held line keeps it until it closes,
-      // which unbind says.
-      const standing = this.reaches.get(pk);
-      if (standing?.held && standing.reach !== reach) return;
-      if (!(await this.prove(pk, reach))) return;
-      if (announces.get(reach) !== said) return; // a newer announce has spoken since
-      if (this.reaches.get(pk)?.held && this.reaches.get(pk)!.reach !== reach) return; // one took it while this was proving
-      this.reaches.set(pk, { reach, held });
-    };
-    for (let i = 0; i < claimed.length; i += PROVING) await Promise.all(claimed.slice(i, i + PROVING).map(prove));
-  }
-  unbind(reach: Reach): void {
-    for (const [pk, b] of this.reaches) if (b.reach === reach) this.reaches.delete(pk);
-  }
-
-  // ---- wards
-
-  // Mint a seed and boot an empty ward under a name: a world born here.
-  async create(name: string, user = '', code = DEFAULT_CODE): Promise<Hosted> {
-    const kept: Kept = { seed: random(KEY), partition: {}, record: { pk: '', code, user } };
-    await this.store.put(name, kept);
-    const hosted = await this.host(name, kept);
-    await this.store.record(name, hosted.record);
-    return hosted;
-  }
-
-  // Stop serving a ward and take it out of the store: what was kept comes
-  // back, for another harbor to put. The partition is written first, and
-  // never again under this name: whoever still holds the old pointers holds
-  // a ward that saves nothing and answers its owner silence.
-  async drop(name: string): Promise<Kept | undefined> {
-    const h = this.wards.get(name);
-    if (h) {
-      await h.save();
-      // Gone for whoever still holds the old pointers, whose save closure has
-      // this row in hand, and out of the map, which now says what this harbor
-      // serves and nothing else.
-      const s = this.#saving.get(name);
-      if (s) s.gone = true;
-      this.#saving.delete(name);
-      this.wards.delete(name);
-      this.doors.delete(h.pk);
-      this.#announce(); // this harbor no longer claims it: a listener unbinds a pk an announce stops naming
-    }
-    return this.store.take(name);
-  }
-
-  // Put what another harbor dropped, and boot it: same seed, same pk. A ward
-  // that will not boot is not adopted. This is the one path where a partition
-  // written somewhere else arrives, so it is the one place the ward's own
-  // shape check is met, and the name is refused for as long as it is kept:
-  // a partition put and left would hold the name against every later try,
-  // with a copy of it in a store that can never serve it. It goes back out,
-  // and the only copy is the one the caller is still holding.
-  async adopt(name: string, kept: Kept): Promise<Hosted> {
-    await this.store.put(name, kept);
-    try {
-      return await this.host(name, kept);
-    } catch (e) {
-      await this.store.take(name);
-      throw e;
-    }
-  }
-
-  // A ward from what the store keeps: the ground, once, and two pointers.
-  async host(name: string, kept: Kept): Promise<Hosted> {
-    const { seed, partition: memory } = kept;
-    const classes = await this.loader(kept.record);
-    const objects = new WeakMap<object, BeingLike>(); // cells -> the object instantiate made. a side's hand, never the ward's; it follows the cells out when she is unbooted
-    const ground: Ground = {
-      seed,
-      // This ward's own classes first, then the harbor's: a ward that names a
-      // class of its own is answered with hers.
-      instantiate: maker(objects, classes, this.classes),
-      carry: (pk, bytes) => this.carry(pk, new Uint8Array(bytes)),
-      random,
-      memory: {
-        rows: memory,
-        told: (row) => this.#wrote(name, row),
-      // What the ward wrote is in the store when this resolves, and it says
-      // whether the store took it. The ward calls it at the end of every
-      // arrival, before it seals, so a call through a pointer has already
-      // waited for the store when it comes back: a restart right after one
-      // finds everything, and a refusal is that arrival's own answer rather
-      // than a number counted behind it. A ward that wrote nothing has
-      // nothing to save, so asking it what it holds is free, which is what
-      // makes the ask pointer the way to find out rather than an expensive
-      // one.
-      //
-      // A ward on its way out keeps nothing and refuses nothing: an arrival
-      // racing an unhost is not a store saying no, and saying so would be a
-      // lie in the one direction that matters.
-      kept: async () => {
-        const s = this.#saving.get(name);
-        if (!s || s.gone) return true;
-        const ok = await this.#flush(name);
-        // A refusal is heard once, by the first arrival to ask after it: the
-        // save that met it may have been a timer's, which had nobody to tell.
-        // Under a call it is left standing, so the call that carried the
-        // refused write is refused too, and the outermost arrival hears it.
-        const no = !ok || s.fault;
-        s.fault = false; // heard. the next arrival is answered by the store and not by what happened before it
-        return !no;
-      },
-      // The ward says a call is in flight, and says when it ends. The harbor
-      // goes on writing under it; what it does not do is take a save made
-      // there as the point a refused ward is put back to, and a refusal that
-      // lands under a call waits here for the call to end before it puts the
-      // ward back. The ward is the one that knows, because a being reaching
-      // another being of her own ward goes to that ward's door directly and
-      // the harbor never sees that call at all.
-      during: () => {
-        const s = this.#saving.get(name);
-        if (!s) return () => {};
-        s.calls += 1;
-        let lowered = false;
-        return () => {
-          if (lowered) return;
-          lowered = true;
-          s.calls -= 1;
-          if (s.calls > 0 || s.gone) return;
-          // The moment the ward is whole again: the point catches up with the
-          // call that just ended, or a put back that was owed is done now, so
-          // a being stands at what is kept before her next word rather than
-          // at the next save.
-          if (s.back) void this.#flush(name);
-          else this.#settle(name, s);
-        };
-      },
-      },
-    };
-    const box = await this.boxFor(name, kept.record);
-    if (box) ground.box = box;
-    // What the store holds for this ward at birth is what it was just handed
-    // or just read, row by row. It is copied once here so that a being whose
-    // very first write of this run is refused is put back too, rather than
-    // waiting for a save of hers to succeed before the harbor knows what she
-    // was. One copy of a partition per hosted ward, paid at boot and never
-    // again: after this, a row's copy is replaced by the save that kept it.
-    const saving: Saving = { memory, dirty: new Set(), kept: new Map(rowsOf(memory, rowsIn(memory))), running: null, timer: undefined, gone: false, calls: 0, fault: false, back: false, under: new Map() };
-    this.#saving.set(name, saving);
-    // A ward that will not be born leaves nothing behind: a partition of a
-    // shape this kit cannot read throws here, and a name the harbor does not
-    // serve must not have a saving row saying it does. Learning the pk is
-    // inside this, because a ward that will not say its pk is a ward this
-    // harbor cannot route to and is no more born than one that threw.
-    let w: WardPointers, pk: string;
-    try {
-      w = await Ward(ground);
-      pk = await learnPk(w);
-    } catch (e) {
-      saving.gone = true;
-      this.#saving.delete(name);
-      throw e;
-    }
-    // The same keep, for a caller that holds the ward rather than asks it:
-    // a side that wrote through `being` and wants the store current says so
-    // here. It answers nothing, because a caller inside the process reads
-    // the fault off the harbor and an arrival is the only thing that needs a
-    // verdict of its own.
-    const save = async (): Promise<void> => void (await ground.memory.kept());
-    const door = (bytes: Uint8Array) => w.door(bytes);
-    const ask = async (method?: string, args?: Record<string, unknown>) => {
-      if (saving.gone) return silence;
-      return w.ask(method, args);
-    };
-    // The objects map is keyed by the cells the ward handed instantiate, so
-    // the way back to a being is her cells; the partition is read for that
-    // one lookup and for nothing else, and a key with no object is a being
-    // who is not here this run. `keys` is what the map holds, so a caller
-    // never needs the beings table to find out what to ask for.
-    const beings = memory.beings as Record<string, object> | undefined;
-    const being = (key: string) => {
-      const cells = beings && Object.hasOwn(beings, key) ? beings[key] : undefined;
-      return cells ? objects.get(cells) : undefined;
-    };
-    const keys = () => Object.keys(beings ?? {}).filter((k) => being(k) !== undefined);
-    const hosted: Hosted = { door, ask, pk, name, record: { ...kept.record, pk }, being, keys, save };
-    this.wards.set(name, hosted);
-    this.doors.set(hosted.pk, door);
-    await save();
-    this.#announce(); // reachable through every line this harbor already holds, not only the next one
-    return hosted;
-  }
-}