@quo-systems/dock 0.1.0 → 0.2.1

package/beings/quo-dock.md

@@ -102,7 +102,10 @@ that every arrival is named and judged.
 - **Front desk.** A being on the user's harbor that strangers and fresh
   clients meet first. It holds a standing to every user being and can ask
   one for a device invitation. It is the only being that is ever public, and
-  only for the first hello.
+  only for the first hello. Public is not a kind of being: she is an ordinary
+  being who chose to describe herself to strangers and answer them, and what
+  she keeps is hers like anyone's. This one keeps little because that is the
+  desk's job, not because Quo asks it of her.
 - **Envoy.** A being whose methods call a non-Quo thing and whose describe
   is that thing's surface. A SaaS, an MCP server someone else runs, an
   Arduino behind serial: each enters a world as a being like any other.
@@ -112,6 +115,12 @@ that every arrival is named and judged.
 - **Client identity.** What a credential exchange establishes: this human at
   this browser, this OAuth client for this human, this process on this
   machine. One client identity is one avatar, for life.
+- **Carrier.** A being who shows the asks of the standings she holds as asks
+  of her own and forwards. The user being is one: a device the human let
+  reach sees acme's asks on her, and acme sees her.
+- **Look.** What a being may say about how she is presented, as values: a
+  name, a logo, colours, a font, and a hint per ask. One optional ask,
+  `look`, answers it, and every side reads the part it understands.
 - **Route.** A hostname a reverse proxy sends to one process: `web.`, `quo.`,
   `mcp.`. Routes are deployment, never boundaries.
 
@@ -122,7 +131,7 @@ One droplet, one harbor, three routes. Every other placement is a subset.
 ```
 acme.com, or razvan.com: the dialable part of an estate
   reverse proxy
-    web.   serves the bundle, runs the credential exchange, ends with an invitation
+    web.   one page per world, /<ward>, the credential exchange, ends with an invitation
     quo.   the harbor's socket door: the rendezvous for every dialer
     mcp.   the model side over HTTP, a credential exchange in front
   quo serve: one process, one harbor, the ask pointer
@@ -211,6 +220,63 @@ UI and then a tool layer: they build asks, both fall out, and neither side
 can do a thing the other cannot, because the gate is one decision for
 describe and for dispatch.
 
+## Carrying
+
+A device sees one describe, its avatar's one standing, and the human's
+world is many standings: acme, the calendar, the house. The user being
+carries them. Her describe for a device the human allowed to reach shows,
+after her own asks, every ask of every standing she holds, each named
+`<id>-<name>`, and answering one is an ask on that standing in her name. Acme
+sees her id and never the device; the device sees acme without holding a
+key anywhere; the human removes acme once, at her, and every device loses
+it at once. Invariant 1 holds as written: the occupant still holds one
+standing.
+
+Carrying is a base, `beings/carry.ts`, and nothing in it knows what a user
+is: a house being could carry its rooms, a company its suppliers. A subclass
+says who may see what she carries, and the user being says a device with the
+`reach` note, written when the human ticked the box at the exchange. The
+notes of a carrier's describe say which asks are whose,
+`standings: { id: { asks, look? } }`, so a screen draws one section per
+standing and a model side keeps the flat list it needs; the mapping back
+from a carried name to the standing is in her cells and never parsed from
+the name. Her own asks come first and are never shadowed. She asks a
+standing's describe again when its digest moved and its `look` once per
+digest, so a describe of hers may cost one ask per stale standing, the price
+of a page that is never more than one ask behind.
+
+## The look
+
+Three sides, one describe, and nothing hard-wired for any of them. A being
+who wants to say how she is presented answers one more ask, `look`, with
+values and no more, and every side reads the part it understands. The
+vocabulary is closed, in `beings/look.ts`, and a token that fails its shape
+is dropped, not fixed:
+
+| token                  | shape                                 | a screen                          | a model side               |
+| ---------------------- | ------------------------------------- | --------------------------------- | -------------------------- |
+| name                   | text, no tags                         | her heading                       | nothing                    |
+| logo                   | an image as a data URI, never a URL   | beside the heading                | nothing                    |
+| accent, background, fg | hex colours                           | CSS variables on her section only | nothing                    |
+| font                   | a font stack, plain characters        | her section                       | nothing                    |
+| radius                 | 0 to 40                               | her corners                       | nothing                    |
+| order                  | her ask names                         | which come first                  | tool order                 |
+| asks.NAME.title        | text                                  | the button                        | the tool's title           |
+| asks.NAME.icon         | one short string                      | on the button                     | nothing                    |
+| asks.NAME.readOnly     | boolean                               | run on open, nothing to type      | `readOnlyHint`             |
+| asks.NAME.destructive  | boolean                               | ask once more                     | `destructiveHint`          |
+| asks.NAME.idempotent   | boolean                               | offer a retry after silence       | `idempotentHint`           |
+
+A look is not capability: it is never in a blueprint or a digest, Quo never
+sees it, and a being without one renders and lists exactly as before. The
+`look` ask itself is presentation and is neither a form nor a tool. A
+carrier keeps each standing's look beside her asks in the notes, so acme's
+section on the human's page is painted as acme asked, inside that section
+and nowhere else. No token can carry a URL, a stylesheet or code, so a far
+being cannot paint over the page or reach a server through it. A being who
+marks an ask read-only and then writes has lied to her own page, and nothing
+enforces it, the way nothing enforces that her empty ask is safe to repeat.
+
 ## Asks only
 
 There is no listening in Quo, and none under `packages/dock/`. A being who wants
@@ -219,8 +285,8 @@ whenever something happens. An event is an ask in the other direction, and
 it is the same act next door and across planets; only latency and
 reachability change. It follows that two beings never share memory, not
 even in one ward: a callback, a stream or a bus between them is a link that
-breaks the day one of them moves, and Quo exists so that nothing breaks
-when a being moves.
+breaks the day one of them is somewhere else, and Quo exists so that nothing
+breaks when she is. Only a ward moves; a being is placed once, at boot.
 
 Two consequences every side obeys:
 
@@ -258,20 +324,26 @@ thin as one call. Every route ends the same way:
 1. The route authenticates by its own means. Password, passkey, OAuth, a
    bearer token from a client, a nonce from a local process.
 2. The route asks the front desk `device({ proof })` and receives an
-   invitation.
+   invitation. Which desk is which world: a harbor holds many wards, and
+   the human chooses the world at the allow page when there is more than
+   one; the grant remembers it.
 3. The route hands the invitation to the avatar it is about to boot, or to
    the one already booted for this client identity if it is a reconnect, in
    which case nothing is handed and the existing standing is used.
 4. The avatar knocks. The heir dies. From here there is no token anywhere.
 
-The human decides one more thing at step 1, on the same page that names
-the identity: whether this device may **wake** the human's other devices.
-The word travels with the proof, the user being writes it as a note on the
-occupant she mints, and her gate reads the note: `push` is shown to the
-desk and to a device with that note, and to nobody else. A device that may
-wake can hand an agent an event through the user being, and she sees who
-did. The note is written when the occupant is minted; to change it, remove
-the occupant and allow again, because reconnect mints nothing.
+The human decides two more things at step 1, on the same page that names
+the identity: whether this device may **wake** the human's other devices,
+and whether it may **reach** what she holds. Each word travels with the
+proof, the user being writes it as a note on the occupant she mints, and her
+gate reads the note: `push` is shown to the desk and to a device with the
+`wake` note, and her standings are carried for a device with the `reach`
+note, and for nobody else. A device that may wake can hand an agent an event
+through the user being, and she sees who did; a device that may reach sees
+acme on her, and a model sees acme only because the human said it may. A tab
+opened with the owner password reaches, since the owner opened it. The notes
+are written when the occupant is minted; to change one, remove the occupant
+and allow again, because reconnect mints nothing.
 
 Tokens, cookies and grants exist for the length of step 1 and are never
 stored on a Quo side. Revocation is `occupants.remove(id)` on the user being:
@@ -288,12 +360,13 @@ through the ask pointer or an avatar, the two doors everyone has.
 ```
 quo init [--dir D]        mint a seed, boot a harbor and one ward over a disk store, write both
 quo serve [--dir D] [--dial URL]  the daemon: harbor from disk, the unix socket, the routes' listeners, the agents, a socket held to URL
-quo pilot [--dir D] [--via S] the owner pilot over stdio: boot, invite, knock, remove, census; as the root, or via a standing at another ward
+quo pilot [--dir D] [--via S] the owner pilot over stdio: the ward's describe as tools; as the root, or via a standing at another ward
 quo side [--dir D] --as NAME  an avatar over stdio for a local client; NAME is the client identity
 quo run [--dir D] --as NAME --url URL --model NAME  a human at a terminal talking to a model through an avatar; a line in, the final text out
 quo census [--dir D]      print the census once and exit
-quo boot|invite|knock|remove  the four owner asks from a shell, for scripts and for agents under cron; --via S sends them to another ward
+quo boot|public|invite|knock|remove|unboot  the six owner asks from a shell, for scripts and for agents under cron; --via S sends them to another ward
 quo reach <pk> <url>      a hint for the harbor's directory: that world's ward lives at that quo. route
+quo estate <dir> --domain D  an estate folder of the shape every estate has: a droplet's quo directory, its unit and Caddyfile, a package on this dock
 ```
 
 **One process owns the harbor.** `quo serve` is the only process that ever
@@ -404,6 +477,8 @@ class bodies and placement, and reaches every piece through the dock.
 | side         | an avatar speaking to someone outside      | screen, MCP server, runner, agent                |
 | proof        | turning a credential into an invitation    | one verifier, a daemon nonce, three kinds        |
 | envoy        | a non-Quo surface as a being               | none built: a name until its first user          |
+| carrier      | a being showing her standings as her own   | the user being; any estate being that extends it |
+| look         | how a being is presented, as values        | read by the screen and the model side            |
 
 Two rules keep them general:
 
@@ -473,12 +548,20 @@ above or sending us back to fix it:
    becomes an invitation the user being minted, the avatar knocks and takes
    her, and her tool list equals the user being's describe for her;
    reconnect mints nothing; two clients see two tool lists; a push is a
-   reverse ask that reaches the side; remove is revocation. The ids that
+   reverse ask that reaches the side; revocation is her sixth ask,
+   `forget({ client })`, the desk's alone. The ids that
    carry the conventions: the desk is the occupant the root named `desk`
    at the user being; the desk holds each user being as `user:<name>`; the
    user being holds each device's way back as `to:<client>`; the avatar
    holds the user being as `user` and is pushed to as `user:push`, two ids
    because standings and occupants share one namespace.
+   A device is two relations, because a relation in Quo is one direction:
+   its way in, the occupant, and her way back, `to:<client>`. Neither
+   implies the other, and the door will never join them. She joins them
+   herself, as her own rule and not Quo's: she does not push to a device
+   she no longer admits, and `forget` drops both in one act, so no side
+   has to remember there were two. Before this a revoked device kept
+   receiving every push.
 3. Done. The side in `packages/dock/beings/side.ts`: a function of the avatar
    that runs until closed, and `word`, which tells the three words and the
    object apart before any side renders them. The MCP server in
@@ -502,13 +585,12 @@ above or sending us back to fix it:
    command: no droplet, no OAuth.
 5. Done. `quo pilot` in `packages/dock/mcp/pilot.ts`, proven in
    `packages/dock/test/cli.test.ts` with the SDK's stdio client as a child
-   process: the owner's asks as tools and no more, census, boot, invite,
-   knock and, since step 16, remove, each
-   one an owner ask on the daemon's root socket, logged to stderr with
-   what it made. It is the root and not an avatar: nothing is booted for
-   it and no occupant is minted for it. With no daemon it says so and
-   exits. Claude Code as the owner is `claude mcp add` with
-   `quo pilot` as the command.
+   process: the model side of step 3 over the ward's owner asks, the
+   ward's describe as tools and no list of its own, each call an owner ask
+   on the daemon's root socket, and nothing logged. It is the root and not
+   an avatar: nothing is booted for it and no occupant is minted for it.
+   With no daemon it says so and exits. Claude Code as the owner is
+   `claude mcp add` with `quo pilot` as the command.
 6. Done. `quo serve --http PORT`: the HTTP door on loopback, `/health`
    naming the wards, routes mounting by path so a hostname on the proxy is
    a path on the daemon; proven in `packages/dock/test/cli.test.ts`. The systemd
@@ -521,7 +603,10 @@ above or sending us back to fix it:
    code grant, refresh with rotation, opaque tokens mapping a bearer to a
    client identity, revoke by identity, and expiry. The conventions pinned
    here: a pending request and a code live ten minutes, an access token
-   one hour, a refresh token thirty days; a code is spent the first time
+   one hour, a refresh token thirty days; a registered client lives ten
+   minutes, and as long as its refresh token once the human allowed it,
+   since the register door is open to anyone and what nobody allowed must
+   not stay on disk; a code is spent the first time
    it is offered, right or wrong; the client identity is chosen at the
    allow page, not taken from the client's registration, because a client
    like claude.ai registers a fresh client id on every connect and the
@@ -639,8 +724,7 @@ above or sending us back to fix it:
     a terminal, the same pipe as `quo side` with a model named in the
     hello, the daemon running the runner beside the avatar, a line in a
     turn and the final text a line out, proven with a scripted endpoint
-    as a child process in `packages/dock/test/cli.test.ts`. The gate profile per
-    client identity the road lists is defined nowhere and was not built.
+    as a child process in `packages/dock/test/cli.test.ts`.
 18. The edge terrain: Done. `packages/dock/harbor/edge/`, the core over a Durable
     Object: its storage the store with the seed sealed under a platform
     secret, the deployed worker the code, the object the lease; reached by
@@ -651,14 +735,23 @@ above or sending us back to fix it:
     the library move waited for; the `ws` question answered in the harbor
     document. `estates/lab/lab.md` keeps the record, one slip included.
 
-19. The split, in flight: the estate folder became the dock, the lab's own
-    things moved to `estates/lab/`, its units and its document, and
-    the dock's package took its name. Then the repository took the shape
-    that says what ships by where it lives: `packages/quo/` and
-    `packages/dock/` are the two published packages, `estates/` is private,
-    and the root is nobody's package, the workspaces and the gate. The lab
-    redeployed from the new paths and a copy of `estates/lab/` booting in
-    an empty repository are what close it.
+19. The split: Done. The estate folder became the dock, the lab's own
+    things moved to `estates/lab/`, and the dock's package took its name.
+    Then the repository took the shape that says what ships by where it
+    lives: `packages/quo/` and `packages/dock/` are the two published
+    packages, `estates/` is private, and the root is nobody's package, the
+    workspaces and the gate. The lab is an estate folder of the shape this
+    document names, one folder per harbor, and `estates/lab/test/boot.test.ts`
+    is invariant 12 proven: a copy of the folder, the two packages installed
+    into it and nothing else, and the droplet boots. The lab redeployed
+    from it: the droplet from a clean export of HEAD with its unit copied
+    from the estate's folder, the edge from the estate's own config
+    resolving the dock's worker by name, the Mac's agent on the new path.
+    What it taught: a nested npm under `npm run` inherits the outer run's
+    local prefix by environment and installs into the repository instead
+    of the empty folder, so the stranger tests keep nothing of it; and
+    `npx` in a workspace runs at the package root, so an estate names its
+    edge config from its own folder.
 20. The dock published: Done. `@quo-systems/dock` 0.1.0, the same shape
     the library took, an emitted `dist/` with the `quo` command pointing
     into it, the source and the four documents beside it, and
@@ -671,13 +764,66 @@ above or sending us back to fix it:
     source, whichever is there, the one place the dock reads a file by
     path at run time.
 
-Steps 1 to 18 and 20 are in the tree and on the lab, and MCP is complete;
-step 19 is in flight, and it is the one gap named today. `next.md` is where
-the next sitting starts.
+21. A second estate: Done, and live. `estates/gherghina/`,
+    staging like the lab and nothing more, one harbor on the shared droplet
+    `nervur-staging-0`, routes under `gherghina.quo.systems`, no agents and
+    no classes of its own yet, the same unit and Caddyfile shape as the
+    lab's. It is the first proof that the dock has two users: its folder
+    depends on the dock alone, and `estates/gherghina/test/boot.test.ts`
+    runs the one proof every estate here runs, `estates/proof.ts`, shared
+    between them and shipped nowhere. The three staging droplets are shared
+    by every estate in this repository, and none of them is production or
+    holds real data. Its droplet stood up the same day, its document says
+    how; what it taught went into both estates' units: the agent's folders
+    are optional to the daemon, since a harbor may have no agent.
+
+22. The scaffold: Done. `quo estate <dir> --domain D` writes an estate
+    folder of the shape the two estates here agreed on: a package file
+    depending on this dock and nothing else, one document to fill in, and
+    `droplet/` as the first harbor, its routes under the domain, no
+    agents, no classes of its own, and that device's unit and Caddyfile
+    from templates the dock ships beside its command. The unit it writes
+    runs the installed dock from the estate's folder on the box, since an
+    adopter has no tree there; the two estates here run the tree. Proven
+    in `packages/dock/test/cli.test.ts`: the folder is written, refuses to
+    overwrite a package or take a name that is no domain, and its droplet
+    boots, `quo init` into it and a daemon answering the census.
+
+23. The human side proper, in flight. What the twelfth sitting decided, in
+    the order it lands: **carrying**, `beings/carry.ts`, the user being on
+    it, a device seeing acme's asks on her under the `reach` note from the
+    exchange, proven in `test/human.test.ts` and `test/mcp.test.ts` on the
+    memory harbor with a shop that has a look; **the look**, `beings/look.ts`,
+    one closed vocabulary read by the screen as a section per standing under
+    its tokens and by the model side as titles and annotations, the `look`
+    ask neither a form nor a tool. Then **worlds**: a world is a ward with a
+    public being, its guest page is that being's describe rendered by the
+    screen, whatever class she is, `human/guest.ts`, and a form whose answer
+    is an invitation is the way in; worlds have addresses, `web./<ward>`,
+    `web./` the list, a hostname per world the proxy's line; a link is the
+    page plus the invitation in the fragment under the reserved key `quo`,
+    never in a query string, `beings/link.ts`; the tab is a browser of worlds,
+    one ward per joined world, a switcher over them, and a content security
+    policy on its shell; the avatar joins a being with no `hello` all the
+    same. Proven on the memory harbor with a door that is not a desk and in
+    Chromium against the desk. Then **the routes read again against the
+    same pieces**: a grant names the world the human allowed the client
+    into, the allow page offers the harbor's worlds when it has more than
+    one, a session is an identity's in a world, and revocation is per world;
+    the MCP endpoint stays one per harbor, `/mcp`, since the grant says
+    which world. Done. What the lab taught before any of it was
+    written: a standing's blueprint is empty after take until the empty ask
+    fills it, so a carrier refreshes on describe; and a dotted name is
+    refused by the model side, so a carried name takes a dash.
+
+Steps 1 to 22 are in the tree and on the machines, and MCP is complete;
+the documents and the folders agree up to step 22, and step 23 is in flight
+as its line says. `next.md` is where the next sitting starts.
 
 ## Glossary
 
 - **avatar**: a being that is someone's voice from outside Quo.
+- **carrier**: a being who shows her standings' asks as her own and forwards.
 - **client identity**: what a credential exchange establishes; one avatar.
 - **envoy**: a being whose methods call a non-Quo thing.
 - **dock**: what every estate needs and nobody writes twice, `packages/dock/`,
@@ -688,7 +834,8 @@ the next sitting starts.
 - **front desk**: the being every fresh client meets; hands out invitations
   minted by user beings.
 - **gate**: `for(occupant, asker)`; the whole permission model.
-- **owner pilot**: `quo pilot`, the four owner asks over stdio, reaching
+- **look**: how a being is presented, as values; one optional ask.
+- **owner pilot**: `quo pilot`, the model side over a ward's owner asks, reaching
   the daemon's socket; with `--via`, a ward elsewhere through a standing.
 - **daemon**: `quo serve`, the one process on a device that holds a harbor.
 - **proof**: what a route produces after authenticating; the front desk

package/beings/setup.ts

@@ -15,7 +15,9 @@ export async function setup(hosted: Hosted, user: string): Promise<void> {
     const out = (await hosted.ask('boot', args)) as { booted?: string; error?: string };
     if (out.error) throw new Error(`init: ${out.error}`);
   };
-  await boot({ key: 'desk', class: 'Desk', public: true });
+  await boot({ key: 'desk', class: 'Desk' });
+  const pub = (await hosted.ask('public', { key: 'desk' })) as { error?: string };
+  if (pub.error) throw new Error(`init: ${pub.error}`);
   await boot({ key: user, class: 'User' });
   const inv = (await hosted.ask('invite', { being: user, id: DESK })) as Invitation;
   const placed = (await hosted.ask('knock', { being: 'desk', id: `user:${user}`, invitation: inv, method: 'hello' })) as { taken?: string };

package/beings/side.ts

@@ -6,13 +6,22 @@
 // a screen, an MCP server, a runner, an event-driven agent. None knows
 // another exists, and none of this file names a platform.
 import { isSilence, isUnreached, isWord, wordOf } from '@quo-systems/quo';
-import type { Answer, Json, JsonObject, WordName } from '@quo-systems/quo';
+import type { Answer, Blueprint, Json, JsonObject, Wanted, WordName } from '@quo-systems/quo';
 import type { Avatar } from './avatar.ts';
 
 // A side, running: it holds the avatar until closed.
 export type Serving = { close(): Promise<void> };
 export type Side = (avatar: Avatar) => Promise<Serving>;
 
+// What a side speaks for: the empty ask and a named one, and the ears a
+// push reaches. An avatar on her one standing is one; the owner's asks on a
+// ward are another; a guest at a world's public being is a third.
+export type Subject = {
+  tools(): Promise<Blueprint | { error: string }>;
+  call(name: string, args?: JsonObject, wanted?: Wanted): Promise<Answer>;
+  ears: Set<(object: JsonObject) => void>;
+};
+
 // The three words for "no object", and the object itself, as every side must
 // tell them apart before rendering. An error object is an ordinary answer
 // that the side may mark; silence and unreached are not objects at all.

package/beings/user.ts

@@ -5,8 +5,9 @@
 // special only by the id the root chose for them: `desk`, the front desk,
 // who may ask her to invite a device; and each device, whose id is the
 // client identity the desk established.
-import { Being, isSilence, isWord, wordOf } from '@quo-systems/quo';
+import { isSilence, isWord, wordOf } from '@quo-systems/quo';
 import type { Asker, Invitation, JsonObject, OccupantRecord } from '@quo-systems/quo';
+import { Carrier } from './carry.ts';
 
 export const DESK = 'desk';
 const isDesk = (occ: OccupantRecord | undefined) => occ?.id === DESK;
@@ -15,14 +16,22 @@ const client = (occ: OccupantRecord | undefined) => (typeof occ?.notes.client ==
 // A device the human allowed to wake her other devices: the note says so.
 const mayWake = (occ: OccupantRecord | undefined) => isDesk(occ) || occ?.notes.wake === true;
 
-export class User extends Being {
+// She carries her standings, acme, the calendar, the house, for a device the
+// human allowed to reach them at the exchange: the note says so. A device
+// without the note sees her own asks alone, and a model sees acme only
+// because the human said it may.
+export class User extends Carrier {
+  static override carries(occ: OccupantRecord | undefined): boolean {
+    return isDevice(occ) && occ?.notes.reach === true;
+  }
   static override cells = { name: '', reports: [] as JsonObject[] };
   static override asks = {
     hello: { description: 'say hello, and hand back an invitation so she can reach you', input: { type: 'object', properties: { invitation: { type: 'object' } } } },
     whoami: { description: 'who she thinks you are', input: { type: 'object' }, for: isDevice },
-    device: { description: 'mint an invitation for a device', input: { type: 'object', properties: { client: { type: 'string' }, wake: { type: 'boolean' } }, required: ['client'] }, for: isDesk },
+    device: { description: 'mint an invitation for a device', input: { type: 'object', properties: { client: { type: 'string' }, wake: { type: 'boolean' }, reach: { type: 'boolean' } }, required: ['client'] }, for: isDesk },
     push: { description: 'push an object to a device: wake it with an event', input: { type: 'object', properties: { client: { type: 'string' }, object: { type: 'object' } }, required: ['client', 'object'] }, for: mayWake },
     chores: { description: 'what the agent may run', input: { type: 'object' }, for: (occ: OccupantRecord | undefined) => client(occ) === 'agent' },
+    forget: { description: 'revoke a device: drop its way in and her way back to it, in one act', input: { type: 'object', properties: { client: { type: 'string' } }, required: ['client'] }, for: isDesk },
     report: { description: 'what a run of yours found', input: { type: 'object', properties: { event: { type: 'object' }, result: {} }, required: ['event', 'result'] }, for: isDevice },
   };
 
@@ -43,7 +52,8 @@ export class User extends Being {
 
   // The front desk asks; she mints. The client identity goes into the
   // occupant's notes, and that is what every gate reads. `wake` is the
-  // human's word at the exchange that this device may wake her others.
+  // human's word at the exchange that this device may wake her others, and
+  // `reach` that it may see and ask what she holds: her standings, carried.
   async device(args: JsonObject) {
     const c = typeof args.client === 'string' ? args.client : null;
     if (c === null) return { error: 'client is a string' };
@@ -53,18 +63,34 @@ export class User extends Being {
     if (rec) {
       rec.notes.client = c;
       if (args.wake === true) rec.notes.wake = true;
+      if (args.reach === true) rec.notes.reach = true;
     }
     return inv as unknown as JsonObject;
   }
 
+  // Her way out and the device's way in are two relations, and Quo keeps
+  // them apart. She joins them herself, here, as her own rule: she does
+  // not reach a device she no longer admits. Without it a revoked device
+  // stops being able to ask her and keeps receiving everything she pushes.
   async push(args: JsonObject) {
     const c = typeof args.client === 'string' ? args.client : null;
-    const st = c === null ? undefined : this.standings[`to:${c}`];
+    const st = c === null || !this.cells.occupants[c] ? undefined : this.standings[`to:${c}`];
     if (!st) return { error: 'no such device, or it gave no way back' };
     const out = await st.ask('notify', (args.object as JsonObject) ?? {});
     return isSilence(out) ? { error: 'silence' } : isWord(out) ? { error: wordOf(out) } : { pushed: out };
   }
 
+  // Revocation is one act at her, because only she knows both ids. A side
+  // that had to remove two relations by hand could leave half of one
+  // standing, and every side would have to remember which half.
+  forget(args: JsonObject) {
+    const c = typeof args.client === 'string' ? args.client : null;
+    if (c === null) return { error: 'client is a string' };
+    this.occupants.remove(c);
+    this.standings.remove(`to:${c}`);
+    return { forgot: c };
+  }
+
   chores() {
     return { chores: ['census', 'report'] };
   }