@nervur-org/dock 0.3.0

package/human/quo-human.md

@@ -0,0 +1,1042 @@
+# The human side
+
+This is how a Quo world speaks to a human, and how a human speaks back. It
+is one side of the avatar described in `papers/quo-dock.md`,
+which owns the avatar, the front desk, the credential exchange, carrying,
+the look and the shared invariants; this document assumes all of that and
+adds only what a screen needs. It names no transport and no model. A tab is
+a device with a harbor of its own, and where its bytes go is
+`papers/quo-harbor.md`.
+
+The claim, made good on: a human needs no page written for them. A screen
+is a blueprint spoken as HTML. A being's describe for this asker becomes the
+forms the human sees, a submitted form becomes a named ask, an answer
+becomes a view, a push becomes a notification, and the three words for "no
+object" each have a face. Nothing the screen shows exists anywhere but in a
+blueprint and a look, so every world gets a screen for free and no world
+gets a screen it did not describe.
+
+Three sides, one describe. The CLI, the model side and the screen are three
+views of the same beings, and the screen adds no vocabulary of its own:
+what a being can be asked is her blueprint, how she wants to be shown is
+her `look`, and both are values that travel through the relation. A being
+who wants more than forms answers `page`, her page as a tree of values in
+one closed grammar, and the screen paints it; a being who answers nothing
+gets the forms. A world that wants a page of its own writes any HTML, CSS
+and JavaScript it likes on its own origin, against the avatar's handles and
+nothing else; a world that writes none gets this screen.
+
+## What a human meets
+
+This side answers for every moment a human has with a world, and the set is
+closed. It is fixed by what Quo already decides: four rungs, stranger,
+occupant, owner and root; an org's three things, home, presence and
+membership, and the state of holding none; four surfaces, a public front,
+the `web.` route, an app and the doorbell; and eight acts, arrive, join,
+ask, be answered, be woken, authorize, move and leave. A moment outside
+that set is either not a human moment or one of those four is wrong, and
+the second is worth knowing.
+
+**Arriving.** A stranger reaches a world's page carrying nothing and meets
+the door page, which asks for nothing, because there is nothing a stranger
+could type that would let them in. A stranger who has never heard of Quo
+meets a public front instead, which is a website and not a route into any
+box.
+
+**Joining**, and there are three ways and no fourth. An invitation in a
+link's fragment, joined in the ward it names. A proof a world handed out
+itself, which names no ward and is knocked at the public being of the
+world whose page it was opened on. A form on that public being's page
+whose answer is an invitation. Nothing is typed to get in on any of them.
+How a world hands out the second is the world's own business and never
+this side's: what a kind of proof is, and what carries it, is decided by
+the org and named nowhere here.
+
+**Asking and being answered.** Her describe for this asker is forms, her
+answer is a view, her `look` says how her section is painted, and her
+`page` is a tree of values she designs and the screen paints. An answer
+that is an invitation is a way in and reads as one. An answer that is a
+link reads as a link, and the side is what composes it, since a being
+knows no routes.
+
+**Holding more than one relation.** One local ward per far world, one
+avatar per relation. Two people sharing one device are two relations in
+one world, and one person may hold several in the same world.
+
+**Being woken.** With a page open, on a page that is closed, and in an
+app. What the human reads is composed on her own device from objects that
+crossed sealed, and never by whatever carried the ring.
+
+**Authorizing.** A model or a program asks to be let into a world, and a
+human is the only one who can say yes. No other way in answers this.
+
+**Placing an account.** An envoy stands in for a thing that speaks no Quo,
+and the key that account was given is placed from a form on the owner's own
+page, by the ordinary screen and never at a shell. The screen never paints
+it back, because the envoy answers that she kept it and answers nothing
+else, ever.
+
+**Lending.** What a device can do, it offers as forms on that device's own
+page, and the platform's prompt belongs to the first ask rather than to the
+install. A refusal is the error object every ask after it answers.
+
+**Moving.** A world goes from one device to another whole, and the far
+world is never asked and never told.
+
+**Gaining a home.** An org whose whole existence was standings in other
+orgs' worlds boots a home, and joins each of those worlds from it. Her
+device at each mints an invitation as it would for any device of hers, and
+her home knocks with it, so from the far side a home is one more thing of
+hers holding a standing. Nothing is converted and no id changes, because
+there is nothing to convert.
+
+**Leaving, and losing.** A relation ends when either side removes a
+standing, and the screen tells the two apart from a world that is merely
+away. A device is lost or its store is cleared, and a presence is a seed,
+so what that costs is said plainly.
+
+## The page
+
+The front end is a ward, and the first move towards it: a page is a tree of
+values in a closed grammar the dock owns, `tree.ts`, and a far being
+answers it from `page` the way she answers `look`, values only. One
+grammar, two sources: the same tree will be computed in the tab by a being
+running there, from her cells, and painted by the same painter.
+
+- **The grammar.** `stack` and `row` hold children, one under another or
+  side by side; `text` is words with a role, `title`, `lead`, `body`,
+  `quiet` or `label`; `image` is a picture as a data URI, never a URL;
+  `form` is one of her asks by name, painted as the form the schema gives;
+  `answer` is one of her asks' last answer, shown as `auto`, `text`,
+  `table`, `cards`, `list`, `people` or `feed`; `standing` is one standing
+  she carries, painted as its section; `standings` is every one of them;
+  `link` is somewhere to go. No selector, no stylesheet, no script, and no
+  node beyond these: a node that fails its shape is dropped, not fixed, and
+  a container with nothing left is kept empty, since an empty region is a
+  design and not a fault.
+- **A being says what, and never how.** A container may name the kind of
+  thing it holds, `as`: a stack is a `list`, several of one thing as rows
+  on one surface; a `grid` of cards; a `hero`, one thing on a lot of air;
+  a `feed`, what happened in order; and a row is a `person`, a face and
+  the words beside it. A standing may be a `door`: named, with the way to
+  her own page, and nothing of hers on this one, which is how the user
+  being carries her own world's door, seven owner asks that are a page of
+  their own and not a section among her worlds. An answer names its kind
+  the same way: `people` are
+  rows of `{ name, line?, picture? }`, a `feed` rows of `{ at, text }`, and
+  a value not of that shape is shown by its own. That is the whole
+  vocabulary an estate gets. What each kind is on a screen, where it sits,
+  how it reflows, is the painter's opinion and the kit's piece, one for
+  every world, so a family's members and a shop's customers are one shape
+  on every device and no class carries a layout. A kind an estate wants and
+  the grammar lacks is asked for here, and never written around.
+- **The painter emits the kit and nothing else.** Every node paints as a
+  piece of `papers/quo-ui.md`'s catalogue, a `stack` as `.nv-stack`, a
+  `list` as `.nv-list` of `.nv-item`, a `person` as `.nv-person` with an
+  `.nv-avatar`, a title as `.nv-t-title`, a form as the kit's fieldset and
+  fields and one `.nv-button`, an answer as `.nv-answer` with the word it
+  came back as on it, a standing as `.nv-standing` under her own look. The
+  screen's own stylesheet is what the shells alone have and holds no
+  piece of its own; a piece it needs is the kit's or is asked for there.
+- **A name is said once.** The bar names the world and where the human
+  stands, as a chip whose tone is her standing; a page that opens with a
+  title of its own is the name, and the bar keeps only the chip. A being
+  painted as forms has no page to say it, so the bar says her name. A
+  standing painted inside another's page keeps her own title inside her
+  section, and the section that is the whole page is the page's title.
+- **A link is named by a being and vouched for by the side.** A human who
+  must pay, sign or come back from a vendor has to be able to go there, so
+  a being may name a place. She names it and no more: the grammar takes an
+  absolute `http` or `https` address, parsed rather than matched, so a
+  scheme that runs code or carries its own content is nothing at all. What
+  the side then does with it is the rule. Two origins are vouched for and
+  no third. The origin of the page she is standing on, so a being may move
+  a human around inside the world she already chose. And the origins that
+  being declared in her look as the ones she stands in for, `stands`,
+  which is how an envoy speaking for a payment or a booking vendor sends a
+  human to that vendor's own checkout. A carried standing vouches by her
+  own look and never her carrier's. Any other address is painted as its
+  own words, in full, and the human goes there by her own hand or not at
+  all. An address is never dropped in silence, because a page that quietly
+  deletes what a being said is a page that lies about her.
+- **A link that leaves the world says so.** An anchor to an origin the
+  being stands in for carries that origin in the page, and the screen
+  paints it after the words, so where a human is going is read on the page
+  rather than in a status bar she may never look at. An anchor is handed
+  no window and no referer, `noopener` and `noreferrer`, since the page it
+  opens is the vendor's and not ours.
+- **An answer that is an invitation is a way in.** The side recognises one
+  and composes the link itself, on the world's page address, because a
+  being knows no routes and a side does. This holds for every ask on every
+  shell, a tab and an app alike, and it is why the grammar carries no
+  address for it.
+- **A page adds no right.** Every name a tree uses, an ask or a standing,
+  is looked up in her describe for this asker; a name that is not there
+  paints as nothing. Her page says what is shown and where, and her gate
+  says what may be asked; a device that may not wake sees no `push` form
+  however her page names it, and an ask her describe holds but her page
+  does not name has no form. `hello` and `report` are wiring, a device's
+  first word and an agent's callback, and stay under the gate and off her
+  page.
+- **What opens with the page.** The answers a tree shows are run on open
+  when the ask needs nothing typed, beside the read-only asks her look
+  marks, so the page opens with what it shows.
+- **The page is presentation.** `page` is asked after every call, and it is
+  never a form and never a tool, hers or a carried one. The user being
+  answers one: her name as the title, who this device is as
+  an answer, her standings as sections, and the three things a human does
+  here by hand, bringing her next device in, waking one and calling her by
+  a name, as forms.
+  A being does not know her own key, so her name is given: by the desk's
+  first hello at the root's setup, or by a device the root minted, through
+  her `name` ask, the trunk's rule.
+- **The door is the first page in the grammar**, painted with nobody behind
+  it: no ask, no answer, no standing, only the mark, a word and a sentence.
+
+## The tab ward
+
+A world's code runs in the tab, as beings. The second source of the one
+grammar: a being booted in the tab's local ward for a world answers `page`
+from her cells, and the same side paints her with the same painter. No
+second verb, no framework, no script of the world's on the page: only
+classes, and the ward runs them.
+
+- **The world's code is a module the harbor folder holds**, `tab/index.ts`,
+  the twin of `classes/index.ts`: the classes meant for the tab, exported
+  by name. The estate that deploys the harbor bundles it into
+  `tab/index.js` beside the source, because the route runs no compiler, and
+  the web route serves that built file as `beings.js` on the world's origin
+  and tells the page it exists. A folder with neither has no such path; a
+  folder with the source and no built file is a build that did not run, and
+  the path says so instead of serving a page with no classes in it. Code
+  crosses the origin, never a relation, and one origin is one world's code.
+- **A world wears a design, and the harbor folder holds it.** `design/`
+  beside the wards is one design's compiled face, `tokens.css`, and the
+  faces it speaks in, `fonts.css` and `fonts/`, copied there from the
+  design the estate wears. The route reads no file: it asks the terrain for
+  those three things by name, and a name it does not know it never asks
+  for, so nothing else in the folder is reachable. Every page it writes
+  links them
+  after the kit without the kit's own face, since a surface loads the
+  default face or a design's and never both; the page's policy admits its
+  own origin for styles and fonts and no other. A harbor with no `design/`
+  wears the kit's own face. The app wears the kit's face and a world's
+  look tints its section, since the app is one bundle for every world.
+- **The boot at join.** The tab loads the world's classes before its harbor
+  boots, since a being kept from the last visit is booted by her class
+  name. When a relation goes on screen, the tab boots one being of each
+  class under that relation's key, `r1-Notes`, the first time, and finds
+  her there after: her cells are in the ward, kept in the tab's store after
+  every ask and migrating with the ward. Two relations in one world are two
+  of each, since what she keeps is one person's.
+- **A subject with no standing.** The tab holds that ward's ask pointer, so
+  the tab is its root, and `local.ts` is the owner's `ask` and nothing else:
+  no relation, no key rotation and no asker of its own making, since the
+  local ward is the human's and she is on it. The ward names the asker,
+  bounds the wait, judges her answer and saves before the pointer returns.
+  Her describe is what she shows the tab, her
+  forms are her asks, and a push never reaches her, since nothing outside
+  the tab holds her.
+- **Her page follows every ask.** `page` is asked again after each call
+  and the answers it shows are run again with it, so a cell moved is a page
+  moved whether or not her describe moved. The describe, the look and the
+  read-only asks off the page stay once per digest. A far being pays the
+  same: her page is never more than one ask behind her.
+- **One section each.** Under the far being's page, each being of the world
+  has her own section and her own side; the shell's own heading is dropped
+  wherever a page carries its title.
+- **A carried page is painted in her section.** The third source of the one
+  grammar, and no new grammar: a standing the user being carries answers
+  `page` like anyone, the carrier carries it as `<id>-page` and names it in
+  her notes, and the side asks it after every call like her own. The
+  section that was her forms under her name becomes her page under her
+  look, painted through a painter of her own: a form or an answer it names
+  is one of her asks by its bare name, carried, and a name that is not hers,
+  or a `standing` inside a page, paints as nothing. So a far page reaches
+  nothing outside its section, by construction and not by a shadow root:
+  the grammar carries no selector, no script and no stylesheet, the one
+  stylesheet is the shell's, and a root of her own would keep the shell's
+  stylesheet out of her section for no gain. The section is the root a page
+  owns.
+
+## How a screen is made
+
+Read with the trunk's "Carrying" and "The look", which this applies.
+
+- **A form from a schema, without a designer.** An input schema is a form
+  with one field per property by type: a string is a text input, and
+  `password`, `date`, `email` and `time` are the input's type; a number is a
+  number input; a boolean a checkbox; an enum a select; an object or an
+  array a box for JSON. The submitted strings come back as arguments typed by
+  the schema, an empty optional field left out. A hint from her look puts a
+  title and an icon on the button and marks a destructive ask.
+- **What the screen can answer, the screen answers.** A property whose schema
+  says `format: "moment"` gets no field: a being may not read a clock, and a
+  screen is not a being, so it fills the moment from the device it runs on,
+  at the moment the form is sent rather than the moment the page was drawn.
+  A read-only ask with nothing left for a human to type then runs itself on
+  open and draws its answer where its form would have been. So a clock's page
+  opens as three tables, and nobody is ever asked to type milliseconds. It is
+  read off the input schema and never off a look, because a look is what a
+  being says about being drawn and this is not: the ask says what the argument
+  is, and each side does what it can with that.
+- **A view from an answer.** A primitive is text, an object a table of its
+  keys in the output schema's order when she declared one, a list of objects
+  one table, null the word nothing. An error object is marked; silence and
+  each of the ward's words say what the side says of them.
+- **A standing is a section.** The user being carries her standings, and
+  her notes say which asks are whose. The page draws her own asks first,
+  then one section per standing, headed by that being's name and logo and
+  painted with her tokens as CSS variables on that section and nowhere
+  else. A form in acme's section is an ask on the human's standing at acme,
+  and acme sees the human, never the device. The same section appears on
+  acme's own web, under the same look: one component, two relations.
+- **The page follows the digest.** The side asks the describe again after
+  every call, asks `look` once per digest and `page` after every call; a
+  digest that moved is a page that moved, and so is a cell that moved
+  behind a page. A read-only ask with nothing to type is run on open,
+  so a page can open with what it shows and not only with buttons. Every one
+  of those asks rotates her keys, so the side saves after each, not only
+  after a form: a relation brought back from a reload with a stale count is
+  refused at the far door and hears silence.
+- **What a look may carry, and never.** The trunk's table is the whole
+  list: a name, a logo as a data URI, three colours, a font, a radius, an
+  order, a hint per ask. No CSS, no URL, no script, ever. A token that fails
+  its shape is dropped. Her tokens become the kit's slots on her section and
+  nowhere else, her accent the accent there, her ground the raised ground,
+  her font the sans, her radius the large corner, and the slots that follow
+  from those follow in the stylesheet; so one colour of hers recolours her
+  whole section and nothing outside it. The page owns layout and typography;
+  a far being paints inside her section and cannot reach out of it.
+- **The shells wear the kit.** One stylesheet, the kit's and then the few
+  things only a shell has, served by the daemon beside the bundle and
+  carried by the app. A shell's own elements are the kit's pieces too: the
+  worlds a device is in are chips on a strip that stays at the top, a
+  relation is a chip, leaving and moving are buttons in the kit's variants,
+  and the door, the held page and the landing page are one thing on air.
+  Nothing a shell paints is a bare element with a rule of its own.
+- **A world is a ward with a public being, and the guest page is her
+  describe.** Whatever class she is. The tab knocks the ward's public
+  invitation, its pk alone, with the empty ask, and renders what she shows
+  strangers with this same screen: the desk shows `hello` and `device`, a
+  shop could show its availability, a garden its `enter`. A form on that
+  page is a knock on the public invitation, and an answer that is an
+  invitation is the way in: the side hands it to `admit`, the avatar joins,
+  and the page becomes hers. Nothing in the screen knows the word desk.
+- **Worlds have addresses, and so do the beings one holds.** `web./<ward>`
+  is that world's page, `web./` lists the worlds shown, and a hostname per
+  world is one proxy line, the estate's choice. Shown is the ward's own
+  mark, `quo show` and `quo hide`, hidden at `init`: a hidden ward is not
+  listed and a stranger at its page meets the plain door, while a link
+  still knocks with its invitation and the desk still answers a proof, so
+  an estate shows its face and leaves every home hidden. `quo.` stays one per harbor,
+  since bytes route by pk. `web./<ward>/<being>` is the page of one
+  standing the user being carries, by its id, as the whole page: her
+  section is the page, her title the page's, the shell's own asks and the
+  world's tab beings stay on the world's page, and a line at the top leads
+  back. No router: the path is a key, the server hands it to the tab as it
+  hands the ward's name, and a key her describe does not carry for this
+  device paints as nothing, since an address adds no right. Every section
+  on the world's page says where its own page is.
+- **A link is the page with the invitation in the fragment**, under the one
+  reserved key `quo`, the invitation compact as `ward.heir.secret` or
+  `ward` alone: `web.acme.com/shop#quo=...`. The fragment never leaves the
+  browser, where a query string would reach the server, its logs and every
+  referer. The tab reads it, strips it from the address bar before anything
+  else runs, and joins. A page's own routing keeps the query, the path and
+  the rest of the fragment; only `quo` is taken. `beings/link.ts`.
+- **An answer that is an invitation paints as the link it is.** The only
+  thing to do with one is to open it, and a being does not know where her
+  page lives while the side does: the side builds the link on the world's
+  page address, which is why the grammar carries no URL and this is not a
+  node. It is how devices beget devices on a page: a human asks her user
+  being's `device` for the next one and gets back a link to send, the same
+  link `quo invite` prints on the box. A side with an `admit` shows a guest
+  the door instead, and that is the door alone.
+- **An invitation is self-addressing.** It names its ward by pk, so the
+  path of the page it was opened on is a hint for humans and nothing more:
+  the tab joins in the local ward of the ward the invitation names, and
+  the address follows. `web./#quo=...` is a complete way in for anyone
+  holding an invitation to any ward the harbor hosts, and every ward has a
+  page, whether or not anyone is at its door, so that a link into one has
+  somewhere to land; a ward with no public being says it admits by
+  invitation only.
+- **The tab is a browser of worlds, and of the relations in each.** One
+  harbor per origin, one local ward per world joined, and inside it one
+  avatar per relation, since an avatar is one standing: a fresh invitation
+  is always a fresh avatar, never a join on one that already holds hers. A
+  link opened while in is one more relation; two humans on one family
+  tablet are two relations in one world; a switcher over worlds and
+  another over relations, and a switch is a switch of avatar and nothing
+  more. A world on another origin is another page, and the switcher links
+  there. `worlds.ts` is this without a document, and the memory harbor
+  proves it.
+- **The policy.** The page carries a content security policy: scripts from
+  its origin only and never inline, connections to its origin and the `quo.`
+  route it dials, images from data URIs and its origin, no frames, no base.
+  The config crosses in a JSON script, which the policy allows. A bug in a
+  renderer cannot become a script, and no look can reach a server.
+
+## The pieces
+
+Seventeen files under `packages/dock/human/`:
+
+- `local.ts` is a being of the world in the tab's own ward as a subject:
+  her door spoken to in-process under the tab's asker, no standing.
+
+- `tree.ts` is the page grammar and its painter, pure: `sanitiseTree`
+  holds a value to the grammar or drops it, `answersIn` names what a tree
+  shows the answers of, `paint` writes a tree as HTML through a painter,
+  and `nobody` is the painter with nothing behind it.
+- `html.ts` is pure, strings in and strings out, and is the screen's whole
+  vocabulary: `form`, `values`, `view`, `face`, `look`, `page`. It reads the
+  look's vocabulary from `beings/look.ts` and the grammar from `tree.ts`
+  and adds none; its painter looks every name a tree uses up in her
+  describe.
+- `screen.ts` is the side: one avatar and one surface, where a surface can
+  only show a page and hand back a submitted form. It keeps the model,
+  speaks it as a page after every change, calls her when a form comes back,
+  re-asks her describe after every call, asks her look once per digest and
+  her page after every call, and runs her read-only asks once per digest
+  and the ones her page shows the answers of after every call. A push is
+  appended and shown as it lands. A
+  describe that fails leaves the last page standing and says so in the
+  notice.
+- `dom.ts` is the surface on an element, the one file that touches one.
+- `guest.ts` is a world's public being as a subject the screen renders:
+  her describe for a stranger, a form as a knock on the public invitation.
+- `worlds.ts` is the worlds and relations of a device with no document in
+  sight: the local ward for a far pk, the relations in it, a fresh avatar
+  for the next way in, and the list of worlds joined, kept by pk with the
+  address each was reached at. A world met again at a new address is the
+  same world and keeps its ward, since the pk is what an invitation names.
+- `move.ts` is a world moving from one device to another, the shell half of
+  the courier in `beings/courier.ts`: the offer a device makes of a world it
+  holds, the invitation and the reach note as one link, and the taking on
+  the other side, the ward adopted and the word back that let the first one
+  delete it. It is the only place a shell hands a ward over or puts one
+  down, and both shells wear it, since a move is a move on any device.
+- `wake.ts` is the device's half of the doorbell, worn by every shell: the
+  doorbell this device holds at its bell, what a world is told of it, the
+  ear subscribed, what each relation missed drained and landed on its
+  avatar, and what the human reads composed from those objects.
+- `worker.ts` is the ear itself, the service worker on a world's origin and
+  the one piece of a tab that runs when nothing of the tab is open.
+- `app.ts` is the app's shell, what `tab.ts` is for a page. A tab is on a
+  world's own origin and is handed that world by the page it was served; an
+  app is one origin of its own, every world is somewhere else, and it
+  learns each by one fetch of its address and keeps the list itself. One
+  harbor, whichever the terrain has, a ward per world by pk, a switcher
+  over them, one world's page at a time, and every world dialed and not
+  only the one on screen, since a world reaches a device by the socket the
+  device opened. No world's code ever runs in it: an app is a published
+  bundle on somebody's phone, and a world that could put code in it would
+  be a world that owns the phone. It is the same shell on the phone and on
+  the desk, the one screen every Quo app has. What it boots when a world is
+  joined is the Presence, the being of that world who lives on this device,
+  holding at her birth a standing at every faculty the box lends, so the
+  first page a world shows carries them and a world reaches the device by
+  asking her.
+
+  The switcher lists the wards she is in, home first, her memberships
+  behind it, and a direct membership she has no home for beside it, each
+  by the name the world gave; with one entry there is no switcher. A world
+  is a home when the being reached there is her user being, who says so
+  with `home` in her describe's notes, and no other being does; the shell
+  keeps that beside the address and the name. Its
+  last entry is never a world: it is this device, the harbor's dock ward
+  with an avatar its root booted there holding a standing at every
+  faculty, shown by the ordinary screen where a world's user being would
+  stand. That page is where a human sees what the box lends, as forms that
+  ask each faculty and show what it answers, a refusal included, the
+  worlds this device is in with a way out of each, which drops that local
+  ward whole and tells the far world nothing, a way to another device for
+  each, which is the Courier's offer, and the one sentence that a reinstall
+  starts fresh; a device that has joined no world sees it first.
+  It is there because a fresh install otherwise asks for location and
+  notifications in its manifest and shows nothing that ever asks for them,
+  which is a store reviewer's first question and a human's second.
+
+  It wears the device's half of the doorbell, `wake.ts`, as the tab does.
+  Two things are handed to it beside the harbor, and both are the build's:
+  the ear, which answers the token this device is reachable at or null, and
+  the bell, its ward's pk and the rendezvous it is reached over. It knows
+  there is an ear and never what kind, and where a bell stands is a build's
+  business and never a being's.
+
+  The token goes to a doorbell of this device's own at that bell, and to
+  nobody else: a store's token is the same at every world, so a world that
+  held one could wake her forever and a rotation would be one write per
+  world. What a world is handed is a standing at that doorbell and the
+  banner key it seals to, said once, because a standing does not rotate.
+  A shell handed no bell holds no doorbell and hands a world nothing, which
+  works in every other way. A tab keeps its own endpoint and is untouched:
+  a browser endpoint is rung only by whoever holds the VAPID secret the
+  subscription was made under, and that secret is the world's own, so it is
+  not a credential that travels. Waking asks
+  every world what it missed and not only the one on screen: a device is
+  woken for whichever world had something to say, and one that drained
+  only what it was looking at would leave the rest waiting for a second
+  wake that may never come. What the human reads is composed here from the
+  objects and never from the ring, which carried nothing, and only when
+  nobody was looking, because a page that is open already shows every one
+  of them where the push would have landed; showing it is an ask on the
+  dock ward's notifications being through the harbor's own pointer, the
+  same act on every terrain and no second body for it.
+- `style.ts` is the stylesheet, one for every screen there is: the web
+  route serves it beside the tab's bundle and the desk app's window carries
+  it in its own. A screen that looked like another product on another
+  terrain would be two designs to keep and one of them always behind. It is
+  `@nervur-org/ui` and then what the screen alone has, as one string,
+  because a screen builds its own page and has nowhere to put a link. The
+  kit brings the tokens, a face, the reset and the bare controls, layered;
+  the screen's own rules are unlayered and win. Nothing in it names a
+  colour: every one is a slot, so a face swapped for another swaps the
+  screen with it. A far being's look still sets `--accent`, `--bg`, `--fg`,
+  `--font` and `--radius` on her own section, and those five stay her
+  vocabulary; the root only defaults each one out of the kit. The page's
+  one column is padded by the device's safe-area insets as well as the
+  gutter, since an app fills the screen it is on, corners and camera and
+  all, and `env()` is zero in a tab and a window.
+- `mark.ts` is the mark, a ring with a gap and a point at its centre, one
+  being's voice reaching another's door. The door page wears it, and so
+  does every Quo app: `app/icon/build.ts` renders the app icons
+  from this one glyph, so a hand-drawn icon can never drift from it.
+- `door.ts` is the door page, pure: what a stranger sees where nothing
+  lets them in, Quo's page and not the estate's, asking for nothing,
+  written as a tree and painted with nobody behind it.
+- `tab.ts` is the shell: the harbor in the tab, the config, the two
+  switchers and the two ways in, and hands one avatar at a time to the
+  side.
+- `web.ts` is the web route, mounted under `/web` by every terrain that has
+  a front door: the daemon and the edge worker both. It serves the list of
+  worlds or the door page at the root, a world's page with its config, the
+  bundle of `tab.ts` it is handed, the policy header and the stylesheet. The
+  bundle and the service worker's arrive as strings, built once by the dock's
+  own build, which emits both beside their source and into `dist/human/` so
+  that one path resolves in either tree. The daemon reads the file off its
+  disk; a deploy at the edge carries the same bundle as a text module. No
+  compiler runs in a server either way. What the
+  world keeps beside its wards arrives the same way, through a `Folder` the
+  terrain answers: the design it wears, by file name, and its own code for
+  the tab, a folder on a disk and rows in an object's storage at the edge.
+  It takes a `Request` and answers a `Response`, and a path that
+  is not its own it answers nothing to, which is how it declines. So the
+  route reads no file, names nothing of Node, and runs wherever a harbor
+  does. It
+  authenticates nothing and admits nobody; the knock is the tab's. Paths
+  it does not take fall through to the exchange pages. The same config
+  crosses as JSON to an app, which is not a tab: an app asks a world's
+  address for JSON from its own origin and learns the world by that one
+  fetch, never the bundle, since its code is its own and a world's code
+  never runs on a phone. Only the origins a Quo app's webview speaks from
+  are answered, `tauri://localhost` on the desk and Capacitor's two on the
+  phone, and only with the config; every other origin asking the same way
+  is served the page, because a world's config is not a thing to hand a
+  stranger's browser. The fetch is a plain GET asking for JSON, which no
+  browser preflights, and the answer says `vary: origin` so that no cache
+  hands one origin what another was told. It also serves the two
+  association files, `/.well-known/apple-app-site-association` and
+  `/.well-known/assetlinks.json`, from `app.json` in the harbor folder: the
+  estate names its apps, the file is the hostname's claim that those apps
+  may open its links, and a platform verifies it over TLS before it hands
+  one over. Every page of the world is claimed but the credential exchange,
+  which belongs in the browser that started it. An estate that names no app
+  serves neither file, and its links open the tab. The words of the claim
+  are `apps.ts`, beside this route and not inside it, because a world's
+  route is not the only hostname that says them: an app's own domain says
+  the same thing and serves no world at all. Apple's format and Google's
+  belong to the platforms and move on the platforms' schedule, so they are
+  written once. A claim with nothing in it is no file rather than an empty
+  one, since a phone reads the two the same way and only one is honest.
+
+Proven in `packages/dock/test/human.test.ts` on the memory harbor with a fake
+surface and no browser, and the DOM surface in the browser terrain: the
+grammar held and painted, the
+user being's page
+with what her gate hides painted as nothing, a being of the world in the
+tab's ward paged from her cells and kept with them, the user being
+carrying a shop with a look, a guest
+at a door that is not a desk let in by a form, the link read, stripped and
+refused, and the worlds and relations on a harbor core over the memory
+store, two invitations into one world being two avatars; and in
+`packages/dock/test/terrain/browser.test.ts` in a real Chromium against a
+daemon on loopback, behind `npm run deep:dock`: the guest page, the
+way in by a link the root minted, a push, a reload, the policy header, a
+link while in as a second relation and the switch back, a link into another
+ward landing on that ward's page, the door page where nobody is at the
+door, and a link at the root; and the app shell in that same browser, two
+worlds on one device with a ward each by pk, a switcher between them, one
+screen, and a push landing while the other world is up, and that same shell
+cold, on a device that has joined nothing, showing the box's own ward with
+a form per faculty and each one answering. The config there
+is handed to the shell rather than fetched, since a world answers its
+config to the app origins alone and a test page is on none of them, which
+is the rule working and is proven where it lives.
+
+## Security, by structure
+
+- Nothing executable crosses. What a screen receives is I-JSON, by the
+  spec: asks, args, answers, the three words, a look and a page. Every string is
+  escaped before it is written into the page; a JSON box is parsed and never
+  evaluated.
+- A look is a closed vocabulary held to shapes. A logo is a data URI, so no
+  request leaves the page towards a far being's server; a colour is a hex
+  colour; there is no token for a stylesheet, a URL or a script.
+- The gate is the permission. What a page can ask is what the being shows
+  that device, already. No page adds a right, and a form for an ask she does
+  not show is nothing.
+- Origin is the boundary. A world's own page runs only on that world's
+  origin; on the human's own web only the dock's bundle and the estate's
+  classes run. A world can only ever damage itself.
+
+## The tab
+
+The tab is a device. The page at `web./<ward>` boots a browser harbor on a
+seed minted into the tab's store the first time, one local ward for this
+world with an avatar per relation in it, and dials the world's `quo.`
+route. **Three ways in and there is no fourth**, one act each, each a fresh
+avatar: a link's invitation, joined at once in the ward it names; a proof
+the world sent out itself, `#proof=<kind>.<token>`, which names no ward and
+so is for the world whose page it was opened on, knocked at that world's
+public being and traded there for an invitation; and a guest form on the
+public being's page whose answer is an invitation. Both fragments are read
+and stripped before any other code runs, and for the same reason: a query
+string is in every log and every referer, and one read of either is one way
+in taken.
+
+**What a proof is worth is the way in's word and never the desk's.** The
+desk routes a proof by its kind to the being who verifies that kind, and
+she says who it is for, how far she may go, whether a user being is made
+for her, and whether the same proof may be spent again. So a refusal here
+is hers: a token she will not take, or a kind she holds no way in for, and
+either leaves the human at the door with nothing taken and one line saying
+so. A proof that names a client already in the world is refused by that,
+so opening the same handed-out link twice is not a second relation.
+
+**A public being is any class, and two of the three ways in ask nothing of
+it.** A ward's public being is an ordinary being the owner marked, and the
+screen renders whatever asks she has: a guest form is the way in when its
+answer is an invitation, and she may call that ask anything, since what
+makes it a way in is the answer and not the name. A link's invitation names
+its own ward and needs her not at all.
+
+The proof is the exception, and the reason is that a proof arrives in a
+fragment rather than typed. There is no form to answer, so the shell hands
+it to a named ask, and that name is `device`: a convention of the dock's
+like `hello`, `look` and `page`. A public being of any class takes proofs by
+writing that ask, and one that writes none has no proof way in and loses
+nothing else.
+
+**What a kind is, and what carries it, is the org's and never the dock's.**
+A kind is a word an org chose, and a way in is a being it wrote or took
+from somewhere. Mail, a message, a code on a screen, a letter, a voice on
+a call, a sign-in a person already holds elsewhere: each of them is one
+kind, and the dock knows the name of none of them. A way in that hands its
+proof out itself says so, and one that only verifies a proof arriving from
+elsewhere says nothing and stands at no door. Nothing in the dock, in the
+screen or in the app is written for a channel, and an org that builds a
+way in nobody here imagined adds a being and a knock and changes no other
+line.
+
+Nothing is typed to get in, no password and no account, the root included:
+the root mints its own first invitation on the box and opens the link. A
+ward with nobody at its door shows the door page, `door.ts`, and a link is
+the only way. From then on there is no
+cookie and no token anywhere, and a reload asks nothing: the seed and the
+standings are in the tab's store, and the relation last on screen is the
+one shown.
+
+## Leaving a world, and being let go
+
+A relation ends from either side, and the two ends are not the same act.
+
+- **A human leaves, and it is one press.** What a device holds of a world
+  is one local ward, and every standing won there is in it, so leaving is
+  that ward dropped whole, seed and all, and the world forgotten from the
+  list. The far world is never asked and never told: it sees one device
+  gone, exactly as it sees a phone that fell in a river. Every shell has
+  this, a tab and an app alike, because a device a human cannot leave is
+  not a device.
+- **A world lets her go**, by removing the standing at its own side. Her
+  next describe says so, and the screen reads the words apart rather than
+  painting one line for every failure. `removed` and `dropped`, and
+  holding no standing at all, are the relation ended: nothing this device
+  does brings it back and the only act left is leaving. `unreached`,
+  `silence`, `late` and `absent` are the world being away: the standing is
+  untouched and the next ask may well answer. Anything else she said is
+  her own error, shown as her words. The notice carries which of the four
+  it is, so a design and a reader tell them apart without parsing a
+  sentence.
+- **A device never drops a world by itself.** An ended relation is one
+  answer from one ask at one moment, and there is nothing to confirm it
+  against, because the far world is never told and never asked. A device
+  that forgot a world on that alone would delete a ward holding a seed and
+  every standing in it on the strength of one reply. So the side tells the
+  shell, on every describe that says it, the shell puts the way out in
+  front of the human, and she presses it or does not. It is said again
+  rather than once because the shell decides what to do with it and a
+  shell that missed the first one would never hear another. Keeping a dead
+  world costs a stale row; dropping a live one costs a ward nothing can
+  recover.
+
+## A tab and an app are one screen and two devices
+
+Everything a human sees is the same screen over the same surface, and
+whichever she opened it in is a harbor of the org's holding presence wards.
+Four things differ, none of them cosmetic, and a human meets all four.
+
+- **A tab runs a world's own code, and an app never does.** A tab is a
+  page on that world's origin, already running the bundle that world
+  serves, so a world may ship beings that live in the tab's own ward,
+  `local.ts`: her cells are in the tab's store, her asks are the forms,
+  her page is computed at every digest by the same painter a far being
+  gets. An app is a published bundle on somebody's phone, and a world that
+  could put code in it would be a world that owns the phone, so every
+  world it meets is a local ward of built-in classes and nothing else. The
+  consequence is a human's: **the same link can show more in a tab than in
+  the app**, and the difference is the world's doing, not the device's.
+- **An app lends, and a bare tab lends nothing.** The app's harbor stands
+  a ward of its own with the box's faculties in it, and the being of each
+  world on that device holds a standing at every one from her birth. A tab
+  stands none, because what a page may ask a browser for is the browser's
+  to gate and there is nothing of its own to lend. Which of a presence
+  being's asks a shell draws as forms is which standings she holds, so the
+  same being shows two forms on a phone and none in a tab, and neither is
+  a lie.
+- **A tab's harbor is one origin's, and an app's is the device's.** A tab
+  boots its harbor on a seed in that origin's store, so worlds served from
+  one `web.` host share a device and worlds on another host are a
+  different device with a different seed. An app is one harbor for the
+  whole device. So a person with a shop, a club and a friend on three
+  origins is three devices in a browser and one device in the app, and
+  seeing all her worlds in one place is the app's sentence and cannot be
+  borrowed by a tab.
+- **A seed in a tab is shorter-lived**, and that is the whole of the rest
+  of the difference. Cleared site data ends a presence exactly as a lost
+  phone does.
+
+So a phone without the app opens the tab, which is the rented room and says
+so. A tab is how a human arrives, since it costs nothing and needs no
+store; the app is how she stays.
+
+## The pages Quo writes itself
+
+Almost every page here is a being's: her describe becomes the forms, her
+`page` becomes the tree, and no world writes HTML. Two pages are nobody's
+being, and they are written out by hand.
+
+**A page with no being cannot be a blueprint, and that is what decides
+it.** The screen paints a describe through a standing. At the door there is
+no standing, and at the credential exchange there is neither: the human is
+a stranger holding nothing, and the world she is about to let something
+into is named by an invitation she has not typed yet. The grammar cannot
+say either page either, because its `form` node is one of a being's asks by
+name, and these forms are nobody's ask. So the rule is not a preference for
+hand-writing. It is that the claim "no world writes a page" is about
+**worlds**, and these two pages are Quo's own.
+
+- **The door page** is written in the grammar and painted with nobody
+  behind it, since inside a tab the painter is already there. So is the
+  held page, which is what a human sees where this browser holds the
+  harbor in another tab: a device is one harbor, two over one seed would
+  be two devices each writing the other's wards, and the second tab is a
+  page rather than a device. It says which of the two it is, and that
+  nothing is lost either way, because what a device is in every world is
+  kept in the browser and not in a tab. It offers nothing that takes the
+  lock, since the tab holding it may be the one she is working in.
+- **The allow page** is written out, since it is served on the web route by
+  whichever terrain mounts it, with no harbor and no ward anywhere near it.
+- **The landing page** is in the grammar, and it is where a redirect comes
+  back. A vendor a world sent a human to returns her by opening a URL in
+  her browser, and that URL is the envoy's own door: the same ask in the
+  envoy always had, with an empty body and the code in the query. So the
+  api road, which is a road for programs, has exactly one human arrival,
+  and it is a person who has just paid for something. She is told which of
+  the two happened and offered the world's own page, since a tab a vendor
+  opened has no history to go back through. What the envoy answered is
+  never shown, because `{ ok }` is a sentence for a machine. A vendor
+  asking that same path for JSON is answered in JSON as it always was: the
+  page is for whoever asked for a page.
+
+**Neither dresses itself.** Both wear the one stylesheet every screen
+wears, so a design that swaps the face swaps them too, and there is no
+second look in the tree to drift from the first. A page of Quo's that
+minted its own colours would be the one page an adopter could not make
+theirs.
+
+**What the allow page says is what a human needs in order to decide**, and
+nothing that merely reassures her. Who is asking. That it will be an
+occupant under a name she gives it. That it sees exactly what that world
+shows that name, decided by the gate and by nothing it can ask for. That it
+cannot become something else later and can be taken out at any time. That
+the invitation is the whole credential, spent once, with nothing stored
+afterwards: no password, no cookie, no session. Where it returns to when
+she is done. And the sentence that matters most to the human this page will
+one day fail: if she did not mint that invitation for that client herself,
+she should close the page.
+
+**All four are served under one policy**, wherever they are served from,
+and it is as tight as they are. They run no script and want none, so
+nothing but their own form is allowed anywhere, an image is the mark and
+therefore data, and no referer carries what brought a human there off the
+page. They also print no address a caller gave them: what a page says about
+where it is comes from what the daemon was configured with, since a `Host`
+header is the caller's to write and a page that printed one would print
+whatever a caller wanted a human to read.
+
+## A device is lost
+
+A presence is a seed. The seed is in that device's store and nowhere else,
+so a phone that is stolen, a laptop that dies and a tab whose site data was
+cleared are one event, and what it costs is the same each time: that
+device's local ward, the avatars in it, and every standing they held. There
+is no copy anywhere, because a copy of a seed is a second device holding the
+org's standings, which is the thing the whole shape exists to prevent. So
+this is said plainly rather than softened: **a lost device is not
+recovered. It is replaced.**
+
+What survives is everything else. Nothing of the org is at risk, because
+the org is at home and this was one of its devices. Every world the lost
+device was in still knows her, since a membership is an id in that world's
+ward and lives there. The standings the device held at those worlds are
+still standing at their far ends: what is gone is the key on this side.
+
+So coming back is two acts, and the order does not matter.
+
+- **The lost device is taken out.** That is one standing removed, exactly
+  as it is for a device simply stopped being used, and it is the only
+  thing that makes the lost device's key useless to whoever holds it.
+  Until it happens the world cannot tell a stolen phone from a quiet one.
+  A device the world granted `revoke` does it in one act, and the screen
+  shows her the form because her gate does; `revoke` is its own word and
+  never `mint`'s, so a device that brings in the next device does not by
+  that fact take one out. Where the world granted it to nobody, the root
+  removes the two relations a device is, and a human whose home is on a
+  box she does not run asks whoever runs it.
+- **She comes back as a new device.** Either by an invitation minted from
+  a device she still holds, which is the ordinary way one device brings in
+  the next, or by that world's own way in again, which is what she has
+  when the lost device was her only one there. Whether that returns her to
+  the being she was is the world's answer and not hers: a way in that
+  identifies a person hands her the same user being, and one that
+  identifies a device hands her a new one.
+
+**A device is named, and a name is taken.** The world holds the lost
+device's standing under the name that device was given, so coming back
+under that same name is refused while it stands, `id taken`. That refusal
+is what a human actually meets after losing her only device, and a screen
+must say what it is rather than that the way in was spent: the two send her
+looking for different things, and only one of them has an answer. An org
+building a way in that hands every person a single fixed device name gives
+each of them exactly one device for life, and this is the paragraph that
+says so before the first person loses a phone.
+
+## The tab's ear
+
+A tab that is closed hears nothing, and that is what the doorbell in
+`papers/quo-dock.md` is for. Its ear here is a service worker, `worker.ts`,
+served by the web route at the root of this route so its scope covers every
+world page on that origin, with the world's config written above the bundle
+since a worker has no page to be handed a JSON script in. A world that
+holds no bell key serves no worker and its pages register none, and the
+page's policy names `worker-src 'self'`, which otherwise falls back to
+`default-src` and is none.
+
+A device is one harbor and the lock says who holds it, so the worker is one
+more claimant of the same lock. With a page open the page holds it: the
+worker hands that page a port, the page tells its dialers it is back,
+drains and answers, and the worker shows what came. With no page open the
+worker boots the harbor over the same database for the length of the wake,
+dials the world, drains and closes both behind itself. A boot that meets
+the lock is a page that holds it and did not answer, and the worker leaves
+it alone rather than opening a second harbor over one seed.
+
+`wake.ts` is the device's half and every shell wears it: `subscribe`
+registers the ear and asks the browser's push service for an endpoint,
+`drained` is the ask on each relation and the objects landing on each
+avatar where a push would have landed, and `notice` composes what the human
+reads from those objects and from nothing else. A tab drains on entry too,
+since a device coming back is a device that missed something. Being woken
+is asked for and never sprung: a page that asks a browser for notifications
+the moment it opens is a page every browser punishes, so a human who has
+not been asked is offered a button.
+
+Two things a browser terrain teaches, held here because a reader would
+otherwise spend an afternoon on them. A Chromium driven for a test can
+never subscribe: its contexts are private ones, and Chrome disables the
+Push API in a private context outright, with no way to feature-detect it.
+And that build shows no notification either, `showNotification` answering
+neither way. So the terrain proves the ring, the wake, the dial and the
+drain, `notice` is proven as a unit, and the platform call is the one line
+no Chromium there runs. Every step of a wake is bounded for the same
+reason: a platform that answers neither way must not hold a worker open.
+
+## The same link, and the app
+
+One link does both. A join link is a world's page with the invitation in
+its fragment, and where the app is installed the platform opens it there
+instead of the browser, on the same address and with the same fragment.
+Nothing of the invitation reaches any server on the way: a fragment is not
+sent, so the world's own host never sees it either, and the app reads it
+from the URL the platform hands over, once as the URL it was launched by
+and again for every link opened while it runs. A phone without the app
+opens the tab, which is the rented room and says so.
+
+What makes the platform open the app is the association file the world's
+own hostname serves, `web.ts` above, naming the app that may claim it, and
+the app naming that hostname back, in the iOS entitlements and in the
+Android manifest. Both halves are verified by the platform and neither is
+Quo's word for anything. So the domain in a join link is the world's, never
+an app publisher's, and no third party stands between a world and the
+device it invited: whoever wants their own name on the store builds the
+same shell with their own app id and their own hostname, one line on each
+side. A custom scheme is claimed by nobody here, since any app may claim
+any scheme and a link on one would hand an invitation to whoever squats it.
+
+## What binds, and what we merely chose
+
+Everything above is written as though it were one thing, and it is two. Some
+of it a human side must do or it is not speaking Quo, and the protocol or
+the world Quo proposes is what makes it so. The rest is this kit's answer,
+worked out here, and another front end may throw it away and be no less
+Quo for it. A reader who cannot tell those apart is holding a cage rather
+than a kit, so here is the line.
+
+### The rules
+
+Break one of these and the thing stops being a Quo world's human side,
+whatever else it does well.
+
+- **Three ways in and no fourth**, and nothing is typed on any of them: an
+  invitation in a link's fragment, a proof the world handed out, or a form
+  whose answer is an invitation. No password, no account, no cookie.
+- **A capability rides in a fragment, never a query.** A query string is in
+  every log and every referer, and one read of an invitation or a proof is
+  one way in taken.
+- **A page adds no right.** Every name a page uses is looked up in the
+  describe for this asker; a name the gate hid paints as nothing. The gate
+  is the whole of permission and there is no second list.
+- **A far being cannot reach out of her page.** No script, no stylesheet,
+  no selector, an image that is data and not a fetch, and an address only
+  where she already stands.
+- **A being knows no routes.** Where her pages live is the side's, so an
+  invitation she answers becomes a link on the side and never in her.
+- **A device is one harbor.** Two over one seed would be two devices each
+  writing the other's wards, so the second is a page and says so.
+- **A presence is a seed.** A device is replaced and never recovered, and a
+  human is told that plainly rather than promised a recovery there is not.
+- **A relation ends from either side**, and a device never drops a world on
+  one answer at one moment, since the far world is never told and can never
+  confirm it.
+- **A world moves whole between devices**, seed and standings, and the far
+  world is never asked and never told.
+- **Consent is a human act.** A model or a program asking to be let into a
+  world is answered by a person and by nothing else.
+- **A published app never runs a world's code.** A world that could put
+  code in somebody's app would be a world that owns their phone.
+- **The screen adds no vocabulary.** What a being can be asked is her
+  blueprint, how she is shown is her look and her page, and there is no
+  third thing.
+- **A route says the grammar and never the rung.** The same identity sees
+  the same describe whether it arrived as forms, as tools or as JSON.
+
+### The offers
+
+Every one of these is a decision made here. An adopter building on this kit
+follows them because they are how this kit is shaped; an adopter writing
+their own front end may answer differently at every line and interoperate
+with us at every door, because a door judges keys and not opinions.
+
+- **The page grammar**, its node kinds and their names. The property it
+  protects is a rule; these eight words are ours.
+- **Forms from an input schema**, a view from an output schema, and what
+  each type is drawn as.
+- **The door page and the held page**, their words and their shape. A world
+  that wants a face of its own has a public being with a page and a look,
+  or its own page on its own origin.
+- **The allow page being written out rather than painted**, and every
+  sentence on it.
+- **`device` as the ask a proof is handed to.** A name is needed because a
+  proof arrives carried rather than typed, and this is the name we chose.
+- **The words a device may be granted**, `wake`, `reach`, `mint` and
+  `revoke`, and the notes that carry them.
+- **`stands`**, and vouching for an address by the origins a being
+  declared.
+- **One stylesheet for every screen**, and a design that swaps the face
+  swapping all of them.
+- **The shell**, Capacitor on a phone and Tauri on a desk, and the app
+  being a browser of worlds with no account of its own.
+
+## Where the tree stands
+
+The chapters above say what this side answers for. Some of it stands with
+code, a proof and these words behind it, and some of it stands with less.
+This chapter is where the difference is admitted, so that a reader building
+against this paper knows which sentences are load-bearing.
+
+**The shells' own ways in.** Each of the three is proven as the act it is,
+from the fragment a world handed out to the standing taken. What has no
+assertion of its own is the tab reading its own address on the first paint
+and the app reading the URL the platform handed it, which the browser
+terrain suite exercises through a link and not through a proof.
+
+**A link a human is shown before she goes.** A being's `stands` is a
+standing claim, and the screen paints the origin on the anchor, so the
+address is on the page. Whether a human should also be told the first time
+a world sends her somewhere it does not serve, rather than only shown, is
+undecided.
+
+**Authorizing.** The exchange is proven and so is what the page says. What
+no assertion holds is the page in a real browser: it is served by the
+daemon and read by no terrain suite, so its layout under the kit's
+stylesheet is unproven at every width.
+
+**The pages Quo writes itself.** Each holds to the grammar and says what it
+says, proven with no browser, and the landing page is proven over real HTTP
+besides. None of the four is ever loaded in one: the held page in
+particular is reached only by a second tab meeting the lock, and what the
+terrain suite proves there is the harbor refusing to boot rather than the
+page that refusal puts up.
+
+**Leaving.** A human leaving and a world letting her go are both moments
+here, and the browser terrain suite exercises neither: the words told apart
+and the side telling the shell are proven with no browser, and the button
+each shell puts up is not.
+
+**A device lost.** What it costs and how she comes back are written above.
+The act, the list and the form are all here, so a device the world granted
+`revoke` sees her devices by name, which one she is on, and the form that
+takes one out. What is unproven is the shell: the user being's page carries
+all three and no terrain suite presses them in a browser.
+
+**The public front.** A website is not a route into any box: it reaches its
+world by origins it names once, and what it needs to speak Quo is a browser
+harbor in the page taking a stranger's standing at that world's public
+being, which is this package's shape rather than a website's. Nothing here
+offers it, because one site has written it and a piece with one user stays
+with that user until the second arrives.
+
+**A home arriving.** The act is two halves of an ordinary knock and both
+are here, so the day costs a human two forms and no migration. What no
+screen does is walk her through it: she meets `join` as one form among
+others, and nothing offers to take her memberships one at a time from the
+device that holds them.
+
+**One device, two people.** Two people sharing a device are two relations
+in one world, one avatar each, since an invitation is self-addressing and a
+fresh one is always a fresh avatar. It runs, it is proven, and no screen
+names the second person: the relations switcher shows keys, so a household
+tablet says `r1` and `r2` where it should say who.
+
+**What a device lends** is one form away and proven once in a real browser.
+What no assertion holds is the phone's own refusal path: that a faculty
+whose permission was declined answers the same error object at every ask
+after, rather than prompting again, is written and exercised by nobody,
+since a driven simulator grants and declines nothing.
+
+**A world's own code** is a rule above, and it is proven from the app's
+side: the app learns a world by one fetch of its config and never loads its
+bundle. What nothing holds is the tab's side of the same rule, that a
+world's beings run only in a ward of the tab's own and reach nothing of
+another world's.