Namespace document for https://ns.klonkt.com/shaer#. Machine-readable context: shaer.jsonld. Normative specification: FEP-633c. DRAFT (companion to fep-633c.md)

The Guardians vocabulary

a sea, its boats, and a sky of known stars

This document is what https://ns.klonkt.com/shaer# resolves to. It has two jobs. It is the namespace document for the vocabulary FEP-633c defines, and it records why that design is what it is.

Nothing here is normative. Every requirement lives in FEP-633c; where this document and the FEP disagree, the FEP wins. The separation is deliberate: a specification should be short enough to implement from, and an argument should be long enough to be honest. Mixing the two produces a document that is bad at both.

This edition is told as a tale. The form is new; the content is not. Every boat, star and ceremony below is a term or a rule, and each chapter closes with its technical footing, so an implementor who follows the tale end to end has met every argument the plain edition made. If you want only the law, read the FEP. If you want to know why the law has the shape it has, read on.

The terms

Defined in https://ns.klonkt.com/shaer#, RECOMMENDED prefix shaer. The normative definitions are in FEP-633c §2; this table is an index, and each term is an anchor — …/shaer#Lapse lands on its row.

On the namespace itself

The namespace names a vendor domain, which is a fair objection to raise against a proposal intended for general adoption. It is recorded here rather than quietly left alone: the terms were developed inside a specific implementation, and renaming the namespace after deployment would break every actor document already published with it. If the FEP process prefers a neutral namespace, that is a migration to plan, not a detail to settle silently.

The tale

I. The sea

There is a sea, and nobody owns it. Every person on it is a boat under sail; every server is a harbour a boat calls home; and the wind — patient, indifferent, reliable — carries words from any deck to any other. That nobody owns the sea is the whole point of it, and the whole price of it: anyone can hail you, and there is no harbourmaster to complain to.

Some boats are young. A young boat is not a lesser boat — it goes where the wind goes, like any other — but it does not sail alone. The boats that sail with it are called guardians, and the young boat is their ward, and between them holds the oldest relationship afloat: someone watches, because someone must.

One rule is laid down before anything else, and the tale will come back to it: no boat both tows and is towed. A guardian is never itself a ward.

In the protocol. Actors are boats; activities are the wind. An actor whose shaer:guardians collection is non-empty is a ward; an actor carrying shaer:isGuardian: true is a guardian; the two are mutually exclusive (§1). The guardianship itself is an ordinary AS2 Relationship whose relationship property is shaer:Guardian (§9.3).

II. The names on the hull

A ward's guardians are painted on its hull, where any passing boat can read them.

That could have been a secret, shared only among the family. It is public because the entire mechanism turns on a stranger being able to find the responsible adults. The model is a village: everyone knows whose child is whose, and that is precisely what makes it possible to knock on the right door. The failure this vocabulary exists to remove is an adult with a legitimate complaint having nowhere to take it except the child — "it came from a stranger on the internet, there is nothing I can do." Names on the hull replace that with an ordinary conversation between adults.

But mind the asymmetry, because it is load-bearing. The hull says who watches; the sea does not say where the child sails. A concerned adult who has already met the ward can reach its guardians, while a stranger idly trawling the charts cannot find the ward in the first place. Reachability for recourse and discoverability to strangers are different things, and they are separated on purpose.

A message, too, may fly a small pennant saying my sender is watched over — a courtesy to whoever receives it, never a proof.

In the protocol. shaer:guardians is public (§2.1), while the ward's content is excluded from indexing and discovery (§5.5). shaer:hasGuardians on an object (§2.2) is the pennant: an advisory hint that the responsible actor is a ward, carried by the object rather than fetched from the actor.

III. The ceremony of joining

A boat that wishes to watch rows across and offers. The offer is its own yes — nobody offers to watch a child and then, asked whether they truly meant it, hesitates — so a candidate is never chased for a second signature on its own promise.

The ward must accept; a watch is worn, not imposed. And when boats already keep the watch, at least one of them must nod as well: nobody joins a watch without the watch knowing.

The sea is wide, and the ceremony respects it. Every harbour with a party to the ceremony keeps its own copy of it and its own count of the yeses, and each concludes when its own count is complete. The wind delivers in any order; no harbour waits on another's say-so; and every copy, counted honestly, reaches the same conclusion. One refusal from any party, at any moment, and the ceremony is void.

In the protocol. The candidate's Offer is addressed to the ward and every existing guardian (§3.1.1) and doubles as the candidate's own Accept (§3.1's one-step clause). Commit requires: the ward accepted, the candidate accepted, and — where guardians exist — at least one of them accepted (§3.1.2). Each instance tallies its own copy and commits locally when that copy is complete; a single Reject voids the offer (§3.2).

IV. The flare

When a young boat is in trouble, it fires a flare. A flare is not addressed; it is seen. It reaches every guardian, every time, and the tale is stricter about this than kindness alone would require: the flare ignores everything said later in this document about absence, sleep and clouded stars. A guardian who answers a flare from a hospital bed is not an edge case to be filtered out. That is the mechanism working.

And every guardianship, the moment it is made, ties one end of a line to the guardian's own deck. Whatever else changes on the sea, that line stays tied. The lifebuoy never filters.

In the protocol. A direct note carrying shaer:helpRequest is a ward's call for help; delivery ignores availability entirely (§3.6). The escalation handle (§6) is supplied automatically at commit and is the guardian's inbox.

V. Not a teapot

The watch is flat. A guardian is never itself a ward, so there are no watchers above watchers, no chain of masts receding into the fog. An implementation that met a guardian carrying its own guardians and followed the chain upward would build an unbounded tower of responsibility nobody agreed to — and a child's flare could come down several relationships away from anyone who has ever met the child.

A boat claiming to tow and be towed at once is answered with the protocol's one joke: it is marked not a teapot, with a 418 flavour. The joke stuck; the refusal underneath it is serious, and it is met at two different moments that demand two different manners.

When a flare is being delivered to several guardians and one of them proves malformed, you drop that one and sail on. The others are still reachable and still responsible, and the flare must not sink with the worst address on its list. But when a ward is about to commit its watch to a single candidate and that candidate proves malformed, there is nobody to sail on to — and a soft failure would leave a ward counting a guardian it does not have. There, the refusal has to be loud.

Loud toward the ward — and careful toward the candidate. Commit is the last step of the ceremony: reaching it at all means every human involved has already said yes. A refusal that names its technical reason therefore hands the candidate a second fact it did not have — the people agreed, only the protocol said no — and where a guardianship is contested, whether the family consented is exactly the fact a party may not be entitled to learn. A bare refusal reveals none of it. So the check moves earlier, to the moment of the offer, where nothing has been agreed and the reason can be given in full without disclosing a thing; the commit-time check remains for the narrow case of a candidate adopted mid-ceremony, and there the deployment decides how much to say.

And fog is a third answer. A boat you cannot see through the fog is neither sound nor a wreck. Call it a wreck, and a moment's weather voids a watch that three parties agreed to and that can only be remade by holding the whole ceremony again — punishment landing on people who did nothing. Call it sound, and you have recorded a guardian nobody ever checked, arrived at by omission instead of attack. So fog defers: the ceremony holds its breath, no longer than the window allows, and if the fog never lifts, the parties are told the ceremony failed because the candidate could not be seen — never that it was refused. Fog says nothing about the boat inside it. Not knowing is its own answer, and it is never silently either of the other two — not here, not at delivery, and not in a client, where an unchecked guardian must never be drawn as a checked one, or a ward reads an unverified safety net as a verified one.

In the protocol. §4 splits by moment: at delivery (§4.1) a malformed guardian is skipped so the rest still receive; at commit (§4.2) the refusal is explicit toward the ward, while the candidate receives a bare Reject indistinguishable from any party's §3.2 refusal. The recommended check runs at offer time, where a full reason discloses nothing. Unverifiable is a third outcome: it defers the commit, bounded by the §3.5 window, and is reported as unverified — never as refused.

VI. The sky

At night the sea shows the young boat a sky, and the sky is made of everyone it knows. Every voice is a star: the recent ones burn close to the middle, the old ones drift toward the rim, and the chart is drawn so an hour and a year fit in the one sky. The guardians are the fixed stars — the ones you steer by.

A fixed star may say: I am behind the clouds until spring. That is an absence declared, and it must name its spring. An absence without an end is not an absence; it is a disappearance wearing better clothes, and the sky declines to file it as weather.

Or a star may simply go dark, saying nothing. Here the sky is careful about evidence. Darkness is never decreed from a calendar — only this counts: calls addressed to that star, by name, that went unanswered. Any fixed number of days written into the rule would punish exactly the long illness the rule exists to accommodate. And when the sky does conclude that a star has gone dark, it says so out loud, to the star among others — observed, notified, never whispered.

None of it leaves a mark. Absence is ordinary: people fall ill, accounts die, harbours sink. One answer restores everything — at any moment, up to and including the last moment of the proceeding the next chapter describes. The sky holds no grudges. It only wants to know who is really there.

In the protocol. shaer:away declares absence and carries an endTime; shaer:dormant is the notice that dormancy was observed (§3.6). The only evidence for dormancy is directly addressed requests that went unanswered — never calendar time alone. Any answer restores availability instantly, and cancels a running lapse.

VII. The race to the threshold

Sometimes the guardians must decide something together — whether a stranger may follow the ward, whether a door on the young boat may be opened.

Unanimity would hand every star a silent veto. One unreachable, inattentive or obstructive guardian could freeze a ward's life on the sea indefinitely, and the ward could never tell obstruction from absence — the cruellest property a rule for children could have. So a decision is not a poll everyone must answer. It is a race to a threshold within a window: more than half of those who could answer, before the window closes. Silence remains every guardian's right; it merely stops being a wall and becomes a choice with a consequence.

The list of who may answer is written down at the moment the question opens. Otherwise either side could stack the sky mid-decision — hoist a friendly star aboard to reach the threshold, or strike an unfriendly one to lower it.

And decisions differ by the cost of a wrong yes. A follower admitted in error is undone tomorrow with a block, so such decisions settle the instant the threshold is reached or has become unreachable, and fail closed when the window ends. But a decision that cannot be taken back does not settle early no matter how fast the yeses arrive: its window runs its full course, so that every star named at the start has had a genuine chance to speak. How long the windows are is the deployment's business. Their shape is not.

In the protocol. §3.5: a snapshotted set, a threshold, a window. Reversible decisions — follow gating (§5.3) and shaer:GatedSetting proposals, which name a shaer:ward, a shaer:feature and a shaer:value — race in both directions and fail closed at the deadline. Irreversible decisions always run the full window. The threshold counts over the available set (§3.6).

VIII. The lapse

Light travels slowly across a wide sea, and sometimes a star's light is still arriving after the star itself has gone. Sooner or later the others must say what all of them can see: that they are steering by something that is no longer there.

That saying has a name, the lapse, and the name was chosen with care. In the design it was called an eviction, and the word was rejected for its carceral frame: nothing here is punishment. What actually happens is that a community acknowledges a departure that has already taken place.

Its mechanics are all restraint. Only a companion who is present may propose it, only about a star already observed dark, and never about the last one. The proposal carries the proposer's own yes. The window always runs its full course — this is the irreversible kind — and to its very last moment, one answer from the missing star cancels the whole proceeding, as if nothing had been said. Coming back is always enough.

One case is left standing, deliberately. A lapse can leave a single guardian in sole command, and it is easy to imagine it wielded inside a failing family: one parent engineering the other's silence. The tale does not pretend to judge that, and the refusal belongs on the record. A protocol can record consensus; it cannot manufacture it. The ceremony of joining works because the consensus is real and the protocol merely writes it down — in a contested removal there is no consensus to write down, and threshold arithmetic bolted onto a family conflict does not settle the conflict. Nor is the ward the arbiter: making a child the tiebreaker between its adults is the loyalty conflict family law goes out of its way to spare children, and outside the protocol the ward remains subject to parental authority no matter what a server records.

What the mechanism guarantees is narrower, and honest: a removal can be unjust, but it can never be silent. Notice over the line that never filters; the full window; cancellation by a single answer; and the record all of it leaves behind — evidence, addressed to where contested removals are actually resolved: the family, the community, if need be a court. The protocol serves that process. It does not replace it.

In the protocol. A shaer:Lapse is proposed by an available co-guardian against one dormant guardian, and the proposal carries the proposer's accept (§5.6 applying §3.1's one-step clause). It never empties the set. The window runs in full; any answer from the target cancels it, up to the last moment.

IX. The last star

No single hand may take the last star out of a ward's sky. Not the guardian itself by leaving, not a companion by proposing, not a harbour by tidying its records. Emptying the sky has its own name — emancipation — and it belongs to no single party, because what it removes is the recourse structure itself, and afterwards the ward has no standing left to reverse it. It is the one decision that always runs its longest window, counted over every guardian there is, present or not.

And it must exist, because children grow up. The measure of this whole tale is the ward who one day no longer needs it. Which is also why nothing in it is anchored to a cryptographic forever: a guardianship protects an account in a harbour, for as long as that account and that relationship exist. An identity that outlives the relationship it describes is precisely the wrong shape for a mechanism whose success is a child leaving it behind.

In the protocol. Removing a guardian (§3.3) applies only while more than one remains; emptying shaer:guardians is emancipation (§3.4), its threshold counted over the full set, its window always run in full. FEP-633c deliberately does not adopt DID-bound or otherwise portable actor identity.

Provenance

The guardianship model, including the emancipation design and the two-witness deadlock-breaker, originates with Bart Overkamp and was developed through discussion on SocialHub. The vocabulary was built and deployed in a guardian-gated Fediverse implementation before being written up as a FEP, which is why the namespace carries that project's domain.

The decision model — a threshold reached within a window rather than a poll everyone must answer, and the distinction between reversible decisions that settle early and irreversible ones that always run their full window — came out of the same discussion. Bart Overkamp put it as "a race to the threshold rather than a vote".

The lapse mechanism was called eviction during design. The name was rejected for its carceral framing: nothing in it is punishment, and what actually happens is that a community acknowledges a departure that has already taken place.

The imagery is not decoration, and it is not new. The boats are Bart Overkamp's sailboat vocabulary from the Hi Playground sketches — every person a small sail, a shield for a guardian — and the Shaer client draws them to this day. The sky of known stars is the client's own Messages screen, which places the people you know around you: recent voices near, old ones far, an hour and a year fitting in one sky. The star chart at the head of this page is placed by the same golden-angle rule. This telling replaced a plainer edition of the same document on 2026-08-07; the arguments are unchanged, and they are meant to be checked against the specification, not merely enjoyed.