@quo-systems/quo 0.2.9 → 0.2.11

package/dist/harbor/core.js

@@ -17,14 +17,25 @@
 // that arrive from the wire go to an own door or a held socket and never
 // onward by request or by fallback; that one rule is the rendezvous.
 import { Ward } from '../ward/ward.js';
+import { maker, entropy as random, learnPk } from '../ward/ground.js';
+import { silence } from '../being/silence.js';
 import { request } from './reach.js';
-import { openReply, wardSignPk } from '../ward/seal.js';
+import { isWardPk, openReply, wardSignPk } from '../ward/seal.js';
 import { concat, sealingPair, KEY } from '../ward/arithmetic.js';
 import { within, LATE } from '../ward/allowance.js';
 export const DEFAULT_CODE = 'classes/index.ts';
+// The device's entropy, spelled once. A harbor draws it for a ward's seed at
+// birth, for the lid of every probe it sends, and it hands the same function
+// to every ward it boots as the ground's `random`.
 // How long a probe waits for the door behind a claim. A claim that answers
 // nothing in this time is not bound; the next announce is another chance.
 const PROBE = 10_000;
+// How many pks one announce may claim, and how many are proven at once.
+const ANNOUNCE = 64;
+const PROVING = 8;
+// How many times each reach has announced: a proof from an older announce
+// binds nothing when it lands.
+const announces = new WeakMap();
 export class Harbor {
     store;
     loader;
@@ -33,7 +44,10 @@ export class Harbor {
     reaches = new Map(); // the directory: foreign ward pk -> reach
     down = new Set(); // pks this harbor will not reach right now: weather, for a test
     refused = new Map(); // own ward pk -> arrivals its door would not admit. what a terrain does with it is its own
+    faults = new Map(); // ward name -> saves the store refused. what a terrain does with it is its own
+    unbooted = []; // the wards the store keeps that would not host this run, by name
     classes = {}; // classes handed in-process, beside the loader's
+    #saving = new Map();
     // The dialers' sockets, in the order they were dialed: where a pk nobody
     // here knows is sent, because the listener a harbor dialed is a rendezvous
     // and may hold that pk for someone else. It is a list because a harbor may
@@ -58,16 +72,73 @@ export class Harbor {
         this.store = store;
         this.loader = loader;
     }
-    // Boot every ward the store keeps, and learn the hints.
+    // Boot every ward the store keeps, and learn the hints. One ward that will
+    // not host, a partition this kit cannot read or a loader that throws, is
+    // named in `unbooted` and takes nobody else down with it.
     async boot() {
         for (const name of await this.store.list()) {
-            const kept = await this.store.load(name);
-            if (kept)
-                await this.host(name, kept);
+            try {
+                const kept = await this.store.load(name);
+                if (kept)
+                    await this.host(name, kept);
+            }
+            catch {
+                this.unbooted.push(name);
+            }
         }
         for (const [pk, url] of Object.entries(await this.store.hints()))
             this.hint(pk, url);
     }
+    // The object a ward writes into, by the name it is kept under: the
+    // partition the harbor was handed at boot and keeps so it can save it.
+    // Nothing in the harbor reads it, and it is not on `Hosted`, because a
+    // side that holds a ward would then hold every seed in it and reach any
+    // being past every door. It is here for one reader, the conformance
+    // suite, whose census is ward state read straight and whose forgeries are
+    // ward state written straight, the way `MemoryHarbor.partitions` is. A
+    // side asks the ward.
+    partitionOf(name) {
+        return this.#saving.get(name)?.memory;
+    }
+    // ---- saving
+    // The ward wrote. Its partition is saved once the line is free, and once
+    // for every burst of writes, in the order the writes came.
+    #wrote(name) {
+        const s = this.#saving.get(name);
+        if (!s || s.gone)
+            return;
+        s.dirty = true;
+        if (s.timer === undefined)
+            s.timer = setTimeout(() => void this.#flush(name), 0);
+    }
+    async #flush(name) {
+        const s = this.#saving.get(name);
+        if (!s)
+            return;
+        if (s.timer !== undefined) {
+            clearTimeout(s.timer);
+            s.timer = undefined;
+        }
+        if (s.running)
+            return s.running;
+        s.running = (async () => {
+            while (s.dirty && !s.gone) {
+                s.dirty = false;
+                try {
+                    await this.store.save(name, s.memory);
+                }
+                catch {
+                    this.faults.set(name, (this.faults.get(name) ?? 0) + 1);
+                }
+            }
+        })();
+        try {
+            await s.running;
+        }
+        finally {
+            s.running = null;
+        }
+    }
     // ---- the directory
     // Bytes to one of this harbor's own doors, and the one bit the door says
     // beside its reply, counted.
@@ -103,8 +174,8 @@ export class Harbor {
         return bound?.held ? bound.reach.carry(pk, bytes) : undefined;
     }
     hint(pk, url) {
-        if (this.reaches.get(pk)?.held)
-            return; // a socket in hand beats a hint
+        if (this.reaches.has(pk))
+            return; // a reach proven at a door beats a hint, held or reached through a dialed line
         this.reaches.set(pk, { reach: request(url), held: false });
     }
     async remember(pk, url) {
@@ -119,13 +190,12 @@ export class Harbor {
     // signed by the ward key. Only the holder of that ward's seed can write
     // that reply, the lid is fresh so nothing replays, and a box that does not
     // open writes nothing at the ward. This is the one box a harbor ever opens,
-    // the one it sealed itself, and it reads nothing from it but that the
-    // signature is the claimed key's.
+    // the one it sealed itself, and it reads nothing from it but that it is
+    // the silence a door owes such a box, signed by the claimed key.
     async prove(pk, reach) {
-        if (!/^[0-9a-f]{128}$/.test(pk))
+        if (!isWardPk(pk))
             return false;
         try {
-            const random = (n) => globalThis.crypto.getRandomValues(new Uint8Array(n));
             const lid = await sealingPair(random(KEY));
             const back = await within(PROBE, reach.carry(pk, concat([lid.pk, random(KEY)])));
             if (back === LATE || back === undefined)
@@ -139,19 +209,45 @@ export class Harbor {
     }
     // Bind what the far side claims, each pk proven at its door first. Both
     // sides bind this way: the listener the dialer's claims, the dialer the
-    // listener's, since a claim is a claim whichever end made it.
+    // listener's, since a claim is a claim whichever end made it. An announce
+    // names at most this many pks, and they are proven a few at a time: a
+    // side that announced a thousand would otherwise cost a thousand keys, a
+    // thousand frames and a thousand waits at once, on its word alone.
     async bind(pks, reach, held) {
         // An announce is the whole of what that side holds now, so a pk this
-        // reach was bound for and no longer claims is unbound at once: a ward
+        // reach was bound for and does not claim now is unbound at once: a ward
         // that left a dialer is not reachable through it, proof or no proof.
+        // And it is the newest word: a proof still in flight from an earlier
+        // announce on this reach binds nothing when it lands, since the side
+        // has spoken again since.
+        const said = (announces.get(reach) ?? 0) + 1;
+        announces.set(reach, said);
         for (const [pk, b] of this.reaches)
             if (b.reach === reach && !pks.includes(pk))
                 this.reaches.delete(pk);
-        await Promise.all(pks.map(async (pk) => {
-            if (this.doors.has(pk) || !(await this.prove(pk, reach)))
+        const claimed = [...new Set(pks)].slice(0, ANNOUNCE);
+        const prove = async (pk) => {
+            if (this.doors.has(pk))
+                return;
+            // A line already held for this pk is not displaced by another line that
+            // proves the same pk. A proof says only that the ward is reachable that
+            // way, and a relay that forwards to the real ward proves as well as the
+            // ward's own line does: taking the binding would add a hop the relay
+            // chooses, and can drop. The first held line keeps it until it closes,
+            // which unbind says.
+            const standing = this.reaches.get(pk);
+            if (standing?.held && standing.reach !== reach)
+                return;
+            if (!(await this.prove(pk, reach)))
                 return;
+            if (announces.get(reach) !== said)
+                return; // a newer announce has spoken since
+            if (this.reaches.get(pk)?.held && this.reaches.get(pk).reach !== reach)
+                return; // one took it while this was proving
             this.reaches.set(pk, { reach, held });
-        }));
+        };
+        for (let i = 0; i < claimed.length; i += PROVING)
+            await Promise.all(claimed.slice(i, i + PROVING).map(prove));
     }
     unbind(reach) {
         for (const [pk, b] of this.reaches)
@@ -161,68 +257,122 @@ export class Harbor {
     // ---- wards
     // Mint a seed and boot an empty ward under a name: a world born here.
     async create(name, user = '', code = DEFAULT_CODE) {
-        const kept = { seed: globalThis.crypto.getRandomValues(new Uint8Array(32)), partition: {}, record: { pk: '', code, user } };
+        const kept = { seed: random(KEY), partition: {}, record: { pk: '', code, user } };
         await this.store.put(name, kept);
         const hosted = await this.host(name, kept);
         await this.store.record(name, hosted.record);
         return hosted;
     }
     // Stop serving a ward and take it out of the store: what was kept comes
-    // back, for another harbor to put. The partition is written first, because
-    // a being driven in-process changes it without passing a door.
+    // back, for another harbor to put. The partition is written first, and
+    // never again under this name: whoever still holds the old pointers holds
+    // a ward that saves nothing and answers its owner silence.
     async drop(name) {
         const h = this.wards.get(name);
         if (h) {
             await h.save();
+            // Gone for whoever still holds the old pointers, whose save closure has
+            // this row in hand, and out of the map, which now says what this harbor
+            // serves and nothing else.
+            const s = this.#saving.get(name);
+            if (s)
+                s.gone = true;
+            this.#saving.delete(name);
             this.wards.delete(name);
             this.doors.delete(h.pk);
             this.#announce(); // this harbor no longer claims it: a listener unbinds a pk an announce stops naming
         }
         return this.store.take(name);
     }
-    // Put what another harbor dropped, and boot it: same seed, same pk.
+    // Put what another harbor dropped, and boot it: same seed, same pk. A ward
+    // that will not boot is not adopted. This is the one path where a partition
+    // written somewhere else arrives, so it is the one place the ward's own
+    // shape check is met, and the name is refused for as long as it is kept:
+    // a partition put and left would hold the name against every later try,
+    // with a copy of it in a store that can never serve it. It goes back out,
+    // and the only copy is the one the caller is still holding.
     async adopt(name, kept) {
         await this.store.put(name, kept);
-        return this.host(name, kept);
+        try {
+            return await this.host(name, kept);
+        }
+        catch (e) {
+            await this.store.take(name);
+            throw e;
+        }
     }
     // A ward from what the store keeps: the ground, once, and two pointers.
     async host(name, kept) {
         const { seed, partition: memory } = kept;
         const classes = await this.loader(kept.record);
-        const objects = new Map(); // cells -> the object instantiate made. a side's hand, never the ward's
+        const objects = new WeakMap(); // cells -> the object instantiate made. a side's hand, never the ward's; it follows the cells out when she is unbooted
         const ground = {
             seed,
             memory,
-            instantiate: (className, stance) => {
-                const C = classes[className] ?? this.classes[className];
-                if (!C)
-                    return null;
-                const obj = new C(stance);
-                objects.set(stance.cells, obj);
-                return obj;
-            },
+            // This ward's own classes first, then the harbor's: a ward that names a
+            // class of its own is answered with hers.
+            instantiate: maker(objects, classes, this.classes),
             carry: (pk, bytes) => this.carry(pk, new Uint8Array(bytes)),
-            random: (n) => globalThis.crypto.getRandomValues(new Uint8Array(n)),
+            random,
+            wrote: () => this.#wrote(name),
         };
-        const w = await Ward(ground);
-        const save = () => this.store.save(name, memory);
-        const after = (f) => async (...a) => {
-            try {
-                return await f(...a);
-            }
-            finally {
-                await save();
-            }
+        const saving = { memory, dirty: false, running: null, timer: undefined, gone: false };
+        this.#saving.set(name, saving);
+        // A ward that will not be born leaves nothing behind: a partition of a
+        // shape this kit cannot read throws here, and a name the harbor does not
+        // serve must not have a saving row saying it does. Learning the pk is
+        // inside this, because a ward that will not say its pk is a ward this
+        // harbor cannot route to and is no more born than one that threw.
+        let w, pk;
+        try {
+            w = await Ward(ground);
+            pk = await learnPk(w);
+        }
+        catch (e) {
+            saving.gone = true;
+            this.#saving.delete(name);
+            throw e;
+        }
+        // A save the caller may wait for: what the ward wrote so far is in the
+        // store when this resolves, or the fault is counted. After a call through
+        // a pointer the store is current, so a restart right after it finds
+        // everything; a refusal at the door wrote nothing and saves nothing, and
+        // neither does a read. A ward that wrote nothing has nothing to save, so
+        // asking it what it holds is free, which is what makes the ask pointer
+        // the way to find out rather than an expensive way.
+        const save = async () => {
+            if (saving.gone)
+                return;
+            await this.#flush(name);
+        };
+        const door = async (bytes) => {
+            const r = await w.door(bytes);
+            // The reply waits for the store, so a restart right after it finds
+            // what the arrival wrote. Whether a key this door holds spoke is not
+            // the test: a stranger at the public being is not heard and her being
+            // may still have written, and a refusal wrote nothing whoever made it.
+            await save();
+            return r;
+        };
+        const ask = async (method, args) => {
+            if (saving.gone)
+                return silence;
+            const out = await w.ask(method, args);
+            await save();
+            return out;
         };
-        const door = after(w.door);
-        const ask = after(w.ask);
-        const bp = (await w.ask()); // learned by asking, as anyone learns anything
+        // The objects map is keyed by the cells the ward handed instantiate, so
+        // the way back to a being is her cells; the partition is read for that
+        // one lookup and for nothing else, and a key with no object is a being
+        // who is not here this run. `keys` is what the map holds, so a caller
+        // never needs the beings table to find out what to ask for.
         const beings = memory.beings;
         const being = (key) => {
-            const cells = beings?.[key];
+            const cells = beings && Object.hasOwn(beings, key) ? beings[key] : undefined;
             return cells ? objects.get(cells) : undefined;
         };
-        const hosted = { door, ask, pk: bp.notes.pk, name, record: { ...kept.record, pk: bp.notes.pk }, partition: memory, being, save };
+        const keys = () => Object.keys(beings ?? {}).filter((k) => being(k) !== undefined);
+        const hosted = { door, ask, pk, name, record: { ...kept.record, pk }, being, keys, save };
         this.wards.set(name, hosted);
         this.doors.set(hosted.pk, door);
         await save();

package/dist/harbor/dial.js

@@ -1,12 +1,13 @@
 import { REFUSED, Socket } from './reach.js';
 export function dial(harbor, url) {
     const d = { url, socket: null, wake: () => { }, close: () => { } };
-    let stopped = false, wait = 1000, timer;
+    let stopped = false, wait = 1000, timer, line, // the line in hand, open or still opening: close() closes it either way
+    held; // the one this dialer owns now, and how it gives back what the line took
     const connect = () => {
         timer = undefined; // no wait pending: this is the dial it was waiting for
         if (stopped)
             return;
-        const line = new WebSocket(url.replace(/\/$/, '').replace(/^http/, 'ws'));
+        line = new WebSocket(url.replace(/\/$/, '').replace(/^http/, 'ws'));
         const s = new Socket(line, (pk, bytes) => harbor.deliver(pk, bytes), (far) => {
             // A line that opened is not a line that works. The wait goes back to
             // a second here, where the far side has answered and been taken, and
@@ -15,13 +16,15 @@ export function dial(harbor, url) {
             wait = 1000;
             void harbor.bind(far, s, false); // the listener's claims, each proven at its door: reached through this socket, not held for others
         }, (why) => {
-            harbor.announcers.delete(say);
-            harbor.unbind(s);
-            if (d.socket === s)
-                d.socket = null;
-            const at = harbor.fallbacks.indexOf(s);
-            if (at !== -1)
-                harbor.fallbacks.splice(at, 1); // this line only: another dialer's stays
+            shed();
+            // A line this dialer already put down. Its close arrives whenever the
+            // system gets round to noticing, which on a socket that died under a
+            // sleeping device is minutes; by then the line dialed in its place is
+            // the one in hand, so this one gives back what it took and dials
+            // nothing. Only the line the dialer still holds dials again.
+            if (held?.socket !== s)
+                return;
+            held = undefined;
             // A suite this listener will not speak is not a line that dropped. It
             // will not become speakable by asking again sooner, so the wait goes
             // straight to the ceiling and stays there until it changes its mind.
@@ -31,12 +34,26 @@ export function dial(harbor, url) {
                 timer = setTimeout(connect, wait);
             wait = Math.min(wait * 2, 30000);
         });
+        // Everything this line took from the harbor, given back. Said when it
+        // closes, and when the dialer puts it down without waiting for that.
+        const shed = () => {
+            harbor.announcers.delete(say);
+            harbor.unbind(s);
+            if (d.socket === s)
+                d.socket = null;
+            const at = harbor.fallbacks.indexOf(s);
+            if (at !== -1)
+                harbor.fallbacks.splice(at, 1); // this line only: another dialer's stays
+        };
+        held = { socket: s, shed };
         harbor.fallbacks.push(s); // from the moment it is dialed: an ask made before the handshake waits on the socket, and is not unreached
         // What this harbor holds, said when the line opens and again whenever it
         // changes. A ward booted or adopted after the handshake is announced on
         // the line already in hand, and a dropped one stops being claimed at once.
         const say = () => s.announce([...harbor.doors.keys()]);
         line.addEventListener('open', () => {
+            if (stopped)
+                return s.close(); // closed while it was opening: it opens into nothing
             d.socket = s;
             harbor.announcers.add(say);
             say();
@@ -45,19 +62,19 @@ export function dial(harbor, url) {
     d.wake = () => {
         if (stopped)
             return;
-        if (d.socket)
-            return d.socket.announce([...harbor.doors.keys()]);
-        if (timer === undefined)
-            return;
         clearTimeout(timer);
         timer = undefined;
-        wait = 1000;
+        wait = 1000; // the device is back, and the wait it froze belongs to the sleep, not to this line
+        const old = held;
+        held = undefined; // put down before the new one is dialed, so a fallback list never holds the dead line ahead of the live one
+        old?.shed();
+        old?.socket.close();
         connect();
     };
     d.close = () => {
         stopped = true;
         clearTimeout(timer);
-        d.socket?.close();
+        line?.close(); // open or opening: a line closed while connecting fires close and never open
     };
     connect();
     return d;

package/dist/harbor/index.d.ts

@@ -4,3 +4,4 @@ export { dial, type Dialer } from './dial.ts';
 export { MemoryStore, values, type Store, type Kept, type WardRecord } from './store.ts';
 export { request, Socket, SUITE, REFUSED, type Reach, type Carry, type Line, type Announce } from './reach.ts';
 export type { Ground, WardPointers } from '../ward/ground.ts';
+export { maker, entropy, learnPk } from '../ward/ground.ts';

package/dist/harbor/index.js

@@ -8,3 +8,6 @@ export { Harbor, DEFAULT_CODE } from './core.js';
 export { dial } from './dial.js';
 export { MemoryStore, values } from './store.js';
 export { request, Socket, SUITE, REFUSED } from './reach.js';
+// What a harbor builds a ground out of. Convenience, never contract: a kit
+// writing its own harbor may write these three again.
+export { maker, entropy, learnPk } from '../ward/ground.js';

package/dist/harbor/memory.d.ts

@@ -1,5 +1,5 @@
-import type { BeingClass } from '../being/types.ts';
-import type { Ground, WardPointers } from '../ward/ground.ts';
+import type { BeingClass, BeingLike } from '../being/types.ts';
+import { type Ground, type WardPointers } from '../ward/ground.ts';
 export type Booted = WardPointers & {
     pk: string;
 };
@@ -16,7 +16,7 @@ export declare class MemoryHarbor {
     cut: boolean;
     readonly partitions: Map<string, Record<string, unknown>>;
     readonly wards: Map<string, Booted>;
-    readonly objects: Map<object, unknown>;
+    readonly objects: WeakMap<object, BeingLike>;
     route(farPk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
     link(harbor: MemoryHarbor): void;
     boot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>): Promise<Booted>;

package/dist/harbor/memory.js

@@ -1,3 +1,4 @@
+import { maker, entropy, learnPk } from '../ward/ground.js';
 import { hex } from '../ward/arithmetic.js';
 export class MemoryHarbor {
     doors = new Map(); // ward pk -> door
@@ -8,7 +9,7 @@ export class MemoryHarbor {
     cut = false;
     partitions = new Map(); // seed -> memory. the harbor keeps it and reads nothing
     wards = new Map(); // seed -> pointers
-    objects = new Map(); // cells -> being object. what instantiate constructed. a hand for tests, never the ward's
+    objects = new WeakMap(); // cells -> being object. what instantiate constructed. a hand for tests, never the ward's; it follows the cells out when she is unbooted
     // the directory: its own doors, else a peer it is linked to. Quo says nothing about how.
     async route(farPk, bytes) {
         if (this.down.has(farPk))
@@ -42,25 +43,19 @@ export class MemoryHarbor {
         const ground = {
             seed,
             memory,
-            instantiate: (name, stance) => {
-                const C = classes[name];
-                if (!C)
-                    return null;
-                const obj = new C(stance);
-                this.objects.set(stance.cells, obj);
-                return obj;
-            },
+            // One objects map for the whole harbor, not one per ward: every ward
+            // here is in this process and a test reaches any being of any of them.
+            instantiate: maker(this.objects, classes),
             // bytes cross, copied, never a reference. both ways.
             carry: async (farPk, bytes) => {
                 this.wire.push(hex(bytes));
                 const back = await this.route(farPk, new Uint8Array(bytes));
                 return back === undefined ? undefined : new Uint8Array(back);
             },
-            random: (n) => globalThis.crypto.getRandomValues(new Uint8Array(n)),
+            random: entropy,
         };
         const w = await Ward(ground);
-        const bp = (await w.ask()); // the harbor learns its ward's pk the way anyone learns anything: by asking
-        const booted = { ...w, pk: bp.notes.pk };
+        const booted = { ...w, pk: await learnPk(w) };
         this.doors.set(booted.pk, booted.door);
         this.wards.set(seed, booted);
         return booted;

package/dist/harbor/reach.js

@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 // Reach: carrying bytes to a pk off the device. One interface, two
-// implementations, as quo-harbor.md names them:
+// implementations:
 //
-//   request   a URL, the quo. route of a world. POST the bytes to
-//             `<url>/<pk>`, get bytes back. Listener to listener.
+//   request   a URL. POST the bytes to `<url>/<pk>`, get bytes back.
+//             Listener to listener.
 //   socket    a held WebSocket at `<url>`, opened by whichever side can
 //             dial, used in both directions with a frame id. Each side
 //             announces the ward pks it holds when the socket opens, and the
@@ -19,7 +19,7 @@
 // at the far end, a connection that would not open, a socket that is gone.
 // A reach that sent the bytes and lost the line afterwards answers nothing
 // at all, and the ward's own bound ends the ask.
-import { hex, unhex } from '../ward/arithmetic.js';
+import { concat, hex, unhex } from '../ward/arithmetic.js';
 const never = () => new Promise(() => { }); // sent, and no word since: the ward's bound decides
 // A request reach to one listener.
 export function request(url) {
@@ -28,14 +28,24 @@ export function request(url) {
         close: () => { },
         carry: async (pk, bytes) => {
             let res;
+            // A body of its own, not the caller's view: fetch reads it after this
+            // line returns, and a buffer somebody else may write is not a body. The
+            // copy is its own ArrayBuffer, which is what a body is; the bytes handed
+            // in are typed as backed by anything, shared memory included.
+            const body = new Uint8Array(bytes.length);
+            body.set(bytes);
             try {
-                res = await fetch(`${base}/${pk}`, { method: 'POST', headers: { 'content-type': 'application/octet-stream', 'quo-suite': String(SUITE) }, body: new Uint8Array(bytes) });
+                res = await fetch(`${base}/${pk}`, { method: 'POST', headers: { 'content-type': 'application/octet-stream', 'quo-suite': String(SUITE) }, body });
             }
             catch {
                 return undefined; // the connection never opened: nothing was delivered
             }
-            if (res.status === 404)
-                return undefined; // the listener holds no reach for that pk
+            // A status that says the listener did not take the bytes is nothing
+            // delivered: no reach for that pk, a request it refused on its face, a
+            // gateway with nobody behind it. Any other failure is a listener that
+            // took them and failed after, which is sent and no word since.
+            if (res.status === 404 || (res.status >= 400 && res.status < 500) || res.status === 502 || res.status === 503 || res.status === 504)
+                return undefined;
             if (!res.ok)
                 return never();
             return new Uint8Array(await res.arrayBuffer());
@@ -68,6 +78,11 @@ export const SUITE = 1;
 // the refusal names itself on the way out, and the far side may read it.
 export const REFUSED = 4001;
 const OPEN = 1; // WebSocket.OPEN, on every terrain
+// How many asks a socket keeps a resolver for. An ask the far side never
+// answers is ended by the ward's bound, and its resolver stays until the
+// line closes; a far side that answers nothing for long enough would grow
+// the map for as long as this side asks, so the oldest goes when it is full.
+const PENDING = 4096;
 // One held socket, either side of it. `deliver` is what this side does with
 // an ask that arrives for a pk: its own door, or a socket it holds for that
 // pk, and nothing else. `onAnnounce` learns the far side's pks; `onClose`
@@ -81,7 +96,17 @@ export class Socket {
     constructor(line, deliver, onAnnounce, onClose) {
         this.line = line;
         line.binaryType = 'arraybuffer';
-        this.#open = line.readyState === OPEN ? Promise.resolve() : new Promise((ok, no) => (line.addEventListener('open', ok), line.addEventListener('error', no)));
+        // A line that opens is a reach; one that errors, or closes before it
+        // opened, is a reach that failed, and an ask waiting on the handshake is
+        // nothing delivered.
+        this.#open =
+            line.readyState === OPEN
+                ? Promise.resolve()
+                : new Promise((ok, no) => {
+                    line.addEventListener('open', ok);
+                    line.addEventListener('error', no);
+                    line.addEventListener('close', () => no(new Error('closed before it opened')));
+                });
         this.#open.catch(() => { }); // a handshake refused is a reach that failed, not a process that dies
         line.addEventListener('message', (e) => {
             if (typeof e.data === 'string') {
@@ -109,12 +134,16 @@ export class Socket {
             const kind = buf[0], id = new DataView(buf.buffer, buf.byteOffset, buf.byteLength).getUint32(1);
             if (kind === ASK) {
                 const pk = hex(buf.subarray(5, 69));
-                void deliver(pk, new Uint8Array(buf.subarray(69))).then((back) => {
+                // A deliver that rejects has delivered nothing this side can vouch
+                // for, and a listener does not die of it: the far side hears none.
+                void deliver(pk, new Uint8Array(buf.subarray(69)))
+                    .then((back) => back, () => undefined)
+                    .then((back) => {
                     const head = new Uint8Array(5);
                     head[0] = back === undefined ? NONE : REPLY;
                     new DataView(head.buffer).setUint32(1, id);
                     if (line.readyState === OPEN)
-                        line.send(back === undefined ? head : concat(head, back));
+                        line.send(back === undefined ? head : concat([head, back]));
                 });
                 return;
             }
@@ -150,17 +179,13 @@ export class Socket {
         new DataView(head.buffer).setUint32(1, id);
         head.set(unhex(pk), 5);
         return new Promise((ok) => {
+            if (this.pending.size >= PENDING)
+                this.pending.delete(this.pending.keys().next().value); // the oldest, which the ward's bound ended long ago
             this.pending.set(id, ok);
-            this.line.send(concat(head, bytes));
+            this.line.send(concat([head, bytes]));
         });
     }
     close() {
         this.line.close();
     }
 }
-function concat(a, b) {
-    const out = new Uint8Array(a.length + b.length);
-    out.set(a, 0);
-    out.set(b, a.length);
-    return out;
-}