@quo-systems/quo 0.1.0

package/SPEC.md

@@ -0,0 +1,1595 @@
+# SPEC
+
+This is the truth of Quo, and the whole context. It assumes nothing from any
+other document. It is written for the two people who work on this repository,
+not for a reader outside it, and it ships with the package as the truth
+the source is read against.
+
+It carries no version and keeps no history. There is no 1.0.0 yet, so there
+is nobody holding an older Quo to be compatible with, and no changelog to
+write. This file is rewritten in place to say what the tree says, and when
+the two disagree the fix is to move one of them, the same day. Where the tree
+is behind a decision, the chapter "Where the tree stands" says so; that
+chapter is the one place a gap is allowed to be named instead of closed.
+`test/repo.test.ts` holds this document to the tree where a test can.
+The package is published from 0.1.0 with no compatibility promise: this
+document may still move under anyone holding it. At 1.0.0 it is frozen
+once, and versioning starts to mean something.
+
+## What Quo is
+
+Quo is a protocol that lets an object ask another object and get an answer,
+without knowing whether that other object is in the same process, on the same
+device, or on another planet. It works on any device and in any language that
+can run code. It is three words, two of which are beings, and two edges.
+Nothing else is Quo.
+
+- **Harbor.** The program a device runs to boot wards. Owns the wire and the
+  operating system. Not a being. Nobody outside its device.
+- **Ward.** One process of its harbor. A being plus ward functions. Keeps
+  beings and judges its door.
+- **Being.** One ordinary object, one voice.
+
+Each word names both the interface and the thing. There is no fourth word.
+
+```
+device A                            device B
+  harbor A                            harbor B
+    map: pk -> door | reach             map: pk -> door | reach
+    ward W1  (pk1)                      ward W3  (pk3)
+      being b1                            being b4
+        standings: [shop, bank]             occupants: [cust7]
+        occupants: [owner]                being b5   public
+      being b2
+    ward W2  (pk2)
+      being b3
+```
+
+- A ward is named outward by one public key, its pk, derived from its seed.
+  That pk routes and nothing else. A being has no pk and no address. She has
+  relations, named by ids that never leave her ward.
+- A **standing** is a pointer a being holds to another being, through which
+  she asks. An **occupant** is a being she invited, whom her ward names when
+  she asks.
+- Every relation has two keys, one minted by each side for that relation
+  alone. Underneath every id her ward keeps the far ward's pk, the key she
+  is known by in that relation, and the key the far side is known by. She
+  never sees them.
+- The harbor routes by ward pk only. Its own pks map to doors, one per ward
+  it booted. Foreign pks map to whatever the device calls a reach. How a
+  harbor fills the foreign half is its own directory, and Quo says nothing
+  about it.
+- b1 asking b3 and b1 asking b4 are the same act inside the ward. The first
+  never leaves harbor A. The second does. b1 cannot tell, and should not. b1
+  asking b2 never leaves the ward at all.
+- The ward routes one thing: its own pk. Every other ward pk goes into one
+  call the harbor gave it, and what comes back is bytes or nothing.
+
+The rule that closes every chapter: whatever does not fit one of the lines in
+this document is not Quo's.
+
+## The two edges
+
+Quo has two edges, harbor to ward and ward to being. At each an object
+crosses once, at birth, and calls cross for the rest of the ward's life.
+Nothing crosses either of them but what is written here.
+
+### Harbor to ward
+
+The harbor passes one object, once, at birth, and receives two pointers.
+
+```
+ground
+  seed          bytes, or a string. the ward derives its pk from it and nothing else.
+                32 bytes are the seed; anything else is SHA-256'd to 32 bytes first.
+  memory        the partition. the ward's files. opaque to the harbor. an object.
+  instantiate   (class name, stance) -> object | null
+  carry         (ward pk, bytes) -> bytes | undefined       undefined: no door was reached. a throw is read the same.
+  random        (n) -> n bytes of entropy. every key a ward mints is drawn from it.
+```
+
+Nothing else is ever passed. A harbor that needs a sixth thing has found a
+gap in Quo or a leak into the ward. The shape is `Ground` in
+`src/ward/ground.ts`.
+
+Returned:
+
+- **The door.** One call: sealed bytes in, sealed bytes out. Always bytes:
+  when the ask did not open, the reply is silence sealed to whatever ephemeral
+  pk the bytes carried, and noise when they carried none.
+- **The ask.** One call: method and args in, object or silence out.
+  In-process and unsealed. This is the one unsealed ask in Quo, and the only
+  way a ward is piloted. Judgment, catching, and the return table are not
+  skipped: a throw inside is silence, and an unreached shape is silence.
+
+The harbor learns the ward's pk the way anyone learns anything: it asks. The
+empty ask on the ask pointer answers with the ward's describe, and the pk is
+in its notes.
+
+### Ward to being
+
+The ward passes one object, once, at birth, and receives one object, on
+which it calls one method.
+
+```
+in    the stance      at birth, once, for life
+      the asker       at every ask
+out   her answer(asker, method?, args?) -> object | silence      the one method the ward calls
+```
+
+The stance is her cells, her standings to ask, and the calls to invite,
+knock, take and remove. The ward builds it and hands it to the harbor's
+instantiate with a class name, and receives her. No method is the empty ask,
+and what she answers to it is her blueprint.
+
+The stance, as every being in every language receives it. Nothing more is
+ever offered, and nothing here may be missing.
+
+```
+stance
+  cells                                                her state. values only.
+
+  occupants.invite(id)                                 -> invitation | null      awaitable: a key is minted
+  occupants.remove(id)                                 -> nothing
+
+  standings.knock(invitation, method?, args?, wanted?) -> object | silence | unreached
+  standings.take(id, invitation)                       -> id | null            awaitable: it waits for the relation
+  standings[id]                                        -> standing | undefined
+  standings[id].ask(method?, args?, wanted?)           -> object | silence | unreached
+  standings.remove(id)                                 -> nothing
+
+  wanted = { time? }                                   what this one ask may spend, in milliseconds. optional,
+                                                       and so is saying anything at all
+```
+
+Return table.
+
+| call                | returns    | when                                                                                                         |
+| ------------------- | ---------- | ------------------------------------------------------------------------------------------------------------ |
+| invite(id)          | invitation | she minted a fresh id; the occupant record exists from now                                                   |
+|                     | null       | the id already names a record, occupant or standing, or is a reserved word                                   |
+| remove(id)          | nothing    | always. removing what is not there is nothing                                                                |
+| knock(inv, m, a, w) | object     | the far being answered                                                                                       |
+|                     | silence    | no ward claims the invitation, or she removed the id, or another consumed it, or the far being chose silence |
+|                     |            | or the invitation is not one, or the wait ran out                                                            |
+|                     | unreached  | her ward could not reach the far door, or could not seal the args                                            |
+| take(id, inv)       | id         | she knocked with this invitation and was answered, and the id is fresh                                       |
+|                     | null       | no answered knock on this invitation, or the id already names a record, or is a reserved word                |
+| standings[id]       | standing   | the record exists                                                                                            |
+|                     | undefined  | it does not. not an error                                                                                    |
+| ask(m, a, w)        | object     | she answered                                                                                                 |
+|                     | silence    | she, or her ward, said nothing; or the wait ran out                                                          |
+|                     | unreached  | her ward could not reach the far door, or could not seal the args                                            |
+
+Ask, knock, invite and take are awaitable. Async where the language has it,
+blocking where it does not. Every ask she makes is a new call.
+
+The asker has three shapes and no fourth, and nothing else ever reaches her.
+
+- `{ id }`: her own id for the occupant at the door, the one she minted when
+  she invited her.
+- `{}`: she is the public being of her ward, and that is how she knows.
+- `{ id: 'OWNER' }`: the arrival came on the ward's ask pointer, from her
+  owner.
+
+`OWNER` and `PUBLIC` are reserved words: invite and take refuse them, so no
+occupant can ever wear either name.
+
+## Silence, unreached, error
+
+Three words for "no object came back", and only three. Everything in Quo
+that can go wrong ends in one of them, and a being who knows the three never
+needs a fourth.
+
+```
+error       an object. hers.             { error: ... }, or any shape her output schema declares.
+silence     the ward's word. heard.       bytes came back, or would have, and said nothing.
+unreached   the ward's word. not heard.   nothing came back. nothing is known to have been delivered.
+```
+
+- An **error** is an ordinary answer. Quo never reads it, never makes it,
+  and never treats it apart from any other object. The base class answers
+  `{ error: 'unknown ask' }` for an ask she did not declare or hid; the
+  owner's asks answer error objects for what they refuse; both are hers to
+  read like any object.
+- **Silence** is not blindly retryable: the far being may have done the work
+  and the answer was lost.
+- **Unreached** is safe to retry: nothing is known to have been delivered.
+  It carries no reason. What she may know is that nothing came back, and
+  that is all. In one case the far ward heard and died before it could
+  answer, and the wire says nothing about it; asking again asks under the
+  next number and is heard, so the retry is safe all the same. See Closed.
+
+Who says what. A being says objects and silence, never unreached: the shape
+is the ward's, and a ward that sees it come out of a being reads it as
+silence. A ward says all three to its own being, and only objects and
+silence on the wire: unreached never crosses, it is the wire's nothing
+turned into a word. A harbor says nothing at all; it returns bytes or
+nothing, and does not know the word silence. The owner hears objects: a
+silence a being met is `{ error: 'silence' }` and an unreached is
+`{ error: 'unreached' }`, because the owner is piloting and an object is
+what a shell can print. The ask pointer answers the value silence only when
+the ward itself threw.
+
+### What her ward turns into silence
+
+Before or after the wire, her own ward answers silence in five cases, and
+tells her nothing about which.
+
+```
+S1  the invitation is not one         a shape that is not a ward pk, a heir with no secret, a secret with no heir.
+                                      nothing is sent.
+S2  the standing is gone              she held a standing, dropped it, and asked on what she held.
+                                      nothing is sent. an ask issued while it stood is answered.
+S3  the wait ran out                  the ask's time was spent and no reply was read.
+                                      what comes back late is not read. the number is spent.
+                                      an ask still waiting at its lane when the wait ran out is never sent.
+S4  the reply is not one              bytes came back that do not open, or are not signed by the ward they
+                                      were sent to, or are not `{ silence }` nor `{ object, seen }` with an
+                                      object present and seen a digest or null. the number is spent.
+S5  the far door said silence         every case in the next list.
+```
+
+And unreached in two: `U1` the args are not a value, or could not be
+sealed, so nothing left;
+`U2` the harbor returned nothing, or threw, so no door was reached. The number is
+taken all the same, and the gap it leaves in the count is harmless: the door
+honours any number above its mark.
+
+### What the door turns into silence
+
+The door answers one silence in thirteen cases. The first ten are refusals:
+the ask reached no being, and nothing was written, spent, rotated or
+touched. The last three are choices: the ask reached her, so the number is
+spent and the keys are rotated, and what she wrote in her cells is hers.
+
+```
+refusals
+D1   the box does not open           wrong padlock, garbage, too short. the reply is sealed to the lid if
+                                     the bytes carried one, and is noise otherwise. a lid that will not
+                                     take a seal, a small-order point, is no lid: noise.
+D2   the payload is malformed        by or next not 64 hex, method not a string, args not an object, seq
+                                     below one, time not a whole number above zero.
+D3   for nobody, and nobody is home  no public being on this ward.
+D4   for nobody, signature fails     the payload names a key it was not signed with.
+D5   the heir is not held            never minted here, or forgotten because the id was removed.
+D6   the key is not admitted         not the key held for the heir, and not the key it announced. a
+                                     forged key, an unannounced key, a heir already spent.
+D7   she is not there                the occupant record is gone, or the being did not come back this run.
+D8   signature fails                 under an admitted key.
+D9   a knock announces nothing       the heir is fresh and next is null. it binds nothing.
+D10  the number is refused           already honoured, or at or below the span.
+choices
+D11  she threw
+D12  she answered silence            on a named ask, or on the empty ask. nothing at all is silence too.
+D13  she answered an unreached shape
+```
+
+A refusal is judged in that order, and the first case met is the answer.
+The signature is verified before the number is spent, so a stranger cannot
+burn a number she could not sign for; a refusal at D9 or D10 has passed the
+signature and still writes nothing.
+
+### The law of one silence
+
+1. Every case above is one reply: `{ silence: true }`, sealed to the lid the
+   ask came with, signed by the ward key. Same bytes, same length. A
+   stranger cannot tell a refusal from a choice, nor one refusal from
+   another, nor any of them from a being who chose to say nothing.
+   The door equalizes the bytes and not the time it took to write them. The
+   ten refusals are cheap and alike; a choice ran a being first, and a being
+   is code this document does not bound. So whoever holds a standing may
+   learn from a clock that she was reached and said nothing, rather than
+   refused at the door. A stranger holds no standing and reaches no choice,
+   which is why the refusals are the ones made alike. Equalizing the time
+   would mean waiting out the allowance ceiling on every silence, and the
+   door will not buy that.
+2. A refusal writes nothing. No number, no key, no heir, no cell, no bind.
+   The same bytes presented again meet the same refusal, and a stranger who
+   knocks a thousand times leaves no mark.
+3. A choice writes what a heard ask writes. The number is spent and the keys
+   rotate, so the relation goes on: the next ask on it is answered, and a
+   silence never kills a standing.
+4. Silence leaves the caller's record as it was. A silent named answer
+   leaves `seen` untouched; a silent empty ask leaves `blueprint` and
+   `digest` untouched.
+5. Her ward never confuses her. Silence and unreached are told apart
+   always, and by nothing else: silence is bytes the far ward wrote, or a
+   bound her ward rang; unreached is the wire's nothing. A ward never
+   answers nothing, so that nothing always means unreached.
+6. Nobody enforces what a being does with silence. It is one value she
+   compares against, and the base class hands it to her unchanged.
+
+`test/silence.test.ts` asserts every numbered line above, by its number.
+
+## Words and values
+
+### Values
+
+Everything that crosses an edge is I-JSON (RFC 7493): args, answer,
+blueprint, invitation, and whatever she caches from them. Strings are valid
+Unicode. No duplicate keys. Numbers must be representable as IEEE doubles,
+so integers are exact up to 2^53. Larger integers and exact decimals travel
+as strings, with a schema format saying so. Bytes are base64 strings.
+Nothing else is a value: no dates, no references, no functions, no native
+types. An id or a standing is never a value.
+
+Args are held to the same rule before they are sealed: an ask whose args
+hold a non-value is unreached, because nothing left. Cells hold values and
+refuse anything else at the moment of writing, in her own frame: a Map, a
+Date, a NaN, a cyclic object, a function, an object that is not a plain one.
+The refusal is a throw where she wrote it, which her ward turns into the
+silence it turns every throw into. She has not answered, and
+nothing was written down that a harbor would later have to lie about. This
+holds all the way down: a container read through her cells is part of her
+cells. The guard is `src/ward/cells.ts`.
+
+### Silence and unreached
+
+Two of the three words for "no object came back". The chapter "Silence,
+unreached, error" is the whole of them; here only the values. Silence is one
+distinguished value. Null is an answer. Unreached is a second distinguished
+value, her ward's own word. Neither is an object, and neither carries
+anything. In this kit silence is the symbol `quo.silence` and unreached is a
+frozen object under the symbol key `quo.unreached`, both from
+`src/being/silence.ts`.
+
+### Blueprint, schema, digest
+
+Nothing here is Quo's invention. Four standards, adopted whole, so that two
+wards in two languages always read one blueprint the same way.
+
+```
+blueprint
+  asks   list of { name, description?, input: schema, output?: schema }
+  notes  any JSON value
+```
+
+The blueprint is the shape of an MCP tool list, plus notes. The schema is
+JSON Schema draft 2020-12, the one MCP uses; typed languages generate from
+it, untyped languages ignore it, and Quo writes none of it. Args are one JSON
+object with named fields, as MCP passes arguments.
+
+The digest is SHA-256, as hex, over the JCS (RFC 8785) canonical
+serialization of the blueprint. Same bytes from every language. This is law:
+two wards in two languages always hash one blueprint to one digest. A ward
+that cannot do this is not a ward. Because only values reach a digest, a key
+holding what is not a value is dropped before hashing and an array slot
+holding one is null, which is what crossing an edge does to them anyway. The
+reference is `src/being/digest.ts`.
+
+Capability and state are two axes, never mixed.
+
+```
+capability   what she can be asked.   blueprint.  changes rarely.
+             hashed into the digest.  learned by the empty ask.
+state        what she answers.        answers only. may change every ask.
+             never hashed.            never in the blueprint.
+```
+
+A digest change means one thing: her interface changed and the cached
+blueprint is wrong. Notes in the blueprint are about the interface. A being
+that puts state there makes every standing refresh for nothing, and that cost
+is hers.
+
+What follows: a being's describe is an MCP tool list with no translation.
+Whoever holds a ward's ask can put an MCP server in front of any being of
+it, and a being's class may wrap an MCP server; neither is a ward function.
+Models are occupants like anyone else. What stays Quo's: silence, unreached,
+ids, invitations, knock and take, the digest rule. MCP is the description
+and value layer. Quo is the relation layer.
+
+### Ids
+
+An id is minted by the being, bound by the ward, permanent, and never crosses
+the door. Her id for you and your id for her are unrelated. One id names one
+record, and standings and occupants are one namespace: invite refuses an id a
+standing holds, take refuses an id an occupant holds.
+
+Two words are the ward's and no being may mint them: `OWNER` and `PUBLIC`,
+the reserved askers of the ward-to-being edge. The ward speaks at every
+being's door as `{ id: 'OWNER' }` when it runs her describe for its owner,
+and an occupant wearing that name would be two parties with one face.
+`PUBLIC` guards nothing today, because a public asker is `{}` and carries no
+id, and it is claimed now while claiming it is free.
+
+Three more are refused for a plainer reason: `knock`, `take` and `remove`
+are the calls on `standings`, and they share that object with the ids she
+takes. A standing under one of those names would be unreachable, so invite
+and take refuse them like the ward's words.
+
+### Cells
+
+Cells are I-JSON values. The ward may persist them. A restart is silent: she
+is constructed again with the same cells.
+
+```
+cells
+  standings: { id: { id, digest, blueprint, seen } }   ward writes all four
+  occupants: { id: { id, notes } }                     ward writes id, she writes notes
+  class                                                ward writes it at boot, so a restart finds her
+  anything else                                        hers
+```
+
+- `digest` is the hash of the blueprint she last fetched by the empty ask.
+- `blueprint` is that blueprint.
+- `seen` is the digest her ward last saw arrive with an answer. A silent
+  refresh leaves it untouched.
+- `notes` is hers. Quo never reads it. Tier, expiry, kinship between an
+  occupant and a standing that are the same far being: all hers.
+
+## Relations
+
+### How a relation is born
+
+There is one way in and one way back.
+
+1. She wants B as an occupant. She mints an id, in her own time, and asks
+   her ward for an invitation for it. The occupant record exists from that
+   moment. The invitation is a value: it goes by mail, paper, or inside the
+   args of some other ask. Quo does not care how.
+2. B consumes it by knocking: an ask carrying the invitation. B's ward
+   seals it and hands it to its harbor's carry, and her ward, which
+   recognises its own seal, and binds the
+   arrival to the id she minted. From now on every ask from B arrives as
+   that id. The first such ask is how she learns the invitation was
+   consumed. Whether it is still welcome is hers: expiry, one use, anything,
+   lives in her notes.
+3. If she answered, B may take her as a standing, minting B's own id for
+   her. That is the only moment a standing is born. Take binds B's side
+   only; the knock bound hers. Take before a knock, or after a silent one,
+   births nothing. B may also knock, say hello, and never call again. She
+   keeps B as an occupant until she decides otherwise. She never learns that
+   B walked away.
+4. B wants her to reach back? B mints an id, makes an invitation, and puts
+   it in the args. She knocks it and takes B if she wants. Two invitations,
+   two relations, each chosen by its owner.
+
+She is always the initiator. Nobody becomes her occupant unless she invited
+them. Nobody becomes her standing unless she knocked and chose to take, or
+her owner knocked for her.
+
+### What take does
+
+Take consumes. Until take the relation lives in a knock record, under the far
+ward and the heir; from take it lives in the standing, under her id, and
+never in both. Take copies the keys and the count the knock left, deletes the
+knock record, and the invitation is spent for her: knocking it again is an
+ask on the standing, and taking it again births nothing.
+
+Take waits, because a relation has one line of keys and one count, and every
+word spoken for it goes in order. Taken out of that order it would read
+between a knock's send and its answer, and the standing would be born holding
+a number the far door has already honoured and a key it has already rotated
+past. So take goes in the line with the rest.
+
+### One relation, one lane
+
+Every send on one relation waits for the one before it. The rotation is a
+conversation: a send reads the key that speaks now, announces the next, and
+moves once the far door has answered, and two sends interleaving on one
+relation would read each other's half-written keys. Lanes are per relation:
+beings still ask concurrently, and a slow relation never holds up another.
+Before take the lane is the invitation's; after take it is the standing's,
+and a knock on a taken invitation joins the standing's lane.
+
+The keys an ask sends under are read when she calls, not when the lane
+reaches her: an ask issued while the standing stood is answered even if she
+drops it in the next line. An ask on a standing she has already dropped is
+silence, and so is a knock on the invitation it was born on: after take the
+invitation names the standing and nothing else, so it is exactly as alive as
+the standing is.
+
+### The public being
+
+A ward may have one public being, and no more. She is an ordinary being,
+booted by the owner and marked public. Arrivals for no heir reach her. Her
+asker is `{}`: she is asked by anyone, and she can tell. She may hold
+standings. She may invite, and an occupant of hers arrives named while
+strangers still arrive as `{}`. A ward without a public being answers
+arrivals for no heir with silence.
+
+An invitation to her is `{ ward }` alone. One with a secret and no heir is
+not an invitation. She may be taken as a standing on that invitation, and
+such a standing has no heir and never rotates.
+
+She is reached without a heir, so the door keeps nothing for whoever asked:
+no key it vouched for, and no count. The signature is still checked, under
+whatever key signed. Once-only delivery does not reach her: the same sealed
+bytes presented twice are delivered twice, and the number the payload carries
+is required and honoured by nobody. A count per voice would be memory a
+stranger chooses the size of, which is the thing the span exists to refuse.
+
+So her answer must be safe to repeat. This is her obligation, not a gap at
+the door. Anything that must happen once lives behind an invitation, where
+there is a heir and a count.
+
+### How a relation crosses wards
+
+1. She mints an id. Her ward mints a heir for it, keeps the pk, and hands
+   her an invitation: her ward's pk, the heir pk, the heir secret. A value.
+   It goes anywhere. Rotation one.
+2. The invitation is consumed by an ask at some ward, and that ask names a
+   being there. Either B holds it, because a standing put it in her args,
+   and B knocks. Or an owner holds it, because it came by mail, and the
+   owner's ask knocks for a being of theirs, new or existing. There is no
+   third way, because a relation cannot end in thin air.
+3. B's ward mints her own key, signs the knock with the heir secret,
+   announces her key inside, seals the box to her ward's padlock, and
+   hands it to carry for the ward pk. No relation between the two wards is needed,
+   ever. Her ward opens its own box, admits the heir, verifies, binds the
+   id to B's key, and hands her the arrival as the id she minted. The heir
+   is spent. Rotation two.
+4. B's ward remembers the knock was answered, and lets B take. From then on
+   every ask from B on that standing is signed by her current key, announces
+   her next, and is sealed to the same padlock. Every answer rotates her.
+5. Same ward: her ward recognises its own pk and delivers without the
+   harbor. Same harbor: the harbor finds the pk in its own map and calls the
+   other door. Two harbors: the wire. The ward's code has one branch between
+   these, and the being has none. A same-ward knock is sealed, signed, and
+   judged exactly like a far one.
+
+## The door
+
+### Keys
+
+One 32-byte seed is one key. A being's key signs and never seals. The ward's
+key does both: an Ed25519 pair to sign replies, an X25519 padlock every ask
+is sealed to. Beings never own a padlock.
+
+- **The ward key** comes from the seed. Its pk on the wire is the signing pk
+  then the padlock, 128 hex, and it routes.
+- **The heir** is the key the inviting ward mints at invite, for one id. It
+  keeps the heir's pk beside the id and gives the secret away. The
+  invitation IS the heir: ward pk, heir pk, heir secret. Rotation one: the
+  occupant already has a key, and the inviter chose it.
+- **Her own key** is what the knocker mints at knock. She signs the knock
+  with the heir and announces her own key in it. The door binds the id to
+  her key and the heir dies as it speaks. Rotation two: from now on she
+  signs with a key the inviter never held. A knock that announces nothing
+  binds nothing.
+- **Next.** Every ask she sends announces the key she will sign with next.
+  The door holds two pks for her: the one that may speak now, and the one
+  it vouched for. Whichever speaks first wins, and the other dies. There is
+  no rotate call: every honoured ask rotates, and a lost reply strands
+  nobody. Her side moves to the announced key only when an answer came back
+  that was not silence; the door has already moved, and admits both.
+
+The knock is the one place where both sides cannot be brought back into
+agreement by that rule alone. If the reply to the first knock is lost, the
+door has spent the heir and rotated to the key she announced, and she does
+not know it: knocking as the heir again would be refused for good. She cannot
+learn which case she is in, so she asks, and the asking tells her. She sends
+under her own key first. If the door heard, that is the key it admits and she
+is answered. If it did not, the key means nothing there and the ask is
+refused; a refusal at a door writes nothing, so the heir is untouched and she
+knocks as the heir, as she would have. One extra round trip, in the one case
+where a reply was lost. It gives a stranger nothing: whoever holds the
+invitation could always knock as the heir, and her own key is admitted only
+where the door already bound it to her.
+
+Three keys per relation over its life, one rule at the door: the key I hold
+for you may speak, and so may the key it announced last time, and each
+number once.
+
+Every key in a relation was minted by one side and its secret never left
+that side, except the heir, which the inviter gives away and which dies the
+first time it speaks. No key serves two relations. No key outlives its
+relation. A ward keeps only the last eight pks a being's side minted, which
+is enough to name the keys in play.
+
+### The count
+
+Every ask she sends carries the next number in one unbroken count for that
+relation, starting at one, and the door honours each number once. The number
+rides inside the signed payload, so bytes caught on the road carry the number
+they were sent under: they cannot be renumbered without breaking her
+signature, and they are refused as themselves. A caller who means to ask
+again asks again, under the next number, and is heard. Retry and
+fire-and-forget stay hers to build; only the accident and the interception
+are refused.
+
+The door keeps the highest number honoured and which numbers below it are
+spent, out to a span of sixty-four, because a door that remembered every
+number ever seen would be a door with unbounded memory. A number above the
+mark is honoured and moves it; a number inside the span is honoured once; a
+number at or below the span is refused. The mark and the spent list are in
+the partition, because a door that forgets what it honoured honours it again
+after a restart.
+
+Her side keeps the number it spoke under whether or not a reply came back. A
+reply lost on the way back is a door that has already honoured the number,
+and offering it twice would silence the relation for good. The count carries
+over from the knock into the standing at take.
+
+### The allowance
+
+Every ask carries what it may still spend: **time**, in milliseconds. It
+rides inside the signed payload, so a budget caught on the road cannot be
+widened by whoever caught it.
+
+A being who says nothing gets her ward's default and never thinks about it.
+A being who wants to say so passes a third argument. What she is given is
+what she asked for held to what her ward allows: a number that is not a
+positive whole number falls to the default rather than refusing her, and one
+above the ceiling is the ceiling, silently, because the ceiling is not hers
+to know. Budget is granted by a ward, never minted by a being. How wide the
+default and the ceiling are is the ward's own; this ward's are thirty
+seconds by default and five minutes at the ceiling, in
+`src/ward/allowance.ts`.
+
+They are two numbers and not one, because the third argument is for both
+directions. A being who knows her own work asks for less on the ask she wants
+back quickly, and for more on the one she knows is slow. A ceiling equal to
+the default would leave her only the narrowing half, and would give the ward
+no way to allow one long piece of work without making every ask that
+patient.
+
+The sender's wait has an end, and this is the one thing the ward times. The
+bound covers the whole of an ask, from the moment she calls: a relation that
+comes back round on itself is stopped at its own lane, before a byte is
+sealed, and a bound that watched only the wire would never see it. This is
+what makes three answers three. A wait that does not end is not an object,
+not silence and not unreached, and before the allowance a cycle of legal asks
+could produce one: A asks B, B answering asks A back, A answering asks B on
+the relation the first ask still holds. Now the innermost wait gives up, the
+silence unwinds outward, and the ask ends.
+
+**A wait that ran out is silence, never unreached.** Unreached promises
+nothing was delivered and is safe to ask again. A bound that expired knows no
+such thing: the far door may have heard and be working still. What comes
+back late is not read.
+
+The harbor keeps a patience of its own, and the two never read each other.
+What a harbor hands back as nothing came back is unreached, and unreached
+says nothing was delivered: a harbor may answer it only where it knows the
+bytes never arrived, no reach for that pk, a socket that would not open, a
+link that is down. A harbor that sent them and then gave up knows no such
+thing, and must not answer at all; the ward's bound will ring, and that is
+silence, which promises nothing. A harbor that throws has answered nothing
+in a louder voice, and the ward reads it as nothing: unreached. So a harbor
+may hold a shorter patience than the ward for its own reasons, a socket it
+wants back or a queue it will not grow, and whichever ends first ends the
+ask.
+
+The receiving door reads the allowance before anything is done under it. A
+payload whose time is not a whole number above zero is malformed, D2, and
+is refused as one. Nothing is spent and nothing rotates, because nothing
+was heard.
+
+Each ask is bounded on its own. The time an arriving call has left does not
+bound the asks a being makes while answering it, and an ask carries no count
+of doors; see Closed. Every wait still ends.
+
+### Judgment
+
+Every arrival is judged by the door, and named by it or falls silent.
+
+1. Open the box with the ward's padlock. Read whether it is for a heir or
+   for nobody. Parse the payload and refuse any field of the wrong shape.
+2. For nobody: find the public being, verify the signature under the key the
+   payload names, and dispatch as `{}`. Nothing is written.
+3. For a heir: admit the signer if it is the key held for that heir or the
+   key that key announced. Find the being who minted the id and check she
+   still holds the occupant. Verify the signature. Only then spend the
+   number and settle the keys, so a stranger cannot burn a number she could
+   not sign for, and the same bytes twice rotate nothing. Dispatch as
+   `{ id }`.
+4. Catch every throw and answer silence. Treat an unreached shape coming out
+   of a being as silence.
+5. On every answered named ask, run her describe for that asker in process,
+   hash it, and put the digest next to the object in the reply. One trip. A
+   describe that throws or falls silent costs the digest and nothing else.
+   On the empty ask the reply carries no digest; her side hashes what came.
+6. Answer by the same call the ask came in on.
+
+A stranger is bytes the ward cannot admit, and every way of being one is
+listed, with a number, under "Silence, unreached, error". The public being
+is the one door a stranger may walk through, and only because she chose it.
+
+### Inner and outer
+
+Inner: being keys, ids, cells, stances, doors, the bind table, every secret,
+every method, every arg, every answer. Nothing inner is ever readable in the
+bytes, and `test/ward.test.ts` reads every byte string that crossed to check.
+
+Outer: ward pks, heir pks, ephemeral pks, ciphertext. That is the whole of
+what the wire sees. The one value a being holds that is outer is the
+invitation, which she carries opaque and never opens.
+
+A far ward binds a heir to a pk, never to a being. Two far beings that talk
+to two beings of mine see two heirs and one ward pk, and two relations that
+share no key learn nothing from each other.
+
+### The wire
+
+Four algorithms, named once and never negotiated: Ed25519 signs, X25519
+agrees, SHA-256 hashes, AES-256-GCM encrypts with key and nonce derived
+together by HKDF-SHA-256 under an empty salt and the label `quo-seal`. The
+ephemeral pk is the additional authenticated data of every box. A small-order
+public key verifies nothing; an all-zero agreement is refused. All four are
+in WebCrypto, which is why the ward names no package -- on any terrain that
+carries them. SHA-256, AES-GCM and HKDF are everywhere; the two curves are
+recent, and a terrain without them is a terrain no ward runs on. The floor is
+named and probed in `test/floor.test.ts`. `crypto.subtle` is read at every use
+and never captured at load, so a page without one -- a plain http:// origin, a
+sandboxed frame -- fails at the first ask with one sentence rather than deep
+inside a key import. The arithmetic is `src/ward/arithmetic.ts`, the seal is
+`src/ward/seal.ts`, and `vectors/arithmetic.json` and `vectors/framing.json`
+hold fixed inputs and outputs so a kit in another language proves it agrees
+on the bytes.
+
+```
+ask on the wire     box     = ephemeral X25519 pk (32) || AES-GCM( payload || signature (64) )
+                              sealed to the ward padlock. nothing rides outside it.
+                    payload = JSON { to, by, next, seq, time, hops?, method?, args }
+                              signed by `by`. to, by, next: 64 hex. to, next may be null.
+                              to names the heir, or null for the public being.
+                              hops is reserved: a whole number, never below zero,
+                              refused at zero, and nothing sets it.
+reply on the wire   box     = ephemeral X25519 pk (32) || AES-GCM( reply || signature (64) )
+                              sealed to the ask's ephemeral pk, signed by the ward key
+                    reply   = JSON { object, seen } | { silence: true }
+```
+
+Nothing rides outside the box, and `to` is the reason to say so. A heir is
+the one name in a relation that never rotates, while the keys under it
+rotate on every ask. Outside the box it would be a handle on that relation
+that never changes: an intermediary carrying the bytes could tell one
+relation from another and follow it for as long as it lasts, and so could
+anyone who ever saw the invitation, which carries that same heir. What
+carries an ask to a ward is the ward pk, which a harbor holds itself and
+never reads from these bytes, so the door loses nothing by opening every ask
+with its own padlock and reading `to` after. What an intermediary still
+learns is the ward it is carrying to, and that is the price of being
+reachable.
+
+The sender keeps the ephemeral secret of the box until the reply comes and
+opens the reply with it. A reply that does not open, or is not signed by the
+ward it was sent to, is silence. Unreached never crosses: the wire's nothing
+is it.
+
+## The ward
+
+### What a ward is
+
+One process of its harbor. A being plus ward functions. It has one voice, the
+door, and every arrival at that door is judged by it and named by it or falls
+silent. It keeps every being it booted, builds every stance, mints every
+key, seals every ask that leaves, and unseals every one that arrives. Its
+beings trust it blindly. It trusts its harbor the same way.
+
+Its ward is itself. It boots itself as the first being in its own map, under
+its own pk, and its own stance is built by the same code that builds every
+being's. Its cells are its partition, all the way down.
+
+It owns nothing durable. It is three things, all in the harbor's hands:
+its seed, its partition, and the classes its beings are made of. The
+partition names each class and the harbor holds the bodies, so a ward is
+whole only where all three are, and a harbor that keeps one remembers where
+the other two came from. It writes as it runs and never decides, asks, or
+learns whether anything was kept. Between one run and the next, a ward is
+nothing at all.
+
+One ward is one runtime and one language, and every being in it shares both.
+A harbor that wants two languages starts two wards at least. Under
+`src/being/`, `src/ward/`, `src/harbor/` and `src/conformance/` no runtime is
+named. The whole
+platform surface is the language plus six globals -- `crypto`, `TextEncoder`,
+`TextDecoder`, `structuredClone`, `setTimeout`, `atob` -- and that list is a
+promise, not an accident: `test/terrain.test.ts` fails the build both when a
+file names a platform and when it reaches for a global outside the list.
+
+The package exports raw TypeScript, extension and all, on every specifier, so
+Node loads it directly and every other terrain reaches a ward through a
+bundler. `test/bundle.test.ts` bundles the three words and runs them, and
+asserts the artefact carries nothing a terrain cannot provide.
+
+The conformance suite is the ward's truth, so it has to be checkable wherever
+a ward runs. It names no runtime either: its runner is handed in, and the five
+assertions it makes are `src/conformance/assert.ts`, held to
+`node:assert/strict`'s own behaviour by `test/assert.test.ts`.
+`test/terrain/exercise.ts` is what every terrain runs -- the whole suite,
+under all three topologies, and the floor probe. Node is the reference: no
+terrain carries a count of its own, so a test added to the suite is demanded
+of every terrain at once. Five run it: Node, a browser, workerd, Deno and
+Bun. Bun is the one that is not V8, so "the language alone" is checked
+against two implementations of the language and not one.
+
+`npm run check` is Node alone, and stays fast. `npm run check:terrain` is the
+browser and the edge, kept apart because a browser is a download and not a
+package: a fresh clone needs `npx playwright install chromium` first, and is
+told so in one sentence rather than a stack trace.
+
+### The partition
+
+Everything durable a ward has is here, every secret included, and nothing
+here is ever in a being's cells. Values only, so the harbor may persist it as
+it likes: as this process's objects, as a row, as a line of JSON on a disk. A
+reboot from its JSON is the same ward. The shape is `src/ward/partition.ts`.
+
+```
+partition
+  version   'pre-1.0.0'
+  beings    key -> her cells, with class
+  bind      key -> her bind table
+              standings   id -> { ward, heir | null, current, next, seq }     her keys for a standing
+              occupants   id -> heir pk
+              knocks      <ward>:<heir> | public:<ward> -> { current, next, spoke, seq }   before take
+              answered    <ward>:<heir> | public:<ward> -> true                            knocked and answered
+              minted      the last eight pks her side minted
+  heirs     heir pk -> { being, id, current, announced, fresh, mark, spent }   the door's view of every occupant
+  public    the one public being's key, or null
+```
+
+A knock record is filed under the ward and the heir together, never the heir
+alone: an invitation carries the heir to whoever it is for, and anyone
+holding one could quote that heir back inside an invitation naming a ward of
+their own.
+
+The version is one value and it does not move until 1.0.0. There is nobody
+holding a partition of another shape to tell apart: if the shape changes, a
+partition is thrown away, not migrated and not counted. A ward opening a
+version it cannot read throws at birth and does not boot. Birth is where a
+ward is allowed to be loud; silence is the door's word, for asks that were
+made, and no ask has been made yet.
+
+What a ward can read is a list, `READS`, and today it has one member. The
+list and the step that carries an older partition forward exist before
+1.0.0 because after it there is nowhere to put them. A partition holds every
+secret and every relation a world has: the first shape change after the
+freeze cannot be answered by throwing it away, and a ward that meets a shape
+it has no step for refuses to boot with all of it still inside. Throwing a
+partition away is what a version means before 1.0.0, and carrying it forward
+is what it means after; the seam is cut now so the second is possible.
+
+### Restart
+
+A restart is silent because the ward cannot tell rebirth from birth. Every
+being whose cells record a class is constructed again, unasked, with the
+same cells; relations and keys are intact on both sides; a knock answered
+before the restart can be taken after it; a door that restarts still refuses
+what it already honoured.
+
+A constructor that throws on a restart takes only herself down: she is
+absent this run, no door, so silence at her door, and her cells sit untouched
+waiting for the run that can read them. The ward is up and so is everyone
+else. A class the harbor no longer knows is the same absence, and so is a
+class the harbor holds at a body the cells were not written for: which body
+a ward reboots on is the harbor's decision, and a ward cannot tell an old
+one from a new one. Loss of the partition is loss of every relation,
+announced to nobody.
+
+### The owner
+
+The owner is a role, not an identity, and it has a root. The root owner is
+whoever holds the ward's ask pointer. The harbor hands that pointer to one
+holder, by the device's rules: a shell, a UI, a socket only the device's
+user can read. Lose the pointer, lose the root; there is no recovery inside
+Quo.
+
+Every other owner is an occupant of the ward itself. The ward is a being of
+its own map, and the root may invite on it like on any being; whoever knocks
+with that invitation is an owner, reached through the door, named by the id
+the root chose, counted and rotated like any relation, and removed like any
+occupant. That is how a ward is piloted from another device: the piloting
+ward holds a standing at it, and every owner ask is a sealed ask. Only the
+root may invite on the ward: an owner at the door asking to is refused, so
+a carried key pilots and never hands piloting on. Ownership moves by the
+root inviting one owner and removing another, and a migrated ward carries
+its owners in its bind table, so the harbor that receives it does not
+become one.
+
+The root is not an occupant. It holds no heir, no key, no invitation. The
+ward names every arrival on the ask `{ id: 'OWNER' }`, the third asker of the
+ward-to-being edge, and answers it as such; an owner at the door arrives as
+her id. What an owner can do is exactly what a being cannot: boot, place a
+relation into a being of the ward, and take one out of her. The root's asks
+carry no allowance of their own.
+
+```
+ask()                                    -> { asks: [boot, invite, knock, remove],
+                                              notes: { pk, beings: { key: { class, public, digest } } } }
+ask('boot',   { key, class, public? })   -> { booted: key } | { error }
+ask('invite', { being, id })             -> invitation | null | { error }
+ask('knock',  { being | { boot: class, key },
+                id, invitation, method?, args?, wanted? })
+                                         -> { taken: id | null, answer } | { error: 'silence' | 'unreached' | ... }
+ask('remove', { being, id })             -> { removed: id } | { error }
+anything else                            -> { error: 'unknown ask' }
+```
+
+- The owner is a caller like any other: `wanted` says what its knock may
+  spend, and saying nothing is the ward's default, exactly as for a being.
+- The describe runs every being's own describe as `OWNER` and hashes it; a
+  being that throws or falls silent there shows a null digest.
+- Boot refuses a key already booted, a class the harbor does not know, and a
+  second public being; a boot that made nobody leaves the partition as it
+  found it. A throw at birth is that boot's error, and nothing half-lives.
+- Invite on the ward's own pk mints an owner, and only the root may ask it:
+  from the door it is answered as an invite on nobody. The ward has
+  occupants, its owners, and no standings: a knock for the ward itself is a
+  knock for nobody, because the ward asks nobody anything.
+- The owner's knock is a being's knock made for her. The ward knocks under a
+  key it mints for her, and if answered, takes under the id the owner gave
+  and writes the standing into her cells. She finds it there. Her owner
+  chose her class and her cells at boot; her owner may choose a relation for
+  her too. The boot form names a being new or existing: a key already booted
+  is a being of theirs, not a class that failed.
+- The owner's remove is the mirror of its knock: a relation out of a being,
+  by id, and the id may be an occupant or a standing, since the two share
+  one namespace. The being's own remove says nothing; the owner hears
+  objects, so this one says what it removed, and that there was nothing when
+  there was nothing. Remove on the ward's own pk unseats an owner, and only
+  the root may ask it, for the reason only the root may invite one: from the
+  door it is answered as a remove on nobody. Ownership moves by the root
+  alone.
+
+The door is a ward function. It is not the ward's answer: it judges before
+anything is named, and a being's answer only ever receives named askers. The
+ask is the ward's answer, with the asker filled in as owner. Ward functions
+are on the object, and no stance and no standing reaches them.
+
+### Responsibilities, and not
+
+The ward:
+
+- Derives its pk from its seed and names itself outward by that and nothing
+  else. Mints every other key from the ground's random, one per side of one
+  relation.
+- Instantiates beings when the owner asks, by class name. It builds the
+  stance, names the class, and receives the object from the harbor's
+  instantiate call. It never sees a class body, its own included.
+- Keeps, per being, the cells, the standings and the occupants, in the
+  partition, and outside her cells the bind table. Never reads notes.
+- Mints a heir for every id a being mints, keeps its pk beside the id, and
+  hands her the invitation. Names every arrival signed by the key it holds
+  for that heir by the id she minted.
+- Seals every ask that leaves to the far ward's padlock, signed by the
+  standing's own key, announcing its next, carrying its count and its
+  allowance. Delivers to its own pk without the harbor. Hands every other
+  ward pk to carry. Bounds the wait.
+- Tells its own being the truth about her asks: an answer with its digest
+  written to seen, silence when bytes came back and said nothing, unreached
+  when nothing came back.
+- Runs her answers concurrently and never serializes her. Two different asks
+  may both be inside her answer at once, one paused, one running. Her cells
+  are hers to guard between one line and the next.
+
+Not stressed with:
+
+- Where any pk lives. Sockets, URLs, DNS, containers, planets. It knows pks
+  and nothing under them. The wire, retries, or the directory.
+- Storage. It writes into its partition and does not know what medium that
+  is, whether it persists, or when.
+- Defending against its harbor. A ward that distrusts its harbor has no
+  move, so Quo gives it none. The harbor vouches, the ward trusts. A being
+  trusts her ward, a ward trusts its harbor, a harbor trusts its device. A
+  broken vouch is total and silent.
+- Deciding who may be an occupant. She invites; it binds and names.
+- Restarting a crashed being, retrying a silent ask, or noticing that a
+  standing walked away. A being learns about a standing by asking it, and
+  from nothing else. There is no estate. The far being is sovereign: she may
+  fall silent on the ask after the knock, and nobody is told.
+- Blacklists, rate limits, and what to do with a pk that keeps knocking with
+  garbage. Its own.
+
+## The harbor
+
+A harbor is what a device already has, offered to Quo: processes, storage, a
+network, entropy, a clock. It fits into a device carved up by its owner,
+users, containers, mounts, profiles, and asks for none of them. It knows no
+being, holds no id, reads no partition, and is nobody outside its device.
+
+The harbor:
+
+- Boots wards as processes, one seed each, and keeps each ward's partition.
+- Holds the class bodies for its wards, and remembers for each ward where
+  its bodies came from, so that a restart is on the same bodies unless the
+  harbor decides otherwise. Constructs a being when a ward names a class
+  through the ground's instantiate, and never chooses a class itself. A
+  name it does not hold is null, and that boot fails. Whose code a ward
+  runs is no concern of the harbor: a ward of its owner's and a ward whose
+  bodies came from a stranger are hosted the same way.
+- Passes every ward the ground, once, at birth. Receives a door and an ask.
+  Hands the ask to exactly one holder, by the device's own rules. That
+  holder is the ward's owner.
+- Keeps the map of ward pk to door for its own wards, and ward pk to reach
+  for foreign ones. Learns its own wards' pks by asking them. Learns foreign
+  pks however it likes.
+- Carries bytes to one ward pk and returns what came back, or nothing.
+  Copies bytes across, never references, even between two of its own
+  doors. Nothing means the bytes never arrived: no reach for that pk, a
+  socket that would not open, a link that is down. Once it has sent them it
+  never answers nothing on its own patience; it waits, and the ward's bound
+  ends the ask.
+- Receives bytes from the wire for a ward pk it holds, hands them to that
+  one door, and returns what the door returned.
+- Vouches: the seed stays secret, the partition is reached by this ward
+  alone, the ask reaches its root owner alone, the device is the harbor's
+  to defend. How is the device's business. Custody is this vouch: two
+  harbors booting one seed over one partition are two wards with one pk,
+  diverging in silence, and a harbor refuses to boot a ward another running
+  harbor holds, by whatever lease its device offers.
+
+Not stressed with:
+
+- Reading, altering, caching, or retrying bytes. It does not know the word
+  silence, and it never answers on a ward's behalf.
+- Fanning out, broadcasting, or forwarding to a pk other than the one it was
+  given. One pk is one ward is one door.
+- Beings, ids, keys inside a relation, classes as things to choose,
+  invitations, or what any partition contains.
+- Judging anything. A ward judges its door. The harbor delivers to it.
+- Speaking Quo. It is nobody's occupant and holds no standing anywhere. The
+  harbor is not a ward and is nobody's.
+
+The memory harbor, `src/harbor/memory.ts`, is one process and no wire. It
+keeps partitions by seed, routes its own doors, and may be linked to peers,
+which stands in for a wire, and cut, which stands in for weather. It routes
+one hop: a pk that is not its own and not a direct peer's is nothing. It
+keeps no lease: two of them may hold one seed and one partition, which is
+the broken vouch every real harbor refuses, kept here so that the tests can
+show what divergence looks like. Every ward and being assertion in the tree
+is made on it, so that the network never hides a fault in the words.
+
+What a harbor on a device keeps is a ward's three parts under one name: the
+seed, the partition, and a **ward record**, which says where the class
+bodies come from and which being is the user's. That is the **store**,
+`src/harbor/store.ts`: list, load, put, save the partition after a call,
+save the record after a boot learned the pk, take a ward out as the first
+move of a migration, and keep the directory's hints, a pk to a URL, across
+a restart. A name already kept is refused. A store reads nothing it keeps
+and hands the partition back as values, never as the object it was given.
+The memory store beside the interface is the library's own; a disk, a tab
+and an edge object each have theirs, outside this tree, and every one of
+them passes `src/conformance/store.ts` untouched.
+
+Carrying bytes to a pk off the device is a **reach**, `src/harbor/reach.ts`:
+carry bytes to a pk, get bytes back or nothing. Two kinds, and no third:
+a **request**, one URL, the bytes posted to it with the pk as the last
+segment and the reply as the answer, listener to listener; and a
+**socket**, one held line used in
+both directions, opened by whichever side can dial, with a frame id
+matching each reply to its ask and one text frame in which a side announces
+the ward pks it holds. The framing on a socket is binary: an ask is a kind
+byte, a four-byte id, the 64-byte pk and the bytes; a reply is the kind, the
+id and the bytes; and nothing delivered is the kind and the id alone. Both
+kinds are written on the standard surface every terrain carries, fetch and
+WebSocket, and this tree holds either end of a line and never a listener:
+who accepts a socket is the terrain's business. A reach reads nothing.
+Nothing comes back only where the reach knows nothing was delivered: no such
+pk at the far end, a connection that would not open, a line already gone. A
+reach that sent the bytes and lost the line after answers nothing at all,
+and the ward's bound ends the ask. Every reach passes
+`src/conformance/reach.ts` untouched, and the frames are pinned in
+`vectors/wire.json`.
+
+A reach also carries the **wire suite**: which frames these are, and which
+four algorithms seal what they travel with. It is one number, it is not
+negotiated, and today it is 1. It rides where a line is opened and never on
+an ask: in the text frame a socket announces itself with, and as the header
+`quo-suite` on a request. So an ask is still bytes from the first one, with
+nothing in front of them to say what they are, and a line still learns
+before it carries anything whether the far side speaks what this side
+speaks. A side meeting a suite it does not know carries nothing for it and
+closes, naming the refusal on the way out with close code 4001; a
+request door meeting one answers nothing delivered. A dialer refused that
+way waits out the ceiling before asking again, because a suite does not
+become speakable by asking sooner. Its wait returns to the first second
+where the far side announced and was taken, and not where the line merely
+opened: a listener that opens and then refuses would otherwise be dialed at
+a fixed two seconds for good, which is what the lab measured before the
+code was read. Absent is this suite,
+because a caller older than the header is this one. Present and different is
+refused as it is written: the number is compared as it was sent, so a suite
+is one spelling and not a family of them.
+
+This is the only place a second suite could ever be told from the first.
+The four algorithms are named once and never negotiated, which is right: a
+choice offered on the wire is a choice a stranger can push. But named once
+is not the same as unnameable, and a kit that must one day seal differently
+has to be able to say so to a kit that cannot, or the day it arrives every
+world stops answering at once and none of them can say why. A silence names
+no reason, by law. This number is the reason, said before the silence.
+
+The **harbor core**, `src/harbor/core.ts`, is what every harbor on a device
+is: the store and the reach put together under the ground. It boots every
+ward the store keeps, keeps the map of ward pk to door for its own wards
+and the **directory**, pk to reach, for foreign ones, carries bytes to a
+pk and delivers bytes from the wire to one door. The directory is filled
+three ways, in this order: its own doors; a socket a dialer holds to it,
+bound at the dialer's announce and unbound when the line closes; and a
+hint, a pk at a URL, kept in the store. One rule makes a **rendezvous** of
+any listener: bytes that arrive from the wire go to an own door or to a
+socket this harbor holds for that pk, and never onward by request. So a
+harbor that cannot be dialed is reached through the one it dialed, by
+anyone who holds a hint that its pk is there. The **dialer**,
+`src/harbor/dial.ts`, is that harbor's half: one held socket to a URL, its
+own pks announced when the line opens, the listener's bound, dialed again
+with a wait that doubles from a second to thirty when the line drops, and
+while it is dialed it is one of the harbor's fallbacks, where a pk nobody
+here knows is sent. Fallbacks are a list and a pk is tried down it in
+order: a harbor may dial more than one listener, and a rendezvous is a
+listener and nothing more, so a ward is never reachable through one place
+by anything but its own choice. A line that drops takes only its own place
+out of the list. A ward is born on the core by minting a seed under a name,
+leaves it by being dropped, the partition written first, and arrives by
+being adopted, same seed, same pk. What a terrain adds is a store of its
+own, a loader for the class bodies, and the lease its device offers; what
+it never touches is a ward.
+
+## The being
+
+### What a being is
+
+One ordinary object, in one language, with one voice. She has state, she can
+ask other beings, and other beings can ask her. She does not know where any
+of them are, and she cannot find out. She never touches a key, a wire, or a
+class. Her ward does all of that, and she trusts it blindly: what the ward
+names is true.
+
+She asks her standings by method and args and gets back an object, silence,
+or unreached. She invites whom she wants, in her own time, and removes them
+when she decides. She knocks with invitations she was given and takes the
+ones she wants. She answers every ask her ward brings her with an object or
+silence; an error is an ordinary object, and she never throws outward. She
+describes herself, per asker, by answering the empty ask.
+
+Not stressed with: where anyone lives; crypto, keys, wire, storage, clocks,
+or the harbor; strangers, because nobody her ward cannot name reaches her;
+whether an occupant is a person, a model or a program; making beings, because
+only the ward instantiates.
+
+### Her obligations
+
+1. Args are one object. A throw is silence outside: the ward is in the
+   middle of every call and catches, always, in every language. An error is
+   an object her output schema declares.
+2. No lifecycle. Construction with the stance is birth. A restart is silent.
+3. The empty ask is hers. Who gets what blueprint is her decision. She obeys
+   the shape, never a content. The empty ask must be safe to repeat: her
+   ward may ask it at any time, and it changes nothing. Nobody enforces
+   this, in any language. It is her obligation alone.
+4. A standing's digest arrives with every answer, as seen. She compares it
+   to digest and refreshes by the empty ask if she wants. The digest is of
+   what she told you, not of who she is: one being, many askers, many
+   digests, all true.
+5. An occupant has no digest. She can only be observed, never asked. To
+   reach an occupant, hold a standing at her: she gave you one, or she did
+   not.
+6. Her cells are hers to guard between one line and the next. Quo does not
+   serialize her, because that would narrow what can be built.
+7. A call is delivered once. Her ward, and the far ward, never let the same
+   call reach a being twice by accident. A repeat is intentional. What she
+   asks is always a new call. The one exception is the public being, who is
+   reached with no heir and no count: the same bytes reach her twice, and
+   her answer must be safe to repeat.
+8. Beings do not make beings. A being that could create would hold class,
+   memory and key, and there would be no ward. A being that wants a child
+   gets one from outside, as an invitation handed to her.
+9. Whatever her ward cannot name is not hers to worry about: what the ward
+   does with an arrival it cannot name is the ward's.
+
+### The base class, and the raw shape
+
+A being is anything with a constructor taking the stance and an `answer`.
+The raw shape needs no import from the kit. The kit also offers a base class,
+`Being` in `src/being/being.ts`, which is a convenience and not Quo:
+
+- `static cells` are her defaults, merged at birth only where a key is
+  missing, so a restart keeps what she wrote.
+- `static asks` declares what she can be asked, name to
+  `{ description?, input?, output?, for? }`, in blueprint order.
+  `for(occupant, asker)` decides whether this asker sees the ask, and so
+  whether this asker may call it: what she shows is what she can be asked,
+  one gate for describe and for dispatch.
+- `answer` is written for her. The empty ask is `describe(asker)`, which she
+  may override by hand. A named ask calls the method of that name with
+  `(args, asker)`. Anything not declared, hidden from this asker, or
+  inherited from Object's prototype is `{ error: 'unknown ask' }` and the
+  method is never entered.
+- A declared ask with no method, or one named after the base's own members,
+  fails at birth, loudly, so a boot fails and nothing half-lives.
+- `occupant(asker)` is the occupant record for whoever is at the door, and
+  undefined at a public being. `invite`, `knock`, `take`, `standings` and
+  `occupants` reach the stance and nothing else.
+
+### Examples
+
+The smallest being. Answers whoever her ward names, describes one ask.
+
+```js
+class Echo {
+  constructor(stance) {
+    this.s = stance;
+  }
+  answer(asker, method, args) {
+    if (method === undefined) return { asks: [{ name: 'echo', input: {} }], notes: {} };
+    return { from: asker.id ?? null, ...args };
+  }
+}
+```
+
+A shop. Invites in her own time, hands the invitation out by any channel,
+and takes a guest back only if the guest offers a way.
+
+```js
+class Shop {
+  constructor(stance) {
+    this.s = stance;
+  }
+  async invite(name) {
+    const id = `g-${name}`;
+    const inv = await this.s.occupants.invite(id);
+    this.s.cells.occupants[id].notes.expireAt = 2028; // hers, not Quo's
+    return inv; // goes by mail
+  }
+  async answer(asker, method, args) {
+    if (method === undefined) return { asks: [{ name: 'hello', input: {} }], notes: {} };
+    const rec = this.s.cells.occupants[asker.id];
+    if (method === 'hello' && args.invitation) {
+      const back = await this.s.standings.knock(args.invitation, 'hi');
+      if (back !== silence && !isUnreached(back))
+        await this.s.standings.take(`back-${asker.id}`, args.invitation);
+    }
+    return { welcome: rec.notes.expireAt > 2026 };
+  }
+}
+```
+
+A guest. Consumes an invitation, and only then decides to keep the shop.
+
+```js
+class Guest {
+  constructor(stance) {
+    this.s = stance;
+  }
+  async join(invitation) {
+    const mine = await this.s.occupants.invite('shop'); // so the shop can reach me
+    const out = await this.s.standings.knock(invitation, 'hello', { invitation: mine });
+    if (out === silence || isUnreached(out)) return out; // nothing was born
+    await this.s.standings.take('shop', invitation); // now, and only now
+    return out;
+  }
+  answer(asker, method) {
+    if (method === undefined) return { asks: [{ name: 'hi', input: {} }], notes: {} };
+    return { heard: method };
+  }
+}
+```
+
+A relay. Forwards every ask to one standing and never looks inside, and asks
+for a short wait because she is one door of several.
+
+```js
+class Relay {
+  constructor(stance) {
+    this.s = stance;
+  }
+  answer(asker, method, args) {
+    return this.s.standings.next.ask(method, args, { time: 2000 }); // silence and unreached pass through
+  }
+}
+```
+
+A watcher. Notices a standing changed shape, then decides.
+
+```js
+class Watcher {
+  constructor(stance) {
+    this.s = stance;
+  }
+  async answer(asker, method, args) {
+    if (method === undefined) return { asks: [{ name: 'poke', input: {} }], notes: {} };
+    const out = await this.s.standings.src.ask('read', args);
+    const rec = this.s.cells.standings.src;
+    if (rec.seen !== rec.digest) {
+      const bp = await this.s.standings.src.ask(); // refresh, or
+      if (!bp?.asks.some((a) => a.name === 'read')) this.s.standings.remove('src'); // walk away
+    }
+    return out;
+  }
+}
+```
+
+## The tree
+
+The repository is one TypeScript implementation of this document, run
+directly on Node's type stripping, no build step, no dependencies. Node 22.18
+or later. The package is `@quo-systems/quo`, published from 0.1.0, the
+first version under this name, and it starts over: nothing before it under
+any other name is this protocol. Before 1.0.0 every version may change the
+words, and nothing is kept for a holder of an earlier one. `npm pack
+--dry-run` shows what ships: the four source folders, the vectors, this
+document, the README and the licence, and nothing else. This document
+ships, decided here: it is the truth the source and the vectors are read
+against, and a kit in another language is written against it and nothing
+else. Publishing runs both gates first, `npm run check` and
+`npm run check:terrain`, and refuses on a failure.
+
+```
+src/being/        the Being side. types, the base class, silence, the digest.
+src/ward/         the ward. door, seal, arithmetic, heirs, stance, owner, partition, cells, allowance.
+src/harbor/       the Ground contract, the memory harbor, the store, the reach and the harbor core.
+src/conformance/  the behaviours any ward must show, and the fixed beings they are shown with.
+test/             the suites.
+vectors/          fixed inputs and outputs: the arithmetic, Quo's own framing, the frames on the wire.
+```
+
+`estate/` sits beside `src` and is not Quo: the beings, screens, model sides
+and real harbors built on it, each folder with its own document. This
+document does not read them, and they may not add a word to it. Its one
+claim on them is that every harbor there passes `src/conformance/` untouched.
+
+The hand to a kit in another language is two things, and they are of two
+kinds. `vectors/` is the byte-level hand: fixed inputs and outputs for
+everything a stranger can observe, the arithmetic, the ward pk, the digest,
+the signed body, the sealed shapes, the invitation, the knock, and the
+frames on a socket and the one request a door takes. A kit reproduces them
+or it is not this protocol. `src/conformance/` is the behavioural hand, and
+it is a checklist and not a harness: one ward is one runtime and one
+language, so the beings it is shown with run only in a TypeScript ward, and
+a kit ports the suite and its beings and reads them beside its own. Nothing
+in this tree drives a foreign ward through its door, and nothing is owed
+here before 1.0.0 that does: the door's thirteen cases and the vectors are
+what two kits meet on, and the suite is what each proves alone.
+
+Entry points: `@quo-systems/quo` is the Being side, `@quo-systems/quo/ward`
+is `Ward`, `@quo-systems/quo/harbor` is `MemoryHarbor`, `Harbor`, the
+store, the reach and the dialer, and `@quo-systems/quo/conformance` is
+`conform` with the store and reach suites beside it.
+
+The gate is `npm run check`: typecheck under TypeScript 7, oxlint with
+type-aware rules, markdownlint, then every suite under `node --test`. There
+is no CI; the gate runs in seconds and is run before every commit. Nothing
+red is committed except a test marked todo, which is a claim the tree does
+not yet meet and says so.
+
+### The suites
+
+The beings are fixed and the ward is what is tested. A ward kit in any
+language offers the ground, the door, and the owner's ask as written, and
+passes the same suite. Those tests are the checklist, not the mock.
+
+- `test/being.test.ts`: the base class against a stance stub. No ward, no
+  harbor. Defaults, describe, dispatch, the gate, the reserved names, the
+  digest.
+- `src/conformance/index.ts`: one suite of behaviours, written against the
+  stance and one probe: a kit hands the suite its ward's heir table and
+  bind table as values, and a forged knock, so the suite can see that a
+  refusal wrote nothing and a knock bound what it should. It reads them and
+  never writes them. With the beings in `src/conformance/beings.ts`: a
+  printer, a shop, two customers, one raw being with no base class, and a
+  member of an estate. Any ward must pass it, under any topology.
+- `src/conformance/estate.ts`: the estate, and the last chapter of that
+  suite. Every other chapter is a scene: three beings, one move, one answer.
+  This one is a graph under churn, which is the shape an organisation running
+  on Quo actually has -- scattered wards on scattered harbors, partners and
+  employees invited, knocking, taken, kicked, and moving to harbors of their
+  own. It keeps a model of the graph, plays legal moves against it from three
+  fixed seeds, and after every move holds three things: that the ledger every
+  ward keeps closes on both ends, that every arc in it answers when asked
+  exactly what being that arc means, and that the same seed played under all
+  three topologies lands on the same graph. The last is the promise of Quo at
+  a scale a scene cannot reach. A relation is two arcs and never one edge:
+  the occupant is the host's, the standing is the guest's, and the model
+  keeps them apart because the ward does. A red run prints its seed and the
+  moves that got there. It is read beside one hand-written story that says in
+  prose what the model is for.
+- `test/ward.test.ts`: the conformance suite against the real ward under
+  three topologies over the memory harbor, one ward, one harbor with a ward
+  per being, two harbors; and what only a real ward can be asked: the
+  owner's asks, the door judged byte by byte, rotation and a lost reply,
+  replay, a restart, and every byte on the wire inspected for anything inner.
+- `test/public.test.ts`: the public being, what the door does and does not
+  do for her.
+- `test/silence.test.ts`: the chapter "Silence, unreached, error" by its
+  numbers: the five silences and two unreacheds of her ward, the thirteen
+  cases of the door with a partition snapshot under each, hops refused at
+  zero, and the six lines of the law of one silence.
+- `test/blueprint.test.ts`: blueprints and instantiation through a real
+  ward. What a boot leaves behind, what a restart brings back when the code
+  moved under the cells, the gate and the door, the reserved ids.
+- `test/allowance.test.ts`: the allowance. Default, ceiling, nonsense, the
+  bound, the signed body, the door's refusal, and one ask through a ward.
+- `test/seal.test.ts`: the arithmetic against `vectors/arithmetic.json`,
+  then the seal, round trip, and what it refuses; then the framing against
+  `vectors/framing.json`. The arithmetic is standard and any language has
+  it. The framing is Quo's own, and a kit that reproduces the hashes and
+  not the ward pk, the digest, the signed ask body, the two sealed shapes,
+  the invitation or the knock is not this protocol. Every seed in that file
+  is fixed, so every output is fixed. The ask body is the payload as JSON
+  and is not canonical: the vectors pin the order the type declares, and a
+  kit that emits another order interoperates, because a door verifies the
+  bytes it received, and will not reproduce the vectors. `hops` is in no
+  vector, because nothing sets it. The invitation is JSON too, and the
+  knock is pinned as the ask it is, by the heir, to the heir, announcing
+  the knocker's own key, and then proven at a real door: a ward booted on
+  the vector's seed, drawing the heir secret as its first entropy, mints
+  the invitation vector, binds the knock vector at its door, answers it,
+  spends the heir, and refuses the same bytes again.
+- `test/break.test.ts`: adversarial probes. Each states what this document
+  promises, then tries to break it.
+- `test/gaps.test.ts` and `test/gaps2.test.ts`: cases the memory harbor
+  cannot express because it is honest, in-order and lossless: a lost reply,
+  a cycle, a partition written down and read back, a long relation, one
+  seed booted twice. Each test is a claim that the ward is wrong; one that
+  will not go red is not a bug.
+- `src/conformance/store.ts`: the store suite, written against the store
+  interface alone and handed a maker of fresh stores. A fresh store keeps
+  nothing; what was put comes back as it went in, as values and not as the
+  object; a name already kept is refused; save and record touch only their
+  part and are nothing on a name not kept; take hands a ward out and frees
+  the name; hints are kept by pk and the last one wins.
+- `src/conformance/reach.ts`: the reach suite, written against the reach
+  interface alone and handed a far side it controls: a door held behind a
+  pk over there, and the far side dropped. The door's bytes come back;
+  nothing for a pk nobody holds; asks in flight at once each get their own
+  answer; what crosses is a copy both ways; and once the far side is gone,
+  nothing. It cannot assert that a reach which sent and then lost the line
+  answers nothing at all, since a suite cannot wait forever.
+- `test/harbor.test.ts`: the harbor pieces on the library's own ground,
+  no device and no wire. The store suite against the memory store; the
+  reach suite against the socket framing over two lines in one process, so
+  the frames are asserted with no network under them; the conformance
+  suite against two harbor cores over memory stores reaching each other
+  in-process, drop and adopt as the migration; a restart from the store
+  with the hints; the dialer over a stubbed line, announce, bind, fallback,
+  unbind and the wait before it dials again; and the frames against
+  `vectors/wire.json`, the ask, the reply, nothing delivered and the
+  announce, so a kit reproduces the bytes on a socket; and the request
+  reach against the request record in the same file, over a fetch that
+  sees what a listener would, one POST with the suite in its header, the
+  reply as a 200 and nothing delivered as a 404. A socket to a real
+  listener and every real store pass the same suites outside this tree.
+- `test/terrain.test.ts`: the terrain census. Nothing under `src/being/`,
+  `src/ward/`, `src/harbor/` or `src/conformance/` names a runtime, and
+  nothing reaches for a global outside the ones it names; nor does the
+  census name one the tree has stopped using. It reads the source as text
+  and not as a parse: it is there to catch drift, and does not pretend to
+  stop someone determined to get around it.
+- `test/assert.test.ts`: `src/conformance/assert.ts` against
+  `node:assert/strict`, pair by pair. The suite means the same thing on
+  every terrain only if those two agree, so they are compared and not
+  trusted.
+- `test/floor.test.ts`: the four algorithms this terrain must carry, probed
+  one by one; that the arithmetic spends every one of them; and the two ways
+  a terrain can be short -- no `crypto.subtle` at all, and a subtle without
+  the curves -- each failing at the first call, in one sentence.
+- `test/bundle.test.ts`: the three words bundled as a consumer must bundle
+  them, the artefact read for anything a terrain cannot provide, and then the
+  whole conformance suite run out of the bundle.
+- `test/terrain/browser.test.ts`, `test/terrain/edge.test.ts`,
+  `test/terrain/deno.test.ts` and `test/terrain/bun.test.ts`: that same
+  bundle and that same suite in a real Chromium, in workerd, in Deno and in
+  Bun, plus each terrain's floor, and, for the browser, a page whose
+  `crypto` has no `subtle`. Deno runs it a second time with every permission
+  denied but read -- no net, no environment, no write, no subprocess -- which
+  is where a ward that had quietly come to need one of them would fail, and
+  nowhere else in this repository. A terrain whose binary is absent skips and
+  names the command that installs it; it never passes quietly.
+  `test/terrain/engine.ts` runs the bundle in another engine on this machine.
+  Behind `npm run check:terrain`. `test/terrain/bundle.ts` is the
+  bundler and the reference run, `test/terrain/exercise.ts` is what every
+  terrain runs, `test/terrain/floor.ts` is the floor -- each written once, so
+  no terrain can be probed for less than another.
+- `test/world.ts`: the memory-harbor probe and the three topologies, held
+  apart from any one chapter because every terrain drives the same one. It
+  also answers the two asks the estate needs: the census, which is every
+  partition in the world as values, and a migration, which lifts a partition
+  out of one harbor and boots it from the same seed in the other -- same
+  seed, same pk, so every standing anyone holds still points at her.
+- `test/repo.test.ts`: this document, the README and the project
+  instructions against the repository: every path they name exists, every
+  source file carries its licence, the package names no host and no user,
+  the awaitable calls are marked and
+  awaited in the examples above, the allowance is decided here and off the
+  Open list, and the allowance is time alone on both sides of the door.
+
+### Where the tree stands
+
+The only place this document may name a gap between itself and the tree.
+Each line is a debt to close, not a note to keep.
+
+- **An announce is believed.** A side that opens a socket to a listener and
+  announces a ward pk is bound to it, and nothing asks whether it holds that
+  ward. So anyone who can reach a rendezvous can announce a pk that is not
+  theirs, and asks for that pk are carried to them instead of to the harbor
+  that holds it. They learn nothing by it: what arrives is sealed to a ward
+  key they do not have, and they cannot answer, because a reply is signed by
+  that ward. What they take is reachability, which is the one thing a
+  rendezvous exists to give. Measured on the lab, 2026-09-04. The shape of
+  the answer is a proof at the announce, the ward signing something the
+  listener chose, so that binding a pk needs the key behind it; that is a
+  decision this document has not taken.
+
+## Open
+
+Named, not decided. Nothing is here today: every question this document ever
+named is decided under Closed, and the slot each one needed is already cut,
+because a slot costs two lines before 1.0.0 and a partition or a payload
+shape after it.
+
+### Closed
+
+Decided here, so that the answer is not rediscovered:
+
+- **Delivered, then died, is refused on repeat.** The far ward receives and
+  crashes, the wire says nothing, and the near ward calls it unreached.
+  Nothing in the kit retries on its own, so a caller who asks again asks
+  under the next number and is heard. A repeated number is refused by every
+  door of this version, D10, and that is the whole answer: a repeated number
+  is only ever seen by the one door it was sent to, so a kit that one day
+  answers it from what the door already said interoperates with one that
+  refuses, the way one ward's ceiling never meets another's. That kit has
+  `last` on the heir to keep the reply in; nothing writes it, and nothing
+  reads it.
+- **Hops is the door's half, and that half is whole.** An ask carries no
+  count of doors, so a chain of relays is bounded by time alone. `hops` is a
+  field of the ask, a whole number and never below zero, and a door refuses
+  an ask that arrives at zero; nothing sets it and nothing decrements it. It
+  is refused now because a count only bounds a chain if every door on it
+  refuses, and a door written after the count was invented cannot make the
+  doors before it enforce anything. The other half, a being's onward asks
+  inheriting a door's remaining time and a count, needs the ward to know
+  which arrival an onward ask belongs to, and it cannot learn that without
+  naming a runtime. If a relay chain ever needs it, the way in is a field on
+  the stance's `ask`, beside `wanted`, that a being who never sends it never
+  has to know about: an addition on the ward-to-being edge, and no byte on
+  the wire moves.
+- **An invitation carries no hint.** It is `ward`, and for a heir `heir` and
+  `secret`, and nothing else. Where a ward lives is the harbor's to know and
+  a relation's to not: a hint inside the value would put a route inside a
+  capability that beings hand around opaquely, and it would go stale while
+  the invitation stayed good. A link is the invitation next to a hint, two
+  values travelling together, and the hint goes to the directory while the
+  being receives the invitation as it receives every invitation.
+- **The owner does not set the allowance default or ceiling.** They are the
+  ward's own policy, never negotiated and never on the wire, and a far door
+  cannot tell one ward's ceiling from another's. A being who wants less than
+  the default says so with `wanted` on the ask, which is the whole of what a
+  being needs. An owner who wants another ceiling is asking for a different
+  ward.
+
+## Glossary
+
+- **being**: one ordinary object with one voice. Asks, answers, decides.
+- **stance**: the one object her ward hands her at birth. Cells and calls.
+- **cells**: her state. I-JSON values. Three keys are the ward's.
+- **standing**: a pointer she holds to another being, through which she asks.
+- **occupant**: a being she invited, whom her ward names when she asks.
+- **id**: her own permanent name for one relation. Never crosses the door.
+- **invitation**: a value her ward makes for an id she minted: its pk, a heir
+  pk, the heir secret. Or a ward pk alone, for its public being. Opaque to
+  her. Travels anywhere.
+- **heir**: the key her ward mints at invite for one id, and gives away.
+  Names the id outward. Dies the first time it speaks.
+- **next**: the key a standing announces on every ask, and signs with on the
+  next one.
+- **count**: the number every ask carries for its relation. Honoured once.
+- **allowance**: the time an ask may still spend. Inside the seal.
+- **owner**: the root, whoever holds a ward's unsealed ask; and every
+  occupant of the ward itself, whom only the root invites and only the root
+  removes. A role, not an identity.
+- **invite**: mint an id and get its invitation.
+- **knock**: an ask carrying an invitation. Binds the far side to the id.
+- **take**: keep an answered knock as a standing, under her own id.
+- **ask**: method and args to a standing. Object, silence, or unreached back.
+- **answer**: her one function. Object or silence out.
+- **the empty ask**: ask with no method. Her answer to it is her blueprint.
+- **blueprint**: her interface as she chooses to show it to one asker.
+- **digest**: SHA-256 over the JCS of a blueprint. Per relation.
+- **seen**: the digest her ward last saw arrive with an answer.
+- **silence**: the far side said nothing. Not retryable blindly.
+- **unreached**: her ward could not reach the far door. Retryable.
+- **notes**: hers, inside every occupant record. Quo never reads it.
+- **partition**: the ward's files. Everything durable, every secret.
+- **ward record**: what a harbor keeps to boot one ward again: seed,
+  partition, and where its class bodies come from. The harbor's, never
+  the ward's.
+- **edge**: one of the two seams of Quo, harbor to ward and ward to being.
+  An object crosses once at birth, calls cross for the rest of the ward's
+  life, and nothing else crosses.
+- **ground**: the one object a harbor passes a ward. Five things.
+- **door**: the ward's one voice outward. Sealed bytes in, sealed bytes out.