The store's own copy of what a caller asked it to write.
Six review rounds found the same bug in six disguises: a getter deleting
a sibling mid-copy, a `toJSON` erasing itself, one injecting a record, one
swapping every value, symbol keys JSON drops in silence, an array root
reappearing as `{"0":…}`, a proxy answering differently on the second read,
a `toJSON` inherited from `Object.prototype`. Each got its own check, and
the next round found another.
They were never separate bugs. The store kept *re-reading* an object it
did not own — validating it, then reading it again to copy it, then reading
the request again to decide about quarantine — and every one of those reads
was a fresh chance for the caller's object to say something different.
Checking harder cannot fix that; each new check is just one more read.
So this module reads everything exactly once and hands back a value the
store owns outright: keys and values lifted straight out of property
descriptors, copied into a frozen object with no prototype, and every
object and list inside them rebuilt the same way by `OwnedValues`. Nothing
downstream ever touches the caller's object again, and
IOwnedRecords is a type only this module can produce, so the
compiler enforces that rather than a convention.
What that buys, by construction rather than by inspection:
Values cannot change after validation — there is no second read.
No accessor can run during serialisation — none survived the copy.
No inherited `toJSON` can intercept `JSON.stringify` — no object or
list in the copy has a prototype to inherit one from, at any depth, even if
`Object.prototype` or `Array.prototype` is polluted.
A request that refuses to be read fails instead of throwing, and fails
before anything is staged.
The store's own copy of what a caller asked it to write.
Six review rounds found the same bug in six disguises: a getter deleting a sibling mid-copy, a `toJSON` erasing itself, one injecting a record, one swapping every value, symbol keys JSON drops in silence, an array root reappearing as `{"0":…}`, a proxy answering differently on the second read, a `toJSON` inherited from `Object.prototype`. Each got its own check, and the next round found another.
They were never separate bugs. The store kept *re-reading* an object it did not own — validating it, then reading it again to copy it, then reading the request again to decide about quarantine — and every one of those reads was a fresh chance for the caller's object to say something different. Checking harder cannot fix that; each new check is just one more read.
So this module reads everything exactly once and hands back a value the store owns outright: keys and values lifted straight out of property descriptors, copied into a frozen object with no prototype, and every object and list inside them rebuilt the same way by `OwnedValues`. Nothing downstream ever touches the caller's object again, and IOwnedRecords is a type only this module can produce, so the compiler enforces that rather than a convention.
What that buys, by construction rather than by inspection: