Decisions, and the mistakes behind them.

Making ownership durable solved one problem and created another. A name now survives its machine being switched off, and survives the registry restarting — but if the key were lost, the name was unusable for a year with no way back. Durability without a release mechanism is just a slower kind of breakage.

The instinct is to add a recovery message. The more useful discipline is to first ask which half of the problem cryptography can actually solve.

Rotation it can. If you hold the current key, you can sign a statement handing the name to a new one, and the registry can verify that with no authority involved at all.

Loss it cannot. If you cannot sign, nothing distinguishes you from somebody claiming to be you. No amount of protocol design changes that. Releasing a name is therefore an authority decision, and became an operator command requiring shell access on the registry host — never a network message, because a network-reachable override is an attack surface wearing a helpful label.

The interesting part was the signature itself. The ordinary message signature deliberately omits the key field, which is correct for registration: the key is self-asserted, and signing with it proves possession. Reusing that for a transfer would have been a disaster. The signature would have said move this name without saying where — so anyone who observed one legitimate transfer could have replayed it to install a key of their own choosing.

The transfer therefore signs over its own string, with the destination key inside it. That claim was checked the way the others have been: by removing the destination key from the signed bytes and confirming that a captured transfer could then be redirected to an attacker.

The registry enforces a rule it is quite proud of: the first key to claim a name owns it, and a registration under a different key is refused no matter how valid its signature. That rule was correct, and it was quietly useless, because of eleven lines somewhere else.

A background loop deleted any record that had not sent a heartbeat in ten minutes. The intent was housekeeping — expire machines that have gone away. The effect was that ownership was a function of uptime. Switch a laptop off over lunch and the binding was gone; the next registration for that name, from anybody, created a fresh one. When the rightful owner came back it was refused its own name, because the name now belonged to somebody else's key.

Nothing was compromised cryptographically. It was worse than that in a way: the protocol behaved exactly as specified, and the specification was wrong. Identity was being leased to whoever happened to be awake.

The fix is to separate two lifetimes that were never the same thing. An endpoint is liveness and expires in sixty seconds, so nobody is directed to a machine that has moved. A name-to-key binding is ownership and is retained for a year, then retired deliberately rather than as a side effect of a cleanup loop.

Six tests now cover the rule, including one pinned to the exact ten-minute boundary that used to fail, so a future adjustment to a constant cannot quietly reintroduce it. As with the deadlock, the fix was verified by reverting it and confirming the tests fail.

For a while the project led with "Route identities, not locations. The name is the address." Two lines, and they disagree: in networking an "address" is a locator, so the second line hands back exactly what the first rejects.

The deeper problem was that the first line was not even true of the implementation. DNX routing is explicitly hierarchical and location-shaped — a core router forwards on the top level, a regional router on the next, and so on. That hierarchy is the entire scaling argument. DNX does not route "identities, not locations"; it routes locations that happen to be expressed as names, with identity bound in cryptographically.

Marketing that the specification then has to walk back is worse than no marketing. The replacement states the actual thesis: the domain is the network — your namespace hierarchy is your routing topology, not a label that maps onto one.

The current implementation encodes a destination as four fixed 64-bit fields: top level, domain, subdomain, host. It is simple, it makes every forwarding decision a fixed-offset integer comparison, and it is wrong.

It breaks on the first realistic organisation chart. api.production.us-east.customer.company is five levels. vpn.engineering.floor3.buildingA.company is five. Any protocol where adding an organisational level requires changing the packet format has a design smell, and this one has it.

The replacement under design is a variable-length path of numeric namespace identifiers, resolved by the registry, so depth is unbounded and no strings ever ride the wire. It is written up as DNXP-0001.

What it costs. The current pitch — "routers mask to a fixed offset, exactly what IP silicon already does" — weakens. Variable length means reading a count, then indexing. Still integer comparison, no longer constant-offset.

Why it is still right. MPLS has forwarded variable-depth label stacks in hardware at line rate for two decades. The precedent already exists, and it is a much stronger foundation than a four-level limit chosen for implementation convenience.

The open question is whether namespace identifiers should be globally unique or unique only within their parent. The current answer is parent-scoped: forwarding is inherently top-down, so a router only ever interprets an identifier after everything above it has already matched. That makes the context guaranteed, keeps identifiers small and dense, and lets each namespace allocate locally without any global coordination — which also happens to dissolve the objection that one organisation would control all naming.

The stream layer passed every test: perfect links, multi-segment transfers, twenty per cent packet loss, reordering, duplication, all of it combined. Then a flow-control test reported something odd — the sender had blocked with zero bytes in flight.

That is the signature of a closed receive window: everything sent had been acknowledged into a receiver buffer that nothing was draining. Correct behaviour. But it raises a specific question: what happens when the receiver finally reads, frees space, sends the acknowledgement announcing it — and that acknowledgement is lost?

The receiver believes it announced space. The sender is waiting to be told. Neither will speak again. A test was written specifically to provoke that sequence, and it deadlocked exactly as feared.

The fix is TCP's persist timer: periodically probe a closed window so the reply carries the current state. Verified by disabling the probe and confirming the test fails, then re-enabling it and confirming recovery — because a passing test proves nothing unless you have watched it fail.

DNX was deliberately built without borrowing an existing transport — the goal was to understand every byte. That choice has an obvious failure mode: "we rolled our own crypto" is the fastest way to lose every serious reader.

The line drawn was between protocol and mathematics. The handshake state machine, the key-derivation structure, the replay discipline, the framing — those are ours, because they are where DNX's ideas live. X25519, ChaCha20-Poly1305, HKDF and ed25519 come from audited implementations, because that is where subtle catastrophes live.

Seven security properties are asserted as tests rather than as prose: that a peer with the right name but the wrong key cannot complete a handshake; that flipping any single bit fails authentication; that a replayed frame is refused; that counters never repeat across a thousand frames; that a foreign session cannot decrypt; that sealed frames contain no plaintext. Claims about security should be executable.

The first routing prototype had a rule that sounded reasonable: if a router does not recognise a level, forward the packet toward the root, on the theory that something closer to the root knows more.

It does not. A packet addressed to a nonexistent site under a known authority reached the authority's router, failed to match, ascended toward the root, was sent back down to the same router, failed again — and oscillated until a hop limit killed it.

The correct rule is that a router responsible for a level is authoritative for its children. If the gateway for an authority has no route for a site beneath it, no router closer to the root knows better. The packet should be dropped there, definitively, in one hop.

This is the entire reason for building a proof of concept rather than writing a specification and calling it designed. The bug was in a diagram that was going to be published.

The original ambition was to replace TCP/IP outright — no addresses, names all the way down. The honest technical answer is that this is not achievable as a first step, and pretending otherwise would have cost the project its credibility with exactly the people best placed to evaluate it.

IP scales because of hierarchical numeric aggregation: a backbone router stores a route to a prefix, not to every host, and matches it at line rate in dedicated silicon. Any replacement must reproduce that property. Aggregation is not an optimisation — it is the load-bearing wall.

So DNX runs on UDP/IP, and says so. The precedent is not embarrassing: IP itself first ran over the telephone network, and nobody ever removed the copper — it simply became irrelevant. Protocols do not win by being installed everywhere on day one. They win by making the layer beneath them stop mattering.

What DNX claims is narrower and more defensible than "replacing IP": that the aggregation key can be replaced. Keep hierarchy, change its alphabet from numeric prefixes to name levels. Geography that IP delivers by accident of allocation, DNX delivers by design of the namespace.