@quo-systems/quo 0.2.0 → 0.2.1

package/SPEC.md

@@ -539,7 +539,8 @@ the standing is.
 ### The public being
 
 A ward may have one public being, and no more. She is an ordinary being,
-booted by the owner and marked public. Arrivals for no heir reach her. Her
+booted by the owner and then marked public by the owner's `public` ask.
+Arrivals for no heir reach her. Her
 asker is `{}`: she is asked by anyone, and she can tell. She may hold
 standings. She may invite, and an occupant of hers arrives named while
 strangers still arrive as `{}`. A ward without a public being answers
@@ -560,6 +561,14 @@ So her answer must be safe to repeat. This is her obligation, not a gap at
 the door. Anything that must happen once lives behind an invitation, where
 there is a heir and a count.
 
+Nothing else about her is different. Her cells, her standings and what she
+keeps are hers, exactly as they are for every being, and Quo has no say in
+them: she may hold a board every stranger plays on, a catalogue, a queue, or
+nothing at all. She is an ordinary being who chose to describe herself to
+strangers and to answer them, and that choice is the whole of what makes her
+public. A stranger who keeps knocking is the harbor's, never hers and never
+the door's.
+
 ### How a relation crosses wards
 
 1. She mints an id. Her ward mints a heir for it, keeps the pk, and hands
@@ -818,6 +827,14 @@ silent. It keeps every being it booted, builds every stance, mints every
 key, seals every ask that leaves, and unseals every one that arrives. Its
 beings trust it blindly. It trusts its harbor the same way.
 
+Only a ward moves. A being has no address of her own and never leaves the
+ward that booted her: her peers hold a standing at a ward pk, and what they
+trust is that ward's word about an id, never the being under it. So which
+beings share a ward is settled when they are booted, and a ward migrates
+whole, with everyone in it, or not at all. To move one being would be to ask
+every peer to trust a ward they never accepted, and asking that is what an
+invitation is.
+
 Its ward is itself. It boots itself as the first being in its own map, under
 its own pk, and its own stance is built by the same code that builds every
 being's. Its cells are its partition, all the way down.
@@ -945,19 +962,25 @@ become one.
 The root is not an occupant. It holds no heir, no key, no invitation. The
 ward names every arrival on the ask `{ id: 'OWNER' }`, the third asker of the
 ward-to-being edge, and answers it as such; an owner at the door arrives as
-her id. What an owner can do is exactly what a being cannot: boot, place a
-relation into a being of the ward, and take one out of her. The root's asks
-carry no allowance of their own.
+her id. What an owner can do is exactly what a being cannot: boot, mark the
+public being, place a relation into a being of the ward, take one out of
+her, and take her out of the ward. The root's asks carry no allowance of
+their own. The ward is a being to her owner: the empty ask is her describe,
+and each ask in it carries a description and an input naming its fields, as
+a being's asks do, so that a side renders the owner's asks the way it
+renders anyone's and holds no list of its own.
 
 ```
-ask()                                    -> { asks: [boot, invite, knock, remove],
+ask()                                    -> { asks: [boot, public, invite, knock, remove, unboot],
                                               notes: { pk, beings: { key: { class, public, digest } } } }
-ask('boot',   { key, class, public? })   -> { booted: key } | { error }
+ask('boot',   { key, class })            -> { booted: key } | { error }
+ask('public', { key })                   -> { public: key } | { error }
 ask('invite', { being, id })             -> invitation | null | { error }
 ask('knock',  { being | { boot: class, key },
                 id, invitation, method?, args?, wanted? })
                                          -> { taken: id | null, answer } | { error: 'silence' | 'unreached' | ... }
 ask('remove', { being, id })             -> { removed: id } | { error }
+ask('unboot', { being })                 -> { unbooted: key, removed: [id, ...] } | { error }
 anything else                            -> { error: 'unknown ask' }
 ```
 
@@ -965,9 +988,15 @@ anything else                            -> { error: 'unknown ask' }
   spend, and saying nothing is the ward's default, exactly as for a being.
 - The describe runs every being's own describe as `OWNER` and hashes it; a
   being that throws or falls silent there shows a null digest.
-- Boot refuses a key already booted, a class the harbor does not know, and a
-  second public being; a boot that made nobody leaves the partition as it
-  found it. A throw at birth is that boot's error, and nothing half-lives.
+- Boot refuses a key already booted and a class the harbor does not know; a
+  boot that made nobody leaves the partition as it found it. A throw at
+  birth is that boot's error, and nothing half-lives.
+- Public marks a being already booted as the ward's one public being. It
+  refuses a key not booted, the ward's own pk, and a second public being
+  while one stands, since marking a second would leave the first holding
+  every relation she had, reachable by nobody at the bare pk and told by
+  nobody she was replaced. Marking the one already public again is
+  answered, and changes nothing.
 - Invite on the ward's own pk mints an owner, and only the root may ask it:
   from the door it is answered as an invite on nobody. The ward has
   occupants, its owners, and no standings: a knock for the ward itself is a
@@ -978,6 +1007,17 @@ anything else                            -> { error: 'unknown ask' }
   chose her class and her cells at boot; her owner may choose a relation for
   her too. The boot form names a being new or existing: a key already booted
   is a being of theirs, not a class that failed.
+- **Unboot is the inverse of boot, and the only way a being leaves a ward.**
+  Every relation she holds goes with her, by the same calls she would have
+  used herself, so an occupant of hers hears `removed` from the keys her door
+  kept rather than meeting a being who is not there; the owner is told which
+  ids went. Her cells and her bind table go too, because a row naming a being
+  no door holds would boot her again on the next restart. If she was the
+  public being the mark goes with her, and the ward answers arrivals for no
+  heir with silence as one that never had a public being does. The ward
+  itself is refused, for the reason knock is: it would be a ward deleting
+  itself from inside its own map, leaving its owners bound to a door that is
+  gone.
 - The owner's remove is the mirror of its knock: a relation out of a being,
   by id, and the id may be an occupant or a standing, since the two share
   one namespace. The being's own remove says nothing; the owner hears
@@ -1188,7 +1228,10 @@ socket this harbor holds for that pk, and never onward by request. So a
 harbor that cannot be dialed is reached through the one it dialed, by
 anyone who holds a hint that its pk is there. The **dialer**,
 `src/harbor/dial.ts`, is that harbor's half: one held socket to a URL, its
-own pks announced when the line opens, the listener's bound, dialed again
+own pks announced when the line opens and again whenever what this harbor
+holds changes, so a ward booted, adopted or dropped on a line already in hand
+is reachable through it without waiting for that line to fall; the listener's
+bound, dialed again
 with a wait that doubles from a second to thirty when the line drops, and
 while it is dialed it is one of the harbor's fallbacks, where a pk nobody
 here knows is sent. Fallbacks are a list and a pk is tried down it in
@@ -1464,11 +1507,14 @@ passes the same suite. Those tests are the checklist, not the mock.
   on Quo actually has -- scattered wards on scattered harbors, partners and
   employees invited, knocking, taken, kicked, and moving to harbors of their
   own. It keeps a model of the graph, plays legal moves against it from three
-  fixed seeds, and after every move holds three things: that the ledger every
-  ward keeps closes on both ends, that every arc in it answers when asked
-  exactly what being that arc means, and that the same seed played under all
-  three topologies lands on the same graph. The last is the promise of Quo at
-  a scale a scene cannot reach. A relation is two arcs and never one edge:
+  fixed seeds, and after every move holds two things: that the ledger every
+  ward keeps closes on both ends, and that every arc in it answers when asked
+  exactly what being that arc means. The second is held under all three
+  topologies, and that is the promise of Quo at a scale a scene cannot
+  reach: the model never learns the topology, so neither may any answer. The
+  model is the script's own bookkeeping and is never compared with itself
+  across topologies, which would hold by construction and prove nothing. A
+  relation is two arcs and never one edge:
   the occupant is the host's, the standing is the guest's, and the model
   keeps them apart because the ward does. A red run prints its seed and the
   moves that got there. It is read beside one hand-written story that says in
@@ -1645,6 +1691,19 @@ Decided here, so that the answer is not rediscovered:
   the default says so with `wanted` on the ask, which is the whole of what a
   being needs. An owner who wants another ceiling is asking for a different
   ward.
+- **A leaked seed is a taken ward, and there is no succession.** The seed has
+  one custodian, the harbor, which vouches that it stays secret; a being
+  never touches it and no byte on the wire carries it. So it is lost only
+  where that vouch broke, and a broken vouch is total and silent. It is not
+  lost alone: a harbor keeps the seed and the partition under one name, and
+  the partition holds every relation's keys, so there is no event where the
+  address is taken and the relations are not. Nothing is left to succeed to.
+  A succession signed by the key that speaks now is signed as well by
+  whoever took it, and one that could not be forged would have to be
+  committed to in advance, in the invitation, which carries nothing. The
+  answer is a new ward, and every peer invited again as anyone is invited.
+  Lose the seed, lose the ward; there is no recovery inside Quo, and that is
+  the same sentence the root owner already hears.
 
 ## Glossary
 

package/dist/conformance/estate.js

@@ -12,20 +12,22 @@
 //
 // So this chapter does not write the sequence. It keeps a model of the graph,
 // plays legal moves against it from three fixed seeds, and after every move
-// asks three things:
+// asks two things:
 //
 //   the ledger is a graph          every arc the wards hold closes on both ends
 //   the ledger is what it can do   every arc in the model is asked, and answers
 //                                  exactly what being that arc means it answers
-//   the graph is not the topology  the same seed, played under one ward, under
-//                                  a ward per being, and under two harbors,
-//                                  ends in the same graph
 //
-// The third is the one that matters most here. A being never learns where the
-// other one is, so a script that is topology-invariant at forty moves is the
-// promise of Quo held at a scale a scene cannot reach -- and it is what makes
-// a migration honest: if nobody can tell the topology apart, moving a ward
-// between harbors cannot be felt.
+// The second is asked under one ward, under a ward per being, and under two
+// harbors, and that is where the promise of Quo is held: a being never learns
+// where the other one is, so every answer, after every move, under every
+// topology, is the answer the model wrote without knowing the topology
+// either. Held forty times a run, it is the promise at a scale a scene
+// cannot reach, and it is what makes a migration honest: if no answer can
+// tell the topology apart, moving a ward between harbors cannot be felt.
+// The model itself is the script's own bookkeeping and takes nothing from a
+// ward, so it is never compared with itself across topologies: that would
+// hold by construction and prove nothing.
 //
 // A relation is two arcs and never one edge. The occupant arc is the host's,
 // born at invite; the standing arc is the guest's, born at take, and only
@@ -45,17 +47,6 @@ const rolls = (seed) => () => {
     t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;
     return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
 };
-// The graph, with nothing of the world in it: no key, no ward pk, no harbor.
-// Two runs under two topologies are the same estate when these agree.
-const abc = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
-const fingerprint = (g) => JSON.stringify({
-    seats: g.seats.map((s) => JSON.stringify([s.host, s.id, s.guest, s.answered, s.live, s.taken])).sort(abc),
-    holds: g.holds.map((h) => JSON.stringify([h.owner, h.id, h.seat.host, h.seat.id, h.live])).sort(abc),
-});
-// Every run of one seed, under every topology, must land on the same graph.
-// The topologies run in one process, so the first to finish records and the
-// rest are held to it.
-const landed = new Map();
 // ---- the ledger is a graph
 // Held after every move. Each line is a way the bookkeeping could stop being
 // a graph: an arc with one end, an arc with two owners, a relation filed in
@@ -303,14 +294,6 @@ export function estate(label, make, { canDown, test }) {
                     throw new Error(`${at(step)}\n  -> ${e.message}`, { cause: e });
                 });
             }
-            // and the estate that came out is the estate every topology comes out with
-            const print = fingerprint(g);
-            const key = `seed ${seed}`;
-            const first = landed.get(key);
-            if (!first)
-                landed.set(key, { by: label, print });
-            else
-                assert.equal(print, first.print, `the estate under ${label} is not the estate under ${first.by}: a being learned the topology`);
         });
     }
 }

package/dist/harbor/core.d.ts

@@ -30,6 +30,7 @@ export declare class Harbor {
     readonly refused: Map<string, number>;
     readonly classes: Record<string, BeingClass>;
     readonly fallbacks: Reach[];
+    readonly announcers: Set<() => void>;
     constructor(store: Store, loader?: Loader);
     boot(): Promise<void>;
     carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;

package/dist/harbor/core.js

@@ -42,6 +42,18 @@ export class Harbor {
     // carries it: with a single slot, a harbor holding two lines answered
     // unreached for a pk the other line could have reached.
     fallbacks = [];
+    // How a dialer says what this harbor holds now. An announce is a claim and
+    // a claim is worth nothing until the door behind it answers a probe, so
+    // saying it again costs a proof and buys nothing to an impostor. What is
+    // not free is never saying it again: a ward booted, adopted or dropped
+    // after a line opened would be announced only by the next line, and a line
+    // that does not drop never opens again, so it would be unreachable through
+    // that listener for as long as the socket stayed healthy.
+    announcers = new Set();
+    #announce() {
+        for (const say of this.announcers)
+            say();
+    }
     constructor(store, loader = async () => ({})) {
         this.store = store;
         this.loader = loader;
@@ -164,6 +176,7 @@ export class Harbor {
             await h.save();
             this.wards.delete(name);
             this.doors.delete(h.pk);
+            this.#announce(); // this harbor no longer claims it: a listener unbinds a pk an announce stops naming
         }
         return this.store.take(name);
     }
@@ -213,6 +226,7 @@ export class Harbor {
         this.wards.set(name, hosted);
         this.doors.set(hosted.pk, door);
         await save();
+        this.#announce(); // reachable through every line this harbor already holds, not only the next one
         return hosted;
     }
 }

package/dist/harbor/dial.js

@@ -14,6 +14,7 @@ export function dial(harbor, url) {
             wait = 1000;
             void harbor.bind(far, s, false); // the listener's claims, each proven at its door: reached through this socket, not held for others
         }, (why) => {
+            harbor.announcers.delete(say);
             harbor.unbind(s);
             if (d.socket === s)
                 d.socket = null;
@@ -30,9 +31,14 @@ export function dial(harbor, url) {
             wait = Math.min(wait * 2, 30000);
         });
         harbor.fallbacks.push(s); // from the moment it is dialed: an ask made before the handshake waits on the socket, and is not unreached
+        // What this harbor holds, said when the line opens and again whenever it
+        // changes. A ward booted or adopted after the handshake is announced on
+        // the line already in hand, and a dropped one stops being claimed at once.
+        const say = () => s.announce([...harbor.doors.keys()]);
         line.addEventListener('open', () => {
             d.socket = s;
-            s.announce([...harbor.doors.keys()]);
+            harbor.announcers.add(say);
+            say();
         });
     };
     d.close = () => {

package/dist/ward/owner.d.ts

@@ -1,4 +1,4 @@
-import type { Asker, Invitation, Json, JsonObject, Wanted } from '../being/types.ts';
+import type { Ask, Asker, Invitation, Json, JsonObject, Wanted } from '../being/types.ts';
 export type OwnerSide = {
     pk: string;
     doors: Map<string, {
@@ -24,9 +24,11 @@ export type OwnerSide = {
         };
     }>;
     publicKey(): string | null;
-    instantiate(key: string, className: string, isPublic?: boolean): {
+    instantiate(key: string, className: string): {
         key: string;
     } | null;
+    unboot(key: string): string[] | null;
+    setPublic(key: string): void;
 };
-export declare const OWNER_ASKS: readonly ['boot', 'invite', 'knock', 'remove'];
+export declare const OWNER_ASKS: Ask[];
 export declare function ownerAnswer(w: OwnerSide, asker: Asker, method: string | undefined, args: JsonObject): Promise<Json>;

package/dist/ward/owner.js

@@ -1,13 +1,29 @@
 // SPDX-License-Identifier: Apache-2.0
 // The owner's asks. The root owner holds the ask pointer; every other owner
-// is an occupant of the ward itself, invited by the root. Five asks:
-// describe, boot, invite, knock, remove. The knock is a being's knock made
-// for her, and the standing is written into her cells under the id the
-// owner gave; remove takes a relation out of her by id, the mirror of it.
+// is an occupant of the ward itself, invited by the root. The ward is a
+// being to her owner: the empty ask is her describe, and it carries her asks
+// with a description and an input each, so a side renders them as it
+// renders any being's. Six asks: boot, public, invite, knock, remove and
+// unboot, which is boot's inverse and takes her relations with her. The
+// knock is a being's knock made for her, and the standing is written into
+// her cells under the id the owner gave; remove takes a relation out of her
+// by id, the mirror of it.
 import { isSilence, isWord, wordOf } from '../being/silence.js';
 import { digest } from '../being/digest.js';
 import { OWNER } from '../being/types.js';
-export const OWNER_ASKS = ['boot', 'invite', 'knock', 'remove'];
+const str = { type: 'string' };
+export const OWNER_ASKS = [
+    { name: 'boot', description: 'boot a being by class name, under a key the owner chooses', input: { type: 'object', properties: { key: str, class: str }, required: ['key', 'class'] } },
+    { name: 'public', description: 'mark a booted being as the one public being of the ward, reached by anyone at the bare pk', input: { type: 'object', properties: { key: str }, required: ['key'] } },
+    { name: 'invite', description: 'mint an invitation on a being of the ward, under the id she will know the occupant by; on the ward pk it mints an owner, and only the root may', input: { type: 'object', properties: { being: str, id: str }, required: ['being', 'id'] } },
+    {
+        name: 'knock',
+        description: 'knock for a being of the ward with an invitation, and take the standing under id if answered; being is a key booted, or { boot: class, key } to boot her first',
+        input: { type: 'object', properties: { being: { description: 'a key, or { boot, key }' }, id: str, invitation: { type: 'object' }, method: str, args: { type: 'object' }, wanted: { type: 'object', properties: { time: { type: 'number' } } } }, required: ['being', 'id', 'invitation'] },
+    },
+    { name: 'remove', description: 'take a relation out of a being of the ward by id, occupant or standing; on the ward pk it unseats an owner, and only the root may', input: { type: 'object', properties: { being: str, id: str }, required: ['being', 'id'] } },
+    { name: 'unboot', description: 'take a being out of the ward, with every relation she holds; her occupants hear removed, and the ward itself is refused', input: { type: 'object', properties: { being: str }, required: ['being'] } },
+];
 export async function ownerAnswer(w, asker, method, args) {
     // Every name the owner gives is a word. Coerced instead of checked, an
     // object passed where a name belongs becomes the string "[object Object]",
@@ -16,17 +32,24 @@ export async function ownerAnswer(w, asker, method, args) {
     if (method === undefined)
         return describe(w);
     if (method === 'boot') {
-        // A ward may have one public being, and no more. Marking a second would
-        // leave the first holding every relation she had, reachable by nobody at
-        // the bare pk, and told by nobody that she had been replaced.
-        if (args.public === true && w.publicKey() !== null)
-            return { error: 'a ward has one public being' };
         const key = word(args.key), className = word(args.class);
         if (key === null || className === null)
             return { error: 'no such class, or key taken' };
-        const door = w.instantiate(key, className, args.public === true);
+        const door = w.instantiate(key, className);
         return door ? { booted: door.key } : { error: 'no such class, or key taken' };
     }
+    if (method === 'public') {
+        // A ward may have one public being, and no more. Marking a second would
+        // leave the first holding every relation she had, reachable by nobody at
+        // the bare pk, and told by nobody that she had been replaced.
+        const key = word(args.key);
+        if (key === null || key === w.pk || !w.doors.has(key))
+            return { error: 'no such being' };
+        if (w.publicKey() !== null && w.publicKey() !== key)
+            return { error: 'a ward has one public being' };
+        w.setPublic(key);
+        return { public: key };
+    }
     if (method === 'invite') {
         // On the ward itself, only the root may invite: an occupant of the ward
         // is an owner, and ownership is minted by the ask pointer alone. An owner
@@ -90,6 +113,20 @@ export async function ownerAnswer(w, asker, method, args) {
             return { error: 'nothing to remove' };
         return { removed: id };
     }
+    if (method === 'unboot') {
+        // The inverse of boot, and the only way a being leaves a ward. Her
+        // relations go with her, so an occupant of hers hears `removed` from the
+        // keys the door kept, exactly as it would had the owner removed each id
+        // by hand; the owner hears which ids those were. The ward itself is
+        // refused, for the reason knock is: it is a being to nobody outside, and
+        // unbooting it would be a ward deleting itself from inside its own map,
+        // leaving its owners bound to a door that is gone.
+        const being = word(args.being);
+        if (being === null || being === w.pk)
+            return { error: 'no such being' };
+        const removed = w.unboot(being);
+        return removed === null ? { error: 'no such being' } : { unbooted: being, removed };
+    }
     return { error: 'unknown ask' };
 }
 // The ward's describe for its owner: its beings, their classes, a digest each,
@@ -110,7 +147,7 @@ async function describe(w) {
         beings[key] = { class: door.cells.class ?? null, public: w.publicKey() === key, digest: d };
     }
     return {
-        asks: OWNER_ASKS.map((name) => ({ name, input: { type: 'object' } })),
+        asks: OWNER_ASKS,
         notes: { pk: w.pk, beings },
     };
 }

package/dist/ward/ward.js

@@ -6,7 +6,7 @@
 // leaves, opens every one that arrives.
 import { silence, isSilence, unreached, isWord, word } from '../being/silence.js';
 import { OWNER } from '../being/types.js';
-import { at, open, put, emptyBind, emptyCells } from './partition.js';
+import { at, drop, open, put, emptyBind, emptyCells } from './partition.js';
 import { Heirs } from './heirs.js';
 import { makeDoor } from './door.js';
 import { buildStance } from './stance.js';
@@ -83,21 +83,46 @@ class Self {
             pk: this.pk,
             doors: this.doors,
             publicKey: () => this.p.public,
-            instantiate: (key, className, isPublic) => this.#instantiate(key, className, isPublic),
+            instantiate: (key, className) => this.#instantiate(key, className),
+            unboot: (key) => this.#unboot(key),
+            setPublic: (key) => void (this.p.public = key),
         }, asker, method, args);
     }
     // ---- ward functions. on the object. no stance reaches them.
-    #instantiate(key, className, isPublic = false) {
+    #instantiate(key, className) {
         if (!key || this.doors.has(key))
             return null;
         const door = this.#boot(key, className);
         if (!door)
             return null;
         door.cells.class = className; // so a restart finds her
-        if (isPublic)
-            this.p.public = key;
         return door;
     }
+    // The inverse of boot, and the only way a being leaves a ward. Her
+    // relations go first and by the same calls she would have used herself,
+    // so every occupant hears `removed` at the door from the keys it kept,
+    // rather than meeting a being who is simply not there any more. What is
+    // left after that is her cells and her bind table, and they go with her:
+    // a row naming a being no door holds would be read on the next restart
+    // and boot her again.
+    #unboot(key) {
+        const door = this.doors.get(key);
+        if (!door || key === this.pk)
+            return null;
+        const occupants = Object.keys(door.cells.occupants), standings = Object.keys(door.cells.standings);
+        for (const id of occupants)
+            door.stance.occupants.remove(id);
+        for (const id of standings)
+            door.stance.standings.remove(id);
+        // A ward whose public being is gone answers arrivals for no heir with
+        // silence, as a ward that never had one does.
+        if (this.p.public === key)
+            this.p.public = null;
+        drop(this.p.beings, key);
+        drop(this.p.bind, key);
+        this.doors.delete(key);
+        return [...occupants, ...standings];
+    }
     // Nothing is written until there is somebody to write it for: a class the
     // harbor does not know makes no being, and a boot that made nobody must
     // leave the partition as it found it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quo-systems/quo",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Quo: an object asks another object and gets an answer, without knowing where it is. Being, Ward, Harbor.",
   "keywords": [
     "quo",

package/src/conformance/estate.ts

@@ -12,20 +12,22 @@
 //
 // So this chapter does not write the sequence. It keeps a model of the graph,
 // plays legal moves against it from three fixed seeds, and after every move
-// asks three things:
+// asks two things:
 //
 //   the ledger is a graph          every arc the wards hold closes on both ends
 //   the ledger is what it can do   every arc in the model is asked, and answers
 //                                  exactly what being that arc means it answers
-//   the graph is not the topology  the same seed, played under one ward, under
-//                                  a ward per being, and under two harbors,
-//                                  ends in the same graph
 //
-// The third is the one that matters most here. A being never learns where the
-// other one is, so a script that is topology-invariant at forty moves is the
-// promise of Quo held at a scale a scene cannot reach -- and it is what makes
-// a migration honest: if nobody can tell the topology apart, moving a ward
-// between harbors cannot be felt.
+// The second is asked under one ward, under a ward per being, and under two
+// harbors, and that is where the promise of Quo is held: a being never learns
+// where the other one is, so every answer, after every move, under every
+// topology, is the answer the model wrote without knowing the topology
+// either. Held forty times a run, it is the promise at a scale a scene
+// cannot reach, and it is what makes a migration honest: if no answer can
+// tell the topology apart, moving a ward between harbors cannot be felt.
+// The model itself is the script's own bookkeeping and takes nothing from a
+// ward, so it is never compared with itself across topologies: that would
+// hold by construction and prove nothing.
 //
 // A relation is two arcs and never one edge. The occupant arc is the host's,
 // born at invite; the standing arc is the guest's, born at take, and only
@@ -60,20 +62,6 @@ const rolls = (seed: number) => () => {
   return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
 };
 
-// The graph, with nothing of the world in it: no key, no ward pk, no harbor.
-// Two runs under two topologies are the same estate when these agree.
-const abc = (a: string, b: string) => (a < b ? -1 : a > b ? 1 : 0);
-const fingerprint = (g: Graph): string =>
-  JSON.stringify({
-    seats: g.seats.map((s) => JSON.stringify([s.host, s.id, s.guest, s.answered, s.live, s.taken])).sort(abc),
-    holds: g.holds.map((h) => JSON.stringify([h.owner, h.id, h.seat.host, h.seat.id, h.live])).sort(abc),
-  });
-
-// Every run of one seed, under every topology, must land on the same graph.
-// The topologies run in one process, so the first to finish records and the
-// rest are held to it.
-const landed = new Map<string, { by: string; print: string }>();
-
 // ---- the ledger is a graph
 
 // Held after every move. Each line is a way the bookkeeping could stop being
@@ -332,13 +320,6 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
           throw new Error(`${at(step)}\n  -> ${e.message}`, { cause: e });
         });
       }
-
-      // and the estate that came out is the estate every topology comes out with
-      const print = fingerprint(g);
-      const key = `seed ${seed}`;
-      const first = landed.get(key);
-      if (!first) landed.set(key, { by: label, print });
-      else assert.equal(print, first.print, `the estate under ${label} is not the estate under ${first.by}: a being learned the topology`);
     });
   }
 }

package/src/harbor/core.ts

@@ -55,6 +55,17 @@ export class Harbor {
   // carries it: with a single slot, a harbor holding two lines answered
   // unreached for a pk the other line could have reached.
   readonly fallbacks: Reach[] = [];
+  // How a dialer says what this harbor holds now. An announce is a claim and
+  // a claim is worth nothing until the door behind it answers a probe, so
+  // saying it again costs a proof and buys nothing to an impostor. What is
+  // not free is never saying it again: a ward booted, adopted or dropped
+  // after a line opened would be announced only by the next line, and a line
+  // that does not drop never opens again, so it would be unreachable through
+  // that listener for as long as the socket stayed healthy.
+  readonly announcers = new Set<() => void>();
+  #announce(): void {
+    for (const say of this.announcers) say();
+  }
 
   constructor(store: Store, loader: Loader = async () => ({})) {
     this.store = store;
@@ -172,6 +183,7 @@ export class Harbor {
       await h.save();
       this.wards.delete(name);
       this.doors.delete(h.pk);
+      this.#announce(); // this harbor no longer claims it: a listener unbinds a pk an announce stops naming
     }
     return this.store.take(name);
   }
@@ -223,6 +235,7 @@ export class Harbor {
     this.wards.set(name, hosted);
     this.doors.set(hosted.pk, door);
     await save();
+    this.#announce(); // reachable through every line this harbor already holds, not only the next one
     return hosted;
   }
 }

package/src/harbor/dial.ts

@@ -33,6 +33,7 @@ export function dial(harbor: Harbor, url: string): Dialer {
         void harbor.bind(far, s, false); // the listener's claims, each proven at its door: reached through this socket, not held for others
       },
       (why) => {
+        harbor.announcers.delete(say);
         harbor.unbind(s);
         if (d.socket === s) d.socket = null;
         const at = harbor.fallbacks.indexOf(s);
@@ -46,9 +47,14 @@ export function dial(harbor: Harbor, url: string): Dialer {
       },
     );
     harbor.fallbacks.push(s); // from the moment it is dialed: an ask made before the handshake waits on the socket, and is not unreached
+    // What this harbor holds, said when the line opens and again whenever it
+    // changes. A ward booted or adopted after the handshake is announced on
+    // the line already in hand, and a dropped one stops being claimed at once.
+    const say = () => s.announce([...harbor.doors.keys()]);
     line.addEventListener('open', () => {
       d.socket = s;
-      s.announce([...harbor.doors.keys()]);
+      harbor.announcers.add(say);
+      say();
     });
   };
   d.close = () => {

package/src/ward/owner.ts

@@ -1,13 +1,17 @@
 // SPDX-License-Identifier: Apache-2.0
 // The owner's asks. The root owner holds the ask pointer; every other owner
-// is an occupant of the ward itself, invited by the root. Five asks:
-// describe, boot, invite, knock, remove. The knock is a being's knock made
-// for her, and the standing is written into her cells under the id the
-// owner gave; remove takes a relation out of her by id, the mirror of it.
+// is an occupant of the ward itself, invited by the root. The ward is a
+// being to her owner: the empty ask is her describe, and it carries her asks
+// with a description and an input each, so a side renders them as it
+// renders any being's. Six asks: boot, public, invite, knock, remove and
+// unboot, which is boot's inverse and takes her relations with her. The
+// knock is a being's knock made for her, and the standing is written into
+// her cells under the id the owner gave; remove takes a relation out of her
+// by id, the mirror of it.
 import { isSilence, isWord, wordOf } from '../being/silence.ts';
 import { digest } from '../being/digest.ts';
 import { OWNER } from '../being/types.ts';
-import type { Asker, Invitation, Json, JsonObject, Wanted } from '../being/types.ts';
+import type { Ask, Asker, Invitation, Json, JsonObject, Wanted } from '../being/types.ts';
 
 export type OwnerSide = {
   pk: string;
@@ -21,10 +25,24 @@ export type OwnerSide = {
     }
   >;
   publicKey(): string | null;
-  instantiate(key: string, className: string, isPublic?: boolean): { key: string } | null;
+  instantiate(key: string, className: string): { key: string } | null;
+  unboot(key: string): string[] | null;
+  setPublic(key: string): void;
 };
 
-export const OWNER_ASKS = ['boot', 'invite', 'knock', 'remove'] as const;
+const str = { type: 'string' };
+export const OWNER_ASKS: Ask[] = [
+  { name: 'boot', description: 'boot a being by class name, under a key the owner chooses', input: { type: 'object', properties: { key: str, class: str }, required: ['key', 'class'] } },
+  { name: 'public', description: 'mark a booted being as the one public being of the ward, reached by anyone at the bare pk', input: { type: 'object', properties: { key: str }, required: ['key'] } },
+  { name: 'invite', description: 'mint an invitation on a being of the ward, under the id she will know the occupant by; on the ward pk it mints an owner, and only the root may', input: { type: 'object', properties: { being: str, id: str }, required: ['being', 'id'] } },
+  {
+    name: 'knock',
+    description: 'knock for a being of the ward with an invitation, and take the standing under id if answered; being is a key booted, or { boot: class, key } to boot her first',
+    input: { type: 'object', properties: { being: { description: 'a key, or { boot, key }' }, id: str, invitation: { type: 'object' }, method: str, args: { type: 'object' }, wanted: { type: 'object', properties: { time: { type: 'number' } } } }, required: ['being', 'id', 'invitation'] },
+  },
+  { name: 'remove', description: 'take a relation out of a being of the ward by id, occupant or standing; on the ward pk it unseats an owner, and only the root may', input: { type: 'object', properties: { being: str, id: str }, required: ['being', 'id'] } },
+  { name: 'unboot', description: 'take a being out of the ward, with every relation she holds; her occupants hear removed, and the ward itself is refused', input: { type: 'object', properties: { being: str }, required: ['being'] } },
+];
 
 export async function ownerAnswer(w: OwnerSide, asker: Asker, method: string | undefined, args: JsonObject): Promise<Json> {
   // Every name the owner gives is a word. Coerced instead of checked, an
@@ -34,16 +52,22 @@ export async function ownerAnswer(w: OwnerSide, asker: Asker, method: string | u
 
   if (method === undefined) return describe(w);
   if (method === 'boot') {
-    // A ward may have one public being, and no more. Marking a second would
-    // leave the first holding every relation she had, reachable by nobody at
-    // the bare pk, and told by nobody that she had been replaced.
-    if (args.public === true && w.publicKey() !== null) return { error: 'a ward has one public being' };
     const key = word(args.key),
       className = word(args.class);
     if (key === null || className === null) return { error: 'no such class, or key taken' };
-    const door = w.instantiate(key, className, args.public === true);
+    const door = w.instantiate(key, className);
     return door ? { booted: door.key } : { error: 'no such class, or key taken' };
   }
+  if (method === 'public') {
+    // A ward may have one public being, and no more. Marking a second would
+    // leave the first holding every relation she had, reachable by nobody at
+    // the bare pk, and told by nobody that she had been replaced.
+    const key = word(args.key);
+    if (key === null || key === w.pk || !w.doors.has(key)) return { error: 'no such being' };
+    if (w.publicKey() !== null && w.publicKey() !== key) return { error: 'a ward has one public being' };
+    w.setPublic(key);
+    return { public: key };
+  }
   if (method === 'invite') {
     // On the ward itself, only the root may invite: an occupant of the ward
     // is an owner, and ownership is minted by the ask pointer alone. An owner
@@ -98,6 +122,19 @@ export async function ownerAnswer(w: OwnerSide, asker: Asker, method: string | u
     else return { error: 'nothing to remove' };
     return { removed: id };
   }
+  if (method === 'unboot') {
+    // The inverse of boot, and the only way a being leaves a ward. Her
+    // relations go with her, so an occupant of hers hears `removed` from the
+    // keys the door kept, exactly as it would had the owner removed each id
+    // by hand; the owner hears which ids those were. The ward itself is
+    // refused, for the reason knock is: it is a being to nobody outside, and
+    // unbooting it would be a ward deleting itself from inside its own map,
+    // leaving its owners bound to a door that is gone.
+    const being = word(args.being);
+    if (being === null || being === w.pk) return { error: 'no such being' };
+    const removed = w.unboot(being);
+    return removed === null ? { error: 'no such being' } : { unbooted: being, removed };
+  }
   return { error: 'unknown ask' };
 }
 
@@ -117,7 +154,7 @@ async function describe(w: OwnerSide): Promise<Json> {
     beings[key] = { class: door.cells.class ?? null, public: w.publicKey() === key, digest: d };
   }
   return {
-    asks: OWNER_ASKS.map((name) => ({ name, input: { type: 'object' } })),
+    asks: OWNER_ASKS,
     notes: { pk: w.pk, beings },
   };
 }

package/src/ward/ward.ts

@@ -8,7 +8,7 @@ import { silence, isSilence, unreached, isWord, word } from '../being/silence.ts
 import { OWNER } from '../being/types.ts';
 import type { Asker, BeingLike, Cells, JsonObject, Reply, Stance, Wanted, Word } from '../being/types.ts';
 import type { Ground, WardPointers } from './ground.ts';
-import { at, open, put, emptyBind, emptyCells, type Bind, type Partition, type StandingKeys } from './partition.ts';
+import { at, drop, open, put, emptyBind, emptyCells, type Bind, type Partition, type StandingKeys } from './partition.ts';
 import { Heirs } from './heirs.ts';
 import { makeDoor, type Door } from './door.ts';
 import { buildStance } from './stance.ts';
@@ -90,7 +90,9 @@ class Self implements BeingLike {
         pk: this.pk,
         doors: this.doors,
         publicKey: () => this.p.public,
-        instantiate: (key, className, isPublic) => this.#instantiate(key, className, isPublic),
+        instantiate: (key, className) => this.#instantiate(key, className),
+        unboot: (key) => this.#unboot(key),
+        setPublic: (key) => void (this.p.public = key),
       },
       asker,
       method,
@@ -99,15 +101,37 @@ class Self implements BeingLike {
   }
 
   // ---- ward functions. on the object. no stance reaches them.
-  #instantiate(key: string, className: string, isPublic = false): Booted | null {
+  #instantiate(key: string, className: string): Booted | null {
     if (!key || this.doors.has(key)) return null;
     const door = this.#boot(key, className);
     if (!door) return null;
     door.cells.class = className; // so a restart finds her
-    if (isPublic) this.p.public = key;
     return door;
   }
 
+  // The inverse of boot, and the only way a being leaves a ward. Her
+  // relations go first and by the same calls she would have used herself,
+  // so every occupant hears `removed` at the door from the keys it kept,
+  // rather than meeting a being who is simply not there any more. What is
+  // left after that is her cells and her bind table, and they go with her:
+  // a row naming a being no door holds would be read on the next restart
+  // and boot her again.
+  #unboot(key: string): string[] | null {
+    const door = this.doors.get(key);
+    if (!door || key === this.pk) return null;
+    const occupants = Object.keys(door.cells.occupants),
+      standings = Object.keys(door.cells.standings);
+    for (const id of occupants) door.stance.occupants.remove(id);
+    for (const id of standings) door.stance.standings.remove(id);
+    // A ward whose public being is gone answers arrivals for no heir with
+    // silence, as a ward that never had one does.
+    if (this.p.public === key) this.p.public = null;
+    drop(this.p.beings, key);
+    drop(this.p.bind, key);
+    this.doors.delete(key);
+    return [...occupants, ...standings];
+  }
+
   // Nothing is written until there is somebody to write it for: a class the
   // harbor does not know makes no being, and a boot that made nobody must
   // leave the partition as it found it.