@quo-systems/quo 0.1.1 → 0.2.0

package/src/ward/door.ts

@@ -1,11 +1,15 @@
 // SPDX-License-Identifier: Apache-2.0
-// Judgment at the door. Sealed bytes in, sealed bytes out. Every failure is
-// one silence, sealed to whoever asked so that a stranger learns nothing,
-// not even which case they hit. What passes is named and dispatched to her
-// answer, and her digest for that asker rides back with the object.
-import { isSilence, isUnreached } from '../being/silence.ts';
+// Judgment at the door. Sealed bytes in, sealed bytes out, and one bit for
+// the harbor: whether a key this door holds spoke. A stranger, bytes the
+// door cannot admit, meets one silence whatever the case, so that it learns
+// nothing, not even which case it hit. A key the door has bound hears the
+// ward's word for what happened, sealed to its own lid, because it has
+// already proven who it is and a reason to it is an oracle to nobody. What
+// passes is named and dispatched to her answer, and her digest for that
+// asker rides back with the object.
+import { isSilence, isWord } from '../being/silence.ts';
 import { digest } from '../being/digest.ts';
-import type { Asker, BeingLike, JsonObject } from '../being/types.ts';
+import type { Asker, BeingLike, DoorWord, JsonObject } from '../being/types.ts';
 import { at } from './partition.ts';
 import type { Heirs } from './heirs.ts';
 import { openAsk, sealReply, verifyAsk, type ReplyPayload, type WardKey } from './seal.ts';
@@ -13,20 +17,26 @@ import { spent } from './allowance.ts';
 import { KEY, sealingPair } from './arithmetic.ts';
 
 export type Door = { key: string; being: BeingLike; cells: { occupants: Record<string, unknown> } };
+export type Judged = { bytes: Uint8Array; heard: boolean };
 const SILENCE: ReplyPayload = { silence: true };
+const said = (quo: DoorWord): ReplyPayload => ({ quo });
 
-// One arrival at one being, already named. Catches every throw.
-export async function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject): Promise<ReplyPayload> {
+// One arrival at one being, already named. Catches every throw. `bound` says
+// whether the asker is a key this door holds: she hears `threw`; a stranger
+// at the public being hears silence, because her insides are hers.
+export async function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload> {
+  const threw = bound ? said('threw') : SILENCE;
   let out: Awaited<ReturnType<BeingLike['answer']>>;
   try {
     out = await door.being.answer(asker, method, args);
   } catch {
-    return SILENCE; // she threw where she was asked. there is no answer.
+    return threw; // she threw where she was asked. there is no answer.
   }
   // Nothing at all is not an answer either: a method that forgot to return
   // has said nothing, and nothing is silence, never a value that JSON drops
   // on the way out and the far side reads back as a fourth word.
-  if (out === undefined || isSilence(out) || isUnreached(out)) return SILENCE;
+  if (out === undefined || isSilence(out)) return SILENCE;
+  if (isWord(out)) return threw; // a word is the ward's to say, never hers
   if (method === undefined) return { object: out, seen: null };
   // The digest rides along, it is not the answer. She has already answered:
   // a describe that will not run costs the digest, and nothing else.
@@ -36,43 +46,54 @@ export async function arrive(door: Door, asker: Asker, method: string | undefine
 async function seen(door: Door, asker: Asker): Promise<string | null> {
   try {
     const bp = await door.being.answer(asker);
-    return isSilence(bp) || isUnreached(bp) ? null : await digest(bp);
+    return isSilence(bp) || isWord(bp) ? null : await digest(bp);
   } catch {
     return null;
   }
 }
 
+type Verdict = { reply: ReplyPayload; ephemeralPk: Uint8Array; heard: boolean };
+
 export function makeDoor(key: WardKey, heirs: Heirs, doors: Map<string, Door>, publicKey: () => string | null, random: (n: number) => Uint8Array) {
-  const judge = async (bytes: Uint8Array): Promise<{ reply: ReplyPayload; ephemeralPk: Uint8Array } | null> => {
+  const judge = async (bytes: Uint8Array): Promise<Verdict | null> => {
     const a = await openAsk(bytes, key.padlock);
-    if (!a) return null; // it did not open. there is nobody to answer.
+    if (!a) return null; // D1. it did not open. there is nobody to answer.
     const { to, payload, ephemeralPk } = a;
-    // The allowance, read before anything is done under it. A budget already
-    // gone is one silence like every other refusal here: a stranger learns
-    // nothing, not even that what she ran out of was time. Nothing is spent
-    // and nothing rotates, because nothing was heard.
-    if (spent({ time: payload.time })) return { reply: SILENCE, ephemeralPk };
-    // An ask with no doors left is one silence like a budget already gone.
-    // Nothing sets hops and nothing decrements it yet; this door refuses zero
-    // so that a relay chain invented later meets doors that already stop it.
-    if (payload.hops === 0) return { reply: SILENCE, ephemeralPk };
+    const refuse = (): Verdict => ({ reply: SILENCE, ephemeralPk, heard: false });
+    // D2, the rest of it. The allowance is read before anything is done under
+    // it, and hops at zero is refused so that a relay chain invented later
+    // meets doors that already stop it. Nothing sets hops.
+    if (spent({ time: payload.time }) || payload.hops === 0) return refuse();
     const args = payload.args ?? {};
     if (to === null) {
+      // For nobody: the public being, or D3 nobody home; D4 the signature
+      // fails under the key the payload names. She is asked by strangers,
+      // and a stranger hears silence for whatever she then does.
       const pk = publicKey();
       const pub = pk !== null ? doors.get(pk) : undefined;
-      if (!pub || !(await verifyAsk(a, payload.by))) return { reply: SILENCE, ephemeralPk };
-      return { reply: await arrive(pub, {}, payload.method, args), ephemeralPk };
+      if (!pub || !(await verifyAsk(a, payload.by))) return refuse();
+      return { reply: await arrive(pub, {}, payload.method, args, false), ephemeralPk, heard: true };
     }
     const h = heirs.admits(to, payload.by);
-    if (!h) return { reply: SILENCE, ephemeralPk };
+    if (!h) {
+      // D5 a heir not held, D6 a key not admitted. One more case: the heir
+      // was held and the id removed. Its last keys are kept so that their
+      // holder, and only their holder, D7 checked, hears that she is gone.
+      if (!heirs.gone(to, payload.by) || !(await verifyAsk(a, payload.by))) return refuse();
+      return { reply: said('removed'), ephemeralPk, heard: true };
+    }
+    if (!(await verifyAsk(a, payload.by))) return refuse(); // D7, under an admitted key
+    // From here the door has heard a key it holds. Every answer below is
+    // sealed to that key's lid; nothing below is a stranger's.
     const door = doors.get(h.being);
-    if (!door || !at(door.cells.occupants, h.id)) return { reply: SILENCE, ephemeralPk }; // she removed it, or she is gone
-    if (!(await verifyAsk(a, payload.by))) return { reply: SILENCE, ephemeralPk };
+    if (!door) return { reply: said('absent'), ephemeralPk, heard: true }; // D8. she did not come back this run
+    if (!at(door.cells.occupants, h.id)) return { reply: said('removed'), ephemeralPk, heard: true }; // D8. the record is gone
     // Once only, and only now: the number is spent after the signature, so a
     // stranger cannot burn a number she could not sign for, and together with
     // the keys, so the same bytes twice rotate nothing and refusal writes nothing.
-    if (!heirs.honour(h, payload.by, payload.next, payload.seq)) return { reply: SILENCE, ephemeralPk };
-    return { reply: await arrive(door, { id: h.id }, payload.method, args), ephemeralPk };
+    const honoured = heirs.honour(h, payload.by, payload.next, payload.seq); // D9, D10
+    if (honoured !== true) return { reply: said(honoured), ephemeralPk, heard: true };
+    return { reply: await arrive(door, { id: h.id }, payload.method, args, true), ephemeralPk, heard: true };
   };
 
   // The door itself. Always answers bytes. When the ask did not open, the
@@ -82,13 +103,14 @@ export function makeDoor(key: WardKey, heirs: Heirs, doors: Map<string, Door>, p
   // A lid that is not a key -- a small-order point, of which the two curves
   // have several each -- makes a dead agreement, and the seal refuses it. The
   // door never throws: that reply is noise, sealed to a key nobody holds.
-  return async function door(bytes: Uint8Array): Promise<Uint8Array> {
+  return async function door(bytes: Uint8Array): Promise<Judged> {
     const out = await judge(bytes);
     const reply = out?.reply ?? SILENCE;
+    const heard = out?.heard ?? false;
     try {
-      return await sealReply(reply, out?.ephemeralPk ?? lid(bytes, random), key.sign, random(32));
+      return { bytes: await sealReply(reply, out?.ephemeralPk ?? lid(bytes, random), key.sign, random(32)), heard };
     } catch {
-      return sealReply(reply, (await sealingPair(random(32))).pk, key.sign, random(32));
+      return { bytes: await sealReply(reply, (await sealingPair(random(32))).pk, key.sign, random(32)), heard };
     }
   };
 }

package/src/ward/ground.ts

@@ -28,8 +28,12 @@ export type Ground = {
   random(n: number): Uint8Array; // entropy. every key a ward mints is drawn from it
 };
 
-// What a ward hands back. Two pointers.
+// What a ward hands back. Two pointers. The door answers bytes, always, and
+// one bit beside them: whether a key it holds spoke. That is all a harbor
+// learns from an arrival, and it is what a harbor can act on -- a pk that
+// only ever brings strangers' bytes is the harbor's to rate or refuse. Never
+// a reason: the reason is sealed to the asker's lid, and is theirs.
 export type WardPointers = {
-  door(bytes: Uint8Array): Promise<Uint8Array>;
+  door(bytes: Uint8Array): Promise<{ bytes: Uint8Array; heard: boolean }>;
   ask(method?: string, args?: Record<string, unknown>): Promise<unknown>;
 };

package/src/ward/heirs.ts

@@ -4,7 +4,8 @@
 // speak, and so may the key it announced last time. A knock is the first
 // use of the heir, which the inviter announced on your behalf, and the heir
 // dies as it speaks.
-import type { Heir, Partition } from './partition.ts';
+import type { DoorWord } from '../being/types.ts';
+import { GONE, type Heir, type Partition } from './partition.ts';
 
 // How wide the span is, is the ward's own — wider is more forgiving of a
 // rough road, and no peer can tell the difference except by being refused.
@@ -18,8 +19,22 @@ export class Heirs {
   open(heir: string, being: string, id: string): void {
     this.#p.heirs[heir] = { being, id, current: heir, announced: null, fresh: true, mark: 0, spent: [] };
   }
+  // The id was removed. The heir is forgotten, and its last keys are kept
+  // apart, bounded, so that whoever still holds them hears `removed` at the
+  // door, once they have signed as themselves, and nobody else hears a thing.
   close(heir: string): void {
+    const h = this.#p.heirs[heir];
+    if (!h) return;
     delete this.#p.heirs[heir];
+    this.#p.gone[heir] = { current: h.current, announced: h.announced };
+    const keys = Object.keys(this.#p.gone);
+    for (const old of keys.slice(0, Math.max(0, keys.length - GONE))) delete this.#p.gone[old];
+  }
+  // May `by` speak for a relation she removed? True only for the keys the
+  // door held when the id went, which nobody but their holder has.
+  gone(heir: string, by: string): boolean {
+    const g = this.#p.gone[heir];
+    return !!g && (by === g.current || by === g.announced);
   }
   get(heir: string): Heir | undefined {
     return this.#p.heirs[heir];
@@ -63,10 +78,10 @@ export class Heirs {
   // neither: a call that binds nothing must not burn a number on its way to
   // being refused, or a stranger who cannot be heard would still leave a mark
   // behind her. Every write below this line is one that is going to hold.
-  honour(h: Heir, by: string, next: string | null, seq: number): boolean {
-    if (h.fresh && next === null) return false; // a knock without a key of her own binds nothing
-    if (!this.spend(h, seq)) return false;
-    return this.settle(h, by, next);
+  honour(h: Heir, by: string, next: string | null, seq: number): true | DoorWord {
+    if (h.fresh && next === null) return 'unannounced'; // a knock without a key of her own binds nothing
+    if (!this.spend(h, seq)) return 'repeated';
+    return this.settle(h, by, next) ? true : 'unannounced';
   }
 
   // The signature checked out. Settle the keys: a fresh heir rotates at once

package/src/ward/owner.ts

@@ -4,7 +4,7 @@
 // describe, boot, invite, knock, remove. The knock is a being's knock made
 // for her, and the standing is written into her cells under the id the
 // owner gave; remove takes a relation out of her by id, the mirror of it.
-import { isSilence, isUnreached } from '../being/silence.ts';
+import { isSilence, isWord, wordOf } from '../being/silence.ts';
 import { digest } from '../being/digest.ts';
 import { OWNER } from '../being/types.ts';
 import type { Asker, Invitation, Json, JsonObject, Wanted } from '../being/types.ts';
@@ -78,7 +78,8 @@ export async function ownerAnswer(w: OwnerSide, asker: Asker, method: string | u
     // The owner is a caller like any other and may say what this knock may
     // spend. Saying nothing is the ward's default, as it is for a being.
     const out = await door.stance.standings.knock(inv, args.method as string | undefined, (args.args as JsonObject) ?? {}, args.wanted as Wanted | undefined);
-    if (isSilence(out) || isUnreached(out)) return { error: isUnreached(out) ? 'unreached' : 'silence' };
+    if (isSilence(out)) return { error: 'silence' };
+    if (isWord(out)) return { error: wordOf(out) }; // the owner hears objects: the word is the error's name
     return { taken: await door.stance.standings.take(id, inv), answer: out as Json };
   }
   if (method === 'remove') {
@@ -109,7 +110,7 @@ async function describe(w: OwnerSide): Promise<Json> {
     let d: string | null = null;
     try {
       const bp = await (door.being.answer as (a: unknown) => unknown)({ id: OWNER });
-      d = isSilence(bp) || isUnreached(bp) ? null : await digest(bp as Json);
+      d = isSilence(bp) || isWord(bp) ? null : await digest(bp as Json);
     } catch {
       // she threw where she was asked. there is no blueprint, and d stays null.
     }

package/src/ward/partition.ts

@@ -78,11 +78,20 @@ export type Bind = {
   minted: string[]; // the last eight pks her side minted. inner. a test reads it
 };
 
+// A relation she removed, as the door remembers it: the keys that may still
+// speak for it, so their holder hears `removed` and a stranger still hears
+// silence. Nothing else survives the removal. The list is bounded, oldest
+// out, because a door that remembered every relation ever ended would grow
+// for as long as she keeps inviting.
+export type Gone = { current: string; announced: string | null };
+export const GONE = 256;
+
 export type Partition = {
   version: string;
   beings: Record<string, Cells & { class?: string }>; // key -> her cells
   bind: Record<string, Bind>; // key -> her bind table
   heirs: Record<string, Heir>; // heir pk -> occupant, across every being of the ward
+  gone: Record<string, Gone>; // heir pk -> the last keys of a relation she removed
   public: string | null; // the one public being's key
 };
 
@@ -101,6 +110,7 @@ export function open(memory: Record<string, unknown>): Partition {
   p.beings ??= {};
   p.bind ??= {};
   p.heirs ??= {};
+  p.gone ??= {};
   p.public ??= null;
   return p;
 }

package/src/ward/seal.ts

@@ -18,8 +18,9 @@
 // itself. The door opens every ask with its own padlock and reads `to` after,
 // so nothing was ever gained by having it in the clear.
 //   reply on the wire   box = eph X pk || AESGCM( reply || signature )       sealed to the ask's eph pk
-//                       reply = JSON { object, seen } | { silence: true }    signed by the ward key
-import type { Json, JsonObject } from '../being/types.ts';
+//                       reply = JSON { object, seen } | { silence: true } | { quo: word }    signed by the ward key
+import type { DoorWord, Json, JsonObject } from '../being/types.ts';
+import { isDoorWord } from '../being/silence.ts';
 import { KEY, SIGNATURE, box, concat, hex, sha256, sign, signingPair, sealingPair, unbox, unhex, verify } from './arithmetic.ts';
 
 const utf8 = new TextEncoder();
@@ -58,7 +59,7 @@ export type AskPayload = { by: string; next: string | null; seq: number; time: n
 // What is actually sealed: the payload with the heir it is for, or null for
 // the public being. `to` is signed with the rest, so it cannot be moved.
 type Sealed = AskPayload & { to: string | null };
-export type ReplyPayload = { object: Json; seen: string | null } | { silence: true };
+export type ReplyPayload = { object: Json; seen: string | null } | { silence: true } | { quo: DoorWord };
 
 // Seal an ask. Returns the bytes and the ephemeral secret the reply will be sealed to.
 export async function sealAsk(to: string | null, payload: AskPayload, signer: Uint8Array, padlock: Uint8Array, seed: Uint8Array): Promise<{ bytes: Uint8Array; ephemeral: Uint8Array }> {
@@ -109,8 +110,9 @@ export async function sealReply(reply: ReplyPayload, ephemeralPk: Uint8Array, wa
 // Open a reply with the ephemeral secret kept from the ask, and verify it
 // came from the ward it was sent to. Null is silence: it did not open, it
 // lied, or it is not a reply. Every ward on the wire is somebody else's code,
-// so the shape is checked here and nowhere later: a reply is `{ silence }`
-// or `{ object, seen }` with an object present and seen a digest or null.
+// so the shape is checked here and nowhere later: a reply is `{ silence }`,
+// `{ quo: word }` with a word the door may say, or `{ object, seen }` with an
+// object present and seen a digest or null.
 // Anything else is bytes that said nothing, and her ward never hands her a
 // throw or an absent value for what a stranger wrote.
 export async function openReply(bytes: unknown, ephemeralSecret: Uint8Array, signPk: Uint8Array): Promise<ReplyPayload | null> {
@@ -124,6 +126,7 @@ export async function openReply(bytes: unknown, ephemeralSecret: Uint8Array, sig
     if (reply === null || typeof reply !== 'object' || Array.isArray(reply)) return null;
     const r = reply as Record<string, unknown>;
     if (r.silence === true) return { silence: true };
+    if (Object.hasOwn(r, 'quo')) return isDoorWord(r.quo) ? { quo: r.quo } : null;
     if (!Object.hasOwn(r, 'object') || r.object === undefined) return null;
     if (r.seen !== null && !(typeof r.seen === 'string' && /^[0-9a-f]{64}$/.test(r.seen))) return null;
     return { object: r.object as Json, seen: r.seen };

package/src/ward/stance.ts

@@ -1,10 +1,10 @@
 // SPDX-License-Identifier: Apache-2.0
 // The one stance builder. Used for every being the ward boots. Nothing
 // outer is in what she holds: ids in, values out, keys in the bind table.
-import { silence, isSilence, isUnreached } from '../being/silence.ts';
+import { silence, isSilence, isUnreached, isWord, word } from '../being/silence.ts';
 import { digest } from '../being/digest.ts';
 import { RESERVED_IDS } from '../being/types.ts';
-import type { Answer, Cells, Invitation, JsonObject, Silence, Stance, Standing, Standings, Unreached, Wanted } from '../being/types.ts';
+import type { Answer, Cells, Invitation, JsonObject, Silence, Stance, Standing, Standings, Wanted, Word } from '../being/types.ts';
 import { at, put, drop, type Bind, type StandingKeys } from './partition.ts';
 import { allow, within, LATE } from './allowance.ts';
 import { isWardPk, type ReplyPayload } from './seal.ts';
@@ -17,7 +17,7 @@ export type Inside = {
   closeHeir(heir: string): void;
   // one send for every destination. the far door's reply, silence, or unreached.
   // signs as keys.current, announces keys.next (minting one if asked), and rotates keys on an answer.
-  send(bind: Bind, keys: StandingKeys, announce: boolean, method: string | undefined, args: JsonObject, wanted: Wanted | undefined): Promise<ReplyPayload | Silence | Unreached>;
+  send(bind: Bind, keys: StandingKeys, announce: boolean, method: string | undefined, args: JsonObject, wanted: Wanted | undefined): Promise<ReplyPayload | Silence | Word>;
 };
 
 // An invitation as it travels: the far ward's pk, the heir pk, the heir's secret seed. Or just the ward, for its public being.
@@ -84,13 +84,14 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
     const out = await within(allow(wanted).time, work(() => !late), () => {
       late = true;
     });
-    return out === LATE ? silence : out;
+    return out === LATE ? word('late') : out;
   };
 
   const send = async (keys: StandingKeys, method: string | undefined, args: JsonObject, wanted: Wanted | undefined, rec?: Cells['standings'][string]): Promise<Answer> => {
     const r = await inside.send(bind, keys, true, method, args, wanted);
-    if (isSilence(r) || isUnreached(r)) return r;
+    if (isSilence(r) || isWord(r)) return r;
     if ('silence' in r) return silence;
+    if ('quo' in r) return word(r.quo); // the far door's word for her, sealed to her lid
     if (rec && method !== undefined && r.seen !== null) rec.seen = r.seen; // the digest rode along
     return r.object;
   };
@@ -122,7 +123,7 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
       k.current = own.current;
       k.next = own.next;
       if (isUnreached(r)) return r; // still nothing. she knows no more than before.
-      if (!isSilence(r) && !('silence' in r)) {
+      if (!isSilence(r) && !isWord(r) && 'object' in r) {
         k.spoke = true; // it was heard the first time, and this is the answer
         bind.answered[name] = true;
         return r.object;
@@ -144,8 +145,13 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
       k.next = keys.next;
     }
     if (isUnreached(r)) return r; // nothing came back. she does not know whether it was heard.
-    k.spoke = true;
-    if (isSilence(r) || 'silence' in r) return silence;
+    // The heir is spent once the door honoured it, whatever she then said: an
+    // object, silence, or that she threw. A refusal wrote nothing, and says
+    // so by its word, so the heir still speaks and the next knock is as it.
+    k.spoke = !(!isSilence(r) && !isWord(r) && 'quo' in r && r.quo !== 'threw');
+    if (isSilence(r) || isWord(r)) return r;
+    if ('silence' in r) return silence;
+    if ('quo' in r) return word(r.quo);
     bind.answered[name] = true;
     return r.object;
   };
@@ -158,14 +164,14 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
 
   const calls = {
     knock: async (inv: Invitation, method?: string, args: JsonObject = {}, wanted?: Wanted): Promise<Answer> => {
-      if (!valid(inv)) return silence;
+      if (!valid(inv)) return word('invitation'); // S1. nothing is sent
       // She may knock again, and after take that knock is an ask: the relation
       // has one home, so it answers on the standing's lane, under the
       // standing's keys and its count. A second lane here would speak for the
       // same relation, and the two would refuse each other.
       const id = takenAs(nameOf(inv));
-      if (id !== undefined) return bounded(wanted, (live) => lane(`ask:${id}`, () => (live() ? asking(id, bind.standings[id], cells.standings[id], method, args, wanted) : Promise.resolve(silence))));
-      return bounded(wanted, (live) => lane(`knock:${nameOf(inv)}`, () => (live() ? knocking(inv, method, args, wanted) : Promise.resolve(silence))));
+      if (id !== undefined) return bounded(wanted, (live) => lane(`ask:${id}`, () => (live() ? asking(id, bind.standings[id], cells.standings[id], method, args, wanted) : Promise.resolve(word('late')))));
+      return bounded(wanted, (live) => lane(`knock:${nameOf(inv)}`, () => (live() ? knocking(inv, method, args, wanted) : Promise.resolve(word('late')))));
     },
     // Take consumes. Until now the relation lived in the knock record, under
     // the ward and the heir; from now it lives in the standing, under her id.
@@ -214,15 +220,15 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
     // the next line. Waiting for the lane is not a reason to lose it.
     ask: (method?: string, args: JsonObject = {}, wanted?: Wanted): Promise<Answer> => {
       const keys = at(bind.standings, id);
-      if (!keys) return Promise.resolve(silence as Answer); // she dropped it between one line and the next
+      if (!keys) return Promise.resolve(word('dropped') as Answer); // S2. she dropped it between one line and the next
       const rec = at(cells.standings, id);
-      return bounded(wanted, (live) => lane(`ask:${id}`, () => (live() ? asking(id, keys, rec, method, args, wanted) : Promise.resolve(silence))));
+      return bounded(wanted, (live) => lane(`ask:${id}`, () => (live() ? asking(id, keys, rec, method, args, wanted) : Promise.resolve(word('late')))));
     },
   });
 
   const asking = async (id: string, keys: StandingKeys, rec: Cells['standings'][string] | undefined, method: string | undefined, args: JsonObject, wanted: Wanted | undefined): Promise<Answer> => {
     const out = await send(keys, method, args, wanted, rec);
-    if (method === undefined && !isSilence(out) && !isUnreached(out)) {
+    if (method === undefined && !isSilence(out) && !isWord(out)) {
       const here = at(cells.standings, id);
       if (here) {
         here.blueprint = out as never;

package/src/ward/ward.ts

@@ -4,9 +4,9 @@
 // the first being in its own map, and every being it later instantiates gets
 // a stance built by the same code. Mints every key, seals every ask that
 // leaves, opens every one that arrives.
-import { silence, isSilence, unreached, isUnreached } from '../being/silence.ts';
+import { silence, isSilence, unreached, isWord, word } from '../being/silence.ts';
 import { OWNER } from '../being/types.ts';
-import type { Asker, BeingLike, Cells, JsonObject, Reply, Stance, Wanted } from '../being/types.ts';
+import type { Asker, BeingLike, Cells, JsonObject, Reply, Stance, Wanted, Word } from '../being/types.ts';
 import type { Ground, WardPointers } from './ground.ts';
 import { at, open, put, emptyBind, emptyCells, type Bind, type Partition, type StandingKeys } from './partition.ts';
 import { Heirs } from './heirs.ts';
@@ -72,7 +72,7 @@ class Self implements BeingLike {
     this.ask = async (method, args = {}) => {
       try {
         const out = await this.answer({ id: OWNER }, method, args as JsonObject);
-        return isSilence(out) || isUnreached(out) ? silence : out;
+        return isSilence(out) || isWord(out) ? silence : out;
       } catch {
         return silence;
       }
@@ -151,7 +151,7 @@ class Self implements BeingLike {
   // next, seals to the far ward, opens the reply with the ephemeral secret,
   // and rotates to the announced key once the far door has answered under
   // the current one.
-  async #send(bind: Bind, keys: StandingKeys, announce: boolean, method: string | undefined, args: JsonObject, wanted?: Wanted): Promise<ReplyPayload | typeof silence | ReturnType<typeof unreached>> {
+  async #send(bind: Bind, keys: StandingKeys, announce: boolean, method: string | undefined, args: JsonObject, wanted?: Wanted): Promise<ReplyPayload | typeof silence | Word> {
     // What she asked for, held to what this ward allows. Asking for nothing is
     // the default, and asking for more than the ceiling is the ceiling: budget
     // is granted by a ward, never minted by a being.
@@ -185,22 +185,22 @@ class Self implements BeingLike {
     // relation that comes back round holds a lane the answer needs, and only a
     // bound on the wait can break that. What comes back late is not read.
     //
-    // A wait that ran out is silence, never unreached. Unreached promises
+    // A wait that ran out is `late`, never unreached. Unreached promises
     // nothing was delivered and is safe to retry; a bound that expired knows
     // no such thing, because the far door may have heard and be working still.
     //
     // A harbor answers bytes or nothing. One that throws instead has answered
     // nothing in a louder voice, and is read as nothing: no door was reached.
-    const carried = (keys.ward === this.pk ? this.door(new Uint8Array(bytes)) : this.g.carry(keys.ward, bytes)).then(
+    const carried = (keys.ward === this.pk ? this.door(new Uint8Array(bytes)).then((r) => r.bytes) : this.g.carry(keys.ward, bytes)).then(
       (b) => b,
       () => undefined,
     );
     const out = await within(budget.time, carried);
-    if (out === LATE) return silence;
+    if (out === LATE) return word('late');
     if (out === undefined) return unreached(); // nothing came back. no door was reached.
     const reply = await openReply(out, ephemeral, wardSignPk(keys.ward));
-    if (!reply) return silence; // did not open, or not from that ward
-    if (!('silence' in reply) && keys.next !== null) {
+    if (!reply) return silence; // did not open, or not from that ward: not Quo's bytes
+    if ('object' in reply && keys.next !== null) {
       keys.current = keys.next; // the far door holds `next` as announced. move to it.
       keys.next = null;
     }

package/vectors/framing.json

@@ -2,7 +2,7 @@
   "corpus": "@quo-systems/quo",
   "encoding": "hex",
   "area": "framing",
-  "note": "The formats a second kit must reproduce byte for byte: the ward pk, the digest, the signed ask body, the sealed ask, the sealed reply, the invitation and the knock. Every random input is fixed here, so every output is fixed. The ask body is JSON.stringify of the payload, which is not canonical: these vectors pin the key order sealAsk writes, to, by, next, seq, time, method, args; hops is in no vector, because nothing sets it. A kit that emits another order still interoperates, because a door verifies the bytes it received, but it will not reproduce these vectors. An invitation is JSON too, ward, heir, secret, and a heir secret is the seed of a being key. A knock is an ask whose by is the heir pk, signed with the heir secret, whose next is the knocker's own key, and whose to is the heir; its answer is an ordinary reply, and the heir is spent by it. The ward here is the one from the ward pk vector, and the heir secret is the first entropy it draws, so the invitation it mints and the knock its door binds are these bytes.",
+  "note": "The formats a second kit must reproduce byte for byte: the ward pk, the digest, the signed ask body, the sealed ask, the sealed reply, the invitation and the knock. Every random input is fixed here, so every output is fixed. The ask body is JSON.stringify of the payload, which is not canonical: these vectors pin the key order sealAsk writes, to, by, next, seq, time, method, args; hops is in no vector, because nothing sets it. A kit that emits another order still interoperates, because a door verifies the bytes it received, but it will not reproduce these vectors. An invitation is JSON too, ward, heir, secret, and a heir secret is the seed of a being key. A knock is an ask whose by is the heir pk, signed with the heir secret, whose next is the knocker's own key, and whose to is the heir; its answer is an ordinary reply, and the heir is spent by it. A reply is one of three shapes: an object with its digest, silence, or the ward's word to a key the door has bound, { quo: word }, where word is one of removed, absent, unannounced, repeated, threw. The ward here is the one from the ward pk vector, and the heir secret is the first entropy it draws, so the invitation it mints and the knock its door binds are these bytes.",
   "vectors": [
     {
       "name": "a ward pk from a fixed seed",
@@ -53,6 +53,12 @@
       "replySeed": "4444444444444444444444444444444444444444444444444444444444444444",
       "bytes": "ff2ee45601ec1b67310c7790404585ae697331eee1c1f8cf2419731c1fff3e6b76ec93e97a657e002d9135a7394f3ec33bcd723c9d8947909f4cc659d8dfeed743f5b64bfa87b4ac79074219c1032037de444400b509f31559331b7995f9dfbadbe7fb0f6d46db2257db70f248b7739b3baa2ca79b07b66b29ea680faf79340f2309163c9e3c65fcdb33297c419d1cd8517647"
     },
+    {
+      "name": "a sealed word reply: the ward's word to a key it has bound",
+      "reply": "{\"quo\":\"removed\"}",
+      "replySeed": "4444444444444444444444444444444444444444444444444444444444444444",
+      "bytes": "ff2ee45601ec1b67310c7790404585ae697331eee1c1f8cf2419731c1fff3e6b76ec8dfe7f2227567dce23ea274378db64eb74efed5c91135d62d89db62db7d8ffbd54cf3e82e3272d0b26d59130020755b442a16340798d3eec60bc3a3875020da9276d5e72d712ac3dad7ef287d3c153a0588bf4951b9d3540b1142bd54875a3"
+    },
     {
       "name": "an invitation for a heir: the ward pk, the heir pk, the heir secret, and nothing else",
       "wardSeed": "1111111111111111111111111111111111111111111111111111111111111111",