@quo-systems/quo 0.2.9 → 0.2.11

package/src/conformance/beings.ts

@@ -1,9 +1,11 @@
 // SPDX-License-Identifier: Apache-2.0
 // The fixture beings. Fixed, so that the ward is what varies. A printer, a
-// shop, a customer on the base class, and one raw being with no base at all.
+// shop, a customer on the base class, a maker, a member, and one raw being
+// with no base at all.
 import { Being } from '../being/being.ts';
-import { isSilence, isUnreached, isWord } from '../being/silence.ts';
-import type { Asker, Blueprint, Invitation, JsonObject, OccupantRecord, Reply, Stance } from '../being/types.ts';
+import { answered, isUnreached } from '../being/silence.ts';
+import { invitationArgs } from '../being/types.ts';
+import type { Ask, Asker, Blueprint, Invitation, Json, JsonObject, OccupantRecord, Reply, Stance } from '../being/types.ts';
 
 // A printer. Invites whom she is told to, prints for her occupants. Her
 // blueprint lives in her cells so a test can change her shape.
@@ -11,7 +13,9 @@ export class Printer extends Being {
   static override cells = { jobs: [] as JsonObject[], asks: [{ name: 'print', input: { type: 'object' } }] as JsonObject[] };
   static override asks = { print: { input: { type: 'object' } } };
   override describe(): Blueprint {
-    return { asks: this.cells.asks as never, notes: { model: 'LX-2' } };
+    // Her own cells, which a test writes to change her shape. Cells are Json
+    // to the ward, so the asks are named for what she keeps in them.
+    return { asks: this.cells.asks as Ask[], notes: { model: 'LX-2' } };
   }
   print({ doc }: JsonObject, asker: Asker) {
     (this.cells.jobs as JsonObject[]).push({ by: asker.id ?? null, doc: doc ?? null });
@@ -46,7 +50,7 @@ export class Shop extends Being {
 
   async keepPrinter(invitation: Invitation): Promise<boolean> {
     const bp = await this.knock(invitation);
-    if (isSilence(bp) || isWord(bp)) return false;
+    if (!answered(bp)) return false;
     this.cells.printerId = await this.take('prn', invitation);
     return true;
   }
@@ -55,7 +59,7 @@ export class Shop extends Being {
     const rec = this.occupant(asker);
     if (rec?.notes.tier === 'gold' && invitation) {
       const back = await this.knock(invitation as Invitation, 'hi');
-      if (!isSilence(back) && !isWord(back)) await this.take(`vip-${asker.id}`, invitation as Invitation);
+      if (answered(back)) await this.take(`vip-${asker.id}`, invitation as Invitation);
     }
     return { welcome: true };
   }
@@ -67,7 +71,7 @@ export class Shop extends Being {
     if (!printer) return { error: 'no printer' };
     const out = await printer.ask('print', { doc: `receipt for ${item}` });
     if (isUnreached(out)) return { error: 'printer unreachable', retry: true };
-    if (isSilence(out) || isWord(out)) return { error: 'printer refused' };
+    if (!answered(out)) return { error: 'printer refused' };
     const st = this.cells.standings[id!];
     if (st.seen !== st.digest) this.occupant(asker)!.notes.printerChanged = true;
     (this.cells.sales as JsonObject[]).push({ item: item ?? null, by: asker.id ?? null });
@@ -86,9 +90,13 @@ export class Customer extends Being {
   static override asks = { hi: { input: { type: 'object' } } };
 
   async join(invitation: Invitation) {
-    const mine = (await this.invite('shop-back'))!;
-    const out = await this.knock(invitation, 'hello', { invitation: mine as never });
-    if (isSilence(out) || isWord(out)) return out; // nothing was born
+    // A way back for the shop, if she can mint one. She may not: two joins on
+    // one invitation race, and the second finds the id taken. Then she offers
+    // nothing and knocks all the same, which is what the shop is asked to
+    // survive. The old shape said `!` here and was wrong about it.
+    const mine = await this.invite('shop-back');
+    const out = await this.knock(invitation, 'hello', { invitation: mine === null ? null : invitationArgs(mine) });
+    if (!answered(out)) return out; // nothing was born
     await this.take('shop', invitation); // now, and only now
     return out;
   }
@@ -119,6 +127,29 @@ export class Echo {
 // A member of an estate. Nothing scripted: she invites whom she is told to,
 // knocks where she is told to, and answers `ping` with the asker's own name.
 // The estate chapter drives her, and what it drives is the graph, not her.
+// A being who makes beings. `boot` is on every stance, so it is the ward's
+// promise and not this kit's, and a second kit that never wired it hands its
+// beings a call that answers null for ever. She says what came of it: the key
+// back, or null for a key already taken, a class the harbor does not hold, or
+// a constructor that threw. With an id she also asks for a way back, and then
+// she holds a standing to what she made like any other.
+export class Maker extends Being {
+  static override cells = { made: [] as string[] };
+  static override asks = {
+    open: { input: { type: 'object', properties: { class: { type: 'string' }, key: { type: 'string' }, id: { type: 'string' } }, required: ['class', 'key'] } },
+    say: { input: { type: 'object', properties: { id: { type: 'string' } }, required: ['id'] } },
+  };
+  async open({ class: className, key, id }: JsonObject) {
+    const made = await this.boot(className as string, key as string, id as string | undefined);
+    if (made !== null) (this.cells.made as string[]).push(made);
+    return { made };
+  }
+  async say({ id }: JsonObject) {
+    const standing = this.standings[id as string];
+    return { said: standing === undefined ? null : ((await standing.ask('ping')) as Json) };
+  }
+}
+
 export class Member extends Being {
   static override cells = { heard: [] as JsonObject[] };
   static override asks = { ping: { input: { type: 'object' } } };

package/src/conformance/estate.ts

@@ -22,7 +22,7 @@
 // harbors, and that is where the promise of Quo is held: a being never learns
 // where the other one is, so every answer, after every move, under every
 // topology, is the answer the model wrote without knowing the topology
-// either. Held forty times a run, it is the promise at a scale a scene
+// either. Held after every one of sixty moves, it is the promise at a scale a scene
 // cannot reach, and it is what makes a migration honest: if no answer can
 // tell the topology apart, moving a ward between harbors cannot be felt.
 // The model itself is the script's own bookkeeping and takes nothing from a
@@ -35,13 +35,13 @@
 // A model that kept one symmetric edge would be a wrong model, and would
 // agree happily with a ward that had drifted.
 import { assert } from './assert.ts';
-import { isSilence, isUnreached, isWord, wordOf } from '../being/silence.ts';
+import { isSilence, isUnreached, told } from '../being/silence.ts';
 import type { Invitation } from '../being/types.ts';
 import { Member } from './beings.ts';
+import { HEX64 } from './index.ts';
 import type { Census, Handle, Runner, World } from './index.ts';
 
-const HEX64 = /^[0-9a-f]{64}$/;
-const said = (x: unknown, w: string): boolean => isWord(x) && wordOf(x) === w;
+const said = (x: unknown, w: string): boolean => told(x) === w;
 
 // One occupant arc, as the host holds it. `guest` is null until somebody
 // knocks; `live` goes false when she is kicked. Both are the host's business
@@ -67,10 +67,47 @@ const rolls = (seed: number) => () => {
 // Held after every move. Each line is a way the bookkeeping could stop being
 // a graph: an arc with one end, an arc with two owners, a relation filed in
 // two places at once, a count that went backwards, a secret in the cells.
-function ledger(c: Census, before: Census | undefined, where: string) {
+function ledger(c: Census, before: Census | undefined, where: string, g?: Graph) {
   const at = (why: string) => `${where}: ${why}`;
   const heirsSeen = new Set<string>();
 
+  // What the model knows, which the ward's own bookkeeping cannot tell it.
+  // Without this the ledger only checks the ward against itself, and a drift
+  // is caught late, if the sweep happens to ask the affected arc, or never.
+  if (g) {
+    for (const s of g.seats) {
+      const heir = c.wards[c.binds[s.host]!.ward]!.heirs[s.inv.heir!];
+      if (!s.live) {
+        assert.ok(!heir, at(`${s.host} kicked ${s.id} and the heir is still held`));
+        assert.ok(!(s.id in c.binds[s.host]!.occupants), at(`${s.host} kicked ${s.id} and still holds the occupant`));
+        continue;
+      }
+      assert.ok(heir, at(`${s.host}'s live seat ${s.id} has no heir`));
+      assert.equal(heir!.id, s.id, at(`the heir for ${s.host}/${s.id} is filed under ${heir!.id}`));
+      // A seat nobody has knocked is a heir that has never spoken: fresh, and
+      // at zero. One that answered has spoken, so it is neither.
+      assert.equal(heir!.fresh, !s.answered, at(`${s.host}/${s.id} is ${s.answered ? 'answered' : 'unknocked'} and its heir says fresh=${heir!.fresh}`));
+      assert.equal(heir!.mark === 0, !s.answered, at(`${s.host}/${s.id} is ${s.answered ? 'answered' : 'unknocked'} and its heir is at ${heir!.mark}`));
+    }
+    for (const h of g.holds) {
+      const standing = c.binds[h.owner]!.standings[h.id];
+      if (!h.live) {
+        assert.ok(!standing, at(`${h.owner} dropped ${h.id} and the standing is still there`));
+        continue;
+      }
+      assert.ok(standing, at(`${h.owner}'s live standing ${h.id} is gone from the bind table`));
+      assert.equal(standing!.heir, h.seat.inv.heir, at(`${h.owner}/${h.id} names a heir that is not the seat it was born on`));
+      // The count she has spent, against the number the far door honoured.
+      // Her side is never behind: she takes a number, then it crosses.
+      const far = c.wards[c.binds[h.seat.host]!.ward]!.heirs[h.seat.inv.heir!];
+      if (far) assert.ok(standing!.seq >= far.mark, at(`${h.owner}/${h.id} counted ${standing!.seq} and the far door has honoured ${far.mark}`));
+    }
+    // Every seat and hold the model knows about, and no relation the ward
+    // holds that the model never made.
+    const mine = new Set(g.seats.filter((s) => s.live).map((s) => `${s.host}/${s.id}`));
+    for (const [key, b] of Object.entries(c.binds)) for (const id of Object.keys(b.occupants)) assert.ok(mine.has(`${key}/${id}`), at(`${key} holds an occupant ${id} the model never made`));
+  }
+
   for (const [pk, w] of Object.entries(c.wards)) {
     for (const [heir, r] of Object.entries(w.heirs)) {
       assert.ok(!heirsSeen.has(heir), at(`heir ${heir} is held by two wards`));
@@ -175,6 +212,18 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
       const pick = <T>(xs: T[]): T => xs[Math.floor(roll() * xs.length)];
       const hands: Record<string, Handle<Member>> = {};
       const g: Graph = { seats: [], holds: [] };
+      // What this run actually got to. A generated walk protects only the
+      // states it reaches, and a list of assertions nobody ran is a list of
+      // assertions nobody has. Every case named here is checked off as it
+      // fires and the run fails at the end if one never did.
+      const reached = new Set<string>();
+      const MUST = [
+        'a kicked seat knocked by the guest it bound, who hears removed',
+        'a standing dropped by its owner, whose host is never told',
+        'a seat kicked by its host, whose guest is never told',
+        'a relation taken, so it lives in the standing and not the knock',
+        'a ward moved to another harbor under everyone standing on it',
+      ];
       let minted = 0;
       const born = async (key: string) => (hands[key] = await w.boot<Member>(key, Member));
       for (const key of ['M1', 'M2', 'M3']) await born(key);
@@ -203,20 +252,37 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
         // taken it the invitation is not a knock any more -- it joins the
         // standing's lane, and is exactly as alive as the standing is.
         for (const s of g.seats) {
-          out.push(async () => {
+          const knock = async () => {
             const guest = s.guest ?? pick(keys.filter((k) => k !== s.host));
             const hold = g.holds.find((h) => h.seat === s);
             const back = await hands[guest].being.knock(s.inv, 'ping');
-            if (s.live && (s.guest === null || s.guest === guest) && (hold === undefined || hold.live)) {
+            // Whether this knock is heard at all: the seat has no guest yet,
+            // or its guest is this one, and nothing of hers has dropped the
+            // key the door would bind her by. A hold exists only where a
+            // guest does, so the two tests are one condition and not two.
+            // Then the seat says which answer: alive is the pong, kicked is
+            // `removed`, and unheard is silence whichever it is.
+            const speaks = (s.guest === null || s.guest === guest) && (hold === undefined || hold.live);
+            if (!speaks) assert.ok(isSilence(back), `${guest} knocking ${s.host}/${s.id} should be silence`);
+            else if (s.live) {
               assert.deepEqual(back, { pong: s.id }, `${guest} knocking ${s.host}/${s.id}`);
               s.guest = guest;
               s.answered = true;
-            } else if (!s.live && (s.guest === null || (s.guest === guest && (hold === undefined || hold.live)))) {
-              // kicked, and she speaks under a key the door bound for this seat: she hears why
+            } else {
               assert.ok(said(back, 'removed'), `${guest} knocking kicked ${s.host}/${s.id} should hear removed`);
-            } else assert.ok(isSilence(back), `${guest} knocking ${s.host}/${s.id} should be silence`);
+              reached.add('a kicked seat knocked by the guest it bound, who hears removed');
+            }
             return `${guest} knocks ${s.host}/${s.id}`;
-          });
+          };
+          out.push(knock);
+          // Weighted, not written twice: the case this move exists to protect
+          // is a seat kicked after it answered and before it was taken, and a
+          // uniform walk over a list that grows with every invitation reaches
+          // it by luck if at all. Three entries make it likely by
+          // construction, and the count at the end of the run makes it
+          // certain: a walk that never got there fails rather than passing
+          // quietly on an assertion that never ran.
+          if (!s.live && s.answered && !s.taken) out.push(knock, knock);
           // a stranger on a spent seat: silence, and nothing rebinds
           if (s.guest !== null)
             out.push(async () => {
@@ -236,6 +302,7 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
             assert.equal(await hands[s.guest!].being.take(id, s.inv), id);
             s.taken = true;
             g.holds.push({ owner: s.guest!, id, seat: s, live: true });
+            reached.add('a relation taken, so it lives in the standing and not the knock');
             assert.equal(await hands[s.guest!].being.take(`${id}-again`, s.inv), null); // spent for her
             return `${s.guest} takes ${s.host}/${s.id} as ${id}`;
           });
@@ -245,6 +312,7 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
           out.push(async () => {
             hands[h.owner].being.standings.remove(h.id);
             h.live = false;
+            reached.add('a standing dropped by its owner, whose host is never told');
             assert.equal(hands[h.owner].being.standings[h.id], undefined);
             return `${h.owner} drops ${h.id}`;
           });
@@ -254,6 +322,7 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
           out.push(async () => {
             hands[s.host].being.occupants.remove(s.id);
             s.live = false;
+            reached.add('a seat kicked by its host, whose guest is never told');
             return `${s.host} kicks ${s.id}`;
           });
 
@@ -264,11 +333,10 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
         out.push(async () => {
           const who = pick(keys);
           await w.migrate(who);
+          reached.add('a ward moved to another harbor under everyone standing on it');
           return `${who}'s ward moves harbor`;
         });
 
-        // weather: the host's door is gone. unreached, never silence, and the
-        // relation is exactly where it was when it comes back.
         // weather: the host's door is gone. unreached, never silence, and the
         // relation is exactly where it was when it comes back. The move is on
         // the list under every topology even where there is nothing to cut,
@@ -306,20 +374,39 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
       // sequence debuggable at all.
       const trace: string[] = [];
       const at = (step: number) => `seed ${seed} step ${step}\n  ${trace.join('\n  ')}`;
-      for (let step = 1; step <= 60; step++) {
-        const move = pick(moves());
+      // Whatever fails inside a step carries the trace that got there. One
+      // wrapper, so the move and the sweep are decorated the same way and a
+      // third thing added to a step cannot be decorated a fourth.
+      const inStep = async <T>(step: number, work: () => Promise<T>): Promise<T> => {
         try {
-          trace.push(await move());
+          return await work();
         } catch (e) {
           throw new Error(`${at(step)}\n  -> ${(e as Error).message}`, { cause: e });
         }
+      };
+      for (let step = 1; step <= 60; step++) {
+        const move = pick(moves());
+        // The move that failed goes into the trace before it runs, not after
+        // it returns: a move names itself as it finishes, so a throw left the
+        // trace ending at the last move that worked and saying nothing about
+        // the one that did not. It is written in twice, provisionally and
+        // then as it named itself, and the provisional line goes when the
+        // real one lands.
+        trace.push(`step ${step}: a move that has not said what it did`);
+        const did = await inStep(step, move);
+        trace[trace.length - 1] = did;
         const c = w.census();
-        ledger(c, before, at(step));
+        ledger(c, before, at(step), g);
         before = c;
-        await sweep(step).catch((e: Error) => {
-          throw new Error(`${at(step)}\n  -> ${e.message}`, { cause: e });
-        });
+        await inStep(step, () => sweep(step));
       }
+      // And the walk is held to having gone somewhere. Sixty moves under one
+      // seed is a sample, not a proof, so the states the chapter is written
+      // to protect are named and counted: a run that never reached one has
+      // not tested it, and says so here rather than passing on an assertion
+      // that never ran.
+      const missed = MUST.filter((what) => !reached.has(what));
+      assert.deepEqual(missed, [], `seed ${seed} never reached: ${missed.join('; ')}\n  ${trace.join('\n  ')}`);
     });
   }
 }

package/src/conformance/index.ts

@@ -12,17 +12,17 @@
 //   handle.being                                  the object, as the test drives it
 //   handle.cells                                  her cells, as the ward keeps them
 //   handle.down = true | false                    her door is unreachable (needs canDown)
-//   handle.minted.has(pk)                         every pk her side ever minted
+//   handle.minted.has(pk)                         the last eight pks her side minted
 //   handle.forgeKnock(invitation)                 make her side knock with a key of its own, unannounced
 //   world.census()                                every partition in the world, as values
 //   world.migrate(key)                            her ward moves to another harbor, same seed, same pk
 //
 // Every assertion here is the truth's. Nothing here knows how a ward is built.
 import { assert } from './assert.ts';
-import { silence, isSilence, isUnreached, isWord, wordOf } from '../being/silence.ts';
+import { silence, isSilence, isUnreached, told } from '../being/silence.ts';
 import { digest } from '../being/digest.ts';
-import type { Asker, BeingClass, Cells, Invitation, Json, JsonObject } from '../being/types.ts';
-import { Printer, Shop, Customer, Echo, Member } from './beings.ts';
+import type { Asker, BeingClass, Cells, Invitation, Json, JsonObject, Reply, Stance } from '../being/types.ts';
+import { Printer, Shop, Customer, Echo, Maker, Member } from './beings.ts';
 import { estate } from './estate.ts';
 
 export type Handle<B = unknown> = {
@@ -49,13 +49,26 @@ export type World = {
   heir(inv: Invitation): HeirView | undefined;
   census(): Census;
   migrate(key: string): Promise<void>;
+  // The ask pointer of the ward a being lives behind, which is the owner's
+  // half and the second of the two a ward hands back. The harness already
+  // speaks it -- `boot` is the owner's boot ask -- and it is named here so the
+  // owner's chapter can be run against a second kit rather than only against
+  // this one. `key` says which ward: a being of it, and never the ward's pk,
+  // because a topology may put every being behind a ward of its own.
+  owner(key: string): (method?: string, args?: JsonObject) => Promise<unknown>;
 };
 
-export { Printer, Shop, Customer, Echo, Member };
+export { Printer, Shop, Customer, Echo, Maker, Member };
 
-const HEX64 = /^[0-9a-f]{64}$/;
+// The two shapes the suite asserts, spelled here for the whole folder. They
+// are spelled again in `src/ward/seal.ts`, and that is the point: this suite
+// is what a second kit runs against its own ward, so it states the shapes it
+// expects instead of importing ours, and nothing under `src/conformance`
+// reaches into `src/ward` for anything.
+export const HEX64 = /^[0-9a-f]{64}$/; // one key, one secret, one digest
+export const HEX128 = /^[0-9a-f]{128}$/; // a ward pk: the signing pk then the padlock
 // Her ward's word, as she receives it.
-const said = (x: unknown, w: string): boolean => isWord(x) && wordOf(x) === w;
+const said = (x: unknown, w: string): boolean => told(x) === w;
 
 // The runner is handed in. Node passes `node:test`; a browser and an edge
 // worker pass a shim of their own. The suite is the ward's truth, and the
@@ -84,7 +97,7 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     const inv = await shop.being.invite('gold');
     assert.deepEqual(Object.keys(shop.cells.occupants), ['cust1']);
     assert.deepEqual(Object.keys(inv).sort(), ['heir', 'secret', 'ward']);
-    assert.match(inv.ward, /^[0-9a-f]{128}$/);
+    assert.match(inv.ward, HEX128);
     assert.match(inv.heir!, HEX64);
     assert.match(inv.secret!, HEX64);
     assert.equal(inv.ward, shop.pk);
@@ -195,6 +208,166 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
     assert.deepEqual(Object.keys(alice.cells.standings), ['shop']);
   });
 
+  // ---- the names that are nobody's to take
+  //
+  // Two lists, refused at both ends of the same namespace. The ward speaks
+  // under its own words, so a being who could mint one would be a being whose
+  // ward is indistinguishable from an occupant of hers. And standings are
+  // reached by name, so a relation taken as one of the calls on them would be
+  // a relation nothing can reach. A kit that ported invite without either
+  // list passes every other scene in this file.
+  t('the reserved ids and the calls on standings are refused at invite and at take, and nothing is written for them', async () => {
+    // alice hosts here rather than the shop, because the shop's own `invite`
+    // takes a tier and mints the id itself. This one is the stance's, which
+    // is where the rule lives.
+    const { alice, bob } = await world();
+    for (const id of ['OWNER', 'PUBLIC', 'knock', 'take', 'remove']) {
+      assert.equal(await alice.being.invite(id), null, `${id} is not hers to mint`);
+      assert.equal(Object.hasOwn(alice.cells.occupants, id), false, `and nothing was written for ${id}`);
+
+      // The other end: a guest is answered and then refused the name.
+      const inv = (await alice.being.invite(`for-${id}`))!;
+      assert.deepEqual(await bob.being.knock(inv, 'hi'), { heard: 'hi' }, `the knock for ${id} was answered`);
+      assert.equal(await bob.being.take(id, inv), null, `take refuses ${id} for the same reason`);
+      assert.equal(Object.hasOwn(bob.cells.standings, id), false, `and nothing was written for ${id}`);
+      assert.equal(await bob.being.take(`as-${id}`, inv), `as-${id}`, 'and an ordinary id takes the same invitation');
+    }
+    // And the three calls are still the calls, not records that shadowed them.
+    for (const call of ['knock', 'take', 'remove']) assert.equal(typeof (bob.being.standings as unknown as Record<string, unknown>)[call], 'function', `standings.${call} is the call`);
+  });
+
+  // ---- the owner
+  //
+  // The second pointer a ward hands back. Every ask below answers an object,
+  // because the owner hears objects and never a word: a refusal is `{ error }`
+  // with its reason, which is what a side renders.
+  t('the owner boots, marks one public being, invites, knocks, removes and unboots, and refuses each in an object', async () => {
+    const { w, shop, alice } = await world();
+    const ask = w.owner('S');
+    const bp = (await ask()) as { asks: { name: string; description?: string; input?: JsonObject }[]; notes: { pk: string; beings: JsonObject } };
+    assert.deepEqual(bp.asks.map((a) => a.name), ['boot', 'public', 'invite', 'knock', 'remove', 'unboot'], 'six asks, in this order');
+    for (const a of bp.asks) {
+      assert.equal(typeof a.description, 'string', `${a.name} says what it is for`);
+      assert.equal((a.input as { type: string }).type, 'object', `${a.name} takes one object`);
+    }
+    assert.match(bp.notes.pk as string, HEX128);
+    assert.equal(typeof bp.notes.beings, 'object');
+    assert.deepEqual(await ask('nosuch'), { error: 'unknown ask' });
+
+    // boot: a key already taken is refused, and so is a class nobody holds.
+    assert.deepEqual(await ask('boot', { key: 'S', class: 'Shop' }), { error: 'no such class, or key taken' });
+    assert.deepEqual(await ask('boot', { key: 'fresh', class: 'NoSuchClass' }), { error: 'no such class, or key taken' });
+    assert.deepEqual(await ask('boot', { key: 42, class: 'Shop' }), { error: 'no such class, or key taken' }, 'a name is a string or it is nothing');
+
+    // public: one per ward, null takes the mark off, and the ward is nobody's
+    // public being.
+    assert.deepEqual(await ask('public', { key: 'nobody' }), { error: 'no such being' });
+    assert.deepEqual(await ask('public', { key: bp.notes.pk }), { error: 'no such being' }, 'the ward is a being to nobody outside');
+
+    // invite and remove, on a being of the ward, by id.
+    assert.deepEqual(await ask('invite', { being: 'nobody', id: 'x' }), { error: 'no such being' });
+    const inv = (await ask('invite', { being: 'S', id: 'by-owner', notes: { tier: 'gold' } })) as Invitation;
+    assert.match(inv.heir!, HEX64);
+    assert.deepEqual((shop.cells.occupants as Record<string, { notes: JsonObject }>)['by-owner'].notes, { tier: 'gold' }, 'the notes she minted under are hers to read');
+    assert.deepEqual(await ask('remove', { being: 'S', id: 'nothing-of-hers' }), { error: 'nothing to remove' });
+    assert.deepEqual(await ask('remove', { being: 'S', id: 'by-owner' }), { removed: 'by-owner' });
+    assert.equal(Object.hasOwn(shop.cells.occupants, 'by-owner'), false);
+
+    // knock: the owner knocks for a being of hers and takes the standing.
+    const forA = (await ask('invite', { being: 'S', id: 'for-alice' })) as Invitation;
+    const knocked = (await w.owner('A'))('knock', { being: 'A', id: 'via-owner', invitation: forA, method: 'hello' });
+    assert.deepEqual(await knocked, { taken: 'via-owner', answer: { welcome: true } });
+    assert.deepEqual(Object.keys(alice.cells.standings), ['via-owner']);
+    assert.deepEqual(await alice.being.standings['via-owner']!.ask('hello'), { welcome: true }, 'and it is an ordinary standing');
+
+    // unboot: the inverse of boot, and the ward refuses itself.
+    assert.deepEqual(await ask('unboot', { being: bp.notes.pk }), { error: 'no such being' });
+    assert.deepEqual(await ask('unboot', { being: 'nobody' }), { error: 'no such being' });
+    const gone = (await ask('unboot', { being: 'S' })) as { unbooted: string; removed: string[] };
+    assert.equal(gone.unbooted, 'S');
+    assert.ok(gone.removed.includes('for-alice'), 'her relations went with her, and the owner is told which');
+    assert.ok(said(await alice.being.standings['via-owner']!.ask('hello'), 'removed'), 'and her occupant hears removed at the door');
+  });
+
+  // The one public being, marked and unmarked through the owner. A second
+  // one would leave the first holding every relation she had, reachable by
+  // nobody at the bare pk and told by nobody that she had been replaced.
+  t('a ward has one public being: a second is refused, null takes the mark off, and she keeps everything she held', async () => {
+    const { w, alice } = await world();
+    const ask = w.owner('A');
+    assert.deepEqual(await ask('public', { key: 'A' }), { public: 'A' });
+    assert.deepEqual(await ask('public', { key: 'A' }), { public: 'A' }, 'marking the same one again is not a second');
+    const bp = (await ask()) as { notes: { beings: Record<string, { public: boolean }> } };
+    assert.equal(bp.notes.beings.A.public, true, 'and the owner sees which one she is');
+    const inv = (await alice.being.invite('kept'))!;
+    assert.deepEqual(await ask('public', { key: null }), { public: null }, 'null takes the mark off');
+    const off = (await ask()) as { notes: { beings: Record<string, { public: boolean }> } };
+    assert.equal(off.notes.beings.A.public, false);
+    assert.ok(Object.hasOwn(alice.cells.occupants, 'kept'), 'retiring her is not destroying her: every relation she held is still hers');
+    assert.equal(inv.ward, alice.pk);
+  });
+
+  // A relation she dropped is nobody's. The word is her own ward's, said to
+  // her and never crossing a door, because there is no door left to ask.
+  t('a standing she dropped is dropped: the word is hers, nothing crosses, and the far side is never told', async () => {
+    const { shop, alice } = await world();
+    await alice.being.join(await shop.being.invite());
+    const standing = alice.being.standings.shop!;
+    alice.being.standings.remove('shop');
+    assert.deepEqual(alice.cells.standings, {}, 'gone from her cells');
+    assert.equal(alice.being.standings.shop, undefined, 'and gone from her stance');
+    assert.ok(said(await standing.ask('hello'), 'dropped'), 'a handle she kept over the drop reaches nothing, and says so');
+    assert.ok(Object.hasOwn(shop.cells.occupants, 'cust1'), 'the far side holds her seat still: dropping is hers alone and she tells nobody');
+  });
+
+  // ---- a being may make
+  //
+  // `boot` is on every stance, so a kit that never wired it hands its beings a
+  // call that answers null for ever and nothing else here would notice.
+  t('a being boots one of her ward s classes from inside her own answer, and may ask for a way back to what she made', async () => {
+    const { w } = await world();
+    const maker = await w.boot<Maker>('MK', Maker);
+    // A harbor holds the classes its device gave it, so one Member is booted
+    // to put the class there. What the maker does after that is the ward's.
+    await w.boot<Member>('MEM', Member);
+    assert.deepEqual(await maker.being.open({ class: 'Member', key: 'made-1' }), { made: 'made-1' });
+    assert.deepEqual(await maker.being.open({ class: 'Member', key: 'made-1' }), { made: null }, 'a key already taken makes nobody');
+    assert.deepEqual(await maker.being.open({ class: 'NoSuchClass', key: 'made-2' }), { made: null }, 'a class the harbor does not hold makes nobody');
+    assert.deepEqual(maker.cells.made, ['made-1']);
+    // With an id she holds a standing to what she made, and the being made
+    // knows her by her own key and by nothing else.
+    assert.deepEqual(await maker.being.open({ class: 'Member', key: 'made-3', id: 'mine' }), { made: 'made-3' });
+    assert.deepEqual(await maker.being.say({ id: 'mine' }), { said: { pong: 'MK' } }, 'she asks through the relation, and arrives under her own key');
+    assert.deepEqual(await maker.being.say({ id: 'nothing' }), { said: null });
+  });
+
+  // The case the estate's walk reaches by weight and this reaches by hand: a
+  // seat kicked after it answered and before it was taken. She holds a key
+  // the door bound for her, so she is the one person who hears why, and she
+  // hears it every time. A kit that forgot to keep the last keys of a
+  // forgotten heir answers her silence, which is what it says to a stranger,
+  // and she cannot tell being kicked from never having been let in.
+  t('a relation kicked between the knock and the take: she hears removed, every time, and the take births nothing', async () => {
+    const { shop, alice, bob } = await world();
+    const inv = await shop.being.invite();
+    assert.deepEqual(await alice.being.knock(inv, 'hello'), { welcome: true }, 'she knocked and was answered');
+    shop.being.occupants.remove('cust1'); // kicked, and she is not told
+    for (let i = 0; i < 3; i++) assert.ok(said(await alice.being.knock(inv, 'hello'), 'removed'), `knock ${i}: a spent heir stays spent, and she hears why every time`);
+    // And the take still births one: it reads the knock record, which says
+    // she was answered, and the far side kicking her afterwards is not
+    // something her side can know or should guess at. The standing is hers,
+    // and it is the standing that hears removed from then on. A kit that
+    // refused the take here would leave her with no record to read the
+    // refusal through, and nothing to drop.
+    assert.equal(await alice.being.take('shop', inv), 'shop', 'the take reads the knock record, and the knock was answered');
+    assert.ok(said(await alice.being.standings.shop!.ask('hello'), 'removed'), 'and the standing is where she hears it now');
+    alice.being.standings.remove('shop');
+    assert.deepEqual(alice.cells.standings, {}, 'hers to drop, like any other');
+    // And only to her: the same invitation in anyone else's hand is silence,
+    // because the keys the door kept are hers and nobody else's.
+    assert.ok(isSilence(await bob.being.knock(inv, 'hello')), 'a stranger holding the same invitation learns nothing at all');
+  });
+
   t('take without a knock, or after a knock that was not answered, births nothing', async () => {
     const { shop, alice } = await world();
     const inv = await shop.being.invite();
@@ -452,20 +625,22 @@ export function conform(label: string, make: () => Promise<World>, { canDown = t
 
   t('a public being is asked by anyone as {}; a knock on her needs no heir and may be taken; a ward with none is silence; an unknown pk is unreached', async () => {
     const w = await make();
+    // A being written by hand: no base class, one answer, and the stance is
+    // all she is handed. She is a being to the ward on those terms alone.
     class Pub {
-      s: { cells: Cells };
-      constructor(s: { cells: Cells }) {
+      s: Stance;
+      constructor(s: Stance) {
         this.s = s;
         this.s.cells.askers ??= [];
       }
-      answer(asker: Asker, m?: string, args?: JsonObject) {
+      answer(asker: Asker, m?: string, args?: JsonObject): Reply {
         if (m === undefined) return { asks: [{ name: 'time', input: {} }], notes: {} };
         (this.s.cells.askers as Json[]).push(asker as Json);
         return { time: 12, got: args ?? {} };
       }
     }
-    const pub = await w.boot<Pub>('PUB', Pub as never, {}, { isPublic: true });
-    const priv = await w.boot<Pub>('PRIV', Pub as never); // same class, not public
+    const pub = await w.boot<Pub>('PUB', Pub, {}, { isPublic: true });
+    const priv = await w.boot<Pub>('PRIV', Pub); // same class, not public
     const a = await w.boot<Customer>('A', Customer);
     const b = await w.boot<Customer>('B', Customer);
     const at = (h: { pk: string }) => ({ ward: h.pk });