@quo-systems/quo 0.2.9 → 0.2.11

package/dist/ward/allowance.js

@@ -5,7 +5,7 @@
 // is held to the ward's ceiling. The door reads it before anything is done
 // under it and refuses a budget already gone, as one silence like every other
 // refusal there. The sender bounds the whole of her ask to the same number,
-// and a wait that ran out is silence, never unreached.
+// and a wait that ran out is the word late, never silence and never unreached.
 //
 // Each ask is bounded on its own. The time an arriving call has left does not
 // bound the asks a being makes while answering it: attributing her onward ask
@@ -24,11 +24,22 @@ export const CEILING = { time: 300_000 };
 // is thirty seconds, silently, because the ceiling is not hers to know.
 // Asking for nothing at all is the default, which is the whole point.
 export function allow(wanted, ceiling = CEILING, base = DEFAULT) {
-    const whole = (n, fallback) => (typeof n === 'number' && Number.isFinite(n) && n > 0 ? Math.floor(n) : fallback);
+    // Floored first, then tested: a fraction of a millisecond is not a budget,
+    // and falls to the default like every other number that is not a positive
+    // whole one.
+    const whole = (n, fallback) => {
+        const w = typeof n === 'number' ? Math.floor(n) : NaN;
+        return Number.isFinite(w) && w > 0 ? w : fallback;
+    };
     return { time: Math.min(whole(wanted?.time, base.time), ceiling.time) };
 }
-// Whether a budget has anything left to spend. A door reads this on arrival.
-export const spent = (a) => !(a.time > 0);
+// Whether a budget has anything left to spend, and the one reader of it: the
+// door calls this on arrival and nothing else asks the question anywhere. A
+// time that is not a whole number above zero is not a budget that ran out, it
+// is no budget at all, and the door refuses both the same way, since a peer
+// learns nothing from the difference. `allow` never makes one, so only bytes
+// off the road ever carry one.
+export const spent = (a) => !(Number.isSafeInteger(a.time) && a.time > 0);
 // What a wait that ran out comes back as. Its own value, held by nobody
 // outside the ward, so no answer from any door can be mistaken for it.
 export const LATE = Symbol('late');

package/dist/ward/arithmetic.d.ts

@@ -17,6 +17,7 @@ export declare function sealingPair(seed: Uint8Array): Promise<Pair>;
 export declare function sign(message: Uint8Array, secret: Uint8Array): Promise<Uint8Array>;
 export declare function verify(message: Uint8Array, signature: Uint8Array, pk: Uint8Array): Promise<boolean>;
 export declare function agree(secret: Uint8Array, peerPk: Uint8Array): Promise<Uint8Array>;
+export declare function derive(secret: Uint8Array, label: Uint8Array, bytes: number): Promise<Uint8Array>;
 export declare function encrypt(shared: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): Promise<Uint8Array>;
 export declare function decrypt(shared: Uint8Array, ciphertext: Uint8Array, aad: Uint8Array): Promise<Uint8Array>;
 export declare function box(inside: Uint8Array, padlock: Uint8Array, seed: Uint8Array): Promise<{

package/dist/ward/arithmetic.js

@@ -8,7 +8,6 @@
 // runs on. `test/floor.test.ts` names the floor and probes for it. Subtle is
 // asynchronous, so everything here is.
 //
-// Ported from an earlier kit's arithmetic. Same bytes, same vectors.
 // `crypto.subtle` is read at every use and never captured at load. A browser
 // on a plain http:// origin has `crypto` without `subtle`, and a terrain may
 // install one after this module is first imported; a reference taken here
@@ -24,7 +23,7 @@ export const SIGNATURE = 64;
 export const NONCE = 12;
 export const TAG = 16;
 const SEAL_INFO = new TextEncoder().encode('quo-seal');
-const SEAL_SALT = new Uint8Array(0);
+const SALT = new Uint8Array(0);
 // A 32-byte secret plus a fixed prefix is the whole PKCS#8 wrapping for both curves.
 const ED_SECRET = unhex('302e020100300506032b657004220420');
 const X_SECRET = unhex('302e020100300506032b656e04220420');
@@ -60,7 +59,12 @@ export function sameBytes(a, b) {
         diff |= a[at] ^ b[at];
     return diff === 0;
 }
-// The eight small-order points. A public key among them verifies nothing.
+// The eight small-order points of Ed25519, in their canonical encoding. A
+// public key among them verifies nothing. An encoding whose y coordinate is
+// not reduced, y at or above the field's prime p, names one of the same
+// points under another spelling, and a terrain's verify may accept a zero
+// signature under it; the field has room for the spelling, so it is refused
+// before the list is read.
 const SMALL_ORDER = [
     '0100000000000000000000000000000000000000000000000000000000000000',
     'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
@@ -71,7 +75,11 @@ const SMALL_ORDER = [
     '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85',
     'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',
 ].map(unhex);
-export const smallOrder = (pk) => SMALL_ORDER.some((p) => sameBytes(p, pk));
+// y >= p, read little-endian with the sign bit masked off: the top byte is
+// 0x7f under the mask, every middle byte is 0xff, and the low byte is at
+// least 0xed, which is p's.
+const unreduced = (pk) => (pk[31] & 0x7f) === 0x7f && pk[0] >= 0xed && pk.subarray(1, 31).every((b) => b === 0xff);
+export const smallOrder = (pk) => unreduced(pk) || SMALL_ORDER.some((p) => sameBytes(p, pk));
 const key32 = (value, what) => {
     if (!(value instanceof Uint8Array) || value.length !== KEY)
         throw new Error(`${what} is not a 32-byte key`);
@@ -124,11 +132,19 @@ export async function agree(secret, peerPk) {
         throw new Error('dead agreement'); // a padlock that was not a real key
     return shared;
 }
+// HKDF-SHA-256: bytes from a secret, under a label that says what they are
+// for. No salt, because the secret handed in is already a secret of full
+// strength and the label is what keeps one use apart from another. Every
+// label in this kit is spelled where it is used, never here: this is
+// arithmetic and a label is a decision.
+export async function derive(secret, label, bytes) {
+    const material = await subtle().importKey('raw', secret, 'HKDF', false, ['deriveBits']);
+    return new Uint8Array(await subtle().deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: SALT, info: label }, material, bytes * 8));
+}
 // One HKDF-SHA-256 yields the AES key and the nonce together. The nonce needs
 // no randomness of its own: the key it pairs with is fresh on every message.
 async function cipherKey(shared, use) {
-    const material = await subtle().importKey('raw', shared, 'HKDF', false, ['deriveBits']);
-    const out = new Uint8Array(await subtle().deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: SEAL_SALT, info: SEAL_INFO }, material, (KEY + NONCE) * 8));
+    const out = await derive(shared, SEAL_INFO, KEY + NONCE);
     return { key: await subtle().importKey('raw', out.subarray(0, KEY), 'AES-GCM', false, [use]), nonce: out.subarray(KEY) };
 }
 // The additional authenticated data is the ephemeral public key: the one thing outside the seal, bound to it.

package/dist/ward/cells.d.ts

@@ -1,3 +1,5 @@
 import type { Cells } from '../being/types.ts';
+export declare const DEPTH = 64;
 export declare const cellFault: (v: unknown, path: string) => string | null;
-export declare const guardCells: (cells: Cells) => Cells;
+export declare const guardCells: (cells: Cells, wrote?: () => void) => Cells;
+export declare const unguarded: (cells: Cells) => Cells;

package/dist/ward/cells.js

@@ -1,6 +1,12 @@
+// How deep a value may nest. Every walk over a value in the kit recurses,
+// and a peer chooses the depth of what she answers; a bound keeps a hostile
+// reply from ending a walk in a stack overflow instead of a refusal.
+export const DEPTH = 64;
 // I-JSON, all the way down. A number that JSON cannot write is not a number
-// a harbor can keep, and a key on the prototype is not a key she wrote.
-function fault(v, path, seen) {
+// a harbor can keep, a key on the prototype is not a key she wrote, and a
+// hole in a list, or a key named `__proto__`, is a thing JSON writes one way
+// and a runtime reads another.
+function fault(v, path, seen, depth) {
     if (v === null || typeof v === 'boolean' || typeof v === 'string')
         return null;
     if (typeof v === 'number')
@@ -9,11 +15,15 @@ function fault(v, path, seen) {
         return `${path} is a ${typeof v}, which is not a value`;
     if (seen.has(v))
         return `${path} refers back to itself`;
+    if (depth >= DEPTH)
+        return `${path} is nested past ${DEPTH} levels, which no harbor can keep`;
     seen.add(v);
     try {
         if (Array.isArray(v)) {
             for (let i = 0; i < v.length; i += 1) {
-                const f = fault(v[i], `${path}[${i}]`, seen);
+                if (!(i in v))
+                    return `${path}[${i}] is a hole, which no harbor can write down`;
+                const f = fault(v[i], `${path}[${i}]`, seen, depth + 1);
                 if (f)
                     return f;
             }
@@ -23,7 +33,9 @@ function fault(v, path, seen) {
         if (proto !== Object.prototype && proto !== null)
             return `${path} is a ${(v).constructor?.name ?? 'object'}, which is not a value`;
         for (const k of Object.keys(v)) {
-            const f = fault(v[k], `${path}.${k}`, seen);
+            if (k === '__proto__')
+                return `${path}.__proto__ is a key no harbor can keep`;
+            const f = fault(v[k], `${path}.${k}`, seen, depth + 1);
             if (f)
                 return f;
         }
@@ -33,14 +45,44 @@ function fault(v, path, seen) {
         seen.delete(v);
     }
 }
-export const cellFault = (v, path) => fault(v, path, new Set());
+export const cellFault = (v, path) => fault(v, path, new Set(), 0);
+// The three keys at the root of her cells that are the ward's: it writes
+// them, she reads them, and a write of hers there is refused like a non-value.
+const WARDS = new Set(['standings', 'occupants', 'class']);
 // The guard is one proxy at the root and one for every container read through
 // it, so a write nested three deep is refused the same way a write at the top
 // is. Wrappers are remembered, so reading the same array twice is the same
 // object twice and a being may still compare what she holds.
 const wrapped = new WeakMap();
+const targets = new WeakMap();
 const guards = new WeakSet();
-function guard(target, path) {
+// A key a write may land on: a string that is not `__proto__`, and not one
+// of the ward's at the root. A symbol key is a thing JSON never writes.
+const refuse = (why) => {
+    throw new TypeError(`cells hold values: ${why}`);
+};
+function keyFault(t, k, v, path, root) {
+    if (typeof k !== 'string')
+        refuse(`${path} takes no symbol key`);
+    if (k === '__proto__')
+        refuse(`${path}.__proto__ is a key no harbor can keep`);
+    if (root && WARDS.has(k))
+        refuse(`${path}.${k} is the ward's to write`);
+    // A list grows by one at its end, or it has holes JSON cannot write. A
+    // push sets the slot at its length and then the length: both pass. A
+    // length set past what she wrote, or a slot beyond it, would leave holes.
+    if (Array.isArray(t)) {
+        if (k === 'length') {
+            if (typeof v !== 'number' || v > t.length)
+                refuse(`${path}.length set past what she wrote would leave holes`);
+            return;
+        }
+        const i = Number(k);
+        if (Number.isInteger(i) && i > t.length)
+            refuse(`${path}[${i}] would leave a hole`);
+    }
+}
+function guard(target, path, wrote, root = false) {
     if (guards.has(target))
         return target;
     const had = wrapped.get(target);
@@ -50,30 +92,46 @@ function guard(target, path) {
         get(t, k, r) {
             const v = Reflect.get(t, k, r);
             // A container reached through her cells is part of her cells.
-            return v !== null && typeof v === 'object' && !ArrayBuffer.isView(v) ? guard(v, `${path}.${String(k)}`) : v;
+            return v !== null && typeof v === 'object' && !ArrayBuffer.isView(v) ? guard(v, `${path}.${String(k)}`, wrote) : v;
         },
         set(t, k, v, r) {
-            if (typeof k === 'string') {
-                const f = cellFault(v, `${path}.${k}`);
-                if (f)
-                    throw new TypeError(`cells hold values: ${f}`);
-            }
-            return Reflect.set(t, k, v, r);
+            keyFault(t, k, v, path, root);
+            const f = cellFault(v, `${path}.${String(k)}`);
+            if (f)
+                refuse(f);
+            const ok = Reflect.set(t, k, v, r);
+            wrote();
+            return ok;
         },
         defineProperty(t, k, d) {
-            if (typeof k === 'string' && 'value' in d) {
-                const f = cellFault(d.value, `${path}.${k}`);
-                if (f)
-                    throw new TypeError(`cells hold values: ${f}`);
-            }
-            return Reflect.defineProperty(t, k, d);
+            if (!('value' in d))
+                refuse(`${path}.${String(k)} is an accessor, which no harbor can keep`);
+            keyFault(t, k, d.value, path, root);
+            const f = cellFault(d.value, `${path}.${String(k)}`);
+            if (f)
+                refuse(f);
+            const ok = Reflect.defineProperty(t, k, d);
+            wrote();
+            return ok;
+        },
+        deleteProperty(t, k) {
+            if (root && typeof k === 'string' && WARDS.has(k))
+                refuse(`${path}.${k} is the ward's to keep`);
+            const ok = Reflect.deleteProperty(t, k);
+            wrote();
+            return ok;
         },
     });
     wrapped.set(target, p);
+    targets.set(p, target);
     guards.add(p);
     return p;
 }
 // Her cells, guarded. Called once per being at boot; the guarded object is
 // what goes into the partition and what the stance hands her, so there is no
-// second door onto the same cells.
-export const guardCells = (cells) => guard(cells, 'cells');
+// second door onto the same cells. Every write that passes says so to the
+// ward, which says so to its harbor.
+export const guardCells = (cells, wrote = () => { }) => guard(cells, 'cells', wrote, true);
+// The cells behind the guard, for the ward alone: the one writer of the
+// three keys that are its own.
+export const unguarded = (cells) => (targets.get(cells) ?? cells);

package/dist/ward/door.d.ts

@@ -1,11 +1,11 @@
-import type { Asker, BeingLike, JsonObject } from '../being/types.ts';
+import type { Asker, BeingLike, JsonObject, OccupantRecord } from '../being/types.ts';
 import type { Heirs } from './heirs.ts';
 import { type ReplyPayload, type WardKey } from './seal.ts';
 export type Door = {
     key: string;
     being: BeingLike;
     cells: {
-        occupants: Record<string, unknown>;
+        occupants: Record<string, OccupantRecord>;
     };
 };
 export type Judged = {
@@ -13,4 +13,5 @@ export type Judged = {
     heard: boolean;
 };
 export declare function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload>;
+export declare function seen(door: Door, asker: Asker): Promise<string | null>;
 export declare function makeDoor(key: WardKey, heirs: Heirs, doors: Map<string, Door>, publicKey: () => string | null, random: (n: number) => Uint8Array): (bytes: Uint8Array) => Promise<Judged>;

package/dist/ward/door.js

@@ -13,6 +13,7 @@ import { at } from './partition.js';
 import { openAsk, sealReply, verifyAsk } from './seal.js';
 import { spent } from './allowance.js';
 import { KEY, sealingPair } from './arithmetic.js';
+import { cellFault } from './cells.js';
 const SILENCE = { silence: true };
 const said = (quo) => ({ quo });
 // One arrival at one being, already named. Catches every throw. `bound` says
@@ -34,13 +35,22 @@ export async function arrive(door, asker, method, args, bound) {
         return SILENCE;
     if (isWord(out))
         return threw; // a word is the ward's to say, never hers
+    // Her answer is held to the rule her args and her cells are held to. A
+    // shape JSON would drop or rewrite on the way out, a Date, a Map, a NaN, a
+    // cycle, is not hers to make: the far side would read something she never
+    // said, or the door itself would fail to write her reply after the number
+    // was spent. It is threw, like a word out of her.
+    if (cellFault(out, 'answer') !== null)
+        return threw;
     if (method === undefined)
         return { object: out, seen: null };
     // The digest rides along, it is not the answer. She has already answered:
     // a describe that will not run costs the digest, and nothing else.
     return { object: out, seen: await seen(door, asker) };
 }
-async function seen(door, asker) {
+// Her digest for this asker, or null when her describe threw or fell silent.
+// The owner's describe reads it the same way for every being of the ward.
+export async function seen(door, asker) {
     try {
         const bp = await door.being.answer(asker);
         return isSilence(bp) || isWord(bp) ? null : await digest(bp);
@@ -56,9 +66,10 @@ export function makeDoor(key, heirs, doors, publicKey, random) {
             return null; // D1. it did not open. there is nobody to answer.
         const { to, payload, ephemeralPk } = a;
         const refuse = () => ({ reply: SILENCE, ephemeralPk, heard: false });
-        // D2, the rest of it. The allowance is read before anything is done under
-        // it, and hops at zero is refused so that a relay chain invented later
-        // meets doors that already stop it. Nothing sets hops.
+        // D2. The allowance is read here, before anything is done under it, and
+        // here only: a time that is not a whole number above zero is malformed and
+        // is refused as one. Hops at zero is refused beside it, so that a relay
+        // chain invented later meets doors that already stop it. Nothing sets hops.
         if (spent({ time: payload.time }) || payload.hops === 0)
             return refuse();
         const args = payload.args ?? {};
@@ -70,7 +81,10 @@ export function makeDoor(key, heirs, doors, publicKey, random) {
             const pub = pk !== null ? doors.get(pk) : undefined;
             if (!pub || !(await verifyAsk(a, payload.by)))
                 return refuse();
-            return { reply: await arrive(pub, {}, payload.method, args, false), ephemeralPk, heard: true };
+            // She answers, and the bit stays false: no key this door holds spoke.
+            // The public being is the one place a stranger is answered by design,
+            // so it is the one place a harbor must still be able to rate her.
+            return { reply: await arrive(pub, {}, payload.method, args, false), ephemeralPk, heard: false };
         }
         const h = heirs.admits(to, payload.by);
         if (!h) {
@@ -83,6 +97,13 @@ export function makeDoor(key, heirs, doors, publicKey, random) {
         }
         if (!(await verifyAsk(a, payload.by)))
             return refuse(); // D7, under an admitted key
+        // The signature took time, and another arrival on this heir may have been
+        // honoured meanwhile: a knock that raced this one and won spent the heir,
+        // and the key this ask speaks under may not be admitted any more. The
+        // door judges concurrently, so admission is read again now that writing
+        // is next, and what changed under the await is judged as it stands.
+        if (!heirs.admits(to, payload.by))
+            return heirs.gone(to, payload.by) ? { reply: said('removed'), ephemeralPk, heard: true } : refuse();
         // From here the door has heard a key it holds. Every answer below is
         // sealed to that key's lid; nothing below is a stranger's.
         const door = doors.get(h.being);
@@ -102,18 +123,25 @@ export function makeDoor(key, heirs, doors, publicKey, random) {
     // reply is sealed to the ephemeral pk on its lid, which is all a stranger
     // holds, and says silence.
     //
-    // A lid that is not a key -- a small-order point, of which the two curves
-    // have several each -- makes a dead agreement, and the seal refuses it. The
-    // door never throws: that reply is noise, sealed to a key nobody holds.
+    // A lid that is not a key, a small-order point, of which the two curves
+    // have several each, makes a dead agreement, and the seal refuses it. The
+    // door never throws: that reply is noise, a plain silence sealed to a key
+    // nobody holds, and the same is written for anything else the seal will
+    // not take.
+    // `judge` reads rows it does not check: open() reads the partition's shape
+    // at birth, so a row it acts on is the shape it expects. That is the first
+    // line and this is the second, because "the door never throws" is a promise
+    // to the harbor, which has nobody to hand a rejection to and would count it
+    // as no answer at all. Anything unforeseen is the silence a stranger hears.
     return async function door(bytes) {
-        const out = await judge(bytes);
+        const out = await judge(bytes).catch(() => null);
         const reply = out?.reply ?? SILENCE;
         const heard = out?.heard ?? false;
         try {
             return { bytes: await sealReply(reply, out?.ephemeralPk ?? lid(bytes, random), key.sign, random(32)), heard };
         }
         catch {
-            return { bytes: await sealReply(reply, (await sealingPair(random(32))).pk, key.sign, random(32)), heard };
+            return { bytes: await sealReply(SILENCE, (await sealingPair(random(32))).pk, key.sign, random(32)), heard };
         }
     };
 }

package/dist/ward/ground.d.ts

@@ -1,8 +1,9 @@
-import type { Stance, BeingLike } from '../being/types.ts';
+import type { Stance, BeingLike, BeingClass } from '../being/types.ts';
 export type Ground = {
     seed: string | Uint8Array;
     memory: Record<string, unknown>;
     instantiate(className: string, stance: Stance): BeingLike | null;
+    wrote?: () => void;
     carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
     random(n: number): Uint8Array;
 };
@@ -13,3 +14,6 @@ export type WardPointers = {
     }>;
     ask(method?: string, args?: Record<string, unknown>): Promise<unknown>;
 };
+export declare const maker: (objects: WeakMap<object, BeingLike>, ...registries: (Record<string, BeingClass> | undefined)[]) => Ground['instantiate'];
+export declare const entropy: (n: number) => Uint8Array;
+export declare function learnPk(w: WardPointers): Promise<string>;

package/dist/ward/ground.js

@@ -1 +1,38 @@
-export {};
+// ---- what every harbor builds a ground out of. Three pieces, because every
+// harbor in this tree writes the same three and the spec keeps the harbors
+// themselves apart: what a memory harbor and a real one differ on is the
+// route and the store, and nothing here. A second kit writes its own harbor
+// and may write these again; they are convenience, never contract.
+// The code half of a ground, and the map back to what it made. A class is
+// found by own key only, since `constructor` is a name Object lends every
+// registry, and the first registry holding the name wins, so a ward's own
+// classes stand in front of the harbor's. The object is remembered by the
+// cells the ward handed in, which is how a side reaches a being it made and
+// how that hand follows her out when she is unbooted.
+export const maker = (objects, ...registries) => (className, stance) => {
+    const r = registries.find((reg) => reg !== undefined && Object.hasOwn(reg, className));
+    const C = r?.[className];
+    if (!C)
+        return null;
+    const obj = new C(stance);
+    objects.set(stance.cells, obj);
+    return obj;
+};
+// Entropy, from the one place every terrain that runs Quo has it. Every key a
+// ward mints is drawn from this, so a harbor that wants another source hands
+// its own and nothing here has to know.
+export const entropy = (n) => globalThis.crypto.getRandomValues(new Uint8Array(n));
+// A ward's pk, learned the way anyone learns anything: by asking. The empty
+// ask on the ask pointer is the ward's own describe and its notes carry the
+// pk. A harbor has no other way to it and wants none: the ward mints it from
+// the seed, and a harbor that read it off the seed itself would be a second
+// derivation to keep in step with the first. A ward that answers anything
+// else is not one this harbor can route to, and says so here rather than
+// leaving an undefined pk in a directory.
+export async function learnPk(w) {
+    const notes = (await w.ask());
+    const pk = notes?.notes?.pk;
+    if (typeof pk !== 'string')
+        throw new Error('the ward did not say its pk');
+    return pk;
+}

package/dist/ward/heirs.d.ts

@@ -2,13 +2,12 @@ import type { DoorWord } from '../being/types.ts';
 import { type Heir, type Partition } from './partition.ts';
 export declare class Heirs {
     #private;
-    constructor(p: Partition);
+    constructor(p: Partition, wrote?: () => void);
     open(heir: string, being: string, id: string): void;
     close(heir: string): void;
     gone(heir: string, by: string): boolean;
-    get(heir: string): Heir | undefined;
     admits(heir: string, by: string): Heir | null;
     spend(h: Heir, seq: number): boolean;
     honour(h: Heir, by: string, next: string | null, seq: number): true | DoorWord;
-    settle(h: Heir, by: string, next: string | null): boolean;
+    settle(h: Heir, by: string, next: string | null): void;
 }

package/dist/ward/heirs.js

@@ -4,11 +4,14 @@ import { GONE } from './partition.js';
 const SPAN = 64;
 export class Heirs {
     #p;
-    constructor(p) {
+    #wrote;
+    constructor(p, wrote = () => { }) {
         this.#p = p;
+        this.#wrote = wrote;
     }
     open(heir, being, id) {
         this.#p.heirs[heir] = { being, id, current: heir, announced: null, fresh: true, mark: 0, spent: [] };
+        this.#wrote();
     }
     // The id was removed. The heir is forgotten, and its last keys are kept
     // apart, bounded, so that whoever still holds them hears `removed` at the
@@ -22,6 +25,7 @@ export class Heirs {
         const keys = Object.keys(this.#p.gone);
         for (const old of keys.slice(0, Math.max(0, keys.length - GONE)))
             delete this.#p.gone[old];
+        this.#wrote();
     }
     // May `by` speak for a relation she removed? True only for the keys the
     // door held when the id went, which nobody but their holder has.
@@ -29,9 +33,6 @@ export class Heirs {
         const g = this.#p.gone[heir];
         return !!g && (by === g.current || by === g.announced);
     }
-    get(heir) {
-        return this.#p.heirs[heir];
-    }
     // May `by` speak for this heir? Returns the record if so, null if not.
     // Does not write: the caller verifies the signature first, then settles.
     admits(heir, by) {
@@ -75,28 +76,33 @@ export class Heirs {
     // neither: a call that binds nothing must not burn a number on its way to
     // being refused, or a stranger who cannot be heard would still leave a mark
     // behind her. Every write below this line is one that is going to hold.
+    // This is where a knock is judged and where `unannounced` is said. settle
+    // below is the writing alone, and it judges nothing: one owner for the
+    // question, one for the answer.
     honour(h, by, next, seq) {
-        if (h.fresh && next === null)
-            return 'unannounced'; // a knock without a key of her own binds nothing
+        if (h.fresh && (next === null || next === h.current))
+            return 'unannounced'; // a knock without a key of her own binds nothing, and the heir is not a key of her own
         if (!this.spend(h, seq))
             return 'repeated';
-        return this.settle(h, by, next) ? true : 'unannounced';
+        this.settle(h, by, next);
+        this.#wrote(); // the number and the keys moved together
+        return true;
     }
-    // The signature checked out. Settle the keys: a fresh heir rotates at once
-    // to what it announced and must announce something; a current key replaces
-    // its announcement; an announced key becomes current.
+    // The signature checked out and honour has judged. Settle the keys: a fresh
+    // heir rotates at once to what it announced, which honour has already held
+    // to being something other than itself, so that the heir dies as it speaks;
+    // a current key replaces its announcement; an announced key becomes current.
     settle(h, by, next) {
         if (h.fresh) {
             if (next === null)
-                return false; // a knock without a key of her own binds nothing
+                return; // honour judged this. the compiler has not read it, so the narrowing stays.
             h.current = next;
             h.announced = null;
             h.fresh = false;
-            return true;
+            return;
         }
         if (by === h.announced)
             h.current = by;
         h.announced = next;
-        return true;
     }
 }

package/dist/ward/index.d.ts

@@ -1,6 +1,7 @@
 export { Ward } from './ward.ts';
 export type { Ground, WardPointers } from './ground.ts';
 export type { Partition, Heir, Bind, StandingKeys } from './partition.ts';
+export { GONE, MINTED } from './partition.ts';
 export type { AskPayload, ReplyPayload } from './seal.ts';
 export * as seal from './seal.ts';
 export * as arithmetic from './arithmetic.ts';

package/dist/ward/index.js

@@ -1,6 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 // @quo-systems/quo/ward — one function. Every ward is the same ward.
 export { Ward } from './ward.js';
+// The two bounds on what a partition may hold, for a kit that must keep the
+// same ones and for a test that pins them.
+export { GONE, MINTED } from './partition.js';
 // The seal and the arithmetic, for a kit in another language to check its
 // bytes against, and for tests that speak to a door directly.
 export * as seal from './seal.js';

package/dist/ward/owner.d.ts

@@ -1,34 +1,13 @@
-import type { Ask, Asker, Invitation, Json, JsonObject, Wanted } from '../being/types.ts';
+import type { Ask, Asker, Json, JsonObject } from '../being/types.ts';
+import type { Resident } from './ward.ts';
 export type OwnerSide = {
     pk: string;
-    doors: Map<string, {
-        key: string;
-        being: {
-            answer: (...a: never[]) => unknown;
-        };
-        cells: {
-            class?: string;
-            occupants: Record<string, unknown>;
-            standings: Record<string, unknown>;
-        };
-        stance: {
-            occupants: {
-                invite(id: string): Promise<Invitation | null>;
-                remove(id: string): void;
-            };
-            standings: {
-                knock(inv: Invitation, m?: string, a?: JsonObject, w?: Wanted): Promise<unknown>;
-                take(id: string, inv: Invitation): Promise<string | null>;
-                remove(id: string): void;
-            };
-        };
-    }>;
+    doors: Map<string, Resident>;
+    absent(): Record<string, string | null>;
     publicKey(): string | null;
-    instantiate(key: string, className: string): {
-        key: string;
-    } | null;
+    instantiate(className: string, key: string): Resident | 'threw' | null;
     unboot(key: string): string[] | null;
-    setPublic(key: string): void;
+    setPublic(key: string | null): void;
 };
 export declare const OWNER_ASKS: Ask[];
 export declare function ownerAnswer(w: OwnerSide, asker: Asker, method: string | undefined, args: JsonObject): Promise<Json>;