@quo-systems/dock 0.2.2 → 0.2.4

package/beings/avatar.ts

@@ -59,7 +59,14 @@ export class Avatar extends Being {
   // is taken all the same, and the way back she did not take is dropped, so
   // any world's public being may admit a guest, hello or not.
   async join(invitation: Invitation): Promise<Blueprint | { error: string }> {
-    if (this.standings[USER]) return this.tools();
+    if (this.standings[USER]) {
+      // A standing the far being removed is not one: she drops it and joins
+      // afresh, so an identity forgotten at the user being can be let in again.
+      const had = await this.tools();
+      if (!('error' in had) || had.error !== 'removed') return had;
+      this.standings.remove(USER);
+      this.occupants.remove(PUSHER);
+    }
     const mine = await this.invite(PUSHER);
     if (mine === null) return { error: 'user is taken' };
     const out = await this.knock(invitation, 'hello', { invitation: mine as unknown as JsonObject });

package/beings/carry.ts

@@ -60,7 +60,7 @@ export class Carrier extends Being {
       if (!rec.blueprint) continue;
       const names: string[] = [];
       for (const a of rec.blueprint.asks) {
-        if (a.name === 'look') continue;
+        if (a.name === 'look' || a.name === 'page') continue; // presentation is hers, never carried as an ask
         const name = `${id}-${a.name}`;
         if (own.has(name)) continue;
         carried[name] = { id, ask: a.name };

package/beings/quo-dock.md

@@ -120,7 +120,9 @@ that every arrival is named and judged.
   reach sees acme's asks on her, and acme sees her.
 - **Look.** What a being may say about how she is presented, as values: a
   name, a logo, colours, a font, and a hint per ask. One optional ask,
-  `look`, answers it, and every side reads the part it understands.
+  `look`, answers it, and every side reads the part it understands. A
+  second optional ask, `page`, answers her page as a tree of values in the
+  screen's closed grammar; only a screen reads it.
 - **Route.** A hostname a reverse proxy sends to one process: `web.`, `quo.`,
   `mcp.`. Routes are deployment, never boundaries.
 
@@ -149,6 +151,12 @@ taken when it can be: a knock back that is unreached, a tab whose pk the
 far harbor has not bound yet or a phone in a tunnel, spends nothing, so she
 keeps the invitation and takes it at the next push. A refusal is final.
 
+A device the root minted may also call her: her `name` ask, gated to
+root-minted devices alone, since the root already trusts that device with
+its id and its reach. A being does not know her own key, so a name is
+always given, by the desk's first hello at setup or by such a device, and
+she keeps the last one. A name is a word, held to the same shape as a key.
+
 ## Architecture
 
 One droplet, one harbor, three routes. Every other placement is a subset.
@@ -303,7 +311,9 @@ is dropped, not fixed:
 
 A look is not capability: it is never in a blueprint or a digest, Quo never
 sees it, and a being without one renders and lists exactly as before. The
-`look` ask itself is presentation and is neither a form nor a tool. A
+`look` ask itself is presentation and is neither a form nor a tool, and so
+is `page`, the one other presentation ask, which a screen alone reads and
+`packages/dock/human/quo-human.md` defines; a carrier carries neither. A
 carrier keeps each standing's look beside her asks in the notes, so acme's
 section on the human's page is painted as acme asked, inside that section
 and nowhere else. No token can carry a URL, a stylesheet or code, so a far
@@ -342,9 +352,9 @@ hello()                          -> { asks it will answer, and how to get in }
 device({ proof })                -> invitation | { error }   proof is what a route produced
 ```
 
-`proof` is the outcome of a credential exchange that already happened outside
-Quo: a session cookie `web.` set, an OAuth grant `mcp.` verified, a signed
-nonce from a local process. The front desk checks it with the verifier for
+`proof` is the daemon's vouch for a process it saw itself: a nonce it
+minted for a side that reached its local socket, the one proof kind there
+is. The front desk checks it with the verifier for
 that proof kind, finds the user being, asks her `invite({ client })`, and
 hands back what she minted. The front desk never mints an invitation itself:
 only the user being invites into her own world, and she keeps the client
@@ -353,42 +363,41 @@ identity in the occupant's notes.
 ## The credential exchange
 
 The only piece that looks like today's SaaS, and it is deliberately kept as
-thin as one call. Every route ends the same way:
-
-1. The route authenticates by its own means. Password, passkey, OAuth, a
-   bearer token from a client, a nonce from a local process.
-2. The route asks the front desk `device({ proof })` and receives an
-   invitation. Which desk is which world: a harbor holds many wards, and
-   the human chooses the world at the allow page when there is more than
-   one; the grant remembers it.
-3. The route hands the invitation to the avatar it is about to boot, or to
-   the one already booted for this client identity if it is a reconnect, in
-   which case nothing is handed and the existing standing is used.
-4. The avatar knocks. The heir dies. From here there is no token anywhere.
-
-The human decides two more things at step 1, on the same page that names
-the identity: whether this device may **wake** the human's other devices,
-and whether it may **reach** what she holds. Each word travels with the
-proof, the user being writes it as a note on the occupant she mints, and her
+thin as one call. Nothing is ever typed to get in but an invitation: there
+is no password anywhere in the dock, because login is a knock. Every way in
+ends the same way:
+
+1. Somebody who may invite mints an invitation for the client identity.
+   The root does, on the box, with `quo invite` on the user being, and
+   sends it as a link or a line. On the device, a side that reached the
+   daemon's side socket is vouched for by the daemon itself, the one
+   **proof** there is: `local`, a nonce the daemon minted for that
+   connection and the front desk honours once, under that kind alone, so
+   the desk asks the user being to mint for it. File permissions on the
+   socket are the device's own rule, which the spec allows.
+2. The invitation reaches the avatar for that identity: handed over at the
+   allow page of the model side's exchange, opened as a link in a tab, or
+   given by the desk to a local side. On a reconnect the avatar already
+   holds her standing, nothing is handed and nothing is minted.
+3. The avatar knocks. The heir dies. From here there is no token anywhere,
+   and a route's own grant only remembers which avatar a client speaks
+   through.
+
+Two more things travel with a minting: whether this device may **wake**
+the human's other devices, and whether it may **reach** what she holds.
+The user being writes each as a note on the occupant she mints, and her
 gate reads the note: `push` is shown to the desk and to a device with the
 `wake` note, and her standings are carried for a device with the `reach`
 note, and for nobody else. A device that may wake can hand an agent an event
 through the user being, and she sees who did; a device that may reach sees
 acme on her, and a model sees acme only because the human said it may. The
 notes are written when the occupant is minted; to change one, remove the
-occupant and allow again, because reconnect mints nothing. A device the
+occupant and mint again, because reconnect mints nothing. A device the
 root mints on her directly, with `quo invite`, carries no note: the id the
 root chose is its client identity, and it reaches and may wake, since the
-root owns everything she holds and chose to mint it.
-
-Two proof kinds exist, and each arrives only the one way it is made:
-`local`, a side that reached the daemon's side socket; `web`, a human who
-passed the exchange pages. Each is a nonce the daemon minted for one kind
-and honours once, under that kind alone, so a proof of any other provenance
-names no nonce and is refused. A human at a screen passes no exchange: a
-tab enters by a link, an invitation a user being minted, and nothing is
-ever typed to get in. The root's first device is no exception; the root
-mints its invitation with `quo invite` on the box and opens the link.
+root owns everything she holds and chose to mint it. An identity the user
+being forgot and lets in again on a fresh invitation is the same avatar:
+her old standing hears `removed`, she drops it, and knocks anew.
 
 The route's own lifetimes, where it speaks OAuth: a pending request and a
 code live ten minutes, an access token one hour, a refresh token thirty
@@ -398,6 +407,8 @@ and what nobody allowed must not stay on disk. A code is spent the first
 time it is offered, right or wrong. The client identity is chosen by the
 human at the allow page and never taken from the client's registration: a
 client may register afresh on every connect, and the avatar outlives that.
+The world the client lands in is the world the invitation names, so the
+page offers no choice of world.
 
 Tokens, cookies and grants exist for the length of step 1 above and are never
 stored on a Quo side. Revocation is `occupants.remove(id)` on the user being:
@@ -431,7 +442,10 @@ quo estate <dir> --domain D  an estate folder of the shape every estate has: a d
 holds the seed, the partition and the ask pointer, on every device, the Mac
 included. Two processes over one partition are two wards with one pk, and
 they diverge silently. `init` is the one exception: it creates with no
-daemon running, and exits.
+daemon running, and exits. Its setup, `beings/setup.ts`, boots the desk
+public and one user being, and knocks the desk on her with `hello` and her
+name: a being does not know her own key, so the desk's first word names
+her, and she keeps the name from then on.
 
 **Everyone else connects to it locally.** `pilot` and the bare owner asks
 are clients of a unix socket the daemon opens with permissions only the
@@ -533,7 +547,7 @@ class bodies and placement, and reaches every piece through the dock.
 | reach        | carrying bytes to a pk                     | request, socket                                  |
 | store        | keeping partitions by seed                 | memory, disk, IndexedDB, edge storage            |
 | side         | an avatar speaking to someone outside      | screen, MCP server, runner, agent                |
-| proof        | turning a credential into an invitation    | one verifier, a daemon nonce, three kinds        |
+| proof        | a device's vouch as an invitation          | one verifier, a daemon nonce, one kind, local    |
 | envoy        | a non-Quo surface as a being               | none built: a name until its first user          |
 | carrier      | a being showing her standings as her own   | the user being; any estate being that extends it |
 | look         | how a being is presented, as values        | read by the screen and the model side            |
@@ -594,8 +608,6 @@ Two rules hold:
   keep in step with every change, and the vectors under `packages/quo/vectors/`
   are the hand that will be extended when the time comes.
 
-`next.md` is where the next sitting starts.
-
 ## Glossary
 
 - **avatar**: a being that is someone's voice from outside Quo.
@@ -611,11 +623,13 @@ Two rules hold:
   minted by user beings.
 - **gate**: `for(occupant, asker)`; the whole permission model.
 - **look**: how a being is presented, as values; one optional ask.
+- **page**: a being's page as a tree of values in the screen's grammar; one
+  optional ask, read by a screen alone.
 - **owner pilot**: `quo pilot`, the model side over a ward's owner asks, reaching
   the daemon's socket; with `--via`, a ward elsewhere through a standing.
 - **daemon**: `quo serve`, the one process on a device that holds a harbor.
-- **proof**: what a route produces after authenticating; the front desk
-  trades it for an invitation.
+- **proof**: the daemon's vouch for a local side, a nonce; the front desk
+  trades it for an invitation. Everyone else arrives with an invitation.
 - **route**: a hostname a reverse proxy sends to one process.
 - **side**: the interface an avatar speaks through to someone outside Quo.
 - **user being**: one per human, 24/7, holding all of the human's standings.

package/beings/setup.ts

@@ -20,6 +20,7 @@ export async function setup(hosted: Hosted, user: string): Promise<void> {
   if (pub.error) throw new Error(`init: ${pub.error}`);
   await boot({ key: user, class: 'User' });
   const inv = (await hosted.ask('invite', { being: user, id: DESK })) as Invitation;
-  const placed = (await hosted.ask('knock', { being: 'desk', id: `user:${user}`, invitation: inv, method: 'hello' })) as { taken?: string };
+  // the desk's first hello names her, since a being does not know her own key
+  const placed = (await hosted.ask('knock', { being: 'desk', id: `user:${user}`, invitation: inv, method: 'hello', args: { name: user } })) as { taken?: string };
   if (placed.taken !== `user:${user}`) throw new Error('init: the desk could not reach the user being');
 }

package/beings/user.ts

@@ -41,17 +41,24 @@ export class User extends Carrier {
     device: { description: 'mint an invitation for a device', input: { type: 'object', properties: { client: { type: 'string' }, wake: { type: 'boolean' }, reach: { type: 'boolean' } }, required: ['client'] }, for: isDesk },
     push: { description: 'push an object to a device: wake it with an event', input: { type: 'object', properties: { client: { type: 'string' }, object: { type: 'object' } }, required: ['client', 'object'] }, for: mayWake },
     chores: { description: 'what the agent may run', input: { type: 'object' }, for: (occ: OccupantRecord | undefined) => client(occ) === 'agent' },
+    look: { description: 'how she is shown', input: { type: 'object' }, for: isDevice },
+    page: { description: 'her page, as a tree of values', input: { type: 'object' }, for: isDevice },
+    name: { description: 'what she is called', input: { type: 'object', properties: { name: { type: 'string' } }, required: ['name'] }, for: rootMinted },
     forget: { description: 'revoke a device: drop its way in and her way back to it, in one act', input: { type: 'object', properties: { client: { type: 'string' } }, required: ['client'] }, for: isDesk },
     report: { description: 'what a run of yours found', input: { type: 'object', properties: { event: { type: 'object' }, result: {} }, required: ['event', 'result'] }, for: isDevice },
   };
 
   // Anyone may say hello. A device that hands her an invitation in the args
   // is taken as a standing under its own id, so she can push to it later;
-  // if it cannot be taken now, it is kept and tried at the next push.
+  // if it cannot be taken now, it is kept and tried at the next push. The
+  // desk's first hello names her: a being does not know her own key, and the
+  // root's setup knocks with the name it booted her under. Once named, she
+  // keeps it.
   async hello(args: JsonObject, asker: Asker) {
     if (asker.id !== undefined && args.invitation && typeof args.invitation === 'object' && !Array.isArray(args.invitation)) {
       await this.wayBack(asker.id, args.invitation as Invitation);
     }
+    if (asker.id === DESK && !this.cells.name && typeof args.name === 'string' && /^[\w.-]{1,80}$/.test(args.name)) this.cells.name = args.name;
     return { welcome: asker.id ?? null, name: this.cells.name };
   }
 
@@ -123,6 +130,46 @@ export class User extends Carrier {
     return { chores: ['census', 'report'] };
   }
 
+  // How a device shows her: her name as the title, and what each ask is
+  // called. Values only; the screen and the model side each read their part.
+  look() {
+    return {
+      name: (this.cells.name as string) || 'you',
+      order: ['whoami', 'push', 'name'],
+      asks: { whoami: { title: 'who am I', readOnly: true }, push: { title: 'wake a device' }, name: { title: 'call her' } },
+    };
+  }
+
+  // Her page for a device: her name, who this device is, the worlds she
+  // holds as sections, and the two things a human does here by hand, waking
+  // another device and naming her. `hello` and `report` are wiring, a
+  // device's first word and an agent's callback; they stay in her describe
+  // under the gate and off her page, since a page is presentation and the
+  // gate is permission. A device that may not do a thing sees no form for
+  // it, however the page names it.
+  page() {
+    return {
+      kind: 'stack',
+      of: [
+        { kind: 'text', text: (this.cells.name as string) || 'you', role: 'title' },
+        { kind: 'row', of: [{ kind: 'text', text: 'this device', role: 'label' }, { kind: 'answer', ask: 'whoami' }] },
+        { kind: 'standings' },
+        { kind: 'form', ask: 'push' },
+        { kind: 'form', ask: 'name' },
+      ],
+    };
+  }
+
+  // A device the root minted may say what she is called: the root trusts
+  // it with its id and its reach already, and a being does not know her own
+  // key. A name is a word; she keeps the last one given.
+  name(args: JsonObject) {
+    const name = typeof args.name === 'string' ? args.name.trim() : '';
+    if (!/^[\w.-]{1,80}$/.test(name)) return { error: 'a name is a word' };
+    this.cells.name = name;
+    return { named: name };
+  }
+
   // A device that ran something for her says what it found. Kept, so that
   // whoever renders her can show it; the ask itself is the callback.
   report(args: JsonObject, asker: Asker) {

package/cli/daemon.ts

@@ -55,7 +55,7 @@ import { createHash, randomBytes } from 'node:crypto';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { createInterface } from 'node:readline';
-import { isSilence, isWord, wordOf, type JsonObject } from '@quo-systems/quo';
+import { isSilence, isWord, wordOf, type Invitation, type JsonObject } from '@quo-systems/quo';
 import type { JSONRPCMessage } from '@modelcontextprotocol/sdk/types.js';
 import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
 import { DiskHarbor, type Hosted } from '../harbor/disk.ts';
@@ -77,7 +77,7 @@ export type Serving = { harbor: DiskHarbor; sock: string; side: string; http: Ht
 // The agents this daemon runs, by client identity. From `<dir>/agents.json`
 // on a device, or given.
 export type Agents = Record<string, { command: string; args?: string[]; dir: string }>;
-export type Options = { http?: { port: number; host?: string }; routes?: Routes; agents?: Agents; dial?: string[]; password?: () => string | undefined };
+export type Options = { http?: { port: number; host?: string }; routes?: Routes; agents?: Agents; dial?: string[] };
 
 // The sockets live in the harbor's folder, where the folder's own permissions
 // guard them. A unix socket path is short by law, about a hundred bytes on
@@ -91,14 +91,11 @@ const socketPath = (dir: string, name: string): string => {
 export const sockPath = (dir: string) => socketPath(dir, 'quo');
 export const sidePath = (dir: string) => socketPath(dir, 'side');
 
-// The nonces this daemon minted, honoured once each. Two proof kinds share
-// them: `local`, for a side that reached side.sock, and `web`, for a human
-// who passed the exchange pages. Both are the daemon vouching for someone it
-// saw itself; a proof of either kind arriving any other way names no nonce.
+// The nonces this daemon minted, honoured once each, for the one proof kind
+// there is: `local`, a side that reached side.sock. That is the daemon
+// vouching for a process it saw itself, by the device's own rule, file
+// permissions on the socket; a proof arriving any other way names no nonce.
 const NONCES = new Map<string, { kind: string; user: string; client: string; wake?: boolean; reach?: boolean }>();
-// A nonce is minted for one kind and honoured under that kind alone: a tab's
-// nonce offered as a `local` proof names no nonce, so a proof of a kind still
-// arrives only the one way that kind is made.
 const honour =
   (kind: string): Verifier =>
   (proof) => {
@@ -109,14 +106,10 @@ const honour =
     return rest;
   };
 Desk.verifiers.local = honour('local');
-Desk.verifiers.web = honour('web');
 
-// Admit a client identity into a ward: find or boot her avatar, and enter
-// her with a nonce the desk honours once. On a reconnect she already holds
-// `user` and nothing is minted, so `wake`, the human's word that this
-// device may wake her others, is read the first time only; to change it,
-// remove the occupant and allow again. The one path for every side.
-export async function admit(hosted: Hosted, identity: string, kind: 'local' | 'web', wake = false, reach = false): Promise<{ avatar?: Avatar; error?: string }> {
+// Her avatar in a ward, found or booted under the identity's key. An
+// identity is a word, and never a being of the ward.
+async function avatarOf(hosted: Hosted, identity: string): Promise<{ avatar?: Avatar; error?: string }> {
   if (!/^[\w.-]+$/.test(identity) || identity === hosted.record.user || identity === 'desk') return { error: 'an identity is a word, and not a being of the ward' };
   const key = `avatar:${identity}`;
   let avatar = hosted.being(key) as Avatar | undefined;
@@ -125,12 +118,48 @@ export async function admit(hosted: Hosted, identity: string, kind: 'local' | 'w
     if (out.error) return { error: out.error };
     avatar = hosted.being(key) as Avatar;
   }
+  return { avatar };
+}
+
+// Admit a local client identity into a ward: find or boot her avatar, and
+// enter her with a nonce the desk honours once. On a reconnect she already
+// holds `user` and nothing is minted, so `wake` and `reach` are read the
+// first time only; to change one, remove the occupant and admit again. The
+// one path for a side on the device: agents, and sides on side.sock.
+export async function admit(hosted: Hosted, identity: string, kind: 'local', wake = false, reach = false): Promise<{ avatar?: Avatar; error?: string }> {
+  const found = await avatarOf(hosted, identity);
+  if (!found.avatar) return found;
   const nonce = randomBytes(16).toString('hex');
   NONCES.set(nonce, { kind, user: hosted.record.user, client: identity, ...(wake ? { wake: true } : {}), ...(reach ? { reach: true } : {}) });
-  const entered = await avatar.enter({ ward: hosted.pk }, { kind, nonce });
+  const entered = await found.avatar.enter({ ward: hosted.pk }, { kind, nonce });
   NONCES.delete(nonce);
   await hosted.save(); // the knock went through the ward's own door, which the harbor never sees
   if ('error' in entered && !('asks' in entered)) return { error: entered.error };
+  return { avatar: found.avatar };
+}
+
+// Join a client identity to a ward with an invitation the root minted for
+// it: find or boot her avatar, and she knocks. The one path for an identity
+// from elsewhere, the exchange page. Nothing is typed to get in but the
+// invitation, and the knock spends it.
+export async function letIn(hosted: Hosted, identity: string, invitation: Invitation): Promise<{ avatar?: Avatar; error?: string }> {
+  const found = await avatarOf(hosted, identity);
+  if (!found.avatar) return found;
+  const joined = await found.avatar.join(invitation);
+  await hosted.save();
+  if ('error' in joined && !('asks' in joined)) return { error: joined.error };
+  return { avatar: found.avatar };
+}
+
+// Her avatar as she stands, for a session opening under a grant: she is in
+// or she is not, and nothing is minted here. An identity the user being
+// removed hears `removed` on her describe, which the endpoint speaks as 401.
+export async function find(hosted: Hosted, identity: string): Promise<{ avatar?: Avatar; error?: string }> {
+  const avatar = hosted.being(`avatar:${identity}`) as Avatar | undefined;
+  if (!avatar) return { error: 'not joined' };
+  const bp = await avatar.tools();
+  await hosted.save();
+  if ('error' in bp && !('asks' in bp)) return { error: bp.error };
   return { avatar };
 }
 
@@ -173,22 +202,20 @@ export async function serve(dir: string, options: Options = {}): Promise<Serving
       http = door;
       http.mount('/quo', quoRoute(harbor, server as HttpServer, quo));
       const routes = options.routes ?? (await readRoutes(harbor.dir));
-      const password = options.password ?? (() => process.env.QUO_OWNER_PASSWORD);
       const here = `http://${http.host}:${http.port}`;
       // the worlds' pages: always, on the daemon's own door when no route names a public one
       const web = webRoute(harbor, { at: { quo: routes?.quo ?? `${here}/quo`, web: routes?.web ?? `${here}/web` } });
       if (routes) {
-        // the worlds a client may be allowed into: every ward with a public being, main first
+        // the worlds a client may be allowed into: every ward here, by name and pk, main first
         const worlds = () =>
           [...harbor.wards]
-            .filter(([, h]) => (h.partition as { public?: string | null }).public !== null)
             .sort(([a], [b]) => (a === 'main' ? -1 : b === 'main' ? 1 : a.localeCompare(b)))
-            .map(([ward, h]) => ({ ward, user: h.record.user }));
+            .map(([ward, h]) => ({ ward, pk: h.pk, user: h.record.user }));
         // the MCP endpoint: a bearer names an identity in a world, the identity names her avatar there, the side runs beside her
         mcp = new McpHttp(
           async (identity, ward) => {
             const hosted = harbor.wards.get(ward);
-            return hosted ? admit(hosted, identity, 'web') : { error: 'no such world' };
+            return hosted ? find(hosted, identity) : { error: 'no such world' };
           },
           async () => {
             for (const h of harbor.wards.values()) await h.save();
@@ -200,12 +227,11 @@ export async function serve(dir: string, options: Options = {}): Promise<Serving
         mcp.gone = (identity, ward) => oauth!.revoke(identity, ward); // removal at the ward ends the grant at the route
         exchange = new Exchange({
           oauth,
-          password,
           worlds,
-          admit: async (identity, wake, reach, ward) => {
+          join: async (identity, invitation, ward) => {
             const hosted = harbor.wards.get(ward);
             if (!hosted) return { error: 'no such world' };
-            const r = await admit(hosted, identity, 'web', wake, reach);
+            const r = await letIn(hosted, identity, invitation);
             return r.error ? { error: r.error } : {};
           },
         });

package/cli/estate/quo.service

@@ -14,7 +14,6 @@ User=quo
 Group=quo
 Environment=QUO_DIR=/home/quo/.quo
 Environment=QUO_HTTP=8787
-# QUO_OWNER_PASSWORD, root-only. Without it the exchange pages are closed.
 # CLAUDE_CODE_OAUTH_TOKEN, when an agent folder runs `claude -p`: the agent
 # reads its credential from the device, never from cells.
 EnvironmentFile=-/etc/quo/env

package/dist/beings/avatar.js

@@ -55,8 +55,15 @@ export class Avatar extends Being {
     // is taken all the same, and the way back she did not take is dropped, so
     // any world's public being may admit a guest, hello or not.
     async join(invitation) {
-        if (this.standings[USER])
-            return this.tools();
+        if (this.standings[USER]) {
+            // A standing the far being removed is not one: she drops it and joins
+            // afresh, so an identity forgotten at the user being can be let in again.
+            const had = await this.tools();
+            if (!('error' in had) || had.error !== 'removed')
+                return had;
+            this.standings.remove(USER);
+            this.occupants.remove(PUSHER);
+        }
         const mine = await this.invite(PUSHER);
         if (mine === null)
             return { error: 'user is taken' };

package/dist/beings/carry.js

@@ -58,8 +58,8 @@ export class Carrier extends Being {
                 continue;
             const names = [];
             for (const a of rec.blueprint.asks) {
-                if (a.name === 'look')
-                    continue;
+                if (a.name === 'look' || a.name === 'page')
+                    continue; // presentation is hers, never carried as an ask
                 const name = `${id}-${a.name}`;
                 if (own.has(name))
                     continue;

package/dist/beings/setup.js

@@ -13,7 +13,8 @@ export async function setup(hosted, user) {
         throw new Error(`init: ${pub.error}`);
     await boot({ key: user, class: 'User' });
     const inv = (await hosted.ask('invite', { being: user, id: DESK }));
-    const placed = (await hosted.ask('knock', { being: 'desk', id: `user:${user}`, invitation: inv, method: 'hello' }));
+    // the desk's first hello names her, since a being does not know her own key
+    const placed = (await hosted.ask('knock', { being: 'desk', id: `user:${user}`, invitation: inv, method: 'hello', args: { name: user } }));
     if (placed.taken !== `user:${user}`)
         throw new Error('init: the desk could not reach the user being');
 }

package/dist/beings/user.d.ts

@@ -3,6 +3,7 @@ import { Carrier } from './carry.ts';
 export declare const DESK = "desk";
 declare const isDesk: (occ: OccupantRecord | undefined) => boolean;
 declare const isDevice: (occ: OccupantRecord | undefined) => boolean;
+declare const rootMinted: (occ: OccupantRecord | undefined) => boolean;
 declare const mayWake: (occ: OccupantRecord | undefined) => boolean;
 export declare class User extends Carrier {
     static carries(occ: OccupantRecord | undefined): boolean;
@@ -72,6 +73,33 @@ export declare class User extends Carrier {
             };
             for: (occ: OccupantRecord | undefined) => boolean;
         };
+        look: {
+            description: string;
+            input: {
+                type: string;
+            };
+            for: typeof isDevice;
+        };
+        page: {
+            description: string;
+            input: {
+                type: string;
+            };
+            for: typeof isDevice;
+        };
+        name: {
+            description: string;
+            input: {
+                type: string;
+                properties: {
+                    name: {
+                        type: string;
+                    };
+                };
+                required: string[];
+            };
+            for: typeof rootMinted;
+        };
         forget: {
             description: string;
             input: {
@@ -127,6 +155,67 @@ export declare class User extends Carrier {
     chores(): {
         chores: string[];
     };
+    look(): {
+        name: string;
+        order: string[];
+        asks: {
+            whoami: {
+                title: string;
+                readOnly: boolean;
+            };
+            push: {
+                title: string;
+            };
+            name: {
+                title: string;
+            };
+        };
+    };
+    page(): {
+        kind: string;
+        of: ({
+            kind: string;
+            text: string;
+            role: string;
+            of?: undefined;
+            ask?: undefined;
+        } | {
+            kind: string;
+            of: ({
+                kind: string;
+                text: string;
+                role: string;
+                ask?: undefined;
+            } | {
+                text?: undefined;
+                role?: undefined;
+                kind: string;
+                ask: string;
+            })[];
+            text?: undefined;
+            role?: undefined;
+            ask?: undefined;
+        } | {
+            of?: undefined;
+            text?: undefined;
+            role?: undefined;
+            kind: string;
+            ask?: undefined;
+        } | {
+            of?: undefined;
+            text?: undefined;
+            role?: undefined;
+            kind: string;
+            ask: string;
+        })[];
+    };
+    name(args: JsonObject): {
+        error: string;
+        named?: undefined;
+    } | {
+        error?: undefined;
+        named: string;
+    };
     report(args: JsonObject, asker: Asker): {
         reported: boolean;
     };