@quo-systems/quo 0.1.1 → 0.2.0

package/SPEC.md

@@ -94,9 +94,13 @@ gap in Quo or a leak into the ward. The shape is `Ground` in
 
 Returned:
 
-- **The door.** One call: sealed bytes in, sealed bytes out. Always bytes:
+- **The door.** One call: sealed bytes in, sealed bytes out, and one bit
+  beside them, `heard`: whether a key this door holds spoke. Always bytes:
   when the ask did not open, the reply is silence sealed to whatever ephemeral
-  pk the bytes carried, and noise when they carried none.
+  pk the bytes carried, and noise when they carried none. The bit is all a
+  harbor learns from an arrival, never a reason: a pk that only ever brings
+  strangers' bytes is the harbor's to rate or refuse, and what a bound key
+  hears is sealed to its own lid.
 - **The ask.** One call: method and args in, object or silence out.
   In-process and unsealed. This is the one unsealed ask in Quo, and the only
   way a ward is piloted. Judgment, catching, and the return table are not
@@ -132,10 +136,10 @@ stance
   occupants.invite(id)                                 -> invitation | null      awaitable: a key is minted
   occupants.remove(id)                                 -> nothing
 
-  standings.knock(invitation, method?, args?, wanted?) -> object | silence | unreached
+  standings.knock(invitation, method?, args?, wanted?) -> object | silence | word
   standings.take(id, invitation)                       -> id | null            awaitable: it waits for the relation
   standings[id]                                        -> standing | undefined
-  standings[id].ask(method?, args?, wanted?)           -> object | silence | unreached
+  standings[id].ask(method?, args?, wanted?)           -> object | silence | word
   standings.remove(id)                                 -> nothing
 
   wanted = { time? }                                   what this one ask may spend, in milliseconds. optional,
@@ -150,16 +154,16 @@ Return table.
 |                     | null       | the id already names a record, occupant or standing, or is a reserved word                                   |
 | remove(id)          | nothing    | always. removing what is not there is nothing                                                                |
 | knock(inv, m, a, w) | object     | the far being answered                                                                                       |
-|                     | silence    | no ward claims the invitation, or she removed the id, or another consumed it, or the far being chose silence |
-|                     |            | or the invitation is not one, or the wait ran out                                                            |
-|                     | unreached  | her ward could not reach the far door, or could not seal the args                                            |
+|                     | silence    | no ward claims the invitation, or another consumed it, or the far being chose silence                        |
+|                     | word       | why not, when the far door or her own ward can say: removed, absent, unannounced, repeated,                  |
+|                     |            | threw, unreached, late, invitation. see "Silence, the words, error"                                          |
 | take(id, inv)       | id         | she knocked with this invitation and was answered, and the id is fresh                                       |
 |                     | null       | no answered knock on this invitation, or the id already names a record, or is a reserved word                |
 | standings[id]       | standing   | the record exists                                                                                            |
 |                     | undefined  | it does not. not an error                                                                                    |
 | ask(m, a, w)        | object     | she answered                                                                                                 |
-|                     | silence    | she, or her ward, said nothing; or the wait ran out                                                          |
-|                     | unreached  | her ward could not reach the far door, or could not seal the args                                            |
+|                     | silence    | she chose to say nothing, or bytes came back that are not Quo's                                              |
+|                     | word       | why not: removed, absent, repeated, threw, unreached, late, dropped                                          |
 
 Ask, knock, invite and take are awaitable. Async where the language has it,
 blocking where it does not. Every ask she makes is a new call.
@@ -175,16 +179,19 @@ The asker has three shapes and no fourth, and nothing else ever reaches her.
 `OWNER` and `PUBLIC` are reserved words: invite and take refuse them, so no
 occupant can ever wear either name.
 
-## Silence, unreached, error
+## Silence, the words, error
 
-Three words for "no object came back", and only three. Everything in Quo
-that can go wrong ends in one of them, and a being who knows the three never
-needs a fourth.
+Three kinds of answer to "no object came back", and only three. Everything in
+Quo that can go wrong ends in one of them, and a being who knows the three
+never needs a fourth.
 
 ```
 error       an object. hers.             { error: ... }, or any shape her output schema declares.
-silence     the ward's word. heard.       bytes came back, or would have, and said nothing.
-unreached   the ward's word. not heard.   nothing came back. nothing is known to have been delivered.
+silence     the ward's silence.          bytes came back, or would have, and said nothing.
+                                         it is what a stranger hears, and what she hears when
+                                         the far being chose to say nothing.
+a word      the ward's word.             one of nine, said only to someone the ward can name,
+                                         and never to a stranger: why no object came.
 ```
 
 - An **error** is an ordinary answer. Quo never reads it, never makes it,
@@ -192,42 +199,75 @@ unreached   the ward's word. not heard.   nothing came back. nothing is known to
   `{ error: 'unknown ask' }` for an ask she did not declare or hid; the
   owner's asks answer error objects for what they refuse; both are hers to
   read like any object.
-- **Silence** is not blindly retryable: the far being may have done the work
-  and the answer was lost.
+- **Silence** names no reason, by law. It is what the door says to bytes it
+  cannot admit, so that a stranger learns nothing, and what a being says
+  when she chooses to say nothing. It is not blindly retryable: the far
+  being may have done the work and the answer was lost.
+- **A word** names the reason. It is said to a key the door has bound, sealed
+  to that key's lid, or by her own ward to her, in process. Nobody else ever
+  hears one. A word is not an object: it carries nothing but its name, a
+  being cannot make one, and one that comes out of a being is read as her
+  having thrown.
+
+The nine words, and who says them:
+
+```
+the door, to a key it has bound, on the wire as { quo: word }
+  removed        the relation this key spoke for was removed by the being who invited it
+  absent         the being who invited it did not come back this run; her cells wait
+  unannounced    the knock announced no key of her own, so it bound nothing
+  repeated       the number was already honoured, or is at or below the span
+  threw          she threw, or answered a shape that is not hers to make
+
+her own ward, to her, and never on the wire
+  unreached      no far door was reached. nothing is known to have been delivered.
+  late           the wait ran out. the far door may have heard and be working still.
+  invitation     the invitation is not one. nothing was sent.
+  dropped        she dropped the standing, and asked on what she held. nothing was sent.
+```
+
 - **Unreached** is safe to retry: nothing is known to have been delivered.
-  It carries no reason. What she may know is that nothing came back, and
-  that is all. In one case the far ward heard and died before it could
-  answer, and the wire says nothing about it; asking again asks under the
-  next number and is heard, so the retry is safe all the same. See Closed.
-
-Who says what. A being says objects and silence, never unreached: the shape
-is the ward's, and a ward that sees it come out of a being reads it as
-silence. A ward says all three to its own being, and only objects and
-silence on the wire: unreached never crosses, it is the wire's nothing
-turned into a word. A harbor says nothing at all; it returns bytes or
-nothing, and does not know the word silence. The owner hears objects: a
-silence a being met is `{ error: 'silence' }` and an unreached is
-`{ error: 'unreached' }`, because the owner is piloting and an object is
+  In one case the far ward heard and died before it could answer, and the
+  wire says nothing about it; asking again asks under the next number and
+  is heard, so the retry is safe all the same. See Closed.
+- **Late** is not unreached, and the difference is the whole reason there are
+  two words: a bound that expired promises nothing about delivery.
+- **Removed**, **absent**, **unannounced** and **repeated** are refusals: the
+  ask reached no being and nothing was written. They are said only because
+  the key that asked has already proven who it is, so a reason to it is an
+  oracle to nobody. **Threw** is a choice: she was reached, and the number is
+  spent.
+
+Who says what. A being says objects and silence, never a word: the shape is
+the ward's, and a ward that sees one come out of a being answers `threw`. A
+ward says all three to its own being, and on the wire objects, silence and
+the five door words, each sealed to the lid of the key that asked; the four
+ward words never cross, they are her own ward's and are said in process. A
+harbor says nothing at all; it returns bytes or nothing, and does not know
+any of these words. What it learns from an arrival is one bit, `heard`,
+beside the bytes the door hands it: whether a key the door holds spoke. The
+owner hears objects: a silence a being met is `{ error: 'silence' }` and a
+word is `{ error: word }`, because the owner is piloting and an object is
 what a shell can print. The ask pointer answers the value silence only when
 the ward itself threw.
 
-### What her ward turns into silence
+### What her ward says to her
 
-Before or after the wire, her own ward answers silence in five cases, and
-tells her nothing about which.
+Before or after the wire, her own ward answers on its own in five cases,
+and each says what it is.
 
 ```
 S1  the invitation is not one         a shape that is not a ward pk, a heir with no secret, a secret with no heir.
-                                      nothing is sent.
+                                      nothing is sent. the word is `invitation`.
 S2  the standing is gone              she held a standing, dropped it, and asked on what she held.
-                                      nothing is sent. an ask issued while it stood is answered.
+                                      nothing is sent. an ask issued while it stood is answered. the word is `dropped`.
 S3  the wait ran out                  the ask's time was spent and no reply was read.
                                       what comes back late is not read. the number is spent.
-                                      an ask still waiting at its lane when the wait ran out is never sent.
+                                      an ask still waiting at its lane when the wait ran out is never sent. the word is `late`.
 S4  the reply is not one              bytes came back that do not open, or are not signed by the ward they
-                                      were sent to, or are not `{ silence }` nor `{ object, seen }` with an
-                                      object present and seen a digest or null. the number is spent.
-S5  the far door said silence         every case in the next list.
+                                      were sent to, or are none of the three reply shapes. the number is spent.
+                                      not Quo's bytes: silence.
+S5  the far door answered             silence, or a word, exactly as the door said it.
 ```
 
 And unreached in two: `U1` the args are not a value, or could not be
@@ -236,69 +276,83 @@ sealed, so nothing left;
 taken all the same, and the gap it leaves in the count is harmless: the door
 honours any number above its mark.
 
-### What the door turns into silence
+### What the door says
 
-The door answers one silence in thirteen cases. The first ten are refusals:
-the ask reached no being, and nothing was written, spent, rotated or
-touched. The last three are choices: the ask reached her, so the number is
-spent and the keys are rotated, and what she wrote in her cells is hers.
+The door judges thirteen cases, in this order, and the first case met is
+the answer. The first seven are strangers: bytes the door cannot admit, met
+with one silence whatever the case, and nothing written. The next three are
+refusals to a key the door has bound: still nothing written, but a word,
+because the asker has proven who it is. The last three are choices: the ask
+reached her, so the number is spent and the keys are rotated, and what she
+wrote in her cells is hers.
 
 ```
-refusals
+strangers: silence, nothing written, heard false
 D1   the box does not open           wrong padlock, garbage, too short. the reply is sealed to the lid if
                                      the bytes carried one, and is noise otherwise. a lid that will not
                                      take a seal, a small-order point, is no lid: noise.
 D2   the payload is malformed        by or next not 64 hex, method not a string, args not an object, seq
-                                     below one, time not a whole number above zero.
+                                     below one, time not a whole number above zero, hops not a whole
+                                     number or at zero.
 D3   for nobody, and nobody is home  no public being on this ward.
 D4   for nobody, signature fails     the payload names a key it was not signed with.
-D5   the heir is not held            never minted here, or forgotten because the id was removed.
+D5   the heir is not held            never minted here, and not one she removed either.
 D6   the key is not admitted         not the key held for the heir, and not the key it announced. a
-                                     forged key, an unannounced key, a heir already spent.
-D7   she is not there                the occupant record is gone, or the being did not come back this run.
-D8   signature fails                 under an admitted key.
-D9   a knock announces nothing       the heir is fresh and next is null. it binds nothing.
-D10  the number is refused           already honoured, or at or below the span.
-choices
-D11  she threw
+                                     forged key, an unannounced key, a heir already spent. a heir she
+                                     removed, under a key that was not the one she removed.
+D7   signature fails                 under an admitted key, or under the key held for a heir she removed.
+refusals to a bound key: a word, nothing written, heard true
+D8   she is not there                `removed`: the occupant record is gone, and this is the key it was
+                                     bound to when it went. `absent`: the being did not come back this run.
+D9   a knock announces nothing       `unannounced`: the heir is fresh and next is null. it binds nothing.
+D10  the number is refused           `repeated`: already honoured, or at or below the span.
+choices: the number spent, the keys rotated, heard true
+D11  she threw                       `threw`
 D12  she answered silence            on a named ask, or on the empty ask. nothing at all is silence too.
-D13  she answered an unreached shape
+D13  she answered a word             `threw`: a word is not hers to make.
 ```
 
-A refusal is judged in that order, and the first case met is the answer.
-The signature is verified before the number is spent, so a stranger cannot
-burn a number she could not sign for; a refusal at D9 or D10 has passed the
-signature and still writes nothing.
+The signature is verified before anything is written and before any word is
+said, so a stranger cannot burn a number she could not sign for and cannot
+hear a word she could not sign for. The public being is asked by strangers
+only, and a stranger hears silence for whatever she then does: her choices
+are hers, and her insides are not a stranger's to read.
+
+A removed relation leaves the door one thing: the keys it held for that
+heir when the id went, kept apart from the heirs under `gone` in the
+partition, bounded, oldest out. That is what lets the door say `removed` to
+the one party who can sign as those keys, and silence to everyone else.
+Nothing else survives a removal.
 
 ### The law of one silence
 
-1. Every case above is one reply: `{ silence: true }`, sealed to the lid the
-   ask came with, signed by the ward key. Same bytes, same length. A
-   stranger cannot tell a refusal from a choice, nor one refusal from
-   another, nor any of them from a being who chose to say nothing.
+1. Every stranger's case is one reply: `{ silence: true }`, sealed to the
+   lid the ask came with, signed by the ward key. Same bytes, same length.
+   A stranger cannot tell one refusal from another, nor any of them from a
+   being who chose to say nothing.
    The door equalizes the bytes and not the time it took to write them. The
-   ten refusals are cheap and alike; a choice ran a being first, and a being
-   is code this document does not bound. So whoever holds a standing may
-   learn from a clock that she was reached and said nothing, rather than
-   refused at the door. A stranger holds no standing and reaches no choice,
-   which is why the refusals are the ones made alike. Equalizing the time
-   would mean waiting out the allowance ceiling on every silence, and the
-   door will not buy that.
+   seven cases are cheap and alike. A word, to a key the door has bound, is
+   another length, and may be: whoever hears it has already proven who they
+   are.
 2. A refusal writes nothing. No number, no key, no heir, no cell, no bind.
    The same bytes presented again meet the same refusal, and a stranger who
-   knocks a thousand times leaves no mark.
+   knocks a thousand times leaves no mark. This holds for the three
+   refusals a bound key hears just the same: a word costs nothing.
 3. A choice writes what a heard ask writes. The number is spent and the keys
    rotate, so the relation goes on: the next ask on it is answered, and a
-   silence never kills a standing.
-4. Silence leaves the caller's record as it was. A silent named answer
-   leaves `seen` untouched; a silent empty ask leaves `blueprint` and
-   `digest` untouched.
-5. Her ward never confuses her. Silence and unreached are told apart
-   always, and by nothing else: silence is bytes the far ward wrote, or a
-   bound her ward rang; unreached is the wire's nothing. A ward never
-   answers nothing, so that nothing always means unreached.
-6. Nobody enforces what a being does with silence. It is one value she
-   compares against, and the base class hands it to her unchanged.
+   silence or a `threw` never kills a standing.
+4. Silence and a word leave the caller's record as it was. A silent named
+   answer leaves `seen` untouched; a silent empty ask leaves `blueprint` and
+   `digest` untouched; a word moves neither, and her keys do not rotate on
+   one.
+5. Her ward never confuses her. Silence, a word and unreached are told apart
+   always, and by nothing else: silence is bytes the far ward wrote and
+   chose to say nothing with; a word is a reason, from the far door or her
+   own ward; unreached is the wire's nothing. A ward never answers nothing,
+   so that nothing always means unreached.
+6. Nobody enforces what a being does with silence or a word. Each is one
+   value she compares against, and the base class hands them to her
+   unchanged.
 
 `test/silence.test.ts` asserts every numbered line above, by its number.
 
@@ -324,15 +378,17 @@ nothing was written down that a harbor would later have to lie about. This
 holds all the way down: a container read through her cells is part of her
 cells. The guard is `src/ward/cells.ts`.
 
-### Silence and unreached
+### Silence and the words
 
-Two of the three words for "no object came back". The chapter "Silence,
-unreached, error" is the whole of them; here only the values. Silence is one
-distinguished value. Null is an answer. Unreached is a second distinguished
-value, her ward's own word. Neither is an object, and neither carries
-anything. In this kit silence is the symbol `quo.silence` and unreached is a
-frozen object under the symbol key `quo.unreached`, both from
-`src/being/silence.ts`.
+Two of the three kinds of "no object came back". The chapter "Silence, the
+words, error" is the whole of them; here only the values. Silence is one
+distinguished value. Null is an answer. A word is a second kind of
+distinguished value, her ward's own, nine of them, `unreached` among them.
+None is an object, and none carries anything but its name. In this kit
+silence is the symbol `quo.silence` and a word is a frozen object under the
+symbol key `quo.word` holding its name, both from `src/being/silence.ts`;
+`isWord` and `wordOf` read them, and `isUnreached` is the one word a being
+asks about most.
 
 ### Blueprint, schema, digest
 
@@ -670,13 +726,15 @@ Every arrival is judged by the door, and named by it or falls silent.
 2. For nobody: find the public being, verify the signature under the key the
    payload names, and dispatch as `{}`. Nothing is written.
 3. For a heir: admit the signer if it is the key held for that heir or the
-   key that key announced. Find the being who minted the id and check she
-   still holds the occupant. Verify the signature. Only then spend the
-   number and settle the keys, so a stranger cannot burn a number she could
-   not sign for, and the same bytes twice rotate nothing. Dispatch as
-   `{ id }`.
-4. Catch every throw and answer silence. Treat an unreached shape coming out
-   of a being as silence.
+   key that key announced, or the key held when she removed the id. Verify
+   the signature. Only then say anything or write anything: a removed
+   relation is `removed`, a being not back this run is `absent`, a knock
+   with no key is `unannounced`, a number already honoured is `repeated`,
+   and none of those writes. Else spend the number and settle the keys, so
+   a stranger cannot burn a number she could not sign for, and the same
+   bytes twice rotate nothing. Dispatch as `{ id }`.
+4. Catch every throw and answer `threw` to a bound key, silence at the
+   public being. Treat a word coming out of a being as a throw.
 5. On every answered named ask, run her describe for that asker in process,
    hash it, and put the digest next to the object in the reply. One trip. A
    describe that throws or falls silent costs the digest and nothing else.
@@ -684,7 +742,7 @@ Every arrival is judged by the door, and named by it or falls silent.
 6. Answer by the same call the ask came in on.
 
 A stranger is bytes the ward cannot admit, and every way of being one is
-listed, with a number, under "Silence, unreached, error". The public being
+listed, with a number, under "Silence, the words, error". The public being
 is the one door a stranger may walk through, and only because she chose it.
 
 ### Inner and outer
@@ -729,7 +787,8 @@ ask on the wire     box     = ephemeral X25519 pk (32) || AES-GCM( payload || si
                               refused at zero, and nothing sets it.
 reply on the wire   box     = ephemeral X25519 pk (32) || AES-GCM( reply || signature (64) )
                               sealed to the ask's ephemeral pk, signed by the ward key
-                    reply   = JSON { object, seen } | { silence: true }
+                    reply   = JSON { object, seen } | { silence: true } | { quo: word }
+                              word: removed | absent | unannounced | repeated | threw. only to a key the door bound.
 ```
 
 Nothing rides outside the box, and `to` is the reason to say so. A heir is
@@ -819,6 +878,8 @@ partition
               answered    <ward>:<heir> | public:<ward> -> true                            knocked and answered
               minted      the last eight pks her side minted
   heirs     heir pk -> { being, id, current, announced, fresh, mark, spent }   the door's view of every occupant
+  gone      heir pk -> { current, announced }   the keys held when an id was removed, bounded, so their
+                                                holder hears `removed` and nobody else hears a thing
   public    the one public being's key, or null
 ```
 
@@ -852,8 +913,9 @@ before the restart can be taken after it; a door that restarts still refuses
 what it already honoured.
 
 A constructor that throws on a restart takes only herself down: she is
-absent this run, no door, so silence at her door, and her cells sit untouched
-waiting for the run that can read them. The ward is up and so is everyone
+absent this run, no door, so `absent` at her door to the keys she bound and
+silence to strangers, and her cells sit untouched waiting for the run that
+can read them. The ward is up and so is everyone
 else. A class the harbor no longer knows is the same absence, and so is a
 class the harbor holds at a body the cells were not written for: which body
 a ward reboots on is the harbor's decision, and a ward cannot tell an old
@@ -972,7 +1034,8 @@ Not stressed with:
   from nothing else. There is no estate. The far being is sovereign: she may
   fall silent on the ask after the knock, and nobody is told.
 - Blacklists, rate limits, and what to do with a pk that keeps knocking with
-  garbage. Its own.
+  garbage. The door says `heard` or not beside every reply; the rest is the
+  harbor's.
 
 ## The harbor
 
@@ -1004,7 +1067,9 @@ The harbor:
   never answers nothing on its own patience; it waits, and the ward's bound
   ends the ask.
 - Receives bytes from the wire for a ward pk it holds, hands them to that
-  one door, and returns what the door returned.
+  one door, and returns what the door returned. Beside the bytes the door
+  says whether a key it holds spoke; the harbor may count that per pk and
+  act on it, and learns nothing more.
 - Vouches: the seed stays secret, the partition is reached by this ward
   alone, the ask reaches its root owner alone, the device is the harbor's
   to defend. How is the device's business. Custody is this vouch: two
@@ -1147,7 +1212,7 @@ class. Her ward does all of that, and she trusts it blindly: what the ward
 names is true.
 
 She asks her standings by method and args and gets back an object, silence,
-or unreached. She invites whom she wants, in her own time, and removes them
+or a word. She invites whom she wants, in her own time, and removes them
 when she decides. She knocks with invitations she was given and takes the
 ones she wants. She answers every ask her ward brings her with an object or
 silence; an error is an ordinary object, and she never throws outward. She
@@ -1160,9 +1225,10 @@ only the ward instantiates.
 
 ### Her obligations
 
-1. Args are one object. A throw is silence outside: the ward is in the
-   middle of every call and catches, always, in every language. An error is
-   an object her output schema declares.
+1. Args are one object. A throw is the word `threw` outside, to whoever the
+   door has bound, and silence to a stranger: the ward is in the middle of
+   every call and catches, always, in every language. An error is an object
+   her output schema declares.
 2. No lifecycle. Construction with the stance is birth. A restart is silent.
 3. The empty ask is hers. Who gets what blueprint is her decision. She obeys
    the shape, never a content. The empty ask must be safe to repeat: her
@@ -1327,7 +1393,7 @@ alone, one JavaScript file and one declaration file per source file with
 every relative import rewritten, and the exports map points there, types
 beside default. The
 build runs before every gate and every publish and is never tracked;
-nothing under `test/` or `estate/` imports it except through the package
+nothing under `test/` or `dock/` imports it except through the package
 name, which is how a consumer does. `test/package.test.ts` is the one
 suite that meets the package as a stranger: it packs the tarball,
 installs it into an empty folder, and imports every entry point under
@@ -1347,7 +1413,7 @@ test/             the suites.
 vectors/          fixed inputs and outputs: the arithmetic, Quo's own framing, the frames on the wire.
 ```
 
-`estate/` sits beside `src` and is not Quo: the beings, screens, model sides
+`dock/` sits beside `src` and is not Quo: the beings, screens, model sides
 and real harbors built on it, each folder with its own document. This
 document does not read them, and they may not add a word to it. Its one
 claim on them is that every harbor there passes `src/conformance/` untouched.
@@ -1414,10 +1480,11 @@ passes the same suite. Those tests are the checklist, not the mock.
   replay, a restart, and every byte on the wire inspected for anything inner.
 - `test/public.test.ts`: the public being, what the door does and does not
   do for her.
-- `test/silence.test.ts`: the chapter "Silence, unreached, error" by its
-  numbers: the five silences and two unreacheds of her ward, the thirteen
-  cases of the door with a partition snapshot under each, hops refused at
-  zero, and the six lines of the law of one silence.
+- `test/silence.test.ts`: the chapter "Silence, the words, error" by its
+  numbers: the five cases and two unreacheds of her ward, the thirteen
+  cases of the door with a partition snapshot under each, seven strangers
+  met with one silence and six bound keys hearing their word, hops refused
+  at zero, and the six lines of the law of one silence.
 - `test/blueprint.test.ts`: blueprints and instantiation through a real
   ward. What a boot leaves behind, what a restart brings back when the code
   moved under the cells, the gate and the door, the reserved ids.
@@ -1608,8 +1675,12 @@ Decided here, so that the answer is not rediscovered:
 - **blueprint**: her interface as she chooses to show it to one asker.
 - **digest**: SHA-256 over the JCS of a blueprint. Per relation.
 - **seen**: the digest her ward last saw arrive with an answer.
-- **silence**: the far side said nothing. Not retryable blindly.
-- **unreached**: her ward could not reach the far door. Retryable.
+- **silence**: the far side said nothing, or the door would not admit the
+  bytes. Names no reason. Not retryable blindly.
+- **word**: the ward's reason, said only to a key the door has bound or by
+  her own ward to her. Nine: removed, absent, unannounced, repeated, threw,
+  unreached, late, invitation, dropped.
+- **unreached**: the word for no far door reached. Retryable.
 - **notes**: hers, inside every occupant record. Quo never reads it.
 - **partition**: the ward's files. Everything durable, every secret.
 - **ward record**: what a harbor keeps to boot one ward again: seed,

package/dist/being/index.d.ts

@@ -1,5 +1,5 @@
 export { Being, type AskSpec } from './being.ts';
-export { silence, isSilence, unreached, isUnreached } from './silence.ts';
+export { silence, isSilence, unreached, isUnreached, word, isWord, wordOf, DOOR_WORDS, isDoorWord } from './silence.ts';
 export { digest, canonical } from './digest.ts';
 export { OWNER, PUBLIC, RESERVED_IDS } from './types.ts';
 export type * from './types.ts';

package/dist/being/index.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 // @quo-systems/quo — the Being side. What a being author imports, if anything.
 export { Being } from './being.js';
-export { silence, isSilence, unreached, isUnreached } from './silence.js';
+export { silence, isSilence, unreached, isUnreached, word, isWord, wordOf, DOOR_WORDS, isDoorWord } from './silence.js';
 export { digest, canonical } from './digest.js';
 export { OWNER, PUBLIC, RESERVED_IDS } from './types.js';

package/dist/being/silence.d.ts

@@ -1,5 +1,10 @@
-import { type Unreached } from './types.ts';
+import { type DoorWord, type Unreached, type Word, type WordName } from './types.ts';
 export declare const silence: unique symbol;
 export declare const isSilence: (x: unknown) => x is typeof silence;
+export declare const DOOR_WORDS: readonly DoorWord[];
+export declare const isDoorWord: (s: unknown) => s is DoorWord;
+export declare const word: <W extends WordName>(name: W) => Word<W>;
+export declare const isWord: (x: unknown) => x is Word;
+export declare const wordOf: (x: Word) => WordName;
 export declare const unreached: () => Unreached;
 export declare const isUnreached: (x: unknown) => x is Unreached;

package/dist/being/silence.js

@@ -1,11 +1,29 @@
 // SPDX-License-Identifier: Apache-2.0
 // Silence is one distinguished value. Null is an answer. Silence is no answer.
-import { UNREACHED_KEY } from './types.js';
+//
+// The ward's words are the other distinguished values: what her ward tells
+// her when no object came back and it knows why. Each is one frozen object
+// under one symbol key, so a being cannot make one by accident, none of them
+// crosses an edge as a value, and a being who compares against them needs
+// no fourth shape. `unreached` is one of them.
+import { WORD_KEY } from './types.js';
 export const silence = Symbol.for('quo.silence');
 export const isSilence = (x) => x === silence;
-// Unreached is the ward's own word: no far door was reached. It carries no
-// reason. Safe to retry, because nothing was delivered. A being cannot
-// produce it: a ward that sees it come out of a being treats it as silence.
-const UNREACHED = Object.freeze({ [UNREACHED_KEY]: true });
-export const unreached = () => UNREACHED;
-export const isUnreached = (x) => x !== null && typeof x === 'object' && x[UNREACHED_KEY] === true;
+// The words a door says to a key it has bound, and no other. They ride on
+// the wire as `{ quo: word }`, so a reply is checked against this list.
+export const DOOR_WORDS = ['removed', 'absent', 'unannounced', 'repeated', 'threw'];
+export const isDoorWord = (s) => typeof s === 'string' && DOOR_WORDS.includes(s);
+const WORDS = new Map();
+export const word = (name) => {
+    let w = WORDS.get(name);
+    if (!w)
+        WORDS.set(name, (w = Object.freeze({ [WORD_KEY]: name })));
+    return w;
+};
+export const isWord = (x) => x !== null && typeof x === 'object' && typeof x[WORD_KEY] === 'string';
+export const wordOf = (x) => x[WORD_KEY];
+// Unreached: no far door was reached. Nothing is known to have been
+// delivered, so asking again is safe. A being cannot produce it: a ward that
+// sees a word come out of a being reads it as her having thrown.
+export const unreached = () => word('unreached');
+export const isUnreached = (x) => isWord(x) && wordOf(x) === 'unreached';

package/dist/being/types.d.ts

@@ -45,11 +45,15 @@ export type Cells = {
     [hers: string]: Json;
 };
 export type Silence = typeof silence;
-export type Unreached = {
-    readonly [K in typeof UNREACHED_KEY]: true;
+export type DoorWord = 'removed' | 'absent' | 'unannounced' | 'repeated' | 'threw';
+export type WardWord = 'unreached' | 'late' | 'invitation' | 'dropped';
+export type WordName = DoorWord | WardWord;
+export declare const WORD_KEY: unique symbol;
+export type Word<W extends WordName = WordName> = {
+    readonly [K in typeof WORD_KEY]: W;
 };
-export declare const UNREACHED_KEY: unique symbol;
-export type Answer = Json | Silence | Unreached;
+export type Unreached = Word<'unreached'>;
+export type Answer = Json | Silence | Word;
 export type Reply = Json | Silence;
 export type Wanted = {
     time?: number;

package/dist/being/types.js

@@ -13,4 +13,4 @@
 export const OWNER = 'OWNER';
 export const PUBLIC = 'PUBLIC';
 export const RESERVED_IDS = [OWNER, PUBLIC];
-export const UNREACHED_KEY = Symbol.for('quo.unreached');
+export const WORD_KEY = Symbol.for('quo.word');

package/dist/conformance/beings.d.ts

@@ -85,7 +85,7 @@ export declare class Customer extends Being {
             };
         };
     };
-    join(invitation: Invitation): Promise<typeof import("../being/silence.ts").silence | import("../being/types.ts").Unreached | import("../being/types.ts").Json>;
+    join(invitation: Invitation): Promise<typeof import("../being/silence.ts").silence | import("../being/types.ts").Word | import("../being/types.ts").Json>;
     buy(item: string): Promise<import("../being/types.ts").Answer>;
     learn(): Promise<import("../being/types.ts").Answer>;
     hi(_args: JsonObject, asker: Asker): {