@quo-systems/quo 0.1.1 → 0.2.1

package/SPEC.md

@@ -94,9 +94,13 @@ gap in Quo or a leak into the ward. The shape is `Ground` in
 
 Returned:
 
-- **The door.** One call: sealed bytes in, sealed bytes out. Always bytes:
+- **The door.** One call: sealed bytes in, sealed bytes out, and one bit
+  beside them, `heard`: whether a key this door holds spoke. Always bytes:
   when the ask did not open, the reply is silence sealed to whatever ephemeral
-  pk the bytes carried, and noise when they carried none.
+  pk the bytes carried, and noise when they carried none. The bit is all a
+  harbor learns from an arrival, never a reason: a pk that only ever brings
+  strangers' bytes is the harbor's to rate or refuse, and what a bound key
+  hears is sealed to its own lid.
 - **The ask.** One call: method and args in, object or silence out.
   In-process and unsealed. This is the one unsealed ask in Quo, and the only
   way a ward is piloted. Judgment, catching, and the return table are not
@@ -132,10 +136,10 @@ stance
   occupants.invite(id)                                 -> invitation | null      awaitable: a key is minted
   occupants.remove(id)                                 -> nothing
 
-  standings.knock(invitation, method?, args?, wanted?) -> object | silence | unreached
+  standings.knock(invitation, method?, args?, wanted?) -> object | silence | word
   standings.take(id, invitation)                       -> id | null            awaitable: it waits for the relation
   standings[id]                                        -> standing | undefined
-  standings[id].ask(method?, args?, wanted?)           -> object | silence | unreached
+  standings[id].ask(method?, args?, wanted?)           -> object | silence | word
   standings.remove(id)                                 -> nothing
 
   wanted = { time? }                                   what this one ask may spend, in milliseconds. optional,
@@ -150,16 +154,16 @@ Return table.
 |                     | null       | the id already names a record, occupant or standing, or is a reserved word                                   |
 | remove(id)          | nothing    | always. removing what is not there is nothing                                                                |
 | knock(inv, m, a, w) | object     | the far being answered                                                                                       |
-|                     | silence    | no ward claims the invitation, or she removed the id, or another consumed it, or the far being chose silence |
-|                     |            | or the invitation is not one, or the wait ran out                                                            |
-|                     | unreached  | her ward could not reach the far door, or could not seal the args                                            |
+|                     | silence    | no ward claims the invitation, or another consumed it, or the far being chose silence                        |
+|                     | word       | why not, when the far door or her own ward can say: removed, absent, unannounced, repeated,                  |
+|                     |            | threw, unreached, late, invitation. see "Silence, the words, error"                                          |
 | take(id, inv)       | id         | she knocked with this invitation and was answered, and the id is fresh                                       |
 |                     | null       | no answered knock on this invitation, or the id already names a record, or is a reserved word                |
 | standings[id]       | standing   | the record exists                                                                                            |
 |                     | undefined  | it does not. not an error                                                                                    |
 | ask(m, a, w)        | object     | she answered                                                                                                 |
-|                     | silence    | she, or her ward, said nothing; or the wait ran out                                                          |
-|                     | unreached  | her ward could not reach the far door, or could not seal the args                                            |
+|                     | silence    | she chose to say nothing, or bytes came back that are not Quo's                                              |
+|                     | word       | why not: removed, absent, repeated, threw, unreached, late, dropped                                          |
 
 Ask, knock, invite and take are awaitable. Async where the language has it,
 blocking where it does not. Every ask she makes is a new call.
@@ -175,16 +179,19 @@ The asker has three shapes and no fourth, and nothing else ever reaches her.
 `OWNER` and `PUBLIC` are reserved words: invite and take refuse them, so no
 occupant can ever wear either name.
 
-## Silence, unreached, error
+## Silence, the words, error
 
-Three words for "no object came back", and only three. Everything in Quo
-that can go wrong ends in one of them, and a being who knows the three never
-needs a fourth.
+Three kinds of answer to "no object came back", and only three. Everything in
+Quo that can go wrong ends in one of them, and a being who knows the three
+never needs a fourth.
 
 ```
 error       an object. hers.             { error: ... }, or any shape her output schema declares.
-silence     the ward's word. heard.       bytes came back, or would have, and said nothing.
-unreached   the ward's word. not heard.   nothing came back. nothing is known to have been delivered.
+silence     the ward's silence.          bytes came back, or would have, and said nothing.
+                                         it is what a stranger hears, and what she hears when
+                                         the far being chose to say nothing.
+a word      the ward's word.             one of nine, said only to someone the ward can name,
+                                         and never to a stranger: why no object came.
 ```
 
 - An **error** is an ordinary answer. Quo never reads it, never makes it,
@@ -192,42 +199,75 @@ unreached   the ward's word. not heard.   nothing came back. nothing is known to
   `{ error: 'unknown ask' }` for an ask she did not declare or hid; the
   owner's asks answer error objects for what they refuse; both are hers to
   read like any object.
-- **Silence** is not blindly retryable: the far being may have done the work
-  and the answer was lost.
+- **Silence** names no reason, by law. It is what the door says to bytes it
+  cannot admit, so that a stranger learns nothing, and what a being says
+  when she chooses to say nothing. It is not blindly retryable: the far
+  being may have done the work and the answer was lost.
+- **A word** names the reason. It is said to a key the door has bound, sealed
+  to that key's lid, or by her own ward to her, in process. Nobody else ever
+  hears one. A word is not an object: it carries nothing but its name, a
+  being cannot make one, and one that comes out of a being is read as her
+  having thrown.
+
+The nine words, and who says them:
+
+```
+the door, to a key it has bound, on the wire as { quo: word }
+  removed        the relation this key spoke for was removed by the being who invited it
+  absent         the being who invited it did not come back this run; her cells wait
+  unannounced    the knock announced no key of her own, so it bound nothing
+  repeated       the number was already honoured, or is at or below the span
+  threw          she threw, or answered a shape that is not hers to make
+
+her own ward, to her, and never on the wire
+  unreached      no far door was reached. nothing is known to have been delivered.
+  late           the wait ran out. the far door may have heard and be working still.
+  invitation     the invitation is not one. nothing was sent.
+  dropped        she dropped the standing, and asked on what she held. nothing was sent.
+```
+
 - **Unreached** is safe to retry: nothing is known to have been delivered.
-  It carries no reason. What she may know is that nothing came back, and
-  that is all. In one case the far ward heard and died before it could
-  answer, and the wire says nothing about it; asking again asks under the
-  next number and is heard, so the retry is safe all the same. See Closed.
-
-Who says what. A being says objects and silence, never unreached: the shape
-is the ward's, and a ward that sees it come out of a being reads it as
-silence. A ward says all three to its own being, and only objects and
-silence on the wire: unreached never crosses, it is the wire's nothing
-turned into a word. A harbor says nothing at all; it returns bytes or
-nothing, and does not know the word silence. The owner hears objects: a
-silence a being met is `{ error: 'silence' }` and an unreached is
-`{ error: 'unreached' }`, because the owner is piloting and an object is
+  In one case the far ward heard and died before it could answer, and the
+  wire says nothing about it; asking again asks under the next number and
+  is heard, so the retry is safe all the same. See Closed.
+- **Late** is not unreached, and the difference is the whole reason there are
+  two words: a bound that expired promises nothing about delivery.
+- **Removed**, **absent**, **unannounced** and **repeated** are refusals: the
+  ask reached no being and nothing was written. They are said only because
+  the key that asked has already proven who it is, so a reason to it is an
+  oracle to nobody. **Threw** is a choice: she was reached, and the number is
+  spent.
+
+Who says what. A being says objects and silence, never a word: the shape is
+the ward's, and a ward that sees one come out of a being answers `threw`. A
+ward says all three to its own being, and on the wire objects, silence and
+the five door words, each sealed to the lid of the key that asked; the four
+ward words never cross, they are her own ward's and are said in process. A
+harbor says nothing at all; it returns bytes or nothing, and does not know
+any of these words. What it learns from an arrival is one bit, `heard`,
+beside the bytes the door hands it: whether a key the door holds spoke. The
+owner hears objects: a silence a being met is `{ error: 'silence' }` and a
+word is `{ error: word }`, because the owner is piloting and an object is
 what a shell can print. The ask pointer answers the value silence only when
 the ward itself threw.
 
-### What her ward turns into silence
+### What her ward says to her
 
-Before or after the wire, her own ward answers silence in five cases, and
-tells her nothing about which.
+Before or after the wire, her own ward answers on its own in five cases,
+and each says what it is.
 
 ```
 S1  the invitation is not one         a shape that is not a ward pk, a heir with no secret, a secret with no heir.
-                                      nothing is sent.
+                                      nothing is sent. the word is `invitation`.
 S2  the standing is gone              she held a standing, dropped it, and asked on what she held.
-                                      nothing is sent. an ask issued while it stood is answered.
+                                      nothing is sent. an ask issued while it stood is answered. the word is `dropped`.
 S3  the wait ran out                  the ask's time was spent and no reply was read.
                                       what comes back late is not read. the number is spent.
-                                      an ask still waiting at its lane when the wait ran out is never sent.
+                                      an ask still waiting at its lane when the wait ran out is never sent. the word is `late`.
 S4  the reply is not one              bytes came back that do not open, or are not signed by the ward they
-                                      were sent to, or are not `{ silence }` nor `{ object, seen }` with an
-                                      object present and seen a digest or null. the number is spent.
-S5  the far door said silence         every case in the next list.
+                                      were sent to, or are none of the three reply shapes. the number is spent.
+                                      not Quo's bytes: silence.
+S5  the far door answered             silence, or a word, exactly as the door said it.
 ```
 
 And unreached in two: `U1` the args are not a value, or could not be
@@ -236,69 +276,83 @@ sealed, so nothing left;
 taken all the same, and the gap it leaves in the count is harmless: the door
 honours any number above its mark.
 
-### What the door turns into silence
+### What the door says
 
-The door answers one silence in thirteen cases. The first ten are refusals:
-the ask reached no being, and nothing was written, spent, rotated or
-touched. The last three are choices: the ask reached her, so the number is
-spent and the keys are rotated, and what she wrote in her cells is hers.
+The door judges thirteen cases, in this order, and the first case met is
+the answer. The first seven are strangers: bytes the door cannot admit, met
+with one silence whatever the case, and nothing written. The next three are
+refusals to a key the door has bound: still nothing written, but a word,
+because the asker has proven who it is. The last three are choices: the ask
+reached her, so the number is spent and the keys are rotated, and what she
+wrote in her cells is hers.
 
 ```
-refusals
+strangers: silence, nothing written, heard false
 D1   the box does not open           wrong padlock, garbage, too short. the reply is sealed to the lid if
                                      the bytes carried one, and is noise otherwise. a lid that will not
                                      take a seal, a small-order point, is no lid: noise.
 D2   the payload is malformed        by or next not 64 hex, method not a string, args not an object, seq
-                                     below one, time not a whole number above zero.
+                                     below one, time not a whole number above zero, hops not a whole
+                                     number or at zero.
 D3   for nobody, and nobody is home  no public being on this ward.
 D4   for nobody, signature fails     the payload names a key it was not signed with.
-D5   the heir is not held            never minted here, or forgotten because the id was removed.
+D5   the heir is not held            never minted here, and not one she removed either.
 D6   the key is not admitted         not the key held for the heir, and not the key it announced. a
-                                     forged key, an unannounced key, a heir already spent.
-D7   she is not there                the occupant record is gone, or the being did not come back this run.
-D8   signature fails                 under an admitted key.
-D9   a knock announces nothing       the heir is fresh and next is null. it binds nothing.
-D10  the number is refused           already honoured, or at or below the span.
-choices
-D11  she threw
+                                     forged key, an unannounced key, a heir already spent. a heir she
+                                     removed, under a key that was not the one she removed.
+D7   signature fails                 under an admitted key, or under the key held for a heir she removed.
+refusals to a bound key: a word, nothing written, heard true
+D8   she is not there                `removed`: the occupant record is gone, and this is the key it was
+                                     bound to when it went. `absent`: the being did not come back this run.
+D9   a knock announces nothing       `unannounced`: the heir is fresh and next is null. it binds nothing.
+D10  the number is refused           `repeated`: already honoured, or at or below the span.
+choices: the number spent, the keys rotated, heard true
+D11  she threw                       `threw`
 D12  she answered silence            on a named ask, or on the empty ask. nothing at all is silence too.
-D13  she answered an unreached shape
+D13  she answered a word             `threw`: a word is not hers to make.
 ```
 
-A refusal is judged in that order, and the first case met is the answer.
-The signature is verified before the number is spent, so a stranger cannot
-burn a number she could not sign for; a refusal at D9 or D10 has passed the
-signature and still writes nothing.
+The signature is verified before anything is written and before any word is
+said, so a stranger cannot burn a number she could not sign for and cannot
+hear a word she could not sign for. The public being is asked by strangers
+only, and a stranger hears silence for whatever she then does: her choices
+are hers, and her insides are not a stranger's to read.
+
+A removed relation leaves the door one thing: the keys it held for that
+heir when the id went, kept apart from the heirs under `gone` in the
+partition, bounded, oldest out. That is what lets the door say `removed` to
+the one party who can sign as those keys, and silence to everyone else.
+Nothing else survives a removal.
 
 ### The law of one silence
 
-1. Every case above is one reply: `{ silence: true }`, sealed to the lid the
-   ask came with, signed by the ward key. Same bytes, same length. A
-   stranger cannot tell a refusal from a choice, nor one refusal from
-   another, nor any of them from a being who chose to say nothing.
+1. Every stranger's case is one reply: `{ silence: true }`, sealed to the
+   lid the ask came with, signed by the ward key. Same bytes, same length.
+   A stranger cannot tell one refusal from another, nor any of them from a
+   being who chose to say nothing.
    The door equalizes the bytes and not the time it took to write them. The
-   ten refusals are cheap and alike; a choice ran a being first, and a being
-   is code this document does not bound. So whoever holds a standing may
-   learn from a clock that she was reached and said nothing, rather than
-   refused at the door. A stranger holds no standing and reaches no choice,
-   which is why the refusals are the ones made alike. Equalizing the time
-   would mean waiting out the allowance ceiling on every silence, and the
-   door will not buy that.
+   seven cases are cheap and alike. A word, to a key the door has bound, is
+   another length, and may be: whoever hears it has already proven who they
+   are.
 2. A refusal writes nothing. No number, no key, no heir, no cell, no bind.
    The same bytes presented again meet the same refusal, and a stranger who
-   knocks a thousand times leaves no mark.
+   knocks a thousand times leaves no mark. This holds for the three
+   refusals a bound key hears just the same: a word costs nothing.
 3. A choice writes what a heard ask writes. The number is spent and the keys
    rotate, so the relation goes on: the next ask on it is answered, and a
-   silence never kills a standing.
-4. Silence leaves the caller's record as it was. A silent named answer
-   leaves `seen` untouched; a silent empty ask leaves `blueprint` and
-   `digest` untouched.
-5. Her ward never confuses her. Silence and unreached are told apart
-   always, and by nothing else: silence is bytes the far ward wrote, or a
-   bound her ward rang; unreached is the wire's nothing. A ward never
-   answers nothing, so that nothing always means unreached.
-6. Nobody enforces what a being does with silence. It is one value she
-   compares against, and the base class hands it to her unchanged.
+   silence or a `threw` never kills a standing.
+4. Silence and a word leave the caller's record as it was. A silent named
+   answer leaves `seen` untouched; a silent empty ask leaves `blueprint` and
+   `digest` untouched; a word moves neither, and her keys do not rotate on
+   one.
+5. Her ward never confuses her. Silence, a word and unreached are told apart
+   always, and by nothing else: silence is bytes the far ward wrote and
+   chose to say nothing with; a word is a reason, from the far door or her
+   own ward; unreached is the wire's nothing. A ward never answers nothing,
+   so that nothing always means unreached.
+6. Nobody enforces what a being does with silence or a word. Each is one
+   value she compares against, and the base class hands them to her
+   unchanged.
 
 `test/silence.test.ts` asserts every numbered line above, by its number.
 
@@ -324,15 +378,17 @@ nothing was written down that a harbor would later have to lie about. This
 holds all the way down: a container read through her cells is part of her
 cells. The guard is `src/ward/cells.ts`.
 
-### Silence and unreached
+### Silence and the words
 
-Two of the three words for "no object came back". The chapter "Silence,
-unreached, error" is the whole of them; here only the values. Silence is one
-distinguished value. Null is an answer. Unreached is a second distinguished
-value, her ward's own word. Neither is an object, and neither carries
-anything. In this kit silence is the symbol `quo.silence` and unreached is a
-frozen object under the symbol key `quo.unreached`, both from
-`src/being/silence.ts`.
+Two of the three kinds of "no object came back". The chapter "Silence, the
+words, error" is the whole of them; here only the values. Silence is one
+distinguished value. Null is an answer. A word is a second kind of
+distinguished value, her ward's own, nine of them, `unreached` among them.
+None is an object, and none carries anything but its name. In this kit
+silence is the symbol `quo.silence` and a word is a frozen object under the
+symbol key `quo.word` holding its name, both from `src/being/silence.ts`;
+`isWord` and `wordOf` read them, and `isUnreached` is the one word a being
+asks about most.
 
 ### Blueprint, schema, digest
 
@@ -483,7 +539,8 @@ the standing is.
 ### The public being
 
 A ward may have one public being, and no more. She is an ordinary being,
-booted by the owner and marked public. Arrivals for no heir reach her. Her
+booted by the owner and then marked public by the owner's `public` ask.
+Arrivals for no heir reach her. Her
 asker is `{}`: she is asked by anyone, and she can tell. She may hold
 standings. She may invite, and an occupant of hers arrives named while
 strangers still arrive as `{}`. A ward without a public being answers
@@ -504,6 +561,14 @@ So her answer must be safe to repeat. This is her obligation, not a gap at
 the door. Anything that must happen once lives behind an invitation, where
 there is a heir and a count.
 
+Nothing else about her is different. Her cells, her standings and what she
+keeps are hers, exactly as they are for every being, and Quo has no say in
+them: she may hold a board every stranger plays on, a catalogue, a queue, or
+nothing at all. She is an ordinary being who chose to describe herself to
+strangers and to answer them, and that choice is the whole of what makes her
+public. A stranger who keeps knocking is the harbor's, never hers and never
+the door's.
+
 ### How a relation crosses wards
 
 1. She mints an id. Her ward mints a heir for it, keeps the pk, and hands
@@ -670,13 +735,15 @@ Every arrival is judged by the door, and named by it or falls silent.
 2. For nobody: find the public being, verify the signature under the key the
    payload names, and dispatch as `{}`. Nothing is written.
 3. For a heir: admit the signer if it is the key held for that heir or the
-   key that key announced. Find the being who minted the id and check she
-   still holds the occupant. Verify the signature. Only then spend the
-   number and settle the keys, so a stranger cannot burn a number she could
-   not sign for, and the same bytes twice rotate nothing. Dispatch as
-   `{ id }`.
-4. Catch every throw and answer silence. Treat an unreached shape coming out
-   of a being as silence.
+   key that key announced, or the key held when she removed the id. Verify
+   the signature. Only then say anything or write anything: a removed
+   relation is `removed`, a being not back this run is `absent`, a knock
+   with no key is `unannounced`, a number already honoured is `repeated`,
+   and none of those writes. Else spend the number and settle the keys, so
+   a stranger cannot burn a number she could not sign for, and the same
+   bytes twice rotate nothing. Dispatch as `{ id }`.
+4. Catch every throw and answer `threw` to a bound key, silence at the
+   public being. Treat a word coming out of a being as a throw.
 5. On every answered named ask, run her describe for that asker in process,
    hash it, and put the digest next to the object in the reply. One trip. A
    describe that throws or falls silent costs the digest and nothing else.
@@ -684,7 +751,7 @@ Every arrival is judged by the door, and named by it or falls silent.
 6. Answer by the same call the ask came in on.
 
 A stranger is bytes the ward cannot admit, and every way of being one is
-listed, with a number, under "Silence, unreached, error". The public being
+listed, with a number, under "Silence, the words, error". The public being
 is the one door a stranger may walk through, and only because she chose it.
 
 ### Inner and outer
@@ -729,7 +796,8 @@ ask on the wire     box     = ephemeral X25519 pk (32) || AES-GCM( payload || si
                               refused at zero, and nothing sets it.
 reply on the wire   box     = ephemeral X25519 pk (32) || AES-GCM( reply || signature (64) )
                               sealed to the ask's ephemeral pk, signed by the ward key
-                    reply   = JSON { object, seen } | { silence: true }
+                    reply   = JSON { object, seen } | { silence: true } | { quo: word }
+                              word: removed | absent | unannounced | repeated | threw. only to a key the door bound.
 ```
 
 Nothing rides outside the box, and `to` is the reason to say so. A heir is
@@ -759,6 +827,14 @@ silent. It keeps every being it booted, builds every stance, mints every
 key, seals every ask that leaves, and unseals every one that arrives. Its
 beings trust it blindly. It trusts its harbor the same way.
 
+Only a ward moves. A being has no address of her own and never leaves the
+ward that booted her: her peers hold a standing at a ward pk, and what they
+trust is that ward's word about an id, never the being under it. So which
+beings share a ward is settled when they are booted, and a ward migrates
+whole, with everyone in it, or not at all. To move one being would be to ask
+every peer to trust a ward they never accepted, and asking that is what an
+invitation is.
+
 Its ward is itself. It boots itself as the first being in its own map, under
 its own pk, and its own stance is built by the same code that builds every
 being's. Its cells are its partition, all the way down.
@@ -819,6 +895,8 @@ partition
               answered    <ward>:<heir> | public:<ward> -> true                            knocked and answered
               minted      the last eight pks her side minted
   heirs     heir pk -> { being, id, current, announced, fresh, mark, spent }   the door's view of every occupant
+  gone      heir pk -> { current, announced }   the keys held when an id was removed, bounded, so their
+                                                holder hears `removed` and nobody else hears a thing
   public    the one public being's key, or null
 ```
 
@@ -852,8 +930,9 @@ before the restart can be taken after it; a door that restarts still refuses
 what it already honoured.
 
 A constructor that throws on a restart takes only herself down: she is
-absent this run, no door, so silence at her door, and her cells sit untouched
-waiting for the run that can read them. The ward is up and so is everyone
+absent this run, no door, so `absent` at her door to the keys she bound and
+silence to strangers, and her cells sit untouched waiting for the run that
+can read them. The ward is up and so is everyone
 else. A class the harbor no longer knows is the same absence, and so is a
 class the harbor holds at a body the cells were not written for: which body
 a ward reboots on is the harbor's decision, and a ward cannot tell an old
@@ -883,19 +962,25 @@ become one.
 The root is not an occupant. It holds no heir, no key, no invitation. The
 ward names every arrival on the ask `{ id: 'OWNER' }`, the third asker of the
 ward-to-being edge, and answers it as such; an owner at the door arrives as
-her id. What an owner can do is exactly what a being cannot: boot, place a
-relation into a being of the ward, and take one out of her. The root's asks
-carry no allowance of their own.
+her id. What an owner can do is exactly what a being cannot: boot, mark the
+public being, place a relation into a being of the ward, take one out of
+her, and take her out of the ward. The root's asks carry no allowance of
+their own. The ward is a being to her owner: the empty ask is her describe,
+and each ask in it carries a description and an input naming its fields, as
+a being's asks do, so that a side renders the owner's asks the way it
+renders anyone's and holds no list of its own.
 
 ```
-ask()                                    -> { asks: [boot, invite, knock, remove],
+ask()                                    -> { asks: [boot, public, invite, knock, remove, unboot],
                                               notes: { pk, beings: { key: { class, public, digest } } } }
-ask('boot',   { key, class, public? })   -> { booted: key } | { error }
+ask('boot',   { key, class })            -> { booted: key } | { error }
+ask('public', { key })                   -> { public: key } | { error }
 ask('invite', { being, id })             -> invitation | null | { error }
 ask('knock',  { being | { boot: class, key },
                 id, invitation, method?, args?, wanted? })
                                          -> { taken: id | null, answer } | { error: 'silence' | 'unreached' | ... }
 ask('remove', { being, id })             -> { removed: id } | { error }
+ask('unboot', { being })                 -> { unbooted: key, removed: [id, ...] } | { error }
 anything else                            -> { error: 'unknown ask' }
 ```
 
@@ -903,9 +988,15 @@ anything else                            -> { error: 'unknown ask' }
   spend, and saying nothing is the ward's default, exactly as for a being.
 - The describe runs every being's own describe as `OWNER` and hashes it; a
   being that throws or falls silent there shows a null digest.
-- Boot refuses a key already booted, a class the harbor does not know, and a
-  second public being; a boot that made nobody leaves the partition as it
-  found it. A throw at birth is that boot's error, and nothing half-lives.
+- Boot refuses a key already booted and a class the harbor does not know; a
+  boot that made nobody leaves the partition as it found it. A throw at
+  birth is that boot's error, and nothing half-lives.
+- Public marks a being already booted as the ward's one public being. It
+  refuses a key not booted, the ward's own pk, and a second public being
+  while one stands, since marking a second would leave the first holding
+  every relation she had, reachable by nobody at the bare pk and told by
+  nobody she was replaced. Marking the one already public again is
+  answered, and changes nothing.
 - Invite on the ward's own pk mints an owner, and only the root may ask it:
   from the door it is answered as an invite on nobody. The ward has
   occupants, its owners, and no standings: a knock for the ward itself is a
@@ -916,6 +1007,17 @@ anything else                            -> { error: 'unknown ask' }
   chose her class and her cells at boot; her owner may choose a relation for
   her too. The boot form names a being new or existing: a key already booted
   is a being of theirs, not a class that failed.
+- **Unboot is the inverse of boot, and the only way a being leaves a ward.**
+  Every relation she holds goes with her, by the same calls she would have
+  used herself, so an occupant of hers hears `removed` from the keys her door
+  kept rather than meeting a being who is not there; the owner is told which
+  ids went. Her cells and her bind table go too, because a row naming a being
+  no door holds would boot her again on the next restart. If she was the
+  public being the mark goes with her, and the ward answers arrivals for no
+  heir with silence as one that never had a public being does. The ward
+  itself is refused, for the reason knock is: it would be a ward deleting
+  itself from inside its own map, leaving its owners bound to a door that is
+  gone.
 - The owner's remove is the mirror of its knock: a relation out of a being,
   by id, and the id may be an occupant or a standing, since the two share
   one namespace. The being's own remove says nothing; the owner hears
@@ -972,7 +1074,8 @@ Not stressed with:
   from nothing else. There is no estate. The far being is sovereign: she may
   fall silent on the ask after the knock, and nobody is told.
 - Blacklists, rate limits, and what to do with a pk that keeps knocking with
-  garbage. Its own.
+  garbage. The door says `heard` or not beside every reply; the rest is the
+  harbor's.
 
 ## The harbor
 
@@ -1004,7 +1107,9 @@ The harbor:
   never answers nothing on its own patience; it waits, and the ward's bound
   ends the ask.
 - Receives bytes from the wire for a ward pk it holds, hands them to that
-  one door, and returns what the door returned.
+  one door, and returns what the door returned. Beside the bytes the door
+  says whether a key it holds spoke; the harbor may count that per pk and
+  act on it, and learns nothing more.
 - Vouches: the seed stays secret, the partition is reached by this ward
   alone, the ask reaches its root owner alone, the device is the harbor's
   to defend. How is the device's business. Custody is this vouch: two
@@ -1123,7 +1228,10 @@ socket this harbor holds for that pk, and never onward by request. So a
 harbor that cannot be dialed is reached through the one it dialed, by
 anyone who holds a hint that its pk is there. The **dialer**,
 `src/harbor/dial.ts`, is that harbor's half: one held socket to a URL, its
-own pks announced when the line opens, the listener's bound, dialed again
+own pks announced when the line opens and again whenever what this harbor
+holds changes, so a ward booted, adopted or dropped on a line already in hand
+is reachable through it without waiting for that line to fall; the listener's
+bound, dialed again
 with a wait that doubles from a second to thirty when the line drops, and
 while it is dialed it is one of the harbor's fallbacks, where a pk nobody
 here knows is sent. Fallbacks are a list and a pk is tried down it in
@@ -1147,7 +1255,7 @@ class. Her ward does all of that, and she trusts it blindly: what the ward
 names is true.
 
 She asks her standings by method and args and gets back an object, silence,
-or unreached. She invites whom she wants, in her own time, and removes them
+or a word. She invites whom she wants, in her own time, and removes them
 when she decides. She knocks with invitations she was given and takes the
 ones she wants. She answers every ask her ward brings her with an object or
 silence; an error is an ordinary object, and she never throws outward. She
@@ -1160,9 +1268,10 @@ only the ward instantiates.
 
 ### Her obligations
 
-1. Args are one object. A throw is silence outside: the ward is in the
-   middle of every call and catches, always, in every language. An error is
-   an object her output schema declares.
+1. Args are one object. A throw is the word `threw` outside, to whoever the
+   door has bound, and silence to a stranger: the ward is in the middle of
+   every call and catches, always, in every language. An error is an object
+   her output schema declares.
 2. No lifecycle. Construction with the stance is birth. A restart is silent.
 3. The empty ask is hers. Who gets what blueprint is her decision. She obeys
    the shape, never a content. The empty ask must be safe to repeat: her
@@ -1327,7 +1436,7 @@ alone, one JavaScript file and one declaration file per source file with
 every relative import rewritten, and the exports map points there, types
 beside default. The
 build runs before every gate and every publish and is never tracked;
-nothing under `test/` or `estate/` imports it except through the package
+nothing under `test/` or `dock/` imports it except through the package
 name, which is how a consumer does. `test/package.test.ts` is the one
 suite that meets the package as a stranger: it packs the tarball,
 installs it into an empty folder, and imports every entry point under
@@ -1347,7 +1456,7 @@ test/             the suites.
 vectors/          fixed inputs and outputs: the arithmetic, Quo's own framing, the frames on the wire.
 ```
 
-`estate/` sits beside `src` and is not Quo: the beings, screens, model sides
+`dock/` sits beside `src` and is not Quo: the beings, screens, model sides
 and real harbors built on it, each folder with its own document. This
 document does not read them, and they may not add a word to it. Its one
 claim on them is that every harbor there passes `src/conformance/` untouched.
@@ -1398,11 +1507,14 @@ passes the same suite. Those tests are the checklist, not the mock.
   on Quo actually has -- scattered wards on scattered harbors, partners and
   employees invited, knocking, taken, kicked, and moving to harbors of their
   own. It keeps a model of the graph, plays legal moves against it from three
-  fixed seeds, and after every move holds three things: that the ledger every
-  ward keeps closes on both ends, that every arc in it answers when asked
-  exactly what being that arc means, and that the same seed played under all
-  three topologies lands on the same graph. The last is the promise of Quo at
-  a scale a scene cannot reach. A relation is two arcs and never one edge:
+  fixed seeds, and after every move holds two things: that the ledger every
+  ward keeps closes on both ends, and that every arc in it answers when asked
+  exactly what being that arc means. The second is held under all three
+  topologies, and that is the promise of Quo at a scale a scene cannot
+  reach: the model never learns the topology, so neither may any answer. The
+  model is the script's own bookkeeping and is never compared with itself
+  across topologies, which would hold by construction and prove nothing. A
+  relation is two arcs and never one edge:
   the occupant is the host's, the standing is the guest's, and the model
   keeps them apart because the ward does. A red run prints its seed and the
   moves that got there. It is read beside one hand-written story that says in
@@ -1414,10 +1526,11 @@ passes the same suite. Those tests are the checklist, not the mock.
   replay, a restart, and every byte on the wire inspected for anything inner.
 - `test/public.test.ts`: the public being, what the door does and does not
   do for her.
-- `test/silence.test.ts`: the chapter "Silence, unreached, error" by its
-  numbers: the five silences and two unreacheds of her ward, the thirteen
-  cases of the door with a partition snapshot under each, hops refused at
-  zero, and the six lines of the law of one silence.
+- `test/silence.test.ts`: the chapter "Silence, the words, error" by its
+  numbers: the five cases and two unreacheds of her ward, the thirteen
+  cases of the door with a partition snapshot under each, seven strangers
+  met with one silence and six bound keys hearing their word, hops refused
+  at zero, and the six lines of the law of one silence.
 - `test/blueprint.test.ts`: blueprints and instantiation through a real
   ward. What a boot leaves behind, what a restart brings back when the code
   moved under the cells, the gate and the door, the reserved ids.
@@ -1578,6 +1691,19 @@ Decided here, so that the answer is not rediscovered:
   the default says so with `wanted` on the ask, which is the whole of what a
   being needs. An owner who wants another ceiling is asking for a different
   ward.
+- **A leaked seed is a taken ward, and there is no succession.** The seed has
+  one custodian, the harbor, which vouches that it stays secret; a being
+  never touches it and no byte on the wire carries it. So it is lost only
+  where that vouch broke, and a broken vouch is total and silent. It is not
+  lost alone: a harbor keeps the seed and the partition under one name, and
+  the partition holds every relation's keys, so there is no event where the
+  address is taken and the relations are not. Nothing is left to succeed to.
+  A succession signed by the key that speaks now is signed as well by
+  whoever took it, and one that could not be forged would have to be
+  committed to in advance, in the invitation, which carries nothing. The
+  answer is a new ward, and every peer invited again as anyone is invited.
+  Lose the seed, lose the ward; there is no recovery inside Quo, and that is
+  the same sentence the root owner already hears.
 
 ## Glossary
 
@@ -1608,8 +1734,12 @@ Decided here, so that the answer is not rediscovered:
 - **blueprint**: her interface as she chooses to show it to one asker.
 - **digest**: SHA-256 over the JCS of a blueprint. Per relation.
 - **seen**: the digest her ward last saw arrive with an answer.
-- **silence**: the far side said nothing. Not retryable blindly.
-- **unreached**: her ward could not reach the far door. Retryable.
+- **silence**: the far side said nothing, or the door would not admit the
+  bytes. Names no reason. Not retryable blindly.
+- **word**: the ward's reason, said only to a key the door has bound or by
+  her own ward to her. Nine: removed, absent, unannounced, repeated, threw,
+  unreached, late, invitation, dropped.
+- **unreached**: the word for no far door reached. Retryable.
 - **notes**: hers, inside every occupant record. Quo never reads it.
 - **partition**: the ward's files. Everything durable, every secret.
 - **ward record**: what a harbor keeps to boot one ward again: seed,