@quo-systems/quo 0.1.1 → 0.2.1

package/dist/ward/ward.js

@@ -4,9 +4,9 @@
 // the first being in its own map, and every being it later instantiates gets
 // a stance built by the same code. Mints every key, seals every ask that
 // leaves, opens every one that arrives.
-import { silence, isSilence, unreached, isUnreached } from '../being/silence.js';
+import { silence, isSilence, unreached, isWord, word } from '../being/silence.js';
 import { OWNER } from '../being/types.js';
-import { at, open, put, emptyBind, emptyCells } from './partition.js';
+import { at, drop, open, put, emptyBind, emptyCells } from './partition.js';
 import { Heirs } from './heirs.js';
 import { makeDoor } from './door.js';
 import { buildStance } from './stance.js';
@@ -65,7 +65,7 @@ class Self {
         this.ask = async (method, args = {}) => {
             try {
                 const out = await this.answer({ id: OWNER }, method, args);
-                return isSilence(out) || isUnreached(out) ? silence : out;
+                return isSilence(out) || isWord(out) ? silence : out;
             }
             catch {
                 return silence;
@@ -83,21 +83,46 @@ class Self {
             pk: this.pk,
             doors: this.doors,
             publicKey: () => this.p.public,
-            instantiate: (key, className, isPublic) => this.#instantiate(key, className, isPublic),
+            instantiate: (key, className) => this.#instantiate(key, className),
+            unboot: (key) => this.#unboot(key),
+            setPublic: (key) => void (this.p.public = key),
         }, asker, method, args);
     }
     // ---- ward functions. on the object. no stance reaches them.
-    #instantiate(key, className, isPublic = false) {
+    #instantiate(key, className) {
         if (!key || this.doors.has(key))
             return null;
         const door = this.#boot(key, className);
         if (!door)
             return null;
         door.cells.class = className; // so a restart finds her
-        if (isPublic)
-            this.p.public = key;
         return door;
     }
+    // The inverse of boot, and the only way a being leaves a ward. Her
+    // relations go first and by the same calls she would have used herself,
+    // so every occupant hears `removed` at the door from the keys it kept,
+    // rather than meeting a being who is simply not there any more. What is
+    // left after that is her cells and her bind table, and they go with her:
+    // a row naming a being no door holds would be read on the next restart
+    // and boot her again.
+    #unboot(key) {
+        const door = this.doors.get(key);
+        if (!door || key === this.pk)
+            return null;
+        const occupants = Object.keys(door.cells.occupants), standings = Object.keys(door.cells.standings);
+        for (const id of occupants)
+            door.stance.occupants.remove(id);
+        for (const id of standings)
+            door.stance.standings.remove(id);
+        // A ward whose public being is gone answers arrivals for no heir with
+        // silence, as a ward that never had one does.
+        if (this.p.public === key)
+            this.p.public = null;
+        drop(this.p.beings, key);
+        drop(this.p.bind, key);
+        this.doors.delete(key);
+        return [...occupants, ...standings];
+    }
     // Nothing is written until there is somebody to write it for: a class the
     // harbor does not know makes no being, and a boot that made nobody must
     // leave the partition as it found it.
@@ -173,22 +198,22 @@ class Self {
         // relation that comes back round holds a lane the answer needs, and only a
         // bound on the wait can break that. What comes back late is not read.
         //
-        // A wait that ran out is silence, never unreached. Unreached promises
+        // A wait that ran out is `late`, never unreached. Unreached promises
         // nothing was delivered and is safe to retry; a bound that expired knows
         // no such thing, because the far door may have heard and be working still.
         //
         // A harbor answers bytes or nothing. One that throws instead has answered
         // nothing in a louder voice, and is read as nothing: no door was reached.
-        const carried = (keys.ward === this.pk ? this.door(new Uint8Array(bytes)) : this.g.carry(keys.ward, bytes)).then((b) => b, () => undefined);
+        const carried = (keys.ward === this.pk ? this.door(new Uint8Array(bytes)).then((r) => r.bytes) : this.g.carry(keys.ward, bytes)).then((b) => b, () => undefined);
         const out = await within(budget.time, carried);
         if (out === LATE)
-            return silence;
+            return word('late');
         if (out === undefined)
             return unreached(); // nothing came back. no door was reached.
         const reply = await openReply(out, ephemeral, wardSignPk(keys.ward));
         if (!reply)
-            return silence; // did not open, or not from that ward
-        if (!('silence' in reply) && keys.next !== null) {
+            return silence; // did not open, or not from that ward: not Quo's bytes
+        if ('object' in reply && keys.next !== null) {
             keys.current = keys.next; // the far door holds `next` as announced. move to it.
             keys.next = null;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quo-systems/quo",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "Quo: an object asks another object and gets an answer, without knowing where it is. Being, Ward, Harbor.",
   "keywords": [
     "quo",
@@ -18,40 +18,28 @@
     "node": ">=22.18"
   },
   "exports": {
-    ".": { "types": "./dist/being/index.d.ts", "default": "./dist/being/index.js" },
-    "./ward": { "types": "./dist/ward/index.d.ts", "default": "./dist/ward/index.js" },
-    "./harbor": { "types": "./dist/harbor/index.d.ts", "default": "./dist/harbor/index.js" },
-    "./conformance": { "types": "./dist/conformance/index.d.ts", "default": "./dist/conformance/index.js" }
+    ".": {
+      "types": "./dist/being/index.d.ts",
+      "default": "./dist/being/index.js"
+    },
+    "./ward": {
+      "types": "./dist/ward/index.d.ts",
+      "default": "./dist/ward/index.js"
+    },
+    "./harbor": {
+      "types": "./dist/harbor/index.d.ts",
+      "default": "./dist/harbor/index.js"
+    },
+    "./conformance": {
+      "types": "./dist/conformance/index.d.ts",
+      "default": "./dist/conformance/index.js"
+    }
   },
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
-    "check": "npm run build && npm run typecheck && npm run lint && npm test && npm run check:estate",
-    "check:estate": "node --test \"estate/test/*.test.ts\"",
-    "pretypecheck": "npm run build",
-    "typecheck": "tsc",
-    "typecheck:watch": "tsc --watch",
-    "lint": "npm run lint:ts && npm run lint:md",
-    "lint:ts": "oxlint --type-aware",
-    "lint:md": "markdownlint-cli2",
-    "lint:fix": "oxlint --type-aware --fix && markdownlint-cli2 --fix",
-    "pretest": "npm run build",
     "test": "node --test \"test/*.test.ts\"",
-    "check:terrain": "node --test \"test/terrain/*.test.ts\" \"estate/test/terrain/*.test.ts\"",
-    "test:being": "node --test test/being.test.ts",
-    "test:ward": "node --test test/ward.test.ts",
-    "prepublishOnly": "npm run check && npm run check:terrain"
-  },
-  "devDependencies": {
-    "@types/node": "^26.4.1",
-    "bun": "^1.4.0",
-    "deno": "^2.9.6",
-    "esbuild": "^0.28.2",
-    "markdownlint-cli2": "^0.23.2",
-    "oxlint": "^1.81.0",
-    "oxlint-tsgolint": "^7.0.2001",
-    "playwright": "^1.62.1",
-    "typescript": "^7.0.2",
-    "workerd": "^1.20260904.1"
+    "check:terrain": "node --test \"test/terrain/*.test.ts\"",
+    "prepublishOnly": "cd ../.. && npm run check && npm run check:terrain"
   },
   "publishConfig": {
     "access": "public"

package/src/being/index.ts

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // @quo-systems/quo — the Being side. What a being author imports, if anything.
 export { Being, type AskSpec } from './being.ts';
-export { silence, isSilence, unreached, isUnreached } from './silence.ts';
+export { silence, isSilence, unreached, isUnreached, word, isWord, wordOf, DOOR_WORDS, isDoorWord } from './silence.ts';
 export { digest, canonical } from './digest.ts';
 export { OWNER, PUBLIC, RESERVED_IDS } from './types.ts';
 export type * from './types.ts';

package/src/being/silence.ts

@@ -1,14 +1,32 @@
 // SPDX-License-Identifier: Apache-2.0
 // Silence is one distinguished value. Null is an answer. Silence is no answer.
-import { UNREACHED_KEY, type Unreached } from './types.ts';
+//
+// The ward's words are the other distinguished values: what her ward tells
+// her when no object came back and it knows why. Each is one frozen object
+// under one symbol key, so a being cannot make one by accident, none of them
+// crosses an edge as a value, and a being who compares against them needs
+// no fourth shape. `unreached` is one of them.
+import { WORD_KEY, type DoorWord, type Unreached, type Word, type WordName } from './types.ts';
 
 export const silence: unique symbol = Symbol.for('quo.silence');
 export const isSilence = (x: unknown): x is typeof silence => x === silence;
 
-// Unreached is the ward's own word: no far door was reached. It carries no
-// reason. Safe to retry, because nothing was delivered. A being cannot
-// produce it: a ward that sees it come out of a being treats it as silence.
-const UNREACHED: Unreached = Object.freeze({ [UNREACHED_KEY]: true });
-export const unreached = (): Unreached => UNREACHED;
-export const isUnreached = (x: unknown): x is Unreached =>
-  x !== null && typeof x === 'object' && (x as Record<symbol, unknown>)[UNREACHED_KEY] === true;
+// The words a door says to a key it has bound, and no other. They ride on
+// the wire as `{ quo: word }`, so a reply is checked against this list.
+export const DOOR_WORDS: readonly DoorWord[] = ['removed', 'absent', 'unannounced', 'repeated', 'threw'];
+export const isDoorWord = (s: unknown): s is DoorWord => typeof s === 'string' && (DOOR_WORDS as readonly string[]).includes(s);
+
+const WORDS = new Map<WordName, Word>();
+export const word = <W extends WordName>(name: W): Word<W> => {
+  let w = WORDS.get(name);
+  if (!w) WORDS.set(name, (w = Object.freeze({ [WORD_KEY]: name })));
+  return w as Word<W>;
+};
+export const isWord = (x: unknown): x is Word => x !== null && typeof x === 'object' && typeof (x as Record<symbol, unknown>)[WORD_KEY] === 'string';
+export const wordOf = (x: Word): WordName => x[WORD_KEY];
+
+// Unreached: no far door was reached. Nothing is known to have been
+// delivered, so asking again is safe. A being cannot produce it: a ward that
+// sees a word come out of a being reads it as her having thrown.
+export const unreached = (): Unreached => word('unreached');
+export const isUnreached = (x: unknown): x is Unreached => isWord(x) && wordOf(x) === 'unreached';

package/src/being/types.ts

@@ -44,11 +44,21 @@ export type Cells = {
 };
 
 export type Silence = typeof silence;
-export type Unreached = { readonly [K in typeof UNREACHED_KEY]: true };
-export const UNREACHED_KEY: unique symbol = Symbol.for('quo.unreached');
+
+// The ward's words: what her ward says when no object came back and it knows
+// why. A door says the first five to a key it has bound, and rides them on
+// the wire as `{ quo: word }`; her own ward says the last four to her and
+// they never leave the ward. Each is one frozen object under one symbol key,
+// so no being makes one and none crosses an edge as a value.
+export type DoorWord = 'removed' | 'absent' | 'unannounced' | 'repeated' | 'threw';
+export type WardWord = 'unreached' | 'late' | 'invitation' | 'dropped';
+export type WordName = DoorWord | WardWord;
+export const WORD_KEY: unique symbol = Symbol.for('quo.word');
+export type Word<W extends WordName = WordName> = { readonly [K in typeof WORD_KEY]: W };
+export type Unreached = Word<'unreached'>;
 
 // What comes back from an ask or a knock.
-export type Answer = Json | Silence | Unreached;
+export type Answer = Json | Silence | Word;
 // What a being answers.
 export type Reply = Json | Silence;
 

package/src/conformance/beings.ts

@@ -2,7 +2,7 @@
 // The fixture beings. Fixed, so that the ward is what varies. A printer, a
 // shop, a customer on the base class, and one raw being with no base at all.
 import { Being } from '../being/being.ts';
-import { isSilence, isUnreached } from '../being/silence.ts';
+import { isSilence, isUnreached, isWord } from '../being/silence.ts';
 import type { Asker, Blueprint, Invitation, JsonObject, OccupantRecord, Reply, Stance } from '../being/types.ts';
 
 // A printer. Invites whom she is told to, prints for her occupants. Her
@@ -46,7 +46,7 @@ export class Shop extends Being {
 
   async keepPrinter(invitation: Invitation): Promise<boolean> {
     const bp = await this.knock(invitation);
-    if (isSilence(bp) || isUnreached(bp)) return false;
+    if (isSilence(bp) || isWord(bp)) return false;
     this.cells.printerId = await this.take('prn', invitation);
     return true;
   }
@@ -55,7 +55,7 @@ export class Shop extends Being {
     const rec = this.occupant(asker);
     if (rec?.notes.tier === 'gold' && invitation) {
       const back = await this.knock(invitation as Invitation, 'hi');
-      if (!isSilence(back) && !isUnreached(back)) await this.take(`vip-${asker.id}`, invitation as Invitation);
+      if (!isSilence(back) && !isWord(back)) await this.take(`vip-${asker.id}`, invitation as Invitation);
     }
     return { welcome: true };
   }
@@ -67,7 +67,7 @@ export class Shop extends Being {
     if (!printer) return { error: 'no printer' };
     const out = await printer.ask('print', { doc: `receipt for ${item}` });
     if (isUnreached(out)) return { error: 'printer unreachable', retry: true };
-    if (isSilence(out)) return { error: 'printer refused' };
+    if (isSilence(out) || isWord(out)) return { error: 'printer refused' };
     const st = this.cells.standings[id!];
     if (st.seen !== st.digest) this.occupant(asker)!.notes.printerChanged = true;
     (this.cells.sales as JsonObject[]).push({ item: item ?? null, by: asker.id ?? null });
@@ -88,7 +88,7 @@ export class Customer extends Being {
   async join(invitation: Invitation) {
     const mine = (await this.invite('shop-back'))!;
     const out = await this.knock(invitation, 'hello', { invitation: mine as never });
-    if (isSilence(out) || isUnreached(out)) return out; // nothing was born
+    if (isSilence(out) || isWord(out)) return out; // nothing was born
     await this.take('shop', invitation); // now, and only now
     return out;
   }

package/src/conformance/estate.ts

@@ -12,20 +12,22 @@
 //
 // So this chapter does not write the sequence. It keeps a model of the graph,
 // plays legal moves against it from three fixed seeds, and after every move
-// asks three things:
+// asks two things:
 //
 //   the ledger is a graph          every arc the wards hold closes on both ends
 //   the ledger is what it can do   every arc in the model is asked, and answers
 //                                  exactly what being that arc means it answers
-//   the graph is not the topology  the same seed, played under one ward, under
-//                                  a ward per being, and under two harbors,
-//                                  ends in the same graph
 //
-// The third is the one that matters most here. A being never learns where the
-// other one is, so a script that is topology-invariant at forty moves is the
-// promise of Quo held at a scale a scene cannot reach -- and it is what makes
-// a migration honest: if nobody can tell the topology apart, moving a ward
-// between harbors cannot be felt.
+// The second is asked under one ward, under a ward per being, and under two
+// harbors, and that is where the promise of Quo is held: a being never learns
+// where the other one is, so every answer, after every move, under every
+// topology, is the answer the model wrote without knowing the topology
+// either. Held forty times a run, it is the promise at a scale a scene
+// cannot reach, and it is what makes a migration honest: if no answer can
+// tell the topology apart, moving a ward between harbors cannot be felt.
+// The model itself is the script's own bookkeeping and takes nothing from a
+// ward, so it is never compared with itself across topologies: that would
+// hold by construction and prove nothing.
 //
 // A relation is two arcs and never one edge. The occupant arc is the host's,
 // born at invite; the standing arc is the guest's, born at take, and only
@@ -33,12 +35,13 @@
 // A model that kept one symmetric edge would be a wrong model, and would
 // agree happily with a ward that had drifted.
 import { assert } from './assert.ts';
-import { isSilence, isUnreached } from '../being/silence.ts';
+import { isSilence, isUnreached, isWord, wordOf } from '../being/silence.ts';
 import type { Invitation } from '../being/types.ts';
 import { Member } from './beings.ts';
 import type { Census, Handle, Runner, World } from './index.ts';
 
 const HEX64 = /^[0-9a-f]{64}$/;
+const said = (x: unknown, w: string): boolean => isWord(x) && wordOf(x) === w;
 
 // One occupant arc, as the host holds it. `guest` is null until somebody
 // knocks; `live` goes false when she is kicked. Both are the host's business
@@ -59,20 +62,6 @@ const rolls = (seed: number) => () => {
   return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
 };
 
-// The graph, with nothing of the world in it: no key, no ward pk, no harbor.
-// Two runs under two topologies are the same estate when these agree.
-const abc = (a: string, b: string) => (a < b ? -1 : a > b ? 1 : 0);
-const fingerprint = (g: Graph): string =>
-  JSON.stringify({
-    seats: g.seats.map((s) => JSON.stringify([s.host, s.id, s.guest, s.answered, s.live, s.taken])).sort(abc),
-    holds: g.holds.map((h) => JSON.stringify([h.owner, h.id, h.seat.host, h.seat.id, h.live])).sort(abc),
-  });
-
-// Every run of one seed, under every topology, must land on the same graph.
-// The topologies run in one process, so the first to finish records and the
-// rest are held to it.
-const landed = new Map<string, { by: string; print: string }>();
-
 // ---- the ledger is a graph
 
 // Held after every move. Each line is a way the bookkeeping could stop being
@@ -161,10 +150,11 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
     assert.deepEqual(await acme.being.knock(back, 'ping'), { pong: 'acme' });
     assert.equal(await acme.being.take('them', back), 'them');
 
-    // 5. acme kicks her. her standing is still hers to hold -- she is never
-    //    told -- and it is silence from here on.
+    // 5. acme kicks her. her standing is still hers to hold, and she is not
+    //    told until she asks: then the door, under the key it bound for her,
+    //    says removed, and only to her.
     acme.being.occupants.remove('partner-1');
-    assert.ok(isSilence(await partner.being.standings['the-client']!.ask('ping')));
+    assert.ok(said(await partner.being.standings['the-client']!.ask('ping'), 'removed'));
     assert.deepEqual(Object.keys(partner.cells.standings), ['the-client']); // she never learns
     assert.deepEqual(await acme.being.standings.them!.ask('ping'), { pong: 'acme' }); // the other arc never moved
 
@@ -174,7 +164,7 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
     assert.notEqual(second.heir, first.heir);
     assert.deepEqual(await partner.being.knock(second, 'ping'), { pong: 'partner-2' });
     assert.equal(await partner.being.take('the-client-again', second), 'the-client-again');
-    assert.ok(isSilence(await partner.being.standings['the-client']!.ask('ping')));
+    assert.ok(said(await partner.being.standings['the-client']!.ask('ping'), 'removed'));
     ledger(w.census(), undefined, 'the story');
   });
 
@@ -221,6 +211,9 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
               assert.deepEqual(back, { pong: s.id }, `${guest} knocking ${s.host}/${s.id}`);
               s.guest = guest;
               s.answered = true;
+            } else if (!s.live && (s.guest === null || (s.guest === guest && (hold === undefined || hold.live)))) {
+              // kicked, and she speaks under a key the door bound for this seat: she hears why
+              assert.ok(said(back, 'removed'), `${guest} knocking kicked ${s.host}/${s.id} should hear removed`);
             } else assert.ok(isSilence(back), `${guest} knocking ${s.host}/${s.id} should be silence`);
             return `${guest} knocks ${s.host}/${s.id}`;
           });
@@ -304,7 +297,7 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
           }
           const out = await standing!.ask('ping');
           if (h.seat.live) assert.deepEqual(out, { pong: h.seat.id }, `step ${step}: ${h.owner}/${h.id} -> ${h.seat.host}/${h.seat.id}`);
-          else assert.ok(isSilence(out), `step ${step}: ${h.owner}/${h.id} is kicked and should be silence`);
+          else assert.ok(said(out, 'removed'), `step ${step}: ${h.owner}/${h.id} is kicked and should hear removed`);
         }
       };
 
@@ -327,13 +320,6 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
           throw new Error(`${at(step)}\n  -> ${e.message}`, { cause: e });
         });
       }
-
-      // and the estate that came out is the estate every topology comes out with
-      const print = fingerprint(g);
-      const key = `seed ${seed}`;
-      const first = landed.get(key);
-      if (!first) landed.set(key, { by: label, print });
-      else assert.equal(print, first.print, `the estate under ${label} is not the estate under ${first.by}: a being learned the topology`);
     });
   }
 }

package/src/conformance/index.ts

@@ -19,7 +19,7 @@
 //
 // Every assertion here is the truth's. Nothing here knows how a ward is built.
 import { assert } from './assert.ts';
-import { silence, isSilence, isUnreached } from '../being/silence.ts';
+import { silence, isSilence, isUnreached, isWord, wordOf } from '../being/silence.ts';
 import { digest } from '../being/digest.ts';
 import type { Asker, BeingClass, Cells, Invitation, Json, JsonObject } from '../being/types.ts';
 import { Printer, Shop, Customer, Echo, Member } from './beings.ts';
@@ -54,6 +54,8 @@ export type World = {
 export { Printer, Shop, Customer, Echo, Member };
 
 const HEX64 = /^[0-9a-f]{64}$/;
+// Her ward's word, as she receives it.
+const said = (x: unknown, w: string): boolean => isWord(x) && wordOf(x) === w;
 
 // The runner is handed in. Node passes `node:test`; a browser and an edge
 // worker pass a shim of their own. The suite is the ward's truth, and the
@@ -100,12 +102,12 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     assert.equal(i1.ward, i2.ward);
   });
 
-  t('remove before any knock: the heir is forgotten, a knock on it is silence', async () => {
+  t('remove before any knock: the heir is forgotten, and a knock on it by whoever holds it hears removed', async () => {
     const { w, shop, alice } = await world();
     const inv = await shop.being.invite();
     shop.being.occupants.remove('cust1');
     assert.equal(w.heir(inv), undefined);
-    assert.ok(isSilence(await alice.being.join(inv)));
+    assert.ok(said(await alice.being.join(inv), 'removed'));
     assert.deepEqual(alice.cells.standings, {});
   });
 
@@ -189,16 +191,16 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     assert.deepEqual(await alice.being.join(inv), { welcome: true }); // the same invitation still works
     const inv2 = await shop.being.invite();
     shop.being.occupants.remove('cust2'); // she changed her mind before the knock
-    assert.ok(isSilence(await alice.being.join(inv2)));
+    assert.ok(said(await alice.being.join(inv2), 'removed'));
     assert.deepEqual(Object.keys(alice.cells.standings), ['shop']);
   });
 
-  t('take without a knock, or after a silent knock, births nothing', async () => {
+  t('take without a knock, or after a knock that was not answered, births nothing', async () => {
     const { shop, alice } = await world();
     const inv = await shop.being.invite();
     assert.equal(await alice.being.take('shop', inv), null);
     shop.being.occupants.remove('cust1');
-    assert.ok(isSilence(await alice.being.knock(inv, 'hello')));
+    assert.ok(said(await alice.being.knock(inv, 'hello'), 'removed'));
     assert.equal(await alice.being.take('shop', inv), null);
     assert.deepEqual(alice.cells.standings, {});
   });
@@ -374,16 +376,16 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     assert.deepEqual(await alice.being.buy('hat'), { ok: true, receipt: 'receipt for hat' });
   });
 
-  t('a removed occupant is silence to the far side and her heir is forgotten; a dropped standing is gone', async () => {
+  t('a removed occupant hears removed under the key the door bound, her heir is forgotten; a dropped standing is gone', async () => {
     const { w, alice, shop } = await world();
     const inv = await shop.being.invite();
     await alice.being.join(inv);
     shop.being.occupants.remove('cust1');
     assert.equal(w.heir(inv), undefined);
-    assert.ok(isSilence(await alice.being.buy('hat')));
+    assert.ok(said(await alice.being.buy('hat'), 'removed'));
     alice.being.standings.remove('shop');
     assert.equal(alice.being.standings.shop, undefined);
-    assert.ok(isSilence(await alice.being.knock(inv, 'hello'))); // and a re-knock finds no heir
+    assert.ok(isSilence(await alice.being.knock(inv, 'hello'))); // her bound key went with the standing: a re-knock is as the heir, which is spent, a stranger
     const again = await shop.being.invite(); // cust2. a new heir
     assert.notEqual(again.heir, inv.heir);
     assert.deepEqual(await alice.being.knock(again, 'hello'), { welcome: true });
@@ -398,7 +400,7 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     assert.equal((shop.cells.sales as unknown[]).length, 1);
   });
 
-  t('a being that throws is silence outside; the ward stays up', async () => {
+  t('a being that throws is the word threw to whom the door has bound; the ward stays up', async () => {
     const w = await make();
     class Bomb {
       s: unknown;
@@ -413,7 +415,7 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     const x = await w.boot<Bomb>('X', Bomb);
     const a = await w.boot<Customer>('A', Customer);
     const inv = (await (x.being.s as Customer['stance']).occupants.invite('a'))!;
-    assert.ok(isSilence(await a.being.knock(inv, 'any')));
+    assert.ok(said(await a.being.knock(inv, 'any'), 'threw'));
     assert.deepEqual(await a.being.knock(inv), { asks: [], notes: {} });
   });
 
@@ -473,7 +475,7 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     assert.deepEqual(pub.cells.occupants, {}); // she never invited anyone
     if (!w.oneWard) assert.ok(isSilence(await a.being.knock(at(priv), 'time'))); // a ward with no public being: silence
     assert.ok(isUnreached(await a.being.knock({ ward: 'a'.repeat(128) }, 'time'))); // no door anywhere: unreached
-    assert.ok(isSilence(await a.being.knock({ ward: 'not a pk' }, 'time'))); // not even an address
+    assert.ok(said(await a.being.knock({ ward: 'not a pk' }, 'time'), 'invitation')); // not even an address
     assert.equal(await a.being.take('clock', at(pub)), 'clock');
     assert.deepEqual(await a.being.standings.clock!.ask('time'), { time: 12, got: {} });
     assert.equal(a.cells.standings.clock.seen, await digest((await a.being.standings.clock!.ask()) as Json));

package/src/harbor/core.ts

@@ -45,6 +45,7 @@ export class Harbor {
   readonly doors = new Map<string, WardPointers['door']>(); // ward pk -> door
   readonly reaches = new Map<string, Bound>(); // the directory: foreign ward pk -> reach
   readonly down = new Set<string>(); // pks this harbor will not reach right now: weather, for a test
+  readonly refused = new Map<string, number>(); // own ward pk -> arrivals its door would not admit. what a terrain does with it is its own
   readonly classes: Record<string, BeingClass> = {}; // classes handed in-process, beside the loader's
   // The dialers' sockets, in the order they were dialed: where a pk nobody
   // here knows is sent, because the listener a harbor dialed is a rendezvous
@@ -54,6 +55,17 @@ export class Harbor {
   // carries it: with a single slot, a harbor holding two lines answered
   // unreached for a pk the other line could have reached.
   readonly fallbacks: Reach[] = [];
+  // How a dialer says what this harbor holds now. An announce is a claim and
+  // a claim is worth nothing until the door behind it answers a probe, so
+  // saying it again costs a proof and buys nothing to an impostor. What is
+  // not free is never saying it again: a ward booted, adopted or dropped
+  // after a line opened would be announced only by the next line, and a line
+  // that does not drop never opens again, so it would be unreachable through
+  // that listener for as long as the socket stayed healthy.
+  readonly announcers = new Set<() => void>();
+  #announce(): void {
+    for (const say of this.announcers) say();
+  }
 
   constructor(store: Store, loader: Loader = async () => ({})) {
     this.store = store;
@@ -71,10 +83,18 @@ export class Harbor {
 
   // ---- the directory
 
+  // Bytes to one of this harbor's own doors, and the one bit the door says
+  // beside its reply, counted.
+  async #own(pk: string, door: WardPointers['door'], bytes: Uint8Array): Promise<Uint8Array> {
+    const r = await door(bytes);
+    if (!r.heard) this.refused.set(pk, (this.refused.get(pk) ?? 0) + 1);
+    return new Uint8Array(r.bytes);
+  }
+
   async carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined> {
     if (this.down.has(pk)) return undefined;
     const door = this.doors.get(pk);
-    if (door) return new Uint8Array(await door(bytes));
+    if (door) return this.#own(pk, door, bytes);
     const bound = this.reaches.get(pk);
     if (bound) return bound.reach.carry(pk, bytes);
     for (const reach of this.fallbacks) {
@@ -87,7 +107,7 @@ export class Harbor {
   async deliver(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined> {
     if (this.down.has(pk)) return undefined;
     const door = this.doors.get(pk);
-    if (door) return new Uint8Array(await door(bytes));
+    if (door) return this.#own(pk, door, bytes);
     const bound = this.reaches.get(pk);
     return bound?.held ? bound.reach.carry(pk, bytes) : undefined;
   }
@@ -163,6 +183,7 @@ export class Harbor {
       await h.save();
       this.wards.delete(name);
       this.doors.delete(h.pk);
+      this.#announce(); // this harbor no longer claims it: a listener unbinds a pk an announce stops naming
     }
     return this.store.take(name);
   }
@@ -214,6 +235,7 @@ export class Harbor {
     this.wards.set(name, hosted);
     this.doors.set(hosted.pk, door);
     await save();
+    this.#announce(); // reachable through every line this harbor already holds, not only the next one
     return hosted;
   }
 }

package/src/harbor/dial.ts

@@ -33,6 +33,7 @@ export function dial(harbor: Harbor, url: string): Dialer {
         void harbor.bind(far, s, false); // the listener's claims, each proven at its door: reached through this socket, not held for others
       },
       (why) => {
+        harbor.announcers.delete(say);
         harbor.unbind(s);
         if (d.socket === s) d.socket = null;
         const at = harbor.fallbacks.indexOf(s);
@@ -46,9 +47,14 @@ export function dial(harbor: Harbor, url: string): Dialer {
       },
     );
     harbor.fallbacks.push(s); // from the moment it is dialed: an ask made before the handshake waits on the socket, and is not unreached
+    // What this harbor holds, said when the line opens and again whenever it
+    // changes. A ward booted or adopted after the handshake is announced on
+    // the line already in hand, and a dropped one stops being claimed at once.
+    const say = () => s.announce([...harbor.doors.keys()]);
     line.addEventListener('open', () => {
       d.socket = s;
-      s.announce([...harbor.doors.keys()]);
+      harbor.announcers.add(say);
+      say();
     });
   };
   d.close = () => {

package/src/harbor/memory.ts

@@ -15,6 +15,7 @@ export class MemoryHarbor {
   readonly doors = new Map<string, WardPointers['door']>(); // ward pk -> door
   readonly down = new Set<string>(); // ward pks this harbor cannot reach right now
   readonly wire: string[] = []; // every byte string that ever crossed, as hex. for inspection
+  readonly refused = new Map<string, number>(); // ward pk -> arrivals its door would not admit: strangers, counted
   readonly peers = new Set<MemoryHarbor>();
   cut = false;
   readonly partitions = new Map<string, Record<string, unknown>>(); // seed -> memory. the harbor keeps it and reads nothing
@@ -25,7 +26,11 @@ export class MemoryHarbor {
   async route(farPk: string, bytes: Uint8Array): Promise<Uint8Array | undefined> {
     if (this.down.has(farPk)) return undefined;
     const door = this.doors.get(farPk);
-    if (door) return door(bytes);
+    if (door) {
+      const r = await door(bytes);
+      if (!r.heard) this.refused.set(farPk, (this.refused.get(farPk) ?? 0) + 1);
+      return r.bytes;
+    }
     const peer = [...this.peers].find((h) => h.doors.has(farPk) && !h.down.has(farPk));
     if (!peer || this.cut) return undefined; // nothing. the harbor has no word silence
     return peer.route(farPk, bytes);