@quo-systems/quo 0.2.16 → 0.2.18

package/GETTING_STARTED.md

@@ -0,0 +1,128 @@
+# Getting started
+
+Quo lets an object ask another object and get an answer, without knowing
+whether that other object is in the same process, on the same device, or
+on another planet. Three words: a harbor boots wards, a ward keeps beings
+and judges its door, and a being is one ordinary object with one voice.
+This is the shortest road from nothing to each of the three, for a
+stranger with a terminal. `SPEC.md` is the truth behind every sentence
+here and assumes nothing; `quo-dock.md` is the dock, the part a box runs.
+
+Two packages, and you start with the one that fits what you have:
+
+- `@quo-systems/quo`, the library. A harbor, a ward and a being in one
+  process, no wire, no files. For a program that wants Quo inside it.
+- `@quo-systems/dock`, the dock. A daemon and one command, `quo`, that
+  stand a box up: a person's world with a page, a model's side, an api, a
+  door on the wire. For a box that receives people and models.
+
+## A being, in one process
+
+```bash
+npm install @quo-systems/quo
+```
+
+A being is a class with `asks`, the methods anyone may reach, each with
+the JSON schema of its input. Everything else on the class is hers alone.
+
+```js
+import { Being } from '@quo-systems/quo';
+import { Ward } from '@quo-systems/quo/ward';
+import { MemoryHarbor } from '@quo-systems/quo/harbor';
+
+class Shop extends Being {
+  static asks = { price: { input: { type: 'object', properties: { item: { type: 'string' } } } } };
+  price({ item }) {
+    return { item, eur: 12 };
+  }
+}
+class Customer extends Being {
+  static asks = {};
+}
+
+const harbor = new MemoryHarbor();
+const ward = await harbor.boot('acme', Ward, { Shop, Customer });
+await ward.ask('boot', { key: 'shop', class: 'Shop' });
+await ward.ask('boot', { key: 'ana', class: 'Customer' });
+```
+
+The harbor booted a ward named `acme` with two classes it may make beings
+of, and the ward's owner, the process itself, booted one of each by key.
+The ward's own asks are seven, `boot`, `public`, `invite`, `knock`,
+`remove`, `unboot` and `ask`, and `ward.ask()` with no method is her
+describe: those asks and her `notes`, the ward's `pk` and her beings.
+
+Nobody reaches a being she has not invited. An invitation is minted on a
+being for one id, the shop's for `ana`, and the customer knocks with it;
+from then she holds a standing at the shop, under the name she took, and
+the shop holds her as an occupant.
+
+```js
+const invitation = await ward.ask('invite', { being: 'shop', id: 'ana' });
+const ana = harbor.objects.get(harbor.partitions.get('acme').beings.ana);
+await ana.knock(invitation);
+await ana.take('shop', invitation);
+console.log(await ana.standings.shop.ask('price', { item: 'bread' }));
+// { item: 'bread', eur: 12 }
+```
+
+That is the whole protocol: a standing on one side, an occupant on the
+other, an ask that rides the relation and an answer that rides it back.
+The two beings here share a process; the same lines hold when the shop is
+on a box across the sea, because a standing is an address and a key, and
+the harbor owns the wire. `harbor.objects` is the memory harbor's hand for
+a test and a first program; a being on a real box is reached through her
+ward, never held.
+
+## A box
+
+```bash
+npm install @quo-systems/dock
+npx quo init --dir ~/.quo --ward acme --user razvan --domain acme.com --default --show
+npx quo serve --dir ~/.quo --http 8787
+```
+
+`init` mints the ward `acme`, boots razvan's user being, her doorbell and
+the desk in it, marks it the default ward and shows it at the web route,
+and writes `routes.json`, the four routes of a box, `mcp.`, `web.`, `quo.`
+and `api.` under the domain, for a proxy to map onto the one loopback
+port. Without `--domain`, write it yourself; on a Mac the four are paths
+at one loopback address:
+
+```json
+{ "mcp": "http://127.0.0.1:8787/mcp", "web": "http://127.0.0.1:8787/web", "quo": "http://127.0.0.1:8787/quo", "api": "http://127.0.0.1:8787/api" }
+```
+
+`serve` is the daemon, the one process over that folder, and every other
+command is its client. From a second terminal, a phone:
+
+```bash
+npx quo invite --dir ~/.quo '{"being":"razvan","id":"phone"}'
+```
+
+The answer carries `link`, the ward's page with the invitation in its
+fragment. Opened on the phone, the tab boots a harbor of its own, joins as
+that device, and is in: no account, nothing typed. What a model gets is
+the same world as tools at `mcp.`, what a program gets is the same asks as
+JSON at `api.`, and what another box gets is the door at `quo.`; a being
+answers each the same, because each is an ask at her door.
+
+The box's own doings are rows on the faculties of its dock ward, placed by
+the root with `quo ask --ward dock`: a socket held to another box, an
+agent run for a ward, a schedule on the clock. A second box owns this one
+across the wire with an invitation on the ward's own pk, knocked with
+from there, and every owner command with `--via` from then on. Each of
+those, the edge, and what an estate stands beyond the init, is the
+"Getting started" chapter of `quo-dock.md`, proven cold on a Mac by
+somebody with nothing else to read.
+
+## Your own beings on a box
+
+A box holds the dock's classes and yours. `classes/index.ts` beside the
+wards exports each of yours by name, and `quo boot '{"key":"shop",
+"class":"Shop"}'` boots one; `quo init --class Shop` makes the ward's home
+being one of yours, an organisation's ward with the org as its being. A
+being's asks may name who may reach them, `for`, over the record of the
+occupant asking, and her `cells` are what she keeps between boots: the
+whole of what a being is, in `SPEC.md`, and the words above the spec, a
+world, a home, a membership, in `WORLDS.md` and `GLOSSARY.md`.

package/README.md

@@ -13,9 +13,10 @@ Nothing else is Quo.
   beings and judges its door.
 - **Being.** One ordinary object, one voice.
 
-[`SPEC.md`](SPEC.md) is the truth. It is the protocol alone: what any ward in
-any language must do for its bytes to be Quo. It is self-contained and
-assumes nothing from any other document, this README included. Read it first.
+[`protocol/SPEC.md`](protocol/SPEC.md) is the truth. It is the protocol
+alone: what any ward in any language must do for its bytes to be Quo. It is
+self-contained and assumes nothing from any other document, this README
+included. Read it first.
 [`quo-kit.md`](quo-kit.md) is this kit: what one TypeScript
 implementation chose and another kit may refuse. It assumes the spec, and
 where the two disagree the spec wins.
@@ -39,8 +40,8 @@ test/             the suites
 
 ## Requirements
 
-Node 22.18 or later for `npm run check`. The terrain gate,
-`npm run check:terrain`, runs the same conformance suite out of a bundle in a
+Node 22.18 or later for `npm run check`. The deep gate,
+`npm run deep:quo`, runs the same conformance suite out of a bundle in a
 real Chromium, in workerd, in Deno and in Bun. All four binaries come with
 `npm install`, except the browser itself: run `npx playwright install
 chromium` once. A terrain whose binary is missing skips and says so.
@@ -54,12 +55,13 @@ and runs from there:
 npm run check
 ```
 
-Build, typecheck, lint, then the suites of every package. The pieces run
-alone there too: `npm run typecheck`, `npm run lint` (`lint:ts` is oxlint
-with type-aware rules, `lint:md` is markdownlint), `npm run lint:fix`, and
-`npm test`. Inside this package three scripts exist and no more: `npm test`
-runs the suites under `test/`, `npm run build` emits `dist/`, and
-`npm run check:terrain` runs the terrains.
+Build, typecheck, lint, then one `check:<layer>` for every layer of that
+repository. The pieces run alone there too: `npm run typecheck`,
+`npm run lint` (`lint:ts` is oxlint with type-aware rules, `lint:md` is
+markdownlint), `npm run lint:fix`, and `npm run check:quo`, which is this
+package. Inside this package three scripts exist and no more:
+`npm run check` runs the suites under `test/`, `npm run build` emits
+`dist/`, and `npm run deep` runs the terrains.
 
 The toolchain is TypeScript 7, the native compiler, and oxlint, which is the
 linter built for it. Both are in Rust or Go rather than JavaScript, so the
@@ -109,7 +111,7 @@ compatibility promise before 1.0.0: the words may still move. `npm pack
 shelf with the spec inside it, this file, the licence and the notice, and no
 tests and no configs. The spec ships because it is the truth the source and
 the vectors are read against. Publishing is gated from the root of the repository:
-`npm run release:quo` there runs both gates, `check` and `check:terrain`,
+`npm run release:quo` there runs both gates, `check` and `deep`,
 and publishes on green; `npm publish` inside this package refuses and says
 so. This package carries the version of its own work and is bound to no
 other's: a number equal to another package's is a coincidence.

package/dist/conformance/store.js

@@ -6,7 +6,15 @@
 // what it put and expects it back, as the harbor will.
 import { assert } from './assert.js';
 const seed = (b) => new Uint8Array(32).fill(b);
-const kept = (b, extra = {}) => ({ seed: seed(b), partition: { beings: {}, ...extra }, record: { pk: '', code: 'classes/index.ts', user: 'me' } });
+const kept = (b, extra = {}) => ({ seed: seed(b), partition: { beings: {}, bind: {}, ...extra }, record: { pk: '', code: 'classes/index.ts', user: 'me' } });
+// A partition as a ward writes one: beings under their keys, a bind table
+// beside each, and whatever else the head carries.
+const ward = (beings, extra = {}) => ({
+    beings,
+    bind: Object.fromEntries(Object.keys(beings).map((k) => [k, { standings: {} }])),
+    ...extra,
+});
+const ALL = (p) => ['', ...Object.keys(p.beings)];
 export function conformStore(label, make, { test }) {
     const t = (name, fn) => test(`[${label}] ${name}`, {}, fn);
     t('a fresh store keeps nothing', async () => {
@@ -23,7 +31,7 @@ export function conformStore(label, make, { test }) {
         const back = await s.load('main');
         assert.ok(back);
         assert.deepEqual(back.seed, seed(7));
-        assert.deepEqual(back.partition, { beings: {}, n: 1, deep: { list: [1, 'two', null], flag: true } });
+        assert.deepEqual(back.partition, { beings: {}, bind: {}, n: 1, deep: { list: [1, 'two', null], flag: true } });
         assert.deepEqual(back.record, { pk: '', code: 'classes/index.ts', user: 'me' });
     });
     t('a name already kept is refused, and what was kept stands', async () => {
@@ -39,26 +47,44 @@ export function conformStore(label, make, { test }) {
         assert.ok(refused, 'a second put under one name must throw');
         assert.deepEqual((await s.load('main')).seed, seed(1));
     });
-    t('save replaces the partition and touches nothing else', async () => {
+    t('save writes every row it is given, and touches nothing else', async () => {
         const s = await make();
         await s.put('main', kept(3));
-        await s.save('main', { beings: { a: { x: 1 } }, bind: {} });
+        const p = ward({ a: { x: 1 } });
+        await s.save('main', p, ALL(p));
         const back = (await s.load('main'));
-        assert.deepEqual(back.partition, { beings: { a: { x: 1 } }, bind: {} });
+        assert.deepEqual(back.partition, p);
         assert.deepEqual(back.seed, seed(3));
         assert.deepEqual(back.record, kept(3).record);
     });
+    // What a store may do with the rows it is told about is its own: writing
+    // the whole partition every time is correct. What it may never do is write
+    // less than it was told, or keep a being the rows say is gone.
+    t('save writes the rows it names, and a being the rows drop is gone', async () => {
+        const s = await make();
+        const p = ward({ a: { x: 1 }, b: { y: 1 } });
+        await s.put('main', { ...kept(3), partition: p });
+        // one being moves, and only her row is named
+        p.beings.a.x = 2;
+        await s.save('main', p, ['a']);
+        assert.deepEqual((await s.load('main')).partition, p, 'the row that was named is written');
+        // she leaves: her row is named and her key is gone from the partition
+        delete p.beings.a;
+        delete p.bind.a;
+        await s.save('main', p, ['a']);
+        assert.deepEqual((await s.load('main')).partition, p, 'a row whose being is gone is dropped');
+    });
     t('record replaces the record and touches nothing else', async () => {
         const s = await make();
         await s.put('main', kept(4, { n: 9 }));
         await s.record('main', { pk: 'ab'.repeat(64), code: 'elsewhere.ts', user: 'her' });
         const back = (await s.load('main'));
         assert.deepEqual(back.record, { pk: 'ab'.repeat(64), code: 'elsewhere.ts', user: 'her' });
-        assert.deepEqual(back.partition, { beings: {}, n: 9 });
+        assert.deepEqual(back.partition, { beings: {}, bind: {}, n: 9 });
     });
     t('save and record on a name not kept are nothing', async () => {
         const s = await make();
-        await s.save('ghost', { beings: {} });
+        await s.save('ghost', { beings: {}, bind: {} }, ['']);
         await s.record('ghost', { pk: '', code: '', user: '' });
         assert.deepEqual(await s.list(), []);
     });
@@ -67,10 +93,10 @@ export function conformStore(label, make, { test }) {
         const k = kept(5, { n: 1 });
         await s.put('main', k);
         k.partition.n = 2;
-        assert.deepEqual((await s.load('main')).partition, { beings: {}, n: 1 });
+        assert.deepEqual((await s.load('main')).partition, { beings: {}, bind: {}, n: 1 });
         const a = (await s.load('main'));
         a.partition.n = 3;
-        assert.deepEqual((await s.load('main')).partition, { beings: {}, n: 1 });
+        assert.deepEqual((await s.load('main')).partition, { beings: {}, bind: {}, n: 1 });
     });
     t('take hands the ward out and forgets it; the name is free again', async () => {
         const s = await make();
@@ -79,7 +105,7 @@ export function conformStore(label, make, { test }) {
         const out = await s.take('main');
         assert.ok(out);
         assert.deepEqual(out.seed, seed(6));
-        assert.deepEqual(out.partition, { beings: {}, n: 6 });
+        assert.deepEqual(out.partition, { beings: {}, bind: {}, n: 6 });
         assert.equal(await s.load('main'), undefined);
         assert.deepEqual(await s.list(), ['other']);
         await s.put('main', kept(9));

package/dist/harbor/core.js

@@ -119,13 +119,13 @@ export class Harbor {
         return this.#saving.get(name)?.memory;
     }
     // ---- saving
-    // The ward wrote. Its partition is saved once the line is free, and once
-    // for every burst of writes, in the order the writes came.
-    #wrote(name) {
+    // The ward wrote one row. Its partition is saved once the line is free, and
+    // once for every burst of writes, with every row named in that burst.
+    #wrote(name, row) {
         const s = this.#saving.get(name);
         if (!s || s.gone)
             return;
-        s.dirty = true;
+        s.dirty.add(row);
         if (s.timer === undefined)
             s.timer = setTimeout(() => void this.#flush(name), 0);
     }
@@ -140,10 +140,13 @@ export class Harbor {
         if (s.running)
             return s.running;
         s.running = (async () => {
-            while (s.dirty && !s.gone) {
-                s.dirty = false;
+            while (s.dirty.size > 0 && !s.gone) {
+                // Taken before the write, so a row named while this one is in flight
+                // is written by the next turn of the loop and not lost with it.
+                const rows = [...s.dirty];
+                s.dirty.clear();
                 try {
-                    await this.store.save(name, s.memory);
+                    await this.store.save(name, s.memory, rows);
                 }
                 catch {
                     this.faults.set(name, (this.faults.get(name) ?? 0) + 1);
@@ -332,12 +335,12 @@ export class Harbor {
             instantiate: maker(objects, classes, this.classes),
             carry: (pk, bytes) => this.carry(pk, new Uint8Array(bytes)),
             random,
-            wrote: () => this.#wrote(name),
+            wrote: (row) => this.#wrote(name, row),
         };
         const lend = this.lendFor(name, kept.record);
         if (lend)
             ground.lend = lend;
-        const saving = { memory, dirty: false, running: null, timer: undefined, gone: false };
+        const saving = { memory, dirty: new Set(), running: null, timer: undefined, gone: false };
         this.#saving.set(name, saving);
         // A ward that will not be born leaves nothing behind: a partition of a
         // shape this kit cannot read throws here, and a name the harbor does not

package/dist/harbor/index.d.ts

@@ -1,7 +1,8 @@
 export { MemoryHarbor, type Booted, type WardFactory } from './memory.ts';
 export { Harbor, DEFAULT_CODE, type Hosted, type Bound, type Loader } from './core.ts';
 export { dial, type Dialer } from './dial.ts';
-export { MemoryStore, values, type Store, type Kept, type WardRecord } from './store.ts';
+export { MemoryStore, values, rowsOf, type Store, type Kept, type WardRecord } from './store.ts';
+export { HEAD, fromRows, rowsIn } from '../ward/partition.ts';
 export { request, Socket, SUITE, REFUSED, type Reach, type Carry, type Line, type Announce } from './reach.ts';
 export type { Ground, WardPointers, Lend } from '../ward/ground.ts';
 export { maker, entropy, learnPk } from '../ward/ground.ts';

package/dist/harbor/index.js

@@ -6,7 +6,10 @@
 export { MemoryHarbor } from './memory.js';
 export { Harbor, DEFAULT_CODE } from './core.js';
 export { dial } from './dial.js';
-export { MemoryStore, values } from './store.js';
+export { MemoryStore, values, rowsOf } from './store.js';
+// What a store keeping a ward in rows needs: the name of the row that is not
+// a being, and the partition back from the rows it was cut into.
+export { HEAD, fromRows, rowsIn } from '../ward/partition.js';
 export { request, Socket, SUITE, REFUSED } from './reach.js';
 // What a harbor builds a ground out of. Convenience, never contract: a kit
 // writing its own harbor may write these three again.

package/dist/harbor/store.d.ts

@@ -12,22 +12,29 @@ export type Store = {
     list(): Promise<string[]>;
     load(name: string): Promise<Kept | undefined>;
     put(name: string, kept: Kept): Promise<void>;
-    save(name: string, partition: Record<string, unknown>): Promise<void>;
+    save(name: string, partition: Record<string, unknown>, rows: readonly string[]): Promise<void>;
     record(name: string, record: WardRecord): Promise<void>;
     take(name: string): Promise<Kept | undefined>;
     hints(): Promise<Record<string, string>>;
     hint(pk: string, url: string): Promise<void>;
 };
 export declare const values: (p: Record<string, unknown>) => Record<string, unknown>;
+export declare const rowsOf: (partition: Record<string, unknown>, rows: readonly string[]) => [string, Record<string, unknown> | undefined][];
+type Row = {
+    seed: Uint8Array;
+    parts: Map<string, Record<string, unknown>>;
+    record: WardRecord;
+};
 export declare class MemoryStore implements Store {
-    readonly rows: Map<string, Kept>;
+    readonly rows: Map<string, Row>;
     readonly reach: Map<string, string>;
     list(): Promise<string[]>;
     load(name: string): Promise<Kept | undefined>;
     put(name: string, kept: Kept): Promise<void>;
-    save(name: string, partition: Record<string, unknown>): Promise<void>;
+    save(name: string, partition: Record<string, unknown>, rows: readonly string[]): Promise<void>;
     record(name: string, record: WardRecord): Promise<void>;
     take(name: string): Promise<Kept | undefined>;
     hints(): Promise<Record<string, string>>;
     hint(pk: string, url: string): Promise<void>;
 }
+export {};

package/dist/harbor/store.js

@@ -1,7 +1,34 @@
+// SPDX-License-Identifier: Apache-2.0
+// The store: keeping wards by name. A ward is three things and the store
+// keeps all three under one name: the seed, the partition and the ward
+// record, which says where the class bodies come from and which being is
+// the user's. Plus the directory's hints, which are the harbor's and
+// survive a restart. The store reads nothing it keeps; the partition is
+// values the ward wrote, and the seed is bytes only the ward derives from.
+// Every terrain has one: files on a disk, IndexedDB in a tab, an object's
+// storage on the edge; the memory store below is the library's own, for a
+// harbor core with no device under it. `src/conformance/store.ts` is what
+// every one of them passes.
+import { fromRows, rowOf, rowsIn } from '../ward/partition.js';
 // The partition is values only, and the ward hands it out through a guard,
 // so a store takes a copy of the values the way a file would: through JSON.
 export const values = (p) => JSON.parse(JSON.stringify(p));
-// The store as a map, one process, nothing kept past it.
+// The rows a store was told about, as values, ready to be written down. A row
+// whose key names nobody is a being who left, and comes back undefined, which
+// is the store dropping what it holds for her.
+export const rowsOf = (partition, rows) => rows.map((row) => {
+    const value = rowOf(partition, row);
+    return [row, value === undefined ? undefined : values(value)];
+});
+// One store's copy, brought up to date with the rows it was told about.
+const keep = (row, partition, rows) => {
+    for (const [id, value] of rowsOf(partition, rows)) {
+        if (value === undefined)
+            row.parts.delete(id);
+        else
+            row.parts.set(id, value);
+    }
+};
 export class MemoryStore {
     rows = new Map();
     reach = new Map();
@@ -10,17 +37,19 @@ export class MemoryStore {
     }
     async load(name) {
         const row = this.rows.get(name);
-        return row && { seed: new Uint8Array(row.seed), partition: values(row.partition), record: { ...row.record } };
+        return row && { seed: new Uint8Array(row.seed), partition: fromRows(Object.fromEntries(row.parts)), record: { ...row.record } };
     }
     async put(name, kept) {
         if (this.rows.has(name))
             throw new Error(`ward ${name} already exists here`);
-        this.rows.set(name, { seed: new Uint8Array(kept.seed), partition: values(kept.partition), record: { ...kept.record } });
+        const row = { seed: new Uint8Array(kept.seed), parts: new Map(), record: { ...kept.record } };
+        this.rows.set(name, row);
+        keep(row, kept.partition, rowsIn(kept.partition));
     }
-    async save(name, partition) {
+    async save(name, partition, rows) {
         const row = this.rows.get(name);
         if (row)
-            row.partition = values(partition);
+            keep(row, partition, rows);
     }
     async record(name, record) {
         const row = this.rows.get(name);

package/dist/ward/ground.d.ts

@@ -4,7 +4,7 @@ export type Ground = {
     seed: string | Uint8Array;
     memory: Record<string, unknown>;
     instantiate(className: string, stance: Stance): BeingLike | null;
-    wrote?: () => void;
+    wrote?: (row: string) => void;
     carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
     random(n: number): Uint8Array;
     lend?: Lend;

package/dist/ward/partition.d.ts

@@ -58,3 +58,7 @@ export declare const put: <T>(rec: Record<string, T>, key: string, value: T) =>
 export declare const drop: (rec: Record<string, unknown>, key: string) => void;
 export declare const emptyCells: () => Cells;
 export declare const emptyBind: () => Bind;
+export declare const HEAD = "";
+export declare const rowOf: (p: Partition, row: string) => Record<string, unknown> | undefined;
+export declare const rowsIn: (p: Record<string, unknown>) => string[];
+export declare const fromRows: (rows: Record<string, Record<string, unknown>>) => Record<string, unknown>;

package/dist/ward/partition.js

@@ -167,3 +167,56 @@ export const drop = (rec, key) => {
 };
 export const emptyCells = () => ({ standings: {}, occupants: {} });
 export const emptyBind = () => ({ standings: {}, occupants: {}, knocks: {}, answered: {}, minted: [] });
+// ---- the partition in rows, for a store that keeps it
+//
+// A ward hands a harbor one object, so a being who writes one cell has every
+// other being in her ward written down beside her. What a being holds is the
+// one thing here that grows without limit, so she is a row: her cells and her
+// bind table, under her key. Everything else is one head row, and every part
+// of it is bounded already, one record per occupant and two lists that drop
+// their oldest.
+//
+// The split is here, where the shape is, and not in the harbor, which keeps
+// what it is given and reads none of it. A store is handed the rows that
+// moved; what it does with that is its own, and one that writes every row is
+// as correct as one that writes the few.
+export const HEAD = ''; // the row that is not a being: no being's key is empty
+// One row's value: a being, or the head, which is everything the partition
+// holds that is not filed under a being. The head is read as what is left
+// rather than as a list of names, so a store keeps whatever it was handed and
+// hands the same thing back, and a field this file grows later needs no line
+// in a store to survive a round trip.
+//
+// Undefined where the key names nobody, which is a row the store drops.
+export const rowOf = (p, row) => {
+    const all = p;
+    if (row === HEAD)
+        return Object.fromEntries(Object.entries(all).filter(([k]) => k !== 'beings' && k !== 'bind'));
+    const cells = at(p.beings ?? {}, row);
+    return cells === undefined ? undefined : { cells, bind: at(p.bind ?? {}, row) ?? emptyBind() };
+};
+export const rowsIn = (p) => [HEAD, ...Object.keys(p.beings ?? {})];
+// The partition back from its rows. A head that is absent is a partition
+// nobody has written, and `open` makes an empty one of it.
+export const fromRows = (rows) => {
+    const out = { ...(rows[HEAD] ?? {}) };
+    const beings = {};
+    const bind = {};
+    let any = Object.keys(out).length > 0;
+    for (const [row, value] of Object.entries(rows)) {
+        if (row === HEAD)
+            continue;
+        put(beings, row, value.cells);
+        put(bind, row, value.bind);
+        any = true;
+    }
+    // Nothing kept is nothing handed back. Rows that say only that there are no
+    // rows must come back as the empty memory they are, because `open` reads an
+    // empty one as a ward's first breath and anything else as a partition
+    // somebody wrote, which must then say which version wrote it.
+    if (!any)
+        return {};
+    out.beings = beings;
+    out.bind = bind;
+    return out;
+};

package/dist/ward/ward.js

@@ -6,7 +6,7 @@
 // leaves, opens every one that arrives.
 import { silence, isSilence, unreached, isWord, word } from '../being/silence.js';
 import { OWNER } from '../being/types.js';
-import { at, drop, open, put, emptyBind, emptyCells, MINTED } from './partition.js';
+import { at, drop, open, put, emptyBind, emptyCells, HEAD, MINTED } from './partition.js';
 import { Heirs } from './heirs.js';
 import { makeDoor } from './door.js';
 import { buildStance } from './stance.js';
@@ -38,7 +38,13 @@ class Self {
         this.key = key;
         this.pk = key.pk;
         this.p = open(ground.memory); // the partition: the ward's own state, and every being's row
-        this.heirs = new Heirs(this.p, () => this.#wrote());
+        // Opening is itself a write: a memory nobody has written comes back with
+        // a version stamped on it and the ward's own tables under it. A ward that
+        // said nothing here would have every being of it kept and the head that
+        // says which version they are written under kept by nobody, so the next
+        // boot would read a partition of no version and refuse it.
+        this.#wrote(HEAD);
+        this.heirs = new Heirs(this.p, () => this.#wrote(HEAD));
         this.door = makeDoor(key, this.heirs, this.doors, () => this.p.public, (n) => ground.random(n)); // pointer one
         this.#boot(this.pk, () => this); // the ward's ward is itself
         // a restart is silent: every being in the cells is constructed again, unasked.
@@ -93,15 +99,18 @@ class Self {
             unboot: (key) => this.#unboot(key),
             setPublic: (key) => {
                 this.p.public = key;
-                this.#wrote();
+                this.#wrote(HEAD);
             },
         }, asker, method, args);
     }
     // ---- ward functions. on the object. no stance reaches them.
-    // The partition was written. The harbor is told, and nothing more: what it
-    // does with the word is its own, and the ward never learns.
-    #wrote() {
-        this.g.wrote?.();
+    // The partition was written, and which row of it: a being by her key, or
+    // the head. The harbor is told, and nothing more: what it does with the
+    // word is its own, and the ward never learns. Every write says its row,
+    // because a harbor told only that something moved must keep all of it, and
+    // a being's row is the one part of a partition that grows without limit.
+    #wrote(row) {
+        this.g.wrote?.(row);
     }
     // The rows no door holds this run: beings whose class threw at birth or
     // is not the harbor's to give. Key to class.
@@ -139,7 +148,7 @@ class Self {
         if (!door)
             return null;
         unguarded(door.cells).class = className; // so a restart finds her. the ward's key, written behind her guard
-        this.#wrote();
+        this.#wrote(key);
         return door;
     }
     // The inverse of boot, and the only way a being leaves a ward. Her
@@ -177,7 +186,8 @@ class Self {
         drop(this.p.beings, key);
         drop(this.p.bind, key);
         this.doors.delete(key);
-        this.#wrote();
+        this.#wrote(key); // she is gone, and her row goes with her
+        this.#wrote(HEAD); // her heirs were closed, and the public being may have been her
         return [...occupants, ...standings];
     }
     // Nothing is written until there is somebody to write it for: a class the
@@ -188,17 +198,17 @@ class Self {
     // makers: the ground's `instantiate` for a being of the ward, and the ward
     // itself, which is the first being in its own map and is already made.
     #boot(key, make) {
-        const cells = guardCells(at(this.p.beings, key) ?? emptyCells(), () => this.#wrote());
+        const cells = guardCells(at(this.p.beings, key) ?? emptyCells(), () => this.#wrote(key));
         const bind = at(this.p.bind, key) ?? emptyBind();
         const stance = buildStance({
             pk: this.pk,
             // This stance, not merely this key: unboot and boot again under the
             // same key makes a new being, and the old stance is not hers.
             live: () => this.doors.get(key)?.stance === stance,
-            mintKey: (b) => this.#mintKey(b),
+            mintKey: (b) => this.#mintKey(b, key),
             openHeir: (heir, being, id) => this.heirs.open(heir, being, id),
             closeHeir: (heir) => this.heirs.close(heir),
-            send: (b, keys, method, args, wanted) => this.#send(b, keys, method, args, wanted),
+            send: (b, keys, method, args, wanted) => this.#send(b, keys, method, args, wanted, key),
             // A throw at birth is null to her, not a throw in her method: she asked
             // for a being and got none, and her own answer is still hers to give.
             instantiate: (className, k) => {
@@ -215,7 +225,7 @@ class Self {
             // names there are, which ward may ask for one, and what becomes of one
             // she did not take, is the harbor's and no word of the ward.
             lend: async (name, take) => (await this.g.lend?.(name, take)) ?? false,
-            wrote: () => this.#wrote(),
+            wrote: () => this.#wrote(key),
         }, key, cells, bind);
         const being = make(stance);
         if (!being || typeof being.answer !== 'function')
@@ -224,10 +234,10 @@ class Self {
         put(this.p.bind, key, bind);
         const door = { key, cells, bind, stance, being };
         this.doors.set(key, door);
-        this.#wrote();
+        this.#wrote(key);
         return door;
     }
-    async #mintKey(bind) {
+    async #mintKey(bind, row) {
         const k = await beingKey(this.g.random(32));
         // The last few she minted, and no more. A relation rotates on every ask,
         // so a list of all of them is a partition that grows for as long as she
@@ -236,7 +246,7 @@ class Self {
         bind.minted.push(k.pk);
         if (bind.minted.length > MINTED)
             bind.minted.splice(0, bind.minted.length - MINTED);
-        this.#wrote();
+        this.#wrote(row);
         return k;
     }
     // One send for every door, the ward's own included. Mine: never leaves.
@@ -244,7 +254,7 @@ class Self {
     // next, seals to the far ward, opens the reply with the ephemeral secret,
     // and rotates to the announced key once the far door has answered under
     // the current one.
-    async #send(bind, keys, method, args, wanted) {
+    async #send(bind, keys, method, args, wanted, row) {
         // What she asked for, held to what this ward allows. Asking for nothing is
         // the default, and asking for more than the ceiling is the ceiling: budget
         // is granted by a ward, never minted by a being.
@@ -255,7 +265,7 @@ class Self {
         // to rotate to. A standing on her signs with one key for life. Every other
         // ask announces its next: there is no send that does not.
         if (keys.next === null && keys.heir !== null)
-            keys.next = (await this.#mintKey(bind)).seed;
+            keys.next = (await this.#mintKey(bind, row)).seed;
         const next = keys.next === null ? null : (await beingKey(unhex(keys.next))).pk;
         // Her count for this relation, one higher every call and never reused. The
         // far door honours each number once. One relation sends one at a time, so
@@ -307,7 +317,7 @@ class Self {
             keys.current = keys.next; // the far door holds `next` as announced. move to it.
             keys.next = null;
         }
-        this.#wrote(); // the count moved, and the keys may have
+        this.#wrote(row); // the count moved, and the keys may have
         return reply;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quo-systems/quo",
-  "version": "0.2.16",
+  "version": "0.2.18",
   "description": "Quo: an object asks another object and gets an answer, without knowing where it is. Being, Ward, Harbor.",
   "keywords": [
     "quo",
@@ -39,9 +39,9 @@
     "./package.json": "./package.json"
   },
   "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json && cp ../../papers/SPEC.md protocol/SPEC.md && cp ../../papers/quo-kit.md quo-kit.md",
-    "test": "node --test \"test/*.test.ts\"",
-    "check:terrain": "node --test \"test/terrain/*.test.ts\"",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && cp ../../papers/SPEC.md protocol/SPEC.md && cp ../../papers/quo-kit.md quo-kit.md && cp ../../papers/GETTING_STARTED.md GETTING_STARTED.md",
+    "check": "node --test \"test/*.test.ts\"",
+    "deep": "node --test \"test/terrain/*.test.ts\"",
     "prepublishOnly": "test \"$QUO_GATED\" = 1 || { echo 'publish from the root, gated once: npm run release:quo' >&2; exit 1; }"
   },
   "publishConfig": {
@@ -52,6 +52,7 @@
     "src",
     "protocol",
     "quo-kit.md",
+    "GETTING_STARTED.md",
     "README.md",
     "LICENSE",
     "NOTICE"

package/quo-kit.md

@@ -40,7 +40,7 @@ is read against and away from every line of TypeScript, because that folder
 is what a kit in another language is written against and nothing else; this
 paper to the package root, where it says which of what a reader sees here
 was a choice. Publishing runs both
-gates first, `npm run check` and `npm run check:terrain`, and refuses on a
+gates first, `npm run check` and `npm run deep`, and refuses on a
 failure.
 
 ```
@@ -289,7 +289,7 @@ ground
   instantiate   (class name, stance) -> object | null
   carry         (ward pk, bytes) -> bytes | undefined       undefined: no door was reached. a throw is read the same.
   random        (n) -> n bytes of entropy
-  wrote         () -> nothing. said after every write to the partition. left out by a harbor that keeps nothing.
+  wrote         (row) -> nothing. said after every write, naming the row: a being by her key, or HEAD. left out by a harbor that keeps nothing.
   lend          lend(name, take) -> taken. left out by a harbor that lends nothing.
 ```
 
@@ -362,6 +362,17 @@ each have theirs, outside this tree, and every one of them passes
 `src/conformance/store.ts` untouched, as every reach passes
 `src/conformance/reach.ts`.
 
+A store keeps a ward in rows. A being's cells are the one part of a partition
+that grows without limit, so she is a row of her own, her cells and her bind
+table under her key; everything else is one head row, and every part of that
+is bounded already. `wrote` names the row, the harbor gathers the names into
+the burst it saves, and `save` is handed them beside the partition. What a
+store does with them is its own: `rowsOf` in `src/harbor/store.ts` is what
+one writing the few uses, and one writing all of it every time is correct and
+slower. The split itself is `src/ward/partition.ts`, where the shape is, so
+that a harbor keeps what it is given and reads none of it, and a field that
+file grows later needs no line in any store to survive a round trip.
+
 The dialer's wait doubles from a second to thirty when a line drops, and
 returns to that first second where the far side announced and was taken.
 Those are this harbor's numbers: what a far side sees is only that a dialer
@@ -552,7 +563,7 @@ passes the same suite. Those tests are the checklist, not the mock.
   nowhere else in this repository. A terrain whose binary is absent skips and
   names the command that installs it; it never passes quietly.
   `test/terrain/engine.ts` runs the bundle in another engine on this machine.
-  Behind `npm run check:terrain`. `test/terrain/bundle.ts` is the
+  Behind `npm run deep:quo`. `test/terrain/bundle.ts` is the
   bundler and the reference run, `test/terrain/exercise.ts` is what every
   terrain runs, `test/terrain/floor.ts` is the floor -- each written once, so
   no terrain can be probed for less than another.
@@ -588,7 +599,7 @@ is no CI; the gate runs in seconds and is run before every commit. Nothing
 red is committed except a test marked todo, which is a claim the tree does
 not yet meet and says so.
 
-`npm run check` is Node alone, and stays fast. `npm run check:terrain` is
+`npm run check` is Node alone, and stays fast. `npm run deep:quo` is
 every other terrain, the browser, workerd, Deno and Bun, kept apart because
 each is a binary of its own and the browser is a download and not a
 package: a fresh clone needs `npx playwright install chromium` first, and is

package/src/conformance/store.ts

@@ -9,7 +9,15 @@ import type { Kept, Store } from '../harbor/store.ts';
 import type { Runner } from './index.ts';
 
 const seed = (b: number) => new Uint8Array(32).fill(b);
-const kept = (b: number, extra: Record<string, unknown> = {}): Kept => ({ seed: seed(b), partition: { beings: {}, ...extra }, record: { pk: '', code: 'classes/index.ts', user: 'me' } });
+const kept = (b: number, extra: Record<string, unknown> = {}): Kept => ({ seed: seed(b), partition: { beings: {}, bind: {}, ...extra }, record: { pk: '', code: 'classes/index.ts', user: 'me' } });
+// A partition as a ward writes one: beings under their keys, a bind table
+// beside each, and whatever else the head carries.
+const ward = (beings: Record<string, unknown>, extra: Record<string, unknown> = {}): Record<string, unknown> => ({
+  beings,
+  bind: Object.fromEntries(Object.keys(beings).map((k) => [k, { standings: {} }])),
+  ...extra,
+});
+const ALL = (p: Record<string, unknown>): string[] => ['', ...Object.keys(p.beings as object)];
 
 export function conformStore(label: string, make: () => Promise<Store>, { test }: { test: Runner }) {
   const t = (name: string, fn: () => Promise<void>) => test(`[${label}] ${name}`, {}, fn);
@@ -29,7 +37,7 @@ export function conformStore(label: string, make: () => Promise<Store>, { test }
     const back = await s.load('main');
     assert.ok(back);
     assert.deepEqual(back.seed, seed(7));
-    assert.deepEqual(back.partition, { beings: {}, n: 1, deep: { list: [1, 'two', null], flag: true } });
+    assert.deepEqual(back.partition, { beings: {}, bind: {}, n: 1, deep: { list: [1, 'two', null], flag: true } });
     assert.deepEqual(back.record, { pk: '', code: 'classes/index.ts', user: 'me' });
   });
 
@@ -46,28 +54,47 @@ export function conformStore(label: string, make: () => Promise<Store>, { test }
     assert.deepEqual((await s.load('main'))!.seed, seed(1));
   });
 
-  t('save replaces the partition and touches nothing else', async () => {
+  t('save writes every row it is given, and touches nothing else', async () => {
     const s = await make();
     await s.put('main', kept(3));
-    await s.save('main', { beings: { a: { x: 1 } }, bind: {} });
+    const p = ward({ a: { x: 1 } });
+    await s.save('main', p, ALL(p));
     const back = (await s.load('main'))!;
-    assert.deepEqual(back.partition, { beings: { a: { x: 1 } }, bind: {} });
+    assert.deepEqual(back.partition, p);
     assert.deepEqual(back.seed, seed(3));
     assert.deepEqual(back.record, kept(3).record);
   });
 
+  // What a store may do with the rows it is told about is its own: writing
+  // the whole partition every time is correct. What it may never do is write
+  // less than it was told, or keep a being the rows say is gone.
+  t('save writes the rows it names, and a being the rows drop is gone', async () => {
+    const s = await make();
+    const p = ward({ a: { x: 1 }, b: { y: 1 } });
+    await s.put('main', { ...kept(3), partition: p });
+    // one being moves, and only her row is named
+    (p.beings as Record<string, { x: number }>).a.x = 2;
+    await s.save('main', p, ['a']);
+    assert.deepEqual((await s.load('main'))!.partition, p, 'the row that was named is written');
+    // she leaves: her row is named and her key is gone from the partition
+    delete (p.beings as Record<string, unknown>).a;
+    delete (p.bind as Record<string, unknown>).a;
+    await s.save('main', p, ['a']);
+    assert.deepEqual((await s.load('main'))!.partition, p, 'a row whose being is gone is dropped');
+  });
+
   t('record replaces the record and touches nothing else', async () => {
     const s = await make();
     await s.put('main', kept(4, { n: 9 }));
     await s.record('main', { pk: 'ab'.repeat(64), code: 'elsewhere.ts', user: 'her' });
     const back = (await s.load('main'))!;
     assert.deepEqual(back.record, { pk: 'ab'.repeat(64), code: 'elsewhere.ts', user: 'her' });
-    assert.deepEqual(back.partition, { beings: {}, n: 9 });
+    assert.deepEqual(back.partition, { beings: {}, bind: {}, n: 9 });
   });
 
   t('save and record on a name not kept are nothing', async () => {
     const s = await make();
-    await s.save('ghost', { beings: {} });
+    await s.save('ghost', { beings: {}, bind: {} }, ['']);
     await s.record('ghost', { pk: '', code: '', user: '' });
     assert.deepEqual(await s.list(), []);
   });
@@ -77,10 +104,10 @@ export function conformStore(label: string, make: () => Promise<Store>, { test }
     const k = kept(5, { n: 1 });
     await s.put('main', k);
     (k.partition as { n: number }).n = 2;
-    assert.deepEqual((await s.load('main'))!.partition, { beings: {}, n: 1 });
+    assert.deepEqual((await s.load('main'))!.partition, { beings: {}, bind: {}, n: 1 });
     const a = (await s.load('main'))!;
     (a.partition as { n: number }).n = 3;
-    assert.deepEqual((await s.load('main'))!.partition, { beings: {}, n: 1 });
+    assert.deepEqual((await s.load('main'))!.partition, { beings: {}, bind: {}, n: 1 });
   });
 
   t('take hands the ward out and forgets it; the name is free again', async () => {
@@ -90,7 +117,7 @@ export function conformStore(label: string, make: () => Promise<Store>, { test }
     const out = await s.take('main');
     assert.ok(out);
     assert.deepEqual(out.seed, seed(6));
-    assert.deepEqual(out.partition, { beings: {}, n: 6 });
+    assert.deepEqual(out.partition, { beings: {}, bind: {}, n: 6 });
     assert.equal(await s.load('main'), undefined);
     assert.deepEqual(await s.list(), ['other']);
     await s.put('main', kept(9));

package/src/harbor/core.ts

@@ -50,7 +50,11 @@ export type Hosted = WardPointers & { pk: string; name: string; record: WardReco
 // snapshot cannot land after a newer one. A save that fails is the harbor's
 // to count and never a door's to answer: the door answered bytes, and a
 // disk that is full is not a reason the far side may hear.
-type Saving = { memory: Record<string, unknown>; dirty: boolean; running: Promise<void> | null; timer: ReturnType<typeof setTimeout> | undefined; gone: boolean };
+// `dirty` holds the rows the ward has named since the last write, and never
+// what changed in them: the harbor keeps the partition and reads none of it,
+// so what a row is worth is the store's to read off the object when it
+// writes. Empty is nothing to do.
+type Saving = { memory: Record<string, unknown>; dirty: Set<string>; running: Promise<void> | null; timer: ReturnType<typeof setTimeout> | undefined; gone: boolean };
 // A reach in the directory, and whether this harbor holds it as a socket a
 // dialer opened: only those, and its own doors, take bytes from the wire.
 export type Bound = { reach: Reach; held: boolean };
@@ -155,12 +159,12 @@ export class Harbor {
 
   // ---- saving
 
-  // The ward wrote. Its partition is saved once the line is free, and once
-  // for every burst of writes, in the order the writes came.
-  #wrote(name: string): void {
+  // The ward wrote one row. Its partition is saved once the line is free, and
+  // once for every burst of writes, with every row named in that burst.
+  #wrote(name: string, row: string): void {
     const s = this.#saving.get(name);
     if (!s || s.gone) return;
-    s.dirty = true;
+    s.dirty.add(row);
     if (s.timer === undefined) s.timer = setTimeout(() => void this.#flush(name), 0);
   }
   async #flush(name: string): Promise<void> {
@@ -172,10 +176,13 @@ export class Harbor {
     }
     if (s.running) return s.running;
     s.running = (async () => {
-      while (s.dirty && !s.gone) {
-        s.dirty = false;
+      while (s.dirty.size > 0 && !s.gone) {
+        // Taken before the write, so a row named while this one is in flight
+        // is written by the next turn of the loop and not lost with it.
+        const rows = [...s.dirty];
+        s.dirty.clear();
         try {
-          await this.store.save(name, s.memory);
+          await this.store.save(name, s.memory, rows);
         } catch {
           this.faults.set(name, (this.faults.get(name) ?? 0) + 1);
         }
@@ -352,11 +359,11 @@ export class Harbor {
       instantiate: maker(objects, classes, this.classes),
       carry: (pk, bytes) => this.carry(pk, new Uint8Array(bytes)),
       random,
-      wrote: () => this.#wrote(name),
+      wrote: (row) => this.#wrote(name, row),
     };
     const lend = this.lendFor(name, kept.record);
     if (lend) ground.lend = lend;
-    const saving: Saving = { memory, dirty: false, running: null, timer: undefined, gone: false };
+    const saving: Saving = { memory, dirty: new Set(), running: null, timer: undefined, gone: false };
     this.#saving.set(name, saving);
     // A ward that will not be born leaves nothing behind: a partition of a
     // shape this kit cannot read throws here, and a name the harbor does not

package/src/harbor/index.ts

@@ -6,7 +6,10 @@
 export { MemoryHarbor, type Booted, type WardFactory } from './memory.ts';
 export { Harbor, DEFAULT_CODE, type Hosted, type Bound, type Loader } from './core.ts';
 export { dial, type Dialer } from './dial.ts';
-export { MemoryStore, values, type Store, type Kept, type WardRecord } from './store.ts';
+export { MemoryStore, values, rowsOf, type Store, type Kept, type WardRecord } from './store.ts';
+// What a store keeping a ward in rows needs: the name of the row that is not
+// a being, and the partition back from the rows it was cut into.
+export { HEAD, fromRows, rowsIn } from '../ward/partition.ts';
 export { request, Socket, SUITE, REFUSED, type Reach, type Carry, type Line, type Announce } from './reach.ts';
 export type { Ground, WardPointers, Lend } from '../ward/ground.ts';
 // What a harbor builds a ground out of. Convenience, never contract: a kit

package/src/harbor/store.ts

@@ -9,6 +9,8 @@
 // storage on the edge; the memory store below is the library's own, for a
 // harbor core with no device under it. `src/conformance/store.ts` is what
 // every one of them passes.
+import { fromRows, rowOf, rowsIn, type Partition } from '../ward/partition.ts';
+
 export type WardRecord = { pk: string; code: string; user: string };
 export type Kept = { seed: Uint8Array; partition: Record<string, unknown>; record: WardRecord };
 
@@ -19,7 +21,14 @@ export type Store = {
   put(name: string, kept: Kept): Promise<void>;
   // The partition back, after a call; the record back, after a boot learned
   // the pk. A name not kept is nothing, on both.
-  save(name: string, partition: Record<string, unknown>): Promise<void>;
+  //
+  // `rows` names what the ward wrote since the last save: a being by her key,
+  // or `HEAD`. A store may write only those, which is what `rowsOf` is for,
+  // and a store that writes the whole partition every time is correct and
+  // slower. A being's cells are the one part of a partition that grows
+  // without limit, so a store that keeps her apart lets her neighbour be
+  // asked without her being written down again.
+  save(name: string, partition: Record<string, unknown>, rows: readonly string[]): Promise<void>;
   record(name: string, record: WardRecord): Promise<void>;
   // Take a ward out: the first move of a migration. What was kept comes back.
   take(name: string): Promise<Kept | undefined>;
@@ -31,9 +40,30 @@ export type Store = {
 // so a store takes a copy of the values the way a file would: through JSON.
 export const values = (p: Record<string, unknown>): Record<string, unknown> => JSON.parse(JSON.stringify(p)) as Record<string, unknown>;
 
-// The store as a map, one process, nothing kept past it.
+// The rows a store was told about, as values, ready to be written down. A row
+// whose key names nobody is a being who left, and comes back undefined, which
+// is the store dropping what it holds for her.
+export const rowsOf = (partition: Record<string, unknown>, rows: readonly string[]): [string, Record<string, unknown> | undefined][] =>
+  rows.map((row) => {
+    const value = rowOf(partition as unknown as Partition, row);
+    return [row, value === undefined ? undefined : (values(value) as Record<string, unknown>)];
+  });
+
+// One store's copy, brought up to date with the rows it was told about.
+const keep = (row: Row, partition: Record<string, unknown>, rows: readonly string[]): void => {
+  for (const [id, value] of rowsOf(partition, rows)) {
+    if (value === undefined) row.parts.delete(id);
+    else row.parts.set(id, value);
+  }
+};
+
+// The store as a map, one process, nothing kept past it. It keeps a ward as
+// rows, the way a store on a device does, so what it costs to save is what a
+// device pays and the library's own measurements mean something.
+type Row = { seed: Uint8Array; parts: Map<string, Record<string, unknown>>; record: WardRecord };
+
 export class MemoryStore implements Store {
-  readonly rows = new Map<string, Kept>();
+  readonly rows = new Map<string, Row>();
   readonly reach = new Map<string, string>();
 
   async list(): Promise<string[]> {
@@ -41,15 +71,17 @@ export class MemoryStore implements Store {
   }
   async load(name: string): Promise<Kept | undefined> {
     const row = this.rows.get(name);
-    return row && { seed: new Uint8Array(row.seed), partition: values(row.partition), record: { ...row.record } };
+    return row && { seed: new Uint8Array(row.seed), partition: fromRows(Object.fromEntries(row.parts)), record: { ...row.record } };
   }
   async put(name: string, kept: Kept): Promise<void> {
     if (this.rows.has(name)) throw new Error(`ward ${name} already exists here`);
-    this.rows.set(name, { seed: new Uint8Array(kept.seed), partition: values(kept.partition), record: { ...kept.record } });
+    const row: Row = { seed: new Uint8Array(kept.seed), parts: new Map(), record: { ...kept.record } };
+    this.rows.set(name, row);
+    keep(row, kept.partition, rowsIn(kept.partition));
   }
-  async save(name: string, partition: Record<string, unknown>): Promise<void> {
+  async save(name: string, partition: Record<string, unknown>, rows: readonly string[]): Promise<void> {
     const row = this.rows.get(name);
-    if (row) row.partition = values(partition);
+    if (row) keep(row, partition, rows);
   }
   async record(name: string, record: WardRecord): Promise<void> {
     const row = this.rows.get(name);

package/src/ward/ground.ts

@@ -31,13 +31,20 @@ export type Ground = {
   seed: string | Uint8Array; // the ward derives its pk from it and nothing else
   memory: Record<string, unknown>; // the partition. the ward's files. opaque to the harbor
   instantiate(className: string, stance: Stance): BeingLike | null; // the code half
-  // The ward wrote its partition. It says so after every write, a key
-  // rotated, a relation taken, a cell she set, and says nothing else: it
-  // never learns whether anything was kept. A harbor that keeps the
+  // The ward wrote its partition, and which row of it: a being by her key,
+  // or `HEAD` for everything that is not one being's. It says so after every
+  // write, a key rotated, a relation taken, a cell she set, and says nothing
+  // else: it never learns whether anything was kept. A harbor that keeps the
   // partition saves after this, when it likes and in the order it was told,
   // so a being driven in process is kept the way one reached through a door
   // is. A harbor that keeps nothing leaves it out.
-  wrote?: () => void;
+  //
+  // The row is named because a being's cells are the one part of a partition
+  // that grows without limit, and a harbor told only that something moved has
+  // to write down every being in the ward to be sure of one. What a harbor
+  // does with the name is its own: writing the whole partition on every word
+  // is correct, and slower.
+  wrote?: (row: string) => void;
   // Sealed bytes to a ward pk. What comes back, or undefined.
   //
   // undefined is a promise, not a shrug: no door was reached, and nothing was

package/src/ward/partition.ts

@@ -235,3 +235,56 @@ export const drop = (rec: Record<string, unknown>, key: string): void => {
 
 export const emptyCells = (): Cells => ({ standings: {}, occupants: {} });
 export const emptyBind = (): Bind => ({ standings: {}, occupants: {}, knocks: {}, answered: {}, minted: [] });
+
+// ---- the partition in rows, for a store that keeps it
+//
+// A ward hands a harbor one object, so a being who writes one cell has every
+// other being in her ward written down beside her. What a being holds is the
+// one thing here that grows without limit, so she is a row: her cells and her
+// bind table, under her key. Everything else is one head row, and every part
+// of it is bounded already, one record per occupant and two lists that drop
+// their oldest.
+//
+// The split is here, where the shape is, and not in the harbor, which keeps
+// what it is given and reads none of it. A store is handed the rows that
+// moved; what it does with that is its own, and one that writes every row is
+// as correct as one that writes the few.
+export const HEAD = ''; // the row that is not a being: no being's key is empty
+
+// One row's value: a being, or the head, which is everything the partition
+// holds that is not filed under a being. The head is read as what is left
+// rather than as a list of names, so a store keeps whatever it was handed and
+// hands the same thing back, and a field this file grows later needs no line
+// in a store to survive a round trip.
+//
+// Undefined where the key names nobody, which is a row the store drops.
+export const rowOf = (p: Partition, row: string): Record<string, unknown> | undefined => {
+  const all = p as unknown as Record<string, unknown>;
+  if (row === HEAD) return Object.fromEntries(Object.entries(all).filter(([k]) => k !== 'beings' && k !== 'bind'));
+  const cells = at(p.beings ?? {}, row);
+  return cells === undefined ? undefined : { cells, bind: at(p.bind ?? {}, row) ?? emptyBind() };
+};
+export const rowsIn = (p: Record<string, unknown>): string[] => [HEAD, ...Object.keys((p.beings as Record<string, unknown>) ?? {})];
+
+// The partition back from its rows. A head that is absent is a partition
+// nobody has written, and `open` makes an empty one of it.
+export const fromRows = (rows: Record<string, Record<string, unknown>>): Record<string, unknown> => {
+  const out: Record<string, unknown> = { ...(rows[HEAD] ?? {}) };
+  const beings: Record<string, unknown> = {};
+  const bind: Record<string, unknown> = {};
+  let any = Object.keys(out).length > 0;
+  for (const [row, value] of Object.entries(rows)) {
+    if (row === HEAD) continue;
+    put(beings, row, value.cells);
+    put(bind, row, value.bind);
+    any = true;
+  }
+  // Nothing kept is nothing handed back. Rows that say only that there are no
+  // rows must come back as the empty memory they are, because `open` reads an
+  // empty one as a ward's first breath and anything else as a partition
+  // somebody wrote, which must then say which version wrote it.
+  if (!any) return {};
+  out.beings = beings;
+  out.bind = bind;
+  return out;
+};

package/src/ward/ward.ts

@@ -8,7 +8,7 @@ import { silence, isSilence, unreached, isWord, word } from '../being/silence.ts
 import { OWNER } from '../being/types.ts';
 import type { Asker, BeingLike, Cells, JsonObject, Reply, Stance, Wanted, Word } from '../being/types.ts';
 import type { Ground, WardPointers } from './ground.ts';
-import { at, drop, open, put, emptyBind, emptyCells, MINTED, type Bind, type Partition, type StandingKeys } from './partition.ts';
+import { at, drop, open, put, emptyBind, emptyCells, HEAD, MINTED, type Bind, type Partition, type StandingKeys } from './partition.ts';
 import { Heirs } from './heirs.ts';
 import { makeDoor, type Door } from './door.ts';
 import { buildStance } from './stance.ts';
@@ -50,7 +50,13 @@ class Self implements BeingLike {
     this.key = key;
     this.pk = key.pk;
     this.p = open(ground.memory); // the partition: the ward's own state, and every being's row
-    this.heirs = new Heirs(this.p, () => this.#wrote());
+    // Opening is itself a write: a memory nobody has written comes back with
+    // a version stamped on it and the ward's own tables under it. A ward that
+    // said nothing here would have every being of it kept and the head that
+    // says which version they are written under kept by nobody, so the next
+    // boot would read a partition of no version and refuse it.
+    this.#wrote(HEAD);
+    this.heirs = new Heirs(this.p, () => this.#wrote(HEAD));
     this.door = makeDoor(key, this.heirs, this.doors, () => this.p.public, (n) => ground.random(n)); // pointer one
     this.#boot(this.pk, () => this); // the ward's ward is itself
     // a restart is silent: every being in the cells is constructed again, unasked.
@@ -103,7 +109,7 @@ class Self implements BeingLike {
         unboot: (key) => this.#unboot(key),
         setPublic: (key) => {
           this.p.public = key;
-          this.#wrote();
+          this.#wrote(HEAD);
         },
       },
       asker,
@@ -114,10 +120,13 @@ class Self implements BeingLike {
 
   // ---- ward functions. on the object. no stance reaches them.
 
-  // The partition was written. The harbor is told, and nothing more: what it
-  // does with the word is its own, and the ward never learns.
-  #wrote(): void {
-    this.g.wrote?.();
+  // The partition was written, and which row of it: a being by her key, or
+  // the head. The harbor is told, and nothing more: what it does with the
+  // word is its own, and the ward never learns. Every write says its row,
+  // because a harbor told only that something moved must keep all of it, and
+  // a being's row is the one part of a partition that grows without limit.
+  #wrote(row: string): void {
+    this.g.wrote?.(row);
   }
 
   // The rows no door holds this run: beings whose class threw at birth or
@@ -151,7 +160,7 @@ class Self implements BeingLike {
     }
     if (!door) return null;
     unguarded(door.cells).class = className; // so a restart finds her. the ward's key, written behind her guard
-    this.#wrote();
+    this.#wrote(key);
     return door;
   }
 
@@ -184,7 +193,8 @@ class Self implements BeingLike {
     drop(this.p.beings, key);
     drop(this.p.bind, key);
     this.doors.delete(key);
-    this.#wrote();
+    this.#wrote(key); // she is gone, and her row goes with her
+    this.#wrote(HEAD); // her heirs were closed, and the public being may have been her
     return [...occupants, ...standings];
   }
 
@@ -196,7 +206,7 @@ class Self implements BeingLike {
   // makers: the ground's `instantiate` for a being of the ward, and the ward
   // itself, which is the first being in its own map and is already made.
   #boot(key: string, make: (stance: Stance) => BeingLike | null): Resident | null {
-    const cells = guardCells(at(this.p.beings, key) ?? emptyCells(), () => this.#wrote());
+    const cells = guardCells(at(this.p.beings, key) ?? emptyCells(), () => this.#wrote(key));
     const bind = at(this.p.bind, key) ?? emptyBind();
     const stance: Stance = buildStance(
       {
@@ -204,10 +214,10 @@ class Self implements BeingLike {
         // This stance, not merely this key: unboot and boot again under the
         // same key makes a new being, and the old stance is not hers.
         live: () => this.doors.get(key)?.stance === stance,
-        mintKey: (b) => this.#mintKey(b),
+        mintKey: (b) => this.#mintKey(b, key),
         openHeir: (heir, being, id) => this.heirs.open(heir, being, id),
         closeHeir: (heir) => this.heirs.close(heir),
-        send: (b, keys, method, args, wanted) => this.#send(b, keys, method, args, wanted),
+        send: (b, keys, method, args, wanted) => this.#send(b, keys, method, args, wanted, key),
         // A throw at birth is null to her, not a throw in her method: she asked
         // for a being and got none, and her own answer is still hers to give.
         instantiate: (className, k) => {
@@ -224,7 +234,7 @@ class Self implements BeingLike {
         // names there are, which ward may ask for one, and what becomes of one
         // she did not take, is the harbor's and no word of the ward.
         lend: async (name, take) => (await this.g.lend?.(name, take)) ?? false,
-        wrote: () => this.#wrote(),
+        wrote: () => this.#wrote(key),
       },
       key,
       cells,
@@ -236,11 +246,11 @@ class Self implements BeingLike {
     put(this.p.bind, key, bind);
     const door: Resident = { key, cells, bind, stance, being };
     this.doors.set(key, door);
-    this.#wrote();
+    this.#wrote(key);
     return door;
   }
 
-  async #mintKey(bind: Bind): Promise<{ seed: string; pk: string }> {
+  async #mintKey(bind: Bind, row: string): Promise<{ seed: string; pk: string }> {
     const k = await beingKey(this.g.random(32));
     // The last few she minted, and no more. A relation rotates on every ask,
     // so a list of all of them is a partition that grows for as long as she
@@ -248,7 +258,7 @@ class Self implements BeingLike {
     // but the keys of the moment.
     bind.minted.push(k.pk);
     if (bind.minted.length > MINTED) bind.minted.splice(0, bind.minted.length - MINTED);
-    this.#wrote();
+    this.#wrote(row);
     return k;
   }
 
@@ -257,7 +267,7 @@ class Self implements BeingLike {
   // next, seals to the far ward, opens the reply with the ephemeral secret,
   // and rotates to the announced key once the far door has answered under
   // the current one.
-  async #send(bind: Bind, keys: StandingKeys, method: string | undefined, args: JsonObject, wanted?: Wanted): Promise<ReplyPayload | typeof silence | Word> {
+  async #send(bind: Bind, keys: StandingKeys, method: string | undefined, args: JsonObject, wanted: Wanted | undefined, row: string): Promise<ReplyPayload | typeof silence | Word> {
     // What she asked for, held to what this ward allows. Asking for nothing is
     // the default, and asking for more than the ceiling is the ceiling: budget
     // is granted by a ward, never minted by a being.
@@ -267,7 +277,7 @@ class Self implements BeingLike {
     // whoever asked: no key it vouched for, so nothing to announce and nothing
     // to rotate to. A standing on her signs with one key for life. Every other
     // ask announces its next: there is no send that does not.
-    if (keys.next === null && keys.heir !== null) keys.next = (await this.#mintKey(bind)).seed;
+    if (keys.next === null && keys.heir !== null) keys.next = (await this.#mintKey(bind, row)).seed;
     const next = keys.next === null ? null : (await beingKey(unhex(keys.next))).pk;
     // Her count for this relation, one higher every call and never reused. The
     // far door honours each number once. One relation sends one at a time, so
@@ -317,7 +327,7 @@ class Self implements BeingLike {
       keys.current = keys.next; // the far door holds `next` as announced. move to it.
       keys.next = null;
     }
-    this.#wrote(); // the count moved, and the keys may have
+    this.#wrote(row); // the count moved, and the keys may have
     return reply;
   }
 }