@nervur-org/dock 0.4.1 → 0.5.0

package/WORLDS.md

@@ -1,569 +0,0 @@
-# WORLDS
-
-This is how Quo is proposed to a person and to an organisation. It sits
-beside `quo/SPEC.md` and adds no word to it. The spec says what a
-harbor, a ward and a being are, and what crosses a door. This paper says
-what to make of them, so that any setup, from one person with a phone to
-an organisation with ten thousand members, is reasoned in the same words.
-`papers/quo-dock.md` and the papers of its sides follow this one; an
-estate's paper follows all of them. It binds the dock and the estates, never
-the library.
-
-It is written in four parts, in this order, because the order is the
-honesty of the paper. First, what Quo allows, which is more than we use.
-Second, the choices we make inside that, each one named as a choice, with
-what Quo would also have allowed and why we chose as we did. Third, the
-world those choices make, home, presence, membership, envoy, route and
-device, narrated once. Fourth, real organisations at every distance from
-Quo, so that the reader finds their own stage and sees the next one. An
-implementer who reads only the first part and builds something unlike the
-rest is still building Quo.
-
-## What Quo allows
-
-Quo is three words. A **harbor** is the program a device runs to boot
-wards; it owns the wire and the operating system and is nobody outside its
-device. A **ward** is one process of its harbor, a seed, a partition and a
-body of code, named outward by one public key derived from the seed. A
-**being** is one ordinary object with one voice, living in a ward, with no
-address of her own. Nothing else is Quo.
-
-Between beings there is one kind of relation, with two ends. A **standing**
-is a pointer a being holds to another being, through which she asks. An
-**occupant** is a being she invited, whom her ward names when she asks.
-Every relation is born of an **invitation** minted by one side and a
-**knock** by the other, carries two keys, one minted by each side, and ends
-by one side removing it. What a being answers to an occupant is decided by
-her **gate**, which is asked for every describe and every dispatch, and it
-is the whole of permission in Quo: there is no second list anywhere.
-
-Two things stand at the edges. A harbor keeps the ask pointer of a ward it
-booted, so it is that ward's **root**, and the root may invite on any being
-of its ward and reach into any of them; that is total, and it stops at the
-device. And a ward may hold one **public being**, who answers anyone at all
-as `{}`, the way every stranger is at every door. What a device can do,
-its clock, its screen, its lines to vendors, it offers by **lend**, as
-beings in a ward of its own that another ward's being reaches by holding a
-standing, exactly as she reaches a being on another planet.
-
-That is the whole of it, and this is what it leaves open:
-
-- **Quo has no person and no organisation.** A ward has an owner in the
-  sense that a root booted it, and no other sense. Who a human is, whether
-  two wards are the same party, and what a company is, are not questions
-  Quo answers.
-- **Quo has no home.** Three boxes rooted by one party, each holding
-  standings on the other two, is Quo, and so is one box with a hundred
-  wards. Nothing says which ward, if any, is the one that matters.
-- **Quo has no route.** It pins the two shapes a reach may take and the
-  frames they carry, because two harbors meet on those, and it says nothing
-  about where a ward lives: which hostname answers, how a harbor learns a
-  foreign pk, and whether anyone can be dialed at all are the device's. A
-  hostname, a screen and a tool list are outside the protocol entirely.
-- **Quo has four rungs and no more.** A stranger hears the public being as
-  `{}`. An occupant hears what the gate shows that occupant. An owner
-  reaches in. A root holds the ask pointer. Guest, member, subscriber,
-  admin: every one of those is an occupant, told apart by the gate and by
-  nothing else.
-- **Quo has no outside.** A vendor's API, a bank, a mail server, a model at
-  its client: to Quo each is either a being someone booted to speak for it,
-  or nothing.
-
-Everything from here on is one way of filling those gaps. It is our way,
-it is opinionated, and another implementer may fill them otherwise and
-interoperate with us at every door, because a door judges keys and not
-opinions.
-
-## The choices
-
-Six choices, each in the same shape: what Quo allows, what we choose, and
-why. Every later sentence of this paper rests on one of them, and a reader
-who disagrees with a choice knows exactly which sentences fall with it.
-
-### The unit is the org
-
-Quo allows any party to be the "you" a world is about, or no party at all.
-
-We choose the **org**. Every "you" in this paper, in the dock and in the
-estates is an organisation: a company, a family, a club, a service, and at
-the smallest, one human alone, who is an org of one. An org owns wards,
-holds standings, trusts boxes and is trusted by others. A human is never
-modelled as something smaller than an org, and an avatar, an account or a
-user id is never the "you"; each of those is a thing an org holds.
-
-Why: one grammar reaches every size. What is said of a family with a box is
-said, word for word, of a person with a phone and of a service with ten
-thousand subscribers. The moment a person and an organisation are two
-kinds of thing, every rule is written twice and the two drift.
-
-### One home per org
-
-Quo allows an org to root three boxes and call each one home, or to have
-no place it calls home.
-
-We choose **one home per org**, and any number of harbors under it. Home
-is the one ward the org owns on a box it trusts, its own being is the org's
-being, and every relation of the org meets there.
-
-Why: the fog. Three homes each hold part of the org, and the day the org
-wants to act as one, "when mail lands in A, tell a friend from B and write
-it down in C", it needs one place that sees all three, and that place is a
-fourth home standing over them, which is one home with three harbors under
-it. Several homes is not a richer arrangement Quo permits and we forbid. It
-is an arrangement that collapses into one home the first time the org
-wants to think. So one home is not a cap: it is the name of the place where
-the fog clears, and an org that has not built it yet is an org that cannot
-yet act as one.
-
-### Every human is an org, with or without a home
-
-Quo allows a human to exist only as ids in other parties' wards, and never
-as a ward of her own.
-
-We choose to say that **every human is an org from the first moment**,
-whether or not that org has a home yet. A human with no box is an org of
-one whose whole existence is the standings it holds in other orgs' worlds:
-a customer id at a shop, a member id at a club, a presence on a phone. The
-day a box is trusted, a home is booted fresh for that org, and it joins
-each of those memberships from there. Nothing is converted and no id
-changes; the org gains a home and keeps everything it had.
-
-Why: the walk. Nobody switches to Quo, and a person who has never heard of
-it must already be in the model when they land on a website of ours. If a
-homeless person were a different kind of thing from a person with a home,
-getting a home would be a migration, and there is none. Homeless is a rung
-on the org's own ladder, and the first one.
-
-### A route says the grammar, a credential says the rung
-
-Quo allows a device to hear bytes any way it likes, and to treat every
-arrival as a stranger.
-
-We choose to name **three routes** into a device, and to forbid any route to
-fix a rung. A route is one hostname, sent by a reverse proxy to one process,
-and it says only which grammar the bytes are in:
-
-| route  | grammar                                          |
-| ------ | ------------------------------------------------ |
-| `web.` | a describe as forms and a page, for a human      |
-| `mcp.` | a describe as tools, for a model                 |
-| `api.` | a describe as plain HTTP and JSON, for a program |
-
-The rung is proven by what the caller carries, and was decided by whoever
-minted it. No credential is the stranger, on every route, and the stranger
-hears the public being as `{}` on every route. A credential is an
-invitation spent once by a knock, then keys, and it names an identity in a
-world at the rung its minter gave it: an occupant, whether guest,
-subscriber, member or admin, told apart by the gate; or an owner, invited
-on the ward's own door. The same credential is honoured on every route, and
-the same identity sees the same describe whether it arrives as forms, as
-tools or as JSON. The three routes are three renderings of one describe,
-and a caller on one can do nothing a caller on another cannot.
-
-Why: a person is not a route. The owner of an estate pilots it from a model,
-presses its buttons in a tab and calls it from a script, and is the same
-owner in all three. A route that fixed a rung would make the same human two
-parties, one per door, which is the fog again, this time inside one box.
-
-### A device is a harbor of the org, never a route
-
-Quo allows a phone to be a home, a tab to be a stranger, and an app to hold
-accounts of its own.
-
-We choose that **a device in a hand is a harbor the org owns**, that every
-world seen there is a presence, a ward of the org's on that device, and
-that nothing in a hand is ever a home. A phone, a tablet, a laptop and a
-browser tab are the same shape. The app is a browser of the org's worlds
-with no account and no person of its own; who the org is lives at home.
-
-Why: night and trust. A hand is reachable only while it dials, so nothing
-runs there for the org at night, and it is lost, stolen and replaced, so no
-one copy of the org is trusted to it. A home on a phone would be a home
-that sleeps and may vanish, and the org would answer for the difference
-every day. So the device is where the org is now, and home is where the
-org is always, and the two never trade places. A device is not a fourth
-route because it does not need one: it is Quo, ward to ward, and the human
-touching it is an occupant of a ward that is theirs.
-
-### A SaaS is an org that has not heard of Quo
-
-Quo allows nothing outside its three words, so a vendor's API is not Quo
-and cannot be spoken to.
-
-We choose to meet every such vendor through an **envoy**: a being booted on
-the org's side who speaks that vendor's surface, narrowed to what the org
-exposes, one being per vendor and one relation per account. From inside the
-org's world, Google, a bank and a booking service look exactly like orgs
-on Quo, reached through a standing, because each is standing in for a ward
-nobody here runs. And the mirror holds: an org on Quo is a website to every
-human who has never heard of Quo, and a member's world to everyone who
-has, at the same time, at the same doors.
-
-Why: Quo bends the SaaS world and cannot wait for it to disappear. An org
-must adopt Quo while every vendor it depends on stays as it is, and must
-serve every customer who never adopts it. Both directions are envoys and
-routes, and neither needs the other side to move.
-
-## The world those choices make
-
-### Three questions, three words
-
-Each word of Quo answers one question for an org, and nothing else answers
-it.
-
-| word   | the question | what it settles                             |
-| ------ | ------------ | ------------------------------------------- |
-| harbor | whose box    | trust: who holds the root, who can reach in |
-| ward   | whose world  | ownership: one seed, one owner, moves whole |
-| being  | whose voice  | a role inside a world                       |
-
-A harbor is a device and belongs to the org that holds it. A ward is the
-unit that is owned and the unit that moves: it goes to another box whole,
-and every standing it holds survives, because its pk is the same there. A
-being is one voice inside a ward, and what she may be asked is her gate.
-
-**Ownership decides the level, and nothing else does.** A thing is a being
-in the ward of the org that owns it, and the default is always that. A chat
-between two members of an org is a being in the org's ward. A chat between
-two people with no org between them is a being in the home of whichever
-hosts it, the other an occupant through their own home. A ward is booted
-only where a thing must be owned by nobody among its members, so that it
-can move whole or stand on a box none of them fully trusts; and then it is
-an org, however small, with an org's home beside it. How rich a being's
-occupant logic is never promotes her. Only ownership does, and promotion is
-not a migration: a being's cells do not cross into another ward, so
-becoming a ward is a new ward booted, the same class placed in it, and the
-members invited again.
-
-Every ward on any harbor is one of three kinds, and there is no fourth:
-
-```
-a home             an org's world, one owner, moves whole
-a presence         a world's foothold on a device in someone's hand
-the box's own      what this harbor lends, one per harbor, never moves
-```
-
-**A harbor boots one ward of its own.** It keeps that ward's ask pointer,
-so it is its root, and everything the box can offer lives there as beings:
-its location, its notifications, its timer, its way of ringing a phone, its
-line to a store, its account at a vendor. A being of any other ward reaches
-one by `lend`, and what she gets is a standing, counted and rotated and
-removable, like every other relation she holds. That ward never moves. Its
-beings are the box's, they die with the box, and a home that moves to
-another box is lent that box's instead. What the org wants asked by others,
-a front desk, a clock with its schedules, is a being with a door in the
-org's home like any other being of theirs.
-
-### An org is three things
-
-One org on Quo is three kinds of thing, each on a harbor of different
-trust, each with a different job. For a human alone the three are the
-same three.
-
-- **Home** is the one ward the org owns on a harbor it trusts. Its own
-  being is the org's being: for a company, its org being; for a human, her
-  user being. Inside it live the org's envoys, its avatars and its rules.
-  Home runs day and night and is the only thing of the org's that must
-  never be lost. A home may stand on a box the org does not run, a
-  family's or a host's, and the day the org has a box of its own the home
-  moves there whole, and nobody who holds a standing at it is told.
-- **Presence** is a ward the org owns on a harbor in a hand: a phone, a
-  desk, a browser tab. It is where the org is now: the screen someone
-  touches and what that box lends, GPS, camera, a keychain, each a standing
-  the org's being there holds at a being of the box's own ward. It holds
-  one standing at home, home holds one back to wake it, and it sees exactly
-  what home's gate shows that device. A lost phone is one standing removed
-  at home, and nothing of the org is lost.
-- **Membership** is an id in a ward another org owns: an employee id at an
-  employer's being, a member id at a party's, a customer id at a shop's.
-  Nothing of the org lives there but the id and the key. Home holds a
-  standing at it, and it holds one back to push. The other org ends it by
-  removing one standing, and home loses that and nothing else.
-
-A membership is never a ward of the org's, because a ward it does not own
-is not its. A presence is never home, because its seed was minted where
-the org happened to be. Home is one, presences are as many as the org's
-devices, and memberships are as many as the orgs that know it.
-
-Read from the other side, the same three words hold. An organisation's
-home is its ward. Its members are ids at its beings, however many. Ten
-thousand subscribers of a service are ten thousand memberships in the
-service's ward, not ten thousand homes: their homes are elsewhere, or do
-not exist yet, and each subscriber is an org of one either way. A ward is a
-process, and that is the only way ten thousand fit.
-
-**A home changes hands, and the change is one act.** A child's home is a
-ward the parent's org owns until the child does; a friend's, one the family
-runs until he has a box. Before that day the host's presences hold the
-door and the child's do not. The day itself is the root minting the child's
-own being the owner standing on that ward, `home`, and stepping back, which
-is what setup does for everyone at boot and may do later. Nothing moves,
-nobody is told, and from then on the door is the child's.
-
-**Trust is the root, and it is total.** Whoever holds a box's root can
-read every home on it, partitions and keys, and can reach into any being
-there. A household's privacy toward each other is its trust in whoever
-runs the box, not cryptography, and a home that wants more than that moves
-to a box of its own. That is the whole meaning of "a harbor it trusts",
-and it is read before a home is booted on somebody else's droplet.
-
-### The hub is home
-
-Every device, every model, every account and every membership of the org is
-either an occupant of its home or a standing its home holds, and most are
-both. The gate of the org's being is its whole permission model: what its
-phone may ask, what its model may ask, what an employer may push. There is
-no second list.
-
-A rule, "when Calendly books, add it to Google", is home answering one
-standing by asking another. There is no trigger vocabulary and no product
-between the two: one being holds both standings and a method joins them.
-Rules run where the hub is, so rules need a home, and that is what a home
-gives an org that a presence cannot: something happens for it at night.
-
-### Everything outside is one relation
-
-Everything outside a world relates to it the same way: a standing in, a
-standing back, or both, placed by a knock on an invitation. Two questions
-decide the shape, and nothing else does.
-
-**Does it speak Quo?** If it does, a standing goes straight at its door. An
-employer's harbor, a party's, the org's own phone: each has a ward with a
-door, and the org knocks there. Nobody stands in for it.
-
-If it does not, an envoy stands in its place. A Google account, a Calendly
-account, a model at its vendor's client, a shop with an old checkout: each
-is a ward nobody here runs, on a harbor nobody here owns, that speaks no
-Quo. So a being is booted in the box's own ward who speaks that vendor's
-surface, narrowed to what is exposed. One being per vendor and one relation
-per account: the credentials are in her cells, the occupant's notes say
-which account a caller is, and a caller never names either. What home holds
-is the standing, so a home that moves box carries no credential and is
-placed again where it lands.
-
-**Does it call in?** If it does, it holds a standing back. A booking
-arrives, a payment settles, a mail lands: the outside thing's bytes reach
-the box, since the box owns the wire, and they reach the envoy's own body,
-because she is the being who claimed that path or opened that line at her
-birth. She checks the signature, keeps the delivery id so a retry lands
-once, and asks the right occupant on the right standing. Nothing arrives at
-a door that nobody invited, and whoever is woken cannot tell a webhook from
-a clock, and must not. If it does not call in, the relation is one way, and
-an envoy on a phone is one way by construction, because nothing calls in
-to a phone.
-
-### Three routes, one describe
-
-An org's box hears the world on three routes, and a route is a hostname the
-reverse proxy sends to one process. `web.` speaks a being's describe as
-forms and a page, for a human at a screen. `mcp.` speaks it as tools, for a
-model at its client. `api.` speaks it as plain HTTP and JSON, for a
-program, a script or a tab on another origin. A fourth voice, the `nervur`
-command on the device itself, speaks it as lines, and reaches the daemon's
-socket rather than a hostname.
-
-Every route hears the same four rungs, and hears them the same way:
-
-- **A stranger** carries nothing and hears the public being as `{}`, on
-  every route alike: as the front desk's first hello, as a public board or
-  a catalogue in JSON, as the public being's asks listed as tools. A world
-  with no public being answers a stranger silence, on every route alike.
-- **An occupant** carries a credential: an invitation spent once, then
-  keys held by an avatar in the org's world. What the occupant hears is the
-  gate's answer for that identity, and it is the same answer on every
-  route. Guest, subscriber, member and admin are all occupants, and the
-  gate is what tells them apart.
-- **An owner** is an occupant of the ward's own door, invited there by
-  the root, and reaches into any being of it. The owner creates and
-  places, and never does the work: the work goes through an avatar under a
-  gate, so every arrival is named and judged.
-- **The root** holds the ask pointer, on the device and nowhere else, and
-  is no occupant of anything.
-
-A model, a human and a program that hold the same credential are one
-identity, and the org sees one occupant whichever route it came in on. That
-is what makes an estate pilotable from a model, a browser and a script in
-the same day by the same hand, with one gate deciding for all three. A
-model is not a special kind of caller: it is a presence that acts, holding
-one standing, seeing what the gate shows it, and what it does arrives home
-named and counted, exactly as a tap on a phone would.
-
-### The device and the app
-
-A Quo app is a browser of worlds and nothing of the org. It has no account,
-no login and no person of its own: every world it shows is a presence ward
-on the device's harbor, and who the org is lives at home. So which app the
-org uses is settled at home, by adding that app as a device of the org's,
-and never by a link. A world's link opens whichever app the platform
-verified for that world's hostname, and any Quo app that opens it is the
-org's, since every one is the same browser. A world names in its claim
-every app it allows to open its links, its own first. An adopter's own app
-is the first app its member meets, and nothing more: from it she reaches
-every world she is in, and from any other Quo app she reaches the same
-worlds through home.
-
-One OS user is one harbor. On a desk and on Android the OS has accounts,
-and the app never sees the second person. A shared iPad is one org's
-device, and a second org's presence on it is a ward of the second's, named
-as such, under the first's lock. Building people into the app would be a
-second grammar for identity beside the ward.
-
-A tab is a device of the same shape: a harbor on a seed in the browser, a
-presence ward per world, and the org's being there holding what the browser
-lends. It differs from the phone only in how long its seed lives.
-
-### The root boots and steps back
-
-A harbor's root is the box's, held by the device's own rule, and it is
-touched once per home: it boots the home ward and mints the org's own
-being an owner standing on it. From then on the owner of that home is the
-org. Placing an envoy, inviting a new device, joining a membership: each is
-an ask on home, shown by the gate to the org's presences and to its model,
-and the box is never logged into for it. The root's shell is for the day
-the root itself must act, and no other.
-
-### A class knows nobody
-
-Every being is an instance of a class, and the class is written by someone
-who has never met the org. An author ships a package with a Calendly
-class; an estate's class file re-exports it; the harbor loads it by name;
-the root boots `calendly/alice` with the token the box holds under that
-name. The author sees no human, no token and no partition.
-
-Nor does the author know the level. The same class is a being in an org's
-ward today and the being of a ward of its own tomorrow, placed there by a
-root's two owner asks and rewritten for none of it: its members are its
-occupants, its gate reads them, its cells are its record, and which ward
-boots it is never in it. A class is written to work at any level, and an
-estate decides the level. That is what keeps a class from an author who
-knows nobody usable by an estate that knows exactly who.
-
-The dock provides the classes every world needs and nobody writes twice:
-the user being, the avatar with its screen side and its model side, the
-bell, the clock, the front desk, the faculties a box lends, and the account
-base an author extends with only the vendor's part. An estate holds class
-bodies and placement, and reaches every general piece through the dock.
-`papers/quo-dock.md` is that catalogue.
-
-### The picture
-
-```
-a box the org trusts                    a hand                    their box
-  ward alice (home)                       ward alice (presence)     ward acme
-    alice, her user being                   her being there            employee being
-    avatar "claude" <- her model            ward acme (presence)       id "alice" at its door
-    rules                                     her being there
-  ward bob (home)                         the box's own ward
-  ward the-family (the estate's home)       screen, GPS, keychain,
-    the front, the clock and its schedules   notifications
-  the box's own ward
-    timer, push (web, apns, fcm),
-    calendly, google
-
-standings, each placed by a knock on an invitation:
-  presence -> home, home -> presence          her devices
-  home -> acme's being, acme's being -> home  her memberships
-  home -> calendly, notes: alice             an account, one way
-  home -> google, notes: alice               an account that calls in
-  any being -> a faculty of its own box      by lend, and never off the box
-
-routes into the box the org trusts, one grammar each, any rung on each:
-  web.   forms and a page      mcp.   tools      api.   HTTP and JSON
-```
-
-## Orgs at every distance from Quo
-
-Four organisations, each real in shape, each at one stage. Every stage is a
-state the model already holds, and no org moves from one to the next by a
-migration. Nobody switches to Quo.
-
-### Never heard of it: a bakery
-
-The bakery takes bookings on Calendly, payments on Stripe and mail on
-Google, and will never run a harbor. To an org on Quo the bakery is three
-envoys: one being per vendor in the box's own ward, each holding the
-bakery's account in her cells, each reached by a standing from the org's
-home. When a booking lands, Calendly's bytes reach the envoy's own body,
-she checks the signature, keeps the delivery id, and asks home on the
-standing home gave her; home's rule adds it to Google by asking the second
-envoy. The bakery is fully in the model and has done nothing. The day it
-runs a harbor, the org's standing moves from the envoy to the bakery's own
-door, and the rule does not change.
-
-### Scouting: a person with the app, and a company with a tab
-
-A person downloads the app and opens three links, a shop's, a club's and a
-friend's. The phone is a harbor; each link boots a presence ward on it,
-with the org's being there and one standing at the world it came from. The
-person is an org of one with three memberships and no home. She sees all
-her worlds in one place, because the app is a browser of worlds, and
-nothing runs for her at night. The three orgs each know her as an id bound
-to that phone's presence and nothing more.
-
-A company's operations lead opens a supplier's world in a tab. The tab
-boots a harbor on a seed in the browser, a presence ward for that world,
-and the lead's being there. That tab is the company's first presence, in a
-rented room: the supplier's ward knows the company by an id bound to that
-tab's pk, and the company has no home. When the lead opens the same link on
-her phone, the tab's ward moves in by seed and partition, rebinding the
-same pk, and the supplier is told nothing.
-
-### Migrating from SaaS: a filings service
-
-A filings service has subscribers, an old checkout and a new harbor. Its
-home is its org ward on a droplet; its subscribers are ids at its beings,
-ten thousand memberships in one process. A subscriber who has
-never heard of Quo arrives on the web route as a stranger, meets the front
-desk, and the checkout she pays at is still the old one, because the
-service's envoy to its payment vendor stands in for it. From the moment she
-pays she is an org of one whose whole existence is a membership in
-a filings service's world, reached from a tab or from the app.
-
-A second subscriber already has a home on a family box. Her home holds a
-standing at a filings service's being and it holds one back to push, and she
-reaches the service from her phone through home as the carrier, or
-directly on a presence. The service cannot tell the two subscribers apart
-by route, and does not try: each is an occupant, and the gate says what each
-may ask. The service's own owner pilots it from a model on the mcp route,
-presses its buttons in a tab on the web route, and runs its reports from a
-script on the api route, and is one owner on all three. The old checkout
-stands until the payment vendor speaks Quo or the service replaces it, and
-neither day changes a subscriber's id.
-
-### Fully on Quo: a family estate
-
-The family runs a droplet that never sleeps, an edge box at the house and
-a Mac on a desk. The three are one estate because each holds standings on
-the others, minted there and taken here, and not because they share a key;
-each has its own root and each root stops at its device. The estate's home
-is the family's org ward on the droplet, with the front desk, the clock and
-its schedules. Each member's home is a ward on the same droplet, owned by
-that member, trusted to the box the family runs. A child's home is owned
-by a parent until the day the root mints the child the owner standing and
-steps back. The Mac and every phone hold presences, one per world, and the
-edge holds what the house can do as faculties of its own ward.
-
-A member's model is an avatar in her home, holding one standing, seeing
-what her gate shows it. Her employer is a membership, her bank an envoy,
-her friend's world a standing at his home on his own box. When she moves
-out and buys a box of her own, her home moves there whole, seed and
-partition, and every standing she holds and every one held at her
-survives, because her pk is the same there. The family is told nothing and
-needs to be told nothing.
-
-## Vocabulary
-
-Org, home, presence, membership, hub, rule, envoy and route are in
-`papers/GLOSSARY.md`, with every other word above the spec.
-
-## Where the tree stands
-
-This paper decides what the estates and the dock are held to, and one
-piece of the dock is not yet in its words.
-
-- The dock holds no org base beside the user being, and no account base
-  class. The first arrives when a service bought by an organisation is
-  read against a household, which is the pair of users that shows what an
-  org actually shares with a home. The second arrives with the second
-  vendor to need one. `papers/quo-dock.md` names the same gap from its
-  side.