@amritk/nish-x86_64-linux 0.18.0 → 0.20.0

package/std/net/http2.ts

@@ -25,12 +25,15 @@
  *
  * **Events.** `next()` reads the frames `feed` handed it and answers the
  * first that means something to the program: `H2_REQUEST` (a stream opened
- * with a request's header section; `fields` holds it), `H2_DATA` (some of a
- * request body, a window onto the input buffer that stays valid until the
- * next `feed`), `H2_TRAILERS`, `H2_RESET` (the stream is gone: the peer reset
- * it, or broke a rule that resets it — `errorCode` says which), `H2_WINDOW`
- * (a send window that held `writeData` back has opened: `stream`, or 0 for the
- * connection's), `H2_GOAWAY` (the peer is going away; `lastStreamId`), and
+ * with a request's header section; `fields` holds it until the next header
+ * block on the connection is read, for any stream, and a program copies what
+ * it keeps past that: the next block empties `fields` and reuses the arrays
+ * it pointed into), `H2_DATA` (some of a request body, a window onto the input
+ * buffer that stays valid until the next `feed`), `H2_TRAILERS`, `H2_RESET`
+ * (the stream is gone: the peer reset it, or broke a rule that resets it —
+ * `errorCode` says which), `H2_WINDOW` (a send window that held `writeData`
+ * back has opened: `stream`, or 0 for the connection's), `H2_GOAWAY` (the
+ * peer is going away; `lastStreamId`), and
  * `H2_ERROR`, final: the connection broke a rule, a GOAWAY with `errorCode`
  * is queued, and every later call answers it again. `H2_NEED_MORE` asks for
  * more input, or for the output to drain: a frame is read only while the
@@ -50,24 +53,34 @@
  * (COMPRESSION_ERROR, RFC 7541 §2.3.2); DATA past the connection window, or a
  * window pushed past 2^31 − 1 (FLOW_CONTROL_ERROR, §6.9); a setting
  * `http2SettingError` refuses; a header block longer than `maxHeaderBlock`
- * or cut into more than `H2_MAX_FRAGMENTS` frames, and more streams reset by
- * the peer than `resetBudget` allows (ENHANCE_YOUR_CALM, §10.5). A stream
- * error resets one stream and the connection lives: a malformed request — any
- * refusal of `nish/net/http-fields`, trailers without END_STREAM, a body that
- * disagrees with `content-length` (PROTOCOL_ERROR, §8.1.1); DATA or HEADERS
- * after the peer ended the stream (STREAM_CLOSED, §5.1); DATA past the
- * stream's window, or its window pushed past 2^31 − 1 (FLOW_CONTROL_ERROR);
- * a stream past `maxStreams` (REFUSED_STREAM, §5.1.2); a stream that depends
- * on itself and a PRIORITY of the wrong length. A request whose header list
- * is longer than `maxHeaderListSize` is answered with a 431 and never reaches
- * the program (§10.5.1).
+ * or cut into more than `H2_MAX_FRAGMENTS` frames, a header block that would
+ * make the HPACK table copy past its budget (`HPACK_ERR_COPY_BUDGET`), and
+ * more streams reset than `resetBudget` allows — by the peer, or by the
+ * server for a stream error the peer caused (ENHANCE_YOUR_CALM, §10.5). A
+ * stream error resets one stream and the connection lives: a malformed request
+ * — any refusal of `nish/net/http-fields`, trailers without END_STREAM, a body
+ * that disagrees with `content-length` (PROTOCOL_ERROR, §8.1.1); DATA or
+ * HEADERS after the peer ended the stream (STREAM_CLOSED, §5.1); DATA past the
+ * stream's window, or its window pushed past 2^31 − 1 (FLOW_CONTROL_ERROR); a
+ * stream past `maxStreams` (REFUSED_STREAM, §5.1.2); a stream that depends on
+ * itself and a PRIORITY of the wrong length. A request whose header list is
+ * longer than `maxHeaderListSize` is answered with a 431 and never reaches the
+ * program (§10.5.1).
  *
  * **Caps are start-up numbers**, all in `Http2Config`: the streams open at
  * once, the windows, the largest frame and header block accepted, the header
- * list, the output buffer and the reset budget. Every buffer and every
- * stream slot is allocated by the constructor; reading DATA, writing DATA and
- * every control frame allocate nothing. A header block does allocate, through
- * `HpackDecoder` (`docs/security/http2.md`, H2-1).
+ * list, the output buffer and the reset budget. Every stream slot is
+ * allocated by the constructor; the input, output and header-block buffers
+ * are borrowed from an `Http2Pools` when first needed and given back, zeroed
+ * as far as they were written, once each is empty or the connection ends, so
+ * an idle connection holds none. A server shares one `Http2Pools` among its
+ * slots; a connection on its own makes a private one that holds one buffer of
+ * each. Once the pools are warm, reading DATA, writing DATA and every control
+ * frame allocate nothing, and neither does a header block once the
+ * decoder's arrays have grown to the largest block and header list seen: it
+ * decodes into storage the connection owns, bounded by `maxHeaderBlock` and
+ * `maxHeaderListSize` whether the stream is opened, refused or reset
+ * (`docs/security/http2.md`, H2-1).
  *
  * The server sends no PUSH_PROMISE and no PRIORITY, and reads PRIORITY only to
  * check it: RFC 9113 §5.3.2 deprecates the scheme. Every field it sends is a
@@ -80,10 +93,18 @@
  * Private helpers share the importing program's flat symbol namespace
  * (`docs/wp26-stdlib.md` §3e), which is why each one carries the module's name.
  *
+ * **The Date.** A final response carries the `date` in `conn.date`, 29
+ * bytes of IMF-fixdate, right after `:status`, unless the program's fields
+ * hold their own; a 1xx and trailers carry none. A bare connection has no
+ * clock, so `date` starts empty and nothing is sent; `Http2TlsServer` fills
+ * it from its `HttpDate` (RFC 9110 §6.6.1).
+ *
  * Written from RFC 9113 and RFC 8441, not ported from another implementation.
  */
+import { BufferPool } from "nish/net/buffer-pool"
 import {
   HPACK_DEFAULT_TABLE_SIZE,
+  HPACK_ERR_COPY_BUDGET,
   HPACK_INDEX_NEVER,
   HPACK_INDEX_WITHOUT,
   HPACK_LIST_TOO_LARGE,
@@ -238,10 +259,46 @@ export class Http2Config {
   enableConnectProtocol: boolean = false
   /** The output buffer, in bytes. */
   outputSize: i32 = 65536
-  /** How many streams the peer may reset before finishing, net of the ones it lets finish. */
+  /**
+   * How many streams may be reset — by the peer, or by the server for a
+   * stream error the peer caused — net of the ones the server finishes.
+   */
   resetBudget: i32 = 100
 }
 
+/**
+ * The three buffers a connection borrows — its input, its output and the
+ * header block it gathers — as one pool each, sized from one `Http2Config`.
+ * `Http2TlsServer` owns one with a ceiling of its slot count and shares it
+ * with every slot; a bare connection makes its own, of ceiling 1, the first
+ * time it needs a buffer.
+ */
+export class Http2Pools {
+  /** `maxFrameSize` and a frame header: the largest frame `next` reads. */
+  input: BufferPool
+  /** `outputSize`. */
+  output: BufferPool
+  /** `maxHeaderBlock`. */
+  block: BufferPool
+
+  /** Pools of at most `ceiling` buffers each, for connections under `config`; `name` prefixes each pool's own. Allocates no buffer. */
+  constructor(name: string, config: Http2Config, ceiling: i32) {
+    this.input = new BufferPool(`${name}.input`, config.maxFrameSize + H2_FRAME_HEADER_SIZE, ceiling)
+    this.output = new BufferPool(`${name}.output`, config.outputSize, ceiling)
+    this.block = new BufferPool(`${name}.block`, config.maxHeaderBlock, ceiling)
+  }
+
+  /** How many buffers of the three kinds are lent now. */
+  lent(): i32 {
+    return this.input.lent() + this.output.lent() + this.block.lent()
+  }
+
+  /** How many buffers of the three kinds have ever been made. */
+  made(): i32 {
+    return this.input.made + this.output.made + this.block.made
+  }
+}
+
 /** One stream's slot. `id` is 0 while the slot is free. */
 export class Http2Stream {
   /** What the server may still send on the stream. */
@@ -302,6 +359,21 @@ const http2CheckWindow = (what: string, buf: u8[], off: i32, len: i32): void =>
   }
 }
 
+/** Whether one of `names` is `date` in any ASCII case (RFC 9110 §5.1). */
+const http2NamesHoldDate = (names: u8[][]): boolean => {
+  // An ASCII letter's case is its 0x20 bit, and every octet of `date` is a letter.
+  const bit: i32 = 32
+  for (const name of names) {
+    if (toI32(name.length) === 4) {
+      const d: boolean = (toI32(name[0]) | bit) === 100 && (toI32(name[1]) | bit) === 97
+      if (d && (toI32(name[2]) | bit) === 116 && (toI32(name[3]) | bit) === 101) {
+        return true
+      }
+    }
+  }
+  return false
+}
+
 /** Panics unless `value` lies in `[low, high]`: a cap out of range is the program's mistake. */
 const http2CheckCap = (what: string, value: i32, low: i32, high: i32): void => {
   if (value < low || value > high) {
@@ -318,6 +390,12 @@ export class Http2Connection {
   // order the layout packs without padding.
   config: Http2Config
   frame: Http2Frame
+  /**
+   * Where `input`, `output` and `block` are borrowed from: the server's, or
+   * a pool of one of each the connection makes itself when it first needs a
+   * buffer. A buffer the connection does not hold is `empty`.
+   */
+  pools: Http2Pools | null = null
   /** Bytes fed and not read yet are `input[inputStart .. inputEnd)`. */
   input: u8[]
   /** Bytes to send are `output[outputStart .. outputEnd)`. */
@@ -328,7 +406,11 @@ export class Http2Connection {
   encoded: u8[]
   decoder: HpackDecoder
   encoder: HpackEncoder
-  /** The last request's or trailers' fields. */
+  /**
+   * The last request's or trailers' fields, valid until the next header block
+   * on the connection, for any stream: that block empties them and reuses
+   * their arrays, so a program copies what it keeps (`docs/security/http2.md`, H2-1).
+   */
   fields: HttpFields
   streams: Http2Stream[]
   /** The identifiers the server reset most recently, a ring. */
@@ -338,8 +420,20 @@ export class Http2Connection {
   /** The bytes of `:status` and of a three-digit status, reused for every response. */
   statusName: u8[]
   statusValue: u8[]
-  /** GOAWAY's debug data, which the server never sends: one empty array, made once. */
-  noDebug: u8[]
+  /**
+   * The `date` every final response carries (RFC 9110 §6.6.1), as the 29
+   * bytes of an IMF-fixdate, or empty for none. A bare connection has no
+   * clock, so it starts empty; `Http2TlsServer` points it at its `HttpDate`'s
+   * bytes, which that rewrites in place once a second.
+   */
+  date: u8[]
+  /** The bytes of `date`, the field's name, made once. */
+  dateName: u8[]
+  /**
+   * One empty array, made once: GOAWAY's debug data, which the server never
+   * sends, and `input`, `output` and `block` while the connection holds none.
+   */
+  empty: u8[]
   /** The server's SETTINGS, made once and sent by every `restart`. */
   settingIds: i32[]
   settingValues: i64[]
@@ -388,6 +482,10 @@ export class Http2Connection {
   lastStreamId: i32 = 0
   /** The last stream identifier the server's first GOAWAY named, which no later one may raise (§6.8). */
   sentLast: i32 = 0
+  /** How far into `input`, `output` and `block` the connection has written since it borrowed each: what giving it back zeroes. */
+  inputUsed: i32 = 0
+  outputUsed: i32 = 0
+  blockUsed: i32 = 0
   blockEndStream: boolean = false
   /** Whether the peer has acknowledged the server's SETTINGS. */
   settingsAcked: boolean = false
@@ -401,12 +499,17 @@ export class Http2Connection {
   endStream: boolean = false
   /** Whether H2_RESET came from the peer's RST_STREAM rather than a rule its stream broke. */
   resetByPeer: boolean = false
+  /** The server's SETTINGS are not written yet: the first `holdOutput` writes them. */
+  prefaceOwed: boolean = false
 
   /**
-   * A connection under `config`, with its SETTINGS — and the WINDOW_UPDATE
+   * A connection under `config`, owing its SETTINGS — and the WINDOW_UPDATE
    * that raises the connection's window, when `connectionWindowSize` asks
-   * for one — already in `output`, since a server's preface is its SETTINGS
-   * (§3.4). A cap outside what RFC 9113 allows panics.
+   * for one — since a server's preface is its SETTINGS (§3.4): the first
+   * `wantsWrite`, `next` or response writes them into `output`. It holds no
+   * buffer until then, so `output` is empty after the constructor and after
+   * `restart`: a caller that reads `output` itself calls `wantsWrite` first.
+   * A cap outside what RFC 9113 allows panics.
    */
   constructor(config: Http2Config) {
     http2CheckCap("maxStreams", config.maxStreams, 1, 65536)
@@ -420,9 +523,10 @@ export class Http2Connection {
     http2CheckCap("resetBudget", config.resetBudget, 0, H2_MAX_WINDOW)
     this.config = config
     this.frame = new Http2Frame()
-    this.input = new Array<u8>(config.maxFrameSize + H2_FRAME_HEADER_SIZE)
-    this.output = new Array<u8>(config.outputSize)
-    this.block = new Array<u8>(config.maxHeaderBlock)
+    this.empty = []
+    this.input = this.empty
+    this.output = this.empty
+    this.block = this.empty
     this.encoded = []
     this.decoder = new HpackDecoder(HPACK_DEFAULT_TABLE_SIZE, config.maxHeaderListSize)
     this.encoder = new HpackEncoder(HPACK_DEFAULT_TABLE_SIZE)
@@ -434,9 +538,10 @@ export class Http2Connection {
     this.resets = new Array<i32>(config.maxStreams + H2_RECENT_RESETS)
     this.closed = new Array<i32>(config.maxStreams + H2_RECENT_RESETS)
     this.statusName = httpFieldBytes(":status")
-    this.noDebug = []
     this.statusValue = [48, 48, 48]
-    this.data = this.input
+    this.date = []
+    this.dateName = httpFieldBytes("date")
+    this.data = this.empty
     this.settingIds = [
       H2_SETTINGS_HEADER_TABLE_SIZE,
       H2_SETTINGS_MAX_CONCURRENT_STREAMS,
@@ -460,18 +565,14 @@ export class Http2Connection {
 
   /**
    * Puts the connection back as the constructor left it, for the next peer:
-   * every stream closed, both HPACK tables empty, and the server's SETTINGS
-   * in `output` again. It allocates nothing, which is what lets a carrier
-   * reuse one connection per slot (WP34 N9).
+   * every stream closed, both HPACK tables empty, every buffer given back,
+   * and the server's SETTINGS owed again. It allocates nothing, which is what
+   * lets a carrier reuse one connection per slot (WP34 N9).
    */
   restart(): void {
     const config: Http2Config = this.config
-    this.inputStart = 0
-    this.inputEnd = 0
-    this.outputStart = 0
-    this.outputEnd = 0
-    this.blockLength = 0
-    this.blockStream = 0
+    // Gives every buffer back and zeroes the cursors over them.
+    this.drop()
     this.blockEndStream = false
     this.blockError = 0
     this.blockFragments = 0
@@ -515,18 +616,127 @@ export class Http2Connection {
     const big: i64 = toI64(H2_DEFAULT_WINDOW)
     this.localInitialWindow = toI64(config.initialWindowSize) > big ? toI64(config.initialWindowSize) : big
     this.recvWindow = toI64(config.connectionWindowSize)
-    this.outputEnd = http2WriteSettings(this.output, H2_ZERO, this.settingIds, this.settingValues)
-    const raise: i32 = config.connectionWindowSize - H2_DEFAULT_WINDOW
-    if (raise > 0) {
-      this.outputEnd = http2WriteWindowUpdate(this.output, this.outputEnd, H2_ZERO, raise)
+    this.prefaceOwed = true
+  }
+
+  // ---- Borrowed buffers ---------------------------------------------------------
+
+  /** The pools the connection borrows from, made at ceiling 1 the first time a bare connection asks. */
+  lender(): Http2Pools {
+    const pools: Http2Pools | null = this.pools
+    if (pools !== null) {
+      return pools
+    }
+    const own: Http2Pools = new Http2Pools("Http2Connection", this.config, 1)
+    this.pools = own
+    return own
+  }
+
+  /** Borrows `input` unless the connection holds it. */
+  holdInput(): void {
+    if (this.input.length === 0) {
+      this.input = this.lender().input.take()
+      this.inputUsed = 0
     }
   }
 
+  /** Borrows `output` unless the connection holds it, and writes the SETTINGS it owes. */
+  holdOutput(): void {
+    if (this.output.length === 0) {
+      this.output = this.lender().output.take()
+      this.outputUsed = 0
+    }
+    if (this.prefaceOwed) {
+      this.prefaceOwed = false
+      this.wrote(http2WriteSettings(this.output, this.outputEnd, this.settingIds, this.settingValues))
+      const raise: i32 = this.config.connectionWindowSize - H2_DEFAULT_WINDOW
+      if (raise > 0) {
+        this.wrote(http2WriteWindowUpdate(this.output, this.outputEnd, H2_ZERO, raise))
+      }
+    }
+  }
+
+  /** Borrows `block` unless the connection holds it. */
+  holdBlock(): void {
+    if (this.block.length === 0) {
+      this.block = this.lender().block.take()
+      this.blockUsed = 0
+    }
+  }
+
+  /** Gives `input` back, zeroing what was written into it; ends the last H2_DATA's window. */
+  giveInput(): void {
+    if (this.input.length > 0) {
+      this.lender().input.give(this.input, this.inputUsed)
+      this.input = this.empty
+    }
+    this.inputStart = 0
+    this.inputEnd = 0
+    this.inputUsed = 0
+    this.data = this.empty
+    this.dataStart = 0
+    this.dataLength = 0
+  }
+
+  /** Gives `output` back, zeroing what was written into it, sent or not. */
+  giveOutput(): void {
+    if (this.output.length > 0) {
+      this.lender().output.give(this.output, this.outputUsed)
+      this.output = this.empty
+    }
+    this.outputStart = 0
+    this.outputEnd = 0
+    this.outputUsed = 0
+  }
+
+  /** Gives `block` back, zeroing what was gathered into it. */
+  giveBlock(): void {
+    if (this.block.length > 0) {
+      this.lender().block.give(this.block, this.blockUsed)
+      this.block = this.empty
+    }
+    this.blockLength = 0
+    this.blockUsed = 0
+  }
+
+  /**
+   * Gives back every buffer the connection holds and does not need: the
+   * input once all of it is read, which ends the last H2_DATA's window; the
+   * output once all of it is sent; the header block while none is open. A
+   * carrier calls it once the program is done with the last event, so a
+   * connection waiting on its peer holds no buffer.
+   */
+  rest(): void {
+    if (this.inputEnd === this.inputStart) {
+      this.giveInput()
+    }
+    if (this.outputEnd === this.outputStart) {
+      this.giveOutput()
+    }
+    if (this.blockStream === 0) {
+      this.giveBlock()
+    }
+  }
+
+  /**
+   * Ends the connection where it stands, for a carrier that closes it: every
+   * buffer is given back, zeroed, with what was unread or unsent, and the
+   * connection answers H2_ERROR until `restart`. `errorCode` is left as it was.
+   */
+  drop(): void {
+    this.giveInput()
+    this.giveOutput()
+    this.blockStream = 0
+    this.giveBlock()
+    this.prefaceOwed = false
+    this.state = H2_STATE_FAILED
+  }
+
   // ---- Bytes in and out ---------------------------------------------------------
 
   /** How many bytes `feed` would take now. */
   inputRoom(): i32 {
-    return toI32(this.input.length) - (this.inputEnd - this.inputStart)
+    return this.config.maxFrameSize + H2_FRAME_HEADER_SIZE - (this.inputEnd - this.inputStart)
   }
 
   /**
@@ -547,6 +757,7 @@ export class Http2Connection {
       this.input[this.inputEnd + k] = buf[off + k]
     }
     this.inputEnd = this.inputEnd + n
+    this.inputUsed = this.inputEnd > this.inputUsed ? this.inputEnd : this.inputUsed
     return n
   }
 
@@ -556,6 +767,7 @@ export class Http2Connection {
    * straight into `input` from `inputEnd`, then `received` what it read.
    */
   inputTail(): i32 {
+    this.holdInput()
     this.inputEnd = http2Compact(this.input, this.inputStart, this.inputEnd)
     this.inputStart = 0
     return toI32(this.input.length) - this.inputEnd
@@ -567,23 +779,27 @@ export class Http2Connection {
     if (n < 0 || n > room) {
       panic(`Http2Connection.received: ${n} bytes into ${room} of room`)
     }
+    // A carrier's read wrote them whatever the state, so they are zeroed when the input goes back.
+    this.inputUsed = this.inputEnd + n > this.inputUsed ? this.inputEnd + n : this.inputUsed
     if (this.state !== H2_STATE_FAILED) {
       this.inputEnd = this.inputEnd + n
     }
   }
 
-  /** Marks the first `n` bytes of the output sent. */
+  /** Marks the first `n` bytes of the output sent; once all of it is, the output goes back to its pool. */
   consume(n: i32): void {
     const pending: i32 = this.outputEnd - this.outputStart
     this.outputStart = this.outputStart + (n < pending ? n : pending)
     if (this.outputStart === this.outputEnd) {
-      this.outputStart = 0
-      this.outputEnd = 0
+      this.giveOutput()
     }
   }
 
-  /** Whether the output holds bytes to send. */
+  /** Whether the output holds bytes to send; the SETTINGS a fresh connection owes are written first. */
   wantsWrite(): boolean {
+    if (this.prefaceOwed) {
+      this.holdOutput()
+    }
     return this.outputEnd > this.outputStart
   }
 
@@ -611,6 +827,7 @@ export class Http2Connection {
 
   /** The room left at the end of the output, once what was sent is moved out of the way. */
   room(): i32 {
+    this.holdOutput()
     this.outputEnd = http2Compact(this.output, this.outputStart, this.outputEnd)
     this.outputStart = 0
     return toI32(this.output.length) - this.outputEnd
@@ -626,6 +843,7 @@ export class Http2Connection {
   wrote(end: i32): boolean {
     if (end >= 0) {
       this.outputEnd = end
+      this.outputUsed = end > this.outputUsed ? end : this.outputUsed
     }
     return end >= 0
   }
@@ -725,10 +943,30 @@ export class Http2Connection {
     return true
   }
 
-  /** A stream error on `s`: resets it, and answers the H2_RESET that tells the program. */
+  /**
+   * Charges one stream the peer had reset to the reset budget, whichever side
+   * sent the RST_STREAM: a client that cannot send one itself provokes the
+   * server into it (MadeYouReset, CVE-2025-8671). Answers H2_NEED_MORE, or
+   * once the budget is spent the connection error ENHANCE_YOUR_CALM (§10.5).
+   */
+  chargeReset(): i32 {
+    this.resetCredit = this.resetCredit - 1
+    return this.resetCredit < 0 ? this.fail(H2_ENHANCE_YOUR_CALM) : H2_NEED_MORE
+  }
+
+  /** A stream error the peer caused on `id`, which the program never saw: resets it and charges the budget. */
+  refuseStream(id: i32, code: i32): i32 {
+    this.resetStream(id, code)
+    return this.chargeReset()
+  }
+
+  /** A stream error on `s`: resets it, charges the budget, and answers the H2_RESET that tells the program. */
   streamError(s: Http2Stream, code: i32): i32 {
     const id: i32 = s.id
-    this.resetStream(id, code)
+    const charged: i32 = this.refuseStream(id, code)
+    if (charged !== H2_NEED_MORE) {
+      return charged
+    }
     this.stream = id
     this.errorCode = toI64(code)
     this.resetByPeer = false
@@ -744,7 +982,7 @@ export class Http2Connection {
     const last: i32 = this.goawaySent ? this.sentLast : this.lastPeerStream
     if (
       !this.wrote(
-        http2WriteGoaway(this.output, this.outputEnd, last, toI64(code), this.noDebug, H2_ZERO, H2_ZERO)
+        http2WriteGoaway(this.output, this.outputEnd, last, toI64(code), this.empty, H2_ZERO, H2_ZERO)
       )
     ) {
       return false
@@ -909,10 +1147,7 @@ export class Http2Connection {
     this.recvWindow = this.recvWindow - toI64(size)
     if (s === null) {
       this.credit(null, size)
-      if (!this.discarded(id)) {
-        this.resetStream(id, H2_STREAM_CLOSED)
-      }
-      return H2_NEED_MORE
+      return this.discarded(id) ? H2_NEED_MORE : this.refuseStream(id, H2_STREAM_CLOSED)
     }
     const end: boolean = f.has(H2_FLAG_END_STREAM)
     const received: i64 = s.received + toI64(f.contentLength)
@@ -947,6 +1182,7 @@ export class Http2Connection {
 
   /** Appends a fragment of a header block; a block past `maxHeaderBlock` or `H2_MAX_FRAGMENTS` ends the connection. */
   gather(f: Http2Frame): boolean {
+    this.holdBlock()
     this.blockFragments = this.blockFragments + 1
     if (
       this.blockFragments > H2_MAX_FRAGMENTS ||
@@ -958,6 +1194,7 @@ export class Http2Connection {
       this.block[this.blockLength + k] = this.input[f.contentStart + k]
     }
     this.blockLength = this.blockLength + f.contentLength
+    this.blockUsed = this.blockLength > this.blockUsed ? this.blockLength : this.blockUsed
     return true
   }
 
@@ -990,9 +1227,15 @@ export class Http2Connection {
   endBlock(): i32 {
     const id: i32 = this.blockStream
     this.blockStream = 0
+    // The decoder takes back the arrays the last request's fields point into,
+    // so those fields go first: a stale read finds nothing, never this block's octets.
+    this.fields.clear()
     const decoded: i32 = this.decoder.decode(this.block, H2_ZERO, this.blockLength)
+    // The decoder copied every field out, so the block goes back before the request is read.
+    this.giveBlock()
     if (decoded < 0) {
-      return this.fail(H2_COMPRESSION_ERROR)
+      // A block past the decoder's copy budget is valid HPACK used as a lever, not a broken one (§10.5).
+      return this.fail(decoded === HPACK_ERR_COPY_BUDGET ? H2_ENHANCE_YOUR_CALM : H2_COMPRESSION_ERROR)
     }
     const s: Http2Stream | null = this.find(id)
     if (s !== null) {
@@ -1012,16 +1255,14 @@ export class Http2Connection {
       return H2_NEED_MORE
     }
     if (this.blockError !== 0) {
-      this.resetStream(id, this.blockError)
-      return H2_NEED_MORE
+      return this.refuseStream(id, this.blockError)
     }
     if (decoded === HPACK_LIST_TOO_LARGE) {
       this.tooLarge(id)
-      return H2_NEED_MORE
+      return this.chargeReset()
     }
     if (this.active >= this.config.maxStreams) {
-      this.resetStream(id, H2_REFUSED_STREAM)
-      return H2_NEED_MORE
+      return this.refuseStream(id, H2_REFUSED_STREAM)
     }
     const shape: i32 = this.fields.readRequest(
       this.decoder.names,
@@ -1029,8 +1270,7 @@ export class Http2Connection {
       this.config.enableConnectProtocol
     )
     if (shape !== HTTP_FIELDS_OK || (this.blockEndStream && this.fields.contentLength > toI64(0))) {
-      this.resetStream(id, H2_PROTOCOL_ERROR)
-      return H2_NEED_MORE
+      return this.refuseStream(id, H2_PROTOCOL_ERROR)
     }
     const opened: Http2Stream = this.open(id)
     opened.contentLength = this.fields.contentLength
@@ -1070,7 +1310,8 @@ export class Http2Connection {
    * sending (§8.1), so the stream never reaches the program.
    */
   tooLarge(id: i32): void {
-    this.encodeStatus(H2_STATUS_TOO_LARGE)
+    // The control reserve holds this with its date: under fifty bytes.
+    this.encodeStatus(H2_STATUS_TOO_LARGE, true)
     const n: i32 = toI32(this.encoded.length)
     this.wrote(
       http2WriteHeaders(
@@ -1089,8 +1330,14 @@ export class Http2Connection {
     }
   }
 
-  /** Empties `encoded` and starts a block with `:status`, or with nothing for 0 (trailers). */
-  encodeStatus(status: i32): void {
+  /**
+   * Empties `encoded` and starts a block with `:status`, or with nothing for
+   * 0 (trailers), then with `date` when `withDate` and the status is final.
+   * Both are literals without indexing, so the dynamic table never moves:
+   * `date` is the static table's name 33 and a value of 29 bytes, in Huffman
+   * when that is shorter.
+   */
+  encodeStatus(status: i32, withDate: boolean): void {
     while (toI32(this.encoded.length) > 0) {
       this.encoded.pop()
     }
@@ -1100,6 +1347,12 @@ export class Http2Connection {
       this.statusValue[2] = toU8((status % 10) + H2_DIGIT_ZERO)
       this.encoder.encodeField(this.encoded, this.statusName, this.statusValue, HPACK_INDEX_WITHOUT, false)
     }
+    if (withDate && status >= 200 && toI32(this.date.length) > 0) {
+      const huffman: boolean =
+        hpackHuffmanLength(this.encoder.huffman, this.date, H2_ZERO, toI32(this.date.length)) <
+        toI32(this.date.length)
+      this.encoder.encodeField(this.encoded, this.dateName, this.date, HPACK_INDEX_WITHOUT, huffman)
+    }
   }
 
   /** PRIORITY (§6.3): checked and otherwise ignored, and it opens nothing. */
@@ -1111,8 +1364,7 @@ export class Http2Connection {
     if (s !== null) {
       return this.streamError(s, f.streamError)
     }
-    this.resetStream(f.streamId, f.streamError)
-    return H2_NEED_MORE
+    return this.refuseStream(f.streamId, f.streamError)
   }
 
   /** RST_STREAM (§6.4): the stream is closed; on an idle one it is a connection error. */
@@ -1125,9 +1377,9 @@ export class Http2Connection {
       return H2_NEED_MORE
     }
     this.release(s)
-    this.resetCredit = this.resetCredit - 1
-    if (this.resetCredit < 0) {
-      return this.fail(H2_ENHANCE_YOUR_CALM)
+    const charged: i32 = this.chargeReset()
+    if (charged !== H2_NEED_MORE) {
+      return charged
     }
     this.stream = f.streamId
     this.errorCode = f.errorCode
@@ -1263,12 +1515,18 @@ export class Http2Connection {
     for (let k: i32 = 0; k < toI32(names.length) && k < toI32(values.length); k++) {
       bound = bound + toI64(names[k].length) + toI64(values[k].length) + toI64(11)
     }
+    // The server's `date` goes on a final response unless the program sent
+    // its own, so a response never carries two.
+    const withDate: boolean = status >= 200 && toI32(this.date.length) > 0 && !http2NamesHoldDate(names)
+    if (withDate) {
+      bound = bound + toI64(this.dateName.length) + toI64(this.date.length) + toI64(11)
+    }
     const frames: i64 = bound / toI64(this.peerMaxFrameSize) + toI64(1)
     const need: i64 = bound + frames * toI64(H2_FRAME_HEADER_SIZE)
     if (need > toI64(this.bodyRoom())) {
       return toI64(this.output.length) < need + toI64(H2_CONTROL_RESERVE) ? H2_INVALID : H2_AGAIN
     }
-    this.encodeStatus(status)
+    this.encodeStatus(status, withDate)
     for (let k: i32 = 0; k < toI32(names.length) && k < toI32(values.length); k++) {
       const value: u8[] = values[k]
       // One choice covers the name and the value, so Huffman is taken only