@nervur-org/dock 0.3.0 → 0.4.0

package/{beings/quo-dock.md → quo-dock.md}

@@ -2,7 +2,7 @@
 
 This is the trunk of the dock: what every estate on Quo needs and nobody writes
 twice. `quo/SPEC.md` is the protocol and knows nothing of this folder, and
-`papers/quo-kit.md` is what the library under `packages/quo/src` chose; the
+`papers/quo-kit.md` is what the library under `packages/nervur/src` chose; the
 five documents under `packages/dock/` are the truth of their folders in the
 same way, and where any of them disagrees with `quo/SPEC.md`, the spec wins
 and the document is rewritten. Nothing
@@ -16,11 +16,11 @@ does not run. `papers/GLOSSARY.md` holds every word of both.
 
 Three layers, one repository, and the words for them:
 
-| layer     | folder            | package              | published       |
-| --------- | ----------------- | -------------------- | --------------- |
-| Quo       | `packages/quo/`   | `@nervur-org/nervur` | yes, Apache 2.0 |
-| the dock  | `packages/dock/`  | `@nervur-org/dock`   | yes, Apache 2.0 |
-| an estate | the owner's own   | none                 | never           |
+| layer     | folder             | package            | published       |
+| --------- | ------------------ | ------------------ | --------------- |
+| Quo       | `packages/nervur/` | `nervur`           | yes, Apache 2.0 |
+| the dock  | `packages/dock/`   | `@nervur-org/dock` | yes, Apache 2.0 |
+| an estate | the owner's own    | none               | never           |
 
 **An estate is all of one owner's harbors.** The droplet, the edge and the
 Mac, with the desk, the user being and the avatars living across them: that
@@ -32,7 +32,7 @@ taken here, exactly as owning anyone else's would be. What makes them one
 estate is who holds those standings, not a key any two of them share. A second
 domain is a second estate. An adopter's company is an estate in their own
 repository, and it looks exactly like ours. An estate folder is one folder
-per harbor, each the quo directory that device runs minus what it mints,
+per harbor, each the harbor directory that device runs minus what it mints,
 its class bodies, its routes, its agents, its dial list, plus that device's
 unit; a package file that depends on the dock and nothing else; secrets by
 reference; and one document. Nothing else may be needed to run it, and the
@@ -41,7 +41,7 @@ one install of the dock, boots. If it does not, the missing piece belongs
 in the dock.
 
 **The dock is what a harbor is fitted with to receive people and models**:
-the daemon and the `quo` command, the front desk, the user being and the
+the daemon and the `nervur` command, the front desk, the user being and the
 avatar, the harbors on real terrains, the model sides and the screen, the
 credential exchange, and the faculties of the dock ward, one being per
 thing a box can do. It is general by two rules, under
@@ -60,7 +60,7 @@ The five documents of the dock, and the folders each answers for:
 
 Five documents and seven folders, because the trunk answers for three: the
 beings every side shares, the dock ward that holds a box's faculties, and
-the daemon and the `quo` command that stand a device up. Each document
+the daemon and the `nervur` command that stand a device up. Each document
 decides only its own folders, and names another side's word only to say
 where the boundary runs: the human document decides no transport, the model
 document decides no screen, the harbor document decides nothing about what
@@ -70,17 +70,17 @@ a being is. Anything two sides need is decided here.
 
 An adopter alone with this paper stands a box and puts a phone in a world
 in six commands. The dock installs from npm and brings the library with
-it; `quo` is its one command, run as `npx quo` in the folder it was
+it; `nervur` is its one command, run as `npx nervur` in the folder it was
 installed in, and every command takes `--dir` for the harbor folder, or
-reads `QUO_DIR`, or takes `~/.quo`.
+reads `NERVUR_DIR`, or takes `~/.nervur`.
 
 ```bash
 npm install @nervur-org/dock
-npx quo init --dir ~/.quo --ward acme --user razvan --domain acme.com --default --show
-npx quo serve --dir ~/.quo --http 8787
+npx nervur init --dir ~/.nervur --ward acme --user razvan --domain acme.com --default --show
+npx nervur serve --dir ~/.nervur --http 8787
 ```
 
-`init` mints the ward `acme` at `~/.quo/wards/acme/`, boots razvan's user
+`init` mints the ward `acme` at `~/.nervur/wards/acme/`, boots razvan's user
 being, her doorbell and the desk in it, marks it the default ward, the one
 a caller means when naming none, shows it at the web route, and writes
 `routes.json`: the four routes `mcp.`, `web.`, `quo.` and `api.` under the
@@ -105,8 +105,8 @@ it hosts, and one of them is `dock`, the box's own, which it boots and no
 init made. From a second terminal:
 
 ```bash
-npx quo invite --dir ~/.quo '{"being":"razvan","id":"phone"}'
-npx quo census --dir ~/.quo
+npx nervur invite --dir ~/.nervur '{"being":"razvan","id":"phone"}'
+npx nervur census --dir ~/.nervur
 ```
 
 The invite's answer is the invitation, `ward`, `heir` and `secret`, and
@@ -120,9 +120,9 @@ her `asks`, the seven of the owner, `boot`, `public`, `invite`, `knock`,
 same daemon; `--ward` names it on any command, and naming none means the
 default.
 
-The root reaches into a being of her own ward with `quo ask <being>
+The root reaches into a being of her own ward with `nervur ask <being>
 [method] [json]`; with no method the answer is the being's describe. A
-being is booted from the classes the box holds, `quo boot
+being is booted from the classes the box holds, `nervur boot
 '{"key":"clock","class":"Clock"}'`, and the classes are the dock's own,
 `User`, `Desk`, `Clock`, `Courier`, `Avatar`, `Presence` and the
 faculties, plus what `classes/index.ts` beside the wards exports by name,
@@ -130,14 +130,14 @@ empty as init leaves it: a class nobody holds answers `no such class, or
 key taken`, as a key already booted does.
 
 Everything the box does on its own is a row on a faculty of the dock ward,
-placed by the root with `quo ask --ward dock`, kept in her cells and back
+placed by the root with `nervur ask --ward dock`, kept in her cells and back
 at every boot; the daemon reads no recipe. Two rows every estate meets:
 
 ```bash
-npx quo ask --dir ~/.quo --ward dock dialers keep '{"url":"http://127.0.0.1:8788/quo"}'
-npx quo ask --dir ~/.quo --ward dock agents keep '{"id":"bot","ward":"acme","url":"http://127.0.0.1:1234/v1","model":"qwen"}'
-npx quo ask --dir ~/.quo --ward dock agents list
-npx quo ask --dir ~/.quo --ward dock agents drop '{"id":"bot"}'
+npx nervur ask --dir ~/.nervur --ward dock dialers keep '{"url":"http://127.0.0.1:8788/quo"}'
+npx nervur ask --dir ~/.nervur --ward dock agents keep '{"id":"bot","ward":"acme","url":"http://127.0.0.1:1234/v1","model":"qwen"}'
+npx nervur ask --dir ~/.nervur --ward dock agents list
+npx nervur ask --dir ~/.nervur --ward dock agents drop '{"id":"bot"}'
 ```
 
 A dialer row is a socket this box holds to that quo route from now and
@@ -156,10 +156,10 @@ B knocks for B's user being with the invitation A answered, the three
 fields without the `link`:
 
 ```bash
-npx quo reach --dir B <pk of A> http://127.0.0.1:8787/quo
-npx quo invite --dir A '{"being":"<pk of A>","id":"b"}'
-npx quo knock --dir B '{"being":"razvan","id":"a","invitation":{"ward":"…","heir":"…","secret":"…"}}'
-npx quo census --dir B --via a
+npx nervur reach --dir B <pk of A> http://127.0.0.1:8787/quo
+npx nervur invite --dir A '{"being":"<pk of A>","id":"b"}'
+npx nervur knock --dir B '{"being":"razvan","id":"a","invitation":{"ward":"…","heir":"…","secret":"…"}}'
+npx nervur census --dir B --via a
 ```
 
 The knock answers `taken`, the standing's name, and A's describe for an
@@ -174,10 +174,10 @@ script, `stand.ts`, under "What a device stands up".
 **On the edge** the harbor is one Durable Object and the worker is the
 dock's, reached by name from a two-line `worker.ts`; there is no process
 of your own and no socket, so the root is whoever holds the platform
-secret `QUO_ROOT`, and the root's asks arrive as one POST under it. The
-other secret, `QUO_SEED_KEY`, thirty-two bytes as hex, seals the seeds in
-the object's storage. `wrangler dev --var QUO_SEED_KEY:… --var
-QUO_ROOT:…` runs the same worker on a Mac's loopback.
+secret `NERVUR_ROOT`, and the root's asks arrive as one POST under it. The
+other secret, `NERVUR_SEED_KEY`, thirty-two bytes as hex, seals the seeds in
+the object's storage. `wrangler dev --var NERVUR_SEED_KEY:… --var
+NERVUR_ROOT:…` runs the same worker on a Mac's loopback.
 
 ```ts
 export { Quo } from '@nervur-org/dock/harbor/edge/worker';
@@ -200,8 +200,8 @@ new_sqlite_classes = ["Quo"]
 ```
 
 ```bash
-npx wrangler secret put QUO_SEED_KEY
-npx wrangler secret put QUO_ROOT
+npx wrangler secret put NERVUR_SEED_KEY
+npx wrangler secret put NERVUR_ROOT
 npx wrangler deploy
 ```
 
@@ -223,7 +223,7 @@ curl -s -X POST $R -H "$H" -H 'content-type: application/json' -d '{"method":"in
 
 The invite answers the three fields and no link, since the edge composes
 none. The first thing a root on the edge does is that invite on the
-ward's own pk: a box reaches the edge with `quo reach <pk>
+ward's own pk: a box reaches the edge with `nervur reach <pk>
 <origin>/h/main/quo`, knocks with the three fields, and from then on
 pilots it with `--via`, as any ward, and the secret is not used again.
 
@@ -296,7 +296,7 @@ that every arrival is named and judged.
   are two sides of one avatar class.
 - **Front desk.** A being strangers and fresh clients meet first. It holds
   a standing to the ward's own being and to every being it made, and can
-  ask one for a device invitation. It is the being `quo init` marks public
+  ask one for a device invitation. It is the being `nervur init` marks public
   in a fresh ward, and nothing more: a ward has one public being of any
   class, an estate's front in place of the desk, a board or a corpus in a
   ward of its own, and the mark is the owner's to move. Public is not a
@@ -435,7 +435,7 @@ acme.com, or a family's domain: the dialable part of an estate
     quo.   the harbor's socket door: the rendezvous for every dialer
     mcp.   the model side over HTTP, a credential exchange in front
     api.   a describe as plain JSON: the public being for a stranger, the avatar under a bearer
-  quo serve: one process, one harbor, the ask pointer
+  nervur serve: one process, one harbor, the ask pointer
     unix socket     owner asks, local only, never behind the proxy
     localhost ports the routes above
     ward main       the estate's home: its org being, the desk, the bell, its envoys, its members, its avatars
@@ -443,13 +443,13 @@ acme.com, or a family's domain: the dialable part of an estate
     ward <world>    any other world the estate runs: a corpus, a board, with a public being of its own
 
 mac
-  quo serve (laptop, dialer, holds a socket to quo.)
+  nervur serve (laptop, dialer, holds a socket to quo.)
     unix socket     owner asks, local only
     ward main       the device's own: the human's local beings and the avatars of local sides
   a local agent
-    quo side  -> an avatar over stdio          occupant
-    quo pilot -> the ask pointer over the sock owner, here
-    quo pilot --via droplet -> a standing at the droplet's ward, sealed  owner, there
+    nervur side  -> an avatar over stdio          occupant
+    nervur pilot -> the ask pointer over the sock owner, here
+    nervur pilot --via droplet -> a standing at the droplet's ward, sealed  owner, there
     the editor -> being classes on disk        developer
 
 iphone, or a tab
@@ -599,7 +599,7 @@ other ward on the box comes to hold a standing at one through `lend`, the
 seventh member of the ground. The faculties below are the ones the dock
 ships, and they are examples of the shape and not a list: `lend` reaches
 any being of the dock ward by her key, so an estate boots a faculty of its
-own there, `quo boot --ward dock`, of a class in its own `classes/` that
+own there, `nervur boot --ward dock`, of a class in its own `classes/` that
 extends `Faculty`, holding whatever its terrain allows, and lends it the
 same way.
 
@@ -817,7 +817,7 @@ Three things that shape are: a token names its bell, the address of the
 service that holds the keys of the app that minted it, set by that app's
 shell from its build the way `sandbox` is, so a box rings the service the
 token names and rings a phone running an app it never shipped, while the
-service the root kept on the push faculty, `quo ask --ward dock push keep
+service the root kept on the push faculty, `nervur ask --ward dock push keep
 '{"service":"https://bell.example"}'`, is a world's default for a token
 that names none and never an address in this package, since whose service it is
 belongs to an estate; who may ring it is the token itself, because a device
@@ -829,7 +829,7 @@ while Node's fetch is undici, which speaks none, so a box whose fetch
 speaks it rings Apple with `dock/apns.ts` and a Node box rings the same
 thing with `dock/http2.ts`, which is that ring over `node:http2` and is
 named by the Node terrain alone. A Node box is a bell when it is handed
-Apple's key, `QUO_APNS_KEY` and the three beside it, and every box handed
+Apple's key, `NERVUR_APNS_KEY` and the three beside it, and every box handed
 none routes to the service instead. Web Push is the world's own key and
 names no service.
 
@@ -1111,7 +1111,7 @@ because nothing runs in a hand at night and a faculty that promised a wake
 nothing would fire is worse than a name the box does not hold.
 
 The root places what the device always does from a shell, once,
-`quo ask clock keep '{"id":"sweep","ask":"corpus.sweep","cron":"0 3 * * *"}'`,
+`nervur ask clock keep '{"id":"sweep","ask":"corpus.sweep","cron":"0 3 * * *"}'`,
 one line per schedule, and the estate's paper holds those lines, so the
 paper still describes the whole device. A schedule that will not read is
 refused in the answer to that line, where it was written, and is never kept
@@ -1233,7 +1233,7 @@ a gate that reads notes is fed without a line of code.
 a kind of ward: its agents boot there, its door answers for it when a
 caller names no ward, and a command with no `--ward` is on it, and that is
 all. A harbor hosting one ward has it as the default with nothing said; a
-harbor hosting several marks one, `quo init --default` or `quo default
+harbor hosting several marks one, `nervur init --default` or `nervur default
 <ward>`, a mark kept in that ward's own folder so it moves with the ward,
 and with none marked is refused at boot, by the names it hosts, rather
 than coming up on a guess. No name is a default, and the dock ward, which
@@ -1377,7 +1377,7 @@ is no password anywhere in the dock, because login is a knock. Every way in
 ends the same way:
 
 1. Somebody who may invite mints an invitation for the client identity.
-   The root does, on the box, with `quo invite` on the user being, and
+   The root does, on the box, with `nervur invite` on the user being, and
    sends it as a link or a line; a device of hers that may mint does it
    from where it stands, on her `device` ask, so only a human's first
    device ever has to come from the box. On the device, a side that reached the
@@ -1422,7 +1422,7 @@ asks for the words it wants, and she writes only those it holds itself, so
 a chain of devices never gains a power along the way. The
 notes are written when the occupant is minted; to change one, remove the
 occupant and mint again, because reconnect mints nothing. A device the
-root mints on her directly, with `quo invite`, carries no note: the id the
+root mints on her directly, with `nervur invite`, carries no note: the id the
 root chose is its client identity, and it reaches and may wake, since the
 root owns everything she holds and chose to mint it. `mint` is never
 implied, not even there, because it admits somebody else rather than
@@ -1453,7 +1453,7 @@ answers 401 at the next session and forgets the grant.
 
 ## The daemon and the CLI
 
-One command, `quo`, under `packages/dock/cli/`. It imports the four library exports
+One command, `nervur`, under `packages/dock/cli/`. It imports the four library exports
 and nothing else, holds no class body, and never speaks to a ward except
 through the ask pointer or an avatar, the two doors everyone has. The
 daemon's folder holds the process and its two sockets, and nothing under
@@ -1470,19 +1470,19 @@ rule: what it is made of is the daemon's socket, so it stands in `cli/`, and
 `mcp/` holds the model side it is handed to.
 
 ```
-quo init [--dir D] [--ward W] [--user U] [--class C] [--default] [--show] [--domain DOM]  mint a seed, boot a ward over a disk store, write both; C is the class of its home being, User unless said, an org's for an org's ward; --default marks it the default ward; --show shows it at the web route; --domain writes the four routes under DOM
-quo default <ward>        mark one ward the default, the one a caller means when naming none; a harbor with one ward needs no mark
-quo show|hide <ward>      show a ward at the web route, listed at its root and its public being's page painted for a stranger; hidden at init
-quo domain <domain>       write routes.json by the convention, mcp., web., quo. and api. under the domain, over https
-quo serve [--dir D]       the daemon: harbor from disk, the unix socket, the routes' listeners, the agents, a socket held to every route the dialers faculty keeps
-quo pilot [--dir D] [--via S] the owner pilot over stdio: the ward's describe as tools; as the root, or via a standing at another ward
-quo side [--dir D] --as NAME  an avatar over stdio for a local client; NAME is the client identity
-quo run [--dir D] --as NAME --url URL --model NAME  a human at a terminal talking to a model through an avatar; a line in, the final text out
-quo census [--dir D]      print the census once and exit
-quo boot|public|invite|knock|remove|unboot  six of the seven owner asks from a shell, for scripts and for agents under cron; --via S sends them to another ward
-quo ask <being> [method] [json]  the seventh: the root reaching into a being of its own ward, as the device
-quo reach <pk> <url>      a hint for the harbor's directory: that world's ward lives at that quo. route
-quo estate <dir> --domain D  an estate folder of the shape every estate has: a droplet's quo directory, its unit and Caddyfile, a Mac's launchd agent and dial list, a package on this dock
+nervur init [--dir D] [--ward W] [--user U] [--class C] [--default] [--show] [--domain DOM]  mint a seed, boot a ward over a disk store, write both; C is the class of its home being, User unless said, an org's for an org's ward; --default marks it the default ward; --show shows it at the web route; --domain writes the four routes under DOM
+nervur default <ward>        mark one ward the default, the one a caller means when naming none; a harbor with one ward needs no mark
+nervur show|hide <ward>      show a ward at the web route, listed at its root and its public being's page painted for a stranger; hidden at init
+nervur domain <domain>       write routes.json by the convention, mcp., web., quo. and api. under the domain, over https
+nervur serve [--dir D]       the daemon: harbor from disk, the unix socket, the routes' listeners, the agents, a socket held to every route the dialers faculty keeps
+nervur pilot [--dir D] [--via S] the owner pilot over stdio: the ward's describe as tools; as the root, or via a standing at another ward
+nervur side [--dir D] --as NAME  an avatar over stdio for a local client; NAME is the client identity
+nervur run [--dir D] --as NAME --url URL --model NAME  a human at a terminal talking to a model through an avatar; a line in, the final text out
+nervur census [--dir D]      print the census once and exit
+nervur boot|public|invite|knock|remove|unboot  six of the seven owner asks from a shell, for scripts and for agents under cron; --via S sends them to another ward
+nervur ask <being> [method] [json]  the seventh: the root reaching into a being of its own ward, as the device
+nervur reach <pk> <url>      a hint for the harbor's directory: that world's ward lives at that quo. route
+nervur estate <dir> --domain D  an estate folder of the shape every estate has: a droplet's harbor directory, its unit and Caddyfile, a Mac's launchd agent and dial list, a package on this dock
 ```
 
 **The owner does two things, and the ward says both.** Six of the seven make
@@ -1498,7 +1498,7 @@ an ask only the daemon's own code could reach, which is an ask nobody can
 make.
 
 It is the ward's ask and not the socket's, so nothing on this dock holds a
-being's answer and judges it again. `quo ask` and the socket's `being` line
+being's answer and judges it again. `nervur ask` and the socket's `being` line
 forward it; the api route asks it with no being named for a stranger,
 which is the public being asked as nobody; and a being of the tab's own
 ward is a subject over it, since the tab holds that ward's pointer and is
@@ -1506,7 +1506,7 @@ its root. Each of those
 was once a hand-written door with an asker of its own making, an allowance
 copied from the spec and a save written after it, and there is one now.
 
-**One process owns the harbor.** `quo serve` is the only process that ever
+**One process owns the harbor.** `nervur serve` is the only process that ever
 holds the seed, the partition and the ask pointer, on every device, the Mac
 included. Two processes over one partition are two wards with one pk, and
 they diverge silently. `init` is the one exception: it creates with no
@@ -1541,7 +1541,7 @@ routes. The socket is the root. Owning a droplet from elsewhere is a
 standing: the root there invites an owner on the ward's own pk, the root
 here knocks for the user being with it, and she takes the droplet's ward
 under a name, `droplet`. Owning is one of the human's standings, so she
-holds it as she holds acme. From then on `quo pilot --via droplet`, and the
+holds it as she holds acme. From then on `nervur pilot --via droplet`, and the
 bare owner asks with `--via droplet`, are sealed asks at the droplet's door,
 counted, rotated, removable: the daemon here asks on her standing
 in-process, as it drives an avatar for a side, and saves. The answers are
@@ -1681,7 +1681,7 @@ class on it is written from this block and nothing else:
 
 ```ts
 import { Envoy, owner, occupant, type Delivery, type Wake } from '@nervur-org/dock';
-import type { Asker, JsonObject } from '@nervur-org/nervur';
+import type { Asker, JsonObject } from 'nervur';
 
 export class Booking extends Envoy {
   // cells and asks are statics, as on every being. Spread the base's asks,
@@ -1857,10 +1857,13 @@ Two rules keep them general:
 2. Every interface has one suite, run against every implementation. A new
    implementation is accepted when the shared suite passes untouched.
 
-Harbor core, reach and store are the library's, decided by `quo/SPEC.md`
-and written under `packages/quo/src`, because a harbor is a word of the
-protocol and not a convention of ours. What is the dock's of those three is
-each terrain's store, loader, lease and listener, which is a device's
+Harbor core, reach and store are the library's and are written under
+`packages/nervur/src`, because a harbor is a word of the protocol and not a
+convention of ours. Only one of the three is the protocol's own: the reach,
+whose two kinds and whose frames `quo/SPEC.md` pins, because two harbors meet
+on them. A core and a store are this kit's way of paying what the spec asks a
+harbor for, and `papers/quo-harbor.md` decides them. What is the dock's of the
+three is each terrain's store, loader, lease and listener, which is a device's
 business and no ward's. The other six pieces are dock conventions and are
 decided here.
 
@@ -1893,7 +1896,7 @@ never against a reader we imagine.
    ward, which never moves. Nothing that migrates carries a credential.
 10. Nothing outside a package reaches inside it. `packages/dock/` imports
     the library by its four exports and never a path under
-    `packages/quo/src`; an estate and an app import the two packages by
+    `packages/nervur/src`; an estate and an app import the two packages by
     their exported names, the root and the subpaths the export map offers,
     and never a file that is not one. A folder of a package reaches its
     sibling folders by relative path, which is inside and not a breach.
@@ -1933,7 +1936,7 @@ Two rules hold:
   The second is how a harbor on any terrain is accepted, untouched, and not
   before. Neither binds an adopter; they bind this bench.
 - **One language, TypeScript, until 1.0.0.** A second kit is a second thing to
-  keep in step with every change, and the shelf under `packages/quo/protocol/`
+  keep in step with every change, and the shelf under `packages/nervur/protocol/`
   are the hand that will be extended when the time comes.
 
 ## Glossary

package/{harbor/quo-harbor.md → quo-harbor.md}

@@ -1,8 +1,11 @@
 # Transports
 
 This is how a harbor lives on a real device and how two of them meet over a real
-network. It implements the harbor of `quo/SPEC.md` on every terrain and
-adds nothing to it: a harbor boots wards, keeps what they are made of, carries
+network. It implements the harbor of `quo/SPEC.md` on every terrain and adds
+nothing a ward or a far harbor can observe: what is written here that the
+protocol does not say is a device's own half, a store, a lease, a loader, a
+core and a dialer's patience, and a second kit that answers the same bytes owes
+none of it. A harbor boots wards, keeps what they are made of, carries
 bytes to one pk, returns what came back or nothing, never reads them, and
 answers nothing only where it knows nothing was sent. This document names no
 being and no side; it knows seeds, partitions, code, sockets and disks.
@@ -109,7 +112,7 @@ apps share that is the argument for the secret store.
 Wrapped is what is built, and it is one piece, `seal.ts`: AES-GCM under a
 32-byte key, a fresh nonce each time, nonce and ciphertext together as hex,
 on WebCrypto so it runs wherever a store does. The key is the one secret a
-harbor reads from its terrain's secret store, named `QUO_SEED_KEY` on every
+harbor reads from its terrain's secret store, named `NERVUR_SEED_KEY` on every
 terrain: a platform secret on the edge, the environment of a daemon on a
 device, handed to it from the Keychain by the app that spawned it. A
 droplet gives no key and its folder stays plain under its file modes. A
@@ -253,7 +256,7 @@ with the owner's word for a world's.
 
 There are two harbor cores, and every device runs one of them:
 
-- **The node daemon**, `quo serve`. A disk or keychain store, a unix socket
+- **The node daemon**, `nervur serve`. A disk or keychain store, a unix socket
   for the owner, listeners on localhost for the routes. Droplet, Mac, Linux
   box: wherever a home runs.
 - **The browser harbor.** A dialer inside a webview or a tab, an IndexedDB
@@ -297,10 +300,26 @@ Two kinds of harbor exist in the world, and every pair reduces to them:
 | browser tab  | no            | yes      | while open              | itself   |
 
 A ward on a dialer is reached only if its harbor dialed first and something
-holds that line open. A phone's ask must survive a push wake-up, and a
-device that comes back from sleep tells its dialer so, `wake`, since the
-system closes a sleeping socket without a word; `quo/SPEC.md` says
-what the dialer does with it. A tab is a
+holds that line open. A dialer holds one socket to a URL, announces the pks
+this harbor holds when the line opens and again whenever they change, and
+dials again with a wait that backs off to a ceiling when the line drops; how
+far it backs off is this harbor's, and the wait goes back to the shortest one
+where the far side announced and was taken, not where the line merely opened,
+or a listener that opens and then refuses is dialed at one short wait for
+good. A harbor may dial several listeners, and a pk nobody here knows is
+tried down that list in order.
+
+A device that comes back from sleep tells its dialer so, `wake`: whatever
+line it holds, open or still opening, is put down and a new one is dialed
+now, the frozen wait called off. Nothing can tell a line the system closed
+under a sleeping device from a live one, and asking would cost a round trip
+the four words do not have; an announce written into a dead line sits in the
+send buffer and errors only when TCP gives up, minutes later, and for all of
+it every ask to a pk bound behind that line hears `late`. Dialing costs one
+handshake when the line was fine, and an ask made meanwhile waits on the new
+socket. A line put down this way closes when the system gets round to it and
+dials nothing: only the line the dialer still holds dials again. A phone's
+ask must survive a push wake-up, and a tab is a
 device, and one seed never lives in two tabs.
 
 ## Transport by necessity
@@ -333,7 +352,7 @@ rotation, and nothing else.
 ## Reach, directory, rendezvous
 
 A harbor needs two reach kinds and nothing more, which is what
-`quo/SPEC.md` says and what `packages/quo/src/harbor/reach.ts` is:
+`quo/SPEC.md` says and what `packages/nervur/src/harbor/reach.ts` is:
 
 - **request**: a URL. Send bytes, get bytes. Listener to listener.
 - **socket**: a held connection, opened by whichever side can dial, used in
@@ -386,8 +405,10 @@ negotiated: in the text frame a socket announces itself with, and as the
 header `quo-suite` on a request. It is never on an ask, so an ask is bytes
 with nothing in front of them, and a harbor still knows before it carries
 anything whether the far side can open what it would send. A side meeting a
-suite it does not know closes the line; a request door answers nothing
-delivered. `quo/SPEC.md` owns the number and says why it exists.
+suite it does not know closes the line with code 4001; a request door answers
+nothing delivered. A dialer refused that way waits out its ceiling before
+asking again, because a suite does not become speakable by asking sooner.
+`quo/SPEC.md` owns the number and says why it exists.
 
 The **directory** is the map from pk to reach. The memory harbor stubs it with
 linked peers. A real one is a table the harbor fills however it likes, and the
@@ -400,7 +421,7 @@ rebinds it.
 ## The quo. route, as built
 
 The reach interface and its two implementations are the library's,
-`packages/quo/src/harbor/reach.ts`, and pass its reach suite here: the request
+`packages/nervur/src/harbor/reach.ts`, and pass its reach suite here: the request
 and a socket to a daemon in `packages/dock/test/wire.test.ts`, the request
 through the worker inside the edge. The route is one file on every terrain,
 `packages/dock/harbor/quo.ts`, `Request` in and `Response` out, mounted by
@@ -425,7 +446,7 @@ socket       a WebSocket at <url>, held by the dialer, used both ways
              reply frame  [1][id 4][bytes]
              none frame   [2][id 4]                  nothing was delivered
 directory    pk -> reach, filled three ways: a socket a dialer holds, bound once proven
-             and unbound at close; a hint from a link, `quo reach <pk> <url>`, kept in
+             and unbound at close; a hint from a link, `nervur reach <pk> <url>`, kept in
              <dir>/reach.json; and the harbor's own doors, always first
 ```
 
@@ -434,7 +455,7 @@ door or to a socket this harbor holds for that pk, and never onward by
 request. So a third harbor with a hint that a phone's pk is at acme's
 `quo.` sends there, and acme forwards down the socket the phone holds.
 A row on the dock ward's `dialers` faculty makes a daemon a dialer, placed
-once by the root, `quo ask --ward dock dialers keep '{"url":"https://quo.acme.com"}'`,
+once by the root, `nervur ask --ward dock dialers keep '{"url":"https://quo.acme.com"}'`,
 kept in her cells and dialed again at every boot: it holds one socket per
 URL, announces its wards on open, binds the listener's pks, and reconnects
 with backoff from a second to thirty when the line drops. `drop` closes
@@ -454,11 +475,13 @@ root as `/quo/`, with the trailing slash, which the door takes.
 
 ## The two cores, as built
 
-The harbor core is the library's, `packages/quo/src/harbor/core.ts`, and so is
-the dialer, `packages/quo/src/harbor/dial.ts`; `quo/SPEC.md` says what
-they are. Every harbor here extends the core and hands it three things: a
+The harbor core is the library's, `packages/nervur/src/harbor/core.ts`, and so is
+the dialer, `packages/nervur/src/harbor/dial.ts`. Neither is a word of the
+protocol: `quo/SPEC.md` says what a harbor owes a ward and what a reach owes
+a far harbor, and a core and a dialer are how this kit pays both on every
+terrain. Every harbor here extends the core and hands it three things: a
 **store**, the library's interface, with `files.ts` on a disk, plain as three
-files per ward or sealed as one blob when the daemon holds `QUO_SEED_KEY`,
+files per ward or sealed as one blob when the daemon holds `NERVUR_SEED_KEY`,
 and `idb.ts` in a tab, each passing the library's store suite, the files
 store in both forms; a **loader**, the code half, a
 module from a folder on a daemon and the bundle in a tab; and a **lease**, a pid
@@ -523,7 +546,7 @@ is the harbor. The platform runs one instance of it at a time, which is
 the lease and the single writer every ward needs. Its storage is the
 store, `storage.ts`: one row per ward, seed, partition and record, with the
 seed sealed by `seal.ts` under a key from the platform's secrets,
-`QUO_SEED_KEY`, so the storage holds ciphertext and the secret store holds
+`NERVUR_SEED_KEY`, so the storage holds ciphertext and the secret store holds
 the one key, as the table above says. The deployed worker is the code, the
 built-in beings and whatever it hands in. It is a listener and never a
 dialer: reached by request at `<origin>/h/<name>/quo`, holding the sockets
@@ -531,7 +554,7 @@ dialers open to it on the platform's own socket pair, the rendezvous for
 them, awake per request and kept awake by a held socket.
 
 Its owner door is a route, not a socket, because the platform has no local
-process: the root is whoever holds `QUO_ROOT`, a platform secret, and the
+process: the root is whoever holds `NERVUR_ROOT`, a platform secret, and the
 root's asks arrive as one POST at `<origin>/h/<name>/root` under it, the
 first of them `{ init: { ward, user } }`, the root's setup. That is the
 device's own rule on this terrain, as file permissions are on a disk. The
@@ -626,8 +649,9 @@ this harbor, the dock's shell over it, and the link the platform hands the
 app, as the launch URL and then on every link opened while it runs.
 
 The harbor on a phone is the browser harbor, `browser.ts`, over that
-store: the browser harbor takes a name, which is an IndexedDB database
-under a web lock, or a store handed in, whose lease is the process that
+store: the browser harbor takes a name, `nervur` unless one is given, which
+is an IndexedDB database under the web lock `nervur:<name>`, or a store
+handed in, whose lease is the process that
 holds it, since an app has one harbor and nothing else can open its
 files. `nativeHarbor` in `capacitor.ts` is that harbor booted and armed:
 the App plugin's foreground event tells it `wake`, which tells every
@@ -735,7 +759,7 @@ desk, so a desk is reached while the app is open and drains what it
 missed when it opens. The one
 window the desk app has is a surface over the DOM like the tab's, and the
 screen runs in it: nothing of the desk app is a daemon, spawns one or
-attaches to one. A person who wants a home on a Mac runs `quo serve` on it
+attaches to one. A person who wants a home on a Mac runs `nervur serve` on it
 as an operator, and that is a home like any other and no concern of the
 app's.
 
@@ -760,8 +784,8 @@ heir dies at the first knock, and whoever opens it first is bound.
 
 ```
 device
-  quo serve                      one process, one harbor, the ask pointer
-    quo.sock                     owner asks; local only; never behind a proxy
+  nervur serve                      one process, one harbor, the ask pointer
+    nervur.sock                  owner asks; local only; never behind a proxy
     side.sock                    local sides; local only; never behind a proxy
     127.0.0.1:8787               the HTTP door, loopback only; routes mount by path
       /health                    the wards it hosts, by name and pk, and the saves refused; harbor/http.ts
@@ -786,8 +810,8 @@ the edge, in a browser's own service worker, on Deno and on Bun, and the
 terrain is the door and never the side.
 
 The daemon listens on loopback only, and only when asked, with `--http PORT`
-or `QUO_HTTP`. The proxy faces the world and terminates TLS; the daemon never
-does. `quo estate` writes a systemd unit that runs the daemon as one user
+or `NERVUR_HTTP`. The proxy faces the world and terminates TLS; the daemon never
+does. `nervur estate` writes a systemd unit that runs the daemon as one user
 forever, a launchd agent that does the same on a Mac, and a Caddyfile that
 maps the hostnames onto the one port by path, from the templates in
 `packages/dock/cli/estate/`.
@@ -804,7 +828,7 @@ There is no `cli.` route.
 **Where the addresses come from, per terrain.** One convention holds
 everywhere: the four routes are `mcp.`, `web.`, `quo.` and `api.` under one
 domain, over https, and nobody types a hostname four times. On a droplet
-the domain is said once, `quo init --domain acme.com` or `quo domain
+the domain is said once, `nervur init --domain acme.com` or `nervur domain
 acme.com`, and `<dir>/routes.json` is written by the convention; an estate
 whose names break it edits that file, and it is the one file that stands
 beside the wards by right, since a ward knows its pk and never its
@@ -824,10 +848,10 @@ A harbor here is accepted when it passes the library's conformance suite
 untouched, and by nothing else. Three do: the disk harbor over the wire
 under both reaches, the browser harbor through a daemon, and the edge harbor
 inside the platform's runtime. Every store passes the library's store suite,
-`packages/quo/src/conformance/store.ts`: files in
+`packages/nervur/src/conformance/store.ts`: files in
 `packages/dock/test/store.test.ts`, IndexedDB and the edge's storage inside
 their terrains behind `deep:dock`. Every reach passes the library's reach
-suite, `packages/quo/src/conformance/reach.ts`. The store, the reach and the
+suite, `packages/nervur/src/conformance/reach.ts`. The store, the reach and the
 core are the library's, and every harbor here is one of them over its own
 terrain.
 

package/{human/quo-human.md → quo-human.md}

@@ -131,7 +131,7 @@ running there, from her cells, and painted by the same painter.
   on every device and no class carries a layout. A kind an estate wants and
   the grammar lacks is asked for here, and never written around.
 - **The painter emits the kit and nothing else.** Every node paints as a
-  piece of `papers/quo-ui.md`'s catalogue, a `stack` as `.nv-stack`, a
+  piece of `papers/nervur-ui.md`'s catalogue, a `stack` as `.nv-stack`, a
   `list` as `.nv-list` of `.nv-item`, a `person` as `.nv-person` with an
   `.nv-avatar`, a title as `.nv-t-title`, a form as the kit's fieldset and
   fields and one `.nv-button`, an answer as `.nv-answer` with the word it
@@ -326,7 +326,7 @@ Read with the trunk's "Carrying" and "The look", which this applies.
 - **Worlds have addresses, and so do the beings one holds.** `web./<ward>`
   is that world's page, `web./` lists the worlds shown, and a hostname per
   world is one proxy line, the estate's choice. Shown is the ward's own
-  mark, `quo show` and `quo hide`, hidden at `init`: a hidden ward is not
+  mark, `nervur show` and `nervur hide`, hidden at `init`: a hidden ward is not
   listed and a stranger at its page meets the plain door, while a link
   still knocks with its invitation and the desk still answers a proof, so
   an estate shows its face and leaves every home hidden. `quo.` stays one per harbor,
@@ -339,24 +339,24 @@ Read with the trunk's "Carrying" and "The look", which this applies.
   device paints as nothing, since an address adds no right. Every section
   on the world's page says where its own page is.
 - **A link is the page with the invitation in the fragment**, under the one
-  reserved key `quo`, the invitation compact as `ward.heir.secret` or
-  `ward` alone: `web.acme.com/shop#quo=...`. The fragment never leaves the
+  reserved key `nervur`, the invitation compact as `ward.heir.secret` or
+  `ward` alone: `web.acme.com/shop#nervur=...`. The fragment never leaves the
   browser, where a query string would reach the server, its logs and every
   referer. The tab reads it, strips it from the address bar before anything
   else runs, and joins. A page's own routing keeps the query, the path and
-  the rest of the fragment; only `quo` is taken. `beings/link.ts`.
+  the rest of the fragment; only `nervur` is taken. `beings/link.ts`.
 - **An answer that is an invitation paints as the link it is.** The only
   thing to do with one is to open it, and a being does not know where her
   page lives while the side does: the side builds the link on the world's
   page address, which is why the grammar carries no URL and this is not a
   node. It is how devices beget devices on a page: a human asks her user
   being's `device` for the next one and gets back a link to send, the same
-  link `quo invite` prints on the box. A side with an `admit` shows a guest
+  link `nervur invite` prints on the box. A side with an `admit` shows a guest
   the door instead, and that is the door alone.
 - **An invitation is self-addressing.** It names its ward by pk, so the
   path of the page it was opened on is a hint for humans and nothing more:
   the tab joins in the local ward of the ward the invitation names, and
-  the address follows. `web./#quo=...` is a complete way in for anyone
+  the address follows. `web./#nervur=...` is a complete way in for anyone
   holding an invitation to any ward the harbor hosts, and every ward has a
   page, whether or not anyone is at its door, so that a link into one has
   somewhere to land; a ward with no public being says it admits by