nervur 0.19.0 → 0.19.2

package/dist/being/lent.js

@@ -53,7 +53,16 @@ export class Lent extends Being {
             return bp;
         return { ...bp, asks: [...bp.asks, LENT_ASKS.offer, LENT_ASKS.retract] };
     }
+    // An offer is open until it is taken or retracted. The taker's knock is the
+    // first word she hears from the occupant she minted for it, so hearing
+    // from that id closes the offer, and `open` holds only offers still
+    // waiting and not every lend she ever made.
     async answer(asker, method, args = {}) {
+        const open = this.cells.open;
+        if (open && asker.id !== undefined && asker.id !== BOX)
+            for (const [heir, id] of Object.entries(open))
+                if (id === asker.id)
+                    delete open[heir];
         if (asker.id === BOX && method === 'offer')
             return this.offer();
         if (asker.id === BOX && method === 'retract')

package/dist/conformance/store.js

@@ -22,7 +22,6 @@ export function conformStore(label, make, { test }) {
         assert.deepEqual(await s.list(), []);
         assert.equal(await s.load('main'), undefined);
         assert.equal(await s.take('main'), undefined);
-        assert.deepEqual(await s.hints(), {});
     });
     t('put, then load: seed, partition and record come back as they went in', async () => {
         const s = await make();
@@ -111,13 +110,4 @@ export function conformStore(label, make, { test }) {
         await s.put('main', kept(9));
         assert.deepEqual((await s.load('main')).seed, seed(9));
     });
-    t('hints are kept by pk and the last one wins', async () => {
-        const s = await make();
-        const pk = 'cd'.repeat(64);
-        await s.hint(pk, 'https://quo.acme.com/quo');
-        await s.hint('ef'.repeat(64), 'http://127.0.0.1:1/quo');
-        assert.deepEqual(await s.hints(), { [pk]: 'https://quo.acme.com/quo', ['ef'.repeat(64)]: 'http://127.0.0.1:1/quo' });
-        await s.hint(pk, 'https://quo.other.com/quo');
-        assert.equal((await s.hints())[pk], 'https://quo.other.com/quo');
-    });
 }

package/dist/harbor/core.d.ts

@@ -39,10 +39,12 @@ export declare class Harbor {
     protected boxFor(name: string, _record: WardRecord): Promise<Invitation | undefined>;
     boot(): Promise<void>;
     partitionOf(name: string): Record<string, unknown> | undefined;
+    quiet(): Promise<void>;
     carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
     deliver(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
     hint(pk: string, url: string): void;
-    remember(pk: string, url: string): Promise<void>;
+    learn(pk: string, url: string): Promise<boolean>;
+    forget(pk: string): void;
     prove(pk: string, reach: Reach): Promise<boolean>;
     bind(pks: string[], reach: Reach, held: boolean): Promise<void>;
     unbind(reach: Reach): void;

package/dist/harbor/core.js

@@ -12,8 +12,10 @@
 // doors; a socket a dialer holds to it, bound once the door behind the
 // dialer's claim has proved it holds the key, and unbound at close; the
 // claims of a listener this harbor dialed, proved the same way and reached
-// through that line; and a hint, a pk at a URL, kept in the store. A hint
-// never displaces a reach proved at a door. And one fallback: a dialer with nothing in its
+// through that line; and a hint, a pk at a URL. A hint never displaces a
+// reach proved at a door. The directory lives in memory and is kept by no
+// store: whoever learns a hint keeps it where it keeps everything, in a
+// being's cells, and hands it back at every boot. And one fallback: a dialer with nothing in its
 // directory for a pk sends down the socket it holds, because the listener
 // it dialed is the rendezvous and may hold that pk on another socket. Bytes
 // that arrive from the wire go to an own door or a held socket and never
@@ -40,6 +42,9 @@ const PROVING = 8;
 // How many times each reach has announced: a proof from an older announce
 // binds nothing when it lands.
 const announces = new WeakMap();
+// The reaches that are hints, so a hint can be replaced and put down without
+// touching a reach a door proved.
+const hinted = new WeakSet();
 export class Harbor {
     store;
     loader;
@@ -92,9 +97,9 @@ export class Harbor {
     boxFor(name, _record) {
         return this.offering?.(name) ?? Promise.resolve(undefined);
     }
-    // Boot every ward the store keeps, and learn the hints. One ward that will
-    // not host, a partition this kit cannot read or a loader that throws, is
-    // named in `unbooted` and takes nobody else down with it.
+    // Boot every ward the store keeps. One ward that will not host, a
+    // partition this kit cannot read or a loader that throws, is named in
+    // `unbooted` and takes nobody else down with it.
     async boot() {
         for (const name of await this.store.list()) {
             // A ward this harbor already hosts is not booted twice. A terrain that
@@ -111,8 +116,6 @@ export class Harbor {
                 this.unbooted.push(name);
             }
         }
-        for (const [pk, url] of Object.entries(await this.store.hints()))
-            this.hint(pk, url);
     }
     // The object a ward writes into, by the name it is kept under: the
     // partition the harbor was handed at boot and keeps so it can save it.
@@ -126,6 +129,19 @@ export class Harbor {
         return this.#saving.get(name)?.memory;
     }
     // ---- saving
+    // Every ward's writes kept and none waiting: no row named, no save armed
+    // and none in flight. A write can name a row while another ward is being
+    // saved, so this goes round until a pass finds nothing. A process about to
+    // exit waits here, since its exit is not a turn the timer is given.
+    async quiet() {
+        for (;;) {
+            const busy = [...this.#saving].filter(([, s]) => !s.gone && (s.dirty.size > 0 || s.timer !== undefined || s.running !== null));
+            if (busy.length === 0)
+                return;
+            for (const [name, s] of busy)
+                await (s.running ?? this.#flush(name));
+        }
+    }
     // The ward wrote one row. Its partition is saved once the line is free, and
     // once for every burst of writes, with every row named in that burst.
     #wrote(name, row) {
@@ -362,14 +378,38 @@ export class Harbor {
         const bound = this.reaches.get(pk);
         return bound?.held ? bound.reach.carry(pk, bytes) : undefined;
     }
+    // A hint, taken on the word of whoever gives it. A hint already standing
+    // for the pk is replaced, since a URL is the one part of a ward that moves;
+    // a reach proven at a door is never displaced by one.
     hint(pk, url) {
-        if (this.reaches.has(pk))
+        const standing = this.reaches.get(pk);
+        if (standing && !hinted.has(standing.reach))
             return; // a reach proven at a door beats a hint, held or reached through a dialed line
-        this.reaches.set(pk, { reach: request(url), held: false });
+        const reach = request(url);
+        hinted.add(reach);
+        this.reaches.set(pk, { reach, held: false });
     }
-    async remember(pk, url) {
+    // A hint kept only once the door behind it has proven it holds the pk's
+    // key, the same probe an announce is proven by. A URL that answers for
+    // another ward, or for nobody, is refused and nothing is kept: whoever
+    // hands a harbor a hint could otherwise point one ward's asks at a place
+    // that drops them. True is kept.
+    async learn(pk, url) {
+        const standing = this.reaches.get(pk);
+        if (standing && !hinted.has(standing.reach))
+            return true; // already reached, and proven at a door
+        const reach = request(url);
+        if (!(await this.prove(pk, reach)))
+            return false;
         this.hint(pk, url);
-        await this.store.hint(pk, url);
+        return true;
+    }
+    // A hint put down. A reach proven at a door is the line's, and goes when
+    // the line does, never by a word from here.
+    forget(pk) {
+        const standing = this.reaches.get(pk);
+        if (standing && hinted.has(standing.reach))
+            this.reaches.delete(pk);
     }
     // An announce is a claim, and a claim binds nothing until proven: anyone
     // who can reach a listener could otherwise name a pk that is not theirs and

package/dist/harbor/reach.js

@@ -20,6 +20,7 @@
 // A reach that sent the bytes and lost the line afterwards answers nothing
 // at all, and the ward's own bound ends the ask.
 import { concat, hex, unhex } from '../ward/arithmetic.js';
+import { readJson } from '../ward/json.js';
 const never = () => new Promise(() => { }); // sent, and no word since: the ward's bound decides
 // A request reach to one listener.
 export function request(url) {
@@ -111,7 +112,9 @@ export class Socket {
         line.addEventListener('message', (e) => {
             if (typeof e.data === 'string') {
                 try {
-                    const m = JSON.parse(e.data);
+                    const m = readJson(e.data);
+                    if (m === null || typeof m !== 'object')
+                        return;
                     // Absent is this suite: a side that says nothing says one.
                     if (m.suite !== undefined && m.suite !== SUITE) {
                         this.far = [];
@@ -129,9 +132,14 @@ export class Socket {
                 return;
             }
             const buf = e.data instanceof ArrayBuffer ? new Uint8Array(e.data) : ArrayBuffer.isView(e.data) ? new Uint8Array(e.data.buffer, e.data.byteOffset, e.data.byteLength) : undefined;
+            // A frame that is none of the three is not a frame: an unknown kind, an
+            // ask too short to hold a pk, a nothing with bytes after its id. It is
+            // dropped, and tells no ask waiting on its id that nothing was delivered.
             if (!buf || buf.length < 5)
                 return;
             const kind = buf[0], id = new DataView(buf.buffer, buf.byteOffset, buf.byteLength).getUint32(1);
+            if (kind > NONE || (kind === ASK && buf.length < 69) || (kind === NONE && buf.length !== 5))
+                return;
             if (kind === ASK) {
                 const pk = hex(buf.subarray(5, 69));
                 // A deliver that rejects has delivered nothing this side can vouch

package/dist/harbor/store.d.ts

@@ -15,8 +15,6 @@ export type Store = {
     save(name: string, partition: Record<string, unknown>, rows: readonly string[]): Promise<void>;
     record(name: string, record: WardRecord): Promise<void>;
     take(name: string): Promise<Kept | undefined>;
-    hints(): Promise<Record<string, string>>;
-    hint(pk: string, url: string): Promise<void>;
 };
 export declare const values: (p: Record<string, unknown>) => Record<string, unknown>;
 export declare const rowsOf: (partition: Record<string, unknown>, rows: readonly string[]) => [string, Record<string, unknown> | undefined][];
@@ -27,14 +25,11 @@ type Row = {
 };
 export declare class MemoryStore implements Store {
     readonly rows: Map<string, Row>;
-    readonly reach: Map<string, string>;
     list(): Promise<string[]>;
     load(name: string): Promise<Kept | undefined>;
     put(name: string, kept: Kept): Promise<void>;
     save(name: string, partition: Record<string, unknown>, rows: readonly string[]): Promise<void>;
     record(name: string, record: WardRecord): Promise<void>;
     take(name: string): Promise<Kept | undefined>;
-    hints(): Promise<Record<string, string>>;
-    hint(pk: string, url: string): Promise<void>;
 }
 export {};

package/dist/harbor/store.js

@@ -2,8 +2,7 @@
 // The store: keeping wards by name. A ward is three things and the store
 // keeps all three under one name: the seed, the partition and the ward
 // record, which says where the class bodies come from and which being is
-// the user's. Plus the directory's hints, which are the harbor's and
-// survive a restart. The store reads nothing it keeps; the partition is
+// the user's. The store reads nothing it keeps; the partition is
 // values the ward wrote, and the seed is bytes only the ward derives from.
 // Every terrain has one: files on a disk, IndexedDB in a tab, an object's
 // storage on the edge; the memory store below is the library's own, for a
@@ -31,7 +30,6 @@ const keep = (row, partition, rows) => {
 };
 export class MemoryStore {
     rows = new Map();
-    reach = new Map();
     async list() {
         return [...this.rows.keys()];
     }
@@ -61,10 +59,4 @@ export class MemoryStore {
         this.rows.delete(name);
         return kept;
     }
-    async hints() {
-        return Object.fromEntries(this.reach);
-    }
-    async hint(pk, url) {
-        this.reach.set(pk, url);
-    }
 }

package/dist/vector/stand.js

@@ -18,6 +18,7 @@
 // world runs on.
 import { SUITE } from '../harbor/reach.js';
 import { hex } from '../ward/arithmetic.js';
+import { readJson } from '../ward/json.js';
 import { caseNamed, stand } from './cases.js';
 import { partitionDigest } from './world.js';
 const CORS = {
@@ -39,7 +40,7 @@ export class Stand {
         if (method === 'POST' && p === '/stand') {
             let named;
             try {
-                named = JSON.parse(new TextDecoder().decode(body));
+                named = readJson(body);
             }
             catch {
                 return NONE;

package/dist/ward/arithmetic.js

@@ -59,8 +59,10 @@ export function sameBytes(a, b) {
         diff |= a[at] ^ b[at];
     return diff === 0;
 }
-// The eight small-order points of Ed25519, in their canonical encoding. A
-// public key among them verifies nothing. An encoding whose y coordinate is
+// The eight small-order points of Ed25519, in their canonical encoding, and
+// the two points with x = 0 spelled with the sign bit set, which a decoder
+// that ignores the bit reads as the same point. A public key among them
+// verifies nothing. An encoding whose y coordinate is
 // not reduced, y at or above the field's prime p, names one of the same
 // points under another spelling, and a terrain's verify may accept a zero
 // signature under it; the field has room for the spelling, so it is refused
@@ -74,6 +76,8 @@ const SMALL_ORDER = [
     'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a',
     '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85',
     'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',
+    '0100000000000000000000000000000000000000000000000000000000000080',
+    'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff',
 ].map(unhex);
 // y >= p, read little-endian with the sign bit masked off: the top byte is
 // 0x7f under the mask, every middle byte is 0xff, and the low byte is at

package/dist/ward/json.d.ts

@@ -0,0 +1,2 @@
+export declare function numberFault(literal: string): string | null;
+export declare function readJson(input: Uint8Array | string): unknown;

package/dist/ward/json.js

@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: Apache-2.0
+// The one reader of JSON that crossed an edge. A runtime's own parser is
+// where two kits stop agreeing: it keeps the last of two keys of one name,
+// rounds a whole number no double holds, reads a number past the doubles as
+// infinity, and mends bytes that are not UTF-8 into a replacement character.
+// Each of those is text two kits read two ways, so each is refused here, where
+// it is read, with a throw the caller already turns into what bytes that said
+// nothing are.
+//
+// What a value is beyond its text, a lone surrogate, a key named `__proto__`,
+// a nesting past the bound, is the value rule's, and `cellFault` in cells.ts
+// is its one reader. This file holds the rules that live only in the text.
+const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+const fail = (at, why) => {
+    throw new Error(`JSON at ${at}: ${why}`);
+};
+// A number text, held to the Values chapter. A text naming a whole number
+// stands only if that number is exactly a double, or if the text is how
+// ECMAScript writes the double it reads as. A text past the largest double,
+// or naming a value other than zero that rounds to zero, is refused, and so
+// is minus zero in any spelling.
+export function numberFault(literal) {
+    const m = /^(-?)(0|[1-9]\d*)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec(literal);
+    if (!m)
+        return 'not a number';
+    const [, sign, whole, frac = '', exp = '0'] = m;
+    const v = Number(literal);
+    if (!Number.isFinite(v))
+        return 'past the largest double';
+    let digits = (whole + frac).replace(/^0+/, '');
+    if (v === 0) {
+        if (digits !== '')
+            return 'a value other than zero that rounds to zero';
+        return sign ? 'minus zero' : null;
+    }
+    // The exact value is digits times ten to e. A finite double bounds e from
+    // above, so the power below is never larger than the double's own width.
+    let e = BigInt(exp) - BigInt(frac.length);
+    const trimmed = digits.replace(/0+$/, '');
+    e += BigInt(digits.length - trimmed.length);
+    digits = trimmed;
+    if (e < 0n)
+        return null; // a fraction: the double nearest it, as every reader takes it
+    const exact = BigInt(digits) * 10n ** e;
+    if (exact === (v < 0 ? -BigInt(v) : BigInt(v)))
+        return null;
+    return literal === String(v) ? null : 'a whole number that is not exactly a double';
+}
+// Bytes to a value, or a throw.
+export function readJson(input) {
+    const s = typeof input === 'string' ? input : utf8.decode(input);
+    let at = 0;
+    const space = () => {
+        for (;;) {
+            const c = s.charCodeAt(at);
+            if (c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d)
+                at += 1;
+            else
+                return;
+        }
+    };
+    const string = () => {
+        const start = at;
+        at += 1;
+        for (;;) {
+            const c = s.charCodeAt(at);
+            if (Number.isNaN(c))
+                fail(start, 'an unterminated string');
+            if (c === 0x22)
+                break;
+            if (c < 0x20)
+                fail(at, 'a control character in a string');
+            at += c === 0x5c ? 2 : 1;
+        }
+        at += 1;
+        // The escapes are JSON's own, and the runtime reads them the one way.
+        return JSON.parse(s.slice(start, at));
+    };
+    const value = () => {
+        space();
+        const c = s[at];
+        if (c === '{') {
+            at += 1;
+            const out = {};
+            const keys = new Set();
+            space();
+            if (s[at] === '}') {
+                at += 1;
+                return out;
+            }
+            for (;;) {
+                space();
+                if (s[at] !== '"')
+                    fail(at, 'a key that is not a string');
+                const where = at;
+                const k = string();
+                if (keys.has(k))
+                    fail(where, `two keys named ${JSON.stringify(k)}`);
+                keys.add(k);
+                space();
+                if (s[at] !== ':')
+                    fail(at, 'a key with no colon');
+                at += 1;
+                // Defined, never assigned: a key named `__proto__` is an own key here
+                // as it is in JSON.parse, and the value rule refuses it after.
+                Object.defineProperty(out, k, { value: value(), enumerable: true, writable: true, configurable: true });
+                space();
+                if (s[at] === ',')
+                    at += 1;
+                else if (s[at] === '}') {
+                    at += 1;
+                    return out;
+                }
+                else
+                    fail(at, 'an object not closed');
+            }
+        }
+        if (c === '[') {
+            at += 1;
+            const out = [];
+            space();
+            if (s[at] === ']') {
+                at += 1;
+                return out;
+            }
+            for (;;) {
+                out.push(value());
+                space();
+                if (s[at] === ',')
+                    at += 1;
+                else if (s[at] === ']') {
+                    at += 1;
+                    return out;
+                }
+                else
+                    fail(at, 'a list not closed');
+            }
+        }
+        if (c === '"')
+            return string();
+        for (const [word, v] of [['true', true], ['false', false], ['null', null]]) {
+            if (s.startsWith(word, at)) {
+                at += word.length;
+                return v;
+            }
+        }
+        const m = /-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?/y;
+        m.lastIndex = at;
+        const hit = m.exec(s);
+        if (!hit)
+            return fail(at, 'no value');
+        const why = numberFault(hit[0]);
+        if (why !== null)
+            fail(at, `${hit[0]} is ${why}`);
+        at += hit[0].length;
+        return Number(hit[0]);
+    };
+    const out = value();
+    space();
+    if (at !== s.length)
+        fail(at, 'text after the value');
+    return out;
+}

package/dist/ward/seal.js

@@ -1,8 +1,8 @@
 import { isDoorWord } from '../being/silence.js';
 import { KEY, SIGNATURE, box, concat, derive, hex, sha256, sign, signingPair, sealingPair, unbox, unhex, verify } from './arithmetic.js';
 import { cellFault } from './cells.js';
+import { readJson } from './json.js';
 const utf8 = new TextEncoder();
-const text = new TextDecoder();
 // The two labels a ward's keys are derived under. They are here and not in
 // arithmetic.ts because a label is a decision and that file is arithmetic.
 // `quo-seal` is taken: it is the label the message cipher derives its key and
@@ -70,7 +70,7 @@ export async function openAsk(bytes, padlockSecret) {
             return null;
         const body = inside.subarray(0, inside.length - SIGNATURE);
         const signature = inside.subarray(inside.length - SIGNATURE);
-        const payload = JSON.parse(text.decode(body));
+        const payload = readJson(body);
         // The heir, or null for the public being. Absent is not null: a payload
         // that never named one is malformed, like any other missing field.
         const to = payload.to;
@@ -112,7 +112,9 @@ export async function sealReply(reply, ephemeralPk, wardSign, seed) {
 // lied, or it is not a reply. Every ward on the wire is somebody else's code,
 // so the shape is checked here and nowhere later: a reply is `{ silence }`,
 // `{ quo: word }` with a word the door may say, or `{ object, seen }` with an
-// object present and seen a digest or null.
+// object that is a value and seen a digest or null. A field beside a shape's
+// own makes it none of the three, since a kit that dropped the field would
+// hand her an answer where this one hands her silence.
 // Anything else is bytes that said nothing, and her ward never hands her a
 // throw or an absent value for what a stranger wrote.
 export async function openReply(bytes, ephemeralSecret, signPk) {
@@ -125,18 +127,21 @@ export async function openReply(bytes, ephemeralSecret, signPk) {
         const body = inside.subarray(0, inside.length - SIGNATURE);
         if (!(await verify(body, inside.subarray(inside.length - SIGNATURE), signPk)))
             return null;
-        const reply = JSON.parse(text.decode(body));
+        const reply = readJson(body);
         if (reply === null || typeof reply !== 'object' || Array.isArray(reply))
             return null;
         const r = reply;
-        if (r.silence === true)
-            return { silence: true };
-        if (Object.hasOwn(r, 'quo'))
+        const keys = Object.keys(r).sort().join(',');
+        if (keys === 'silence')
+            return r.silence === true ? { silence: true } : null;
+        if (keys === 'quo')
             return isDoorWord(r.quo) ? { quo: r.quo } : null;
-        if (!Object.hasOwn(r, 'object') || r.object === undefined)
+        if (keys !== 'object,seen')
             return null;
         if (r.seen !== null && !isHex(r.seen))
             return null;
+        if (cellFault(r.object, 'object') !== null)
+            return null; // values in both directions: nested past the bound is none of the shapes
         return { object: r.object, seen: r.seen };
     }
     catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nervur",
-  "version": "0.19.0",
+  "version": "0.19.2",
   "description": "Nervur's kit of Quo: an object asks another object and gets an answer, without knowing where it is. Being, Ward, Harbor.",
   "keywords": [
     "quo",

package/src/being/lent.ts

@@ -58,7 +58,13 @@ export class Lent extends Being {
     return { ...bp, asks: [...bp.asks, LENT_ASKS.offer, LENT_ASKS.retract] };
   }
 
+  // An offer is open until it is taken or retracted. The taker's knock is the
+  // first word she hears from the occupant she minted for it, so hearing
+  // from that id closes the offer, and `open` holds only offers still
+  // waiting and not every lend she ever made.
   override async answer(asker: Asker, method?: string, args: JsonObject = {}): Promise<Reply> {
+    const open = this.cells.open as Record<string, string> | undefined;
+    if (open && asker.id !== undefined && asker.id !== BOX) for (const [heir, id] of Object.entries(open)) if (id === asker.id) delete open[heir];
     if (asker.id === BOX && method === 'offer') return this.offer();
     if (asker.id === BOX && method === 'retract') return this.retract(args);
     return super.answer(asker, method, args);

package/src/conformance/store.ts

@@ -27,7 +27,6 @@ export function conformStore(label: string, make: () => Promise<Store>, { test }
     assert.deepEqual(await s.list(), []);
     assert.equal(await s.load('main'), undefined);
     assert.equal(await s.take('main'), undefined);
-    assert.deepEqual(await s.hints(), {});
   });
 
   t('put, then load: seed, partition and record come back as they went in', async () => {
@@ -123,14 +122,4 @@ export function conformStore(label: string, make: () => Promise<Store>, { test }
     await s.put('main', kept(9));
     assert.deepEqual((await s.load('main'))!.seed, seed(9));
   });
-
-  t('hints are kept by pk and the last one wins', async () => {
-    const s = await make();
-    const pk = 'cd'.repeat(64);
-    await s.hint(pk, 'https://quo.acme.com/quo');
-    await s.hint('ef'.repeat(64), 'http://127.0.0.1:1/quo');
-    assert.deepEqual(await s.hints(), { [pk]: 'https://quo.acme.com/quo', ['ef'.repeat(64)]: 'http://127.0.0.1:1/quo' });
-    await s.hint(pk, 'https://quo.other.com/quo');
-    assert.equal((await s.hints())[pk], 'https://quo.other.com/quo');
-  });
 }

package/src/harbor/core.ts

@@ -12,8 +12,10 @@
 // doors; a socket a dialer holds to it, bound once the door behind the
 // dialer's claim has proved it holds the key, and unbound at close; the
 // claims of a listener this harbor dialed, proved the same way and reached
-// through that line; and a hint, a pk at a URL, kept in the store. A hint
-// never displaces a reach proved at a door. And one fallback: a dialer with nothing in its
+// through that line; and a hint, a pk at a URL. A hint never displaces a
+// reach proved at a door. The directory lives in memory and is kept by no
+// store: whoever learns a hint keeps it where it keeps everything, in a
+// being's cells, and hands it back at every boot. And one fallback: a dialer with nothing in its
 // directory for a pk sends down the socket it holds, because the listener
 // it dialed is the rendezvous and may hold that pk on another socket. Bytes
 // that arrive from the wire go to an own door or a held socket and never
@@ -110,6 +112,9 @@ const PROVING = 8;
 // How many times each reach has announced: a proof from an older announce
 // binds nothing when it lands.
 const announces = new WeakMap<Reach, number>();
+// The reaches that are hints, so a hint can be replaced and put down without
+// touching a reach a door proved.
+const hinted = new WeakSet<Reach>();
 
 export class Harbor {
   readonly store: Store;
@@ -166,9 +171,9 @@ export class Harbor {
     return this.offering?.(name) ?? Promise.resolve(undefined);
   }
 
-  // Boot every ward the store keeps, and learn the hints. One ward that will
-  // not host, a partition this kit cannot read or a loader that throws, is
-  // named in `unbooted` and takes nobody else down with it.
+  // Boot every ward the store keeps. One ward that will not host, a
+  // partition this kit cannot read or a loader that throws, is named in
+  // `unbooted` and takes nobody else down with it.
   async boot(): Promise<void> {
     for (const name of await this.store.list()) {
       // A ward this harbor already hosts is not booted twice. A terrain that
@@ -182,7 +187,6 @@ export class Harbor {
         this.unbooted.push(name);
       }
     }
-    for (const [pk, url] of Object.entries(await this.store.hints())) this.hint(pk, url);
   }
 
   // The object a ward writes into, by the name it is kept under: the
@@ -199,6 +203,18 @@ export class Harbor {
 
   // ---- saving
 
+  // Every ward's writes kept and none waiting: no row named, no save armed
+  // and none in flight. A write can name a row while another ward is being
+  // saved, so this goes round until a pass finds nothing. A process about to
+  // exit waits here, since its exit is not a turn the timer is given.
+  async quiet(): Promise<void> {
+    for (;;) {
+      const busy = [...this.#saving].filter(([, s]) => !s.gone && (s.dirty.size > 0 || s.timer !== undefined || s.running !== null));
+      if (busy.length === 0) return;
+      for (const [name, s] of busy) await (s.running ?? this.#flush(name));
+    }
+  }
+
   // The ward wrote one row. Its partition is saved once the line is free, and
   // once for every burst of writes, with every row named in that burst.
   #wrote(name: string, row: string): void {
@@ -418,14 +434,36 @@ export class Harbor {
     return bound?.held ? bound.reach.carry(pk, bytes) : undefined;
   }
 
+  // A hint, taken on the word of whoever gives it. A hint already standing
+  // for the pk is replaced, since a URL is the one part of a ward that moves;
+  // a reach proven at a door is never displaced by one.
   hint(pk: string, url: string): void {
-    if (this.reaches.has(pk)) return; // a reach proven at a door beats a hint, held or reached through a dialed line
-    this.reaches.set(pk, { reach: request(url), held: false });
+    const standing = this.reaches.get(pk);
+    if (standing && !hinted.has(standing.reach)) return; // a reach proven at a door beats a hint, held or reached through a dialed line
+    const reach = request(url);
+    hinted.add(reach);
+    this.reaches.set(pk, { reach, held: false });
   }
 
-  async remember(pk: string, url: string): Promise<void> {
+  // A hint kept only once the door behind it has proven it holds the pk's
+  // key, the same probe an announce is proven by. A URL that answers for
+  // another ward, or for nobody, is refused and nothing is kept: whoever
+  // hands a harbor a hint could otherwise point one ward's asks at a place
+  // that drops them. True is kept.
+  async learn(pk: string, url: string): Promise<boolean> {
+    const standing = this.reaches.get(pk);
+    if (standing && !hinted.has(standing.reach)) return true; // already reached, and proven at a door
+    const reach = request(url);
+    if (!(await this.prove(pk, reach))) return false;
     this.hint(pk, url);
-    await this.store.hint(pk, url);
+    return true;
+  }
+
+  // A hint put down. A reach proven at a door is the line's, and goes when
+  // the line does, never by a word from here.
+  forget(pk: string): void {
+    const standing = this.reaches.get(pk);
+    if (standing && hinted.has(standing.reach)) this.reaches.delete(pk);
   }
 
   // An announce is a claim, and a claim binds nothing until proven: anyone

package/src/harbor/reach.ts

@@ -20,6 +20,7 @@
 // A reach that sent the bytes and lost the line afterwards answers nothing
 // at all, and the ward's own bound ends the ask.
 import { concat, hex, unhex } from '../ward/arithmetic.ts';
+import { readJson } from '../ward/json.ts';
 
 export type Carry = (pk: string, bytes: Uint8Array) => Promise<Uint8Array | undefined>;
 export type Reach = { carry: Carry; close(): void };
@@ -136,7 +137,8 @@ export class Socket implements Reach {
     line.addEventListener('message', (e) => {
       if (typeof e.data === 'string') {
         try {
-          const m = JSON.parse(e.data) as { announce?: unknown; suite?: unknown };
+          const m = readJson(e.data) as { announce?: unknown; suite?: unknown };
+          if (m === null || typeof m !== 'object') return;
           // Absent is this suite: a side that says nothing says one.
           if (m.suite !== undefined && m.suite !== SUITE) {
             this.far = [];
@@ -153,9 +155,13 @@ export class Socket implements Reach {
         return;
       }
       const buf = e.data instanceof ArrayBuffer ? new Uint8Array(e.data) : ArrayBuffer.isView(e.data) ? new Uint8Array(e.data.buffer, e.data.byteOffset, e.data.byteLength) : undefined;
+      // A frame that is none of the three is not a frame: an unknown kind, an
+      // ask too short to hold a pk, a nothing with bytes after its id. It is
+      // dropped, and tells no ask waiting on its id that nothing was delivered.
       if (!buf || buf.length < 5) return;
       const kind = buf[0],
         id = new DataView(buf.buffer, buf.byteOffset, buf.byteLength).getUint32(1);
+      if (kind > NONE || (kind === ASK && buf.length < 69) || (kind === NONE && buf.length !== 5)) return;
       if (kind === ASK) {
         const pk = hex(buf.subarray(5, 69));
         // A deliver that rejects has delivered nothing this side can vouch

package/src/harbor/store.ts

@@ -2,8 +2,7 @@
 // The store: keeping wards by name. A ward is three things and the store
 // keeps all three under one name: the seed, the partition and the ward
 // record, which says where the class bodies come from and which being is
-// the user's. Plus the directory's hints, which are the harbor's and
-// survive a restart. The store reads nothing it keeps; the partition is
+// the user's. The store reads nothing it keeps; the partition is
 // values the ward wrote, and the seed is bytes only the ward derives from.
 // Every terrain has one: files on a disk, IndexedDB in a tab, an object's
 // storage on the edge; the memory store below is the library's own, for a
@@ -32,8 +31,6 @@ export type Store = {
   record(name: string, record: WardRecord): Promise<void>;
   // Take a ward out: the first move of a migration. What was kept comes back.
   take(name: string): Promise<Kept | undefined>;
-  hints(): Promise<Record<string, string>>;
-  hint(pk: string, url: string): Promise<void>;
 };
 
 // The partition is values only, and the ward hands it out through a guard,
@@ -64,7 +61,6 @@ type Row = { seed: Uint8Array; parts: Map<string, Record<string, unknown>>; reco
 
 export class MemoryStore implements Store {
   readonly rows = new Map<string, Row>();
-  readonly reach = new Map<string, string>();
 
   async list(): Promise<string[]> {
     return [...this.rows.keys()];
@@ -92,10 +88,4 @@ export class MemoryStore implements Store {
     this.rows.delete(name);
     return kept;
   }
-  async hints(): Promise<Record<string, string>> {
-    return Object.fromEntries(this.reach);
-  }
-  async hint(pk: string, url: string): Promise<void> {
-    this.reach.set(pk, url);
-  }
 }

package/src/vector/stand.ts

@@ -18,6 +18,7 @@
 // world runs on.
 import { SUITE } from '../harbor/reach.ts';
 import { hex } from '../ward/arithmetic.ts';
+import { readJson } from '../ward/json.ts';
 import { caseNamed, stand } from './cases.ts';
 import type { World } from './world.ts';
 import { partitionDigest } from './world.ts';
@@ -44,7 +45,7 @@ export class Stand {
     if (method === 'POST' && p === '/stand') {
       let named: { case?: unknown; name?: unknown };
       try {
-        named = JSON.parse(new TextDecoder().decode(body)) as typeof named;
+        named = readJson(body) as typeof named;
       } catch {
         return NONE;
       }

package/src/ward/arithmetic.ts

@@ -58,8 +58,10 @@ export function sameBytes(a: Uint8Array, b: Uint8Array): boolean {
   return diff === 0;
 }
 
-// The eight small-order points of Ed25519, in their canonical encoding. A
-// public key among them verifies nothing. An encoding whose y coordinate is
+// The eight small-order points of Ed25519, in their canonical encoding, and
+// the two points with x = 0 spelled with the sign bit set, which a decoder
+// that ignores the bit reads as the same point. A public key among them
+// verifies nothing. An encoding whose y coordinate is
 // not reduced, y at or above the field's prime p, names one of the same
 // points under another spelling, and a terrain's verify may accept a zero
 // signature under it; the field has room for the spelling, so it is refused
@@ -73,6 +75,8 @@ const SMALL_ORDER = [
   'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a',
   '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85',
   'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',
+  '0100000000000000000000000000000000000000000000000000000000000080',
+  'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff',
 ].map(unhex);
 // y >= p, read little-endian with the sign bit masked off: the top byte is
 // 0x7f under the mask, every middle byte is 0xff, and the low byte is at

package/src/ward/json.ts

@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: Apache-2.0
+// The one reader of JSON that crossed an edge. A runtime's own parser is
+// where two kits stop agreeing: it keeps the last of two keys of one name,
+// rounds a whole number no double holds, reads a number past the doubles as
+// infinity, and mends bytes that are not UTF-8 into a replacement character.
+// Each of those is text two kits read two ways, so each is refused here, where
+// it is read, with a throw the caller already turns into what bytes that said
+// nothing are.
+//
+// What a value is beyond its text, a lone surrogate, a key named `__proto__`,
+// a nesting past the bound, is the value rule's, and `cellFault` in cells.ts
+// is its one reader. This file holds the rules that live only in the text.
+
+const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+
+const fail = (at: number, why: string): never => {
+  throw new Error(`JSON at ${at}: ${why}`);
+};
+
+// A number text, held to the Values chapter. A text naming a whole number
+// stands only if that number is exactly a double, or if the text is how
+// ECMAScript writes the double it reads as. A text past the largest double,
+// or naming a value other than zero that rounds to zero, is refused, and so
+// is minus zero in any spelling.
+export function numberFault(literal: string): string | null {
+  const m = /^(-?)(0|[1-9]\d*)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec(literal);
+  if (!m) return 'not a number';
+  const [, sign, whole, frac = '', exp = '0'] = m;
+  const v = Number(literal);
+  if (!Number.isFinite(v)) return 'past the largest double';
+  let digits = (whole + frac).replace(/^0+/, '');
+  if (v === 0) {
+    if (digits !== '') return 'a value other than zero that rounds to zero';
+    return sign ? 'minus zero' : null;
+  }
+  // The exact value is digits times ten to e. A finite double bounds e from
+  // above, so the power below is never larger than the double's own width.
+  let e = BigInt(exp) - BigInt(frac.length);
+  const trimmed = digits.replace(/0+$/, '');
+  e += BigInt(digits.length - trimmed.length);
+  digits = trimmed;
+  if (e < 0n) return null; // a fraction: the double nearest it, as every reader takes it
+  const exact = BigInt(digits) * 10n ** e;
+  if (exact === (v < 0 ? -BigInt(v) : BigInt(v))) return null;
+  return literal === String(v) ? null : 'a whole number that is not exactly a double';
+}
+
+// Bytes to a value, or a throw.
+export function readJson(input: Uint8Array | string): unknown {
+  const s = typeof input === 'string' ? input : utf8.decode(input);
+  let at = 0;
+  const space = () => {
+    for (;;) {
+      const c = s.charCodeAt(at);
+      if (c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d) at += 1;
+      else return;
+    }
+  };
+  const string = (): string => {
+    const start = at;
+    at += 1;
+    for (;;) {
+      const c = s.charCodeAt(at);
+      if (Number.isNaN(c)) fail(start, 'an unterminated string');
+      if (c === 0x22) break;
+      if (c < 0x20) fail(at, 'a control character in a string');
+      at += c === 0x5c ? 2 : 1;
+    }
+    at += 1;
+    // The escapes are JSON's own, and the runtime reads them the one way.
+    return JSON.parse(s.slice(start, at)) as string;
+  };
+  const value = (): unknown => {
+    space();
+    const c = s[at];
+    if (c === '{') {
+      at += 1;
+      const out: Record<string, unknown> = {};
+      const keys = new Set<string>();
+      space();
+      if (s[at] === '}') {
+        at += 1;
+        return out;
+      }
+      for (;;) {
+        space();
+        if (s[at] !== '"') fail(at, 'a key that is not a string');
+        const where = at;
+        const k = string();
+        if (keys.has(k)) fail(where, `two keys named ${JSON.stringify(k)}`);
+        keys.add(k);
+        space();
+        if (s[at] !== ':') fail(at, 'a key with no colon');
+        at += 1;
+        // Defined, never assigned: a key named `__proto__` is an own key here
+        // as it is in JSON.parse, and the value rule refuses it after.
+        Object.defineProperty(out, k, { value: value(), enumerable: true, writable: true, configurable: true });
+        space();
+        if (s[at] === ',') at += 1;
+        else if (s[at] === '}') {
+          at += 1;
+          return out;
+        } else fail(at, 'an object not closed');
+      }
+    }
+    if (c === '[') {
+      at += 1;
+      const out: unknown[] = [];
+      space();
+      if (s[at] === ']') {
+        at += 1;
+        return out;
+      }
+      for (;;) {
+        out.push(value());
+        space();
+        if (s[at] === ',') at += 1;
+        else if (s[at] === ']') {
+          at += 1;
+          return out;
+        } else fail(at, 'a list not closed');
+      }
+    }
+    if (c === '"') return string();
+    for (const [word, v] of [['true', true], ['false', false], ['null', null]] as const) {
+      if (s.startsWith(word, at)) {
+        at += word.length;
+        return v;
+      }
+    }
+    const m = /-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?/y;
+    m.lastIndex = at;
+    const hit = m.exec(s);
+    if (!hit) return fail(at, 'no value');
+    const why = numberFault(hit[0]);
+    if (why !== null) fail(at, `${hit[0]} is ${why}`);
+    at += hit[0].length;
+    return Number(hit[0]);
+  };
+  const out = value();
+  space();
+  if (at !== s.length) fail(at, 'text after the value');
+  return out;
+}

package/src/ward/seal.ts

@@ -23,9 +23,9 @@ import type { DoorWord, Json, JsonObject } from '../being/types.ts';
 import { isDoorWord } from '../being/silence.ts';
 import { KEY, SIGNATURE, box, concat, derive, hex, sha256, sign, signingPair, sealingPair, unbox, unhex, verify } from './arithmetic.ts';
 import { cellFault } from './cells.ts';
+import { readJson } from './json.ts';
 
 const utf8 = new TextEncoder();
-const text = new TextDecoder();
 
 export type WardKey = { sign: Uint8Array; padlock: Uint8Array; signPk: Uint8Array; padlockPk: Uint8Array; pk: string };
 
@@ -115,7 +115,7 @@ export async function openAsk(bytes: Uint8Array, padlockSecret: Uint8Array): Pro
     if (inside.length <= SIGNATURE) return null;
     const body = inside.subarray(0, inside.length - SIGNATURE);
     const signature = inside.subarray(inside.length - SIGNATURE);
-    const payload = JSON.parse(text.decode(body)) as Sealed;
+    const payload = readJson(body) as Sealed;
     // The heir, or null for the public being. Absent is not null: a payload
     // that never named one is malformed, like any other missing field.
     const to = payload.to;
@@ -150,7 +150,9 @@ export async function sealReply(reply: ReplyPayload, ephemeralPk: Uint8Array, wa
 // lied, or it is not a reply. Every ward on the wire is somebody else's code,
 // so the shape is checked here and nowhere later: a reply is `{ silence }`,
 // `{ quo: word }` with a word the door may say, or `{ object, seen }` with an
-// object present and seen a digest or null.
+// object that is a value and seen a digest or null. A field beside a shape's
+// own makes it none of the three, since a kit that dropped the field would
+// hand her an answer where this one hands her silence.
 // Anything else is bytes that said nothing, and her ward never hands her a
 // throw or an absent value for what a stranger wrote.
 export async function openReply(bytes: unknown, ephemeralSecret: Uint8Array, signPk: Uint8Array): Promise<ReplyPayload | null> {
@@ -160,13 +162,15 @@ export async function openReply(bytes: unknown, ephemeralSecret: Uint8Array, sig
     if (inside.length <= SIGNATURE) return null;
     const body = inside.subarray(0, inside.length - SIGNATURE);
     if (!(await verify(body, inside.subarray(inside.length - SIGNATURE), signPk))) return null;
-    const reply = JSON.parse(text.decode(body)) as unknown;
+    const reply = readJson(body);
     if (reply === null || typeof reply !== 'object' || Array.isArray(reply)) return null;
     const r = reply as Record<string, unknown>;
-    if (r.silence === true) return { silence: true };
-    if (Object.hasOwn(r, 'quo')) return isDoorWord(r.quo) ? { quo: r.quo } : null;
-    if (!Object.hasOwn(r, 'object') || r.object === undefined) return null;
+    const keys = Object.keys(r).sort().join(',');
+    if (keys === 'silence') return r.silence === true ? { silence: true } : null;
+    if (keys === 'quo') return isDoorWord(r.quo) ? { quo: r.quo } : null;
+    if (keys !== 'object,seen') return null;
     if (r.seen !== null && !isHex(r.seen)) return null;
+    if (cellFault(r.object, 'object') !== null) return null; // values in both directions: nested past the bound is none of the shapes
     return { object: r.object as Json, seen: r.seen };
   } catch {
     return null;