@quo-systems/quo 0.2.8 → 0.2.10

package/SPEC.md

@@ -86,9 +86,12 @@ ground
   instantiate   (class name, stance) -> object | null
   carry         (ward pk, bytes) -> bytes | undefined       undefined: no door was reached. a throw is read the same.
   random        (n) -> n bytes of entropy. every key a ward mints is drawn from it.
+  wrote         () -> nothing. the ward says it after every write to its partition, and nothing else:
+                a harbor that keeps the partition saves after it, when it likes and in the order
+                it was told. a harbor that keeps nothing leaves it out.
 ```
 
-Nothing else is ever passed. A harbor that needs a sixth thing has found a
+Nothing else is ever passed. A harbor that needs a seventh thing has found a
 gap in Quo or a leak into the ward. The shape is `Ground` in
 `src/ward/ground.ts`.
 
@@ -133,7 +136,7 @@ ever offered, and nothing here may be missing.
 stance
   cells                                                her state. values only.
 
-  occupants.invite(id)                                 -> invitation | null      awaitable: a key is minted
+  occupants.invite(id, notes?)                         -> invitation | null      awaitable: a key is minted
   occupants.remove(id)                                 -> nothing
 
   standings.knock(invitation, method?, args?, wanted?) -> object | silence | word
@@ -142,7 +145,8 @@ stance
   standings[id].ask(method?, args?, wanted?)           -> object | silence | word
   standings.remove(id)                                 -> nothing
 
-  boot(class, key)                                     -> key | null           a new being of her ward, by class name
+  boot(class, key, id?)                                -> key | null           a new being of her ward, by class name.
+                                                                               with an id, her standing to her under it
 
   wanted = { time? }                                   what this one ask may spend, in milliseconds. optional,
                                                        and so is saying anything at all
@@ -152,7 +156,7 @@ Return table.
 
 | call                | returns    | when                                                                                                         |
 | ------------------- | ---------- | ------------------------------------------------------------------------------------------------------------ |
-| invite(id)          | invitation | she minted a fresh id; the occupant record exists from now                                                   |
+| invite(id, notes?)  | invitation | she minted a fresh id; the occupant record exists from now, with those notes on it                           |
 |                     | null       | the id already names a record, occupant or standing, or is a reserved word                                   |
 | remove(id)          | nothing    | always. removing what is not there is nothing                                                                |
 | knock(inv, m, a, w) | object     | the far being answered                                                                                       |
@@ -166,17 +170,25 @@ Return table.
 | ask(m, a, w)        | object     | she answered                                                                                                 |
 |                     | silence    | she chose to say nothing, or bytes came back that are not Quo's                                              |
 |                     | word       | why not: removed, absent, repeated, threw, unreached, late, dropped                                          |
-| boot(class, key)    | key        | she exists from now, with fresh cells, and a restart finds her                                               |
-|                     | null       | the key is already booted, the harbor holds no such class, or the class threw at birth                       |
+| boot(cls, key, id?) | key        | she exists from now, with fresh cells, and a restart finds her; with an id, her maker holds her standing     |
+|                     | null       | the key is already booted, the harbor holds no such class, the class threw at birth, the id is one the maker |
+|                     |            | already holds or a reserved word, or the relation was refused; nothing of the being made is left             |
 
 A being may make, and only the owner reaches into another. Boot touches
-nobody: the being made has empty cells and no relation, hers included, until
-one is invited and taken like any other. What the owner has that she does
-not is every ask that reaches into a being from outside: public, invite and
-knock for her, remove, unboot. Who may ask her to boot is her gate, as who
-may ask her anything is.
-
-Ask, knock, invite and take are awaitable. Async where the language has it,
+nobody else: the being made has empty cells and no relation but the one her
+maker named, and every other is invited and taken like any other. That one is
+made the way all of them are, and it is the whole of what making gives: the
+being made mints an occupant for her maker under the maker's own key, so she
+knows who made her by that name and by nothing else, and her maker knocks
+with it and takes the standing under the id she gave. Naming no id makes no
+relation at all, and a being made that way is reachable by the owner alone. A
+relation that could not be made is a boot that made nobody: the being made
+goes out again, and nobody saw her, since she is a moment old and named to
+no one yet. What the owner has that the maker does not is every ask that
+reaches into a being from outside: public, invite and knock for her, remove,
+unboot. Who may ask her to boot is her gate, as who may ask her anything is.
+
+Ask, knock, invite, take and boot are awaitable. Async where the language has it,
 blocking where it does not. Every ask she makes is a new call.
 
 The asker has three shapes and no fourth, and nothing else ever reaches her.
@@ -281,8 +293,8 @@ S4  the reply is not one              bytes came back that do not open, or are n
 S5  the far door answered             silence, or a word, exactly as the door said it.
 ```
 
-And unreached in two: `U1` the args are not a value, or could not be
-sealed, so nothing left;
+And unreached in two: `U1` the args are not one object of values, or could
+not be sealed, so nothing left;
 `U2` the harbor returned nothing, or threw, so no door was reached. The number is
 taken all the same, and the gap it leaves in the count is harmless: the door
 honours any number above its mark.
@@ -302,9 +314,9 @@ strangers: silence, nothing written, heard false
 D1   the box does not open           wrong padlock, garbage, too short. the reply is sealed to the lid if
                                      the bytes carried one, and is noise otherwise. a lid that will not
                                      take a seal, a small-order point, is no lid: noise.
-D2   the payload is malformed        by or next not 64 hex, method not a string, args not an object, seq
-                                     below one, time not a whole number above zero, hops not a whole
-                                     number or at zero.
+D2   the payload is malformed        by or next not 64 lowercase hex, method not a string, args present and
+                                     not one object of values, seq not a whole number from one, time not a
+                                     whole number above zero, hops not a whole number or at zero.
 D3   for nobody, and nobody is home  no public being on this ward.
 D4   for nobody, signature fails     the payload names a key it was not signed with.
 D5   the heir is not held            never minted here, and not one she removed either.
@@ -320,7 +332,7 @@ D10  the number is refused           `repeated`: already honoured, or at or belo
 choices: the number spent, the keys rotated, heard true
 D11  she threw                       `threw`
 D12  she answered silence            on a named ask, or on the empty ask. nothing at all is silence too.
-D13  she answered a word             `threw`: a word is not hers to make.
+D13  she answered a non-value        `threw`: a word, a Date, a cycle, a NaN, none is hers to make.
 ```
 
 The signature is verified before anything is written and before any word is
@@ -380,7 +392,9 @@ Nothing else is a value: no dates, no references, no functions, no native
 types. An id or a standing is never a value.
 
 Args are held to the same rule before they are sealed: an ask whose args
-hold a non-value is unreached, because nothing left. Cells hold values and
+are not one object of values is unreached, because nothing left. Her answer
+is held to it at the door: a shape that is not a value is `threw` to a bound
+key and silence to a stranger, so nothing crosses altered. Cells hold values and
 refuse anything else at the moment of writing, in her own frame: a Map, a
 Date, a NaN, a cyclic object, a function, an object that is not a plain one.
 The refusal is a throw where she wrote it, which her ward turns into the
@@ -468,7 +482,12 @@ and take refuse them like the ward's words.
 ### Cells
 
 Cells are I-JSON values. The ward may persist them. A restart is silent: she
-is constructed again with the same cells.
+is constructed again with the same cells. Three keys at their root are the
+ward's, `standings`, `occupants` and `class`, and a write of hers to them is
+refused where she wrote it, like a non-value. A value nested past sixty-four
+levels, a hole in a list, an accessor, and a key named `__proto__` are
+refused the same way: JSON writes each one way and a runtime reads it
+another, so no harbor can keep them.
 
 ```
 cells
@@ -483,7 +502,10 @@ cells
 - `seen` is the digest her ward last saw arrive with an answer. A silent
   refresh leaves it untouched.
 - `notes` is hers. Quo never reads it. Tier, expiry, kinship between an
-  occupant and a standing that are the same far being: all hers.
+  occupant and a standing that are the same far being: all hers. `invite`
+  may seed it, which is how an inviter says the terms it mints under, and
+  after that it is written by nobody but her. The owner's `invite` passes
+  what it was given straight through; the ward reads none of it.
 
 ## Relations
 
@@ -543,7 +565,9 @@ and a knock on a taken invitation joins the standing's lane.
 The keys an ask sends under are read when she calls, not when the lane
 reaches her: an ask issued while the standing stood is answered even if she
 drops it in the next line. An ask on a standing she has already dropped is
-silence, and so is a knock on the invitation it was born on: after take the
+the word `dropped`, and nothing is sent. A knock on the invitation it was
+born on, after take and a drop, is a knock as a heir the far door has already
+spent, so bytes leave and the door's silence comes back: after take the
 invitation names the standing and nothing else, so it is exactly as alive as
 the standing is.
 
@@ -622,8 +646,8 @@ is sealed to. Beings never own a padlock.
 - **Her own key** is what the knocker mints at knock. She signs the knock
   with the heir and announces her own key in it. The door binds the id to
   her key and the heir dies as it speaks. Rotation two: from now on she
-  signs with a key the inviter never held. A knock that announces nothing
-  binds nothing.
+  signs with a key the inviter never held. A knock that announces nothing,
+  or announces the heir itself, binds nothing.
 - **Next.** Every ask she sends announces the key she will sign with next.
   The door holds two pks for her: the one that may speak now, and the one
   it vouched for. Whichever speaks first wins, and the other dies. There is
@@ -709,12 +733,12 @@ what makes three answers three. A wait that does not end is not an object,
 not silence and not unreached, and before the allowance a cycle of legal asks
 could produce one: A asks B, B answering asks A back, A answering asks B on
 the relation the first ask still holds. Now the innermost wait gives up, the
-silence unwinds outward, and the ask ends.
+word `late` unwinds outward, and the ask ends.
 
-**A wait that ran out is silence, never unreached.** Unreached promises
-nothing was delivered and is safe to ask again. A bound that expired knows no
-such thing: the far door may have heard and be working still. What comes
-back late is not read.
+**A wait that ran out is the word `late`, never silence and never
+unreached.** Unreached promises nothing was delivered and is safe to ask
+again. A bound that expired knows no such thing: the far door may have heard
+and be working still. What comes back late is not read.
 
 The harbor keeps a patience of its own, and the two never read each other.
 What a harbor hands back as nothing came back is unreached, and unreached
@@ -722,7 +746,7 @@ says nothing was delivered: a harbor may answer it only where it knows the
 bytes never arrived, no reach for that pk, a socket that would not open, a
 link that is down. A harbor that sent them and then gave up knows no such
 thing, and must not answer at all; the ward's bound will ring, and that is
-silence, which promises nothing. A harbor that throws has answered nothing
+`late`, which promises nothing. A harbor that throws has answered nothing
 in a louder voice, and the ward reads it as nothing: unreached. So a harbor
 may hold a shorter patience than the ward for its own reasons, a socket it
 wants back or a queue it will not grow, and whichever ends first ends the
@@ -747,7 +771,10 @@ Every arrival is judged by the door, and named by it or falls silent.
    payload names, and dispatch as `{}`. Nothing is written.
 3. For a heir: admit the signer if it is the key held for that heir or the
    key that key announced, or the key held when she removed the id. Verify
-   the signature. Only then say anything or write anything: a removed
+   the signature. Read admission again, since the door judges arrivals
+   concurrently and a knock that raced this one may have spent the heir
+   while the signature was checked. Only then say anything or write
+   anything: a removed
    relation is `removed`, a being not back this run is `absent`, a knock
    with no key is `unannounced`, a number already honoured is `repeated`,
    and none of those writes. Else spend the number and settle the keys, so
@@ -800,14 +827,17 @@ on the bytes.
 ```
 ask on the wire     box     = ephemeral X25519 pk (32) || AES-GCM( payload || signature (64) )
                               sealed to the ward padlock. nothing rides outside it.
-                    payload = JSON { to, by, next, seq, time, hops?, method?, args }
-                              signed by `by`. to, by, next: 64 hex. to, next may be null.
-                              to names the heir, or null for the public being.
+                    payload = JSON { to, by, next, seq, time, hops?, method?, args? }
+                              signed by `by`. to, by, next: 64 lowercase hex. to, next may be null.
+                              to names the heir, or null for the public being. seq is a whole
+                              number from one. args, when present, is one object of values.
                               hops is reserved: a whole number, never below zero,
                               refused at zero, and nothing sets it.
 reply on the wire   box     = ephemeral X25519 pk (32) || AES-GCM( reply || signature (64) )
                               sealed to the ask's ephemeral pk, signed by the ward key
                     reply   = JSON { object, seen } | { silence: true } | { quo: word }
+                              seen is always present: the digest, 64 hex, on a named ask that
+                              had one, and null otherwise, the empty ask included.
                               word: removed | absent | unannounced | repeated | threw. only to a key the door bound.
 ```
 
@@ -854,8 +884,9 @@ It owns nothing durable. It is three things, all in the harbor's hands:
 its seed, its partition, and the classes its beings are made of. The
 partition names each class and the harbor holds the bodies, so a ward is
 whole only where all three are, and a harbor that keeps one remembers where
-the other two came from. It writes as it runs and never decides, asks, or
-learns whether anything was kept. Between one run and the next, a ward is
+the other two came from. It writes as it runs, says so after every write,
+and never decides, asks, or learns whether anything was kept. Between one
+run and the next, a ward is
 nothing at all.
 
 One ward is one runtime and one language, and every being in it shares both.
@@ -871,8 +902,9 @@ list is a promise, not an accident: `test/terrain.test.ts` fails the build
 both when a file names a platform and when it reaches for a global outside
 the list, and when the list names one the tree has stopped using.
 
-The package exports raw TypeScript, extension and all, on every specifier, so
-Node loads it directly and every other terrain reaches a ward through a
+The package exports the emitted `dist/`, JavaScript with a declaration
+beside it, on every specifier, so plain Node imports it; the tree runs the
+source directly, and every other terrain reaches a ward through a
 bundler. `test/bundle.test.ts` bundles the three words and runs them, and
 asserts the artefact carries nothing a terrain cannot provide.
 
@@ -887,8 +919,9 @@ of every terrain at once. Five run it: Node, a browser, workerd, Deno and
 Bun. Bun is the one that is not V8, so "the language alone" is checked
 against two implementations of the language and not one.
 
-`npm run check` is Node alone, and stays fast. `npm run check:terrain` is the
-browser and the edge, kept apart because a browser is a download and not a
+`npm run check` is Node alone, and stays fast. `npm run check:terrain` is
+every other terrain, the browser, workerd, Deno and Bun, kept apart because
+each is a binary of its own and the browser is a download and not a
 package: a fresh clone needs `npx playwright install chromium` first, and is
 told so in one sentence rather than a stack trace.
 
@@ -897,7 +930,9 @@ told so in one sentence rather than a stack trace.
 Everything durable a ward has is here, every secret included, and nothing
 here is ever in a being's cells. Values only, so the harbor may persist it as
 it likes: as this process's objects, as a row, as a line of JSON on a disk. A
-reboot from its JSON is the same ward. The shape is `src/ward/partition.ts`.
+reboot from its JSON is the same ward. A harbor that keeps it copies it
+through JSON and never structured-clones it: what the ward hands out is
+behind the cells guard. The shape is `src/ward/partition.ts`.
 
 ```
 partition
@@ -949,7 +984,9 @@ A constructor that throws on a restart takes only herself down: she is
 absent this run, no door, so `absent` at her door to the keys she bound and
 silence to strangers, and her cells sit untouched waiting for the run that
 can read them. The ward is up and so is everyone
-else. A class the harbor no longer knows is the same absence, and so is a
+else. Her row is hers while she is absent: the owner sees her as absent, no
+class boots under her key, and the owner may unboot her. A class the harbor
+does not hold this run is the same absence, and so is a
 class the harbor holds at a body the cells were not written for: which body
 a ward reboots on is the harbor's decision, and a ward cannot tell an old
 one from a new one. Loss of the partition is loss of every relation,
@@ -989,10 +1026,10 @@ renders anyone's and holds no list of its own.
 
 ```
 ask()                                    -> { asks: [boot, public, invite, knock, remove, unboot],
-                                              notes: { pk, beings: { key: { class, public, digest } } } }
+                                              notes: { pk, beings: { key: { class, public, digest, absent? } } } }
 ask('boot',   { key, class })            -> { booted: key } | { error }
 ask('public', { key })                   -> { public: key } | { error }
-ask('invite', { being, id })             -> invitation | null | { error }
+ask('invite', { being, id, notes? })     -> invitation | null | { error }
 ask('knock',  { being | { boot: class, key },
                 id, invitation, method?, args?, wanted? })
                                          -> { taken: id | null, answer } | { error: 'silence' | 'unreached' | ... }
@@ -1004,16 +1041,20 @@ anything else                            -> { error: 'unknown ask' }
 - The owner is a caller like any other: `wanted` says what its knock may
   spend, and saying nothing is the ward's default, exactly as for a being.
 - The describe runs every being's own describe as `OWNER` and hashes it; a
-  being that throws or falls silent there shows a null digest.
-- Boot refuses a key already booted and a class the harbor does not know; a
-  boot that made nobody leaves the partition as it found it. A throw at
-  birth is that boot's error, and nothing half-lives.
+  being that throws or falls silent there shows a null digest. A being
+  absent this run is listed with a null digest and `absent: true`.
+- Boot refuses a key that has a row in the partition, booted this run or
+  absent, and a class the harbor does not know; a boot that made nobody
+  leaves the partition as it found it. A throw at birth is that boot's
+  error, `{ error: 'threw at birth' }`, and nothing half-lives; a being's
+  own boot answers null for it.
 - Public marks a being already booted as the ward's one public being. It
   refuses a key not booted, the ward's own pk, and a second public being
   while one stands, since marking a second would leave the first holding
   every relation she had, reachable by nobody at the bare pk and told by
   nobody she was replaced. Marking the one already public again is
-  answered, and changes nothing.
+  answered, and changes nothing. A public being absent this run is
+  reachable by nobody already, so the mark may move to another.
 - Invite on the ward's own pk mints an owner, and only the root may ask it:
   from the door it is answered as an invite on nobody. The ward has
   occupants, its owners, and no standings: a knock for the ward itself is a
@@ -1034,7 +1075,9 @@ anything else                            -> { error: 'unknown ask' }
   heir with silence as one that never had a public being does. The ward
   itself is refused, for the reason knock is: it would be a ward deleting
   itself from inside its own map, leaving its owners bound to a door that is
-  gone.
+  gone. An absent being is unbooted the same way: she has no stance to speak
+  for her, so the ward closes her heirs itself, and her occupants hear
+  `removed`.
 - The owner's remove is the mirror of its knock: a relation out of a being,
   by id, and the id may be an occupant or a standing, since the two share
   one namespace. The being's own remove says nothing; the owner hears
@@ -1104,7 +1147,12 @@ being, holds no id, reads no partition, and is nobody outside its device.
 
 The harbor:
 
-- Boots wards as processes, one seed each, and keeps each ward's partition.
+- Boots wards as processes, one seed each, and keeps each ward's partition:
+  saves it when the ward says it wrote, one save at a time per ward and in
+  the order it was told, so a being driven in process is kept the way one
+  reached through a door is. A save that fails is the harbor's to count and
+  never a door's to answer: the door answered bytes, and a full disk is not
+  a reason the far side may hear.
 - Holds the class bodies for its wards, and remembers for each ward where
   its bodies came from, so that a restart is on the same bodies unless the
   harbor decides otherwise. Constructs a being when a ward names a class
@@ -1154,12 +1202,13 @@ one hop: a pk that is not its own and not a direct peer's is nothing. It
 keeps no lease: two of them may hold one seed and one partition, which is
 the broken vouch every real harbor refuses, kept here so that the tests can
 show what divergence looks like. Every ward and being assertion in the tree
-is made on it, so that the network never hides a fault in the words.
+is made on it first, so that the network never hides a fault in the words;
+the harbor core then passes the same suite over memory stores.
 
 What a harbor on a device keeps is a ward's three parts under one name: the
 seed, the partition, and a **ward record**, which says where the class
 bodies come from and which being is the user's. That is the **store**,
-`src/harbor/store.ts`: list, load, put, save the partition after a call,
+`src/harbor/store.ts`: list, load, put, save the partition when the ward wrote,
 save the record after a boot learned the pk, take a ward out as the first
 move of a migration, and keep the directory's hints, a pk to a URL, across
 a restart. A name already kept is refused. A store reads nothing it keeps
@@ -1183,14 +1232,17 @@ WebSocket, and this tree holds either end of a line and never a listener:
 who accepts a socket is the terrain's business. A reach reads nothing; a
 harbor opens no box but its own probe's.
 Nothing comes back only where the reach knows nothing was delivered: no such
-pk at the far end, a connection that would not open, a line already gone. A
+pk at the far end, a connection that would not open or closed before it
+opened, a line already gone, a status from a request that says the listener
+did not take the bytes, refused on their face or with nobody behind the
+gateway. A
 reach that sent the bytes and lost the line after answers nothing at all,
 and the ward's bound ends the ask. Every reach passes
 `src/conformance/reach.ts` untouched, and the frames are pinned in
 `vectors/wire.json`.
 
 A reach also carries the **wire suite**: which frames these are, and which
-four algorithms seal what they travel with. It is one number, it is not
+five algorithms seal what they travel with. It is one number, it is not
 negotiated, and today it is 1. It rides where a line is opened and never on
 an ask: in the text frame a socket announces itself with, and as the header
 `quo-suite` on a request. So an ask is still bytes from the first one, with
@@ -1209,7 +1261,7 @@ refused as it is written: the number is compared as it was sent, so a suite
 is one spelling and not a family of them.
 
 This is the only place a second suite could ever be told from the first.
-The four algorithms are named once and never negotiated, which is right: a
+The five algorithms are named once and never negotiated, which is right: a
 choice offered on the wire is a choice a stranger can push. But named once
 is not the same as unnameable, and a kit that must one day seal differently
 has to be able to say so to a kit that cannot, or the day it arrives every
@@ -1221,9 +1273,14 @@ is: the store and the reach put together under the ground. It boots every
 ward the store keeps, keeps the map of ward pk to door for its own wards
 and the **directory**, pk to reach, for foreign ones, carries bytes to a
 pk and delivers bytes from the wire to one door. The directory is filled
-three ways, in this order: its own doors; a socket a dialer holds to it,
+four ways, in this order: its own doors; a socket a dialer holds to it,
 bound once the door behind the dialer's claim has proved it, and unbound
-when the line closes; and a hint, a pk at a URL, kept in the store.
+when the line closes; the claims of a listener this harbor dialed, proven
+the same way and reached through that line; and a hint, a pk at a URL,
+kept in the store. A hint never displaces a reach proven at a door. An
+announce names at most sixty-four pks, proven a few at a time, and is the
+newest word: a proof still in flight from an earlier announce on the same
+line binds nothing when it lands.
 
 An announce is a claim, and a claim binds nothing until proven: anyone who
 can reach a listener could otherwise name a pk that is not theirs and take
@@ -1238,8 +1295,9 @@ listener proves the dialer's claims and the dialer the listener's. What a
 relay that genuinely reaches a ward elsewhere can still do is forward the
 probe and pass, and then it is a rendezvous for that ward like any other,
 able to drop and nothing more. This is the one box a harbor ever opens,
-the one it sealed itself, and it reads nothing from it but whose key
-signed. One rule makes a **rendezvous** of
+the one it sealed itself, and it reads nothing from it but that it is the
+silence a door owes such a box, signed by the claimed key. One rule makes a
+**rendezvous** of
 any listener: bytes that arrive from the wire go to an own door or to a
 socket this harbor holds for that pk, and never onward by request. So a
 harbor that cannot be dialed is reached through the one it dialed, by
@@ -1285,8 +1343,7 @@ describes herself, per asker, by answering the empty ask.
 
 Not stressed with: where anyone lives; crypto, keys, wire, storage, clocks,
 or the harbor; strangers, because nobody her ward cannot name reaches her;
-whether an occupant is a person, a model or a program; making beings, because
-only the ward instantiates.
+whether an occupant is a person, a model or a program.
 
 ### Her obligations
 
@@ -1313,9 +1370,11 @@ only the ward instantiates.
    asks is always a new call. The one exception is the public being, who is
    reached with no heir and no count: the same bytes reach her twice, and
    her answer must be safe to repeat.
-8. Beings do not make beings. A being that could create would hold class,
-   memory and key, and there would be no ward. A being that wants a child
-   gets one from outside, as an invitation handed to her.
+8. A being may make a being of her own ward, by class name and under a key
+   she chooses, and holds no relation to her until one is invited and taken
+   like any other; the ward builds the stance and the harbor holds the
+   class, so she never touches either. Only the owner reaches into a being
+   from outside.
 9. Whatever her ward cannot name is not hers to worry about: what the ward
    does with an arrival it cannot name is the ward's.
 
@@ -1338,10 +1397,13 @@ The raw shape needs no import from the kit. The kit also offers a base class,
   inherited from Object's prototype is `{ error: 'unknown ask' }` and the
   method is never entered.
 - A declared ask with no method, or one named after the base's own members,
-  fails at birth, loudly, so a boot fails and nothing half-lives.
+  fails at birth, loudly, so a boot fails and nothing half-lives. The
+  method is one on her prototype chain below Object's: a class field
+  holding a function is not there yet when the base checks, and the
+  refusal says so.
 - `occupant(asker)` is the occupant record for whoever is at the door, and
-  undefined at a public being. `invite`, `knock`, `take`, `standings` and
-  `occupants` reach the stance and nothing else.
+  undefined at a public being. `invite`, `knock`, `take`, `boot`, `cells`,
+  `standings` and `occupants` reach the stance and nothing else.
 
 ### Examples
 
@@ -1375,6 +1437,7 @@ class Shop {
   }
   async answer(asker, method, args) {
     if (method === undefined) return { asks: [{ name: 'hello', input: {} }], notes: {} };
+    if (asker.id === undefined) return { welcome: false }; // a stranger at the public door has no record
     const rec = this.s.cells.occupants[asker.id];
     if (method === 'hello' && args.invitation) {
       const back = await this.s.standings.knock(args.invitation, 'hi');
@@ -1408,15 +1471,18 @@ class Guest {
 ```
 
 A relay. Forwards every ask to one standing and never looks inside, and asks
-for a short wait because she is one door of several.
+for a short wait because she is one door of several. Silence passes through
+her; a word does not, since a word out of a being is `threw` at the door,
+D13, so she says it as an error of her own.
 
 ```js
 class Relay {
   constructor(stance) {
     this.s = stance;
   }
-  answer(asker, method, args) {
-    return this.s.standings.next.ask(method, args, { time: 2000 }); // silence and unreached pass through
+  async answer(asker, method, args) {
+    const out = await this.s.standings.next.ask(method, args, { time: 2000 });
+    return isWord(out) ? { error: wordOf(out) } : out; // unreached and late reach her asker as an error, not as a throw
   }
 }
 ```
@@ -1452,8 +1518,7 @@ words, and nothing is kept for a holder of an earlier one.
 
 The tree runs as TypeScript and the package ships as JavaScript. Node
 strips types nowhere under `node_modules`, so a consumer cannot load the
-source, and 0.1.0, which shipped it, imported nowhere; 0.1.1 is the first
-version a stranger can import. `npm run build` emits `dist/` from `src`
+source. `npm run build` emits `dist/` from `src`
 alone, one JavaScript file and one declaration file per source file with
 every relative import rewritten, and the exports map points there, types
 beside default. The
@@ -1463,11 +1528,12 @@ which is how a consumer does. `test/package.test.ts` is the one
 suite that meets the package as a stranger: it packs the tarball,
 installs it into an empty folder, and imports every entry point under
 plain Node. `npm pack --dry-run` shows what ships: `dist/`, the four
-source folders, the vectors, this document, the README and the licence,
-and nothing else. This document ships, decided here: it is the truth the
-source and the vectors are read against, and a kit in another language is
-written against it and nothing else. Publishing runs both gates first,
-`npm run check` and `npm run check:terrain`, and refuses on a failure.
+source folders, the vectors, this document, the README, the licence and
+the notice, and nothing else. This document ships, decided here: it is the
+truth the source and the vectors are read against, and a kit in another
+language is written against it and nothing else. Publishing runs both
+gates first, `npm run check` and `npm run check:terrain`, and refuses on a
+failure.
 
 ```
 src/being/        the Being side. types, the base class, silence, the digest.
@@ -1514,8 +1580,9 @@ passes the same suite. Those tests are the checklist, not the mock.
 - `src/conformance/index.ts`: one suite of behaviours, written against the
   stance and one probe: a kit hands the suite its ward's heir table and
   bind table as values, and a forged knock, so the suite can see that a
-  refusal wrote nothing and a knock bound what it should. It reads them and
-  never writes them. With the beings in `src/conformance/beings.ts`: a
+  refusal wrote nothing and a knock bound what it should. It reads the
+  tables and never writes them; the forged knock is the one thing it sends
+  through a door. With the beings in `src/conformance/beings.ts`: a
   printer, a shop, two customers, one raw being with no base class, and a
   member of an estate. Any ward must pass it, under any topology.
 - `src/conformance/estate.ts`: the estate, and the last chapter of that
@@ -1594,8 +1661,11 @@ passes the same suite. Those tests are the checklist, not the mock.
   reach suite against the socket framing over two lines in one process, so
   the frames are asserted with no network under them; the conformance
   suite against two harbor cores over memory stores reaching each other
-  in-process, drop and adopt as the migration; a restart from the store
-  with the hints; the dialer over a stubbed line, announce, a claim proven
+  in-process, drop and adopt as the migration; a ward that moves harbor
+  keeping its pk and every relation, the rendezvous told on the line in
+  hand; a ward booted or dropped after a line opened, announced on that
+  line, and a claim on a pk nobody holds binding nothing; a restart from
+  the store with the hints; the dialer over a stubbed line, announce, a claim proven
   at a real door before it binds and a claim nobody there holds left
   unbound, fallback, unbind and the wait before it dials again; and the frames against
   `vectors/wire.json`, the ask, the reply, nothing delivered and the
@@ -1614,7 +1684,7 @@ passes the same suite. Those tests are the checklist, not the mock.
   `node:assert/strict`, pair by pair. The suite means the same thing on
   every terrain only if those two agree, so they are compared and not
   trusted.
-- `test/floor.test.ts`: the four algorithms this terrain must carry, probed
+- `test/floor.test.ts`: the five algorithms this terrain must carry, probed
   one by one; that the arithmetic spends every one of them; and the two ways
   a terrain can be short -- no `crypto.subtle` at all, and a subtle without
   the curves -- each failing at the first call, in one sentence.
@@ -1745,7 +1815,7 @@ Decided here, so that the answer is not rediscovered:
 - **invite**: mint an id and get its invitation.
 - **knock**: an ask carrying an invitation. Binds the far side to the id.
 - **take**: keep an answered knock as a standing, under her own id.
-- **ask**: method and args to a standing. Object, silence, or unreached back.
+- **ask**: method and args to a standing. Object, silence, or a word back.
 - **answer**: her one function. Object or silence out.
 - **the empty ask**: ask with no method. Her answer to it is her blueprint.
 - **blueprint**: her interface as she chooses to show it to one asker.
@@ -1759,11 +1829,13 @@ Decided here, so that the answer is not rediscovered:
 - **unreached**: the word for no far door reached. Retryable.
 - **notes**: hers, inside every occupant record. Quo never reads it.
 - **partition**: the ward's files. Everything durable, every secret.
-- **ward record**: what a harbor keeps to boot one ward again: seed,
-  partition, and where its class bodies come from. The harbor's, never
-  the ward's.
+- **ward record**: what a harbor keeps beside a ward's seed and partition
+  to boot her again: her pk, where the class bodies come from, and which
+  being is the user's. The harbor's, never the ward's.
+- **lid**: the ephemeral X25519 pk an ask carries in front of its box. The
+  reply is sealed to it and to nothing else. One per ask, never reused.
 - **edge**: one of the two seams of Quo, harbor to ward and ward to being.
   An object crosses once at birth, calls cross for the rest of the ward's
   life, and nothing else crosses.
-- **ground**: the one object a harbor passes a ward. Five things.
+- **ground**: the one object a harbor passes a ward. Six things.
 - **door**: the ward's one voice outward. Sealed bytes in, sealed bytes out.

package/dist/being/being.d.ts

@@ -13,10 +13,10 @@ export declare class Being {
     get cells(): Cells;
     get standings(): Standings;
     get occupants(): Occupants;
-    invite(id: string): Promise<Invitation | null>;
+    invite(id: string, notes?: JsonObject): Promise<Invitation | null>;
     knock(invitation: Invitation, method?: string, args?: JsonObject, wanted?: Wanted): Promise<Answer>;
     take(id: string, invitation: Invitation): Promise<string | null>;
-    boot(className: string, key: string): string | null;
+    boot(className: string, key: string, id?: string): Promise<string | null>;
     occupant(asker: Asker): OccupantRecord | undefined;
     describe(asker: Asker): Blueprint;
     answer(asker: Asker, method?: string, args?: JsonObject): Promise<Reply>;