Anatomy
The mechanism, without the metaphor. Everything below maps to a file in lib/aether/.
What the recovery number measures
It is the time from detection to restoration: performance.now() captured immediately before the repair runs and again immediately after. Typically a fraction of a millisecond, because re-inserting a node the browser still has in memory is cheap.
It is not the time since the damage happened. MutationObserver delivers its records as a microtask, so detection follows the mutation at the end of the current task — usually sub-millisecond, but bounded by whatever else that task is doing, not by anything Aether controls. Reporting the two as one number would flatter the system, so the ledger reports only the part that was measured.
You will notice most repairs read exactly 0.10ms. That is not a placeholder and not a coincidence: browsers deliberately coarsen performance.now() to roughly 100 microseconds to blunt timing side-channel attacks. The repair genuinely finishes faster than the clock available to measure it. The floor belongs to the browser, and rounding it into a prettier-looking number would be inventing precision that does not exist.
Damage, record, repair
| What changed | How it arrives | What happens |
|---|---|---|
| A node leaves the document | childList · removedNodes | The original node object is re-inserted between the recorded previous and next siblings. Listeners and state survive because it is the same object, not a clone. |
| Contents replaced wholesale | childList · target inside a snapshot | innerHTML restored from the snapshot. textContent and innerHTML assignment arrive here, not as characterData — they remove and re-add child nodes. |
| A text node edited in place | characterData | The host element's innerHTML is restored from the snapshot. |
| An attribute added, altered or removed | attributes · attributeOldValue | The attribute is set back to its boot value, or removed if it was not present at boot. Class stripping is this case. |
| Executable content appears | childList · addedNodes | Script, iframe, object and embed elements not on the allowlist are removed. Same-origin /_next/ chunks and Next's inline flight payload are sanctioned — ejecting those would break the site the guard defends. |
| A stylesheet is switched off | none — it is a property, not an attribute | Caught by the idle sweep and re-enabled. No MutationObserver reports a property assignment, so this one is genuinely delayed. |
Why healing does not loop
Self-mutation suppression
A repair is itself a mutation. Left alone, the observer would see the repair, classify it as damage, and repair the repair — an infinite loop that pins the main thread. Every repair runs behind a flag, and takeRecords() drains the queue the repair just filled before the flag clears.
The idle sweep
Draining the queue can also discard a genuine mutation that landed in the same microtask window. So every two seconds, on the idle callback, the guard re-checks each snapshot directly: still attached, contents unchanged, stylesheets still enabled. It is the second pass that makes the first one safe to be aggressive.
Circuit breakers
Each reflex has a budget. Spend it and the breaker opens, refusing further attempts until a cooldown passes, then allowing a single probe. A node rewritten faster than it can be restored is a fight the organism deliberately loses — and the ledger records the loss as failed rather than hiding it.
Load shedding
Sustained lag above 120ms sets one data attribute on the root element. CSS drops animation, and the cell field cuts its population from 38 to 8 — no component re-renders to make that happen. The organism spends less precisely when spending is expensive.
Why there is no server
This site is entirely static. No middleware, no API routes, no database, no function invocations. That is a defensive decision as much as an economic one: a request-time rate limiter is itself a cost-amplification vector, because flooding it makes the target pay for the flood. The network layer belongs to the CDN in front of this site, and pretending otherwise would be the exact failure mode this project argues against.
The full account of what that costs is on Limits.