Description

SPPAS reads files where it runs, and the files of a person are not always there: she works on her machine and SPPAS answers from a server. What crosses that gap has to stand somewhere while it is being treated, and has to stop standing there afterwards.

This is that somewhere, and it is nothing else. It gives a place, says what it takes, writes a file there, gives an address at which a file of a place is reached, and forgets what is out of date without being asked. It has no face: nobody sees it, no person acts on it. It is called.

It knows nothing of what it holds. Not a workspace, not a root, not an app, not what a file is for. That ignorance is the whole point: it is what lets one place serve the provision of files to the apps of swapp, an app served online, and whatever comes next.

It exists already, in one place. The spin-off Auto-CS holds it inside one of its apps: a place, a lifetime, and a cleanup which runs at every request rather than on a schedule. An access is authorised there too, by a signature carried in the address, which the front of the machine verifies and whose secret and lifetime it holds. That code is the proof of concept and the starting point; what it lacks is a name of its own, a place said once instead of written in an app, and this dossier.

What is required of it

It has no needs of a person to serve: a person never reaches it. What follows is what the domains which call it require, and every one of them answers a need written in their dossiers.

• R1 — To obtain a place where files may stand, or a refusal saying when to come back.
• R2 — To be told what is accepted — what size for one file, what volume for one place, how many places — before anything is sent.
• R3 — To put a file in a place, under the name it was given.
• R4 — To obtain an address at which a file of a place is reached, and which lasts exactly as long as the file.
• R5 — That nothing stays beyond its lifetime, and that no caller has to ask for that.
• R6 — That what is in one place never meets what is in another.

Scope

This document covers a place: what it accepts, how it is obtained, what becomes of what stands in it, how long, and who may reach it.

What is not covered, and belongs to whoever calls: what a file is for, which files SPPAS is able to read, what is shown to a person, and what is done with a file once it stands here.

Data dictionary

Three things are handled, and they are all that is handled.

• D1. The place — where files stand and nothing else stands. It is named, it holds a moment, and it does not last.
• D2. The file — an object standing in a place, identified by its name inside it. What is manipulated here is its name and its size; its content is bytes, and what they mean is not read.
• D3. The address — what a file of a place is reached by. It leads to that file and to nothing else of the machine, and it lasts as long as it does.

Conceptual model of communication

This domain gives a place, takes files into it, gives an address at which one of them is reached, and forgets. Two actors border it, and neither of them is a person: a person never acts here.

Actors

• A1. A caller — a domain which has files standing nowhere it can read them, and which knows what they are for. It asks what is accepted, asks for a place, puts files there, and asks for an address. Two are known: the domain of the provision of files of swapp, and the app of the spin-off Auto-CS.
• A2. Whoever holds an address — it asks at an address for what that address names. It knows the address and nothing else, and it did not necessarily ask for the place: the machine of a person to whom the address was given is one of them, the caller itself is another.

Flows

• F1. A1 → domain — what is accepted? asked before anything is sent (R2).
• F2. domain → A1 — the size for one file, the volume for one place, the number of places (R2).
• F3. A1 → domain — the request for a place (R1).
• F4. domain → A1 — a place of its own, empty and named; or a refusal saying at what hour there will be room (R1).
• F5. A1 → domain — a file, the name it is to stand under, and the place it is for (R3).
• F6. domain → A1 — that it stands there; or that it is not taken in, and why (R3, C4, C5, C8).
• F7. A1 → domain — the request for an address for a file of a place (R4).
• F8. domain → A1 — the address (R4).
• F9. A2 → domain — a request at an address.
• F10. domain → A2 — the file, or nothing at all (C10).

The host of the machine is not an actor: it exchanges nothing with this domain. It imposes the size beyond which a file does not pass, which this domain says in F2 and does not choose (D2, C4).

No flow says what a file is for, and none could be added which did: what crosses the border is a name, a size, bytes, and a place. That is what lets one place serve callers which have nothing in common.

Conceptual model of data

Two classes, and the second exists only inside the first.

The classes of entities

The relations

R1 is an aggregation: a file is named inside the place which holds it, and two places name a file the same way without naming the same file. It is also what identifies a file — its name inside its place — and it is where R6 is answered: what is in one place cannot be reached from another, there being no way to name it from there.

A place is given empty, which is why the leg reads (0,n); and it stays a place while it holds nothing, until its duration runs out.

Computed, and never held

• The address at which a file is reached, which is a place, a name, a moment, and a signature made from a secret held where the space stands. It is verified by being computed again, nothing of it being written down anywhere (R4).
• That a place is out of date, which follows from its moment and the one duration (C1).
• The hour at which there will be room, which follows from the moment of the oldest place and the one duration (T02).
• The volume of a place, which is the sum of the sizes of what stands in it (C5).

An address carries a moment of its own, so it has a life of its own, and that life is not the place's: it starts when the address is made, and not when the place was given. The two cannot be made to end together without giving up one single duration for every place (C1), so one of them outlives the other, and C3 says which: never the place. An address made at the last instant of a place authorises an access past the end of that place, and what it then reaches is nothing at all, which is what T05 answers and what is wanted. The reverse — a file still standing which no address can reach any more — is what C3 forbids.

What the keys do not hold

• A file is written under the name it was given, and under no other: nothing here renames (C7).
• What one place holds does not exceed the volume, which no key says (C5).
• The space holds at most its number of places at a time (C6).

What is not modelled, and why

• The bounds and the duration: they are values (D1 to D4), and a value which moves is not a rule.
• What a file is for, what reads it, what produced it: the caller's, and the ignorance is deliberate.
• Who asked for a place. A place belongs to whoever holds its name, and this domain keeps nothing of a caller.

Conceptual model of treatments

Six treatments, and they are all that the domain does. Five answer a caller which asked; the sixth answers nobody. None of them waits for two events: there is no synchronisation here, a request being answered on what it carries and on the state of the space, and never on a second request.

The events

E6 is temporal and nothing here holds a clock. That is not a contradiction of levels: the conceptual model says that a place which has outlived its duration has to go, and the organisational level says by what this is noticed — the requests, C2 saying it already, for want of that chapter.

What it offers

Nothing here reads a content. A type refused on its bytes, an extension which is not read: those are the caller's, who knows what a file is for.

Organisational model of treatments

One procedure per treatment, numbered as it is, and each one triggered by one event. There is one table and not several: nothing here branches on where the software is installed, on who is at the other end, or on what the files are for. A caller which is refused a place is refused the same way wherever it runs.

Two columns say the same thing six times, and both are results. Where: one machine, the one the space stands on, and a caller runs on it too — it calls this domain where it stands, and nothing of what is exchanged from F1 to F8 crosses a network. What crosses one is what a caller collects from a person, before, and what whoever holds an address follows, after. Nature: every procedure is automated, and none is conversational. That is what « it has no face » means once it is written at this level: there is nobody to converse with.

PF5 is the one procedure with two operators, and they do not do each other's work. What authorises an address is verified by the front of the machine, which holds the secret and which lets nothing through without it; what is verified by this domain is that the place is of this hour and that the file stands in it. RO3

PF6 is triggered by an event nobody sends, and it is run at the beginning of a request which asked for something else. Before, and not after: a place which is out of date is then neither counted against the number of places, nor put into, nor addressed, nor served, and the hour PF2 announces is exact. RO2

What the forgetting does not reach

Nothing here holds a clock, so the forgetting happens when something else does. A space which nobody comes to holds its places past their duration, on a disk, until somebody comes. That is a fact of this level and it is not hidden: what is promised is not that a place is gone at the minute, it is that a place past its duration is never given, never added to, and never served.

What stays on the disk is not exposed by staying. Nothing under the space is served without a signature which is still of this hour, whatever stands there; and a place which has ended has no address but those which were made before it ended, T04 making no new one for it, each of them dying at an hour of its own. What the disk keeps past the duration, it keeps from everybody.

One window is not closed by that door, and it is the other one: a signature still of this hour, and a place which is not. It cannot be avoided, an address beginning its life when it is made and not when its place was given. This is why T05 reads the moment of the place and does not take the front of the machine for an answer. A signature which is still of this hour says nothing of a place, and between the instant a place runs out and the request which sweeps it, the file is still on the disk. What keeps C1 on the way in is the reading, not the sweeping.

And it is wanted so. A file which stands still costs no more than its absence: it is written once and it is read once, and between the two it asks nothing of the machine. A process which runs on and on to verify that everything is still valid costs, and here it costs for nothing — it would spend, at every turn, to find that there is nothing to do, and on the turn where there is something it would do what a request was going to do anyway.

That is the principle, and it decides this level: nothing runs here which is not answering somebody. A clock would have to be installed, watched and restarted, and it would buy a minute of exactness which nobody asked for. What it would buy is a disk emptied sooner, which is a matter of room and not of what is promised: the promise is held by the reading.

Rules of organisation

• RO1 — A caller calls this domain where it stands: the space and whoever asks for a place are on one machine. Nothing of what is asked and answered from F1 to F8 travels.
• RO2 — The forgetting is done at the beginning of every request which reaches this domain, nobody having asked for it and nothing holding a clock (C2).
• RO3 — What authorises an address is verified by the front of the machine, which holds the secret; that a place is of this hour is verified by this domain. Neither does the other's work.
• RO4 — Where the space stands is said in one place and read from there: by this domain, and by the front of the machine which protects that one place, once, and not one entry per place (C9, C10).
• RO5 — What says which places exist is the space itself. No list of places is held beside it, and none of callers: counting the places and finding the oldest is reading the space (C6, T02).
• RO6 — A caller is never told that its place was forgotten. It learns it by being refused a file (T03), by getting no address (T04), or by an address reaching nothing (T05). Nothing is sent to anybody who did not ask.
• RO7 — The bounds and the duration are said in one place and read from there. A caller obtains them by asking (T01), and holds no copy of them: a bound written twice is a bound which will differ from itself.

What the code holds to

The tables

Each class of entities becomes a table, and its identifier becomes its key. There are two, and one of them is named inside the other.

R1 is an aggregation: the aggregated class takes the key of the aggregating one, so a file carries the name of its place, and the two together tell one file from another. Two places carry a file under one name without carrying the same file, which is R6 answered by a key and not by a verification.

The low cardinality of R1 on the side of FILE is (1,1): the key of the place is taken, and it is never empty. A file has no existence outside the place which names it, and that is what makes the deletion of T06 one single act: what deletes a row of PLACE deletes the rows of FILE which were named by it, there being no way left to name them. Nothing has to go through the files one by one, and nothing is left behind which nothing points at.

On the side of PLACE it is (0,n), and the table says so: a place is a row before anything stands in it, and it stays one while nothing does.

Content is a column, and it is the only one which is written whole and read whole. Nothing looks into it, nothing indexes it, nothing selects on it. It is put there by T03 and given back by T05, and between the two it is bytes.

The size is not a column. It is read from the content, which is held: a column would be a second statement of the same thing, and one of the two would end up false. That is where this differs from the neighbouring dossier, which holds a size on a copy: there, a size is known of a file whose content has not travelled yet, and there is nothing to read it from.

Not in the tables, and computed every time they are wanted: the size of a file, the volume of a place, whether a place is out of date, the number of places standing, the hour at which there will be room, and the address at which a file is reached with what authorises it. None of the six would stay true if it were held.

Not in the tables, and not anywhere else either: what addresses were given and to whom, and which caller a place was given to. An address is verified by being made again, so there is nothing to keep and nothing to withdraw; and a place belongs to whoever holds its name, which is all this domain will ever know of a caller.

The secret which the signatures are made from is not in the tables: it is the front of the machine's, and this domain neither holds it nor reads it. RO3

Where each table stands

Here the machine is named, and not before. There is no database: one disk bears both tables, and nothing bears anything else. RO5

The name of a place carries the moment it was given at. The moment is not read from the disk, and the reason is exact: the moment a folder carries is the one it was last written into, so it moves every time a file is put in the place. A place would live its duration from its last file and not from its making, and a caller which puts one file just before the end holds it for another turn, and another. C1 says one single duration, and a duration which can be renewed is not one.

The code of the spin-off reads the moment from the disk, and is right to: what it sweeps is written once and never added to. A place is not that, and this is the one place where this domain departs from the code it comes from.

What else the name carries is drawn at random, as the spin-off draws the name of a page. Not to make a secret of it — what authorises reaching a file is the signature and never the name — but so that two places made in one second are two names, and so that a name says nothing of who asked for it.

Where the space stands is one line, read by this domain and by the front of the machine, which protects that one folder by its prefix, once, and not one entry per place. C9, C10, RO4

The sweep is a reading of names. T06 lists the folders of the space and deletes those whose moment has run out; it opens nothing and asks the disk nothing about them. The number of places standing (C6) and the moment of the oldest (T02) are read from that same listing: one listing answers three questions, and it is the whole of what this domain knows of itself.

Deleting a place is deleting a folder, which is the logical level said in the terms of a disk: what named the files is gone, and they are gone with it. The volume of a place is the sum of the sizes of what the folder holds, read when it is wanted and never written down.

Two requests read one listing, and nothing is locked. Two callers which ask for a place at the same instant may both find room where there was room for one, and the space may stand one place over its number for a while. It is left so: what one place may hold is bounded (C5), so what an overshoot costs is bounded too, and the next sweep brings the space back under its number. The state is the disk, and what the disk does with two writers at once is what happens here.

Operational model of treatments

The organisational level said by what and when; this says in what tasks, and what among them cannot be half done. One request is one unit: nothing here is begun in one and finished in another, and nothing is held from one to the next.

The sweep is the first task of every procedure

It is written in every row, PF6 excepted, which is that task and nothing else. That is what RO2 becomes here, and it holds even for PF1, which reads neither a place nor a file: what runs before PF1 is PF6, and T01 still reads nothing. A caller which asks what is accepted is a caller which is about to deposit, so it is the cheapest moment there is to find the space in the state PF2 will count.

Two tasks are a making which the name refuses

A name which is taken is not verified and then written: it is one task which either makes the thing or says that the name is taken. Between a verification and a writing, two requests both pass and the second overwrites the first; there is no between here.

C8 is therefore a property and not a control. Two files of one name given at one instant — which is what a browser does when a person gives several files at once — are one file made and one refusal, and which of the two was first is what the disk says. The refusal of T03 for a name taken is that task failing, and nothing else.

The same holds of PF2: a drawn name which is already a place is a making which is refused, and another name is drawn. Nothing has to be looked up beforehand.

The writing of the bytes is not one task

A request which dies in the middle of it leaves a file which stands under its name and is short. Nothing repairs it, and nothing has to: the place dies at its hour with what it holds. That is why there is no journal here, no transaction and no recovery — the duration is what undoes, and it undoes everything, whether or not anything went wrong.

What is short belongs to a request which failed, and it is that request's caller which learns that it failed. A caller which is told nothing put nothing.

What two requests do to each other

Between the moment PF5 reads that a place is of this hour and the moment it opens the file, the sweep of another request may have deleted the place. The opening then fails, and what is answered is nothing at all — which is already what T05 answers to the three other cases. There is nothing new to decide, and nothing to lock.

Between the counting of PF2 and the making of its folder, another request may have made one: that is the overshoot the previous section describes, and it is left as it is for the reason given there.

Where the code goes

In sppas/ui/swapp/services/deposit/: in the family folder of the services, beside the provision of files, because it is a service and not an app.

One module per kind of knowledge, and every procedure has one module and one only.

The four values and the line which says where the space stands are in a file of their own, read by the three and written in none of them: a value written twice is a value which will differ from itself.

What each one promises, which is the reason for the cutting:

• The place module is the only one which touches a disk. The day the space stands elsewhere, or is not a disk at all, it is the only one to be read again.
• Acceptance touches nothing and reads nothing: it is given a size, a volume, a number, and it answers. That is what makes it testable with no disk at all, and it is where the four values are answered from.
• The address module is the only one which knows what an address is made of, and the only one which meets the front of the machine. It is also where the moment of the place is read before anything is served, which is T05 and not the front's to do. RO3

No module here knows a workspace, a root, an app, or what a file is for. The ignorance which the first chapter claims is this cut and nothing else: there is nowhere for that knowledge to be held.

The architecture of the code

No manager, no view, no controller. Those are the shapes of an app, which assembles a page for a person at every request; nothing here is assembled and nobody is shown anything. What a caller holds is one object, and the three modules stand behind it.

It holds nothing between two calls. It is made, it is called, it reads the disk, it answers. Two callers in two processes see one space without knowing of each other, because the space is what they both read and neither of them keeps. That is RO5 written as code, and it is what lets a caller be made and dropped at every request without anything being lost.

What it asks of whoever assembles the server, and it asks one thing: that a request under the prefix of the space reach this domain, once the front has verified what authorises it. How it is routed there belongs to whoever assembles the server, and it is not settled here. It is the only point at which this domain needs anything of its host: everything else it does, it does because it was called.

A refusal is an answer and not a failure. There being no room now (T02), a size, a volume or a name (T03), an address which names nothing (T04, T05): each of them is read by a caller, which knows what to say about it and to whom. What fails here is what fails anywhere — a disk which will not be written — and it is not answered, it is raised.

The classes

Those which carry the data come from the tables, one per table. Those which work come from the modules, one per module. A name says what the class handles and nothing of how it is arranged.

What carries the data

What does the work

No view, no controller, no record. Those are what an app has because it assembles a page for a person at every request; nothing here is assembled and nobody is shown anything, and the architecture of the code says it already.

The façade puts the tasks in order, and that is not a formality. Judging a size is SpaceAcceptance's, summing a volume is SpaceFolder's, and what says that the one comes before the other is the façade. Written otherwise, one of the two would have to call the other, and the promise that one class alone touches a disk would be false. The operational model is what this order comes from.

The class diagram

/ marks what is derived and held by nobody. What the operations promise is the chapter on the contracts; what they are called is a proposal, and one pass renames them all.

SpaceFolder.make_a_place() and SpaceFolder.make_a_file() are the two operations which either do the thing or say that the name is taken. They do not look first, and no other operation looks for them: that is C8 as the operational model writes it.

DepositSpace.forget() is called by no caller. It is the first thing the five others do.

The class which reads a moment from a name is the one which writes it. Place.a_name_for() makes the name of a place for a moment, and SpaceFolder is given that name and makes a folder of it. Written otherwise, what a name is made of would be in two classes, and the day it changes one of the two would keep the old shape.

What is tied to what

FileAddress does not call SpaceFolder, and that is deliberate: the promise that one class alone touches a disk would be false the moment it did. It says what an address names; the façade is what then asks for the bytes.

No class holds a state. There is no attribute in the three which work, and the two which carry data are made, handed over and dropped. What a place is and what it holds is on the disk, and it is read again at every request: that is RO5 written as a diagram, and it is why two callers in two processes need to know nothing of each other.

In yUML

To be read at yuml.me, class diagram.

[DepositSpace|what_is_accepted();ask_for_a_place();put();address_of();serve();forget()]

[DepositSpace]++1-1>[SpaceAcceptance|what_is_accepted();accepts_size();accepts_volume();accepts_one_more_place()]
[DepositSpace]++1-1>[SpaceFolder|make_a_place();places();delete();make_a_file();files();volume();read()]
[DepositSpace]++1-1>[FileAddress|address_of();what_it_names()]

[Place|name;/moment|a_name_for();moment();is_of_this_hour()]++1-0..*>[PlacedFile|place;name]

[SpaceFolder]-.->[Place]
[SpaceFolder]-.->[PlacedFile]
[FileAddress]-.->[Place]
[FileAddress]-.->[PlacedFile]

The sequences

When a caller deposits

1. It asks what is accepted, and is answered a size, a volume and a number.
2. It asks for a place. Either it is given a name, or it is refused with the hour at which there will be room, and it stops there.
3. It gives a file, with the name it is to stand under. The size is judged, the volume of the place is summed and judged, the file is made under that name — or the name was taken, and it is told so.
4. It gives the next file, and the next, one call each.
5. It asks for the address of one of them, and is given one which authorises reaching it. Or the place is gone, and there is no address.

When a request arrives at an address

1. The front of the machine verifies what authorises the address, and lets nothing through without it.
2. What the address names is read: a place and a name.
3. The moment of the place is read from its name. It is of this hour, or nothing at all is answered.
4. The file is opened. It is there, or nothing at all is answered.
5. The bytes are given.

Each of the two begins with the forgetting, which is in neither list because it is in every step of both: it is the first task of each call, and the caller neither asks for it nor is told of it.

The error policy

A file which stands under its name and is short is none of the three: nothing looks for it, nothing repairs it, and the place it stands in dies at its hour. The operational model says why.

How to read them

pre is what has to be true on the way in, and what the operation does not check; post is what the caller can count on without looking. The operations are named by what they do and not by a signature: a signature invented before the code is a name nobody will use.

What holds everywhere

• The forgetting has run before any operation of the façade answers. No caller asks for it, and no operation is answered on a place which has outlived its duration.
• What is absent gives back an empty thing — an empty list, a volume of zero — and never nothing at all. The one exception is what an address names, where nothing at all is the answer and is meant.
• Only SpaceFolder touches a disk, and it is the only class which knows where the space stands.
• Nothing reads a content. The bytes are written as they are given and given back as they are written.
• No class holds anything between two calls. Every operation reads what it needs and keeps none of it.
• A refusal is answered. What the machine will not do is raised, caught by whatever answers a request, and no class below it writes a catch.

Class by class

This class is where the tasks of one procedure are put in order, and it is the only class of this domain which anything outside it holds. What it promises is the six operations of the model, one for one.

It reads no disk, writes nothing, and makes no name. Every bound of this domain is therefore verified with nothing installed, which makes it the first class to be tested and the last to surprise.

Making a place and making a file do not look before they make: each of them either makes the thing or says that the name is taken, which is what turns C8 from a control into a property. This class judges no bound: what it is asked to make has been judged before.

It never touches a disk and never reads a moment. Whether a place is of this hour is read from its name, by the façade, and never taken from what authorises an address: the two know nothing of each other, and RO3 is that.

Where each constraint is held

One place each, and a constraint held in two would be a constraint held in neither.

Without a disk

Nothing is installed, nothing is written, nothing waits.

TE5 is where the physical level pays. The moment is in the name, so a place of any age is a name written by the test, and the minute on either side of the bound is where the two are separated. No clock is faked and nothing waits thirty minutes.

TE2 to TE4 are the whole of what SpaceAcceptance does, and they run on a machine where no space has ever stood.

With a disk

On a space of its own, made for the test and deleted with it.

TE13, TE14 and TE15 are the three to write first, being what the levels above lean on: the cascade of the logical level seen on a disk, and the making which a name refuses, twice.

TE16 checks an order and not a bound. A test which found a file written and then removed would have found the tasks reversed: the judging comes before the writing, and the dossier says so before the code does.

TE19 is the test this design rests on. A door which is not tested is a consigne.

What only two at once show

Three things cannot be seen by one request, and they are exactly the three the operational model settled.

TE21 says that the overshoot happens, and does not forbid it. A test which demanded exactness there would be a test written against the design, and it is the design which would have to be answered, not the test.

What no test covers, and where they stand

• A file left short by a request which died in the middle of writing it. Nothing looks for it, by decision: the place dies at its hour with what it holds, and a test would have to assert the absence of a thing nothing is asked to detect.
• What authorises an address, which the front of the machine makes and verifies. Its secret and its lifetime are not this domain's; TE9 checks the only thing which is — that the lifetime is never the shorter of the two.
• A disk which fills. It is raised and not answered, and what catches it is whatever answers a request.
• The routing of a request under the prefix of the space, which belongs to whoever assembles the server.

The tests stand beside the code, in the folder of this service, and none of them needs a server, a browser or a person. Nine need nothing at all, ten need a disk, three need two things running at once — which is what the cutting into three modules was for.

The four values

What the levels above do not determine, written here alone: a value written twice is a value which will differ from itself.

D1. A place lives thirty minutes. Taken at the judgment of the moment. What authorises reaching a file is set from it and never the other way round, and never below it (C3): a signature which expires first would leave a file standing which nothing can reach any more.

D2. A file does not exceed ten megabytes. This one is not chosen: the front server of the machine refuses beyond, and its configuration is not ours. A file of twelve megabytes has been tried, and it does not pass. The day the host changes, this value changes and nothing else does.

D3. One place does not exceed a hundred megabytes. Taken at the judgment of the moment.

D4. The space holds ten places. Taken at the judgment of the moment, and it is what bounds the space: ten places of a hundred megabytes, and no more. Without it, whoever asks opens places until the disk gives out, every one of them within its own bound.

Three of the four are ours and change by changing a line. The fourth is not ours. None of them belongs to the model: a value which moves is not a rule.

What this dossier owes

The levels are written, the classes are drawn, what they promise is said, and what is tested is named. One thing is still owed, and it comes before a line is written: a reading of what the spin-off already answers. Its code holds a place, a lifetime and a sweep which runs at every request, and it has been running; what this dossier asks for beyond it is a name of its own, a moment carried by a name, and the cutting into three.

One thing is settled and should not be reopened without a reason: this domain has no interface. What a person sees of a deposit — what may be given, what was refused and why, what was produced and what it came from — is shown by whoever calls, because it is that one which knows what the files are.