@quo-systems/quo 0.2.9 → 0.2.11

package/SPEC.md

@@ -86,11 +86,20 @@ ground
   instantiate   (class name, stance) -> object | null
   carry         (ward pk, bytes) -> bytes | undefined       undefined: no door was reached. a throw is read the same.
   random        (n) -> n bytes of entropy. every key a ward mints is drawn from it.
+  wrote         () -> nothing. the ward says it after every write to its partition, and nothing else:
+                a harbor that keeps the partition saves after it, when it likes and in the order
+                it was told. a harbor that keeps nothing leaves it out.
 ```
 
-Nothing else is ever passed. A harbor that needs a sixth thing has found a
+Nothing else is ever passed. A harbor that needs a seventh thing has found a
 gap in Quo or a leak into the ward. The shape is `Ground` in
-`src/ward/ground.ts`.
+`src/ward/ground.ts`, and beside it are the three pieces every harbor in this
+kit builds one out of: `maker`, the code half, which finds a class by own key
+in the first registry that holds it and remembers the object by the cells;
+`entropy`, the one line every terrain has; and `learnPk`, the empty ask, since
+a harbor learns its ward's pk the way anyone learns anything and has no second
+derivation to keep in step. They are convenience and never contract: a kit
+writes its own harbor, and may write these again.
 
 Returned:
 
@@ -101,7 +110,9 @@ Returned:
   harbor learns from an arrival, never a reason: a pk that only ever brings
   strangers' bytes is the harbor's to rate or refuse, and what a bound key
   hears is sealed to its own lid.
-- **The ask.** One call: method and args in, object or silence out.
+- **The ask.** One call: method and args in, a value or silence out. A value,
+  not an object: what a being answers is held to the value rule and nothing
+  narrower, so a string, a number and an array are all answers.
   In-process and unsealed. This is the one unsealed ask in Quo, and the only
   way a ward is piloted. Judgment, catching, and the return table are not
   skipped: a throw inside is silence, and an unreached shape is silence.
@@ -133,7 +144,7 @@ ever offered, and nothing here may be missing.
 stance
   cells                                                her state. values only.
 
-  occupants.invite(id)                                 -> invitation | null      awaitable: a key is minted
+  occupants.invite(id, notes?)                         -> invitation | null      awaitable: a key is minted
   occupants.remove(id)                                 -> nothing
 
   standings.knock(invitation, method?, args?, wanted?) -> object | silence | word
@@ -142,7 +153,8 @@ stance
   standings[id].ask(method?, args?, wanted?)           -> object | silence | word
   standings.remove(id)                                 -> nothing
 
-  boot(class, key)                                     -> key | null           a new being of her ward, by class name
+  boot(class, key, id?)                                -> key | null           a new being of her ward, by class name.
+                                                                               with an id, her standing to her under it
 
   wanted = { time? }                                   what this one ask may spend, in milliseconds. optional,
                                                        and so is saying anything at all
@@ -152,7 +164,7 @@ Return table.
 
 | call                | returns    | when                                                                                                         |
 | ------------------- | ---------- | ------------------------------------------------------------------------------------------------------------ |
-| invite(id)          | invitation | she minted a fresh id; the occupant record exists from now                                                   |
+| invite(id, notes?)  | invitation | she minted a fresh id; the occupant record exists from now, with those notes on it                           |
 |                     | null       | the id already names a record, occupant or standing, or is a reserved word                                   |
 | remove(id)          | nothing    | always. removing what is not there is nothing                                                                |
 | knock(inv, m, a, w) | object     | the far being answered                                                                                       |
@@ -166,17 +178,25 @@ Return table.
 | ask(m, a, w)        | object     | she answered                                                                                                 |
 |                     | silence    | she chose to say nothing, or bytes came back that are not Quo's                                              |
 |                     | word       | why not: removed, absent, repeated, threw, unreached, late, dropped                                          |
-| boot(class, key)    | key        | she exists from now, with fresh cells, and a restart finds her                                               |
-|                     | null       | the key is already booted, the harbor holds no such class, or the class threw at birth                       |
+| boot(cls, key, id?) | key        | she exists from now, with fresh cells, and a restart finds her; with an id, her maker holds her standing     |
+|                     | null       | the key is already booted, the harbor holds no such class, the class threw at birth, the id is one the maker |
+|                     |            | already holds or a reserved word, or the relation was refused; nothing of the being made is left             |
 
 A being may make, and only the owner reaches into another. Boot touches
-nobody: the being made has empty cells and no relation, hers included, until
-one is invited and taken like any other. What the owner has that she does
-not is every ask that reaches into a being from outside: public, invite and
-knock for her, remove, unboot. Who may ask her to boot is her gate, as who
-may ask her anything is.
-
-Ask, knock, invite and take are awaitable. Async where the language has it,
+nobody else: the being made has empty cells and no relation but the one her
+maker named, and every other is invited and taken like any other. That one is
+made the way all of them are, and it is the whole of what making gives: the
+being made mints an occupant for her maker under the maker's own key, so she
+knows who made her by that name and by nothing else, and her maker knocks
+with it and takes the standing under the id she gave. Naming no id makes no
+relation at all, and a being made that way is reachable by the owner alone. A
+relation that could not be made is a boot that made nobody: the being made
+goes out again, and nobody saw her, since she is a moment old and named to
+no one yet. What the owner has that the maker does not is every ask that
+reaches into a being from outside: public, invite and knock for her, remove,
+unboot. Who may ask her to boot is her gate, as who may ask her anything is.
+
+Ask, knock, invite, take and boot are awaitable. Async where the language has it,
 blocking where it does not. Every ask she makes is a new call.
 
 The asker has three shapes and no fourth, and nothing else ever reaches her.
@@ -281,8 +301,8 @@ S4  the reply is not one              bytes came back that do not open, or are n
 S5  the far door answered             silence, or a word, exactly as the door said it.
 ```
 
-And unreached in two: `U1` the args are not a value, or could not be
-sealed, so nothing left;
+And unreached in two: `U1` the args are not one object of values, or could
+not be sealed, so nothing left;
 `U2` the harbor returned nothing, or threw, so no door was reached. The number is
 taken all the same, and the gap it leaves in the count is harmless: the door
 honours any number above its mark.
@@ -302,9 +322,9 @@ strangers: silence, nothing written, heard false
 D1   the box does not open           wrong padlock, garbage, too short. the reply is sealed to the lid if
                                      the bytes carried one, and is noise otherwise. a lid that will not
                                      take a seal, a small-order point, is no lid: noise.
-D2   the payload is malformed        by or next not 64 hex, method not a string, args not an object, seq
-                                     below one, time not a whole number above zero, hops not a whole
-                                     number or at zero.
+D2   the payload is malformed        by or next not 64 lowercase hex, method not a string, args present and
+                                     not one object of values, seq not a whole number from one, time not a
+                                     whole number above zero, hops not a whole number or at zero.
 D3   for nobody, and nobody is home  no public being on this ward.
 D4   for nobody, signature fails     the payload names a key it was not signed with.
 D5   the heir is not held            never minted here, and not one she removed either.
@@ -315,12 +335,13 @@ D7   signature fails                 under an admitted key, or under the key hel
 refusals to a bound key: a word, nothing written, heard true
 D8   she is not there                `removed`: the occupant record is gone, and this is the key it was
                                      bound to when it went. `absent`: the being did not come back this run.
-D9   a knock announces nothing       `unannounced`: the heir is fresh and next is null. it binds nothing.
+D9   a knock announces nothing       `unannounced`: the heir is fresh and next is null, or is the heir
+                                     itself, which is no key of her own. it binds nothing.
 D10  the number is refused           `repeated`: already honoured, or at or below the span.
 choices: the number spent, the keys rotated, heard true
 D11  she threw                       `threw`
 D12  she answered silence            on a named ask, or on the empty ask. nothing at all is silence too.
-D13  she answered a word             `threw`: a word is not hers to make.
+D13  she answered a non-value        `threw`: a word, a Date, a cycle, a NaN, none is hers to make.
 ```
 
 The signature is verified before anything is written and before any word is
@@ -380,7 +401,9 @@ Nothing else is a value: no dates, no references, no functions, no native
 types. An id or a standing is never a value.
 
 Args are held to the same rule before they are sealed: an ask whose args
-hold a non-value is unreached, because nothing left. Cells hold values and
+are not one object of values is unreached, because nothing left. Her answer
+is held to it at the door: a shape that is not a value is `threw` to a bound
+key and silence to a stranger, so nothing crosses altered. Cells hold values and
 refuse anything else at the moment of writing, in her own frame: a Map, a
 Date, a NaN, a cyclic object, a function, an object that is not a plain one.
 The refusal is a throw where she wrote it, which her ward turns into the
@@ -399,7 +422,10 @@ None is an object, and none carries anything but its name. In this kit
 silence is the symbol `quo.silence` and a word is a frozen object under the
 symbol key `quo.word` holding its name, both from `src/being/silence.ts`;
 `isWord` and `wordOf` read them, and `isUnreached` is the one word a being
-asks about most.
+asks about most. `told` names a word and leaves everything else exactly as it
+came, so asking which word arrived is one comparison rather than two joined by
+an and: `told(out) === 'late'`. A kit in another language spells it however
+that language spells one value standing for either, and owes nothing here.
 
 ### Blueprint, schema, digest
 
@@ -425,6 +451,16 @@ holding what is not a value is dropped before hashing and an array slot
 holding one is null, which is what crossing an edge does to them anyway. The
 reference is `src/being/digest.ts`.
 
+Two places in RFC 8785 are where languages part, and a kit is held to both by
+`vectors/framing.json`. Keys sort by **UTF-16 code unit**, not by code point
+and not by byte, so an astral character sorts before one in the surrogate
+range: `U+1F600` comes before `U+FB33`, which is the reverse of what a
+language sorting code points gives. Numbers are written as ECMAScript writes
+them, `1e+21` and `1e-7` and `0.3333333333333333`, with a negative zero
+written `0`. A kit that reproduces every ASCII vector and neither of these
+hashes one blueprint to two digests, and every standing between the two wards
+refreshes on every ask.
+
 Capability and state are two axes, never mixed.
 
 ```
@@ -468,7 +504,12 @@ and take refuse them like the ward's words.
 ### Cells
 
 Cells are I-JSON values. The ward may persist them. A restart is silent: she
-is constructed again with the same cells.
+is constructed again with the same cells. Three keys at their root are the
+ward's, `standings`, `occupants` and `class`, and a write of hers to them is
+refused where she wrote it, like a non-value. A value nested past sixty-four
+levels, a hole in a list, an accessor, and a key named `__proto__` are
+refused the same way: JSON writes each one way and a runtime reads it
+another, so no harbor can keep them.
 
 ```
 cells
@@ -479,11 +520,20 @@ cells
 ```
 
 - `digest` is the hash of the blueprint she last fetched by the empty ask.
-- `blueprint` is that blueprint.
+  It is over what came back, whatever that was.
+- `blueprint` is that blueprint, and only if it is one. A far describe is
+  somebody else's code and may answer any value at all; the ward reads it as
+  a blueprint before writing it as one, a list of asks with a name and an
+  input each, and writes `null` when it is not. A side walks `asks` by name,
+  and a side that broke on a far ward's answer would be one kit made wrong
+  by another. The answer itself still goes to whoever asked, unread.
 - `seen` is the digest her ward last saw arrive with an answer. A silent
   refresh leaves it untouched.
 - `notes` is hers. Quo never reads it. Tier, expiry, kinship between an
-  occupant and a standing that are the same far being: all hers.
+  occupant and a standing that are the same far being: all hers. `invite`
+  may seed it, which is how an inviter says the terms it mints under, and
+  after that it is written by nobody but her. The owner's `invite` passes
+  what it was given straight through; the ward reads none of it.
 
 ## Relations
 
@@ -543,7 +593,9 @@ and a knock on a taken invitation joins the standing's lane.
 The keys an ask sends under are read when she calls, not when the lane
 reaches her: an ask issued while the standing stood is answered even if she
 drops it in the next line. An ask on a standing she has already dropped is
-silence, and so is a knock on the invitation it was born on: after take the
+the word `dropped`, and nothing is sent. A knock on the invitation it was
+born on, after take and a drop, is a knock as a heir the far door has already
+spent, so bytes leave and the door's silence comes back: after take the
 invitation names the standing and nothing else, so it is exactly as alive as
 the standing is.
 
@@ -561,8 +613,22 @@ An invitation to her is `{ ward }` alone. One with a secret and no heir is
 not an invitation. She may be taken as a standing on that invitation, and
 such a standing has no heir and never rotates.
 
+The signature is checked here for no property, and the check is kept anyway.
+Whoever asks chose that key a moment ago, the box is already authenticated to
+the ward's padlock, and the door binds nothing, so nothing is proven by it and
+nothing would be lost by dropping it. It stays because the payload has one
+shape and the door has one path: `by`, `next` and `seq` are required of her
+ask as of every other, and honoured by nobody. A kit author who goes looking
+for the property behind this signature will not find one, and is not missing
+anything.
+
 She is reached without a heir, so the door keeps nothing for whoever asked:
-no key it vouched for, and no count. The signature is still checked, under
+no key it vouched for, and no count. The bit beside her reply is `heard`
+false, as it is for every stranger: no key this door holds spoke. She is the
+one place a stranger is answered by design, so she is the one place the
+harbor's rating must still see a stranger arrive. A harbor that saves before
+its reply goes out follows the ward writing, never the bit, since a public
+being writes in her cells like anyone. The signature is still checked, under
 whatever key signed. Once-only delivery does not reach her: the same sealed
 bytes presented twice are delivered twice, and the number the payload carries
 is required and honoured by nobody. A count per voice would be memory a
@@ -614,7 +680,17 @@ key does both: an Ed25519 pair to sign replies, an X25519 padlock every ask
 is sealed to. Beings never own a padlock.
 
 - **The ward key** comes from the seed. Its pk on the wire is the signing pk
-  then the padlock, 128 hex, and it routes.
+  then the padlock, 128 hex, and it routes. Two curves, and each secret is
+  HKDF-SHA-256 of the seed under its own label, `quo-ward-sign` and
+  `quo-ward-seal`, empty salt, 32 bytes out. Fed the seed straight the two
+  scalars would still differ, because Ed25519 hashes what it is given and
+  X25519 clamps it raw, but that is an accident of the two designs and no
+  separation: one secret would be doing two jobs with nothing said about it,
+  and a second kit would have to reproduce a construction nobody named. A
+  seed handed in as bytes of the key length is the seed; anything else, text
+  or bytes of another length, is SHA-256 first, so a thirty-two character
+  name is a name and not a key for being the right size.
+  `vectors/framing.json` pins it.
 - **The heir** is the key the inviting ward mints at invite, for one id. It
   keeps the heir's pk beside the id and gives the secret away. The
   invitation IS the heir: ward pk, heir pk, heir secret. Rotation one: the
@@ -622,8 +698,8 @@ is sealed to. Beings never own a padlock.
 - **Her own key** is what the knocker mints at knock. She signs the knock
   with the heir and announces her own key in it. The door binds the id to
   her key and the heir dies as it speaks. Rotation two: from now on she
-  signs with a key the inviter never held. A knock that announces nothing
-  binds nothing.
+  signs with a key the inviter never held. A knock that announces nothing,
+  or announces the heir itself, binds nothing.
 - **Next.** Every ask she sends announces the key she will sign with next.
   The door holds two pks for her: the one that may speak now, and the one
   it vouched for. Whichever speaks first wins, and the other dies. There is
@@ -709,12 +785,12 @@ what makes three answers three. A wait that does not end is not an object,
 not silence and not unreached, and before the allowance a cycle of legal asks
 could produce one: A asks B, B answering asks A back, A answering asks B on
 the relation the first ask still holds. Now the innermost wait gives up, the
-silence unwinds outward, and the ask ends.
+word `late` unwinds outward, and the ask ends.
 
-**A wait that ran out is silence, never unreached.** Unreached promises
-nothing was delivered and is safe to ask again. A bound that expired knows no
-such thing: the far door may have heard and be working still. What comes
-back late is not read.
+**A wait that ran out is the word `late`, never silence and never
+unreached.** Unreached promises nothing was delivered and is safe to ask
+again. A bound that expired knows no such thing: the far door may have heard
+and be working still. What comes back late is not read.
 
 The harbor keeps a patience of its own, and the two never read each other.
 What a harbor hands back as nothing came back is unreached, and unreached
@@ -722,7 +798,7 @@ says nothing was delivered: a harbor may answer it only where it knows the
 bytes never arrived, no reach for that pk, a socket that would not open, a
 link that is down. A harbor that sent them and then gave up knows no such
 thing, and must not answer at all; the ward's bound will ring, and that is
-silence, which promises nothing. A harbor that throws has answered nothing
+`late`, which promises nothing. A harbor that throws has answered nothing
 in a louder voice, and the ward reads it as nothing: unreached. So a harbor
 may hold a shorter patience than the ward for its own reasons, a socket it
 wants back or a queue it will not grow, and whichever ends first ends the
@@ -747,7 +823,10 @@ Every arrival is judged by the door, and named by it or falls silent.
    payload names, and dispatch as `{}`. Nothing is written.
 3. For a heir: admit the signer if it is the key held for that heir or the
    key that key announced, or the key held when she removed the id. Verify
-   the signature. Only then say anything or write anything: a removed
+   the signature. Read admission again, since the door judges arrivals
+   concurrently and a knock that raced this one may have spent the heir
+   while the signature was checked. Only then say anything or write
+   anything: a removed
    relation is `removed`, a being not back this run is `absent`, a knock
    with no key is `unannounced`, a number already honoured is `repeated`,
    and none of those writes. Else spend the number and settle the keys, so
@@ -783,7 +862,11 @@ share no key learn nothing from each other.
 
 Four algorithms, named once and never negotiated: Ed25519 signs, X25519
 agrees, SHA-256 hashes, AES-256-GCM encrypts with key and nonce derived
-together by HKDF-SHA-256 under an empty salt and the label `quo-seal`. The
+together by HKDF-SHA-256 under an empty salt and the label `quo-seal`. That
+label is the message cipher's and no other: HKDF appears twice in this kit,
+here from an agreement and again at the ward key from a seed, and the three
+labels, `quo-seal`, `quo-ward-sign`, `quo-ward-seal`, are three so that two
+derivations never answer to one name. The
 ephemeral pk is the additional authenticated data of every box. A small-order
 public key verifies nothing; an all-zero agreement is refused. All four are
 in WebCrypto, which is why the ward names no package -- on any terrain that
@@ -800,14 +883,17 @@ on the bytes.
 ```
 ask on the wire     box     = ephemeral X25519 pk (32) || AES-GCM( payload || signature (64) )
                               sealed to the ward padlock. nothing rides outside it.
-                    payload = JSON { to, by, next, seq, time, hops?, method?, args }
-                              signed by `by`. to, by, next: 64 hex. to, next may be null.
-                              to names the heir, or null for the public being.
+                    payload = JSON { to, by, next, seq, time, hops?, method?, args? }
+                              signed by `by`. to, by, next: 64 lowercase hex. to, next may be null.
+                              to names the heir, or null for the public being. seq is a whole
+                              number from one. args, when present, is one object of values.
                               hops is reserved: a whole number, never below zero,
                               refused at zero, and nothing sets it.
 reply on the wire   box     = ephemeral X25519 pk (32) || AES-GCM( reply || signature (64) )
                               sealed to the ask's ephemeral pk, signed by the ward key
                     reply   = JSON { object, seen } | { silence: true } | { quo: word }
+                              seen is always present: the digest, 64 hex, on a named ask that
+                              had one, and null otherwise, the empty ask included.
                               word: removed | absent | unannounced | repeated | threw. only to a key the door bound.
 ```
 
@@ -854,8 +940,9 @@ It owns nothing durable. It is three things, all in the harbor's hands:
 its seed, its partition, and the classes its beings are made of. The
 partition names each class and the harbor holds the bodies, so a ward is
 whole only where all three are, and a harbor that keeps one remembers where
-the other two came from. It writes as it runs and never decides, asks, or
-learns whether anything was kept. Between one run and the next, a ward is
+the other two came from. It writes as it runs, says so after every write,
+and never decides, asks, or learns whether anything was kept. Between one
+run and the next, a ward is
 nothing at all.
 
 One ward is one runtime and one language, and every being in it shares both.
@@ -871,8 +958,9 @@ list is a promise, not an accident: `test/terrain.test.ts` fails the build
 both when a file names a platform and when it reaches for a global outside
 the list, and when the list names one the tree has stopped using.
 
-The package exports raw TypeScript, extension and all, on every specifier, so
-Node loads it directly and every other terrain reaches a ward through a
+The package exports the emitted `dist/`, JavaScript with a declaration
+beside it, on every specifier, so plain Node imports it; the tree runs the
+source directly, and every other terrain reaches a ward through a
 bundler. `test/bundle.test.ts` bundles the three words and runs them, and
 asserts the artefact carries nothing a terrain cannot provide.
 
@@ -887,8 +975,9 @@ of every terrain at once. Five run it: Node, a browser, workerd, Deno and
 Bun. Bun is the one that is not V8, so "the language alone" is checked
 against two implementations of the language and not one.
 
-`npm run check` is Node alone, and stays fast. `npm run check:terrain` is the
-browser and the edge, kept apart because a browser is a download and not a
+`npm run check` is Node alone, and stays fast. `npm run check:terrain` is
+every other terrain, the browser, workerd, Deno and Bun, kept apart because
+each is a binary of its own and the browser is a download and not a
 package: a fresh clone needs `npx playwright install chromium` first, and is
 told so in one sentence rather than a stack trace.
 
@@ -897,7 +986,9 @@ told so in one sentence rather than a stack trace.
 Everything durable a ward has is here, every secret included, and nothing
 here is ever in a being's cells. Values only, so the harbor may persist it as
 it likes: as this process's objects, as a row, as a line of JSON on a disk. A
-reboot from its JSON is the same ward. The shape is `src/ward/partition.ts`.
+reboot from its JSON is the same ward. A harbor that keeps it copies it
+through JSON and never structured-clones it: what the ward hands out is
+behind the cells guard. The shape is `src/ward/partition.ts`.
 
 ```
 partition
@@ -908,8 +999,10 @@ partition
               occupants   id -> heir pk
               knocks      <ward>:<heir> | public:<ward> -> { current, next, spoke, sent, seq }   before take
                           spoke: bytes came back once. sent: bytes went out once, answered or not
+                          bounded, oldest out, and one that answered outlives one that never did
               answered    <ward>:<heir> | public:<ward> -> true                            knocked and answered
-              minted      the last eight pks her side minted
+              minted      the last eight pks her side minted. nothing in the ward reads it: it is there to
+                          be looked at, and a kit that keeps the list empty holds the same ward
   heirs     heir pk -> { being, id, current, announced, fresh, mark, spent }   the door's view of every occupant
   gone      heir pk -> { current, announced }   the keys held when an id was removed, bounded, so their
                                                 holder hears `removed` and nobody else hears a thing
@@ -921,6 +1014,12 @@ alone: an invitation carries the heir to whoever it is for, and anyone
 holding one could quote that heir back inside an invitation naming a ward of
 their own.
 
+Only take ends a knock record, so the list is bounded like `gone`: past the
+count the oldest go, and one that was answered outlives one that never was,
+since an answered knock is a relation she may still take. A being who knocks
+without ever taking keeps a fixed number of keys behind her, not one per
+invitation she ever met.
+
 The version is one value and it does not move until 1.0.0. There is nobody
 holding a partition of another shape to tell apart: if the shape changes, a
 partition is thrown away, not migrated and not counted. A ward opening a
@@ -928,6 +1027,17 @@ version it cannot read throws at birth and does not boot. Birth is where a
 ward is allowed to be loud; silence is the door's word, for asks that were
 made, and no ask has been made yet.
 
+The version says which shape, and the ward reads the shape as well, once, at
+birth: every field above that the ward, the door or the heirs later act on
+without looking again. A partition this ward wrote is that shape by
+construction. One adopted from elsewhere was written by a hand, another kit,
+or a file that was cut short, and a `spent` that is not a list or a `mark`
+that is not a number is a door that honours every number, or one that
+rejects where it promised a word. A ward that meets one throws at birth with
+the path that failed, which names what is wrong to whoever is holding the
+file. A being's own cells are read no further than the two records the ward
+keeps in them: what she puts in her own is hers, of any shape JSON carries.
+
 What a ward can read is a list, `READS`, and today it has one member. The
 list and the step that carries an older partition forward exist before
 1.0.0 because after it there is nowhere to put them. A partition holds every
@@ -949,7 +1059,9 @@ A constructor that throws on a restart takes only herself down: she is
 absent this run, no door, so `absent` at her door to the keys she bound and
 silence to strangers, and her cells sit untouched waiting for the run that
 can read them. The ward is up and so is everyone
-else. A class the harbor no longer knows is the same absence, and so is a
+else. Her row is hers while she is absent: the owner sees her as absent, no
+class boots under her key, and the owner may unboot her. A class the harbor
+does not hold this run is the same absence, and so is a
 class the harbor holds at a body the cells were not written for: which body
 a ward reboots on is the harbor's decision, and a ward cannot tell an old
 one from a new one. Loss of the partition is loss of every relation,
@@ -989,10 +1101,10 @@ renders anyone's and holds no list of its own.
 
 ```
 ask()                                    -> { asks: [boot, public, invite, knock, remove, unboot],
-                                              notes: { pk, beings: { key: { class, public, digest } } } }
+                                              notes: { pk, beings: { key: { class, public, digest, absent? } } } }
 ask('boot',   { key, class })            -> { booted: key } | { error }
 ask('public', { key })                   -> { public: key } | { error }
-ask('invite', { being, id })             -> invitation | null | { error }
+ask('invite', { being, id, notes? })     -> invitation | null | { error }
 ask('knock',  { being | { boot: class, key },
                 id, invitation, method?, args?, wanted? })
                                          -> { taken: id | null, answer } | { error: 'silence' | 'unreached' | ... }
@@ -1004,16 +1116,24 @@ anything else                            -> { error: 'unknown ask' }
 - The owner is a caller like any other: `wanted` says what its knock may
   spend, and saying nothing is the ward's default, exactly as for a being.
 - The describe runs every being's own describe as `OWNER` and hashes it; a
-  being that throws or falls silent there shows a null digest.
-- Boot refuses a key already booted and a class the harbor does not know; a
-  boot that made nobody leaves the partition as it found it. A throw at
-  birth is that boot's error, and nothing half-lives.
+  being that throws or falls silent there shows a null digest. A being
+  absent this run is listed with a null digest and `absent: true`.
+- Boot refuses a key that has a row in the partition, booted this run or
+  absent, and a class the harbor does not know; a boot that made nobody
+  leaves the partition as it found it. A throw at birth is that boot's
+  error, `{ error: 'threw at birth' }`, and nothing half-lives; a being's
+  own boot answers null for it.
 - Public marks a being already booted as the ward's one public being. It
   refuses a key not booted, the ward's own pk, and a second public being
   while one stands, since marking a second would leave the first holding
   every relation she had, reachable by nobody at the bare pk and told by
   nobody she was replaced. Marking the one already public again is
-  answered, and changes nothing.
+  answered, and changes nothing. A public being absent this run is
+  reachable by nobody already, so the mark may move to another. A null key
+  takes the mark off: the being stays booted with every relation she holds,
+  and the ward answers arrivals for no heir with silence as one that never
+  had a public being does. Retiring her is not destroying her, and the mark
+  is free for another.
 - Invite on the ward's own pk mints an owner, and only the root may ask it:
   from the door it is answered as an invite on nobody. The ward has
   occupants, its owners, and no standings: a knock for the ward itself is a
@@ -1034,7 +1154,9 @@ anything else                            -> { error: 'unknown ask' }
   heir with silence as one that never had a public being does. The ward
   itself is refused, for the reason knock is: it would be a ward deleting
   itself from inside its own map, leaving its owners bound to a door that is
-  gone.
+  gone. An absent being is unbooted the same way: she has no stance to speak
+  for her, so the ward closes her heirs itself, and her occupants hear
+  `removed`.
 - The owner's remove is the mirror of its knock: a relation out of a being,
   by id, and the id may be an occupant or a standing, since the two share
   one namespace. The being's own remove says nothing; the owner hears
@@ -1099,12 +1221,24 @@ Not stressed with:
 
 A harbor is what a device already has, offered to Quo: processes, storage, a
 network, entropy, a clock. It fits into a device carved up by its owner,
-users, containers, mounts, profiles, and asks for none of them. It knows no
-being, holds no id, reads no partition, and is nobody outside its device.
+users, containers, mounts, profiles, and asks for none of them. It judges
+nothing, holds no id, chooses no class, and is nobody outside its device.
+
+It makes every being of every ward it serves, because `instantiate` is in
+the ground and the ward calls it, and it keeps what it made. That is not
+knowing a being. It has her object and knows nothing about her: not what she
+answers, not who her occupants are, not which of her cells is a secret. It
+never reads a partition to decide anything, and it never hands one out
+except as the values a store keeps.
 
 The harbor:
 
-- Boots wards as processes, one seed each, and keeps each ward's partition.
+- Boots wards as processes, one seed each, and keeps each ward's partition:
+  saves it when the ward says it wrote, one save at a time per ward and in
+  the order it was told, so a being driven in process is kept the way one
+  reached through a door is. A save that fails is the harbor's to count and
+  never a door's to answer: the door answered bytes, and a full disk is not
+  a reason the far side may hear.
 - Holds the class bodies for its wards, and remembers for each ward where
   its bodies came from, so that a restart is on the same bodies unless the
   harbor decides otherwise. Constructs a being when a ward names a class
@@ -1115,6 +1249,16 @@ The harbor:
 - Passes every ward the ground, once, at birth. Receives a door and an ask.
   Hands the ask to exactly one holder, by the device's own rules. That
   holder is the ward's owner.
+- Hands its own device's code the beings it made for a ward, by key, and the
+  keys it has. This is not a path around a door. The object is already in
+  that process, made there a moment ago by the harbor itself, and reaching
+  it is the device's own code calling its own object, the same reach a being
+  has on one she booted herself. Nothing of it crosses an edge, so there is
+  no door it could have passed instead. A key with no object is a being who
+  is not here this run. What the device does not get is the partition: it
+  holds every seed the ward has, and a side that wants to know which beings
+  there are, or which one is public, asks the ward through the ask pointer,
+  which is the only thing that answers for a ward anyway.
 - Keeps the map of ward pk to door for its own wards, and ward pk to reach
   for foreign ones. Learns its own wards' pks by asking them. Learns foreign
   pks however it likes.
@@ -1141,8 +1285,8 @@ Not stressed with:
   silence, and it never answers on a ward's behalf.
 - Fanning out, broadcasting, or forwarding to a pk other than the one it was
   given. One pk is one ward is one door.
-- Beings, ids, keys inside a relation, classes as things to choose,
-  invitations, or what any partition contains.
+- Choosing a class, deciding an id, reading the keys inside a relation,
+  minting an invitation, or acting on anything a partition contains.
 - Judging anything. A ward judges its door. The harbor delivers to it.
 - Speaking Quo. It is nobody's occupant and holds no standing anywhere. The
   harbor is not a ward and is nobody's.
@@ -1154,12 +1298,15 @@ one hop: a pk that is not its own and not a direct peer's is nothing. It
 keeps no lease: two of them may hold one seed and one partition, which is
 the broken vouch every real harbor refuses, kept here so that the tests can
 show what divergence looks like. Every ward and being assertion in the tree
-is made on it, so that the network never hides a fault in the words.
+is made on it first, so that the network never hides a fault in the words;
+the harbor core then passes the same suite over memory stores.
 
 What a harbor on a device keeps is a ward's three parts under one name: the
 seed, the partition, and a **ward record**, which says where the class
-bodies come from and which being is the user's. That is the **store**,
-`src/harbor/store.ts`: list, load, put, save the partition after a call,
+bodies come from and which being is the user's. `user` is a key and nothing
+else: a label the device's own code hands back to get the being it made,
+never read to route a byte or judge an ask. That is the **store**,
+`src/harbor/store.ts`: list, load, put, save the partition when the ward wrote,
 save the record after a boot learned the pk, take a ward out as the first
 move of a migration, and keep the directory's hints, a pk to a URL, across
 a restart. A name already kept is refused. A store reads nothing it keeps
@@ -1183,14 +1330,17 @@ WebSocket, and this tree holds either end of a line and never a listener:
 who accepts a socket is the terrain's business. A reach reads nothing; a
 harbor opens no box but its own probe's.
 Nothing comes back only where the reach knows nothing was delivered: no such
-pk at the far end, a connection that would not open, a line already gone. A
+pk at the far end, a connection that would not open or closed before it
+opened, a line already gone, a status from a request that says the listener
+did not take the bytes, refused on their face or with nobody behind the
+gateway. A
 reach that sent the bytes and lost the line after answers nothing at all,
 and the ward's bound ends the ask. Every reach passes
 `src/conformance/reach.ts` untouched, and the frames are pinned in
 `vectors/wire.json`.
 
 A reach also carries the **wire suite**: which frames these are, and which
-four algorithms seal what they travel with. It is one number, it is not
+five algorithms seal what they travel with. It is one number, it is not
 negotiated, and today it is 1. It rides where a line is opened and never on
 an ask: in the text frame a socket announces itself with, and as the header
 `quo-suite` on a request. So an ask is still bytes from the first one, with
@@ -1209,7 +1359,7 @@ refused as it is written: the number is compared as it was sent, so a suite
 is one spelling and not a family of them.
 
 This is the only place a second suite could ever be told from the first.
-The four algorithms are named once and never negotiated, which is right: a
+The five algorithms are named once and never negotiated, which is right: a
 choice offered on the wire is a choice a stranger can push. But named once
 is not the same as unnameable, and a kit that must one day seal differently
 has to be able to say so to a kit that cannot, or the day it arrives every
@@ -1221,9 +1371,14 @@ is: the store and the reach put together under the ground. It boots every
 ward the store keeps, keeps the map of ward pk to door for its own wards
 and the **directory**, pk to reach, for foreign ones, carries bytes to a
 pk and delivers bytes from the wire to one door. The directory is filled
-three ways, in this order: its own doors; a socket a dialer holds to it,
+four ways, in this order: its own doors; a socket a dialer holds to it,
 bound once the door behind the dialer's claim has proved it, and unbound
-when the line closes; and a hint, a pk at a URL, kept in the store.
+when the line closes; the claims of a listener this harbor dialed, proven
+the same way and reached through that line; and a hint, a pk at a URL,
+kept in the store. A hint never displaces a reach proven at a door. An
+announce names at most sixty-four pks, proven a few at a time, and is the
+newest word: a proof still in flight from an earlier announce on the same
+line binds nothing when it lands.
 
 An announce is a claim, and a claim binds nothing until proven: anyone who
 can reach a listener could otherwise name a pk that is not theirs and take
@@ -1238,8 +1393,9 @@ listener proves the dialer's claims and the dialer the listener's. What a
 relay that genuinely reaches a ward elsewhere can still do is forward the
 probe and pass, and then it is a rendezvous for that ward like any other,
 able to drop and nothing more. This is the one box a harbor ever opens,
-the one it sealed itself, and it reads nothing from it but whose key
-signed. One rule makes a **rendezvous** of
+the one it sealed itself, and it reads nothing from it but that it is the
+silence a door owes such a box, signed by the claimed key. One rule makes a
+**rendezvous** of
 any listener: bytes that arrive from the wire go to an own door or to a
 socket this harbor holds for that pk, and never onward by request. So a
 harbor that cannot be dialed is reached through the one it dialed, by
@@ -1253,18 +1409,28 @@ with a wait that doubles from a second to thirty when the line drops, and
 while it is dialed it is one of the harbor's fallbacks, where a pk nobody
 here knows is sent. A device that slept, a phone in a pocket, comes back
 with that wait frozen and, often, its socket closed under it by the system
-without a word, so the dialer takes one call from the device, `wake`: a
-line in hand is made to announce, and a dead one closes under the word and
-is dialed again; a line that is down is dialed now, the wait called off; a
-dial in flight is left alone. Fallbacks are a list and a pk is tried down it in
+without a word, so the dialer takes one call from the device, `wake`:
+whatever line it holds, open or still opening, is put down and a new one is
+dialed now, the frozen wait called off. Nothing can tell a line the system
+dropped from a live one, and asking would cost a round trip the four words
+do not have; an announce written into a dead line is taken into the send
+buffer and errors only when TCP gives up, minutes later, and for all of it
+every ask to a pk bound behind that line hears `late`. Dialing costs one
+handshake when the line was fine, and an ask made meanwhile waits on the new
+socket. A line put down this way closes when the system gets round to it,
+gives back what it took, and dials nothing: only the line the dialer still
+holds dials again. Fallbacks are a list and a pk is tried down it in
 order: a harbor may dial more than one listener, and a rendezvous is a
 listener and nothing more, so a ward is never reachable through one place
 by anything but its own choice. A line that drops takes only its own place
 out of the list. A ward is born on the core by minting a seed under a name,
 leaves it by being dropped, the partition written first, and arrives by
-being adopted, same seed, same pk. What a terrain adds is a store of its
-own, a loader for the class bodies, and the lease its device offers; what
-it never touches is a ward.
+being adopted, same seed, same pk. Adopting is the one path a partition
+written elsewhere takes, so it is where the ward's shape check is met: one
+that will not boot is not adopted, it goes back out of the store, and the
+only copy is the one the caller is still holding. What a terrain adds is a
+store of its own, a loader for the class bodies, and the lease its device
+offers; what it never touches is a ward.
 
 ## The being
 
@@ -1285,8 +1451,7 @@ describes herself, per asker, by answering the empty ask.
 
 Not stressed with: where anyone lives; crypto, keys, wire, storage, clocks,
 or the harbor; strangers, because nobody her ward cannot name reaches her;
-whether an occupant is a person, a model or a program; making beings, because
-only the ward instantiates.
+whether an occupant is a person, a model or a program.
 
 ### Her obligations
 
@@ -1313,9 +1478,11 @@ only the ward instantiates.
    asks is always a new call. The one exception is the public being, who is
    reached with no heir and no count: the same bytes reach her twice, and
    her answer must be safe to repeat.
-8. Beings do not make beings. A being that could create would hold class,
-   memory and key, and there would be no ward. A being that wants a child
-   gets one from outside, as an invitation handed to her.
+8. A being may make a being of her own ward, by class name and under a key
+   she chooses, and holds no relation to her until one is invited and taken
+   like any other; the ward builds the stance and the harbor holds the
+   class, so she never touches either. Only the owner reaches into a being
+   from outside.
 9. Whatever her ward cannot name is not hers to worry about: what the ward
    does with an arrival it cannot name is the ward's.
 
@@ -1332,16 +1499,30 @@ The raw shape needs no import from the kit. The kit also offers a base class,
   `for(occupant, asker)` decides whether this asker sees the ask, and so
   whether this asker may call it: what she shows is what she can be asked,
   one gate for describe and for dispatch.
+- Both statics are read off the class the object was made from, and a
+  subclass that declares either **replaces** its parent's rather than adding
+  to it. That is the rule and not an oversight: a being's blueprint is
+  exactly what the class in front of you declares, in the order she chose,
+  and a merge would hand her asks she may mean to drop and an order she did
+  not write. A subclass that means to extend says so, in one spelling,
+  `static override asks = { ...Parent.asks, mine: {} }`, and the same for
+  cells. A parent that means to be subclassed at all annotates rather than
+  infers, `static override cells: JsonObject = { ... }`, since this language
+  holds a subclass's static side to its parent's and would otherwise refuse a
+  subclass declaring fewer keys than the parent happened to write.
 - `answer` is written for her. The empty ask is `describe(asker)`, which she
   may override by hand. A named ask calls the method of that name with
   `(args, asker)`. Anything not declared, hidden from this asker, or
   inherited from Object's prototype is `{ error: 'unknown ask' }` and the
   method is never entered.
 - A declared ask with no method, or one named after the base's own members,
-  fails at birth, loudly, so a boot fails and nothing half-lives.
+  fails at birth, loudly, so a boot fails and nothing half-lives. The
+  method is one on her prototype chain below Object's: a class field
+  holding a function is not there yet when the base checks, and the
+  refusal says so.
 - `occupant(asker)` is the occupant record for whoever is at the door, and
-  undefined at a public being. `invite`, `knock`, `take`, `standings` and
-  `occupants` reach the stance and nothing else.
+  undefined at a public being. `invite`, `knock`, `take`, `boot`, `cells`,
+  `standings` and `occupants` reach the stance and nothing else.
 
 ### Examples
 
@@ -1375,6 +1556,7 @@ class Shop {
   }
   async answer(asker, method, args) {
     if (method === undefined) return { asks: [{ name: 'hello', input: {} }], notes: {} };
+    if (asker.id === undefined) return { welcome: false }; // a stranger at the public door has no record
     const rec = this.s.cells.occupants[asker.id];
     if (method === 'hello' && args.invitation) {
       const back = await this.s.standings.knock(args.invitation, 'hi');
@@ -1408,15 +1590,18 @@ class Guest {
 ```
 
 A relay. Forwards every ask to one standing and never looks inside, and asks
-for a short wait because she is one door of several.
+for a short wait because she is one door of several. Silence passes through
+her; a word does not, since a word out of a being is `threw` at the door,
+D13, so she says it as an error of her own.
 
 ```js
 class Relay {
   constructor(stance) {
     this.s = stance;
   }
-  answer(asker, method, args) {
-    return this.s.standings.next.ask(method, args, { time: 2000 }); // silence and unreached pass through
+  async answer(asker, method, args) {
+    const out = await this.s.standings.next.ask(method, args, { time: 2000 });
+    return isWord(out) ? { error: wordOf(out) } : out; // unreached and late reach her asker as an error, not as a throw
   }
 }
 ```
@@ -1452,8 +1637,7 @@ words, and nothing is kept for a holder of an earlier one.
 
 The tree runs as TypeScript and the package ships as JavaScript. Node
 strips types nowhere under `node_modules`, so a consumer cannot load the
-source, and 0.1.0, which shipped it, imported nowhere; 0.1.1 is the first
-version a stranger can import. `npm run build` emits `dist/` from `src`
+source. `npm run build` emits `dist/` from `src`
 alone, one JavaScript file and one declaration file per source file with
 every relative import rewritten, and the exports map points there, types
 beside default. The
@@ -1463,11 +1647,12 @@ which is how a consumer does. `test/package.test.ts` is the one
 suite that meets the package as a stranger: it packs the tarball,
 installs it into an empty folder, and imports every entry point under
 plain Node. `npm pack --dry-run` shows what ships: `dist/`, the four
-source folders, the vectors, this document, the README and the licence,
-and nothing else. This document ships, decided here: it is the truth the
-source and the vectors are read against, and a kit in another language is
-written against it and nothing else. Publishing runs both gates first,
-`npm run check` and `npm run check:terrain`, and refuses on a failure.
+source folders, the vectors, this document, the README, the licence and
+the notice, and nothing else. This document ships, decided here: it is the
+truth the source and the vectors are read against, and a kit in another
+language is written against it and nothing else. Publishing runs both
+gates first, `npm run check` and `npm run check:terrain`, and refuses on a
+failure.
 
 ```
 src/being/        the Being side. types, the base class, silence, the digest.
@@ -1514,8 +1699,9 @@ passes the same suite. Those tests are the checklist, not the mock.
 - `src/conformance/index.ts`: one suite of behaviours, written against the
   stance and one probe: a kit hands the suite its ward's heir table and
   bind table as values, and a forged knock, so the suite can see that a
-  refusal wrote nothing and a knock bound what it should. It reads them and
-  never writes them. With the beings in `src/conformance/beings.ts`: a
+  refusal wrote nothing and a knock bound what it should. It reads the
+  tables and never writes them; the forged knock is the one thing it sends
+  through a door. With the beings in `src/conformance/beings.ts`: a
   printer, a shop, two customers, one raw being with no base class, and a
   member of an estate. Any ward must pass it, under any topology.
 - `src/conformance/estate.ts`: the estate, and the last chapter of that
@@ -1594,8 +1780,11 @@ passes the same suite. Those tests are the checklist, not the mock.
   reach suite against the socket framing over two lines in one process, so
   the frames are asserted with no network under them; the conformance
   suite against two harbor cores over memory stores reaching each other
-  in-process, drop and adopt as the migration; a restart from the store
-  with the hints; the dialer over a stubbed line, announce, a claim proven
+  in-process, drop and adopt as the migration; a ward that moves harbor
+  keeping its pk and every relation, the rendezvous told on the line in
+  hand; a ward booted or dropped after a line opened, announced on that
+  line, and a claim on a pk nobody holds binding nothing; a restart from
+  the store with the hints; the dialer over a stubbed line, announce, a claim proven
   at a real door before it binds and a claim nobody there holds left
   unbound, fallback, unbind and the wait before it dials again; and the frames against
   `vectors/wire.json`, the ask, the reply, nothing delivered and the
@@ -1614,7 +1803,7 @@ passes the same suite. Those tests are the checklist, not the mock.
   `node:assert/strict`, pair by pair. The suite means the same thing on
   every terrain only if those two agree, so they are compared and not
   trusted.
-- `test/floor.test.ts`: the four algorithms this terrain must carry, probed
+- `test/floor.test.ts`: the five algorithms this terrain must carry, probed
   one by one; that the arithmetic spends every one of them; and the two ways
   a terrain can be short -- no `crypto.subtle` at all, and a subtle without
   the curves -- each failing at the first call, in one sentence.
@@ -1745,7 +1934,7 @@ Decided here, so that the answer is not rediscovered:
 - **invite**: mint an id and get its invitation.
 - **knock**: an ask carrying an invitation. Binds the far side to the id.
 - **take**: keep an answered knock as a standing, under her own id.
-- **ask**: method and args to a standing. Object, silence, or unreached back.
+- **ask**: method and args to a standing. Object, silence, or a word back.
 - **answer**: her one function. Object or silence out.
 - **the empty ask**: ask with no method. Her answer to it is her blueprint.
 - **blueprint**: her interface as she chooses to show it to one asker.
@@ -1759,11 +1948,13 @@ Decided here, so that the answer is not rediscovered:
 - **unreached**: the word for no far door reached. Retryable.
 - **notes**: hers, inside every occupant record. Quo never reads it.
 - **partition**: the ward's files. Everything durable, every secret.
-- **ward record**: what a harbor keeps to boot one ward again: seed,
-  partition, and where its class bodies come from. The harbor's, never
-  the ward's.
+- **ward record**: what a harbor keeps beside a ward's seed and partition
+  to boot her again: her pk, where the class bodies come from, and which
+  being is the user's. The harbor's, never the ward's.
+- **lid**: the ephemeral X25519 pk an ask carries in front of its box. The
+  reply is sealed to it and to nothing else. One per ask, never reused.
 - **edge**: one of the two seams of Quo, harbor to ward and ward to being.
   An object crosses once at birth, calls cross for the rest of the ward's
   life, and nothing else crosses.
-- **ground**: the one object a harbor passes a ward. Five things.
+- **ground**: the one object a harbor passes a ward. Six things.
 - **door**: the ward's one voice outward. Sealed bytes in, sealed bytes out.