fix(cockpit): a provider's methods keep their this, a hold answers true or false, and a cut text never splits a surrogate pair

Provider methods and worded members are called on the provider itself,
so a class-based provider works. A hold that answers false refuses entry
and is released; any answer but true or false refuses it too, released,
with one warning. An answer whose `then` getter throws is handled as a
throw, and a text cut at its cap never leaves half an emoji.

docs/APPLICATION.md

@@ -239,7 +239,8 @@ providers, checked once when the controls are built
 warning. Entry rides the most recently selected subject of all kinds and needs
 the provider's `layerId` on; the provider then holds its subject, hands the
 camera a frame and the generic HUD a view model on every update, and releases
-it on exit. Provider methods are synchronous; one that throws or returns a
+it on exit. Provider methods are synchronous and are called on the provider,
+so a class instance's methods keep their `this`; one that throws or returns a
 promise is treated as having failed.
 
 ```js
@@ -317,7 +318,11 @@ user's selection.
 A frame with `heightM: null` stands on the shared floor, or where it last
 stood while that floor is cold. If no height has been known since entry, the
 view waits, showing ACQUIRING SURFACE, for at most five seconds
-(`COCKPIT_GROUND_WAIT_TIMEOUT_MS`), then ends and releases the subject. A
-`hold` that throws or returns a promise refuses entry and is followed by
-`release(id, { restore: false })`, again once a returned promise settles, so
-`release` must be harmless when called more than once.
+(`COCKPIT_GROUND_WAIT_TIMEOUT_MS`), then ends and releases the subject.
+
+`hold(id)` returns `true` once it holds the subject, or `false` to refuse
+entry; any other answer, `undefined` included, refuses entry too, with one
+warning. A refused hold, and one that throws or returns a promise, is followed
+by `release(id, { restore: false })`, again once a returned promise settles,
+so `release` must be harmless for a subject it does not hold and when called
+more than once.