@quo-systems/quo 0.2.8 → 0.2.10

package/src/ward/stance.ts

@@ -1,13 +1,14 @@
 // SPDX-License-Identifier: Apache-2.0
 // The one stance builder. Used for every being the ward boots. Nothing
 // outer is in what she holds: ids in, values out, keys in the bind table.
-import { silence, isSilence, isUnreached, isWord, word } from '../being/silence.ts';
+import { silence, isSilence, isWord, word, wordOf } from '../being/silence.ts';
 import { digest } from '../being/digest.ts';
 import { RESERVED_IDS } from '../being/types.ts';
 import type { Answer, Cells, Invitation, JsonObject, Silence, Stance, Standing, Standings, Wanted, Word } from '../being/types.ts';
 import { at, put, drop, type Bind, type StandingKeys } from './partition.ts';
 import { allow, within, LATE } from './allowance.ts';
 import { isWardPk, type ReplyPayload } from './seal.ts';
+import { cellFault } from './cells.ts';
 
 // What the stance needs from its ward, and no more.
 export type Inside = {
@@ -20,6 +21,12 @@ export type Inside = {
   send(bind: Bind, keys: StandingKeys, announce: boolean, method: string | undefined, args: JsonObject, wanted: Wanted | undefined): Promise<ReplyPayload | Silence | Word>;
   // a new being of this ward, as the owner's boot makes one. the key, or null.
   instantiate(key: string, className: string): string | null;
+  // mint an occupant on a being of this ward, for the being who made her.
+  relate(key: string, id: string): Promise<Invitation | null>;
+  // take a being of this ward out again, with every relation she holds.
+  unmake(key: string): void;
+  // the bind table was written: a record put, dropped or moved on.
+  wrote(): void;
 };
 
 // An invitation as it travels: the far ward's pk, the heir pk, the heir's secret seed. Or just the ward, for its public being.
@@ -72,9 +79,9 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
   // Every ask a being makes, bounded. The bound is outside the lane on
   // purpose: an ask that waits its turn behind a relation that comes back
   // round never reaches a send, and a bound that only watched the wire would
-  // never see it hang. A bound that ran out is silence, never unreached:
-  // unreached promises nothing was delivered and is safe to ask again, and a
-  // wait that gave up knows no such thing.
+  // never see it hang. A bound that ran out is the word late, never
+  // unreached: unreached promises nothing was delivered and is safe to ask
+  // again, and a wait that gave up knows no such thing.
   //
   // The bell rings before the work is reached, too: an ask that was still
   // waiting its turn when the wait ran out is never sent. Sent then, it would
@@ -89,53 +96,89 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
     return out === LATE ? word('late') : out;
   };
 
+  // What one send came back as, read in one place for every path that sends.
+  // A reply that opened and was signed by the far ward is the door speaking,
+  // whatever it said: an object, its silence, or a word. Bytes that were not
+  // Quo's, late and unreached are not the door speaking, and say nothing
+  // about whether it heard.
+  type Read = { answer: Answer; door: boolean; seen: string | null };
+  const read = (r: ReplyPayload | Silence | Word): Read => {
+    if (isSilence(r) || isWord(r)) return { answer: r, door: false, seen: null };
+    if ('silence' in r) return { answer: silence, door: true, seen: null };
+    if ('quo' in r) return { answer: word(r.quo), door: true, seen: null }; // the far door's word for her, sealed to her lid
+    return { answer: r.object, door: true, seen: r.seen };
+  };
+  // Whether the door spent the heir this send spoke under. An object, the
+  // door's silence and threw all mean it was honoured. A refusal word wrote
+  // nothing and says so. Anything that is not the door speaking says nothing.
+  const honoured = (r: Read): boolean => r.door && !(isWord(r.answer) && wordOf(r.answer) !== 'threw');
+  const answered = (r: Read): boolean => r.door && !isSilence(r.answer) && !isWord(r.answer);
+
   const send = async (keys: StandingKeys, method: string | undefined, args: JsonObject, wanted: Wanted | undefined, rec?: Cells['standings'][string]): Promise<Answer> => {
-    const r = await inside.send(bind, keys, true, method, args, wanted);
-    if (isSilence(r) || isWord(r)) return r;
-    if ('silence' in r) return silence;
-    if ('quo' in r) return word(r.quo); // the far door's word for her, sealed to her lid
+    const r = read(await inside.send(bind, keys, true, method, args, wanted));
     if (rec && method !== undefined && r.seen !== null) rec.seen = r.seen; // the digest rode along
-    return r.object;
+    return r.answer;
   };
 
   const knocking = async (inv: SealedInvitation, method: string | undefined, args: JsonObject, wanted: Wanted | undefined): Promise<Answer> => {
     const name = nameOf(inv);
+    // Taken while this knock waited its turn: the relation lives in the
+    // standing now and speaks on its lane, under its keys and its count.
+    const taken = takenAs(name);
+    if (taken !== undefined) {
+      const keys = at(bind.standings, taken);
+      if (!keys) return word('dropped');
+      return lane(`ask:${taken}`, () => asking(taken, keys, at(cells.standings, taken), method, args, wanted));
+    }
     // her own key for this relation, minted once: rotation two. reused if she knocks again.
     const k = (bind.knocks[name] ??= { current: (await inside.mintKey(bind)).seed, next: null, spoke: false, sent: false, seq: 0 });
-    // the first knock on a heir speaks as the heir, the key the inviter handed out, and announces her own.
-    // once bytes have come back, the heir is spent whatever they said, and her own key speaks.
-    // She sent once as the heir and nothing came back. Either the door heard,
-    // spent the heir and rotated to the key she announced, or nothing arrived
-    // and the heir still stands. Only the far door knows, and it will not say.
+    // The first knock on a heir speaks as the heir, the key the inviter
+    // handed out, and announces her own. Once the door has honoured it the
+    // heir is spent, whatever she then said, and her own key speaks; a heir
+    // spent once stays spent.
+    //
+    // She sent once as the heir and the door did not speak: nothing came
+    // back, or bytes that were not Quo's, or the wait ran out. Either the
+    // door heard, spent the heir and rotated to the key she announced, or
+    // nothing arrived and the heir still stands. Only the far door knows,
+    // and it will not say.
     //
     // So she asks, and the asking tells her. Under her own key: if the door
-    // heard, that key is the one it admits, and she is answered. If it did
-    // not, the key means nothing there, the ask is refused, and a refusal at
-    // that door writes nothing — the heir is untouched and still speaks. Then
-    // she knocks as the heir, as she would have. One extra round trip in the
-    // one case where a reply was lost, and the relation is not stranded.
+    // heard, that key is the one it admits, and she is answered, or told the
+    // door's word. If it did not, the key means nothing there, the ask is
+    // refused, and a refusal at that door writes nothing: the heir is
+    // untouched and still speaks. Then she knocks as the heir, as she would
+    // have. One extra round trip in the one case where a reply was lost, and
+    // the relation is not stranded.
     //
     // No stranger gains anything by it: whoever holds the invitation could
     // always knock as the heir, and her own key is admitted only where the
     // door already bound it to her.
     if (inv.heir !== undefined && !k.spoke && k.sent) {
       const own: StandingKeys = { ward: inv.ward, heir: inv.heir, current: k.current, next: k.next, seq: k.seq };
-      const r = await inside.send(bind, own, true, method, args, wanted);
+      const r = read(await inside.send(bind, own, true, method, args, wanted));
       k.seq = own.seq;
       k.current = own.current;
       k.next = own.next;
-      if (isUnreached(r)) return r; // still nothing. she knows no more than before.
-      if (!isSilence(r) && !isWord(r) && 'object' in r) {
-        k.spoke = true; // it was heard the first time, and this is the answer
-        bind.answered[name] = true;
-        return r.object;
+      inside.wrote();
+      if (!r.door) {
+        // Nothing the door said. Unreached and late are hers to hear now; bytes
+        // that were not Quo's leave her where she was, and the heir is tried.
+        if (!isSilence(r.answer)) return r.answer;
+      } else if (!isSilence(r.answer)) {
+        // The door spoke to her own key, so it heard the first knock: this is
+        // the answer, or the door's word for her. Its silence alone cannot be
+        // told from a refusal, so silence is followed by the knock as the heir,
+        // which the door then refuses if it had heard, and she hears silence.
+        k.spoke = true;
+        if (answered(r)) bind.answered[name] = true;
+        return r.answer;
       }
-      // Refused. The door never heard her, so the heir is still hers to spend.
     }
 
     const first = inv.heir !== undefined && !k.spoke;
     const keys: StandingKeys = first ? { ward: inv.ward, heir: inv.heir!, current: inv.secret!, next: k.current, seq: k.seq } : { ward: inv.ward, heir: inv.heir ?? null, current: k.current, next: k.next, seq: k.seq };
-    const r = await inside.send(bind, keys, true, method, args, wanted);
+    const r = read(await inside.send(bind, keys, true, method, args, wanted));
     k.sent = true; // bytes went out. whether they arrived is the far door's to know.
     // The number she spoke under, and the key she announced, kept whoever
     // answered and kept when nobody did. A reply lost on the way back is a
@@ -146,16 +189,10 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
       k.current = keys.current;
       k.next = keys.next;
     }
-    if (isUnreached(r)) return r; // nothing came back. she does not know whether it was heard.
-    // The heir is spent once the door honoured it, whatever she then said: an
-    // object, silence, or that she threw. A refusal wrote nothing, and says
-    // so by its word, so the heir still speaks and the next knock is as it.
-    k.spoke = !(!isSilence(r) && !isWord(r) && 'quo' in r && r.quo !== 'threw');
-    if (isSilence(r) || isWord(r)) return r;
-    if ('silence' in r) return silence;
-    if ('quo' in r) return word(r.quo);
-    bind.answered[name] = true;
-    return r.object;
+    if (honoured(r)) k.spoke = true;
+    if (answered(r)) bind.answered[name] = true;
+    inside.wrote();
+    return r.answer;
   };
 
   // The id she took this relation under, if she took it. One relation is one
@@ -172,7 +209,7 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
       // standing's keys and its count. A second lane here would speak for the
       // same relation, and the two would refuse each other.
       const id = takenAs(nameOf(inv));
-      if (id !== undefined) return bounded(wanted, (live) => lane(`ask:${id}`, () => (live() ? asking(id, bind.standings[id], cells.standings[id], method, args, wanted) : Promise.resolve(word('late')))));
+      if (id !== undefined) return standingAt(id).ask(method, args, wanted);
       return bounded(wanted, (live) => lane(`knock:${nameOf(inv)}`, () => (live() ? knocking(inv, method, args, wanted) : Promise.resolve(word('late')))));
     },
     // Take consumes. Until now the relation lived in the knock record, under
@@ -206,12 +243,14 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
         put(cells.standings, id, { id, digest: null, blueprint: null, seen: null });
         delete bind.knocks[name];
         delete bind.answered[name];
+        inside.wrote();
         return Promise.resolve(id);
       });
     },
     remove: (id: string): void => {
       drop(cells.standings, id);
       drop(bind.standings, id);
+      inside.wrote();
     },
   };
 
@@ -228,13 +267,18 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
     },
   });
 
+  // The record an ask writes into is the one it was issued on. A standing
+  // dropped and re-taken under the same id while the ask was in flight is
+  // another relation, and the blueprint that came back is not hers.
   const asking = async (id: string, keys: StandingKeys, rec: Cells['standings'][string] | undefined, method: string | undefined, args: JsonObject, wanted: Wanted | undefined): Promise<Answer> => {
     const out = await send(keys, method, args, wanted, rec);
     if (method === undefined && !isSilence(out) && !isWord(out)) {
-      const here = at(cells.standings, id);
-      if (here) {
-        here.blueprint = out as never;
-        here.digest = here.seen = await digest(out);
+      // A blueprint her cells cannot keep, nested past the bound or carrying
+      // a key no harbor writes, is not Quo's bytes: silence, and nothing written.
+      if (cellFault(out, 'blueprint') !== null) return silence;
+      if (rec && at(cells.standings, id) === rec) {
+        rec.blueprint = out as never;
+        rec.digest = rec.seen = await digest(out);
       }
     }
     return out;
@@ -251,19 +295,43 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
     cells,
     // A being may make. The ward refuses what it refuses the owner: a key
     // already booted, a class the harbor does not hold, and a throw at birth
-    // leaves the partition as it was. Reaching into the being made is not
-    // offered here: that is the owner's, and she has no relation to her
-    // until one is invited and taken like any other.
-    boot: (className: string, key: string): string | null => inside.instantiate(key, className),
+    // leaves the partition as it was. Reaching into another is still the
+    // owner's alone: what a maker may have is a relation to what she made,
+    // by naming an id, and it is made the way every relation is. The being
+    // made mints an occupant for her maker under the maker's own key, so she
+    // knows who made her by that name and by nothing else; her maker knocks,
+    // takes it under the id she gave, and holds one standing like any other.
+    // Nothing half-lives: a relation that could not be made unmakes the
+    // being, who is a moment old and known to nobody.
+    boot: async (className: string, made: string, id?: string): Promise<string | null> => {
+      if (id !== undefined && (reserved(id) || at(cells.standings, id) || at(cells.occupants, id))) return null;
+      const born = inside.instantiate(made, className);
+      if (born === null || id === undefined) return born;
+      const inv = await inside.relate(born, key);
+      if (inv) {
+        const out = await calls.knock(inv);
+        if (!isSilence(out) && !isWord(out) && (await calls.take(id, inv)) === id) return born;
+      }
+      inside.unmake(born);
+      return null;
+    },
     occupants: {
       // rotation one: the ward mints the occupant's first key and gives the secret away.
       // it keeps the pk beside the id and nothing else. the invitation IS the key.
-      invite: async (id: string): Promise<Invitation | null> => {
+      invite: async (id: string, notes?: JsonObject): Promise<Invitation | null> => {
         if (reserved(id) || at(cells.occupants, id) || at(cells.standings, id)) return null;
-        put(cells.occupants, id, { id, notes: {} });
+        // The key first, and nothing written until it exists: a record put
+        // before the mint would be a record a remove in the meantime drops
+        // with no heir to close, and the heir opened after it would name an
+        // id nobody holds, for a later invite under that id to resurrect.
         const k = await inside.mintKey(bind);
+        if (reserved(id) || at(cells.occupants, id) || at(cells.standings, id)) return null; // taken while the key was minted
+        // The notes are the terms the inviter minted under, hers to read on her
+        // gate. She may write more later; nobody outside ever writes them.
+        put(cells.occupants, id, { id, notes: notes ? { ...notes } : {} });
         inside.openHeir(k.pk, key, id);
         put(bind.occupants, id, k.pk);
+        inside.wrote();
         return { ward: inside.pk, heir: k.pk, secret: k.seed };
       },
       remove: (id: string): void => {
@@ -271,6 +339,7 @@ export function buildStance(inside: Inside, key: string, cells: Cells, bind: Bin
         const heir = at(bind.occupants, id);
         drop(bind.occupants, id);
         if (heir) inside.closeHeir(heir); // the heir dies with the id
+        inside.wrote();
       },
     },
     standings,

package/src/ward/ward.ts

@@ -16,9 +16,11 @@ import { ownerAnswer } from './owner.ts';
 import { allow, within, LATE } from './allowance.ts';
 import { beingKey, openReply, sealAsk, wardKey, wardPadlock, wardSignPk, type ReplyPayload, type WardKey } from './seal.ts';
 import { unhex } from './arithmetic.ts';
-import { guardCells, cellFault } from './cells.ts';
+import { guardCells, unguarded, cellFault } from './cells.ts';
 
-type Booted = Door & { bind: Bind; stance: Stance; cells: Cells & { class?: string } };
+// One being of the ward as the ward holds her: her door, her bind table, her
+// stance and her cells. The owner's asks see this and nothing more.
+export type Booted = Door & { bind: Bind; stance: Stance; cells: Cells & { class?: string } };
 
 // How many minted pks she keeps behind her. Enough to name the keys in play.
 const MINTED = 8;
@@ -47,23 +49,24 @@ class Self implements BeingLike {
     this.g = ground;
     this.key = key;
     this.pk = key.pk;
-    this.p = open(ground.memory); // the partition IS the ward's cells
-    this.heirs = new Heirs(this.p);
+    this.p = open(ground.memory); // the partition: the ward's own state, and every being's row
+    this.heirs = new Heirs(this.p, () => this.#wrote());
     this.door = makeDoor(key, this.heirs, this.doors, () => this.p.public, (n) => ground.random(n)); // pointer one
     this.#boot(this.pk, this); // the ward's ward is itself
     // a restart is silent: every being in the cells is constructed again, unasked.
-    // A throw on a boot the owner asked for is that boot's answer: silence,
-    // and nothing half-lives. This boot nobody asked for, and there is nobody
-    // to hand a silence to. Any constructor may throw — a default that is not
-    // a value, an author's mistake, a shape she no longer recognises after an
-    // upgrade — and let through here it is one being taking down the ward and
-    // every other being in it, on a restart. She is absent instead: no door,
-    // so silence at the door, and her cells sit untouched, waiting for the
-    // run that can read them.
+    // A throw on a boot the owner asked for is that boot's error, and nothing
+    // half-lives. This boot nobody asked for, and there is nobody to hand an
+    // error to. Any constructor may throw, a default that is not a value, an
+    // author's mistake, a shape she does not recognise after an upgrade, and
+    // let through here it is one being taking down the ward and every other
+    // being in it, on a restart. She is absent instead: no door, so silence
+    // at the door, and her cells sit untouched, waiting for the run that can
+    // read them. Her row stays hers: nobody boots another class over it, the
+    // owner sees her as absent, and the owner may unboot her.
     for (const [k, c] of Object.entries(this.p.beings)) {
       if (k === this.pk || !c.class) continue;
       try {
-        this.#instantiate(k, c.class);
+        this.#boot(k, c.class);
       } catch {
         /* she is not here this run. the ward is, and so is everyone else. */
       }
@@ -89,10 +92,14 @@ class Self implements BeingLike {
       {
         pk: this.pk,
         doors: this.doors,
+        absent: () => this.#absent(),
         publicKey: () => this.p.public,
         instantiate: (key, className) => this.#instantiate(key, className),
         unboot: (key) => this.#unboot(key),
-        setPublic: (key) => void (this.p.public = key),
+        setPublic: (key) => {
+          this.p.public = key;
+          this.#wrote();
+        },
       },
       asker,
       method,
@@ -101,11 +108,37 @@ class Self implements BeingLike {
   }
 
   // ---- ward functions. on the object. no stance reaches them.
-  #instantiate(key: string, className: string): Booted | null {
-    if (!key || this.doors.has(key)) return null;
-    const door = this.#boot(key, className);
+
+  // The partition was written. The harbor is told, and nothing more: what it
+  // does with the word is its own, and the ward never learns.
+  #wrote(): void {
+    this.g.wrote?.();
+  }
+
+  // The rows no door holds this run: beings whose class threw at birth or
+  // is not the harbor's to give. Key to class.
+  #absent(): Record<string, string | null> {
+    const out: Record<string, string | null> = {};
+    for (const [k, c] of Object.entries(this.p.beings)) if (k !== this.pk && !this.doors.has(k)) put(out, k, c.class ?? null);
+    return out;
+  }
+
+  // A new being under a key nobody holds. A key with a row in the partition
+  // is booted, whether a door holds it this run or not: an absent being's
+  // row is hers, with every relation in it, and no class is booted over it.
+  // A throw at birth is that boot's refusal and nothing half-lives; the
+  // ward says which, since the owner hears objects.
+  #instantiate(key: string, className: string): Booted | 'threw' | null {
+    if (typeof key !== 'string' || typeof className !== 'string' || !key || this.doors.has(key) || at(this.p.beings, key)) return null;
+    let door: Booted | null;
+    try {
+      door = this.#boot(key, className);
+    } catch {
+      return 'threw';
+    }
     if (!door) return null;
-    door.cells.class = className; // so a restart finds her
+    unguarded(door.cells).class = className; // so a restart finds her. the ward's key, written behind her guard
+    this.#wrote();
     return door;
   }
 
@@ -115,20 +148,30 @@ class Self implements BeingLike {
   // rather than meeting a being who is simply not there any more. What is
   // left after that is her cells and her bind table, and they go with her:
   // a row naming a being no door holds would be read on the next restart
-  // and boot her again.
+  // and boot her again. An absent being leaves the same way: she has no
+  // stance to speak for her, so the ward closes her heirs itself.
   #unboot(key: string): string[] | null {
+    if (key === this.pk) return null;
     const door = this.doors.get(key);
-    if (!door || key === this.pk) return null;
-    const occupants = Object.keys(door.cells.occupants),
-      standings = Object.keys(door.cells.standings);
-    for (const id of occupants) door.stance.occupants.remove(id);
-    for (const id of standings) door.stance.standings.remove(id);
+    const cells = door?.cells ?? at(this.p.beings, key);
+    if (!cells) return null;
+    const ids = (r: unknown) => (r !== null && typeof r === 'object' ? Object.keys(r) : []);
+    const occupants = ids(cells.occupants),
+      standings = ids(cells.standings);
+    if (door) {
+      for (const id of occupants) door.stance.occupants.remove(id);
+      for (const id of standings) door.stance.standings.remove(id);
+    } else {
+      const bind = at(this.p.bind, key);
+      for (const heir of Object.values(bind?.occupants ?? {})) this.heirs.close(heir);
+    }
     // A ward whose public being is gone answers arrivals for no heir with
     // silence, as a ward that never had one does.
     if (this.p.public === key) this.p.public = null;
     drop(this.p.beings, key);
     drop(this.p.bind, key);
     this.doors.delete(key);
+    this.#wrote();
     return [...occupants, ...standings];
   }
 
@@ -136,7 +179,7 @@ class Self implements BeingLike {
   // harbor does not know makes no being, and a boot that made nobody must
   // leave the partition as it found it.
   #boot(key: string, classNameOrSelf: string | Self): Booted | null {
-    const cells = guardCells(at(this.p.beings, key) ?? emptyCells());
+    const cells = guardCells(at(this.p.beings, key) ?? emptyCells(), () => this.#wrote());
     const bind = at(this.p.bind, key) ?? emptyBind();
     const stance = buildStance(
       {
@@ -148,23 +191,27 @@ class Self implements BeingLike {
         // A throw at birth is null to her, not a throw in her method: she asked
         // for a being and got none, and her own answer is still hers to give.
         instantiate: (k, className) => {
-          try {
-            return this.#instantiate(k, className)?.key ?? null;
-          } catch {
-            return null;
-          }
+          const made = this.#instantiate(k, className);
+          return made && made !== 'threw' ? made.key : null;
         },
+        // The two halves of a maker's way back, each the ward's own call: the
+        // being made mints an occupant for her maker, and a relation that
+        // never came about takes her out again.
+        relate: async (k, id) => (await this.doors.get(k)?.stance.occupants.invite(id)) ?? null,
+        unmake: (k) => void this.#unboot(k),
+        wrote: () => this.#wrote(),
       },
       key,
       cells,
       bind,
     );
     const being = classNameOrSelf === this ? this : this.g.instantiate(classNameOrSelf as string, stance);
-    if (!being) return null;
+    if (!being || typeof being.answer !== 'function') return null; // a being is anything with an answer, and nothing without one
     put(this.p.beings, key, cells);
     put(this.p.bind, key, bind);
     const door: Booted = { key, cells, bind, stance, being };
     this.doors.set(key, door);
+    this.#wrote();
     return door;
   }
 
@@ -176,6 +223,7 @@ class Self implements BeingLike {
     // but the keys of the moment.
     bind.minted.push(k.pk);
     if (bind.minted.length > MINTED) bind.minted.splice(0, bind.minted.length - MINTED);
+    this.#wrote();
     return k;
   }
 
@@ -202,10 +250,12 @@ class Self implements BeingLike {
     // Args that will not go through the seal are args that never left. A
     // being holds three answers and a throw is not one of them, so an ask
     // that cannot be sealed is told what is true of it: no door was reached.
-    // Values only, by the same rule her cells keep: a Date would arrive as a
-    // string, a function would not arrive at all, and she would never know
-    // the far being was asked something other than what she said.
-    if (cellFault(args, 'args') !== null) return unreached();
+    // One object of values, by the rule her cells keep and the far door
+    // reads: a Date would arrive as a string, a function would not arrive at
+    // all, a list or a string would be refused as a stranger's bytes, and
+    // she would never know the far being was asked something other than
+    // what she said.
+    if (args === null || typeof args !== 'object' || Array.isArray(args) || cellFault(args, 'args') !== null) return unreached();
     let sealed;
     try {
       sealed = await sealAsk(keys.heir, { by, next, seq, time: budget.time, method, args }, unhex(keys.current), wardPadlock(keys.ward), this.g.random(32));
@@ -237,6 +287,7 @@ class Self implements BeingLike {
       keys.current = keys.next; // the far door holds `next` as announced. move to it.
       keys.next = null;
     }
+    this.#wrote(); // the count moved, and the keys may have
     return reply;
   }
 }

package/vectors/arithmetic.json

@@ -65,6 +65,13 @@
       "signature": "60aa62f7129c8fdeba710872fa10016dae1aa12df0f31969a6baabf60b2ebc3d0822cc9a8b1eb12246076b2eea69d381a03c2f581c05ba6bcca3b4ba80c2f504",
       "refuses": true
     },
+    {
+      "name": "a zero signature under a non-canonical small-order public key, y equal to p, is silence",
+      "voice": "edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
+      "message": "62792077686f736520617574686f72697479",
+      "signature": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "refuses": true
+    },
     {
       "name": "an X25519 agreement",
       "secret": "fcfabee71b7a33993cca5579e6a273ffd1c62cc1749cbf1c9049f599e44f6477",

package/vectors/framing.json

@@ -2,7 +2,7 @@
   "corpus": "@quo-systems/quo",
   "encoding": "hex",
   "area": "framing",
-  "note": "The formats a second kit must reproduce byte for byte: the ward pk, the digest, the signed ask body, the sealed ask, the sealed reply, the invitation and the knock. Every random input is fixed here, so every output is fixed. The ask body is JSON.stringify of the payload, which is not canonical: these vectors pin the key order sealAsk writes, to, by, next, seq, time, method, args; hops is in no vector, because nothing sets it. A kit that emits another order still interoperates, because a door verifies the bytes it received, but it will not reproduce these vectors. An invitation is JSON too, ward, heir, secret, and a heir secret is the seed of a being key. A knock is an ask whose by is the heir pk, signed with the heir secret, whose next is the knocker's own key, and whose to is the heir; its answer is an ordinary reply, and the heir is spent by it. A reply is one of three shapes: an object with its digest, silence, or the ward's word to a key the door has bound, { quo: word }, where word is one of removed, absent, unannounced, repeated, threw. The ward here is the one from the ward pk vector, and the heir secret is the first entropy it draws, so the invitation it mints and the knock its door binds are these bytes.",
+  "note": "The formats a second kit must reproduce byte for byte: the ward pk, the digest, the signed ask body, the sealed ask, the sealed reply, the invitation and the knock. Every random input is fixed here, so every output is fixed. The ask body is JSON.stringify of the payload with the heir it is for in front, which is not canonical: these vectors pin the key order sealAsk writes, to, by, next, seq, time, method, args, and to is signed with the rest, null for nobody; hops is in no vector, because nothing sets it. The two signed bodies are the bytes inside the two sealed asks. A kit that emits another order still interoperates, because a door verifies the bytes it received, but it will not reproduce these vectors. An invitation is JSON too, ward, heir, secret, and a heir secret is the seed of a being key. A knock is an ask whose by is the heir pk, signed with the heir secret, whose next is the knocker's own key, and whose to is the heir; its answer is an ordinary reply, and the heir is spent by it. A reply is one of three shapes: an object with its digest, silence, or the ward's word to a key the door has bound, { quo: word }, where word is one of removed, absent, unannounced, repeated, threw. The ward here is the one from the ward pk vector, and the heir secret is the first entropy it draws, so the invitation it mints and the knock its door binds are these bytes.",
   "vectors": [
     {
       "name": "a ward pk from a fixed seed",
@@ -23,11 +23,20 @@
       "digest": "269c9e90f39f6fcae9deab916e3a4148788dec5ba0d06023edc8e52180c773db"
     },
     {
-      "name": "the signed ask body, and its signature",
-      "payload": "{\"by\":\"a09aa5f47a6759802ff955f8dc2d2a14a5c99d23be97f864127ff9383455a4f0\",\"next\":null,\"seq\":1,\"time\":30000,\"method\":\"hello\",\"args\":{\"name\":\"quo\"}}",
-      "body": "7b226279223a2261303961613566343761363735393830326666393535663864633264326131346135633939643233626539376638363431323766663933383334353561346630222c226e657874223a6e756c6c2c22736571223a312c2274696d65223a33303030302c226d6574686f64223a2268656c6c6f222c2261726773223a7b226e616d65223a2271756f227d7d",
+      "name": "the signed ask body for nobody, and its signature: to is inside, first",
+      "to": "",
+      "payload": "{\"to\":null,\"by\":\"a09aa5f47a6759802ff955f8dc2d2a14a5c99d23be97f864127ff9383455a4f0\",\"next\":null,\"seq\":1,\"time\":30000,\"method\":\"hello\",\"args\":{\"name\":\"quo\"}}",
+      "body": "7b22746f223a6e756c6c2c226279223a2261303961613566343761363735393830326666393535663864633264326131346135633939643233626539376638363431323766663933383334353561346630222c226e657874223a6e756c6c2c22736571223a312c2274696d65223a33303030302c226d6574686f64223a2268656c6c6f222c2261726773223a7b226e616d65223a2271756f227d7d",
+      "secret": "2222222222222222222222222222222222222222222222222222222222222222",
+      "signature": "535c50354632d607fc5b68d081a0191ebf85c296b6c7e67b7b0dcc6030d569673dfe35f164b6b2eb3558c4454c32aabc5586bd82e305401a82fda7a166b91906"
+    },
+    {
+      "name": "the signed ask body to a heir, and its signature: the same payload, to named",
+      "to": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "payload": "{\"to\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"by\":\"a09aa5f47a6759802ff955f8dc2d2a14a5c99d23be97f864127ff9383455a4f0\",\"next\":null,\"seq\":1,\"time\":30000,\"method\":\"hello\",\"args\":{\"name\":\"quo\"}}",
+      "body": "7b22746f223a2261616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161222c226279223a2261303961613566343761363735393830326666393535663864633264326131346135633939643233626539376638363431323766663933383334353561346630222c226e657874223a6e756c6c2c22736571223a312c2274696d65223a33303030302c226d6574686f64223a2268656c6c6f222c2261726773223a7b226e616d65223a2271756f227d7d",
       "secret": "2222222222222222222222222222222222222222222222222222222222222222",
-      "signature": "21fae42dc81de4a1983ac9dd457338043e3e69ba76331cb5616f3106e007de228fee0f19c49035b90789799667bc7de4d4212618790b2b449e5a26c299134c0b"
+      "signature": "1f0e63f365dd09bff2c070091ea209d14eefec1026bf210dba87a4a18135fd90107c9879177695f0b4a899e67777b75d6001229e0875657cfc9a2cd197880500"
     },
     {
       "name": "a sealed ask to a heir: the ephemeral pk, then the box, and nothing outside it",