@quo-systems/quo 0.2.15 → 0.2.17

package/src/ward/ward.ts

@@ -8,7 +8,7 @@ import { silence, isSilence, unreached, isWord, word } from '../being/silence.ts
 import { OWNER } from '../being/types.ts';
 import type { Asker, BeingLike, Cells, JsonObject, Reply, Stance, Wanted, Word } from '../being/types.ts';
 import type { Ground, WardPointers } from './ground.ts';
-import { at, drop, open, put, emptyBind, emptyCells, MINTED, type Bind, type Partition, type StandingKeys } from './partition.ts';
+import { at, drop, open, put, emptyBind, emptyCells, HEAD, MINTED, type Bind, type Partition, type StandingKeys } from './partition.ts';
 import { Heirs } from './heirs.ts';
 import { makeDoor, type Door } from './door.ts';
 import { buildStance } from './stance.ts';
@@ -50,7 +50,13 @@ class Self implements BeingLike {
     this.key = key;
     this.pk = key.pk;
     this.p = open(ground.memory); // the partition: the ward's own state, and every being's row
-    this.heirs = new Heirs(this.p, () => this.#wrote());
+    // Opening is itself a write: a memory nobody has written comes back with
+    // a version stamped on it and the ward's own tables under it. A ward that
+    // said nothing here would have every being of it kept and the head that
+    // says which version they are written under kept by nobody, so the next
+    // boot would read a partition of no version and refuse it.
+    this.#wrote(HEAD);
+    this.heirs = new Heirs(this.p, () => this.#wrote(HEAD));
     this.door = makeDoor(key, this.heirs, this.doors, () => this.p.public, (n) => ground.random(n)); // pointer one
     this.#boot(this.pk, () => this); // the ward's ward is itself
     // a restart is silent: every being in the cells is constructed again, unasked.
@@ -103,7 +109,7 @@ class Self implements BeingLike {
         unboot: (key) => this.#unboot(key),
         setPublic: (key) => {
           this.p.public = key;
-          this.#wrote();
+          this.#wrote(HEAD);
         },
       },
       asker,
@@ -114,10 +120,13 @@ class Self implements BeingLike {
 
   // ---- ward functions. on the object. no stance reaches them.
 
-  // The partition was written. The harbor is told, and nothing more: what it
-  // does with the word is its own, and the ward never learns.
-  #wrote(): void {
-    this.g.wrote?.();
+  // The partition was written, and which row of it: a being by her key, or
+  // the head. The harbor is told, and nothing more: what it does with the
+  // word is its own, and the ward never learns. Every write says its row,
+  // because a harbor told only that something moved must keep all of it, and
+  // a being's row is the one part of a partition that grows without limit.
+  #wrote(row: string): void {
+    this.g.wrote?.(row);
   }
 
   // The rows no door holds this run: beings whose class threw at birth or
@@ -151,7 +160,7 @@ class Self implements BeingLike {
     }
     if (!door) return null;
     unguarded(door.cells).class = className; // so a restart finds her. the ward's key, written behind her guard
-    this.#wrote();
+    this.#wrote(key);
     return door;
   }
 
@@ -184,7 +193,8 @@ class Self implements BeingLike {
     drop(this.p.beings, key);
     drop(this.p.bind, key);
     this.doors.delete(key);
-    this.#wrote();
+    this.#wrote(key); // she is gone, and her row goes with her
+    this.#wrote(HEAD); // her heirs were closed, and the public being may have been her
     return [...occupants, ...standings];
   }
 
@@ -196,7 +206,7 @@ class Self implements BeingLike {
   // makers: the ground's `instantiate` for a being of the ward, and the ward
   // itself, which is the first being in its own map and is already made.
   #boot(key: string, make: (stance: Stance) => BeingLike | null): Resident | null {
-    const cells = guardCells(at(this.p.beings, key) ?? emptyCells(), () => this.#wrote());
+    const cells = guardCells(at(this.p.beings, key) ?? emptyCells(), () => this.#wrote(key));
     const bind = at(this.p.bind, key) ?? emptyBind();
     const stance: Stance = buildStance(
       {
@@ -204,10 +214,10 @@ class Self implements BeingLike {
         // This stance, not merely this key: unboot and boot again under the
         // same key makes a new being, and the old stance is not hers.
         live: () => this.doors.get(key)?.stance === stance,
-        mintKey: (b) => this.#mintKey(b),
+        mintKey: (b) => this.#mintKey(b, key),
         openHeir: (heir, being, id) => this.heirs.open(heir, being, id),
         closeHeir: (heir) => this.heirs.close(heir),
-        send: (b, keys, method, args, wanted) => this.#send(b, keys, method, args, wanted),
+        send: (b, keys, method, args, wanted) => this.#send(b, keys, method, args, wanted, key),
         // A throw at birth is null to her, not a throw in her method: she asked
         // for a being and got none, and her own answer is still hers to give.
         instantiate: (className, k) => {
@@ -224,7 +234,7 @@ class Self implements BeingLike {
         // names there are, which ward may ask for one, and what becomes of one
         // she did not take, is the harbor's and no word of the ward.
         lend: async (name, take) => (await this.g.lend?.(name, take)) ?? false,
-        wrote: () => this.#wrote(),
+        wrote: () => this.#wrote(key),
       },
       key,
       cells,
@@ -236,11 +246,11 @@ class Self implements BeingLike {
     put(this.p.bind, key, bind);
     const door: Resident = { key, cells, bind, stance, being };
     this.doors.set(key, door);
-    this.#wrote();
+    this.#wrote(key);
     return door;
   }
 
-  async #mintKey(bind: Bind): Promise<{ seed: string; pk: string }> {
+  async #mintKey(bind: Bind, row: string): Promise<{ seed: string; pk: string }> {
     const k = await beingKey(this.g.random(32));
     // The last few she minted, and no more. A relation rotates on every ask,
     // so a list of all of them is a partition that grows for as long as she
@@ -248,7 +258,7 @@ class Self implements BeingLike {
     // but the keys of the moment.
     bind.minted.push(k.pk);
     if (bind.minted.length > MINTED) bind.minted.splice(0, bind.minted.length - MINTED);
-    this.#wrote();
+    this.#wrote(row);
     return k;
   }
 
@@ -257,7 +267,7 @@ class Self implements BeingLike {
   // next, seals to the far ward, opens the reply with the ephemeral secret,
   // and rotates to the announced key once the far door has answered under
   // the current one.
-  async #send(bind: Bind, keys: StandingKeys, method: string | undefined, args: JsonObject, wanted?: Wanted): Promise<ReplyPayload | typeof silence | Word> {
+  async #send(bind: Bind, keys: StandingKeys, method: string | undefined, args: JsonObject, wanted: Wanted | undefined, row: string): Promise<ReplyPayload | typeof silence | Word> {
     // What she asked for, held to what this ward allows. Asking for nothing is
     // the default, and asking for more than the ceiling is the ceiling: budget
     // is granted by a ward, never minted by a being.
@@ -267,7 +277,7 @@ class Self implements BeingLike {
     // whoever asked: no key it vouched for, so nothing to announce and nothing
     // to rotate to. A standing on her signs with one key for life. Every other
     // ask announces its next: there is no send that does not.
-    if (keys.next === null && keys.heir !== null) keys.next = (await this.#mintKey(bind)).seed;
+    if (keys.next === null && keys.heir !== null) keys.next = (await this.#mintKey(bind, row)).seed;
     const next = keys.next === null ? null : (await beingKey(unhex(keys.next))).pk;
     // Her count for this relation, one higher every call and never reused. The
     // far door honours each number once. One relation sends one at a time, so
@@ -289,10 +299,14 @@ class Self implements BeingLike {
       return unreached();
     }
     const { bytes, ephemeral } = sealed;
-    // The wait is bounded, and this is the one thing the ward times. A being
-    // holds three answers and a wait that does not end is none of them: a
-    // relation that comes back round holds a lane the answer needs, and only a
-    // bound on the wait can break that. What comes back late is not read.
+    // The wait is bounded here, and again around the lane in the stance. Two
+    // bounds and not one, because they end two different things: the stance's
+    // ends the wait a being is held in, and this one ends the occupancy of the
+    // relation's lane. A being holds three answers and a wait that does not
+    // end is none of them, and a lane nobody ever leaves is a relation the
+    // next ask never reaches. Only a bound on the wire breaks the second, and
+    // taking it out would leave one quiet far side holding the lane for good.
+    // What comes back late is not read.
     //
     // A wait that ran out is `late`, never unreached. Unreached promises
     // nothing was delivered and is safe to retry; a bound that expired knows
@@ -313,7 +327,7 @@ class Self implements BeingLike {
       keys.current = keys.next; // the far door holds `next` as announced. move to it.
       keys.next = null;
     }
-    this.#wrote(); // the count moved, and the keys may have
+    this.#wrote(row); // the count moved, and the keys may have
     return reply;
   }
 }