nervur 0.23.0 → 0.24.0

package/GROUNDS.md

@@ -1,315 +0,0 @@
-# Grounds
-
-A ground is the process houses run in. The library ships one for each
-terrain, and you write none. You give it one key, and through its hand
-you tell it which faculties to stand and which houses to open. This
-guide says what every ground does, then what each one adds. [Writing
-for nervur](AUTHORING.md) builds the shop this guide runs, and [the
-command](COMMAND.md) drives a ground on your machine.
-
-## What every ground does
-
-**It holds one key outside itself.** The key is sixty-four hex digits,
-kept by what the ground stands on: a file, a keychain, a Worker's
-secret. The part of a ground that answers it is its unlock. Everything
-else the ground keeps is sealed under that key.
-
-**It unpacks in layers, each a faculty.** Every faculty has one
-lifecycle. A registry holds faculties by name, each an object `{ takes?,
-up, install? }`. Standing one raises it by its `up` into a body, the
-living instance houses and other bodies use. `install` does the slow
-work once for each entry, and a body's `down` lets go of what its `up`
-opened.
-
-| Layer | Its faculties | What they are |
-| --- | --- | --- |
-| primordial | the memory, the unlock, crypto, tools, the clock | the host's, read from the environment alone |
-| the ground's work | `ground` | the library's, offered to the dock alone |
-| the dock | a house of the library's beings | the drawer, and the hand's one road |
-| the ladder | the terrain's defaults and your entries | carries, code, and every custom faculty |
-| the hand | a socket, a key, a channel | the owner's reach, up last and down first |
-
-**It keeps its drawer as cells of the dock's beings.** The dock is a
-house every ground stands, and its beings are the library's. A twin
-stands for each faculty entry, a being for each house, and one for each
-secret. Their cells hold every entry, what each faculty installed, each
-house's seed and ward, every secret, and the ground's bound on every
-ask. No row of the ground's stands beside them.
-
-**Every name an entry gives is a standing.** A house's code, its memory
-and the faculties it uses, and a faculty's registry, its callees and its
-secrets, are relations between those beings. The dock's steward
-introduces each, and her notes name the grant. An entry that names a
-faculty or a secret the dock does not hold is refused, and nothing
-lands.
-
-**Its houses keep their places in the same memory.** The dock, each
-house and each faculty sees a view of the ground's memory under a prefix
-of its own. A house seals its own rows, and the ground seals each
-faculty's. So what rests on the disk is ciphertext, and copying the key,
-the memory and the code moves the whole ground. A memory the key opens
-no dock in is refused.
-
-**It stands its bodies on a ladder.** The ground's own registry is its
-terrain's. A body may carry a registry of its own, and the faculties an
-entry raises `from` it stand after it. A body stands after each body its
-entry names in `faculties`, whose objects its `up` receives. A body that
-fails to stand stays down and says why, and the ground boots beside it.
-
-**Its terrain names default entries, and yours win.** Each ground stands
-its carries and its bodies of code from entries of its own. Its one
-clock is primordial, which the dock and every house receive.
-An entry you land under the same name stands in its place.
-
-```text
-recipe    { from: 'folder', make: 'module', args: { at: 'recipe.ts' } }
-payments  { from: 'recipe', make: 'payments', secrets: ['stripe-key'], kinds: ['com.acme.order'] }
-```
-
-**It opens each house on its entry.** An entry names the body that
-serves the house's code, the custom faculties it may use, and the
-longest any of its asks may run. It names a body serving memory only
-where the house keeps its places apart from the ground's memory. Beside
-each body's name, it holds the args that body hands this house.
-
-```text
-shop  { classes: { faculty: 'folder', at: 'shop' }, faculties: ['payments'], wait: 60000 }
-```
-
-**A change answers what stands, and an error means nothing landed.**
-Adding or updating a faculty answers why its body is down, where it is.
-Adding or updating a house answers its ward, or why it stays closed.
-The entry lands either way, and the hand mends it later.
-
-**It updates an entry in one write.** `update` lands the new entry over
-the old. A house closes and opens again on it, as the same ward. A body
-goes down, installs where its entry moved, and goes up, and each house
-naming it opens again. `restart` takes a body down and up on its entry.
-
-**It grants a faculty in two steps.** A house uses only the faculties its
-entry names. Inside it, a being holds one only where the faculty's entry
-names her class in `kinds`, or where it names none. So a raw program
-reaches one house and one class inside it.
-
-**It hands each faculty its secrets.** A secret is set through the hand
-and kept in a being's cells. A faculty's entry names the secrets its
-`up` receives, and no other code reads one. The hand lists their names
-and the entries that name each, and never a value. A secret's cells are
-shown to no one, and a changed secret reaches a body when it goes up
-again.
-
-**It holds each entry to what its faculty takes.** A faculty declares
-`takes`: a schema its args meet, and the secrets its entry must name.
-The hand refuses an entry that fails it, or that names a secret not
-kept, and says what failed. `facultiesCatalog` shows every faculty the
-ground can raise, and what each takes.
-
-**It hooks every door and runs one listener.** Each house's door goes to
-the ground's carry, which also delivers between the ground's own houses
-without touching the network. Everything that speaks HTTP, Quo over the
-web and every face, is a handler on one listener. A faculty stood while
-the ground runs is served at once.
-
-**The dock's steward reaches the ground through two faculties.** The
-`ground` faculty raises and lowers bodies, opens and closes houses,
-shows the catalogue and moves a house's places. It is offered to the
-dock's beings alone. The `shell` runs a command on the ground's machine,
-where the terrain has one. The dock is offered it as any house is
-offered a body. Its steward stands on the shell's twin, and the twin's
-entry grants it to the dock's shell being alone. No entry names, makes
-or grants either.
-
-**A boot writes only what moved.** Each twin raises its body by a read,
-and her cells are written only where what came of it differs. So a wake
-that finds nothing changed writes nothing.
-
-**It serves its owner's hand, and the hand has one road.** The hand
-answers `describe`, and otherwise asks a being of the dock or of a house
-as `root`. A request that names a house asks a being there. One that
-names none asks the dock's steward. `describe` shows her asks, every
-faculty with its methods or why it is down, and every house.
-
-| The dock's asks | What they do | Who asks them |
-| --- | --- | --- |
-| `housesAdd`, `housesUpdate`, `housesRemove`, `housesList` | the houses | `root`, and a pilot |
-| `facultiesAdd`, `facultiesUpdate`, `facultiesRestart`, `facultiesRemove`, `facultiesList` | the faculties | `root`, and a pilot |
-| `facultiesCatalog` | every faculty the ground can raise, and what it takes | `root`, and a pilot |
-| `waitSet`, `waitShow` | the ground's bound on every ask | `root`, and a pilot |
-| `secretsSet`, `secretsRemove`, `secretsList` | the secrets | `root` alone |
-| `movesOut`, `movesIn` | a house moved between grounds | `root` alone |
-| `callFaculty` | a faculty's method, called by name | `root` alone |
-| `shellRun` | a command on the ground's machine | `root` alone |
-| `pilotsInvite`, `pilotsDismiss`, `pilotsList` | who pilots the ground | `root` alone |
-| `boot` | the ladder stood and every house opened, as each boot asks | `root` alone |
-
-**An ask of the dock is safe to send twice.** A request may carry
-`call`, its call id. The same id sent again answers what the first
-answered, and runs nothing twice.
-
-**It lets a pilot possess it from afar.** `pilotsInvite` mints an
-invitation to the dock's steward, and the owner hands it to one being.
-That being then holds a standing on the dock, and asks the houses and
-faculties asks through it. Her class reaches them typed with
-`this.held(id, DockPilot)`, the need `nervur` exports. Secrets, moves,
-the shell and faculties' methods stay the hand's alone. A secret passes
-through `secretsSet`, which answers nothing, so no answer holds one.
-
-**It moves a house by its seed and its memory.** `movesOut` takes a
-house out as its seed and every place of its memory, and another ground
-takes them in with `movesIn`. The house keeps its identity, so every
-relation still answers and no far house notices.
-
-## The five grounds
-
-| Ground | Where it runs | When it wakes | Its unlock | Its memory | Its hand |
-| --- | --- | --- | --- | --- | --- |
-| NodeGround | a server, a desktop, a Pi | always on | a key file, or the macOS keychain | a ledger in its folder | a socket in its folder |
-| EdgeGround | a Cloudflare Worker and its Durable Object | per request, per message, per alarm | the Worker's secret | the object's storage | a key the Worker holds |
-| BrowserGround | a page or its service worker | while a tab is open, and by push | a key sealed under one the browser never hands out | IndexedDB | a channel between the origin's tabs |
-| AppGround | an iOS or Android app's web view | per launch, and by push | the Keychain or the Keystore | the app's native store | a channel, as in a page |
-| BenchGround | memory, in a test | as the test moves its clock | a key drawn from the bench's seed | memory in the process | the test's own |
-
-The same class runs unchanged on every row. What differs is the bodies
-each ground hands its houses.
-
-## NodeGround
-
-**`nervur up <folder>` runs one.** The folder holds your code: a folder
-for each house, and each module or program your entries name. Its
-`state/` holds the key, the ground's ledger and the hand's socket. A
-house's folder has an `index` that exports its `steward`, and `public`
-and `beings` where it has them, as [Writing for nervur](AUTHORING.md)
-shows. The ground's folder is an ES module package, so its
-`package.json` says `"type": "module"`. It listens on TCP and, where a
-port is set, on the web. [The command](COMMAND.md) lists its settings
-and runs its hand.
-
-**Its registry holds its terrain's faculties.** `folder` serves each
-house its classes from a folder inside the code folder its args name.
-Its body carries a registry of two more, rooted there. `module` imports
-a module as a registry, whose `faculties` export holds `{ up, install?
-}` by name. `bridge` starts a program, in any language, and hands it the
-secrets its entry names as its environment. An entry stands either with
-`from: 'folder'`. `tcp` and `web` are its carries, `listener` its one
-listener, and `shell` its shell. Its clock is the library's, and
-primordial.
-
-**Its code gives the default entries.** `folder`, `listener`, `tcp`,
-`web` and `shell` stand from entries the library fixes. TCP
-listens on the loopback at 9110, so nothing beyond the machine reaches
-a new ground. A server names its bind through the hand. The web names
-`listener` in its `faculties` and listens on no port. An entry of the
-same name you land stands in their place, so a port changes through the
-hand. Name
-`listener` there too, since the web serves the listener it calls.
-
-**A port another process holds keeps that carry down with why.** The
-ground boots beside it until the hand moves the port. A `tcp` entry
-whose args name no port only dials, and its invitations name no TCP
-address. Its environment names only `NERVUR_STATE`, `NERVUR_UNLOCK` and
-`NERVUR_HAND`.
-
-**Its key rests in `state/key`, its owner's alone.** A key file others
-may read is refused, as ssh refuses a key. On macOS,
-`NERVUR_UNLOCK=keychain:<account>` keeps the key in the keychain
-instead. Keep `state/` as you keep an ssh key: whoever holds the key and
-the ledger holds the ground.
-
-**It keeps its memory as a ledger, which holds the folder's lock.** Every
-write is one line, chained to the line before it and synced before it
-counts. A ledger edited anywhere but its end is refused. A witness file
-kept on another disk refuses a restored copy that is behind. While the
-ledger stands, a second ground on the same state is refused.
-
-**Its shell runs a command for the hand alone.** `nervur shell run --
-<command>` runs it in the code folder, and answers its exit code and
-what it printed. Its environment holds `PATH`, `HOME` and a few more of
-the process's, and never a secret or a `NERVUR_` variable. No pilot and
-no being reaches it.
-
-**It runs a program as a faculty, in any language.** The bridge starts a
-program and speaks one JSON value a line on its standard streams. The
-program keeps what it must in the faculty's sealed memory, through lines
-of its own. [Writing a faculty](FACULTIES.md) teaches it.
-
-## EdgeGround
-
-**An edge is one Durable Object, woken per event.** The Worker hands
-every request to the one object its ground's name gives. At each wake
-the ground boots again, and a house opens only when a box for it arrives
-or the hand names it.
-
-**Its Worker's module is two lines over your code.**
-
-```ts
-// worker.ts
-import { EdgeGround } from 'nervur/edge';
-import * as shop from './classes/index.ts';
-import * as recipe from './recipe.ts';
-
-export const Ground = EdgeGround.object({ registry: recipe, code: { shop } });
-
-export default EdgeGround.worker();
-```
-
-The Worker binds the object's class as `GROUND`, with SQLite storage.
-`registry` joins the terrain's own, so an entry raises `payments` with
-no `from`. A house's entry names its code with `classes: { faculty:
-'bundle', at: 'shop' }`.
-
-**Its Worker holds two secrets and nothing else.**
-
-| Variable | What it names |
-| --- | --- |
-| `NERVUR_SECRET` | the ground's key, sixty-four hex digits; set as a secret |
-| `NERVUR_HAND` | the key its hand answers; set as a secret |
-
-A Worker learns no name it is reached by, so it writes only the
-addresses its `web` entry names, the held line first. Name them through
-the hand with `facultiesUpdate`, as `addresses` in the args of `web`,
-beside its `origins` and `allowPrivate`, and the dock keeps them.
-Every ask runs a minute at most, and `waitSet` keeps a shorter bound.
-Its faculties take their secrets from the dock, as on every ground. It
-has no shell.
-
-**Its hand answers its key alone.** The hand is `POST /nervur/hand`, with
-the key as a bearer token and one request as the body. Every other
-request there, and every request to an edge that sets no key, finds
-nothing.
-
-**It is deployed by a faculty, never by hand.** A faculty on your
-NodeGround holds the account. It builds the module, uploads it with the
-two secrets, keeps them, and reaches the hand. The library ships none,
-since a deploy is a choice of yours. The first deploy is that faculty
-called through your NodeGround's hand, and every later one is your pilot
-being's.
-
-**Its held lines hibernate.** A page or a device holds a WebSocket on the
-edge, the platform keeps it while the object sleeps, and a message wakes
-the object. A watch held on that line answers the moment the change lands.
-
-## BrowserGround and AppGround
-
-**A BrowserGround is one ground for its origin.** Every tab and the
-service worker of an origin share it. The tab holding a Web Lock runs
-the ground, and its hand answers every other tab over a channel. It
-only dials, so it answers no face. Whoever serves the origin's script
-possesses the ground, so its origin serves nothing else.
-[The package's start](README.md) opens one in a page.
-
-**Its registry is the one the page hands.** `BrowserGround.open({
-registry })` joins it to the terrain's own, whose faculty `origin`
-serves each house its classes from the origin.
-
-**An AppGround is a BrowserGround with the shell's bodies.** The app's
-native shell hands in two small interfaces, one for secrets and one for
-a store, and the library holds the rest. The ground's key rests in the
-secret store.
-
-## BenchGround
-
-**A BenchGround runs a world in memory.** A `FakeNetwork` joins several,
-gives them names as DNS does, and carries every box between them on one
-clock the test moves. It cuts, slows, drops and repeats boxes, and turns
-a ground off and on. So one test proves the same classes at every
-distance. [Writing for nervur](AUTHORING.md) tests the shop on it.

package/KIT-SPEC.md

@@ -1,304 +0,0 @@
-# nervur's answers to KIT-SPEC
-
-This document answers, for `nervur`, every question that Quo's `KIT-SPEC.md`
-asks of a kit. Quo's spec, `SPEC.md`, and `KIT-SPEC.md` stand in
-[razvangherghina/quo](https://github.com/razvangherghina/quo), and every
-term below is the term they define. Quo's verifier judges nervur's Quo
-layer as a door, an asker, a TCP listener and a TCP dialer. It passes all
-four. Each answer states what the code of this version does.
-
-## What stands behind a door
-
-**Question 1.** A house stands behind each door, and holds one ward. A
-house holds beings. A being is an instance of a class a developer writes,
-with JSON cells and named asks. A ground is the script that opens a house.
-It hands each arrival to the house's `door(box)` function. The door finds
-the relation by its heir, and the heir names one being and one of her
-occupants. An occupant is a being's name for the door's end of a relation.
-Asks to one being run one at a time, in the order they arrive. An ask
-marked `readOnly`, and the empty ask, run beside them. Asks to two beings
-run side by side.
-
-**Question 2.** The ground that runs the house holds its seed, sealed in
-the ground's drawer under the one key the ground holds outside itself. A
-keys body gives signatures and agreements from the seed, and never the
-seed itself. `House.open`
-hands the ground a hand, `ask({ id, method, args })`, which asks the being
-`id`, or the steward where none is named, as the occupant `root`. The
-steward places and removes every other being. Every other being holds the
-standing `steward`, which she cannot drop. The steward cannot dismiss
-`root`. So no path inside a house removes the edge back to what made it.
-`root` never arrives through a door. The ground serves the hands of all
-its houses in one place. On Node, that is a local socket only the
-ground's user may open.
-
-**Question 3.** The public being answers the zero head, where the ground's
-classes name one. A house with no public being answers every ask on the
-zero head with silence, as case 4. The public being reads each such asker
-as the occupant `stranger`, with the key its ask was signed by. A stranger
-reaches only her asks that are safe to repeat. The house keeps each
-zero-head choice by the box's signature for ten minutes. The same sealed
-bytes arriving again within that window hear the same choice, and nothing
-runs twice. That cache lives in the process, so a restart empties it.
-
-**Question 4.** The door opens any number of boxes at once, and judges
-one at a time on each relation. A box whose relation has another box in
-flight waits for it, and is judged again on the record it left. A box
-opened on a record that moved meanwhile is judged again too. So each box
-is admitted by what holds when the door chooses, and the highest number
-honoured never goes down. An admitted ask waits its turn among its
-being's asks, and its move lands in the ask's own write.
-
-**Question 5.** nervur calls what stands behind a door a house, and what
-it holds beings. The door's end of a relation is an occupant, named by an
-id its being chooses. The asking end keeps Quo's name, a standing. A
-standing that arrives by invitation is named `standing:` and sixteen hex
-digits drawn from its heir, so the same invitation taken again gives the
-same standing. The ids `root`, `stranger` and `steward` are reserved, with every
-id beginning `handle:` or `being:`. The process that opens a house is its
-ground. None of these names crosses a door.
-
-## What a kit keeps
-
-**Question 6.** A ward's seed is sixty-four lowercase hex digits, and
-anything else opens no house. `SeedKeys` takes it as a string. A ground
-draws a fresh seed when a house is first added, and keeps it sealed in
-its drawer. The drawer's key rests outside the ground, in a file only
-its owner may read, the macOS keychain, a Worker's secret, or the
-platform's keystore. The house never holds the seed, and asks its keys
-body for operations alone. The lock is
-derived, not drawn. It is the ML-KEM-768 key pair from 64 bytes of
-HKDF-SHA-256 over the seed, under the label `nervur-lock`. It is made on
-first use and is the same every time. So a ward holds one lock, and its
-seed alone restores it whole. The ward keeps no heir's secret after it
-gives the invitation.
-
-**Question 7.** Every drawn byte comes from `crypto.getRandomValues`, the
-platform's Web Crypto source. The default crypto body, `NobleCrypto`, draws
-there for heir secrets, ephemeral secrets, announced keys and ids. Its
-ML-KEM encapsulation, from the noble library, draws from the same source.
-The lock draws nothing, since it derives from the seed. A ground may hand
-its own crypto body, and then the source is that body's.
-
-**Question 8.** For each heir, the door keeps whether it is spent, the key
-it holds, the key it vouches for, and the open and offered edge keys. It
-keeps the highest number it honoured as well. That record sits in the
-place of the being the heir reaches, beside her other relations. The house
-keeps it in the memory its ground hands it, sealed under a key derived
-from the seed. `FileMemory` and `LedgerMemory` write to disk, and the
-record survives a restart with them. A standing's record is kept the same
-way. Its number and its knock are written before a box leaves.
-
-**Question 9.** A door stops holding an heir when its being dismisses the
-occupant the heir reaches. It stops when a handle made for one use has its
-first ask land. It stops when the steward removes the being. An invitation
-taken by a standing of the same house binds inside the house, and its heir
-leaves the door then. An heir minted with a time to be spent in, and
-still unspent past it, is one the door never held. The door lets it go
-at the next mint or binding knock. A spent heir never expires, nor one
-minted without a time.
-
-**Question 10.** The door keeps no keys at removal, for any time.
-Dismissal deletes the heir from the door's index. So an ask signed by any
-of the relation's keys hears silence at once, and the door never answers
-`removed` in this version.
-
-**Question 11.** None. A door honours no number below the highest it
-honoured on a relation, and a number at or below it hears `repeated`. A
-nervur standing numbers each ask above every number it sent. So a retry
-never meets `repeated` for a box that arrived.
-
-## What a kit answers
-
-**Question 12.** The door answers every box it refuses with silence or
-with one of Quo's words. It answers every admitted ask with a choice. The
-choice is the being's object, or silence where the being is absent or does
-not hold that asker. The door gives nothing where the memory refuses the
-write that holds the ask's move. Over TCP, the listener also answers
-nothing for a ward it does not hold, and for a door that fails with an
-error.
-
-**Question 13.** `seen` is sixteen lowercase hex digits. They are the first
-eight bytes of the SHA-256 of the canonical JSON of the describe that asker
-would hear. So `seen` changes exactly when that describe changes: the
-being's state, the asks shown to that asker, or their entries. Every
-object carries it, an answer and a describe alike, a refusal of `args`
-that repeat a key among them.
-
-**Question 14.** The empty ask answers a describe to any asker the door
-admits, a stranger on the zero head among them. A being that is absent
-answers silence instead. A describe holds the being's current state and
-every entry shown to the roles its asker holds, in every state. So two
-askers with different roles hear two describes. Its `lang` is
-`org.nervur.asks/1`, nervur's language above Quo, whose shapes are below.
-An entry's `description` is the class author's text. Its `args` and
-`result` are JSON Schema 2020-12, in a closed subset. A named ask that no
-entry shown to that asker names hears `{"error":{"message":"no such ask"}}`.
-
-```text
-describe = { lang: "org.nervur.asks/1", kind?, description?, view?, state, asks }
-entry    = { method, in, to, description?, args, result?, hints, wait }
-answer   = { result } | { error: { message } }
-```
-
-A stranger's describe names no `kind` and no `description`. A `view` is
-the being's markup as text, which a screen renders, and every asker is
-shown it.
-
-**Question 15.** A reply text holds no whitespace between tokens. An
-object reply writes `object` first and `seen` second. Its object is
-canonical JSON, with every object's keys sorted by UTF-16 code units. A
-word is written `{"quo":"removed"}`, and silence `{"silence":true}`.
-
-**Question 16.** No. nervur seals every payload and every reply text with
-no padding. It reads padding wherever padding arrives.
-
-**Question 17.** No. Each refusal returns as soon as its case is found.
-So a box refused at its head returns sooner than one refused at its
-signature.
-
-**Question 18.** The Quo layer names the case that refused each arrival,
-and the house discards it. Nothing in this version logs a refusal, or a
-reply that breaks a rule. A standing reads a reply that breaks a rule as
-silence, and keeps no record of why.
-
-## What a kit asks
-
-**Question 19.** An invitation leaves a house as a handle. A being puts a
-handle in her answer, or in the `args` of a call outward. The house writes
-it as the hex of the invitation's canonical JSON. From there it travels
-however its receiver carries it. The minting house keeps no copy. It keeps
-the heir's public key and the record of the relation, never the heir's
-secret.
-
-**Question 20.** A standing whose knock surely reached no door sends the
-knock again, as the same bytes, until it may have. Its carry says so: no
-address took the box. A standing whose knock may have been heard, and
-brought no object back, recovers it in turns. Its next send is an ask
-with a new number, under the key its knock announced and the knock's edge
-key. The send after that is the knock again, as the same bytes. The two
-take turns until an object comes back, or a word to an ask. An awaited
-call makes one send within its wait, and the next call on the relation
-takes the next turn. An effect is sent again after a wait that starts at
-one second and doubles, never past five minutes. It stops at its
-deadline, which is seven days for a standing.
-
-**Question 21.** Over TCP and the web, a dialer waits thirty seconds for
-each address, unless the ground sets `wait` on its carry. An awaited call
-waits as long as the method it calls names. That is thirty seconds by
-default, never past five minutes, and never past the ground's `wait` on
-the house. It never waits past what is left of the ask that makes it. An
-awaited call to a far ward carries that time in the payload field
-`within`, in milliseconds. The ask it starts waits that long at most, and
-an ask whose time is spent runs nothing and hears silence. A being waits
-on no effect, and an effect's answer returns to her as an ask.
-
-**Question 22.** A standing numbers its asks from 1, each one above the
-last it sent. Every ask announces a fresh random key in `next`. The house
-sends one ask at a time on each relation, and the next waits for the reply
-to the last. The number and any knock are written before a box leaves.
-The standing moves only on an object answering an ask above every ask it
-has moved on. It then signs with the key that ask announced, and keeps no
-key it moved from. After a move, an ask that meets silence moves nothing.
-The next ask signs with the same key under the same edge key, with a new
-number and a new announced key.
-
-**Question 23.** The Quo layer reads a reply as one of four: an object
-with its `seen`, silence, one of Quo's three words, or nothing. The house
-treats silence, a word and nothing alike, as transient, and names no
-cause for any of them. An address that never answered, a spent heir and
-a reply that came late read the same. An awaited call fails with the
-method's name followed by `answered nothing`. An effect is sent again.
-Past its deadline, its reply ask reads `the call gave up at its
-deadline`. A being never reads silence, a word or nothing as such.
-
-## What a kit carries
-
-**Question 24.** nervur stands Quo over TCP, as a listener and as a
-dialer, in `TcpCarry` from `nervur/node`. It carries plain TCP, with no TLS
-and no check beyond Quo's own. The listener binds `0.0.0.0` by default, on
-the port the ground names or one the system picks. One listener answers
-for every ward whose house listens on it, routed by the ward each ask
-names.
-
-nervur stands Quo over the web in `WebCarry`, both its post and its held
-line, as a listener and as a dialer. The listener is a handler on the
-ground's own HTTP listener, at the path `/quo` unless the ground names
-another. It answers a reply with status 200 and nothing with 204. It
-answers a request that is not a `POST` with 405, a body of the wrong size
-with 400, and a ward pk it holds no door for with 404. It answers the
-CORS protocol only for the origins its ground names, and no origin
-otherwise. A held line that does not offer the subprotocol `quo` is
-refused at its handshake with 400. TLS is the ground's listener's, and
-this carry adds none.
-
-**Question 25.** A standing learns where a ward is reached from the `at` of
-its invitation, and from which address answered. A house writes `at` in
-every invitation it mints. It writes the addresses the ground hands its
-carry, the same toward every holder. A carry that joins several lists
-every one's addresses. Where the ground hands none, `TcpCarry` writes the
-listener's own address, with `0.0.0.0` written as `127.0.0.1`.
-
-A carry keeps the door of every ward it listens for. A box to one of those
-wards goes to its door in the same process, before any address, and no
-connection is made. So the houses of one ground reach each other by the
-carry they share, whatever their invitations' `at` holds.
-
-A standing keeps its route: the address that last answered with an
-object or a word, which only a reply that opened as the ward's carries.
-Silence pins nothing. Each ask tries the route first, then the addresses
-of `at` in their order, one after another. The route is kept with the
-standing's record and survives a restart.
-
-A door writes `at` in an object reply when the ground's addresses differ
-from the ones that holder last heard, in its invitation or in a reply.
-It writes them once, and a later reply carries none until they change
-again. A reply lost after it carried them leaves that holder with the
-old addresses until the next change. A standing takes `at` from an
-object reply alone. It replaces the addresses it held, and a later reply
-with none leaves them as they stand. The dialer skips an
-address its carry does not speak. It looks a name up and takes its first
-address. One connection to each address carries many asks at once.
-
-The dialer refuses a loopback, private, link-local, shared or unspecified
-address, unless the ground sets `allowPrivate`. Over the web it reads
-the host as the URL writes it, and refuses `localhost` too. It moves to
-the next address after a refused address, a failed connection, a
-nothing frame, or a post answered with any status but 200 and a body. It
-carries the box no further after a wait that runs out, a connection that
-closes with the ask in flight, or a post that failed after it was sent.
-That ask may have been heard, and the send answers nothing.
-
-## What is not the kit's either
-
-**Question 26.** `method` names an entry of the being's describe, and
-`args` are that entry's arguments. The house holds `args` to the entry's
-schema before the method runs, and answers a mismatch as an error. The
-`lang` `org.nervur.asks/1` names nervur's language, whose shapes Question
-14 gives. A field `call` beside `method` carries a call id, and a field
-`within` the milliseconds its chain has left, as Question 21 gives. An ask whose
-call id that occupant already used hears the stored answer, and runs
-nothing. A call id is kept seven days.
-
-## What a kit reads
-
-**Question 27.** nervur's JSON reader is iterative. It reads any nesting
-depth that a box of at most 1 MiB holds, and sets no length below that
-size. It takes lone surrogates written as escapes, and noncharacters, as
-they stand. Repeated keys anywhere inside `args` are answered
-`{"error":{"message":"the args repeat a key"}}`, and the method never runs.
-Numbers are read as IEEE 754 doubles. So an integer beyond 2^53 loses
-precision before the schema holds it. Fields of the payload that the spec
-does not name, `call` and `within` apart, are ignored. Inside a reply's
-`object`, a standing takes a repeated key and keeps its last value.
-
-## What a kit shows
-
-**Question 28.** nervur reads a domain's vouch for every standing on a
-far ward. The domains it checks are the hosts of the invitation's
-`https` and `wss` addresses, so a domain that serves no web is never
-asked. It reads the file once the ask that takes the invitation lands, and
-again when the ward names new addresses in a reply. A being sees the
-domains that vouched beside each standing she holds, and shows them to
-the person as her class chooses. A domain that lists the ward is shown,
-and one that does not is not.