grpc 1.57.0 → 1.62.0

data/src/core/ext/transport/chttp2/transport/chttp2_transport.cc

@@ -20,14 +20,16 @@
 
 #include <inttypes.h>
 #include <limits.h>
-#include <stdio.h>
 #include <string.h>
 
 #include <algorithm>
-#include <initializer_list>
+#include <atomic>
+#include <cstddef>
+#include <limits>
 #include <memory>
 #include <new>
 #include <string>
+#include <type_traits>
 #include <utility>
 #include <vector>
 
@@ -35,15 +37,18 @@
 #include "absl/container/flat_hash_map.h"
 #include "absl/hash/hash.h"
 #include "absl/meta/type_traits.h"
+#include "absl/random/random.h"
 #include "absl/status/status.h"
 #include "absl/strings/cord.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
+#include "absl/types/variant.h"
 
 #include <grpc/event_engine/event_engine.h>
 #include <grpc/grpc.h>
+#include <grpc/impl/channel_arg_names.h>
 #include <grpc/impl/connectivity_state.h>
 #include <grpc/slice_buffer.h>
 #include <grpc/status.h>
@@ -53,7 +58,6 @@
 
 #include "src/core/ext/transport/chttp2/transport/context_list_entry.h"
 #include "src/core/ext/transport/chttp2/transport/flow_control.h"
-#include "src/core/ext/transport/chttp2/transport/frame.h"
 #include "src/core/ext/transport/chttp2/transport/frame_data.h"
 #include "src/core/ext/transport/chttp2/transport/frame_goaway.h"
 #include "src/core/ext/transport/chttp2/transport/frame_rst_stream.h"
@@ -61,13 +65,21 @@
 #include "src/core/ext/transport/chttp2/transport/http2_settings.h"
 #include "src/core/ext/transport/chttp2/transport/http_trace.h"
 #include "src/core/ext/transport/chttp2/transport/internal.h"
+#include "src/core/ext/transport/chttp2/transport/legacy_frame.h"
+#include "src/core/ext/transport/chttp2/transport/max_concurrent_streams_policy.h"
+#include "src/core/ext/transport/chttp2/transport/ping_abuse_policy.h"
+#include "src/core/ext/transport/chttp2/transport/ping_callbacks.h"
+#include "src/core/ext/transport/chttp2/transport/ping_rate_policy.h"
 #include "src/core/ext/transport/chttp2/transport/varint.h"
+#include "src/core/ext/transport/chttp2/transport/write_size_policy.h"
 #include "src/core/lib/channel/call_tracer.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/context.h"
+#include "src/core/lib/channel/tcp_tracer.h"
 #include "src/core/lib/debug/stats.h"
 #include "src/core/lib/debug/stats_data.h"
 #include "src/core/lib/experiments/experiments.h"
+#include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/bitset.h"
 #include "src/core/lib/gprpp/crash.h"
@@ -96,7 +108,6 @@
 #include "src/core/lib/transport/metadata_batch.h"
 #include "src/core/lib/transport/status_conversion.h"
 #include "src/core/lib/transport/transport.h"
-#include "src/core/lib/transport/transport_impl.h"
 
 #ifdef GRPC_POSIX_SOCKET_TCP
 #include "src/core/lib/iomgr/ev_posix.h"
@@ -112,6 +123,9 @@
 
 #define DEFAULT_MAX_PENDING_INDUCED_FRAMES 10000
 
+#define GRPC_ARG_HTTP2_PING_ON_RST_STREAM_PERCENT \
+  "grpc.http2.ping_on_rst_stream_percent"
+
 static grpc_core::Duration g_default_client_keepalive_time =
     grpc_core::Duration::Infinity();
 static grpc_core::Duration g_default_client_keepalive_timeout =
@@ -123,10 +137,10 @@ static grpc_core::Duration g_default_server_keepalive_timeout =
 static bool g_default_client_keepalive_permit_without_calls = false;
 static bool g_default_server_keepalive_permit_without_calls = false;
 
-static grpc_core::Duration g_default_min_recv_ping_interval_without_data =
-    grpc_core::Duration::Minutes(5);
-static int g_default_max_pings_without_data = 2;
-static int g_default_max_ping_strikes = 2;
+// EXPERIMENTAL: control tarpitting in chttp2
+#define GRPC_ARG_HTTP_ALLOW_TARPIT "grpc.http.tarpit"
+#define GRPC_ARG_HTTP_TARPIT_MIN_DURATION_MS "grpc.http.tarpit_min_duration_ms"
+#define GRPC_ARG_HTTP_TARPIT_MAX_DURATION_MS "grpc.http.tarpit_max_duration_ms"
 
 #define MAX_CLIENT_STREAM_ID 0x7fffffffu
 grpc_core::TraceFlag grpc_keepalive_trace(false, "http_keepalive");
@@ -134,21 +148,23 @@ grpc_core::DebugOnlyTraceFlag grpc_trace_chttp2_refcount(false,
                                                          "chttp2_refcount");
 
 // forward declarations of various callbacks that we'll build closures around
-static void write_action_begin_locked(void* t, grpc_error_handle error);
-static void write_action(void* t, grpc_error_handle error);
-static void write_action_end(void* t, grpc_error_handle error);
-static void write_action_end_locked(void* t, grpc_error_handle error);
-
-static void read_action(void* t, grpc_error_handle error);
-static void read_action_locked(void* t, grpc_error_handle error);
-static void continue_read_action_locked(grpc_chttp2_transport* t);
-
-// Set a transport level setting, and push it to our peer
-static void queue_setting_update(grpc_chttp2_transport* t,
-                                 grpc_chttp2_setting_id id, uint32_t value);
+static void write_action_begin_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport>, grpc_error_handle error);
+static void write_action(grpc_chttp2_transport* t);
+static void write_action_end(grpc_core::RefCountedPtr<grpc_chttp2_transport>,
+                             grpc_error_handle error);
+static void write_action_end_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport>, grpc_error_handle error);
+
+static void read_action(grpc_core::RefCountedPtr<grpc_chttp2_transport>,
+                        grpc_error_handle error);
+static void read_action_locked(grpc_core::RefCountedPtr<grpc_chttp2_transport>,
+                               grpc_error_handle error);
+static void continue_read_action_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t);
 
 static void close_from_api(grpc_chttp2_transport* t, grpc_chttp2_stream* s,
-                           grpc_error_handle error);
+                           grpc_error_handle error, bool tarpit);
 
 // Start new streams that have been created if we can
 static void maybe_start_some_streams(grpc_chttp2_transport* t);
@@ -158,8 +174,10 @@ static void connectivity_state_set(grpc_chttp2_transport* t,
                                    const absl::Status& status,
                                    const char* reason);
 
-static void benign_reclaimer_locked(void* arg, grpc_error_handle error);
-static void destructive_reclaimer_locked(void* arg, grpc_error_handle error);
+static void benign_reclaimer_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport>, grpc_error_handle error);
+static void destructive_reclaimer_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport>, grpc_error_handle error);
 
 static void post_benign_reclaimer(grpc_chttp2_transport* t);
 static void post_destructive_reclaimer(grpc_chttp2_transport* t);
@@ -169,42 +187,75 @@ static void close_transport_locked(grpc_chttp2_transport* t,
 static void end_all_the_calls(grpc_chttp2_transport* t,
                               grpc_error_handle error);
 
-static void start_bdp_ping(void* tp, grpc_error_handle error);
-static void finish_bdp_ping(void* tp, grpc_error_handle error);
-static void start_bdp_ping_locked(void* tp, grpc_error_handle error);
-static void finish_bdp_ping_locked(void* tp, grpc_error_handle error);
+static void start_bdp_ping(grpc_core::RefCountedPtr<grpc_chttp2_transport>,
+                           grpc_error_handle error);
+static void finish_bdp_ping(grpc_core::RefCountedPtr<grpc_chttp2_transport>,
+                            grpc_error_handle error);
+static void start_bdp_ping_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport>, grpc_error_handle error);
+static void finish_bdp_ping_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport>, grpc_error_handle error);
 static void next_bdp_ping_timer_expired(grpc_chttp2_transport* t);
 static void next_bdp_ping_timer_expired_locked(
-    void* tp, GRPC_UNUSED grpc_error_handle error);
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> tp,
+    GRPC_UNUSED grpc_error_handle error);
 
 static void cancel_pings(grpc_chttp2_transport* t, grpc_error_handle error);
 static void send_ping_locked(grpc_chttp2_transport* t,
                              grpc_closure* on_initiate, grpc_closure* on_ack);
-static void retry_initiate_ping_locked(void* tp,
-                                       GRPC_UNUSED grpc_error_handle error);
+static void retry_initiate_ping_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    GRPC_UNUSED grpc_error_handle error);
 
 // keepalive-relevant functions
-static void init_keepalive_ping(grpc_chttp2_transport* t);
-static void init_keepalive_ping_locked(void* arg,
-                                       GRPC_UNUSED grpc_error_handle error);
-static void start_keepalive_ping(void* arg, grpc_error_handle error);
-static void finish_keepalive_ping(void* arg, grpc_error_handle error);
-static void start_keepalive_ping_locked(void* arg, grpc_error_handle error);
-static void finish_keepalive_ping_locked(void* arg, grpc_error_handle error);
-static void keepalive_watchdog_fired(grpc_chttp2_transport* t);
-static void keepalive_watchdog_fired_locked(
-    void* arg, GRPC_UNUSED grpc_error_handle error);
+static void init_keepalive_ping(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t);
+static void init_keepalive_ping_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    GRPC_UNUSED grpc_error_handle error);
+static void finish_keepalive_ping(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t, grpc_error_handle error);
+static void finish_keepalive_ping_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t, grpc_error_handle error);
 static void maybe_reset_keepalive_ping_timer_locked(grpc_chttp2_transport* t);
 
+static void send_goaway(grpc_chttp2_transport* t, grpc_error_handle error,
+                        bool immediate_disconnect_hint);
+
+// Timeout for getting an ack back on settings changes
+#define GRPC_ARG_SETTINGS_TIMEOUT "grpc.http2.settings_timeout"
+
 namespace {
-grpc_core::CallTracerInterface* CallTracerIfEnabled(grpc_chttp2_stream* s) {
+
+using TaskHandle = ::grpc_event_engine::experimental::EventEngine::TaskHandle;
+
+grpc_core::CallTracerInterface* CallTracerIfSampled(grpc_chttp2_stream* s) {
   if (s->context == nullptr || !grpc_core::IsTraceRecordCallopsEnabled()) {
     return nullptr;
   }
-  return static_cast<grpc_core::CallTracerInterface*>(
+  auto* call_tracer = static_cast<grpc_core::CallTracerInterface*>(
       static_cast<grpc_call_context_element*>(
           s->context)[GRPC_CONTEXT_CALL_TRACER_ANNOTATION_INTERFACE]
           .value);
+  if (call_tracer == nullptr || !call_tracer->IsSampled()) {
+    return nullptr;
+  }
+  return call_tracer;
+}
+
+std::shared_ptr<grpc_core::TcpTracerInterface> TcpTracerIfSampled(
+    grpc_chttp2_stream* s) {
+  if (s->context == nullptr || !grpc_core::IsTraceRecordCallopsEnabled()) {
+    return nullptr;
+  }
+  auto* call_attempt_tracer = static_cast<grpc_core::CallTracerInterface*>(
+      static_cast<grpc_call_context_element*>(
+          s->context)[GRPC_CONTEXT_CALL_TRACER]
+          .value);
+  if (call_attempt_tracer == nullptr || !call_attempt_tracer->IsSampled()) {
+    return nullptr;
+  }
+  return call_attempt_tracer->StartNewTcpTrace();
 }
 
 grpc_core::WriteTimestampsCallback g_write_timestamps_callback = nullptr;
@@ -213,6 +264,24 @@ grpc_core::CopyContextFn g_get_copied_context_fn = nullptr;
 
 namespace grpc_core {
 
+namespace {
+// Initialize a grpc_closure \a c to call \a Fn with \a t and \a error. Holds
+// the passed in reference to \a t until it's moved into Fn.
+template <void (*Fn)(RefCountedPtr<grpc_chttp2_transport>, grpc_error_handle)>
+grpc_closure* InitTransportClosure(RefCountedPtr<grpc_chttp2_transport> t,
+                                   grpc_closure* c) {
+  GRPC_CLOSURE_INIT(
+      c,
+      [](void* tp, grpc_error_handle error) {
+        Fn(RefCountedPtr<grpc_chttp2_transport>(
+               static_cast<grpc_chttp2_transport*>(tp)),
+           std::move(error));
+      },
+      t.release(), nullptr);
+  return c;
+}
+}  // namespace
+
 namespace {
 TestOnlyGlobalHttp2TransportInitCallback test_only_init_callback = nullptr;
 TestOnlyGlobalHttp2TransportDestructCallback test_only_destruct_callback =
@@ -269,6 +338,42 @@ void ForEachContextListEntryExecute(void* arg, Timestamps* ts,
   delete context_list;
 }
 
+HttpAnnotation::HttpAnnotation(
+    Type type, gpr_timespec time,
+    absl::optional<chttp2::TransportFlowControl::Stats> transport_stats,
+    absl::optional<chttp2::StreamFlowControl::Stats> stream_stats)
+    : CallTracerAnnotationInterface::Annotation(
+          CallTracerAnnotationInterface::AnnotationType::kHttpTransport),
+      type_(type),
+      time_(time),
+      transport_stats_(transport_stats),
+      stream_stats_(stream_stats) {}
+
+std::string HttpAnnotation::ToString() const {
+  std::string s = "HttpAnnotation type: ";
+  switch (type_) {
+    case Type::kStart:
+      absl::StrAppend(&s, "Start");
+      break;
+    case Type::kHeadWritten:
+      absl::StrAppend(&s, "HeadWritten");
+      break;
+    case Type::kEnd:
+      absl::StrAppend(&s, "End");
+      break;
+    default:
+      absl::StrAppend(&s, "Unknown");
+  }
+  absl::StrAppend(&s, " time: ", gpr_format_timespec(time_));
+  if (transport_stats_.has_value()) {
+    absl::StrAppend(&s, " transport:[", transport_stats_->ToString(), "]");
+  }
+  if (stream_stats_.has_value()) {
+    absl::StrAppend(&s, " stream:[", stream_stats_->ToString(), "]");
+  }
+  return s;
+}
+
 }  // namespace grpc_core
 
 //
@@ -278,6 +383,8 @@ void ForEachContextListEntryExecute(void* arg, Timestamps* ts,
 grpc_chttp2_transport::~grpc_chttp2_transport() {
   size_t i;
 
+  cancel_pings(this, GRPC_ERROR_CREATE("Transport destroyed"));
+
   event_engine.reset();
 
   if (channelz_socket != nullptr) {
@@ -288,8 +395,6 @@ grpc_chttp2_transport::~grpc_chttp2_transport() {
 
   grpc_slice_buffer_destroy(&qbuf);
 
-  grpc_slice_buffer_destroy(&outbuf);
-
   grpc_error_handle error = GRPC_ERROR_CREATE("Transport destroyed");
   // ContextList::Execute follows semantics of a callback function and does not
   // take a ref on error
@@ -309,8 +414,6 @@ grpc_chttp2_transport::~grpc_chttp2_transport() {
   GPR_ASSERT(stream_map.empty());
   GRPC_COMBINER_UNREF(combiner, "chttp2_transport");
 
-  cancel_pings(this, GRPC_ERROR_CREATE("Transport destroyed"));
-
   while (write_cb_pool) {
     grpc_chttp2_write_cb* next = write_cb_pool->next;
     gpr_free(write_cb_pool);
@@ -323,8 +426,6 @@ grpc_chttp2_transport::~grpc_chttp2_transport() {
   }
 }
 
-static const grpc_transport_vtable* get_vtable(void);
-
 static void read_channel_args(grpc_chttp2_transport* t,
                               const grpc_core::ChannelArgs& channel_args,
                               bool is_client) {
@@ -346,18 +447,6 @@ static void read_channel_args(grpc_chttp2_transport* t,
     t->hpack_compressor.SetMaxUsableSize(max_hpack_table_size);
   }
 
-  t->ping_policy.max_pings_without_data =
-      std::max(0, channel_args.GetInt(GRPC_ARG_HTTP2_MAX_PINGS_WITHOUT_DATA)
-                      .value_or(g_default_max_pings_without_data));
-  t->ping_policy.max_ping_strikes =
-      std::max(0, channel_args.GetInt(GRPC_ARG_HTTP2_MAX_PING_STRIKES)
-                      .value_or(g_default_max_ping_strikes));
-  t->ping_policy.min_recv_ping_interval_without_data =
-      std::max(grpc_core::Duration::Zero(),
-               channel_args
-                   .GetDurationFromIntMillis(
-                       GRPC_ARG_HTTP2_MIN_RECV_PING_INTERVAL_WITHOUT_DATA_MS)
-                   .value_or(g_default_min_recv_ping_interval_without_data));
   t->write_buffer_size =
       std::max(0, channel_args.GetInt(GRPC_ARG_HTTP2_WRITE_BUFFER_SIZE)
                       .value_or(grpc_core::chttp2::kDefaultWindow));
@@ -369,20 +458,35 @@ static void read_channel_args(grpc_chttp2_transport* t,
   t->keepalive_timeout = std::max(
       grpc_core::Duration::Zero(),
       channel_args.GetDurationFromIntMillis(GRPC_ARG_KEEPALIVE_TIMEOUT_MS)
-          .value_or(t->is_client ? g_default_client_keepalive_timeout
-                                 : g_default_server_keepalive_timeout));
-  if (grpc_core::IsKeepaliveFixEnabled()) {
+          .value_or(t->keepalive_time == grpc_core::Duration::Infinity()
+                        ? grpc_core::Duration::Infinity()
+                        : (t->is_client ? g_default_client_keepalive_timeout
+                                        : g_default_server_keepalive_timeout)));
+  t->ping_timeout = std::max(
+      grpc_core::Duration::Zero(),
+      channel_args.GetDurationFromIntMillis(GRPC_ARG_PING_TIMEOUT_MS)
+          .value_or(t->keepalive_time == grpc_core::Duration::Infinity()
+                        ? grpc_core::Duration::Infinity()
+                        : grpc_core::Duration::Minutes(1)));
+  if (t->is_client) {
     t->keepalive_permit_without_calls =
         channel_args.GetBool(GRPC_ARG_KEEPALIVE_PERMIT_WITHOUT_CALLS)
-            .value_or(t->is_client
+            .value_or(grpc_core::IsKeepaliveFixEnabled()
                           ? g_default_client_keepalive_permit_without_calls
-                          : g_default_server_keepalive_permit_without_calls);
+                          : false);
   } else {
     t->keepalive_permit_without_calls =
         channel_args.GetBool(GRPC_ARG_KEEPALIVE_PERMIT_WITHOUT_CALLS)
-            .value_or(false);
+            .value_or(grpc_core::IsKeepaliveServerFixEnabled()
+                          ? g_default_server_keepalive_permit_without_calls
+                          : false);
   }
 
+  t->settings_timeout =
+      channel_args.GetDurationFromIntMillis(GRPC_ARG_SETTINGS_TIMEOUT)
+          .value_or(std::max(t->keepalive_timeout * 2,
+                             grpc_core::Duration::Minutes(1)));
+
   // Only send the prefered rx frame size http2 setting if we are instructed
   // to auto size the buffers allocated at tcp level and we also can adjust
   // sending frame size.
@@ -391,13 +495,22 @@ static void read_channel_args(grpc_chttp2_transport* t,
           .GetBool(GRPC_ARG_EXPERIMENTAL_HTTP2_PREFERRED_CRYPTO_FRAME_SIZE)
           .value_or(false);
 
+  const auto max_requests_per_read =
+      channel_args.GetInt("grpc.http2.max_requests_per_read");
+  if (max_requests_per_read.has_value()) {
+    t->max_requests_per_read =
+        grpc_core::Clamp(*max_requests_per_read, 1, 10000);
+  } else {
+    t->max_requests_per_read = 32;
+  }
+
   if (channel_args.GetBool(GRPC_ARG_ENABLE_CHANNELZ)
           .value_or(GRPC_ENABLE_CHANNELZ_DEFAULT)) {
     t->channelz_socket =
         grpc_core::MakeRefCounted<grpc_core::channelz::SocketNode>(
             std::string(grpc_endpoint_get_local_address(t->ep)),
             std::string(t->peer_string.as_string_view()),
-            absl::StrCat(get_vtable()->name, " ",
+            absl::StrCat(t->GetTransportName(), " ",
                          t->peer_string.as_string_view()),
             channel_args
                 .GetObjectRef<grpc_core::channelz::SocketNode::Security>());
@@ -405,6 +518,19 @@ static void read_channel_args(grpc_chttp2_transport* t,
 
   t->ack_pings = channel_args.GetBool("grpc.http2.ack_pings").value_or(true);
 
+  t->allow_tarpit =
+      channel_args.GetBool(GRPC_ARG_HTTP_ALLOW_TARPIT).value_or(true);
+  t->min_tarpit_duration_ms =
+      channel_args
+          .GetDurationFromIntMillis(GRPC_ARG_HTTP_TARPIT_MIN_DURATION_MS)
+          .value_or(grpc_core::Duration::Milliseconds(100))
+          .millis();
+  t->max_tarpit_duration_ms =
+      channel_args
+          .GetDurationFromIntMillis(GRPC_ARG_HTTP_TARPIT_MAX_DURATION_MS)
+          .value_or(grpc_core::Duration::Seconds(1))
+          .millis();
+
   const int soft_limit =
       channel_args.GetInt(GRPC_ARG_MAX_METADATA_SIZE).value_or(-1);
   if (soft_limit < 0) {
@@ -420,104 +546,77 @@ static void read_channel_args(grpc_chttp2_transport* t,
     t->max_header_list_size_soft_limit = soft_limit;
   }
 
-  static const struct {
-    absl::string_view channel_arg_name;
-    grpc_chttp2_setting_id setting_id;
-    int default_value;
-    int min;
-    int max;
-    bool availability[2] /* server, client */;
-  } settings_map[] = {{GRPC_ARG_MAX_CONCURRENT_STREAMS,
-                       GRPC_CHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS,
-                       -1,
-                       0,
-                       INT32_MAX,
-                       {true, false}},
-                      {GRPC_ARG_HTTP2_HPACK_TABLE_SIZE_DECODER,
-                       GRPC_CHTTP2_SETTINGS_HEADER_TABLE_SIZE,
-                       -1,
-                       0,
-                       INT32_MAX,
-                       {true, true}},
-                      {GRPC_ARG_ABSOLUTE_MAX_METADATA_SIZE,
-                       GRPC_CHTTP2_SETTINGS_MAX_HEADER_LIST_SIZE,
-                       -1,
-                       0,
-                       INT32_MAX,
-                       {true, true}},
-                      {GRPC_ARG_HTTP2_MAX_FRAME_SIZE,
-                       GRPC_CHTTP2_SETTINGS_MAX_FRAME_SIZE,
-                       -1,
-                       16384,
-                       16777215,
-                       {true, true}},
-                      {GRPC_ARG_HTTP2_ENABLE_TRUE_BINARY,
-                       GRPC_CHTTP2_SETTINGS_GRPC_ALLOW_TRUE_BINARY_METADATA,
-                       1,
-                       0,
-                       1,
-                       {true, true}},
-                      {GRPC_ARG_HTTP2_STREAM_LOOKAHEAD_BYTES,
-                       GRPC_CHTTP2_SETTINGS_INITIAL_WINDOW_SIZE,
-                       -1,
-                       5,
-                       INT32_MAX,
-                       {true, true}}};
-
-  for (size_t i = 0; i < GPR_ARRAY_SIZE(settings_map); i++) {
-    const auto& setting = settings_map[i];
-    if (setting.availability[is_client]) {
-      const int value = channel_args.GetInt(setting.channel_arg_name)
-                            .value_or(setting.default_value);
-      if (value >= 0) {
-        queue_setting_update(t, setting.setting_id,
-                             grpc_core::Clamp(value, setting.min, setting.max));
-      } else if (setting.setting_id ==
-                 GRPC_CHTTP2_SETTINGS_MAX_HEADER_LIST_SIZE) {
-        // Set value to 1.25 * soft limit if this is larger than
-        // `DEFAULT_MAX_HEADER_LIST_SIZE` and
-        // `GRPC_ARG_ABSOLUTE_MAX_METADATA_SIZE` is not set.
-        const int soft_limit = channel_args.GetInt(GRPC_ARG_MAX_METADATA_SIZE)
-                                   .value_or(setting.default_value);
-        const int value = (soft_limit >= 0 && soft_limit < (INT_MAX / 1.25))
-                              ? static_cast<int>(soft_limit * 1.25)
-                              : soft_limit;
-        if (value > DEFAULT_MAX_HEADER_LIST_SIZE) {
-          queue_setting_update(
-              t, setting.setting_id,
-              grpc_core::Clamp(value, setting.min, setting.max));
-        }
-      }
-    } else if (channel_args.Contains(setting.channel_arg_name)) {
-      gpr_log(GPR_DEBUG, "%s is not available on %s",
-              std::string(setting.channel_arg_name).c_str(),
-              is_client ? "clients" : "servers");
+  int value;
+  if (!is_client) {
+    value = channel_args.GetInt(GRPC_ARG_MAX_CONCURRENT_STREAMS).value_or(-1);
+    if (value >= 0) {
+      t->settings.mutable_local().SetMaxConcurrentStreams(value);
+      t->max_concurrent_streams_policy.SetTarget(value);
+    }
+  } else if (channel_args.Contains(GRPC_ARG_MAX_CONCURRENT_STREAMS)) {
+    gpr_log(GPR_DEBUG, "%s is not available on clients",
+            GRPC_ARG_MAX_CONCURRENT_STREAMS);
+  }
+  value =
+      channel_args.GetInt(GRPC_ARG_HTTP2_HPACK_TABLE_SIZE_DECODER).value_or(-1);
+  if (value >= 0) {
+    t->settings.mutable_local().SetHeaderTableSize(value);
+  }
+  value = channel_args.GetInt(GRPC_ARG_ABSOLUTE_MAX_METADATA_SIZE).value_or(-1);
+  if (value >= 0) {
+    t->settings.mutable_local().SetMaxHeaderListSize(value);
+  } else {
+    // Set value to 1.25 * soft limit if this is larger than
+    // `DEFAULT_MAX_HEADER_LIST_SIZE` and
+    // `GRPC_ARG_ABSOLUTE_MAX_METADATA_SIZE` is not set.
+    const int soft_limit =
+        channel_args.GetInt(GRPC_ARG_MAX_METADATA_SIZE).value_or(-1);
+    const int value = (soft_limit >= 0 && soft_limit < (INT_MAX / 1.25))
+                          ? static_cast<int>(soft_limit * 1.25)
+                          : soft_limit;
+    if (value > DEFAULT_MAX_HEADER_LIST_SIZE) {
+      t->settings.mutable_local().SetMaxHeaderListSize(value);
     }
   }
+  value = channel_args.GetInt(GRPC_ARG_HTTP2_MAX_FRAME_SIZE).value_or(-1);
+  if (value >= 0) {
+    t->settings.mutable_local().SetMaxFrameSize(value);
+  }
+  value =
+      channel_args.GetInt(GRPC_ARG_HTTP2_STREAM_LOOKAHEAD_BYTES).value_or(-1);
+  if (value >= 0) {
+    t->settings.mutable_local().SetInitialWindowSize(value);
+  }
+  value = channel_args.GetInt(GRPC_ARG_HTTP2_ENABLE_TRUE_BINARY).value_or(-1);
+  if (value >= 0) {
+    t->settings.mutable_local().SetAllowTrueBinaryMetadata(value != 0);
+  }
 
   if (t->enable_preferred_rx_crypto_frame_advertisement) {
-    const grpc_chttp2_setting_parameters* sp =
-        &grpc_chttp2_settings_parameters
-            [GRPC_CHTTP2_SETTINGS_GRPC_PREFERRED_RECEIVE_CRYPTO_FRAME_SIZE];
-    queue_setting_update(
-        t, GRPC_CHTTP2_SETTINGS_GRPC_PREFERRED_RECEIVE_CRYPTO_FRAME_SIZE,
-        grpc_core::Clamp(INT_MAX, static_cast<int>(sp->min_value),
-                         static_cast<int>(sp->max_value)));
+    t->settings.mutable_local().SetPreferredReceiveCryptoMessageSize(INT_MAX);
   }
+
+  t->ping_on_rst_stream_percent = grpc_core::Clamp(
+      channel_args.GetInt(GRPC_ARG_HTTP2_PING_ON_RST_STREAM_PERCENT)
+          .value_or(1),
+      0, 100);
+
+  t->max_concurrent_streams_overload_protection =
+      channel_args.GetBool(GRPC_ARG_MAX_CONCURRENT_STREAMS_OVERLOAD_PROTECTION)
+          .value_or(true);
 }
 
 static void init_keepalive_pings_if_enabled_locked(
-    void* arg, GRPC_UNUSED grpc_error_handle error) {
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    GRPC_UNUSED grpc_error_handle error) {
   GPR_DEBUG_ASSERT(error.ok());
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(arg);
   if (t->keepalive_time != grpc_core::Duration::Infinity()) {
     t->keepalive_state = GRPC_CHTTP2_KEEPALIVE_STATE_WAITING;
-    GRPC_CHTTP2_REF_TRANSPORT(t, "init keepalive ping");
     t->keepalive_ping_timer_handle =
-        t->event_engine->RunAfter(t->keepalive_time, [t] {
+        t->event_engine->RunAfter(t->keepalive_time, [t = t->Ref()]() mutable {
           grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
           grpc_core::ExecCtx exec_ctx;
-          init_keepalive_ping(t);
+          init_keepalive_ping(std::move(t));
         });
   } else {
     // Use GRPC_CHTTP2_KEEPALIVE_STATE_DISABLED to indicate there are no
@@ -529,76 +628,66 @@ static void init_keepalive_pings_if_enabled_locked(
 grpc_chttp2_transport::grpc_chttp2_transport(
     const grpc_core::ChannelArgs& channel_args, grpc_endpoint* ep,
     bool is_client)
-    : refs(1, GRPC_TRACE_FLAG_ENABLED(grpc_trace_chttp2_refcount)
-                  ? "chttp2_refcount"
-                  : nullptr),
+    : grpc_core::RefCounted<grpc_chttp2_transport,
+                            grpc_core::NonPolymorphicRefCount>(
+          GRPC_TRACE_FLAG_ENABLED(grpc_trace_chttp2_refcount)
+              ? "chttp2_refcount"
+              : nullptr),
       ep(ep),
       peer_string(
           grpc_core::Slice::FromCopiedString(grpc_endpoint_get_peer(ep))),
       memory_owner(channel_args.GetObject<grpc_core::ResourceQuota>()
                        ->memory_quota()
-                       ->CreateMemoryOwner(absl::StrCat(
-                           grpc_endpoint_get_peer(ep), ":client_transport"))),
+                       ->CreateMemoryOwner()),
       self_reservation(
           memory_owner.MakeReservation(sizeof(grpc_chttp2_transport))),
-      combiner(grpc_combiner_create()),
+      event_engine(
+          channel_args
+              .GetObjectRef<grpc_event_engine::experimental::EventEngine>()),
+      combiner(grpc_combiner_create(event_engine)),
       state_tracker(is_client ? "client_transport" : "server_transport",
                     GRPC_CHANNEL_READY),
-      is_client(is_client),
       next_stream_id(is_client ? 1 : 2),
+      ping_abuse_policy(channel_args),
+      ping_rate_policy(channel_args, is_client),
       flow_control(
           peer_string.as_string_view(),
           channel_args.GetBool(GRPC_ARG_HTTP2_BDP_PROBE).value_or(true),
           &memory_owner),
       deframe_state(is_client ? GRPC_DTS_FH_0 : GRPC_DTS_CLIENT_PREFIX_0),
-      event_engine(
-          channel_args
-              .GetObjectRef<grpc_event_engine::experimental::EventEngine>()) {
+      is_client(is_client) {
   cl = new grpc_core::ContextList();
   GPR_ASSERT(strlen(GRPC_CHTTP2_CLIENT_CONNECT_STRING) ==
              GRPC_CHTTP2_CLIENT_CONNECT_STRLEN);
-  base.vtable = get_vtable();
 
   grpc_slice_buffer_init(&read_buffer);
-  grpc_slice_buffer_init(&outbuf);
   if (is_client) {
-    grpc_slice_buffer_add(&outbuf, grpc_slice_from_copied_string(
-                                       GRPC_CHTTP2_CLIENT_CONNECT_STRING));
+    grpc_slice_buffer_add(
+        outbuf.c_slice_buffer(),
+        grpc_slice_from_copied_string(GRPC_CHTTP2_CLIENT_CONNECT_STRING));
   }
   grpc_slice_buffer_init(&qbuf);
-  // copy in initial settings to all setting sets
-  size_t i;
-  int j;
-  for (i = 0; i < GRPC_CHTTP2_NUM_SETTINGS; i++) {
-    for (j = 0; j < GRPC_NUM_SETTING_SETS; j++) {
-      settings[j][i] = grpc_chttp2_settings_parameters[i].default_value;
-    }
-  }
   grpc_chttp2_goaway_parser_init(&goaway_parser);
 
   // configure http2 the way we like it
   if (is_client) {
-    queue_setting_update(this, GRPC_CHTTP2_SETTINGS_ENABLE_PUSH, 0);
-    queue_setting_update(this, GRPC_CHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS, 0);
+    settings.mutable_local().SetEnablePush(false);
+    settings.mutable_local().SetMaxConcurrentStreams(0);
   }
-  queue_setting_update(this, GRPC_CHTTP2_SETTINGS_MAX_HEADER_LIST_SIZE,
-                       DEFAULT_MAX_HEADER_LIST_SIZE);
-  queue_setting_update(this,
-                       GRPC_CHTTP2_SETTINGS_GRPC_ALLOW_TRUE_BINARY_METADATA, 1);
+  settings.mutable_local().SetMaxHeaderListSize(DEFAULT_MAX_HEADER_LIST_SIZE);
+  settings.mutable_local().SetAllowTrueBinaryMetadata(true);
 
   read_channel_args(this, channel_args, is_client);
 
-  // No pings allowed before receiving a header or data frame.
-  ping_state.pings_before_data_required = 0;
-  ping_state.last_ping_sent_time = grpc_core::Timestamp::InfPast();
-
-  ping_recv_state.last_ping_recv_time = grpc_core::Timestamp::InfPast();
-  ping_recv_state.ping_strikes = 0;
+  // Initially allow *UP TO* MAX_CONCURRENT_STREAMS incoming before we start
+  // blanket cancelling them.
+  num_incoming_streams_before_settings_ack =
+      settings.local().max_concurrent_streams();
 
   grpc_core::ExecCtx exec_ctx;
   combiner->Run(
-      GRPC_CLOSURE_INIT(&init_keepalive_ping_locked,
-                        init_keepalive_pings_if_enabled_locked, this, nullptr),
+      grpc_core::InitTransportClosure<init_keepalive_pings_if_enabled_locked>(
+          Ref(), &init_keepalive_ping_locked),
       absl::OkStatus());
 
   if (flow_control.bdp_probe()) {
@@ -623,21 +712,20 @@ grpc_chttp2_transport::grpc_chttp2_transport(
 }
 
 static void destroy_transport_locked(void* tp, grpc_error_handle /*error*/) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(tp);
+  grpc_core::RefCountedPtr<grpc_chttp2_transport> t(
+      static_cast<grpc_chttp2_transport*>(tp));
   t->destroying = 1;
   close_transport_locked(
-      t, grpc_error_set_int(GRPC_ERROR_CREATE("Transport destroyed"),
-                            grpc_core::StatusIntProperty::kOccurredDuringWrite,
-                            t->write_state));
+      t.get(),
+      grpc_error_set_int(GRPC_ERROR_CREATE("Transport destroyed"),
+                         grpc_core::StatusIntProperty::kOccurredDuringWrite,
+                         t->write_state));
   t->memory_owner.Reset();
-  // Must be the last line.
-  GRPC_CHTTP2_UNREF_TRANSPORT(t, "destroy");
 }
 
-static void destroy_transport(grpc_transport* gt) {
-  grpc_chttp2_transport* t = reinterpret_cast<grpc_chttp2_transport*>(gt);
-  t->combiner->Run(GRPC_CLOSURE_CREATE(destroy_transport_locked, t, nullptr),
-                   absl::OkStatus());
+void grpc_chttp2_transport::Orphan() {
+  combiner->Run(GRPC_CLOSURE_CREATE(destroy_transport_locked, this, nullptr),
+                absl::OkStatus());
 }
 
 static void close_transport_locked(grpc_chttp2_transport* t,
@@ -663,39 +751,33 @@ static void close_transport_locked(grpc_chttp2_transport* t,
     t->closed_with_error = error;
     connectivity_state_set(t, GRPC_CHANNEL_SHUTDOWN, absl::Status(),
                            "close_transport");
-    if (t->ping_state.delayed_ping_timer_handle.has_value()) {
-      if (t->event_engine->Cancel(*t->ping_state.delayed_ping_timer_handle)) {
-        GRPC_CHTTP2_UNREF_TRANSPORT(t, "retry_initiate_ping_locked");
-        t->ping_state.delayed_ping_timer_handle.reset();
-      }
+    if (t->keepalive_ping_timeout_handle != TaskHandle::kInvalid) {
+      t->event_engine->Cancel(std::exchange(t->keepalive_ping_timeout_handle,
+                                            TaskHandle::kInvalid));
     }
-    if (t->next_bdp_ping_timer_handle.has_value()) {
-      if (t->event_engine->Cancel(*t->next_bdp_ping_timer_handle)) {
-        GRPC_CHTTP2_UNREF_TRANSPORT(t, "bdp_ping");
-        t->next_bdp_ping_timer_handle.reset();
-      }
+    if (t->settings_ack_watchdog != TaskHandle::kInvalid) {
+      t->event_engine->Cancel(
+          std::exchange(t->settings_ack_watchdog, TaskHandle::kInvalid));
+    }
+    if (t->delayed_ping_timer_handle != TaskHandle::kInvalid &&
+        t->event_engine->Cancel(t->delayed_ping_timer_handle)) {
+      t->delayed_ping_timer_handle = TaskHandle::kInvalid;
+    }
+    if (t->next_bdp_ping_timer_handle != TaskHandle::kInvalid &&
+        t->event_engine->Cancel(t->next_bdp_ping_timer_handle)) {
+      t->next_bdp_ping_timer_handle = TaskHandle::kInvalid;
     }
     switch (t->keepalive_state) {
       case GRPC_CHTTP2_KEEPALIVE_STATE_WAITING:
-        if (t->keepalive_ping_timer_handle.has_value()) {
-          if (t->event_engine->Cancel(*t->keepalive_ping_timer_handle)) {
-            GRPC_CHTTP2_UNREF_TRANSPORT(t, "init keepalive ping");
-            t->keepalive_ping_timer_handle.reset();
-          }
+        if (t->keepalive_ping_timer_handle != TaskHandle::kInvalid &&
+            t->event_engine->Cancel(t->keepalive_ping_timer_handle)) {
+          t->keepalive_ping_timer_handle = TaskHandle::kInvalid;
         }
         break;
       case GRPC_CHTTP2_KEEPALIVE_STATE_PINGING:
-        if (t->keepalive_ping_timer_handle.has_value()) {
-          if (t->event_engine->Cancel(*t->keepalive_ping_timer_handle)) {
-            GRPC_CHTTP2_UNREF_TRANSPORT(t, "init keepalive ping");
-            t->keepalive_ping_timer_handle.reset();
-          }
-        }
-        if (t->keepalive_watchdog_timer_handle.has_value()) {
-          if (t->event_engine->Cancel(*t->keepalive_watchdog_timer_handle)) {
-            GRPC_CHTTP2_UNREF_TRANSPORT(t, "keepalive watchdog");
-            t->keepalive_watchdog_timer_handle.reset();
-          }
+        if (t->keepalive_ping_timer_handle != TaskHandle::kInvalid &&
+            t->event_engine->Cancel(t->keepalive_ping_timer_handle)) {
+          t->keepalive_ping_timer_handle = TaskHandle::kInvalid;
         }
         break;
       case GRPC_CHTTP2_KEEPALIVE_STATE_DYING:
@@ -739,24 +821,27 @@ void grpc_chttp2_stream_unref(grpc_chttp2_stream* s) {
 }
 #endif
 
-grpc_chttp2_stream::Reffer::Reffer(grpc_chttp2_stream* s) {
-  // We reserve one 'active stream' that's dropped when the stream is
-  //   read-closed. The others are for Chttp2IncomingByteStreams that are
-  //   actively reading
-  GRPC_CHTTP2_STREAM_REF(s, "chttp2");
-  GRPC_CHTTP2_REF_TRANSPORT(s->t, "stream");
-}
-
 grpc_chttp2_stream::grpc_chttp2_stream(grpc_chttp2_transport* t,
                                        grpc_stream_refcount* refcount,
                                        const void* server_data,
                                        grpc_core::Arena* arena)
-    : t(t),
-      refcount(refcount),
-      reffer(this),
+    : t(t->Ref()),
+      refcount([refcount]() {
+// We reserve one 'active stream' that's dropped when the stream is
+//   read-closed. The others are for Chttp2IncomingByteStreams that are
+//   actively reading
+// We do this here to avoid cache misses.
+#ifndef NDEBUG
+        grpc_stream_ref(refcount, "chttp2");
+#else
+        grpc_stream_ref(refcount);
+#endif
+        return refcount;
+      }()),
       initial_metadata_buffer(arena),
       trailing_metadata_buffer(arena),
       flow_control(&t->flow_control) {
+  t->streams_allocated.fetch_add(1, std::memory_order_relaxed);
   if (server_data) {
     id = static_cast<uint32_t>(reinterpret_cast<uintptr_t>(server_data));
     if (grpc_http_trace.enabled()) {
@@ -773,8 +858,9 @@ grpc_chttp2_stream::grpc_chttp2_stream(grpc_chttp2_transport* t,
 }
 
 grpc_chttp2_stream::~grpc_chttp2_stream() {
-  grpc_chttp2_list_remove_stalled_by_stream(t, this);
-  grpc_chttp2_list_remove_stalled_by_transport(t, this);
+  t->streams_allocated.fetch_sub(1, std::memory_order_relaxed);
+  grpc_chttp2_list_remove_stalled_by_stream(t.get(), this);
+  grpc_chttp2_list_remove_stalled_by_transport(t.get(), this);
 
   if (t->channelz_socket != nullptr) {
     if ((t->is_client && eos_received) || (!t->is_client && eos_sent)) {
@@ -805,16 +891,14 @@ grpc_chttp2_stream::~grpc_chttp2_stream() {
   GPR_ASSERT(recv_message_ready == nullptr);
   GPR_ASSERT(recv_trailing_metadata_finished == nullptr);
   grpc_slice_buffer_destroy(&flow_controlled_buffer);
-  GRPC_CHTTP2_UNREF_TRANSPORT(t, "stream");
   grpc_core::ExecCtx::Run(DEBUG_LOCATION, destroy_stream_arg, absl::OkStatus());
 }
 
-static int init_stream(grpc_transport* gt, grpc_stream* gs,
-                       grpc_stream_refcount* refcount, const void* server_data,
-                       grpc_core::Arena* arena) {
-  grpc_chttp2_transport* t = reinterpret_cast<grpc_chttp2_transport*>(gt);
-  new (gs) grpc_chttp2_stream(t, refcount, server_data, arena);
-  return 0;
+void grpc_chttp2_transport::InitStream(grpc_stream* gs,
+                                       grpc_stream_refcount* refcount,
+                                       const void* server_data,
+                                       grpc_core::Arena* arena) {
+  new (gs) grpc_chttp2_stream(this, refcount, server_data, arena);
 }
 
 static void destroy_stream_locked(void* sp, grpc_error_handle /*error*/) {
@@ -822,13 +906,12 @@ static void destroy_stream_locked(void* sp, grpc_error_handle /*error*/) {
   s->~grpc_chttp2_stream();
 }
 
-static void destroy_stream(grpc_transport* gt, grpc_stream* gs,
-                           grpc_closure* then_schedule_closure) {
-  grpc_chttp2_transport* t = reinterpret_cast<grpc_chttp2_transport*>(gt);
+void grpc_chttp2_transport::DestroyStream(grpc_stream* gs,
+                                          grpc_closure* then_schedule_closure) {
   grpc_chttp2_stream* s = reinterpret_cast<grpc_chttp2_stream*>(gs);
 
   s->destroy_stream_arg = then_schedule_closure;
-  t->combiner->Run(
+  combiner->Run(
       GRPC_CLOSURE_INIT(&s->destroy_stream, destroy_stream_locked, s, nullptr),
       absl::OkStatus());
 }
@@ -841,7 +924,7 @@ grpc_chttp2_stream* grpc_chttp2_parsing_accept_stream(grpc_chttp2_transport* t,
   grpc_chttp2_stream* accepting = nullptr;
   GPR_ASSERT(t->accepting_stream == nullptr);
   t->accepting_stream = &accepting;
-  t->accept_stream_cb(t->accept_stream_cb_user_data, &t->base,
+  t->accept_stream_cb(t->accept_stream_cb_user_data, t,
                       reinterpret_cast<void*>(id));
   t->accepting_stream = nullptr;
   return accepting;
@@ -893,7 +976,6 @@ void grpc_chttp2_initiate_write(grpc_chttp2_transport* t,
     case GRPC_CHTTP2_WRITE_STATE_IDLE:
       set_write_state(t, GRPC_CHTTP2_WRITE_STATE_WRITING,
                       grpc_chttp2_initiate_write_reason_string(reason));
-      GRPC_CHTTP2_REF_TRANSPORT(t, "writing");
       // Note that the 'write_action_begin_locked' closure is being scheduled
       // on the 'finally_scheduler' of t->combiner. This means that
       // 'write_action_begin_locked' is called only *after* all the other
@@ -911,8 +993,8 @@ void grpc_chttp2_initiate_write(grpc_chttp2_transport* t,
       // It does not call the endpoint to write the bytes. That is done by the
       // 'write_action' (which is scheduled by 'write_action_begin_locked')
       t->combiner->FinallyRun(
-          GRPC_CLOSURE_INIT(&t->write_action_begin_locked,
-                            write_action_begin_locked, t, nullptr),
+          grpc_core::InitTransportClosure<write_action_begin_locked>(
+              t->Ref(), &t->write_action_begin_locked),
           absl::OkStatus());
       break;
     case GRPC_CHTTP2_WRITE_STATE_WRITING:
@@ -939,22 +1021,22 @@ static const char* begin_writing_desc(bool partial) {
   }
 }
 
-static void write_action_begin_locked(void* gt,
-                                      grpc_error_handle /*error_ignored*/) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(gt);
+static void write_action_begin_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    grpc_error_handle /*error_ignored*/) {
   GPR_ASSERT(t->write_state != GRPC_CHTTP2_WRITE_STATE_IDLE);
   grpc_chttp2_begin_write_result r;
   if (!t->closed_with_error.ok()) {
     r.writing = false;
   } else {
-    r = grpc_chttp2_begin_write(t);
+    r = grpc_chttp2_begin_write(t.get());
   }
   if (r.writing) {
-    set_write_state(t,
+    set_write_state(t.get(),
                     r.partial ? GRPC_CHTTP2_WRITE_STATE_WRITING_WITH_MORE
                               : GRPC_CHTTP2_WRITE_STATE_WRITING,
                     begin_writing_desc(r.partial));
-    write_action(t, absl::OkStatus());
+    write_action(t.get());
     if (t->reading_paused_on_pending_induced_frames) {
       GPR_ASSERT(t->num_pending_induced_frames == 0);
       // We had paused reading, because we had many induced frames (SETTINGS
@@ -964,18 +1046,17 @@ static void write_action_begin_locked(void* gt,
           GPR_INFO,
           "transport %p : Resuming reading after being paused due to too "
           "many unwritten SETTINGS ACK, PINGS ACK and RST_STREAM frames",
-          t));
+          t.get()));
       t->reading_paused_on_pending_induced_frames = false;
-      continue_read_action_locked(t);
+      continue_read_action_locked(std::move(t));
     }
   } else {
-    set_write_state(t, GRPC_CHTTP2_WRITE_STATE_IDLE, "begin writing nothing");
-    GRPC_CHTTP2_UNREF_TRANSPORT(t, "writing");
+    set_write_state(t.get(), GRPC_CHTTP2_WRITE_STATE_IDLE,
+                    "begin writing nothing");
   }
 }
 
-static void write_action(void* gt, grpc_error_handle /*error*/) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(gt);
+static void write_action(grpc_chttp2_transport* t) {
   void* cl = t->cl;
   if (!t->cl->empty()) {
     // Transfer the ownership of the context list to the endpoint and create and
@@ -991,36 +1072,45 @@ static void write_action(void* gt, grpc_error_handle /*error*/) {
   // Choose max_frame_size as the prefered rx crypto frame size indicated by the
   // peer.
   int max_frame_size =
-      t->settings
-          [GRPC_PEER_SETTINGS]
-          [GRPC_CHTTP2_SETTINGS_GRPC_PREFERRED_RECEIVE_CRYPTO_FRAME_SIZE];
+      t->settings.peer().preferred_receive_crypto_message_size();
   // Note: max frame size is 0 if the remote peer does not support adjusting the
   // sending frame size.
   if (max_frame_size == 0) {
     max_frame_size = INT_MAX;
   }
-  grpc_endpoint_write(
-      t->ep, &t->outbuf,
-      GRPC_CLOSURE_INIT(&t->write_action_end_locked, write_action_end, t,
-                        grpc_schedule_on_exec_ctx),
-      cl, max_frame_size);
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_ping_trace)) {
+    gpr_log(GPR_INFO, "%s[%p]: Write %" PRIdPTR " bytes",
+            t->is_client ? "CLIENT" : "SERVER", t, t->outbuf.Length());
+  }
+  t->write_size_policy.BeginWrite(t->outbuf.Length());
+  grpc_endpoint_write(t->ep, t->outbuf.c_slice_buffer(),
+                      grpc_core::InitTransportClosure<write_action_end>(
+                          t->Ref(), &t->write_action_end_locked),
+                      cl, max_frame_size);
 }
 
-static void write_action_end(void* tp, grpc_error_handle error) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(tp);
-  t->combiner->Run(GRPC_CLOSURE_INIT(&t->write_action_end_locked,
-                                     write_action_end_locked, t, nullptr),
-                   error);
+static void write_action_end(grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+                             grpc_error_handle error) {
+  auto* tp = t.get();
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_ping_trace)) {
+    gpr_log(GPR_INFO, "%s[%p]: Finish write",
+            t->is_client ? "CLIENT" : "SERVER", t.get());
+  }
+  tp->combiner->Run(grpc_core::InitTransportClosure<write_action_end_locked>(
+                        std::move(t), &tp->write_action_end_locked),
+                    error);
 }
 
 // Callback from the grpc_endpoint after bytes have been written by calling
 // sendmsg
-static void write_action_end_locked(void* tp, grpc_error_handle error) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(tp);
+static void write_action_end_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    grpc_error_handle error) {
+  t->write_size_policy.EndWrite(error.ok());
 
   bool closed = false;
   if (!error.ok()) {
-    close_transport_locked(t, error);
+    close_transport_locked(t.get(), error);
     closed = true;
   }
 
@@ -1028,7 +1118,7 @@ static void write_action_end_locked(void* tp, grpc_error_handle error) {
     t->sent_goaway_state = GRPC_CHTTP2_FINAL_GOAWAY_SENT;
     closed = true;
     if (t->stream_map.empty()) {
-      close_transport_locked(t, GRPC_ERROR_CREATE("goaway sent"));
+      close_transport_locked(t.get(), GRPC_ERROR_CREATE("goaway sent"));
     }
   }
 
@@ -1036,11 +1126,11 @@ static void write_action_end_locked(void* tp, grpc_error_handle error) {
     case GRPC_CHTTP2_WRITE_STATE_IDLE:
       GPR_UNREACHABLE_CODE(break);
     case GRPC_CHTTP2_WRITE_STATE_WRITING:
-      set_write_state(t, GRPC_CHTTP2_WRITE_STATE_IDLE, "finish writing");
+      set_write_state(t.get(), GRPC_CHTTP2_WRITE_STATE_IDLE, "finish writing");
       break;
     case GRPC_CHTTP2_WRITE_STATE_WRITING_WITH_MORE:
-      set_write_state(t, GRPC_CHTTP2_WRITE_STATE_WRITING, "continue writing");
-      GRPC_CHTTP2_REF_TRANSPORT(t, "writing");
+      set_write_state(t.get(), GRPC_CHTTP2_WRITE_STATE_WRITING,
+                      "continue writing");
       // If the transport is closed, we will retry writing on the endpoint
       // and next write may contain part of the currently serialized frames.
       // So, we should only call the run_after_write callbacks when the next
@@ -1050,42 +1140,24 @@ static void write_action_end_locked(void* tp, grpc_error_handle error) {
         grpc_core::ExecCtx::RunList(DEBUG_LOCATION, &t->run_after_write);
       }
       t->combiner->FinallyRun(
-          GRPC_CLOSURE_INIT(&t->write_action_begin_locked,
-                            write_action_begin_locked, t, nullptr),
+          grpc_core::InitTransportClosure<write_action_begin_locked>(
+              t, &t->write_action_begin_locked),
           absl::OkStatus());
       break;
   }
 
-  grpc_chttp2_end_write(t, error);
-  GRPC_CHTTP2_UNREF_TRANSPORT(t, "writing");
-}
-
-// Dirties an HTTP2 setting to be sent out next time a writing path occurs.
-// If the change needs to occur immediately, manually initiate a write.
-static void queue_setting_update(grpc_chttp2_transport* t,
-                                 grpc_chttp2_setting_id id, uint32_t value) {
-  const grpc_chttp2_setting_parameters* sp =
-      &grpc_chttp2_settings_parameters[id];
-  uint32_t use_value = grpc_core::Clamp(value, sp->min_value, sp->max_value);
-  if (use_value != value) {
-    gpr_log(GPR_INFO, "Requested parameter %s clamped from %d to %d", sp->name,
-            value, use_value);
-  }
-  if (use_value != t->settings[GRPC_LOCAL_SETTINGS][id]) {
-    t->settings[GRPC_LOCAL_SETTINGS][id] = use_value;
-    t->dirtied_local_settings = true;
-  }
+  grpc_chttp2_end_write(t.get(), error);
 }
 
 // Cancel out streams that haven't yet started if we have received a GOAWAY
 static void cancel_unstarted_streams(grpc_chttp2_transport* t,
-                                     grpc_error_handle error) {
+                                     grpc_error_handle error, bool tarpit) {
   grpc_chttp2_stream* s;
   while (grpc_chttp2_list_pop_waiting_for_concurrency(t, &s)) {
     s->trailing_metadata_buffer.Set(
         grpc_core::GrpcStreamNetworkState(),
         grpc_core::GrpcStreamNetworkState::kNotSentOnWire);
-    grpc_chttp2_cancel_stream(t, s, error);
+    grpc_chttp2_cancel_stream(t, s, error, tarpit);
   }
 }
 
@@ -1118,7 +1190,7 @@ void grpc_chttp2_add_incoming_goaway(grpc_chttp2_transport* t,
             grpc_core::StatusToString(t->goaway_error).c_str());
   }
   if (t->is_client) {
-    cancel_unstarted_streams(t, t->goaway_error);
+    cancel_unstarted_streams(t, t->goaway_error, false);
     // Cancel all unseen streams
     std::vector<grpc_chttp2_stream*> to_cancel;
     for (auto id_stream : t->stream_map) {
@@ -1130,7 +1202,7 @@ void grpc_chttp2_add_incoming_goaway(grpc_chttp2_transport* t,
       s->trailing_metadata_buffer.Set(
           grpc_core::GrpcStreamNetworkState(),
           grpc_core::GrpcStreamNetworkState::kNotSeenByServer);
-      grpc_chttp2_cancel_stream(s->t, s, s->t->goaway_error);
+      grpc_chttp2_cancel_stream(s->t.get(), s, s->t->goaway_error, false);
     }
   }
   absl::Status status = grpc_error_to_absl_status(t->goaway_error);
@@ -1169,15 +1241,13 @@ static void maybe_start_some_streams(grpc_chttp2_transport* t) {
   // maybe cancel out streams that haven't yet started if we have received a
   // GOAWAY
   if (!t->goaway_error.ok()) {
-    cancel_unstarted_streams(t, t->goaway_error);
+    cancel_unstarted_streams(t, t->goaway_error, false);
     return;
   }
   // start streams where we have free grpc_chttp2_stream ids and free
   // * concurrency
   while (t->next_stream_id <= MAX_CLIENT_STREAM_ID &&
-         t->stream_map.size() <
-             t->settings[GRPC_PEER_SETTINGS]
-                        [GRPC_CHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS] &&
+         t->stream_map.size() < t->settings.peer().max_concurrent_streams() &&
          grpc_chttp2_list_pop_waiting_for_concurrency(t, &s)) {
     // safe since we can't (legally) be parsing this stream yet
     GRPC_CHTTP2_IF_TRACING(gpr_log(
@@ -1211,7 +1281,8 @@ static void maybe_start_some_streams(grpc_chttp2_transport* t) {
           t, s,
           grpc_error_set_int(GRPC_ERROR_CREATE("Stream IDs exhausted"),
                              grpc_core::StatusIntProperty::kRpcStatus,
-                             GRPC_STATUS_UNAVAILABLE));
+                             GRPC_STATUS_UNAVAILABLE),
+          false);
     }
   }
 }
@@ -1259,9 +1330,8 @@ void grpc_chttp2_complete_closure_step(grpc_chttp2_transport* t,
         write_state_name(t->write_state), whence.file(), whence.line());
   }
 
-  auto* tracer = CallTracerIfEnabled(s);
-  if (tracer != nullptr) {
-    tracer->RecordAnnotation(
+  if (s->call_tracer) {
+    s->call_tracer->RecordAnnotation(
         absl::StrFormat("on_complete: s=%p %p desc=%s err=%s", s, closure, desc,
                         grpc_core::StatusToString(error).c_str()));
   }
@@ -1319,10 +1389,12 @@ static void perform_stream_op_locked(void* stream_op,
   grpc_chttp2_stream* s =
       static_cast<grpc_chttp2_stream*>(op->handler_private.extra_arg);
   grpc_transport_stream_op_batch_payload* op_payload = op->payload;
-  grpc_chttp2_transport* t = s->t;
+  grpc_chttp2_transport* t = s->t.get();
 
   s->context = op->payload->context;
   s->traced = op->is_traced;
+  s->call_tracer = CallTracerIfSampled(s);
+  s->tcp_tracer = TcpTracerIfSampled(s);
   if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace)) {
     gpr_log(GPR_INFO,
             "perform_stream_op_locked[s=%p; op=%p]: %s; on_complete = %p", s,
@@ -1338,9 +1410,8 @@ static void perform_stream_op_locked(void* stream_op,
     }
   }
 
-  auto* tracer = CallTracerIfEnabled(s);
-  if (tracer != nullptr) {
-    tracer->RecordAnnotation(absl::StrFormat(
+  if (s->call_tracer) {
+    s->call_tracer->RecordAnnotation(absl::StrFormat(
         "perform_stream_op_locked[s=%p; op=%p]: %s; on_complete = %p", s, op,
         grpc_transport_stream_op_batch_string(op, true).c_str(),
         op->on_complete));
@@ -1356,10 +1427,16 @@ static void perform_stream_op_locked(void* stream_op,
   }
 
   if (op->cancel_stream) {
-    grpc_chttp2_cancel_stream(t, s, op_payload->cancel_stream.cancel_error);
+    grpc_chttp2_cancel_stream(t, s, op_payload->cancel_stream.cancel_error,
+                              op_payload->cancel_stream.tarpit);
   }
 
   if (op->send_initial_metadata) {
+    if (s->call_tracer) {
+      s->call_tracer->RecordAnnotation(grpc_core::HttpAnnotation(
+          grpc_core::HttpAnnotation::Type::kStart, gpr_now(GPR_CLOCK_REALTIME),
+          s->t->flow_control.stats(), s->flow_control.stats()));
+    }
     if (t->is_client && t->channelz_socket != nullptr) {
       t->channelz_socket->RecordStreamStartedFromLocal();
     }
@@ -1394,7 +1471,8 @@ static void perform_stream_op_locked(void* stream_op,
                   GRPC_ERROR_CREATE_REFERENCING("Transport closed",
                                                 &t->closed_with_error, 1),
                   grpc_core::StatusIntProperty::kRpcStatus,
-                  GRPC_STATUS_UNAVAILABLE));
+                  GRPC_STATUS_UNAVAILABLE),
+              false);
         }
       } else {
         GPR_ASSERT(s->id != 0);
@@ -1441,6 +1519,11 @@ static void perform_stream_op_locked(void* stream_op,
       frame_hdr[3] = static_cast<uint8_t>(len >> 8);
       frame_hdr[4] = static_cast<uint8_t>(len);
 
+      if (grpc_core::IsHttp2StatsFixEnabled()) {
+        s->stats.outgoing.framing_bytes += GRPC_HEADER_SIZE_IN_BYTES;
+        s->stats.outgoing.data_bytes +=
+            op_payload->send_message.send_message->Length();
+      }
       s->next_message_end_offset =
           s->flow_controlled_bytes_written +
           static_cast<int64_t>(s->flow_controlled_buffer.length) +
@@ -1567,12 +1650,11 @@ static void perform_stream_op_locked(void* stream_op,
   GRPC_CHTTP2_STREAM_UNREF(s, "perform_stream_op");
 }
 
-static void perform_stream_op(grpc_transport* gt, grpc_stream* gs,
-                              grpc_transport_stream_op_batch* op) {
-  grpc_chttp2_transport* t = reinterpret_cast<grpc_chttp2_transport*>(gt);
+void grpc_chttp2_transport::PerformStreamOp(
+    grpc_stream* gs, grpc_transport_stream_op_batch* op) {
   grpc_chttp2_stream* s = reinterpret_cast<grpc_chttp2_stream*>(gs);
 
-  if (!t->is_client) {
+  if (!is_client) {
     if (op->send_initial_metadata) {
       GPR_ASSERT(!op->payload->send_initial_metadata.send_initial_metadata
                       ->get(grpc_core::GrpcTimeoutMetadata())
@@ -1592,9 +1674,9 @@ static void perform_stream_op(grpc_transport* gt, grpc_stream* gs,
 
   GRPC_CHTTP2_STREAM_REF(s, "perform_stream_op");
   op->handler_private.extra_arg = gs;
-  t->combiner->Run(GRPC_CLOSURE_INIT(&op->handler_private.closure,
-                                     perform_stream_op_locked, op, nullptr),
-                   absl::OkStatus());
+  combiner->Run(GRPC_CLOSURE_INIT(&op->handler_private.closure,
+                                  perform_stream_op_locked, op, nullptr),
+                absl::OkStatus());
 }
 
 static void cancel_pings(grpc_chttp2_transport* t, grpc_error_handle error) {
@@ -1602,14 +1684,38 @@ static void cancel_pings(grpc_chttp2_transport* t, grpc_error_handle error) {
                                  grpc_core::StatusToString(error).c_str()));
   // callback remaining pings: they're not allowed to call into the transport,
   //   and maybe they hold resources that need to be freed
-  grpc_chttp2_ping_queue* pq = &t->ping_queue;
-  GPR_ASSERT(!error.ok());
-  for (size_t j = 0; j < GRPC_CHTTP2_PCL_COUNT; j++) {
-    grpc_closure_list_fail_all(&pq->lists[j], error);
-    grpc_core::ExecCtx::RunList(DEBUG_LOCATION, &pq->lists[j]);
-  }
+  t->ping_callbacks.CancelAll(t->event_engine.get());
 }
 
+namespace {
+class PingClosureWrapper {
+ public:
+  explicit PingClosureWrapper(grpc_closure* closure) : closure_(closure) {}
+  PingClosureWrapper(const PingClosureWrapper&) = delete;
+  PingClosureWrapper& operator=(const PingClosureWrapper&) = delete;
+  PingClosureWrapper(PingClosureWrapper&& other) noexcept
+      : closure_(other.Take()) {}
+  PingClosureWrapper& operator=(PingClosureWrapper&& other) noexcept {
+    std::swap(closure_, other.closure_);
+    return *this;
+  }
+  ~PingClosureWrapper() {
+    if (closure_ != nullptr) {
+      grpc_core::ExecCtx::Run(DEBUG_LOCATION, closure_, absl::CancelledError());
+    }
+  }
+
+  void operator()() {
+    grpc_core::ExecCtx::Run(DEBUG_LOCATION, Take(), absl::OkStatus());
+  }
+
+ private:
+  grpc_closure* Take() { return std::exchange(closure_, nullptr); }
+
+  grpc_closure* closure_ = nullptr;
+};
+}  // namespace
+
 static void send_ping_locked(grpc_chttp2_transport* t,
                              grpc_closure* on_initiate, grpc_closure* on_ack) {
   if (!t->closed_with_error.ok()) {
@@ -1617,82 +1723,119 @@ static void send_ping_locked(grpc_chttp2_transport* t,
     grpc_core::ExecCtx::Run(DEBUG_LOCATION, on_ack, t->closed_with_error);
     return;
   }
-  grpc_chttp2_ping_queue* pq = &t->ping_queue;
-  grpc_closure_list_append(&pq->lists[GRPC_CHTTP2_PCL_INITIATE], on_initiate,
-                           absl::OkStatus());
-  grpc_closure_list_append(&pq->lists[GRPC_CHTTP2_PCL_NEXT], on_ack,
-                           absl::OkStatus());
+  t->ping_callbacks.OnPing(PingClosureWrapper(on_initiate),
+                           PingClosureWrapper(on_ack));
 }
 
 // Specialized form of send_ping_locked for keepalive ping. If there is already
 // a ping in progress, the keepalive ping would piggyback onto that ping,
 // instead of waiting for that ping to complete and then starting a new ping.
-static void send_keepalive_ping_locked(grpc_chttp2_transport* t) {
+static void send_keepalive_ping_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t) {
   if (!t->closed_with_error.ok()) {
-    t->combiner->Run(GRPC_CLOSURE_INIT(&t->start_keepalive_ping_locked,
-                                       start_keepalive_ping_locked, t, nullptr),
-                     t->closed_with_error);
     t->combiner->Run(
-        GRPC_CLOSURE_INIT(&t->finish_keepalive_ping_locked,
-                          finish_keepalive_ping_locked, t, nullptr),
+        grpc_core::InitTransportClosure<finish_keepalive_ping_locked>(
+            t->Ref(), &t->finish_keepalive_ping_locked),
         t->closed_with_error);
     return;
   }
-  grpc_chttp2_ping_queue* pq = &t->ping_queue;
-  if (!grpc_closure_list_empty(pq->lists[GRPC_CHTTP2_PCL_INFLIGHT])) {
-    // There is a ping in flight. Add yourself to the inflight closure list.
-    t->combiner->Run(GRPC_CLOSURE_INIT(&t->start_keepalive_ping_locked,
-                                       start_keepalive_ping_locked, t, nullptr),
-                     t->closed_with_error);
-    grpc_closure_list_append(
-        &pq->lists[GRPC_CHTTP2_PCL_INFLIGHT],
-        GRPC_CLOSURE_INIT(&t->finish_keepalive_ping_locked,
-                          finish_keepalive_ping, t, grpc_schedule_on_exec_ctx),
-        absl::OkStatus());
-    return;
-  }
-  grpc_closure_list_append(
-      &pq->lists[GRPC_CHTTP2_PCL_INITIATE],
-      GRPC_CLOSURE_INIT(&t->start_keepalive_ping_locked, start_keepalive_ping,
-                        t, grpc_schedule_on_exec_ctx),
-      absl::OkStatus());
-  grpc_closure_list_append(
-      &pq->lists[GRPC_CHTTP2_PCL_NEXT],
-      GRPC_CLOSURE_INIT(&t->finish_keepalive_ping_locked, finish_keepalive_ping,
-                        t, grpc_schedule_on_exec_ctx),
-      absl::OkStatus());
+  t->ping_callbacks.OnPingAck(
+      PingClosureWrapper(grpc_core::InitTransportClosure<finish_keepalive_ping>(
+          t->Ref(), &t->finish_keepalive_ping_locked)));
 }
 
-void grpc_chttp2_retry_initiate_ping(grpc_chttp2_transport* t) {
-  t->combiner->Run(GRPC_CLOSURE_INIT(&t->retry_initiate_ping_locked,
-                                     retry_initiate_ping_locked, t, nullptr),
-                   absl::OkStatus());
+void grpc_chttp2_retry_initiate_ping(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t) {
+  auto tp = t.get();
+  tp->combiner->Run(grpc_core::InitTransportClosure<retry_initiate_ping_locked>(
+                        std::move(t), &tp->retry_initiate_ping_locked),
+                    absl::OkStatus());
 }
 
-static void retry_initiate_ping_locked(void* tp,
-                                       GRPC_UNUSED grpc_error_handle error) {
+static void retry_initiate_ping_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    GRPC_UNUSED grpc_error_handle error) {
   GPR_DEBUG_ASSERT(error.ok());
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(tp);
-  GPR_ASSERT(t->ping_state.delayed_ping_timer_handle.has_value());
-  t->ping_state.delayed_ping_timer_handle.reset();
-  grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_RETRY_SEND_PING);
-  GRPC_CHTTP2_UNREF_TRANSPORT(t, "retry_initiate_ping_locked");
+  GPR_ASSERT(t->delayed_ping_timer_handle != TaskHandle::kInvalid);
+  t->delayed_ping_timer_handle = TaskHandle::kInvalid;
+  grpc_chttp2_initiate_write(t.get(),
+                             GRPC_CHTTP2_INITIATE_WRITE_RETRY_SEND_PING);
 }
 
 void grpc_chttp2_ack_ping(grpc_chttp2_transport* t, uint64_t id) {
-  grpc_chttp2_ping_queue* pq = &t->ping_queue;
-  if (pq->inflight_id != id) {
+  if (!t->ping_callbacks.AckPing(id, t->event_engine.get())) {
     gpr_log(GPR_DEBUG, "Unknown ping response from %s: %" PRIx64,
             std::string(t->peer_string.as_string_view()).c_str(), id);
     return;
   }
-  grpc_core::ExecCtx::RunList(DEBUG_LOCATION,
-                              &pq->lists[GRPC_CHTTP2_PCL_INFLIGHT]);
-  if (!grpc_closure_list_empty(pq->lists[GRPC_CHTTP2_PCL_NEXT])) {
+  if (t->ping_callbacks.ping_requested()) {
     grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_CONTINUE_PINGS);
   }
 }
 
+void grpc_chttp2_keepalive_timeout(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t) {
+  t->combiner->Run(
+      grpc_core::NewClosure([t](grpc_error_handle) {
+        gpr_log(GPR_INFO, "%s: Keepalive timeout. Closing transport.",
+                std::string(t->peer_string.as_string_view()).c_str());
+        send_goaway(
+            t.get(),
+            grpc_error_set_int(GRPC_ERROR_CREATE("keepalive_timeout"),
+                               grpc_core::StatusIntProperty::kHttp2Error,
+                               GRPC_HTTP2_ENHANCE_YOUR_CALM),
+            /*immediate_disconnect_hint=*/true);
+        close_transport_locked(
+            t.get(),
+            grpc_error_set_int(GRPC_ERROR_CREATE("keepalive timeout"),
+                               grpc_core::StatusIntProperty::kRpcStatus,
+                               GRPC_STATUS_UNAVAILABLE));
+      }),
+      absl::OkStatus());
+}
+
+void grpc_chttp2_ping_timeout(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t) {
+  t->combiner->Run(
+      grpc_core::NewClosure([t](grpc_error_handle) {
+        gpr_log(GPR_INFO, "%s: Ping timeout. Closing transport.",
+                std::string(t->peer_string.as_string_view()).c_str());
+        send_goaway(
+            t.get(),
+            grpc_error_set_int(GRPC_ERROR_CREATE("ping_timeout"),
+                               grpc_core::StatusIntProperty::kHttp2Error,
+                               GRPC_HTTP2_ENHANCE_YOUR_CALM),
+            /*immediate_disconnect_hint=*/true);
+        close_transport_locked(
+            t.get(),
+            grpc_error_set_int(GRPC_ERROR_CREATE("ping timeout"),
+                               grpc_core::StatusIntProperty::kRpcStatus,
+                               GRPC_STATUS_UNAVAILABLE));
+      }),
+      absl::OkStatus());
+}
+
+void grpc_chttp2_settings_timeout(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t) {
+  t->combiner->Run(
+      grpc_core::NewClosure([t](grpc_error_handle) {
+        gpr_log(GPR_INFO, "%s: Settings timeout. Closing transport.",
+                std::string(t->peer_string.as_string_view()).c_str());
+        send_goaway(
+            t.get(),
+            grpc_error_set_int(GRPC_ERROR_CREATE("settings_timeout"),
+                               grpc_core::StatusIntProperty::kHttp2Error,
+                               GRPC_HTTP2_SETTINGS_TIMEOUT),
+            /*immediate_disconnect_hint=*/true);
+        close_transport_locked(
+            t.get(),
+            grpc_error_set_int(GRPC_ERROR_CREATE("settings timeout"),
+                               grpc_core::StatusIntProperty::kRpcStatus,
+                               GRPC_STATUS_UNAVAILABLE));
+      }),
+      absl::OkStatus());
+}
+
 namespace {
 
 // Fire and forget (deletes itself on completion). Does a graceful shutdown by
@@ -1706,31 +1849,19 @@ class GracefulGoaway : public grpc_core::RefCounted<GracefulGoaway> {
  public:
   static void Start(grpc_chttp2_transport* t) { new GracefulGoaway(t); }
 
-  ~GracefulGoaway() override {
-    GRPC_CHTTP2_UNREF_TRANSPORT(t_, "graceful goaway");
-  }
-
  private:
   using TaskHandle = ::grpc_event_engine::experimental::EventEngine::TaskHandle;
 
-  explicit GracefulGoaway(grpc_chttp2_transport* t) : t_(t) {
+  explicit GracefulGoaway(grpc_chttp2_transport* t) : t_(t->Ref()) {
     t->sent_goaway_state = GRPC_CHTTP2_GRACEFUL_GOAWAY;
-    GRPC_CHTTP2_REF_TRANSPORT(t_, "graceful goaway");
     grpc_chttp2_goaway_append((1u << 31) - 1, 0, grpc_empty_slice(), &t->qbuf);
+    t->keepalive_timeout =
+        std::min(t->keepalive_timeout, grpc_core::Duration::Seconds(20));
+    t->ping_timeout =
+        std::min(t->ping_timeout, grpc_core::Duration::Seconds(20));
     send_ping_locked(
         t, nullptr, GRPC_CLOSURE_INIT(&on_ping_ack_, OnPingAck, this, nullptr));
     grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_GOAWAY_SENT);
-    timer_handle_ = t_->event_engine->RunAfter(
-        grpc_core::Duration::Seconds(20),
-        [self = Ref(DEBUG_LOCATION, "GoawayTimer")]() mutable {
-          grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
-          grpc_core::ExecCtx exec_ctx;
-          // The ref will be unreffed in the combiner.
-          auto* ptr = self.release();
-          ptr->t_->combiner->Run(
-              GRPC_CLOSURE_INIT(&ptr->on_timer_, OnTimerLocked, ptr, nullptr),
-              absl::OkStatus());
-        });
   }
 
   void MaybeSendFinalGoawayLocked() {
@@ -1743,7 +1874,7 @@ class GracefulGoaway : public grpc_core::RefCounted<GracefulGoaway> {
           gpr_log(GPR_INFO,
                   "transport:%p %s peer:%s Transport already shutting down. "
                   "Graceful GOAWAY abandoned.",
-                  t_, t_->is_client ? "CLIENT" : "SERVER",
+                  t_.get(), t_->is_client ? "CLIENT" : "SERVER",
                   std::string(t_->peer_string.as_string_view()).c_str()));
       return;
     }
@@ -1752,13 +1883,14 @@ class GracefulGoaway : public grpc_core::RefCounted<GracefulGoaway> {
         gpr_log(GPR_INFO,
                 "transport:%p %s peer:%s Graceful shutdown: Ping received. "
                 "Sending final GOAWAY with stream_id:%d",
-                t_, t_->is_client ? "CLIENT" : "SERVER",
+                t_.get(), t_->is_client ? "CLIENT" : "SERVER",
                 std::string(t_->peer_string.as_string_view()).c_str(),
                 t_->last_new_stream_id));
     t_->sent_goaway_state = GRPC_CHTTP2_FINAL_GOAWAY_SEND_SCHEDULED;
     grpc_chttp2_goaway_append(t_->last_new_stream_id, 0, grpc_empty_slice(),
                               &t_->qbuf);
-    grpc_chttp2_initiate_write(t_, GRPC_CHTTP2_INITIATE_WRITE_GOAWAY_SENT);
+    grpc_chttp2_initiate_write(t_.get(),
+                               GRPC_CHTTP2_INITIATE_WRITE_GOAWAY_SENT);
   }
 
   static void OnPingAck(void* arg, grpc_error_handle /* error */) {
@@ -1770,26 +1902,12 @@ class GracefulGoaway : public grpc_core::RefCounted<GracefulGoaway> {
 
   static void OnPingAckLocked(void* arg, grpc_error_handle /* error */) {
     auto* self = static_cast<GracefulGoaway*>(arg);
-    if (self->timer_handle_ != TaskHandle::kInvalid) {
-      self->t_->event_engine->Cancel(
-          std::exchange(self->timer_handle_, TaskHandle::kInvalid));
-    }
     self->MaybeSendFinalGoawayLocked();
     self->Unref();
   }
 
-  static void OnTimerLocked(void* arg, grpc_error_handle /* error */) {
-    auto* self = static_cast<GracefulGoaway*>(arg);
-    // Clearing the handle since the timer has fired and the handle is invalid.
-    self->timer_handle_ = TaskHandle::kInvalid;
-    self->MaybeSendFinalGoawayLocked();
-    self->Unref();
-  }
-
-  grpc_chttp2_transport* t_;
+  const grpc_core::RefCountedPtr<grpc_chttp2_transport> t_;
   grpc_closure on_ping_ack_;
-  TaskHandle timer_handle_ = TaskHandle::kInvalid;
-  grpc_closure on_timer_;
 };
 
 }  // namespace
@@ -1825,44 +1943,40 @@ static void send_goaway(grpc_chttp2_transport* t, grpc_error_handle error,
   grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_GOAWAY_SENT);
 }
 
-void grpc_chttp2_add_ping_strike(grpc_chttp2_transport* t) {
-  if (++t->ping_recv_state.ping_strikes > t->ping_policy.max_ping_strikes &&
-      t->ping_policy.max_ping_strikes != 0) {
-    send_goaway(t,
-                grpc_error_set_int(GRPC_ERROR_CREATE("too_many_pings"),
-                                   grpc_core::StatusIntProperty::kHttp2Error,
-                                   GRPC_HTTP2_ENHANCE_YOUR_CALM),
-                /*immediate_disconnect_hint=*/true);
-    // The transport will be closed after the write is done
-    close_transport_locked(
-        t, grpc_error_set_int(GRPC_ERROR_CREATE("Too many pings"),
-                              grpc_core::StatusIntProperty::kRpcStatus,
-                              GRPC_STATUS_UNAVAILABLE));
-  }
+void grpc_chttp2_exceeded_ping_strikes(grpc_chttp2_transport* t) {
+  send_goaway(t,
+              grpc_error_set_int(GRPC_ERROR_CREATE("too_many_pings"),
+                                 grpc_core::StatusIntProperty::kHttp2Error,
+                                 GRPC_HTTP2_ENHANCE_YOUR_CALM),
+              /*immediate_disconnect_hint=*/true);
+  // The transport will be closed after the write is done
+  close_transport_locked(
+      t, grpc_error_set_int(GRPC_ERROR_CREATE("Too many pings"),
+                            grpc_core::StatusIntProperty::kRpcStatus,
+                            GRPC_STATUS_UNAVAILABLE));
 }
 
 void grpc_chttp2_reset_ping_clock(grpc_chttp2_transport* t) {
   if (!t->is_client) {
-    t->ping_recv_state.last_ping_recv_time = grpc_core::Timestamp::InfPast();
-    t->ping_recv_state.ping_strikes = 0;
+    t->ping_abuse_policy.ResetPingStrikes();
   }
-  t->ping_state.pings_before_data_required =
-      t->ping_policy.max_pings_without_data;
+  t->ping_rate_policy.ResetPingsBeforeDataRequired();
 }
 
 static void perform_transport_op_locked(void* stream_op,
                                         grpc_error_handle /*error_ignored*/) {
   grpc_transport_op* op = static_cast<grpc_transport_op*>(stream_op);
-  grpc_chttp2_transport* t =
-      static_cast<grpc_chttp2_transport*>(op->handler_private.extra_arg);
+  grpc_core::RefCountedPtr<grpc_chttp2_transport> t(
+      static_cast<grpc_chttp2_transport*>(op->handler_private.extra_arg));
 
   if (!op->goaway_error.ok()) {
-    send_goaway(t, op->goaway_error, /*immediate_disconnect_hint=*/false);
+    send_goaway(t.get(), op->goaway_error, /*immediate_disconnect_hint=*/false);
   }
 
   if (op->set_accept_stream) {
     t->accept_stream_cb = op->set_accept_stream_fn;
     t->accept_stream_cb_user_data = op->set_accept_stream_user_data;
+    t->registered_method_matcher_cb = op->set_registered_method_matcher_fn;
   }
 
   if (op->bind_pollset) {
@@ -1874,8 +1988,9 @@ static void perform_transport_op_locked(void* stream_op,
   }
 
   if (op->send_ping.on_initiate != nullptr || op->send_ping.on_ack != nullptr) {
-    send_ping_locked(t, op->send_ping.on_initiate, op->send_ping.on_ack);
-    grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_APPLICATION_PING);
+    send_ping_locked(t.get(), op->send_ping.on_initiate, op->send_ping.on_ack);
+    grpc_chttp2_initiate_write(t.get(),
+                               GRPC_CHTTP2_INITIATE_WRITE_APPLICATION_PING);
   }
 
   if (op->start_connectivity_watch != nullptr) {
@@ -1887,27 +2002,24 @@ static void perform_transport_op_locked(void* stream_op,
   }
 
   if (!op->disconnect_with_error.ok()) {
-    send_goaway(t, op->disconnect_with_error,
+    send_goaway(t.get(), op->disconnect_with_error,
                 /*immediate_disconnect_hint=*/true);
-    close_transport_locked(t, op->disconnect_with_error);
+    close_transport_locked(t.get(), op->disconnect_with_error);
   }
 
   grpc_core::ExecCtx::Run(DEBUG_LOCATION, op->on_consumed, absl::OkStatus());
-
-  GRPC_CHTTP2_UNREF_TRANSPORT(t, "transport_op");
 }
 
-static void perform_transport_op(grpc_transport* gt, grpc_transport_op* op) {
-  grpc_chttp2_transport* t = reinterpret_cast<grpc_chttp2_transport*>(gt);
+void grpc_chttp2_transport::PerformOp(grpc_transport_op* op) {
   if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace)) {
-    gpr_log(GPR_INFO, "perform_transport_op[t=%p]: %s", t,
+    gpr_log(GPR_INFO, "perform_transport_op[t=%p]: %s", this,
             grpc_transport_op_string(op).c_str());
   }
-  op->handler_private.extra_arg = gt;
-  GRPC_CHTTP2_REF_TRANSPORT(t, "transport_op");
-  t->combiner->Run(GRPC_CLOSURE_INIT(&op->handler_private.closure,
-                                     perform_transport_op_locked, op, nullptr),
-                   absl::OkStatus());
+  op->handler_private.extra_arg = this;
+  Ref().release()->combiner->Run(
+      GRPC_CLOSURE_INIT(&op->handler_private.closure,
+                        perform_transport_op_locked, op, nullptr),
+      absl::OkStatus());
 }
 
 //
@@ -1933,6 +2045,10 @@ void grpc_chttp2_maybe_complete_recv_initial_metadata(grpc_chttp2_transport* t,
       *s->trailing_metadata_available = true;
       s->trailing_metadata_available = nullptr;
     }
+    if (t->registered_method_matcher_cb != nullptr) {
+      t->registered_method_matcher_cb(t->accept_stream_cb_user_data,
+                                      s->recv_initial_metadata);
+    }
     null_then_sched_closure(&s->recv_initial_metadata_ready);
   }
 }
@@ -2043,8 +2159,8 @@ void grpc_chttp2_maybe_complete_recv_trailing_metadata(grpc_chttp2_transport* t,
   }
 }
 
-static void remove_stream(grpc_chttp2_transport* t, uint32_t id,
-                          grpc_error_handle error) {
+static grpc_chttp2_transport::RemovedStreamHandle remove_stream(
+    grpc_chttp2_transport* t, uint32_t id, grpc_error_handle error) {
   grpc_chttp2_stream* s = t->stream_map.extract(id).mapped();
   GPR_DEBUG_ASSERT(s);
   if (t->incoming_stream == s) {
@@ -2067,29 +2183,74 @@ static void remove_stream(grpc_chttp2_transport* t, uint32_t id,
   grpc_chttp2_list_remove_stalled_by_transport(t, s);
 
   maybe_start_some_streams(t);
+
+  if (t->is_client) return grpc_chttp2_transport::RemovedStreamHandle();
+  return grpc_chttp2_transport::RemovedStreamHandle(t->Ref());
 }
 
+namespace grpc_core {
+namespace {
+
+Duration TarpitDuration(grpc_chttp2_transport* t) {
+  return Duration::Milliseconds(absl::LogUniform<int>(
+      absl::BitGen(), t->min_tarpit_duration_ms, t->max_tarpit_duration_ms));
+}
+
+template <typename F>
+void MaybeTarpit(grpc_chttp2_transport* t, bool tarpit, F fn) {
+  if (!tarpit || !t->allow_tarpit || t->is_client) {
+    fn(t);
+    return;
+  }
+  const auto duration = TarpitDuration(t);
+  t->event_engine->RunAfter(
+      duration, [t = t->Ref(), fn = std::move(fn)]() mutable {
+        ApplicationCallbackExecCtx app_exec_ctx;
+        ExecCtx exec_ctx;
+        t->combiner->Run(
+            NewClosure([t, fn = std::move(fn)](grpc_error_handle) mutable {
+              // TODO(ctiller): this can result in not sending RST_STREAMS if a
+              // request gets tarpit behind a transport close.
+              if (!t->closed_with_error.ok()) return;
+              fn(t.get());
+            }),
+            absl::OkStatus());
+      });
+}
+
+}  // namespace
+}  // namespace grpc_core
+
 void grpc_chttp2_cancel_stream(grpc_chttp2_transport* t, grpc_chttp2_stream* s,
-                               grpc_error_handle due_to_error) {
+                               grpc_error_handle due_to_error, bool tarpit) {
   if (!t->is_client && !s->sent_trailing_metadata &&
-      grpc_error_has_clear_grpc_status(due_to_error)) {
-    close_from_api(t, s, due_to_error);
+      grpc_error_has_clear_grpc_status(due_to_error) &&
+      !(s->read_closed && s->write_closed)) {
+    close_from_api(t, s, due_to_error, tarpit);
     return;
   }
 
+  if (!due_to_error.ok() && !s->seen_error) {
+    s->seen_error = true;
+  }
   if (!s->read_closed || !s->write_closed) {
     if (s->id != 0) {
       grpc_http2_error_code http_error;
       grpc_error_get_status(due_to_error, s->deadline, nullptr, nullptr,
                             &http_error, nullptr);
-      grpc_chttp2_add_rst_stream_to_next_write(
-          t, s->id, static_cast<uint32_t>(http_error), &s->stats.outgoing);
-      grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_RST_STREAM);
+      grpc_core::MaybeTarpit(
+          t, tarpit,
+          [id = s->id, http_error,
+           remove_stream_handle = grpc_chttp2_mark_stream_closed(
+               t, s, 1, 1, due_to_error)](grpc_chttp2_transport* t) {
+            grpc_chttp2_add_rst_stream_to_next_write(
+                t, id, static_cast<uint32_t>(http_error), nullptr);
+            grpc_chttp2_initiate_write(t,
+                                       GRPC_CHTTP2_INITIATE_WRITE_RST_STREAM);
+          });
+      return;
     }
   }
-  if (!due_to_error.ok() && !s->seen_error) {
-    s->seen_error = true;
-  }
   grpc_chttp2_mark_stream_closed(t, s, 1, 1, due_to_error);
 }
 
@@ -2182,9 +2343,10 @@ void grpc_chttp2_fail_pending_writes(grpc_chttp2_transport* t,
   flush_write_list(t, s, &s->on_flow_controlled_cbs, error);
 }
 
-void grpc_chttp2_mark_stream_closed(grpc_chttp2_transport* t,
-                                    grpc_chttp2_stream* s, int close_reads,
-                                    int close_writes, grpc_error_handle error) {
+grpc_chttp2_transport::RemovedStreamHandle grpc_chttp2_mark_stream_closed(
+    grpc_chttp2_transport* t, grpc_chttp2_stream* s, int close_reads,
+    int close_writes, grpc_error_handle error) {
+  grpc_chttp2_transport::RemovedStreamHandle rsh;
   if (grpc_http_trace.enabled()) {
     gpr_log(
         GPR_DEBUG, "MARK_STREAM_CLOSED: t=%p s=%p(id=%d) %s [%s]", t, s, s->id,
@@ -2200,7 +2362,7 @@ void grpc_chttp2_mark_stream_closed(grpc_chttp2_transport* t,
       grpc_chttp2_fake_status(t, s, overall_error);
     }
     grpc_chttp2_maybe_complete_recv_trailing_metadata(t, s);
-    return;
+    return rsh;
   }
   bool closed_read = false;
   bool became_closed = false;
@@ -2218,7 +2380,7 @@ void grpc_chttp2_mark_stream_closed(grpc_chttp2_transport* t,
     became_closed = true;
     grpc_error_handle overall_error = removal_error(error, s, "Stream removed");
     if (s->id != 0) {
-      remove_stream(t, s->id, overall_error);
+      rsh = remove_stream(t, s->id, overall_error);
     } else {
       // Purge streams waiting on concurrency still waiting for id assignment
       grpc_chttp2_list_remove_waiting_for_concurrency(t, s);
@@ -2242,17 +2404,11 @@ void grpc_chttp2_mark_stream_closed(grpc_chttp2_transport* t,
     grpc_chttp2_maybe_complete_recv_trailing_metadata(t, s);
     GRPC_CHTTP2_STREAM_UNREF(s, "chttp2");
   }
+  return rsh;
 }
 
 static void close_from_api(grpc_chttp2_transport* t, grpc_chttp2_stream* s,
-                           grpc_error_handle error) {
-  grpc_slice hdr;
-  grpc_slice status_hdr;
-  grpc_slice http_status_hdr;
-  grpc_slice content_type_hdr;
-  grpc_slice message_pfx;
-  uint8_t* p;
-  uint32_t len = 0;
+                           grpc_error_handle error, bool tarpit) {
   grpc_status_code grpc_status;
   std::string message;
   grpc_error_get_status(error, s->deadline, &grpc_status, &message, nullptr,
@@ -2260,147 +2416,167 @@ static void close_from_api(grpc_chttp2_transport* t, grpc_chttp2_stream* s,
 
   GPR_ASSERT(grpc_status >= 0 && (int)grpc_status < 100);
 
-  // Hand roll a header block.
-  //   This is unnecessarily ugly - at some point we should find a more
-  //   elegant solution.
-  //   It's complicated by the fact that our send machinery would be dead by
-  //   the time we got around to sending this, so instead we ignore HPACK
-  //   compression and just write the uncompressed bytes onto the wire.
-  if (!s->sent_initial_metadata) {
-    http_status_hdr = GRPC_SLICE_MALLOC(13);
-    p = GRPC_SLICE_START_PTR(http_status_hdr);
-    *p++ = 0x00;
-    *p++ = 7;
-    *p++ = ':';
-    *p++ = 's';
-    *p++ = 't';
-    *p++ = 'a';
-    *p++ = 't';
-    *p++ = 'u';
-    *p++ = 's';
-    *p++ = 3;
-    *p++ = '2';
-    *p++ = '0';
-    *p++ = '0';
-    GPR_ASSERT(p == GRPC_SLICE_END_PTR(http_status_hdr));
-    len += static_cast<uint32_t> GRPC_SLICE_LENGTH(http_status_hdr);
-
-    content_type_hdr = GRPC_SLICE_MALLOC(31);
-    p = GRPC_SLICE_START_PTR(content_type_hdr);
-    *p++ = 0x00;
-    *p++ = 12;
-    *p++ = 'c';
-    *p++ = 'o';
-    *p++ = 'n';
-    *p++ = 't';
-    *p++ = 'e';
-    *p++ = 'n';
-    *p++ = 't';
-    *p++ = '-';
-    *p++ = 't';
-    *p++ = 'y';
-    *p++ = 'p';
-    *p++ = 'e';
-    *p++ = 16;
-    *p++ = 'a';
-    *p++ = 'p';
-    *p++ = 'p';
-    *p++ = 'l';
-    *p++ = 'i';
-    *p++ = 'c';
-    *p++ = 'a';
-    *p++ = 't';
-    *p++ = 'i';
-    *p++ = 'o';
-    *p++ = 'n';
-    *p++ = '/';
-    *p++ = 'g';
-    *p++ = 'r';
-    *p++ = 'p';
-    *p++ = 'c';
-    GPR_ASSERT(p == GRPC_SLICE_END_PTR(content_type_hdr));
-    len += static_cast<uint32_t> GRPC_SLICE_LENGTH(content_type_hdr);
-  }
-
-  status_hdr = GRPC_SLICE_MALLOC(15 + (grpc_status >= 10));
-  p = GRPC_SLICE_START_PTR(status_hdr);
-  *p++ = 0x00;  // literal header, not indexed
-  *p++ = 11;    // len(grpc-status)
-  *p++ = 'g';
-  *p++ = 'r';
-  *p++ = 'p';
-  *p++ = 'c';
-  *p++ = '-';
-  *p++ = 's';
-  *p++ = 't';
-  *p++ = 'a';
-  *p++ = 't';
-  *p++ = 'u';
-  *p++ = 's';
-  if (grpc_status < 10) {
-    *p++ = 1;
-    *p++ = static_cast<uint8_t>('0' + grpc_status);
-  } else {
-    *p++ = 2;
-    *p++ = static_cast<uint8_t>('0' + (grpc_status / 10));
-    *p++ = static_cast<uint8_t>('0' + (grpc_status % 10));
-  }
-  GPR_ASSERT(p == GRPC_SLICE_END_PTR(status_hdr));
-  len += static_cast<uint32_t> GRPC_SLICE_LENGTH(status_hdr);
-
-  size_t msg_len = message.length();
-  GPR_ASSERT(msg_len <= UINT32_MAX);
-  grpc_core::VarintWriter<1> msg_len_writer(static_cast<uint32_t>(msg_len));
-  message_pfx = GRPC_SLICE_MALLOC(14 + msg_len_writer.length());
-  p = GRPC_SLICE_START_PTR(message_pfx);
-  *p++ = 0x00;  // literal header, not indexed
-  *p++ = 12;    // len(grpc-message)
-  *p++ = 'g';
-  *p++ = 'r';
-  *p++ = 'p';
-  *p++ = 'c';
-  *p++ = '-';
-  *p++ = 'm';
-  *p++ = 'e';
-  *p++ = 's';
-  *p++ = 's';
-  *p++ = 'a';
-  *p++ = 'g';
-  *p++ = 'e';
-  msg_len_writer.Write(0, p);
-  p += msg_len_writer.length();
-  GPR_ASSERT(p == GRPC_SLICE_END_PTR(message_pfx));
-  len += static_cast<uint32_t> GRPC_SLICE_LENGTH(message_pfx);
-  len += static_cast<uint32_t>(msg_len);
-
-  hdr = GRPC_SLICE_MALLOC(9);
-  p = GRPC_SLICE_START_PTR(hdr);
-  *p++ = static_cast<uint8_t>(len >> 16);
-  *p++ = static_cast<uint8_t>(len >> 8);
-  *p++ = static_cast<uint8_t>(len);
-  *p++ = GRPC_CHTTP2_FRAME_HEADER;
-  *p++ = GRPC_CHTTP2_DATA_FLAG_END_STREAM | GRPC_CHTTP2_DATA_FLAG_END_HEADERS;
-  *p++ = static_cast<uint8_t>(s->id >> 24);
-  *p++ = static_cast<uint8_t>(s->id >> 16);
-  *p++ = static_cast<uint8_t>(s->id >> 8);
-  *p++ = static_cast<uint8_t>(s->id);
-  GPR_ASSERT(p == GRPC_SLICE_END_PTR(hdr));
-
-  grpc_slice_buffer_add(&t->qbuf, hdr);
-  if (!s->sent_initial_metadata) {
-    grpc_slice_buffer_add(&t->qbuf, http_status_hdr);
-    grpc_slice_buffer_add(&t->qbuf, content_type_hdr);
-  }
-  grpc_slice_buffer_add(&t->qbuf, status_hdr);
-  grpc_slice_buffer_add(&t->qbuf, message_pfx);
-  grpc_slice_buffer_add(&t->qbuf,
-                        grpc_slice_from_cpp_string(std::move(message)));
-  grpc_chttp2_reset_ping_clock(t);
-  grpc_chttp2_add_rst_stream_to_next_write(t, s->id, GRPC_HTTP2_NO_ERROR,
-                                           &s->stats.outgoing);
-
-  grpc_chttp2_mark_stream_closed(t, s, 1, 1, error);
-  grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_CLOSE_FROM_API);
+  auto remove_stream_handle = grpc_chttp2_mark_stream_closed(t, s, 1, 1, error);
+  grpc_core::MaybeTarpit(
+      t, tarpit,
+      [error = std::move(error),
+       sent_initial_metadata = s->sent_initial_metadata, id = s->id,
+       grpc_status, message = std::move(message),
+       remove_stream_handle =
+           std::move(remove_stream_handle)](grpc_chttp2_transport* t) mutable {
+        grpc_slice hdr;
+        grpc_slice status_hdr;
+        grpc_slice http_status_hdr;
+        grpc_slice content_type_hdr;
+        grpc_slice message_pfx;
+        uint8_t* p;
+        uint32_t len = 0;
+
+        // Hand roll a header block.
+        //   This is unnecessarily ugly - at some point we should find a more
+        //   elegant solution.
+        //   It's complicated by the fact that our send machinery would be dead
+        //   by the time we got around to sending this, so instead we ignore
+        //   HPACK compression and just write the uncompressed bytes onto the
+        //   wire.
+        if (!sent_initial_metadata) {
+          http_status_hdr = GRPC_SLICE_MALLOC(13);
+          p = GRPC_SLICE_START_PTR(http_status_hdr);
+          *p++ = 0x00;
+          *p++ = 7;
+          *p++ = ':';
+          *p++ = 's';
+          *p++ = 't';
+          *p++ = 'a';
+          *p++ = 't';
+          *p++ = 'u';
+          *p++ = 's';
+          *p++ = 3;
+          *p++ = '2';
+          *p++ = '0';
+          *p++ = '0';
+          GPR_ASSERT(p == GRPC_SLICE_END_PTR(http_status_hdr));
+          len += static_cast<uint32_t> GRPC_SLICE_LENGTH(http_status_hdr);
+
+          content_type_hdr = GRPC_SLICE_MALLOC(31);
+          p = GRPC_SLICE_START_PTR(content_type_hdr);
+          *p++ = 0x00;
+          *p++ = 12;
+          *p++ = 'c';
+          *p++ = 'o';
+          *p++ = 'n';
+          *p++ = 't';
+          *p++ = 'e';
+          *p++ = 'n';
+          *p++ = 't';
+          *p++ = '-';
+          *p++ = 't';
+          *p++ = 'y';
+          *p++ = 'p';
+          *p++ = 'e';
+          *p++ = 16;
+          *p++ = 'a';
+          *p++ = 'p';
+          *p++ = 'p';
+          *p++ = 'l';
+          *p++ = 'i';
+          *p++ = 'c';
+          *p++ = 'a';
+          *p++ = 't';
+          *p++ = 'i';
+          *p++ = 'o';
+          *p++ = 'n';
+          *p++ = '/';
+          *p++ = 'g';
+          *p++ = 'r';
+          *p++ = 'p';
+          *p++ = 'c';
+          GPR_ASSERT(p == GRPC_SLICE_END_PTR(content_type_hdr));
+          len += static_cast<uint32_t> GRPC_SLICE_LENGTH(content_type_hdr);
+        }
+
+        status_hdr = GRPC_SLICE_MALLOC(15 + (grpc_status >= 10));
+        p = GRPC_SLICE_START_PTR(status_hdr);
+        *p++ = 0x00;  // literal header, not indexed
+        *p++ = 11;    // len(grpc-status)
+        *p++ = 'g';
+        *p++ = 'r';
+        *p++ = 'p';
+        *p++ = 'c';
+        *p++ = '-';
+        *p++ = 's';
+        *p++ = 't';
+        *p++ = 'a';
+        *p++ = 't';
+        *p++ = 'u';
+        *p++ = 's';
+        if (grpc_status < 10) {
+          *p++ = 1;
+          *p++ = static_cast<uint8_t>('0' + grpc_status);
+        } else {
+          *p++ = 2;
+          *p++ = static_cast<uint8_t>('0' + (grpc_status / 10));
+          *p++ = static_cast<uint8_t>('0' + (grpc_status % 10));
+        }
+        GPR_ASSERT(p == GRPC_SLICE_END_PTR(status_hdr));
+        len += static_cast<uint32_t> GRPC_SLICE_LENGTH(status_hdr);
+
+        size_t msg_len = message.length();
+        GPR_ASSERT(msg_len <= UINT32_MAX);
+        grpc_core::VarintWriter<1> msg_len_writer(
+            static_cast<uint32_t>(msg_len));
+        message_pfx = GRPC_SLICE_MALLOC(14 + msg_len_writer.length());
+        p = GRPC_SLICE_START_PTR(message_pfx);
+        *p++ = 0x00;  // literal header, not indexed
+        *p++ = 12;    // len(grpc-message)
+        *p++ = 'g';
+        *p++ = 'r';
+        *p++ = 'p';
+        *p++ = 'c';
+        *p++ = '-';
+        *p++ = 'm';
+        *p++ = 'e';
+        *p++ = 's';
+        *p++ = 's';
+        *p++ = 'a';
+        *p++ = 'g';
+        *p++ = 'e';
+        msg_len_writer.Write(0, p);
+        p += msg_len_writer.length();
+        GPR_ASSERT(p == GRPC_SLICE_END_PTR(message_pfx));
+        len += static_cast<uint32_t> GRPC_SLICE_LENGTH(message_pfx);
+        len += static_cast<uint32_t>(msg_len);
+
+        hdr = GRPC_SLICE_MALLOC(9);
+        p = GRPC_SLICE_START_PTR(hdr);
+        *p++ = static_cast<uint8_t>(len >> 16);
+        *p++ = static_cast<uint8_t>(len >> 8);
+        *p++ = static_cast<uint8_t>(len);
+        *p++ = GRPC_CHTTP2_FRAME_HEADER;
+        *p++ = GRPC_CHTTP2_DATA_FLAG_END_STREAM |
+               GRPC_CHTTP2_DATA_FLAG_END_HEADERS;
+        *p++ = static_cast<uint8_t>(id >> 24);
+        *p++ = static_cast<uint8_t>(id >> 16);
+        *p++ = static_cast<uint8_t>(id >> 8);
+        *p++ = static_cast<uint8_t>(id);
+        GPR_ASSERT(p == GRPC_SLICE_END_PTR(hdr));
+
+        grpc_slice_buffer_add(&t->qbuf, hdr);
+        if (!sent_initial_metadata) {
+          grpc_slice_buffer_add(&t->qbuf, http_status_hdr);
+          grpc_slice_buffer_add(&t->qbuf, content_type_hdr);
+        }
+        grpc_slice_buffer_add(&t->qbuf, status_hdr);
+        grpc_slice_buffer_add(&t->qbuf, message_pfx);
+        grpc_slice_buffer_add(&t->qbuf,
+                              grpc_slice_from_cpp_string(std::move(message)));
+        grpc_chttp2_reset_ping_clock(t);
+        grpc_chttp2_add_rst_stream_to_next_write(t, id, GRPC_HTTP2_NO_ERROR,
+                                                 nullptr);
+
+        grpc_chttp2_initiate_write(t,
+                                   GRPC_CHTTP2_INITIATE_WRITE_CLOSE_FROM_API);
+      });
 }
 
 static void end_all_the_calls(grpc_chttp2_transport* t,
@@ -2413,13 +2589,13 @@ static void end_all_the_calls(grpc_chttp2_transport* t,
     error = grpc_error_set_int(error, grpc_core::StatusIntProperty::kRpcStatus,
                                GRPC_STATUS_UNAVAILABLE);
   }
-  cancel_unstarted_streams(t, error);
+  cancel_unstarted_streams(t, error, false);
   std::vector<grpc_chttp2_stream*> to_cancel;
   for (auto id_stream : t->stream_map) {
     to_cancel.push_back(id_stream.second);
   }
   for (auto s : to_cancel) {
-    grpc_chttp2_cancel_stream(t, s, error);
+    grpc_chttp2_cancel_stream(t, s, error, false);
   }
 }
 
@@ -2456,21 +2632,19 @@ void grpc_chttp2_act_on_flowctl_action(
               GRPC_CHTTP2_INITIATE_WRITE_TRANSPORT_FLOW_CONTROL, []() {});
   WithUrgency(t, action.send_initial_window_update(),
               GRPC_CHTTP2_INITIATE_WRITE_SEND_SETTINGS, [t, &action]() {
-                queue_setting_update(t,
-                                     GRPC_CHTTP2_SETTINGS_INITIAL_WINDOW_SIZE,
-                                     action.initial_window_size());
-              });
-  WithUrgency(t, action.send_max_frame_size_update(),
-              GRPC_CHTTP2_INITIATE_WRITE_SEND_SETTINGS, [t, &action]() {
-                queue_setting_update(t, GRPC_CHTTP2_SETTINGS_MAX_FRAME_SIZE,
-                                     action.max_frame_size());
+                t->settings.mutable_local().SetInitialWindowSize(
+                    action.initial_window_size());
               });
+  WithUrgency(
+      t, action.send_max_frame_size_update(),
+      GRPC_CHTTP2_INITIATE_WRITE_SEND_SETTINGS, [t, &action]() {
+        t->settings.mutable_local().SetMaxFrameSize(action.max_frame_size());
+      });
   if (t->enable_preferred_rx_crypto_frame_advertisement) {
     WithUrgency(
         t, action.preferred_rx_crypto_frame_size_update(),
         GRPC_CHTTP2_INITIATE_WRITE_SEND_SETTINGS, [t, &action]() {
-          queue_setting_update(
-              t, GRPC_CHTTP2_SETTINGS_GRPC_PREFERRED_RECEIVE_CRYPTO_FRAME_SIZE,
+          t->settings.mutable_local().SetPreferredReceiveCryptoMessageSize(
               action.preferred_rx_crypto_frame_size());
         });
   }
@@ -2504,31 +2678,45 @@ static grpc_error_handle try_http_parsing(grpc_chttp2_transport* t) {
   return error;
 }
 
-static void read_action(void* tp, grpc_error_handle error) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(tp);
-  t->combiner->Run(
-      GRPC_CLOSURE_INIT(&t->read_action_locked, read_action_locked, t, nullptr),
-      error);
+static void read_action(grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+                        grpc_error_handle error) {
+  auto* tp = t.get();
+  tp->combiner->Run(grpc_core::InitTransportClosure<read_action_locked>(
+                        std::move(t), &tp->read_action_locked),
+                    error);
 }
 
-static void read_action_locked(void* tp, grpc_error_handle error) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(tp);
-
-  grpc_error_handle err = error;
-  if (!err.ok()) {
-    err = grpc_error_set_int(
-        GRPC_ERROR_CREATE_REFERENCING("Endpoint read failed", &err, 1),
-        grpc_core::StatusIntProperty::kOccurredDuringWrite, t->write_state);
-  }
-  std::swap(err, error);
+static void read_action_parse_loop_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    grpc_error_handle error) {
   if (t->closed_with_error.ok()) {
-    size_t i = 0;
     grpc_error_handle errors[3] = {error, absl::OkStatus(), absl::OkStatus()};
-    for (; i < t->read_buffer.count && errors[1] == absl::OkStatus(); i++) {
-      errors[1] = grpc_chttp2_perform_read(t, t->read_buffer.slices[i]);
+    size_t requests_started = 0;
+    for (size_t i = 0;
+         i < t->read_buffer.count && errors[1] == absl::OkStatus(); i++) {
+      auto r = grpc_chttp2_perform_read(t.get(), t->read_buffer.slices[i],
+                                        requests_started);
+      if (auto* partial_read_size = absl::get_if<size_t>(&r)) {
+        for (size_t j = 0; j < i; j++) {
+          grpc_core::CSliceUnref(grpc_slice_buffer_take_first(&t->read_buffer));
+        }
+        grpc_slice_buffer_sub_first(
+            &t->read_buffer, *partial_read_size,
+            GRPC_SLICE_LENGTH(t->read_buffer.slices[0]));
+        t->combiner->ForceOffload();
+        auto* tp = t.get();
+        tp->combiner->Run(
+            grpc_core::InitTransportClosure<read_action_parse_loop_locked>(
+                std::move(t), &tp->read_action_locked),
+            std::move(errors[0]));
+        // Early return: we queued to retry later.
+        return;
+      } else {
+        errors[1] = std::move(absl::get<absl::Status>(r));
+      }
     }
     if (errors[1] != absl::OkStatus()) {
-      errors[2] = try_http_parsing(t);
+      errors[2] = try_http_parsing(t.get());
       error = GRPC_ERROR_CREATE_REFERENCING("Failed parsing HTTP/2", errors,
                                             GPR_ARRAY_SIZE(errors));
     }
@@ -2536,10 +2724,11 @@ static void read_action_locked(void* tp, grpc_error_handle error) {
     if (t->initial_window_update != 0) {
       if (t->initial_window_update > 0) {
         grpc_chttp2_stream* s;
-        while (grpc_chttp2_list_pop_stalled_by_stream(t, &s)) {
-          grpc_chttp2_mark_stream_writable(t, s);
+        while (grpc_chttp2_list_pop_stalled_by_stream(t.get(), &s)) {
+          grpc_chttp2_mark_stream_writable(t.get(), s);
           grpc_chttp2_initiate_write(
-              t, GRPC_CHTTP2_INITIATE_WRITE_FLOW_CONTROL_UNSTALLED_BY_SETTING);
+              t.get(),
+              GRPC_CHTTP2_INITIATE_WRITE_FLOW_CONTROL_UNSTALLED_BY_SETTING);
         }
       }
       t->initial_window_update = 0;
@@ -2558,13 +2747,12 @@ static void read_action_locked(void* tp, grpc_error_handle error) {
       error = grpc_error_add_child(error, t->goaway_error);
     }
 
-    close_transport_locked(t, error);
-    t->endpoint_reading = 0;
+    close_transport_locked(t.get(), error);
   } else if (t->closed_with_error.ok()) {
     keep_reading = true;
     // Since we have read a byte, reset the keepalive timer
     if (t->keepalive_state == GRPC_CHTTP2_KEEPALIVE_STATE_WAITING) {
-      maybe_reset_keepalive_ping_timer_locked(t);
+      maybe_reset_keepalive_ping_timer_locked(t.get());
     }
   }
   grpc_slice_buffer_reset_and_unref(&t->read_buffer);
@@ -2576,45 +2764,73 @@ static void read_action_locked(void* tp, grpc_error_handle error) {
           gpr_log(GPR_INFO,
                   "transport %p : Pausing reading due to too "
                   "many unwritten SETTINGS ACK and RST_STREAM frames",
-                  t));
+                  t.get()));
     } else {
-      continue_read_action_locked(t);
+      continue_read_action_locked(std::move(t));
     }
-  } else {
-    GRPC_CHTTP2_UNREF_TRANSPORT(t, "reading_action");
   }
 }
 
-static void continue_read_action_locked(grpc_chttp2_transport* t) {
+static void read_action_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    grpc_error_handle error) {
+  // got an incoming read, cancel any pending keepalive timers
+  t->keepalive_incoming_data_wanted = false;
+  if (t->keepalive_ping_timeout_handle != TaskHandle::kInvalid) {
+    if (GRPC_TRACE_FLAG_ENABLED(grpc_ping_trace) ||
+        GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace)) {
+      gpr_log(GPR_INFO,
+              "%s[%p]: Clear keepalive timer because data was received",
+              t->is_client ? "CLIENT" : "SERVER", t.get());
+    }
+    t->event_engine->Cancel(
+        std::exchange(t->keepalive_ping_timeout_handle, TaskHandle::kInvalid));
+  }
+  grpc_error_handle err = error;
+  if (!err.ok()) {
+    err = grpc_error_set_int(
+        GRPC_ERROR_CREATE_REFERENCING("Endpoint read failed", &err, 1),
+        grpc_core::StatusIntProperty::kOccurredDuringWrite, t->write_state);
+  }
+  std::swap(err, error);
+  read_action_parse_loop_locked(std::move(t), std::move(err));
+}
+
+static void continue_read_action_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t) {
   const bool urgent = !t->goaway_error.ok();
-  GRPC_CLOSURE_INIT(&t->read_action_locked, read_action, t,
-                    grpc_schedule_on_exec_ctx);
-  grpc_endpoint_read(t->ep, &t->read_buffer, &t->read_action_locked, urgent,
-                     grpc_chttp2_min_read_progress_size(t));
+  auto* tp = t.get();
+  grpc_endpoint_read(tp->ep, &tp->read_buffer,
+                     grpc_core::InitTransportClosure<read_action>(
+                         std::move(t), &tp->read_action_locked),
+                     urgent, grpc_chttp2_min_read_progress_size(tp));
 }
 
 // t is reffed prior to calling the first time, and once the callback chain
 // that kicks off finishes, it's unreffed
-void schedule_bdp_ping_locked(grpc_chttp2_transport* t) {
-  t->flow_control.bdp_estimator()->SchedulePing();
-  send_ping_locked(
-      t,
-      GRPC_CLOSURE_INIT(&t->start_bdp_ping_locked, start_bdp_ping, t,
-                        grpc_schedule_on_exec_ctx),
-      GRPC_CLOSURE_INIT(&t->finish_bdp_ping_locked, finish_bdp_ping, t,
-                        grpc_schedule_on_exec_ctx));
-  grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_BDP_PING);
-}
-
-static void start_bdp_ping(void* tp, grpc_error_handle error) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(tp);
-  t->combiner->Run(GRPC_CLOSURE_INIT(&t->start_bdp_ping_locked,
-                                     start_bdp_ping_locked, t, nullptr),
-                   error);
-}
-
-static void start_bdp_ping_locked(void* tp, grpc_error_handle error) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(tp);
+void schedule_bdp_ping_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t) {
+  auto* tp = t.get();
+  tp->flow_control.bdp_estimator()->SchedulePing();
+  send_ping_locked(tp,
+                   grpc_core::InitTransportClosure<start_bdp_ping>(
+                       tp->Ref(), &tp->start_bdp_ping_locked),
+                   grpc_core::InitTransportClosure<finish_bdp_ping>(
+                       std::move(t), &tp->finish_bdp_ping_locked));
+  grpc_chttp2_initiate_write(tp, GRPC_CHTTP2_INITIATE_WRITE_BDP_PING);
+}
+
+static void start_bdp_ping(grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+                           grpc_error_handle error) {
+  grpc_chttp2_transport* tp = t.get();
+  tp->combiner->Run(grpc_core::InitTransportClosure<start_bdp_ping_locked>(
+                        std::move(t), &tp->start_bdp_ping_locked),
+                    error);
+}
+
+static void start_bdp_ping_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    grpc_error_handle error) {
   if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace)) {
     gpr_log(GPR_INFO, "%s: Start BDP ping err=%s",
             std::string(t->peer_string.as_string_view()).c_str(),
@@ -2625,71 +2841,69 @@ static void start_bdp_ping_locked(void* tp, grpc_error_handle error) {
   }
   // Reset the keepalive ping timer
   if (t->keepalive_state == GRPC_CHTTP2_KEEPALIVE_STATE_WAITING) {
-    maybe_reset_keepalive_ping_timer_locked(t);
+    maybe_reset_keepalive_ping_timer_locked(t.get());
   }
   t->flow_control.bdp_estimator()->StartPing();
   t->bdp_ping_started = true;
 }
 
-static void finish_bdp_ping(void* tp, grpc_error_handle error) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(tp);
-  t->combiner->Run(GRPC_CLOSURE_INIT(&t->finish_bdp_ping_locked,
-                                     finish_bdp_ping_locked, t, nullptr),
-                   error);
+static void finish_bdp_ping(grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+                            grpc_error_handle error) {
+  grpc_chttp2_transport* tp = t.get();
+  tp->combiner->Run(grpc_core::InitTransportClosure<finish_bdp_ping_locked>(
+                        std::move(t), &tp->finish_bdp_ping_locked),
+                    error);
 }
 
-static void finish_bdp_ping_locked(void* tp, grpc_error_handle error) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(tp);
+static void finish_bdp_ping_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    grpc_error_handle error) {
   if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace)) {
     gpr_log(GPR_INFO, "%s: Complete BDP ping err=%s",
             std::string(t->peer_string.as_string_view()).c_str(),
             grpc_core::StatusToString(error).c_str());
   }
   if (!error.ok() || !t->closed_with_error.ok()) {
-    GRPC_CHTTP2_UNREF_TRANSPORT(t, "bdp_ping");
     return;
   }
   if (!t->bdp_ping_started) {
     // start_bdp_ping_locked has not been run yet. Schedule
     // finish_bdp_ping_locked to be run later.
-    t->combiner->Run(GRPC_CLOSURE_INIT(&t->finish_bdp_ping_locked,
-                                       finish_bdp_ping_locked, t, nullptr),
-                     error);
+    finish_bdp_ping(std::move(t), std::move(error));
     return;
   }
   t->bdp_ping_started = false;
   grpc_core::Timestamp next_ping =
       t->flow_control.bdp_estimator()->CompletePing();
-  grpc_chttp2_act_on_flowctl_action(t->flow_control.PeriodicUpdate(), t,
+  grpc_chttp2_act_on_flowctl_action(t->flow_control.PeriodicUpdate(), t.get(),
                                     nullptr);
-  GPR_ASSERT(!t->next_bdp_ping_timer_handle.has_value());
+  GPR_ASSERT(t->next_bdp_ping_timer_handle == TaskHandle::kInvalid);
   t->next_bdp_ping_timer_handle =
       t->event_engine->RunAfter(next_ping - grpc_core::Timestamp::Now(), [t] {
         grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
         grpc_core::ExecCtx exec_ctx;
-        next_bdp_ping_timer_expired(t);
+        next_bdp_ping_timer_expired(t.get());
       });
 }
 
 static void next_bdp_ping_timer_expired(grpc_chttp2_transport* t) {
   t->combiner->Run(
-      GRPC_CLOSURE_INIT(&t->next_bdp_ping_timer_expired_locked,
-                        next_bdp_ping_timer_expired_locked, t, nullptr),
+      grpc_core::InitTransportClosure<next_bdp_ping_timer_expired_locked>(
+          t->Ref(), &t->next_bdp_ping_timer_expired_locked),
       absl::OkStatus());
 }
 
 static void next_bdp_ping_timer_expired_locked(
-    void* tp, GRPC_UNUSED grpc_error_handle error) {
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    GRPC_UNUSED grpc_error_handle error) {
   GPR_DEBUG_ASSERT(error.ok());
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(tp);
-  GPR_ASSERT(t->next_bdp_ping_timer_handle.has_value());
-  t->next_bdp_ping_timer_handle.reset();
+  GPR_ASSERT(t->next_bdp_ping_timer_handle != TaskHandle::kInvalid);
+  t->next_bdp_ping_timer_handle = TaskHandle::kInvalid;
   if (t->flow_control.bdp_estimator()->accumulator() == 0) {
     // Block the bdp ping till we receive more data.
     t->bdp_ping_blocked = true;
-    GRPC_CHTTP2_UNREF_TRANSPORT(t, "bdp_ping");
   } else {
-    schedule_bdp_ping_locked(t);
+    schedule_bdp_ping_locked(std::move(t));
   }
 }
 
@@ -2736,45 +2950,34 @@ void grpc_chttp2_config_default_keepalive_args(
         keepalive_permit_without_calls;
   }
 
-  g_default_max_ping_strikes =
-      std::max(0, channel_args.GetInt(GRPC_ARG_HTTP2_MAX_PING_STRIKES)
-                      .value_or(g_default_max_ping_strikes));
-
-  g_default_max_pings_without_data =
-      std::max(0, channel_args.GetInt(GRPC_ARG_HTTP2_MAX_PINGS_WITHOUT_DATA)
-                      .value_or(g_default_max_pings_without_data));
-
-  g_default_min_recv_ping_interval_without_data =
-      std::max(grpc_core::Duration::Zero(),
-               channel_args
-                   .GetDurationFromIntMillis(
-                       GRPC_ARG_HTTP2_MIN_RECV_PING_INTERVAL_WITHOUT_DATA_MS)
-                   .value_or(g_default_min_recv_ping_interval_without_data));
+  grpc_core::Chttp2PingAbusePolicy::SetDefaults(channel_args);
+  grpc_core::Chttp2PingRatePolicy::SetDefaults(channel_args);
 }
 
-static void init_keepalive_ping(grpc_chttp2_transport* t) {
-  t->combiner->Run(GRPC_CLOSURE_INIT(&t->init_keepalive_ping_locked,
-                                     init_keepalive_ping_locked, t, nullptr),
-                   absl::OkStatus());
+static void init_keepalive_ping(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t) {
+  auto* tp = t.get();
+  tp->combiner->Run(grpc_core::InitTransportClosure<init_keepalive_ping_locked>(
+                        std::move(t), &tp->init_keepalive_ping_locked),
+                    absl::OkStatus());
 }
 
-static void init_keepalive_ping_locked(void* arg,
-                                       GRPC_UNUSED grpc_error_handle error) {
+static void init_keepalive_ping_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    GRPC_UNUSED grpc_error_handle error) {
   GPR_DEBUG_ASSERT(error.ok());
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(arg);
   GPR_ASSERT(t->keepalive_state == GRPC_CHTTP2_KEEPALIVE_STATE_WAITING);
-  GPR_ASSERT(t->keepalive_ping_timer_handle.has_value());
-  t->keepalive_ping_timer_handle.reset();
+  GPR_ASSERT(t->keepalive_ping_timer_handle != TaskHandle::kInvalid);
+  t->keepalive_ping_timer_handle = TaskHandle::kInvalid;
   if (t->destroying || !t->closed_with_error.ok()) {
     t->keepalive_state = GRPC_CHTTP2_KEEPALIVE_STATE_DYING;
   } else {
     if (t->keepalive_permit_without_calls || !t->stream_map.empty()) {
       t->keepalive_state = GRPC_CHTTP2_KEEPALIVE_STATE_PINGING;
-      GRPC_CHTTP2_REF_TRANSPORT(t, "keepalive ping end");
       send_keepalive_ping_locked(t);
-      grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_KEEPALIVE_PING);
+      grpc_chttp2_initiate_write(t.get(),
+                                 GRPC_CHTTP2_INITIATE_WRITE_KEEPALIVE_PING);
     } else {
-      GRPC_CHTTP2_REF_TRANSPORT(t, "init keepalive ping");
       t->keepalive_ping_timer_handle =
           t->event_engine->RunAfter(t->keepalive_time, [t] {
             grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
@@ -2783,48 +2986,21 @@ static void init_keepalive_ping_locked(void* arg,
           });
     }
   }
-  GRPC_CHTTP2_UNREF_TRANSPORT(t, "init keepalive ping");
-}
-
-static void start_keepalive_ping(void* arg, grpc_error_handle error) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(arg);
-  t->combiner->Run(GRPC_CLOSURE_INIT(&t->start_keepalive_ping_locked,
-                                     start_keepalive_ping_locked, t, nullptr),
-                   error);
-}
-
-static void start_keepalive_ping_locked(void* arg, grpc_error_handle error) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(arg);
-  if (!error.ok()) {
-    return;
-  }
-  if (t->channelz_socket != nullptr) {
-    t->channelz_socket->RecordKeepaliveSent();
-  }
-  if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace) ||
-      GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace)) {
-    gpr_log(GPR_INFO, "%s: Start keepalive ping",
-            std::string(t->peer_string.as_string_view()).c_str());
-  }
-  GRPC_CHTTP2_REF_TRANSPORT(t, "keepalive watchdog");
-  t->keepalive_watchdog_timer_handle =
-      t->event_engine->RunAfter(t->keepalive_timeout, [t] {
-        grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
-        grpc_core::ExecCtx exec_ctx;
-        keepalive_watchdog_fired(t);
-      });
-  t->keepalive_ping_started = true;
 }
 
-static void finish_keepalive_ping(void* arg, grpc_error_handle error) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(arg);
-  t->combiner->Run(GRPC_CLOSURE_INIT(&t->finish_keepalive_ping_locked,
-                                     finish_keepalive_ping_locked, t, nullptr),
-                   error);
+static void finish_keepalive_ping(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    grpc_error_handle error) {
+  auto* tp = t.get();
+  tp->combiner->Run(
+      grpc_core::InitTransportClosure<finish_keepalive_ping_locked>(
+          std::move(t), &tp->finish_keepalive_ping_locked),
+      error);
 }
 
-static void finish_keepalive_ping_locked(void* arg, grpc_error_handle error) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(arg);
+static void finish_keepalive_ping_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    grpc_error_handle error) {
   if (t->keepalive_state == GRPC_CHTTP2_KEEPALIVE_STATE_PINGING) {
     if (error.ok()) {
       if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace) ||
@@ -2832,25 +3008,8 @@ static void finish_keepalive_ping_locked(void* arg, grpc_error_handle error) {
         gpr_log(GPR_INFO, "%s: Finish keepalive ping",
                 std::string(t->peer_string.as_string_view()).c_str());
       }
-      if (!t->keepalive_ping_started) {
-        // start_keepalive_ping_locked has not run yet. Reschedule
-        // finish_keepalive_ping_locked for it to be run later.
-        t->combiner->Run(
-            GRPC_CLOSURE_INIT(&t->finish_keepalive_ping_locked,
-                              finish_keepalive_ping_locked, t, nullptr),
-            error);
-        return;
-      }
-      t->keepalive_ping_started = false;
       t->keepalive_state = GRPC_CHTTP2_KEEPALIVE_STATE_WAITING;
-      if (t->keepalive_watchdog_timer_handle.has_value()) {
-        if (t->event_engine->Cancel(*t->keepalive_watchdog_timer_handle)) {
-          GRPC_CHTTP2_UNREF_TRANSPORT(t, "keepalive watchdog");
-          t->keepalive_watchdog_timer_handle.reset();
-        }
-      }
-      GPR_ASSERT(!t->keepalive_ping_timer_handle.has_value());
-      GRPC_CHTTP2_REF_TRANSPORT(t, "init keepalive ping");
+      GPR_ASSERT(t->keepalive_ping_timer_handle == TaskHandle::kInvalid);
       t->keepalive_ping_timer_handle =
           t->event_engine->RunAfter(t->keepalive_time, [t] {
             grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
@@ -2859,57 +3018,24 @@ static void finish_keepalive_ping_locked(void* arg, grpc_error_handle error) {
           });
     }
   }
-  GRPC_CHTTP2_UNREF_TRANSPORT(t, "keepalive ping end");
-}
-
-static void keepalive_watchdog_fired(grpc_chttp2_transport* t) {
-  t->combiner->Run(
-      GRPC_CLOSURE_INIT(&t->keepalive_watchdog_fired_locked,
-                        keepalive_watchdog_fired_locked, t, nullptr),
-      absl::OkStatus());
-}
-
-static void keepalive_watchdog_fired_locked(
-    void* arg, GRPC_UNUSED grpc_error_handle error) {
-  GPR_DEBUG_ASSERT(error.ok());
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(arg);
-  GPR_ASSERT(t->keepalive_watchdog_timer_handle.has_value());
-  t->keepalive_watchdog_timer_handle.reset();
-  if (t->keepalive_state == GRPC_CHTTP2_KEEPALIVE_STATE_PINGING) {
-    gpr_log(GPR_INFO, "%s: Keepalive watchdog fired. Closing transport.",
-            std::string(t->peer_string.as_string_view()).c_str());
-    t->keepalive_state = GRPC_CHTTP2_KEEPALIVE_STATE_DYING;
-    close_transport_locked(
-        t, grpc_error_set_int(GRPC_ERROR_CREATE("keepalive watchdog timeout"),
-                              grpc_core::StatusIntProperty::kRpcStatus,
-                              GRPC_STATUS_UNAVAILABLE));
-  } else {
-    // If keepalive_state is not PINGING, we consider it as an error. Maybe the
-    // cancellation failed in finish_keepalive_ping_locked. Users have seen
-    // other states: https://github.com/grpc/grpc/issues/32085.
-    gpr_log(GPR_ERROR, "keepalive_ping_end state error: %d (expect: %d)",
-            t->keepalive_state, GRPC_CHTTP2_KEEPALIVE_STATE_PINGING);
-  }
-  GRPC_CHTTP2_UNREF_TRANSPORT(t, "keepalive watchdog");
 }
 
 static void maybe_reset_keepalive_ping_timer_locked(grpc_chttp2_transport* t) {
-  if (t->keepalive_ping_timer_handle.has_value()) {
-    if (t->event_engine->Cancel(*t->keepalive_ping_timer_handle)) {
-      // Cancel succeeds, resets the keepalive ping timer. Note that we don't
-      // need to Ref or Unref here since we still hold the Ref.
-      if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace) ||
-          GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace)) {
-        gpr_log(GPR_INFO, "%s: Keepalive ping cancelled. Resetting timer.",
-                std::string(t->peer_string.as_string_view()).c_str());
-      }
-      t->keepalive_ping_timer_handle =
-          t->event_engine->RunAfter(t->keepalive_time, [t] {
-            grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
-            grpc_core::ExecCtx exec_ctx;
-            init_keepalive_ping(t);
-          });
+  if (t->keepalive_ping_timer_handle != TaskHandle::kInvalid &&
+      t->event_engine->Cancel(t->keepalive_ping_timer_handle)) {
+    // Cancel succeeds, resets the keepalive ping timer. Note that we don't
+    // need to Ref or Unref here since we still hold the Ref.
+    if (GRPC_TRACE_FLAG_ENABLED(grpc_http_trace) ||
+        GRPC_TRACE_FLAG_ENABLED(grpc_keepalive_trace)) {
+      gpr_log(GPR_INFO, "%s: Keepalive ping cancelled. Resetting timer.",
+              std::string(t->peer_string.as_string_view()).c_str());
     }
+    t->keepalive_ping_timer_handle =
+        t->event_engine->RunAfter(t->keepalive_time, [t = t->Ref()]() mutable {
+          grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
+          grpc_core::ExecCtx exec_ctx;
+          init_keepalive_ping(std::move(t));
+        });
   }
 }
 
@@ -2931,16 +3057,14 @@ static void connectivity_state_set(grpc_chttp2_transport* t,
 // POLLSET STUFF
 //
 
-static void set_pollset(grpc_transport* gt, grpc_stream* /*gs*/,
-                        grpc_pollset* pollset) {
-  grpc_chttp2_transport* t = reinterpret_cast<grpc_chttp2_transport*>(gt);
-  grpc_endpoint_add_to_pollset(t->ep, pollset);
+void grpc_chttp2_transport::SetPollset(grpc_stream* /*gs*/,
+                                       grpc_pollset* pollset) {
+  grpc_endpoint_add_to_pollset(ep, pollset);
 }
 
-static void set_pollset_set(grpc_transport* gt, grpc_stream* /*gs*/,
-                            grpc_pollset_set* pollset_set) {
-  grpc_chttp2_transport* t = reinterpret_cast<grpc_chttp2_transport*>(gt);
-  grpc_endpoint_add_to_pollset_set(t->ep, pollset_set);
+void grpc_chttp2_transport::SetPollsetSet(grpc_stream* /*gs*/,
+                                          grpc_pollset_set* pollset_set) {
+  grpc_endpoint_add_to_pollset_set(ep, pollset_set);
 }
 
 //
@@ -2950,18 +3074,17 @@ static void set_pollset_set(grpc_transport* gt, grpc_stream* /*gs*/,
 static void post_benign_reclaimer(grpc_chttp2_transport* t) {
   if (!t->benign_reclaimer_registered) {
     t->benign_reclaimer_registered = true;
-    GRPC_CHTTP2_REF_TRANSPORT(t, "benign_reclaimer");
     t->memory_owner.PostReclaimer(
         grpc_core::ReclamationPass::kBenign,
-        [t](absl::optional<grpc_core::ReclamationSweep> sweep) {
+        [t = t->Ref()](
+            absl::optional<grpc_core::ReclamationSweep> sweep) mutable {
           if (sweep.has_value()) {
-            GRPC_CLOSURE_INIT(&t->benign_reclaimer_locked,
-                              benign_reclaimer_locked, t,
-                              grpc_schedule_on_exec_ctx);
-            t->active_reclamation = std::move(*sweep);
-            t->combiner->Run(&t->benign_reclaimer_locked, absl::OkStatus());
-          } else {
-            GRPC_CHTTP2_UNREF_TRANSPORT(t, "benign_reclaimer");
+            auto* tp = t.get();
+            tp->active_reclamation = std::move(*sweep);
+            tp->combiner->Run(
+                grpc_core::InitTransportClosure<benign_reclaimer_locked>(
+                    std::move(t), &tp->benign_reclaimer_locked),
+                absl::OkStatus());
           }
         });
   }
@@ -2970,26 +3093,25 @@ static void post_benign_reclaimer(grpc_chttp2_transport* t) {
 static void post_destructive_reclaimer(grpc_chttp2_transport* t) {
   if (!t->destructive_reclaimer_registered) {
     t->destructive_reclaimer_registered = true;
-    GRPC_CHTTP2_REF_TRANSPORT(t, "destructive_reclaimer");
     t->memory_owner.PostReclaimer(
         grpc_core::ReclamationPass::kDestructive,
-        [t](absl::optional<grpc_core::ReclamationSweep> sweep) {
+        [t = t->Ref()](
+            absl::optional<grpc_core::ReclamationSweep> sweep) mutable {
           if (sweep.has_value()) {
-            GRPC_CLOSURE_INIT(&t->destructive_reclaimer_locked,
-                              destructive_reclaimer_locked, t,
-                              grpc_schedule_on_exec_ctx);
-            t->active_reclamation = std::move(*sweep);
-            t->combiner->Run(&t->destructive_reclaimer_locked,
-                             absl::OkStatus());
-          } else {
-            GRPC_CHTTP2_UNREF_TRANSPORT(t, "destructive_reclaimer");
+            auto* tp = t.get();
+            tp->active_reclamation = std::move(*sweep);
+            tp->combiner->Run(
+                grpc_core::InitTransportClosure<destructive_reclaimer_locked>(
+                    std::move(t), &tp->destructive_reclaimer_locked),
+                absl::OkStatus());
           }
         });
   }
 }
 
-static void benign_reclaimer_locked(void* arg, grpc_error_handle error) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(arg);
+static void benign_reclaimer_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    grpc_error_handle error) {
   if (error.ok() && t->stream_map.empty()) {
     // Channel with no active streams: send a goaway to try and make it
     // disconnect cleanly
@@ -2997,7 +3119,7 @@ static void benign_reclaimer_locked(void* arg, grpc_error_handle error) {
       gpr_log(GPR_INFO, "HTTP2: %s - send goaway to free memory",
               std::string(t->peer_string.as_string_view()).c_str());
     }
-    send_goaway(t,
+    send_goaway(t.get(),
                 grpc_error_set_int(GRPC_ERROR_CREATE("Buffers full"),
                                    grpc_core::StatusIntProperty::kHttp2Error,
                                    GRPC_HTTP2_ENHANCE_YOUR_CALM),
@@ -3013,11 +3135,11 @@ static void benign_reclaimer_locked(void* arg, grpc_error_handle error) {
   if (error != absl::CancelledError()) {
     t->active_reclamation.Finish();
   }
-  GRPC_CHTTP2_UNREF_TRANSPORT(t, "benign_reclaimer");
 }
 
-static void destructive_reclaimer_locked(void* arg, grpc_error_handle error) {
-  grpc_chttp2_transport* t = static_cast<grpc_chttp2_transport*>(arg);
+static void destructive_reclaimer_locked(
+    grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
+    grpc_error_handle error) {
   t->destructive_reclaimer_registered = false;
   if (error.ok() && !t->stream_map.empty()) {
     // As stream_map is a hash map, this selects effectively a random stream.
@@ -3027,22 +3149,22 @@ static void destructive_reclaimer_locked(void* arg, grpc_error_handle error) {
               std::string(t->peer_string.as_string_view()).c_str(), s->id);
     }
     grpc_chttp2_cancel_stream(
-        t, s,
+        t.get(), s,
         grpc_error_set_int(GRPC_ERROR_CREATE("Buffers full"),
                            grpc_core::StatusIntProperty::kHttp2Error,
-                           GRPC_HTTP2_ENHANCE_YOUR_CALM));
+                           GRPC_HTTP2_ENHANCE_YOUR_CALM),
+        false);
     if (!t->stream_map.empty()) {
       // Since we cancel one stream per destructive reclamation, if
       //   there are more streams left, we can immediately post a new
       //   reclaimer in case the resource quota needs to free more
       //   memory
-      post_destructive_reclaimer(t);
+      post_destructive_reclaimer(t.get());
     }
   }
   if (error != absl::CancelledError()) {
     t->active_reclamation.Finish();
   }
-  GRPC_CHTTP2_UNREF_TRANSPORT(t, "destructive_reclaimer");
 }
 
 //
@@ -3100,53 +3222,46 @@ const char* grpc_chttp2_initiate_write_reason_string(
   GPR_UNREACHABLE_CODE(return "unknown");
 }
 
-static grpc_endpoint* chttp2_get_endpoint(grpc_transport* t) {
-  return (reinterpret_cast<grpc_chttp2_transport*>(t))->ep;
+grpc_endpoint* grpc_chttp2_transport::GetEndpoint() { return ep; }
+
+size_t grpc_chttp2_transport::SizeOfStream() const {
+  return sizeof(grpc_chttp2_stream);
 }
 
-static const grpc_transport_vtable vtable = {sizeof(grpc_chttp2_stream),
-                                             false,
-                                             "chttp2",
-                                             init_stream,
-                                             nullptr,
-                                             set_pollset,
-                                             set_pollset_set,
-                                             perform_stream_op,
-                                             perform_transport_op,
-                                             destroy_stream,
-                                             destroy_transport,
-                                             chttp2_get_endpoint};
+bool grpc_chttp2_transport::
+    HackyDisableStreamOpBatchCoalescingInConnectedChannel() const {
+  return false;
+}
 
-static const grpc_transport_vtable* get_vtable(void) { return &vtable; }
+absl::string_view grpc_chttp2_transport::GetTransportName() const {
+  return "chttp2";
+}
 
 grpc_core::RefCountedPtr<grpc_core::channelz::SocketNode>
-grpc_chttp2_transport_get_socket_node(grpc_transport* transport) {
+grpc_chttp2_transport_get_socket_node(grpc_core::Transport* transport) {
   grpc_chttp2_transport* t =
       reinterpret_cast<grpc_chttp2_transport*>(transport);
   return t->channelz_socket;
 }
 
-grpc_transport* grpc_create_chttp2_transport(
+grpc_core::Transport* grpc_create_chttp2_transport(
     const grpc_core::ChannelArgs& channel_args, grpc_endpoint* ep,
     bool is_client) {
-  auto t = new grpc_chttp2_transport(channel_args, ep, is_client);
-  return &t->base;
+  return new grpc_chttp2_transport(channel_args, ep, is_client);
 }
 
 void grpc_chttp2_transport_start_reading(
-    grpc_transport* transport, grpc_slice_buffer* read_buffer,
+    grpc_core::Transport* transport, grpc_slice_buffer* read_buffer,
     grpc_closure* notify_on_receive_settings, grpc_closure* notify_on_close) {
-  grpc_chttp2_transport* t =
-      reinterpret_cast<grpc_chttp2_transport*>(transport);
-  GRPC_CHTTP2_REF_TRANSPORT(
-      t, "reading_action");  // matches unref inside reading_action
+  auto t = reinterpret_cast<grpc_chttp2_transport*>(transport)->Ref();
   if (read_buffer != nullptr) {
     grpc_slice_buffer_move_into(read_buffer, &t->read_buffer);
     gpr_free(read_buffer);
   }
-  t->combiner->Run(
-      grpc_core::NewClosure([t, notify_on_receive_settings,
-                             notify_on_close](grpc_error_handle) {
+  auto* tp = t.get();
+  tp->combiner->Run(
+      grpc_core::NewClosure([t = std::move(t), notify_on_receive_settings,
+                             notify_on_close](grpc_error_handle) mutable {
         if (!t->closed_with_error.ok()) {
           if (notify_on_receive_settings != nullptr) {
             grpc_core::ExecCtx::Run(DEBUG_LOCATION, notify_on_receive_settings,
@@ -3156,12 +3271,11 @@ void grpc_chttp2_transport_start_reading(
             grpc_core::ExecCtx::Run(DEBUG_LOCATION, notify_on_close,
                                     t->closed_with_error);
           }
-          GRPC_CHTTP2_UNREF_TRANSPORT(t, "reading_action");
           return;
         }
         t->notify_on_receive_settings = notify_on_receive_settings;
         t->notify_on_close = notify_on_close;
-        read_action_locked(t, absl::OkStatus());
+        read_action_locked(std::move(t), absl::OkStatus());
       }),
       absl::OkStatus());
 }