@threadedstack/wmd-web 0.1.13 → 0.1.14

package/README.md

@@ -2600,3 +2600,14 @@ engines' memory64 limit), passes `WMD_RAM_FLAT=1` to vm.wasm and hands the memor
 Measured in Chromium (page/b7.js, `ram=`): 4096 shows `Mem: 3976`; 8192 with 4 vCPUs held 5366 MB in six
 processes with every byte checked; the same work at 1536 (small) and 4096 (flat) took 35 s and 39 s.
 Tests: `test/unit/ram-mem.test.js` (bun has no memory64: the helper's part runs under node).
+
+## D-544: `--init` and keep-running containers (2026-11-12)
+
+`containerBundle({ ..., init: true })` runs the command under tini at `/sbin/docker-init`, as `docker run --init`
+does. `containerBundle({ ..., keepRunning: true, stopSignal })` keeps the container up after its command ends;
+send its `run` fields (`{ command: true, stop_signal }`) with the main process's run request and pass `onCommand`
+to hear `{ state: 'running' | 'exited' | 'none', code }`. `control.startCommand({ args, env, cwd, user })` starts a
+command in a keep-running container that has none running (browser only: for a base snapshot made with `args: []`).
+After a restore, attach the main process again with `onCommand`: the guest sends the restored machine's state.
+Guide: `../docs/keep-running.md`. Tests: `test/unit/ctl-keep-running.test.js`, `test/b9/b9keep.spec.js`
+(`bunx playwright test -c test/b9 b9keep`, under the boot lock; 4 tests, passing in Chromium, Firefox and WebKit).

package/RELEASE.json

@@ -1,7 +1,7 @@
 {
   "name": "wmd-web",
-  "version": "0.3.1",
-  "commit": "23bf0595198cec6c2027017049b2caa39753efc2",
+  "version": "0.3.2",
+  "commit": "1fe3dd6c164b913eecd21d64097b285c51fc1401",
   "previous": "wmd-web-v0.1.0",
   "decisions": [
     "D-486",
@@ -18,7 +18,9 @@
     "D-531",
     "D-533",
     "D-539",
-    "D-542"
+    "D-542",
+    "D-544",
+    "D-545"
   ],
   "vmSources": "f638fbdada4ccae26c12334b851e12244c1985d8",
   "guest": {
@@ -37,22 +39,22 @@
         "bytes": 38828040
       },
       "initramfs.cpio.gz": {
-        "sha256": "38101c6b9bd0f8ec8f1b0aea99046d80d36669052794fa8e0368b6a1743285c1",
-        "bytes": 4667433
+        "sha256": "a2260db90e5d8acdf12a2123f696b4512a1465856d5653e20a85504069a3480c",
+        "bytes": 4685323
       }
     }
   },
   "files": {
-    "README.md": "e26f6e48262e55f34f7bb2c3e5b4a91163aac356e3f07b5f82202b6ca16e10a3",
+    "README.md": "b9edbf3db9576f7016df93dee8e2b197071655518f90363fe2dafe2a97b03a3d",
     "export-page/coi-sw.js": "0300e670b413cb2e0aae35843fc583546bbf6687df971ab6df41cfa3b0d494d7",
     "export-page/index.html": "f5450c89e63601bbbbffef421f03491b231d1f143070012c1c5315d4b0059f43",
     "export-page/run.css": "b57adf1e76553549c1f89ff157b7973409dedc21889cd3932948cd05b51adc6f",
     "export-page/run.js": "717636a632a40469106ddf1383e198eaac5d83651b5866d0699ec04b82462b7f",
     "guest/arm64/Image": "a6b3209cf69d5bc1dacf0f3ed67f92c535dbb4108d67b47091c2aef87c6d7b04",
     "guest/arm64/Image-4k": "8ff6e338a0b42d9f774b35423e0e7f9d7f779c635446e8de2a3beb83d3518f8a",
-    "guest/arm64/initramfs.cpio.gz": "38101c6b9bd0f8ec8f1b0aea99046d80d36669052794fa8e0368b6a1743285c1",
+    "guest/arm64/initramfs.cpio.gz": "a2260db90e5d8acdf12a2123f696b4512a1465856d5653e20a85504069a3480c",
     "guest/arm64/vm.wasm": "f7affc474658fdfdc50e96c29a224eed1520ea69b426d6427fbc058eb141091a",
-    "package.json": "5ec889bd829e3e0a021e042e59eaf4f832280ac2135ce8ef160582173aa9dce3",
+    "package.json": "17aa3a8406e8d2d85b647c426438d3fd75edcb59d83e257882227e7b93cccbc0",
     "src/base.js": "982f8e46dbb727ec542a494ebdb884ccd19a31ff4e091425b2d1fc01b0d4754a",
     "src/boot.js": "114f9cf0561bca17b042c8db2e72e6984f7a55fd8d19700730895935f226cc77",
     "src/calib-worker.js": "3d610591a1b3b58f59c3a2ab457f43c90727d95973cd43055b3b73b76180611d",
@@ -79,7 +81,7 @@
     "src/host/ckpt-save.js": "e222571033ae74a4439596c5e90e03b2aa9a5516665dd290f8dd243712294523",
     "src/host/ckpt.js": "17c3e3f39c7e4ab9b51a4d121d1017d943257f95357330d8f21140011562d0db",
     "src/host/clock.js": "aba6af3a8b1a985ae340892222e4b482d33afe20f5c8b3a4c7403ce87d1e247c",
-    "src/host/ctl.js": "a2293b8cb53463323999e0d74277eeab6ebc580625db81b324ecbe2e07ddd98d",
+    "src/host/ctl.js": "654c55c64efa3df4df8b7b28024a10bd0e7ed3afb89004f8a583b9e62f17f58f",
     "src/host/errno.js": "26021d85962084be2c43c98fb3accafc2a8f11fbf3c8a5b8d484bd6a088ae4db",
     "src/host/fs.js": "d6753f74db35b7b01baa8709fc7fdcdfc8d638dfe42f454b0a833b22111e8f4a",
     "src/host/gcnudge.js": "4a6569cb73ae24a11fc4ac8c467380bd9efba0bb5fa9867b797bc4f153ab15ab",
@@ -107,9 +109,9 @@
     "src/net/relay-client.js": "4101de76dc0251db46839dc786cce677e4020795adf022bdce14bcf7edf8f864",
     "src/net/stack.js": "cd451cce7130f08e59cc19c961d2a5fca8416e577a40df1419ab6d5046018891",
     "src/net/switch.js": "bb047fb1ceeb10a84b5475916ead916362accf0e6f42a86561653dfad0c6c50d",
-    "src/net/wisp-client.js": "51207a1fab6f0d2dc4cada17ecdc202db2ffa95f16c318459be79c0abb919faf",
+    "src/net/wisp-client.js": "653961c4b735f2f74e5ea89e75c387f15ec8b8d9ed4c45d06c7d6b2a04968d42",
     "src/net/wisp-transport.js": "2b71201f3c686078c867e8995bf5c1cd6d47a0d415f476f3a33fbd5729a55f74",
-    "src/net/wisp.js": "f5740bd349cca6ca5bbb03ef392a0b2ce9f23c0ec8e07abe3286329fa209118d",
+    "src/net/wisp.js": "06c50159f416d40a912fe2cce4806388b938f2ab0220b2ee6da890630ce3d113",
     "src/registry/client.js": "fd38550e9afd82c5cb498513d245c33357a71697b3b2e6dd78538934bcc9d879",
     "src/registry/converter.js": "1fb8294fd5275f6772c27130cc9ba70bd46fafaf440884d42448036618229f37",
     "src/registry/hub.js": "22323e0f799a7078843514c9f87bbcdaa4173fd991ad4e059377befa773762d4",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@threadedstack/wmd-web",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "license": "MIT",
   "homepage": "https://github.com/threadedstack/wmd-releases",
   "repository": {
@@ -9,9 +9,9 @@
   },
   "description": "Browser host for wmd's guest vm.wasm (Web Workers + shared memory + WASI preview1)",
   "wmd": {
-    "tag": "v0.1.13",
-    "commit": "23bf0595198cec6c2027017049b2caa39753efc2",
-    "web": "0.3.1"
+    "tag": "v0.1.14",
+    "commit": "1fe3dd6c164b913eecd21d64097b285c51fc1401",
+    "web": "0.3.2"
   },
   "type": "module",
   "main": "./src/boot.js",

package/relay/engine.ts

@@ -3,8 +3,8 @@
 // The engine owns everything that is not the wire format:
 //   - policy (policy.ts): names and addresses checked on the address actually dialled, the
 //     allowlist with its per-guest pins, blocked ports
-//   - principals (a guest identity) and their caps: connections, connect/DNS/open rates,
-//     bandwidth buckets, total bytes; sessions per group; one live session per identity
+//   - principals (a guest identity) and their caps, each off unless set (plan §16): connections,
+//     connect/DNS/open rates, bandwidth buckets, total bytes; sessions per group; one live session per identity
 //   - resolve-and-check, dial, the stream lifecycle and byte accounting
 //   - logging (metadata only, never payloads)
 //
@@ -24,25 +24,31 @@ const PRINCIPAL_FLOOR_MS = 60 * 60_000
 export type ResolveFn = (name: string) => Promise<{ address: string; ttl: number }[]>
 export type DialFn = (host: string, port: number) => Socket
 
+/** A refusal as the page hears it (wmd-reason): the rule's name, words, and when it lifts (ms since 1970, 0 = no time). */
+export type Why = { rule: string; words: string; until?: number }
+
 /** What the hosted profile (hosted.ts) asks of the engine; absent outside it. Each method is a hook at one point of the stream lifecycle. */
 export interface Guard {
   /** An extra reason to refuse a dialled address (NAT64, `--deny-cidr`). */
   blockedAddr(a: Addr): string | null
   /** A destination on the operator's deny list. */
   isDeniedDest(host: string, port: number): boolean
-  /** Before a connect is resolved: the words to refuse it with, or null. */
-  admitConnect(s: Session, host: string, port: number): string | null
-  /** Just before the dial: concurrent caps. Sets `st.rel`. */
-  openStream(s: Session, st: Stream, host: string, port: number): string | null
-  dialFailed(s: Session): void
-  dnsAllowed(s: Session): boolean
-  dnsClosed?(): string | null // words when lookups are refused too (stop-new, drain, ceiling)
-  /** Bytes moved for a session; false when its address group is over its bytes for the hour. */
+  /** Before a connect is resolved: a refusal, a wait before the dial, or null. */
+  admitConnect(s: Session, host: string, port: number): Why | { waitMs: number } | null
+  /** Just before the dial: a socket for it. Sets `st.rel`. */
+  openStream(s: Session, st: Stream, host: string, port: number): Why | null
+  /** A dial failed after `ms` (refused, no route, timed out, or a name that does not exist). */
+  dialFailed(s: Session, ms: number): void
+  dialOk?(s: Session): void
+  dnsClosed?(): string | null // words when lookups are refused too (stop-new, drain, the month cap)
+  /** Bytes moved for a session; false when its streams must end (limitWhy says why). */
   bytes(s: Session, n: number): boolean
-  limitWhy?(): string // why `bytes` said no
-  /** Of n bytes the session's own bucket let through, how many the coarse, origin and relay-wide buckets allow. */
+  limitWhy?(): Why
+  /** Of n bytes the session's own bucket let through, how many the guard's slowdowns allow. */
   take(s: Session, dir: 'down' | 'up', n: number): number
   waitMs(s: Session, dir: 'down' | 'up', n: number): number
+  /** The session's WebSocket is backed up. */
+  backpressure?(s: Session): void
 }
 
 export type EngineOptions = {
@@ -74,6 +80,7 @@ export type EngineOptions = {
   log?: (e: Record<string, unknown>) => void
 }
 
+/** A token bucket of `rate` bytes a second, holding at most `rate`. Infinity is no limit. */
 export class Bucket {
   tokens: number
   last = performance.now()
@@ -86,6 +93,7 @@ export class Bucket {
   }
   /** Up to n bytes, or 0 when fewer than floor(n) are there (no trickle of tiny messages). */
   take(n: number): number {
+    if (this.rate === Infinity) return n
     const t = performance.now()
     this.tokens = Math.min(this.rate, this.tokens + ((t - this.last) / 1000) * this.rate)
     this.last = t
@@ -96,6 +104,7 @@ export class Bucket {
   }
   /** ms until n tokens are there. */
   waitMs(n: number): number {
+    if (this.rate === Infinity) return 1
     return Math.max(1, Math.ceil(((this.floor(n) - this.tokens) / this.rate) * 1000))
   }
 }
@@ -104,6 +113,7 @@ export class Window {
   times: number[] = []
   constructor(public max: number, public ms: number) {}
   hit(): boolean {
+    if (this.max === Infinity) return true
     const t = performance.now()
     while (this.times.length && t - this.times[0] > this.ms) this.times.shift()
     if (this.times.length >= this.max) return false
@@ -113,6 +123,7 @@ export class Window {
 }
 
 export type Stream = {
+  site?: string // the name the guest looked up for this address (siteOf), or the host it asked for
   id: number
   sock: Socket | null
   connected: boolean
@@ -128,6 +139,7 @@ export type Stream = {
   bytesDown: number
   bytesUp: number
   openedAt: number
+  dialAt?: number // when the lookup or dial began (after any wait)
   w?: any // adapter state for the stream
   rel?: () => void // the guard's release, called once when the stream is gone
 }
@@ -152,13 +164,13 @@ export type Principal = {
 export interface Wire {
   /** The stream is open; `detail` is "address:port" dialled. The adapter grants the first upload window (engine.takeUp / engine.owe). */
   connected(s: Session, st: Stream, detail: string): void
-  /** The connect failed or was refused before the stream opened. */
-  refused(s: Session, id: number, code: number, why: string): void
+  /** The connect failed or was refused before the stream opened; `rule` and `until` when a rule refused it. */
+  refused(s: Session, id: number, code: number, why: string, rule?: string, until?: number): void
   data(s: Session, st: Stream, bytes: Uint8Array): void
   /** The remote closed cleanly (FIN) and every byte was sent. */
   end(s: Session, st: Stream): void
   /** The stream failed after it opened: never a clean end. */
-  abort(s: Session, st: Stream, code: number, why: string): void
+  abort(s: Session, st: Stream, code: number, why: string, rule?: string, until?: number): void
   /** Upload credit: `n` more bytes of the stream may come (out of the up bucket). */
   grant(s: Session, st: Stream, n: number): void
   dnsReply(s: Session, id: number, rcode: number, ttl: number, addrs: Uint8Array[], why: string): void
@@ -167,6 +179,7 @@ export interface Wire {
 }
 
 export type Session = {
+  names?: Map<string, { name: string; exp: number }> // looked-up name by address, until the answer's TTL (the sites rule and the deny list by name)
   ws: any
   sid: string
   p: Principal
@@ -198,9 +211,9 @@ export function compileAllow(list: string[] | undefined): AllowEntry[] {
 
 /** Bandwidth buckets shared by several identities (Wisp: one client address, or one owner key). */
 export type Shared = { down: Bucket; up: Bucket }
-export const newShared = (o: { rateDown?: number; rateUp?: number }): Shared => ({ down: new Bucket(o.rateDown ?? 16 << 20), up: new Bucket(o.rateUp ?? 4 << 20) })
+export const newShared = (o: { rateDown?: number; rateUp?: number }): Shared => ({ down: new Bucket(o.rateDown ?? Infinity), up: new Bucket(o.rateUp ?? Infinity) })
 
-export type Admission = { ok: true; p: Principal } | { ok: false; status: number; body: string }
+export type Admission = { ok: true; p: Principal } | { ok: false; status: number; body: string; rule: string }
 
 const ERR_CODE: Record<string, number> = {
   ECONNREFUSED: E.REFUSED, ETIMEDOUT: E.TIMEOUT, ECONNRESET: E.RESET, EPIPE: E.RESET,
@@ -213,10 +226,10 @@ export type Engine = ReturnType<typeof createEngine>
 
 export function createEngine(o: EngineOptions) {
   const log = o.log || (() => {})
-  const maxConns = o.maxConns ?? 64
-  const maxSessions = o.maxSessions ?? 100
-  const maxBytes = o.maxBytes ?? 4 * 2 ** 30
-  const blockedPorts = new Set(o.blockedPorts ?? [25])
+  const maxConns = o.maxConns ?? Infinity
+  const maxSessions = o.maxSessions ?? Infinity
+  const maxBytes = o.maxBytes ?? Infinity
+  const blockedPorts = new Set(o.blockedPorts ?? [])
   const allowPorts = o.allowPorts?.length ? new Set(o.allowPorts) : null
   const guard = o.guard
   const relStream = (st: Stream) => {
@@ -227,7 +240,7 @@ export function createEngine(o: EngineOptions) {
   const connectTimeoutMs = o.connectTimeoutMs ?? 10_000
   // allowlist entries: name[:port|port...]; no ports: 80 and 443
   const allow = compileAllow(o.allowHosts)
-  const maxPerGroup = o.maxSessionsPerGroup ?? 8
+  const maxPerGroup = o.maxSessionsPerGroup ?? Infinity
   const testRoutes: Record<string, string> = Object.assign(Object.create(null), o.testRoutes) // no prototype keys ("constructor", "__proto__")
   const testHosts: Record<string, string> = Object.assign(Object.create(null), o.testHosts)
   let self = hostAddresses(o.selfAddrs)
@@ -267,8 +280,8 @@ export function createEngine(o: EngineOptions) {
       principals.set(uid, p)
     } else {
       p = {
-        uid, grp, connects: new Window(o.connectsPerMin ?? 600, 60_000), dnsHits: new Window(o.dnsPerMin ?? 1200, 60_000),
-        opens: new Window(o.opensPerMin ?? 30, 60_000), down: share?.down ?? new Bucket(o.rateDown ?? 16 << 20), up: share?.up ?? new Bucket(o.rateUp ?? 4 << 20),
+        uid, grp, connects: new Window(o.connectsPerMin ?? Infinity, 60_000), dnsHits: new Window(o.dnsPerMin ?? Infinity, 60_000),
+        opens: new Window(o.opensPerMin ?? Infinity, 60_000), down: share?.down ?? new Bucket(o.rateDown ?? Infinity), up: share?.up ?? new Bucket(o.rateUp ?? Infinity),
         bytes: 0, exp, live: null, pins: new Map(), overBytes: false,
       }
       principals.set(uid, p)
@@ -293,12 +306,13 @@ export function createEngine(o: EngineOptions) {
     A.find(a => (a.name.startsWith('.') ? name.endsWith(a.name) || name === a.name.slice(1) : name === a.name))
   const allowed = (A: AllowEntry[], name: string) => !A.length || !!entryFor(A, name)
 
-  function refuse(s: Session, id: number, code: number, why: string, to: string) {
+  function refuse(s: Session, id: number, code: number, why: string, to: string, rule?: string, until?: number) {
     const name = codeName(code)!
     stats.refused[name] = (stats.refused[name] || 0) + 1
-    log({ ev: 'refused', sid: s.sid, id, to, code: name, why })
-    if (!s.closed) s.wire.refused(s, id, code, why)
+    log({ ev: 'refused', sid: s.sid, id, to, code: name, why, ...(rule ? { rule } : {}) })
+    if (!s.closed) s.wire.refused(s, id, code, why, rule, until)
   }
+  const ruleOf = (code: number) => (code === E.BLOCKED ? 'blocked-address' : code === E.NOT_ALLOWED ? 'allowHosts' : undefined)
 
   /** The address to dial for a name: resolved here, filtered by the policy. */
   async function resolveChecked(s: Session, name: string, port?: number): Promise<{ addrs: { a: Addr; ttl: number }[]; rcode: number; why: string; code: number }> {
@@ -342,10 +356,9 @@ export function createEngine(o: EngineOptions) {
 
   async function dns(s: Session, id: number, name: string, qtype: number) {
     stats.dns++
-    if (!s.p.dnsHits.hit()) return s.wire.dnsReply(s, id, RCODE.REFUSED, 0, [], 'dns rate limit')
+    if (!s.p.dnsHits.hit()) return s.wire.dnsReply(s, id, RCODE.REFUSED, 0, [], 'dns rate limit (dnsPerMin)')
     const closed = guard?.dnsClosed?.()
     if (closed) return s.wire.dnsReply(s, id, RCODE.REFUSED, 0, [], closed)
-    if (guard && !guard.dnsAllowed(s)) return s.wire.dnsReply(s, id, RCODE.REFUSED, 0, [], 'dns rate limit for this address')
     if (qtype !== 1) return s.wire.dnsReply(s, id, RCODE.NOERROR, 60, [], 'only A')
     let r: Awaited<ReturnType<typeof resolveChecked>>
     try {
@@ -356,26 +369,49 @@ export function createEngine(o: EngineOptions) {
     }
     if (r.rcode !== RCODE.NOERROR || r.why) log({ ev: 'dns', sid: s.sid, name, rcode: r.rcode, why: r.why })
     const ttl = r.addrs.length ? Math.min(...r.addrs.map(x => x.ttl)) : 30
+    if (r.addrs.length) remember(s, name, r.addrs.slice(0, 16), ttl)
     if (!s.closed) s.wire.dnsReply(s, id, r.rcode, ttl, r.addrs.slice(0, 16).map(x => x.a.b), r.why)
   }
 
+  /** The names this session looked up, by the address each gave, for as long as the answer's DNS lifetime (TTL). A guest
+      connects to the address its lookup returned; the sites rule and the deny list by name go by the name it asked for. */
+  function remember(s: Session, name: string, addrs: { a: Addr }[], ttl: number) {
+    const now = Date.now()
+    const m = (s.names ??= new Map())
+    for (const [k, v] of m) if (v.exp <= now) m.delete(k)
+    const n = name.toLowerCase().replace(/\.$/, '')
+    for (const x of addrs) m.set(addrKey(x.a), { name: n, exp: now + ttl * 1000 })
+  }
+  /** The name a connect to `host` stands for: the looked-up name of that address, else `host` itself. */
+  function siteOf(s: Session, host: string): string {
+    const a = s.names && parseIP(host)
+    const hit = a ? s.names!.get(addrKey(a)) : undefined
+    return hit && hit.exp > Date.now() ? hit.name : host
+  }
+
   async function connect(s: Session, id: number, host: string, port: number) {
     const to = `${host}:${port}`
     const A = listFor(s)
     if (s.streams.has(id)) return refuse(s, id, E.BAD, 'stream id in use', to)
     if (!port) return refuse(s, id, E.BAD, 'port 0', to)
-    if (blockedPorts.has(port)) return refuse(s, id, E.PORT, `port ${port} is blocked`, to)
-    if (allowPorts && !allowPorts.has(port)) return refuse(s, id, E.PORT, `port ${port} is not allowed on this relay`, to)
-    if (s.streams.size >= maxConns) return refuse(s, id, E.LIMIT, `more than ${maxConns} connections at once`, to)
-    if (!s.p.connects.hit()) return refuse(s, id, E.LIMIT, 'connect rate limit', to)
-    if (guard?.isDeniedDest(host, port)) return refuse(s, id, E.BLOCKED, 'this destination is blocked by the operator', to)
-    const held = guard?.admitConnect(s, host, port)
-    if (held) return refuse(s, id, E.LIMIT, held, to)
+    if (blockedPorts.has(port)) return refuse(s, id, E.PORT, `port ${port} is blocked`, to, 'blocked-port')
+    if (allowPorts && !allowPorts.has(port)) return refuse(s, id, E.PORT, `port ${port} is not allowed on this relay`, to, 'allowPorts')
+    if (s.streams.size >= maxConns) return refuse(s, id, E.LIMIT, `more than ${maxConns} connections at once`, to, 'maxConns')
+    if (!s.p.connects.hit()) return refuse(s, id, E.LIMIT, 'connect rate limit', to, 'connectsPerMin')
+    const site = siteOf(s, host)
+    if (guard?.isDeniedDest(host, port) || (site !== host && guard?.isDeniedDest(site, port))) return refuse(s, id, E.BLOCKED, 'this destination is blocked by the operator', to, 'denied-destination')
+    const held = guard?.admitConnect(s, site, port)
+    if (held && 'rule' in held) return refuse(s, id, E.LIMIT, held.words, to, held.rule, held.until)
     const st: Stream = {
       id, sock: null, connected: false, clientCredit: s.window, ourGrant: 0, outQ: [], outBytes: 0, remoteEnded: false, endSent: false,
-      clientEnded: false, closed: false, to, bytesDown: 0, bytesUp: 0, openedAt: performance.now(),
+      clientEnded: false, closed: false, to, site, bytesDown: 0, bytesUp: 0, openedAt: performance.now(),
     }
     s.streams.set(id, st) // reserve the id while resolving
+    if (held?.waitMs) {
+      await new Promise(r => setTimeout(r, held.waitMs))
+      if (st.closed || s.closed) return
+    }
+    st.dialAt = performance.now()
     let addr = parseIP(host)
     let dialHost: string
     let dialPort = port
@@ -385,13 +421,13 @@ export function createEngine(o: EngineOptions) {
       const why = route ? null : whyBlocked(addr, port)
       if (why) {
         s.streams.delete(id)
-        return refuse(s, id, E.BLOCKED, `${key} is ${why}`, to)
+        return refuse(s, id, E.BLOCKED, `${key} is ${why}`, to, 'blocked-address')
       }
       if (A.length && !route) {
         const exp = s.p.pins.get(`${key}:${port}`)
         if (!exp || exp < Date.now()) {
           s.streams.delete(id)
-          return refuse(s, id, E.NOT_ALLOWED, `${key}:${port} was not resolved from an allowed name (for this port) by this guest`, to)
+          return refuse(s, id, E.NOT_ALLOWED, `${key}:${port} was not resolved from an allowed name (for this port) by this guest`, to, 'allowHosts')
         }
       }
       if (route) {
@@ -415,12 +451,12 @@ export function createEngine(o: EngineOptions) {
       if (st.closed || s.closed) return
       if (r.addrs.length && A.length && !testHosts[host.toLowerCase().replace(/\.$/, '')] && !entryFor(A, host.toLowerCase().replace(/\.$/, ''))?.ports.has(port)) {
         s.streams.delete(id)
-        return refuse(s, id, E.NOT_ALLOWED, `port ${port} is not allowed for ${host}`, to)
+        return refuse(s, id, E.NOT_ALLOWED, `port ${port} is not allowed for ${host}`, to, 'allowHosts')
       }
       if (!r.addrs.length) {
         s.streams.delete(id)
-        if (r.code === E.DNS) guard?.dialFailed(s)
-        return refuse(s, id, r.code || E.DNS, r.why || 'no address', to)
+        if (r.code === E.DNS && r.rcode === RCODE.NXDOMAIN) guard?.dialFailed(s, performance.now() - st.dialAt!)
+        return refuse(s, id, r.code || E.DNS, r.why || 'no address', to, ruleOf(r.code))
       }
       addr = r.addrs[0].a
       const route = testRoutes[`${addrKey(addr)}:${port}`]
@@ -434,7 +470,7 @@ export function createEngine(o: EngineOptions) {
     const full = guard?.openStream(s, st, host, port)
     if (full) {
       s.streams.delete(id)
-      return refuse(s, id, E.LIMIT, full, to)
+      return refuse(s, id, E.LIMIT, full.words, to, full.rule, full.until)
     }
     stats.connects++
     let sock: Socket
@@ -442,7 +478,7 @@ export function createEngine(o: EngineOptions) {
       sock = dial(dialHost, dialPort)
     } catch (e: any) {
       relStream(st)
-      guard?.dialFailed(s)
+      guard?.dialFailed(s, performance.now() - st.dialAt!)
       s.streams.delete(id)
       return refuse(s, id, E.UNREACHABLE, e?.message || 'dial failed', to)
     }
@@ -457,6 +493,7 @@ export function createEngine(o: EngineOptions) {
       clearTimeout(timer)
       if (st.closed) return sock.destroy()
       st.connected = true
+      guard?.dialOk?.(s)
       log({ ev: 'connect', sid: s.sid, id, to, via: `${dialHost}:${dialPort}`, ms: Math.round(performance.now() - st.openedAt) })
       if (!s.closed) s.wire.connected(s, st, `${addrKey(addr!)}:${port}`)
     })
@@ -504,7 +541,10 @@ export function createEngine(o: EngineOptions) {
   function pump(s: Session, st: Stream) {
     if (st.closed || s.closed) return
     while (st.outBytes > 0 && st.clientCredit > 0) {
-      if (s.ws.getBufferedAmount?.() > 8 << 20) break // the drain handler pumps again
+      if (s.ws.getBufferedAmount?.() > 8 << 20) {
+        guard?.backpressure?.(s)
+        break // the drain handler pumps again
+      }
       const want = Math.min(st.outBytes, st.clientCredit, MAX_DATA)
       let n = s.p.down.take(want)
       if (!n) {
@@ -563,20 +603,20 @@ export function createEngine(o: EngineOptions) {
     }, ms)
   }
 
-  /** The hosted profile's per-hour bytes for the session's address group: past them the session's streams end. */
+  /** The guard's bytes (the hosted month): when it says no, the session's streams end. */
   function overHour(s: Session, n: number): boolean {
     if (!guard || guard.bytes(s, n)) return false
-    const why = guard.limitWhy?.() ?? 'this address has used its bytes for this hour'
-    log({ ev: 'limit', sid: s.sid, why })
-    for (const st of [...s.streams.values()]) fail(s, st, E.LIMIT, why)
+    const why = guard.limitWhy?.() ?? { rule: 'limit', words: 'the relay limited this session' }
+    log({ ev: 'limit', sid: s.sid, why: why.words, rule: why.rule })
+    for (const st of [...s.streams.values()]) fail(s, st, E.LIMIT, why.words, why.rule, why.until)
     return true
   }
 
   function overBytes(s: Session): boolean {
     if (s.p.bytes <= maxBytes) return false
     s.p.overBytes = true // the identity stays over its cap: later sessions are refused
-    log({ ev: 'limit', sid: s.sid, why: 'session byte limit' })
-    for (const st of [...s.streams.values()]) fail(s, st, E.LIMIT, 'session byte limit')
+    log({ ev: 'limit', sid: s.sid, why: 'session byte limit', rule: 'maxBytes' })
+    for (const st of [...s.streams.values()]) fail(s, st, E.LIMIT, 'session byte limit', 'maxBytes')
     s.ws.close(4008, 'session byte limit')
     return true
   }
@@ -636,16 +676,16 @@ export function createEngine(o: EngineOptions) {
     })
   }
 
-  function fail(s: Session, st: Stream, code: number, why: string) {
+  function fail(s: Session, st: Stream, code: number, why: string, rule?: string, until?: number) {
     if (st.closed) return
     st.closed = true
     relStream(st)
     s.streams.delete(st.id)
     st.sock?.destroy()
-    if (!st.connected && guard && (code === E.REFUSED || code === E.UNREACHABLE || code === E.TIMEOUT)) guard.dialFailed(s)
-    if (!st.connected) return refuse(s, st.id, code, why, st.to)
-    log({ ev: 'abort', sid: s.sid, id: st.id, to: st.to, code: codeName(code), why, down: st.bytesDown, up: st.bytesUp })
-    if (!s.closed) s.wire.abort(s, st, code, why)
+    if (!st.connected && guard && st.sock && (code === E.REFUSED || code === E.UNREACHABLE || code === E.TIMEOUT)) guard.dialFailed(s, performance.now() - (st.dialAt ?? st.openedAt))
+    if (!st.connected) return refuse(s, st.id, code, why, st.to, rule, until)
+    log({ ev: 'abort', sid: s.sid, id: st.id, to: st.to, code: codeName(code), why, down: st.bytesDown, up: st.bytesUp, ...(rule ? { rule } : {}) })
+    if (!s.closed) s.wire.abort(s, st, code, why, rule, until)
   }
 
   function maybeDone(s: Session, st: Stream) {
@@ -699,22 +739,22 @@ export function createEngine(o: EngineOptions) {
     const replaces = !!known?.live
     if (sessions.size >= maxSessions && !replaces) {
       stats.refusedSessions++
-      return { ok: false, status: 503, body: 'too many sessions\n' }
+      return { ok: false, status: 503, body: 'too many sessions\n', rule: 'maxSessions' }
     }
     if ((groupLive.get(grp) || 0) >= maxPerGroup && !replaces) {
       stats.refusedSessions++
       log({ ev: 'session-refused', why: 'group session limit', grp, ...extra })
-      return { ok: false, status: 429, body: `more than ${maxPerGroup} sessions for this client\n` }
+      return { ok: false, status: 429, body: `more than ${maxPerGroup} sessions for this client\n`, rule: 'maxSessionsPerGroup' }
     }
     const p = principal(uid, grp, exp, share)
     if (p.overBytes) {
       stats.refusedSessions++
-      return { ok: false, status: 429, body: 'byte limit reached for this guest\n' }
+      return { ok: false, status: 429, body: 'byte limit reached for this guest\n', rule: 'maxBytes' }
     }
     if (!p.opens.hit()) {
       stats.refusedSessions++
       log({ ev: 'session-refused', why: 'open rate limit', uid, ...extra })
-      return { ok: false, status: 429, body: 'too many connections for this guest; wait\n' }
+      return { ok: false, status: 429, body: 'too many connections for this guest; wait\n', rule: 'opensPerMin' }
     }
     return { ok: true, p }
   }
@@ -766,9 +806,11 @@ export function createEngine(o: EngineOptions) {
     log({ ev: 'session-end', sid: s.sid, why, bytes: s.bytes })
   }
 
+  /** The v1 hello's limits; null where there is none. */
   function limits(p: Principal, A: AllowEntry[] = allow) {
+    const n = (v: number) => (Number.isFinite(v) ? v : null)
     return {
-      maxConns, window: WINDOW, rateDown: p.down.rate, rateUp: p.up.rate, bytesLeft: Math.max(0, maxBytes - p.bytes),
+      maxConns: n(maxConns), window: WINDOW, rateDown: n(p.down.rate), rateUp: n(p.up.rate), bytesLeft: n(Math.max(0, maxBytes - p.bytes)),
       allowHosts: A.length ? A.map(a => `${a.name}:${[...a.ports].join('|')}`) : null,
     }
   }