Merge branch 'master' into next/npm

2024-12-19 00:13:12 +03:00 · 2022-09-13 11:26:22 -05:00 · 2022-09-13 11:26:22 -05:00 · ac6ef65a87
commit ac6ef65a87
parent aaebd9c01b 5094c3a3c9
95 changed files with 31704 additions and 13878 deletions
--- a/.github/workflows/vere.yml
+++ b/.github/workflows/vere.yml
@ -232,9 +232,7 @@ jobs:
  after:
    runs-on: ubuntu-latest
    needs: [urbit, mingw]
-    # XX disabled due to missing storage.objects.delete access
-    if: false
-    # if: inputs.upload
+    if: inputs.upload
    steps:
      - uses: google-github-actions/setup-gcloud@v0.2.0
        with:
--- a/4
+++ b/4
@ -1,10 +1,10 @@
 .PHONY: build build-all install cross release test pills ropsten-pills clean

 build:
-	nix-build -A urbit -A herb --no-out-link
+	nix-build -A urbit --no-out-link

 install:
-	nix-env -f . -iA urbit -iA herb
+	nix-env -f . -iA urbit

 release:
 	sh/release
--- a/bin/solid.pill
+++ b/bin/solid.pill
@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:c45166ff0f8ab8dc1552bcef519c77c0afa6ca52f8ed1ba31ed632012667d619
-size 8674763
+oid sha256:b604b45df0496baf94ac38145c3fc8d4fa9429ae02b49b33a7af4e32ad770db4
+size 5896517
--- a/nix/sources-openssl.json
+++ b/nix/sources-openssl.json
@ -0,0 +1,18 @@
+{
+    "openssl": {
+        "branch": "1_1_1n",
+        "homepage": "https://www.openssl.org/",
+        "pmnsh": {
+            "include": "build/include",
+            "lib": "build",
+            "prepare": "./config --prefix=`mkdir -p build && readlink -f ./build` --libdir=. no-shared no-tests",
+            "make": "install_dev"
+        },
+        "owner": "openssl",
+        "repo": "openssl",
+        "rev": "OpenSSL_1_1_1n",
+        "type": "tarball",
+        "url": "https://github.com/openssl/openssl/archive/refs/tags/OpenSSL_1_1_1n.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/refs/tags/<rev>.tar.gz"
+    }
+}
--- a/nix/sources-pmnsh.json
+++ b/nix/sources-pmnsh.json
@ -4,6 +4,11 @@
        "description": "A command line tool and library for transferring data with URL syntax",
        "homepage": "http://curl.se/",
        "pmnsh": {
+            "compat": {
+                "openbsd": {
+                    "prepare": "autoreconf -vfi && ./configure --disable-shared --disable-ldap --disable-rtsp --without-brotli --without-libidn2 --without-libpsl --without-nghttp2 --with-openssl=`readlink -f ../openssl/build`"
+                }
+            },
            "include": "include",
            "lib": "lib/.libs",
            "prepare": "autoreconf -vfi && ./configure --disable-shared --disable-ldap --disable-rtsp --without-brotli --without-libidn2 --without-libpsl --without-nghttp2 --with-openssl",
@ -76,6 +81,13 @@
    },
    "urcrypt": {
        "pmnsh": {
+            "compat": {
+                "openbsd": {
+                    "make": "install prefix=`readlink -f .` exec_prefix=`readlink -f .`",
+                    "include": "include",
+                    "lib": "lib"
+                }
+            },
            "prepare": "./autogen.sh && ./configure --disable-shared PKG_CONFIG_PATH=../secp256k1 CFLAGS=\"-I../secp256k1/include -I../libaes_siv\" LDFLAGS=-L../libaes_siv",
            "make": "install"
        }
--- a/nix/sources.json
+++ b/nix/sources.json
@ -8,6 +8,9 @@
            "compat": {
                "mingw": {
                    "prepare": "cmake -G\"MSYS Makefiles\" -DCMAKE_INSTALL_PREFIX=. ."
+                },
+                "openbsd": {
+                    "prepare": "cmake -DOPENSSL_ROOT_DIR=`readlink -f ../openssl/build` ."
                }
            },
            "include": "include",
@ -35,6 +38,10 @@
                "mingw": {
                    "make": "aes_siv_static",
                    "prepare": "cmake -G\"MSYS Makefiles\" -DDISABLE_DOCS:BOOL=ON ."
+                },
+                "openbsd": {
+                    "make": "aes_siv_static",
+                    "prepare": "cmake -DDISABLE_DOCS:BOOL=ON -DOPENSSL_ROOT_DIR=`readlink -f ../openssl/build` ."
                }
            }
        },
@ -98,6 +105,10 @@
                "mingw": {
                    "lib": "build/Win64-MinGW-w64",
                    "make": "-C build/Win64-MinGW-w64 libsoftfloat3.a"
+                },
+                "openbsd": {
+                    "lib": "build/template-FAST_INT64",
+                    "make": "-C build/template-FAST_INT64 libsoftfloat3.a"
                }
            },
            "include": "source/include"
--- a/pkg/arvo/app/azimuth.hoon
+++ b/pkg/arvo/app/azimuth.hoon
@ -6,22 +6,16 @@
    default-agent,
    verb,
    dbug
-::  Generally don't update the snapshot until we have clay tombstoning.
-::
-/*  snap  %azimuth-snapshot  /app/azimuth/version-0/azimuth-snapshot
 ::  To update, run from dojo:
 ::    -azimuth-snap-state %default 'version-0'
 ::
 ::  To recreate from a full list of logs (at /app/azimuth/logs/eth-logs):
 ::    -azimuth-snap-logs %default 'version-0'
 ::
-=/  snap=snap-state  snap
-=/  last-snap=@      number.id.snap
-::
 =,  jael
 |%
 +$  app-state
-  $:  %6
+  $:  %7
      url=@ta
      =net
      refresh=_~m5
@ -30,10 +24,14 @@
      own=owners
      spo=sponsors
      logs=(list =event-log:rpc:ethereum)
+      sap=snap-state
  ==
 ::
 +$  poke-data
-  $%  ::  %listen
+  $%  ::  %load: load snapshot
+      ::
+      [%load snap=snap-state]
+      ::  %listen
      ::
      [%listen whos=(list ship) =source:jael]
      ::  %watch: configure node url and network
@ -75,14 +73,18 @@
      ==
    ::
    ++  init-timer
-      |=  =bowl:gall
+      |=  at=@da
      ^-  card
-      [%pass /init %arvo %b %wait now.bowl]
+      [%pass /init %arvo %b %wait at]
    ::
    ++  start-log-retrieval
      |=  [=ship args=vase]
      ^-  card
      [%pass /wa %agent [ship %eth-watcher] %poke %eth-watcher-poke args]
+    ::
+    ++  start-azimuth-load
+      ^-  card
+      [%pass /al %arvo %k %fard %base %azimuth-load %noun !>(~)]
    --
 ::
 =<
@ -92,22 +94,10 @@
      def   ~(. (default-agent this %|) bowl)
  ::
  ++  on-init
-    ^-  (quip card _this)
-    =/  points=@ud  ~(wyt by points.nas.snap)
-    %-  %-  slog
-        [leaf+"ship: loading azimuth snapshot ({<points>} points)"]~
-    ::
-    =:  net.state   %default
-        nas.state   nas.snap
-        own.state   owners.snap
-        spo.state   sponsors.snap
-        url.state   'http://eth-mainnet.urbit.org:8545'
-      ==
    :_  this
    ?:  .^(? %j /(scot %p our.bowl)/fake/(scot %da now.bowl))
      ~
-    ~[(nuke-azimuth-tracker bowl) (init-timer bowl)]
-  ::
+    ~[(init-timer now.bowl)]
  ++  on-save   !>(state)
  ++  on-load
    |=  old=vase
@ -122,7 +112,7 @@
        `old-state
      %-  %-  slog  :_  ~
          leaf+"ship: loading snapshot with {<(lent logs.old-state)>} events"
-      =.  +.state  +:(state-5-to-6 old-state)
+      =.  +.state  +:(state-6-to-7 (state-5-to-6 old-state))
      =^  cards  state
        (%*(run-logs do nas.state *^state:naive) logs.state)
      [(jael-update:do (to-udiffs:do cards)) state]
@ -130,12 +120,12 @@
      ?.  ?=(%2 -.old-state)
        `old-state
      ~&  >  '%azimuth: updating to state 3'
-      =.  +.state  +:(state-5-to-6 old-state)
+      =.  +.state  +:(state-6-to-7 (state-5-to-6 old-state))
      ::  replace naive state and indices with snapshot
      ::
-      =:  nas.state   nas.snap
-          own.state   owners.snap
-          spo.state   sponsors.snap
+      =:  nas.state   nas.sap.state
+          own.state   owners.sap.state
+          spo.state   sponsors.sap.state
          logs.state  ~
          ::  TODO: shouldn't be needed but have seen eth-watcher
          ::        threads use a url='' if this is not used
@ -144,8 +134,8 @@
        ==
      =/  points=@ud  ~(wyt by points.nas.state)
      %-  %-  slog  :_  ~
-          leaf+"ship: processing azimuth snapshot ({<points>} points)"
-      =/  snap-cards=udiffs:point  (run-state:do id.snap points.nas.state)
+          leaf+"ship: processing azimuth snapshot (~{<points>} points)"
+      =/  snap-cards=udiffs:point  (run-state:do id.sap.state points.nas.state)
      :_  [%3 url net whos nas own spo logs]:state
      %+  weld
        (jael-update:do snap-cards)
@ -160,22 +150,30 @@
    =^  cards-4  old-state
      ?.  ?=(%4 -.old-state)  [cards-3 old-state]
      =^  cards  this
-        %-  %*(. on-poke +.state.this +:(state-5-to-6 old-state))
+        %-  %*(. on-poke +.state.this +:(state-6-to-7 (state-5-to-6 old-state)))
        [%azimuth-poke !>([%watch [url net]:old-state])]
      ~&  >  '%azimuth: updating to state 5'
      [cards [%5 url net whos nas own spo logs]:state.this]
    =?  old-state  ?=(%5 -.old-state)
      (state-5-to-6 old-state)
-    ?>  ?=(%6 -.old-state)
+    =?  old-state  ?=(%6 -.old-state)
+      (state-6-to-7 old-state)
+    ?>  ?=(%7 -.old-state)
    [cards-4 this(state old-state)]
    ::
-    ++  app-states  $%(state-0 state-1-2-3-4-5 app-state)
-    ::
-    ++  state-5-to-6
-      |=  state-1-2-3-4-5
-      ^-  app-state
-      [%6 url net ~m5 whos nas own spo logs]
+    ++  app-states  $%(state-0 state-1-2-3-4-5 state-6 app-state)
    ::
+    +$  state-6
+      $:  %6
+          url=@ta
+          =net
+          refresh=_~m5
+          whos=(set ship)
+          nas=^state:naive
+          own=owners
+          spo=sponsors
+          logs=(list =event-log:rpc:ethereum)
+      ==
    +$  state-1-2-3-4-5
      $:  ?(%1 %2 %3 %4 %5)
          url=@ta
@ -196,6 +194,15 @@
          own=owners
          logs=(list =event-log:rpc:ethereum)
      ==
+    ++  state-5-to-6
+      |=  state-1-2-3-4-5
+      ^-  state-6
+      [%6 url net ~m5 whos nas own spo logs]
+    ::
+    ++  state-6-to-7
+      |=  state-6
+      ^-  app-state
+      [%7 url net refresh whos nas own spo logs *snap-state]
    --
  ::
  ++  on-poke
@ -219,9 +226,9 @@
        [(subscribe-to-eth-watcher bowl)]~
      ::
          %resnap
-        =:  nas.state  nas.snap
-            own.state  owners.snap
-            spo.state  sponsors.snap
+        =:  nas.state  nas.sap.state
+            own.state  owners.sap.state
+            spo.state  sponsors.sap.state
          ==
        `this
      ==
@ -229,7 +236,23 @@
    ?.  ?=(%azimuth-poke mark)
      (on-poke:def mark vase)
    =+  !<(poke=poke-data vase)
+    |-
    ?-    -.poke
+        %load
+      =/  points=@ud  ~(wyt by points.nas.snap.poke)
+      %-  %-  slog
+          [leaf+"ship: loading azimuth snapshot ({<points>} points)"]~
+      ::
+      =:  net.state   %default
+          nas.state   nas.snap.poke
+          own.state   owners.snap.poke
+          spo.state   sponsors.snap.poke
+          url.state   'http://eth-mainnet.urbit.org:8545'
+          sap.state   snap.poke
+          logs.state  ~
+        ==
+      $(poke [%kick ~])
+    ::
        %listen
      [[(listen-to-azimuth (silt whos.poke) source.poke)]~ this]
    ::
@ -237,8 +260,8 @@
      =/  last-block=@
        ?^  logs.state
          number:(last-block-id:dice logs.state)
-        ~&  >>  %no-logs-in-azimuth-state
-        last-snap
+        ::  ~&  >>  %no-logs-in-azimuth-state
+        number.id.sap.state
      =+  [our=(scot %p our.bowl) now=(scot %da now.bowl)]
      =+  .^(dudes=(set [dude:gall ?]) %ge our %base now /)
      =/  running=?  (~(has in dudes) [%eth-watcher &])
@ -246,12 +269,14 @@
        |((~(has in dudes) [%eth-watcher &]) (~(has in dudes) [%eth-watcher |]))
      :_  this
      =/  cards=(list card)
-        :-  ::  %jael will re-subscribe to get all azimuth diffs
-            ::
-            (listen-to-azimuth ~ [%| dap.bowl])
-        ::  we poke eth-watcher to retrieve logs from the latest we have
+        ?:  installed
+          ~
+        ::  reinstall %base desk
        ::
-        %*(start do last-snap last-block)
+        =+  spo=(sein:title [our now our]:bowl)
+        ~&  >>  re-installing-base-from+spo
+        =/  fresh=[desk ship desk]  [%base spo %kids]
+        [%pass /fresh %agent [our.bowl %hood] %poke kiln-install+!>(fresh)]~
      =?  cards  !running
        ::  restart %eth-watcher
        ::
@ -259,30 +284,29 @@
        =/  rein=[desk rein]  [%base %.y [%eth-watcher ~ ~] ~]
        :_  cards
        [%pass /rein %agent [our.bowl %hood] %poke kiln-rein+!>(rein)]
-      =?  cards  !installed
-        ::  reinstall %base desk
+      =.  cards
+        ::  we poke eth-watcher to retrieve logs from the latest we have
        ::
-        =+  spo=(sein:title [our now our]:bowl)
-        ~&  >>  re-installing-base-from+spo
-        =/  fresh=[desk ship desk]  [%base spo %kids]
-        :_  cards
-        [%pass /fresh %agent [our.bowl %hood] %poke kiln-install+!>(fresh)]
-      ::  resubscribe if we somehow get unsubscribed from eth-watcher
-      ::
-      ?:  (~(has by wex.bowl) [/eth-watcher our.bowl %eth-watcher])
-        cards
-      ~&  >>  %resubscribing-to-eth-watcher
-      [(subscribe-to-eth-watcher bowl) cards]
+        (weld %*(start do number.id.sap.state last-block) cards)
+      =?  cards  !(~(has by wex.bowl) [/eth-watcher our.bowl %eth-watcher])
+        ::  resubscribe if we somehow get unsubscribed from eth-watcher
+        ::
+        [(subscribe-to-eth-watcher bowl) cards]
+      =.  cards
+        ::  %jael will re-subscribe to get all azimuth diffs
+        ::
+        [(listen-to-azimuth ~ [%| dap.bowl]) cards]
+      (flop cards)
    ::
        %watch
-      =:  nas.state   ?:(?=(%default net.poke) nas.snap *^state:naive)
-          own.state   ?:(?=(%default net.poke) owners.snap ~)
-          spo.state   ?:(?=(%default net.poke) sponsors.snap ~)
+      =:  nas.state   ?:(?=(%default net.poke) nas.sap.state *^state:naive)
+          own.state   ?:(?=(%default net.poke) owners.sap.state ~)
+          spo.state   ?:(?=(%default net.poke) sponsors.sap.state ~)
          net.state   net.poke
          url.state   url.poke
          logs.state  ~
        ==
-      [start:do this]
+      `this
    ==
  ::
  ++  on-watch
@ -309,7 +333,7 @@
        :-  %leaf
        "ship: processing azimuth snapshot ({<points>} points)"
    =/  snap-cards=udiffs:point
-      (%*(run-state do logs.state ~) id.snap points.nas.state)
+      (%*(run-state do logs.state ~) id.sap.state points.nas.state)
    [(weld (jael-update:do snap-cards) start:do) this]
  ::
  ++  on-leave  on-leave:def
@ -318,13 +342,14 @@
    ^-  (unit (unit cage))
    |^
    ?+  path  (on-peek:def path)
-        [%x %logs ~]     ``noun+!>(logs.state)
-        [%x %nas ~]      ``noun+!>(nas.state)
-        [%x %dns ~]      ``noun+!>(dns.nas.state)
-        [%x %own ~]      ``noun+!>(own.state)
-        [%x %spo ~]      ``noun+!>(spo.state)
-        [%x %refresh ~]  ``atom+!>(refresh.state)
-        [%x %point @ ~]  ``noun+(point i.t.t.path)
+        [%x %logs ~]       ``noun+!>(logs.state)
+        [%x %nas ~]        ``noun+!>(nas.state)
+        [%x %dns ~]        ``noun+!>(dns.nas.state)
+        [%x %own ~]        ``noun+!>(own.state)
+        [%x %spo ~]        ``noun+!>(spo.state)
+        [%x %refresh ~]    ``atom+!>(refresh.state)
+        [%x %point @ ~]    ``noun+(point i.t.t.path)
+        [%x %last-snap ~]  ``noun+!>(sap.state)
    ==
    ::
    ++  point
@ -369,19 +394,24 @@
  ::
  ++  on-arvo
    |=  [=wire =sign-arvo]
+    ?:  &(=(/al wire) ?=(%arow +<.sign-arvo))
+      ?-    -.p.sign-arvo
+          %&  `this
+          %|
+        %-  (slog 'loading azimuth snapshot failed! still trying' p.p.sign-arvo)
+        [~[(init-timer (add ~s10 now.bowl))] this]
+      ==
    ?.  &(=(/init wire) ?=(%wake +<.sign-arvo))
      (on-arvo:def wire sign-arvo)
    ?^  error.sign-arvo
      %-  (slog 'azimuth: failed to initialize!' ~)
      `this
    :_  this
-    ~[(subscribe-to-eth-watcher bowl) (listen-to-azimuth ~ [%| dap.bowl])]
+    ~[start-azimuth-load]
  ::
  ++  on-fail   on-fail:def
  --
 |_  =bowl:gall
-::  TODO: maybe flop the endianness here so metamask signs it in normal
-::  order?
 ::
 ++  verifier
  ^-  ^verifier:naive
@ -514,7 +544,7 @@
    :+  %watch  /[dap.bowl]
    ^-  config:eth-watcher
    :*  url.state  =(%czar (clan:title our.bowl))  refresh.state  ~h30
-        (max launch.net ?:(=(net.state %default) +(last-snap) 0))
+        (max launch.net ?:(=(net.state %default) +(number.id.sap.state) 0))
        ~
        ~[azimuth.net]
        ~[naive.net]
--- a/pkg/arvo/app/azimuth/version-0.azimuth-snapshot
+++ b/pkg/arvo/app/azimuth/version-0.azimuth-snapshot
--- a/pkg/arvo/app/dojo.hoon
+++ b/pkg/arvo/app/dojo.hoon
@ -532,10 +532,11 @@
      ?:  ?=([%show %3] -.mad)
        (dy-rash %tan (dy-show-source q.mad) ~)
      ?:  ?=(%brev -.mad)
+        ?:  ?=(?(%eny %now %our) p.mad)
+          (dy-rash %tan (cat 3 p.mad ' is immutable') ~)
        =.  var  (~(del by var) p.mad)
        =<  dy-amok
        ?+  p.mad  .
-          $?(%eny %now %our)  !!
          %lib  .(lib ~)
          %sur  .(sur ~)
          %dir  .(dir [[our.hid %base ud+0] /])
@ -543,13 +544,12 @@
      =+  cay=(~(got by rez) p.q.mad)
      ?-    -.p.mad
          %verb
+        ?:  ?=(?(%eny %now %our) p.p.mad)
+          (dy-rash %tan (cat 3 p.p.mad ' is immutable') ~)
        =.  var  (~(put by var) p.p.mad cay)
        ~|  bad-set+[p.p.mad p.q.cay]
        =<  dy-amok
        ?+  p.p.mad  .
-            %eny  ~|(%entropy-is-eternal !!)
-            %now  ~|(%time-is-immutable !!)
-            %our  ~|(%self-is-immutable !!)
            %lib
          %_    .
              lib
@ -568,6 +568,8 @@
                      ?:  ?=([@ ~] pax)  ~[i.pax %base '0']
                      ?:  ?=([@ @ ~] pax)  ~[i.pax i.t.pax '0']
                      pax
+                  ?:  =(~ .^((list path) %ct pax))
+                    +(..dy (he-diff %tan 'dojo: dir does not exist' ~))
                  =.  dir  (need (de-beam pax))
                  =-  +>(..dy (he-diff %tan - ~))
                  rose+[" " `~]^~[leaf+"=%" (smyt (en-beam he-beak s.dir))]
@ -735,9 +737,9 @@
      ^+  +>+>
      =^  dat  say  (~(transceive sole say) cal)
      ?:  |(?=(^ per) ?=(^ pux) ?=(~ pro))
-        ~&  %dy-edit-busy
        =^  lic  say  (~(transmit sole say) dat)
-        (dy-diff %mor [%det lic] [%bel ~] ~)
+        =/  tip=@t  'dojo: busy (press backspace to abort)'
+        (dy-diff %mor [%det lic] [%bel ~] [%tan [tip ~]] ~)
      =>  .(per `dat)
      =/  res  (mule |.((slam u.pro !>((tufa buf.say)))))
      ?:  ?=(%| -.res)
--- a/pkg/arvo/app/eth-watcher.hoon
+++ b/pkg/arvo/app/eth-watcher.hoon
@ -469,6 +469,10 @@
      [~ this(dogs.state (~(put by dogs.state) path u.dog(running ~)))]
    ::
        %thread-done
+      ::  if empty, that means we cancelled this thread
+      ::
+      ?:  =(*vase q.cage.sign)
+        `this
      =+  !<([vows=disavows pup=watchpup] q.cage.sign)
      =.  u.dog
        %_  u.dog
--- a/pkg/arvo/gen/ames-flows.hoon
+++ b/pkg/arvo/gen/ames-flows.hoon
@ -0,0 +1,46 @@
+::  print [len] %ames flows, sorted by number-per-ship
+::
+:-  %say
+|=  [[now=@da eny=@uvJ bec=beak] arg=$@(~ [len=@ ~]) ~]
+:-  %noun
+::
+=;  flows
+  ^-  (list [=ship open=[out-open=@ out-closing=@ in=@ nax=@] corked=@])
+  =/  len   ?^(arg len.arg 50)
+  (scag len (sort flows |=([[@ [a=@ud *] *] @ [b=@ud *] *] (gth a b))))
+::
+=/  peers-map
+  .^  (map ship ?(%alien %known))
+      %ax  /(scot %p p.bec)//(scot %da now)/peers
+  ==
+=/  peers=(list ship)
+  %+  murn  ~(tap by peers-map)
+  |=  [=ship val=?(%alien %known)]
+  ?:  =(ship p.bec)
+    ~  ::  this is weird, but we saw it
+  ?-  val
+    %alien  ~
+    %known  (some ship)
+  ==
+::
+^-  (list [=ship open=[out-open=@ out-closing=@ in=@ nax=@] corked=@])
+%+  turn  peers
+|=  =ship
+=+  .^  =ship-state:ames
+        %ax  /(scot %p p.bec)//(scot %da now)/peers/(scot %p ship)
+    ==
+=/  =peer-state:ames  ?>(?=(%known -.ship-state) +.ship-state)
+=/  corked  ~(wyt in corked.peer-state)
+=-  [ship - corked]
+::
+=+  %+  roll  ~(tap in ~(key by snd.peer-state))
+    |=  [b=bone [out=(list bone) in=(list bone) nax=(list bone)]]
+    =/  m  (mod b 4)
+    ?+  m  ~|([%odd-bone b] !!)
+      %0  [[b out] in nax]
+      %1  [out [b in] nax]
+      %3  [out in [b nax]]
+    ==
+=/  [out-closing=(list bone) out-open=(list bone)]
+  (skid out ~(has ^in closing.peer-state))
+[(lent out-open) (lent out-closing) (lent in) (lent nax)]
--- a/pkg/arvo/gen/ames-timers.hoon
+++ b/pkg/arvo/gen/ames-timers.hoon
@ -0,0 +1,20 @@
+::  print [len] %ames message-pump timers, sorted by number-per-ship
+::
+:-  %say
+|=  [[now=@da eny=@uvJ bec=beak] arg=$@(~ [len=@ ~]) ~]
+:-  %noun
+::
+=;  who
+  ^-  (list [@ta @ud])
+  =/  len   ?^(arg len.arg 50)
+  (scag len (sort ~(tap by who) |=([[@ a=@ud] @ b=@ud] (gth a b))))
+::
+=|  who=(map @ta @ud)
+=/  tim  .^((list (pair @da duct)) bx+/(scot %p p.bec)//(scot %da now)/debug/timers)
+|-  ^+   who
+?~  tim  who
+?.  &(?=(^ q.i.tim) ?=([%ames %pump ^] i.q.i.tim))
+  $(tim t.tim)
+=*  her  i.t.t.i.q.i.tim
+=/  i  (~(gut by who) her 0)
+$(tim t.tim, who (~(put by who) her +(i)))
--- a/pkg/arvo/gen/azimuth/kick.hoon
+++ b/pkg/arvo/gen/azimuth/kick.hoon
@ -1,5 +0,0 @@
-::  Kick azimuth
-::
-:-  %say
-|=  *
-[%azimuth-poke %kick ~]
--- a/pkg/arvo/gen/gall-nonces.hoon
+++ b/pkg/arvo/gen/gall-nonces.hoon
@ -0,0 +1,10 @@
+::  +gall-nonces: print %gall agent subscription nonces, highest-last
+::
+:-  %say
+|=  [[now=@da eny=@uvJ bec=beak] ~ ~]
+:-  %noun
+^-  (list [dude:gall @ud])
+%+  sort
+  %~  tap  by
+  .^((map dude:gall @ud) %gf /(scot %p p.bec)//(scot %da now))
+|=([[* a=@ud] [* b=@ud]] (lth a b))
--- a/pkg/arvo/gen/hood/doff.hoon
+++ b/pkg/arvo/gen/hood/doff.hoon
@ -0,0 +1,8 @@
+:-  %say
+|=  $:  [now=@da eny=@uvJ bec=beak]
+        ~
+        [dude=_`dude:gall`%$ ship=_`@p`(bex 128)]
+    ==
+=/  darg=(unit dude:gall)  ?:(=(%$ dude) ~ `dude)
+=/  sarg=(unit ^ship)      ?:(=((bex 128) ship) ~ `ship)
+[%helm-doff darg sarg]
--- a/pkg/arvo/gen/hood/gall-sift.hoon
+++ b/pkg/arvo/gen/hood/gall-sift.hoon
@ -0,0 +1,8 @@
+::  Helm: Set Gall Verbosity by Agent
+::
+/?    310
+::
+:-  %say
+|=  [^ dudes=(list dude:gall) ~]
+:-  %helm-gall-sift
+dudes
--- a/pkg/arvo/gen/hood/gall-verb.hoon
+++ b/pkg/arvo/gen/hood/gall-verb.hoon
@ -0,0 +1,11 @@
+::  Helm: Adjust Gall verbosity
+::
+::  List of diagnostic flags is in verb:gall in zuse.hoon, documented in
+::  gall.hoon
+::
+/?    310
+::
+:-  %say
+|=  [^ veb=(list verb:gall) ~]
+:-  %helm-gall-verb
+veb
--- a/pkg/arvo/gen/hood/rein.hoon
+++ b/pkg/arvo/gen/hood/rein.hoon
@ -9,7 +9,9 @@
 :-  %kiln-rein
 :-  desk
 %+  roll  arg
-=|  =rein:hood
+=/  =rein:hood
+  =<  rein.arak
+  .^(vat:hood %gx /(scot %p p.bec)/hood/(scot %da now)/kiln/vat/[desk]/noun)
 |:  [*[on=? =dude:gall] rein=rein(liv liv)]
 ?:  on
  rein(add (~(put in add.rein) dude))
--- a/pkg/arvo/lib/hood/drum.hoon
+++ b/pkg/arvo/lib/hood/drum.hoon
@ -77,7 +77,8 @@
 ::
 ++  de-gill                                           ::  gill from wire
  |=  way=wire  ^-  gill:gall
-  ?>(?=([@ @ ~] way) [(slav %p i.way) i.t.way])
+  ~|  way
+  ?>(?=([@ @ *] way) [(slav %p i.way) i.t.way])
 --
 ::  TODO: remove .ost
 ::
--- a/pkg/arvo/lib/hood/helm.hoon
+++ b/pkg/arvo/lib/hood/helm.hoon
@ -230,6 +230,14 @@
  |=  veb=(list verb:ames)  =<  abet
  (emit %pass /helm %arvo %a %spew veb)
 ::
++  poke-gall-sift
+  |=  dudes=(list dude:gall)  =<  abet
+  (emit %pass /helm %arvo %g %sift dudes)
+::
++  poke-gall-verb
+  |=  veb=(list verb:gall)  =<  abet
+  (emit %pass /helm %arvo %g %spew veb)
+::
 ++  poke-ames-wake
  |=  ~  =<  abet
  (emit %pass /helm %arvo %a %stir '')
@ -252,6 +260,11 @@
  =<  abet
  (emit %pass /helm/cors/reject %arvo %e %reject-origin origin)
 ::
++  poke-doff
+  |=  [dude=(unit dude:gall) ship=(unit ship)]
+  =<  abet
+  (emit %pass /helm/doff %arvo %g %doff dude ship)
+::
 ++  poke
  |=  [=mark =vase]
  ?>  ?|  ?=(%helm-hi mark)
@ -269,6 +282,9 @@
    %helm-code             =;(f (f !<(_+<.f vase)) poke-code)
    %helm-cors-approve     =;(f (f !<(_+<.f vase)) poke-cors-approve)
    %helm-cors-reject      =;(f (f !<(_+<.f vase)) poke-cors-reject)
+    %helm-doff             =;(f (f !<(_+<.f vase)) poke-doff)
+    %helm-gall-sift        =;(f (f !<(_+<.f vase)) poke-gall-sift)
+    %helm-gall-verb        =;(f (f !<(_+<.f vase)) poke-gall-verb)
    %helm-hi               =;(f (f !<(_+<.f vase)) poke-hi)
    %helm-knob             =;(f (f !<(_+<.f vase)) poke-knob)
    %helm-pans             =;(f (f !<(_+<.f vase)) poke-pans)
--- a/pkg/arvo/lib/test/ames-gall.hoon
+++ b/pkg/arvo/lib/test/ames-gall.hoon
@ -0,0 +1,203 @@
+/+  *test, test-pub, test-sub
+/=  ames-raw      /sys/vane/ames
+/=  gall-raw  /sys/vane/gall
+::
+=/  ames-bunt  (ames-raw ~zod)
+=/  gall-bunt  (gall-raw ~zod)
+::  basic helpers
+::
+|%
++  make-gall
+  |=  =ship
+  =/  gall-pupa  (gall-raw ship)
+  =/  gall-core  (gall-pupa now=~1111.1.1 eny=`@`0xdead.beef scry=*roof)
+  =+  [out adult]=(call:gall-core duct=~[/init] dud=~ task=[%init ~])
+  adult
+::
++  ames-nec-bud
+  ::  create ~nec
+  ::
+  =/  nec  (ames-raw ~nec)
+  =.  now.nec        ~1111.1.1
+  =.  eny.nec        0xdead.beef
+  =.  life.ames-state.nec  2
+  =.  rof.nec  |=(* ``[%noun !>(*(list turf))])
+  =.  crypto-core.ames-state.nec  (pit:nu:crub:crypto 512 (shaz 'nec'))
+  =/  nec-pub  pub:ex:crypto-core.ames-state.nec
+  =/  nec-sec  sec:ex:crypto-core.ames-state.nec
+  ::  create ~bud
+  ::
+  =/  bud  (ames-raw ~bud)
+  =.  now.bud        ~1111.1.1
+  =.  eny.bud        0xbeef.dead
+  =.  life.ames-state.bud  3
+  =.  rof.bud  |=(* ``[%noun !>(*(list turf))])
+  =.  crypto-core.ames-state.bud  (pit:nu:crub:crypto 512 (shaz 'bud'))
+  =/  bud-pub  pub:ex:crypto-core.ames-state.bud
+  =/  bud-sec  sec:ex:crypto-core.ames-state.bud
+  ::
+  =/  nec-sym  (derive-symmetric-key:ames-raw bud-pub nec-sec)
+  =/  bud-sym  (derive-symmetric-key:ames-raw nec-pub bud-sec)
+  ?>  =(nec-sym bud-sym)
+  ::  tell ~nec about ~bud
+  ::
+  =.  peers.ames-state.nec
+    %+  ~(put by peers.ames-state.nec)  ~bud
+    =|  =peer-state:ames
+    =.  -.peer-state
+      :*  symmetric-key=bud-sym
+          life=3
+          rift=0
+          public-key=bud-pub
+          sponsor=~bud
+      ==
+    =.  route.peer-state  `[direct=%.y `lane:ames`[%& ~bud]]
+    [%known peer-state]
+  ::  tell ~bud about ~nec
+  ::
+  =.  peers.ames-state.bud
+    %+  ~(put by peers.ames-state.bud)  ~nec
+    =|  =peer-state:ames
+    =.  -.peer-state
+      :*  symmetric-key=nec-sym
+          life=2
+          rift=0
+          public-key=nec-pub
+          sponsor=~nec
+      ==
+    =.  route.peer-state  `[direct=%.y `lane:ames`[%& ~nec]]
+    [%known peer-state]
+  ::  metamorphose
+  ::
+  =>  .(nec +:(call:(nec) ~[//unix] ~ %born ~))
+  =>  .(bud +:(call:(bud) ~[//unix] ~ %born ~))
+  ::
+  [nec=nec bud=bud]
+--
+::  forward-declare to avoid repeated metamorphoses
+=/  gall-adult  (make-gall ~zod)
+=/  ames-adult  nec:ames-nec-bud
+::  main core
+::
+|%
+$  gall-gate  _gall-adult
+$  ames-gate  _ames-adult
+::
++  nec-bud
+  =/  a  ames-nec-bud
+  =/  gall-nec  (make-gall ~nec)
+  =.  gall-nec  (load-agent ~nec gall-nec %sub test-sub)
+  =/  gall-bud  (make-gall ~bud)
+  =.  gall-bud  (load-agent ~bud gall-bud %pub test-pub)
+  :*  nec=[ames=nec.a gall=gall-nec]
+      bud=[ames=bud.a gall=gall-bud]
+  ==
+::  +gall-check-call: run gall task, assert produces expected-moves
+::
++  gall-check-call
+  |=  $:  =gall-gate
+          [now=@da eny=@ =roof]
+          [=duct task=(hobo task:gall)]
+          expected-moves=(list move:gall-bunt)
+      ==
+  ^-  [tang ^gall-gate]
+  =/  gall-core  (gall-gate now eny roof)
+  =^  moves  gall-gate  (call:gall-core duct dud=~ task)
+  [(expect-eq !>(expected-moves) !>(moves)) gall-gate]
+::
++  gall-call
+  |=  [=gall-gate =duct task=(hobo task:gall) =roof]
+  %.  [duct dud=~ task]
+  call:(gall-gate now=~1111.1.1 eny=`@`0xdead.beef roof)
+::  +gall-check-take: run gall sign, assert produces expected-moves
+::
++  gall-check-take
+  |=  $:  =gall-gate
+          [now=@da eny=@ =roof]
+          [=wire =duct =sign-arvo]
+          expected-moves=(list move:gall-bunt)
+      ==
+  ^-  [tang ^gall-gate]
+  =/  gall-core  (gall-gate now eny roof)
+  =^  moves  gall-gate  (take:gall-core wire duct dud=~ sign-arvo)
+  [(expect-eq !>(expected-moves) !>(moves)) gall-gate]
+::
++  gall-take
+  |=  [=gall-gate =wire =duct =sign-arvo =roof]
+  %.  [wire duct dud=~ sign-arvo]
+  take:(gall-gate now=~1111.1.1 eny=`@`0xdead.beef roof)
+::  +ames-check-call: run gall task, assert produces expected-moves
+::
++  ames-check-call
+  |=  $:  =ames-gate
+          [now=@da eny=@ =roof]
+          [=duct task=(hobo task:ames)]
+          expected-moves=(list move:ames-bunt)
+      ==
+  ^-  [tang ^ames-gate]
+  =/  ames-core  (ames-gate now eny roof)
+  =^  moves  ames-gate  (call:ames-core duct dud=~ task)
+  [(expect-eq !>(expected-moves) !>(moves)) ames-gate]
+::
++  ames-call
+  |=  [=ames-gate =duct task=(hobo task:ames) =roof]
+  %.  [duct dud=~ task]
+  call:(ames-gate now=~1111.1.1 eny=`@`0xdead.beef roof)
+::  +ames: run ames sign, assert produces expected-moves
+::
++  ames-check-take
+  |=  $:  =ames-gate
+          [now=@da eny=@ =roof]
+          [=wire =duct =sign:ames-bunt]
+          expected-moves=(list move:ames-bunt)
+      ==
+  ^-  [tang ^ames-gate]
+  =/  ames-core  (ames-gate now eny roof)
+  =^  moves  ames-gate  (take:ames-core wire duct dud=~ sign)
+  [(expect-eq !>(expected-moves) !>(moves)) ames-gate]
+::
++  ames-scry-peer
+  |=  $:  =ames-gate
+          [now=@da eny=@ =roof]
+          our=ship
+          her=ship
+      ==
+  ^-  peer-state:ames
+  =-  ?>(?=(%known -<) ->)
+  !<  ship-state:ames
+  =<  q
+  %-  need  %-  need
+  %-  scry:(ames-gate now eny roof)
+  [~ %x [[our %$ da+now] /peers/(scot %p her)]]
+::
++  gall-scry-nonce
+  |=  $:  =gall-gate
+          [now=@da eny=@ =roof]
+          our=ship
+          =dude:gall
+          sub=[=ship =term =wire]
+      ==
+  ^-  @ud
+  !<  @ud
+  =<  q
+  %-  need  %-  need
+  %-  scry:(gall-gate now eny roof)
+  [~ %n [[our dude da+now] [(scot %p ship.sub) [term wire]:sub]]]
+::
++  load-agent
+  |=  [=ship =gall-gate =dude:gall =agent:gall]
+  =^  *  gall-gate
+    (gall-call gall-gate ~[/jolt] [%jolt %base dude] *roof)
+  =^  *  gall-gate
+    =/  =sign-arvo
+      :+  %clay  %writ
+      `[[%a da+~1111.1.1 %base] /app/[dude]/hoon vase+!>(!>(agent))]
+    %:  gall-take
+      gall-gate
+      /sys/cor/[dude]/(scot %p ship)/base/(scot %da ~1111.1.1)
+      ~[/jolt]
+      sign-arvo
+      *roof
+    ==
+  gall-gate
+--
--- a/pkg/arvo/lib/test/pub.hoon
+++ b/pkg/arvo/lib/test/pub.hoon
@ -0,0 +1,36 @@
+/+  default-agent, verb, dbug
+::
+=|  state=~
+%-  agent:dbug
+%+  verb  &
+^-  agent:gall
+|_  =bowl:gall
+*  this  .
+    def   ~(. (default-agent this %|) bowl)
+::
++  on-poke
+  |=  [=mark =vase]
+  (on-poke:def +<)
+::
++  on-watch
+  |=  =path
+  `this
+::
++  on-agent
+  |=  [=wire =sign:agent:gall]
+  (on-agent:def +<)
+::
++  on-fail
+  |=  [=term =tang]
+  (mean ':pub +on-fail' term tang)
+::
++  on-leave
+  |=  =path
+  `this
+::
++  on-init   `this
++  on-save   !>(state)
++  on-load   |=(old=vase `this(state !<(_state old)))
++  on-arvo   on-arvo:def
++  on-peek   on-peek:def
+--
--- a/pkg/arvo/lib/test/sub.hoon
+++ b/pkg/arvo/lib/test/sub.hoon
@ -0,0 +1,47 @@
+/+  default-agent, verb, dbug
+::
+=|  state=~
+%-  agent:dbug
+%+  verb  &
+^-  agent:gall
+|_  =bowl:gall
+*  this  .
+    def   ~(. (default-agent this %|) bowl)
+::
++  on-poke
+  |=  [=mark =vase]
+  =+  !<(=ship vase)
+  :_  this
+  ?+  mark  !!
+    %leave  [%pass /sub-foo/(scot %p ship) %agent [ship %pub] %leave ~]~
+    %watch  [%pass /sub-foo/(scot %p ship) %agent [ship %pub] %watch /foo]~
+  ==
+::
++  on-watch
+  |=  =path
+  (on-watch:def +<)
+::
++  on-agent
+  |=  [=wire =sign:agent:gall]
+  =/  =ship  (slav %p &2.wire)
+  ?+    -.sign  !!
+      %fact       `this
+      %watch-ack  `this
+      %kick
+    [[%pass /sub-foo/(scot %p ship) %agent [ship %pub] %watch /foo]~ this]
+  ==
+::
++  on-fail
+  |=  [=term =tang]
+  (mean ':sub +on-fail' term tang)
+::
++  on-leave
+  |=  =path
+  `this
+::
++  on-init   `this
++  on-save   !>(state)
++  on-load   |=(old=vase `this(state !<(_state old)))
++  on-arvo   on-arvo:def
++  on-peek   on-peek:def
+--
--- a/pkg/arvo/mar/aqua/effect.hoon
+++ b/pkg/arvo/mar/aqua/effect.hoon
@ -0,0 +1,12 @@
+/-  *aquarium
+|_  af=aqua-effect
++  grad  %noun
++  grow
+  |%
+  ++  noun  af
+  --
++  grab
+  |%
+  ++  noun  aqua-effect
+  --
+--
--- a/pkg/arvo/mar/dns/complete.hoon
+++ b/pkg/arvo/mar/dns/complete.hoon
@ -8,5 +8,14 @@
 ++  grab
  |%
  +$  noun  [ship binding]
+  ++  json
+    =,  dejs:format
+    |=  jon=json
+    %.  jon
+    %-  ot
+    :~  [%ship |=(j=json ?>(?=([%s *] j) (rash +.j fed:ag)))]
+        [%address |=(j=json ?>(?=([%s *] j) [%if (rash +.j ip4:eyre)]))]
+        [%turf (ar so)]
+    ==
  --
 --
--- a/pkg/arvo/mar/dns/request.hoon
+++ b/pkg/arvo/mar/dns/request.hoon
@ -0,0 +1,16 @@
+/-  *dns
+|_  r=request
++  grad  %noun
++  grow
+  |%
+  ++  json
+    %-  pairs:enjs:format
+    :~  ['ship' (ship:enjs:format ship.r)]
+        ['address' s+(rsh 3 (scot %if +.address.r))]
+    ==
+  --
++  grab
+  |%
+  ++  noun  request
+  --
+--
--- a/pkg/arvo/sur/dice.hoon
+++ b/pkg/arvo/sur/dice.hoon
@ -7,6 +7,7 @@
 +$  owners      (jug owner ship)
 +$  sponsors    (map ship [residents=(set ship) requests=(set ship)])
 +$  history     (map address:ethereum (tree hist-tx))
+$  events      (list event-log:rpc:ethereum)
 +$  net         ?(%mainnet %ropsten %local %default)
 +$  snap-state  [%0 =id:block:jael nas=^state:naive =owners =sponsors]
 ::
--- a/pkg/arvo/sys/lull.hoon
+++ b/pkg/arvo/sys/lull.hoon
@ -351,6 +351,7 @@
  ::    %hear: packet from unix
  ::    %heed: track peer's responsiveness; gives %clog if slow
  ::    %jilt: stop tracking peer's responsiveness
+  ::    %cork: request to delete message flow
  ::    %plea: request to send message
  ::
  ::    System and Lifecycle Tasks
@ -367,6 +368,7 @@
    $%  [%hear =lane =blob]
        [%heed =ship]
        [%jilt =ship]
+        [%cork =ship]
        $>(%plea vane-task)
    ::
        $>(%born vane-task)
@ -511,6 +513,9 @@
  ::         entry and emit a nack to the local vane that asked us to send
  ::         the message.
  ::    heeds: listeners for %clog notifications
+  ::    closing: bones closed on the sender side
+  ::    corked:  bones closed on both sender and receiver
+  ::    krocs:   bones that need to be sent again to the publisher
  ::
  +$  peer-state
    $:  $:  =symmetric-key
@ -526,6 +531,9 @@
        rcv=(map bone message-sink-state)
        nax=(set [=bone =message-num])
        heeds=(set duct)
+        closing=(set bone)
+        corked=(set bone)
+        krocs=(set bone)
    ==
  ::  $qos: quality of service; how is our connection to a peer doing?
  ::
@ -1651,15 +1659,18 @@
        [%jolt =desk =dude]                             ::  (re)start agent
        [%idle =dude]                                   ::  suspend agent
        [%nuke =dude]                                   ::  delete agent
+        [%doff dude=(unit dude) ship=(unit ship)]       ::  kill subscriptions
+        [%rake dude=(unit dude) all=?]                  ::  reclaim old subs
        $>(%init vane-task)                             ::  set owner
        $>(%trim vane-task)                             ::  trim state
        $>(%vega vane-task)                             ::  report upgrade
        $>(%plea vane-task)                             ::  network request
+        [%spew veb=(list verb)]                         ::  set verbosity
+        [%sift dudes=(list dude)]                       ::  per agent
    ==                                                  ::
  +$  bitt  (map duct (pair ship path))                 ::  incoming subs
-  +$  boat                                              ::  outgoing subs
-    %+  map  [=wire =ship =term]                        ::
-    [acked=? =path]                                     ::
+  +$  boat  (map [=wire =ship =term] [acked=? =path])   ::  outgoing subs
+  +$  boar  (map [=wire =ship =term] nonce=@)           ::  and their nonces
  +$  bowl                                              ::  standard app state
          $:  $:  our=ship                              ::  host
                  src=ship                              ::  guest
@ -1695,6 +1706,9 @@
    $%  [%raw-fact =mark =noun]
        sign:agent
    ==
+  ::  TODO: add more flags?
+  ::
+  +$  verb  ?(%odd)
  ::
  ::  +agent: app core
  ::
--- a/pkg/arvo/sys/vane/ames.hoon
+++ b/pkg/arvo/sys/vane/ames.hoon
--- a/pkg/arvo/sys/vane/behn.hoon
+++ b/pkg/arvo/sys/vane/behn.hoon
@ -45,161 +45,112 @@
  |=  [[now=@da =duct] state=behn-state]
  ::
  |%
-  ::  %entry-points
  ::
-  ::  +born: urbit restarted; refresh :next-wake and store wakeup timer duct
+  +|  %helpers
  ::
-  ++  born  set-unix-wake(next-wake.state ~, unix-duct.state duct)
-  ::  +crud: handle failure of previous arvo event
-  ::
-  ++  crud
-    |=  [tag=@tas error=tang]
+  ++  this  .
+  ++  emit  |=(m=move this(moves [m moves]))
+  ++  abet
    ^+  [moves state]
-    ::  behn must get activated before other vanes in a %wake
+    ::  moves are statefully pre-flopped to ensure that
+    ::  any prepended %doze is emitted first
    ::
-    ?.  =(%wake tag)
-      ~&  %behn-crud-not-wake^tag
-      [[duct %slip %d %flog %crud tag error]~ state]
+    =.  moves  (flop moves)
+    =/  new=(unit @da)  (bind (pry:timer-map timers.state) head)
+    ::  emit %doze if needed
    ::
-    ?:  =(~ timers.state)
-      ~|(%behn-crud-no-timer^tag^error !!)
+    =?    ..this
+        ?~  unix-duct.state  |
+        =/  dif=[old=(unit @da) new=(unit @da)]  [next-wake.state new]
+        ?+  dif  ~|([%unpossible dif] !!)
+          [~ ~]  |                        :: no-op
+          [~ ^]  &                        :: set
+          [^ ~]  &                        :: clear
+          [^ ^]  !=(u.old.dif u.new.dif)  :: set if changed
+        ==
+      (emit(next-wake.state new) [unix-duct.state %give %doze new])
    ::
-    (wake `error)
-  ::  +rest: cancel the timer at :date, then adjust unix wakeup
-  ::  +wait: set a new timer at :date, then adjust unix wakeup
+    [moves state]
  ::
-  ++  rest  |=(date=@da set-unix-wake(timers.state (unset-timer [date duct])))
-  ++  wait  |=(date=@da set-unix-wake(timers.state (set-timer [date duct])))
-  ::  +huck: give back immediately
+  +|  %entry-points
  ::
-  ::    Useful if you want to continue working after other moves finish.
+  ++  call
+    |=  [=task error=(unit tang)]
+    ^+  this
+    ?:  ?&  ?=(^ error)
+            !?=(%wake -.task)
+        ==
+      ::  XX more and better error handling
+      ::
+      ~&  %behn-crud-not-wake^-.task
+      (emit [duct %slip %d %flog %crud -.task u.error])
+    ::
+    ?-  -.task
+      %born  this(next-wake.state ~, unix-duct.state duct)
+      %drip  (drip p.task)
+      %huck  (emit [duct %give %heck syn.task])
+      %rest  this(timers.state (unset-timer [p.task duct]))
+      %trim  this
+      %vega  this
+      %wait  this(timers.state (set-timer [p.task duct]))
+      %wake  (wake(next-wake.state ~) error)
+    ==
  ::
-  ++  huck
-    |=  syn=sign-arvo
-    =<  [moves state]
-    event-core(moves [duct %give %heck syn]~)
-  ::  +drip:  XX
-  ::
-  ++  drip
-    |=  mov=vase
-    =<  [moves state]
-    ^+  event-core
-    =.  moves
-      [duct %pass /drip/(scot %ud count.drips.state) %b %wait +(now)]~
-    =.  movs.drips.state
-      (~(put by movs.drips.state) count.drips.state mov)
-    =.  count.drips.state  +(count.drips.state)
-    event-core
-  ::  +take-drip:  XX
+  ::  +take-drip: the future is now, %give the deferred move
  ::
  ++  take-drip
    |=  [num=@ud error=(unit tang)]
-    =<  [moves state]
-    ^+  event-core
+    ^+  this
    =/  drip  (~(got by movs.drips.state) num)
-    =.  movs.drips.state  (~(del by movs.drips.state) num)
-    =/  =move
-      =/  card  [%give %meta drip]
-      ?~  error
-        [duct card]
-      =/  =tang
-        (weld u.error `tang`[leaf/"drip failed" ~])
-      ::  XX should be
-      ::  [duct %hurl fail/tang card]
-      ::
-      [duct %pass /drip-slog %d %flog %crud %drip-fail tang]
-    event-core(moves [move moves])
-  ::  +trim: in response to memory pressue
+    %-  emit(movs.drips.state (~(del by movs.drips.state) num))
+    =/  card  [%give %meta drip]
+    ?~  error
+      [duct card]
+    =/  =tang
+      (weld u.error `tang`[leaf/"drip failed" ~])
+    ::  XX should be
+    ::  [duct %hurl fail/tang card]
+    ::
+    [duct %pass /drip-slog %d %flog %crud %drip-fail tang]
  ::
-  ++  trim  [moves state]
-  ::  +vega: learn of a kernel upgrade
+  +|  %tasks
  ::
-  ++  vega  [moves state]
-  ::  +wake: unix says wake up; process the elapsed timer and set :next-wake
+  ::  +drip: enqueue a future gift (as a vase), %pass ourselves a %wait
+  ::
+  ++  drip
+    |=  vax=vase
+    ^+  this
+    %.  [duct %pass /drip/(scot %ud count.drips.state) %b %wait +(now)]
+    %=  emit
+      movs.drips.state   (~(put by movs.drips.state) count.drips.state vax)
+      count.drips.state  +(count.drips.state)
+    ==
+  ::
+  ::  +wake: unix says wake up; process the elapsed timer (or forward error)
  ::
  ++  wake
    |=  error=(unit tang)
-    ^+  [moves state]
-    ::  no-op on spurious but innocuous unix wakeups
-    ::
+    ^+  this
    ?:  =(~ timers.state)
+      ::  no-op on spurious but innocuous unix wakeups
+      ::
      ~?  ?=(^ error)  %behn-wake-no-timer^u.error
-      [moves state]
-    ::  if we errored, pop the timer and notify the client vane of the error
-    ::
-    ?^  error
-      =<  set-unix-wake
-      =^  =timer  timers.state  pop-timer
-      (emit-vane-wake duct.timer error)
-    ::  if unix woke us too early, retry by resetting the unix wakeup timer
-    ::
+      this
    =/  [=timer later-timers=_timers.state]  pop-timer
    ?:  (gth date.timer now)
-      set-unix-wake(next-wake.state ~)
-    ::  pop first timer, tell vane it has elapsed, and adjust next unix wakeup
+      ::  no-op if timer is early, (+abet will reset)
+      ::
+      this
+    ::  pop the first timer and notify client vane,
+    ::  forwarding error if present
    ::
-    =<  set-unix-wake
-    (emit-vane-wake(timers.state later-timers) duct.timer ~)
-  ::  %utilities
+    ::    XX %wake errors should be signaled out-of-band
+    ::    [duct.timer %hurl goof %give %wake ~]
+    ::
+    (emit(timers.state later-timers) [duct.timer %give %wake error])
  ::
-  ::+|
+  +|  %implementation
  ::
-  ++  event-core  .
-  ::  +emit-vane-wake: produce a move to wake a vane; assumes no prior moves
-  ::
-  ++  emit-vane-wake
-    |=  [=^duct error=(unit tang)]
-    event-core(moves [duct %give %wake error]~)
-  ::  +emit-doze: set new unix wakeup timer in state and emit move to unix
-  ::
-  ::    We prepend the unix %doze event so that it is handled first. Arvo must
-  ::    handle this first because the moves %behn emits will get handled in
-  ::    depth-first order. If we're handling a %wake which causes a move to a
-  ::    different vane and a %doze event to send to unix, Arvo needs to process
-  ::    the %doze first because otherwise if the move to the other vane calls
-  ::    back into %behn and emits a second %doze, the second %doze would be
-  ::    handled by unix first which is incorrect.
-  ::
-  ++  emit-doze
-    |=  =date=(unit @da)
-    ^+  event-core
-    ::  no-op if .unix-duct has not yet been set
-    ::
-    ?~  unix-duct.state
-      event-core
-    ::  make sure we don't try to wake up in the past
-    ::
-    =?  date-unit  ?=(^ date-unit)  `(max now u.date-unit)
-    ::
-    %_  event-core
-      next-wake.state  date-unit
-      moves            [[unix-duct.state %give %doze date-unit] moves]
-    ==
-  ::  +set-unix-wake: set or unset next unix wakeup timer based on :i.timers
-  ::
-  ++  set-unix-wake
-    =<  [moves state]
-    ~%  %set-unix-wake  ..part  ~  |-
-    ^+  event-core
-    ::
-    =*  next-wake  next-wake.state
-    =*  timers     timers.state
-    ::  if no timers, cancel existing wakeup timer or no-op
-    ::
-    =/  first=(unit [date=@da *])  (pry:timer-map timers.state)
-    ?~  first
-      ?~  next-wake
-        event-core
-      (emit-doze ~)
-    ::  if :next-wake is in the past or not soon enough, reset it
-    ::
-    ?^  next-wake
-      ?:  &((gte date.u.first u.next-wake) (lte now u.next-wake))
-        event-core
-      (emit-doze `date.u.first)
-    ::  there was no unix wakeup timer; set one
-    ::
-    (emit-doze `date.u.first)
  ::  +pop-timer: dequeue and produce earliest timer
  ::
  ++  pop-timer
@ -267,27 +218,10 @@
          wrapped-task=(hobo task)
      ==
  ^-  [(list move) _behn-gate]
-  ::
  =/  =task  ((harden task) wrapped-task)
  =/  event-core  (per-event [now hen] state)
-  ::
  =^  moves  state
-    ::
-    ::  handle error notifications
-    ::
-    ?^  dud
-      (crud:event-core -.task tang.u.dud)
-    ::
-    ?-  -.task
-      %born  born:event-core
-      %rest  (rest:event-core date=p.task)
-      %drip  (drip:event-core move=p.task)
-      %huck  (huck:event-core syn.task)
-      %trim  trim:event-core
-      %vega  vega:event-core
-      %wait  (wait:event-core date=p.task)
-      %wake  (wake:event-core error=~)
-    ==
+    abet:(call:event-core task ?~(dud ~ `tang.u.dud))
  [moves behn-gate]
 ::  +load: migrate an old state to a new behn version
 ::
@ -378,6 +312,6 @@
  ?>  ?=([%drip @ ~] tea)
  =/  event-core  (per-event [now hen] state)
  =^  moves  state
-    (take-drip:event-core (slav %ud i.t.tea) error.hin)
+    abet:(take-drip:event-core (slav %ud i.t.tea) error.hin)
  [moves behn-gate]
 --
--- a/pkg/arvo/sys/vane/eyre.hoon
+++ b/pkg/arvo/sys/vane/eyre.hoon
@ -251,7 +251,7 @@
      ;meta(charset "utf-8");
      ;meta(name "viewport", content "width=device-width, initial-scale=1, shrink-to-fit=no");
      ;link(rel "icon", type "image/svg+xml", href (weld "data:image/svg+xml;utf8," favicon));
-      ;title:"OS1"
+      ;title:"Urbit"
      ;style:'''
             @import url("https://rsms.me/inter/inter.css");
             @font-face {
@ -2178,7 +2178,7 @@
  ::    XX cancel active too if =(0 trim-priority) ?
  ::
  ?:  ?=(%trim -.task)
-    =/  event-args  [[eny duct now rof] server-state.ax]
+    =*  event-args  [[eny duct now rof] server-state.ax]
    =*  by-channel  by-channel:(per-server-event event-args)
    =*  channel-state  channel-state.server-state.ax
    ::
--- a/pkg/arvo/sys/vane/gall.hoon
+++ b/pkg/arvo/sys/vane/gall.hoon
--- a/pkg/arvo/sys/vane/jael.hoon
+++ b/pkg/arvo/sys/vane/jael.hoon
@ -306,28 +306,6 @@
        %^  poke-watch  hen  %azimuth
        %+  fall  node.tac
        (need (de-purl:html 'http://eth-mainnet.urbit.org:8545'))
-      =.  +>.$
-        ::  get everything from /app/azimuth because jael subscriptions
-        ::  seem to be flaky for now
-        ::
-        ?:  &
-          %-  curd  =<  abet
-          (sources:~(feel su hen now pki etn) ~ [%| %azimuth])
-        ::
-        ?-    (clan:title our)
-            %czar
-          %-  curd  =<  abet
-          (sources:~(feel su hen now pki etn) ~ [%| %azimuth])
-        ::
-            *
-          =.  +>.$
-            %-  curd  =<  abet
-            %+  sources:~(feel su hen now pki etn)
-              (silt (turn spon-points head))
-            [%| %azimuth]
-          %-  curd  =<  abet
-          (sources:~(feel su hen now pki etn) ~ [%& (need spon-ship)])
-        ==
      ::
      =.  moz
        %+  weld  moz
@ -391,7 +369,7 @@
    ::    [%listen whos=(set ship) =source]
    ::
        %listen
-      ~&  [%jael-listen whos source]:tac
+      ::  %-  (slog leaf+"jael: listen {<whos.tac>} {<source.tac>}" ~)
      %-  curd  =<  abet
      (sources:~(feel su hen now pki etn) [whos source]:tac)
    ::
--- a/pkg/arvo/ted/azimuth/load.hoon
+++ b/pkg/arvo/ted/azimuth/load.hoon
@ -0,0 +1,15 @@
+/-  spider, *dice
+/+  strand, strandio, naive, dice
+=,  strand=strand:spider
+^-  thread:spider
+|=  arg=vase
+=/  m  (strand ,vase)
+^-  form:m
+=/  url=tape
+  ?~  lur=!<((unit tape) arg)
+    "https://bootstrap.urbit.org/mainnet.azimuth-snapshot"
+  u.lur
+;<  =cord  bind:m  (fetch-cord:strandio url)
+=+  ;;(snap=snap-state (cue cord))
+;<  ~      bind:m  (poke-our:strandio %azimuth %azimuth-poke !>([%load snap]))
+(pure:m !>(~))
--- a/pkg/arvo/ted/dns/address.hoon
+++ b/pkg/arvo/ted/dns/address.hoon
@ -25,17 +25,17 @@
  |=  if=@if
  =/  m  (strand ,~)
  ^-  form:m
-  =/  collector-app  `dock`[~zod %dns-collector]
+  =/  collector-app  `dock`[~deg %dns-collector]
  ;<  good=?  bind:m  (self-check-http:libdns |+if 2)
  ?.  good
    %+  strand-fail:strandio  %bail-early-self-check
    [>"couldn't access ship on port 80"< ~]
+  ;<  our=@p  bind:m  get-our:strandio
+  ;<  ~       bind:m  (watch:strandio /response collector-app /(scot %p our))
  ;<  ~       bind:m  (poke:strandio collector-app %dns-address !>([%if if]))
  =/  msg=cord
    (cat 3 'request for DNS sent to ' (scot %p p:collector-app))
  ;<  ~       bind:m  (app-message:strandio %dns msg ~)
-  ;<  our=@p  bind:m  get-our:strandio
-  ;<  ~       bind:m  (watch:strandio /sub collector-app /(scot %p our))
  =/  msg=cord
    (cat 3 'awaiting response from ' (scot %p p:collector-app))
  ;<  ~       bind:m  (app-message:strandio %dns msg ~)
@ -45,7 +45,7 @@
  =/  m  (strand ,~)
  ^-  form:m
  ;<  our=ship  bind:m  get-our:strandio
-  ;<  =cage     bind:m  (take-fact:strandio /(scot %p our))
+  ;<  =cage     bind:m  (take-fact:strandio /response)
  ?>  ?=(%dns-binding p.cage)
  =/  =binding:dns  !<(binding:dns q.cage)
  ;<  good=?    bind:m  (turf-confirm-install:libdns turf.binding)
--- a/pkg/arvo/tests/sys/grq.hoon
+++ b/pkg/arvo/tests/sys/grq.hoon
@ -0,0 +1,504 @@
+::  test gall subscription nonce incrementation and ames flow killing
+::
+/+  *test, v=test-ames-gall
+|%
++  test-watch
+  %-  run-chain
+  |.  :-  %|
+  =+  nec-bud:v
+  ::  uncomment to turn on verbose debug output
+  ::=^  *  ames.nec
+  ::  (ames-call:v ames.nec ~[/none] [%spew ~[%msg %snd %rcv %odd]] *roof)
+  ::=^  *  ames.bud
+  ::  (ames-call:v ames.bud ~[/none] [%spew ~[%msg %snd %rcv %odd]] *roof)
+  ::  poke %sub to tell it to subscribe
+  =/  =task:gall  [%deal [~nec ~nec] %sub %poke watch+!>(~bud)]
+  =^  t1  gall.nec
+    %:  gall-check-call:v  gall.nec
+      [~1111.1.1 0xdead.beef *roof]
+      [~[/foo] task]
+      :~  :-  ~[/foo]  [%give %unto %poke-ack ~]
+          :-  ~[/init]
+          :*  %pass  /use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud
+              [%g %deal [~nec ~bud] %pub %watch /foo]
+      ==  ==
+    ==
+  :-  t1  |.  :-  %|
+  ::  handle gall passing the %watch to itself, which passes to ames
+  =^  t2  gall.nec
+    %:  gall-check-call:v  gall.nec
+      [~1111.1.1 0xdead.beef *roof]
+      :-  ~[/use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud /init]
+      [%deal [~nec ~bud] %pub %watch /foo]
+      :~  :-  ~[/init]  [%pass /sys/lag %a %heed ~bud]
+          :-  ~[/init]  [%pass /sys/era %j %public-keys (sy ~bud ~)]
+          :-  ~[/use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud /init]
+          [%pass /sys/way/~bud/pub %a %plea ~bud %g /ge/pub [%0 %s /foo]]
+      ==
+    ==
+  :-  t2  |.  :-  %|
+  ::  subscriber ames handles %plea from gall, gives a packet to vere
+  =^  t3  ames.nec
+    %:  ames-check-call:v  ames.nec
+      [~1111.1.1 0xdead.beef *roof]
+      :-  :~  /sys/way/~bud/pub
+              /use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud
+              /init
+          ==
+      [%plea ~bud %g /ge/pub [%0 %s /foo]]
+      :~  :-  ~[//unix]
+          :*  %give  %send  [%& ~bud]
+              0xae59.5b29.277b.22c1.20b7.a8db.9086.46df.31bd.f9bc.
+              2633.7300.17d4.f5fc.8be5.8bfe.5c9d.36d9.2ea1.7cb3.
+              8a00.0200.0132.8fd4.f000
+          ==
+          :-  ~[/ames]  [%pass /pump/~bud/0 %b %wait ~1111.1.1..00.00.01]
+      ==
+    ==
+  :-  t3  |.  :-  %|
+  ::  publisher ames hears %watch, passes to gall
+  =^  t4  ames.bud
+    %:  ames-check-call:v  ames.bud
+      [~1111.1.2 0xbeef.dead *roof]
+      :-  ~[//unix]
+      :*  %hear  [%& ~nec]
+          0xae59.5b29.277b.22c1.20b7.a8db.9086.46df.31bd.f9bc.
+          2633.7300.17d4.f5fc.8be5.8bfe.5c9d.36d9.2ea1.7cb3.
+          8a00.0200.0132.8fd4.f000
+      ==
+      :~  :-  ~[//unix]  [%pass /qos %d %flog %text "; ~nec is your neighbor"]
+          :-  ~[//unix]
+          [%pass /bone/~nec/0/1 %g %plea ~nec %g /ge/pub [%0 %s /foo]]
+      ==
+    ==
+  :-  t4  |.  :-  %|
+  ::  publisher gall hears %watch from ames, passes to itself
+  =^  t5  gall.bud
+    %:  gall-check-call:v  gall.bud
+      [~1111.1.2 0xbeef.dead *roof]
+      :-  ~[/bone/~nec/0/1 //unix]
+      [%plea ~nec %g /ge/pub [%0 %s /foo]]
+      :~  :-  ~[/init]  [%pass /sys/lag %a %heed ~nec]
+          :-  ~[/init]  [%pass /sys/era %j %public-keys (sy ~nec ~)]
+          :-  ~[/bone/~nec/0/1 //unix]
+          [%pass /sys/req/~nec/pub %g %deal [~nec ~bud] %pub %watch /foo]
+      ==
+    ==
+  :-  t5  |.  :-  %|
+  ::  publisher gall runs %pub with %watch, gives ack to itself
+  =^  t6  gall.bud
+    %:  gall-check-call:v  gall.bud
+      [~1111.1.2 0xbeef.dead *roof]
+      :-  ~[/sys/req/~nec/pub /bone/~nec/0/1 //unix]
+      [%deal [~nec ~bud] %pub %watch /foo]
+      :~  :-  ~[/sys/req/~nec/pub /bone/~nec/0/1 //unix]
+          [%give %unto %watch-ack ~]
+      ==
+    ==
+  :-  t6  |.  :-  %|
+  ::  gall gives ack to ames
+  =^  t7  gall.bud
+    %:  gall-check-take:v  gall.bud
+      [~1111.1.2 0xbeef.dead *roof]
+      :+  /sys/req/~nec/pub  ~[/bone/~nec/0/1 //unix]
+      [%gall %unto %watch-ack ~]
+      :~  :-  ~[/bone/~nec/0/1 //unix]  [%give %done ~]
+      ==
+    ==
+  :-  t7  |.  :-  %|
+  ::  publisher ames hears ack from gall, sends over the network
+  =^  t8  ames.bud
+    %:  ames-check-take:v  ames.bud
+      [~1111.1.2 0xbeef.dead *roof]
+      :+  /bone/~nec/0/1  ~[//unix]
+      [%gall %done ~]
+      :~  :-  ~[//unix]
+          :*  %give  %send  [%& ~nec]
+              0x2.0219.8100.0485.5530.3c88.9068.3cc6.484e.
+              2d9d.076e.6d00.0100.0223.9ae9.5000
+      ==  ==
+    ==
+  :-  t8  |.  :-  %|
+  ::  subscriber ames hears watch-ack packet, gives to gall
+  =^  t9  ames.nec
+    %:  ames-check-call:v  ames.nec
+      [~1111.1.3 0xdead.beef *roof]
+      :-  ~[//unix]
+      :*  %hear  [%& ~bud]
+          0x2.0219.8100.0485.5530.3c88.9068.3cc6.484e.
+          2d9d.076e.6d00.0100.0223.9ae9.5000
+      ==
+      :~  :-  ~[//unix]  [%pass /qos %d %flog %text "; ~bud is your neighbor"]
+          :-  :~  /sys/way/~bud/pub
+                  /use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud
+                  /init
+              ==
+          [%give %done ~]
+          :-  ~[/ames]  [%pass /pump/~bud/0 %b %rest ~1111.1.1..00.00.01]
+      ==
+    ==
+  :-  t9  |.  :-  %|
+  ::  gall gives %done to itself
+  =^  t10  gall.nec
+    %:  gall-check-take:v  gall.nec
+      [~1111.1.3 0xdead.beef *roof]
+      :+  /sys/way/~bud/pub
+        ~[/use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud /init]
+      [%ames %done ~]
+      :~  :-  ~[/use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud /init]
+          [%give %unto %watch-ack ~]
+      ==
+    ==
+  :-  t10  |.  :-  %|
+  ::  gall gives watch-ack to itself
+  =^  t11  gall.nec
+    %:  gall-check-take:v  gall.nec
+      [~1111.1.3 0xdead.beef *roof]
+      :+  /use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud
+        ~[/init]
+      [%gall %unto %watch-ack ~]
+      ~
+    ==
+  :-  t11  |.  :-  %|
+  ::  start the clog and kick process; give clog to publisher gall
+  =^  t12  gall.bud
+    %:  gall-check-take:v  gall.bud
+      [~1111.1.4 0xbeef.dead *roof]
+      :+  /sys/lag  ~[/init]
+      [%ames %clog ~nec]
+      :~  :-  ~[/sys/req/~nec/pub /bone/~nec/0/1 //unix]
+          [%give %unto %kick ~]
+      ==
+    ==
+  :-  t12  |.  :-  %|
+  ::  gall gives %kick %boon to ames
+  =^  t13  gall.bud
+    %:  gall-check-take:v  gall.bud
+      [~1111.1.4 0xbeef.dead *roof]
+      :+  /sys/req/~nec/pub  ~[/bone/~nec/0/1 //unix]
+      [%gall %unto %kick ~]
+      :~  :-  ~[/bone/~nec/0/1 //unix]  [%give %boon %x ~]
+      ==
+    ==
+  :-  t13  |.  :-  %|
+  ::  ames gives kick over the network
+  =^  t14  ames.bud
+    %:  ames-check-take:v  ames.bud
+      [~1111.1.4 0xbeef.dead *roof]
+      :+  /bone/~nec/0/1  ~[//unix]
+      [%gall %boon %x ~]
+      :~  :-  ~[//unix]
+          :*  %give  %send  [%& ~nec]
+              0xa1fc.cd35.c730.9a00.07e0.90a2.f87c.3657.935e.
+              4ca0.801d.3ddc.d400.0100.0223.bc18.1000
+          ==
+          :-  ~[/ames]  [%pass /pump/~nec/1 %b %wait ~1111.1.4..00.00.01]
+      ==
+    ==
+  :-  t14  |.  :-  %|
+  ::  subscriber ames receives kick, gives to gall and gives ack to unix
+  =^  t15  ames.nec
+    %:  ames-check-call:v  ames.nec
+      [~1111.1.5 0xdead.beef *roof]
+      :-  ~[//unix]
+      :*  %hear  [%& ~bud]
+          0xa1fc.cd35.c730.9a00.07e0.90a2.f87c.3657.935e.
+          4ca0.801d.3ddc.d400.0100.0223.bc18.1000
+      ==
+      :~  :-  :~  /sys/way/~bud/pub
+                  /use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud
+                  /init
+              ==
+          [%give %boon %x ~]
+          :-  ~[//unix]
+          :*  %give  %send  [%& ~bud]
+              0xfe.e208.da00.0491.bf7f.9594.2ddc.0948.
+              9de0.3906.b678.6e00.0200.0132.e55d.5000
+      ==  ==
+    ==
+  :-  t15  |.  :-  %|
+  ::  subscriber gall receives kick %boon from ames, gives to self
+  =^  t16  gall.nec
+    %:  gall-check-take:v  gall.nec
+      [~1111.1.5 0xdead.beef *roof]
+      :+  /sys/way/~bud/pub
+        ~[/use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud /init]
+      [%ames %boon %x ~]
+      :~  :-  ~[/use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud /init]
+          [%give %unto %kick ~]
+          :-  ~[/use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud /init]
+          [%pass /sys/way/~bud/pub %a %cork ~bud]
+      ==
+    ==
+  ::  subscriber gall receives %kick from itself
+  =^  t17  gall.nec
+    %:  gall-check-take:v  gall.nec
+      [~1111.1.5 0xdead.beef *roof]
+      :+  /use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud
+        ~[/init]
+      [%gall %unto %kick ~]
+      :~  :-  ~[/init]
+          :*  %pass  /use/sub/0w1.d6Isf/out/~bud/pub/2/sub-foo/~bud
+              [%g %deal [~nec ~bud] %pub %watch /foo]
+      ==  ==
+    ==
+  :-  t17  |.  :-  %|
+  ::  gall receives %deal %watch from itself, passes to ames
+  =^  t18  gall.nec
+    %:  gall-check-call:v  gall.nec
+      [~1111.1.5 0xdead.beef *roof]
+      :-  ~[/use/sub/0w1.d6Isf/out/~bud/pub/2/sub-foo/~bud /init]
+      [%deal [~nec ~bud] %pub %watch /foo]
+      :~  :-  ~[/use/sub/0w1.d6Isf/out/~bud/pub/2/sub-foo/~bud /init]
+          [%pass /sys/way/~bud/pub %a %plea ~bud %g /ge/pub [%0 %s /foo]]
+      ==
+    ==
+  :-  t18  |.  :-  %|
+  ::  subscriber ames sends new %watch
+  =^  t19  ames.nec
+    %:  ames-check-call:v  ames.nec
+      [~1111.1.5 0xdead.beef *roof]
+      :-  :~  /sys/way/~bud/pub
+              /use/sub/0w1.d6Isf/out/~bud/pub/2/sub-foo/~bud
+              /init
+          ==
+      [%plea ~bud %g /ge/pub [%0 %s /foo]]
+      :~  :-  ~[//unix]
+          :*  %give  %send  [%& ~bud]
+              0xfe.9174.6d7c.e042.4ea7.cf3c.08da.3acf.68ec.3bd1.1f2c.abfe.f500.
+              1897.c42e.a3ec.2159.86d6.e2f1.b344.9d06.b600.0200.0132.ebe7.8800
+          ==
+          :-  ~[/ames]  [%pass /pump/~bud/4 %b %wait ~1111.1.5..00.00.01]
+      ==
+    ==
+  :-  t19  |.  :-  %|
+  ::  subscriber ames sends %cork
+  =^  t20  ames.nec
+    %:  ames-check-call:v  ames.nec
+      [~1111.1.5 0xdead.beef *roof]
+      :-  :~  /sys/way/~bud/pub
+              /use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud
+              /init
+          ==
+      [%cork ~bud]
+      :~  :-  ~[//unix]
+          :*  %give  %send  [%& ~bud]
+              0xb.130c.ab37.ca24.49cd.aecb.23ba.70f1.6f1c.4d00.124e.c9a5.
+              3413.3843.d81c.47c4.7040.6e62.3700.0200.0132.e1ab.9000
+          ==
+          :-  ~[/ames]  [%pass /pump/~bud/0 %b %wait ~1111.1.5..00.02.00]
+      ==
+    ==
+  ::  publisher ames hears %kick ack
+  :-  t20  |.  :-  %|
+  =^  t21  ames.bud
+    %:  ames-check-call:v  ames.bud
+      [~1111.1.6 0xbeef.dead *roof]
+      :-  ~[//unix]
+      :*  %hear  [%& ~nec]
+          0xfe.e208.da00.0491.bf7f.9594.2ddc.0948.
+          9de0.3906.b678.6e00.0200.0132.e55d.5000
+      ==
+      :~  :-  ~[/ames]  [%pass /pump/~nec/1 %b %rest ~1111.1.4..00.00.01]
+      ==
+    ==
+  ::  publisher ames hears new %watch
+  :-  t21  |.  :-  %|
+  =^  t22  ames.bud
+    %:  ames-check-call:v  ames.bud
+      [~1111.1.7 0xbeef.dead *roof]
+      :-  ~[//unix]
+      :*  %hear  [%& ~nec]
+          0xfe.9174.6d7c.e042.4ea7.cf3c.08da.3acf.68ec.3bd1.1f2c.abfe.f500.
+          1897.c42e.a3ec.2159.86d6.e2f1.b344.9d06.b600.0200.0132.ebe7.8800
+      ==
+      :~  :-  ~[//unix]
+          [%pass /bone/~nec/0/5 %g %plea ~nec %g /ge/pub [%0 %s /foo]]
+      ==
+    ==
+  ::  publisher gall hears new %watch, passes to self
+  :-  t22  |.  :-  %|
+  =^  t23  gall.bud
+    %:  gall-check-call:v  gall.bud
+      [~1111.1.7 0xbeef.dead *roof]
+      :-  ~[/bone/~nec/0/5 //unix]
+      [%plea ~nec %g /ge/pub [%0 %s /foo]]
+      :~  :-  ~[/bone/~nec/0/5 //unix]
+          [%pass /sys/req/~nec/pub %g %deal [~nec ~bud] %pub %watch /foo]
+      ==
+    ==
+  ::  publisher gall runs :pub's +on-watch, gives ack to self
+  :-  t23  |.  :-  %|
+  =^  t24  gall.bud
+    %:  gall-check-call:v  gall.bud
+      [~1111.1.7 0xbeef.dead *roof]
+      :-  ~[/sys/req/~nec/pub /bone/~nec/0/5 //unix]
+      [%deal [~nec ~bud] %pub %watch /foo]
+      :~  :-  ~[/sys/req/~nec/pub /bone/~nec/0/5 //unix]
+          [%give %unto %watch-ack ~]
+      ==
+    ==
+    ::  publisher gall hears %watch-ack, gives to ames
+  :-  t24  |.  :-  %|
+  =^  t25  gall.bud
+    %:  gall-check-take:v  gall.bud
+      [~1111.1.7 0xbeef.dead *roof]
+      :+  /sys/req/~nec/pub  ~[/bone/~nec/0/5 //unix]
+      [%gall %unto %watch-ack ~]
+      :~  :-  ~[/bone/~nec/0/5 //unix]  [%give %done ~]
+      ==
+    ==
+  ::  publisher ames hears done from gall, sends over the network
+  :-  t25  |.  :-  %|
+  =^  t26  ames.bud
+    %:  ames-check-take:v  ames.bud
+      [~1111.1.7 0xbeef.dead *roof]
+      :+  /bone/~nec/0/5  ~[//unix]
+      [%gall %done ~]
+      :~  :-  ~[//unix]
+          :*  %give  %send  [%& ~nec]
+              0x5f5.c27c.c400.0587.8b0d.0a5d.eb8e.39fa.
+              49f4.4848.bfa6.f600.0100.0223.c98c.8800
+      ==  ==
+    ==
+  ::  publisher ames hears %cork, passes to itself
+  :-  t26  |.  :-  %|
+  =^  t27  ames.bud
+    %:  ames-check-call:v  ames.bud
+      [~1111.1.8 0xbeef.dead *roof]
+      :-  ~[//unix]
+      :*  %hear  [%& ~nec]
+          0xb.130c.ab37.ca24.49cd.aecb.23ba.70f1.6f1c.4d00.124e.c9a5.
+          3413.3843.d81c.47c4.7040.6e62.3700.0200.0132.e1ab.9000
+      ==
+      :~  :-  ~[//unix]  [%pass /bone/~nec/0/1 %a %plea ~nec [%a /close ~]]
+      ==
+    ==
+  :-  t27  |.  :-  %|
+  ::  publisher ames hear cork plea from self, give %done to self
+  =^  t28  ames.bud
+    %:  ames-check-call:v  ames.bud
+      [~1111.1.8 0xbeef.dead *roof]
+      :-  ~[/bone/~nec/0/1 //unix]
+      [%plea ~nec [%a /close ~]]
+      :~  :-  ~[/bone/~nec/0/1 //unix]  [%give %done ~]
+      ==
+    ==
+  ::  publisher ames hears cork done from self, sends ack packet
+  :-  t28  |.  :-  %|
+  =^  t29  ames.bud
+    %:  ames-check-take:v  ames.bud
+      [~1111.1.8 0xbeef.dead *roof]
+      :+  /bone/~nec/0/1
+        ~[//unix]
+      [%ames %done ~]
+      :~  :-  ~[//unix]
+          :*  %give  %send  [%& ~nec]
+              0x5f.f966.8e00.0449.bdec.9006.c7e5.1237.
+              1d87.53fe.d7bb.ad00.0100.0223.c6a8.5800
+      ==  ==
+    ==
+  ::  subscriber ames hears %watch-ack, gives to gall
+  :-  t29  |.  :-  %|
+  =^  t30  ames.nec
+    %:  ames-check-call:v  ames.nec
+      [~1111.1.9 0xdead.beef *roof]
+      :-  ~[//unix]
+      :*  %hear  [%& ~bud]
+          0x5f5.c27c.c400.0587.8b0d.0a5d.eb8e.39fa.
+          49f4.4848.bfa6.f600.0100.0223.c98c.8800
+      ==
+      :~  :-  :~  /sys/way/~bud/pub
+                  /use/sub/0w1.d6Isf/out/~bud/pub/2/sub-foo/~bud
+                  /init
+              ==
+          [%give %done ~]
+          :-  ~[/ames]  [%pass /pump/~bud/4 %b %rest ~1111.1.5..00.00.01]
+      ==
+    ==
+  ::  subscriber gall hears new %watch-ack from ames, gives to self
+  :-  t30  |.  :-  %|
+  =^  t31  gall.nec
+    %:  gall-check-take:v  gall.nec
+      [~1111.1.9 0xdead.beef *roof]
+      :+  /sys/way/~bud/pub
+        :~  /use/sub/0w1.d6Isf/out/~bud/pub/2/sub-foo/~bud
+            /init
+        ==
+      [%ames %done ~]
+      :~  :-  :~  /use/sub/0w1.d6Isf/out/~bud/pub/2/sub-foo/~bud
+                  /init
+              ==
+          [%give %unto %watch-ack ~]
+      ==
+    ==
+  ::  subscriber gall hears new %watch-ack from self, tells :sub
+  :-  t31  |.  :-  %|
+  =^  t32  gall.nec
+    %:  gall-check-take:v  gall.nec
+      [~1111.1.9 0xdead.beef *roof]
+      :+  /use/sub/0w1.d6Isf/out/~bud/pub/2/sub-foo/~bud
+        ~[/init]
+      [%gall %unto %watch-ack ~]
+      ~
+    ==
+  ::  subscriber ames hears %cork ack
+  :-  t32  |.  :-  %|
+  =^  t33  ames.nec
+    %:  ames-check-call:v  ames.nec
+      [~1111.1.10 0xdead.beef *roof]
+      :-  ~[//unix]
+      :*  %hear  [%& ~bud]
+          0x5f.f966.8e00.0449.bdec.9006.c7e5.1237.
+          1d87.53fe.d7bb.ad00.0100.0223.c6a8.5800
+      ==
+      :~  :-  :~  /sys/way/~bud/pub
+                  /use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud
+                  /init
+              ==
+          [%give %done ~]
+          :-  ~[/ames]  [%pass /pump/~bud/0 %b %rest ~1111.1.5..00.02.00]
+      ==
+    ==
+  ::  subscriber gall hears %cork ack from ames
+  :-  t33  |.  :-  %|
+  =^  t34  gall.nec
+    %:  gall-check-take:v  gall.nec
+      [~1111.1.10 0xdead.beef *roof]
+      :+  /sys/way/~bud/pub
+        :~  /use/sub/0w1.d6Isf/out/~bud/pub/1/sub-foo/~bud
+            /init
+        ==
+      [%ames %done ~]
+      ~
+    ==
+  :-  t34  |.  :-  %&
+  ;:  weld
+    %+  expect-eq
+      !>  (sy 0 ~)
+      !>  =<  corked
+          %:  ames-scry-peer:v
+            ames.nec
+            [~1111.1.10 0xdead.beef *roof]
+            [~nec ~bud]
+          ==
+  ::
+    %+  expect-eq
+      !>  (sy 1 ~)
+      !>  =<  corked
+          %:  ames-scry-peer:v
+            ames.bud
+            [~1111.1.8 0xbeef.dead *roof]
+            [~bud ~nec]
+          ==
+  ::
+    %+  expect-eq
+      !>  2
+      !>  %:  gall-scry-nonce:v
+            gall.nec
+            [~1111.1.10 0xdead.beef *roof]
+            ~nec  %sub
+            [~bud %pub /sub-foo/~bud]
+          ==
+  ==
+--
--- a/pkg/arvo/tests/sys/vane/ames.hoon
+++ b/pkg/arvo/tests/sys/vane/ames.hoon
@ -353,10 +353,14 @@
      !>  [~[/g/talk] %give %boon [%post 'first1']]
      !>  (snag 0 `(list move:ames)`moves6)
  ==
+::  +test-comet-message-flow: galaxy<->comet comms
+::
+::    same as test-message-flow, but ~nec will send a sendkeys packet to
+::    request comet's self-attestation directly
 ::
 ++  test-comet-message-flow  ^-  tang
-  ::  same as test-message-flow, but ~nec will send a sendkeys packet to request
-  ::  comet's self-attestation directly
+  ::=^  *       nec   (call nec ~[//nemo] %spew ~[%snd %rcv %odd %msg])
+  ::=^  *     comet   (call comet ~[//nemo] %spew ~[%snd %rcv %odd %msg])
  ::
  =^  moves0  nec    (call nec ~[/g/talk] %plea our-comet %g /talk [%get %post])
  =^  moves1  comet  (call comet ~[//unix] %hear (snag-packet 0 moves0))
@ -371,27 +375,34 @@
    :^  comet  /public-keys  ~[//unix]
    ^-  sign:ames
    [%jael %public-keys %full [n=[~nec point] ~ ~]]
-  ::  give comet's self-attestation to ~nec; at this point, we have established
-  ::  a channel, and can proceed as usual
+  ::  give comet's self-attestation to ~nec; at this point, we have
+  ::  established a channel, and can proceed as usual
  ::
+  =/  post  [%post 'first1!!']
  =^  moves3  nec    (call nec ~[//unix] %hear (snag-packet 0 moves2))
+  %+  weld
+    %-  expect-fail  |.
+    (call nec ~[//unix] %hear (snag-packet 1 moves2))
+  ::
  =^  moves4  comet  (call comet ~[//unix] %hear (snag-packet 0 moves3))
-  =^  moves5  comet  (take comet /bone/~nec/0/1 ~[//unix] %g %done ~)
+  =^  moves5  comet  (take comet /bone/~nec/1/1 ~[//unix] %g %done ~)
  =^  moves6  nec    (call nec ~[//unix] %hear (snag-packet 0 moves5))
-  =^  moves7  comet  (take comet /bone/~nec/0/1 ~[//unix] %g %boon [%post 'first1!!'])
+  =^  moves7  comet  (take comet /bone/~nec/1/1 ~[//unix] %g %boon post)
  =^  moves8  nec    (call nec ~[//unix] %hear (snag-packet 0 moves7))
  ::
  ;:  weld
    %+  expect-eq
-      !>  [~[//unix] %pass /qos %d %flog %text "; ~nec is your neighbor"]
+      !>  =-  [~[//unix] %pass /qos %d %flog %text -]
+              "; ~nec is your neighbor"
      !>  (snag 0 `(list move:ames)`moves4)
  ::
    %+  expect-eq
-      !>  [~[//unix] %pass /qos %d %flog %text "; {<our-comet>} is your neighbor"]
+      !>  =-  [~[//unix] %pass /qos %d %flog %text -]
+              "; {<our-comet>} is your neighbor"
      !>  (snag 0 `(list move:ames)`moves6)
  ::
    %+  expect-eq
-      !>  [~[/g/talk] %give %boon [%post 'first1!!']]
+      !>  [~[/g/talk] %give %boon post]
      !>  (snag 0 `(list move:ames)`moves8)
  ==
 ::
--- a/pkg/arvo/tests/sys/vane/behn.hoon
+++ b/pkg/arvo/tests/sys/vane/behn.hoon
@ -0,0 +1,234 @@
+/+  *test
+/=  behn-raw  /sys/vane/behn
+=/  behn-gate  (behn-raw ~bus)
+=/  scry  *roof
+=*  move  move:behn-gate
+::
+|%
++  test-wake-no
+  ^-  tang
+  =/  wen  ~1111.1.1
+  =/  arg  [~[/vere] [%wake ~]]
+  -:(call ~ wen arg ~)
+::
++  test-wake-no-wait
+  ^-  tang
+  =/  wen  ~1111.1.1
+  ::
+  =/  a-arg  [~[/vere] [%born ~]]
+  =/  a-out  ~
+  =^  a  behn-gate  (call `%a wen a-arg a-out)
+  ::
+  =/  b-arg  [~[/vere] [%wake ~]]
+  =/  b-out  ~
+  =^  b  behn-gate  (call `%b wen b-arg b-out)
+  ::
+  (weld a b)
+::
++  test-wake-no-born
+  ^-  tang
+  =/  wen  ~1111.1.1
+  ::
+  =/  a-arg  [~[/foo] [%wait +(wen)]]
+  =/  a-out  ~
+  =^  a  behn-gate  (call `%a wen a-arg a-out)
+  ::
+  =/  b-arg  [~[/vere] [%wake ~]]
+  =/  b-out  ~
+  =^  b  behn-gate  (call `%b wen b-arg b-out)
+  ::
+  (weld a b)
+::
++  test-wake
+  ^-  tang
+  =/  wen  ~1111.1.1
+  ::
+  =/  a-arg  [~[/vere] [%born ~]]
+  =/  a-out  ~
+  =^  a  behn-gate
+    (call ~ wen a-arg a-out)
+  ::
+  =/  b-arg  [~[/foo] [%wait +(wen)]]
+  =/  b-out=(list move)  [~[/vere] [%give [%doze `+(wen)]]]~
+  =^  b  behn-gate  (call `%b wen b-arg b-out)
+  ::
+  =/  c-arg  [~[/vere] [%wake ~]]
+  =/  c-out=(list move)  [~[/foo] [%give [%wake ~]]]~
+  =^  c  behn-gate  (call `%c +(wen) c-arg c-out)
+  ::
+  :(weld a b c)
+::
++  test-born
+  ^-  tang
+  =/  wen  ~1111.1.1
+  ::
+  =/  a-arg  [~[/foo] [%wait +(wen)]]
+  =/  a-out  ~
+  =^  a  behn-gate  (call `%a wen a-arg a-out)
+  ::
+  =/  b-arg  [~[/vere] [%born ~]]
+  =/  b-out=(list move)  [~[/vere] [%give [%doze `+(wen)]]]~
+  =^  b  behn-gate  (call `%b wen b-arg b-out)
+  ::
+  (weld a b)
+::
++  test-many-ordered
+  ^-  tang
+  =/  wen  ~1111.1.1
+  ::
+  =/  a-arg  [~[/vere] [%born ~]]
+  =/  a-out  ~
+  =^  a  behn-gate  (call `%a wen a-arg a-out)
+  ::
+  =/  b-arg  [~[/foo] [%wait +(wen)]]
+  =/  b-out=(list move)  [~[/vere] [%give [%doze `+(wen)]]]~
+  =^  b  behn-gate  (call `%b wen b-arg b-out)
+  ::
+  =/  c-arg  [~[/foo] [%wait (add 2 wen)]]
+  =/  c-out  ~
+  =^  c  behn-gate  (call `%c wen c-arg c-out)
+  ::
+  =/  d-arg  [~[/foo] [%wait (add 3 wen)]]
+  =/  d-out  ~
+  =^  d  behn-gate  (call `%d wen d-arg d-out)
+  ::
+  =/  e-arg  [~[/vere] [%wake ~]]
+  =/  e-out=(list move)
+    :~  [~[/vere] [%give [%doze `(add 2 wen)]]]
+        [~[/foo] [%give [%wake ~]]]
+    ==
+  =^  e  behn-gate  (call `%e (add 4 wen) e-arg e-out)
+  ::
+  :(weld a b c d e)
+::
++  test-many-ordered-lag
+  ^-  tang
+  =/  wen  ~1111.1.1
+  ::
+  =/  a-arg  [~[/vere] [%born ~]]
+  =/  a-out  ~
+  =^  a  behn-gate  (call `%a wen a-arg a-out)
+  ::
+  =/  b-arg  [~[/foo] [%wait +(wen)]]
+  =/  b-out=(list move)  [~[/vere] [%give [%doze `+(wen)]]]~
+  =^  b  behn-gate  (call `%b wen b-arg b-out)
+  ::
+  =/  c-arg  [~[/foo] [%wait (add 2 wen)]]
+  =/  c-out  ~
+  =^  c  behn-gate  (call `%c wen c-arg c-out)
+  ::
+  =/  d-arg  [~[/foo] [%wait (add 3 wen)]]
+  =/  d-out  ~
+  =^  d  behn-gate  (call `%d wen d-arg d-out)
+  ::
+  =/  e-arg  [~[/vere] [%wake ~]]
+  =/  e-out=(list move)
+    :~  [~[/vere] [%give [%doze `(add 2 wen)]]]
+        [~[/foo] [%give [%wake ~]]]
+    ==
+  =^  e  behn-gate  (call `%e +(wen) e-arg e-out)
+  ::
+  :(weld a b c d e)
+::
++  test-many-unordered
+  ^-  tang
+  =/  wen  ~1111.1.1
+  ::
+  =/  a-arg  [~[/vere] [%born ~]]
+  =/  a-out  ~
+  =^  a  behn-gate  (call `%a wen a-arg a-out)
+  ::
+  =/  b-arg  [~[/foo] [%wait (add 2 wen)]]
+  =/  b-out=(list move)  [~[/vere] [%give [%doze `(add 2 wen)]]]~
+  =^  b  behn-gate  (call `%b wen b-arg b-out)
+  ::
+  =/  c-arg  [~[/foo] [%wait (add 3 wen)]]
+  =/  c-out  ~
+  =^  c  behn-gate  (call `%c wen c-arg c-out)
+  ::
+  =/  d-arg  [~[/foo] [%wait +(wen)]]
+  =/  d-out=(list move)  [~[/vere] [%give [%doze `+(wen)]]]~
+  =^  d  behn-gate  (call `%d wen d-arg d-out)
+  ::
+  =/  e-arg  [~[/vere] [%wake ~]]
+  =/  e-out=(list move)
+    :~  [~[/vere] [%give [%doze `(add 2 wen)]]]
+        [~[/foo] [%give [%wake ~]]]
+    ==
+  =^  e  behn-gate  (call `%e (add 4 wen) e-arg e-out)
+  ::
+  :(weld a b c d e)
+::
++  test-same-ordered-lag
+  ^-  tang
+  =/  wen  ~1111.1.1
+  ::
+  =/  a-arg  [~[/vere] [%born ~]]
+  =/  a-out  ~
+  =^  a  behn-gate  (call `%a wen a-arg a-out)
+  ::
+  =/  b-arg  [~[/foo] [%wait (add 2 wen)]]
+  =/  b-out=(list move)  [~[/vere] [%give [%doze `(add 2 wen)]]]~
+  =^  b  behn-gate  (call `%b wen b-arg b-out)
+  ::
+  =/  c-arg  [~[/foo] [%wait (add 2 wen)]]
+  =/  c-out  ~
+  =^  c  behn-gate  (call `%c wen c-arg c-out)
+  ::
+  =/  d-arg  [~[/foo] [%wait (add 2 wen)]]
+  =/  d-out  ~
+  =^  d  behn-gate  (call `%d wen d-arg d-out)
+  ::
+  =/  e-arg  [~[/vere] [%wake ~]]
+  =/  e-out=(list move)
+    :~  [~[/vere] [%give [%doze `(add 2 wen)]]]
+        [~[/foo] [%give [%wake ~]]]
+    ==
+  =^  e  behn-gate  (call `%e (add 3 wen) e-arg e-out)
+  ::
+  :(weld a b c d e)
+::
++  test-rest
+  ^-  tang
+  =/  wen  ~1111.1.1
+  ::
+  =/  a-arg  [~[/vere] [%born ~]]
+  =/  a-out  ~
+  =^  a  behn-gate  (call `%a wen a-arg a-out)
+  ::
+  =/  b-arg  [~[/foo] [%wait (add 2 wen)]]
+  =/  b-out=(list move)  [~[/vere] [%give [%doze `(add 2 wen)]]]~
+  =^  b  behn-gate  (call `%b wen b-arg b-out)
+  ::
+  =/  c-arg  [~[/foo] [%wait (add 3 wen)]]
+  =/  c-out  ~
+  =^  c  behn-gate  (call `%c wen c-arg c-out)
+  ::
+  =/  d-arg  [~[/foo] [%rest (add 2 wen)]]
+  =/  d-out=(list move)  [~[/vere] [%give [%doze `(add 3 wen)]]]~
+  =^  d  behn-gate  (call `%d wen d-arg d-out)
+  ::
+  =/  e-arg  [~[/vere] [%wake ~]]
+  =/  e-out=(list move)  [~[/foo] [%give [%wake ~]]]~
+  =^  e  behn-gate  (call `%e (add 4 wen) e-arg e-out)
+  ::
+  :(weld a b c d e)
+::
++  call
+  =|  lac=?
+  |=  $:  label=(unit @tas)
+          now=@da
+          args=[=duct task=(hobo task:behn)]
+          expected-moves=(list move)
+      ==
+  =/  behn-core  (behn-gate now=now eny=`@`0xdead.beef scry=scry)
+  =^  moves  behn-gate
+    (call:behn-core duct.args dud=~ task.args)
+  ::
+  ~?  !lac  moves
+  =/  output=tang
+    %+  expect-eq
+      !>  expected-moves
+      !>  moves
+  [?~(label output ?~(output ~ [u.label output])) behn-gate]
+--
--- a/pkg/base-dev/lib/agentio.hoon
+++ b/pkg/base-dev/lib/agentio.hoon
@ -66,7 +66,7 @@
  ::
  ++  rest
    |=  p=@da
-    (arvo %b %wait p)
+    (arvo %b %rest p)
  ::
  ++  warp
    |=  [wer=ship =riff:clay]
--- a/pkg/base-dev/lib/bip/b173.hoon
+++ b/pkg/base-dev/lib/bip/b173.hoon
@ -11,7 +11,7 @@
 |%
 ++  prefixes
  ^-  (map network tape)
-  (my [[%main "bc"] [%testnet "tb"] ~])
+  (my [[%main "bc"] [%testnet "tb"] [%regtest "bcrt"] ~])
 ++  charset  "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
 +$  raw-decoded  [hrp=tape data=(list @) checksum=(list @)]
 ::  below is a port of: https://github.com/bitcoinjs/bech32/blob/master/index.js
--- a/pkg/base-dev/lib/bip/b174.hoon
+++ b/pkg/base-dev/lib/bip/b174.hoon
@ -56,6 +56,8 @@
        1^0x0
          %testnet
        1^0x1
+          %regtest
+        1^0x1
      ==
    :-  (cat:byt ~[1^typ pubkey.h])
    %-  cat:byt
--- a/pkg/base-dev/lib/strandio.hoon
+++ b/pkg/base-dev/lib/strandio.hoon
@ -433,7 +433,6 @@
  %-  pure:m
  ?~  full-file.client-response  ''
  q.data.u.full-file.client-response
-
 ::
 ++  fetch-cord
  |=  url=tape
--- a/pkg/base-dev/lib/test.hoon
+++ b/pkg/base-dev/lib/test.hoon
@ -38,7 +38,37 @@
  =/  b  (mule a)
  ?-  -.b
    %|  ~
-    %&  [leaf+"expected failure - succeeded" ~]
+    %&  ['expected failure - succeeded' ~]
+  ==
+::  +expect-runs: kicks a trap, expecting success; returns trace on failure
+::
++  expect-success
+  |=  a=(trap)
+  ^-  tang
+  =/  b  (mule a)
+  ?-  -.b
+    %&  ~
+    %|  ['expected success - failed' p.b]
+  ==
+::  $test-chain: a sequence of tests to be run
+::
+$  test-chain
+  $_
+  |?
+  ?:  =(0 0)
+    [%& p=*tang]
+  [%| p=[tang=*tang next=^?(..$)]]
+::  +run-chain: run a sequence of tests, stopping at first failure
+::
++  run-chain
+  |=  seq=test-chain
+  ^-  tang
+  =/  res  $:seq
+  ?-  -.res
+    %&  p.res
+    %|  ?.  =(~ tang.p.res)
+          tang.p.res
+        $(seq next.p.res)
  ==
 ::  +category: prepends a name to an error result; passes successes unchanged
 ::
--- a/pkg/base-dev/sur/bitcoin.hoon
+++ b/pkg/base-dev/sur/bitcoin.hoon
@ -4,7 +4,7 @@
 ::  chyg: whether account is (non-)change. 0 or 1
 ::  bytc: "btc-byts" with dat cast to @ux
 |%
-+$  network  ?(%main %testnet)
+$  network  ?(%main %testnet %regtest)
 +$  hexb  [wid=@ dat=@ux]                :: hex byts
 +$  bits  [wid=@ dat=@ub]
 +$  xpub  @ta
--- a/pkg/bitcoin/app/btc-provider.hoon
+++ b/pkg/bitcoin/app/btc-provider.hoon
@ -169,12 +169,17 @@
    %+  req-card  act
    ^-  action:rpc-types
    ?-  -.act
-      %address-info  [%get-address-info address.act]
-      %tx-info       [%get-tx-vals txid.act]
-      %raw-tx        [%get-raw-tx txid.act]
-      %broadcast-tx  [%broadcast-tx rawtx.act]
-      %ping          [%get-block-info ~]
-      %block-info    [%get-block-info block.act]
+      %address-info   [%get-address-info address.act]
+      %tx-info        [%get-tx-vals txid.act]
+      %raw-tx         [%get-raw-tx txid.act]
+      %broadcast-tx   [%broadcast-tx rawtx.act]
+      %ping           [%get-block-info ~]
+      %block-info     [%get-block-info block.act]
+      %histogram      [%get-histogram ~]
+      %block-headers  [%get-block-headers start.act count.act cp.act]
+      %tx-from-pos    [%get-tx-from-pos height.act pos.act merkle.act]
+      %fee            [%get-fee block.act]
+      %psbt           [%update-psbt psbt.act]
    ==
  ::
  ++  req-card
@ -309,6 +314,31 @@
      ?>  ?=([%get-block-info *] r)
      :_  state
      ~[(send-update:hc [%.y %block-info network.host-info +.r] ship)]
+      :: 
+        %histogram
+      ?>  ?=([%get-histogram *] r)
+      :_  state
+      ~[(send-update:hc [%.y %histogram +.r] ship)]
+      ::
+        %block-headers
+      ?>  ?=([%get-block-headers *] r)
+      :_  state
+      ~[(send-update:hc [%.y %block-headers +.r] ship)]
+      ::
+        %tx-from-pos
+      ?>  ?=([%get-tx-from-pos *] r)
+      :_  state
+      ~[(send-update:hc [%.y %tx-from-pos +.r] ship)]
+      ::
+        %fee
+      ?>  ?=([%get-fee *] r)
+      :_  state
+      ~[(send-update:hc [%.y %fee +.r] ship)]
+      ::
+        %psbt
+      ?>  ?=([%update-psbt *] r)
+      :_  state
+      ~[(send-update:hc [%.y %psbt +.r] ship)]
    ==
  ::
  ++  connection-error
--- a/pkg/bitcoin/app/btc-wallet.hoon
+++ b/pkg/bitcoin/app/btc-wallet.hoon
@ -900,7 +900,7 @@
    ?:  =(~ prov)  `state
    ?.  =(host:(need prov) src.bowl)  `state
    ?.  ?=(%.y -.upd)  `state
-    ?-  -.p.upd
+    ?+  -.p.upd  `state
        %address-info
      ::  located in the helper in Scan Logic to keep all of that unified
      ::
--- a/pkg/bitcoin/desk.docket-0
+++ b/pkg/bitcoin/desk.docket-0
@ -5,7 +5,7 @@
  glob-http+['https://bootstrap.urbit.org/glob-0v3.7b5q1.gn30e.cpfem.abmqg.qh77v.glob' 0v3.7b5q1.gn30e.cpfem.abmqg.qh77v]
  image+'https://urbit.ewr1.vultrobjects.com/hastuc-dibtux/2021.8.24..02.57.38-bitcoin.svg'
  base+'bitcoin'
-  version+[0 0 1]
+  version+[0 0 2]
  license+'MIT'
  website+'https://tlon.io'
 ==
--- a/pkg/bitcoin/lib/bitcoin.hoon
+++ b/pkg/bitcoin/lib/bitcoin.hoon
@ -74,6 +74,7 @@
      :-  ?-  network
              %main     1^0x0
              %testnet  1^0x6f
+              %regtest  1^0x6f
          ==
      ~[(hash-160:bcu pubkey)]
      ::
@ -84,6 +85,7 @@
      :~  ?-  network
            %main     1^0x5
            %testnet  1^0xc4
+            %regtest  1^0xc4
          ==
          %-  hash-160:bcu
          (cat:byt:bcu ~[2^0x14 (hash-160:bcu pubkey)])
@ -109,7 +111,8 @@
    ++  is-base58
      |=  at=tape
      ^-  ?
-      ?|  =("m" (scag 1 at))
+      ?|  =("n" (scag 1 at))
+          =("m" (scag 1 at))
          =("1" (scag 1 at))
          =("3" (scag 1 at))
          =("2" (scag 1 at))
@ -120,6 +123,7 @@
      ^-  ?
      ?|  =("bc1" (scag 3 at))
          =("tb1" (scag 3 at))
+          =("bcrt1" (scag 5 at))
      ==
    --
  ::
--- a/pkg/bitcoin/lib/btc.hoon
+++ b/pkg/bitcoin/lib/btc.hoon
@ -423,6 +423,21 @@
      ::
        %get-block-info
      [id.res (block-info res.res)]
+      ::
+        %get-histogram
+      [id.res ((ar (ar ni)) res.res)]
+      ::
+        %get-block-headers
+      [id.res (block-headers res.res)]
+      ::
+        %get-tx-from-pos
+      [id.res (tx-from-pos res.res)]
+      ::
+        %get-fee
+      [id.res (ne res.res)]
+      ::
+        %update-psbt
+      [id.res (so res.res)]
    ==
    ::
    ++  address-info
@ -433,7 +448,7 @@
          [%block ni]
      ==
    ++  utxo
-    %-  ot
+      %-  ot
      :~  ['tx_pos' ni]
          ['tx_hash' (cu from-cord:hxb:bcu so)]
          [%height ni]
@ -474,11 +489,25 @@
          [%blockhash (cu from-cord:hxb:bcu so)]
          [%blockfilter (cu from-cord:hxb:bcu so)]
      ==
+    ++  block-headers
+      %-  ot
+      :~  [%count ni] 
+          [%hex (cu from-cord:hxb:bcu so)]
+          [%max ni]
+          [%root (cu:dejs-soft:format from-cord:hxb:bcu so:dejs-soft:format)]
+          [%branch (ar (cu from-cord:hxb:bcu so))]
+      ==
+    ++  tx-from-pos
+      %-  ot
+      :~  [%tx-hash (cu from-cord:hxb:bcu so)]
+          [%merkle (ar (cu from-cord:hxb:bcu so))] 
+      ==
    --
  --
 ::
 ++  rpc-action-to-http
  |=  [endpoint=@t ract=action:rpc-types:bp]
+  =,  enjs:format
  |^  ^-  request:http
  ?-  -.ract
      %get-address-info
@ -510,6 +539,39 @@
      ?~(block.ract '' (rsh [3 2] (scot %ui u.block.ract)))
    %-  get-request
    (mk-url '/getblockinfo/' param)
+    ::
+      %get-histogram
+    %-  get-request
+    (mk-url '/feehistogram' '')
+    ::
+      %get-block-headers
+    %+  post-request    
+    %+  mk-url  '/blockheaders'  '' 
+    %-  pairs
+    :~  [%start (numb start.ract)]  
+        [%count (numb count.ract)]
+        [%cp (numb (fall cp.ract 0))] 
+    == 
+    ::
+      %get-tx-from-pos
+    %+  post-request    
+    %+  mk-url  '/txfrompos'  ''  
+    %-  pairs
+    :~  [%height (numb height.ract)]  
+        [%pos (numb pos.ract)]
+        [%merkle %b merkle.ract] 
+    == 
+    ::
+      %get-fee
+    %-  get-request
+    %+  mk-url  '/estimatefee/'
+    %-  crip 
+    %+  scow  %ud  block.ract
+    ::
+      %update-psbt
+    %-  get-request
+    %+  mk-url  '/updatepsbt/'
+    %-  en:base64:mimes:html  [(lent (trip psbt.ract)) psbt.ract]
  ==
  ++  mk-url
    |=  [base=@t params=@t]
--- a/pkg/bitcoin/sur/btc-provider.hoon
+++ b/pkg/bitcoin/sur/btc-provider.hoon
@ -33,6 +33,11 @@
      [%broadcast-tx rawtx=hexb]
      [%ping ~]
      [%block-info block=(unit @ud)]
+      [%histogram ~]
+      [%block-headers start=@ud count=@ud cp=(unit @ud)]
+      [%tx-from-pos height=@ud pos=@ud merkle=?]
+      [%fee block=@ud]
+      [%psbt psbt=@t]
  ==
 ::
 +$  result
@ -41,6 +46,11 @@
      [%raw-tx txid=hexb rawtx=hexb]
      [%broadcast-tx txid=hexb broadcast=? included=?]
      [%block-info =network block=@ud fee=(unit sats) blockhash=hexb blockfilter=hexb]
+      [%histogram hist=(list (list @ud))]
+      [%block-headers count=@ud hex=hexb max=@ud root=(unit hexb) branch=(list hexb)]
+      [%tx-from-pos tx-hash=hexb merkle=(list hexb)]
+      [%fee fee=@rd]
+      [%psbt psbt=@t]
  ==
 +$  error
  $%  [%not-connected status=@ud]
@ -64,6 +74,11 @@
        [%broadcast-tx rawtx=hexb]
        [%get-block-count ~]
        [%get-block-info block=(unit @ud)]
+        [%get-histogram ~]
+        [%get-block-headers start=@ud count=@ud cp=(unit @ud)]
+        [%get-tx-from-pos height=@ud pos=@ud merkle=?]
+        [%get-fee block=@ud]
+        [%update-psbt psbt=@t]
    ==
  ::
  +$  result
@ -74,7 +89,11 @@
        [%broadcast-tx txid=hexb broadcast=? included=?]
        [%get-block-count block=@ud]
        [%get-block-info block=@ud fee=(unit sats) blockhash=hexb blockfilter=hexb]
-
+        [%get-histogram hist=(list (list @ud))]
+        [%get-block-headers count=@ud hex=hexb max=@ud root=(unit hexb) branch=(list hexb)]
+        [%get-tx-from-pos tx-hash=hexb merkle=(list hexb)]
+        [%get-fee fee=@rd]
+        [%update-psbt psbt=@t]
    ==
  --
 --
--- a/pkg/garden/desk.docket-0
+++ b/pkg/garden/desk.docket-0
@ -1,10 +1,10 @@
 :~  title+'System'
    info+'An app launcher for Urbit.'
    color+0xee.5432
-    glob-http+['https://bootstrap.urbit.org/glob-0v2.p3f6i.19q8d.lsgcb.mckg7.dtu8f.glob' 0v2.p3f6i.19q8d.lsgcb.mckg7.dtu8f]
+    glob-http+['https://bootstrap.urbit.org/glob-0v5.kgrq2.gp725.bo5bk.dmr7d.h41qk.glob' 0v5.kgrq2.gp725.bo5bk.dmr7d.h41qk]
    ::glob-ames+~zod^0v0
    base+'grid'
-    version+[1 1 3]
+    version+[1 1 6]
    website+'https://tlon.io'
    license+'MIT'
 ==
--- a/pkg/grid/package-lock.json
+++ b/pkg/grid/package-lock.json
@ -18,7 +18,7 @@
        "@radix-ui/react-toggle": "^0.0.10",
        "@tlon/sigil-js": "^1.4.4",
        "@types/lodash": "^4.14.172",
-        "@urbit/api": "^2.1.0",
+        "@urbit/api": "^2.1.1",
        "@urbit/http-api": "^2.1.0",
        "big-integer": "^1.6.48",
        "classnames": "^2.3.1",
@ -1468,9 +1468,9 @@
      }
    },
    "node_modules/@urbit/api": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@urbit/api/-/api-2.1.0.tgz",
-      "integrity": "sha512-2njwpvZ2s23gp5C4v9uDynU1wxrN33+vloqpvlErUhMR/4R6mXE4cMvsZzj/fCGOa0J3LRV/If7XmgG+kY69Tg==",
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@urbit/api/-/api-2.1.1.tgz",
+      "integrity": "sha512-QRlqhtJ73q+pgMdSwuOO62HlxA7/2c5ylCcOUT01LXkJ2LTVCl5u+QnejdDvUmqjOuN2PyZk7df30xJVg6rC2A==",
      "dependencies": {
        "@babel/runtime": "^7.16.0",
        "big-integer": "^1.6.48",
@ -8257,9 +8257,9 @@
      }
    },
    "@urbit/api": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@urbit/api/-/api-2.1.0.tgz",
-      "integrity": "sha512-2njwpvZ2s23gp5C4v9uDynU1wxrN33+vloqpvlErUhMR/4R6mXE4cMvsZzj/fCGOa0J3LRV/If7XmgG+kY69Tg==",
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@urbit/api/-/api-2.1.1.tgz",
+      "integrity": "sha512-QRlqhtJ73q+pgMdSwuOO62HlxA7/2c5ylCcOUT01LXkJ2LTVCl5u+QnejdDvUmqjOuN2PyZk7df30xJVg6rC2A==",
      "requires": {
        "@babel/runtime": "^7.16.0",
        "big-integer": "^1.6.48",
--- a/pkg/grid/package.json
+++ b/pkg/grid/package.json
@ -15,8 +15,8 @@
    "tsc": "tsc --noEmit"
  },
  "dependencies": {
-    "@radix-ui/react-checkbox": "^0.1.5",
    "@fingerprintjs/fingerprintjs": "^3.3.3",
+    "@radix-ui/react-checkbox": "^0.1.5",
    "@radix-ui/react-dialog": "^0.0.20",
    "@radix-ui/react-dropdown-menu": "^0.0.23",
    "@radix-ui/react-icons": "^1.1.0",
@ -25,7 +25,7 @@
    "@radix-ui/react-toggle": "^0.0.10",
    "@tlon/sigil-js": "^1.4.4",
    "@types/lodash": "^4.14.172",
-    "@urbit/api": "^2.1.0",
+    "@urbit/api": "^2.1.1",
    "@urbit/http-api": "^2.1.0",
    "big-integer": "^1.6.48",
    "classnames": "^2.3.1",
--- a/pkg/interface/.eslintrc.js
+++ b/pkg/interface/.eslintrc.js
@ -7,6 +7,7 @@ module.exports = {
    // Because we use styled system, and use
    // the convention of each prop on a new line
    // we probably shouldn't keep this on
-    'max-lines-per-function': ['off', {}]
+    'max-lines-per-function': ['off', {}],
+    'max-lines': ['off', {}]
  }
 };
--- a/pkg/interface/package-lock.json
+++ b/pkg/interface/package-lock.json
--- a/pkg/interface/package.json
+++ b/pkg/interface/package.json
@ -40,7 +40,7 @@
    "react-codemirror2-react-17": "^1.0.0",
    "react-dom": "^17.0.2",
    "react-helmet": "^6.1.0",
-    "react-markdown": "^8.0.3",
+    "react-markdown": "^5.0.3",
    "react-oembed-container": "^1.0.1",
    "react-router-dom": "^5.2.0",
    "react-use-gesture": "^9.1.3",
--- a/pkg/interface/src/views/apps/publish/components/MarkdownEditor.tsx
+++ b/pkg/interface/src/views/apps/publish/components/MarkdownEditor.tsx
@ -96,7 +96,7 @@ export function MarkdownEditor(
      p={1}
      border={1}
      borderColor="lightGray"
-      backgroundColor={disabled ? '#eee' : '#fff'}
+      backgroundColor={disabled ? 'lightGray' : 'white'}
      borderRadius={2}
      height={['calc(100% - 22vh)', '100%']}
      {...boxProps}
--- a/pkg/interface/src/views/components/RichText.tsx
+++ b/pkg/interface/src/views/components/RichText.tsx
@ -2,26 +2,12 @@ import { Anchor, Text } from '@tlon/indigo-react';
 import { Contact, Group } from '@urbit/api';
 import React from 'react';
 import ReactMarkdown, { ReactMarkdownProps } from 'react-markdown';
-import RemarkDisableTokenizers from 'remark-disable-tokenizers';
 import { isValidPatp } from 'urbit-ob';
 import { deSig } from '~/logic/lib/util';
 import { PermalinkEmbed } from '~/views/apps/permalinks/embed';
 import { Mention } from '~/views/components/MentionText';
 import RemoteContent from '~/views/components/RemoteContent';

-const DISABLED_BLOCK_TOKENS = [
-  'indentedCode',
-  'atxHeading',
-  'thematicBreak',
-  'list',
-  'setextHeading',
-  'html',
-  'definition',
-  'table'
-];
-
-const DISABLED_INLINE_TOKENS = [];
-
 type RichTextProps = ReactMarkdownProps & {
  disableRemoteContent?: boolean;
  contact?: Contact;
@ -110,10 +96,6 @@ const RichText = React.memo(({ disableRemoteContent = false, ...props }: RichTex
        return <Text display={props.inline ? 'inline' : 'block'} mb={2} {...props}>{paraProps.children}</Text>;
      }
    }}
-    plugins={[[
-      RemarkDisableTokenizers,
-      { block: DISABLED_BLOCK_TOKENS, inline: DISABLED_INLINE_TOKENS }
-    ]]}
  />
 ));

--- a/pkg/interface/src/views/landscape/components/ChannelPopoverRoutes/ChannelPermissions.tsx
+++ b/pkg/interface/src/views/landscape/components/ChannelPopoverRoutes/ChannelPermissions.tsx
@ -91,7 +91,7 @@ export function GraphPermissions(props: GraphPermissionsProps) {

  const initialValues = {
    writePerms,
-    writers: writers
+    writers: [...writers]
      .filter(x => x !== hostShip),
    readerComments: association.metadata.vip === 'reader-comments'
  };
@ -104,7 +104,7 @@ export function GraphPermissions(props: GraphPermissionsProps) {
      resource: association.resource,
      tag: 'writers'
    };
-    const allWriters = writers.map(w => `~${w}`);
+    const allWriters = [...writers].map(w => `~${w}`);
    if (values.readerComments !== readerComments) {
      await airlock.poke(metadataEdit(association, {
        vip: values.readerComments ? 'reader-comments' : ''
--- a/pkg/interface/src/views/landscape/components/Graph/GraphContent.tsx
+++ b/pkg/interface/src/views/landscape/components/Graph/GraphContent.tsx
@ -34,26 +34,30 @@ interface GraphMentionNode {
  ship: string;
 }

-const addEmphasisToMention = (contents: Content[], content: Content, index: number) => {
+const addEmphasisToMention = (
+  contents: Content[],
+  content: Content,
+  index: number
+) => {
  const prevContent = contents[index - 1];
  const nextContent = contents[index + 1];

  if (
    'text' in content &&
-    (content.text.trim() === '**' || content.text.trim() === '*' )
-  )  {
+    (content.text.trim() === '**' || content.text.trim() === '*')
+  ) {
    return {
      text: ''
    };
  }
-  if(
+  if (
    'text' in content &&
    content.text.endsWith('*') &&
    !content.text.startsWith('*') &&
    nextContent !== undefined &&
    'mention' in nextContent
  ) {
-    if (content.text.charAt((content.text.length - 2)) === '*') {
+    if (content.text.charAt(content.text.length - 2) === '*') {
      return { text: content.text.slice(0, content.text.length - 2) };
    }
    return { text: content.text.slice(0, content.text.length - 1) };
@ -116,72 +120,80 @@ const codeToMdAst = (content: CodeContent) => {
  };
 };

-const contentToMdAst = (tall: boolean) => (
-  content: Content
-): [StitchMode, any] => {
-  if ('text' in content) {
-    if (content.text.toString().trim().length === 0) {
+const contentToMdAst =
+  (tall: boolean) =>
+  (content: Content): [StitchMode, any] => {
+    if ('text' in content) {
+      if (content.text.toString().trim().length === 0) {
+        return [
+          'merge',
+          { type: 'root', children: [{ type: 'paragraph', children: [] }] }
+        ];
+      }
      return [
        'merge',
-        { type: 'root', children: [{ type: 'paragraph', children: [] }] }
+        tall ? parseTall(content.text) : parseWide(content.text)
+      ] as [StitchMode, any];
+    } else if ('code' in content) {
+      return ['block', codeToMdAst(content)];
+    } else if ('reference' in content) {
+      return [
+        'block',
+        {
+          type: 'root',
+          children: [
+            {
+              type: 'graph-reference',
+              reference: content.reference
+            }
+          ]
+        }
+      ];
+    } else if ('url' in content) {
+      const images = ['.jpg', '.jpeg', '.png', '.gif', '.webp'];
+      return [
+        'inline',
+        {
+          type: 'root',
+          children: [
+            {
+              type: 'link',
+              url: content.url,
+              children: [
+                {
+                  type: 'text',
+                  value: !images.some(i => content.url.includes(i))
+                    ? content.url
+                    : ''
+                }
+              ]
+            }
+          ]
+        }
+      ];
+    } else if ('mention' in content) {
+      return [
+        'inline',
+        {
+          type: 'root',
+          children: [
+            {
+              type: 'graph-mention',
+              ship: content.mention,
+              emphasis: content.emphasis
+            }
+          ]
+        }
      ];
    }
-    return [
-      'merge',
-      tall ? parseTall(content.text) : parseWide(content.text)
-    ] as [StitchMode, any];
-  } else if ('code' in content) {
-    return ['block', codeToMdAst(content)];
-  } else if ('reference' in content) {
-    return [
-      'block',
-      {
-        type: 'root',
-        children: [
-          {
-            type: 'graph-reference',
-            reference: content.reference
-          }
-        ]
-      }
-    ];
-  } else if ('url' in content) {
    return [
      'inline',
      {
        type: 'root',
-        children: [
-          {
-            type: 'link',
-            url: content.url,
-            children: [{ type: 'text', value: content.url }]
-          }
-        ]
+        children: []
      }
    ];
-  } else if ('mention' in content) {
-    return [
-      'inline',
-      {
-        type: 'root',
-        children: [
-          {
-            type: 'graph-mention',
-            ship: content.mention,
-            emphasis: content.emphasis
-          }
-        ]
-      }
-    ];
-  }
-  return [
-    'inline',
-    {
-      type: 'root',
-      children: []
-    }
-  ];
-};
+  };

 function stitchInline(a: any, b: any) {
  if (!a?.children) {
@ -230,9 +242,14 @@ function getChildren<T extends unknown>(node: T): AstContent[] {
 }

 export function asParent<T extends BlockContent>(node: T): Parent | undefined {
-    return ['paragraph', 'heading', 'list', 'listItem', 'table', 'blockquote'].includes(
-    node.type
-  )
+  return [
+    'paragraph',
+    'heading',
+    'list',
+    'listItem',
+    'table',
+    'blockquote'
+  ].includes(node.type)
    ? (node as Parent)
    : undefined;
 }
@ -299,20 +316,10 @@ function stitchAsts(asts: [StitchMode, GraphAstNode][]) {
  );

  t[1].children.map((c, idx) => {
-    if (c.type === 'blockquote' && t[1].children[idx +1] !== undefined && t[1].children[idx +1].type === 'paragraph') {
-        const next = idx !== t[1].children.length -1
-            ? t[1].children.splice(idx +1, 1)
-            : [];
-
-        if (next.length > 0) {
-            t[1].children[idx].children.push(next[0]);
-        }
-    }
-
    const links = [];
    function addRichEmbedURL(nodes) {
      if (nodes?.children) {
-        nodes.children.filter((k) => {
+        nodes.children.filter(k => {
          if (k.type === 'link') {
            links.push({
              type: 'root',
@ -324,7 +331,7 @@ function stitchAsts(asts: [StitchMode, GraphAstNode][]) {
              ]
            });
          } else if (k?.children) {
-            k.children.filter((o) => {
+            k.children.filter(o => {
              if (o.type === 'link') {
                links.push({
                  type: 'root',
@ -456,7 +463,7 @@ const renderers = {
    );
    return tall ? <Box mb={2}>{inner}</Box> : inner;
  },
-  link: (props) => {
+  link: props => {
    return (
      <Anchor
        display="inline"
@ -472,9 +479,13 @@ const renderers = {
    );
  },
  list: ({ depth, ordered, children }) => {
-    return ordered ? <Ol fontSize="1">{children}</Ol> : <Ul fontSize="1">{children}</Ul>;
+    return ordered ? (
+      <Ol fontSize="1">{children}</Ol>
+    ) : (
+      <Ul fontSize="1">{children}</Ul>
+    );
  },
-  'graph-mention': (obj) => {
+  'graph-mention': obj => {
    return <Mention ship={obj.ship} emphasis={obj.emphasis} />;
  },
  image: ({ url, tall }) => (
@ -483,17 +494,13 @@ const renderers = {
    </Box>
  ),
  'graph-url': ({ url, tall }) => (
-     <RemoteContent key={url} url={url} tall={tall} />
+    <RemoteContent key={url} url={url} tall={tall} />
  ),
  'graph-reference': ({ reference, transcluded }) => {
    const { link } = referenceToPermalink({ reference });
    return (
      <Box my={2} flexShrink={0}>
-        <PermalinkEmbed
-          link={link}
-          transcluded={transcluded}
-          showOurContact
-        />
+        <PermalinkEmbed link={link} transcluded={transcluded} showOurContact />
      </Box>
    );
  },
@ -561,19 +568,13 @@ export type GraphContentProps = PropFunc<typeof Box> & {
  showOurContact: boolean;
 };

-export const GraphContent = React.memo((
-  props: GraphContentProps
-) => {
-  const {
-    contents,
-    tall = false,
-    transcluded = 0,
-    ...rest
-  } = props;
+export const GraphContent = React.memo((props: GraphContentProps) => {
+  const { contents, tall = false, transcluded = 0, ...rest } = props;
  const [, ast] = stitchAsts(
    contents
-    .map((content, index) => addEmphasisToMention(contents, content, index))
-    .map(contentToMdAst(tall)));
+      .map((content, index) => addEmphasisToMention(contents, content, index))
+      .map(contentToMdAst(tall))
+  );
  return (
    <Box {...rest}>
      <Graphdown transcluded={transcluded} ast={ast} tall={tall} />
--- a/pkg/landscape/app/graph-store.hoon
+++ b/pkg/landscape/app/graph-store.hoon
@ -679,20 +679,19 @@
    =/  update-log
      (~(get by update-logs) [ship term])
    :-  ~  :-  ~  :-  %noun
-    !>
    ?+    t.t.t.t.path  (on-peek:def path)
        ~
-      ^-  update-log:store
+      !>  ^-  update-log:store
      ?~(update-log *update-log:store u.update-log)
    ::
        [%latest ~]
-      ^-  (unit time)
+      !>  ^-  (unit time)
      %+  biff  update-log
      |=  =update-log:store
      (bind (pry:orm-log:store update-log) head)
    ::
        [%subset @ @ ~]
-      ^-  update-log:store
+      !>  ^-  update-log:store
      ?~  update-log  *update-log:store
      =*  start  i.t.t.t.t.t.path
      =*  end    i.t.t.t.t.t.t.path
--- a/pkg/landscape/desk.docket-0
+++ b/pkg/landscape/desk.docket-0
@ -1,10 +1,10 @@
 :~  title+'Groups'
    info+'A suite of applications to communicate on Urbit'
    color+0xee.5432
-    glob-http+['https://bootstrap.urbit.org/glob-0v4.2se6m.fvv67.nn5e8.vfrv9.mmi88.glob' 0v4.2se6m.fvv67.nn5e8.vfrv9.mmi88]
+    glob-http+['https://bootstrap.urbit.org/glob-0v3.mtkm8.77bad.7j793.jtnl4.pi1mm.glob' 0v3.mtkm8.77bad.7j793.jtnl4.pi1mm]

    base+'landscape'
-    version+[1 0 11]
+    version+[1 1 0]
    website+'https://tlon.io'
    license+'MIT'
 ==
--- a/pkg/urbit/.gitignore
+++ b/pkg/urbit/.gitignore
@ -3,3 +3,8 @@
 /include/config.h
 /include/ca-bundle.h
 /include/ivory.h
+
+# indexing
+/.cache/
+compile_commands.json
+tags
--- a/pkg/urbit/Makefile
+++ b/pkg/urbit/Makefile
@ -1,5 +1,6 @@
 include config.mk
-include $(foreach dir,$(compat),$(wildcard compat/$(dir)/*.mk))
+compat_mks := $(foreach dir,$(compat),$(wildcard compat/$(dir)/*.mk))
+include $(compat_mks)

 jets = jets/tree.c $(wildcard jets/*/*.c)
 noun = $(wildcard noun/*.c)
@ -32,7 +33,7 @@ CFLAGS := $(CFLAGS)

 ################################################################################

-.PHONY: all test clean mrproper
+.PHONY: all bench test clean mrproper

 ################################################################################

@ -53,7 +54,7 @@ clean:
 	rm -f ./tags $(all_objs) $(all_exes)

 mrproper: clean
-	rm -f config.mk include/config.h
+	rm -f config.mk include/config.h compile_commands.json

 ################################################################################

@ -80,3 +81,15 @@ build/urbit: $(common_objs) $(daemon_objs) $(worker_objs)

 tags: $(all_srcs) $(headers)
 	ctags $^
+
+compile_commands.json: Makefile config.mk $(compat_mks)
+	@echo "[" > $@ && sep= && \
+	for src in $(all_srcs); do \
+		echo "$$sep{" >> $@; \
+		printf '"directory": "%s",\n' $$(pwd) >> $@; \
+		printf '"command": "%s",\n' "$(CC) -I./include $(CFLAGS) $$src $(CCEXTRA) -c" >> $@; \
+		printf '"file": "%s",\n' $$src >> $@; \
+		echo "}" >> $@; \
+		sep=','; \
+	done && \
+	echo "]" >> $@
--- a/pkg/urbit/compat/openbsd/lmdb.patch
+++ b/pkg/urbit/compat/openbsd/lmdb.patch
@ -0,0 +1,12 @@
+diff --git a/Makefile b/Makefile
+--- a/Makefile
+++ b/Makefile
+@@ -18,7 +18,7 @@
+ # There may be other macros in mdb.c of interest. You should
+ # read mdb.c before changing any of them.
+ #
+-CC	= gcc
+CC	= cc
+ AR	= ar
+ W	= -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized
+ THREADS = -pthread
--- a/pkg/urbit/compat/openbsd/murmur3.patch
+++ b/pkg/urbit/compat/openbsd/murmur3.patch
@ -0,0 +1,13 @@
+diff --git a/makefile b/makefile
+--- a/makefile
+++ b/makefile
+@@ -12,5 +12,9 @@ shared: murmur3.c murmur3.h
+ 	$(CC) -fPIC -O3 -c murmur3.c
+ 	$(CC) -shared -Wl,--export-dynamic murmur3.o -o libmurmur3.so
+ 
+static: murmur3.c murmur3.h
+	$(CC) -fPIC -O3 -c murmur3.c
+	$(AR) rcs libmurmur3.a murmur3.o
+
+ clean:
+ 	rm -rf example *.o *.so
--- a/pkg/urbit/compat/openbsd/softfloat3.patch
+++ b/pkg/urbit/compat/openbsd/softfloat3.patch
@ -0,0 +1,85 @@
+diff --git a/build/template-FAST_INT64/Makefile b/build/template-FAST_INT64/Makefile
+--- a/build/template-FAST_INT64/Makefile
+++ b/build/template-FAST_INT64/Makefile
+@@ -34,28 +34,27 @@
+ #
+ #=============================================================================
+ 
+-# Edit lines marked with `==>'.  See "SoftFloat-source.html".
+SOURCE_DIR ?= ../../source
+SPECIALIZE_TYPE ?= 8086-SSE
+ 
+-==> SOURCE_DIR ?= ../../source
+-==> SPECIALIZE_TYPE ?= 8086
+SOFTFLOAT_OPTS ?= \
+   -DSOFTFLOAT_ROUND_ODD -DINLINE_LEVEL=5 -DSOFTFLOAT_FAST_DIV32TO16 \
+   -DSOFTFLOAT_FAST_DIV64TO32
+ 
+-==> SOFTFLOAT_OPTS ?= \
+-==>   -DSOFTFLOAT_ROUND_ODD -DINLINE_LEVEL=5 -DSOFTFLOAT_FAST_DIV32TO16 \
+-==>   -DSOFTFLOAT_FAST_DIV64TO32
+DELETE = rm -f
+C_INCLUDES = -I. -I$(SOURCE_DIR)/$(SPECIALIZE_TYPE) -I$(SOURCE_DIR)/include
+COMPILE_C = \
+  cc -c -DSOFTFLOAT_FAST_INT64 $(SOFTFLOAT_OPTS) $(C_INCLUDES) -O2 -o $@
+MAKELIB = ar crs $@
+LIBNAME = libsoftfloat3
+ 
+-==> DELETE = rm -f
+-==> C_INCLUDES = -I. -I$(SOURCE_DIR)/$(SPECIALIZE_TYPE) -I$(SOURCE_DIR)/include
+-==> COMPILE_C = \
+-==>   cc -c -DSOFTFLOAT_FAST_INT64 $(SOFTFLOAT_OPTS) $(C_INCLUDES) -O2 -o $@
+-==> MAKELIB = ar crs $@
+OBJ = .o
+LIB = .a
+ 
+-==> OBJ = .o
+-==> LIB = .a
+-
+-==> OTHER_HEADERS =
+OTHER_HEADERS =
+ 
+ .PHONY: all
+-all: softfloat$(LIB)
+all: $(LIBNAME)$(LIB)
+ 
+ OBJS_PRIMITIVES = \
+   s_eq128$(OBJ) \
+@@ -381,11 +380,11 @@ $(OBJS_PRIMITIVES) $(OBJS_OTHERS): %$(OBJ): $(SOURCE_DIR)/%.c
+ $(OBJS_SPECIALIZE): %$(OBJ): $(SOURCE_DIR)/$(SPECIALIZE_TYPE)/%.c
+ 	$(COMPILE_C) $(SOURCE_DIR)/$(SPECIALIZE_TYPE)/$*.c
+ 
+-softfloat$(LIB): $(OBJS_ALL)
+$(LIBNAME)$(LIB): $(OBJS_ALL)
+ 	$(DELETE) $@
+ 	$(MAKELIB) $^
+ 
+ .PHONY: clean
+ clean:
+-	$(DELETE) $(OBJS_ALL) softfloat$(LIB)
+	$(DELETE) $(OBJS_ALL) $(LIBNAME)$(LIB)
+ 
+diff --git a/build/template-FAST_INT64/platform.h b/build/template-FAST_INT64/platform.h
+--- a/build/template-FAST_INT64/platform.h
+++ b/build/template-FAST_INT64/platform.h
+@@ -34,17 +34,15 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ 
+ =============================================================================*/
+ 
+-// Edit lines marked with `==>'.  See "SoftFloat-source.html".
+-
+ /*----------------------------------------------------------------------------
+ *----------------------------------------------------------------------------*/
+-==> #define LITTLEENDIAN 1
+#define LITTLEENDIAN 1
+ 
+ /*----------------------------------------------------------------------------
+ *----------------------------------------------------------------------------*/
+-==> #define INLINE inline
+#define INLINE inline
+ 
+ /*----------------------------------------------------------------------------
+ *----------------------------------------------------------------------------*/
+-==> #define THREAD_LOCAL _Thread_local
+#define THREAD_LOCAL
+ 
--- a/pkg/urbit/compat/poor-mans-nix-shell.sh
+++ b/pkg/urbit/compat/poor-mans-nix-shell.sh
@ -3,13 +3,18 @@ declare -a ldirs
 declare -a pdirs
 declare -A hdeps
 sources=(../../nix/sources.json ../../nix/sources-pmnsh.json)
+[ "yes" == "${build_openssl-no}" ] && sources=(../../nix/sources-openssl.json ${sources[@]})
 patches=compat/$1
 deriver=urbit-$1-build
 markfil=.$1~
 depdirs=
 nixpath=${NIX_STORE-../build}

-: "${MAKE:=make}"
+: ${gnutar:=tar}
+: ${gnumake:=make}
+: ${sha256tool:=sha256sum}
+
+export MAKE=$gnumake

 # LDFLAGS doesn't like absolute paths
 if [ "${nixpath:0:1}" == "/" ]
@ -71,7 +76,7 @@ buildnixdep () {
      fi
      mkdir -p $dir
      pushd $dir
-      curl -fL "$url"|(tar --strip $strip -xzf - || true)
+      curl -fL "$url"|($gnutar --strip $strip -xzf - || true)
      popd
    fi
  else
@ -86,7 +91,7 @@ buildnixdep () {
    [ -e $patch ] && patch -d $dir -p 1 <$patch
    pushd $dir
    eval "$cmdprep"
-    eval ${MAKE} "$cmdmake"
+    eval $gnumake "$cmdmake"
    touch $markfil
    popd
  fi
@ -98,13 +103,13 @@ buildnixdep () {
    echo Uploading freshly built $hash-$key to binary cache...
    tar -C $dir -czf $hash.tar .
    local size=$(stat -c '%s' $hash.tar)
-    read filehash _ < <(sha256sum $hash.tar)
+    read filehash _ < <($sha256tool $hash.tar)
    curl -fL -H "Content-Type: application/gzip" -H "Authorization: Bearer $CACHIX_AUTH_TOKEN" --data-binary @"$hash.tar" "$cache/nar"
    curl -fL -H "Content-Type: application/json" -H "Authorization: Bearer $CACHIX_AUTH_TOKEN" --data-binary @- "$cache/${hash}.narinfo" <<EOF
 {
  "cStoreHash": "$hash",
  "cStoreSuffix": "$key",
-  "cNarHash": "sha256:$(hex2nixbase32 $filehash)",
+  "cNarHash": "$sha256tool:$(hex2nixbase32 $filehash)",
  "cNarSize": $size,
  "cFileHash": "$filehash",
  "cFileSize": $size,
@ -129,7 +134,7 @@ do
  patch=$patches/$key.patch
  read hash _ < <((
  echo -n $json
-  [ -e $patch ] && cat $patch)|sha256sum)
+  [ -e $patch ] && cat $patch)|$sha256tool)
  hash=$(hex2nixbase32 $hash)
  hdeps[$key]=$hash
  depdirs="$depdirs|gsub(\"\\\\.\\\\./$key\";\"\\(\$d)/$hash-$key\")"
--- a/pkg/urbit/configure
+++ b/pkg/urbit/configure
@ -64,6 +64,7 @@ do
  shift
 done

+[ -z "${NO_GUARD_PAGE-}" ]    && defmacro U3_GUARD_PAGE 1
 [ -n "${MEMORY_DEBUG-}" ]     && defmacro U3_MEMORY_DEBUG 1
 [ -n "${MEMORY_LOG-}" ]       && defmacro U3_MEMORY_LOG 1
 [ -n "${CPU_DEBUG-}" ]        && defmacro U3_CPU_DEBUG 1
@ -86,7 +87,7 @@ case $(tr A-Z a-z <<< $cpu) in
  i686)
     defmacro U3_OS_ENDIAN_little 1
     ;;
-  x86_64)
+  x86_64 | amd64)
     defmacro U3_OS_ENDIAN_little 1
     ;;
  arm64|aarch64)
@ -110,7 +111,7 @@ case $(tr A-Z a-z <<< $os) in
     mpkgs=(cmake curl gcc jq make)
     pacman -S --needed autoconf automake-wrapper libtool patch ${mpkgs[@]/#/mingw-w64-x86_64-}

-     export MAKE=mingw32-make
+     gnumake=mingw32-make

     . compat/poor-mans-nix-shell.sh mingw
     compat/create-include-files.sh 'stat -c %s' /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
@ -157,7 +158,28 @@ case $(tr A-Z a-z <<< $os) in
     deps="$deps kvm" # XX use new compat.mk pattern
     ;;
  *openbsd*)
+     # pkg_add bash automake libtool jq gtar cmake gmake libsigsegv gmp
+     # Tested versions:
+        # bash-5.1.8 automake-1.16.3 (autoconf-2.69p3) libtool-2.4.2p2
+        # jq-1.6p0 gtar-1.34-static cmake-3.20.3p0v0 gmake-4.3 libsigsegv-2.12
+        # gmp-6.2.1p0
+
+     gnutar=gtar
+     gnumake=gmake
+     sha256tool=sha256
+     build_openssl=yes
+     export AUTOCONF_VERSION="${AUTOCONF_VERSION-2.69}"
+     export AUTOMAKE_VERSION="${AUTOMAKE_VERSION-1.16}"
+     . compat/poor-mans-nix-shell.sh openbsd
+     compat/create-include-files.sh 'stat -f %z' /etc/ssl/cert.pem
+
     defmacro U3_OS_bsd 1
+     defmacro U3_OS_no_ubc 1
+
+     export PKG_CONFIG_PATH="${PKG_CONFIG_PATH-}"
+     deps="$deps aes_siv secp256k1"
+
+     compat="${compat-} posix openbsd"
     ;;
  *)
     echo "Unknown or unsupported OS: '$os'" >&2
--- a/pkg/urbit/daemon/main.c
+++ b/pkg/urbit/daemon/main.c
@ -251,7 +251,7 @@ _main_getopt(c3_i argc, c3_c** argv)
        break;
      }
      case 'Y': {
-        u3_Host.ops_u.puk_c = _main_repath(optarg);
+        u3_Host.ops_u.puk_c = strdup(optarg);
        break;
      }
      case 'Z': {
@ -681,6 +681,7 @@ u3_ve_usage(c3_i argc, c3_c** argv)
    "-Y, --scry-into FILE          Optional name of file (for -X)\n",
    "-Z, --scry-format FORMAT      Optional file format ('jam', or aura, for -X)\n",
    "    --no-conn                 Do not run control plane\n",
+    "    --no-dock                 Skip binary \"docking\" on boot\n",
    "\n",
    "Development Usage:\n",
    "   To create a development ship, use a fakezod:\n",
--- a/pkg/urbit/include/c/defs.h
+++ b/pkg/urbit/include/c/defs.h
@ -56,6 +56,16 @@
 #     define c3_max(x, y) ( ((x) > (y)) ? (x) : (y) )
 #     define c3_min(x, y) ( ((x) < (y)) ? (x) : (y) )

+
+//! Round up/down (respectively).
+//!
+//! @param[in] x  Integer to round.
+//! @param[in] n  Multiple to round to. Must be power of 2.
+//!
+//! @return  `x` rounded to the nearest multiple of `n`.
+#     define c3_rop(x, n) (((x) + ((n) - 1)) & (~((n) - 1)))
+#     define c3_rod(x, n) ((x) & ~((n) - 1))
+
    /* Rotate.
    */
 #     define c3_rotw(r, x)  ( ((x) << (r)) | ((x) >> (32 - (r))) )
--- a/pkg/urbit/include/c/motes.h
+++ b/pkg/urbit/include/c/motes.h
@ -387,6 +387,7 @@
 #   define c3__ergo   c3_s4('e','r','g','o')
 #   define c3__esh    c3_s3('e','s','h')
 #   define c3__etch   c3_s4('e','t','c','h')
+#   define c3__evil   c3_s4('e','v','i','l')
 #   define c3__ex     c3_s2('e','x')
 #   define c3__exit   c3_s4('e','x','i','t')
 #   define c3__eyre   c3_s4('e','y','r','e')
--- a/pkg/urbit/include/noun/allocate.h
+++ b/pkg/urbit/include/noun/allocate.h
@ -25,7 +25,7 @@

    /* u3a_bytes: number of bytes in memory.
    */
-#     define u3a_bytes  (c3_w)((1 << (2 + u3a_bits)))
+#     define u3a_bytes  (sizeof(c3_w) * u3a_words)

    /* u3a_cells: number of representable cells.
    */
@ -397,36 +397,33 @@
          u3a_push(const u3a_pile* pil_u)
          {
            u3R->cap_p += pil_u->mov_ws;
-            return u3a_peek(pil_u);
-          }

-        /* u3a_pile_sane(): bail on invalid road stack state.
-        */
-          inline void
-          u3a_pile_sane(const u3a_pile* pil_u)
-          {
+#ifndef U3_GUARD_PAGE
            //  !off means we're on a north road
            //
            if ( !pil_u->off_ws ) {
              if( !(u3R->cap_p > u3R->hat_p) ) {
                u3m_bail(c3__meme);
              }
-#ifdef U3_MEMORY_DEBUG
+# ifdef U3_MEMORY_DEBUG
              c3_assert( pil_u->top_p >= u3R->cap_p );
-#endif
+# endif
            }
            else {
              if( !(u3R->cap_p < u3R->hat_p) ) {
                u3m_bail(c3__meme);
              }
-#ifdef U3_MEMORY_DEBUG
+# ifdef U3_MEMORY_DEBUG
              c3_assert( pil_u->top_p <= u3R->cap_p );
-#endif
+# endif
            }
+#endif /* ifndef U3_GUARD_PAGE */

 #ifdef U3_MEMORY_DEBUG
            c3_assert( pil_u->rod_u == u3R );
 #endif
+
+            return u3a_peek(pil_u);
          }

        /* u3a_pile_done(): assert valid upon completion.
@ -708,14 +705,6 @@
                        void     (*pat_f)(u3_atom, void*),
                        c3_o     (*cel_f)(u3_noun, void*));

-        /* u3a_walk_fore_unsafe(): u3a_walk_fore(), without overflow checks
-        */
-          void
-          u3a_walk_fore_unsafe(u3_noun    a,
-                               void*      ptr_v,
-                               void     (*pat_f)(u3_atom, void*),
-                               c3_o     (*cel_f)(u3_noun, void*));
-
        /* u3a_string(): `a` as an on-loom c-string.
        */
          c3_c*
--- a/pkg/urbit/include/noun/events.h
+++ b/pkg/urbit/include/noun/events.h
@ -84,4 +84,9 @@
      void
      u3e_foul(void);

+    /* u3e_init(): initialize page tracking.
+    */
+      void
+      u3e_init(void);
+
 #endif /* ifndef U3_EVENTS_H */
--- a/pkg/urbit/include/noun/manage.h
+++ b/pkg/urbit/include/noun/manage.h
@ -44,6 +44,11 @@
        void
        u3m_pave(c3_o nuu_o);

+      /* u3m_signal(): treat a nock-level exception as a signal interrupt.
+      */
+        void
+        u3m_signal(u3_noun sig_l);
+
      /* u3m_file(): load file, as atom, or bail.
      */
        u3_noun
--- a/pkg/urbit/jets/b/reel.c
+++ b/pkg/urbit/jets/b/reel.c
@ -27,7 +27,6 @@
        *top = i;
      } while ( u3_nul != t );

-      u3a_pile_sane(&pil_u);
      u3j_gate_prep(&sit_u, u3k(b));

      while ( c3n == u3a_pile_done(&pil_u) ) {
--- a/pkg/urbit/jets/e/aes_siv.c
+++ b/pkg/urbit/jets/e/aes_siv.c
@ -149,9 +149,11 @@ _cqea_siv_de(c3_y*   key_y,
    txt_y = u3r_bytes_alloc(0, txt_w, txt);
    out_y = u3a_malloc(txt_w);

-    ret = ( 0 != (*low_f)(txt_y, txt_w, dat_u, soc_w, key_y, iv_y, out_y) )
-      ? u3_none
-      : u3nc(0, u3i_bytes(txt_w, out_y));
+    if ( 0 != (*low_f)(txt_y, txt_w, dat_u, soc_w, key_y, iv_y, out_y) ) {
+      return u3m_bail(c3__evil);
+    }
+
+    ret = u3nc(0, u3i_bytes(txt_w, out_y));

    u3a_free(txt_y);
    u3a_free(out_y);
--- a/pkg/urbit/jets/e/parse.c
+++ b/pkg/urbit/jets/e/parse.c
@ -984,10 +984,6 @@
      u3j_site raq_u;
      u3j_gate_prep(&raq_u, u3k(raq));

-      //  check for stack overflow
-      //
-      u3a_pile_sane(&pil_u);
-
      while ( c3n == u3a_pile_done(&pil_u) ) {
        p_wag   = _last_k(par_u->har, p_wag);
        puq_wag = u3j_gate_slam(&raq_u, u3nc(par_u->res, puq_wag));
--- a/pkg/urbit/noun/allocate.c
+++ b/pkg/urbit/noun/allocate.c
@ -13,8 +13,6 @@ void*
 u3a_pop(const u3a_pile* pil_u);
 void*
 u3a_push(const u3a_pile* pil_u);
-void
-u3a_pile_sane(const u3a_pile* pil_u);
 c3_o
 u3a_pile_done(const u3a_pile* pil_u);

@ -715,12 +713,13 @@ u3a_cellblock(c3_w num_w)
  c3_w          i_w;

  if ( c3y == u3a_is_north(u3R) ) {
-    if ( u3R->cap_p <= (u3R->hat_p + (num_w * u3a_minimum)) ) {
+    if ( u3R->cap_p <= (u3R->hat_p + (num_w * u3a_minimum) + (1 << u3a_page)) ) {
      return c3n;
    }
    else {
-      u3_post hat_p = u3R->hat_p;
      u3_post cel_p = u3R->all.cel_p;
+      u3_post hat_p = u3R->hat_p;
+      u3R->hat_p   += (num_w * u3a_minimum);

      for ( i_w = 0; i_w < num_w; i_w++) {
        u3_post  all_p = hat_p;
@ -744,17 +743,18 @@ u3a_cellblock(c3_w num_w)
        u3to(u3a_fbox, fre_p)->nex_p = cel_p;
        cel_p = fre_p;
      }
-      u3R->hat_p = hat_p;
+
      u3R->all.cel_p = cel_p;
    }
  }
  else {
-    if ( (u3R->cap_p + (num_w * u3a_minimum)) >= u3R->hat_p ) {
+    if ( (u3R->cap_p + (num_w * u3a_minimum) + (1 << u3a_page)) >= u3R->hat_p ) {
      return c3n;
    }
    else {
-      u3_post hat_p = u3R->hat_p;
      u3_post cel_p = u3R->all.cel_p;
+      u3_post hat_p = u3R->hat_p;
+      u3R->hat_p   -= (num_w * u3a_minimum);

      for ( i_w = 0; i_w < num_w; i_w++ ) {
        u3_post  all_p = (hat_p -= u3a_minimum);
@ -776,7 +776,7 @@ u3a_cellblock(c3_w num_w)
        u3to(u3a_fbox, fre_p)->nex_p = cel_p;
        cel_p = fre_p;
      }
-      u3R->hat_p = hat_p;
+
      u3R->all.cel_p = cel_p;
    }
  }
@ -1174,7 +1174,6 @@ _ca_take_next_north(u3a_pile* pil_u, u3_noun veb)
      else {
        u3a_cell* old_u = (u3a_cell*)veb_u;
        _ca_take* fam_u = u3a_push(pil_u);
-        u3a_pile_sane(pil_u);

        fam_u->hed = u3_none;
        fam_u->old = veb;
@ -1230,7 +1229,6 @@ _ca_take_next_south(u3a_pile* pil_u, u3_noun veb)
      else {
        u3a_cell* old_u = (u3a_cell*)veb_u;
        _ca_take* fam_u = u3a_push(pil_u);
-        u3a_pile_sane(pil_u);

        fam_u->hed = u3_none;
        fam_u->old = veb;
@ -2654,50 +2652,6 @@ u3a_walk_fore(u3_noun    a,
    else {
      *top = u3t(a);
      top  = u3a_push(&pil_u);
-      u3a_pile_sane(&pil_u);
-      *top = u3h(a);
-    }
-
-    a = *top;
-  }
-}
-
-/* u3a_walk_fore_unsafe(): u3a_walk_fore(), without overflow checks
-*/
-void
-u3a_walk_fore_unsafe(u3_noun    a,
-                     void*      ptr_v,
-                     void     (*pat_f)(u3_atom, void*),
-                     c3_o     (*cel_f)(u3_noun, void*))
-{
-  u3_noun*   top;
-  u3a_pile pil_u;
-
-  //  initialize stack control; push argument
-  //
-  u3a_pile_prep(&pil_u, sizeof(u3_noun));
-  top  = u3a_push(&pil_u);
-  *top = a;
-
-  while ( c3n == u3a_pile_done(&pil_u) ) {
-    //  visit an atom, then pop the stack
-    //
-    if ( c3y == u3a_is_atom(a) ) {
-      pat_f(a, ptr_v);
-      top = u3a_pop(&pil_u);
-    }
-    //  vist a cell, if c3n, pop the stack
-    //
-    else if ( c3n == cel_f(a, ptr_v) ) {
-      top = u3a_pop(&pil_u);
-    }
-    //  otherwise, push the tail and continue into the head
-    //
-    else {
-      *top = u3t(a);
-      //  NB: overflow check elided here
-      //
-      top  = u3a_push(&pil_u);
      *top = u3h(a);
    }

--- a/pkg/urbit/noun/events.c
+++ b/pkg/urbit/noun/events.c
@ -29,6 +29,11 @@
 //!     handled outside this module).
 //!   - faults are handled by dirtying the page and switching protections to
 //!     read/write.
+//!   - a guard page is initially placed in the approximate middle of the free
+//!     space between the heap and stack at the time of the first page fault.
+//!     when a fault is detected in the guard page, the guard page is recentered
+//!     in the free space of the current road. if the guard page cannot be
+//!     recentered, then memory exhaustion has occurred.
 //!
 //! ### updates (u3e_save())
 //!
@ -71,6 +76,15 @@
 #include <fcntl.h>
 #include <sys/stat.h>

+// Base loom offset of the guard page.
+static u3p(c3_w) gar_pag_p;
+
+//! Urbit page size in 4-byte words.
+static const size_t pag_wiz_i = 1 << u3a_page;
+
+//! Urbit page size in bytes.
+static const size_t pag_siz_i = sizeof(c3_w) * pag_wiz_i;
+
 #ifdef U3_SNAPSHOT_VALIDATION
 /* Image check.
 */
@ -172,6 +186,60 @@ _ce_mapfree(void* map_v)
 }
 #endif

+#ifdef U3_GUARD_PAGE
+//! Place a guard page at the (approximate) middle of the free space between
+//! the heap and stack of the current road, bailing if memory has been
+//! exhausted.
+static c3_i
+_ce_center_guard_page(void)
+{
+  u3p(c3_w) bot_p, top_p;
+  if ( !u3R ) {
+    top_p = u3a_outa(u3_Loom + u3a_words);
+    bot_p = u3a_outa(u3_Loom);
+  }
+  else if ( c3y == u3a_is_north(u3R) ) {
+    top_p = c3_rod(u3R->cap_p, pag_wiz_i);
+    bot_p = c3_rop(u3R->hat_p, pag_wiz_i);
+  }
+  else {
+    top_p = c3_rod(u3R->hat_p, pag_wiz_i);
+    bot_p = c3_rop(u3R->cap_p, pag_wiz_i);
+  }
+
+  if ( top_p < bot_p + pag_wiz_i ) {
+    fprintf(stderr,
+            "loom: not enough memory to recenter the guard page\r\n");
+    goto bail;
+  }
+  const u3p(c3_w) old_gar_p = gar_pag_p;
+  const c3_w      mid_p     = (top_p - bot_p) / 2;
+  gar_pag_p                 = bot_p + c3_rod(mid_p, pag_wiz_i);
+  if ( old_gar_p == gar_pag_p ) {
+    fprintf(stderr,
+            "loom: can't move the guard page to the same location"
+            " (base address %p)\r\n",
+            u3a_into(gar_pag_p));
+    goto bail;
+  }
+
+  if ( -1 == mprotect(u3a_into(gar_pag_p), pag_siz_i, PROT_NONE) ) {
+    fprintf(stderr,
+            "loom: failed to protect the guard page "
+            "(base address %p)\r\n",
+            u3a_into(gar_pag_p));
+    goto fail;
+  }
+
+  return 1;
+
+bail:
+  u3m_signal(c3__meme);
+fail:
+  return 0;
+}
+#endif /* ifdef U3_GUARD_PAGE */
+
 /* u3e_fault(): handle a memory event with libsigsegv protocol.
 */
 c3_i
@ -193,40 +261,38 @@ u3e_fault(void* adr_v, c3_i ser_i)
    c3_assert(0);
    return 0;
  }
-  else {
-    c3_w off_w = u3a_outa(adr_w);
-    c3_w pag_w = off_w >> u3a_page;
-    c3_w blk_w = (pag_w >> 5);
-    c3_w bit_w = (pag_w & 31);

-#if 0
-    if ( pag_w == 131041 ) {
-      u3l_log("dirty page %d (at %p); unprotecting %p to %p\r\n",
-              pag_w,
-              adr_v,
-              (u3_Loom + (pag_w << u3a_page)),
-              (u3_Loom + (pag_w << u3a_page) + (1 << u3a_page)));
-    }
-#endif
+  u3p(c3_w) adr_p  = u3a_outa(adr_w);
+  c3_w      pag_w  = adr_p >> u3a_page;
+  c3_w      blk_w  = (pag_w >> 5);
+  c3_w      bit_w  = (pag_w & 31);

-    if ( 0 != (u3P.dit_w[blk_w] & (1 << bit_w)) ) {
-      fprintf(stderr, "strange page: %d, at %p, off %x\r\n",
-              pag_w, adr_w, off_w);
-      c3_assert(0);
-      return 0;
-    }
-
-    u3P.dit_w[blk_w] |= (1 << bit_w);
-
-    if ( -1 == mprotect((void *)(u3_Loom + (pag_w << u3a_page)),
-                        (1 << (u3a_page + 2)),
-                        (PROT_READ | PROT_WRITE)) )
-    {
-      fprintf(stderr, "loom: fault mprotect: %s\r\n", strerror(errno));
-      c3_assert(0);
+#ifdef U3_GUARD_PAGE
+  // The fault happened in the guard page.
+  if ( gar_pag_p <= adr_p && adr_p < gar_pag_p + pag_wiz_i ) {
+    if ( 0 == _ce_center_guard_page() ) {
      return 0;
    }
  }
+  else
+#endif /* ifdef U3_GUARD_PAGE */
+  if ( 0 != (u3P.dit_w[blk_w] & (1 << bit_w)) ) {
+    fprintf(stderr, "strange page: %d, at %p, off %x\r\n", pag_w, adr_w, adr_p);
+    c3_assert(0);
+    return 0;
+  }
+
+  u3P.dit_w[blk_w] |= (1 << bit_w);
+
+  if ( -1 == mprotect((void *)(u3_Loom + (pag_w << u3a_page)),
+                      pag_siz_i,
+                      (PROT_READ | PROT_WRITE)) )
+  {
+    fprintf(stderr, "loom: fault mprotect: %s\r\n", strerror(errno));
+    c3_assert(0);
+    return 0;
+  }
+
  return 1;
 }

@ -262,7 +328,7 @@ _ce_image_open(u3e_image* img_u)
    }
    else {
      c3_d siz_d = buf_u.st_size;
-      c3_d pgs_d = (siz_d + (c3_d)((1 << (u3a_page + 2)) - 1)) >>
+      c3_d pgs_d = (siz_d + (c3_d)(pag_siz_i - 1)) >>
                   (c3_d)(u3a_page + 2);

      if ( !siz_d ) {
@ -388,12 +454,12 @@ _ce_patch_verify(u3_ce_patch* pat_u)
      fprintf(stderr, "loom: patch seek: %s\r\n", strerror(errno));
      return c3n;
    }
-    if ( -1 == read(pat_u->mem_i, mem_w, (1 << (u3a_page + 2))) ) {
+    if ( -1 == read(pat_u->mem_i, mem_w, pag_siz_i) ) {
      fprintf(stderr, "loom: patch read: %s\r\n", strerror(errno));
      return c3n;
    }
    {
-      c3_w nug_w = u3r_mug_words(mem_w, (1 << u3a_page));
+      c3_w nug_w = u3r_mug_words(mem_w, pag_wiz_i);

      if ( mug_w != nug_w ) {
        fprintf(stderr, "loom: patch mug mismatch %d/%d; (%x, %x)\r\n",
@ -476,14 +542,8 @@ _ce_patch_write_page(u3_ce_patch* pat_u,
                     c3_w         pgc_w,
                     c3_w*        mem_w)
 {
-  if ( -1 == lseek(pat_u->mem_i, (pgc_w << (u3a_page + 2)), SEEK_SET) ) {
-    c3_assert(0);
-  }
-  if ( (1 << (u3a_page + 2)) !=
-       write(pat_u->mem_i, mem_w, (1 << (u3a_page + 2))) )
-  {
-    c3_assert(0);
-  }
+  c3_assert(-1 != lseek(pat_u->mem_i, pgc_w * pag_siz_i, SEEK_SET));
+  c3_assert(pag_siz_i == write(pat_u->mem_i, mem_w, pag_siz_i));
 }

 /* _ce_patch_count_page(): count a page, producing new counter.
@ -515,8 +575,7 @@ _ce_patch_save_page(u3_ce_patch* pat_u,
    c3_w* mem_w = u3_Loom + (pag_w << u3a_page);

    pat_u->con_u->mem_u[pgc_w].pag_w = pag_w;
-    pat_u->con_u->mem_u[pgc_w].mug_w = u3r_mug_words(mem_w,
-                                                       (1 << u3a_page));
+    pat_u->con_u->mem_u[pgc_w].mug_w = u3r_mug_words(mem_w, pag_wiz_i);

 #if 0
    u3l_log("protect a: page %d\r\n", pag_w);
@ -524,7 +583,7 @@ _ce_patch_save_page(u3_ce_patch* pat_u,
    _ce_patch_write_page(pat_u, pgc_w, mem_w);

    if ( -1 == mprotect(u3_Loom + (pag_w << u3a_page),
-                        (1 << (u3a_page + 2)),
+                        pag_siz_i,
                        PROT_READ) )
    {
      c3_assert(0);
@ -552,8 +611,8 @@ _ce_patch_compose(void)

    u3m_water(&nwr_w, &swu_w);

-    nor_w = (nwr_w + ((1 << u3a_page) - 1)) >> u3a_page;
-    sou_w = (swu_w + ((1 << u3a_page) - 1)) >> u3a_page;
+    nor_w = (nwr_w + (pag_wiz_i - 1)) >> u3a_page;
+    sou_w = (swu_w + (pag_wiz_i - 1)) >> u3a_page;
  }

 #ifdef U3_SNAPSHOT_VALIDATION
@ -676,7 +735,7 @@ _ce_patch_apply(u3_ce_patch* pat_u)
  //
  for ( i_w = 0; i_w < pat_u->con_u->pgs_w; i_w++ ) {
    c3_w pag_w = pat_u->con_u->mem_u[i_w].pag_w;
-    c3_w mem_w[1 << u3a_page];
+    c3_w mem_w[pag_wiz_i];
    c3_i fid_i;
    c3_w off_w;

@ -689,7 +748,7 @@ _ce_patch_apply(u3_ce_patch* pat_u)
      off_w = (u3a_pages - (pag_w + 1));
    }

-    if ( -1 == read(pat_u->mem_i, mem_w, (1 << (u3a_page + 2))) ) {
+    if ( -1 == read(pat_u->mem_i, mem_w, pag_siz_i) ) {
      fprintf(stderr, "loom: patch apply read: %s\r\n", strerror(errno));
      c3_assert(0);
    }
@ -698,13 +757,13 @@ _ce_patch_apply(u3_ce_patch* pat_u)
        fprintf(stderr, "loom: patch apply seek: %s\r\n", strerror(errno));
        c3_assert(0);
      }
-      if ( -1 == write(fid_i, mem_w, (1 << (u3a_page + 2))) ) {
+      if ( -1 == write(fid_i, mem_w, pag_siz_i) ) {
        fprintf(stderr, "loom: patch apply write: %s\r\n", strerror(errno));
        c3_assert(0);
      }
    }
 #if 0
-    u3l_log("apply: %d, %x\n", pag_w, u3r_mug_words(mem_w, (1 << u3a_page)));
+    u3l_log("apply: %d, %x\n", pag_w, u3r_mug_words(mem_w, pag_wiz_i));
 #endif
  }
 }
@ -721,7 +780,7 @@ _ce_image_blit(u3e_image* img_u,
  }

  c3_w i_w;
-  c3_w siz_w = 1 << (u3a_page + 2);
+  c3_w siz_w = pag_siz_i;

  lseek(img_u->fid_i, 0, SEEK_SET);
  for ( i_w = 0; i_w < img_u->pgs_w; i_w++ ) {
@ -753,18 +812,18 @@ _ce_image_fine(u3e_image* img_u,
               c3_ws        stp_ws)
 {
  c3_w i_w;
-  c3_w buf_w[1 << u3a_page];
+  c3_w buf_w[pag_wiz_i];

  lseek(img_u->fid_i, 0, SEEK_SET);
  for ( i_w=0; i_w < img_u->pgs_w; i_w++ ) {
    c3_w mem_w, fil_w;

-    if ( -1 == read(img_u->fid_i, buf_w, (1 << (u3a_page + 2))) ) {
+    if ( -1 == read(img_u->fid_i, buf_w, pag_siz_i) ) {
      fprintf(stderr, "loom: image fine read: %s\r\n", strerror(errno));
      c3_assert(0);
    }
-    mem_w = u3r_mug_words(ptr_w, (1 << u3a_page));
-    fil_w = u3r_mug_words(buf_w, (1 << u3a_page));
+    mem_w = u3r_mug_words(ptr_w, pag_wiz_i);
+    fil_w = u3r_mug_words(buf_w, pag_wiz_i);

    if ( mem_w != fil_w ) {
      c3_w pag_w = (ptr_w - u3_Loom) >> u3a_page;
@ -804,10 +863,10 @@ _ce_image_copy(u3e_image* fom_u, u3e_image* tou_u)
  //  copy pages into destination image
  //
  for ( i_w = 0; i_w < fom_u->pgs_w; i_w++ ) {
-    c3_w mem_w[1 << u3a_page];
+    c3_w mem_w[pag_wiz_i];
    c3_w off_w = i_w;

-    if ( -1 == read(fom_u->fid_i, mem_w, (1 << (u3a_page + 2))) ) {
+    if ( -1 == read(fom_u->fid_i, mem_w, pag_siz_i) ) {
      fprintf(stderr, "loom: image copy read: %s\r\n", strerror(errno));
      return c3n;
    }
@ -816,7 +875,7 @@ _ce_image_copy(u3e_image* fom_u, u3e_image* tou_u)
        fprintf(stderr, "loom: image copy seek: %s\r\n", strerror(errno));
        return c3n;
      }
-      if ( -1 == write(tou_u->fid_i, mem_w, (1 << (u3a_page + 2))) ) {
+      if ( -1 == write(tou_u->fid_i, mem_w, pag_siz_i) ) {
        fprintf(stderr, "loom: image copy write: %s\r\n", strerror(errno));
        return c3n;
      }
@ -921,11 +980,11 @@ u3e_save(void)
  {
    _ce_image_fine(&u3P.nor_u,
                   u3_Loom,
-                   (1 << u3a_page));
+                   pag_wiz_i);

    _ce_image_fine(&u3P.sou_u,
-                   (u3_Loom + (1 << u3a_bits) - (1 << u3a_page)),
-                   -(1 << u3a_page));
+                   (u3_Loom + (1 << u3a_bits) - pag_wiz_i),
+                   -(ssize_t)pag_wiz_i);

    c3_assert(u3P.nor_u.pgs_w == u3K.nor_w);
    c3_assert(u3P.sou_u.pgs_w == u3K.sou_w);
@ -991,11 +1050,11 @@ u3e_live(c3_o nuu_o, c3_c* dir_c)
      {
        _ce_image_blit(&u3P.nor_u,
                       u3_Loom,
-                       (1 << u3a_page));
+                       pag_wiz_i);

        _ce_image_blit(&u3P.sou_u,
-                       (u3_Loom + (1 << u3a_bits) - (1 << u3a_page)),
-                       -(1 << u3a_page));
+                       (u3_Loom + (1 << u3a_bits) - pag_wiz_i),
+                       -(ssize_t)pag_wiz_i);

        u3l_log("boot: protected loom\r\n");
      }
@ -1012,6 +1071,7 @@ u3e_live(c3_o nuu_o, c3_c* dir_c)
      }
    }
  }
+
  return nuu_o;
 }

@ -1036,3 +1096,11 @@ u3e_foul(void)
 {
  memset((void*)u3P.dit_w, 0xff, sizeof(u3P.dit_w));
 }
+
+void
+u3e_init(void)
+{
+#ifdef U3_GUARD_PAGE
+  _ce_center_guard_page();
+#endif
+}
--- a/pkg/urbit/noun/manage.c
+++ b/pkg/urbit/noun/manage.c
@ -361,7 +361,9 @@ _cm_signal_deep(c3_w mil_w)
  // go utterly haywire.
  //
  if ( 0 == u3H->rod_u.bug.mer ) {
-    u3H->rod_u.bug.mer = u3i_string("emergency buffer");
+    u3H->rod_u.bug.mer = u3i_string(
+      "emergency buffer with sufficient space to cons the trace and bail"
+    );
  }

  if ( mil_w ) {
@ -731,6 +733,11 @@ u3m_bail(u3_noun how)
    u3m_signal(how);
  }

+  //  release the emergency buffer, ensuring space for cells
+  //
+  u3z(u3R->bug.mer);
+  u3R->bug.mer = 0;
+
  /* Reconstruct a correct error ball.
  */
  if ( _(u3ud(how)) ) {
@ -900,6 +907,10 @@ u3m_hate(c3_w pad_w)

  u3R->ear_p = u3R->cap_p;
  u3m_leap(pad_w);
+
+  u3R->bug.mer = u3i_string(
+    "emergency buffer with sufficient space to cons the trace and bail"
+  );
 }

 /* u3m_love(): return product from leap.
@ -1290,20 +1301,32 @@ u3m_soft(c3_w    mil_w,
    return why;
  }
  else {
-    //  don't use .^ at the top level!
-    //
-    c3_assert(1 != u3h(why));
+    u3_noun tax, cod, pro;
+
+    switch ( u3h(why) ) {
+      case 2: {
+        cod = c3__exit;
+        tax = u3t(why);
+      } break;
+
+      case 3: {
+        cod = u3h(u3t(why));
+        tax = u3t(u3t(why));
+      } break;
+
+      //  don't use .^ at the top level!
+      //
+      default: {
+        u3m_p("invalid mot", u3h(why));
+        c3_assert(0);
+      }
+    }

    //  don't call +mook if we have no kernel
    //
    //    This is required to soft the boot sequence.
-    //    XX produce specific error motes instead of %2?
    //
    if ( 0 == u3A->roc ) {
-      u3_noun tax = u3t(why);
-
-      u3m_p("tone", u3h(why));
-
      while ( u3_nul != tax ) {
        u3_noun dat, mot, val;
        u3x_cell(tax, &dat, &tax);
@ -1323,31 +1346,21 @@ u3m_soft(c3_w    mil_w,
        }
      }

-      u3z(why);
-      return u3nc(c3__fail, u3_nul);
+      pro = u3nc(u3k(cod), u3_nul);
+    }
+    //  %evil leaves no trace
+    //
+    else if ( c3__evil == cod ) {
+      pro = u3nc(u3k(cod), u3_nul);
    }
    else {
-      u3_noun tax, cod, pro, mok;
-
-      if ( 2 == u3h(why) ) {
-        cod = c3__exit;
-        tax = u3k(u3t(why));
-      }
-      else {
-        c3_assert(3 == u3h(why));
-
-        cod = u3k(u3h(u3t(why)));
-        tax = u3k(u3t(u3t(why)));
-      }
-
-      mok = u3dc("mook", 2, tax);
-      pro = u3nc(cod, u3k(u3t(mok)));
-
+      u3_noun mok = u3dc("mook", 2, u3k(tax));
+      pro = u3nc(u3k(cod), u3k(u3t(mok)));
      u3z(mok);
-      u3z(why);
-
-      return pro;
    }
+
+    u3z(why);
+    return pro;
  }
 }

@ -1796,6 +1809,10 @@ u3m_boot(c3_c* dir_c)
  */
  u3m_pave(nuu_o);

+  /* Place the guard page.
+  */
+  u3e_init();
+
  /* Initialize the jet system.
  */
  {
--- a/pkg/urbit/noun/nock.c
+++ b/pkg/urbit/noun/nock.c
@ -1444,9 +1444,9 @@ _n_push(c3_ys mov, c3_ys off, u3_noun a)
 {
  u3R->cap_p += mov;

-  //  XX stack sanity-check disabled for performance
+  //  XX switch to u3a_push()
  //
-#if 0
+#ifndef U3_GUARD_PAGE
  if ( 0 == off ) {
    if( !(u3R->cap_p > u3R->hat_p) ) {
      u3m_bail(c3__meme);
--- a/pkg/urbit/noun/retrieve.c
+++ b/pkg/urbit/noun/retrieve.c
@ -864,7 +864,7 @@ u3r_p(u3_noun  a,
  if ( (c3y == u3r_cell(a, &feg, &nux)) &&
       (c3y == u3r_sing(feg, b)) )
  {
-    *c = nux;
+    if ( c ) *c = nux;
    return c3y;
  }
  else return c3n;
@ -1732,10 +1732,6 @@ _cr_mug_next(u3a_pile* pil_u, u3_noun veb)
        u3a_cell* cel_u = (u3a_cell*)veb_u;
        _cr_mugf* fam_u = u3a_push(pil_u);

-        //  check for overflow
-        //
-        u3a_pile_sane(pil_u);
-
        fam_u->mug_l = 0;
        fam_u->cel   = veb;

--- a/pkg/urbit/noun/serial.c
+++ b/pkg/urbit/noun/serial.c
@ -158,15 +158,9 @@ u3s_jam_fib(u3i_slab* sab_u, u3_noun a)
  fib_u.bit_w = 0;
  u3i_slab_init(sab_u, 0, fib_u.a_w);

-  //  as this is a hot path, we unsafely elide overflow checks
-  //
-  //    a page-fault overflow detection system is urgently needed ...
-  //
-  u3a_walk_fore_unsafe(a, &fib_u, _cs_jam_fib_atom_cb,
-                                  _cs_jam_fib_cell_cb);
+  u3a_walk_fore(a, &fib_u, _cs_jam_fib_atom_cb, _cs_jam_fib_cell_cb);

  u3h_free(fib_u.har_p);
-
  return fib_u.bit_w;
 }

@ -270,18 +264,11 @@ u3s_jam_xeno(u3_noun a, c3_d* len_d, c3_y** byt_y)
 {
  _jam_xeno_t jam_u = {0};
  ur_bsw_init(&jam_u.rit_u, ur_fib11, ur_fib12);
-
  jam_u.har_p = u3h_new();

-  //  as this is a hot path, we unsafely elide overflow checks
-  //
-  //    a page-fault overflow detection system is urgently needed ...
-  //
-  u3a_walk_fore_unsafe(a, &jam_u, _cs_jam_xeno_atom,
-                                  _cs_jam_xeno_cell);
+  u3a_walk_fore(a, &jam_u, _cs_jam_xeno_atom, _cs_jam_xeno_cell);

  u3h_free(jam_u.har_p);
-
  return ur_bsw_done(&jam_u.rit_u, len_d, byt_y);
 }

@ -360,7 +347,6 @@ _cs_cue_next(u3a_pile*     pil_u,
      //
      else {
        _cs_cue* fam_u = u3a_push(pil_u);
-        u3a_pile_sane(pil_u);

        //  NB: fam_u->wid unused in head-frame
        //
@ -472,7 +458,6 @@ _cs_cue_xeno_next(u3a_pile*    pil_u,

      case ur_jam_cell: {
        _cue_frame_t* fam_u = u3a_push(pil_u);
-        u3a_pile_sane(pil_u);

        fam_u->ref   = u3_none;
        fam_u->bit_d = bit_d;
@ -731,7 +716,6 @@ _cs_cue_bytes_next(u3a_pile*     pil_u,

      case ur_jam_cell: {
        _cue_frame_t* fam_u = u3a_push(pil_u);
-        u3a_pile_sane(pil_u);

        fam_u->ref   = u3_none;
        fam_u->bit_d = bit_d;
--- a/pkg/urbit/tests/nock_tests.c
+++ b/pkg/urbit/tests/nock_tests.c
@ -0,0 +1,83 @@
+#include "all.h"
+
+/* _setup(): prepare for tests.
+*/
+static void
+_setup(void)
+{
+  u3m_init();
+  u3m_pave(c3y);
+  u3e_init();
+}
+
+static u3_noun
+_nock_fol(u3_noun fol)
+{
+  return u3n_nock_on(u3_nul, fol);
+}
+
+static c3_i
+_test_nock_meme(void)
+{
+  //  (jam !=(=(~ =|(i=@ |-(?:(=(i ^~((bex 32))) ~ [i $(i +(i))]))))))
+  //
+  const c3_y buf_y[] = {
+    0xe1, 0x16, 0x1b,  0x4, 0x1b, 0xe1, 0x20, 0x58, 0x1c, 0x76, 0x4d, 0x96, 0xd8,
+    0x31, 0x60,  0x0,  0x0,  0x0,  0x0, 0xd8,  0x8, 0x37, 0xce,  0xd, 0x92, 0x21,
+    0x83, 0x68, 0x61, 0x87, 0x39, 0xce, 0x4d,  0xe, 0x92, 0x21, 0x87, 0x19,  0x8
+  };
+  u3_noun fol = u3s_cue_bytes(sizeof(buf_y), buf_y);
+  u3_noun gon;
+  c3_w    i_w;
+  c3_i  ret_i = 1;
+
+  for ( i_w = 0; i_w < 3; i_w++ ) {
+    gon = u3m_soft(0, _nock_fol, u3k(fol));
+
+    if ( c3n == u3r_p(gon, c3__meme, 0) ) {
+      u3m_p("nock meme unexpected mote", u3h(gon));
+      ret_i = 0;
+      u3z(gon);
+      break;
+    }
+
+    u3z(gon);
+  }
+
+  u3z(fol);
+
+  return ret_i;
+}
+
+static c3_i
+_test_nock(void)
+{
+  c3_i ret_i = 1;
+
+  if ( !_test_nock_meme() ) {
+    fprintf(stderr, "test nock meme: failed\r\n");
+    ret_i = 0;
+  }
+
+  return ret_i;
+}
+
+/* main(): run all test cases.
+*/
+int
+main(int argc, char* argv[])
+{
+  _setup();
+
+  if ( !_test_nock() ) {
+    fprintf(stderr, "test nock: failed\r\n");
+    exit(1);
+  }
+
+  //  GC
+  //
+  u3m_grab(u3_none);
+
+  fprintf(stderr, "test nock: ok\r\n");
+  return 0;
+}
--- a/pkg/urbit/vere/db/lmdb.c
+++ b/pkg/urbit/vere/db/lmdb.c
@ -63,11 +63,19 @@ u3_lmdb_init(const c3_c* pax_c, size_t siz_i)
    return 0;
  }

-  if ( (ret_w = mdb_env_open(env_u, pax_c, 0, 0664)) ) {
-    mdb_logerror(stderr, ret_w, "lmdb: failed to open event log");
-    //  XX dispose env_u
-    //
-    return 0;
+  {
+#   if defined(U3_OS_no_ubc)
+      c3_w ops_w = MDB_WRITEMAP;
+#   else
+      c3_w ops_w = 0;
+#   endif
+
+    if ( (ret_w = mdb_env_open(env_u, pax_c, ops_w, 0664)) ) {
+      mdb_logerror(stderr, ret_w, "lmdb: failed to open event log");
+      //  XX dispose env_u
+      //
+      return 0;
+    }
  }

  return env_u;
--- a/pkg/urbit/vere/disk.c
+++ b/pkg/urbit/vere/disk.c
@ -689,18 +689,14 @@ u3_disk_exit(u3_disk* log_u)
    }
  }

-  //  cancel write thread
+  //  try to cancel write thread
+  //  shortcircuit cleanup if we cannot
  //
-  //    XX can deadlock when called from signal handler
-  //    XX revise SIGTSTP handling
-  //
-  if ( c3y == log_u->ted_o ) {
-    c3_i sas_i;
-
-    do {
-      sas_i = uv_cancel(&log_u->req_u);
-    }
-    while ( UV_EBUSY == sas_i );
+  if (  (c3y == log_u->ted_o)
+     && (0 > uv_cancel(&log_u->req_u)) )
+  {
+    // u3l_log("disk: unable to cleanup\r\n");
+    return;
  }

  //  close database
@ -885,8 +881,11 @@ u3_disk_init(c3_c* pax_c, u3_disk_cb cb_u)
    //
    {
      const size_t siz_i =
-      #if (defined(U3_CPU_aarch64) && defined(U3_OS_linux)) || defined(U3_OS_mingw)
+      #if defined(U3_OS_mingw)
        0xf00000000;
+      // 500 GiB is as large as musl on aarch64 wants to allow
+      #elif (defined(U3_CPU_aarch64) && defined(U3_OS_linux))
+        0x7d00000000;
      #else
        0x10000000000;
      #endif
--- a/pkg/urbit/vere/io/ames.c
+++ b/pkg/urbit/vere/io/ames.c
@ -52,6 +52,7 @@
      c3_d           foq_d;             //  forward queue size
      c3_d           fow_d;             //  forwarded count
      c3_d           fod_d;             //  forwards dropped count
+      c3_d           bad_d;             //  bad ciphertext count
    } sat_u;                            //
  } u3_ames;

@ -768,51 +769,47 @@ _ames_cap_queue(u3_ames* sam_u)
  }
 }

-/* _ames_punt_goof(): print %bail error report(s).
-*/
-static void
-_ames_punt_goof(u3_noun lud)
-{
-  if ( 2 == u3qb_lent(lud) ) {
-    u3_pier_punt_goof("hear", u3k(u3h(lud)));
-    u3_pier_punt_goof("crud", u3k(u3h(u3t(lud))));
-  }
-  else {
-    u3_noun dul = lud;
-    c3_w len_w = 1;
-
-    while ( u3_nul != dul ) {
-      u3l_log("ames: bail %u\r\n", len_w++);
-      u3_pier_punt_goof("ames", u3k(u3h(dul)));
-      dul = u3t(dul);
-    }
-  }
-
-  u3z(lud);
-}
-
 /* _ames_hear_bail(): handle packet failure.
 */
 static void
 _ames_hear_bail(u3_ovum* egg_u, u3_noun lud)
 {
  u3_ames* sam_u = (u3_ames*)egg_u->car_u;
-  sam_u->sat_u.fal_d++;
+  c3_w     len_w = u3qb_lent(lud);

-  if (  (u3C.wag_w & u3o_verbose)
-     || (0 == (sam_u->sat_u.fal_d % 1000)) )
-  {
-    _ames_punt_goof(lud);
-    u3l_log("ames: packet failed (%" PRIu64 " total)\n\n", sam_u->sat_u.fal_d);
+  if ( (1 == len_w) && c3__evil == u3h(u3h(lud)) ) {
+    sam_u->sat_u.bad_d++;
+
+    if (  (u3C.wag_w & u3o_verbose)
+       || (0 == (sam_u->sat_u.bad_d % 100)) )
+    {
+      u3l_log("ames: heard bad crypto (%" PRIu64 " total), "
+              "check azimuth state\r\n",
+              sam_u->sat_u.bad_d);
+    }
  }
  else {
-    u3z(lud);
+    sam_u->sat_u.fal_d++;

-    if (  0 == (sam_u->sat_u.fal_d % 1000) )  {
-      u3l_log("ames: packet failed (%" PRIu64 " total)\n\n", sam_u->sat_u.fal_d);
+    if (  (u3C.wag_w & u3o_verbose)
+       || (0 == (sam_u->sat_u.fal_d % 100)) )
+    {
+      if ( 2 == len_w ) {
+        u3_pier_punt_goof("hear", u3k(u3h(lud)));
+        u3_pier_punt_goof("crud", u3k(u3h(u3t(lud))));
+      }
+      //  !2 traces is unusual, just print the first if present
+      //
+      else if ( len_w ) {
+        u3_pier_punt_goof("hear", u3k(u3h(lud)));
+      }
+
+      u3l_log("ames: packet failed (%" PRIu64 " total)\r\n",
+              sam_u->sat_u.fal_d);
    }
  }

+  u3z(lud);
  u3_ovum_free(egg_u);
 }

@ -853,9 +850,10 @@ _ames_forward(u3_panc* pac_u, u3_noun las)
    c3_c* rec_c = u3r_string(rec);
    c3_y* pip_y = (c3_y*)&pac_u->ore_u.pip_w;

+    //NOTE  ip byte order assumes little-endian
    u3l_log("ames: forwarding for %s to %s from %d.%d.%d.%d:%d\n",
            sen_c, rec_c,
-            pip_y[0], pip_y[1], pip_y[2], pip_y[3],
+            pip_y[3], pip_y[2], pip_y[1], pip_y[0],
            pac_u->ore_u.por_s);

    c3_free(sen_c); c3_free(rec_c);
--- a/pkg/urbit/vere/io/http.c
+++ b/pkg/urbit/vere/io/http.c
@ -666,6 +666,14 @@ _http_start_respond(u3_hreq* req_u,
  c3_i has_len_i = 0;

  while ( 0 != hed_u ) {
+    if ( 0x200 <= rec_u->version ) {
+      h2o_strtolower(hed_u->nam_c, hed_u->nam_w);
+
+      if ( 0 == strncmp(hed_u->nam_c, "connection", 10) ) {
+        hed_u = hed_u->nex_u;
+        continue;
+      }
+    }
    if ( 0 == strncmp(hed_u->nam_c, "content-length", 14) ) {
      has_len_i = 1;
    }
@ -1608,7 +1616,7 @@ _http_init_tls(uv_buf_t key_u, uv_buf_t cer_u)
                          "RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS");

  // enable ALPN for HTTP 2 support
-#if 0 //H2O_USE_ALPN
+#if H2O_USE_ALPN
  {
    SSL_CTX_set_ecdh_auto(tls_u, 1);
    h2o_ssl_register_alpn_protocols(tls_u, h2o_http2_alpn_protocols);
--- a/pkg/urbit/vere/io/term.c
+++ b/pkg/urbit/vere/io/term.c
@ -1036,13 +1036,11 @@ u3_term_ef_ctlc(void)
 {
  u3_utty* uty_u = _term_main();

-  {
+  if ( uty_u->car_u ) {
    u3_noun wir = u3nt(c3__term, '1', u3_nul);
    u3_noun cad = u3nt(c3__belt, c3__ctl, 'c');

    c3_assert( 1 == uty_u->tid_l );
-    c3_assert( uty_u->car_u );
-
    _term_ovum_plan(uty_u->car_u, wir, cad);
  }

--- a/pkg/urbit/vere/king.c
+++ b/pkg/urbit/vere/king.c
@ -1507,51 +1507,61 @@ u3_king_done(void)
 {
  uv_handle_t* han_u = (uv_handle_t*)&u3K.tim_u;

-  //  get next binary
-  //
-  if ( c3y == u3_Host.nex_o ) {
-    c3_c* pac_c;
-    c3_c* ver_c;
-
-    //  hack to ensure we only try once
+  if ( u3_Host.xit_i ) {
+    if ( c3y == u3_Host.nex_o ) {
+      u3l_log("vere: upgrade failed\r\n");
+    }
+    else if ( c3y == u3_Host.pep_o ) {
+      u3l_log("vere: prep for upgrade failed\r\n");
+    }
+  }
+  else {
+    //  get next binary
    //
-    u3_Host.nex_o = c3n;
+    if ( c3y == u3_Host.nex_o ) {
+      c3_c* pac_c;
+      c3_c* ver_c;

-    pac_c = _king_get_pace();
+      //  hack to ensure we only try once
+      //
+      u3_Host.nex_o = c3n;

-    switch ( u3_king_next(pac_c, &ver_c) ) {
-      case -2: {
-        u3l_log("vere: unable to check for next version\n");
-      } break;
+      pac_c = _king_get_pace();

-      case -1: {
-        u3l_log("vere: up to date\n");
-      } break;
+      switch ( u3_king_next(pac_c, &ver_c) ) {
+        case -2: {
+          u3l_log("vere: unable to check for next version\n");
+        } break;

-      case 0: {
-        u3l_log("vere: next (%%%s): %s\n", pac_c, ver_c);
-        _king_do_upgrade(pac_c, ver_c);
-        c3_free(ver_c);
-      } break;
+        case -1: {
+          u3l_log("vere: up to date\n");
+        } break;

-      default: c3_assert(0);
+        case 0: {
+          u3l_log("vere: next (%%%s): %s\n", pac_c, ver_c);
+          _king_do_upgrade(pac_c, ver_c);
+          c3_free(ver_c);
+        } break;
+
+        default: c3_assert(0);
+      }
+
+      c3_free(pac_c);
+    }
+    else if ( c3y == u3_Host.pep_o ) {
+      u3l_log("vere: ready for upgrade\n");
    }

-    c3_free(pac_c);
-  }
-  else if ( c3y == u3_Host.pep_o ) {
-    u3l_log("vere: ready for upgrade\n");
-  }
-
-  //  copy binary into pier on boot
-  //
-  if (  (c3y == u3_Host.ops_u.nuu)
-     && (c3y == u3_Host.ops_u.doc) )
-  {
-    //  hack to ensure we only try once
+    //  copy binary into pier on boot
    //
-    u3_Host.ops_u.nuu = c3n;
-    u3_king_dock(U3_VERE_PACE);
+    if (  (c3y == u3_Host.ops_u.nuu)
+       && (c3y == u3_Host.ops_u.doc) )
+    {
+      //  hack to ensure we only try once
+      //
+      u3_Host.ops_u.nuu = c3n;
+      u3_king_dock(U3_VERE_PACE);
+    }
  }

  //  XX hack, if pier's are still linked, we're not actually done
@ -1566,7 +1576,7 @@ u3_king_done(void)

  //  XX remove move
  //
-  exit(0);
+  exit(u3_Host.xit_i);
 }

 /* u3_king_exit(): shutdown gracefully
@ -1582,10 +1592,11 @@ u3_king_exit(void)
 void
 u3_king_bail(void)
 {
+  u3_Host.xit_i = 1;
  _king_forall_unlink(u3_pier_bail);
  _king_loop_exit();
  u3_king_done();
-  exit(1);
+  exit(u3_Host.xit_i);
 }

 /* u3_king_grab(): gc the daemon
--- a/pkg/urbit/vere/pier.c
+++ b/pkg/urbit/vere/pier.c
@ -2234,6 +2234,8 @@ u3_pier_exit(u3_pier* pir_u)
 void
 u3_pier_bail(u3_pier* pir_u)
 {
+  u3_Host.xit_i = 1;
+
  //  halt serf
  //
  if ( pir_u->god_u ) {
--- a/pkg/urbit/version
+++ b/pkg/urbit/version
@ -1 +1 @@
-1.9
+1.10
--- a/pkg/urbit/worker/serf.c
+++ b/pkg/urbit/worker/serf.c
@ -565,6 +565,14 @@ _serf_work(u3_serf* sef_u, c3_w mil_w, u3_noun job)
                               sef_u->mug_l,
                               vir));
  }
+  //  event rejected -- bad ciphertext
+  //
+  else if ( c3__evil == u3h(gon) ) {
+    sef_u->sen_d = sef_u->dun_d;
+
+    u3z(job);
+    return u3nt(c3__bail, gon, u3_nul);
+  }
  //  event rejected
  //
  else {
--- a/shell.nix
+++ b/shell.nix
@ -22,7 +22,7 @@ let
  #
  # Typically the inputs listed here also have a shell.nix in their respective
  # source directory you can use directly.
-  inputsFrom = with pkgsLocal; [ ent herb urbit urcrypt ];
+  inputsFrom = with pkgsLocal; [ ent urbit urcrypt ];

  # Collect the named attribute from all dependencies listed in inputsFrom.
  mergeFrom = name: pkgs.lib.concatLists (pkgs.lib.catAttrs name inputsFrom);
 @ -1 +1 @@
 .9
 .10