@quo-systems/dock 0.2.0 → 0.2.2

package/dist/mcp/http.d.ts

@@ -4,12 +4,13 @@ import type { Avatar } from '../beings/avatar.ts';
 import type { Serving } from '../beings/side.ts';
 export type Session = {
     identity: string;
+    ward: string;
     transport: StreamableHTTPServerTransport;
     serving: Serving;
     touched: number;
 };
 export declare const SESSION_IDLE: number;
-export type Resolve = (identity: string) => Promise<{
+export type Resolve = (identity: string, ward: string) => Promise<{
     avatar?: Avatar;
     error?: string;
 }>;
@@ -18,9 +19,9 @@ export declare class McpHttp {
     readonly resolve: Resolve;
     readonly after: () => Promise<void>;
     now: () => number;
-    gone: (identity: string) => Promise<void>;
+    gone: (identity: string, ward: string) => Promise<void>;
     constructor(resolve: Resolve, after?: () => Promise<void>);
-    handle(req: IncomingMessage, res: ServerResponse, identity: string): Promise<void>;
+    handle(req: IncomingMessage, res: ServerResponse, identity: string, ward?: string): Promise<void>;
     sweep(): void;
     drop(sid: string): void;
     close(): Promise<void>;

package/dist/mcp/http.js

@@ -28,7 +28,7 @@ export class McpHttp {
     // `identity` is what the bearer named; the caller has already turned a
     // stranger away. A request on a known session goes to it. A request with
     // no session opens one, if it is an initialize; anything else is 400.
-    async handle(req, res, identity) {
+    async handle(req, res, identity, ward = 'main') {
         const id = req.headers['mcp-session-id'];
         const sid = Array.isArray(id) ? id[0] : id;
         const json = (status, body) => {
@@ -40,7 +40,7 @@ export class McpHttp {
             const s = this.sessions.get(sid);
             if (!s)
                 return json(404, { jsonrpc: '2.0', error: { code: -32001, message: 'no such session' }, id: null });
-            if (s.identity !== identity)
+            if (s.identity !== identity || s.ward !== ward)
                 return json(403, { jsonrpc: '2.0', error: { code: -32003, message: 'not your session' }, id: null });
             s.touched = this.now();
             await s.transport.handleRequest(req, res);
@@ -50,16 +50,16 @@ export class McpHttp {
         }
         if (req.method !== 'POST')
             return json(400, { jsonrpc: '2.0', error: { code: -32000, message: 'no session' }, id: null });
-        const found = await this.resolve(identity);
+        const found = await this.resolve(identity, ward);
         // A session opens on her describe, and admit already asked it. The one
         // word the door says for an identity the user being removed is
         // `removed`, under the key it bound for her avatar: in MCP's vocabulary
         // that is 401, the client drops its token and starts the exchange again,
         // and the route forgets the grant.
         if (found.error === 'removed') {
-            await this.gone(identity);
+            await this.gone(identity, ward);
             for (const [sid, s] of this.sessions)
-                if (s.identity === identity)
+                if (s.identity === identity && s.ward === ward)
                     this.drop(sid);
             res.writeHead(401, { 'content-type': 'application/json' });
             return void res.end(JSON.stringify({ jsonrpc: '2.0', error: { code: -32001, message: 'removed: the user being removed this identity' }, id: null }));
@@ -69,7 +69,7 @@ export class McpHttp {
         const transport = new StreamableHTTPServerTransport({
             sessionIdGenerator: () => randomUUID(),
             onsessioninitialized: (s) => {
-                this.sessions.set(s, { identity, transport, serving, touched: this.now() });
+                this.sessions.set(s, { identity, ward, transport, serving, touched: this.now() });
             },
             onsessionclosed: (s) => this.drop(s),
         });

package/dist/mcp/oauth.d.ts

@@ -18,6 +18,7 @@ export type Pending = {
 };
 export type Grant = {
     identity: string;
+    ward: string;
     client_id: string;
     exp: number;
 };
@@ -26,6 +27,7 @@ export type Store = {
     pending: Record<string, Pending>;
     codes: Record<string, Pending & {
         identity: string;
+        ward: string;
     }>;
     access: Record<string, Grant>;
     refresh: Record<string, Grant>;
@@ -72,7 +74,7 @@ export declare class OAuth {
     pending(id: string): (Pending & {
         client: Client;
     }) | null;
-    complete(id: string, identity: string): Promise<{
+    complete(id: string, identity: string, ward?: string): Promise<{
         redirect: string;
     } | {
         error: string;
@@ -83,15 +85,18 @@ export declare class OAuth {
         error: string;
     }>;
     token(body: URLSearchParams): Promise<Record<string, unknown>>;
-    issue(identity: string, client_id: string): Promise<{
+    issue(identity: string, ward: string, client_id: string): Promise<{
         access_token: string;
         token_type: string;
         expires_in: number;
         refresh_token: string;
         scope: string;
     }>;
-    bearer(req: IncomingMessage): string | null;
-    revoke(identity: string): Promise<void>;
+    bearer(req: IncomingMessage): {
+        identity: string;
+        ward: string;
+    } | null;
+    revoke(identity: string, ward?: string): Promise<void>;
     sweep(): void;
     handle(req: IncomingMessage, res: ServerResponse, rest: string): Promise<boolean>;
     challenge(res: ServerResponse): void;

package/dist/mcp/oauth.js

@@ -99,14 +99,15 @@ export class OAuth {
         const client = this.client(p.client_id);
         return client ? { ...p, client } : null;
     }
-    // The web route's last step: the human allowed this client as this identity.
-    async complete(id, identity) {
+    // The web route's last step: the human allowed this client as this
+    // identity, into this world.
+    async complete(id, identity, ward = 'main') {
         const p = this.pending(id);
         if (!p)
             return { error: 'expired' };
         delete this.store.pending[id];
         const code = token();
-        this.store.codes[code] = { ...p, identity, exp: this.now() + CODE_TTL };
+        this.store.codes[code] = { ...p, identity, ward, exp: this.now() + CODE_TTL };
         await this.o.persist(this.store);
         return { redirect: withQuery(p.redirect_uri, { code, state: p.state }) };
     }
@@ -131,7 +132,7 @@ export class OAuth {
                 await this.o.persist(this.store);
                 return { error: 'invalid_grant' };
             }
-            return this.issue(c.identity, c.client_id);
+            return this.issue(c.identity, c.ward ?? 'main', c.client_id);
         }
         if (grant === 'refresh_token') {
             const rt = body.get('refresh_token') ?? '';
@@ -139,14 +140,14 @@ export class OAuth {
             if (!r || r.exp < this.now())
                 return { error: 'invalid_grant' };
             delete this.store.refresh[rt]; // rotated: the old one is gone with the new one's birth
-            return this.issue(r.identity, r.client_id);
+            return this.issue(r.identity, r.ward ?? 'main', r.client_id);
         }
         return { error: 'unsupported_grant_type' };
     }
-    async issue(identity, client_id) {
+    async issue(identity, ward, client_id) {
         const access_token = token(), refresh_token = token();
-        this.store.access[access_token] = { identity, client_id, exp: this.now() + ACCESS_TTL };
-        this.store.refresh[refresh_token] = { identity, client_id, exp: this.now() + REFRESH_TTL };
+        this.store.access[access_token] = { identity, ward, client_id, exp: this.now() + ACCESS_TTL };
+        this.store.refresh[refresh_token] = { identity, ward, client_id, exp: this.now() + REFRESH_TTL };
         const c = own(this.store.clients, client_id);
         if (c)
             c.exp = this.now() + REFRESH_TTL; // allowed: the client lives as long as what it was granted
@@ -154,19 +155,19 @@ export class OAuth {
         await this.o.persist(this.store);
         return { access_token, token_type: 'Bearer', expires_in: ACCESS_TTL / 1000, refresh_token, scope: 'quo' };
     }
-    // The bearer on an MCP request, to a client identity. Null is 401.
+    // The bearer on an MCP request, to a client identity in a world. Null is 401.
     bearer(req) {
         const h = req.headers.authorization ?? '';
         const t = h.startsWith('Bearer ') ? h.slice(7) : '';
         const g = own(this.store.access, t);
-        return g && g.exp >= this.now() && typeof g.identity === 'string' ? g.identity : null;
+        return g && g.exp >= this.now() && typeof g.identity === 'string' ? { identity: g.identity, ward: g.ward ?? 'main' } : null;
     }
-    // Every grant an identity holds, gone: the route's half of revocation.
-    // The other half is the user being removing the occupant.
-    async revoke(identity) {
+    // Every grant an identity holds in a world, gone: the route's half of
+    // revocation. The other half is the user being removing the occupant.
+    async revoke(identity, ward = 'main') {
         for (const k of ['access', 'refresh'])
             for (const [t, g] of Object.entries(this.store[k]))
-                if (g.identity === identity)
+                if (g.identity === identity && (g.ward ?? 'main') === ward)
                     delete this.store[k][t];
         await this.o.persist(this.store);
     }

package/dist/mcp/pilot.js

@@ -15,7 +15,7 @@ export function owner(dir, ward, via) {
             return { error: r.word };
         return r;
     };
-    return { tools: () => one(undefined, {}), call: (name, args) => one(name, args), ears: new Set() };
+    return { tools: () => one(undefined, {}), call: (name, args) => one(name, args ?? {}), ears: new Set() };
 }
 export function pilotSide(dir, ward, transport, via) {
     return mcpSide(owner(dir, ward, via), transport);

package/dist/mcp/route.d.ts

@@ -0,0 +1,12 @@
+import { OAuth } from './oauth.ts';
+import type { McpHttp } from './http.ts';
+import type { Handler } from '../cli/http.ts';
+export type Routes = {
+    mcp: string;
+    web: string;
+    quo?: string;
+};
+export declare function mcpRoute(dir: string, routes: Routes, mcp: McpHttp | null): Promise<{
+    oauth: OAuth;
+    handler: Handler;
+}>;

package/dist/mcp/route.js

@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: Apache-2.0
+// The mcp. route: the credential exchange and the MCP endpoint, served by
+// the daemon under `/mcp` and mapped by the proxy from the mcp. hostname.
+// The OAuth store is `<dir>/oauth.json`, the route's own and never a
+// ward's: clients, pending requests, codes and tokens, each mapping to a
+// client identity at most. A bearer names an identity in a world; the
+// endpoint hands both to the model side, which runs beside her avatar.
+import { readFile, writeFile, rename } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { OAuth, emptyStore } from './oauth.js';
+export async function mcpRoute(dir, routes, mcp) {
+    const file = join(dir, 'oauth.json');
+    const store = existsSync(file) ? { ...emptyStore(), ...JSON.parse(await readFile(file, 'utf8')) } : emptyStore();
+    let queue = Promise.resolve();
+    const persist = (s) => (queue = queue.then(async () => {
+        await writeFile(file + '.tmp', JSON.stringify(s), { mode: 0o600 });
+        await rename(file + '.tmp', file);
+    }));
+    const oauth = new OAuth({ issuer: routes.mcp, resource: `${routes.mcp}/mcp`, finish: (id) => `${routes.web}/login?request=${id}`, store, persist });
+    const handler = async (req, res, rest) => {
+        if (await oauth.handle(req, res, rest))
+            return;
+        if (rest === '/mcp') {
+            const grant = oauth.bearer(req);
+            if (grant === null || !mcp)
+                return oauth.challenge(res);
+            return mcp.handle(req, res, grant.identity, grant.ward);
+        }
+        res.writeHead(404, { 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: 'no such route' }));
+    };
+    return { oauth, handler };
+}

package/dist/mcp/server.d.ts

@@ -1,16 +1,11 @@
 import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
 import { type Tool } from '@modelcontextprotocol/sdk/types.js';
-import type { Answer, Blueprint, JsonObject } from '@quo-systems/quo';
-import { type Serving } from '../beings/side.ts';
+import type { Blueprint } from '@quo-systems/quo';
+import { type Serving, type Subject } from '../beings/side.ts';
+import { type Look } from '../beings/look.ts';
 export declare const NAME = "quo";
 export declare const VERSION = "0.0.0";
-export type Subject = {
-    tools(): Promise<Blueprint | {
-        error: string;
-    }>;
-    call(name: string, args: JsonObject): Promise<Answer>;
-    ears: Set<(object: JsonObject) => void>;
-};
+export type { Subject } from '../beings/side.ts';
 export declare const DESCRIBE: Tool;
-export declare function tools(bp: Blueprint): Tool[];
+export declare function tools(bp: Blueprint, look?: Look): Tool[];
 export declare function mcpSide(avatar: Subject, transport: Transport, after?: () => Promise<void>): Promise<Serving>;

package/dist/mcp/server.js

@@ -11,19 +11,37 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { word, wordText, SILENCE_TEXT, UNREACHED_TEXT } from '../beings/side.js';
+import { hintFor, sanitise } from '../beings/look.js';
+import { isSilence, isWord, digest } from '@quo-systems/quo';
 export const NAME = 'quo';
 export const VERSION = '0.0.0';
 // The empty ask as a tool: her describe whole, asks and notes.
 export const DESCRIBE = { name: 'describe', description: 'the empty ask: her describe, the asks and the notes', inputSchema: { type: 'object' } };
 // Her describe, spoken as tools, the empty ask first. Name, description and
-// input are verbatim; an output schema crosses when she declared one.
-export function tools(bp) {
-    const asks = bp.asks.map((a) => {
+// input are verbatim; an output schema crosses when she declared one. Her
+// look, when she has one, is the hints: a title, and the annotations a host
+// reads. The `look` ask itself is presentation, and is not a tool.
+export function tools(bp, look = {}) {
+    const asks = bp.asks
+        .filter((a) => a.name !== 'look')
+        .map((a) => {
         const t = { name: a.name, inputSchema: { ...a.input, type: 'object' } };
         if (a.description !== undefined)
             t.description = a.description;
         if (a.output !== undefined)
             t.outputSchema = { ...a.output, type: 'object' };
+        const h = hintFor(bp, look, a.name);
+        if (h.title !== undefined)
+            t.title = h.title;
+        const notes = {};
+        if (h.readOnly !== undefined)
+            notes.readOnlyHint = h.readOnly;
+        if (h.destructive !== undefined)
+            notes.destructiveHint = h.destructive;
+        if (h.idempotent !== undefined)
+            notes.idempotentHint = h.idempotent;
+        if (Object.keys(notes).length)
+            t.annotations = notes;
         return t;
     });
     return [DESCRIBE, ...asks];
@@ -32,11 +50,24 @@ export function tools(bp) {
 // changed hooks it, since a same-ward ask never crosses the harbor.
 export async function mcpSide(avatar, transport, after = async () => { }) {
     const server = new Server({ name: NAME, version: VERSION }, { capabilities: { tools: { listChanged: true }, logging: {} } });
+    // Her look, asked once per digest of her describe.
+    let seen = null;
+    let look = {};
     server.setRequestHandler(ListToolsRequestSchema, async () => {
         const bp = await avatar.tools();
         if ('error' in bp && !('asks' in bp))
             return { tools: [] }; // not joined: nothing to show, and nothing to call
-        return { tools: tools(bp) };
+        const d = await digest(bp);
+        if (d !== seen) {
+            seen = d;
+            if (bp.asks.some((a) => a.name === 'look')) {
+                const l = await avatar.call('look', {});
+                look = isSilence(l) || isWord(l) ? {} : sanitise(l);
+            }
+            else
+                look = {};
+        }
+        return { tools: tools(bp, look) };
     });
     server.setRequestHandler(CallToolRequestSchema, async (req) => {
         const w = word(req.params.name === DESCRIBE.name ? await avatar.tools() : await avatar.call(req.params.name, (req.params.arguments ?? {})));

package/dist/mcp/web/exchange.d.ts

@@ -1,14 +1,17 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { OAuth } from '../oauth.ts';
 export declare const SESSION_TTL: number;
-export type Admit = (identity: string, wake: boolean) => Promise<{
+export type Admit = (identity: string, wake: boolean, reach: boolean, ward: string) => Promise<{
     error?: string;
 }>;
 export type Options = {
     oauth: OAuth;
     password: () => string | undefined;
     admit: Admit;
-    user: string;
+    worlds: () => {
+        ward: string;
+        user: string;
+    }[];
     now?: () => number;
 };
 export declare const suggest: (name: string) => string;

package/dist/mcp/web/exchange.js

@@ -90,7 +90,7 @@ export class Exchange {
                 return page(400, `<h1>Nothing to allow</h1><p>This request is gone.</p>`), true;
             if (!this.valid(req))
                 return go(`/login?request=${encodeURIComponent(request)}`), true;
-            return page(200, allowForm(request, p.client.client_name, p.redirect_uri, suggest(p.client.client_name), this.o.user)), true;
+            return page(200, allowForm(request, p.client.client_name, p.redirect_uri, suggest(p.client.client_name), this.o.worlds())), true;
         }
         if (rest === '/allow' && req.method === 'POST') {
             const f = await readForm(req);
@@ -104,13 +104,17 @@ export class Exchange {
                 const out = await this.o.oauth.deny(request);
                 return 'redirect' in out ? go(out.redirect) : page(400, `<h1>Gone</h1>`), true;
             }
+            const worlds = this.o.worlds();
+            const world = worlds.find((w) => w.ward === (f.get('ward') ?? worlds[0]?.ward));
+            if (!world)
+                return page(400, allowForm(request, p.client.client_name, p.redirect_uri, suggest(p.client.client_name), worlds, 'That is not a world of this harbor.')), true;
             const identity = word(f.get('identity'));
-            if (identity === null || identity === this.o.user || identity === 'desk')
-                return page(400, allowForm(request, p.client.client_name, p.redirect_uri, suggest(p.client.client_name), this.o.user, 'An identity is one word, and not the user or the desk.')), true;
-            const admitted = await this.o.admit(identity, f.get('wake') === 'on');
+            if (identity === null || identity === world.user || identity === 'desk')
+                return page(400, allowForm(request, p.client.client_name, p.redirect_uri, suggest(p.client.client_name), worlds, 'An identity is one word, and not the user or the desk.')), true;
+            const admitted = await this.o.admit(identity, f.get('wake') === 'on', f.get('reach') === 'on', world.ward);
             if (admitted.error)
                 return page(500, `<h1>Not admitted</h1><p>${esc(admitted.error)}</p>`), true;
-            const out = await this.o.oauth.complete(request, identity);
+            const out = await this.o.oauth.complete(request, identity, world.ward);
             return 'redirect' in out ? go(out.redirect, { 'set-cookie': `${COOKIE}=; Path=/; Max-Age=0` }) : page(400, `<h1>Gone</h1>`), true;
         }
         return false;
@@ -125,12 +129,22 @@ ${err ? `<p class="err">${esc(err)}</p>` : ''}
 <form method="post" action="/login"><input type="hidden" name="request" value="${esc(request)}">
 <label for="p">Owner password</label><input id="p" name="password" type="password" autocomplete="current-password" autofocus required>
 <button type="submit">Log in</button></form>`;
-const allowForm = (request, client, redirect, identity, user, err = '') => `<h1>Allow ${esc(client)}?</h1>
-<div class="who"><p><strong>${esc(client)}</strong> asks to be an occupant of <strong>${esc(user)}</strong>.</p>
+// The world is a choice when the harbor has more than one; the user named
+// is the first world's, and the page says which world each identity lands in.
+const allowForm = (request, client, redirect, identity, worlds, err = '') => {
+    const user = worlds[0]?.user ?? '';
+    const pick = worlds.length > 1
+        ? `<label for="wd">World</label><select id="wd" name="ward">${worlds.map((w) => `<option value="${esc(w.ward)}">${esc(w.ward)}, ${esc(w.user)}'s</option>`).join('')}</select>`
+        : `<input type="hidden" name="ward" value="${esc(worlds[0]?.ward ?? 'main')}">`;
+    return `<h1>Allow ${esc(client)}?</h1>
+<div class="who"><p><strong>${esc(client)}</strong> asks to be an occupant of <strong>${esc(user)}</strong>${worlds.length > 1 ? ', or of another world below' : ''}.</p>
 <p>It will see exactly what ${esc(user)} shows the identity below, and nothing else. You can remove it any time.</p>
 <p>It returns to <code>${esc(redirect)}</code>.</p></div>
 ${err ? `<p class="err">${esc(err)}</p>` : ''}
 <form method="post" action="/allow"><input type="hidden" name="request" value="${esc(request)}">
+${pick}
 <label for="i">Identity</label><input id="i" name="identity" value="${esc(identity)}" pattern="[\\w.-]{1,40}" required>
+<label for="r"><input id="r" name="reach" type="checkbox" style="width:auto"> May reach what ${esc(user)} holds: her standings, acme and the rest, as asks of hers</label>
 <label for="w"><input id="w" name="wake" type="checkbox" style="width:auto"> May wake your other devices: hand an agent an event through ${esc(user)}</label>
 <button type="submit" name="decision" value="allow">Allow</button><button type="submit" name="decision" value="deny">Deny</button></form>`;
+};

package/harbor/quo-harbor.md

@@ -88,6 +88,38 @@ the new harbor pointed at the same code. Same seed, same pk, every standing
 anyone holds still points at her. The old harbor deletes its copies first:
 two harbors holding one seed are two wards with one pk, diverging silently.
 
+What a move costs is not the three parts, which are bytes, but how many
+peers wrote down where the ward was. A pk is permanent by arithmetic; a
+location is soft state in every other harbor's directory, and only that goes
+stale. So the bill is proportional to who hard-coded it, and there are two
+kinds of ward.
+
+A ward whose harbor dials out is free. It announces what it holds when a
+line opens and whenever that changes, the listener proves each claim at the
+door and binds it, and a ward that arrives on a new box is reachable as soon
+as its harbor dials. Nobody is told and no peer acts.
+
+A ward that is dialed keeps a second name. Peers hold a hint, pk at a URL,
+in their own stores and across their own restarts, so that URL is a promise
+the same way the pk is. Moving boxes does not break it, because a hostname
+is not a location: DNS and the proxy point it wherever the harbor now runs,
+which is the whole reason the route is a hostname and not an address.
+Changing the URL itself is the move that costs, and it cannot be announced
+to a peer this ward cannot reach.
+
+When it must change, what is republished is a hint and never an invitation.
+The relation, its keys and its count are untouched, and the invitation is
+as good as it was: that is why the two travel separately, a link being one
+next to the other. Peers on a rendezvous this ward also dials relearn by
+themselves, since a binding is proven at the door and names no URL; peers
+holding a hint need a new one, and a hint is not a capability, so it may be
+published in the open to all of them at once. Nobody is invited twice.
+
+The rule, then: a dialable ward keeps two names and owes the second the same
+care as the first, and a ward that only dials keeps one, which is why a
+laptop, a tab and a phone move home without ceremony and the droplet does
+not.
+
 ### Code is a harbor decision
 
 A ward's code has an origin: a folder the owner wrote, a bundle a world
@@ -168,14 +200,17 @@ rotation, and nothing else.
 
 ## Reach, directory, rendezvous
 
-A harbor needs three reach kinds and nothing more:
+A harbor needs two reach kinds and nothing more, which is what
+`packages/quo/SPEC.md` says and what `packages/quo/src/harbor/reach.ts` is:
 
 - **request**: a URL. Send bytes, get bytes. Listener to listener.
 - **socket**: a held connection, opened by whichever side can dial, used in
   both directions with a frame id. A WebSocket, a WebRTC channel and a
   native socket are one socket reach.
-- **channel**: an in-process port between two runtimes on one device. Tabs
-  on one machine, a webview and its sidecar.
+
+Two runtimes on one device are no third kind. Either they are one harbor,
+and it calls its other door with no transport at all, or they are two
+harbors, and one of them dials the other as any dialer does.
 
 Plus one forwarding rule: a pk whose reach is another harbor that holds a
 socket to it. That rule is the **rendezvous**, and with it every dialer is
@@ -228,13 +263,19 @@ rebinds it.
 The reach interface and its two implementations are the library's,
 `packages/quo/src/harbor/reach.ts`, and pass its reach suite here: the request
 and a socket to a daemon in `packages/dock/test/wire.test.ts`, the request
-through the worker inside the edge. The listener half is the terrain's, below:
+through the worker inside the edge. The listener half is the terrain's,
+`packages/dock/harbor/quo.ts`, the route the daemon mounts under `/quo`:
 
 ```
 request      POST <url>/<pk>, the sealed ask as the body, the sealed reply as the answer;
              <url> is the world's quo. route, which the proxy maps onto the daemon's /quo
              404 is "no reach for that pk" and comes back as nothing; a line lost after
              sending answers nothing at all, and the ward's bound ends the ask
+             at most 1 MiB is read, and a body over it is answered by that same 404: an
+             ask too big for this door is nothing delivered, never a silence, so it is
+             safe to send again and it will fail again. The number is this daemon's and
+             is on no wire; a caller cannot ask for it and is never told which of the
+             two a 404 was
 socket       a WebSocket at <url>, held by the dialer, used both ways
              text frame   { announce: [pk, ...] }   the ward pks this side holds
              ask frame    [0][id 4][pk 64][bytes]    a frame id matches the reply
@@ -252,19 +293,18 @@ request. So a third harbor with a hint that a phone's pk is at acme's
 `quo serve --dial URL`, or `<dir>/dial.json`, makes a daemon a dialer: it
 holds one socket per URL, announces its wards on open, binds the listener's
 pks, and reconnects with backoff from a second to thirty when the line
-drops. A pk is 64 bytes on the wire, the ward key and the padlock, which the
-first version of the ask frame got wrong and the suite caught in one run.
+drops. A pk is 64 bytes on the wire, the ward key and the padlock.
 
 The proof is `packages/dock/test/wire.test.ts`: the library's conformance suite,
 untouched, against two disk harbors in two folders with HTTP doors on
 loopback, once with every ask a request and once with the second harbor
 dialing the first; down is the reach refused, migrate is the ward folder
-moved and adopted. Then the rendezvous on its own. What it taught: a harbor
-must write the partition before it lets a folder go, because a being driven
-in-process changes it without passing a door; listeners left open keep a
-test process alive forever, so every pair is closed after the file; and a
-proxy sends the route root as `/quo/`, trailing slash, which the door takes.
-The first live crossing, Mac to lab and back, is in `estates/lab/lab.md`.
+moved and adopted. Then the rendezvous on its own.
+
+Two rules the daemon obeys and a reader would otherwise rediscover: a harbor
+writes the partition before it lets a folder go, because a being driven
+in-process changes it without passing a door; and a proxy sends the route
+root as `/quo/`, with the trailing slash, which the door takes.
 
 ## The two cores, as built
 
@@ -301,7 +341,7 @@ harbors in one tab with two databases, both dialing a Node daemon on
 loopback, so every relation crosses the rendezvous; down is the reach
 refused on both, migrate lifts seed, partition and record from one database
 into the other and boots there, the tab-to-home scene. And the lock: a
-second harbor over one database does not boot. It passed on 2026-09-04.
+second harbor over one database does not boot.
 
 ## The edge, as built
 
@@ -333,11 +373,10 @@ against two edge harbors in one object over two prefixed views of its
 storage, reaching each other by request through the worker; the root door
 refused without the secret and answering under it; and a Node daemon
 dialing the edge, its pk held there, reached by a third harbor through the
-edge, unreached when the line drops. What it taught: one object may not
-touch another's storage, the platform says so at the first put, and so the
-two harbors of the exercise share an object the way two tabs share a page;
-and a Uint8Array over a shared buffer is refused by the platform's crypto,
-which wants a plain one.
+edge, unreached when the line drops. Two platform rules shape it: one object
+may not touch another's storage, so the exercise's two harbors share one
+object the way two tabs share a page; and the platform's crypto refuses a
+Uint8Array over a shared buffer and wants a plain one.
 
 The `ws` question the road asked is answered by this terrain: the socket
 reach's framing and the dialer are written on the standard surface and
@@ -362,10 +401,10 @@ device
     quo.sock                     owner asks; local only; never behind a proxy
     side.sock                    local sides; local only; never behind a proxy
     127.0.0.1:8787               the HTTP door, loopback only; routes mount by path
-      /health                    the wards it hosts, by name and pk
-      /mcp                       the model side
-      /web                       the bundle for tabs, and the exchange pages
-      /quo                       later: the socket door: request in, sockets held, the rendezvous
+      /health                    the wards it hosts, by name and pk; cli/http.ts
+      /mcp                       the model side; mcp/route.ts
+      /web                       the worlds' pages and the exchange; human/web.ts, mcp/web/
+      /quo                       the socket door: request in, sockets held, the rendezvous; harbor/quo.ts
   reverse proxy
     mcp.example.com -> 127.0.0.1:8787/mcp
     web.example.com -> 127.0.0.1:8787/web
@@ -389,15 +428,13 @@ There is no `cli.` route.
 
 ## Acceptance
 
-Every harbor here is accepted the day it passes the library's conformance suite
-untouched, and by nothing else. The disk harbor over the wire passed it on
-2026-09-04, under both reaches; the browser harbor through a daemon passed it
-the same day; the edge harbor inside the platform's runtime passed it the same
-day. Reach, store and the core now hold on three terrains, which is where the
-library takes them. Every store passes the library's store suite,
+A harbor here is accepted when it passes the library's conformance suite
+untouched, and by nothing else. Three do: the disk harbor over the wire
+under both reaches, the browser harbor through a daemon, and the edge harbor
+inside the platform's runtime. Every store passes the library's store suite,
 `packages/quo/src/conformance/store.ts`: files in
 `packages/dock/test/store.test.ts`, IndexedDB and the edge's storage inside
 their terrains behind `check:terrain`. Every reach passes the library's reach
 suite, `packages/quo/src/conformance/reach.ts`. The store, the reach and the
-core are in the library since 2026-09-04, each with `packages/quo/SPEC.md` in
-the same commit, and every harbor here is one of them over its own terrain.
+core are the library's, and every harbor here is one of them over its own
+terrain.