dream: pure-SX JSON encode + recursive-descent parse + 35 tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/dream-on-sx.md

@@ -104,6 +104,14 @@ with extensions + hardening below.
   short-circuits preflight `OPTIONS` with a 204 carrying Allow-Methods/Headers/Max-Age.
   `dream-cors-origin` for a specific origin, `dream-cors-with opts` for full control
   (origin/methods/headers/credentials/max-age). Composes around a router.
+- **2026-06-07 — Ext: JSON** (`lib/dream/json.sx`, 35 tests, 329 total). Host JSON
+  primitives live in the ocaml-on-sx runtime (not the base env), so Dream ships its own
+  pure-SX `dream-json-encode` (scalars/list/dict, string escaping) + `dream-json-parse`
+  (recursive-descent over chars, objects/arrays/strings/numbers/true/false/null,
+  whitespace-tolerant). `dream-json-value` (encode → application/json response) and
+  `dream-json-body` (parse request body). GOTCHA: `number?` is unreliable in this env —
+  used `(= (type-of v) "number")`; `parse-float` handles decimals. Multi-key dict
+  encode order follows `keys` (non-deterministic) so tests assert via parse round-trip.
 
 ## Extensions (post-roadmap)
 
@@ -115,7 +123,7 @@ The five-types core is complete; these harden it toward a production HTTP front
 - [x] **CORS middleware** (`dream-cors`).
 - [x] **Error-handling middleware** (`dream-catch` / custom 500 templates; `guard`-based).
 - [ ] **Signed session cookies** (the noted hardening — sign the sid).
-- [ ] **JSON helpers** (build from dict; parse to dict).
+- [x] **JSON helpers** (encode + recursive-descent parse, pure SX).
 - [ ] **Query/header convenience** (`dream-queries`, defaults).
 - [ ] **`api.sx` facade + README** — single load point listing the public surface.