@quo-systems/quo 0.2.10 → 0.2.12

package/dist/conformance/beings.js

@@ -1,14 +1,18 @@
 // SPDX-License-Identifier: Apache-2.0
 // The fixture beings. Fixed, so that the ward is what varies. A printer, a
-// shop, a customer on the base class, and one raw being with no base at all.
+// shop, a customer on the base class, a maker, a member, and one raw being
+// with no base at all.
 import { Being } from '../being/being.js';
-import { isSilence, isUnreached, isWord } from '../being/silence.js';
+import { answered, isUnreached } from '../being/silence.js';
+import { invitationArgs } from '../being/types.js';
 // A printer. Invites whom she is told to, prints for her occupants. Her
 // blueprint lives in her cells so a test can change her shape.
 export class Printer extends Being {
     static cells = { jobs: [], asks: [{ name: 'print', input: { type: 'object' } }] };
     static asks = { print: { input: { type: 'object' } } };
     describe() {
+        // Her own cells, which a test writes to change her shape. Cells are Json
+        // to the ward, so the asks are named for what she keeps in them.
         return { asks: this.cells.asks, notes: { model: 'LX-2' } };
     }
     print({ doc }, asker) {
@@ -41,7 +45,7 @@ export class Shop extends Being {
     }
     async keepPrinter(invitation) {
         const bp = await this.knock(invitation);
-        if (isSilence(bp) || isWord(bp))
+        if (!answered(bp))
             return false;
         this.cells.printerId = await this.take('prn', invitation);
         return true;
@@ -50,7 +54,7 @@ export class Shop extends Being {
         const rec = this.occupant(asker);
         if (rec?.notes.tier === 'gold' && invitation) {
             const back = await this.knock(invitation, 'hi');
-            if (!isSilence(back) && !isWord(back))
+            if (answered(back))
                 await this.take(`vip-${asker.id}`, invitation);
         }
         return { welcome: true };
@@ -65,7 +69,7 @@ export class Shop extends Being {
         const out = await printer.ask('print', { doc: `receipt for ${item}` });
         if (isUnreached(out))
             return { error: 'printer unreachable', retry: true };
-        if (isSilence(out) || isWord(out))
+        if (!answered(out))
             return { error: 'printer refused' };
         const st = this.cells.standings[id];
         if (st.seen !== st.digest)
@@ -83,9 +87,13 @@ export class Customer extends Being {
     static cells = { heard: [] };
     static asks = { hi: { input: { type: 'object' } } };
     async join(invitation) {
-        const mine = (await this.invite('shop-back'));
-        const out = await this.knock(invitation, 'hello', { invitation: mine });
-        if (isSilence(out) || isWord(out))
+        // A way back for the shop, if she can mint one. She may not: two joins on
+        // one invitation race, and the second finds the id taken. Then she offers
+        // nothing and knocks all the same, which is what the shop is asked to
+        // survive. The old shape said `!` here and was wrong about it.
+        const mine = await this.invite('shop-back');
+        const out = await this.knock(invitation, 'hello', { invitation: mine === null ? null : invitationArgs(mine) });
+        if (!answered(out))
             return out; // nothing was born
         await this.take('shop', invitation); // now, and only now
         return out;
@@ -116,6 +124,29 @@ export class Echo {
 // A member of an estate. Nothing scripted: she invites whom she is told to,
 // knocks where she is told to, and answers `ping` with the asker's own name.
 // The estate chapter drives her, and what it drives is the graph, not her.
+// A being who makes beings. `boot` is on every stance, so it is the ward's
+// promise and not this kit's, and a second kit that never wired it hands its
+// beings a call that answers null for ever. She says what came of it: the key
+// back, or null for a key already taken, a class the harbor does not hold, or
+// a constructor that threw. With an id she also asks for a way back, and then
+// she holds a standing to what she made like any other.
+export class Maker extends Being {
+    static cells = { made: [] };
+    static asks = {
+        open: { input: { type: 'object', properties: { class: { type: 'string' }, key: { type: 'string' }, id: { type: 'string' } }, required: ['class', 'key'] } },
+        say: { input: { type: 'object', properties: { id: { type: 'string' } }, required: ['id'] } },
+    };
+    async open({ class: className, key, id }) {
+        const made = await this.boot(className, key, id);
+        if (made !== null)
+            this.cells.made.push(made);
+        return { made };
+    }
+    async say({ id }) {
+        const standing = this.standings[id];
+        return { said: standing === undefined ? null : (await standing.ask('ping')) };
+    }
+}
 export class Member extends Being {
     static cells = { heard: [] };
     static asks = { ping: { input: { type: 'object' } } };

package/dist/conformance/estate.js

@@ -35,10 +35,10 @@
 // A model that kept one symmetric edge would be a wrong model, and would
 // agree happily with a ward that had drifted.
 import { assert } from './assert.js';
-import { isSilence, isUnreached, isWord, wordOf } from '../being/silence.js';
+import { isSilence, isUnreached, told } from '../being/silence.js';
 import { Member } from './beings.js';
-const HEX64 = /^[0-9a-f]{64}$/;
-const said = (x, w) => isWord(x) && wordOf(x) === w;
+import { HEX64 } from './index.js';
+const said = (x, w) => told(x) === w;
 // A pseudo-random source in the language alone: the estate must replay, on
 // every terrain, from a number a failure can print.
 const rolls = (seed) => () => {
@@ -51,9 +51,48 @@ const rolls = (seed) => () => {
 // Held after every move. Each line is a way the bookkeeping could stop being
 // a graph: an arc with one end, an arc with two owners, a relation filed in
 // two places at once, a count that went backwards, a secret in the cells.
-function ledger(c, before, where) {
+function ledger(c, before, where, g) {
     const at = (why) => `${where}: ${why}`;
     const heirsSeen = new Set();
+    // What the model knows, which the ward's own bookkeeping cannot tell it.
+    // Without this the ledger only checks the ward against itself, and a drift
+    // is caught late, if the sweep happens to ask the affected arc, or never.
+    if (g) {
+        for (const s of g.seats) {
+            const heir = c.wards[c.binds[s.host].ward].heirs[s.inv.heir];
+            if (!s.live) {
+                assert.ok(!heir, at(`${s.host} kicked ${s.id} and the heir is still held`));
+                assert.ok(!(s.id in c.binds[s.host].occupants), at(`${s.host} kicked ${s.id} and still holds the occupant`));
+                continue;
+            }
+            assert.ok(heir, at(`${s.host}'s live seat ${s.id} has no heir`));
+            assert.equal(heir.id, s.id, at(`the heir for ${s.host}/${s.id} is filed under ${heir.id}`));
+            // A seat nobody has knocked is a heir that has never spoken: fresh, and
+            // at zero. One that answered has spoken, so it is neither.
+            assert.equal(heir.fresh, !s.answered, at(`${s.host}/${s.id} is ${s.answered ? 'answered' : 'unknocked'} and its heir says fresh=${heir.fresh}`));
+            assert.equal(heir.mark === 0, !s.answered, at(`${s.host}/${s.id} is ${s.answered ? 'answered' : 'unknocked'} and its heir is at ${heir.mark}`));
+        }
+        for (const h of g.holds) {
+            const standing = c.binds[h.owner].standings[h.id];
+            if (!h.live) {
+                assert.ok(!standing, at(`${h.owner} dropped ${h.id} and the standing is still there`));
+                continue;
+            }
+            assert.ok(standing, at(`${h.owner}'s live standing ${h.id} is gone from the bind table`));
+            assert.equal(standing.heir, h.seat.inv.heir, at(`${h.owner}/${h.id} names a heir that is not the seat it was born on`));
+            // The count she has spent, against the number the far door honoured.
+            // Her side is never behind: she takes a number, then it crosses.
+            const far = c.wards[c.binds[h.seat.host].ward].heirs[h.seat.inv.heir];
+            if (far)
+                assert.ok(standing.seq >= far.mark, at(`${h.owner}/${h.id} counted ${standing.seq} and the far door has honoured ${far.mark}`));
+        }
+        // Every seat and hold the model knows about, and no relation the ward
+        // holds that the model never made.
+        const mine = new Set(g.seats.filter((s) => s.live).map((s) => `${s.host}/${s.id}`));
+        for (const [key, b] of Object.entries(c.binds))
+            for (const id of Object.keys(b.occupants))
+                assert.ok(mine.has(`${key}/${id}`), at(`${key} holds an occupant ${id} the model never made`));
+    }
     for (const [pk, w] of Object.entries(c.wards)) {
         for (const [heir, r] of Object.entries(w.heirs)) {
             assert.ok(!heirsSeen.has(heir), at(`heir ${heir} is held by two wards`));
@@ -151,6 +190,18 @@ export function estate(label, make, { canDown, test }) {
             const pick = (xs) => xs[Math.floor(roll() * xs.length)];
             const hands = {};
             const g = { seats: [], holds: [] };
+            // What this run actually got to. A generated walk protects only the
+            // states it reaches, and a list of assertions nobody ran is a list of
+            // assertions nobody has. Every case named here is checked off as it
+            // fires and the run fails at the end if one never did.
+            const reached = new Set();
+            const MUST = [
+                'a kicked seat knocked by the guest it bound, who hears removed',
+                'a standing dropped by its owner, whose host is never told',
+                'a seat kicked by its host, whose guest is never told',
+                'a relation taken, so it lives in the standing and not the knock',
+                'a ward moved to another harbor under everyone standing on it',
+            ];
             let minted = 0;
             const born = async (key) => (hands[key] = await w.boot(key, Member));
             for (const key of ['M1', 'M2', 'M3'])
@@ -177,23 +228,40 @@ export function estate(label, make, { canDown, test }) {
                 // taken it the invitation is not a knock any more -- it joins the
                 // standing's lane, and is exactly as alive as the standing is.
                 for (const s of g.seats) {
-                    out.push(async () => {
+                    const knock = async () => {
                         const guest = s.guest ?? pick(keys.filter((k) => k !== s.host));
                         const hold = g.holds.find((h) => h.seat === s);
                         const back = await hands[guest].being.knock(s.inv, 'ping');
-                        if (s.live && (s.guest === null || s.guest === guest) && (hold === undefined || hold.live)) {
+                        // Whether this knock is heard at all: the seat has no guest yet,
+                        // or its guest is this one, and nothing of hers has dropped the
+                        // key the door would bind her by. A hold exists only where a
+                        // guest does, so the two tests are one condition and not two.
+                        // Then the seat says which answer: alive is the pong, kicked is
+                        // `removed`, and unheard is silence whichever it is.
+                        const speaks = (s.guest === null || s.guest === guest) && (hold === undefined || hold.live);
+                        if (!speaks)
+                            assert.ok(isSilence(back), `${guest} knocking ${s.host}/${s.id} should be silence`);
+                        else if (s.live) {
                             assert.deepEqual(back, { pong: s.id }, `${guest} knocking ${s.host}/${s.id}`);
                             s.guest = guest;
                             s.answered = true;
                         }
-                        else if (!s.live && (s.guest === null || (s.guest === guest && (hold === undefined || hold.live)))) {
-                            // kicked, and she speaks under a key the door bound for this seat: she hears why
+                        else {
                             assert.ok(said(back, 'removed'), `${guest} knocking kicked ${s.host}/${s.id} should hear removed`);
+                            reached.add('a kicked seat knocked by the guest it bound, who hears removed');
                         }
-                        else
-                            assert.ok(isSilence(back), `${guest} knocking ${s.host}/${s.id} should be silence`);
                         return `${guest} knocks ${s.host}/${s.id}`;
-                    });
+                    };
+                    out.push(knock);
+                    // Weighted, not written twice: the case this move exists to protect
+                    // is a seat kicked after it answered and before it was taken, and a
+                    // uniform walk over a list that grows with every invitation reaches
+                    // it by luck if at all. Three entries make it likely by
+                    // construction, and the count at the end of the run makes it
+                    // certain: a walk that never got there fails rather than passing
+                    // quietly on an assertion that never ran.
+                    if (!s.live && s.answered && !s.taken)
+                        out.push(knock, knock);
                     // a stranger on a spent seat: silence, and nothing rebinds
                     if (s.guest !== null)
                         out.push(async () => {
@@ -213,6 +281,7 @@ export function estate(label, make, { canDown, test }) {
                         assert.equal(await hands[s.guest].being.take(id, s.inv), id);
                         s.taken = true;
                         g.holds.push({ owner: s.guest, id, seat: s, live: true });
+                        reached.add('a relation taken, so it lives in the standing and not the knock');
                         assert.equal(await hands[s.guest].being.take(`${id}-again`, s.inv), null); // spent for her
                         return `${s.guest} takes ${s.host}/${s.id} as ${id}`;
                     });
@@ -221,6 +290,7 @@ export function estate(label, make, { canDown, test }) {
                     out.push(async () => {
                         hands[h.owner].being.standings.remove(h.id);
                         h.live = false;
+                        reached.add('a standing dropped by its owner, whose host is never told');
                         assert.equal(hands[h.owner].being.standings[h.id], undefined);
                         return `${h.owner} drops ${h.id}`;
                     });
@@ -229,6 +299,7 @@ export function estate(label, make, { canDown, test }) {
                     out.push(async () => {
                         hands[s.host].being.occupants.remove(s.id);
                         s.live = false;
+                        reached.add('a seat kicked by its host, whose guest is never told');
                         return `${s.host} kicks ${s.id}`;
                     });
                 // a new being: an estate grows
@@ -238,6 +309,7 @@ export function estate(label, make, { canDown, test }) {
                 out.push(async () => {
                     const who = pick(keys);
                     await w.migrate(who);
+                    reached.add('a ward moved to another harbor under everyone standing on it');
                     return `${who}'s ward moves harbor`;
                 });
                 // weather: the host's door is gone. unreached, never silence, and the
@@ -277,21 +349,40 @@ export function estate(label, make, { canDown, test }) {
             // sequence debuggable at all.
             const trace = [];
             const at = (step) => `seed ${seed} step ${step}\n  ${trace.join('\n  ')}`;
-            for (let step = 1; step <= 60; step++) {
-                const move = pick(moves());
+            // Whatever fails inside a step carries the trace that got there. One
+            // wrapper, so the move and the sweep are decorated the same way and a
+            // third thing added to a step cannot be decorated a fourth.
+            const inStep = async (step, work) => {
                 try {
-                    trace.push(await move());
+                    return await work();
                 }
                 catch (e) {
                     throw new Error(`${at(step)}\n  -> ${e.message}`, { cause: e });
                 }
+            };
+            for (let step = 1; step <= 60; step++) {
+                const move = pick(moves());
+                // The move that failed goes into the trace before it runs, not after
+                // it returns: a move names itself as it finishes, so a throw left the
+                // trace ending at the last move that worked and saying nothing about
+                // the one that did not. It is written in twice, provisionally and
+                // then as it named itself, and the provisional line goes when the
+                // real one lands.
+                trace.push(`step ${step}: a move that has not said what it did`);
+                const did = await inStep(step, move);
+                trace[trace.length - 1] = did;
                 const c = w.census();
-                ledger(c, before, at(step));
+                ledger(c, before, at(step), g);
                 before = c;
-                await sweep(step).catch((e) => {
-                    throw new Error(`${at(step)}\n  -> ${e.message}`, { cause: e });
-                });
+                await inStep(step, () => sweep(step));
             }
+            // And the walk is held to having gone somewhere. Sixty moves under one
+            // seed is a sample, not a proof, so the states the chapter is written
+            // to protect are named and counted: a run that never reached one has
+            // not tested it, and says so here rather than passing on an assertion
+            // that never ran.
+            const missed = MUST.filter((what) => !reached.has(what));
+            assert.deepEqual(missed, [], `seed ${seed} never reached: ${missed.join('; ')}\n  ${trace.join('\n  ')}`);
         });
     }
 }

package/dist/conformance/index.d.ts

@@ -1,5 +1,5 @@
 import type { BeingClass, Cells, Invitation, JsonObject } from '../being/types.ts';
-import { Printer, Shop, Customer, Echo, Member } from './beings.ts';
+import { Printer, Shop, Customer, Echo, Maker, Member } from './beings.ts';
 export type Handle<B = unknown> = {
     pk: string;
     being: B;
@@ -52,8 +52,11 @@ export type World = {
     heir(inv: Invitation): HeirView | undefined;
     census(): Census;
     migrate(key: string): Promise<void>;
+    owner(key: string): (method?: string, args?: JsonObject) => Promise<unknown>;
 };
-export { Printer, Shop, Customer, Echo, Member };
+export { Printer, Shop, Customer, Echo, Maker, Member };
+export declare const HEX64: RegExp;
+export declare const HEX128: RegExp;
 export type Runner = (name: string, opts: {
     skip?: string | false;
 }, fn: () => Promise<void> | void) => void;

package/dist/conformance/index.js

@@ -19,14 +19,20 @@
 //
 // Every assertion here is the truth's. Nothing here knows how a ward is built.
 import { assert } from './assert.js';
-import { silence, isSilence, isUnreached, isWord, wordOf } from '../being/silence.js';
+import { silence, isSilence, isUnreached, told } from '../being/silence.js';
 import { digest } from '../being/digest.js';
-import { Printer, Shop, Customer, Echo, Member } from './beings.js';
+import { Printer, Shop, Customer, Echo, Maker, Member } from './beings.js';
 import { estate } from './estate.js';
-export { Printer, Shop, Customer, Echo, Member };
-const HEX64 = /^[0-9a-f]{64}$/;
+export { Printer, Shop, Customer, Echo, Maker, Member };
+// The two shapes the suite asserts, spelled here for the whole folder. They
+// are spelled again in `src/ward/seal.ts`, and that is the point: this suite
+// is what a second kit runs against its own ward, so it states the shapes it
+// expects instead of importing ours, and nothing under `src/conformance`
+// reaches into `src/ward` for anything.
+export const HEX64 = /^[0-9a-f]{64}$/; // one key, one secret, one digest
+export const HEX128 = /^[0-9a-f]{128}$/; // a ward pk: the signing pk then the padlock
 // Her ward's word, as she receives it.
-const said = (x, w) => isWord(x) && wordOf(x) === w;
+const said = (x, w) => told(x) === w;
 export function conform(label, make, { canDown = true, test }) {
     const t = (name, fn) => test(`[${label}] ${name}`, {}, fn);
     const down = (name, fn) => test(`[${label}] ${name}`, { skip: !canDown && 'nothing to cut inside one ward' }, fn);
@@ -47,7 +53,7 @@ export function conform(label, make, { canDown = true, test }) {
         const inv = await shop.being.invite('gold');
         assert.deepEqual(Object.keys(shop.cells.occupants), ['cust1']);
         assert.deepEqual(Object.keys(inv).sort(), ['heir', 'secret', 'ward']);
-        assert.match(inv.ward, /^[0-9a-f]{128}$/);
+        assert.match(inv.ward, HEX128);
         assert.match(inv.heir, HEX64);
         assert.match(inv.secret, HEX64);
         assert.equal(inv.ward, shop.pk);
@@ -148,6 +154,156 @@ export function conform(label, make, { canDown = true, test }) {
         assert.ok(said(await alice.being.join(inv2), 'removed'));
         assert.deepEqual(Object.keys(alice.cells.standings), ['shop']);
     });
+    // ---- the names that are nobody's to take
+    //
+    // Two lists, refused at both ends of the same namespace. The ward speaks
+    // under its own words, so a being who could mint one would be a being whose
+    // ward is indistinguishable from an occupant of hers. And standings are
+    // reached by name, so a relation taken as one of the calls on them would be
+    // a relation nothing can reach. A kit that ported invite without either
+    // list passes every other scene in this file.
+    t('the reserved ids and the calls on standings are refused at invite and at take, and nothing is written for them', async () => {
+        // alice hosts here rather than the shop, because the shop's own `invite`
+        // takes a tier and mints the id itself. This one is the stance's, which
+        // is where the rule lives.
+        const { alice, bob } = await world();
+        for (const id of ['OWNER', 'PUBLIC', 'knock', 'take', 'remove']) {
+            assert.equal(await alice.being.invite(id), null, `${id} is not hers to mint`);
+            assert.equal(Object.hasOwn(alice.cells.occupants, id), false, `and nothing was written for ${id}`);
+            // The other end: a guest is answered and then refused the name.
+            const inv = (await alice.being.invite(`for-${id}`));
+            assert.deepEqual(await bob.being.knock(inv, 'hi'), { heard: 'hi' }, `the knock for ${id} was answered`);
+            assert.equal(await bob.being.take(id, inv), null, `take refuses ${id} for the same reason`);
+            assert.equal(Object.hasOwn(bob.cells.standings, id), false, `and nothing was written for ${id}`);
+            assert.equal(await bob.being.take(`as-${id}`, inv), `as-${id}`, 'and an ordinary id takes the same invitation');
+        }
+        // And the three calls are still the calls, not records that shadowed them.
+        for (const call of ['knock', 'take', 'remove'])
+            assert.equal(typeof bob.being.standings[call], 'function', `standings.${call} is the call`);
+    });
+    // ---- the owner
+    //
+    // The second pointer a ward hands back. Every ask below answers an object,
+    // because the owner hears objects and never a word: a refusal is `{ error }`
+    // with its reason, which is what a side renders.
+    t('the owner boots, marks one public being, invites, knocks, removes and unboots, and refuses each in an object', async () => {
+        const { w, shop, alice } = await world();
+        const ask = w.owner('S');
+        const bp = (await ask());
+        assert.deepEqual(bp.asks.map((a) => a.name), ['boot', 'public', 'invite', 'knock', 'remove', 'unboot'], 'six asks, in this order');
+        for (const a of bp.asks) {
+            assert.equal(typeof a.description, 'string', `${a.name} says what it is for`);
+            assert.equal(a.input.type, 'object', `${a.name} takes one object`);
+        }
+        assert.match(bp.notes.pk, HEX128);
+        assert.equal(typeof bp.notes.beings, 'object');
+        assert.deepEqual(await ask('nosuch'), { error: 'unknown ask' });
+        // boot: a key already taken is refused, and so is a class nobody holds.
+        assert.deepEqual(await ask('boot', { key: 'S', class: 'Shop' }), { error: 'no such class, or key taken' });
+        assert.deepEqual(await ask('boot', { key: 'fresh', class: 'NoSuchClass' }), { error: 'no such class, or key taken' });
+        assert.deepEqual(await ask('boot', { key: 42, class: 'Shop' }), { error: 'no such class, or key taken' }, 'a name is a string or it is nothing');
+        // public: one per ward, null takes the mark off, and the ward is nobody's
+        // public being.
+        assert.deepEqual(await ask('public', { key: 'nobody' }), { error: 'no such being' });
+        assert.deepEqual(await ask('public', { key: bp.notes.pk }), { error: 'no such being' }, 'the ward is a being to nobody outside');
+        // invite and remove, on a being of the ward, by id.
+        assert.deepEqual(await ask('invite', { being: 'nobody', id: 'x' }), { error: 'no such being' });
+        const inv = (await ask('invite', { being: 'S', id: 'by-owner', notes: { tier: 'gold' } }));
+        assert.match(inv.heir, HEX64);
+        assert.deepEqual(shop.cells.occupants['by-owner'].notes, { tier: 'gold' }, 'the notes she minted under are hers to read');
+        assert.deepEqual(await ask('remove', { being: 'S', id: 'nothing-of-hers' }), { error: 'nothing to remove' });
+        assert.deepEqual(await ask('remove', { being: 'S', id: 'by-owner' }), { removed: 'by-owner' });
+        assert.equal(Object.hasOwn(shop.cells.occupants, 'by-owner'), false);
+        // knock: the owner knocks for a being of hers and takes the standing.
+        const forA = (await ask('invite', { being: 'S', id: 'for-alice' }));
+        const knocked = (await w.owner('A'))('knock', { being: 'A', id: 'via-owner', invitation: forA, method: 'hello' });
+        assert.deepEqual(await knocked, { taken: 'via-owner', answer: { welcome: true } });
+        assert.deepEqual(Object.keys(alice.cells.standings), ['via-owner']);
+        assert.deepEqual(await alice.being.standings['via-owner'].ask('hello'), { welcome: true }, 'and it is an ordinary standing');
+        // unboot: the inverse of boot, and the ward refuses itself.
+        assert.deepEqual(await ask('unboot', { being: bp.notes.pk }), { error: 'no such being' });
+        assert.deepEqual(await ask('unboot', { being: 'nobody' }), { error: 'no such being' });
+        const gone = (await ask('unboot', { being: 'S' }));
+        assert.equal(gone.unbooted, 'S');
+        assert.ok(gone.removed.includes('for-alice'), 'her relations went with her, and the owner is told which');
+        assert.ok(said(await alice.being.standings['via-owner'].ask('hello'), 'removed'), 'and her occupant hears removed at the door');
+    });
+    // The one public being, marked and unmarked through the owner. A second
+    // one would leave the first holding every relation she had, reachable by
+    // nobody at the bare pk and told by nobody that she had been replaced.
+    t('a ward has one public being: a second is refused, null takes the mark off, and she keeps everything she held', async () => {
+        const { w, alice } = await world();
+        const ask = w.owner('A');
+        assert.deepEqual(await ask('public', { key: 'A' }), { public: 'A' });
+        assert.deepEqual(await ask('public', { key: 'A' }), { public: 'A' }, 'marking the same one again is not a second');
+        const bp = (await ask());
+        assert.equal(bp.notes.beings.A.public, true, 'and the owner sees which one she is');
+        const inv = (await alice.being.invite('kept'));
+        assert.deepEqual(await ask('public', { key: null }), { public: null }, 'null takes the mark off');
+        const off = (await ask());
+        assert.equal(off.notes.beings.A.public, false);
+        assert.ok(Object.hasOwn(alice.cells.occupants, 'kept'), 'retiring her is not destroying her: every relation she held is still hers');
+        assert.equal(inv.ward, alice.pk);
+    });
+    // A relation she dropped is nobody's. The word is her own ward's, said to
+    // her and never crossing a door, because there is no door left to ask.
+    t('a standing she dropped is dropped: the word is hers, nothing crosses, and the far side is never told', async () => {
+        const { shop, alice } = await world();
+        await alice.being.join(await shop.being.invite());
+        const standing = alice.being.standings.shop;
+        alice.being.standings.remove('shop');
+        assert.deepEqual(alice.cells.standings, {}, 'gone from her cells');
+        assert.equal(alice.being.standings.shop, undefined, 'and gone from her stance');
+        assert.ok(said(await standing.ask('hello'), 'dropped'), 'a handle she kept over the drop reaches nothing, and says so');
+        assert.ok(Object.hasOwn(shop.cells.occupants, 'cust1'), 'the far side holds her seat still: dropping is hers alone and she tells nobody');
+    });
+    // ---- a being may make
+    //
+    // `boot` is on every stance, so a kit that never wired it hands its beings a
+    // call that answers null for ever and nothing else here would notice.
+    t('a being boots one of her ward s classes from inside her own answer, and may ask for a way back to what she made', async () => {
+        const { w } = await world();
+        const maker = await w.boot('MK', Maker);
+        // A harbor holds the classes its device gave it, so one Member is booted
+        // to put the class there. What the maker does after that is the ward's.
+        await w.boot('MEM', Member);
+        assert.deepEqual(await maker.being.open({ class: 'Member', key: 'made-1' }), { made: 'made-1' });
+        assert.deepEqual(await maker.being.open({ class: 'Member', key: 'made-1' }), { made: null }, 'a key already taken makes nobody');
+        assert.deepEqual(await maker.being.open({ class: 'NoSuchClass', key: 'made-2' }), { made: null }, 'a class the harbor does not hold makes nobody');
+        assert.deepEqual(maker.cells.made, ['made-1']);
+        // With an id she holds a standing to what she made, and the being made
+        // knows her by her own key and by nothing else.
+        assert.deepEqual(await maker.being.open({ class: 'Member', key: 'made-3', id: 'mine' }), { made: 'made-3' });
+        assert.deepEqual(await maker.being.say({ id: 'mine' }), { said: { pong: 'MK' } }, 'she asks through the relation, and arrives under her own key');
+        assert.deepEqual(await maker.being.say({ id: 'nothing' }), { said: null });
+    });
+    // The case the estate's walk reaches by weight and this reaches by hand: a
+    // seat kicked after it answered and before it was taken. She holds a key
+    // the door bound for her, so she is the one person who hears why, and she
+    // hears it every time. A kit that forgot to keep the last keys of a
+    // forgotten heir answers her silence, which is what it says to a stranger,
+    // and she cannot tell being kicked from never having been let in.
+    t('a relation kicked between the knock and the take: she hears removed, every time, and the take births nothing', async () => {
+        const { shop, alice, bob } = await world();
+        const inv = await shop.being.invite();
+        assert.deepEqual(await alice.being.knock(inv, 'hello'), { welcome: true }, 'she knocked and was answered');
+        shop.being.occupants.remove('cust1'); // kicked, and she is not told
+        for (let i = 0; i < 3; i++)
+            assert.ok(said(await alice.being.knock(inv, 'hello'), 'removed'), `knock ${i}: a spent heir stays spent, and she hears why every time`);
+        // And the take still births one: it reads the knock record, which says
+        // she was answered, and the far side kicking her afterwards is not
+        // something her side can know or should guess at. The standing is hers,
+        // and it is the standing that hears removed from then on. A kit that
+        // refused the take here would leave her with no record to read the
+        // refusal through, and nothing to drop.
+        assert.equal(await alice.being.take('shop', inv), 'shop', 'the take reads the knock record, and the knock was answered');
+        assert.ok(said(await alice.being.standings.shop.ask('hello'), 'removed'), 'and the standing is where she hears it now');
+        alice.being.standings.remove('shop');
+        assert.deepEqual(alice.cells.standings, {}, 'hers to drop, like any other');
+        // And only to her: the same invitation in anyone else's hand is silence,
+        // because the keys the door kept are hers and nobody else's.
+        assert.ok(isSilence(await bob.being.knock(inv, 'hello')), 'a stranger holding the same invitation learns nothing at all');
+    });
     t('take without a knock, or after a knock that was not answered, births nothing', async () => {
         const { shop, alice } = await world();
         const inv = await shop.being.invite();
@@ -384,6 +540,8 @@ export function conform(label, make, { canDown = true, test }) {
     // ---- public
     t('a public being is asked by anyone as {}; a knock on her needs no heir and may be taken; a ward with none is silence; an unknown pk is unreached', async () => {
         const w = await make();
+        // A being written by hand: no base class, one answer, and the stance is
+        // all she is handed. She is a being to the ward on those terms alone.
         class Pub {
             s;
             constructor(s) {

package/dist/harbor/core.d.ts

@@ -1,4 +1,4 @@
-import type { WardPointers } from '../ward/ground.ts';
+import { type WardPointers } from '../ward/ground.ts';
 import type { BeingClass, BeingLike } from '../being/types.ts';
 import { type Reach } from './reach.ts';
 import type { Kept, Store, WardRecord } from './store.ts';
@@ -6,8 +6,8 @@ export type Hosted = WardPointers & {
     pk: string;
     name: string;
     record: WardRecord;
-    partition: Record<string, unknown>;
     being(key: string): BeingLike | undefined;
+    keys(): string[];
     save(): Promise<void>;
 };
 export type Bound = {
@@ -35,6 +35,7 @@ export declare class Harbor {
     readonly announcers: Set<() => void>;
     constructor(store: Store, loader?: Loader);
     boot(): Promise<void>;
+    partitionOf(name: string): Record<string, unknown> | undefined;
     carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
     deliver(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
     hint(pk: string, url: string): void;