@quo-systems/quo 0.2.9 → 0.2.11

package/dist/ward/ward.js

@@ -6,7 +6,7 @@
 // leaves, opens every one that arrives.
 import { silence, isSilence, unreached, isWord, word } from '../being/silence.js';
 import { OWNER } from '../being/types.js';
-import { at, drop, open, put, emptyBind, emptyCells } from './partition.js';
+import { at, drop, open, put, emptyBind, emptyCells, MINTED } from './partition.js';
 import { Heirs } from './heirs.js';
 import { makeDoor } from './door.js';
 import { buildStance } from './stance.js';
@@ -14,9 +14,7 @@ import { ownerAnswer } from './owner.js';
 import { allow, within, LATE } from './allowance.js';
 import { beingKey, openReply, sealAsk, wardKey, wardPadlock, wardSignPk } from './seal.js';
 import { unhex } from './arithmetic.js';
-import { guardCells, cellFault } from './cells.js';
-// How many minted pks she keeps behind her. Enough to name the keys in play.
-const MINTED = 8;
+import { guardCells, unguarded, cellFault } from './cells.js';
 // The ward. One call in, two pointers out. Async because keys are derived.
 export async function Ward(ground) {
     const w = await Self.boot(ground);
@@ -29,6 +27,7 @@ class Self {
     p;
     heirs;
     doors = new Map();
+    #birthing = new Set(); // keys whose constructor is running: taken, though no door and no row say so yet
     door;
     ask;
     static async boot(ground) {
@@ -38,24 +37,26 @@ class Self {
         this.g = ground;
         this.key = key;
         this.pk = key.pk;
-        this.p = open(ground.memory); // the partition IS the ward's cells
-        this.heirs = new Heirs(this.p);
+        this.p = open(ground.memory); // the partition: the ward's own state, and every being's row
+        this.heirs = new Heirs(this.p, () => this.#wrote());
         this.door = makeDoor(key, this.heirs, this.doors, () => this.p.public, (n) => ground.random(n)); // pointer one
-        this.#boot(this.pk, this); // the ward's ward is itself
+        this.#boot(this.pk, () => this); // the ward's ward is itself
         // a restart is silent: every being in the cells is constructed again, unasked.
-        // A throw on a boot the owner asked for is that boot's answer: silence,
-        // and nothing half-lives. This boot nobody asked for, and there is nobody
-        // to hand a silence to. Any constructor may throw — a default that is not
-        // a value, an author's mistake, a shape she no longer recognises after an
-        // upgrade — and let through here it is one being taking down the ward and
-        // every other being in it, on a restart. She is absent instead: no door,
-        // so silence at the door, and her cells sit untouched, waiting for the
-        // run that can read them.
+        // A throw on a boot the owner asked for is that boot's error, and nothing
+        // half-lives. This boot nobody asked for, and there is nobody to hand an
+        // error to. Any constructor may throw, a default that is not a value, an
+        // author's mistake, a shape she does not recognise after an upgrade, and
+        // let through here it is one being taking down the ward and every other
+        // being in it, on a restart. She is absent instead: no door, so silence
+        // at the door, and her cells sit untouched, waiting for the run that can
+        // read them. Her row stays hers: nobody boots another class over it, the
+        // owner sees her as absent, and the owner may unboot her.
         for (const [k, c] of Object.entries(this.p.beings)) {
-            if (k === this.pk || !c.class)
+            const className = c.class;
+            if (k === this.pk || !className)
                 continue;
             try {
-                this.#instantiate(k, c.class);
+                this.#boot(k, (stance) => this.g.instantiate(className, stance));
             }
             catch {
                 /* she is not here this run. the ward is, and so is everyone else. */
@@ -77,25 +78,68 @@ class Self {
     // can invite. A stranger cannot be a named asker here, because the door
     // names nobody the ward did not bind.
     async answer(asker, method, args = {}) {
+        // Nobody is not an owner. The door names nobody the ward did not bind, so
+        // the only way here unnamed is a partition that says the ward is its own
+        // public being, which no owner ask will write. Silence, not an error
+        // object: an unnamed asker is a stranger, and a stranger hears one thing.
         if (asker.id === undefined)
-            return { error: 'unknown ask' };
+            return silence;
         return ownerAnswer({
             pk: this.pk,
             doors: this.doors,
+            absent: () => this.#absent(),
             publicKey: () => this.p.public,
-            instantiate: (key, className) => this.#instantiate(key, className),
+            instantiate: (className, key) => this.#instantiate(className, key),
             unboot: (key) => this.#unboot(key),
-            setPublic: (key) => void (this.p.public = key),
+            setPublic: (key) => {
+                this.p.public = key;
+                this.#wrote();
+            },
         }, asker, method, args);
     }
     // ---- ward functions. on the object. no stance reaches them.
-    #instantiate(key, className) {
-        if (!key || this.doors.has(key))
+    // The partition was written. The harbor is told, and nothing more: what it
+    // does with the word is its own, and the ward never learns.
+    #wrote() {
+        this.g.wrote?.();
+    }
+    // The rows no door holds this run: beings whose class threw at birth or
+    // is not the harbor's to give. Key to class.
+    #absent() {
+        const out = {};
+        for (const [k, c] of Object.entries(this.p.beings))
+            if (k !== this.pk && !this.doors.has(k))
+                put(out, k, c.class ?? null);
+        return out;
+    }
+    // A new being under a key nobody holds. A key with a row in the partition
+    // is booted, whether a door holds it this run or not: an absent being's
+    // row is hers, with every relation in it, and no class is booted over it.
+    // A throw at birth is that boot's refusal and nothing half-lives; the
+    // ward says which, since the owner hears objects.
+    #instantiate(className, key) {
+        // The three refusals are read before the constructor runs, and the
+        // constructor can reach the stance and boot: a class that boots its own
+        // key from inside itself would pass all three, since neither its door nor
+        // its row exists yet, and the two objects would then share one row. A key
+        // being born is a key taken, for as long as the birth lasts.
+        if (typeof key !== 'string' || typeof className !== 'string' || !key || this.doors.has(key) || at(this.p.beings, key) || this.#birthing.has(key))
             return null;
-        const door = this.#boot(key, className);
+        let door;
+        this.#birthing.add(key);
+        try {
+            door = this.#boot(key, (stance) => this.g.instantiate(className, stance));
+        }
+        catch {
+            return 'threw';
+        }
+        finally {
+            this.#birthing.delete(key);
+        }
         if (!door)
             return null;
-        door.cells.class = className; // so a restart finds her
+        unguarded(door.cells).class = className; // so a restart finds her. the ward's key, written behind her guard
+        this.#wrote();
         return door;
     }
     // The inverse of boot, and the only way a being leaves a ward. Her
@@ -104,16 +148,28 @@ class Self {
     // rather than meeting a being who is simply not there any more. What is
     // left after that is her cells and her bind table, and they go with her:
     // a row naming a being no door holds would be read on the next restart
-    // and boot her again.
+    // and boot her again. An absent being leaves the same way: she has no
+    // stance to speak for her, so the ward closes her heirs itself.
     #unboot(key) {
+        if (key === this.pk)
+            return null;
         const door = this.doors.get(key);
-        if (!door || key === this.pk)
+        const cells = door?.cells ?? at(this.p.beings, key);
+        if (!cells)
             return null;
-        const occupants = Object.keys(door.cells.occupants), standings = Object.keys(door.cells.standings);
-        for (const id of occupants)
-            door.stance.occupants.remove(id);
-        for (const id of standings)
-            door.stance.standings.remove(id);
+        const ids = (r) => (r !== null && typeof r === 'object' ? Object.keys(r) : []);
+        const occupants = ids(cells.occupants), standings = ids(cells.standings);
+        if (door) {
+            for (const id of occupants)
+                door.stance.occupants.remove(id);
+            for (const id of standings)
+                door.stance.standings.remove(id);
+        }
+        else {
+            const bind = at(this.p.bind, key);
+            for (const heir of Object.values(bind?.occupants ?? {}))
+                this.heirs.close(heir);
+        }
         // A ward whose public being is gone answers arrivals for no heir with
         // silence, as a ward that never had one does.
         if (this.p.public === key)
@@ -121,38 +177,49 @@ class Self {
         drop(this.p.beings, key);
         drop(this.p.bind, key);
         this.doors.delete(key);
+        this.#wrote();
         return [...occupants, ...standings];
     }
     // Nothing is written until there is somebody to write it for: a class the
     // harbor does not know makes no being, and a boot that made nobody must
     // leave the partition as it found it.
-    #boot(key, classNameOrSelf) {
-        const cells = guardCells(at(this.p.beings, key) ?? emptyCells());
+    //
+    // `make` is who to build with the stance this raises. Two callers and two
+    // makers: the ground's `instantiate` for a being of the ward, and the ward
+    // itself, which is the first being in its own map and is already made.
+    #boot(key, make) {
+        const cells = guardCells(at(this.p.beings, key) ?? emptyCells(), () => this.#wrote());
         const bind = at(this.p.bind, key) ?? emptyBind();
         const stance = buildStance({
             pk: this.pk,
+            // This stance, not merely this key: unboot and boot again under the
+            // same key makes a new being, and the old stance is not hers.
+            live: () => this.doors.get(key)?.stance === stance,
             mintKey: (b) => this.#mintKey(b),
             openHeir: (heir, being, id) => this.heirs.open(heir, being, id),
             closeHeir: (heir) => this.heirs.close(heir),
-            send: (b, keys, announce, method, args, wanted) => this.#send(b, keys, announce, method, args, wanted),
+            send: (b, keys, method, args, wanted) => this.#send(b, keys, method, args, wanted),
             // A throw at birth is null to her, not a throw in her method: she asked
             // for a being and got none, and her own answer is still hers to give.
-            instantiate: (k, className) => {
-                try {
-                    return this.#instantiate(k, className)?.key ?? null;
-                }
-                catch {
-                    return null;
-                }
+            instantiate: (className, k) => {
+                const made = this.#instantiate(className, k);
+                return made && made !== 'threw' ? made.key : null;
             },
+            // The two halves of a maker's way back, each the ward's own call: the
+            // being made mints an occupant for her maker, and a relation that
+            // never came about takes her out again.
+            relate: async (k, id) => (await this.doors.get(k)?.stance.occupants.invite(id)) ?? null,
+            unmake: (k) => void this.#unboot(k),
+            wrote: () => this.#wrote(),
         }, key, cells, bind);
-        const being = classNameOrSelf === this ? this : this.g.instantiate(classNameOrSelf, stance);
-        if (!being)
-            return null;
+        const being = make(stance);
+        if (!being || typeof being.answer !== 'function')
+            return null; // a being is anything with an answer, and nothing without one
         put(this.p.beings, key, cells);
         put(this.p.bind, key, bind);
         const door = { key, cells, bind, stance, being };
         this.doors.set(key, door);
+        this.#wrote();
         return door;
     }
     async #mintKey(bind) {
@@ -164,6 +231,7 @@ class Self {
         bind.minted.push(k.pk);
         if (bind.minted.length > MINTED)
             bind.minted.splice(0, bind.minted.length - MINTED);
+        this.#wrote();
         return k;
     }
     // One send for every door, the ward's own included. Mine: never leaves.
@@ -171,7 +239,7 @@ class Self {
     // next, seals to the far ward, opens the reply with the ephemeral secret,
     // and rotates to the announced key once the far door has answered under
     // the current one.
-    async #send(bind, keys, announce, method, args, wanted) {
+    async #send(bind, keys, method, args, wanted) {
         // What she asked for, held to what this ward allows. Asking for nothing is
         // the default, and asking for more than the ceiling is the ceiling: budget
         // is granted by a ward, never minted by a being.
@@ -179,8 +247,9 @@ class Self {
         const by = (await beingKey(unhex(keys.current))).pk;
         // A public being is reached without a heir, and the door keeps nothing for
         // whoever asked: no key it vouched for, so nothing to announce and nothing
-        // to rotate to. A standing on her signs with one key for life.
-        if (announce && keys.next === null && keys.heir !== null)
+        // to rotate to. A standing on her signs with one key for life. Every other
+        // ask announces its next: there is no send that does not.
+        if (keys.next === null && keys.heir !== null)
             keys.next = (await this.#mintKey(bind)).seed;
         const next = keys.next === null ? null : (await beingKey(unhex(keys.next))).pk;
         // Her count for this relation, one higher every call and never reused. The
@@ -190,10 +259,12 @@ class Self {
         // Args that will not go through the seal are args that never left. A
         // being holds three answers and a throw is not one of them, so an ask
         // that cannot be sealed is told what is true of it: no door was reached.
-        // Values only, by the same rule her cells keep: a Date would arrive as a
-        // string, a function would not arrive at all, and she would never know
-        // the far being was asked something other than what she said.
-        if (cellFault(args, 'args') !== null)
+        // One object of values, by the rule her cells keep and the far door
+        // reads: a Date would arrive as a string, a function would not arrive at
+        // all, a list or a string would be refused as a stranger's bytes, and
+        // she would never know the far being was asked something other than
+        // what she said.
+        if (args === null || typeof args !== 'object' || Array.isArray(args) || cellFault(args, 'args') !== null)
             return unreached();
         let sealed;
         try {
@@ -227,6 +298,7 @@ class Self {
             keys.current = keys.next; // the far door holds `next` as announced. move to it.
             keys.next = null;
         }
+        this.#wrote(); // the count moved, and the keys may have
         return reply;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quo-systems/quo",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "Quo: an object asks another object and gets an answer, without knowing where it is. Being, Ward, Harbor.",
   "keywords": [
     "quo",
@@ -33,7 +33,9 @@
     "./conformance": {
       "types": "./dist/conformance/index.d.ts",
       "default": "./dist/conformance/index.js"
-    }
+    },
+    "./vectors/*": "./vectors/*",
+    "./package.json": "./package.json"
   },
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json",

package/src/being/being.ts

@@ -18,11 +18,30 @@ export type AskSpec = {
 // Names a subclass may not use for an ask, because they are the base's own.
 const RESERVED = new Set(['answer', 'describe', 'stance', 'cells', 'standings', 'occupants', 'occupant', 'invite', 'knock', 'take', 'boot', 'constructor']);
 
+// Whether she has a method of that name, written on her own prototype chain
+// below Object's. A name Object lends every object, `hasOwnProperty` or
+// `toString`, is not a method she wrote; and a field she assigns in her own
+// constructor is not there yet when the base checks, so an ask is a method
+// on the prototype and nothing else.
+const method = (self: object, name: string): boolean => {
+  for (let p = Object.getPrototypeOf(self); p !== null && p !== Object.prototype; p = Object.getPrototypeOf(p)) {
+    if (Object.hasOwn(p, name)) return typeof (p as Record<string, unknown>)[name] === 'function';
+  }
+  return false;
+};
+
+// Both statics below are read off the class the object was made from, so a
+// subclass declaring either replaces its parent's rather than adding to it.
+// That is the rule: her blueprint is exactly what the class in front of you
+// declares, in the order she chose, and merging down a chain would hand her
+// asks she may mean to drop and an order she did not write. A subclass that
+// means to extend says so, `static override asks = { ...Parent.asks, mine: {} }`.
 export class Being {
   // Her cells' defaults. Merged in at birth, only where a key is missing, so
   // a restart keeps what she wrote.
   static cells: JsonObject = {};
-  // What she can be asked. Declaration order is blueprint order.
+  // What she can be asked. Declaration order is blueprint order, except a
+  // name that reads as an array index, which the language lists first.
   static asks: Record<string, AskSpec> = {};
 
   readonly stance: Stance;
@@ -32,9 +51,11 @@ export class Being {
     const C = this.constructor as typeof Being;
     for (const name of Object.keys(C.asks)) {
       if (RESERVED.has(name)) throw new Error(`ask '${name}' is a reserved name`);
-      if (typeof (this as unknown as Record<string, unknown>)[name] !== 'function') throw new Error(`ask '${name}' has no method`);
+      if (!method(this, name)) throw new Error(`ask '${name}' has no method on the prototype`);
     }
-    for (const [k, v] of Object.entries(C.cells)) if (!(k in stance.cells)) stance.cells[k] = structuredClone(v);
+    // Own keys only: a default named after a member of Object's prototype is
+    // still hers, and still missing until she writes it.
+    for (const [k, v] of Object.entries(C.cells)) if (!Object.hasOwn(stance.cells, k)) stance.cells[k] = structuredClone(v);
   }
 
   get cells(): Cells {
@@ -46,8 +67,8 @@ export class Being {
   get occupants(): Occupants {
     return this.stance.occupants;
   }
-  invite(id: string): Promise<Invitation | null> {
-    return this.stance.occupants.invite(id);
+  invite(id: string, notes?: JsonObject): Promise<Invitation | null> {
+    return this.stance.occupants.invite(id, notes);
   }
   knock(invitation: Invitation, method?: string, args?: JsonObject, wanted?: Wanted): Promise<Answer> {
     return this.stance.standings.knock(invitation, method, args, wanted);
@@ -55,13 +76,14 @@ export class Being {
   take(id: string, invitation: Invitation): Promise<string | null> {
     return this.stance.standings.take(id, invitation);
   }
-  // A new being of her ward, by class name, under a key she chooses.
-  boot(className: string, key: string): string | null {
-    return this.stance.boot(className, key);
+  // A new being of her ward, by class name, under a key she chooses. With an
+  // id, she holds a standing to the being she made, who knows her by her key.
+  boot(className: string, key: string, id?: string): Promise<string | null> {
+    return this.stance.boot(className, key, id);
   }
   // The occupant record for whoever is at the door. Undefined at a public being.
   occupant(asker: Asker): OccupantRecord | undefined {
-    return asker.id === undefined ? undefined : this.cells.occupants[asker.id];
+    return asker.id !== undefined && Object.hasOwn(this.cells.occupants, asker.id) ? this.cells.occupants[asker.id] : undefined;
   }
 
   // Her blueprint for this asker. Override to shape it by hand.
@@ -87,8 +109,8 @@ export class Being {
     // lookup would also find every name on Object's prototype: `valueOf`
     // would answer with her stance, `toString` with a string, and neither is
     // an ask she wrote. Only her own keys are asks, which is what describe
-    // has always shown. What she shows is what she can be asked.
-    const spec = typeof method === 'string' && Object.hasOwn(C.asks, method) ? C.asks[method] : undefined;
+    // shows. What she shows is what she can be asked.
+    const spec = Object.hasOwn(C.asks, method) ? C.asks[method] : undefined;
     if (!spec || (spec.for && !spec.for(this.occupant(asker), asker))) return { error: 'unknown ask' };
     const fn = (this as unknown as Record<string, (args: JsonObject, asker: Asker) => Reply | Promise<Reply>>)[method];
     return fn.call(this, args ?? {}, asker);

package/src/being/digest.ts

@@ -12,20 +12,35 @@ import type { Json } from './types.ts';
 const absent = (v: unknown): boolean => v === undefined || typeof v === 'function' || typeof v === 'symbol';
 
 // JCS for I-JSON values: sorted keys, no whitespace, JSON escaping. Numbers
-// are serialized as ES does, which is what RFC 8785 specifies.
-export const canonical = (v: Json): string =>
-  Array.isArray(v)
-    ? `[${v.map((slot) => (absent(slot) ? 'null' : canonical(slot))).join(',')}]`
-    : v !== null && typeof v === 'object'
-      ? `{${Object.keys(v)
-          .filter((k) => !absent(v[k]))
-          .sort()
-          .map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`)
-          .join(',')}}`
-      : JSON.stringify(v);
+// are serialized as ES does, which is what RFC 8785 specifies. A hole in a
+// list is null, as JSON writes it.
+export const canonical = (v: Json): string => {
+  if (Array.isArray(v)) return `[${Array.from(v, (slot) => (absent(slot) ? 'null' : canonical(slot))).join(',')}]`;
+  if (v !== null && typeof v === 'object') {
+    return `{${Object.keys(v)
+      .filter((k) => !absent(v[k]))
+      .sort()
+      .map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`)
+      .join(',')}}`;
+  }
+  return JSON.stringify(v);
+};
 
+// Hex and the guard are spelled here and again in `src/ward/arithmetic.ts`,
+// which is the price of the boundary: nothing under `src/being` imports
+// anything above it, because this is the whole world a being's own code sees
+// and a being reaching the ward is the thing the shape is against.
 const hex = (bytes: ArrayBuffer): string =>
   Array.from(new Uint8Array(bytes), (b) => b.toString(16).padStart(2, '0')).join('');
 
-export const digest = async (blueprint: Json): Promise<string> =>
-  hex(await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(canonical(blueprint))));
+// `crypto.subtle` is read at the call and never captured at load. A browser
+// on a plain http:// origin has `crypto` without `subtle`, and a terrain may
+// install one after this module is first imported; either way the failure is
+// one sentence and not a TypeError from inside a digest nobody can read.
+const subtle = (): SubtleCrypto => {
+  const s = globalThis.crypto?.subtle;
+  if (!s) throw new Error('this terrain has no crypto.subtle: a being needs a secure context to be described');
+  return s;
+};
+
+export const digest = async (blueprint: Json): Promise<string> => hex(await subtle().digest('SHA-256', new TextEncoder().encode(canonical(blueprint))));

package/src/being/index.ts

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // @quo-systems/quo — the Being side. What a being author imports, if anything.
 export { Being, type AskSpec } from './being.ts';
-export { silence, isSilence, unreached, isUnreached, word, isWord, wordOf, DOOR_WORDS, isDoorWord } from './silence.ts';
+export { silence, isSilence, answered, unreached, isUnreached, word, isWord, wordOf, told, DOOR_WORDS, isDoorWord } from './silence.ts';
 export { digest, canonical } from './digest.ts';
-export { OWNER, PUBLIC, RESERVED_IDS } from './types.ts';
+export { OWNER, PUBLIC, RESERVED_IDS, isBlueprint, invitationArgs } from './types.ts';
 export type * from './types.ts';

package/src/being/silence.ts

@@ -25,6 +25,20 @@ export const word = <W extends WordName>(name: W): Word<W> => {
 export const isWord = (x: unknown): x is Word => x !== null && typeof x === 'object' && typeof (x as Record<symbol, unknown>)[WORD_KEY] === 'string';
 export const wordOf = (x: Word): WordName => x[WORD_KEY];
 
+// What came back is an answer and not one of the two things that are not
+// answers. A being who only wants the object writes one test instead of
+// three, and the three shapes stay three shapes: silence is no answer, a word
+// is her ward telling her why there is none.
+export const answered = <T>(x: T): x is Exclude<T, typeof silence | Word> => !isSilence(x) && !isWord(x);
+
+// What she was told, with a word given its name and everything else left
+// exactly as it came. One value to compare against, so asking which word came
+// back is one test and not two joined by an and: `told(out) === 'late'` says
+// what `isWord(out) && wordOf(out) === 'late'` says, and says which answer
+// arrived instead when it is wrong, where the pair collapses to false and
+// names nothing. Silence stays the symbol it is, and an object stays itself.
+export const told = (x: unknown): unknown => (isWord(x) ? wordOf(x) : x);
+
 // Unreached: no far door was reached. Nothing is known to have been
 // delivered, so asking again is safe. A being cannot produce it: a ward that
 // sees a word come out of a being reads it as her having thrown.

package/src/being/types.ts

@@ -30,11 +30,36 @@ export const RESERVED_IDS: readonly string[] = [OWNER, PUBLIC];
 // and the heir's secret. Without a heir it addresses a ward's public being.
 export type Invitation = { ward: string; heir?: string; secret?: string };
 
+// An invitation as one object of values, which is what it already is. A being
+// who hands one on sends it as args, and args are values; this is the one
+// place that is spelled, so nobody spells it with a cast. Absent stays absent:
+// an invitation to a public being carries no heir and no secret, and a key
+// present and undefined is not the same object once JSON has been through it.
+export const invitationArgs = (inv: Invitation): JsonObject => ({
+  ward: inv.ward,
+  ...(inv.heir !== undefined ? { heir: inv.heir } : {}),
+  ...(inv.secret !== undefined ? { secret: inv.secret } : {}),
+});
+
 // A blueprint is an MCP tool list plus notes.
 export type Schema = JsonObject;
 export type Ask = { name: string; description?: string; input: Schema; output?: Schema };
 export type Blueprint = { asks: Ask[]; notes: Json };
 
+// Whether what came back from an empty ask is a blueprint. Every describe on
+// the far side of a door is somebody else's code, so nothing may be written
+// into a standing's record as a blueprint without being read as one first: a
+// side walks `asks` by name, and a list of anything else, or no list at all,
+// is a side that breaks on a far ward's answer. The asks are checked to the
+// depth a side reads them, a name and an input each, and no further: what a
+// far being puts beside those is hers.
+export const isBlueprint = (v: unknown): v is Blueprint => {
+  if (v === null || typeof v !== 'object' || Array.isArray(v)) return false;
+  const { asks, notes } = v as { asks?: unknown; notes?: unknown };
+  if (!Array.isArray(asks) || notes === undefined) return false;
+  return asks.every((a) => a !== null && typeof a === 'object' && !Array.isArray(a) && typeof (a as Ask).name === 'string' && (a as Ask).input !== null && typeof (a as Ask).input === 'object' && !Array.isArray((a as Ask).input));
+};
+
 export type StandingRecord = { id: string; digest: string | null; blueprint: Blueprint | null; seen: string | null };
 export type OccupantRecord = { id: string; notes: JsonObject };
 export type Cells = {
@@ -49,7 +74,10 @@ export type Silence = typeof silence;
 // why. A door says the first five to a key it has bound, and rides them on
 // the wire as `{ quo: word }`; her own ward says the last four to her and
 // they never leave the ward. Each is one frozen object under one symbol key,
-// so no being makes one and none crosses an edge as a value.
+// so no being makes one by accident and none crosses an edge as a value. A
+// being who reaches for the symbol on purpose makes an object her ward reads
+// as her having thrown, which is what a being who returns nonsense gets: the
+// key is a guard against collision, never against her.
 export type DoorWord = 'removed' | 'absent' | 'unannounced' | 'repeated' | 'threw';
 export type WardWord = 'unreached' | 'late' | 'invitation' | 'dropped';
 export type WordName = DoorWord | WardWord;
@@ -79,7 +107,9 @@ export type Standings = {
 } & { readonly [id: string]: Standing | undefined };
 
 export type Occupants = {
-  invite(id: string): Promise<Invitation | null>; // awaitable: a key is minted
+  // awaitable: a key is minted. The notes are the terms it is minted under,
+  // written on the occupant for her gate to read, and hers alone after that.
+  invite(id: string, notes?: JsonObject): Promise<Invitation | null>;
 
   remove(id: string): void;
 };
@@ -90,9 +120,13 @@ export type Stance = {
   readonly occupants: Occupants;
   readonly standings: Standings;
   // A new being of her ward, by class name, under a key she chooses. The key
-  // back, or null: the key is taken or the harbor holds no such class. A
-  // being may make; only the owner reaches into another.
-  boot(className: string, key: string): string | null;
+  // back, or null: the key is taken, the harbor holds no such class, or the
+  // class threw at birth. A being may make; only the owner reaches into
+  // another. Naming an id asks for a way back too: the being made holds an
+  // occupant for her maker under the maker's own key, and the maker holds
+  // the standing under that id. A relation that could not be made is a boot
+  // that made nobody, and the being made goes with it.
+  boot(className: string, key: string, id?: string): Promise<string | null>;
 };
 
 // The raw shape of a being. Anything with these two is a being.

package/src/conformance/assert.ts

@@ -11,6 +11,14 @@ const show = (v: unknown): string => {
   if (typeof v === 'bigint') return `${v}n`;
   if (v === undefined) return 'undefined';
   if (typeof v === 'function') return `[function ${v.name}]`;
+  // A ward's word is a frozen object under one symbol key, and JSON shows it
+  // as `{}`. A red estate chapter saying `{} is not {}` names nothing, so a
+  // value whose own keys are all symbols is shown by its keys.
+  if (v !== null && typeof v === 'object') {
+    const keys = Object.keys(v);
+    const syms = Object.getOwnPropertySymbols(v).filter((s) => Object.getOwnPropertyDescriptor(v, s)!.enumerable);
+    if (keys.length === 0 && syms.length > 0) return `{ ${syms.map((s) => `${s.toString()}: ${show((v as Record<symbol, unknown>)[s])}`).join(', ')} }`;
+  }
   try {
     return JSON.stringify(v) ?? Object.prototype.toString.call(v);
   } catch {
@@ -24,15 +32,40 @@ const fail = (why: string, message?: string): never => {
 // Structural, and strict about shape the way `node:assert/strict` is: a value
 // is not equal to one of another kind, and an array is not equal to an object
 // that happens to hold the same keys.
+// The four kinds this compares, and every other object is refused rather than
+// guessed at. A Date, a RegExp, a boxed primitive and a class instance each
+// carry state no key walk can see, so two of them with the same keys are
+// equal here and unequal in node, which is a wrong yes: the one answer a
+// suite must never give. A refusal is a red test that says so.
+const KNOWN: readonly (object | null)[] = [Object.prototype, null, Array.prototype, Uint8Array.prototype];
+
+// What node compares: own enumerable keys, strings then enumerable symbols.
+// Not `Reflect.ownKeys`, which also lists what a definition hid.
+const keysOf = (v: object): PropertyKey[] => [...Object.keys(v), ...Object.getOwnPropertySymbols(v).filter((s) => Object.getOwnPropertyDescriptor(v, s)!.enumerable)];
+
 export function same(a: unknown, b: unknown): boolean {
   if (Object.is(a, b)) return true;
   if (typeof a !== 'object' || typeof b !== 'object' || a === null || b === null) return false;
-  if (Object.getPrototypeOf(a) !== Object.getPrototypeOf(b)) return false;
+  const proto = Object.getPrototypeOf(a) as object | null;
+  if (proto !== (Object.getPrototypeOf(b) as object | null)) return false;
+  if (!KNOWN.includes(proto)) return false; // a Date, a RegExp, a boxed number, a class of hers
   if (Array.isArray(a) !== Array.isArray(b)) return false;
-  if (Array.isArray(a) && Array.isArray(b)) return a.length === b.length && a.every((x, i) => same(x, b[i]));
   if (a instanceof Uint8Array && b instanceof Uint8Array) return a.length === b.length && a.every((x, i) => x === b[i]);
-  if (a instanceof Map || b instanceof Map || a instanceof Set || b instanceof Set) return false; // the suite has none, and a wrong yes is worse than a refusal
-  const ka = Reflect.ownKeys(a), kb = Reflect.ownKeys(b);
+  // An array is its indices and whatever else was hung on it, and a hole is
+  // not a present undefined: `[, 1]` and `[undefined, 1]` differ in node and
+  // must differ here. `every` skips holes, so the loop is written out.
+  if (Array.isArray(a) && Array.isArray(b)) {
+    if (a.length !== b.length) return false;
+    for (let i = 0; i < a.length; i += 1) {
+      if (i in a !== i in b) return false;
+      if (i in a && !same(a[i], b[i])) return false;
+    }
+    const extra = (v: unknown[]) => keysOf(v).filter((k) => typeof k !== 'string' || !/^(?:0|[1-9]\d*)$/.test(k));
+    const xa = extra(a), xb = extra(b);
+    const at = (v: unknown[], k: PropertyKey) => (v as unknown as Record<PropertyKey, unknown>)[k];
+    return xa.length === xb.length && xa.every((k) => xb.includes(k) && same(at(a, k), at(b, k)));
+  }
+  const ka = keysOf(a), kb = keysOf(b);
   if (ka.length !== kb.length) return false;
   return ka.every((k) => kb.includes(k) && same((a as Record<PropertyKey, unknown>)[k], (b as Record<PropertyKey, unknown>)[k]));
 }