quicsilver 0.5.0-x86_64-linux

data/ext/quicsilver/quicsilver.c

@@ -0,0 +1,2741 @@
+#include <ruby.h>
+#include <ruby/thread.h>
+#include <ruby/st.h>
+#include <pthread.h>
+#define QUIC_API_ENABLE_PREVIEW_FEATURES 1
+#include "msquic.h"
+
+// A reset stream's final size arrives on the PEER_SEND_ABORTED event, added
+// by patches/stream-final-size.patch. This is the value MsQuic uses while it
+// is unsettled, and what we pass to Ruby as "not known".
+#define QUICSILVER_FINAL_SIZE_UNKNOWN UINT64_MAX
+#include <errno.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+#if __linux__
+#include <sys/epoll.h>
+#elif __APPLE__ || __FreeBSD__
+#include <sys/event.h>
+#endif
+
+static VALUE mQuicsilver;
+
+// Custom execution: app owns the event loop, MsQuic spawns no threads
+static QUIC_EVENTQ EventQ = -1;        // kqueue (macOS) / epoll (Linux)
+static QUIC_EXECUTION* ExecContext = NULL;
+
+#if __linux__
+#include <sys/eventfd.h>
+static int WakeFd = -1;  // eventfd for waking epoll
+#endif
+#define WAKE_IDENT 0xCAFE  // kqueue EVFILT_USER identifier (macOS only)
+
+// Wake the event loop from another thread (e.g. after StreamSend)
+static void
+wake_event_loop(void)
+{
+    if (EventQ == -1) return;
+#if __linux__
+    if (WakeFd != -1) {
+        uint64_t val = 1;
+        write(WakeFd, &val, sizeof(val));
+    }
+#elif __APPLE__ || __FreeBSD__
+    struct kevent kev;
+    EV_SET(&kev, WAKE_IDENT, EVFILT_USER, 0, NOTE_TRIGGER, 0, NULL);
+    kevent(EventQ, &kev, 1, NULL, 0, NULL);
+#endif
+}
+
+// Global MSQUIC API table
+static const QUIC_API_TABLE* MsQuic = NULL;
+
+// Global registration handle
+static HQUIC Registration = NULL;
+
+// Registration configuration
+static const QUIC_REGISTRATION_CONFIG RegConfig = { "quicsilver", QUIC_EXECUTION_PROFILE_LOW_LATENCY };
+
+// Connection state tracking
+typedef struct {
+    int connected;
+    int failed;
+    QUIC_STATUS error_status;
+    uint64_t error_code;
+    VALUE client_obj;  // Ruby client object (Qnil for server connections)
+    char remote_address[INET6_ADDRSTRLEN];
+    uint16_t remote_port;
+    int session_resumed;
+    int reliable_reset_negotiated;
+    // 0-RTT resumption ticket (client-side)
+    uint8_t* resumption_ticket;
+    uint32_t resumption_ticket_length;
+    // Datagrams queued for Ruby and dropped for lack of room, per connection.
+    // Both maintained under EventQueue.lock, not StateLock.
+    size_t queued_datagrams;
+    uint64_t dropped_datagrams;
+} ConnectionContext;
+
+// Listener state tracking
+typedef struct {
+    int started;
+    int stopped;
+    int failed;
+    QUIC_STATUS error_status;
+    HQUIC Configuration;
+} ListenerContext;
+
+// Stream state tracking
+typedef struct {
+    HQUIC stream;
+    uint64_t token;
+    QUIC_STREAM_SHUTDOWN_FLAGS abort_flags;
+    uint32_t pending_priority;
+    uint64_t receive_credit;
+    uint64_t receive_chunks;
+    // Set under StateLock when a RECEIVE returned less than indicated, which
+    // makes MsQuic stop delivering. The next grant that leaves both credits
+    // positive clears it and calls StreamReceiveSetEnabled.
+    int receive_paused;
+    int receive_credit_enabled;
+    int receive_delivery_failed;
+    // Set when a RECEIVE_FIN has been queued for Ruby. Poll thread only.
+    int fin_delivered;
+    HQUIC connection;
+    void* connection_ctx;  // ConnectionContext pointer (for building connection_data)
+    VALUE client_obj;      // Ruby client object (copied from connection context)
+    char remote_address[INET6_ADDRSTRLEN];
+    uint16_t remote_port;
+    int session_resumed;
+    uint64_t stream_id;    // QUIC stream ID, cached once after StreamStart
+    int started;
+    int shutdown;
+    int early_data;        // Set when stream received 0-RTT data
+    QUIC_STATUS error_status;
+} StreamContext;
+
+// --- Threading model ---------------------------------------------------------
+//
+// Two threads touch this file's state, and neither holds the other's lock.
+//
+// The poll thread drives MsQuic (ExecutionPoll, kevent/epoll_wait, completion
+// callbacks) with the GVL released for the whole loop. Nothing reachable from
+// a StreamCallback or ConnectionCallback may call into Ruby. Callbacks push a
+// RubyEvent onto EventQueue and return.
+//
+// The dispatcher thread, a Ruby Thread in Transport::EventLoop, waits on
+// EventQueue without the GVL, then takes it to pop a batch and call
+// Server.handle_stream / Client#handle_stream_event for each. It also does
+// the releases that used to happen inside callbacks and either need the GVL
+// (rb_gc_unregister_address) or free memory a Ruby thread could still be
+// using (StreamContext, ConnectionContext, SendContext). Because every free
+// happens on a thread holding the GVL, a Ruby thread that found a context
+// cannot see it freed underneath it: the GVL is the lifetime guarantee, as it
+// was before, just held by a different thread.
+//
+// StateLock covers LiveStreams and every context field one side writes and
+// the other reads: receive credit and the paused flag, the lazily cached
+// stream_id. Rule: never call MsQuic while holding StateLock. Callbacks run
+// inside MsQuic's connection lock, so holding StateLock across an MsQuic call
+// from a Ruby thread would invert the order and deadlock.
+//
+// Why the receive path can be asynchronous: MsQuic processes API calls on a
+// stream (StreamReceiveSetEnabled, StreamSend) as queued operations on the
+// connection's worker, which here is ExecutionPoll on the poll thread. A call
+// made from a Ruby thread therefore runs after any callback in flight, never
+// during it. So when a RECEIVE returns a partial length and MsQuic pauses the
+// stream, a grant that observed receive_paused and queued SetEnabled is
+// applied after the pause, not lost before it.
+static pthread_mutex_t StateLock = PTHREAD_MUTEX_INITIALIZER;
+#define STATE_LOCK()   pthread_mutex_lock(&StateLock)
+#define STATE_UNLOCK() pthread_mutex_unlock(&StateLock)
+
+// Tokens are never reused. find_stream returns a pointer whose lifetime is
+// guaranteed by the GVL: contexts are freed only on the dispatcher thread,
+// which holds it. So a caller must hold the GVL from the lookup through the
+// last use of the pointer and must not release it in between, including via
+// rb_thread_call_without_gvl, rb_thread_schedule, or any Ruby call that can
+// block. Inserting one of those between find_stream and the MsQuic call it
+// guards is a use-after-free.
+static st_table* LiveStreams;
+
+typedef enum {
+    RELEASE_NONE = 0,
+    RELEASE_SEND,              // SendContext*: drop the retained String
+    RELEASE_STREAM,            // StreamContext*: StreamClose + free
+    RELEASE_STREAM_NOCLOSE,    // StreamContext*: free only, app is closing
+    RELEASE_CONNECTION,        // ConnectionContext*: unregister client_obj, free
+} ReleaseKind;
+
+// Most events carry a token or a token plus two integers; those fit inline
+// and cost no malloc. RECEIVE payloads are handed over already allocated.
+#define EVENT_INLINE_DATA 40
+
+typedef struct {
+    HQUIC connection;
+    void* connection_ctx;
+    VALUE client_obj;
+    const char* event_type;      // string literal, never freed
+    uint64_t stream_id;
+    char* data;                  // malloc'd when data_len > EVENT_INLINE_DATA
+    size_t data_len;
+    char inline_data[EVENT_INLINE_DATA];
+    int early_data;
+    int dropped;                 // superseded datagram: free, do not deliver
+    ReleaseKind release;
+    void* release_ptr;
+
+    // A pending receive: MsQuic owns the bytes until StreamReceiveComplete.
+    // Descriptors are copied (callback-scoped); data is NULL.
+    HQUIC stream;
+    uint64_t token;
+    uint64_t accepted;
+    QUIC_BUFFER* buffers;        // inline_buffers, or malloc'd when more
+    uint32_t buffer_count;
+    QUIC_BUFFER inline_buffers[4];
+} RubyEvent;
+
+#define EVENT_INLINE_BUFFERS 4
+
+static struct {
+    pthread_mutex_t lock;
+    pthread_cond_t ready;
+    RubyEvent* buf;
+    size_t cap, head, len;
+    int closed;
+} EventQueue = { PTHREAD_MUTEX_INITIALIZER, PTHREAD_COND_INITIALIZER, NULL, 0, 0, 0, 0 };
+
+// The queue is unbounded for stream events, which stream limits and receive
+// credit already bound. Datagrams have no flow control (RFC 9221 §5.3) and
+// MAY be dropped when the receiver cannot process them, so each connection
+// may have at most this many queued ahead of the dispatcher. Per connection,
+// not global: one flooding peer must not cost every other peer its datagrams.
+// 128 is quic-go's per-connection receive queue; neqo uses 10, quiche makes
+// the application choose. When full the oldest is dropped, not the newest:
+// for the signals datagrams carry (presence, positions) the stale one is the
+// one nobody wants, which is quiche's and neqo's policy too. The count is of
+// datagrams, so a backlog of stream events does not cost datagrams.
+#define DATAGRAM_QUEUE_LIMIT 128
+static uint64_t DroppedDatagrams = 0;
+
+// Under EventQueue.lock. Finds the oldest undropped datagram for the
+// connection and marks it; the dispatcher frees it without delivering.
+static void
+drop_oldest_datagram(void* connection_ctx)
+{
+    for (size_t i = 0; i < EventQueue.len; i++) {
+        RubyEvent* ev = &EventQueue.buf[(EventQueue.head + i) % EventQueue.cap];
+        if (ev->connection_ctx == connection_ctx && !ev->dropped &&
+            strcmp(ev->event_type, "DATAGRAM_RECEIVED") == 0) {
+            ev->dropped = 1;
+            return;
+        }
+    }
+}
+
+// Grow by doubling, re-linearising the ring. Unbounded on purpose: a bounded
+// queue that blocks the poll thread would deadlock against a Ruby thread
+// calling StreamSend (needs the connection lock the blocked callback holds),
+// and one that drops would lose stream data. Per-stream receive credit is
+// what bounds memory, as before.
+static int
+event_queue_grow(void)
+{
+    size_t cap = EventQueue.cap ? EventQueue.cap * 2 : 256;
+    RubyEvent* buf = malloc(cap * sizeof(RubyEvent));
+    if (!buf) return 0;
+    for (size_t i = 0; i < EventQueue.len; i++) {
+        RubyEvent* from = &EventQueue.buf[(EventQueue.head + i) % EventQueue.cap];
+        buf[i] = *from;
+        // Inline descriptors must point at their own copy.
+        if (from->buffers == from->inline_buffers) buf[i].buffers = buf[i].inline_buffers;
+    }
+    free(EventQueue.buf);
+    EventQueue.buf = buf;
+    EventQueue.cap = cap;
+    EventQueue.head = 0;
+    return 1;
+}
+
+static int event_queue_push(RubyEvent* evp);
+
+// `owned` is a malloc'd buffer the queue takes over; otherwise data is copied.
+static int
+queue_event_full(HQUIC connection, void* connection_ctx, VALUE client_obj,
+                 const char* event_type, uint64_t stream_id,
+                 const char* data, size_t data_len, int early_data,
+                 char* owned, ReleaseKind release, void* release_ptr)
+{
+    RubyEvent ev;
+    ev.connection = connection;
+    ev.connection_ctx = connection_ctx;
+    ev.client_obj = client_obj;
+    ev.event_type = event_type;
+    ev.stream_id = stream_id;
+    ev.data_len = data_len;
+    ev.early_data = early_data;
+    ev.release = release;
+    ev.release_ptr = release_ptr;
+    if (owned) {
+        ev.data = owned;
+    } else if (data_len <= EVENT_INLINE_DATA) {
+        ev.data = NULL;
+        if (data_len) memcpy(ev.inline_data, data, data_len);
+    } else {
+        ev.data = malloc(data_len);
+        if (!ev.data) return 0;
+        memcpy(ev.data, data, data_len);
+    }
+
+    ev.dropped = 0;
+    ev.stream = NULL;
+    ev.buffers = NULL;
+    ev.buffer_count = 0;
+    return event_queue_push(&ev);
+}
+
+// Copies the record into the ring; frees ev->data on failure.
+static int
+event_queue_push(RubyEvent* evp)
+{
+    RubyEvent ev = *evp;
+    const char* event_type = ev.event_type;
+    void* connection_ctx = ev.connection_ctx;
+    int is_datagram = strcmp(event_type, "DATAGRAM_RECEIVED") == 0;
+    ConnectionContext* conn = (ConnectionContext*)connection_ctx;
+    pthread_mutex_lock(&EventQueue.lock);
+    if (is_datagram && conn && conn->queued_datagrams >= DATAGRAM_QUEUE_LIMIT) {
+        // Make room by dropping the oldest; the new one is queued below.
+        drop_oldest_datagram(conn);
+        conn->queued_datagrams--;
+        conn->dropped_datagrams++;
+        DroppedDatagrams++;
+    }
+    if (EventQueue.len == EventQueue.cap && !event_queue_grow()) {
+        pthread_mutex_unlock(&EventQueue.lock);
+        free(ev.data);
+        return 0;
+    }
+    RubyEvent* slot = &EventQueue.buf[(EventQueue.head + EventQueue.len) % EventQueue.cap];
+    *slot = ev;
+    if (ev.buffers == evp->inline_buffers) slot->buffers = slot->inline_buffers;
+    EventQueue.len++;
+    if (is_datagram && conn) conn->queued_datagrams++;
+    pthread_cond_signal(&EventQueue.ready);
+    pthread_mutex_unlock(&EventQueue.lock);
+    return 1;
+}
+
+static int
+queue_event(HQUIC connection, void* connection_ctx, VALUE client_obj,
+            const char* event_type, uint64_t stream_id,
+            const char* data, size_t data_len, int early_data)
+{
+    return queue_event_full(connection, connection_ctx, client_obj, event_type, stream_id,
+                            data, data_len, early_data, NULL, RELEASE_NONE, NULL);
+}
+
+// --- Zero-copy sends ---------------------------------------------------------
+//
+// A send used to malloc a QUIC_BUFFER plus a copy of the body and memcpy the
+// body into it, with the GVL held, then free it on SEND_COMPLETE. For a 12MB
+// response that is a 12MB allocate-and-copy during which no other Ruby thread
+// runs. Instead the Ruby String is frozen and retained, and QUIC_BUFFER points
+// straight at its bytes. MsQuic owns the pointer until SEND_COMPLETE, so the
+// String must not move or be collected until then: LiveSends is a GC root
+// that marks every retained String, and SEND_COMPLETE removes the entry.
+//
+// Freezing is what makes the pointer stable. A frozen String cannot be
+// resized or have its buffer replaced, and the encoder hands these Strings
+// over without reusing them. Compaction could still move an unfrozen embedded
+// String; rb_gc_mark (not rb_gc_mark_movable) pins what it marks, so the
+// retained Strings stay put.
+//
+// Every mutation of LiveSends happens with the GVL held: quicsilver_send_stream
+// is a Ruby method, and the release for SEND_COMPLETE runs on the dispatcher
+// thread, not in the callback. GC runs with the GVL. So the table needs no
+// lock.
+typedef struct {
+    QUIC_BUFFER buffer;
+    VALUE data;
+} SendContext;
+
+static st_table* LiveSends;
+static VALUE LiveSendsRoot = Qnil;
+// gc_mark_children skips a T_DATA's dmark when its data pointer is NULL, so
+// the root wraps this instead of NULL. Its value is never read.
+static int LiveSendsRootData;
+
+static int
+mark_live_send(st_data_t key, st_data_t value, st_data_t arg)
+{
+    (void)key; (void)arg;
+    rb_gc_mark(((SendContext*)value)->data);
+    return ST_CONTINUE;
+}
+
+static void
+live_sends_mark(void* ptr)
+{
+    (void)ptr;
+    if (LiveSends) st_foreach(LiveSends, mark_live_send, 0);
+}
+
+static const rb_data_type_t live_sends_type = {
+    "Quicsilver::LiveSends",
+    { live_sends_mark, NULL, NULL, },
+    0, 0, RUBY_TYPED_FREE_IMMEDIATELY
+};
+
+static SendContext*
+send_context_new(VALUE data)
+{
+    SendContext* ctx = malloc(sizeof(SendContext));
+    if (!ctx) return NULL;
+    ctx->data = data;
+    ctx->buffer.Buffer = (uint8_t*)RSTRING_PTR(data);
+    ctx->buffer.Length = (uint32_t)RSTRING_LEN(data);
+    st_insert(LiveSends, (st_data_t)ctx, (st_data_t)ctx);
+    return ctx;
+}
+
+static void
+send_context_release(void* raw)
+{
+    if (!raw) return;
+    st_data_t key = (st_data_t)raw;
+    st_delete(LiveSends, &key, NULL);
+    free(raw);
+}
+static uint64_t NextStreamToken = 1;
+
+static uint64_t
+register_stream(StreamContext* ctx, HQUIC stream, QUIC_STREAM_SHUTDOWN_FLAGS flags)
+{
+    ctx->stream = stream;
+    ctx->abort_flags = flags;
+    ctx->receive_credit = 0;
+    ctx->receive_chunks = 0;
+    ctx->receive_paused = 0;
+    ctx->receive_credit_enabled = 0;
+    ctx->receive_delivery_failed = 0;
+    ctx->fin_delivered = 0;
+    ctx->pending_priority = 0;
+    // The token is minted under the same lock that inserts it. Peer streams
+    // are registered on the poll thread and client streams on Ruby threads;
+    // with the poll thread no longer holding the GVL, a bare increment here
+    // handed two streams one token, and send_stream resolved to the wrong one.
+    // Found as a client receiving its own request frame as a response.
+    STATE_LOCK();
+    ctx->token = NextStreamToken++;
+    st_insert(LiveStreams, (st_data_t)ctx->token, (st_data_t)ctx);
+    STATE_UNLOCK();
+    return ctx->token;
+}
+
+static StreamContext*
+find_stream(uint64_t token)
+{
+    st_data_t entry;
+    STATE_LOCK();
+    int found = st_lookup(LiveStreams, (st_data_t)token, &entry);
+    STATE_UNLOCK();
+    return found ? (StreamContext*)entry : NULL;
+}
+
+static void
+unregister_stream(uint64_t token)
+{
+    st_data_t key = (st_data_t)token;
+    STATE_LOCK();
+    st_delete(LiveStreams, &key, NULL);
+    STATE_UNLOCK();
+}
+
+static int
+forget_connection_stream(st_data_t key, st_data_t value, st_data_t connection)
+{
+    StreamContext* ctx = (StreamContext*)value;
+    if (ctx->connection != (HQUIC)connection) return ST_CONTINUE;
+    return ST_DELETE;
+}
+
+static void
+forget_connection_streams(HQUIC connection)
+{
+    STATE_LOCK();
+    st_foreach(LiveStreams, forget_connection_stream, (st_data_t)connection);
+    STATE_UNLOCK();
+}
+
+
+// rb_protect wrapper — catches Ruby exceptions so they don't longjmp
+// through MsQuic callback frames (which would corrupt MsQuic state).
+// All Ruby object construction AND the funcall happen inside rb_protect.
+struct dispatch_ruby_args {
+    HQUIC connection;
+    void* connection_ctx;
+    VALUE client_obj;
+    // For a pending receive: gather these into the String after the token.
+    const QUIC_BUFFER* buffers;
+    uint32_t buffer_count;
+    uint64_t token;
+    uint64_t accepted;
+    VALUE payload;               // Qundef, or a String built before dispatch
+    char remote_address[INET6_ADDRSTRLEN];
+    uint16_t remote_port;
+    int session_resumed;
+    const char* event_type;
+    uint64_t stream_id;
+    const char* data;
+    size_t data_len;
+    int early_data;
+};
+
+// [token][bytes], gathered straight from MsQuic's buffers.
+static VALUE
+gather_receive_string(struct dispatch_ruby_args* a)
+{
+    VALUE str = rb_str_new(NULL, (long)(sizeof(a->token) + a->accepted));
+    char* out = RSTRING_PTR(str);
+    memcpy(out, &a->token, sizeof(a->token));
+    out += sizeof(a->token);
+    uint64_t remaining = a->accepted;
+    for (uint32_t b = 0; b < a->buffer_count && remaining; b++) {
+        size_t len = a->buffers[b].Length;
+        if (len > remaining) len = (size_t)remaining;
+        memcpy(out, a->buffers[b].Buffer, len);
+        out += len;
+        remaining -= len;
+    }
+    return str;
+}
+
+static VALUE
+gather_receive_protected(VALUE arg)
+{
+    return gather_receive_string((struct dispatch_ruby_args*)arg);
+}
+
+static VALUE
+dispatch_ruby_body(VALUE arg)
+{
+    struct dispatch_ruby_args* a = (struct dispatch_ruby_args*)arg;
+    VALUE payload = a->payload != Qundef ? a->payload : rb_str_new(a->data, a->data_len);
+
+    if (NIL_P(a->client_obj)) {
+        VALUE server_class = rb_const_get_at(mQuicsilver, rb_intern("Server"));
+        if (rb_class_real(CLASS_OF(server_class)) == rb_cClass) {
+            ConnectionContext* conn_ctx = (ConnectionContext*)a->connection_ctx;
+            VALUE connection_data = rb_ary_new2(3);
+            rb_ary_push(connection_data, ULL2NUM((uintptr_t)a->connection));
+            rb_ary_push(connection_data, ULL2NUM((uintptr_t)a->connection_ctx));
+            rb_ary_push(connection_data, conn_ctx && conn_ctx->session_resumed ? Qtrue : Qfalse);
+            VALUE argv[5] = {
+                connection_data,
+                ULL2NUM(a->stream_id),
+                rb_str_new_cstr(a->event_type),
+                payload,
+                a->early_data ? Qtrue : Qfalse
+            };
+            rb_funcallv(server_class, rb_intern("handle_stream"), 5, argv);
+        }
+    } else {
+        if (RB_TYPE_P(a->client_obj, T_OBJECT)) {
+            VALUE argv[4] = {
+                ULL2NUM(a->stream_id),
+                rb_str_new_cstr(a->event_type),
+                payload,
+                a->early_data ? Qtrue : Qfalse
+            };
+            rb_funcallv(a->client_obj, rb_intern("handle_stream_event"), 4, argv);
+        }
+    }
+
+    return Qnil;
+}
+
+static VALUE
+format_dispatch_error(VALUE err)
+{
+    VALUE klass = rb_class_name(rb_obj_class(err));
+    VALUE msg = rb_funcall(err, rb_intern("message"), 0);
+    VALUE bt = rb_funcall(err, rb_intern("backtrace"), 0);
+    fprintf(stderr, "Quicsilver: exception in callback: %s: %s\n",
+        StringValueCStr(klass), StringValueCStr(msg));
+    if (RB_TYPE_P(bt, T_ARRAY) && RARRAY_LEN(bt) > 0) {
+        long bt_len = RARRAY_LEN(bt) < 5 ? RARRAY_LEN(bt) : 5;
+        for (long i = 0; i < bt_len; i++) {
+            VALUE line = rb_ary_entry(bt, i);
+            fprintf(stderr, "  %s\n", StringValueCStr(line));
+        }
+    }
+    return Qnil;
+}
+
+// Deliver one event to Ruby, on the dispatcher thread, with the GVL. The body
+// is wrapped in rb_protect so an exception in the handler is logged rather
+// than unwinding the dispatcher. Returns the protect state: nonzero means the
+// handler raised.
+static int
+dispatch_to_ruby(HQUIC connection, void* connection_ctx, VALUE client_obj,
+                 const char* event_type, uint64_t stream_id,
+                 const char* data, size_t data_len, int early_data,
+                 VALUE prebuilt)
+{
+    struct dispatch_ruby_args args;
+    args.buffers = NULL;
+    args.buffer_count = 0;
+    args.token = 0;
+    args.accepted = 0;
+    args.payload = prebuilt;
+    args.connection = connection;
+    args.connection_ctx = connection_ctx;
+    args.client_obj = client_obj;
+    args.event_type = event_type;
+    args.stream_id = stream_id;
+    args.data = data;
+    args.data_len = data_len;
+    args.early_data = early_data;
+
+    int state = 0;
+    rb_protect(dispatch_ruby_body, (VALUE)&args, &state);
+    if (state) {
+        VALUE err = rb_errinfo();
+        rb_set_errinfo(Qnil);
+        if (!NIL_P(err)) {
+            // #message and #backtrace are Ruby methods and can raise. Protect
+            // them too, or an exception in the handler's exception takes the
+            // dispatcher thread down.
+            int format_state = 0;
+            rb_protect(format_dispatch_error, err, &format_state);
+            if (format_state) {
+                rb_set_errinfo(Qnil);
+                fprintf(stderr, "Quicsilver: exception in callback (unprintable)\n");
+            }
+        }
+    }
+    return state;
+}
+
+// Unsigned credit argument: NUM2ULL wraps negatives, so check the sign first.
+static uint64_t
+credit_arg(VALUE value, const char* label)
+{
+    if (!RB_INTEGER_TYPE_P(value)) rb_raise(rb_eTypeError, "%s must be an integer", label);
+    if (RTEST(rb_funcall(value, rb_intern("<"), 1, INT2FIX(0)))) {
+        rb_raise(rb_eArgError, "%s must not be negative", label);
+    }
+    return NUM2ULL(value);
+}
+
+static int
+resume_receive(StreamContext* ctx)
+{
+    QUIC_STATUS status = MsQuic->StreamReceiveSetEnabled(ctx->stream, TRUE);
+    if (QUIC_FAILED(status)) return 0;
+    return 1;
+}
+
+// Returns QUIC_STATUS_PENDING: MsQuic keeps the bytes until the dispatcher
+// has copied them into the Ruby String and called StreamReceiveComplete. The
+// bytes outlive this callback (freed at StreamClose, which the dispatcher does
+// later); the QUIC_BUFFER descriptors do not and are copied. One receive per
+// stream is pending at a time, so the queue holds at most one per stream.
+//
+// When credit enforcement is active (receive_credit_enabled, set by the first
+// grant) we accept only what fits and complete with that length; MsQuic then
+// disables further receives until StreamReceiveSetEnabled, which the next
+// sufficient grant issues (see receive_paused). A partially accepted receive
+// never carries FIN: it arrives with the suffix.
+static QUIC_STATUS
+receive_with_credit(StreamContext* ctx, QUIC_STREAM_EVENT* event)
+{
+    uint64_t indicated = event->RECEIVE.TotalBufferLength;
+    uint64_t accepted = indicated;
+
+    // Decide and debit under one lock hold, so a concurrent grant sees either
+    // the state before this receive or after it, never the middle.
+    STATE_LOCK();
+    int failed_before = ctx->receive_delivery_failed;
+    if (ctx->receive_credit_enabled) {
+        if (accepted > ctx->receive_credit) accepted = ctx->receive_credit;
+        if (!ctx->receive_chunks) accepted = 0;
+        ctx->receive_credit -= accepted;
+        if (accepted) ctx->receive_chunks--;
+        if (accepted < indicated) ctx->receive_paused = 1;
+    }
+    STATE_UNLOCK();
+
+    int has_fin = (event->RECEIVE.Flags & QUIC_RECEIVE_FLAG_FIN) && accepted == indicated;
+    if (failed_before || (!accepted && !has_fin)) {
+        event->RECEIVE.TotalBufferLength = 0;
+        return QUIC_STATUS_SUCCESS;
+    }
+    if (accepted > LONG_MAX - sizeof(uint64_t)) goto failed;
+
+    RubyEvent ev;
+    memset(&ev, 0, sizeof(ev));
+    ev.connection = ctx->connection;
+    ev.connection_ctx = ctx->connection_ctx;
+    ev.client_obj = ctx->client_obj;
+    ev.event_type = has_fin ? "RECEIVE_FIN" : "RECEIVE";
+    ev.stream_id = ctx->stream_id;
+    ev.early_data = has_fin ? ctx->early_data : 0;
+    ev.stream = ctx->stream;
+    ev.token = ctx->token;
+    ev.accepted = accepted;
+    ev.data = NULL;
+    ev.data_len = sizeof(uint64_t) + (size_t)accepted;
+
+    uint32_t count = 0;
+    uint64_t covered = 0;
+    while (count < event->RECEIVE.BufferCount && covered < accepted) {
+        covered += event->RECEIVE.Buffers[count].Length;
+        count++;
+    }
+    ev.buffer_count = count;
+    if (count <= EVENT_INLINE_BUFFERS) {
+        ev.buffers = ev.inline_buffers;
+    } else {
+        ev.buffers = malloc(count * sizeof(QUIC_BUFFER));
+        if (!ev.buffers) goto failed;
+    }
+    memcpy(ev.buffers, event->RECEIVE.Buffers, count * sizeof(QUIC_BUFFER));
+
+    if (!event_queue_push(&ev)) {
+        if (ev.buffers != ev.inline_buffers) free(ev.buffers);
+        goto failed;
+    }
+    if (has_fin) ctx->fin_delivered = 1;
+    return QUIC_STATUS_PENDING;
+
+failed:
+    // Last resort: a receive we could not hand to Ruby is data the stream can
+    // never deliver in order, so the stream ends here.
+    fprintf(stderr, "Quicsilver: receive delivery failed on stream %llu; aborting\n",
+        (unsigned long long)ctx->stream_id);
+    STATE_LOCK();
+    ctx->receive_delivery_failed = 1;
+    ctx->receive_credit = 0;
+    STATE_UNLOCK();
+    // Already in a native callback; inline abort avoids allocating a queued
+    // operation on this failure path. It may retire ctx before returning.
+    MsQuic->StreamShutdown(ctx->stream, ctx->abort_flags | QUIC_STREAM_SHUTDOWN_FLAG_INLINE, 0);
+    event->RECEIVE.TotalBufferLength = 0;
+    return QUIC_STATUS_SUCCESS;
+}
+
+// Platform I/O wait — called without GVL so other Ruby threads can run
+struct poll_args {
+    QUIC_EVENTQ eq;
+    QUIC_CQE events[64];
+    int max_events;
+    int timeout_ms;
+    int count;
+};
+
+static void*
+eventq_wait_nogvl(void* arg)
+{
+    struct poll_args* a = (struct poll_args*)arg;
+#if __linux__
+    a->count = epoll_wait(a->eq, a->events, a->max_events, a->timeout_ms);
+    if (a->count < 0 && errno == EINTR) a->count = 0;
+#elif __APPLE__ || __FreeBSD__
+    struct timespec ts;
+    ts.tv_sec = a->timeout_ms / 1000;
+    ts.tv_nsec = (a->timeout_ms % 1000) * 1000000;
+    a->count = kevent(a->eq, NULL, 0, a->events, a->max_events, &ts);
+    if (a->count < 0 && errno == EINTR) a->count = 0;
+#endif
+    return NULL;
+}
+
+static inline QUIC_SQE*
+cqe_get_sqe(QUIC_CQE* cqe)
+{
+#if __linux__
+    return (QUIC_SQE*)cqe->data.ptr;
+#elif __APPLE__ || __FreeBSD__
+    return (QUIC_SQE*)cqe->udata;
+#endif
+}
+
+// Drive MsQuic execution: poll internal timers, wait for I/O, fire completions.
+// Callbacks (StreamCallback, ConnectionCallback) fire HERE on the Ruby thread.
+// One iteration of the MsQuic loop, with the GVL released for all of it.
+//
+// Before, only the kevent/epoll_wait sleep released the GVL; ExecutionPoll and
+// the completion callbacks, which is where MsQuic decrypts packets, runs loss
+// recovery and reassembles streams, ran with it held, because the callbacks
+// called into Ruby. They no longer do, so none of this needs the lock, and
+// the dispatcher and worker threads run in parallel with the datapath.
+static void*
+poll_nogvl(void* arg)
+{
+    struct poll_args* a = (struct poll_args*)arg;
+
+    uint32_t wait_ms = MsQuic->ExecutionPoll(ExecContext);
+    // With wake_event_loop(), Ruby threads instantly unblock us when work is
+    // queued. Cap at 1s as a safety net for shutdown responsiveness.
+    a->timeout_ms = (int)((wait_ms == UINT32_MAX) ? 1000 : wait_ms);
+    a->count = 0;
+    eventq_wait_nogvl(a);
+
+    for (int i = 0; i < a->count; i++) {
+#if __linux__
+        if (a->events[i].data.ptr == NULL) {
+            uint64_t val;
+            read(WakeFd, &val, sizeof(val));  // drain eventfd
+            continue;
+        }
+#elif __APPLE__ || __FreeBSD__
+        if (a->events[i].filter == EVFILT_USER && a->events[i].ident == WAKE_IDENT) continue;
+#endif
+        QUIC_SQE* sqe = cqe_get_sqe(&a->events[i]);
+        if (sqe && sqe->Completion) {
+            sqe->Completion(&a->events[i]);
+        }
+    }
+    return NULL;
+}
+
+static VALUE
+quicsilver_poll(VALUE self)
+{
+    if (ExecContext == NULL) return INT2NUM(0);
+
+    struct poll_args args;
+    args.eq = EventQ;
+    args.max_events = 64;
+    rb_thread_call_without_gvl(poll_nogvl, &args, RUBY_UBF_IO, NULL);
+    return INT2NUM(args.count);
+}
+
+// --- Dispatcher side ---------------------------------------------------------
+
+// Upper bound on events per dispatch_events call, and the size of the batch
+// copied out under the queue lock. Fixed rather than caller-sized so the
+// stack frame is known.
+#define DISPATCH_BATCH_MAX 64
+
+struct queue_wait_args {
+    int timeout_ms;
+};
+
+static void*
+queue_wait_nogvl(void* arg)
+{
+    struct queue_wait_args* a = (struct queue_wait_args*)arg;
+    struct timespec deadline;
+    clock_gettime(CLOCK_REALTIME, &deadline);
+    deadline.tv_sec += a->timeout_ms / 1000;
+    deadline.tv_nsec += (long)(a->timeout_ms % 1000) * 1000000L;
+    if (deadline.tv_nsec >= 1000000000L) { deadline.tv_sec++; deadline.tv_nsec -= 1000000000L; }
+
+    pthread_mutex_lock(&EventQueue.lock);
+    while (EventQueue.len == 0 && !EventQueue.closed) {
+        if (pthread_cond_timedwait(&EventQueue.ready, &EventQueue.lock, &deadline) == ETIMEDOUT) break;
+    }
+    pthread_mutex_unlock(&EventQueue.lock);
+    return NULL;
+}
+
+// Thread#raise / Thread#kill against a dispatcher blocked in the wait.
+static void
+queue_wake_ubf(void* arg)
+{
+    (void)arg;
+    pthread_mutex_lock(&EventQueue.lock);
+    pthread_cond_broadcast(&EventQueue.ready);
+    pthread_mutex_unlock(&EventQueue.lock);
+}
+
+// What a callback used to do after dispatch, done here with the GVL held.
+static void
+perform_release(RubyEvent* ev)
+{
+    switch (ev->release) {
+    case RELEASE_NONE:
+        break;
+    case RELEASE_SEND:
+        send_context_release(ev->release_ptr);
+        break;
+    case RELEASE_STREAM:
+    case RELEASE_STREAM_NOCLOSE: {
+        StreamContext* ctx = (StreamContext*)ev->release_ptr;
+        unregister_stream(ctx->token);
+        if (ev->release == RELEASE_STREAM) MsQuic->StreamClose(ctx->stream);
+        free(ctx);
+        break;
+    }
+    case RELEASE_CONNECTION: {
+        ConnectionContext* ctx = (ConnectionContext*)ev->release_ptr;
+        forget_connection_streams(ev->connection);
+        if (!NIL_P(ctx->client_obj)) rb_gc_unregister_address(&ctx->client_obj);
+        free(ctx->resumption_ticket);
+        free(ctx);
+        break;
+    }
+    }
+}
+
+// A handler that raised on RECEIVE has broken the stream's byte order for
+// good, so the stream is aborted, as the callback used to do inline.
+static void
+abort_after_failed_receive(RubyEvent* ev)
+{
+    if (strncmp(ev->event_type, "RECEIVE", 7) != 0) return;
+    uint64_t token = ev->token;
+    StreamContext* ctx = find_stream(token);
+    if (!ctx) return;
+    STATE_LOCK();
+    ctx->receive_delivery_failed = 1;
+    ctx->receive_credit = 0;
+    STATE_UNLOCK();
+    MsQuic->StreamShutdown(ctx->stream, ctx->abort_flags, 0);
+    wake_event_loop();
+}
+
+// Wait up to timeout_ms for events, then deliver up to max_events of them to
+// Ruby. Returns the number delivered, or nil once the queue is closed and
+// empty, which is the dispatcher's signal to exit.
+static VALUE
+quicsilver_dispatch_events(VALUE self, VALUE max_events, VALUE timeout_ms)
+{
+    long max = NUM2LONG(max_events);
+    if (max < 1) max = 1;
+    if (max > DISPATCH_BATCH_MAX) max = DISPATCH_BATCH_MAX;
+    struct queue_wait_args wait = { NUM2INT(timeout_ms) };
+    rb_thread_call_without_gvl(queue_wait_nogvl, &wait, queue_wake_ubf, NULL);
+
+    RubyEvent batch[DISPATCH_BATCH_MAX];
+    long n = 0;
+    int closed;
+    pthread_mutex_lock(&EventQueue.lock);
+    closed = EventQueue.closed;
+    while (n < max && EventQueue.len > 0) {
+        RubyEvent* ev = &EventQueue.buf[EventQueue.head];
+        if (!ev->dropped && ev->connection_ctx && strcmp(ev->event_type, "DATAGRAM_RECEIVED") == 0) {
+            ((ConnectionContext*)ev->connection_ctx)->queued_datagrams--;
+        }
+        batch[n] = *ev;
+        if (ev->buffers == ev->inline_buffers) batch[n].buffers = batch[n].inline_buffers;
+        n++;
+        EventQueue.head = (EventQueue.head + 1) % EventQueue.cap;
+        EventQueue.len--;
+    }
+    pthread_mutex_unlock(&EventQueue.lock);
+
+    for (long i = 0; i < n; i++) {
+        RubyEvent* ev = &batch[i];
+        if (ev->dropped) { free(ev->data); continue; }
+        const char* data = ev->data ? ev->data : ev->inline_data;
+        VALUE payload = Qundef;
+        if (ev->buffers) {
+            // Complete before the handler runs. A partial completion pauses
+            // the stream; a grant from the handler queues the resume; the
+            // pause must be queued first.
+            struct dispatch_ruby_args gather = { .buffers = ev->buffers,
+                .buffer_count = ev->buffer_count, .token = ev->token, .accepted = ev->accepted };
+            int gather_state = 0;
+            payload = rb_protect(gather_receive_protected, (VALUE)&gather, &gather_state);
+            if (gather_state) { rb_set_errinfo(Qnil); payload = Qundef; }
+            if (MsQuic) MsQuic->StreamReceiveComplete(ev->stream, ev->accepted);
+            if (ev->buffers != ev->inline_buffers) free(ev->buffers);
+            if (payload == Qundef) { abort_after_failed_receive(ev); perform_release(ev); continue; }
+        }
+        int state = dispatch_to_ruby(ev->connection, ev->connection_ctx, ev->client_obj,
+            ev->event_type, ev->stream_id, data, ev->data_len, ev->early_data, payload);
+        if (state) abort_after_failed_receive(ev);
+        perform_release(ev);
+        free(ev->data);
+    }
+
+    if (n == 0 && closed) return Qnil;
+    // The dispatcher does not yield here. Workers get the GVL when the
+    // server's admission queue is under pressure (Server#enqueue_work), which
+    // is the only reason to interrupt a batch; an unconditional yield per
+    // batch cost throughput and doubled tail latency for nothing.
+    return LONG2NUM(n);
+}
+
+// Datagrams dropped because the dispatcher was behind (DATAGRAM_QUEUE_LIMIT).
+// A drop counter nobody can read is a drop debugged by guessing.
+static VALUE
+quicsilver_dropped_datagrams(VALUE self)
+{
+    pthread_mutex_lock(&EventQueue.lock);
+    uint64_t dropped = DroppedDatagrams;
+    pthread_mutex_unlock(&EventQueue.lock);
+    return ULL2NUM(dropped);
+}
+
+
+static VALUE
+quicsilver_open_event_queue(VALUE self)
+{
+    pthread_mutex_lock(&EventQueue.lock);
+    EventQueue.closed = 0;
+    pthread_mutex_unlock(&EventQueue.lock);
+    return Qnil;
+}
+
+// Stops the dispatcher once it has drained what is already queued. Call after
+// the poll thread has stopped, so nothing is pushed afterwards.
+static VALUE
+quicsilver_close_event_queue(VALUE self)
+{
+    pthread_mutex_lock(&EventQueue.lock);
+    EventQueue.closed = 1;
+    pthread_cond_broadcast(&EventQueue.ready);
+    pthread_mutex_unlock(&EventQueue.lock);
+    return Qnil;
+}
+
+
+QUIC_STATUS
+StreamCallback(HQUIC Stream, void* Context, QUIC_STREAM_EVENT* Event)
+{
+    StreamContext* ctx = (StreamContext*)Context;
+
+    if (ctx == NULL) {
+        return QUIC_STATUS_SUCCESS;
+    }
+
+    uint64_t token = ctx->token;
+
+    // Lazily cache the QUIC stream ID on first callback.
+    // Can't do this at StreamStart — MsQuic defers ID assignment with FLAG_NONE
+    // until data is sent. By the first callback the ID is always assigned.
+    if (ctx->stream_id == UINT64_MAX) {
+        uint64_t id = UINT64_MAX;
+        uint32_t id_len = sizeof(id);
+        MsQuic->GetParam(Stream, QUIC_PARAM_STREAM_ID, &id_len, &id);
+        STATE_LOCK();
+        ctx->stream_id = id;
+        STATE_UNLOCK();
+    }
+
+    // MsQuic requires SetParam on its event thread.
+    uint32_t pending = __atomic_exchange_n(&ctx->pending_priority, 0, __ATOMIC_ACQ_REL);
+    if (pending) {
+        uint16_t priority = (uint16_t)(pending - 1);
+        MsQuic->SetParam(Stream, QUIC_PARAM_STREAM_PRIORITY, sizeof(priority), &priority);
+    }
+
+    switch (Event->Type) {
+        case QUIC_STREAM_EVENT_RECEIVE: {
+            // Track 0-RTT early data for replay protection
+            if (Event->RECEIVE.Flags & QUIC_RECEIVE_FLAG_0_RTT) {
+                ctx->early_data = 1;
+            }
+
+            return receive_with_credit(ctx, Event);
+        }
+        case QUIC_STREAM_EVENT_SEND_COMPLETE:
+            // The retained String is dropped on the dispatcher, after Ruby has
+            // seen the event; LiveSends is only ever touched under the GVL.
+            if (!queue_event_full(ctx->connection, ctx->connection_ctx, ctx->client_obj,
+                    "SEND_COMPLETE", ctx->stream_id, (const char*)&token, sizeof(token), 0,
+                    NULL, RELEASE_SEND, Event->SEND_COMPLETE.ClientContext)) {
+                // Out of memory. LiveSends is only touched under the GVL, so the
+                // SendContext and the String it pins leak rather than race GC.
+                fprintf(stderr, "Quicsilver: event queue allocation failed; leaking one send buffer\n");
+            }
+            break;
+        case QUIC_STREAM_EVENT_SHUTDOWN_COMPLETE:
+            // Nothing is torn down here. The stream stays in LiveStreams, and
+            // its handle stays open, until the dispatcher has delivered this
+            // event: Ruby may still be handling an earlier RECEIVE for it (a
+            // uni stream with FIN completes natively before Ruby sees its
+            // data) and must be able to address it. MsQuic returns an error
+            // for operations on a shut-down handle, so that is safe. The
+            // dispatcher unregisters, closes and frees, holding the GVL, which
+            // is what any Ruby thread that found ctx also holds.
+            __atomic_store_n(&ctx->shutdown, 1, __ATOMIC_RELEASE);
+            MsQuic->SetCallbackHandler(Stream, (void*)StreamCallback, NULL);
+            if (!queue_event_full(ctx->connection, ctx->connection_ctx, ctx->client_obj,
+                    "STREAM_SHUTDOWN_COMPLETE", ctx->stream_id, (const char*)&token, sizeof(token), 0,
+                    NULL, Event->SHUTDOWN_COMPLETE.AppCloseInProgress ? RELEASE_STREAM_NOCLOSE : RELEASE_STREAM, ctx)) {
+                // Out of memory. The context is not freed here: contexts are
+                // freed only on a thread holding the GVL, so that a Ruby thread
+                // between find_stream and its MsQuic call cannot have the
+                // pointer freed underneath it, and this thread never holds the
+                // GVL. Unregistering only stops future lookups. One context and
+                // one handle leak on an allocation failure that is already a
+                // terminal condition; the invariant stays whole.
+                fprintf(stderr, "Quicsilver: event queue allocation failed; leaking stream %llu\n",
+                    (unsigned long long)ctx->stream_id);
+                unregister_stream(token);
+            }
+            break;
+        case QUIC_STREAM_EVENT_START_COMPLETE: {
+            // Pack [stream_handle(8)][peer_accepted(1)] for Ruby
+            uint8_t accepted = Event->START_COMPLETE.PeerAccepted ? 1 : 0;
+            char payload[sizeof(token) + 1];
+            memcpy(payload, &token, sizeof(token));
+            payload[sizeof(token)] = accepted;
+            queue_event(ctx->connection, ctx->connection_ctx, ctx->client_obj,
+                "STREAM_START_COMPLETE", ctx->stream_id, payload, sizeof(payload), 0);
+            break;
+        }
+        case QUIC_STREAM_EVENT_PEER_ACCEPTED:
+            // Queued stream now accepted — peer raised MAX_STREAMS
+            queue_event(ctx->connection, ctx->connection_ctx, ctx->client_obj,
+                "STREAM_PEER_ACCEPTED", ctx->stream_id, (const char*)&token, sizeof(token), 0);
+            break;
+        case QUIC_STREAM_EVENT_PEER_SEND_SHUTDOWN:
+            // If the FIN arrived while a receive was pending, MsQuic reports it
+            // only here, never as a zero-length RECEIVE. Ruby expects RECEIVE_FIN.
+            if (!ctx->fin_delivered && !ctx->receive_delivery_failed) {
+                ctx->fin_delivered = 1;
+                queue_event(ctx->connection, ctx->connection_ctx, ctx->client_obj,
+                    "RECEIVE_FIN", ctx->stream_id, (const char*)&token, sizeof(token), ctx->early_data);
+            }
+            break;
+        case QUIC_STREAM_EVENT_PEER_SEND_ABORTED: {
+            // Peer sent RESET_STREAM — pack
+            // [stream_handle(8)][error_code(8)][final_size(8)]
+            //
+            // RESET_STREAM carries the stream's final size, and WebTransport
+            // session accounting needs it: without it the two endpoints
+            // disagree about how much credit a reset stream consumed
+            // (draft-ietf-webtrans-http3-16 5.4, RFC 9000 4.5).
+            uint64_t error_code = Event->PEER_SEND_ABORTED.ErrorCode;
+            // Read straight off the event: calling back into the MsQuic API
+            // from inside a callback risks re-entering locks the callback
+            // already holds.
+            uint64_t final_size = Event->PEER_SEND_ABORTED.FinalSize;
+            char combined[sizeof(token) + sizeof(uint64_t) + sizeof(uint64_t)];
+            memcpy(combined, &token, sizeof(token));
+            memcpy(combined + sizeof(token), &error_code, sizeof(uint64_t));
+            memcpy(combined + sizeof(token) + sizeof(uint64_t), &final_size, sizeof(uint64_t));
+            queue_event(ctx->connection, ctx->connection_ctx, ctx->client_obj, "STREAM_RESET", ctx->stream_id, combined, sizeof(combined), 0);
+            break;
+        }
+        case QUIC_STREAM_EVENT_PEER_RECEIVE_ABORTED: {
+            // Peer sent STOP_SENDING — pack [stream_handle(8)][error_code(8)]
+            uint64_t error_code = Event->PEER_RECEIVE_ABORTED.ErrorCode;
+            char combined[sizeof(token) + sizeof(uint64_t)];
+            memcpy(combined, &token, sizeof(token));
+            memcpy(combined + sizeof(token), &error_code, sizeof(uint64_t));
+            queue_event(ctx->connection, ctx->connection_ctx, ctx->client_obj, "STOP_SENDING", ctx->stream_id, combined, sizeof(combined), 0);
+            break;
+        }
+    }
+
+    return QUIC_STATUS_SUCCESS;
+}
+
+// Connection callback
+static QUIC_STATUS QUIC_API
+ConnectionCallback(HQUIC Connection, void* Context, QUIC_CONNECTION_EVENT* Event)
+{
+    ConnectionContext* ctx = (ConnectionContext*)Context;
+    HQUIC Stream;
+    StreamContext* stream_ctx;
+    
+    if (ctx == NULL) {
+        return QUIC_STATUS_SUCCESS;
+    }
+    
+    switch (Event->Type) {
+        case QUIC_CONNECTION_EVENT_RELIABLE_RESET_NEGOTIATED:
+            ctx->reliable_reset_negotiated = Event->RELIABLE_RESET_NEGOTIATED.IsNegotiated;
+            break;
+        case QUIC_CONNECTION_EVENT_CONNECTED:
+            ctx->connected = 1;
+            ctx->failed = 0;
+            ctx->session_resumed = Event->CONNECTED.SessionResumed;
+            // Server: send resumption ticket so client can do 0-RTT on reconnect
+            if (NIL_P(ctx->client_obj)) {
+                MsQuic->ConnectionSendResumptionTicket(Connection, QUIC_SEND_RESUMPTION_FLAG_NONE, 0, NULL);
+            }
+            // Notify Ruby about new connection - pass ctx pointer for building connection_data
+            queue_event(Connection, ctx, ctx->client_obj, "CONNECTION_ESTABLISHED", 0, (const char*)&Connection, sizeof(HQUIC), 0);
+            break;
+        case QUIC_CONNECTION_EVENT_RESUMPTION_TICKET_RECEIVED:
+            // Client-only: store the ticket for future 0-RTT reconnection
+            if (ctx->resumption_ticket) {
+                free(ctx->resumption_ticket);
+            }
+            ctx->resumption_ticket_length = Event->RESUMPTION_TICKET_RECEIVED.ResumptionTicketLength;
+            ctx->resumption_ticket = (uint8_t*)malloc(ctx->resumption_ticket_length);
+            if (ctx->resumption_ticket) {
+                memcpy(ctx->resumption_ticket, Event->RESUMPTION_TICKET_RECEIVED.ResumptionTicket, ctx->resumption_ticket_length);
+            }
+            break;
+        case QUIC_CONNECTION_EVENT_SHUTDOWN_INITIATED_BY_TRANSPORT:
+            ctx->connected = 0;
+            ctx->failed = 1;
+            ctx->error_status = Event->SHUTDOWN_INITIATED_BY_TRANSPORT.Status;
+            ctx->error_code = Event->SHUTDOWN_INITIATED_BY_TRANSPORT.ErrorCode;
+            break;
+        case QUIC_CONNECTION_EVENT_SHUTDOWN_INITIATED_BY_PEER:
+            ctx->connected = 0;
+            ctx->failed = 1;
+            ctx->error_status = QUIC_STATUS_SUCCESS; // Peer initiated, not an error
+            ctx->error_code = Event->SHUTDOWN_INITIATED_BY_PEER.ErrorCode;
+            break;
+        case QUIC_CONNECTION_EVENT_SHUTDOWN_COMPLETE:
+            ctx->connected = 0;
+            // Freed on the dispatcher after Ruby has seen CONNECTION_CLOSED:
+            // rb_gc_unregister_address needs the GVL, and Ruby may still hold
+            // the context pointer as a handle until it processes this event.
+            if (!queue_event_full(Connection, ctx, ctx->client_obj, "CONNECTION_CLOSED", 0,
+                    (const char*)&Connection, sizeof(HQUIC), 0, NULL, RELEASE_CONNECTION, ctx)) {
+                // Out of memory, and the release needs the GVL
+                // (rb_gc_unregister_address), which this thread never holds.
+                // Leaking one small context is the safe failure: freeing it
+                // would leave a GC root pointing at freed memory.
+                fprintf(stderr, "Quicsilver: event queue allocation failed; leaking connection context\n");
+            }
+            break;
+         case QUIC_CONNECTION_EVENT_PEER_STREAM_STARTED:
+            // Client opened a stream
+            Stream = Event->PEER_STREAM_STARTED.Stream;
+            stream_ctx = (StreamContext*)malloc(sizeof(StreamContext));
+            if (stream_ctx != NULL) {
+                stream_ctx->connection = Connection;
+                stream_ctx->connection_ctx = ctx;  // Store connection context pointer
+                stream_ctx->client_obj = ctx->client_obj;  // Copy from connection context
+                stream_ctx->started = 1;
+                stream_ctx->shutdown = 0;
+                stream_ctx->stream_id = UINT64_MAX;  // Lazily resolved on first callback
+                stream_ctx->early_data = 0;
+                stream_ctx->error_status = QUIC_STATUS_SUCCESS;
+
+                register_stream(stream_ctx, Stream,
+                    Event->PEER_STREAM_STARTED.Flags & QUIC_STREAM_OPEN_FLAG_UNIDIRECTIONAL
+                        ? QUIC_STREAM_SHUTDOWN_FLAG_ABORT_RECEIVE
+                        : QUIC_STREAM_SHUTDOWN_FLAG_ABORT);
+
+                // Set the stream callback handler to handle data events
+                MsQuic->SetCallbackHandler(Stream, (void*)StreamCallback, stream_ctx);
+            } else {
+                MsQuic->StreamClose(Stream);
+            }
+         break; 
+        case QUIC_CONNECTION_EVENT_DATAGRAM_RECEIVED:
+            // Bounded by DATAGRAM_QUEUE_LIMIT inside queue_event_full; past it
+            // the datagram is dropped and counted. Datagrams are best-effort by
+            // definition (RFC 9221), so that is a legitimate response to a
+            // dispatcher that has fallen behind.
+            queue_event(Connection, ctx, ctx->client_obj, "DATAGRAM_RECEIVED", 0,
+                (const char*)Event->DATAGRAM_RECEIVED.Buffer->Buffer,
+                Event->DATAGRAM_RECEIVED.Buffer->Length, 0);
+            break;
+        case QUIC_CONNECTION_EVENT_DATAGRAM_STATE_CHANGED:
+            break;
+        case QUIC_CONNECTION_EVENT_DATAGRAM_SEND_STATE_CHANGED:
+            // Free the send buffer when the datagram reaches a final state
+            if (QUIC_DATAGRAM_SEND_STATE_IS_FINAL(Event->DATAGRAM_SEND_STATE_CHANGED.State)) {
+                if (Event->DATAGRAM_SEND_STATE_CHANGED.ClientContext != NULL) {
+                    free(Event->DATAGRAM_SEND_STATE_CHANGED.ClientContext);
+                }
+            }
+            break;
+        default:
+            break;
+    }
+    
+    return QUIC_STATUS_SUCCESS;
+}
+
+// Listener callback to handle incoming connections
+static QUIC_STATUS QUIC_API
+ListenerCallback(HQUIC Listener, void* Context, QUIC_LISTENER_EVENT* Event)
+{
+    ListenerContext* ctx = (ListenerContext*)Context;
+    ConnectionContext* conn_ctx;
+    
+    if (ctx == NULL) {
+        return QUIC_STATUS_SUCCESS;
+    }
+    
+    switch (Event->Type) {
+        case QUIC_LISTENER_EVENT_NEW_CONNECTION:
+            // Create a connection context for the new connection
+            conn_ctx = (ConnectionContext*)malloc(sizeof(ConnectionContext));
+            if (conn_ctx != NULL) {
+                conn_ctx->connected = 0;
+                conn_ctx->failed = 0;
+                conn_ctx->error_status = QUIC_STATUS_SUCCESS;
+                conn_ctx->error_code = 0;
+                conn_ctx->client_obj = Qnil;  // Server connections have no client object
+                conn_ctx->remote_address[0] = '\0';
+                conn_ctx->remote_port = 0;
+                conn_ctx->session_resumed = 0;
+                conn_ctx->reliable_reset_negotiated = 0;
+                conn_ctx->resumption_ticket = NULL;
+                conn_ctx->queued_datagrams = 0;
+                conn_ctx->dropped_datagrams = 0;
+                conn_ctx->resumption_ticket_length = 0;
+
+                // Set the connection callback
+                MsQuic->SetCallbackHandler(Event->NEW_CONNECTION.Connection, (void*)ConnectionCallback, conn_ctx);
+
+                // Accept the new connection with the server configuration
+                QUIC_STATUS Status = MsQuic->ConnectionSetConfiguration(Event->NEW_CONNECTION.Connection, ctx->Configuration);
+                if (QUIC_FAILED(Status)) {
+                    free(conn_ctx);
+                    return Status;
+                }
+
+            } else {
+                // Reject the connection if we can't allocate context
+                return QUIC_STATUS_OUT_OF_MEMORY;
+            }
+            break;
+            
+        case QUIC_LISTENER_EVENT_STOP_COMPLETE:
+            ctx->stopped = 1;
+            break;
+            
+        default:
+            break;
+    }
+    
+    return QUIC_STATUS_SUCCESS;
+}
+
+// Initialize MSQUIC
+static VALUE
+quicsilver_open(VALUE self)
+{
+    QUIC_STATUS Status;
+    
+    // Check if already initialized
+    if (MsQuic != NULL && Registration != NULL) {
+        return Qtrue;
+    }
+    
+    // Open a handle to the library and get the API function table
+    if (MsQuic == NULL && QUIC_FAILED(Status = MsQuicOpenVersion(2, (const void**)&MsQuic))) {
+        rb_raise(rb_eRuntimeError, "MsQuicOpenVersion failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    // Custom execution MUST be set up BEFORE RegistrationOpen.
+    // RegistrationOpen triggers MsQuic lazy init (LazyInitComplete=TRUE),
+    // after which ExecutionCreate returns QUIC_STATUS_INVALID_STATE.
+#if __linux__
+    EventQ = epoll_create1(0);
+#elif __APPLE__ || __FreeBSD__
+    EventQ = kqueue();
+#endif
+    if (EventQ == -1) {
+        MsQuicClose(MsQuic);
+        MsQuic = NULL;
+        rb_raise(rb_eRuntimeError, "Failed to create event queue for custom execution");
+        return Qfalse;
+    }
+
+    // PollingIdleTimeoutUs: how long MsQuic keeps spinning on an idle
+    // execution context before it lets us sleep in kevent/epoll_wait. At zero
+    // every idle gap is a full sleep-and-wake, which is the fixed latency floor
+    // at low concurrency. A short spin trades CPU for that latency.
+    // QUICSILVER_POLL_IDLE_US overrides for measurement; the default stays 0
+    // until the trade is measured.
+    uint32_t polling_idle_us = 0;
+    const char* idle_env = getenv("QUICSILVER_POLL_IDLE_US");
+    if (idle_env && *idle_env) polling_idle_us = (uint32_t)strtoul(idle_env, NULL, 10);
+
+    // One execution context. The receive path's correctness argument depends
+    // on it: receive_with_credit sets receive_paused and returns a partial
+    // length, and a grant from a Ruby thread calls StreamReceiveSetEnabled,
+    // which MsQuic applies as a queued operation on the connection's worker.
+    // With one context that worker is this ExecutionPoll, so the resume
+    // always runs after the callback that paused. With more than one context
+    // a connection still has exactly one worker, so the argument holds per
+    // connection, but revisit it before changing this.
+    QUIC_EXECUTION_CONFIG exec_config = { 0, &EventQ };
+    Status = MsQuic->ExecutionCreate(
+        QUIC_GLOBAL_EXECUTION_CONFIG_FLAG_NONE,
+        polling_idle_us,
+        1,      // 1 execution context
+        &exec_config,
+        &ExecContext
+    );
+    if (QUIC_FAILED(Status)) {
+        close(EventQ);
+        EventQ = -1;
+        MsQuicClose(MsQuic);
+        MsQuic = NULL;
+        rb_raise(rb_eRuntimeError, "ExecutionCreate failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    // Now open registration — MsQuic lazy init will see the custom execution
+    // context and skip spawning its own worker threads.
+    if (QUIC_FAILED(Status = MsQuic->RegistrationOpen(&RegConfig, &Registration))) {
+        MsQuic->ExecutionDelete(1, &ExecContext);
+        ExecContext = NULL;
+        close(EventQ);
+        EventQ = -1;
+        MsQuicClose(MsQuic);
+        MsQuic = NULL;
+        rb_raise(rb_eRuntimeError, "RegistrationOpen failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    // Register wake source — Ruby threads can unblock the event loop
+#if __linux__
+    WakeFd = eventfd(0, EFD_NONBLOCK);
+    if (WakeFd != -1) {
+        struct epoll_event ev = { .events = EPOLLIN, .data.ptr = NULL };
+        epoll_ctl(EventQ, EPOLL_CTL_ADD, WakeFd, &ev);
+    }
+#elif __APPLE__ || __FreeBSD__
+    {
+        struct kevent kev;
+        EV_SET(&kev, WAKE_IDENT, EVFILT_USER, EV_ADD | EV_CLEAR, 0, 0, NULL);
+        kevent(EventQ, &kev, 1, NULL, 0, NULL);
+    }
+#endif
+
+    return Qtrue;
+}
+
+// Create a QUIC configuration (for client connections)
+static VALUE
+quicsilver_create_configuration(int argc, VALUE *argv, VALUE self)
+{
+    VALUE unsecure, datagram_receive_enabled, reliable_reset_enabled, incoming_bidi, incoming_uni,
+        idle_timeout_ms;
+    rb_scan_args(argc, argv, "15", &unsecure, &datagram_receive_enabled,
+        &reliable_reset_enabled, &incoming_bidi, &incoming_uni, &idle_timeout_ms);
+    if (argc < 2) datagram_receive_enabled = Qtrue;
+    if (argc < 3) reliable_reset_enabled = Qtrue;
+
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized. Call Quicsilver.open_connection first.");
+        return Qnil;
+    }
+    
+    QUIC_STATUS Status;
+    HQUIC Configuration = NULL;
+    
+    // Basic settings
+    QUIC_SETTINGS Settings = {0};
+    Settings.ReliableResetEnabled = RTEST(reliable_reset_enabled);
+    Settings.IsSet.ReliableResetEnabled = TRUE;
+    // The peer advertises its own idle timeout and the lower of the two applies.
+    if (!NIL_P(idle_timeout_ms)) {
+        Settings.IdleTimeoutMs = NUM2ULL(idle_timeout_ms);
+        Settings.IsSet.IdleTimeoutMs = TRUE;
+    }
+    Settings.DatagramReceiveEnabled = RTEST(datagram_receive_enabled);
+    Settings.IsSet.DatagramReceiveEnabled = TRUE;
+
+    // Optional credit for server-initiated streams. Leave native defaults alone
+    // when omitted; the uni limit also covers HTTP/3 control and QPACK streams.
+    if (!NIL_P(incoming_bidi)) {
+        unsigned int count = NUM2UINT(incoming_bidi);
+        if (count > UINT16_MAX) rb_raise(rb_eArgError, "max_incoming_bidi_streams must be between 0 and 65535");
+        Settings.PeerBidiStreamCount = (uint16_t)count;
+        Settings.IsSet.PeerBidiStreamCount = TRUE;
+    }
+    if (!NIL_P(incoming_uni)) {
+        unsigned int count = NUM2UINT(incoming_uni);
+        if (count > UINT16_MAX) rb_raise(rb_eArgError, "max_incoming_uni_streams must be between 0 and 65535");
+        Settings.PeerUnidiStreamCount = (uint16_t)count;
+        Settings.IsSet.PeerUnidiStreamCount = TRUE;
+    }
+    
+    // Simple ALPN for now - Ruby can customize this later
+    QUIC_BUFFER Alpn = { sizeof("h3") - 1, (uint8_t*)"h3" };
+    
+    // Create configuration
+    if (QUIC_FAILED(Status = MsQuic->ConfigurationOpen(Registration, &Alpn, 1, &Settings, sizeof(Settings), NULL, &Configuration))) {
+        rb_raise(rb_eRuntimeError, "ConfigurationOpen failed, 0x%x!", Status);
+        return Qnil;
+    }
+    
+    // Set up credentials
+    QUIC_CREDENTIAL_CONFIG CredConfig = {0};
+    CredConfig.Type = QUIC_CREDENTIAL_TYPE_NONE;
+    CredConfig.Flags = QUIC_CREDENTIAL_FLAG_CLIENT;
+    
+    if (RTEST(unsecure)) {
+        CredConfig.Flags |= QUIC_CREDENTIAL_FLAG_NO_CERTIFICATE_VALIDATION;
+    }
+    
+    if (QUIC_FAILED(Status = MsQuic->ConfigurationLoadCredential(Configuration, &CredConfig))) {
+        MsQuic->ConfigurationClose(Configuration);
+        rb_raise(rb_eRuntimeError, "ConfigurationLoadCredential failed, 0x%x!", Status);
+        return Qnil;
+    }
+
+    // Return the configuration handle as a Ruby integer (pointer)
+    return ULL2NUM((uintptr_t)Configuration);
+}
+
+// Create a QUIC server configuration
+static VALUE
+quicsilver_create_server_configuration(VALUE self, VALUE config_hash)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized. Call Quicsilver.open_connection first.");
+        return Qnil;
+    }
+    VALUE cert_file_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("cert_file")));
+    VALUE key_file_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("key_file")));
+    VALUE idle_timeout_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("idle_timeout_ms")));
+    VALUE server_resumption_level_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("server_resumption_level")));
+    VALUE max_concurrent_requests_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("max_concurrent_requests")));
+    VALUE max_unidirectional_streams_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("max_unidirectional_streams")));
+    VALUE alpn_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("alpn")));
+    VALUE stream_receive_window_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("stream_receive_window")));
+    VALUE stream_receive_buffer_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("stream_receive_buffer")));
+    VALUE connection_flow_control_window_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("connection_flow_control_window")));
+    VALUE pacing_enabled_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("pacing_enabled")));
+    VALUE send_buffering_enabled_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("send_buffering_enabled")));
+    VALUE initial_rtt_ms_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("initial_rtt_ms")));
+    VALUE initial_window_packets_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("initial_window_packets")));
+    VALUE max_ack_delay_ms_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("max_ack_delay_ms")));
+    VALUE keep_alive_interval_ms_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("keep_alive_interval_ms")));
+    VALUE congestion_control_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("congestion_control_algorithm")));
+    VALUE migration_enabled_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("migration_enabled")));
+    VALUE disconnect_timeout_ms_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("disconnect_timeout_ms")));
+    VALUE handshake_idle_timeout_ms_val = rb_hash_aref(config_hash, ID2SYM(rb_intern("handshake_idle_timeout_ms")));
+
+    QUIC_STATUS Status;
+    HQUIC Configuration = NULL;
+
+    const char* cert_path = StringValueCStr(cert_file_val);
+    const char* key_path = StringValueCStr(key_file_val);
+    uint32_t idle_timeout_ms = NUM2INT(idle_timeout_val);
+    uint32_t server_resumption_level = NUM2INT(server_resumption_level_val);
+    uint32_t max_concurrent_requests = NUM2INT(max_concurrent_requests_val);
+    uint32_t max_unidirectional_streams = NUM2INT(max_unidirectional_streams_val);
+    const char* alpn_str = StringValueCStr(alpn_val);
+    uint32_t stream_receive_window = NUM2UINT(stream_receive_window_val);
+    uint32_t stream_receive_buffer = NUM2UINT(stream_receive_buffer_val);
+    uint32_t connection_flow_control_window = NUM2UINT(connection_flow_control_window_val);
+    uint8_t pacing_enabled = (uint8_t)NUM2INT(pacing_enabled_val);
+    uint8_t send_buffering_enabled = (uint8_t)NUM2INT(send_buffering_enabled_val);
+    uint32_t initial_rtt_ms = NUM2UINT(initial_rtt_ms_val);
+    uint32_t initial_window_packets = NUM2UINT(initial_window_packets_val);
+    uint32_t max_ack_delay_ms = NUM2UINT(max_ack_delay_ms_val);
+    uint32_t keep_alive_interval_ms = NUM2UINT(keep_alive_interval_ms_val);
+    uint16_t congestion_control = (uint16_t)NUM2INT(congestion_control_val);
+    uint8_t migration_enabled = (uint8_t)NUM2INT(migration_enabled_val);
+    uint32_t disconnect_timeout_ms = NUM2UINT(disconnect_timeout_ms_val);
+    uint64_t handshake_idle_timeout_ms = NUM2ULL(handshake_idle_timeout_ms_val);
+
+    QUIC_SETTINGS Settings = {0};
+    Settings.ReliableResetEnabled = TRUE;
+    Settings.IsSet.ReliableResetEnabled = TRUE;
+    Settings.IdleTimeoutMs = idle_timeout_ms;
+    Settings.IsSet.IdleTimeoutMs = TRUE;
+    Settings.ServerResumptionLevel = server_resumption_level;
+    Settings.IsSet.ServerResumptionLevel = TRUE;
+    Settings.PeerBidiStreamCount = max_concurrent_requests;
+    Settings.IsSet.PeerBidiStreamCount = TRUE;
+    Settings.PeerUnidiStreamCount = max_unidirectional_streams;
+    Settings.IsSet.PeerUnidiStreamCount = TRUE;
+
+    // Flow control / backpressure settings
+    Settings.StreamRecvWindowDefault = stream_receive_window;
+    Settings.IsSet.StreamRecvWindowDefault = TRUE;
+    Settings.StreamRecvBufferDefault = stream_receive_buffer;
+    Settings.IsSet.StreamRecvBufferDefault = TRUE;
+    Settings.ConnFlowControlWindow = connection_flow_control_window;
+    Settings.IsSet.ConnFlowControlWindow = TRUE;
+    Settings.DatagramReceiveEnabled = TRUE;
+    Settings.IsSet.DatagramReceiveEnabled = TRUE;
+
+    // Throughput settings
+    Settings.PacingEnabled = pacing_enabled;
+    Settings.IsSet.PacingEnabled = TRUE;
+    Settings.SendBufferingEnabled = send_buffering_enabled;
+    Settings.IsSet.SendBufferingEnabled = TRUE;
+    Settings.InitialRttMs = initial_rtt_ms;
+    Settings.IsSet.InitialRttMs = TRUE;
+    Settings.InitialWindowPackets = initial_window_packets;
+    Settings.IsSet.InitialWindowPackets = TRUE;
+    Settings.MaxAckDelayMs = max_ack_delay_ms;
+    Settings.IsSet.MaxAckDelayMs = TRUE;
+
+    // Connection management
+    Settings.KeepAliveIntervalMs = keep_alive_interval_ms;
+    Settings.IsSet.KeepAliveIntervalMs = TRUE;
+    Settings.CongestionControlAlgorithm = congestion_control;
+    Settings.IsSet.CongestionControlAlgorithm = TRUE;
+    Settings.MigrationEnabled = migration_enabled;
+    Settings.IsSet.MigrationEnabled = TRUE;
+    Settings.DisconnectTimeoutMs = disconnect_timeout_ms;
+    Settings.IsSet.DisconnectTimeoutMs = TRUE;
+    Settings.HandshakeIdleTimeoutMs = handshake_idle_timeout_ms;
+    Settings.IsSet.HandshakeIdleTimeoutMs = TRUE;
+
+    QUIC_BUFFER Alpn = { (uint32_t)strlen(alpn_str), (uint8_t*)alpn_str };
+    
+    // Create configuration
+    if (QUIC_FAILED(Status = MsQuic->ConfigurationOpen(Registration, &Alpn, 1, &Settings, sizeof(Settings), NULL, &Configuration))) {
+        rb_raise(rb_eRuntimeError, "Server ConfigurationOpen failed, 0x%x!", Status);
+        return Qnil;
+    }
+    
+    // Set up server credentials with certificate files
+    QUIC_CREDENTIAL_CONFIG CredConfig = {0};
+    QUIC_CERTIFICATE_FILE CertFile = {0};
+    
+    CertFile.CertificateFile = cert_path;
+    CertFile.PrivateKeyFile = key_path;
+    
+    CredConfig.Type = QUIC_CREDENTIAL_TYPE_CERTIFICATE_FILE;
+    CredConfig.CertificateFile = &CertFile;
+    CredConfig.Flags = QUIC_CREDENTIAL_FLAG_NONE;
+    
+    if (QUIC_FAILED(Status = MsQuic->ConfigurationLoadCredential(Configuration, &CredConfig))) {
+        MsQuic->ConfigurationClose(Configuration);
+        rb_raise(rb_eRuntimeError, "Server ConfigurationLoadCredential failed, 0x%x!", Status);
+        return Qnil;
+    }
+    
+    // Return the configuration handle as a Ruby integer (pointer)
+    return ULL2NUM((uintptr_t)Configuration);
+}
+
+// Create a QUIC connection with context
+static VALUE
+quicsilver_create_connection(VALUE self, VALUE client_obj)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized. Call Quicsilver.open_connection first.");
+        return Qnil;
+    }
+
+    QUIC_STATUS Status;
+    HQUIC Connection = NULL;
+
+    // Allocate and initialize connection context
+    ConnectionContext* ctx = (ConnectionContext*)malloc(sizeof(ConnectionContext));
+    if (ctx == NULL) {
+        rb_raise(rb_eRuntimeError, "Failed to allocate connection context");
+        return Qnil;
+    }
+
+    ctx->connected = 0;
+    ctx->failed = 0;
+    ctx->error_status = QUIC_STATUS_SUCCESS;
+    ctx->error_code = 0;
+    ctx->client_obj = client_obj;  // Store Ruby client object (Qnil for server)
+    ctx->remote_address[0] = '\0';
+    ctx->remote_port = 0;
+    ctx->session_resumed = 0;
+    ctx->reliable_reset_negotiated = 0;
+    ctx->resumption_ticket = NULL;
+    ctx->queued_datagrams = 0;
+    ctx->dropped_datagrams = 0;
+    ctx->resumption_ticket_length = 0;
+
+    // Protect from GC if it's a Ruby object
+    if (!NIL_P(client_obj)) {
+        rb_gc_register_address(&ctx->client_obj);
+    }
+
+    // Create connection with enhanced callback and context
+    if (QUIC_FAILED(Status = MsQuic->ConnectionOpen(Registration, ConnectionCallback, ctx, &Connection))) {
+        if (!NIL_P(client_obj)) {
+            rb_gc_unregister_address(&ctx->client_obj);
+        }
+        free(ctx);
+        rb_raise(rb_eRuntimeError, "ConnectionOpen failed, 0x%x!", Status);
+        return Qnil;
+    }
+
+    // Return both the connection handle and context as an array
+    VALUE result = rb_ary_new2(2);
+    rb_ary_push(result, ULL2NUM((uintptr_t)Connection));
+    rb_ary_push(result, ULL2NUM((uintptr_t)ctx));
+    return result;
+}
+
+// Start a QUIC connection
+static VALUE
+quicsilver_start_connection(VALUE self, VALUE connection_handle, VALUE config_handle, VALUE hostname, VALUE port)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
+        return Qfalse;
+    }
+    
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle);
+    HQUIC Configuration = (HQUIC)(uintptr_t)NUM2ULL(config_handle);
+    const char* Target = StringValueCStr(hostname);
+    uint16_t Port = (uint16_t)NUM2INT(port);
+    
+    QUIC_STATUS Status;
+    if (QUIC_FAILED(Status = MsQuic->ConnectionStart(Connection, Configuration, QUIC_ADDRESS_FAMILY_UNSPEC, Target, Port))) {
+        rb_raise(rb_eRuntimeError, "ConnectionStart failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    wake_event_loop();
+    return Qtrue;
+}
+
+// Sleep without GVL so other Ruby threads can run.
+struct sleep_args { int ms; };
+static void* sleep_nogvl(void* arg) {
+    struct sleep_args* a = (struct sleep_args*)arg;
+    struct timespec ts = { .tv_sec = a->ms / 1000, .tv_nsec = (a->ms % 1000) * 1000000 };
+    nanosleep(&ts, NULL);
+    return NULL;
+}
+
+// Wait for connection to complete (connected or failed).
+// Waits only; the poll thread is the sole driver of MsQuic.
+static VALUE
+quicsilver_wait_for_connection(VALUE self, VALUE context_handle, VALUE timeout_ms)
+{
+    ConnectionContext* ctx = (ConnectionContext*)(uintptr_t)NUM2ULL(context_handle);
+    int timeout = NUM2INT(timeout_ms);
+    int elapsed = 0;
+    const int sleep_interval = 1; // 1ms
+
+    while (elapsed < timeout && !ctx->connected && !ctx->failed) {
+        struct sleep_args sa = { .ms = sleep_interval };
+        rb_thread_call_without_gvl(sleep_nogvl, &sa, RUBY_UBF_IO, NULL);
+        elapsed += sleep_interval;
+    }
+    
+    if (ctx->connected) {
+        return rb_hash_new();
+    } else if (ctx->failed) {
+        VALUE error_info = rb_hash_new();
+        rb_hash_aset(error_info, rb_str_new_cstr("error"), Qtrue);
+        rb_hash_aset(error_info, rb_str_new_cstr("status"), ULL2NUM(ctx->error_status));
+        rb_hash_aset(error_info, rb_str_new_cstr("code"), ULL2NUM(ctx->error_code));
+        
+        return error_info;
+    } else {
+        VALUE timeout_info = rb_hash_new();
+        rb_hash_aset(timeout_info, rb_str_new_cstr("timeout"), Qtrue);
+        return timeout_info;
+    }
+}
+
+// Check connection status
+static VALUE
+quicsilver_connection_status(VALUE self, VALUE context_handle)
+{
+    ConnectionContext* ctx = (ConnectionContext*)(uintptr_t)NUM2ULL(context_handle);
+    
+    VALUE status = rb_hash_new();
+    rb_hash_aset(status, rb_str_new_cstr("connected"), ctx->connected ? Qtrue : Qfalse);
+    rb_hash_aset(status, rb_str_new_cstr("failed"), ctx->failed ? Qtrue : Qfalse);
+    
+    if (ctx->failed) {
+        rb_hash_aset(status, rb_str_new_cstr("error_status"), ULL2NUM(ctx->error_status));
+        rb_hash_aset(status, rb_str_new_cstr("error_code"), ULL2NUM(ctx->error_code));
+    }
+    
+    return status;
+}
+
+// Get QUIC connection statistics (QUIC_STATISTICS_V2)
+static VALUE
+quicsilver_connection_statistics(VALUE self, VALUE connection_handle_val)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
+        return Qnil;
+    }
+
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle_val);
+    if (Connection == NULL) return Qnil;
+
+    QUIC_STATISTICS_V2 stats;
+    uint32_t stats_size = sizeof(stats);
+    memset(&stats, 0, stats_size);
+
+    QUIC_STATUS status = MsQuic->GetParam(
+        Connection,
+        QUIC_PARAM_CONN_STATISTICS_V2,
+        &stats_size,
+        &stats);
+
+    if (QUIC_FAILED(status)) {
+        return Qnil;
+    }
+
+    VALUE result = rb_hash_new();
+
+    // RTT (microseconds)
+    rb_hash_aset(result, rb_str_new_cstr("rtt"), UINT2NUM(stats.Rtt));
+    rb_hash_aset(result, rb_str_new_cstr("min_rtt"), UINT2NUM(stats.MinRtt));
+    rb_hash_aset(result, rb_str_new_cstr("max_rtt"), UINT2NUM(stats.MaxRtt));
+
+    // Handshake
+    rb_hash_aset(result, rb_str_new_cstr("resumption_attempted"), stats.ResumptionAttempted ? Qtrue : Qfalse);
+    rb_hash_aset(result, rb_str_new_cstr("resumption_succeeded"), stats.ResumptionSucceeded ? Qtrue : Qfalse);
+
+    // Send
+    rb_hash_aset(result, rb_str_new_cstr("send_path_mtu"), UINT2NUM(stats.SendPathMtu));
+    rb_hash_aset(result, rb_str_new_cstr("send_total_packets"), ULL2NUM(stats.SendTotalPackets));
+    rb_hash_aset(result, rb_str_new_cstr("send_retransmittable_packets"), ULL2NUM(stats.SendRetransmittablePackets));
+    rb_hash_aset(result, rb_str_new_cstr("send_suspected_lost_packets"), ULL2NUM(stats.SendSuspectedLostPackets));
+    rb_hash_aset(result, rb_str_new_cstr("send_spurious_lost_packets"), ULL2NUM(stats.SendSpuriousLostPackets));
+    rb_hash_aset(result, rb_str_new_cstr("send_total_bytes"), ULL2NUM(stats.SendTotalBytes));
+    rb_hash_aset(result, rb_str_new_cstr("send_total_stream_bytes"), ULL2NUM(stats.SendTotalStreamBytes));
+    rb_hash_aset(result, rb_str_new_cstr("send_congestion_count"), UINT2NUM(stats.SendCongestionCount));
+    rb_hash_aset(result, rb_str_new_cstr("send_persistent_congestion_count"), UINT2NUM(stats.SendPersistentCongestionCount));
+    rb_hash_aset(result, rb_str_new_cstr("send_congestion_window"), UINT2NUM(stats.SendCongestionWindow));
+
+    // Recv
+    rb_hash_aset(result, rb_str_new_cstr("recv_total_packets"), ULL2NUM(stats.RecvTotalPackets));
+    rb_hash_aset(result, rb_str_new_cstr("recv_reordered_packets"), ULL2NUM(stats.RecvReorderedPackets));
+    rb_hash_aset(result, rb_str_new_cstr("recv_dropped_packets"), ULL2NUM(stats.RecvDroppedPackets));
+    rb_hash_aset(result, rb_str_new_cstr("recv_duplicate_packets"), ULL2NUM(stats.RecvDuplicatePackets));
+    rb_hash_aset(result, rb_str_new_cstr("recv_total_bytes"), ULL2NUM(stats.RecvTotalBytes));
+    rb_hash_aset(result, rb_str_new_cstr("recv_total_stream_bytes"), ULL2NUM(stats.RecvTotalStreamBytes));
+    rb_hash_aset(result, rb_str_new_cstr("recv_decryption_failures"), ULL2NUM(stats.RecvDecryptionFailures));
+    rb_hash_aset(result, rb_str_new_cstr("recv_valid_ack_frames"), ULL2NUM(stats.RecvValidAckFrames));
+
+    // Misc
+    rb_hash_aset(result, rb_str_new_cstr("key_update_count"), UINT2NUM(stats.KeyUpdateCount));
+
+    return result;
+}
+
+// Get global QUIC transport counters.
+//
+// These counters are process-wide transport state, not scoped to a single
+// Quicsilver::Server or QUIC connection. They complement QUIC_STATISTICS_V2,
+// which is exposed by quicsilver_connection_statistics for a specific
+// connection handle.
+//
+// MsQuic stores the values as a uint64_t array indexed by QUIC_PERF_COUNTER_*.
+// The public Ruby API uses transport-domain names instead of MsQuic enum names
+// so Server#stats does not leak the native implementation detail.
+static VALUE
+quicsilver_transport_counters(VALUE self)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "QUIC transport not initialized.");
+        return Qnil;
+    }
+
+#ifdef QUIC_PARAM_GLOBAL_PERF_COUNTERS
+    uint64_t counters[QUIC_PERF_COUNTER_MAX] = {0};
+    uint32_t counters_size = sizeof(counters);
+
+    QUIC_STATUS status = MsQuic->GetParam(
+        NULL,
+        QUIC_PARAM_GLOBAL_PERF_COUNTERS,
+        &counters_size,
+        counters);
+
+    if (QUIC_FAILED(status)) {
+        return Qnil;
+    }
+
+    VALUE result = rb_hash_new();
+
+#define ADD_COUNTER(key, counter) \
+    rb_hash_aset(result, rb_str_new_cstr(key), ULL2NUM(counters[counter]))
+
+    // Connection lifecycle counters.
+    ADD_COUNTER("connections_created", QUIC_PERF_COUNTER_CONN_CREATED);
+    ADD_COUNTER("connections_handshake_failed", QUIC_PERF_COUNTER_CONN_HANDSHAKE_FAIL);
+    ADD_COUNTER("connections_app_rejected", QUIC_PERF_COUNTER_CONN_APP_REJECT);
+    ADD_COUNTER("connections_resumed", QUIC_PERF_COUNTER_CONN_RESUMED);
+    ADD_COUNTER("connections_active", QUIC_PERF_COUNTER_CONN_ACTIVE);
+    ADD_COUNTER("connections_connected", QUIC_PERF_COUNTER_CONN_CONNECTED);
+    ADD_COUNTER("connections_protocol_errors", QUIC_PERF_COUNTER_CONN_PROTOCOL_ERRORS);
+    ADD_COUNTER("connections_no_alpn", QUIC_PERF_COUNTER_CONN_NO_ALPN);
+    ADD_COUNTER("connections_load_rejected", QUIC_PERF_COUNTER_CONN_LOAD_REJECT);
+
+    // Stream, packet, UDP, and application byte counters.
+    ADD_COUNTER("streams_active", QUIC_PERF_COUNTER_STRM_ACTIVE);
+    ADD_COUNTER("packets_suspected_lost", QUIC_PERF_COUNTER_PKTS_SUSPECTED_LOST);
+    ADD_COUNTER("packets_dropped", QUIC_PERF_COUNTER_PKTS_DROPPED);
+    ADD_COUNTER("packets_decryption_failed", QUIC_PERF_COUNTER_PKTS_DECRYPTION_FAIL);
+    ADD_COUNTER("udp_datagrams_received", QUIC_PERF_COUNTER_UDP_RECV);
+    ADD_COUNTER("udp_datagrams_sent", QUIC_PERF_COUNTER_UDP_SEND);
+    ADD_COUNTER("udp_bytes_received", QUIC_PERF_COUNTER_UDP_RECV_BYTES);
+    ADD_COUNTER("udp_bytes_sent", QUIC_PERF_COUNTER_UDP_SEND_BYTES);
+    ADD_COUNTER("udp_receive_events", QUIC_PERF_COUNTER_UDP_RECV_EVENTS);
+    ADD_COUNTER("udp_send_calls", QUIC_PERF_COUNTER_UDP_SEND_CALLS);
+    ADD_COUNTER("app_bytes_sent", QUIC_PERF_COUNTER_APP_SEND_BYTES);
+    ADD_COUNTER("app_bytes_received", QUIC_PERF_COUNTER_APP_RECV_BYTES);
+
+    // Queue/worker pressure counters. These are useful for distinguishing
+    // transport saturation from Ruby scheduler saturation in Server#stats.
+    ADD_COUNTER("connection_queue_depth", QUIC_PERF_COUNTER_CONN_QUEUE_DEPTH);
+    ADD_COUNTER("connection_operations_queue_depth", QUIC_PERF_COUNTER_CONN_OPER_QUEUE_DEPTH);
+    ADD_COUNTER("connection_operations_queued", QUIC_PERF_COUNTER_CONN_OPER_QUEUED);
+    ADD_COUNTER("connection_operations_completed", QUIC_PERF_COUNTER_CONN_OPER_COMPLETED);
+    ADD_COUNTER("worker_operations_queue_depth", QUIC_PERF_COUNTER_WORK_OPER_QUEUE_DEPTH);
+    ADD_COUNTER("worker_operations_queued", QUIC_PERF_COUNTER_WORK_OPER_QUEUED);
+    ADD_COUNTER("worker_operations_completed", QUIC_PERF_COUNTER_WORK_OPER_COMPLETED);
+
+    // Path validation and stateless response counters.
+    ADD_COUNTER("paths_validated", QUIC_PERF_COUNTER_PATH_VALIDATED);
+    ADD_COUNTER("paths_failed", QUIC_PERF_COUNTER_PATH_FAILURE);
+    ADD_COUNTER("stateless_resets_sent", QUIC_PERF_COUNTER_SEND_STATELESS_RESET);
+    ADD_COUNTER("stateless_retries_sent", QUIC_PERF_COUNTER_SEND_STATELESS_RETRY);
+
+#undef ADD_COUNTER
+
+    return result;
+#else
+    return Qnil;
+#endif
+}
+
+// Get the remote address of a QUIC connection. Called lazily from Ruby
+// so we don't block MsQuic's event thread during the CONNECTED callback.
+// Get the resumption ticket from a connection context (for 0-RTT)
+static VALUE
+quicsilver_get_resumption_ticket(VALUE self, VALUE context_handle_val)
+{
+    ConnectionContext* ctx = (ConnectionContext*)(uintptr_t)NUM2ULL(context_handle_val);
+    if (ctx == NULL || ctx->resumption_ticket == NULL || ctx->resumption_ticket_length == 0) {
+        return Qnil;
+    }
+    return rb_str_new((const char*)ctx->resumption_ticket, ctx->resumption_ticket_length);
+}
+
+// Set a resumption ticket on a connection (for 0-RTT reconnection)
+static VALUE
+quicsilver_set_resumption_ticket(VALUE self, VALUE connection_handle_val, VALUE ticket_val)
+{
+    if (MsQuic == NULL) return Qfalse;
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle_val);
+    if (Connection == NULL || NIL_P(ticket_val)) return Qfalse;
+
+    const uint8_t* ticket = (const uint8_t*)RSTRING_PTR(ticket_val);
+    uint32_t ticket_len = (uint32_t)RSTRING_LEN(ticket_val);
+
+    QUIC_STATUS Status = MsQuic->SetParam(
+        Connection,
+        QUIC_PARAM_CONN_RESUMPTION_TICKET,
+        ticket_len,
+        ticket);
+
+    return QUIC_SUCCEEDED(Status) ? Qtrue : Qfalse;
+}
+
+static VALUE
+connection_param_bytes(VALUE connection_handle_val, uint32_t param)
+{
+    if (MsQuic == NULL) return Qnil;
+
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle_val);
+    if (Connection == NULL) return Qnil;
+
+    uint8_t buffer[256];
+    uint32_t buffer_size = sizeof(buffer);
+    memset(buffer, 0, sizeof(buffer));
+
+    QUIC_STATUS status = MsQuic->GetParam(Connection, param, &buffer_size, buffer);
+    if (QUIC_FAILED(status) || buffer_size == 0) {
+        return Qnil;
+    }
+
+    return rb_str_new((const char*)buffer, buffer_size);
+}
+
+// MsQuic derives this from the peer's max_datagram_frame_size transport parameter.
+static VALUE
+quicsilver_connection_datagram_send_enabled(VALUE self, VALUE connection_handle_val)
+{
+    if (MsQuic == NULL) return Qfalse;
+
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle_val);
+    if (Connection == NULL) return Qfalse;
+
+    BOOLEAN enabled = FALSE;
+    uint32_t size = sizeof(enabled);
+    QUIC_STATUS status = MsQuic->GetParam(
+        Connection, QUIC_PARAM_CONN_DATAGRAM_SEND_ENABLED, &size, &enabled);
+    return QUIC_SUCCEEDED(status) && enabled ? Qtrue : Qfalse;
+}
+
+static VALUE
+quicsilver_connection_reliable_reset_enabled(VALUE self, VALUE connection_handle_val)
+{
+    if (MsQuic == NULL) return Qfalse;
+    HQUIC connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle_val);
+    if (!connection) return Qfalse;
+    ConnectionContext* ctx = MsQuic->GetContext(connection);
+    return ctx && ctx->reliable_reset_negotiated ? Qtrue : Qfalse;
+}
+
+static VALUE
+quicsilver_set_stream_reliable_offset(VALUE self, VALUE stream_handle, VALUE offset_val)
+{
+    uint64_t token = NUM2ULL(stream_handle);
+    uint64_t offset = NUM2ULL(offset_val);
+    StreamContext* ctx = find_stream(token);
+    if (!MsQuic || !ctx) rb_raise(rb_eIOError, "QUIC stream is closed");
+    QUIC_STATUS status = MsQuic->SetParam(
+        ctx->stream, QUIC_PARAM_STREAM_RELIABLE_OFFSET, sizeof(offset), &offset);
+    if (QUIC_FAILED(status)) rb_raise(rb_eRuntimeError, "Setting reliable offset failed, 0x%x", status);
+    return offset_val;
+}
+
+// Returns [ip_string, port] or nil.
+static VALUE
+quicsilver_connection_remote_address(VALUE self, VALUE connection_handle_val)
+{
+    if (MsQuic == NULL) return Qnil;
+
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle_val);
+    if (Connection == NULL) return Qnil;
+
+    QUIC_ADDR addr;
+    uint32_t addr_size = sizeof(addr);
+    if (QUIC_FAILED(MsQuic->GetParam(Connection, QUIC_PARAM_CONN_REMOTE_ADDRESS, &addr_size, &addr)))
+        return Qnil;
+
+    char ip[INET6_ADDRSTRLEN];
+    uint16_t port = 0;
+    if (addr.Ip.sa_family == QUIC_ADDRESS_FAMILY_INET) {
+        struct sockaddr_in *v4 = (struct sockaddr_in *)&addr;
+        inet_ntop(AF_INET, &v4->sin_addr, ip, sizeof(ip));
+        port = ntohs(v4->sin_port);
+    } else {
+        struct sockaddr_in6 *v6 = (struct sockaddr_in6 *)&addr;
+        port = ntohs(v6->sin6_port);
+        if (IN6_IS_ADDR_V4MAPPED(&v6->sin6_addr)) {
+            struct in_addr v4;
+            memcpy(&v4, &v6->sin6_addr.s6_addr[12], 4);
+            inet_ntop(AF_INET, &v4, ip, sizeof(ip));
+        } else {
+            inet_ntop(AF_INET6, &v6->sin6_addr, ip, sizeof(ip));
+        }
+    }
+
+    VALUE result = rb_ary_new2(2);
+    rb_ary_push(result, rb_str_new_cstr(ip));
+    rb_ary_push(result, UINT2NUM(port));
+    return result;
+}
+
+// QUIC connection ID bytes for server-side routing/debugging.
+static VALUE
+quicsilver_connection_ids(VALUE self, VALUE connection_handle_val)
+{
+    VALUE result = rb_hash_new();
+
+    VALUE odcid = connection_param_bytes(connection_handle_val, QUIC_PARAM_CONN_ORIG_DEST_CID);
+    if (!NIL_P(odcid)) {
+        rb_hash_aset(result, rb_str_new_cstr("original_destination_connection_id"), odcid);
+    }
+
+    return result;
+}
+
+static void
+close_connection(HQUIC connection)
+{
+    // MsQuic 2.6 defaults to a blocking close outside the worker callback.
+    // Our poll thread needs the GVL to complete that work, so queue it instead.
+    BOOLEAN async = TRUE;
+    QUIC_STATUS status = MsQuic->SetParam(connection, QUIC_PARAM_CONN_CLOSE_ASYNC, sizeof(async), &async);
+    if (QUIC_FAILED(status)) {
+        rb_raise(rb_eRuntimeError, "Enabling asynchronous connection close failed, 0x%x!", status);
+    }
+    forget_connection_streams(connection);
+    MsQuic->ConnectionClose(connection);
+    wake_event_loop();
+}
+
+// Close a QUIC connection and free context
+static VALUE
+quicsilver_close_connection_handle(VALUE self, VALUE connection_data)
+{
+    if (MsQuic == NULL) {
+        return Qnil;
+    }
+
+    // Extract connection handle and context from array
+    VALUE connection_handle = rb_ary_entry(connection_data, 0);
+    VALUE context_handle = rb_ary_entry(connection_data, 1);
+
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle);
+    (void)context_handle; // ctx freed by SHUTDOWN_COMPLETE, not here
+
+    if (Connection != NULL) {
+        close_connection(Connection);
+    }
+
+    // Don't free ctx here — ConnectionClose is async and SHUTDOWN_COMPLETE
+    // will fire on the next event loop poll, which still needs ctx.
+    // SHUTDOWN_COMPLETE handles cleanup for both client and server.
+
+    return Qnil;
+}
+
+// Close a server-side connection handle (context already freed in C callback)
+static VALUE
+quicsilver_close_server_connection(VALUE self, VALUE connection_handle)
+{
+    if (MsQuic == NULL) return Qnil;
+
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle);
+    if (Connection != NULL) {
+        close_connection(Connection);
+    }
+    return Qnil;
+}
+
+// Gracefully shutdown a QUIC connection (sends CONNECTION_CLOSE frame to peer)
+// silent = true: immediate shutdown without notifying peer
+// silent = false: graceful shutdown with CONNECTION_CLOSE frame
+static VALUE
+quicsilver_connection_shutdown(VALUE self, VALUE connection_handle, VALUE error_code, VALUE silent)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
+        return Qnil;
+    }
+
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle);
+    uint64_t ErrorCode = NUM2ULL(error_code);
+
+    if (Connection != NULL) {
+        QUIC_CONNECTION_SHUTDOWN_FLAGS flags = RTEST(silent)
+            ? QUIC_CONNECTION_SHUTDOWN_FLAG_SILENT
+            : QUIC_CONNECTION_SHUTDOWN_FLAG_NONE;
+
+        MsQuic->ConnectionShutdown(Connection, flags, ErrorCode);
+        wake_event_loop();
+    }
+
+    return Qtrue;
+}
+
+// Close a QUIC configuration
+static VALUE
+quicsilver_close_configuration(VALUE self, VALUE config_handle)
+{
+    if (MsQuic == NULL) {
+        return Qnil;
+    }
+    
+    HQUIC Configuration = (HQUIC)(uintptr_t)NUM2ULL(config_handle);
+    MsQuic->ConfigurationClose(Configuration);
+    return Qnil;
+}
+
+static VALUE
+quicsilver_close(VALUE self)
+{
+    if (MsQuic != NULL) {
+        st_clear(LiveStreams);
+        if (Registration != NULL) {
+            MsQuic->RegistrationClose(Registration);
+            Registration = NULL;
+        }
+
+        if (ExecContext != NULL) {
+            MsQuic->ExecutionDelete(1, &ExecContext);
+            ExecContext = NULL;
+        }
+
+        MsQuicClose(MsQuic);
+        MsQuic = NULL;
+    }
+
+#if __linux__
+    if (WakeFd != -1) {
+        close(WakeFd);
+        WakeFd = -1;
+    }
+#endif
+    if (EventQ != -1) {
+        close(EventQ);
+        EventQ = -1;
+    }
+
+    return Qnil;
+}
+
+// Create a QUIC listener
+static VALUE
+quicsilver_create_listener(VALUE self, VALUE config_handle)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
+        return Qnil;
+    }
+    
+    HQUIC Configuration = (HQUIC)(uintptr_t)NUM2ULL(config_handle);
+    HQUIC Listener = NULL;
+    QUIC_STATUS Status;
+    
+    // Create listener context
+    ListenerContext* ctx = (ListenerContext*)malloc(sizeof(ListenerContext));
+    if (ctx == NULL) {
+        rb_raise(rb_eRuntimeError, "Failed to allocate listener context");
+        return Qnil;
+    }
+    
+    ctx->started = 0;
+    ctx->stopped = 0;
+    ctx->failed = 0;
+    ctx->error_status = QUIC_STATUS_SUCCESS;
+    ctx->Configuration = Configuration;
+    
+    // Create listener
+    if (QUIC_FAILED(Status = MsQuic->ListenerOpen(Registration, ListenerCallback, ctx, &Listener))) {
+        free(ctx);
+        rb_raise(rb_eRuntimeError, "ListenerOpen failed, 0x%x!", Status);
+        return Qnil;
+    }
+    
+    // Return listener handle and context
+    VALUE result = rb_ary_new2(2);
+    rb_ary_push(result, ULL2NUM((uintptr_t)Listener));
+    rb_ary_push(result, ULL2NUM((uintptr_t)ctx));
+    return result;
+}
+
+static uint32_t
+cibir_param_buffer(VALUE cibir_bytes_val, uint8_t* buffer)
+{
+    StringValue(cibir_bytes_val);
+    long cibir_len = RSTRING_LEN(cibir_bytes_val);
+    if (cibir_len == 0 || cibir_len > 6) {
+        rb_raise(rb_eArgError, "cibir bytes must be 1..6 bytes");
+        return 0;
+    }
+
+    buffer[0] = 0;
+    memcpy(buffer + 1, RSTRING_PTR(cibir_bytes_val), cibir_len);
+    return (uint32_t)(1 + cibir_len);
+}
+
+// Configure the fixed Server ID bytes MsQuic places in generated QUIC
+// connection IDs. Must run before RegistrationOpen, because MsQuic only applies
+// this process-global setting safely before the library is in use.
+static VALUE
+quicsilver_apply_msquic_server_id(VALUE self, VALUE server_id_bytes_val)
+{
+    QUIC_STATUS Status;
+
+    if (Registration != NULL || ExecContext != NULL) {
+        rb_raise(rb_eRuntimeError, "MsQuic Server ID must be configured before Quicsilver is opened");
+        return Qfalse;
+    }
+
+    if (MsQuic == NULL && QUIC_FAILED(Status = MsQuicOpenVersion(2, (const void**)&MsQuic))) {
+        rb_raise(rb_eRuntimeError, "MsQuicOpenVersion failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    QUIC_GLOBAL_SETTINGS Settings;
+    memset(&Settings, 0, sizeof(Settings));
+
+    StringValue(server_id_bytes_val);
+    if (RSTRING_LEN(server_id_bytes_val) != sizeof(Settings.FixedServerID)) {
+        rb_raise(rb_eArgError, "Server ID must be exactly 4 bytes");
+        return Qfalse;
+    }
+    Settings.IsSet.LoadBalancingMode = TRUE;
+    Settings.LoadBalancingMode = QUIC_LOAD_BALANCING_SERVER_ID_FIXED;
+    Settings.IsSet.FixedServerID = TRUE;
+    memcpy(&Settings.FixedServerID, RSTRING_PTR(server_id_bytes_val), sizeof(Settings.FixedServerID));
+
+    Status = MsQuic->SetParam(
+        NULL,
+        QUIC_PARAM_GLOBAL_GLOBAL_SETTINGS,
+        sizeof(Settings),
+        &Settings);
+
+    if (QUIC_FAILED(Status)) {
+        rb_raise(rb_eRuntimeError, "MsQuic Server ID configuration failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    return Qtrue;
+}
+
+// Configure listener-level CIBIR (Connection ID Based Implicit Routing) bytes.
+static VALUE
+quicsilver_configure_listener_cibir(VALUE self, VALUE listener_handle, VALUE cibir_bytes_val)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
+        return Qfalse;
+    }
+
+    uint8_t buffer[7];
+    uint32_t buffer_len = cibir_param_buffer(cibir_bytes_val, buffer);
+
+    HQUIC Listener = (HQUIC)(uintptr_t)NUM2ULL(listener_handle);
+    QUIC_STATUS Status = MsQuic->SetParam(
+        Listener,
+        QUIC_PARAM_LISTENER_CIBIR_ID,
+        buffer_len,
+        buffer);
+
+    if (QUIC_FAILED(Status)) {
+        rb_raise(rb_eRuntimeError, "Listener CIBIR configuration failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    return Qtrue;
+}
+
+// Configure client-side CIBIR bytes before ConnectionStart.
+static VALUE
+quicsilver_configure_connection_cibir(VALUE self, VALUE connection_handle, VALUE cibir_bytes_val)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
+        return Qfalse;
+    }
+
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle);
+    BOOLEAN share_binding = TRUE;
+    QUIC_STATUS Status = MsQuic->SetParam(
+        Connection,
+        QUIC_PARAM_CONN_SHARE_UDP_BINDING,
+        sizeof(share_binding),
+        &share_binding);
+    if (QUIC_FAILED(Status)) {
+        rb_raise(rb_eRuntimeError, "Connection UDP binding configuration failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    uint8_t buffer[7];
+    uint32_t buffer_len = cibir_param_buffer(cibir_bytes_val, buffer);
+    Status = MsQuic->SetParam(
+        Connection,
+        QUIC_PARAM_CONN_CIBIR_ID,
+        buffer_len,
+        buffer);
+
+    if (QUIC_FAILED(Status)) {
+        rb_raise(rb_eRuntimeError, "Connection CIBIR configuration failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    return Qtrue;
+}
+
+// Start listener on specific address and port
+static VALUE
+quicsilver_start_listener(VALUE self, VALUE listener_handle, VALUE address, VALUE port, VALUE alpn)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
+        return Qfalse;
+    }
+
+    HQUIC Listener = (HQUIC)(uintptr_t)NUM2ULL(listener_handle);
+    uint16_t Port = (uint16_t)NUM2INT(port);
+    const char* alpn_str = StringValueCStr(alpn);
+
+    // Setup address - properly initialize the entire structure
+    QUIC_ADDR Address;
+    memset(&Address, 0, sizeof(Address));
+
+    // Parse address string to determine family.
+    // "::" or any address with ':' → INET6 (IPv6 only on macOS).
+    // "0.0.0.0" → UNSPEC (dual-stack: accepts both IPv4 and IPv6).
+    // Specific IPv4 (e.g. "127.0.0.1") → INET (IPv4 only).
+    const char* addr_str = StringValueCStr(address);
+    if (strchr(addr_str, ':') != NULL) {
+        QuicAddrSetFamily(&Address, QUIC_ADDRESS_FAMILY_INET6);
+    } else if (strcmp(addr_str, "0.0.0.0") == 0) {
+        QuicAddrSetFamily(&Address, QUIC_ADDRESS_FAMILY_UNSPEC);
+    } else {
+        QuicAddrSetFamily(&Address, QUIC_ADDRESS_FAMILY_INET);
+    }
+    QuicAddrSetPort(&Address, Port);
+
+    QUIC_STATUS Status;
+
+    QUIC_BUFFER AlpnBuffer = { (uint32_t)strlen(alpn_str), (uint8_t*)alpn_str };
+
+    if (QUIC_FAILED(Status = MsQuic->ListenerStart(Listener, &AlpnBuffer, 1, &Address))) {
+        rb_raise(rb_eRuntimeError, "ListenerStart failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    wake_event_loop();
+    return Qtrue;
+}
+
+// Stop listener
+static VALUE
+quicsilver_stop_listener(VALUE self, VALUE listener_handle)
+{
+    if (MsQuic == NULL) {
+        return Qfalse;
+    }
+
+    HQUIC Listener = (HQUIC)(uintptr_t)NUM2ULL(listener_handle);
+    MsQuic->ListenerStop(Listener);
+    wake_event_loop();
+    return Qtrue;
+}
+
+// Close listener
+static VALUE
+quicsilver_close_listener(VALUE self, VALUE listener_data)
+{
+    if (MsQuic == NULL) {
+        return Qnil;
+    }
+    
+    VALUE listener_handle = rb_ary_entry(listener_data, 0);
+    VALUE context_handle = rb_ary_entry(listener_data, 1);
+    
+    HQUIC Listener = (HQUIC)(uintptr_t)NUM2ULL(listener_handle);
+    ListenerContext* ctx = (ListenerContext*)(uintptr_t)NUM2ULL(context_handle);
+    
+    MsQuic->ListenerClose(Listener);
+    
+    if (ctx != NULL) {
+        free(ctx);
+    }
+    
+    return Qnil;
+}
+
+// Open a QUIC stream
+// Accepts connection_data array [connection_handle, context_handle]
+// Works uniformly for both client and server
+static VALUE
+quicsilver_open_stream(VALUE self, VALUE connection_data, VALUE unidirectional)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
+        return Qnil;
+    }
+
+    // Extract connection handle and context from array
+    VALUE connection_handle = rb_ary_entry(connection_data, 0);
+    VALUE context_handle = rb_ary_entry(connection_data, 1);
+
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(connection_handle);
+    ConnectionContext* conn_ctx = (ConnectionContext*)(uintptr_t)NUM2ULL(context_handle);
+    HQUIC Stream = NULL;
+
+    StreamContext* ctx = (StreamContext*)malloc(sizeof(StreamContext));
+    if (ctx == NULL) {
+        rb_raise(rb_eRuntimeError, "Failed to allocate stream context");
+        return Qnil;
+    }
+
+    ctx->connection = Connection;
+    ctx->connection_ctx = conn_ctx;  // Store connection context pointer
+    ctx->client_obj = conn_ctx ? conn_ctx->client_obj : Qnil;
+    ctx->stream_id = UINT64_MAX;  // Sentinel: lazily resolved on first callback
+    ctx->started = 1;
+    ctx->shutdown = 0;
+    ctx->early_data = 0;
+    ctx->error_status = QUIC_STATUS_SUCCESS;
+
+    // Use flag based on parameter
+    QUIC_STREAM_OPEN_FLAGS flags = RTEST(unidirectional)
+        ? QUIC_STREAM_OPEN_FLAG_UNIDIRECTIONAL
+        : QUIC_STREAM_OPEN_FLAG_NONE;
+
+    // Create stream
+    QUIC_STATUS Status = MsQuic->StreamOpen(Connection, flags, StreamCallback, ctx, &Stream);
+    if (QUIC_FAILED(Status)) {
+        free(ctx);
+        rb_raise(rb_eRuntimeError, "StreamOpen failed, 0x%x!", Status);
+        return Qnil;
+    }
+    
+    uint64_t token = register_stream(ctx, Stream, RTEST(unidirectional)
+        ? QUIC_STREAM_SHUTDOWN_FLAG_ABORT_SEND : QUIC_STREAM_SHUTDOWN_FLAG_ABORT);
+
+    // Start the stream. INDICATE_PEER_ACCEPT gives us visibility into
+    // stream flow control — fires PEER_ACCEPTED event when the peer
+    // raises MAX_STREAMS if the stream was initially queued.
+    Status = MsQuic->StreamStart(Stream,
+        QUIC_STREAM_START_FLAG_INDICATE_PEER_ACCEPT | QUIC_STREAM_START_FLAG_SHUTDOWN_ON_FAIL);
+    if (QUIC_FAILED(Status)) {
+        unregister_stream(token);
+        // StreamClose fires SHUTDOWN_COMPLETE synchronously which frees ctx
+        MsQuic->StreamClose(Stream);
+        rb_raise(rb_eRuntimeError, "StreamStart failed, 0x%x!", Status);
+        return Qnil;
+    }
+
+    wake_event_loop();
+    return ULL2NUM(token);
+}
+
+// Send data on a QUIC stream
+static VALUE
+quicsilver_send_stream(VALUE self, VALUE stream_handle, VALUE data, VALUE send_fin)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
+        return Qnil;
+    }
+
+    uint64_t token = NUM2ULL(stream_handle);
+    StringValue(data);
+    StreamContext* ctx = find_stream(token);
+    if (!ctx || __atomic_load_n(&ctx->shutdown, __ATOMIC_ACQUIRE)) rb_raise(rb_eIOError, "QUIC stream is closed");
+    HQUIC Stream = ctx->stream;
+
+    // MsQuic holds a pointer into the String until SEND_COMPLETE, so the
+    // bytes must not change. A frozen String is sent as-is (zero copy); an
+    // unfrozen one gets a frozen copy-on-write share, so a caller that keeps
+    // mutating its buffer unshares on its own side and never sees a
+    // FrozenError from here. Library callers freeze their output to get the
+    // zero-copy path.
+    data = rb_str_new_frozen(data);
+
+    SendContext* send = send_context_new(data);
+    if (send == NULL) {
+        rb_raise(rb_eRuntimeError, "SendContext allocation failed!");
+        return Qnil;
+    }
+
+    // Use flag based on parameter (default to FIN for backwards compat)
+    QUIC_SEND_FLAGS flags = (NIL_P(send_fin) || RTEST(send_fin))
+        ? QUIC_SEND_FLAG_FIN
+        : QUIC_SEND_FLAG_NONE;
+
+    QUIC_STATUS Status = MsQuic->StreamSend(Stream, &send->buffer, 1, flags, send);
+    if (QUIC_FAILED(Status)) {
+        send_context_release(send);
+        rb_raise(rb_eRuntimeError, "StreamSend failed, 0x%x!", Status);
+        return Qfalse;
+    }
+
+    wake_event_loop();
+    return Qtrue;
+}
+
+// Send an unreliable datagram on a QUIC connection (RFC 9221).
+// Datagrams are not retransmitted — best effort delivery.
+// Data must fit in a single QUIC packet (typically ~1200 bytes).
+static VALUE
+quicsilver_datagram_send(VALUE self, VALUE connection_data, VALUE data)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
+        return Qnil;
+    }
+
+    VALUE conn_handle_val = rb_ary_entry(connection_data, 0);
+    HQUIC Connection = (HQUIC)(uintptr_t)NUM2ULL(conn_handle_val);
+
+    StringValue(data);
+    const char* data_str = RSTRING_PTR(data);
+    uint32_t data_len = (uint32_t)RSTRING_LEN(data);
+
+    void* SendBufferRaw = malloc(sizeof(QUIC_BUFFER) + data_len);
+    if (SendBufferRaw == NULL) {
+        rb_raise(rb_eRuntimeError, "Datagram buffer allocation failed!");
+        return Qnil;
+    }
+
+    QUIC_BUFFER* SendBuffer = (QUIC_BUFFER*)SendBufferRaw;
+    SendBuffer->Buffer = (uint8_t*)SendBufferRaw + sizeof(QUIC_BUFFER);
+    SendBuffer->Length = data_len;
+    memcpy(SendBuffer->Buffer, data_str, data_len);
+
+    QUIC_STATUS Status = MsQuic->DatagramSend(Connection, SendBuffer, 1, QUIC_SEND_FLAG_NONE, SendBufferRaw);
+    if (QUIC_FAILED(Status)) {
+        free(SendBufferRaw);
+        if (Status == QUIC_STATUS_BUFFER_TOO_SMALL) {
+            rb_raise(rb_eArgError, "Datagram too large (%u bytes) - must fit in a single QUIC packet", data_len);
+        } else {
+            rb_raise(rb_eRuntimeError, "DatagramSend failed, 0x%x", Status);
+        }
+        return Qfalse;
+    }
+
+    wake_event_loop();
+    return Qtrue;
+}
+
+// Get the QUIC stream ID for an open stream.
+// Must be called after data has been sent (MsQuic defers ID assignment
+// with QUIC_STREAM_START_FLAG_NONE until data flows).
+static VALUE
+quicsilver_get_stream_id(VALUE self, VALUE stream_handle)
+{
+    if (MsQuic == NULL) {
+        rb_raise(rb_eRuntimeError, "MSQUIC not initialized.");
+        return Qnil;
+    }
+    StreamContext* ctx = find_stream(NUM2ULL(stream_handle));
+    if (!ctx) return Qnil;
+    HQUIC Stream = ctx->stream;
+    uint64_t stream_id = 0;
+    uint32_t stream_id_len = sizeof(stream_id);
+    QUIC_STATUS Status = MsQuic->GetParam(Stream, QUIC_PARAM_STREAM_ID, &stream_id_len, &stream_id);
+    if (QUIC_FAILED(Status)) {
+        return Qnil;
+    }
+    return ULL2NUM(stream_id);
+}
+
+// Experimental native byte/chunk admission. First grant opts in (zero pauses on the
+// next data indication); subsequent grants add credit. This does not reserve
+// connection-level control credit or integrate application queue consumption.
+static VALUE
+quicsilver_grant_stream_receive_credit(VALUE self, VALUE stream_handle, VALUE bytes, VALUE chunks)
+{
+    // Validate here, not in Transport::Stream: this module function is a public
+    // boundary, and NUM2ULL silently wraps a negative Integer into huge credit.
+    uint64_t token = NUM2ULL(stream_handle);
+    uint64_t credit = credit_arg(bytes, "Receive credit");
+    uint64_t chunk_credit = credit_arg(chunks, "Receive chunks");
+    StreamContext* ctx = find_stream(token);
+    if (!MsQuic || !ctx || !(ctx->abort_flags & QUIC_STREAM_SHUTDOWN_FLAG_ABORT_RECEIVE)) return Qfalse;
+
+    // Update under the lock; resume outside it (MsQuic call). A receive that
+    // paused the stream set receive_paused under this same lock, so either it
+    // ran before us and we see the flag, or it runs after us and sees the
+    // credit. StreamReceiveSetEnabled is a queued MsQuic operation that runs
+    // after any callback in flight, so the resume cannot land before the pause
+    // it is meant to undo.
+    int resume = 0;
+    STATE_LOCK();
+    if (ctx->receive_delivery_failed) { STATE_UNLOCK(); return Qfalse; }
+    if (credit > UINT64_MAX - ctx->receive_credit) { STATE_UNLOCK(); rb_raise(rb_eRangeError, "Receive credit exceeds 64 bits"); }
+    if (chunk_credit > UINT64_MAX - ctx->receive_chunks) { STATE_UNLOCK(); rb_raise(rb_eRangeError, "Receive chunks exceed 64 bits"); }
+    ctx->receive_credit_enabled = 1;
+    ctx->receive_credit += credit;
+    ctx->receive_chunks += chunk_credit;
+    if (ctx->receive_paused && ctx->receive_credit && ctx->receive_chunks) {
+        ctx->receive_paused = 0;
+        resume = 1;
+    }
+    STATE_UNLOCK();
+
+    if (resume && !resume_receive(ctx)) return Qfalse;
+    wake_event_loop();
+    return Qtrue;
+}
+
+
+static VALUE
+shutdown_stream(VALUE stream_handle, VALUE error_code, QUIC_STREAM_SHUTDOWN_FLAGS flags)
+{
+    uint64_t token = NUM2ULL(stream_handle);
+    uint64_t code = NUM2ULL(error_code);
+    StreamContext* ctx = find_stream(token);
+    if (!MsQuic || !ctx) return Qfalse;
+
+    flags &= ctx->abort_flags;
+    if (!flags) return Qfalse;
+    QUIC_STATUS status = MsQuic->StreamShutdown(ctx->stream, flags, code);
+    wake_event_loop();
+    return QUIC_SUCCEEDED(status) ? Qtrue : Qfalse;
+}
+
+// Reset a QUIC stream (RESET_STREAM frame - abruptly terminates sending)
+static VALUE
+quicsilver_stream_reset(VALUE self, VALUE stream_handle, VALUE error_code)
+{
+    return shutdown_stream(stream_handle, error_code, QUIC_STREAM_SHUTDOWN_FLAG_ABORT_SEND);
+}
+
+static VALUE
+quicsilver_set_stream_priority(VALUE self, VALUE stream_handle, VALUE priority)
+{
+    uint64_t token = NUM2ULL(stream_handle);
+    unsigned int value = NUM2UINT(priority);
+    if (value > UINT16_MAX) rb_raise(rb_eArgError, "Stream priority must fit in 16 bits");
+    StreamContext* ctx = find_stream(token);
+    if (!MsQuic || !ctx) return Qfalse;
+    __atomic_store_n(&ctx->pending_priority, value + 1, __ATOMIC_RELEASE);
+    wake_event_loop();
+    return Qtrue;
+}
+
+static VALUE
+quicsilver_stream_stop_sending(VALUE self, VALUE stream_handle, VALUE error_code)
+{
+    return shutdown_stream(stream_handle, error_code, QUIC_STREAM_SHUTDOWN_FLAG_ABORT_RECEIVE);
+}
+
+static VALUE
+quicsilver_wake(VALUE self)
+{
+    wake_event_loop();
+    return Qnil;
+}
+
+// Initialize the extension
+void
+Init_quicsilver(void)
+{
+    mQuicsilver = rb_define_module("Quicsilver");
+    LiveStreams = st_init_numtable();
+    LiveSends = st_init_numtable();
+    LiveSendsRoot = TypedData_Wrap_Struct(rb_cObject, &live_sends_type, &LiveSendsRootData);
+    rb_gc_register_mark_object(LiveSendsRoot);
+
+    // Core initialization
+    rb_define_singleton_method(mQuicsilver, "open_connection", quicsilver_open, 0);
+    rb_define_singleton_method(mQuicsilver, "close_connection", quicsilver_close, 0);
+    
+    // Configuration management
+    rb_define_singleton_method(mQuicsilver, "create_configuration", quicsilver_create_configuration, -1);
+    rb_define_singleton_method(mQuicsilver, "create_server_configuration", quicsilver_create_server_configuration, 1);
+    rb_define_singleton_method(mQuicsilver, "close_configuration", quicsilver_close_configuration, 1);
+    
+    // Connection management
+    rb_define_singleton_method(mQuicsilver, "create_connection", quicsilver_create_connection, 1);
+    rb_define_singleton_method(mQuicsilver, "start_connection", quicsilver_start_connection, 4);
+    rb_define_singleton_method(mQuicsilver, "wait_for_connection", quicsilver_wait_for_connection, 2);
+    rb_define_singleton_method(mQuicsilver, "connection_status", quicsilver_connection_status, 1);
+    rb_define_singleton_method(mQuicsilver, "connection_statistics", quicsilver_connection_statistics, 1);
+    rb_define_singleton_method(mQuicsilver, "transport_counters", quicsilver_transport_counters, 0);
+    rb_define_singleton_method(mQuicsilver, "connection_reliable_reset_enabled?", quicsilver_connection_reliable_reset_enabled, 1);
+    rb_define_singleton_method(mQuicsilver, "set_stream_reliable_offset", quicsilver_set_stream_reliable_offset, 2);
+    rb_define_singleton_method(mQuicsilver, "connection_datagram_send_enabled?", quicsilver_connection_datagram_send_enabled, 1);
+    rb_define_singleton_method(mQuicsilver, "connection_remote_address", quicsilver_connection_remote_address, 1);
+    rb_define_singleton_method(mQuicsilver, "connection_ids", quicsilver_connection_ids, 1);
+    rb_define_singleton_method(mQuicsilver, "get_resumption_ticket", quicsilver_get_resumption_ticket, 1);
+    rb_define_singleton_method(mQuicsilver, "set_resumption_ticket", quicsilver_set_resumption_ticket, 2);
+    rb_define_singleton_method(mQuicsilver, "connection_shutdown", quicsilver_connection_shutdown, 3);
+    rb_define_singleton_method(mQuicsilver, "close_connection_handle", quicsilver_close_connection_handle, 1);
+    rb_define_singleton_method(mQuicsilver, "close_server_connection", quicsilver_close_server_connection, 1);
+    
+    // Listener management
+    rb_define_singleton_method(mQuicsilver, "apply_msquic_server_id", quicsilver_apply_msquic_server_id, 1);
+    rb_define_singleton_method(mQuicsilver, "create_listener", quicsilver_create_listener, 1);
+    rb_define_singleton_method(mQuicsilver, "configure_listener_cibir", quicsilver_configure_listener_cibir, 2);
+    rb_define_singleton_method(mQuicsilver, "configure_connection_cibir", quicsilver_configure_connection_cibir, 2);
+    rb_define_singleton_method(mQuicsilver, "start_listener", quicsilver_start_listener, 4);
+    rb_define_singleton_method(mQuicsilver, "stop_listener", quicsilver_stop_listener, 1);
+    rb_define_singleton_method(mQuicsilver, "close_listener", quicsilver_close_listener, 1);
+
+    // Stream management
+    rb_define_singleton_method(mQuicsilver, "open_stream", quicsilver_open_stream, 2);
+    rb_define_singleton_method(mQuicsilver, "send_stream", quicsilver_send_stream, 3);
+    rb_define_singleton_method(mQuicsilver, "stream_reset", quicsilver_stream_reset, 2);
+    rb_define_singleton_method(mQuicsilver, "stream_stop_sending", quicsilver_stream_stop_sending, 2);
+    rb_define_singleton_method(mQuicsilver, "set_stream_priority", quicsilver_set_stream_priority, 2);
+    rb_define_singleton_method(mQuicsilver, "get_stream_id", quicsilver_get_stream_id, 1);
+    rb_define_singleton_method(mQuicsilver, "grant_stream_receive_credit", quicsilver_grant_stream_receive_credit, 3);
+    rb_define_singleton_method(mQuicsilver, "datagram_send", quicsilver_datagram_send, 2);
+
+    // Event processing (custom execution — app drives MsQuic)
+    rb_define_singleton_method(mQuicsilver, "poll", quicsilver_poll, 0);
+    rb_define_singleton_method(mQuicsilver, "wake", quicsilver_wake, 0);
+    rb_define_singleton_method(mQuicsilver, "dispatch_events", quicsilver_dispatch_events, 2);
+    rb_define_singleton_method(mQuicsilver, "open_event_queue", quicsilver_open_event_queue, 0);
+    rb_define_singleton_method(mQuicsilver, "close_event_queue", quicsilver_close_event_queue, 0);
+    rb_define_singleton_method(mQuicsilver, "dropped_datagrams", quicsilver_dropped_datagrams, 0);
+}