quicsilver 0.4.0 → 0.5.0

data/ext/quicsilver/quicsilver.c

@@ -1,9 +1,19 @@
 #include <ruby.h>
 #include <ruby/thread.h>
+#include <ruby/st.h>
+#include <pthread.h>
 #define QUIC_API_ENABLE_PREVIEW_FEATURES 1
 #include "msquic.h"
+
+// A reset stream's final size arrives on the PEER_SEND_ABORTED event, added
+// by patches/stream-final-size.patch. This is the value MsQuic uses while it
+// is unsettled, and what we pass to Ruby as "not known".
+#define QUICSILVER_FINAL_SIZE_UNKNOWN UINT64_MAX
+#include <errno.h>
+#include <limits.h>
 #include <stdlib.h>
 #include <string.h>
+#include <time.h>
 #include <unistd.h>
 
 #if __linux__
@@ -57,6 +67,17 @@ typedef struct {
     QUIC_STATUS error_status;
     uint64_t error_code;
     VALUE client_obj;  // Ruby client object (Qnil for server connections)
+    char remote_address[INET6_ADDRSTRLEN];
+    uint16_t remote_port;
+    int session_resumed;
+    int reliable_reset_negotiated;
+    // 0-RTT resumption ticket (client-side)
+    uint8_t* resumption_ticket;
+    uint32_t resumption_ticket_length;
+    // Datagrams queued for Ruby and dropped for lack of room, per connection.
+    // Both maintained under EventQueue.lock, not StateLock.
+    size_t queued_datagrams;
+    uint64_t dropped_datagrams;
 } ConnectionContext;
 
 // Listener state tracking
@@ -70,20 +91,387 @@ typedef struct {
 
 // Stream state tracking
 typedef struct {
+    HQUIC stream;
+    uint64_t token;
+    QUIC_STREAM_SHUTDOWN_FLAGS abort_flags;
+    uint32_t pending_priority;
+    uint64_t receive_credit;
+    uint64_t receive_chunks;
+    // Set under StateLock when a RECEIVE returned less than indicated, which
+    // makes MsQuic stop delivering. The next grant that leaves both credits
+    // positive clears it and calls StreamReceiveSetEnabled.
+    int receive_paused;
+    int receive_credit_enabled;
+    int receive_delivery_failed;
+    // Set when a RECEIVE_FIN has been queued for Ruby. Poll thread only.
+    int fin_delivered;
     HQUIC connection;
     void* connection_ctx;  // ConnectionContext pointer (for building connection_data)
     VALUE client_obj;      // Ruby client object (copied from connection context)
+    char remote_address[INET6_ADDRSTRLEN];
+    uint16_t remote_port;
+    int session_resumed;
+    uint64_t stream_id;    // QUIC stream ID, cached once after StreamStart
     int started;
     int shutdown;
     int early_data;        // Set when stream received 0-RTT data
     QUIC_STATUS error_status;
 } StreamContext;
 
-// Pending stream priorities — set from Ruby threads, applied on MsQuic event thread.
-// Simple array-based storage (max 256 pending). Key = stream handle, value = priority + 1.
-#define MAX_PENDING_PRIORITIES 256
-static struct { HQUIC stream; uint16_t priority_plus_one; } PendingPriorities[MAX_PENDING_PRIORITIES];
-static int PendingPriorityCount = 0;
+// --- Threading model ---------------------------------------------------------
+//
+// Two threads touch this file's state, and neither holds the other's lock.
+//
+// The poll thread drives MsQuic (ExecutionPoll, kevent/epoll_wait, completion
+// callbacks) with the GVL released for the whole loop. Nothing reachable from
+// a StreamCallback or ConnectionCallback may call into Ruby. Callbacks push a
+// RubyEvent onto EventQueue and return.
+//
+// The dispatcher thread, a Ruby Thread in Transport::EventLoop, waits on
+// EventQueue without the GVL, then takes it to pop a batch and call
+// Server.handle_stream / Client#handle_stream_event for each. It also does
+// the releases that used to happen inside callbacks and either need the GVL
+// (rb_gc_unregister_address) or free memory a Ruby thread could still be
+// using (StreamContext, ConnectionContext, SendContext). Because every free
+// happens on a thread holding the GVL, a Ruby thread that found a context
+// cannot see it freed underneath it: the GVL is the lifetime guarantee, as it
+// was before, just held by a different thread.
+//
+// StateLock covers LiveStreams and every context field one side writes and
+// the other reads: receive credit and the paused flag, the lazily cached
+// stream_id. Rule: never call MsQuic while holding StateLock. Callbacks run
+// inside MsQuic's connection lock, so holding StateLock across an MsQuic call
+// from a Ruby thread would invert the order and deadlock.
+//
+// Why the receive path can be asynchronous: MsQuic processes API calls on a
+// stream (StreamReceiveSetEnabled, StreamSend) as queued operations on the
+// connection's worker, which here is ExecutionPoll on the poll thread. A call
+// made from a Ruby thread therefore runs after any callback in flight, never
+// during it. So when a RECEIVE returns a partial length and MsQuic pauses the
+// stream, a grant that observed receive_paused and queued SetEnabled is
+// applied after the pause, not lost before it.
+static pthread_mutex_t StateLock = PTHREAD_MUTEX_INITIALIZER;
+#define STATE_LOCK()   pthread_mutex_lock(&StateLock)
+#define STATE_UNLOCK() pthread_mutex_unlock(&StateLock)
+
+// Tokens are never reused. find_stream returns a pointer whose lifetime is
+// guaranteed by the GVL: contexts are freed only on the dispatcher thread,
+// which holds it. So a caller must hold the GVL from the lookup through the
+// last use of the pointer and must not release it in between, including via
+// rb_thread_call_without_gvl, rb_thread_schedule, or any Ruby call that can
+// block. Inserting one of those between find_stream and the MsQuic call it
+// guards is a use-after-free.
+static st_table* LiveStreams;
+
+typedef enum {
+    RELEASE_NONE = 0,
+    RELEASE_SEND,              // SendContext*: drop the retained String
+    RELEASE_STREAM,            // StreamContext*: StreamClose + free
+    RELEASE_STREAM_NOCLOSE,    // StreamContext*: free only, app is closing
+    RELEASE_CONNECTION,        // ConnectionContext*: unregister client_obj, free
+} ReleaseKind;
+
+// Most events carry a token or a token plus two integers; those fit inline
+// and cost no malloc. RECEIVE payloads are handed over already allocated.
+#define EVENT_INLINE_DATA 40
+
+typedef struct {
+    HQUIC connection;
+    void* connection_ctx;
+    VALUE client_obj;
+    const char* event_type;      // string literal, never freed
+    uint64_t stream_id;
+    char* data;                  // malloc'd when data_len > EVENT_INLINE_DATA
+    size_t data_len;
+    char inline_data[EVENT_INLINE_DATA];
+    int early_data;
+    int dropped;                 // superseded datagram: free, do not deliver
+    ReleaseKind release;
+    void* release_ptr;
+
+    // A pending receive: MsQuic owns the bytes until StreamReceiveComplete.
+    // Descriptors are copied (callback-scoped); data is NULL.
+    HQUIC stream;
+    uint64_t token;
+    uint64_t accepted;
+    QUIC_BUFFER* buffers;        // inline_buffers, or malloc'd when more
+    uint32_t buffer_count;
+    QUIC_BUFFER inline_buffers[4];
+} RubyEvent;
+
+#define EVENT_INLINE_BUFFERS 4
+
+static struct {
+    pthread_mutex_t lock;
+    pthread_cond_t ready;
+    RubyEvent* buf;
+    size_t cap, head, len;
+    int closed;
+} EventQueue = { PTHREAD_MUTEX_INITIALIZER, PTHREAD_COND_INITIALIZER, NULL, 0, 0, 0, 0 };
+
+// The queue is unbounded for stream events, which stream limits and receive
+// credit already bound. Datagrams have no flow control (RFC 9221 §5.3) and
+// MAY be dropped when the receiver cannot process them, so each connection
+// may have at most this many queued ahead of the dispatcher. Per connection,
+// not global: one flooding peer must not cost every other peer its datagrams.
+// 128 is quic-go's per-connection receive queue; neqo uses 10, quiche makes
+// the application choose. When full the oldest is dropped, not the newest:
+// for the signals datagrams carry (presence, positions) the stale one is the
+// one nobody wants, which is quiche's and neqo's policy too. The count is of
+// datagrams, so a backlog of stream events does not cost datagrams.
+#define DATAGRAM_QUEUE_LIMIT 128
+static uint64_t DroppedDatagrams = 0;
+
+// Under EventQueue.lock. Finds the oldest undropped datagram for the
+// connection and marks it; the dispatcher frees it without delivering.
+static void
+drop_oldest_datagram(void* connection_ctx)
+{
+    for (size_t i = 0; i < EventQueue.len; i++) {
+        RubyEvent* ev = &EventQueue.buf[(EventQueue.head + i) % EventQueue.cap];
+        if (ev->connection_ctx == connection_ctx && !ev->dropped &&
+            strcmp(ev->event_type, "DATAGRAM_RECEIVED") == 0) {
+            ev->dropped = 1;
+            return;
+        }
+    }
+}
+
+// Grow by doubling, re-linearising the ring. Unbounded on purpose: a bounded
+// queue that blocks the poll thread would deadlock against a Ruby thread
+// calling StreamSend (needs the connection lock the blocked callback holds),
+// and one that drops would lose stream data. Per-stream receive credit is
+// what bounds memory, as before.
+static int
+event_queue_grow(void)
+{
+    size_t cap = EventQueue.cap ? EventQueue.cap * 2 : 256;
+    RubyEvent* buf = malloc(cap * sizeof(RubyEvent));
+    if (!buf) return 0;
+    for (size_t i = 0; i < EventQueue.len; i++) {
+        RubyEvent* from = &EventQueue.buf[(EventQueue.head + i) % EventQueue.cap];
+        buf[i] = *from;
+        // Inline descriptors must point at their own copy.
+        if (from->buffers == from->inline_buffers) buf[i].buffers = buf[i].inline_buffers;
+    }
+    free(EventQueue.buf);
+    EventQueue.buf = buf;
+    EventQueue.cap = cap;
+    EventQueue.head = 0;
+    return 1;
+}
+
+static int event_queue_push(RubyEvent* evp);
+
+// `owned` is a malloc'd buffer the queue takes over; otherwise data is copied.
+static int
+queue_event_full(HQUIC connection, void* connection_ctx, VALUE client_obj,
+                 const char* event_type, uint64_t stream_id,
+                 const char* data, size_t data_len, int early_data,
+                 char* owned, ReleaseKind release, void* release_ptr)
+{
+    RubyEvent ev;
+    ev.connection = connection;
+    ev.connection_ctx = connection_ctx;
+    ev.client_obj = client_obj;
+    ev.event_type = event_type;
+    ev.stream_id = stream_id;
+    ev.data_len = data_len;
+    ev.early_data = early_data;
+    ev.release = release;
+    ev.release_ptr = release_ptr;
+    if (owned) {
+        ev.data = owned;
+    } else if (data_len <= EVENT_INLINE_DATA) {
+        ev.data = NULL;
+        if (data_len) memcpy(ev.inline_data, data, data_len);
+    } else {
+        ev.data = malloc(data_len);
+        if (!ev.data) return 0;
+        memcpy(ev.data, data, data_len);
+    }
+
+    ev.dropped = 0;
+    ev.stream = NULL;
+    ev.buffers = NULL;
+    ev.buffer_count = 0;
+    return event_queue_push(&ev);
+}
+
+// Copies the record into the ring; frees ev->data on failure.
+static int
+event_queue_push(RubyEvent* evp)
+{
+    RubyEvent ev = *evp;
+    const char* event_type = ev.event_type;
+    void* connection_ctx = ev.connection_ctx;
+    int is_datagram = strcmp(event_type, "DATAGRAM_RECEIVED") == 0;
+    ConnectionContext* conn = (ConnectionContext*)connection_ctx;
+    pthread_mutex_lock(&EventQueue.lock);
+    if (is_datagram && conn && conn->queued_datagrams >= DATAGRAM_QUEUE_LIMIT) {
+        // Make room by dropping the oldest; the new one is queued below.
+        drop_oldest_datagram(conn);
+        conn->queued_datagrams--;
+        conn->dropped_datagrams++;
+        DroppedDatagrams++;
+    }
+    if (EventQueue.len == EventQueue.cap && !event_queue_grow()) {
+        pthread_mutex_unlock(&EventQueue.lock);
+        free(ev.data);
+        return 0;
+    }
+    RubyEvent* slot = &EventQueue.buf[(EventQueue.head + EventQueue.len) % EventQueue.cap];
+    *slot = ev;
+    if (ev.buffers == evp->inline_buffers) slot->buffers = slot->inline_buffers;
+    EventQueue.len++;
+    if (is_datagram && conn) conn->queued_datagrams++;
+    pthread_cond_signal(&EventQueue.ready);
+    pthread_mutex_unlock(&EventQueue.lock);
+    return 1;
+}
+
+static int
+queue_event(HQUIC connection, void* connection_ctx, VALUE client_obj,
+            const char* event_type, uint64_t stream_id,
+            const char* data, size_t data_len, int early_data)
+{
+    return queue_event_full(connection, connection_ctx, client_obj, event_type, stream_id,
+                            data, data_len, early_data, NULL, RELEASE_NONE, NULL);
+}
+
+// --- Zero-copy sends ---------------------------------------------------------
+//
+// A send used to malloc a QUIC_BUFFER plus a copy of the body and memcpy the
+// body into it, with the GVL held, then free it on SEND_COMPLETE. For a 12MB
+// response that is a 12MB allocate-and-copy during which no other Ruby thread
+// runs. Instead the Ruby String is frozen and retained, and QUIC_BUFFER points
+// straight at its bytes. MsQuic owns the pointer until SEND_COMPLETE, so the
+// String must not move or be collected until then: LiveSends is a GC root
+// that marks every retained String, and SEND_COMPLETE removes the entry.
+//
+// Freezing is what makes the pointer stable. A frozen String cannot be
+// resized or have its buffer replaced, and the encoder hands these Strings
+// over without reusing them. Compaction could still move an unfrozen embedded
+// String; rb_gc_mark (not rb_gc_mark_movable) pins what it marks, so the
+// retained Strings stay put.
+//
+// Every mutation of LiveSends happens with the GVL held: quicsilver_send_stream
+// is a Ruby method, and the release for SEND_COMPLETE runs on the dispatcher
+// thread, not in the callback. GC runs with the GVL. So the table needs no
+// lock.
+typedef struct {
+    QUIC_BUFFER buffer;
+    VALUE data;
+} SendContext;
+
+static st_table* LiveSends;
+static VALUE LiveSendsRoot = Qnil;
+// gc_mark_children skips a T_DATA's dmark when its data pointer is NULL, so
+// the root wraps this instead of NULL. Its value is never read.
+static int LiveSendsRootData;
+
+static int
+mark_live_send(st_data_t key, st_data_t value, st_data_t arg)
+{
+    (void)key; (void)arg;
+    rb_gc_mark(((SendContext*)value)->data);
+    return ST_CONTINUE;
+}
+
+static void
+live_sends_mark(void* ptr)
+{
+    (void)ptr;
+    if (LiveSends) st_foreach(LiveSends, mark_live_send, 0);
+}
+
+static const rb_data_type_t live_sends_type = {
+    "Quicsilver::LiveSends",
+    { live_sends_mark, NULL, NULL, },
+    0, 0, RUBY_TYPED_FREE_IMMEDIATELY
+};
+
+static SendContext*
+send_context_new(VALUE data)
+{
+    SendContext* ctx = malloc(sizeof(SendContext));
+    if (!ctx) return NULL;
+    ctx->data = data;
+    ctx->buffer.Buffer = (uint8_t*)RSTRING_PTR(data);
+    ctx->buffer.Length = (uint32_t)RSTRING_LEN(data);
+    st_insert(LiveSends, (st_data_t)ctx, (st_data_t)ctx);
+    return ctx;
+}
+
+static void
+send_context_release(void* raw)
+{
+    if (!raw) return;
+    st_data_t key = (st_data_t)raw;
+    st_delete(LiveSends, &key, NULL);
+    free(raw);
+}
+static uint64_t NextStreamToken = 1;
+
+static uint64_t
+register_stream(StreamContext* ctx, HQUIC stream, QUIC_STREAM_SHUTDOWN_FLAGS flags)
+{
+    ctx->stream = stream;
+    ctx->abort_flags = flags;
+    ctx->receive_credit = 0;
+    ctx->receive_chunks = 0;
+    ctx->receive_paused = 0;
+    ctx->receive_credit_enabled = 0;
+    ctx->receive_delivery_failed = 0;
+    ctx->fin_delivered = 0;
+    ctx->pending_priority = 0;
+    // The token is minted under the same lock that inserts it. Peer streams
+    // are registered on the poll thread and client streams on Ruby threads;
+    // with the poll thread no longer holding the GVL, a bare increment here
+    // handed two streams one token, and send_stream resolved to the wrong one.
+    // Found as a client receiving its own request frame as a response.
+    STATE_LOCK();
+    ctx->token = NextStreamToken++;
+    st_insert(LiveStreams, (st_data_t)ctx->token, (st_data_t)ctx);
+    STATE_UNLOCK();
+    return ctx->token;
+}
+
+static StreamContext*
+find_stream(uint64_t token)
+{
+    st_data_t entry;
+    STATE_LOCK();
+    int found = st_lookup(LiveStreams, (st_data_t)token, &entry);
+    STATE_UNLOCK();
+    return found ? (StreamContext*)entry : NULL;
+}
+
+static void
+unregister_stream(uint64_t token)
+{
+    st_data_t key = (st_data_t)token;
+    STATE_LOCK();
+    st_delete(LiveStreams, &key, NULL);
+    STATE_UNLOCK();
+}
+
+static int
+forget_connection_stream(st_data_t key, st_data_t value, st_data_t connection)
+{
+    StreamContext* ctx = (StreamContext*)value;
+    if (ctx->connection != (HQUIC)connection) return ST_CONTINUE;
+    return ST_DELETE;
+}
+
+static void
+forget_connection_streams(HQUIC connection)
+{
+    STATE_LOCK();
+    st_foreach(LiveStreams, forget_connection_stream, (st_data_t)connection);
+    STATE_UNLOCK();
+}
+
 
 // rb_protect wrapper — catches Ruby exceptions so they don't longjmp
 // through MsQuic callback frames (which would corrupt MsQuic state).
@@ -92,6 +480,15 @@ struct dispatch_ruby_args {
     HQUIC connection;
     void* connection_ctx;
     VALUE client_obj;
+    // For a pending receive: gather these into the String after the token.
+    const QUIC_BUFFER* buffers;
+    uint32_t buffer_count;
+    uint64_t token;
+    uint64_t accepted;
+    VALUE payload;               // Qundef, or a String built before dispatch
+    char remote_address[INET6_ADDRSTRLEN];
+    uint16_t remote_port;
+    int session_resumed;
     const char* event_type;
     uint64_t stream_id;
     const char* data;
@@ -99,22 +496,50 @@ struct dispatch_ruby_args {
     int early_data;
 };
 
+// [token][bytes], gathered straight from MsQuic's buffers.
+static VALUE
+gather_receive_string(struct dispatch_ruby_args* a)
+{
+    VALUE str = rb_str_new(NULL, (long)(sizeof(a->token) + a->accepted));
+    char* out = RSTRING_PTR(str);
+    memcpy(out, &a->token, sizeof(a->token));
+    out += sizeof(a->token);
+    uint64_t remaining = a->accepted;
+    for (uint32_t b = 0; b < a->buffer_count && remaining; b++) {
+        size_t len = a->buffers[b].Length;
+        if (len > remaining) len = (size_t)remaining;
+        memcpy(out, a->buffers[b].Buffer, len);
+        out += len;
+        remaining -= len;
+    }
+    return str;
+}
+
+static VALUE
+gather_receive_protected(VALUE arg)
+{
+    return gather_receive_string((struct dispatch_ruby_args*)arg);
+}
+
 static VALUE
 dispatch_ruby_body(VALUE arg)
 {
     struct dispatch_ruby_args* a = (struct dispatch_ruby_args*)arg;
+    VALUE payload = a->payload != Qundef ? a->payload : rb_str_new(a->data, a->data_len);
 
     if (NIL_P(a->client_obj)) {
         VALUE server_class = rb_const_get_at(mQuicsilver, rb_intern("Server"));
         if (rb_class_real(CLASS_OF(server_class)) == rb_cClass) {
-            VALUE connection_data = rb_ary_new2(2);
+            ConnectionContext* conn_ctx = (ConnectionContext*)a->connection_ctx;
+            VALUE connection_data = rb_ary_new2(3);
             rb_ary_push(connection_data, ULL2NUM((uintptr_t)a->connection));
             rb_ary_push(connection_data, ULL2NUM((uintptr_t)a->connection_ctx));
+            rb_ary_push(connection_data, conn_ctx && conn_ctx->session_resumed ? Qtrue : Qfalse);
             VALUE argv[5] = {
                 connection_data,
                 ULL2NUM(a->stream_id),
                 rb_str_new_cstr(a->event_type),
-                rb_str_new(a->data, a->data_len),
+                payload,
                 a->early_data ? Qtrue : Qfalse
             };
             rb_funcallv(server_class, rb_intern("handle_stream"), 5, argv);
@@ -124,7 +549,7 @@ dispatch_ruby_body(VALUE arg)
             VALUE argv[4] = {
                 ULL2NUM(a->stream_id),
                 rb_str_new_cstr(a->event_type),
-                rb_str_new(a->data, a->data_len),
+                payload,
                 a->early_data ? Qtrue : Qfalse
             };
             rb_funcallv(a->client_obj, rb_intern("handle_stream_event"), 4, argv);
@@ -134,14 +559,40 @@ dispatch_ruby_body(VALUE arg)
     return Qnil;
 }
 
-// Dispatch event to Ruby — entire body wrapped in rb_protect so no Ruby call
-// (object construction or funcall) can longjmp through MsQuic callback frames.
-static void
+static VALUE
+format_dispatch_error(VALUE err)
+{
+    VALUE klass = rb_class_name(rb_obj_class(err));
+    VALUE msg = rb_funcall(err, rb_intern("message"), 0);
+    VALUE bt = rb_funcall(err, rb_intern("backtrace"), 0);
+    fprintf(stderr, "Quicsilver: exception in callback: %s: %s\n",
+        StringValueCStr(klass), StringValueCStr(msg));
+    if (RB_TYPE_P(bt, T_ARRAY) && RARRAY_LEN(bt) > 0) {
+        long bt_len = RARRAY_LEN(bt) < 5 ? RARRAY_LEN(bt) : 5;
+        for (long i = 0; i < bt_len; i++) {
+            VALUE line = rb_ary_entry(bt, i);
+            fprintf(stderr, "  %s\n", StringValueCStr(line));
+        }
+    }
+    return Qnil;
+}
+
+// Deliver one event to Ruby, on the dispatcher thread, with the GVL. The body
+// is wrapped in rb_protect so an exception in the handler is logged rather
+// than unwinding the dispatcher. Returns the protect state: nonzero means the
+// handler raised.
+static int
 dispatch_to_ruby(HQUIC connection, void* connection_ctx, VALUE client_obj,
                  const char* event_type, uint64_t stream_id,
-                 const char* data, size_t data_len, int early_data)
+                 const char* data, size_t data_len, int early_data,
+                 VALUE prebuilt)
 {
     struct dispatch_ruby_args args;
+    args.buffers = NULL;
+    args.buffer_count = 0;
+    args.token = 0;
+    args.accepted = 0;
+    args.payload = prebuilt;
     args.connection = connection;
     args.connection_ctx = connection_ctx;
     args.client_obj = client_obj;
@@ -154,9 +605,129 @@ dispatch_to_ruby(HQUIC connection, void* connection_ctx, VALUE client_obj,
     int state = 0;
     rb_protect(dispatch_ruby_body, (VALUE)&args, &state);
     if (state) {
+        VALUE err = rb_errinfo();
         rb_set_errinfo(Qnil);
-        fprintf(stderr, "Quicsilver: exception in callback\n");
+        if (!NIL_P(err)) {
+            // #message and #backtrace are Ruby methods and can raise. Protect
+            // them too, or an exception in the handler's exception takes the
+            // dispatcher thread down.
+            int format_state = 0;
+            rb_protect(format_dispatch_error, err, &format_state);
+            if (format_state) {
+                rb_set_errinfo(Qnil);
+                fprintf(stderr, "Quicsilver: exception in callback (unprintable)\n");
+            }
+        }
     }
+    return state;
+}
+
+// Unsigned credit argument: NUM2ULL wraps negatives, so check the sign first.
+static uint64_t
+credit_arg(VALUE value, const char* label)
+{
+    if (!RB_INTEGER_TYPE_P(value)) rb_raise(rb_eTypeError, "%s must be an integer", label);
+    if (RTEST(rb_funcall(value, rb_intern("<"), 1, INT2FIX(0)))) {
+        rb_raise(rb_eArgError, "%s must not be negative", label);
+    }
+    return NUM2ULL(value);
+}
+
+static int
+resume_receive(StreamContext* ctx)
+{
+    QUIC_STATUS status = MsQuic->StreamReceiveSetEnabled(ctx->stream, TRUE);
+    if (QUIC_FAILED(status)) return 0;
+    return 1;
+}
+
+// Returns QUIC_STATUS_PENDING: MsQuic keeps the bytes until the dispatcher
+// has copied them into the Ruby String and called StreamReceiveComplete. The
+// bytes outlive this callback (freed at StreamClose, which the dispatcher does
+// later); the QUIC_BUFFER descriptors do not and are copied. One receive per
+// stream is pending at a time, so the queue holds at most one per stream.
+//
+// When credit enforcement is active (receive_credit_enabled, set by the first
+// grant) we accept only what fits and complete with that length; MsQuic then
+// disables further receives until StreamReceiveSetEnabled, which the next
+// sufficient grant issues (see receive_paused). A partially accepted receive
+// never carries FIN: it arrives with the suffix.
+static QUIC_STATUS
+receive_with_credit(StreamContext* ctx, QUIC_STREAM_EVENT* event)
+{
+    uint64_t indicated = event->RECEIVE.TotalBufferLength;
+    uint64_t accepted = indicated;
+
+    // Decide and debit under one lock hold, so a concurrent grant sees either
+    // the state before this receive or after it, never the middle.
+    STATE_LOCK();
+    int failed_before = ctx->receive_delivery_failed;
+    if (ctx->receive_credit_enabled) {
+        if (accepted > ctx->receive_credit) accepted = ctx->receive_credit;
+        if (!ctx->receive_chunks) accepted = 0;
+        ctx->receive_credit -= accepted;
+        if (accepted) ctx->receive_chunks--;
+        if (accepted < indicated) ctx->receive_paused = 1;
+    }
+    STATE_UNLOCK();
+
+    int has_fin = (event->RECEIVE.Flags & QUIC_RECEIVE_FLAG_FIN) && accepted == indicated;
+    if (failed_before || (!accepted && !has_fin)) {
+        event->RECEIVE.TotalBufferLength = 0;
+        return QUIC_STATUS_SUCCESS;
+    }
+    if (accepted > LONG_MAX - sizeof(uint64_t)) goto failed;
+
+    RubyEvent ev;
+    memset(&ev, 0, sizeof(ev));
+    ev.connection = ctx->connection;
+    ev.connection_ctx = ctx->connection_ctx;
+    ev.client_obj = ctx->client_obj;
+    ev.event_type = has_fin ? "RECEIVE_FIN" : "RECEIVE";
+    ev.stream_id = ctx->stream_id;
+    ev.early_data = has_fin ? ctx->early_data : 0;
+    ev.stream = ctx->stream;
+    ev.token = ctx->token;
+    ev.accepted = accepted;
+    ev.data = NULL;
+    ev.data_len = sizeof(uint64_t) + (size_t)accepted;
+
+    uint32_t count = 0;
+    uint64_t covered = 0;
+    while (count < event->RECEIVE.BufferCount && covered < accepted) {
+        covered += event->RECEIVE.Buffers[count].Length;
+        count++;
+    }
+    ev.buffer_count = count;
+    if (count <= EVENT_INLINE_BUFFERS) {
+        ev.buffers = ev.inline_buffers;
+    } else {
+        ev.buffers = malloc(count * sizeof(QUIC_BUFFER));
+        if (!ev.buffers) goto failed;
+    }
+    memcpy(ev.buffers, event->RECEIVE.Buffers, count * sizeof(QUIC_BUFFER));
+
+    if (!event_queue_push(&ev)) {
+        if (ev.buffers != ev.inline_buffers) free(ev.buffers);
+        goto failed;
+    }
+    if (has_fin) ctx->fin_delivered = 1;
+    return QUIC_STATUS_PENDING;
+
+failed:
+    // Last resort: a receive we could not hand to Ruby is data the stream can
+    // never deliver in order, so the stream ends here.
+    fprintf(stderr, "Quicsilver: receive delivery failed on stream %llu; aborting\n",
+        (unsigned long long)ctx->stream_id);
+    STATE_LOCK();
+    ctx->receive_delivery_failed = 1;
+    ctx->receive_credit = 0;
+    STATE_UNLOCK();
+    // Already in a native callback; inline abort avoids allocating a queued
+    // operation on this failure path. It may retire ctx before returning.
+    MsQuic->StreamShutdown(ctx->stream, ctx->abort_flags | QUIC_STREAM_SHUTDOWN_FLAG_INLINE, 0);
+    event->RECEIVE.TotalBufferLength = 0;
+    return QUIC_STATUS_SUCCESS;
 }
 
 // Platform I/O wait — called without GVL so other Ruby threads can run
@@ -174,11 +745,13 @@ eventq_wait_nogvl(void* arg)
     struct poll_args* a = (struct poll_args*)arg;
 #if __linux__
     a->count = epoll_wait(a->eq, a->events, a->max_events, a->timeout_ms);
+    if (a->count < 0 && errno == EINTR) a->count = 0;
 #elif __APPLE__ || __FreeBSD__
     struct timespec ts;
     ts.tv_sec = a->timeout_ms / 1000;
     ts.tv_nsec = (a->timeout_ms % 1000) * 1000000;
     a->count = kevent(a->eq, NULL, 0, a->events, a->max_events, &ts);
+    if (a->count < 0 && errno == EINTR) a->count = 0;
 #endif
     return NULL;
 }
@@ -195,81 +768,237 @@ cqe_get_sqe(QUIC_CQE* cqe)
 
 // Drive MsQuic execution: poll internal timers, wait for I/O, fire completions.
 // Callbacks (StreamCallback, ConnectionCallback) fire HERE on the Ruby thread.
-static VALUE
-quicsilver_poll(VALUE self)
+// One iteration of the MsQuic loop, with the GVL released for all of it.
+//
+// Before, only the kevent/epoll_wait sleep released the GVL; ExecutionPoll and
+// the completion callbacks, which is where MsQuic decrypts packets, runs loss
+// recovery and reassembles streams, ran with it held, because the callbacks
+// called into Ruby. They no longer do, so none of this needs the lock, and
+// the dispatcher and worker threads run in parallel with the datapath.
+static void*
+poll_nogvl(void* arg)
 {
-    if (ExecContext == NULL) return INT2NUM(0);
+    struct poll_args* a = (struct poll_args*)arg;
 
-    // 1. ExecutionPoll — process MsQuic timers/state, may fire callbacks (has GVL)
     uint32_t wait_ms = MsQuic->ExecutionPoll(ExecContext);
-
-    // 2. Wait for I/O completions (releases GVL)
-    struct poll_args args;
-    args.eq = EventQ;
-    args.max_events = 64;
     // With wake_event_loop(), Ruby threads instantly unblock us when work is
     // queued. Cap at 1s as a safety net for shutdown responsiveness.
-    uint32_t actual_wait = (wait_ms == UINT32_MAX) ? 1000 : wait_ms;
-    args.timeout_ms = (int)actual_wait;
-    args.count = 0;
+    a->timeout_ms = (int)((wait_ms == UINT32_MAX) ? 1000 : wait_ms);
+    a->count = 0;
+    eventq_wait_nogvl(a);
 
-    rb_thread_call_without_gvl(eventq_wait_nogvl, &args, RUBY_UBF_IO, NULL);
-
-    // 3. Fire completions — MsQuic callbacks run here (has GVL)
-    for (int i = 0; i < args.count; i++) {
+    for (int i = 0; i < a->count; i++) {
 #if __linux__
-        if (args.events[i].data.ptr == NULL) {
+        if (a->events[i].data.ptr == NULL) {
             uint64_t val;
             read(WakeFd, &val, sizeof(val));  // drain eventfd
             continue;
         }
 #elif __APPLE__ || __FreeBSD__
-        if (args.events[i].filter == EVFILT_USER && args.events[i].ident == WAKE_IDENT) continue;
+        if (a->events[i].filter == EVFILT_USER && a->events[i].ident == WAKE_IDENT) continue;
 #endif
-        QUIC_SQE* sqe = cqe_get_sqe(&args.events[i]);
+        QUIC_SQE* sqe = cqe_get_sqe(&a->events[i]);
         if (sqe && sqe->Completion) {
-            sqe->Completion(&args.events[i]);
+            sqe->Completion(&a->events[i]);
         }
     }
+    return NULL;
+}
+
+static VALUE
+quicsilver_poll(VALUE self)
+{
+    if (ExecContext == NULL) return INT2NUM(0);
 
+    struct poll_args args;
+    args.eq = EventQ;
+    args.max_events = 64;
+    rb_thread_call_without_gvl(poll_nogvl, &args, RUBY_UBF_IO, NULL);
     return INT2NUM(args.count);
 }
 
-// Inline poll for use during synchronous waits (e.g. wait_for_connection).
-// Short non-blocking poll — keeps MsQuic alive while we spin.
+// --- Dispatcher side ---------------------------------------------------------
+
+// Upper bound on events per dispatch_events call, and the size of the batch
+// copied out under the queue lock. Fixed rather than caller-sized so the
+// stack frame is known.
+#define DISPATCH_BATCH_MAX 64
+
+struct queue_wait_args {
+    int timeout_ms;
+};
+
+static void*
+queue_wait_nogvl(void* arg)
+{
+    struct queue_wait_args* a = (struct queue_wait_args*)arg;
+    struct timespec deadline;
+    clock_gettime(CLOCK_REALTIME, &deadline);
+    deadline.tv_sec += a->timeout_ms / 1000;
+    deadline.tv_nsec += (long)(a->timeout_ms % 1000) * 1000000L;
+    if (deadline.tv_nsec >= 1000000000L) { deadline.tv_sec++; deadline.tv_nsec -= 1000000000L; }
+
+    pthread_mutex_lock(&EventQueue.lock);
+    while (EventQueue.len == 0 && !EventQueue.closed) {
+        if (pthread_cond_timedwait(&EventQueue.ready, &EventQueue.lock, &deadline) == ETIMEDOUT) break;
+    }
+    pthread_mutex_unlock(&EventQueue.lock);
+    return NULL;
+}
+
+// Thread#raise / Thread#kill against a dispatcher blocked in the wait.
 static void
-poll_inline(int timeout_ms)
+queue_wake_ubf(void* arg)
 {
-    if (ExecContext == NULL) return;
+    (void)arg;
+    pthread_mutex_lock(&EventQueue.lock);
+    pthread_cond_broadcast(&EventQueue.ready);
+    pthread_mutex_unlock(&EventQueue.lock);
+}
 
-    MsQuic->ExecutionPoll(ExecContext);
+// What a callback used to do after dispatch, done here with the GVL held.
+static void
+perform_release(RubyEvent* ev)
+{
+    switch (ev->release) {
+    case RELEASE_NONE:
+        break;
+    case RELEASE_SEND:
+        send_context_release(ev->release_ptr);
+        break;
+    case RELEASE_STREAM:
+    case RELEASE_STREAM_NOCLOSE: {
+        StreamContext* ctx = (StreamContext*)ev->release_ptr;
+        unregister_stream(ctx->token);
+        if (ev->release == RELEASE_STREAM) MsQuic->StreamClose(ctx->stream);
+        free(ctx);
+        break;
+    }
+    case RELEASE_CONNECTION: {
+        ConnectionContext* ctx = (ConnectionContext*)ev->release_ptr;
+        forget_connection_streams(ev->connection);
+        if (!NIL_P(ctx->client_obj)) rb_gc_unregister_address(&ctx->client_obj);
+        free(ctx->resumption_ticket);
+        free(ctx);
+        break;
+    }
+    }
+}
 
-    QUIC_CQE events[8];
-#if __linux__
-    int count = epoll_wait(EventQ, events, 8, timeout_ms);
-#elif __APPLE__ || __FreeBSD__
-    struct timespec ts;
-    ts.tv_sec = timeout_ms / 1000;
-    ts.tv_nsec = (timeout_ms % 1000) * 1000000;
-    int count = kevent(EventQ, NULL, 0, events, 8, &ts);
-#endif
-    for (int i = 0; i < count; i++) {
-#if __linux__
-        if (events[i].data.ptr == NULL) {
-            uint64_t val;
-            read(WakeFd, &val, sizeof(val));  // drain eventfd
-            continue;
+// A handler that raised on RECEIVE has broken the stream's byte order for
+// good, so the stream is aborted, as the callback used to do inline.
+static void
+abort_after_failed_receive(RubyEvent* ev)
+{
+    if (strncmp(ev->event_type, "RECEIVE", 7) != 0) return;
+    uint64_t token = ev->token;
+    StreamContext* ctx = find_stream(token);
+    if (!ctx) return;
+    STATE_LOCK();
+    ctx->receive_delivery_failed = 1;
+    ctx->receive_credit = 0;
+    STATE_UNLOCK();
+    MsQuic->StreamShutdown(ctx->stream, ctx->abort_flags, 0);
+    wake_event_loop();
+}
+
+// Wait up to timeout_ms for events, then deliver up to max_events of them to
+// Ruby. Returns the number delivered, or nil once the queue is closed and
+// empty, which is the dispatcher's signal to exit.
+static VALUE
+quicsilver_dispatch_events(VALUE self, VALUE max_events, VALUE timeout_ms)
+{
+    long max = NUM2LONG(max_events);
+    if (max < 1) max = 1;
+    if (max > DISPATCH_BATCH_MAX) max = DISPATCH_BATCH_MAX;
+    struct queue_wait_args wait = { NUM2INT(timeout_ms) };
+    rb_thread_call_without_gvl(queue_wait_nogvl, &wait, queue_wake_ubf, NULL);
+
+    RubyEvent batch[DISPATCH_BATCH_MAX];
+    long n = 0;
+    int closed;
+    pthread_mutex_lock(&EventQueue.lock);
+    closed = EventQueue.closed;
+    while (n < max && EventQueue.len > 0) {
+        RubyEvent* ev = &EventQueue.buf[EventQueue.head];
+        if (!ev->dropped && ev->connection_ctx && strcmp(ev->event_type, "DATAGRAM_RECEIVED") == 0) {
+            ((ConnectionContext*)ev->connection_ctx)->queued_datagrams--;
         }
-#elif __APPLE__ || __FreeBSD__
-        if (events[i].filter == EVFILT_USER && events[i].ident == WAKE_IDENT) continue;
-#endif
-        QUIC_SQE* sqe = cqe_get_sqe(&events[i]);
-        if (sqe && sqe->Completion) {
-            sqe->Completion(&events[i]);
+        batch[n] = *ev;
+        if (ev->buffers == ev->inline_buffers) batch[n].buffers = batch[n].inline_buffers;
+        n++;
+        EventQueue.head = (EventQueue.head + 1) % EventQueue.cap;
+        EventQueue.len--;
+    }
+    pthread_mutex_unlock(&EventQueue.lock);
+
+    for (long i = 0; i < n; i++) {
+        RubyEvent* ev = &batch[i];
+        if (ev->dropped) { free(ev->data); continue; }
+        const char* data = ev->data ? ev->data : ev->inline_data;
+        VALUE payload = Qundef;
+        if (ev->buffers) {
+            // Complete before the handler runs. A partial completion pauses
+            // the stream; a grant from the handler queues the resume; the
+            // pause must be queued first.
+            struct dispatch_ruby_args gather = { .buffers = ev->buffers,
+                .buffer_count = ev->buffer_count, .token = ev->token, .accepted = ev->accepted };
+            int gather_state = 0;
+            payload = rb_protect(gather_receive_protected, (VALUE)&gather, &gather_state);
+            if (gather_state) { rb_set_errinfo(Qnil); payload = Qundef; }
+            if (MsQuic) MsQuic->StreamReceiveComplete(ev->stream, ev->accepted);
+            if (ev->buffers != ev->inline_buffers) free(ev->buffers);
+            if (payload == Qundef) { abort_after_failed_receive(ev); perform_release(ev); continue; }
         }
+        int state = dispatch_to_ruby(ev->connection, ev->connection_ctx, ev->client_obj,
+            ev->event_type, ev->stream_id, data, ev->data_len, ev->early_data, payload);
+        if (state) abort_after_failed_receive(ev);
+        perform_release(ev);
+        free(ev->data);
     }
+
+    if (n == 0 && closed) return Qnil;
+    // The dispatcher does not yield here. Workers get the GVL when the
+    // server's admission queue is under pressure (Server#enqueue_work), which
+    // is the only reason to interrupt a batch; an unconditional yield per
+    // batch cost throughput and doubled tail latency for nothing.
+    return LONG2NUM(n);
+}
+
+// Datagrams dropped because the dispatcher was behind (DATAGRAM_QUEUE_LIMIT).
+// A drop counter nobody can read is a drop debugged by guessing.
+static VALUE
+quicsilver_dropped_datagrams(VALUE self)
+{
+    pthread_mutex_lock(&EventQueue.lock);
+    uint64_t dropped = DroppedDatagrams;
+    pthread_mutex_unlock(&EventQueue.lock);
+    return ULL2NUM(dropped);
 }
 
+
+static VALUE
+quicsilver_open_event_queue(VALUE self)
+{
+    pthread_mutex_lock(&EventQueue.lock);
+    EventQueue.closed = 0;
+    pthread_mutex_unlock(&EventQueue.lock);
+    return Qnil;
+}
+
+// Stops the dispatcher once it has drained what is already queued. Call after
+// the poll thread has stopped, so nothing is pushed afterwards.
+static VALUE
+quicsilver_close_event_queue(VALUE self)
+{
+    pthread_mutex_lock(&EventQueue.lock);
+    EventQueue.closed = 1;
+    pthread_cond_broadcast(&EventQueue.ready);
+    pthread_mutex_unlock(&EventQueue.lock);
+    return Qnil;
+}
+
+
 QUIC_STATUS
 StreamCallback(HQUIC Stream, void* Context, QUIC_STREAM_EVENT* Event)
 {
@@ -279,119 +1008,124 @@ StreamCallback(HQUIC Stream, void* Context, QUIC_STREAM_EVENT* Event)
         return QUIC_STATUS_SUCCESS;
     }
 
-    // Apply pending priority on the event loop thread (safe context for SetParam)
-    for (int i = 0; i < PendingPriorityCount; i++) {
-        if (PendingPriorities[i].stream == Stream) {
-            uint16_t priority = PendingPriorities[i].priority_plus_one - 1;
-            // Remove by swapping with last
-            PendingPriorities[i] = PendingPriorities[--PendingPriorityCount];
-            MsQuic->SetParam(Stream, QUIC_PARAM_STREAM_PRIORITY, sizeof(priority), &priority);
-            break;
-        }
+    uint64_t token = ctx->token;
+
+    // Lazily cache the QUIC stream ID on first callback.
+    // Can't do this at StreamStart — MsQuic defers ID assignment with FLAG_NONE
+    // until data is sent. By the first callback the ID is always assigned.
+    if (ctx->stream_id == UINT64_MAX) {
+        uint64_t id = UINT64_MAX;
+        uint32_t id_len = sizeof(id);
+        MsQuic->GetParam(Stream, QUIC_PARAM_STREAM_ID, &id_len, &id);
+        STATE_LOCK();
+        ctx->stream_id = id;
+        STATE_UNLOCK();
+    }
+
+    // MsQuic requires SetParam on its event thread.
+    uint32_t pending = __atomic_exchange_n(&ctx->pending_priority, 0, __ATOMIC_ACQ_REL);
+    if (pending) {
+        uint16_t priority = (uint16_t)(pending - 1);
+        MsQuic->SetParam(Stream, QUIC_PARAM_STREAM_PRIORITY, sizeof(priority), &priority);
     }
 
     switch (Event->Type) {
         case QUIC_STREAM_EVENT_RECEIVE: {
-            int has_fin = (Event->RECEIVE.Flags & QUIC_RECEIVE_FLAG_FIN) != 0;
-
             // Track 0-RTT early data for replay protection
             if (Event->RECEIVE.Flags & QUIC_RECEIVE_FLAG_0_RTT) {
                 ctx->early_data = 1;
             }
 
-            if (Event->RECEIVE.BufferCount == 0 && has_fin) {
-                // Empty FIN — headers-only request/response with no body
-                uint64_t stream_id = 0;
-                uint32_t stream_id_len = sizeof(stream_id);
-                MsQuic->GetParam(Stream, QUIC_PARAM_STREAM_ID, &stream_id_len, &stream_id);
-
-                dispatch_to_ruby(ctx->connection, ctx->connection_ctx, ctx->client_obj,
-                    "RECEIVE_FIN", stream_id, (const char*)&Stream, sizeof(HQUIC), ctx->early_data);
-                break;
-            }
-
-            if (Event->RECEIVE.BufferCount > 0) {
-                const char* event_type = has_fin ? "RECEIVE_FIN" : "RECEIVE";
-
-                uint64_t stream_id = 0;
-                uint32_t stream_id_len = sizeof(stream_id);
-                MsQuic->GetParam(Stream, QUIC_PARAM_STREAM_ID, &stream_id_len, &stream_id);
-
-                size_t total_data_len = 0;
-                for (uint32_t b = 0; b < Event->RECEIVE.BufferCount; b++) {
-                    total_data_len += Event->RECEIVE.Buffers[b].Length;
-                }
-
-                if (Event->RECEIVE.Flags & QUIC_RECEIVE_FLAG_FIN) {
-                    // Create combined buffer: [stream_handle(8)][all data]
-                    size_t total_len = sizeof(HQUIC) + total_data_len;
-                    char* combined = (char*)malloc(total_len);
-                    if (combined != NULL) {
-                        memcpy(combined, &Stream, sizeof(HQUIC));
-                        size_t offset = sizeof(HQUIC);
-                        for (uint32_t b = 0; b < Event->RECEIVE.BufferCount; b++) {
-                            memcpy(combined + offset, Event->RECEIVE.Buffers[b].Buffer, Event->RECEIVE.Buffers[b].Length);
-                            offset += Event->RECEIVE.Buffers[b].Length;
-                        }
-                        dispatch_to_ruby(ctx->connection, ctx->connection_ctx, ctx->client_obj, event_type, stream_id, combined, total_len, ctx->early_data);
-                        free(combined);
-                    }
-                } else if (Event->RECEIVE.BufferCount == 1) {
-                    dispatch_to_ruby(ctx->connection, ctx->connection_ctx, ctx->client_obj, event_type, stream_id,
-                        (const char*)Event->RECEIVE.Buffers[0].Buffer, Event->RECEIVE.Buffers[0].Length, 0);
-                } else {
-                    char* combined = (char*)malloc(total_data_len);
-                    if (combined != NULL) {
-                        size_t offset = 0;
-                        for (uint32_t b = 0; b < Event->RECEIVE.BufferCount; b++) {
-                            memcpy(combined + offset, Event->RECEIVE.Buffers[b].Buffer, Event->RECEIVE.Buffers[b].Length);
-                            offset += Event->RECEIVE.Buffers[b].Length;
-                        }
-                        dispatch_to_ruby(ctx->connection, ctx->connection_ctx, ctx->client_obj, event_type, stream_id, combined, total_data_len, 0);
-                        free(combined);
-                    }
-                }
-            }
-            break;
+            return receive_with_credit(ctx, Event);
         }
         case QUIC_STREAM_EVENT_SEND_COMPLETE:
-            // Free the send buffer that was allocated in quicsilver_send_stream
-            if (Event->SEND_COMPLETE.ClientContext != NULL) {
-                free(Event->SEND_COMPLETE.ClientContext);
+            // The retained String is dropped on the dispatcher, after Ruby has
+            // seen the event; LiveSends is only ever touched under the GVL.
+            if (!queue_event_full(ctx->connection, ctx->connection_ctx, ctx->client_obj,
+                    "SEND_COMPLETE", ctx->stream_id, (const char*)&token, sizeof(token), 0,
+                    NULL, RELEASE_SEND, Event->SEND_COMPLETE.ClientContext)) {
+                // Out of memory. LiveSends is only touched under the GVL, so the
+                // SendContext and the String it pins leak rather than race GC.
+                fprintf(stderr, "Quicsilver: event queue allocation failed; leaking one send buffer\n");
             }
             break;
         case QUIC_STREAM_EVENT_SHUTDOWN_COMPLETE:
-            ctx->shutdown = 1;
-            free(ctx);
+            // Nothing is torn down here. The stream stays in LiveStreams, and
+            // its handle stays open, until the dispatcher has delivered this
+            // event: Ruby may still be handling an earlier RECEIVE for it (a
+            // uni stream with FIN completes natively before Ruby sees its
+            // data) and must be able to address it. MsQuic returns an error
+            // for operations on a shut-down handle, so that is safe. The
+            // dispatcher unregisters, closes and frees, holding the GVL, which
+            // is what any Ruby thread that found ctx also holds.
+            __atomic_store_n(&ctx->shutdown, 1, __ATOMIC_RELEASE);
             MsQuic->SetCallbackHandler(Stream, (void*)StreamCallback, NULL);
-            if (Event->SHUTDOWN_COMPLETE.AppCloseInProgress == FALSE) {
-                MsQuic->StreamClose(Stream);
+            if (!queue_event_full(ctx->connection, ctx->connection_ctx, ctx->client_obj,
+                    "STREAM_SHUTDOWN_COMPLETE", ctx->stream_id, (const char*)&token, sizeof(token), 0,
+                    NULL, Event->SHUTDOWN_COMPLETE.AppCloseInProgress ? RELEASE_STREAM_NOCLOSE : RELEASE_STREAM, ctx)) {
+                // Out of memory. The context is not freed here: contexts are
+                // freed only on a thread holding the GVL, so that a Ruby thread
+                // between find_stream and its MsQuic call cannot have the
+                // pointer freed underneath it, and this thread never holds the
+                // GVL. Unregistering only stops future lookups. One context and
+                // one handle leak on an allocation failure that is already a
+                // terminal condition; the invariant stays whole.
+                fprintf(stderr, "Quicsilver: event queue allocation failed; leaking stream %llu\n",
+                    (unsigned long long)ctx->stream_id);
+                unregister_stream(token);
             }
             break;
+        case QUIC_STREAM_EVENT_START_COMPLETE: {
+            // Pack [stream_handle(8)][peer_accepted(1)] for Ruby
+            uint8_t accepted = Event->START_COMPLETE.PeerAccepted ? 1 : 0;
+            char payload[sizeof(token) + 1];
+            memcpy(payload, &token, sizeof(token));
+            payload[sizeof(token)] = accepted;
+            queue_event(ctx->connection, ctx->connection_ctx, ctx->client_obj,
+                "STREAM_START_COMPLETE", ctx->stream_id, payload, sizeof(payload), 0);
+            break;
+        }
+        case QUIC_STREAM_EVENT_PEER_ACCEPTED:
+            // Queued stream now accepted — peer raised MAX_STREAMS
+            queue_event(ctx->connection, ctx->connection_ctx, ctx->client_obj,
+                "STREAM_PEER_ACCEPTED", ctx->stream_id, (const char*)&token, sizeof(token), 0);
+            break;
         case QUIC_STREAM_EVENT_PEER_SEND_SHUTDOWN:
+            // If the FIN arrived while a receive was pending, MsQuic reports it
+            // only here, never as a zero-length RECEIVE. Ruby expects RECEIVE_FIN.
+            if (!ctx->fin_delivered && !ctx->receive_delivery_failed) {
+                ctx->fin_delivered = 1;
+                queue_event(ctx->connection, ctx->connection_ctx, ctx->client_obj,
+                    "RECEIVE_FIN", ctx->stream_id, (const char*)&token, sizeof(token), ctx->early_data);
+            }
             break;
         case QUIC_STREAM_EVENT_PEER_SEND_ABORTED: {
-            // Peer sent RESET_STREAM — pack [stream_handle(8)][error_code(8)]
-            uint64_t stream_id = 0;
-            uint32_t stream_id_len = sizeof(stream_id);
-            MsQuic->GetParam(Stream, QUIC_PARAM_STREAM_ID, &stream_id_len, &stream_id);
+            // Peer sent RESET_STREAM — pack
+            // [stream_handle(8)][error_code(8)][final_size(8)]
+            //
+            // RESET_STREAM carries the stream's final size, and WebTransport
+            // session accounting needs it: without it the two endpoints
+            // disagree about how much credit a reset stream consumed
+            // (draft-ietf-webtrans-http3-16 5.4, RFC 9000 4.5).
             uint64_t error_code = Event->PEER_SEND_ABORTED.ErrorCode;
-            char combined[sizeof(HQUIC) + sizeof(uint64_t)];
-            memcpy(combined, &Stream, sizeof(HQUIC));
-            memcpy(combined + sizeof(HQUIC), &error_code, sizeof(uint64_t));
-            dispatch_to_ruby(ctx->connection, ctx->connection_ctx, ctx->client_obj, "STREAM_RESET", stream_id, combined, sizeof(combined), 0);
+            // Read straight off the event: calling back into the MsQuic API
+            // from inside a callback risks re-entering locks the callback
+            // already holds.
+            uint64_t final_size = Event->PEER_SEND_ABORTED.FinalSize;
+            char combined[sizeof(token) + sizeof(uint64_t) + sizeof(uint64_t)];
+            memcpy(combined, &token, sizeof(token));
+            memcpy(combined + sizeof(token), &error_code, sizeof(uint64_t));
+            memcpy(combined + sizeof(token) + sizeof(uint64_t), &final_size, sizeof(uint64_t));
+            queue_event(ctx->connection, ctx->connection_ctx, ctx->client_obj, "STREAM_RESET", ctx->stream_id, combined, sizeof(combined), 0);
             break;
         }
         case QUIC_STREAM_EVENT_PEER_RECEIVE_ABORTED: {
             // Peer sent STOP_SENDING — pack [stream_handle(8)][error_code(8)]
-            uint64_t stream_id = 0;
-            uint32_t stream_id_len = sizeof(stream_id);
-            MsQuic->GetParam(Stream, QUIC_PARAM_STREAM_ID, &stream_id_len, &stream_id);
             uint64_t error_code = Event->PEER_RECEIVE_ABORTED.ErrorCode;
-            char combined[sizeof(HQUIC) + sizeof(uint64_t)];
-            memcpy(combined, &Stream, sizeof(HQUIC));
-            memcpy(combined + sizeof(HQUIC), &error_code, sizeof(uint64_t));
-            dispatch_to_ruby(ctx->connection, ctx->connection_ctx, ctx->client_obj, "STOP_SENDING", stream_id, combined, sizeof(combined), 0);
+            char combined[sizeof(token) + sizeof(uint64_t)];
+            memcpy(combined, &token, sizeof(token));
+            memcpy(combined + sizeof(token), &error_code, sizeof(uint64_t));
+            queue_event(ctx->connection, ctx->connection_ctx, ctx->client_obj, "STOP_SENDING", ctx->stream_id, combined, sizeof(combined), 0);
             break;
         }
     }
@@ -412,11 +1146,30 @@ ConnectionCallback(HQUIC Connection, void* Context, QUIC_CONNECTION_EVENT* Event
     }
     
     switch (Event->Type) {
+        case QUIC_CONNECTION_EVENT_RELIABLE_RESET_NEGOTIATED:
+            ctx->reliable_reset_negotiated = Event->RELIABLE_RESET_NEGOTIATED.IsNegotiated;
+            break;
         case QUIC_CONNECTION_EVENT_CONNECTED:
             ctx->connected = 1;
             ctx->failed = 0;
+            ctx->session_resumed = Event->CONNECTED.SessionResumed;
+            // Server: send resumption ticket so client can do 0-RTT on reconnect
+            if (NIL_P(ctx->client_obj)) {
+                MsQuic->ConnectionSendResumptionTicket(Connection, QUIC_SEND_RESUMPTION_FLAG_NONE, 0, NULL);
+            }
             // Notify Ruby about new connection - pass ctx pointer for building connection_data
-            dispatch_to_ruby(Connection, ctx, ctx->client_obj, "CONNECTION_ESTABLISHED", 0, (const char*)&Connection, sizeof(HQUIC), 0);
+            queue_event(Connection, ctx, ctx->client_obj, "CONNECTION_ESTABLISHED", 0, (const char*)&Connection, sizeof(HQUIC), 0);
+            break;
+        case QUIC_CONNECTION_EVENT_RESUMPTION_TICKET_RECEIVED:
+            // Client-only: store the ticket for future 0-RTT reconnection
+            if (ctx->resumption_ticket) {
+                free(ctx->resumption_ticket);
+            }
+            ctx->resumption_ticket_length = Event->RESUMPTION_TICKET_RECEIVED.ResumptionTicketLength;
+            ctx->resumption_ticket = (uint8_t*)malloc(ctx->resumption_ticket_length);
+            if (ctx->resumption_ticket) {
+                memcpy(ctx->resumption_ticket, Event->RESUMPTION_TICKET_RECEIVED.ResumptionTicket, ctx->resumption_ticket_length);
+            }
             break;
         case QUIC_CONNECTION_EVENT_SHUTDOWN_INITIATED_BY_TRANSPORT:
             ctx->connected = 0;
@@ -432,13 +1185,17 @@ ConnectionCallback(HQUIC Connection, void* Context, QUIC_CONNECTION_EVENT* Event
             break;
         case QUIC_CONNECTION_EVENT_SHUTDOWN_COMPLETE:
             ctx->connected = 0;
-            dispatch_to_ruby(Connection, ctx, ctx->client_obj, "CONNECTION_CLOSED", 0, (const char*)&Connection, sizeof(HQUIC), 0);
-            // Free context for all connections (both client and server).
-            // Client GC registration must be removed before freeing.
-            if (!NIL_P(ctx->client_obj)) {
-                rb_gc_unregister_address(&ctx->client_obj);
+            // Freed on the dispatcher after Ruby has seen CONNECTION_CLOSED:
+            // rb_gc_unregister_address needs the GVL, and Ruby may still hold
+            // the context pointer as a handle until it processes this event.
+            if (!queue_event_full(Connection, ctx, ctx->client_obj, "CONNECTION_CLOSED", 0,
+                    (const char*)&Connection, sizeof(HQUIC), 0, NULL, RELEASE_CONNECTION, ctx)) {
+                // Out of memory, and the release needs the GVL
+                // (rb_gc_unregister_address), which this thread never holds.
+                // Leaking one small context is the safe failure: freeing it
+                // would leave a GC root pointing at freed memory.
+                fprintf(stderr, "Quicsilver: event queue allocation failed; leaking connection context\n");
             }
-            free(ctx);
             break;
          case QUIC_CONNECTION_EVENT_PEER_STREAM_STARTED:
             // Client opened a stream
@@ -450,15 +1207,40 @@ ConnectionCallback(HQUIC Connection, void* Context, QUIC_CONNECTION_EVENT* Event
                 stream_ctx->client_obj = ctx->client_obj;  // Copy from connection context
                 stream_ctx->started = 1;
                 stream_ctx->shutdown = 0;
+                stream_ctx->stream_id = UINT64_MAX;  // Lazily resolved on first callback
                 stream_ctx->early_data = 0;
                 stream_ctx->error_status = QUIC_STATUS_SUCCESS;
 
+                register_stream(stream_ctx, Stream,
+                    Event->PEER_STREAM_STARTED.Flags & QUIC_STREAM_OPEN_FLAG_UNIDIRECTIONAL
+                        ? QUIC_STREAM_SHUTDOWN_FLAG_ABORT_RECEIVE
+                        : QUIC_STREAM_SHUTDOWN_FLAG_ABORT);
+
                 // Set the stream callback handler to handle data events
                 MsQuic->SetCallbackHandler(Stream, (void*)StreamCallback, stream_ctx);
             } else {
                 MsQuic->StreamClose(Stream);
             }
          break; 
+        case QUIC_CONNECTION_EVENT_DATAGRAM_RECEIVED:
+            // Bounded by DATAGRAM_QUEUE_LIMIT inside queue_event_full; past it
+            // the datagram is dropped and counted. Datagrams are best-effort by
+            // definition (RFC 9221), so that is a legitimate response to a
+            // dispatcher that has fallen behind.
+            queue_event(Connection, ctx, ctx->client_obj, "DATAGRAM_RECEIVED", 0,
+                (const char*)Event->DATAGRAM_RECEIVED.Buffer->Buffer,
+                Event->DATAGRAM_RECEIVED.Buffer->Length, 0);
+            break;
+        case QUIC_CONNECTION_EVENT_DATAGRAM_STATE_CHANGED:
+            break;
+        case QUIC_CONNECTION_EVENT_DATAGRAM_SEND_STATE_CHANGED:
+            // Free the send buffer when the datagram reaches a final state
+            if (QUIC_DATAGRAM_SEND_STATE_IS_FINAL(Event->DATAGRAM_SEND_STATE_CHANGED.State)) {
+                if (Event->DATAGRAM_SEND_STATE_CHANGED.ClientContext != NULL) {
+                    free(Event->DATAGRAM_SEND_STATE_CHANGED.ClientContext);
+                }
+            }
+            break;
         default:
             break;
     }
@@ -487,6 +1269,14 @@ ListenerCallback(HQUIC Listener, void* Context, QUIC_LISTENER_EVENT* Event)
                 conn_ctx->error_status = QUIC_STATUS_SUCCESS;
                 conn_ctx->error_code = 0;
                 conn_ctx->client_obj = Qnil;  // Server connections have no client object
+                conn_ctx->remote_address[0] = '\0';
+                conn_ctx->remote_port = 0;
+                conn_ctx->session_resumed = 0;
+                conn_ctx->reliable_reset_negotiated = 0;
+                conn_ctx->resumption_ticket = NULL;
+                conn_ctx->queued_datagrams = 0;
+                conn_ctx->dropped_datagrams = 0;
+                conn_ctx->resumption_ticket_length = 0;
 
                 // Set the connection callback
                 MsQuic->SetCallbackHandler(Event->NEW_CONNECTION.Connection, (void*)ConnectionCallback, conn_ctx);
@@ -522,12 +1312,12 @@ quicsilver_open(VALUE self)
     QUIC_STATUS Status;
     
     // Check if already initialized
-    if (MsQuic != NULL) {
+    if (MsQuic != NULL && Registration != NULL) {
         return Qtrue;
     }
     
     // Open a handle to the library and get the API function table
-    if (QUIC_FAILED(Status = MsQuicOpenVersion(2, (const void**)&MsQuic))) {
+    if (MsQuic == NULL && QUIC_FAILED(Status = MsQuicOpenVersion(2, (const void**)&MsQuic))) {
         rb_raise(rb_eRuntimeError, "MsQuicOpenVersion failed, 0x%x!", Status);
         return Qfalse;
     }
@@ -547,10 +1337,28 @@ quicsilver_open(VALUE self)
         return Qfalse;
     }
 
+    // PollingIdleTimeoutUs: how long MsQuic keeps spinning on an idle
+    // execution context before it lets us sleep in kevent/epoll_wait. At zero
+    // every idle gap is a full sleep-and-wake, which is the fixed latency floor
+    // at low concurrency. A short spin trades CPU for that latency.
+    // QUICSILVER_POLL_IDLE_US overrides for measurement; the default stays 0
+    // until the trade is measured.
+    uint32_t polling_idle_us = 0;
+    const char* idle_env = getenv("QUICSILVER_POLL_IDLE_US");
+    if (idle_env && *idle_env) polling_idle_us = (uint32_t)strtoul(idle_env, NULL, 10);
+
+    // One execution context. The receive path's correctness argument depends
+    // on it: receive_with_credit sets receive_paused and returns a partial
+    // length, and a grant from a Ruby thread calls StreamReceiveSetEnabled,
+    // which MsQuic applies as a queued operation on the connection's worker.
+    // With one context that worker is this ExecutionPoll, so the resume
+    // always runs after the callback that paused. With more than one context
+    // a connection still has exactly one worker, so the argument holds per
+    // connection, but revisit it before changing this.
     QUIC_EXECUTION_CONFIG exec_config = { 0, &EventQ };
     Status = MsQuic->ExecutionCreate(
         QUIC_GLOBAL_EXECUTION_CONFIG_FLAG_NONE,
-        0,      // PollingIdleTimeoutUs
+        polling_idle_us,
         1,      // 1 execution context
         &exec_config,
         &ExecContext
@@ -597,8 +1405,15 @@ quicsilver_open(VALUE self)
 
 // Create a QUIC configuration (for client connections)
 static VALUE
-quicsilver_create_configuration(VALUE self, VALUE unsecure)
+quicsilver_create_configuration(int argc, VALUE *argv, VALUE self)
 {
+    VALUE unsecure, datagram_receive_enabled, reliable_reset_enabled, incoming_bidi, incoming_uni,
+        idle_timeout_ms;
+    rb_scan_args(argc, argv, "15", &unsecure, &datagram_receive_enabled,
+        &reliable_reset_enabled, &incoming_bidi, &incoming_uni, &idle_timeout_ms);
+    if (argc < 2) datagram_receive_enabled = Qtrue;
+    if (argc < 3) reliable_reset_enabled = Qtrue;
+
     if (MsQuic == NULL) {
         rb_raise(rb_eRuntimeError, "MSQUIC not initialized. Call Quicsilver.open_connection first.");
         return Qnil;
@@ -609,8 +1424,30 @@ quicsilver_create_configuration(VALUE self, VALUE unsecure)
     
     // Basic settings
     QUIC_SETTINGS Settings = {0};
-    Settings.IdleTimeoutMs = 10000; // 10 second idle timeout to match server
-    Settings.IsSet.IdleTimeoutMs = TRUE;
+    Settings.ReliableResetEnabled = RTEST(reliable_reset_enabled);
+    Settings.IsSet.ReliableResetEnabled = TRUE;
+    // The peer advertises its own idle timeout and the lower of the two applies.
+    if (!NIL_P(idle_timeout_ms)) {
+        Settings.IdleTimeoutMs = NUM2ULL(idle_timeout_ms);
+        Settings.IsSet.IdleTimeoutMs = TRUE;
+    }
+    Settings.DatagramReceiveEnabled = RTEST(datagram_receive_enabled);
+    Settings.IsSet.DatagramReceiveEnabled = TRUE;
+
+    // Optional credit for server-initiated streams. Leave native defaults alone
+    // when omitted; the uni limit also covers HTTP/3 control and QPACK streams.
+    if (!NIL_P(incoming_bidi)) {
+        unsigned int count = NUM2UINT(incoming_bidi);
+        if (count > UINT16_MAX) rb_raise(rb_eArgError, "max_incoming_bidi_streams must be between 0 and 65535");
+        Settings.PeerBidiStreamCount = (uint16_t)count;
+        Settings.IsSet.PeerBidiStreamCount = TRUE;
+    }
+    if (!NIL_P(incoming_uni)) {
+        unsigned int count = NUM2UINT(incoming_uni);
+        if (count > UINT16_MAX) rb_raise(rb_eArgError, "max_incoming_uni_streams must be between 0 and 65535");
+        Settings.PeerUnidiStreamCount = (uint16_t)count;
+        Settings.IsSet.PeerUnidiStreamCount = TRUE;
+    }
     
     // Simple ALPN for now - Ruby can customize this later
     QUIC_BUFFER Alpn = { sizeof("h3") - 1, (uint8_t*)"h3" };
@@ -694,6 +1531,8 @@ quicsilver_create_server_configuration(VALUE self, VALUE config_hash)
     uint64_t handshake_idle_timeout_ms = NUM2ULL(handshake_idle_timeout_ms_val);
 
     QUIC_SETTINGS Settings = {0};
+    Settings.ReliableResetEnabled = TRUE;
+    Settings.IsSet.ReliableResetEnabled = TRUE;
     Settings.IdleTimeoutMs = idle_timeout_ms;
     Settings.IsSet.IdleTimeoutMs = TRUE;
     Settings.ServerResumptionLevel = server_resumption_level;
@@ -710,6 +1549,8 @@ quicsilver_create_server_configuration(VALUE self, VALUE config_hash)
     Settings.IsSet.StreamRecvBufferDefault = TRUE;
     Settings.ConnFlowControlWindow = connection_flow_control_window;
     Settings.IsSet.ConnFlowControlWindow = TRUE;
+    Settings.DatagramReceiveEnabled = TRUE;
+    Settings.IsSet.DatagramReceiveEnabled = TRUE;
 
     // Throughput settings
     Settings.PacingEnabled = pacing_enabled;
@@ -752,7 +1593,7 @@ quicsilver_create_server_configuration(VALUE self, VALUE config_hash)
     
     CredConfig.Type = QUIC_CREDENTIAL_TYPE_CERTIFICATE_FILE;
     CredConfig.CertificateFile = &CertFile;
-    CredConfig.Flags = QUIC_CREDENTIAL_FLAG_NO_CERTIFICATE_VALIDATION;
+    CredConfig.Flags = QUIC_CREDENTIAL_FLAG_NONE;
     
     if (QUIC_FAILED(Status = MsQuic->ConfigurationLoadCredential(Configuration, &CredConfig))) {
         MsQuic->ConfigurationClose(Configuration);
@@ -788,6 +1629,14 @@ quicsilver_create_connection(VALUE self, VALUE client_obj)
     ctx->error_status = QUIC_STATUS_SUCCESS;
     ctx->error_code = 0;
     ctx->client_obj = client_obj;  // Store Ruby client object (Qnil for server)
+    ctx->remote_address[0] = '\0';
+    ctx->remote_port = 0;
+    ctx->session_resumed = 0;
+    ctx->reliable_reset_negotiated = 0;
+    ctx->resumption_ticket = NULL;
+    ctx->queued_datagrams = 0;
+    ctx->dropped_datagrams = 0;
+    ctx->resumption_ticket_length = 0;
 
     // Protect from GC if it's a Ruby object
     if (!NIL_P(client_obj)) {
@@ -835,17 +1684,28 @@ quicsilver_start_connection(VALUE self, VALUE connection_handle, VALUE config_ha
     return Qtrue;
 }
 
-// Wait for connection to complete (connected or failed)
+// Sleep without GVL so other Ruby threads can run.
+struct sleep_args { int ms; };
+static void* sleep_nogvl(void* arg) {
+    struct sleep_args* a = (struct sleep_args*)arg;
+    struct timespec ts = { .tv_sec = a->ms / 1000, .tv_nsec = (a->ms % 1000) * 1000000 };
+    nanosleep(&ts, NULL);
+    return NULL;
+}
+
+// Wait for connection to complete (connected or failed).
+// Waits only; the poll thread is the sole driver of MsQuic.
 static VALUE
 quicsilver_wait_for_connection(VALUE self, VALUE context_handle, VALUE timeout_ms)
 {
     ConnectionContext* ctx = (ConnectionContext*)(uintptr_t)NUM2ULL(context_handle);
     int timeout = NUM2INT(timeout_ms);
     int elapsed = 0;
-    const int sleep_interval = 10; // 10ms
-    
+    const int sleep_interval = 1; // 1ms
+
     while (elapsed < timeout && !ctx->connected && !ctx->failed) {
-        poll_inline(sleep_interval);  // Drive MsQuic execution while waiting
+        struct sleep_args sa = { .ms = sleep_interval };
+        rb_thread_call_without_gvl(sleep_nogvl, &sa, RUBY_UBF_IO, NULL);
         elapsed += sleep_interval;
     }
     
@@ -883,6 +1743,316 @@ quicsilver_connection_status(VALUE self, VALUE context_handle)
     return status;
 }
 
+// Get QUIC connection statistics (QUIC_STATISTICS_V2)
+static VALUE
+quicsilver_connection_statistics(VALUE self, VALUE connection_handle_val)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
+        return Qnil;
+    }
+
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle_val);
+    if (Connection == NULL) return Qnil;
+
+    QUIC_STATISTICS_V2 stats;
+    uint32_t stats_size = sizeof(stats);
+    memset(&stats, 0, stats_size);
+
+    QUIC_STATUS status = MsQuic->GetParam(
+        Connection,
+        QUIC_PARAM_CONN_STATISTICS_V2,
+        &stats_size,
+        &stats);
+
+    if (QUIC_FAILED(status)) {
+        return Qnil;
+    }
+
+    VALUE result = rb_hash_new();
+
+    // RTT (microseconds)
+    rb_hash_aset(result, rb_str_new_cstr("rtt"), UINT2NUM(stats.Rtt));
+    rb_hash_aset(result, rb_str_new_cstr("min_rtt"), UINT2NUM(stats.MinRtt));
+    rb_hash_aset(result, rb_str_new_cstr("max_rtt"), UINT2NUM(stats.MaxRtt));
+
+    // Handshake
+    rb_hash_aset(result, rb_str_new_cstr("resumption_attempted"), stats.ResumptionAttempted ? Qtrue : Qfalse);
+    rb_hash_aset(result, rb_str_new_cstr("resumption_succeeded"), stats.ResumptionSucceeded ? Qtrue : Qfalse);
+
+    // Send
+    rb_hash_aset(result, rb_str_new_cstr("send_path_mtu"), UINT2NUM(stats.SendPathMtu));
+    rb_hash_aset(result, rb_str_new_cstr("send_total_packets"), ULL2NUM(stats.SendTotalPackets));
+    rb_hash_aset(result, rb_str_new_cstr("send_retransmittable_packets"), ULL2NUM(stats.SendRetransmittablePackets));
+    rb_hash_aset(result, rb_str_new_cstr("send_suspected_lost_packets"), ULL2NUM(stats.SendSuspectedLostPackets));
+    rb_hash_aset(result, rb_str_new_cstr("send_spurious_lost_packets"), ULL2NUM(stats.SendSpuriousLostPackets));
+    rb_hash_aset(result, rb_str_new_cstr("send_total_bytes"), ULL2NUM(stats.SendTotalBytes));
+    rb_hash_aset(result, rb_str_new_cstr("send_total_stream_bytes"), ULL2NUM(stats.SendTotalStreamBytes));
+    rb_hash_aset(result, rb_str_new_cstr("send_congestion_count"), UINT2NUM(stats.SendCongestionCount));
+    rb_hash_aset(result, rb_str_new_cstr("send_persistent_congestion_count"), UINT2NUM(stats.SendPersistentCongestionCount));
+    rb_hash_aset(result, rb_str_new_cstr("send_congestion_window"), UINT2NUM(stats.SendCongestionWindow));
+
+    // Recv
+    rb_hash_aset(result, rb_str_new_cstr("recv_total_packets"), ULL2NUM(stats.RecvTotalPackets));
+    rb_hash_aset(result, rb_str_new_cstr("recv_reordered_packets"), ULL2NUM(stats.RecvReorderedPackets));
+    rb_hash_aset(result, rb_str_new_cstr("recv_dropped_packets"), ULL2NUM(stats.RecvDroppedPackets));
+    rb_hash_aset(result, rb_str_new_cstr("recv_duplicate_packets"), ULL2NUM(stats.RecvDuplicatePackets));
+    rb_hash_aset(result, rb_str_new_cstr("recv_total_bytes"), ULL2NUM(stats.RecvTotalBytes));
+    rb_hash_aset(result, rb_str_new_cstr("recv_total_stream_bytes"), ULL2NUM(stats.RecvTotalStreamBytes));
+    rb_hash_aset(result, rb_str_new_cstr("recv_decryption_failures"), ULL2NUM(stats.RecvDecryptionFailures));
+    rb_hash_aset(result, rb_str_new_cstr("recv_valid_ack_frames"), ULL2NUM(stats.RecvValidAckFrames));
+
+    // Misc
+    rb_hash_aset(result, rb_str_new_cstr("key_update_count"), UINT2NUM(stats.KeyUpdateCount));
+
+    return result;
+}
+
+// Get global QUIC transport counters.
+//
+// These counters are process-wide transport state, not scoped to a single
+// Quicsilver::Server or QUIC connection. They complement QUIC_STATISTICS_V2,
+// which is exposed by quicsilver_connection_statistics for a specific
+// connection handle.
+//
+// MsQuic stores the values as a uint64_t array indexed by QUIC_PERF_COUNTER_*.
+// The public Ruby API uses transport-domain names instead of MsQuic enum names
+// so Server#stats does not leak the native implementation detail.
+static VALUE
+quicsilver_transport_counters(VALUE self)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "QUIC transport not initialized.");
+        return Qnil;
+    }
+
+#ifdef QUIC_PARAM_GLOBAL_PERF_COUNTERS
+    uint64_t counters[QUIC_PERF_COUNTER_MAX] = {0};
+    uint32_t counters_size = sizeof(counters);
+
+    QUIC_STATUS status = MsQuic->GetParam(
+        NULL,
+        QUIC_PARAM_GLOBAL_PERF_COUNTERS,
+        &counters_size,
+        counters);
+
+    if (QUIC_FAILED(status)) {
+        return Qnil;
+    }
+
+    VALUE result = rb_hash_new();
+
+#define ADD_COUNTER(key, counter) \
+    rb_hash_aset(result, rb_str_new_cstr(key), ULL2NUM(counters[counter]))
+
+    // Connection lifecycle counters.
+    ADD_COUNTER("connections_created", QUIC_PERF_COUNTER_CONN_CREATED);
+    ADD_COUNTER("connections_handshake_failed", QUIC_PERF_COUNTER_CONN_HANDSHAKE_FAIL);
+    ADD_COUNTER("connections_app_rejected", QUIC_PERF_COUNTER_CONN_APP_REJECT);
+    ADD_COUNTER("connections_resumed", QUIC_PERF_COUNTER_CONN_RESUMED);
+    ADD_COUNTER("connections_active", QUIC_PERF_COUNTER_CONN_ACTIVE);
+    ADD_COUNTER("connections_connected", QUIC_PERF_COUNTER_CONN_CONNECTED);
+    ADD_COUNTER("connections_protocol_errors", QUIC_PERF_COUNTER_CONN_PROTOCOL_ERRORS);
+    ADD_COUNTER("connections_no_alpn", QUIC_PERF_COUNTER_CONN_NO_ALPN);
+    ADD_COUNTER("connections_load_rejected", QUIC_PERF_COUNTER_CONN_LOAD_REJECT);
+
+    // Stream, packet, UDP, and application byte counters.
+    ADD_COUNTER("streams_active", QUIC_PERF_COUNTER_STRM_ACTIVE);
+    ADD_COUNTER("packets_suspected_lost", QUIC_PERF_COUNTER_PKTS_SUSPECTED_LOST);
+    ADD_COUNTER("packets_dropped", QUIC_PERF_COUNTER_PKTS_DROPPED);
+    ADD_COUNTER("packets_decryption_failed", QUIC_PERF_COUNTER_PKTS_DECRYPTION_FAIL);
+    ADD_COUNTER("udp_datagrams_received", QUIC_PERF_COUNTER_UDP_RECV);
+    ADD_COUNTER("udp_datagrams_sent", QUIC_PERF_COUNTER_UDP_SEND);
+    ADD_COUNTER("udp_bytes_received", QUIC_PERF_COUNTER_UDP_RECV_BYTES);
+    ADD_COUNTER("udp_bytes_sent", QUIC_PERF_COUNTER_UDP_SEND_BYTES);
+    ADD_COUNTER("udp_receive_events", QUIC_PERF_COUNTER_UDP_RECV_EVENTS);
+    ADD_COUNTER("udp_send_calls", QUIC_PERF_COUNTER_UDP_SEND_CALLS);
+    ADD_COUNTER("app_bytes_sent", QUIC_PERF_COUNTER_APP_SEND_BYTES);
+    ADD_COUNTER("app_bytes_received", QUIC_PERF_COUNTER_APP_RECV_BYTES);
+
+    // Queue/worker pressure counters. These are useful for distinguishing
+    // transport saturation from Ruby scheduler saturation in Server#stats.
+    ADD_COUNTER("connection_queue_depth", QUIC_PERF_COUNTER_CONN_QUEUE_DEPTH);
+    ADD_COUNTER("connection_operations_queue_depth", QUIC_PERF_COUNTER_CONN_OPER_QUEUE_DEPTH);
+    ADD_COUNTER("connection_operations_queued", QUIC_PERF_COUNTER_CONN_OPER_QUEUED);
+    ADD_COUNTER("connection_operations_completed", QUIC_PERF_COUNTER_CONN_OPER_COMPLETED);
+    ADD_COUNTER("worker_operations_queue_depth", QUIC_PERF_COUNTER_WORK_OPER_QUEUE_DEPTH);
+    ADD_COUNTER("worker_operations_queued", QUIC_PERF_COUNTER_WORK_OPER_QUEUED);
+    ADD_COUNTER("worker_operations_completed", QUIC_PERF_COUNTER_WORK_OPER_COMPLETED);
+
+    // Path validation and stateless response counters.
+    ADD_COUNTER("paths_validated", QUIC_PERF_COUNTER_PATH_VALIDATED);
+    ADD_COUNTER("paths_failed", QUIC_PERF_COUNTER_PATH_FAILURE);
+    ADD_COUNTER("stateless_resets_sent", QUIC_PERF_COUNTER_SEND_STATELESS_RESET);
+    ADD_COUNTER("stateless_retries_sent", QUIC_PERF_COUNTER_SEND_STATELESS_RETRY);
+
+#undef ADD_COUNTER
+
+    return result;
+#else
+    return Qnil;
+#endif
+}
+
+// Get the remote address of a QUIC connection. Called lazily from Ruby
+// so we don't block MsQuic's event thread during the CONNECTED callback.
+// Get the resumption ticket from a connection context (for 0-RTT)
+static VALUE
+quicsilver_get_resumption_ticket(VALUE self, VALUE context_handle_val)
+{
+    ConnectionContext* ctx = (ConnectionContext*)(uintptr_t)NUM2ULL(context_handle_val);
+    if (ctx == NULL || ctx->resumption_ticket == NULL || ctx->resumption_ticket_length == 0) {
+        return Qnil;
+    }
+    return rb_str_new((const char*)ctx->resumption_ticket, ctx->resumption_ticket_length);
+}
+
+// Set a resumption ticket on a connection (for 0-RTT reconnection)
+static VALUE
+quicsilver_set_resumption_ticket(VALUE self, VALUE connection_handle_val, VALUE ticket_val)
+{
+    if (MsQuic == NULL) return Qfalse;
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle_val);
+    if (Connection == NULL || NIL_P(ticket_val)) return Qfalse;
+
+    const uint8_t* ticket = (const uint8_t*)RSTRING_PTR(ticket_val);
+    uint32_t ticket_len = (uint32_t)RSTRING_LEN(ticket_val);
+
+    QUIC_STATUS Status = MsQuic->SetParam(
+        Connection,
+        QUIC_PARAM_CONN_RESUMPTION_TICKET,
+        ticket_len,
+        ticket);
+
+    return QUIC_SUCCEEDED(Status) ? Qtrue : Qfalse;
+}
+
+static VALUE
+connection_param_bytes(VALUE connection_handle_val, uint32_t param)
+{
+    if (MsQuic == NULL) return Qnil;
+
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle_val);
+    if (Connection == NULL) return Qnil;
+
+    uint8_t buffer[256];
+    uint32_t buffer_size = sizeof(buffer);
+    memset(buffer, 0, sizeof(buffer));
+
+    QUIC_STATUS status = MsQuic->GetParam(Connection, param, &buffer_size, buffer);
+    if (QUIC_FAILED(status) || buffer_size == 0) {
+        return Qnil;
+    }
+
+    return rb_str_new((const char*)buffer, buffer_size);
+}
+
+// MsQuic derives this from the peer's max_datagram_frame_size transport parameter.
+static VALUE
+quicsilver_connection_datagram_send_enabled(VALUE self, VALUE connection_handle_val)
+{
+    if (MsQuic == NULL) return Qfalse;
+
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle_val);
+    if (Connection == NULL) return Qfalse;
+
+    BOOLEAN enabled = FALSE;
+    uint32_t size = sizeof(enabled);
+    QUIC_STATUS status = MsQuic->GetParam(
+        Connection, QUIC_PARAM_CONN_DATAGRAM_SEND_ENABLED, &size, &enabled);
+    return QUIC_SUCCEEDED(status) && enabled ? Qtrue : Qfalse;
+}
+
+static VALUE
+quicsilver_connection_reliable_reset_enabled(VALUE self, VALUE connection_handle_val)
+{
+    if (MsQuic == NULL) return Qfalse;
+    HQUIC connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle_val);
+    if (!connection) return Qfalse;
+    ConnectionContext* ctx = MsQuic->GetContext(connection);
+    return ctx && ctx->reliable_reset_negotiated ? Qtrue : Qfalse;
+}
+
+static VALUE
+quicsilver_set_stream_reliable_offset(VALUE self, VALUE stream_handle, VALUE offset_val)
+{
+    uint64_t token = NUM2ULL(stream_handle);
+    uint64_t offset = NUM2ULL(offset_val);
+    StreamContext* ctx = find_stream(token);
+    if (!MsQuic || !ctx) rb_raise(rb_eIOError, "QUIC stream is closed");
+    QUIC_STATUS status = MsQuic->SetParam(
+        ctx->stream, QUIC_PARAM_STREAM_RELIABLE_OFFSET, sizeof(offset), &offset);
+    if (QUIC_FAILED(status)) rb_raise(rb_eRuntimeError, "Setting reliable offset failed, 0x%x", status);
+    return offset_val;
+}
+
+// Returns [ip_string, port] or nil.
+static VALUE
+quicsilver_connection_remote_address(VALUE self, VALUE connection_handle_val)
+{
+    if (MsQuic == NULL) return Qnil;
+
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle_val);
+    if (Connection == NULL) return Qnil;
+
+    QUIC_ADDR addr;
+    uint32_t addr_size = sizeof(addr);
+    if (QUIC_FAILED(MsQuic->GetParam(Connection, QUIC_PARAM_CONN_REMOTE_ADDRESS, &addr_size, &addr)))
+        return Qnil;
+
+    char ip[INET6_ADDRSTRLEN];
+    uint16_t port = 0;
+    if (addr.Ip.sa_family == QUIC_ADDRESS_FAMILY_INET) {
+        struct sockaddr_in *v4 = (struct sockaddr_in *)&addr;
+        inet_ntop(AF_INET, &v4->sin_addr, ip, sizeof(ip));
+        port = ntohs(v4->sin_port);
+    } else {
+        struct sockaddr_in6 *v6 = (struct sockaddr_in6 *)&addr;
+        port = ntohs(v6->sin6_port);
+        if (IN6_IS_ADDR_V4MAPPED(&v6->sin6_addr)) {
+            struct in_addr v4;
+            memcpy(&v4, &v6->sin6_addr.s6_addr[12], 4);
+            inet_ntop(AF_INET, &v4, ip, sizeof(ip));
+        } else {
+            inet_ntop(AF_INET6, &v6->sin6_addr, ip, sizeof(ip));
+        }
+    }
+
+    VALUE result = rb_ary_new2(2);
+    rb_ary_push(result, rb_str_new_cstr(ip));
+    rb_ary_push(result, UINT2NUM(port));
+    return result;
+}
+
+// QUIC connection ID bytes for server-side routing/debugging.
+static VALUE
+quicsilver_connection_ids(VALUE self, VALUE connection_handle_val)
+{
+    VALUE result = rb_hash_new();
+
+    VALUE odcid = connection_param_bytes(connection_handle_val, QUIC_PARAM_CONN_ORIG_DEST_CID);
+    if (!NIL_P(odcid)) {
+        rb_hash_aset(result, rb_str_new_cstr("original_destination_connection_id"), odcid);
+    }
+
+    return result;
+}
+
+static void
+close_connection(HQUIC connection)
+{
+    // MsQuic 2.6 defaults to a blocking close outside the worker callback.
+    // Our poll thread needs the GVL to complete that work, so queue it instead.
+    BOOLEAN async = TRUE;
+    QUIC_STATUS status = MsQuic->SetParam(connection, QUIC_PARAM_CONN_CLOSE_ASYNC, sizeof(async), &async);
+    if (QUIC_FAILED(status)) {
+        rb_raise(rb_eRuntimeError, "Enabling asynchronous connection close failed, 0x%x!", status);
+    }
+    forget_connection_streams(connection);
+    MsQuic->ConnectionClose(connection);
+    wake_event_loop();
+}
+
 // Close a QUIC connection and free context
 static VALUE
 quicsilver_close_connection_handle(VALUE self, VALUE connection_data)
@@ -899,7 +2069,7 @@ quicsilver_close_connection_handle(VALUE self, VALUE connection_data)
     (void)context_handle; // ctx freed by SHUTDOWN_COMPLETE, not here
 
     if (Connection != NULL) {
-        MsQuic->ConnectionClose(Connection);
+        close_connection(Connection);
     }
 
     // Don't free ctx here — ConnectionClose is async and SHUTDOWN_COMPLETE
@@ -917,7 +2087,7 @@ quicsilver_close_server_connection(VALUE self, VALUE connection_handle)
 
     HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle);
     if (Connection != NULL) {
-        MsQuic->ConnectionClose(Connection);
+        close_connection(Connection);
     }
     return Qnil;
 }
@@ -965,6 +2135,7 @@ static VALUE
 quicsilver_close(VALUE self)
 {
     if (MsQuic != NULL) {
+        st_clear(LiveStreams);
         if (Registration != NULL) {
             MsQuic->RegistrationClose(Registration);
             Registration = NULL;
@@ -1033,6 +2204,130 @@ quicsilver_create_listener(VALUE self, VALUE config_handle)
     return result;
 }
 
+static uint32_t
+cibir_param_buffer(VALUE cibir_bytes_val, uint8_t* buffer)
+{
+    StringValue(cibir_bytes_val);
+    long cibir_len = RSTRING_LEN(cibir_bytes_val);
+    if (cibir_len == 0 || cibir_len > 6) {
+        rb_raise(rb_eArgError, "cibir bytes must be 1..6 bytes");
+        return 0;
+    }
+
+    buffer[0] = 0;
+    memcpy(buffer + 1, RSTRING_PTR(cibir_bytes_val), cibir_len);
+    return (uint32_t)(1 + cibir_len);
+}
+
+// Configure the fixed Server ID bytes MsQuic places in generated QUIC
+// connection IDs. Must run before RegistrationOpen, because MsQuic only applies
+// this process-global setting safely before the library is in use.
+static VALUE
+quicsilver_apply_msquic_server_id(VALUE self, VALUE server_id_bytes_val)
+{
+    QUIC_STATUS Status;
+
+    if (Registration != NULL || ExecContext != NULL) {
+        rb_raise(rb_eRuntimeError, "MsQuic Server ID must be configured before Quicsilver is opened");
+        return Qfalse;
+    }
+
+    if (MsQuic == NULL && QUIC_FAILED(Status = MsQuicOpenVersion(2, (const void**)&MsQuic))) {
+        rb_raise(rb_eRuntimeError, "MsQuicOpenVersion failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    QUIC_GLOBAL_SETTINGS Settings;
+    memset(&Settings, 0, sizeof(Settings));
+
+    StringValue(server_id_bytes_val);
+    if (RSTRING_LEN(server_id_bytes_val) != sizeof(Settings.FixedServerID)) {
+        rb_raise(rb_eArgError, "Server ID must be exactly 4 bytes");
+        return Qfalse;
+    }
+    Settings.IsSet.LoadBalancingMode = TRUE;
+    Settings.LoadBalancingMode = QUIC_LOAD_BALANCING_SERVER_ID_FIXED;
+    Settings.IsSet.FixedServerID = TRUE;
+    memcpy(&Settings.FixedServerID, RSTRING_PTR(server_id_bytes_val), sizeof(Settings.FixedServerID));
+
+    Status = MsQuic->SetParam(
+        NULL,
+        QUIC_PARAM_GLOBAL_GLOBAL_SETTINGS,
+        sizeof(Settings),
+        &Settings);
+
+    if (QUIC_FAILED(Status)) {
+        rb_raise(rb_eRuntimeError, "MsQuic Server ID configuration failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    return Qtrue;
+}
+
+// Configure listener-level CIBIR (Connection ID Based Implicit Routing) bytes.
+static VALUE
+quicsilver_configure_listener_cibir(VALUE self, VALUE listener_handle, VALUE cibir_bytes_val)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
+        return Qfalse;
+    }
+
+    uint8_t buffer[7];
+    uint32_t buffer_len = cibir_param_buffer(cibir_bytes_val, buffer);
+
+    HQUIC Listener = (HQUIC)(uintptr_t)NUM2ULL(listener_handle);
+    QUIC_STATUS Status = MsQuic->SetParam(
+        Listener,
+        QUIC_PARAM_LISTENER_CIBIR_ID,
+        buffer_len,
+        buffer);
+
+    if (QUIC_FAILED(Status)) {
+        rb_raise(rb_eRuntimeError, "Listener CIBIR configuration failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    return Qtrue;
+}
+
+// Configure client-side CIBIR bytes before ConnectionStart.
+static VALUE
+quicsilver_configure_connection_cibir(VALUE self, VALUE connection_handle, VALUE cibir_bytes_val)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
+        return Qfalse;
+    }
+
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle);
+    BOOLEAN share_binding = TRUE;
+    QUIC_STATUS Status = MsQuic->SetParam(
+        Connection,
+        QUIC_PARAM_CONN_SHARE_UDP_BINDING,
+        sizeof(share_binding),
+        &share_binding);
+    if (QUIC_FAILED(Status)) {
+        rb_raise(rb_eRuntimeError, "Connection UDP binding configuration failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    uint8_t buffer[7];
+    uint32_t buffer_len = cibir_param_buffer(cibir_bytes_val, buffer);
+    Status = MsQuic->SetParam(
+        Connection,
+        QUIC_PARAM_CONN_CIBIR_ID,
+        buffer_len,
+        buffer);
+
+    if (QUIC_FAILED(Status)) {
+        rb_raise(rb_eRuntimeError, "Connection CIBIR configuration failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    return Qtrue;
+}
+
 // Start listener on specific address and port
 static VALUE
 quicsilver_start_listener(VALUE self, VALUE listener_handle, VALUE address, VALUE port, VALUE alpn)
@@ -1050,14 +2345,17 @@ quicsilver_start_listener(VALUE self, VALUE listener_handle, VALUE address, VALU
     QUIC_ADDR Address;
     memset(&Address, 0, sizeof(Address));
 
-    // Parse address string to determine family
+    // Parse address string to determine family.
+    // "::" or any address with ':' → INET6 (IPv6 only on macOS).
+    // "0.0.0.0" → UNSPEC (dual-stack: accepts both IPv4 and IPv6).
+    // Specific IPv4 (e.g. "127.0.0.1") → INET (IPv4 only).
     const char* addr_str = StringValueCStr(address);
     if (strchr(addr_str, ':') != NULL) {
-        // IPv6 address (contains ':')
         QuicAddrSetFamily(&Address, QUIC_ADDRESS_FAMILY_INET6);
-    } else {
-        // IPv4 address or unspecified - use UNSPEC for dual-stack
+    } else if (strcmp(addr_str, "0.0.0.0") == 0) {
         QuicAddrSetFamily(&Address, QUIC_ADDRESS_FAMILY_UNSPEC);
+    } else {
+        QuicAddrSetFamily(&Address, QUIC_ADDRESS_FAMILY_INET);
     }
     QuicAddrSetPort(&Address, Port);
 
@@ -1139,6 +2437,7 @@ quicsilver_open_stream(VALUE self, VALUE connection_data, VALUE unidirectional)
     ctx->connection = Connection;
     ctx->connection_ctx = conn_ctx;  // Store connection context pointer
     ctx->client_obj = conn_ctx ? conn_ctx->client_obj : Qnil;
+    ctx->stream_id = UINT64_MAX;  // Sentinel: lazily resolved on first callback
     ctx->started = 1;
     ctx->shutdown = 0;
     ctx->early_data = 0;
@@ -1157,9 +2456,16 @@ quicsilver_open_stream(VALUE self, VALUE connection_data, VALUE unidirectional)
         return Qnil;
     }
     
-    // Start the stream
-    Status = MsQuic->StreamStart(Stream, QUIC_STREAM_START_FLAG_NONE);
+    uint64_t token = register_stream(ctx, Stream, RTEST(unidirectional)
+        ? QUIC_STREAM_SHUTDOWN_FLAG_ABORT_SEND : QUIC_STREAM_SHUTDOWN_FLAG_ABORT);
+
+    // Start the stream. INDICATE_PEER_ACCEPT gives us visibility into
+    // stream flow control — fires PEER_ACCEPTED event when the peer
+    // raises MAX_STREAMS if the stream was initially queued.
+    Status = MsQuic->StreamStart(Stream,
+        QUIC_STREAM_START_FLAG_INDICATE_PEER_ACCEPT | QUIC_STREAM_START_FLAG_SHUTDOWN_ON_FAIL);
     if (QUIC_FAILED(Status)) {
+        unregister_stream(token);
         // StreamClose fires SHUTDOWN_COMPLETE synchronously which frees ctx
         MsQuic->StreamClose(Stream);
         rb_raise(rb_eRuntimeError, "StreamStart failed, 0x%x!", Status);
@@ -1167,7 +2473,7 @@ quicsilver_open_stream(VALUE self, VALUE connection_data, VALUE unidirectional)
     }
 
     wake_event_loop();
-    return ULL2NUM((uintptr_t)Stream);
+    return ULL2NUM(token);
 }
 
 // Send data on a QUIC stream
@@ -1179,31 +2485,34 @@ quicsilver_send_stream(VALUE self, VALUE stream_handle, VALUE data, VALUE send_f
         return Qnil;
     }
 
-    HQUIC Stream = (HQUIC)(uintptr_t)NUM2ULL(stream_handle);
-    // Use StringValuePtr and RSTRING_LEN for binary data with null bytes
-    const char* data_str = RSTRING_PTR(data);
-    uint32_t data_len = (uint32_t)RSTRING_LEN(data);
-    
-    void* SendBufferRaw = malloc(sizeof(QUIC_BUFFER) + data_len);
-    if (SendBufferRaw == NULL) {
-        rb_raise(rb_eRuntimeError, "SendBuffer allocation failed!");
+    uint64_t token = NUM2ULL(stream_handle);
+    StringValue(data);
+    StreamContext* ctx = find_stream(token);
+    if (!ctx || __atomic_load_n(&ctx->shutdown, __ATOMIC_ACQUIRE)) rb_raise(rb_eIOError, "QUIC stream is closed");
+    HQUIC Stream = ctx->stream;
+
+    // MsQuic holds a pointer into the String until SEND_COMPLETE, so the
+    // bytes must not change. A frozen String is sent as-is (zero copy); an
+    // unfrozen one gets a frozen copy-on-write share, so a caller that keeps
+    // mutating its buffer unshares on its own side and never sees a
+    // FrozenError from here. Library callers freeze their output to get the
+    // zero-copy path.
+    data = rb_str_new_frozen(data);
+
+    SendContext* send = send_context_new(data);
+    if (send == NULL) {
+        rb_raise(rb_eRuntimeError, "SendContext allocation failed!");
         return Qnil;
     }
 
-    QUIC_BUFFER* SendBuffer = (QUIC_BUFFER*)SendBufferRaw;
-    SendBuffer->Buffer = (uint8_t*)SendBufferRaw + sizeof(QUIC_BUFFER);
-    SendBuffer->Length = data_len;
-
-    memcpy(SendBuffer->Buffer, data_str, data_len);
-
     // Use flag based on parameter (default to FIN for backwards compat)
     QUIC_SEND_FLAGS flags = (NIL_P(send_fin) || RTEST(send_fin))
         ? QUIC_SEND_FLAG_FIN
         : QUIC_SEND_FLAG_NONE;
-    
-    QUIC_STATUS Status = MsQuic->StreamSend(Stream, SendBuffer, 1, flags, SendBufferRaw);
+
+    QUIC_STATUS Status = MsQuic->StreamSend(Stream, &send->buffer, 1, flags, send);
     if (QUIC_FAILED(Status)) {
-        free(SendBufferRaw);
+        send_context_release(send);
         rb_raise(rb_eRuntimeError, "StreamSend failed, 0x%x!", Status);
         return Qfalse;
     }
@@ -1212,67 +2521,153 @@ quicsilver_send_stream(VALUE self, VALUE stream_handle, VALUE data, VALUE send_f
     return Qtrue;
 }
 
-// Reset a QUIC stream (RESET_STREAM frame - abruptly terminates sending)
+// Send an unreliable datagram on a QUIC connection (RFC 9221).
+// Datagrams are not retransmitted — best effort delivery.
+// Data must fit in a single QUIC packet (typically ~1200 bytes).
 static VALUE
-quicsilver_stream_reset(VALUE self, VALUE stream_handle, VALUE error_code)
+quicsilver_datagram_send(VALUE self, VALUE connection_data, VALUE data)
 {
     if (MsQuic == NULL) {
         rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
         return Qnil;
     }
 
-    HQUIC Stream = (HQUIC)(uintptr_t)NUM2ULL(stream_handle);
-    if (Stream == NULL) return Qnil;
-
-    uint64_t ErrorCode = NUM2ULL(error_code);
-
-    MsQuic->StreamShutdown(Stream, QUIC_STREAM_SHUTDOWN_FLAG_ABORT_SEND, ErrorCode);
-
-    wake_event_loop();
-    return Qtrue;
-}
+    VALUE conn_handle_val = rb_ary_entry(connection_data, 0);
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(conn_handle_val);
 
-// Queue a stream priority change. Called from Ruby threads — just stores the
-// priority. The actual SetParam happens on the MsQuic event thread in StreamCallback.
-static VALUE
-quicsilver_set_stream_priority(VALUE self, VALUE stream_handle, VALUE priority)
-{
-    if (MsQuic == NULL) return Qnil;
+    StringValue(data);
+    const char* data_str = RSTRING_PTR(data);
+    uint32_t data_len = (uint32_t)RSTRING_LEN(data);
 
-    HQUIC Stream = (HQUIC)(uintptr_t)NUM2ULL(stream_handle);
-    if (Stream == NULL) return Qnil;
+    void* SendBufferRaw = malloc(sizeof(QUIC_BUFFER) + data_len);
+    if (SendBufferRaw == NULL) {
+        rb_raise(rb_eRuntimeError, "Datagram buffer allocation failed!");
+        return Qnil;
+    }
 
-    if (PendingPriorityCount >= MAX_PENDING_PRIORITIES) return Qfalse;
+    QUIC_BUFFER* SendBuffer = (QUIC_BUFFER*)SendBufferRaw;
+    SendBuffer->Buffer = (uint8_t*)SendBufferRaw + sizeof(QUIC_BUFFER);
+    SendBuffer->Length = data_len;
+    memcpy(SendBuffer->Buffer, data_str, data_len);
 
-    uint16_t Priority = (uint16_t)NUM2UINT(priority);
-    PendingPriorities[PendingPriorityCount].stream = Stream;
-    PendingPriorities[PendingPriorityCount].priority_plus_one = Priority + 1;
-    PendingPriorityCount++;
+    QUIC_STATUS Status = MsQuic->DatagramSend(Connection, SendBuffer, 1, QUIC_SEND_FLAG_NONE, SendBufferRaw);
+    if (QUIC_FAILED(Status)) {
+        free(SendBufferRaw);
+        if (Status == QUIC_STATUS_BUFFER_TOO_SMALL) {
+            rb_raise(rb_eArgError, "Datagram too large (%u bytes) - must fit in a single QUIC packet", data_len);
+        } else {
+            rb_raise(rb_eRuntimeError, "DatagramSend failed, 0x%x", Status);
+        }
+        return Qfalse;
+    }
 
     wake_event_loop();
     return Qtrue;
 }
 
-// Stop sending on a QUIC stream (STOP_SENDING frame - requests peer to stop)
+// Get the QUIC stream ID for an open stream.
+// Must be called after data has been sent (MsQuic defers ID assignment
+// with QUIC_STREAM_START_FLAG_NONE until data flows).
 static VALUE
-quicsilver_stream_stop_sending(VALUE self, VALUE stream_handle, VALUE error_code)
+quicsilver_get_stream_id(VALUE self, VALUE stream_handle)
 {
     if (MsQuic == NULL) {
         rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
         return Qnil;
     }
+    StreamContext* ctx = find_stream(NUM2ULL(stream_handle));
+    if (!ctx) return Qnil;
+    HQUIC Stream = ctx->stream;
+    uint64_t stream_id = 0;
+    uint32_t stream_id_len = sizeof(stream_id);
+    QUIC_STATUS Status = MsQuic->GetParam(Stream, QUIC_PARAM_STREAM_ID, &stream_id_len, &stream_id);
+    if (QUIC_FAILED(Status)) {
+        return Qnil;
+    }
+    return ULL2NUM(stream_id);
+}
 
-    HQUIC Stream = (HQUIC)(uintptr_t)NUM2ULL(stream_handle);
-    if (Stream == NULL) return Qnil;
+// Experimental native byte/chunk admission. First grant opts in (zero pauses on the
+// next data indication); subsequent grants add credit. This does not reserve
+// connection-level control credit or integrate application queue consumption.
+static VALUE
+quicsilver_grant_stream_receive_credit(VALUE self, VALUE stream_handle, VALUE bytes, VALUE chunks)
+{
+    // Validate here, not in Transport::Stream: this module function is a public
+    // boundary, and NUM2ULL silently wraps a negative Integer into huge credit.
+    uint64_t token = NUM2ULL(stream_handle);
+    uint64_t credit = credit_arg(bytes, "Receive credit");
+    uint64_t chunk_credit = credit_arg(chunks, "Receive chunks");
+    StreamContext* ctx = find_stream(token);
+    if (!MsQuic || !ctx || !(ctx->abort_flags & QUIC_STREAM_SHUTDOWN_FLAG_ABORT_RECEIVE)) return Qfalse;
+
+    // Update under the lock; resume outside it (MsQuic call). A receive that
+    // paused the stream set receive_paused under this same lock, so either it
+    // ran before us and we see the flag, or it runs after us and sees the
+    // credit. StreamReceiveSetEnabled is a queued MsQuic operation that runs
+    // after any callback in flight, so the resume cannot land before the pause
+    // it is meant to undo.
+    int resume = 0;
+    STATE_LOCK();
+    if (ctx->receive_delivery_failed) { STATE_UNLOCK(); return Qfalse; }
+    if (credit > UINT64_MAX - ctx->receive_credit) { STATE_UNLOCK(); rb_raise(rb_eRangeError, "Receive credit exceeds 64 bits"); }
+    if (chunk_credit > UINT64_MAX - ctx->receive_chunks) { STATE_UNLOCK(); rb_raise(rb_eRangeError, "Receive chunks exceed 64 bits"); }
+    ctx->receive_credit_enabled = 1;
+    ctx->receive_credit += credit;
+    ctx->receive_chunks += chunk_credit;
+    if (ctx->receive_paused && ctx->receive_credit && ctx->receive_chunks) {
+        ctx->receive_paused = 0;
+        resume = 1;
+    }
+    STATE_UNLOCK();
 
-    uint64_t ErrorCode = NUM2ULL(error_code);
+    if (resume && !resume_receive(ctx)) return Qfalse;
+    wake_event_loop();
+    return Qtrue;
+}
 
-    MsQuic->StreamShutdown(Stream, QUIC_STREAM_SHUTDOWN_FLAG_ABORT_RECEIVE, ErrorCode);
 
+static VALUE
+shutdown_stream(VALUE stream_handle, VALUE error_code, QUIC_STREAM_SHUTDOWN_FLAGS flags)
+{
+    uint64_t token = NUM2ULL(stream_handle);
+    uint64_t code = NUM2ULL(error_code);
+    StreamContext* ctx = find_stream(token);
+    if (!MsQuic || !ctx) return Qfalse;
+
+    flags &= ctx->abort_flags;
+    if (!flags) return Qfalse;
+    QUIC_STATUS status = MsQuic->StreamShutdown(ctx->stream, flags, code);
+    wake_event_loop();
+    return QUIC_SUCCEEDED(status) ? Qtrue : Qfalse;
+}
+
+// Reset a QUIC stream (RESET_STREAM frame - abruptly terminates sending)
+static VALUE
+quicsilver_stream_reset(VALUE self, VALUE stream_handle, VALUE error_code)
+{
+    return shutdown_stream(stream_handle, error_code, QUIC_STREAM_SHUTDOWN_FLAG_ABORT_SEND);
+}
+
+static VALUE
+quicsilver_set_stream_priority(VALUE self, VALUE stream_handle, VALUE priority)
+{
+    uint64_t token = NUM2ULL(stream_handle);
+    unsigned int value = NUM2UINT(priority);
+    if (value > UINT16_MAX) rb_raise(rb_eArgError, "Stream priority must fit in 16 bits");
+    StreamContext* ctx = find_stream(token);
+    if (!MsQuic || !ctx) return Qfalse;
+    __atomic_store_n(&ctx->pending_priority, value + 1, __ATOMIC_RELEASE);
     wake_event_loop();
     return Qtrue;
 }
 
+static VALUE
+quicsilver_stream_stop_sending(VALUE self, VALUE stream_handle, VALUE error_code)
+{
+    return shutdown_stream(stream_handle, error_code, QUIC_STREAM_SHUTDOWN_FLAG_ABORT_RECEIVE);
+}
+
 static VALUE
 quicsilver_wake(VALUE self)
 {
@@ -1285,13 +2680,17 @@ void
 Init_quicsilver(void)
 {
     mQuicsilver = rb_define_module("Quicsilver");
+    LiveStreams = st_init_numtable();
+    LiveSends = st_init_numtable();
+    LiveSendsRoot = TypedData_Wrap_Struct(rb_cObject, &live_sends_type, &LiveSendsRootData);
+    rb_gc_register_mark_object(LiveSendsRoot);
 
     // Core initialization
     rb_define_singleton_method(mQuicsilver, "open_connection", quicsilver_open, 0);
     rb_define_singleton_method(mQuicsilver, "close_connection", quicsilver_close, 0);
     
     // Configuration management
-    rb_define_singleton_method(mQuicsilver, "create_configuration", quicsilver_create_configuration, 1);
+    rb_define_singleton_method(mQuicsilver, "create_configuration", quicsilver_create_configuration, -1);
     rb_define_singleton_method(mQuicsilver, "create_server_configuration", quicsilver_create_server_configuration, 1);
     rb_define_singleton_method(mQuicsilver, "close_configuration", quicsilver_close_configuration, 1);
     
@@ -1300,12 +2699,24 @@ Init_quicsilver(void)
     rb_define_singleton_method(mQuicsilver, "start_connection", quicsilver_start_connection, 4);
     rb_define_singleton_method(mQuicsilver, "wait_for_connection", quicsilver_wait_for_connection, 2);
     rb_define_singleton_method(mQuicsilver, "connection_status", quicsilver_connection_status, 1);
+    rb_define_singleton_method(mQuicsilver, "connection_statistics", quicsilver_connection_statistics, 1);
+    rb_define_singleton_method(mQuicsilver, "transport_counters", quicsilver_transport_counters, 0);
+    rb_define_singleton_method(mQuicsilver, "connection_reliable_reset_enabled?", quicsilver_connection_reliable_reset_enabled, 1);
+    rb_define_singleton_method(mQuicsilver, "set_stream_reliable_offset", quicsilver_set_stream_reliable_offset, 2);
+    rb_define_singleton_method(mQuicsilver, "connection_datagram_send_enabled?", quicsilver_connection_datagram_send_enabled, 1);
+    rb_define_singleton_method(mQuicsilver, "connection_remote_address", quicsilver_connection_remote_address, 1);
+    rb_define_singleton_method(mQuicsilver, "connection_ids", quicsilver_connection_ids, 1);
+    rb_define_singleton_method(mQuicsilver, "get_resumption_ticket", quicsilver_get_resumption_ticket, 1);
+    rb_define_singleton_method(mQuicsilver, "set_resumption_ticket", quicsilver_set_resumption_ticket, 2);
     rb_define_singleton_method(mQuicsilver, "connection_shutdown", quicsilver_connection_shutdown, 3);
     rb_define_singleton_method(mQuicsilver, "close_connection_handle", quicsilver_close_connection_handle, 1);
     rb_define_singleton_method(mQuicsilver, "close_server_connection", quicsilver_close_server_connection, 1);
     
     // Listener management
+    rb_define_singleton_method(mQuicsilver, "apply_msquic_server_id", quicsilver_apply_msquic_server_id, 1);
     rb_define_singleton_method(mQuicsilver, "create_listener", quicsilver_create_listener, 1);
+    rb_define_singleton_method(mQuicsilver, "configure_listener_cibir", quicsilver_configure_listener_cibir, 2);
+    rb_define_singleton_method(mQuicsilver, "configure_connection_cibir", quicsilver_configure_connection_cibir, 2);
     rb_define_singleton_method(mQuicsilver, "start_listener", quicsilver_start_listener, 4);
     rb_define_singleton_method(mQuicsilver, "stop_listener", quicsilver_stop_listener, 1);
     rb_define_singleton_method(mQuicsilver, "close_listener", quicsilver_close_listener, 1);
@@ -1316,8 +2727,15 @@ Init_quicsilver(void)
     rb_define_singleton_method(mQuicsilver, "stream_reset", quicsilver_stream_reset, 2);
     rb_define_singleton_method(mQuicsilver, "stream_stop_sending", quicsilver_stream_stop_sending, 2);
     rb_define_singleton_method(mQuicsilver, "set_stream_priority", quicsilver_set_stream_priority, 2);
+    rb_define_singleton_method(mQuicsilver, "get_stream_id", quicsilver_get_stream_id, 1);
+    rb_define_singleton_method(mQuicsilver, "grant_stream_receive_credit", quicsilver_grant_stream_receive_credit, 3);
+    rb_define_singleton_method(mQuicsilver, "datagram_send", quicsilver_datagram_send, 2);
 
     // Event processing (custom execution — app drives MsQuic)
     rb_define_singleton_method(mQuicsilver, "poll", quicsilver_poll, 0);
     rb_define_singleton_method(mQuicsilver, "wake", quicsilver_wake, 0);
+    rb_define_singleton_method(mQuicsilver, "dispatch_events", quicsilver_dispatch_events, 2);
+    rb_define_singleton_method(mQuicsilver, "open_event_queue", quicsilver_open_event_queue, 0);
+    rb_define_singleton_method(mQuicsilver, "close_event_queue", quicsilver_close_event_queue, 0);
+    rb_define_singleton_method(mQuicsilver, "dropped_datagrams", quicsilver_dropped_datagrams, 0);
 }