@quo-systems/quo 0.1.0 → 0.2.0

package/src/conformance/estate.ts

@@ -33,12 +33,13 @@
 // A model that kept one symmetric edge would be a wrong model, and would
 // agree happily with a ward that had drifted.
 import { assert } from './assert.ts';
-import { isSilence, isUnreached } from '../being/silence.ts';
+import { isSilence, isUnreached, isWord, wordOf } from '../being/silence.ts';
 import type { Invitation } from '../being/types.ts';
 import { Member } from './beings.ts';
 import type { Census, Handle, Runner, World } from './index.ts';
 
 const HEX64 = /^[0-9a-f]{64}$/;
+const said = (x: unknown, w: string): boolean => isWord(x) && wordOf(x) === w;
 
 // One occupant arc, as the host holds it. `guest` is null until somebody
 // knocks; `live` goes false when she is kicked. Both are the host's business
@@ -161,10 +162,11 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
     assert.deepEqual(await acme.being.knock(back, 'ping'), { pong: 'acme' });
     assert.equal(await acme.being.take('them', back), 'them');
 
-    // 5. acme kicks her. her standing is still hers to hold -- she is never
-    //    told -- and it is silence from here on.
+    // 5. acme kicks her. her standing is still hers to hold, and she is not
+    //    told until she asks: then the door, under the key it bound for her,
+    //    says removed, and only to her.
     acme.being.occupants.remove('partner-1');
-    assert.ok(isSilence(await partner.being.standings['the-client']!.ask('ping')));
+    assert.ok(said(await partner.being.standings['the-client']!.ask('ping'), 'removed'));
     assert.deepEqual(Object.keys(partner.cells.standings), ['the-client']); // she never learns
     assert.deepEqual(await acme.being.standings.them!.ask('ping'), { pong: 'acme' }); // the other arc never moved
 
@@ -174,7 +176,7 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
     assert.notEqual(second.heir, first.heir);
     assert.deepEqual(await partner.being.knock(second, 'ping'), { pong: 'partner-2' });
     assert.equal(await partner.being.take('the-client-again', second), 'the-client-again');
-    assert.ok(isSilence(await partner.being.standings['the-client']!.ask('ping')));
+    assert.ok(said(await partner.being.standings['the-client']!.ask('ping'), 'removed'));
     ledger(w.census(), undefined, 'the story');
   });
 
@@ -221,6 +223,9 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
               assert.deepEqual(back, { pong: s.id }, `${guest} knocking ${s.host}/${s.id}`);
               s.guest = guest;
               s.answered = true;
+            } else if (!s.live && (s.guest === null || (s.guest === guest && (hold === undefined || hold.live)))) {
+              // kicked, and she speaks under a key the door bound for this seat: she hears why
+              assert.ok(said(back, 'removed'), `${guest} knocking kicked ${s.host}/${s.id} should hear removed`);
             } else assert.ok(isSilence(back), `${guest} knocking ${s.host}/${s.id} should be silence`);
             return `${guest} knocks ${s.host}/${s.id}`;
           });
@@ -304,7 +309,7 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
           }
           const out = await standing!.ask('ping');
           if (h.seat.live) assert.deepEqual(out, { pong: h.seat.id }, `step ${step}: ${h.owner}/${h.id} -> ${h.seat.host}/${h.seat.id}`);
-          else assert.ok(isSilence(out), `step ${step}: ${h.owner}/${h.id} is kicked and should be silence`);
+          else assert.ok(said(out, 'removed'), `step ${step}: ${h.owner}/${h.id} is kicked and should hear removed`);
         }
       };
 

package/src/conformance/index.ts

@@ -19,7 +19,7 @@
 //
 // Every assertion here is the truth's. Nothing here knows how a ward is built.
 import { assert } from './assert.ts';
-import { silence, isSilence, isUnreached } from '../being/silence.ts';
+import { silence, isSilence, isUnreached, isWord, wordOf } from '../being/silence.ts';
 import { digest } from '../being/digest.ts';
 import type { Asker, BeingClass, Cells, Invitation, Json, JsonObject } from '../being/types.ts';
 import { Printer, Shop, Customer, Echo, Member } from './beings.ts';
@@ -54,6 +54,8 @@ export type World = {
 export { Printer, Shop, Customer, Echo, Member };
 
 const HEX64 = /^[0-9a-f]{64}$/;
+// Her ward's word, as she receives it.
+const said = (x: unknown, w: string): boolean => isWord(x) && wordOf(x) === w;
 
 // The runner is handed in. Node passes `node:test`; a browser and an edge
 // worker pass a shim of their own. The suite is the ward's truth, and the
@@ -100,12 +102,12 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     assert.equal(i1.ward, i2.ward);
   });
 
-  t('remove before any knock: the heir is forgotten, a knock on it is silence', async () => {
+  t('remove before any knock: the heir is forgotten, and a knock on it by whoever holds it hears removed', async () => {
     const { w, shop, alice } = await world();
     const inv = await shop.being.invite();
     shop.being.occupants.remove('cust1');
     assert.equal(w.heir(inv), undefined);
-    assert.ok(isSilence(await alice.being.join(inv)));
+    assert.ok(said(await alice.being.join(inv), 'removed'));
     assert.deepEqual(alice.cells.standings, {});
   });
 
@@ -189,16 +191,16 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     assert.deepEqual(await alice.being.join(inv), { welcome: true }); // the same invitation still works
     const inv2 = await shop.being.invite();
     shop.being.occupants.remove('cust2'); // she changed her mind before the knock
-    assert.ok(isSilence(await alice.being.join(inv2)));
+    assert.ok(said(await alice.being.join(inv2), 'removed'));
     assert.deepEqual(Object.keys(alice.cells.standings), ['shop']);
   });
 
-  t('take without a knock, or after a silent knock, births nothing', async () => {
+  t('take without a knock, or after a knock that was not answered, births nothing', async () => {
     const { shop, alice } = await world();
     const inv = await shop.being.invite();
     assert.equal(await alice.being.take('shop', inv), null);
     shop.being.occupants.remove('cust1');
-    assert.ok(isSilence(await alice.being.knock(inv, 'hello')));
+    assert.ok(said(await alice.being.knock(inv, 'hello'), 'removed'));
     assert.equal(await alice.being.take('shop', inv), null);
     assert.deepEqual(alice.cells.standings, {});
   });
@@ -374,16 +376,16 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     assert.deepEqual(await alice.being.buy('hat'), { ok: true, receipt: 'receipt for hat' });
   });
 
-  t('a removed occupant is silence to the far side and her heir is forgotten; a dropped standing is gone', async () => {
+  t('a removed occupant hears removed under the key the door bound, her heir is forgotten; a dropped standing is gone', async () => {
     const { w, alice, shop } = await world();
     const inv = await shop.being.invite();
     await alice.being.join(inv);
     shop.being.occupants.remove('cust1');
     assert.equal(w.heir(inv), undefined);
-    assert.ok(isSilence(await alice.being.buy('hat')));
+    assert.ok(said(await alice.being.buy('hat'), 'removed'));
     alice.being.standings.remove('shop');
     assert.equal(alice.being.standings.shop, undefined);
-    assert.ok(isSilence(await alice.being.knock(inv, 'hello'))); // and a re-knock finds no heir
+    assert.ok(isSilence(await alice.being.knock(inv, 'hello'))); // her bound key went with the standing: a re-knock is as the heir, which is spent, a stranger
     const again = await shop.being.invite(); // cust2. a new heir
     assert.notEqual(again.heir, inv.heir);
     assert.deepEqual(await alice.being.knock(again, 'hello'), { welcome: true });
@@ -398,7 +400,7 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     assert.equal((shop.cells.sales as unknown[]).length, 1);
   });
 
-  t('a being that throws is silence outside; the ward stays up', async () => {
+  t('a being that throws is the word threw to whom the door has bound; the ward stays up', async () => {
     const w = await make();
     class Bomb {
       s: unknown;
@@ -413,7 +415,7 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     const x = await w.boot<Bomb>('X', Bomb);
     const a = await w.boot<Customer>('A', Customer);
     const inv = (await (x.being.s as Customer['stance']).occupants.invite('a'))!;
-    assert.ok(isSilence(await a.being.knock(inv, 'any')));
+    assert.ok(said(await a.being.knock(inv, 'any'), 'threw'));
     assert.deepEqual(await a.being.knock(inv), { asks: [], notes: {} });
   });
 
@@ -473,7 +475,7 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     assert.deepEqual(pub.cells.occupants, {}); // she never invited anyone
     if (!w.oneWard) assert.ok(isSilence(await a.being.knock(at(priv), 'time'))); // a ward with no public being: silence
     assert.ok(isUnreached(await a.being.knock({ ward: 'a'.repeat(128) }, 'time'))); // no door anywhere: unreached
-    assert.ok(isSilence(await a.being.knock({ ward: 'not a pk' }, 'time'))); // not even an address
+    assert.ok(said(await a.being.knock({ ward: 'not a pk' }, 'time'), 'invitation')); // not even an address
     assert.equal(await a.being.take('clock', at(pub)), 'clock');
     assert.deepEqual(await a.being.standings.clock!.ask('time'), { time: 12, got: {} });
     assert.equal(a.cells.standings.clock.seen, await digest((await a.being.standings.clock!.ask()) as Json));

package/src/harbor/core.ts

@@ -9,8 +9,9 @@
 // tree, and every one of them passes the conformance suite untouched.
 //
 // The directory is filled three ways, in this order: the harbor's own
-// doors; a socket a dialer holds to it, bound at announce and unbound at
-// close; a hint from a link. And one fallback: a dialer with nothing in its
+// doors; a socket a dialer holds to it, bound once the door behind the
+// dialer's claim has proved it holds the key, and unbound at close; a hint
+// from a link. And one fallback: a dialer with nothing in its
 // directory for a pk sends down the socket it holds, because the listener
 // it dialed is the rendezvous and may hold that pk on another socket. Bytes
 // that arrive from the wire go to an own door or a held socket and never
@@ -19,6 +20,9 @@ import { Ward } from '../ward/ward.ts';
 import type { Ground, WardPointers } from '../ward/ground.ts';
 import type { BeingClass, BeingLike } from '../being/types.ts';
 import { request, type Reach } from './reach.ts';
+import { openReply, wardSignPk } from '../ward/seal.ts';
+import { concat, sealingPair, KEY } from '../ward/arithmetic.ts';
+import { within, LATE } from '../ward/allowance.ts';
 import type { Kept, Store, WardRecord } from './store.ts';
 
 export type Hosted = WardPointers & { pk: string; name: string; record: WardRecord; partition: Record<string, unknown>; being(key: string): BeingLike | undefined; save(): Promise<void> };
@@ -30,6 +34,9 @@ export type Bound = { reach: Reach; held: boolean };
 export type Loader = (record: WardRecord) => Promise<Record<string, BeingClass>>;
 
 export const DEFAULT_CODE = 'classes/index.ts';
+// How long a probe waits for the door behind a claim. A claim that answers
+// nothing in this time is not bound; the next announce is another chance.
+const PROBE = 10_000;
 
 export class Harbor {
   readonly store: Store;
@@ -38,6 +45,7 @@ export class Harbor {
   readonly doors = new Map<string, WardPointers['door']>(); // ward pk -> door
   readonly reaches = new Map<string, Bound>(); // the directory: foreign ward pk -> reach
   readonly down = new Set<string>(); // pks this harbor will not reach right now: weather, for a test
+  readonly refused = new Map<string, number>(); // own ward pk -> arrivals its door would not admit. what a terrain does with it is its own
   readonly classes: Record<string, BeingClass> = {}; // classes handed in-process, beside the loader's
   // The dialers' sockets, in the order they were dialed: where a pk nobody
   // here knows is sent, because the listener a harbor dialed is a rendezvous
@@ -64,10 +72,18 @@ export class Harbor {
 
   // ---- the directory
 
+  // Bytes to one of this harbor's own doors, and the one bit the door says
+  // beside its reply, counted.
+  async #own(pk: string, door: WardPointers['door'], bytes: Uint8Array): Promise<Uint8Array> {
+    const r = await door(bytes);
+    if (!r.heard) this.refused.set(pk, (this.refused.get(pk) ?? 0) + 1);
+    return new Uint8Array(r.bytes);
+  }
+
   async carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined> {
     if (this.down.has(pk)) return undefined;
     const door = this.doors.get(pk);
-    if (door) return new Uint8Array(await door(bytes));
+    if (door) return this.#own(pk, door, bytes);
     const bound = this.reaches.get(pk);
     if (bound) return bound.reach.carry(pk, bytes);
     for (const reach of this.fallbacks) {
@@ -80,7 +96,7 @@ export class Harbor {
   async deliver(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined> {
     if (this.down.has(pk)) return undefined;
     const door = this.doors.get(pk);
-    if (door) return new Uint8Array(await door(bytes));
+    if (door) return this.#own(pk, door, bytes);
     const bound = this.reaches.get(pk);
     return bound?.held ? bound.reach.carry(pk, bytes) : undefined;
   }
@@ -95,8 +111,42 @@ export class Harbor {
     await this.store.hint(pk, url);
   }
 
-  bind(pks: string[], reach: Reach, held: boolean): void {
-    for (const pk of pks) if (!this.doors.has(pk)) this.reaches.set(pk, { reach, held });
+  // An announce is a claim, and a claim binds nothing until proven: anyone
+  // who can reach a listener could otherwise name a pk that is not theirs and
+  // take its reachability. The proof is the door itself, as it already is. A
+  // lid this harbor minted and noise after it is a box that does not open,
+  // and the door answers one such box with silence sealed to the lid and
+  // signed by the ward key. Only the holder of that ward's seed can write
+  // that reply, the lid is fresh so nothing replays, and a box that does not
+  // open writes nothing at the ward. This is the one box a harbor ever opens,
+  // the one it sealed itself, and it reads nothing from it but that the
+  // signature is the claimed key's.
+  async prove(pk: string, reach: Reach): Promise<boolean> {
+    if (!/^[0-9a-f]{128}$/.test(pk)) return false;
+    try {
+      const random = (n: number) => globalThis.crypto.getRandomValues(new Uint8Array(n));
+      const lid = await sealingPair(random(KEY));
+      const back = await within(PROBE, reach.carry(pk, concat([lid.pk, random(KEY)])));
+      if (back === LATE || back === undefined) return false;
+      const reply = await openReply(back, lid.secret, wardSignPk(pk));
+      return reply !== null && 'silence' in reply;
+    } catch {
+      return false;
+    }
+  }
+
+  // Bind what the far side claims, each pk proven at its door first. Both
+  // sides bind this way: the listener the dialer's claims, the dialer the
+  // listener's, since a claim is a claim whichever end made it.
+  async bind(pks: string[], reach: Reach, held: boolean): Promise<void> {
+    // An announce is the whole of what that side holds now, so a pk this
+    // reach was bound for and no longer claims is unbound at once: a ward
+    // that left a dialer is not reachable through it, proof or no proof.
+    for (const [pk, b] of this.reaches) if (b.reach === reach && !pks.includes(pk)) this.reaches.delete(pk);
+    await Promise.all(pks.map(async (pk) => {
+      if (this.doors.has(pk) || !(await this.prove(pk, reach))) return;
+      this.reaches.set(pk, { reach, held });
+    }));
   }
   unbind(reach: Reach): void {
     for (const [pk, b] of this.reaches) if (b.reach === reach) this.reaches.delete(pk);

package/src/harbor/dial.ts

@@ -30,7 +30,7 @@ export function dial(harbor: Harbor, url: string): Dialer {
         // not at the handshake: a listener that opens and then refuses every
         // time would otherwise be dialed at a fixed two seconds for good.
         wait = 1000;
-        harbor.bind(far, s, false); // the listener's pks: reached through this socket, not held for others
+        void harbor.bind(far, s, false); // the listener's claims, each proven at its door: reached through this socket, not held for others
       },
       (why) => {
         harbor.unbind(s);

package/src/harbor/memory.ts

@@ -15,6 +15,7 @@ export class MemoryHarbor {
   readonly doors = new Map<string, WardPointers['door']>(); // ward pk -> door
   readonly down = new Set<string>(); // ward pks this harbor cannot reach right now
   readonly wire: string[] = []; // every byte string that ever crossed, as hex. for inspection
+  readonly refused = new Map<string, number>(); // ward pk -> arrivals its door would not admit: strangers, counted
   readonly peers = new Set<MemoryHarbor>();
   cut = false;
   readonly partitions = new Map<string, Record<string, unknown>>(); // seed -> memory. the harbor keeps it and reads nothing
@@ -25,7 +26,11 @@ export class MemoryHarbor {
   async route(farPk: string, bytes: Uint8Array): Promise<Uint8Array | undefined> {
     if (this.down.has(farPk)) return undefined;
     const door = this.doors.get(farPk);
-    if (door) return door(bytes);
+    if (door) {
+      const r = await door(bytes);
+      if (!r.heard) this.refused.set(farPk, (this.refused.get(farPk) ?? 0) + 1);
+      return r.bytes;
+    }
     const peer = [...this.peers].find((h) => h.doors.has(farPk) && !h.down.has(farPk));
     if (!peer || this.cut) return undefined; // nothing. the harbor has no word silence
     return peer.route(farPk, bytes);

package/src/ward/door.ts

@@ -1,11 +1,15 @@
 // SPDX-License-Identifier: Apache-2.0
-// Judgment at the door. Sealed bytes in, sealed bytes out. Every failure is
-// one silence, sealed to whoever asked so that a stranger learns nothing,
-// not even which case they hit. What passes is named and dispatched to her
-// answer, and her digest for that asker rides back with the object.
-import { isSilence, isUnreached } from '../being/silence.ts';
+// Judgment at the door. Sealed bytes in, sealed bytes out, and one bit for
+// the harbor: whether a key this door holds spoke. A stranger, bytes the
+// door cannot admit, meets one silence whatever the case, so that it learns
+// nothing, not even which case it hit. A key the door has bound hears the
+// ward's word for what happened, sealed to its own lid, because it has
+// already proven who it is and a reason to it is an oracle to nobody. What
+// passes is named and dispatched to her answer, and her digest for that
+// asker rides back with the object.
+import { isSilence, isWord } from '../being/silence.ts';
 import { digest } from '../being/digest.ts';
-import type { Asker, BeingLike, JsonObject } from '../being/types.ts';
+import type { Asker, BeingLike, DoorWord, JsonObject } from '../being/types.ts';
 import { at } from './partition.ts';
 import type { Heirs } from './heirs.ts';
 import { openAsk, sealReply, verifyAsk, type ReplyPayload, type WardKey } from './seal.ts';
@@ -13,20 +17,26 @@ import { spent } from './allowance.ts';
 import { KEY, sealingPair } from './arithmetic.ts';
 
 export type Door = { key: string; being: BeingLike; cells: { occupants: Record<string, unknown> } };
+export type Judged = { bytes: Uint8Array; heard: boolean };
 const SILENCE: ReplyPayload = { silence: true };
+const said = (quo: DoorWord): ReplyPayload => ({ quo });
 
-// One arrival at one being, already named. Catches every throw.
-export async function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject): Promise<ReplyPayload> {
+// One arrival at one being, already named. Catches every throw. `bound` says
+// whether the asker is a key this door holds: she hears `threw`; a stranger
+// at the public being hears silence, because her insides are hers.
+export async function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload> {
+  const threw = bound ? said('threw') : SILENCE;
   let out: Awaited<ReturnType<BeingLike['answer']>>;
   try {
     out = await door.being.answer(asker, method, args);
   } catch {
-    return SILENCE; // she threw where she was asked. there is no answer.
+    return threw; // she threw where she was asked. there is no answer.
   }
   // Nothing at all is not an answer either: a method that forgot to return
   // has said nothing, and nothing is silence, never a value that JSON drops
   // on the way out and the far side reads back as a fourth word.
-  if (out === undefined || isSilence(out) || isUnreached(out)) return SILENCE;
+  if (out === undefined || isSilence(out)) return SILENCE;
+  if (isWord(out)) return threw; // a word is the ward's to say, never hers
   if (method === undefined) return { object: out, seen: null };
   // The digest rides along, it is not the answer. She has already answered:
   // a describe that will not run costs the digest, and nothing else.
@@ -36,43 +46,54 @@ export async function arrive(door: Door, asker: Asker, method: string | undefine
 async function seen(door: Door, asker: Asker): Promise<string | null> {
   try {
     const bp = await door.being.answer(asker);
-    return isSilence(bp) || isUnreached(bp) ? null : await digest(bp);
+    return isSilence(bp) || isWord(bp) ? null : await digest(bp);
   } catch {
     return null;
   }
 }
 
+type Verdict = { reply: ReplyPayload; ephemeralPk: Uint8Array; heard: boolean };
+
 export function makeDoor(key: WardKey, heirs: Heirs, doors: Map<string, Door>, publicKey: () => string | null, random: (n: number) => Uint8Array) {
-  const judge = async (bytes: Uint8Array): Promise<{ reply: ReplyPayload; ephemeralPk: Uint8Array } | null> => {
+  const judge = async (bytes: Uint8Array): Promise<Verdict | null> => {
     const a = await openAsk(bytes, key.padlock);
-    if (!a) return null; // it did not open. there is nobody to answer.
+    if (!a) return null; // D1. it did not open. there is nobody to answer.
     const { to, payload, ephemeralPk } = a;
-    // The allowance, read before anything is done under it. A budget already
-    // gone is one silence like every other refusal here: a stranger learns
-    // nothing, not even that what she ran out of was time. Nothing is spent
-    // and nothing rotates, because nothing was heard.
-    if (spent({ time: payload.time })) return { reply: SILENCE, ephemeralPk };
-    // An ask with no doors left is one silence like a budget already gone.
-    // Nothing sets hops and nothing decrements it yet; this door refuses zero
-    // so that a relay chain invented later meets doors that already stop it.
-    if (payload.hops === 0) return { reply: SILENCE, ephemeralPk };
+    const refuse = (): Verdict => ({ reply: SILENCE, ephemeralPk, heard: false });
+    // D2, the rest of it. The allowance is read before anything is done under
+    // it, and hops at zero is refused so that a relay chain invented later
+    // meets doors that already stop it. Nothing sets hops.
+    if (spent({ time: payload.time }) || payload.hops === 0) return refuse();
     const args = payload.args ?? {};
     if (to === null) {
+      // For nobody: the public being, or D3 nobody home; D4 the signature
+      // fails under the key the payload names. She is asked by strangers,
+      // and a stranger hears silence for whatever she then does.
       const pk = publicKey();
       const pub = pk !== null ? doors.get(pk) : undefined;
-      if (!pub || !(await verifyAsk(a, payload.by))) return { reply: SILENCE, ephemeralPk };
-      return { reply: await arrive(pub, {}, payload.method, args), ephemeralPk };
+      if (!pub || !(await verifyAsk(a, payload.by))) return refuse();
+      return { reply: await arrive(pub, {}, payload.method, args, false), ephemeralPk, heard: true };
     }
     const h = heirs.admits(to, payload.by);
-    if (!h) return { reply: SILENCE, ephemeralPk };
+    if (!h) {
+      // D5 a heir not held, D6 a key not admitted. One more case: the heir
+      // was held and the id removed. Its last keys are kept so that their
+      // holder, and only their holder, D7 checked, hears that she is gone.
+      if (!heirs.gone(to, payload.by) || !(await verifyAsk(a, payload.by))) return refuse();
+      return { reply: said('removed'), ephemeralPk, heard: true };
+    }
+    if (!(await verifyAsk(a, payload.by))) return refuse(); // D7, under an admitted key
+    // From here the door has heard a key it holds. Every answer below is
+    // sealed to that key's lid; nothing below is a stranger's.
     const door = doors.get(h.being);
-    if (!door || !at(door.cells.occupants, h.id)) return { reply: SILENCE, ephemeralPk }; // she removed it, or she is gone
-    if (!(await verifyAsk(a, payload.by))) return { reply: SILENCE, ephemeralPk };
+    if (!door) return { reply: said('absent'), ephemeralPk, heard: true }; // D8. she did not come back this run
+    if (!at(door.cells.occupants, h.id)) return { reply: said('removed'), ephemeralPk, heard: true }; // D8. the record is gone
     // Once only, and only now: the number is spent after the signature, so a
     // stranger cannot burn a number she could not sign for, and together with
     // the keys, so the same bytes twice rotate nothing and refusal writes nothing.
-    if (!heirs.honour(h, payload.by, payload.next, payload.seq)) return { reply: SILENCE, ephemeralPk };
-    return { reply: await arrive(door, { id: h.id }, payload.method, args), ephemeralPk };
+    const honoured = heirs.honour(h, payload.by, payload.next, payload.seq); // D9, D10
+    if (honoured !== true) return { reply: said(honoured), ephemeralPk, heard: true };
+    return { reply: await arrive(door, { id: h.id }, payload.method, args, true), ephemeralPk, heard: true };
   };
 
   // The door itself. Always answers bytes. When the ask did not open, the
@@ -82,13 +103,14 @@ export function makeDoor(key: WardKey, heirs: Heirs, doors: Map<string, Door>, p
   // A lid that is not a key -- a small-order point, of which the two curves
   // have several each -- makes a dead agreement, and the seal refuses it. The
   // door never throws: that reply is noise, sealed to a key nobody holds.
-  return async function door(bytes: Uint8Array): Promise<Uint8Array> {
+  return async function door(bytes: Uint8Array): Promise<Judged> {
     const out = await judge(bytes);
     const reply = out?.reply ?? SILENCE;
+    const heard = out?.heard ?? false;
     try {
-      return await sealReply(reply, out?.ephemeralPk ?? lid(bytes, random), key.sign, random(32));
+      return { bytes: await sealReply(reply, out?.ephemeralPk ?? lid(bytes, random), key.sign, random(32)), heard };
     } catch {
-      return sealReply(reply, (await sealingPair(random(32))).pk, key.sign, random(32));
+      return { bytes: await sealReply(reply, (await sealingPair(random(32))).pk, key.sign, random(32)), heard };
     }
   };
 }

package/src/ward/ground.ts

@@ -28,8 +28,12 @@ export type Ground = {
   random(n: number): Uint8Array; // entropy. every key a ward mints is drawn from it
 };
 
-// What a ward hands back. Two pointers.
+// What a ward hands back. Two pointers. The door answers bytes, always, and
+// one bit beside them: whether a key it holds spoke. That is all a harbor
+// learns from an arrival, and it is what a harbor can act on -- a pk that
+// only ever brings strangers' bytes is the harbor's to rate or refuse. Never
+// a reason: the reason is sealed to the asker's lid, and is theirs.
 export type WardPointers = {
-  door(bytes: Uint8Array): Promise<Uint8Array>;
+  door(bytes: Uint8Array): Promise<{ bytes: Uint8Array; heard: boolean }>;
   ask(method?: string, args?: Record<string, unknown>): Promise<unknown>;
 };

package/src/ward/heirs.ts

@@ -4,7 +4,8 @@
 // speak, and so may the key it announced last time. A knock is the first
 // use of the heir, which the inviter announced on your behalf, and the heir
 // dies as it speaks.
-import type { Heir, Partition } from './partition.ts';
+import type { DoorWord } from '../being/types.ts';
+import { GONE, type Heir, type Partition } from './partition.ts';
 
 // How wide the span is, is the ward's own — wider is more forgiving of a
 // rough road, and no peer can tell the difference except by being refused.
@@ -18,8 +19,22 @@ export class Heirs {
   open(heir: string, being: string, id: string): void {
     this.#p.heirs[heir] = { being, id, current: heir, announced: null, fresh: true, mark: 0, spent: [] };
   }
+  // The id was removed. The heir is forgotten, and its last keys are kept
+  // apart, bounded, so that whoever still holds them hears `removed` at the
+  // door, once they have signed as themselves, and nobody else hears a thing.
   close(heir: string): void {
+    const h = this.#p.heirs[heir];
+    if (!h) return;
     delete this.#p.heirs[heir];
+    this.#p.gone[heir] = { current: h.current, announced: h.announced };
+    const keys = Object.keys(this.#p.gone);
+    for (const old of keys.slice(0, Math.max(0, keys.length - GONE))) delete this.#p.gone[old];
+  }
+  // May `by` speak for a relation she removed? True only for the keys the
+  // door held when the id went, which nobody but their holder has.
+  gone(heir: string, by: string): boolean {
+    const g = this.#p.gone[heir];
+    return !!g && (by === g.current || by === g.announced);
   }
   get(heir: string): Heir | undefined {
     return this.#p.heirs[heir];
@@ -63,10 +78,10 @@ export class Heirs {
   // neither: a call that binds nothing must not burn a number on its way to
   // being refused, or a stranger who cannot be heard would still leave a mark
   // behind her. Every write below this line is one that is going to hold.
-  honour(h: Heir, by: string, next: string | null, seq: number): boolean {
-    if (h.fresh && next === null) return false; // a knock without a key of her own binds nothing
-    if (!this.spend(h, seq)) return false;
-    return this.settle(h, by, next);
+  honour(h: Heir, by: string, next: string | null, seq: number): true | DoorWord {
+    if (h.fresh && next === null) return 'unannounced'; // a knock without a key of her own binds nothing
+    if (!this.spend(h, seq)) return 'repeated';
+    return this.settle(h, by, next) ? true : 'unannounced';
   }
 
   // The signature checked out. Settle the keys: a fresh heir rotates at once

package/src/ward/owner.ts

@@ -4,7 +4,7 @@
 // describe, boot, invite, knock, remove. The knock is a being's knock made
 // for her, and the standing is written into her cells under the id the
 // owner gave; remove takes a relation out of her by id, the mirror of it.
-import { isSilence, isUnreached } from '../being/silence.ts';
+import { isSilence, isWord, wordOf } from '../being/silence.ts';
 import { digest } from '../being/digest.ts';
 import { OWNER } from '../being/types.ts';
 import type { Asker, Invitation, Json, JsonObject, Wanted } from '../being/types.ts';
@@ -78,7 +78,8 @@ export async function ownerAnswer(w: OwnerSide, asker: Asker, method: string | u
     // The owner is a caller like any other and may say what this knock may
     // spend. Saying nothing is the ward's default, as it is for a being.
     const out = await door.stance.standings.knock(inv, args.method as string | undefined, (args.args as JsonObject) ?? {}, args.wanted as Wanted | undefined);
-    if (isSilence(out) || isUnreached(out)) return { error: isUnreached(out) ? 'unreached' : 'silence' };
+    if (isSilence(out)) return { error: 'silence' };
+    if (isWord(out)) return { error: wordOf(out) }; // the owner hears objects: the word is the error's name
     return { taken: await door.stance.standings.take(id, inv), answer: out as Json };
   }
   if (method === 'remove') {
@@ -109,7 +110,7 @@ async function describe(w: OwnerSide): Promise<Json> {
     let d: string | null = null;
     try {
       const bp = await (door.being.answer as (a: unknown) => unknown)({ id: OWNER });
-      d = isSilence(bp) || isUnreached(bp) ? null : await digest(bp as Json);
+      d = isSilence(bp) || isWord(bp) ? null : await digest(bp as Json);
     } catch {
       // she threw where she was asked. there is no blueprint, and d stays null.
     }

package/src/ward/partition.ts

@@ -78,11 +78,20 @@ export type Bind = {
   minted: string[]; // the last eight pks her side minted. inner. a test reads it
 };
 
+// A relation she removed, as the door remembers it: the keys that may still
+// speak for it, so their holder hears `removed` and a stranger still hears
+// silence. Nothing else survives the removal. The list is bounded, oldest
+// out, because a door that remembered every relation ever ended would grow
+// for as long as she keeps inviting.
+export type Gone = { current: string; announced: string | null };
+export const GONE = 256;
+
 export type Partition = {
   version: string;
   beings: Record<string, Cells & { class?: string }>; // key -> her cells
   bind: Record<string, Bind>; // key -> her bind table
   heirs: Record<string, Heir>; // heir pk -> occupant, across every being of the ward
+  gone: Record<string, Gone>; // heir pk -> the last keys of a relation she removed
   public: string | null; // the one public being's key
 };
 
@@ -101,6 +110,7 @@ export function open(memory: Record<string, unknown>): Partition {
   p.beings ??= {};
   p.bind ??= {};
   p.heirs ??= {};
+  p.gone ??= {};
   p.public ??= null;
   return p;
 }

package/src/ward/seal.ts

@@ -18,8 +18,9 @@
 // itself. The door opens every ask with its own padlock and reads `to` after,
 // so nothing was ever gained by having it in the clear.
 //   reply on the wire   box = eph X pk || AESGCM( reply || signature )       sealed to the ask's eph pk
-//                       reply = JSON { object, seen } | { silence: true }    signed by the ward key
-import type { Json, JsonObject } from '../being/types.ts';
+//                       reply = JSON { object, seen } | { silence: true } | { quo: word }    signed by the ward key
+import type { DoorWord, Json, JsonObject } from '../being/types.ts';
+import { isDoorWord } from '../being/silence.ts';
 import { KEY, SIGNATURE, box, concat, hex, sha256, sign, signingPair, sealingPair, unbox, unhex, verify } from './arithmetic.ts';
 
 const utf8 = new TextEncoder();
@@ -58,7 +59,7 @@ export type AskPayload = { by: string; next: string | null; seq: number; time: n
 // What is actually sealed: the payload with the heir it is for, or null for
 // the public being. `to` is signed with the rest, so it cannot be moved.
 type Sealed = AskPayload & { to: string | null };
-export type ReplyPayload = { object: Json; seen: string | null } | { silence: true };
+export type ReplyPayload = { object: Json; seen: string | null } | { silence: true } | { quo: DoorWord };
 
 // Seal an ask. Returns the bytes and the ephemeral secret the reply will be sealed to.
 export async function sealAsk(to: string | null, payload: AskPayload, signer: Uint8Array, padlock: Uint8Array, seed: Uint8Array): Promise<{ bytes: Uint8Array; ephemeral: Uint8Array }> {
@@ -109,8 +110,9 @@ export async function sealReply(reply: ReplyPayload, ephemeralPk: Uint8Array, wa
 // Open a reply with the ephemeral secret kept from the ask, and verify it
 // came from the ward it was sent to. Null is silence: it did not open, it
 // lied, or it is not a reply. Every ward on the wire is somebody else's code,
-// so the shape is checked here and nowhere later: a reply is `{ silence }`
-// or `{ object, seen }` with an object present and seen a digest or null.
+// so the shape is checked here and nowhere later: a reply is `{ silence }`,
+// `{ quo: word }` with a word the door may say, or `{ object, seen }` with an
+// object present and seen a digest or null.
 // Anything else is bytes that said nothing, and her ward never hands her a
 // throw or an absent value for what a stranger wrote.
 export async function openReply(bytes: unknown, ephemeralSecret: Uint8Array, signPk: Uint8Array): Promise<ReplyPayload | null> {
@@ -124,6 +126,7 @@ export async function openReply(bytes: unknown, ephemeralSecret: Uint8Array, sig
     if (reply === null || typeof reply !== 'object' || Array.isArray(reply)) return null;
     const r = reply as Record<string, unknown>;
     if (r.silence === true) return { silence: true };
+    if (Object.hasOwn(r, 'quo')) return isDoorWord(r.quo) ? { quo: r.quo } : null;
     if (!Object.hasOwn(r, 'object') || r.object === undefined) return null;
     if (r.seen !== null && !(typeof r.seen === 'string' && /^[0-9a-f]{64}$/.test(r.seen))) return null;
     return { object: r.object as Json, seen: r.seen };