Upper Ford and Lower Ford face each other across a river.

Upper Ford deals in salt; Lower Ford deals in silk. Each bank keeps a customs house, and every cargo crossing the water must be declared on a slip before it boards: goods, grade, duty class, the carrier’s name, the inspecting clerk, the day’s cyclical sign — line after line, all of it written out.

At first this was a few strokes of a brush.

Then business on both banks grew. Two thousand boats a day, three slips a boat, forty lines a slip. Clerks’ wrists ached, boatmen cursed, and the queue of hulls ran from the landing all the way down to the sandbar. People with connections began cutting the line; people cutting the line began paying; people paying began adding two extra lines.

That autumn a woman clerk arrived at the customs house. Her name was A-Ruo.

Her first act was not to write faster. It was to stand at the door and count slips.

She counted for seven days, and found something absurd: across two thousand boats, the slips contained only sixty-one distinct phrases.

“Salt, upper grade, official permit.” “Silk, white, woven by the household.” “Inspection: none.” “Carrier: the boat’s own master.” “Duty: standard.” These phrases repeated on every slip. Of forty lines, thirty-nine were the same few sentences. Only one line was new: the hull number, or the weight.

On the eighth day she nailed a wooden board to the customs house wall.

Sixty-one phrases were carved into it in advance, top to bottom, each with a number. Every customs house on the river carved the same board, with the same numbers, in the same order.

From then on, nobody wrote the declaration. They called it.

A clerk glanced at the board and called “number eight.” The scribe opposite wrote a single character: eight. A forty-line slip became thirty-nine numbers and one hull number. A slip that took an incense stick to write now took three breaths.

The boatmen stopped cursing.

—

But a number can only hold sixty-one phrases.

New goods, new duty classes, new carrier names — more of them appeared in a day than the board had room to carve. Those still had to be spelled out, letter by letter. And the most laborious things to spell were precisely the newest ones: not on the board, so you wrote them in full.

A-Ruo did the arithmetic. The board absorbed seventy percent. Of the remaining thirty, most were things that had appeared only recently and were appearing every day now. Today they were new. Tomorrow they wouldn’t be.

So she nailed up a second board. This one was wax.

The rules went like this:

• The sixty-one on the wooden board were dead numbers. Anyone could call them at any time. They never changed.
• The phrases on the wax were live numbers. Live numbers started at sixty-two and ran downward. The newest thing written had the smallest number. The older a phrase, the larger its number grew.
• Whenever you used a new phrase on a slip, you also wrote it onto the wax — in the same row. Because the wax at the other end had to be written too.
• The wax had weight. A phrase’s footprint was not measured in characters, but in “length of the name + length of the value + thirty-two notches.” Those thirty-two notches were fixed overhead: no phrase was short enough to escape them.
• When the wax filled up, you scraped from the oldest end until the new phrase fit.
• If a single phrase was heavier than the whole tablet, you scraped the tablet clean and did not write it at all — writing it would be pointless, since the next phrase would scrape it off.

On the first day, live numbers barely appeared. On the second, they began. By the fifth, eleven hundred of the two thousand slips carried live numbers in their opening lines.

On the tenth day, A-Ruo had an apprentice try to call an entire slip in numbers.

The apprentice called six: eight, sixty-two, sixty-three, sixty-five, sixty-six, seventy-one.

The scribe opposite wrote them out one by one, then looked up: this was a complete salt declaration, forty lines, not one character wrong.

Six characters in exchange for forty lines.

—

The wax was useful, but it had a vicious temper.

It was not on the slip.

The slip carried only numbers. What a number pointed to lived entirely on the two tablets — one on the sending bank, one on the receiving bank. And those two tablets had never been compared, and could not be compared, because nothing written on them ever crossed the water. Only the numbers crossed.

So the two tablets had to be identical.

Not roughly. Row for row, in the same order.

A-Ruo had three rules carved on the customs house wall:

One. When you write a new phrase, write it in the same row. If you say “this goes on the tablet,” the other side writes the same phrase in the same cell. One row late, and every number after it is off by one.

Two. When you scrape, scrape from the oldest end. You may not scrape a phrase early because it looks useless. The order of the tablet is not usefulness. It is age.

Three. If a number doesn’t match, do not guess. Whoever calls a number not on the tablet, or calls one the other side did not record, cuts the ferry rope on the spot, closes the river, and starts over. No “it’s probably this.” No skipping it and carrying on.

The third rule was the least reasonable. Closing the river for half a day over one number earned her a whole winter of merchants’ curses.

A-Ruo did not explain. She said only this:

One wrong number, and everything after it is wrong. And the wrong things look exactly like the right ones.

—

That twelfth month, it happened.

Fog on the river. A boat struck a mooring post, and half the roof beam of the receiving customs house came down. Nobody was hurt. The wax tablet shattered on the floor, and when they pieced it together there was a hole between sixty-one and seventy — one row of wax had been trodden away.

The old clerk thought it a small matter. He slid the rows below up by one, filled the gap, and went on calling numbers.

All that day, every slip at Lower Ford was correct.

Clean brushwork. Proper form. Duty collected. Cargo released.

Except that a consignment which should have read “official-permit salt, three hundred catties” now read “household white silk, thirty bolts.” Duty was charged at the silk rate, double the salt rate, and the merchant started shouting at the customs house on the spot. And while he was shouting, another consignment recorded as salt — silk, in fact — had already loaded and gone downstream.

By the third day, two hundred and seventy slips failed reconciliation.

Not one line was wrong. From that row onward, every line was wrong. And each line, taken alone, was legal, fluent, and entirely convincing.

A-Ruo reached Lower Ford, looked once at the patched tablet, and said nothing.

She walked to the landing, drew her blade, and cut the ferry rope.

The river closed for seven days.

In those seven days the customs houses on both banks voided every slip still on the water and rewrote them all — without live numbers this time, one character at a time.

When the seven days ended, A-Ruo raised a new rule board on each bank. It carried two lines:

A wax tablet is never patched. If it doesn’t match, start over.

—

Later she added two more rules. Neither was reasonable. Both were necessary.

The first was for sealed letters.

Some consignments could not have their carrier’s name appear on any tablet — the secret marks on official salt, the permits for military goods, a trading house’s private seal. People had been writing these onto the wax for convenience; after all, the phrase would be reusable next time.

A-Ruo banned all of it. She said: the wax is for everyone to read.

Anything that could not remain on the tablet had to be spelled out in full every time, and the slip had to carry a mark: this phrase does not enter the tablet. The mark was not only for your own side; it told the other side, explicitly, not to record it.

She gave no reason then. The reason took years for anyone to work out: a phrase written onto the tablet is mixed into the same pile of codes as everyone else’s, pressed and scraped over and over; the harder the pressing, the shorter the codes; the shorter the codes, the more the length of a code tells you about the characters underneath. Put a secret and your enemy on the same scale, and the scale will talk.

The second rule was for hostile parties.

A trading house had discovered that by stuffing dozens of long, useless phrases at the head of a slip, the useful phrases got shoved off the wax; by the time the real declaration arrived, every line had to be spelled out afresh.

A-Ruo’s answer: the size of the tablet is set by the receiving side; the writing side may not change it on its own. If you want to scrape it to a new size, you call out “I am resizing to this” first — and that call must come at the very front of the slip.

One more: a slip may only be so long. If someone hands you a slip that is short and light but unfolds into something as heavy as a mountain, that is not a declaration. That is a man come to demolish the customs house.

—

A-Ruo worked at the customs house for eleven years.

On the day she left, the wooden board and the wax were both still there. The board still carried its sixty-one. The wax had been replaced many times. Not one rule had changed.

The young man taking over asked her: what’s so good about this method? Doesn’t it just save a few characters?

A-Ruo said: it doesn’t save characters.

She said: fewer characters on the slips means more boats on the river. A boat waits half a day because the customs house is writing. The customs house is writing because every slip is saying the same things over again. Write the same thing down the first time, and the second time you only call a number — that isn’t saving paper. That is taking repetition off the river.

The young man asked: and if one day the two tablets don’t match?

A-Ruo looked at the water.

She said: then cut the rope.

Don’t try to repair it.

Some things, once they start to disagree, can only be started over.

— —

By now you’ve probably recognized it: this is HPACK.

What it is

HPACK is HTTP/2’s header compression format (RFC 7541). HTTP/2 split requests into HEADERS and DATA frames, but headers still travel on every single request — and fields like user-agent, cookie, authorization, :method, and :path repeat at astonishing rates on one connection. HPACK is how that repetition gets removed.

It is built from three pieces.

One, the static table: 61 predefined header fields, indices 1–61, permanent, built into both endpoints. :method: GET is 2, :status: 200 is 8, accept-encoding: gzip, deflate is 16. A common header compresses to a single byte — 0x82 is :method: GET.

Two, the dynamic table: one per connection per direction, initially empty, indices starting at 62. The newest entry has the smallest index (62); the oldest has the largest. Every insertion happens simultaneously at the front on both ends; when the table is full, eviction proceeds from the largest index — the oldest — one entry at a time. An entry’s size is name length + value length + 32 bytes (32 is the RFC’s fixed overhead), and the table’s ceiling comes from the peer’s SETTINGS_HEADER_TABLE_SIZE, 4096 bytes by default. An entry larger than the entire table clears the table and is not inserted. The encoder may resize with a dynamic table size update (001 prefix, 5-bit integer), and that update must appear at the very start of the header block.

Three, Huffman coding: string literals that aren’t in a table are encoded byte by byte with a predefined static Huffman code, derived from the character distribution of real HTTP headers — frequent characters short, rare ones long, with an EOS symbol (256) beyond 0–255, and each code length written as a 5-bit integer. Literals typically save another 20–30%.

Inside a header block, each field uses one of four prefixes:

• 1xxxxxxx: indexed header field, 7-bit index, one byte for the whole field.
• 01xxxxxx: literal with incremental indexing, 6-bit name index plus a value literal. This is how new entries get into the dynamic table.
• 0000xxxx: literal without indexing — Huffman only, never stored.
• 0001xxxx: literal never indexed — Huffman only, never stored, and an explicit instruction to every hop: do not cache this. authorization and cookie must use it.

Index 0 is reserved: it means the name is not in a table either, so the name travels as a literal too.

Why it matters

• Header compression is the cost center of small requests. A typical HTTP/2 request carries 700–800 bytes of headers against a body of perhaps a few dozen bytes. gRPC, mobile APIs, and service-mesh sidecar calls all have this shape: headers are over 80% of the request. HPACK drives the headers of the second and subsequent similar requests down to tens of bytes, with 80–90% header-byte reduction commonly measured.
• It makes the connection stateful. The slip carries only numbers; what a number means lives in a table at each end, and that table never crosses the wire. This is HPACK’s most important structural fact: the decoder must process header blocks in order, and if either table shifts by one slot, every header from that point on is wrong — wrong in a way that is legal and fluent. That is why the RFC makes a decoding failure COMPRESSION_ERROR, a connection-level error rather than a request-level one. It is also why HTTP/2 requires header blocks on a connection to be processed strictly in order.
• It reopens the compression side channel. Put attacker-controlled input and a secret you would rather not leak (a cookie, a token) into the same compression context, and variations in code length leak the content — the CRIME / BREACH family. HTTP/2 reintroduced stateful header compression on top of TLS, so never indexed is not an option. It is a security boundary.
• It can be weaponized. Decoder memory and CPU are decoupled from the compression ratio: a few dozen bytes of header block can expand into an enormous allocation (an HPACK bomb). And dynamic-table memory multiplies by concurrent connections, which makes SETTINGS_HEADER_TABLE_SIZE itself a DoS surface. The 2019 wave of HTTP/2 DoS disclosures included entries aimed squarely at header-block handling.
• HTTP/3 changed the protocol’s shape for it. QUIC streams arrive out of order, while HPACK demands order, so HTTP/3 cannot use it directly — which is why QPACK exists: dynamic-table references move onto separate encoder and decoder streams, a receiver that references an entry it hasn’t received must block, and SETTINGS_QPACK_BLOCKED_STREAMS caps how much blocking is allowed. One compression scheme’s constraint became the next transport protocol’s architectural decision.

Metaphor mapping

• Two thousand boats a day, three slips a boat, forty lines a slip → request volume and header fields per request on one connection
• Thirty-nine of forty lines are the same phrases → the high repetition rate of HTTP/2 header fields (user-agent, cookie, :path)
• Rewriting the same phrases on every slip → plaintext headers before HPACK, resent in full per request
• The carved board of sixty-one phrases → the static table, indices 1–61, permanent
• Every customs house carves the same board, same numbers, same order → the static table is specified, built into both ends, never negotiated
• Glancing at the board and calling “number eight” → the indexed header field, 1xxxxxxx prefix, 7-bit index
• One character “eight” replacing a whole line → one common header compressed to one byte (0x82 = :method: GET)
• Wax that accepts new phrases at any time → the dynamic table, indices from 62
• Live numbers run down from 62; the newest is smallest → newest entry is index 62; older entries have larger indices
• A phrase occupies “name length + value length + thirty-two notches” → entry size name + value + 32 bytes
• Tablet size set by the receiving side → SETTINGS_HEADER_TABLE_SIZE, 4096 bytes by default
• Scraping from the oldest end when full → evicting the largest-index (oldest) entry, FIFO
• A phrase heavier than the whole tablet clears it and is not written → entries larger than the table clear it and are skipped
• Announcing a resize, which must come first → dynamic table size update, 001 prefix, first in the header block
• Both sides writing new phrases in the same row → encoder and decoder inserting in lockstep at the same position
• Only numbers cross the water → the dynamic table is implicit shared state; its contents are never transmitted
• One wrong number and everything after is wrong → a single desync corrupts every subsequent header
• The wrong thing looks exactly like the right thing → decoded fields remain syntactically valid and semantically plausible, so errors hide
• Patching the gap by shifting rows → attempting to repair a desynced table in place instead of resetting the connection
• Cutting the ferry rope and closing the river → COMPRESSION_ERROR, a connection-level failure; the whole connection dies
• Seven days of voided slips rewritten from scratch → all in-flight requests reissued after a connection reset, at full RTT cost
• “A wax tablet is never patched”; “if it doesn’t match, start over” → the spec forbids incremental repair of compression state
• Sealed letters barred from the tablet, marked “this phrase does not enter” → the never indexed literal, 0001xxxx prefix
• A secret and your enemy on the same scale, and the scale talks → side channels in stateful compression (CRIME / BREACH)
• Replacing the sealed phrase with a reused number → indexing authorization / cookie into the dynamic table, leaking them
• Stuffing useless phrases to shove hot ones off the wax → using eviction to force out hot entries and inflate compression cost
• A light slip that unfolds into a mountain → HPACK bomb: expansion decoupled from decode resources
• Every customs house holds its own copy of the tablet → dynamic-table memory times concurrent connections, a DoS surface
• Boats arriving out of order versus a tablet that must align row for row → QUIC’s unordered streams against HPACK’s ordering requirement
• QPACK: a dedicated line for “what I wrote,” plus a limit on waiting → separate encoder/decoder streams and SETTINGS_QPACK_BLOCKED_STREAMS
• Calling numbers instead of writing, so more boats cross → header-byte reduction turns directly into throughput and latency
• The board absorbs seventy percent; the wax absorbs most of the rest → static plus dynamic table hits, producing 80–90% measured header reduction
• A-Ruo counts slips for seven days before carving the board → compression tables must be driven by real traffic distributions, not intuition