@quo-systems/quo 0.1.1 → 0.2.0

package/dist/conformance/beings.js

@@ -2,7 +2,7 @@
 // The fixture beings. Fixed, so that the ward is what varies. A printer, a
 // shop, a customer on the base class, and one raw being with no base at all.
 import { Being } from '../being/being.js';
-import { isSilence, isUnreached } from '../being/silence.js';
+import { isSilence, isUnreached, isWord } from '../being/silence.js';
 // A printer. Invites whom she is told to, prints for her occupants. Her
 // blueprint lives in her cells so a test can change her shape.
 export class Printer extends Being {
@@ -41,7 +41,7 @@ export class Shop extends Being {
     }
     async keepPrinter(invitation) {
         const bp = await this.knock(invitation);
-        if (isSilence(bp) || isUnreached(bp))
+        if (isSilence(bp) || isWord(bp))
             return false;
         this.cells.printerId = await this.take('prn', invitation);
         return true;
@@ -50,7 +50,7 @@ export class Shop extends Being {
         const rec = this.occupant(asker);
         if (rec?.notes.tier === 'gold' && invitation) {
             const back = await this.knock(invitation, 'hi');
-            if (!isSilence(back) && !isUnreached(back))
+            if (!isSilence(back) && !isWord(back))
                 await this.take(`vip-${asker.id}`, invitation);
         }
         return { welcome: true };
@@ -65,7 +65,7 @@ export class Shop extends Being {
         const out = await printer.ask('print', { doc: `receipt for ${item}` });
         if (isUnreached(out))
             return { error: 'printer unreachable', retry: true };
-        if (isSilence(out))
+        if (isSilence(out) || isWord(out))
             return { error: 'printer refused' };
         const st = this.cells.standings[id];
         if (st.seen !== st.digest)
@@ -85,7 +85,7 @@ export class Customer extends Being {
     async join(invitation) {
         const mine = (await this.invite('shop-back'));
         const out = await this.knock(invitation, 'hello', { invitation: mine });
-        if (isSilence(out) || isUnreached(out))
+        if (isSilence(out) || isWord(out))
             return out; // nothing was born
         await this.take('shop', invitation); // now, and only now
         return out;

package/dist/conformance/estate.js

@@ -33,9 +33,10 @@
 // A model that kept one symmetric edge would be a wrong model, and would
 // agree happily with a ward that had drifted.
 import { assert } from './assert.js';
-import { isSilence, isUnreached } from '../being/silence.js';
+import { isSilence, isUnreached, isWord, wordOf } from '../being/silence.js';
 import { Member } from './beings.js';
 const HEX64 = /^[0-9a-f]{64}$/;
+const said = (x, w) => isWord(x) && wordOf(x) === w;
 // A pseudo-random source in the language alone: the estate must replay, on
 // every terrain, from a number a failure can print.
 const rolls = (seed) => () => {
@@ -136,10 +137,11 @@ export function estate(label, make, { canDown, test }) {
         const back = (await partner.being.invite('acme'));
         assert.deepEqual(await acme.being.knock(back, 'ping'), { pong: 'acme' });
         assert.equal(await acme.being.take('them', back), 'them');
-        // 5. acme kicks her. her standing is still hers to hold -- she is never
-        //    told -- and it is silence from here on.
+        // 5. acme kicks her. her standing is still hers to hold, and she is not
+        //    told until she asks: then the door, under the key it bound for her,
+        //    says removed, and only to her.
         acme.being.occupants.remove('partner-1');
-        assert.ok(isSilence(await partner.being.standings['the-client'].ask('ping')));
+        assert.ok(said(await partner.being.standings['the-client'].ask('ping'), 'removed'));
         assert.deepEqual(Object.keys(partner.cells.standings), ['the-client']); // she never learns
         assert.deepEqual(await acme.being.standings.them.ask('ping'), { pong: 'acme' }); // the other arc never moved
         // 6. and back, as somebody else: a second invitation is a second relation,
@@ -148,7 +150,7 @@ export function estate(label, make, { canDown, test }) {
         assert.notEqual(second.heir, first.heir);
         assert.deepEqual(await partner.being.knock(second, 'ping'), { pong: 'partner-2' });
         assert.equal(await partner.being.take('the-client-again', second), 'the-client-again');
-        assert.ok(isSilence(await partner.being.standings['the-client'].ask('ping')));
+        assert.ok(said(await partner.being.standings['the-client'].ask('ping'), 'removed'));
         ledger(w.census(), undefined, 'the story');
     });
     for (const seed of [1, 2, 3]) {
@@ -193,6 +195,10 @@ export function estate(label, make, { canDown, test }) {
                             s.guest = guest;
                             s.answered = true;
                         }
+                        else if (!s.live && (s.guest === null || (s.guest === guest && (hold === undefined || hold.live)))) {
+                            // kicked, and she speaks under a key the door bound for this seat: she hears why
+                            assert.ok(said(back, 'removed'), `${guest} knocking kicked ${s.host}/${s.id} should hear removed`);
+                        }
                         else
                             assert.ok(isSilence(back), `${guest} knocking ${s.host}/${s.id} should be silence`);
                         return `${guest} knocks ${s.host}/${s.id}`;
@@ -274,7 +280,7 @@ export function estate(label, make, { canDown, test }) {
                     if (h.seat.live)
                         assert.deepEqual(out, { pong: h.seat.id }, `step ${step}: ${h.owner}/${h.id} -> ${h.seat.host}/${h.seat.id}`);
                     else
-                        assert.ok(isSilence(out), `step ${step}: ${h.owner}/${h.id} is kicked and should be silence`);
+                        assert.ok(said(out, 'removed'), `step ${step}: ${h.owner}/${h.id} is kicked and should hear removed`);
                 }
             };
             // The trace is the seed's own account of itself: a red run prints the

package/dist/conformance/index.js

@@ -19,12 +19,14 @@
 //
 // Every assertion here is the truth's. Nothing here knows how a ward is built.
 import { assert } from './assert.js';
-import { silence, isSilence, isUnreached } from '../being/silence.js';
+import { silence, isSilence, isUnreached, isWord, wordOf } from '../being/silence.js';
 import { digest } from '../being/digest.js';
 import { Printer, Shop, Customer, Echo, Member } from './beings.js';
 import { estate } from './estate.js';
 export { Printer, Shop, Customer, Echo, Member };
 const HEX64 = /^[0-9a-f]{64}$/;
+// Her ward's word, as she receives it.
+const said = (x, w) => isWord(x) && wordOf(x) === w;
 export function conform(label, make, { canDown = true, test }) {
     const t = (name, fn) => test(`[${label}] ${name}`, {}, fn);
     const down = (name, fn) => test(`[${label}] ${name}`, { skip: !canDown && 'nothing to cut inside one ward' }, fn);
@@ -62,12 +64,12 @@ export function conform(label, make, { canDown = true, test }) {
         assert.notEqual(i1.secret, i2.secret);
         assert.equal(i1.ward, i2.ward);
     });
-    t('remove before any knock: the heir is forgotten, a knock on it is silence', async () => {
+    t('remove before any knock: the heir is forgotten, and a knock on it by whoever holds it hears removed', async () => {
         const { w, shop, alice } = await world();
         const inv = await shop.being.invite();
         shop.being.occupants.remove('cust1');
         assert.equal(w.heir(inv), undefined);
-        assert.ok(isSilence(await alice.being.join(inv)));
+        assert.ok(said(await alice.being.join(inv), 'removed'));
         assert.deepEqual(alice.cells.standings, {});
     });
     // ---- consume, the knock
@@ -143,15 +145,15 @@ export function conform(label, make, { canDown = true, test }) {
         assert.deepEqual(await alice.being.join(inv), { welcome: true }); // the same invitation still works
         const inv2 = await shop.being.invite();
         shop.being.occupants.remove('cust2'); // she changed her mind before the knock
-        assert.ok(isSilence(await alice.being.join(inv2)));
+        assert.ok(said(await alice.being.join(inv2), 'removed'));
         assert.deepEqual(Object.keys(alice.cells.standings), ['shop']);
     });
-    t('take without a knock, or after a silent knock, births nothing', async () => {
+    t('take without a knock, or after a knock that was not answered, births nothing', async () => {
         const { shop, alice } = await world();
         const inv = await shop.being.invite();
         assert.equal(await alice.being.take('shop', inv), null);
         shop.being.occupants.remove('cust1');
-        assert.ok(isSilence(await alice.being.knock(inv, 'hello')));
+        assert.ok(said(await alice.being.knock(inv, 'hello'), 'removed'));
         assert.equal(await alice.being.take('shop', inv), null);
         assert.deepEqual(alice.cells.standings, {});
     });
@@ -311,16 +313,16 @@ export function conform(label, make, { canDown = true, test }) {
         printer.down = false;
         assert.deepEqual(await alice.being.buy('hat'), { ok: true, receipt: 'receipt for hat' });
     });
-    t('a removed occupant is silence to the far side and her heir is forgotten; a dropped standing is gone', async () => {
+    t('a removed occupant hears removed under the key the door bound, her heir is forgotten; a dropped standing is gone', async () => {
         const { w, alice, shop } = await world();
         const inv = await shop.being.invite();
         await alice.being.join(inv);
         shop.being.occupants.remove('cust1');
         assert.equal(w.heir(inv), undefined);
-        assert.ok(isSilence(await alice.being.buy('hat')));
+        assert.ok(said(await alice.being.buy('hat'), 'removed'));
         alice.being.standings.remove('shop');
         assert.equal(alice.being.standings.shop, undefined);
-        assert.ok(isSilence(await alice.being.knock(inv, 'hello'))); // and a re-knock finds no heir
+        assert.ok(isSilence(await alice.being.knock(inv, 'hello'))); // her bound key went with the standing: a re-knock is as the heir, which is spent, a stranger
         const again = await shop.being.invite(); // cust2. a new heir
         assert.notEqual(again.heir, inv.heir);
         assert.deepEqual(await alice.being.knock(again, 'hello'), { welcome: true });
@@ -333,7 +335,7 @@ export function conform(label, make, { canDown = true, test }) {
         assert.deepEqual(await p, { ok: true, receipt: 'receipt for hat' });
         assert.equal(shop.cells.sales.length, 1);
     });
-    t('a being that throws is silence outside; the ward stays up', async () => {
+    t('a being that throws is the word threw to whom the door has bound; the ward stays up', async () => {
         const w = await make();
         class Bomb {
             s;
@@ -349,7 +351,7 @@ export function conform(label, make, { canDown = true, test }) {
         const x = await w.boot('X', Bomb);
         const a = await w.boot('A', Customer);
         const inv = (await x.being.s.occupants.invite('a'));
-        assert.ok(isSilence(await a.being.knock(inv, 'any')));
+        assert.ok(said(await a.being.knock(inv, 'any'), 'threw'));
         assert.deepEqual(await a.being.knock(inv), { asks: [], notes: {} });
     });
     t('null is an answer, silence is not', async () => {
@@ -407,7 +409,7 @@ export function conform(label, make, { canDown = true, test }) {
         if (!w.oneWard)
             assert.ok(isSilence(await a.being.knock(at(priv), 'time'))); // a ward with no public being: silence
         assert.ok(isUnreached(await a.being.knock({ ward: 'a'.repeat(128) }, 'time'))); // no door anywhere: unreached
-        assert.ok(isSilence(await a.being.knock({ ward: 'not a pk' }, 'time'))); // not even an address
+        assert.ok(said(await a.being.knock({ ward: 'not a pk' }, 'time'), 'invitation')); // not even an address
         assert.equal(await a.being.take('clock', at(pub)), 'clock');
         assert.deepEqual(await a.being.standings.clock.ask('time'), { time: 12, got: {} });
         assert.equal(a.cells.standings.clock.seen, await digest((await a.being.standings.clock.ask())));

package/dist/harbor/core.d.ts

@@ -17,12 +17,17 @@ export type Bound = {
 export type Loader = (record: WardRecord) => Promise<Record<string, BeingClass>>;
 export declare const DEFAULT_CODE = "classes/index.ts";
 export declare class Harbor {
+    #private;
     readonly store: Store;
     readonly loader: Loader;
     readonly wards: Map<string, Hosted>;
-    readonly doors: Map<string, (bytes: Uint8Array) => Promise<Uint8Array>>;
+    readonly doors: Map<string, (bytes: Uint8Array) => Promise<{
+        bytes: Uint8Array;
+        heard: boolean;
+    }>>;
     readonly reaches: Map<string, Bound>;
     readonly down: Set<string>;
+    readonly refused: Map<string, number>;
     readonly classes: Record<string, BeingClass>;
     readonly fallbacks: Reach[];
     constructor(store: Store, loader?: Loader);

package/dist/harbor/core.js

@@ -32,6 +32,7 @@ export class Harbor {
     doors = new Map(); // ward pk -> door
     reaches = new Map(); // the directory: foreign ward pk -> reach
     down = new Set(); // pks this harbor will not reach right now: weather, for a test
+    refused = new Map(); // own ward pk -> arrivals its door would not admit. what a terrain does with it is its own
     classes = {}; // classes handed in-process, beside the loader's
     // The dialers' sockets, in the order they were dialed: where a pk nobody
     // here knows is sent, because the listener a harbor dialed is a rendezvous
@@ -56,12 +57,20 @@ export class Harbor {
             this.hint(pk, url);
     }
     // ---- the directory
+    // Bytes to one of this harbor's own doors, and the one bit the door says
+    // beside its reply, counted.
+    async #own(pk, door, bytes) {
+        const r = await door(bytes);
+        if (!r.heard)
+            this.refused.set(pk, (this.refused.get(pk) ?? 0) + 1);
+        return new Uint8Array(r.bytes);
+    }
     async carry(pk, bytes) {
         if (this.down.has(pk))
             return undefined;
         const door = this.doors.get(pk);
         if (door)
-            return new Uint8Array(await door(bytes));
+            return this.#own(pk, door, bytes);
         const bound = this.reaches.get(pk);
         if (bound)
             return bound.reach.carry(pk, bytes);
@@ -77,7 +86,7 @@ export class Harbor {
             return undefined;
         const door = this.doors.get(pk);
         if (door)
-            return new Uint8Array(await door(bytes));
+            return this.#own(pk, door, bytes);
         const bound = this.reaches.get(pk);
         return bound?.held ? bound.reach.carry(pk, bytes) : undefined;
     }

package/dist/harbor/memory.d.ts

@@ -5,9 +5,13 @@ export type Booted = WardPointers & {
 };
 export type WardFactory = (ground: Ground) => Promise<WardPointers>;
 export declare class MemoryHarbor {
-    readonly doors: Map<string, (bytes: Uint8Array) => Promise<Uint8Array>>;
+    readonly doors: Map<string, (bytes: Uint8Array) => Promise<{
+        bytes: Uint8Array;
+        heard: boolean;
+    }>>;
     readonly down: Set<string>;
     readonly wire: string[];
+    readonly refused: Map<string, number>;
     readonly peers: Set<MemoryHarbor>;
     cut: boolean;
     readonly partitions: Map<string, Record<string, unknown>>;

package/dist/harbor/memory.js

@@ -3,6 +3,7 @@ export class MemoryHarbor {
     doors = new Map(); // ward pk -> door
     down = new Set(); // ward pks this harbor cannot reach right now
     wire = []; // every byte string that ever crossed, as hex. for inspection
+    refused = new Map(); // ward pk -> arrivals its door would not admit: strangers, counted
     peers = new Set();
     cut = false;
     partitions = new Map(); // seed -> memory. the harbor keeps it and reads nothing
@@ -13,8 +14,12 @@ export class MemoryHarbor {
         if (this.down.has(farPk))
             return undefined;
         const door = this.doors.get(farPk);
-        if (door)
-            return door(bytes);
+        if (door) {
+            const r = await door(bytes);
+            if (!r.heard)
+                this.refused.set(farPk, (this.refused.get(farPk) ?? 0) + 1);
+            return r.bytes;
+        }
         const peer = [...this.peers].find((h) => h.doors.has(farPk) && !h.down.has(farPk));
         if (!peer || this.cut)
             return undefined; // nothing. the harbor has no word silence

package/dist/ward/door.d.ts

@@ -8,5 +8,9 @@ export type Door = {
         occupants: Record<string, unknown>;
     };
 };
-export declare function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject): Promise<ReplyPayload>;
-export declare function makeDoor(key: WardKey, heirs: Heirs, doors: Map<string, Door>, publicKey: () => string | null, random: (n: number) => Uint8Array): (bytes: Uint8Array) => Promise<Uint8Array>;
+export type Judged = {
+    bytes: Uint8Array;
+    heard: boolean;
+};
+export declare function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload>;
+export declare function makeDoor(key: WardKey, heirs: Heirs, doors: Map<string, Door>, publicKey: () => string | null, random: (n: number) => Uint8Array): (bytes: Uint8Array) => Promise<Judged>;

package/dist/ward/door.js

@@ -1,29 +1,39 @@
 // SPDX-License-Identifier: Apache-2.0
-// Judgment at the door. Sealed bytes in, sealed bytes out. Every failure is
-// one silence, sealed to whoever asked so that a stranger learns nothing,
-// not even which case they hit. What passes is named and dispatched to her
-// answer, and her digest for that asker rides back with the object.
-import { isSilence, isUnreached } from '../being/silence.js';
+// Judgment at the door. Sealed bytes in, sealed bytes out, and one bit for
+// the harbor: whether a key this door holds spoke. A stranger, bytes the
+// door cannot admit, meets one silence whatever the case, so that it learns
+// nothing, not even which case it hit. A key the door has bound hears the
+// ward's word for what happened, sealed to its own lid, because it has
+// already proven who it is and a reason to it is an oracle to nobody. What
+// passes is named and dispatched to her answer, and her digest for that
+// asker rides back with the object.
+import { isSilence, isWord } from '../being/silence.js';
 import { digest } from '../being/digest.js';
 import { at } from './partition.js';
 import { openAsk, sealReply, verifyAsk } from './seal.js';
 import { spent } from './allowance.js';
 import { KEY, sealingPair } from './arithmetic.js';
 const SILENCE = { silence: true };
-// One arrival at one being, already named. Catches every throw.
-export async function arrive(door, asker, method, args) {
+const said = (quo) => ({ quo });
+// One arrival at one being, already named. Catches every throw. `bound` says
+// whether the asker is a key this door holds: she hears `threw`; a stranger
+// at the public being hears silence, because her insides are hers.
+export async function arrive(door, asker, method, args, bound) {
+    const threw = bound ? said('threw') : SILENCE;
     let out;
     try {
         out = await door.being.answer(asker, method, args);
     }
     catch {
-        return SILENCE; // she threw where she was asked. there is no answer.
+        return threw; // she threw where she was asked. there is no answer.
     }
     // Nothing at all is not an answer either: a method that forgot to return
     // has said nothing, and nothing is silence, never a value that JSON drops
     // on the way out and the far side reads back as a fourth word.
-    if (out === undefined || isSilence(out) || isUnreached(out))
+    if (out === undefined || isSilence(out))
         return SILENCE;
+    if (isWord(out))
+        return threw; // a word is the ward's to say, never hers
     if (method === undefined)
         return { object: out, seen: null };
     // The digest rides along, it is not the answer. She has already answered:
@@ -33,7 +43,7 @@ export async function arrive(door, asker, method, args) {
 async function seen(door, asker) {
     try {
         const bp = await door.being.answer(asker);
-        return isSilence(bp) || isUnreached(bp) ? null : await digest(bp);
+        return isSilence(bp) || isWord(bp) ? null : await digest(bp);
     }
     catch {
         return null;
@@ -43,41 +53,50 @@ export function makeDoor(key, heirs, doors, publicKey, random) {
     const judge = async (bytes) => {
         const a = await openAsk(bytes, key.padlock);
         if (!a)
-            return null; // it did not open. there is nobody to answer.
+            return null; // D1. it did not open. there is nobody to answer.
         const { to, payload, ephemeralPk } = a;
-        // The allowance, read before anything is done under it. A budget already
-        // gone is one silence like every other refusal here: a stranger learns
-        // nothing, not even that what she ran out of was time. Nothing is spent
-        // and nothing rotates, because nothing was heard.
-        if (spent({ time: payload.time }))
-            return { reply: SILENCE, ephemeralPk };
-        // An ask with no doors left is one silence like a budget already gone.
-        // Nothing sets hops and nothing decrements it yet; this door refuses zero
-        // so that a relay chain invented later meets doors that already stop it.
-        if (payload.hops === 0)
-            return { reply: SILENCE, ephemeralPk };
+        const refuse = () => ({ reply: SILENCE, ephemeralPk, heard: false });
+        // D2, the rest of it. The allowance is read before anything is done under
+        // it, and hops at zero is refused so that a relay chain invented later
+        // meets doors that already stop it. Nothing sets hops.
+        if (spent({ time: payload.time }) || payload.hops === 0)
+            return refuse();
         const args = payload.args ?? {};
         if (to === null) {
+            // For nobody: the public being, or D3 nobody home; D4 the signature
+            // fails under the key the payload names. She is asked by strangers,
+            // and a stranger hears silence for whatever she then does.
             const pk = publicKey();
             const pub = pk !== null ? doors.get(pk) : undefined;
             if (!pub || !(await verifyAsk(a, payload.by)))
-                return { reply: SILENCE, ephemeralPk };
-            return { reply: await arrive(pub, {}, payload.method, args), ephemeralPk };
+                return refuse();
+            return { reply: await arrive(pub, {}, payload.method, args, false), ephemeralPk, heard: true };
         }
         const h = heirs.admits(to, payload.by);
-        if (!h)
-            return { reply: SILENCE, ephemeralPk };
-        const door = doors.get(h.being);
-        if (!door || !at(door.cells.occupants, h.id))
-            return { reply: SILENCE, ephemeralPk }; // she removed it, or she is gone
+        if (!h) {
+            // D5 a heir not held, D6 a key not admitted. One more case: the heir
+            // was held and the id removed. Its last keys are kept so that their
+            // holder, and only their holder, D7 checked, hears that she is gone.
+            if (!heirs.gone(to, payload.by) || !(await verifyAsk(a, payload.by)))
+                return refuse();
+            return { reply: said('removed'), ephemeralPk, heard: true };
+        }
         if (!(await verifyAsk(a, payload.by)))
-            return { reply: SILENCE, ephemeralPk };
+            return refuse(); // D7, under an admitted key
+        // From here the door has heard a key it holds. Every answer below is
+        // sealed to that key's lid; nothing below is a stranger's.
+        const door = doors.get(h.being);
+        if (!door)
+            return { reply: said('absent'), ephemeralPk, heard: true }; // D8. she did not come back this run
+        if (!at(door.cells.occupants, h.id))
+            return { reply: said('removed'), ephemeralPk, heard: true }; // D8. the record is gone
         // Once only, and only now: the number is spent after the signature, so a
         // stranger cannot burn a number she could not sign for, and together with
         // the keys, so the same bytes twice rotate nothing and refusal writes nothing.
-        if (!heirs.honour(h, payload.by, payload.next, payload.seq))
-            return { reply: SILENCE, ephemeralPk };
-        return { reply: await arrive(door, { id: h.id }, payload.method, args), ephemeralPk };
+        const honoured = heirs.honour(h, payload.by, payload.next, payload.seq); // D9, D10
+        if (honoured !== true)
+            return { reply: said(honoured), ephemeralPk, heard: true };
+        return { reply: await arrive(door, { id: h.id }, payload.method, args, true), ephemeralPk, heard: true };
     };
     // The door itself. Always answers bytes. When the ask did not open, the
     // reply is sealed to the ephemeral pk on its lid, which is all a stranger
@@ -89,11 +108,12 @@ export function makeDoor(key, heirs, doors, publicKey, random) {
     return async function door(bytes) {
         const out = await judge(bytes);
         const reply = out?.reply ?? SILENCE;
+        const heard = out?.heard ?? false;
         try {
-            return await sealReply(reply, out?.ephemeralPk ?? lid(bytes, random), key.sign, random(32));
+            return { bytes: await sealReply(reply, out?.ephemeralPk ?? lid(bytes, random), key.sign, random(32)), heard };
         }
         catch {
-            return sealReply(reply, (await sealingPair(random(32))).pk, key.sign, random(32));
+            return { bytes: await sealReply(reply, (await sealingPair(random(32))).pk, key.sign, random(32)), heard };
         }
     };
 }

package/dist/ward/ground.d.ts

@@ -7,6 +7,9 @@ export type Ground = {
     random(n: number): Uint8Array;
 };
 export type WardPointers = {
-    door(bytes: Uint8Array): Promise<Uint8Array>;
+    door(bytes: Uint8Array): Promise<{
+        bytes: Uint8Array;
+        heard: boolean;
+    }>;
     ask(method?: string, args?: Record<string, unknown>): Promise<unknown>;
 };

package/dist/ward/heirs.d.ts

@@ -1,12 +1,14 @@
-import type { Heir, Partition } from './partition.ts';
+import type { DoorWord } from '../being/types.ts';
+import { type Heir, type Partition } from './partition.ts';
 export declare class Heirs {
     #private;
     constructor(p: Partition);
     open(heir: string, being: string, id: string): void;
     close(heir: string): void;
+    gone(heir: string, by: string): boolean;
     get(heir: string): Heir | undefined;
     admits(heir: string, by: string): Heir | null;
     spend(h: Heir, seq: number): boolean;
-    honour(h: Heir, by: string, next: string | null, seq: number): boolean;
+    honour(h: Heir, by: string, next: string | null, seq: number): true | DoorWord;
     settle(h: Heir, by: string, next: string | null): boolean;
 }

package/dist/ward/heirs.js

@@ -1,3 +1,4 @@
+import { GONE } from './partition.js';
 // How wide the span is, is the ward's own — wider is more forgiving of a
 // rough road, and no peer can tell the difference except by being refused.
 const SPAN = 64;
@@ -9,8 +10,24 @@ export class Heirs {
     open(heir, being, id) {
         this.#p.heirs[heir] = { being, id, current: heir, announced: null, fresh: true, mark: 0, spent: [] };
     }
+    // The id was removed. The heir is forgotten, and its last keys are kept
+    // apart, bounded, so that whoever still holds them hears `removed` at the
+    // door, once they have signed as themselves, and nobody else hears a thing.
     close(heir) {
+        const h = this.#p.heirs[heir];
+        if (!h)
+            return;
         delete this.#p.heirs[heir];
+        this.#p.gone[heir] = { current: h.current, announced: h.announced };
+        const keys = Object.keys(this.#p.gone);
+        for (const old of keys.slice(0, Math.max(0, keys.length - GONE)))
+            delete this.#p.gone[old];
+    }
+    // May `by` speak for a relation she removed? True only for the keys the
+    // door held when the id went, which nobody but their holder has.
+    gone(heir, by) {
+        const g = this.#p.gone[heir];
+        return !!g && (by === g.current || by === g.announced);
     }
     get(heir) {
         return this.#p.heirs[heir];
@@ -60,10 +77,10 @@ export class Heirs {
     // behind her. Every write below this line is one that is going to hold.
     honour(h, by, next, seq) {
         if (h.fresh && next === null)
-            return false; // a knock without a key of her own binds nothing
+            return 'unannounced'; // a knock without a key of her own binds nothing
         if (!this.spend(h, seq))
-            return false;
-        return this.settle(h, by, next);
+            return 'repeated';
+        return this.settle(h, by, next) ? true : 'unannounced';
     }
     // The signature checked out. Settle the keys: a fresh heir rotates at once
     // to what it announced and must announce something; a current key replaces

package/dist/ward/owner.js

@@ -4,7 +4,7 @@
 // describe, boot, invite, knock, remove. The knock is a being's knock made
 // for her, and the standing is written into her cells under the id the
 // owner gave; remove takes a relation out of her by id, the mirror of it.
-import { isSilence, isUnreached } from '../being/silence.js';
+import { isSilence, isWord, wordOf } from '../being/silence.js';
 import { digest } from '../being/digest.js';
 import { OWNER } from '../being/types.js';
 export const OWNER_ASKS = ['boot', 'invite', 'knock', 'remove'];
@@ -63,8 +63,10 @@ export async function ownerAnswer(w, asker, method, args) {
         // The owner is a caller like any other and may say what this knock may
         // spend. Saying nothing is the ward's default, as it is for a being.
         const out = await door.stance.standings.knock(inv, args.method, args.args ?? {}, args.wanted);
-        if (isSilence(out) || isUnreached(out))
-            return { error: isUnreached(out) ? 'unreached' : 'silence' };
+        if (isSilence(out))
+            return { error: 'silence' };
+        if (isWord(out))
+            return { error: wordOf(out) }; // the owner hears objects: the word is the error's name
         return { taken: await door.stance.standings.take(id, inv), answer: out };
     }
     if (method === 'remove') {
@@ -100,7 +102,7 @@ async function describe(w) {
         let d = null;
         try {
             const bp = await door.being.answer({ id: OWNER });
-            d = isSilence(bp) || isUnreached(bp) ? null : await digest(bp);
+            d = isSilence(bp) || isWord(bp) ? null : await digest(bp);
         }
         catch {
             // she threw where she was asked. there is no blueprint, and d stays null.

package/dist/ward/partition.d.ts

@@ -34,6 +34,11 @@ export type Bind = {
     answered: Record<string, true>;
     minted: string[];
 };
+export type Gone = {
+    current: string;
+    announced: string | null;
+};
+export declare const GONE = 256;
 export type Partition = {
     version: string;
     beings: Record<string, Cells & {
@@ -41,6 +46,7 @@ export type Partition = {
     }>;
     bind: Record<string, Bind>;
     heirs: Record<string, Heir>;
+    gone: Record<string, Gone>;
     public: string | null;
 };
 export declare function open(memory: Record<string, unknown>): Partition;

package/dist/ward/partition.js

@@ -25,6 +25,7 @@ export const READS = [VERSION];
 function upgrade(p) {
     return p;
 }
+export const GONE = 256;
 // The one place a ward reads state that another ward wrote. A fresh
 // memory becomes a partition of this version; anything already written must
 // say it is this version, and a ward that cannot read it does not boot. Birth is
@@ -41,6 +42,7 @@ export function open(memory) {
     p.beings ??= {};
     p.bind ??= {};
     p.heirs ??= {};
+    p.gone ??= {};
     p.public ??= null;
     return p;
 }

package/dist/ward/seal.d.ts

@@ -1,4 +1,4 @@
-import type { Json, JsonObject } from '../being/types.ts';
+import type { DoorWord, Json, JsonObject } from '../being/types.ts';
 export type WardKey = {
     sign: Uint8Array;
     padlock: Uint8Array;
@@ -28,6 +28,8 @@ export type ReplyPayload = {
     seen: string | null;
 } | {
     silence: true;
+} | {
+    quo: DoorWord;
 };
 export declare function sealAsk(to: string | null, payload: AskPayload, signer: Uint8Array, padlock: Uint8Array, seed: Uint8Array): Promise<{
     bytes: Uint8Array;