aamio 0.7.0 → 0.7.2

package/README.md

@@ -31,8 +31,13 @@ SHA-256 hash and its eight-character hash prefix, the inbox and when it
 expires, the service and the tags presence publishes, as aamio-python and
 aamio-php do; `init` opens no inbox, so it needs no service, and the first
 read opens one. The service is `--host URL`, else `AAMIO_HOST`, else
-https://aamio.at. The tags are `init --tags`, else the home's own, else
-`AAMIO_TAGS`. Save the home if you want to keep the identity.
+https://aamio.at. `--host` moves the service and nothing else: the board is
+`AAMIO_BOARD`, else https://board.aamio.at, and a receipt is anchored at
+`AAMIO_VERIFYUM`, else Verifyum's MCP server. For a copy of both on your own
+machine, name both before a post, as in
+`AAMIO_BOARD=http://127.0.0.1:8081 aamio --host http://127.0.0.1:8080 board find`.
+The tags are `init --tags`, else the home's own, else `AAMIO_TAGS`. Save the
+home if you want to keep the identity.
 
 `doctor` answers three questions as the other two runtimes answer them:
 whether this client fits the service, read from `/health` and from what the
@@ -66,7 +71,7 @@ else: the message is handed over and the send is delivered, with
 `archive_failed` in `attention` or `archive_error` on the answer.
 
 To connect an MCP client, set its command to `npx` and its arguments to
-`["-y", "aamio@0.7.0", "--home", "/absolute/path/to/home", "serve"]`, or from a
+`["-y", "aamio@0.7.2", "--home", "/absolute/path/to/home", "serve"]`, or from a
 checkout the command `node` and the arguments
 `["/absolute/path/to/aamio-js/bin/aamio.js", "--home", "/absolute/path/to/home", "serve"]`.
 The server speaks JSON-RPC over stdio and creates a new identity on first
@@ -176,9 +181,9 @@ instructions. Answer a post with `board answer POST_ID` rather than by sending
 to the address on it: the answer names the post and is sealed to the key that
 signed it, from any process. The server has the same as `aamio_board_post`,
 `aamio_board_find`, `aamio_board_answer`, `aamio_board_withdraw` and
-`aamio_board_tags`. Add-on commands are planned for a later milestone. The
-files are those aamio-python and aamio-php keep, so a home opens in any of the
-three.
+`aamio_board_tags`. An add-on brings its own commands, under `aamio addon`,
+as the section on add-ons below says. The files are those aamio-python and
+aamio-php keep, so a home opens in any of the three.
 
 `board replies` reads the board inboxes, and only those, and lists the answers
 to your posts: what this run read, and what the archive holds from the runs

package/bin/aamio.js

@@ -9,7 +9,7 @@ import { AddonError, describe, disable, enable, enabledButMissing, installWords,
 import { parseCommand, probe, runCommand, usageOf } from "../src/node-addon-process.js";
 import { archiveStatus, parsePolicy } from "../src/node-archive.js";
 import { doctor, homeCheck } from "../src/node-doctor.js";
-import { CHANNEL_TTL, NodeRuntime, SEND_STOPS, checkChannelTtl, checkGate, checkLabel, checkPartner, checkRe, stopFields, tagsFrom } from "../src/node-runtime.js";
+import { BODY_MAX_DEPTH, CHANNEL_TTL, NodeRuntime, SEND_STOPS, checkChannelTtl, checkGate, checkLabel, checkPartner, checkRe, stopFields, tagsFrom, unfitJson } from "../src/node-runtime.js";
 import { checkAccess, checkScopeAdd, checkScopeName } from "../src/node-scopes.js";
 
 const { version } = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
@@ -70,6 +70,10 @@ An add-on is an npm package of its own, installed in the home's folder for
 add-ons, addon-packages/npm, and run in a process of its own for each call.
 The default home is AAMIO_HOME or ~/.aamio. A new home needs an existing
 parent directory. The service is --host, else AAMIO_HOST, else https://aamio.at.
+--host moves the service and nothing else: the board is AAMIO_BOARD, else
+https://board.aamio.at, and a receipt is anchored at AAMIO_VERIFYUM, else
+Verifyum's MCP server. For a copy of both on this machine, name both, as in
+AAMIO_BOARD=http://127.0.0.1:8081 aamio --host http://127.0.0.1:8080 board find
 The tags presence publishes are init --tags, else the home's own, else
 AAMIO_TAGS. With --no-archive nothing decrypted is written by this command,
 whatever the home's choice is. Run with --version to print the version.
@@ -218,11 +222,34 @@ function scopeName(value) {
 
 function jsonData(value) {
   if (value === undefined) return null;
+  let parsed;
   try {
-    return JSON.parse(value);
+    parsed = JSON.parse(value);
   } catch {
     throw Object.assign(new Error("--data is not JSON. Give a JSON value, quoted for the shell."), { code: "usage" });
   }
+  return holdable(parsed, "--data", BODY_MAX_DEPTH - 1);
+}
+
+/**
+ * A JSON option every reader can hold, or the usage error that says why not:
+ * a number that is not finite, as 1e999 is, which JSON.parse makes Infinity
+ * and JSON.stringify sends as null, and --data nested so deep that the
+ * message around it passes BODY_MAX_DEPTH, which a reader hands over as text.
+ * The three runtimes refuse both alike (a security review of 13 November 2026).
+ */
+function holdable(parsed, option, limit) {
+  const unreadable = unfitJson(parsed, limit);
+  if (unreadable && unreadable[1] === "half a pair") {
+    throw Object.assign(new Error(`${option} holds half of a UTF-16 surrogate pair, as "\\ud800" is: JSON can write it, and UTF-8 cannot carry it.`), { code: "usage" });
+  }
+  if (unreadable && unreadable[1] === "not finite") {
+    throw Object.assign(new Error(`${option} holds a number that is not finite, as 1e999 is: JSON can write it, and nothing that reads it can hold it.`), { code: "usage" });
+  }
+  if (unreadable) {
+    throw Object.assign(new Error(`${option} is nested too deep: with the message around it, it is deeper than ${BODY_MAX_DEPTH}, and a reader hands such a message over as text.`), { code: "usage" });
+  }
+  return parsed;
 }
 
 /**
@@ -345,6 +372,7 @@ function plan(command, positional, options) {
         } catch {
           throw wrong("--gate is not JSON. Quote it as one argument, as in --gate '{\"require\": {\"pow\": {\"bits\": 20}}}'.");
         }
+        holdable(gate, "--gate", 1000000);
         usage(() => checkGate(gate));
       }
       return (runtime) => runtime.channelOpen(first, { ttl, allow, gate });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aamio",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "mcpName": "at.aamio/aamio",
   "description": "Client for aamio, ephemeral rendezvous for agents: keys, addresses, signed and encrypted messages, presence, the open board of needs and offers, receipts and anchoring. Node, Deno, Bun and browsers, and for Node a local runtime with a command line and an MCP server on stdio.",
   "type": "module",

package/src/node-archive.js

@@ -132,14 +132,17 @@ export function parsePolicy(text, maxMb = null) {
 
 /** One sentence a person or a model can act on. The words are aamio-python's. */
 export function describePolicy(policy) {
-  const size = policy.max_mb ? ` and never more than ${policy.max_mb} MB, oldest first out` : "";
+  // The ceiling holds each time the archive is tidied, not at every write:
+  // under one of 128 bytes a row of 415 stayed until the next tidying, where
+  // this said never more than (the fifth release check of 14 November 2026).
+  const size = policy.max_mb ? ` Each time it is tidied, when a runtime starts and at most once an hour after, the oldest go first until it holds no more than ${policy.max_mb} MB, so in between it can hold more.` : "";
   if (policy.mode === "off") {
     return "Nothing decrypted is written to this machine. The key, the read keys of open threads and the outbox with sealed bytes still are, since the runtime cannot work without them.";
   }
   if (policy.mode === "days") {
-    return `Decrypted messages and receipts are kept in archive/ for ${policy.days} days${size}, then removed. The service itself keeps nothing past a thread's expiry: this archive is yours, on this machine.`;
+    return `Decrypted messages and receipts are kept in archive/ for ${policy.days} days, then removed.${size} The service itself keeps nothing past a thread's expiry: this archive is yours, on this machine.`;
   }
-  return `Decrypted messages and receipts are kept in archive/ until you remove them${size}. The service itself keeps nothing past a thread's expiry: this archive is yours, on this machine. \`aamio archive days:30\` gives it a lifetime, \`aamio archive off\` stops it.`;
+  return `Decrypted messages and receipts are kept in archive/ until you remove them.${size} The service itself keeps nothing past a thread's expiry: this archive is yours, on this machine. \`aamio archive days:30\` gives it a lifetime, \`aamio archive off\` stops it.`;
 }
 
 /** After a rename the new name is on disk only when the folder is. Windows has no such call for a folder, and journals the rename. */

package/src/node-doctor.js

@@ -265,15 +265,37 @@ async function ask(runtime, path) {
   }
 }
 
+/**
+ * What /health said when it is not aamio's health answer, an object with
+ * "service": "aamio" and "status": "ok" as the service gives it, and null when
+ * it is. A 200 from a proxy or a login page in front of the host was said as
+ * healthy, beside "answered 200 and not 200" (a check of 13 November 2026).
+ */
+function notHealth(body) {
+  if (body === null || body === "") return "an empty body";
+  if (typeof body === "string") return "a body that is not JSON";
+  if (!isObject(body) || body.service !== "aamio" || body.status !== "ok") return "JSON that is not aamio's health answer";
+  return null;
+}
+
 /** One answer to three questions: does this client fit the service, who can read the home, what is kept. */
 export async function doctor(runtime, version) {
   const health = await ask(runtime, "/health");
-  const service = { host: runtime.host, reachable: health.status === 200 };
-  if (health.status === 200 && isObject(health.body)) {
+  // Whether the service answered and whether it is well are two things, and
+  // both apart from whether this client fits it. A 503 from /health was said
+  // as no answer, beside a fit read from the descriptor, which had answered
+  // (a check of 13 November 2026). As aamio-python and aamio-php say it.
+  const unlike = health.status === 200 ? notHealth(health.body) : null;
+  const service = { host: runtime.host, reachable: health.status > 0, healthy: health.status === 200 && unlike === null, status: health.status };
+  if (service.healthy) {
     service.version = health.body.version ?? null;
     service.revision = health.body.revision ?? null;
+  } else if (health.status === 0) {
+    service.problem = "no answer from /health, so the service's version and health were not read";
+  } else if (health.status !== 200) {
+    service.problem = `/health answered ${health.status} and not 200: the service is reachable and not healthy, and its version was not read`;
   } else {
-    service.problem = `no answer from /health (${health.status}), so nothing below about the service was checked`;
+    service.problem = `/health answered 200 with ${unlike}, so the service's version and health were not read: check that --host names the aamio service and not a page in front of it`;
   }
   const descriptor = await ask(runtime, "/.well-known/aamio.json");
   const fits = compatCheck(descriptor.status === 200 ? descriptor.body : null);

package/src/node-mcp.js

@@ -2,7 +2,7 @@ import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { GateStop, isKey } from "./aamio.js";
 import { readIdentity } from "./node-identity.js";
-import { OUTBOX_NOTES, SEND_STOPS, checkGate, outboxOutcome, stopFields } from "./node-runtime.js";
+import { OUTBOX_NOTES, SEND_STOPS, checkGate, outboxOutcome, stopFields, unfitJson, unfitText } from "./node-runtime.js";
 import { toolsOf } from "./node-addons.js";
 import { HOST_QUESTION, callTool } from "./node-addon-process.js";
 
@@ -510,6 +510,8 @@ async function addPartner(runtime, args, ask) {
 
 /** What a call whose arguments do not fit is told to do, in the three runtimes alike. */
 const ARGUMENTS_FIX = "Check each argument against the tool's inputSchema and call again.";
+/** And one whose gate does not fit: there is no changing a gate once the channel is open. */
+const GATE_FIX = "Send a gate with require, advise or both, as in {\"require\": {\"pow\": {\"bits\": 20}, \"per_key\": 5}}, or leave gate out to take writes from anyone on the allowlist.";
 
 /**
  * Arguments as the tool's schema says: an object of known names, each of its
@@ -519,22 +521,53 @@ const ARGUMENTS_FIX = "Check each argument against the tool's inputSchema and ca
  */
 function wrongArguments(tool, args) {
   if (args === undefined) args = {};
-  if (!object(args)) return "arguments must be an object";
   const properties = tool.inputSchema.properties;
   for (const [name, value] of Object.entries(args)) {
-    const want = properties[name];
-    if (!want) return `${tool.name} takes no argument called ${name}`;
-    const ok = want.type === "string" ? typeof value === "string" && (!want.pattern || new RegExp(want.pattern).test(value)) && [...value].length >= (want.minLength ?? 0) && [...value].length <= (want.maxLength ?? Infinity) && (!want.enum || want.enum.includes(value))
-      : want.type === "integer" ? Number.isInteger(value) && value >= (want.minimum ?? -Infinity) && value <= (want.maximum ?? Infinity)
-        : want.type === "boolean" ? typeof value === "boolean"
-        : want.type === "object" ? object(value)
-          : want.type === "array" ? Array.isArray(value) && value.every((item) => typeof item === "string") && value.length <= (want.maxItems ?? Infinity) : false;
-    if (!ok) return `${name} is not what ${tool.name} takes: ${JSON.stringify(want)}`;
+    // Own names only: constructor or __proto__ is no argument of any tool.
+    if (!Object.hasOwn(properties, name)) return { path: name, message: `${tool.name} takes no argument called ${name}` };
+    const wrong = wrongValue(tool, name, properties[name], value);
+    if (wrong) return wrong;
   }
-  for (const name of tool.inputSchema.required ?? []) if (!(name in args)) return `${tool.name} needs ${name}`;
+  for (const name of tool.inputSchema.required ?? []) if (!Object.hasOwn(args, name)) return { path: name, message: `${tool.name} needs ${name}` };
   return null;
 }
 
+/**
+ * What is wrong with one value against its schema, named by its path, as the
+ * three runtimes say it; or null. An object whose fields the schema declares,
+ * as a gate's, is checked field by field: a pow of "5" bits went on to the
+ * service, and a field no gate has was passed over (a check of 13 November
+ * 2026). One that declares none, as data, takes any field.
+ */
+function wrongValue(tool, path, want, value) {
+  const ok = want.type === "string" ? typeof value === "string" && (!want.pattern || new RegExp(want.pattern).test(value)) && [...value].length >= (want.minLength ?? 0) && [...value].length <= (want.maxLength ?? Infinity) && (!want.enum || want.enum.includes(value))
+    : want.type === "integer" ? Number.isInteger(value) && value >= (want.minimum ?? -Infinity) && value <= (want.maximum ?? Infinity)
+      : want.type === "boolean" ? typeof value === "boolean"
+      : want.type === "object" ? object(value)
+        : want.type === "array" ? Array.isArray(value) && value.every((item) => typeof item === "string") && value.length <= (want.maxItems ?? Infinity) : false;
+  if (!ok) return { path, message: `${path} is not what ${tool.name} takes: ${JSON.stringify(want)}` };
+  if (want.type === "object" && object(want.properties)) {
+    for (const [key, inner] of Object.entries(value)) {
+      if (!Object.hasOwn(want.properties, key)) {
+        if (want.additionalProperties === false) return { path: `${path}.${key}`, message: `${path} has no field called ${key}` };
+        continue;
+      }
+      const wrong = wrongValue(tool, `${path}.${key}`, want.properties[key], inner);
+      if (wrong) return wrong;
+    }
+    for (const key of want.required ?? []) if (!Object.hasOwn(value, key)) return { path: `${path}.${key}`, message: `${path} needs ${key}` };
+  }
+  return null;
+}
+
+/** What does not fit, as the call's answer: inside a gate it is the gate's refusal, with its fix; anything else is invalid_arguments. */
+function unfit(tool, wrong, args) {
+  if (tool.name === "aamio_open_channel" && (wrong.path === "gate" || wrong.path.startsWith("gate."))) {
+    return { error: wrong.message, error_code: "invalid_gate", fix: GATE_FIX, given: args.gate };
+  }
+  return { error: wrong.message, error_code: "invalid_arguments", fix: ARGUMENTS_FIX };
+}
+
 /**
  * One tool of an add-on enabled in this home. The core settles what is the
  * core's, in turn with everything else that uses the home: the key behind a
@@ -562,6 +595,15 @@ async function callAddonTool(id, params, session, version, reply, complete, mani
 /** One tool of the runtime. A call and the presence timer take turns with the home. */
 async function callRuntimeTool(id, params, session, version, reply, complete) {
   const runtime = session.runtime;
+  // A number that is not finite, as 1e999 is, or nesting deeper than a reader
+  // reads as JSON, is refused before any tool runs, an add-on's included, as in
+  // the other two runtimes. JSON.parse made 1e999 Infinity here and it went on
+  // as null; in aamio-php the arguments vanished and an add-on ran with its
+  // defaults (a security review of 13 November 2026).
+  if (object(params.arguments)) {
+    const unreadable = unfitJson(params.arguments);
+    if (unreadable) return complete(toolResult({ error: unfitText(unreadable), error_code: "invalid_arguments", fix: ARGUMENTS_FIX }, true));
+  }
   const tool = RUNTIME_TOOLS.find((t) => t.name === params.name);
   if (!tool) {
     const manifest = session.addons.find((held) => held.tools.some((offered) => offered.name === params.name));
@@ -587,7 +629,7 @@ async function callRuntimeTool(id, params, session, version, reply, complete) {
   // of 13 November 2026).
   if (params.arguments !== undefined && !object(params.arguments)) return rpcError(id, -32602, "arguments must be an object");
   const wrong = wrongArguments(tool, params.arguments);
-  if (wrong) return complete(toolResult({ error: wrong, error_code: "invalid_arguments", fix: ARGUMENTS_FIX }, true));
+  if (wrong) return complete(toolResult(unfit(tool, wrong, params.arguments ?? {}), true));
   const args = params.arguments ?? {};
   try {
     const data = await runtime.serial(async () => {
@@ -611,7 +653,7 @@ async function callRuntimeTool(id, params, session, version, reply, complete) {
             try {
               checkGate(args.gate);
             } catch (wrong) {
-              throw new ToolRefusal({ error: wrong.message, error_code: "invalid_gate", fix: "Send a gate with require, advise or both, as in {\"require\": {\"pow\": {\"bits\": 20}, \"per_key\": 5}}, or leave gate out to take writes from anyone on the allowlist.", given: args.gate });
+              throw new ToolRefusal({ error: wrong.message, error_code: "invalid_gate", fix: GATE_FIX, given: args.gate });
             }
           }
           return runtime.channelOpen(args.label, { ttl: args.ttl, allow: args.allow ?? null, gate: args.gate ?? null, to: args.to ?? null, note: args.note ?? null });

package/src/node-runtime.js

@@ -1,4 +1,5 @@
-import { open, readFile, rename, unlink } from "node:fs/promises";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { open, readFile, rename, stat as fsStat, unlink } from "node:fs/promises";
 import { constants } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";
@@ -249,6 +250,80 @@ export function checkGate(gate) {
   return gate;
 }
 
+
+/**
+ * What a body may be and still be read as JSON, in all three runtimes: every
+ * number finite and nested at most this deep, the outermost array or object
+ * counted as one. Anything else is handed over as text. A body nested 5 000
+ * deep made every read of its thread throw here, and the messages other
+ * channels had handed over in the same read, their cursors saved, were lost.
+ * 1e999 became Infinity, and went on as null (a security review of 13 November
+ * 2026).
+ */
+export const BODY_MAX_DEPTH = 64;
+// How far back from the end of a channel's archive a read looks for a delivery
+// an earlier process wrote down and did not get past with its cursor.
+const ARCHIVE_TAIL_BYTES = 16 * 1024 * 1024;
+
+/** One step of a path: a member name with half a pair in it is written escaped, so the path can be printed. */
+function segment(key) {
+  return key.isWellFormed() ? key : JSON.stringify(key).slice(1, -1);
+}
+
+/**
+ * [path, what] for the first part of value no reader can hold, in document
+ * order, or null: "not finite" for a number such as 1e999, "too deep" for
+ * arrays and objects nested deeper than limit, and "half a pair" for a string
+ * or member name with half of a UTF-16 surrogate pair in it, as "\\ud800"
+ * decodes to: JSON can write it and UTF-8 cannot carry it, so it went out as
+ * U+FFFD in its place, and aamio-php reads no such body as JSON (the release
+ * check of 14 November 2026). The path names keys and indices with dots, and
+ * is "" for value itself.
+ */
+export function unfitJson(value, limit = BODY_MAX_DEPTH) {
+  const stack = [[value, "", 0]];
+  while (stack.length) {
+    const [node, path, level] = stack.pop();
+    if (typeof node === "number") {
+      if (!Number.isFinite(node)) return [path, "not finite"];
+      continue;
+    }
+    if (typeof node === "string") {
+      if (!node.isWellFormed()) return [path, "half a pair"];
+      continue;
+    }
+    if (node === null || typeof node !== "object") continue;
+    if (level + 1 > limit) return [path, "too deep"];
+    const items = Array.isArray(node) ? node.map((child, index) => [String(index), child]) : Object.entries(node);
+    for (const [key, child] of items.reverse()) {
+      const where = path ? `${path}.${segment(key)}` : segment(key);
+      stack.push([child, where, level + 1]);
+      // The member name, where it stands: before its value.
+      if (!Array.isArray(node)) stack.push([key, where, level + 1]);
+    }
+  }
+  return null;
+}
+
+/** What is wrong with an argument unfitJson found, as all three runtimes say it. */
+export function unfitText([path, what]) {
+  const where = path || "arguments";
+  if (what === "not finite") return `${where} is a number that is not finite, as 1e999 is: JSON can write it, and nothing that reads it can hold it`;
+  if (what === "half a pair") return `${where} holds half of a UTF-16 surrogate pair, as "\\ud800" is: JSON can write it, and UTF-8 cannot carry it`;
+  return `${where} is nested deeper than ${BODY_MAX_DEPTH}: a reader hands a message nested that deep over as text`;
+}
+
+/** A body's JSON as { value }, or null when it is to be read as text: not JSON, a number that is not finite, or too deep. */
+function bodyJson(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  return unfitJson(value) === null ? { value } : null;
+}
+
 /**
  * A label for a channel of the caller's own. It names the channel in every
  * answer and its file in the archive, so it is made of what a file's name may
@@ -373,6 +448,12 @@ export class NodeRuntime {
     this.archivePolicy = { ...DEFAULT_POLICY };
     this.archiveEnabled = false;
     this.prunedAt = 0;
+    // The read an async call belongs to, how many reads are saying what the
+    // archive holds, and a tidying under way: tidying waits for those reads
+    // (the fifth release check of 14 November 2026).
+    this.readScope = new AsyncLocalStorage();
+    this.receiptWindows = 0;
+    this.tidying = null;
     // What this process read on each channel, by write address, as it was
     // handed over, with the thread's instance and the archive's mark: what
     // board replies lists beside the archive. In memory only, and gone with
@@ -380,7 +461,16 @@ export class NodeRuntime {
     this.received = new Map();
     // Messages the archive holds from a read whose cursor could not be
     // written: read again, they are not written down a second time.
-    this.writtenDown = new Set();
+    // By delivery, the name of the archive file each went to.
+    this.writtenDown = new Map();
+    // What earlier processes wrote to each channel's archive, from the end of
+    // the file, by file name: read once a process.
+    this.archiveBefore = new Map();
+    // How often a delivery was handed over here with a row an earlier process
+    // had written: copies held here that wrote none, by board replies' key.
+    this.rowsReused = new Map();
+    // How far back from the end of a channel's archive that is read.
+    this.archiveTailBytes = ARCHIVE_TAIL_BYTES;
     this.host = host.replace(/\/+$/, "");
     // Where a receipt's root is anchored, as aamio-python reads it: AAMIO_VERIFYUM.
     this.verifyum = String(verifyum).replace(/\/+$/, "");
@@ -498,7 +588,7 @@ export class NodeRuntime {
     for (const channel of this.state.channels.filter(gone)) {
       this.received.delete(channel.w);
       // And what was written down of it at a read that could not be saved: it will not be read again.
-      for (const delivery of this.writtenDown) if (delivery.startsWith(channel.w + "\u0000")) this.writtenDown.delete(delivery);
+      for (const delivery of [...this.writtenDown.keys()]) if (delivery.startsWith(channel.w + "\u0000")) this.writtenDown.delete(delivery);
     }
     this.state.channels = this.state.channels.filter((channel) => !gone(channel));
   }
@@ -511,6 +601,50 @@ export class NodeRuntime {
   // fails costs the record, and is said, and the message, the send or the
   // post it is about stands.
 
+  /**
+   * Tidies the archive when an hour has passed since it was tidied last, and
+   * no read is saying what the archive holds. Never within a read, and never
+   * while another read is between its first word on the archive and its
+   * return: one read() over two channels tidied between them, took the first
+   * channel's row and still said archived of it (the fifth release check of
+   * 14 November 2026). A tidying that has to wait waits for the next chance.
+   */
+  async pruneWhenDue() {
+    if (this.now() - this.prunedAt <= 3600) return;
+    if (this.readScope?.getStore() !== undefined) return;
+    if (this.receiptWindows > 0 || this.tidying) return;
+    this.tidying = this.prune().finally(() => {
+      this.tidying = null;
+    });
+    await this.tidying;
+  }
+
+  /**
+   * A read as its caller asked for it: it tidies first, when that is due, and
+   * nothing within it tidies. The channels it reads one by one, the reads
+   * within it and the rows it writes are one read for the archive, so what it
+   * says of each message is so when it returns.
+   */
+  async outerRead(read) {
+    if (!this.readScope || this.readScope.getStore() !== undefined) return read();
+    if (this.archiveEnabled && !this.closed) await this.pruneWhenDue();
+    const scope = { receipts: false };
+    try {
+      return await this.readScope.run(scope, read);
+    } finally {
+      if (scope.receipts) this.receiptWindows--;
+    }
+  }
+
+  /** From here until the outer read returns, what it says of the archive is to stay so: tidying waits. */
+  async givingReceipts() {
+    const scope = this.readScope?.getStore();
+    if (!scope || scope.receipts) return;
+    while (this.tidying) await this.tidying;
+    this.receiptWindows++;
+    scope.receipts = true;
+  }
+
   /** Removes what the policy no longer keeps. A failure is said, since the archive then keeps growing in plain text. */
   async prune() {
     const policy = this.archivePolicy;
@@ -518,6 +652,11 @@ export class NodeRuntime {
     this.prunedAt = this.now();
     try {
       await pruneArchive(this.home, policy, { now: this.now() });
+      // What the end of each file held may be gone with it, and with it a row
+      // this process wrote at a read whose cursor was not written: the next
+      // read looks in the file again.
+      this.archiveBefore.clear();
+      this.writtenDown.clear();
     } catch (error) {
       this.note("archive", "unpruned", `the archive was not pruned: ${error.code || error.name}: ${error.message}. It keeps growing, and what is in it stays readable to whoever can read this folder.`);
     }
@@ -530,11 +669,100 @@ export class NodeRuntime {
    */
   async archive(label, record) {
     if (!this.archiveEnabled || this.closed) return false;
+    // Before the row, never after it: a ceiling under one row took the row just
+    // written, and the read said archived (the fourth release check of 14
+    // November 2026). Within a read, never: the outer read tidies before it
+    // begins.
+    await this.pruneWhenDue();
     await appendRecord(this.home, archiveName(label), record);
-    if (this.now() - this.prunedAt > 3600) await this.prune();
     return true;
   }
 
+  /**
+   * What earlier processes wrote to this channel's archive, from the end of
+   * the file, as deliveries. The end is enough for what an earlier process
+   * wrote and did not get past with its cursor, which was written last: a
+   * read takes at most a thread's megabyte of messages. A row further back is
+   * not found, and that delivery is written down again. The rows are the ones
+   * the archive's own reader counts, by its rules: past a byte order mark at
+   * the start of the file, UTF-8, JSON. The first line of the end counts when
+   * it starts where a line starts, and is passed by when it is the tail of a
+   * line cut by where the end begins.
+   *
+   * Read again when the file is not the one that was read: replaced, as a
+   * prune replaces it, or shorter. A row a prune had removed was still taken
+   * as there, and the message said archived: true with no row behind it (the
+   * release check of 14 November 2026).
+   */
+  async archivedBefore(label) {
+    const name = archiveName(label);
+    const path = join(this.home, "archive", name + ".jsonl");
+    let found = null;
+    try {
+      found = await fsStat(path, { bigint: true });
+    } catch {
+      found = null;
+    }
+    const version = found === null ? null : `${found.dev}:${found.ino}`;
+    const size = found === null ? 0 : Number(found.size);
+    const held = this.archiveBefore.get(name);
+    if (held && held.version === version && size >= held.size) return held.rows;
+    // Another file now, or a shorter one: what this process wrote to it at a
+    // read that did not get past its cursor is looked for in it again.
+    if (held) for (const [delivery, at] of [...this.writtenDown]) if (at === name) this.writtenDown.delete(delivery);
+    const rows = new Set();
+    if (found !== null) {
+      let handle = null;
+      try {
+        handle = await open(path, "r");
+        const start = Math.max(0, size - this.archiveTailBytes);
+        // The byte before the end says whether its first line is whole.
+        const from = Math.max(0, start - 1);
+        const buffer = Buffer.alloc(size - from);
+        let filled = 0;
+        while (filled < buffer.length) {
+          const { bytesRead } = await handle.read(buffer, filled, buffer.length - filled, from + filled);
+          if (bytesRead === 0) break;
+          filled += bytesRead;
+        }
+        let bytes = buffer.subarray(0, filled);
+        let whole = true;
+        if (start > 0) {
+          whole = bytes[0] === 0x0a;
+          bytes = bytes.subarray(1);
+        } else if (bytes.length >= 3 && bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf) {
+          bytes = bytes.subarray(3);
+        }
+        const lines = [];
+        for (let at = 0; at < bytes.length; ) {
+          let end = bytes.indexOf(0x0a, at);
+          if (end === -1) end = bytes.length;
+          lines.push(bytes.subarray(at, end));
+          at = end + 1;
+        }
+        if (!whole) lines.shift();
+        for (const raw of lines) {
+          let row;
+          try {
+            row = JSON.parse(new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw));
+          } catch {
+            continue;
+          }
+          if (isObject(row) && row.kind === "received" && typeof row.w === "string" && typeof row.instance === "string" && Number.isInteger(row.seq) && typeof row.sha256 === "string") {
+            rows.add([row.w, row.instance, row.seq, row.sha256].join("\u0000"));
+          }
+        }
+      } catch {
+        // One that cannot be read: there is no row to use again.
+        rows.clear();
+      } finally {
+        await handle?.close();
+      }
+    }
+    this.archiveBefore.set(name, { rows, version, size });
+    return rows;
+  }
+
   /** The same for a record of something that is done already: what went wrong is given back, said in attention, and never thrown. */
   async archiveSafely(label, record, what) {
     try {
@@ -568,6 +796,8 @@ export class NodeRuntime {
   /** Removes what the policy no longer keeps, or with everything the whole archive, and says how much went. */
   async archivePrune({ everything = false } = {}) {
     const gone = await pruneArchive(this.home, this.archivePolicy, { now: this.now(), everything });
+    this.archiveBefore.clear();
+    this.writtenDown.clear();
     return { ...(await this.archiveStatus()), removed: gone.removed };
   }
 
@@ -2210,6 +2440,11 @@ export class NodeRuntime {
    * board inbox is waited on, and the others are asked once.
    */
   async boardPoll(wait = 0) {
+    return this.outerRead(() => this.boardPollHeld(wait));
+  }
+
+  /** boardPoll, as one read for the archive. */
+  async boardPollHeld(wait) {
     this.dropExpired();
     const now = this.now();
     const boards = this.state.channels.filter((channel) => isObject(channel) && (channel.label === "board" || String(channel.label).startsWith("board-")) && !channel.muted && Number(channel.expire_at) > now)
@@ -2280,6 +2515,9 @@ export class NodeRuntime {
     // and the copies held here are later readings of it.
     const stored = count(rows.map(one));
     const written = count(held.filter((entry) => entry.archived !== false).map(one));
+    // A copy held here whose row an earlier process wrote wrote none: it is a
+    // later reading of that row (the release check of 14 November 2026).
+    for (const [delivery, times] of this.rowsReused) if (written.has(delivery)) written.set(delivery, Math.max(0, written.get(delivery) - times));
     const earlier = new Set([...stored].filter(([delivery, rowsOfIt]) => rowsOfIt > (written.get(delivery) ?? 0)).map(([delivery]) => delivery));
     const out = [];
     const skipped = [];
@@ -2365,12 +2603,9 @@ export class NodeRuntime {
     const raw = message.body;
     if (!message.verified || !message.from) return [{ text: raw }, { signed: false, encrypted: false, format: "unsigned" }];
     if (!isEnvelope(raw)) {
-      let parsed;
-      try {
-        parsed = JSON.parse(raw);
-      } catch {
-        return [{ text: raw }, { signed: true, encrypted: false, format: "text" }];
-      }
+      const read = bodyJson(raw);
+      if (read === null) return [{ text: raw }, { signed: true, encrypted: false, format: "text" }];
+      const parsed = read.value;
       return isObject(parsed) ? [parsed, { signed: true, encrypted: false, format: "json" }] : [{ text: raw }, { signed: true, encrypted: false, format: "json" }];
     }
     let text;
@@ -2382,12 +2617,9 @@ export class NodeRuntime {
     } catch (error) {
       return [{ text: null }, { signed: true, encrypted: true, format: "unreadable", error: error.name || "Error" }];
     }
-    let parsed;
-    try {
-      parsed = JSON.parse(text);
-    } catch {
-      return [{ text }, { signed: true, encrypted: true, format: "text" }];
-    }
+    const read = bodyJson(text);
+    if (read === null) return [{ text }, { signed: true, encrypted: true, format: "text" }];
+    const parsed = read.value;
     return isObject(parsed) ? [parsed, { signed: true, encrypted: true, format: "json" }] : [{ text: parsed }, { signed: true, encrypted: true, format: "json" }];
   }
 
@@ -2445,21 +2677,46 @@ export class NodeRuntime {
    * one before it redelivers what the stored hashes then mark as replays.
    */
   async poll(channel, wait = 0, limit = null, maxBytes = null) {
+    return this.outerRead(() => this.pollHeld(channel, wait, limit, maxBytes));
+  }
+
+  /** One poll, inside the read it belongs to. */
+  async pollHeld(channel, wait, limit, maxBytes) {
     const before = { after: channel.after, created_at: channel.created_at, instance: channel.instance ?? null, expire_at: channel.expire_at, gone: channel.gone, seen: [...channel.seen], seen_from: [...(channel.seen_from ?? [])], peers: { ...this.state.peers } };
     try {
       return await this.pollOnce(channel, wait, limit, true, maxBytes);
     } catch (error) {
-      if (!error?.notSaved) throw error;
       // What this read changed is undone in memory too: the cursor, the hashes
       // and the bindings stay as the file has them, and the messages wait at
-      // the service for the next read, which hands them over.
+      // the service for the next read, which hands them over. Whatever stopped
+      // the read: one that threw halfway through its messages kept the hashes of
+      // the ones it had taken, the next channel's save wrote them down, and the
+      // next read handed those messages over marked replay, never having handed
+      // them over at all (the release check of 13 November 2026).
       Object.assign(channel, { after: before.after, created_at: before.created_at, instance: before.instance, expire_at: before.expire_at, gone: before.gone, seen: before.seen, seen_from: before.seen_from });
       this.state.peers = before.peers;
+      if (!error?.notSaved) throw error;
       this.note(channel.label, "not_saved", `what this read found here could not be written down (${error.cause?.code || error.cause?.message}), so nothing from this channel was handed over. It is still there for the next read, and nothing was skipped.`, channel.w);
       return [];
     }
   }
 
+  /**
+   * One channel of a read across channels, and what went wrong there said in
+   * attention rather than thrown, as aamio-python and aamio-php do. One channel
+   * that threw rejected the whole read, and what the channels before it had
+   * handed over, their cursors already saved, was lost (a security review of
+   * 13 November 2026).
+   */
+  async pollSafely(channel, wait, limit, maxBytes) {
+    try {
+      return await this.poll(channel, wait, limit, maxBytes);
+    } catch (error) {
+      this.note(channel.label, "unread", `this channel could not be read: ${error?.name || "Error"}. Messages from the other channels are still returned.`);
+      return [];
+    }
+  }
+
   async saveRead() {
     try {
       await this.saveState();
@@ -2606,6 +2863,13 @@ export class NodeRuntime {
     // cursor cannot be written, so the same rows are not written down again
     // when this process reads them again.
     const written = [];
+    // The outer read tidied before it began, and from the first message weighed
+    // for the archive nothing tidies until it returns, in this read or another:
+    // what it says of the archive is so as it returns. Tidied here, channel by
+    // channel, a ceiling under one row took the first channel's row when the
+    // hour passed before the second (the fifth release check of 14 November
+    // 2026).
+    if (Array.isArray(data.messages) && data.messages.length > 0 && this.archiveEnabled && !this.closed) await this.givingReceipts();
     for (const raw of data.messages) {
       if (limit !== null && entries.length >= limit) break;
       const entry = this.readEntry(channel, raw);
@@ -2680,13 +2944,33 @@ export class NodeRuntime {
       if (typeof channel.instance === "string") row.instance = channel.instance;
       const delivery = this.deliveryOf(channel, entry);
       if (this.archiveEnabled) {
+        // The file first: one that is another now, or shorter, makes this
+        // process forget what it wrote to it, and that is looked for in it
+        // again (the third release check of 14 November 2026).
+        const before = delivery !== null && typeof channel.instance === "string" ? await this.archivedBefore(channel.label) : new Set();
+        if (delivery !== null && !this.writtenDown.has(delivery) && before.has(delivery)) {
+          // Written down by an earlier process that stopped before its cursor:
+          // the row holds the same message and is used again, where it was
+          // written a second time (the release check of 14 November 2026). A
+          // row without the thread's instance, from a version before it was
+          // kept, could be another delivery, so both are kept.
+          this.writtenDown.set(delivery, archiveName(channel.label));
+          const shown = [channel.w, channel.instance, entry.seq].join("\u0000");
+          this.rowsReused.set(shown, (this.rowsReused.get(shown) ?? 0) + 1);
+        }
         if (delivery !== null && this.writtenDown.has(delivery)) {
-          // Written down at a read whose cursor could not be saved, by this process.
+          // Written down at a read that did not get as far as its cursor, by this process or an earlier one.
           entry.archived = true;
         } else {
           try {
             entry.archived = (await this.archive(channel.label, row)) !== false;
-            if (entry.archived && delivery !== null) written.push(delivery);
+            if (entry.archived && delivery !== null) {
+              written.push(delivery);
+              // Known at once: a read that throws before its cursor is written
+              // reads it again, and wrote it down a second time (the release
+              // check of 14 November 2026).
+              this.writtenDown.set(delivery, archiveName(channel.label));
+            }
           } catch (error) {
             entry.archived = false;
             said.push(["archive_failed", `message ${entry.seq} was handed over and could not be written to the archive: ${error.code || error.name}: ${error.message}. The archive does not have it.`]);
@@ -2739,7 +3023,7 @@ export class NodeRuntime {
     try {
       await this.saveRead();
     } catch (error) {
-      for (const delivery of written) this.writtenDown.add(delivery);
+      for (const delivery of written) this.writtenDown.set(delivery, archiveName(channel.label));
       throw error;
     }
     for (const [state, what] of said) this.note(channel.label, state, what, channel.w);
@@ -2866,6 +3150,13 @@ export class NodeRuntime {
 
   /** Messages on every channel still read, the inbox first. The inbox is opened and presence published as the read starts. */
   async read({ wait = 0, limit = 50, maxBytes = null } = {}) {
+    // The channels it reads one by one are one read for the archive: it is
+    // tidied before the first, and not again until this returns.
+    return this.outerRead(() => this.readHeld({ wait, limit, maxBytes }));
+  }
+
+  /** read, as one read for the archive. */
+  async readHeld({ wait, limit, maxBytes }) {
     const noted = this.attention.length;
     await this.ensureInbox();
     await this.publishPresence();
@@ -2896,11 +3187,11 @@ export class NodeRuntime {
         notAsked.push(channel);
         continue;
       }
-      messages.push(...(await this.poll(channel, 0, limit - messages.length, maxBytes)));
+      messages.push(...(await this.pollSafely(channel, 0, limit - messages.length, maxBytes)));
     }
     const inbox = this.channel("inbox");
     if (!messages.length && wait > 0 && inbox && !inbox.muted) {
-      messages.push(...(await this.poll(inbox, wait, limit, maxBytes)));
+      messages.push(...(await this.pollSafely(inbox, wait, limit, maxBytes)));
       // What reached the other channels during the wait comes with this
       // answer, as in aamio-python: only the inbox can end the wait early. It
       // used to wait for the next read (a review of 9 November 2026).
@@ -2910,7 +3201,7 @@ export class NodeRuntime {
           notAskedAfter.push(channel);
           continue;
         }
-        messages.push(...(await this.poll(channel, 0, limit - messages.length, maxBytes)));
+        messages.push(...(await this.pollSafely(channel, 0, limit - messages.length, maxBytes)));
       }
     }
     for (const channel of notAsked) {