J3a: the journey on a server. A server per land (Lands: the hub starts land servers on demand over a private link), the cliff tunnel online, crossings with one-time passes, shared characters that remember their land, one clock from the hub; test_net_lands

docs/WORLDLETS_DESIGN.md

@@ -1,7 +1,44 @@
 # Worldlets design
 
-Status: **W0-W3 and J1 built** (the Cove without its stream yet; the
-tunnel single-player only); the rest is planned.
+Status: **W0-W3, J1 and J3a built**: the Cove (with its stream), the cliff
+tunnel, and the journey on a server (a server per land; chat and the
+player list across lands are J3b). The rest is planned.
+
+*As built in J3a (a server per land):*
+- `scripts/net/lands.gd` (autoload `Lands`): the server players join is the
+  hub. `Lands.ensure(land)` starts a land server (`--server --land cove
+  --port <hub+1..> --hub-port <hub>`, same config and world folder, output
+  to `land-<land>.log` beside server.json) and waits for it to say it's
+  listening. Hub and land servers talk over TCP on 127.0.0.1, port hub +
+  100, one JSON object per line: hello/ready, the player count, the clock
+  (the hub's, every 10 s: one clock everywhere), how far the tunnel's dug,
+  one-time passes, "stop", "host_left". A land server stops after 2 minutes
+  empty, when the hub stops, or if it loses the hub.
+- A land server's saves: `Saves.land` makes it load and save its own
+  worldlet's file (`worldlets/cove.json`) in the hub's world folder.
+  Characters (`players/<id>.json`) are shared, and say which land they're
+  in (`land`) and, mid-crossing, where they'll come out (`arrive`).
+- Crossing (`PlayerNet.cross`): the server saves the character as heading
+  there, makes sure the other server's up, and sends the game
+  `_s2c_travel {land, port, pass}`; the game drops the connection quietly
+  and joins that port with the pass (`Net.join(address, "", pass)`), checked
+  after the identity proof: a land server lets nobody in without one. The
+  world reloads on `Net.arrived`. Joining the hub when your character's in
+  another land sends you on there; a crossing that fails goes back to the
+  title. A hosted game: the host crossing doesn't stop the hub; the host
+  leaving the game from another land stops everything.
+- The tunnel online: built on the server and in every game. The server
+  decides blows on its faces (`"hit"` finds them by uid), props
+  (`"tunnel_prop"`), going in and out (`"tunnel_go"`: a server teleport;
+  the move check allows the tunnel only from inside it) and the crossings
+  (`"cross"`), and tells everyone how it stands (`_s2c_tunnel`; it's in the
+  shared state a joining player gets, and saved with the Valley).
+- `tests/test_net_lands.gd`: Alice digs and props online, lights it,
+  crosses to the Cove (bag and day kept) while Bob stays in the Valley,
+  comes back up, then leaves from the Cove and rejoining sends her there.
+- Next, J3b: chat, the player list (with where each player is) and admin
+  commands across lands; sleeping needs everyone in every land. J3c: a land
+  server crashing, the Host page's extra ports.
 
 *As built in J1:*
 - `scripts/world/tunnel.gd`: the seam (an outcrop on the clifftop strip,