@amritk/nish-x86_64-linux 0.17.0 → 0.20.0

package/std/net/quic.ts

@@ -58,27 +58,46 @@
  * its current value. When nothing is acknowledged for a probe timeout, with
  * its backoff, everything in flight is queued again and a probe goes out in
  * each space that has packets in flight, a PING if there is nothing to
- * resend (§6.2.4). NewReno's window holds back everything ack-eliciting but
- * a probe; an ACK always goes. PATH_RESPONSE and DATAGRAM are never sent
- * again (RFC 9000 §13.3, RFC 9221 §5.2). Pacing, and GSO batching, are the
- * carrier's: `nish/net/quic-listener`.
+ * resend (§6.2.4) — two datagrams of them during the handshake, each with
+ * the oldest CRYPTO data not acknowledged. A client that shows it lacks the
+ * server's handshake data (an Initial repeating CRYPTO data, an
+ * ack-eliciting Handshake packet) gets it again at once, a datagram each
+ * time, up to `QUIC_CONN_EARLY_RESENDS` times (§6.2.3). NewReno's window
+ * holds back everything ack-eliciting but a probe; an ACK always goes.
+ * PATH_RESPONSE and DATAGRAM are never sent again (RFC 9000 §13.3, RFC 9221
+ * §5.2). Pacing, and GSO batching, are the carrier's:
+ * `nish/net/quic-listener`. Once the 1-RTT keys are in, one Application
+ * Data packet number in every 128 to 1024 is skipped, at a distance drawn
+ * from the ID seed, and the last `QUIC_CONN_SKIP_RING` are remembered: an
+ * ACK of one acknowledges a packet never sent, an optimistic ACK meant to
+ * widen the congestion window, and is PROTOCOL_VIOLATION (RFC 9000 §21.4).
  *
  * **Nothing allocated per packet** (QUIC-3). A connection is a slot: every
- * buffer it uses — the packet record, the stream buffers, the CRYPTO
- * reassembly, the connection-ID table, the datagram rings — is made by the
- * constructor and reused, and `reset` makes the slot a new connection for
- * the next peer. A packet is opened (`receiveWindow`) and a datagram built
+ * buffer it uses — the packet record, the CRYPTO reassembly, the
+ * connection-ID table, the datagram rings — is made by the constructor and
+ * reused, and `reset` makes the slot a new connection for the next peer. The
+ * stream buffers are borrowed instead (`QuicStreamPools` in
+ * `nish/net/quic-stream`): a receive side takes one on its first byte and a
+ * send side on its first write, each goes back zeroed once the stream is done
+ * with it, and a server's connections share one set of pools, so idle slots
+ * hold none. A standalone connection makes private pools as large as all its
+ * slots at its first packet. The pools are primed before a packet's arena
+ * block and never touched inside it. A packet is opened (`receiveWindow`) and a datagram built
  * and sealed (`takeDatagramInto`) inside a `using a = arena()` block, so the
  * AEAD's and the header protection's temporaries go when the block ends, and
- * the compiler refuses the block if anything in it could store one. What
- * still allocates is the handshake's, once a connection: `TlsServer` and its
- * key schedule (TLS-3), the packet keys of each level, the stateless reset
- * tokens and connection IDs (HMAC), and a key update (QUIC-4) — recorded in
- * `docs/security/quic.md`.
+ * the compiler refuses the block if anything in it could store one. The
+ * handshake keeps its state in the slot too: one `TlsServer`, made by the
+ * slot's first handshake and `restart`ed by each after it; every level's
+ * packet keys, and a key update's, derived in place into `QuicKeysSlot`s
+ * (`nish/net/quic-packet`) over the slot's HKDF scratch; the Initial
+ * secrets, the stateless reset tokens and the connection IDs computed in
+ * arena blocks; the transport parameters encoded and parsed into the
+ * slot's own objects. After the first connection in a slot, a connection
+ * keeps nothing at all (QUIC-3 in `docs/security/quic.md`).
  *
  * **Time.** The connection has no clock: `receive`, `takeDatagram` and
  * `handleTimer` take the caller's monotonic time in milliseconds, and
- * `deadline()` says when `handleTimer` is next due. Three things run on it.
+ * `deadline()` says when `handleTimer` is next due. Four things run on it.
  * The idle timeout (RFC 9000 §10.1) is the smaller of the two sides'
  * `max_idle_timeout`, never under `QUIC_CONN_IDLE_FLOOR` or three probe
  * timeouts; once it passes with nothing received, the connection closes
@@ -86,7 +105,13 @@
  * timer declares packets lost by the time threshold or fires the probe
  * timeout. And after a key update the previous read keys are kept for a
  * probe timeout (`recovery.probeTimeout()`), for packets the network
- * reordered, before the next generation's are derived (RFC 9001 §6.5).
+ * reordered, before the next generation's are derived (RFC 9001 §6.5). Once
+ * the connection has closed, by either side, its keys are kept through the
+ * closing or draining period, three probe timeouts (RFC 9000 §10.2), and
+ * wiped at its end; `deadline()` is that end, then -1. A close this side
+ * owes starts the period when `takeDatagram` sends it, not when `close` or
+ * `fail` is called, so that however long the caller waits, the close still
+ * goes out.
  *
  * **Key update** (RFC 9001 §6), both ways. A 1-RTT packet whose Key Phase
  * bit differs from the current one is opened with the next generation's read
@@ -94,11 +119,17 @@
  * derivation and shows no timing difference (§6.3); if it opens, the client
  * has updated, and the server's write keys follow before anything is
  * acknowledged (§6.2). `updateKeys()` starts an update from the server once
- * the client has acknowledged a packet of the current phase (§6.1). Each
- * update the client starts costs two key derivations, which stay in the arena
- * (QUIC-4 in `docs/security/quic.md`), so a connection takes at most
- * `QUIC_CONN_MAX_KEY_UPDATES` of them and closes on the next with
- * KEY_UPDATE_ERROR.
+ * the client has acknowledged a packet of the current phase (§6.1). The
+ * generations take turns in two key slots and two secrets a direction, so an
+ * update keeps nothing in the arena; each still costs two key derivations of
+ * work, so a connection takes at most `QUIC_CONN_MAX_KEY_UPDATES` updates the
+ * client starts and closes on the next with KEY_UPDATE_ERROR (QUIC-4).
+ * The AEAD limits are kept (RFC 9001 §6.6): from three quarters of AES-GCM's
+ * confidentiality limit, 2^23 packets under one write key, the server starts
+ * an update itself, and closes with AEAD_LIMIT_REACHED, sealing nothing more,
+ * if it reaches the limit with none possible; past the integrity limit of
+ * packets that fail to authenticate over the connection, 2^52 for AES-GCM
+ * and 2^36 for ChaCha20-Poly1305, it closes with AEAD_LIMIT_REACHED too.
  *
  * **Sans-IO and deterministic.** No socket, no clock and no random device:
  * every random choice (the TLS server random and ephemeral key, the server's
@@ -122,25 +153,31 @@
  * `maxData`, the connection-ID table by the limit advertised, the received
  * packet numbers by `QUIC_ACK_MAX_RANGES`, and datagrams by their ring.
  *
- * **Secrets.** The packet keys of each level live in this connection's
- * fields as long as the level does, and in `TlsServer`'s (TLS-1); so do the
- * 1-RTT secrets the next key generation is derived from, and the next
- * generation's read keys. A `Secret` may not be a field (NL2430), so they are
- * plain bytes; `secureZero` wipes each level's key, IV and header-protection
- * key when the level is discarded, each generation's key, IV and secret when
- * a key update replaces it, and `release()` (and `reset`) the rest — the
- * 1-RTT keys, the traffic secrets `TlsServer` holds, its ephemeral key and
- * the connection-ID seed. What no wipe reaches (the expanded AES key
- * schedules, the HKDF and HMAC intermediates in arena memory) is recorded as
- * QUIC-2 in `docs/security/quic.md`, with #430, the follow-up that moves
- * these structs onto `nish:secret`.
+ * **Secrets.** The packet keys of each level live in this connection's key
+ * slots as long as the level does; so do the 1-RTT secrets the next key
+ * generation is derived from, and the next generation's read keys. The
+ * traffic secrets and the ephemeral key `TlsServer` holds are `Secret`
+ * fields its `wipe()` reaches (TLS-1): `afterTls` takes each level's secrets
+ * out of them once, into this connection's plain slots, and zeroes them
+ * through `wipeSecret`. The slots are plain bytes, wiped with stores no
+ * optimiser removes (`secureZero`, and `aesKeyWipe` for an AES schedule):
+ * each level's key, IV, header-protection key and schedules when the level
+ * is discarded; each generation's key, IV, schedule and secret when a key
+ * update replaces it; and the rest — the 1-RTT keys, the key-update secrets,
+ * whatever `TlsServer` still holds and the connection-ID seed — by
+ * `release()`, `reset`, the idle timeout, and the end of the closing or
+ * draining period (RFC 9000 §10.2), three probe timeouts after this side's
+ * CONNECTION_CLOSE went out or the client's arrived.
+ * `docs/security/quic.md` records what is wiped where as QUIC-2.
  *
  * Written from RFC 9000, RFC 9001 and RFC 9221, in this module's own
  * structure; nothing here is ported from another implementation. Private
  * names carry the `quicConn` prefix (`docs/wp26-stdlib.md` §3e).
  */
 import { timingSafeEqualAt } from "nish/crypto/ct"
-import { hmacSha256 } from "nish/crypto/hmac"
+import { AesKey, aesKeyWipe } from "nish/crypto/aes"
+import { HkdfScratch } from "nish/crypto/hkdf"
+import { HmacSha256Scratch, hmacSha256 } from "nish/crypto/hmac"
 import {
   QUIC_AEAD_AES_128_GCM,
   QUIC_AEAD_AES_256_GCM,
@@ -153,15 +190,16 @@ import {
   QUIC_PACKET_INITIAL,
   QUIC_PACKET_OK,
   QUIC_PACKET_SHORT,
+  QUIC_PACKET_ZERO_RTT,
   QuicHeader,
-  QuicInitialSecrets,
   QuicKeys,
+  QuicKeysSlot,
   QuicPacket,
   quicDecryptPayload,
-  quicInitialSecrets,
-  quicKeyUpdateSecret,
-  quicKeys,
-  quicKeysUpdate,
+  quicInitialSecretsInto,
+  quicKeyUpdateSecretInto,
+  quicKeysInto,
+  quicKeysUpdateInto,
   quicPacketNumberLength,
   quicParseHeaderInto,
   quicPutLongHeader,
@@ -170,6 +208,7 @@ import {
   quicUnprotectHeader,
 } from "nish/net/quic-packet"
 import {
+  QUIC_ERROR_AEAD_LIMIT_REACHED,
   QUIC_ERROR_APPLICATION,
   QUIC_ERROR_CRYPTO,
   QUIC_ERROR_CRYPTO_BUFFER_EXCEEDED,
@@ -218,8 +257,8 @@ import {
 } from "nish/net/quic-frame"
 import {
   QuicTransportParameters,
-  quicEncodeTransportParameters,
-  quicParseTransportParameters,
+  quicEncodeTransportParametersInto,
+  quicParseTransportParametersInto,
 } from "nish/net/quic-conn-params"
 import { QuicAckRanges } from "nish/net/quic-conn-ack"
 import {
@@ -249,13 +288,22 @@ import {
   TLS_LEVEL_APPLICATION,
   TLS_LEVEL_HANDSHAKE,
   TLS_LEVEL_INITIAL,
+  TLS_SECRET_CLIENT_APPLICATION,
+  TLS_SECRET_CLIENT_HANDSHAKE,
+  TLS_SECRET_SERVER_APPLICATION,
+  TLS_SECRET_SERVER_HANDSHAKE,
   TLS_STATE_CONNECTED,
   TLS_STATE_WAIT_CLIENT_HELLO,
   TLS_STATE_WAIT_SIGNATURE,
+  TlsSecretPool,
   TlsServer,
   TlsServerConfig,
+  tlsHeldClone,
+  tlsHeldCopyIn,
+  tlsHeldCopyOver,
 } from "nish/net/tls"
 import { TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256 } from "nish/net/tls/schedule"
+import { Secret, expose, exposeWith, secret, wipe } from "nish:secret"
 
 // ---- Sizes ----------------------------------------------------------------------
 
@@ -288,10 +336,11 @@ export const QUIC_CONN_MAX_STREAM_DATA: i64 = 1048576
 /** The most streams of one kind a configuration may let the client open at once, or open itself. */
 export const QUIC_CONN_MAX_STREAMS: i64 = 1024
 /**
- * The most bytes of stream buffer a configuration may make each connection
+ * The most bytes of stream buffer a configuration may let each connection
  * hold: every stream slot (`maxStreamsBidi + maxStreamsUni + localStreams`)
- * has `maxStreamData` bytes each way, made when the connection is, so a
- * configuration past 64 MiB of them is refused rather than allocated.
+ * may borrow `maxStreamData` bytes each way, and the pools are sized so all
+ * of them can at once, so a configuration past 64 MiB of them is refused
+ * rather than allowed to allocate it.
  */
 export const QUIC_CONN_MAX_STREAM_BUFFERS: i64 = 67108864
 /** The length of the configuration's static keys: the stateless reset key and the Retry token key. */
@@ -320,12 +369,62 @@ export const QUIC_CONN_PACKET_STREAMS: i32 = 4
 export const QUIC_CONN_PACKET_CONTROL: i32 = 4
 /**
  * How many key updates a connection takes from its client (RFC 9001 §6).
- * Each costs two key derivations whose temporaries stay in the arena, so the
- * cap bounds what a client can make the server derive (QUIC-4); the next one
+ * Each costs two key derivations of work, though none of their memory, so
+ * the cap bounds what a client can make the server derive (QUIC-4); the next one
  * closes the connection with KEY_UPDATE_ERROR. A client also has to wait
  * a probe timeout between two of them.
  */
 export const QUIC_CONN_MAX_KEY_UPDATES: i32 = 64
+/**
+ * AES-GCM's confidentiality limit (RFC 9001 §6.6): how many packets one
+ * 1-RTT write key seals. The server starts a key update at three quarters of
+ * it, and closes the connection with AEAD_LIMIT_REACHED, sending nothing more
+ * under the key, if it reaches it with no update possible. ChaCha20-Poly1305
+ * has no such limit.
+ */
+export const QUIC_CONN_CONFIDENTIALITY_LIMIT: i64 = 8388608
+/**
+ * The integrity limits (RFC 9001 §6.6): how many packets may fail to
+ * authenticate over a connection's life, across every key, before it closes
+ * with AEAD_LIMIT_REACHED. AES-GCM's is 2^52, ChaCha20-Poly1305's 2^36.
+ */
+export const QUIC_CONN_INTEGRITY_LIMIT_GCM: i64 = 4503599627370496
+export const QUIC_CONN_INTEGRITY_LIMIT_CHACHA: i64 = 68719476736
+/**
+ * How many skipped packet numbers the server remembers (RFC 9000 §21.4): an
+ * ACK of any of the last this many closes the connection as an optimistic
+ * acknowledgement. One is skipped every `QUIC_CONN_SKIP_MIN` to
+ * `QUIC_CONN_SKIP_MIN + QUIC_CONN_SKIP_SPREAD - 1` packets, so the ring
+ * reaches back at least 7 × 129 = 903 packets.
+ */
+export const QUIC_CONN_SKIP_RING: i32 = 8
+export const QUIC_CONN_SKIP_MIN: i64 = 128
+export const QUIC_CONN_SKIP_SPREAD: i64 = 897
+/**
+ * The HMAC counter the skip distances are drawn under, past any connection
+ * ID's sequence number (`QUIC_CONN_MAX_ISSUED_CIDS`), so the same seed gives
+ * both without either telling anything about the other.
+ */
+const QUIC_CONN_SKIP_SEQUENCE: i64 = QUIC_MAX_VARINT + 1
+/**
+ * How many ack-eliciting datagrams a probe timeout sends in the Initial and
+ * Handshake spaces (RFC 9002 §6.2.4 allows up to two). The server's first
+ * flight is usually one datagram, so with one probe a lossy path loses every
+ * copy of it about as often as it loses one datagram per probe timeout; two
+ * square that, and stay inside the amplification limit, which a one-datagram
+ * flight and two probes fill exactly. The Application Data space sends one.
+ */
+export const QUIC_CONN_HANDSHAKE_PROBES: i32 = 2
+/**
+ * How many times a connection resends its handshake data before the probe
+ * timeout because the client showed it lacks it (RFC 9002 §6.2.3, "for a
+ * limited number of times per connection"): a client Initial carrying
+ * CRYPTO data the server already read, or an ack-eliciting Handshake packet,
+ * while the server's own CRYPTO data at that level is in flight. Each
+ * resend is one datagram, so a client cannot make the server answer more
+ * than this many packets that way, whatever it sends.
+ */
+export const QUIC_CONN_EARLY_RESENDS: i32 = 2
 /**
  * How many connection IDs a connection issues in all, its first included.
  * The client retiring one asks for a replacement (§5.1.1, a SHOULD), and
@@ -381,6 +480,10 @@ export const QUIC_DATAGRAM_ERR_FULL: i32 = -5
 
 /** A typed zero for the offsets below: a bare literal is an `f64` under `--number-mode f64`. */
 const QUIC_CONN_FROM: i32 = 0
+/** A space's key slots (`QuicConnSpace.keySlot`): the read keys', the write keys', and where Application Data's write keys start. */
+const QUIC_CONN_READ_SLOT: i32 = 0
+const QUIC_CONN_WRITE_SLOT: i32 = 1
+const QUIC_CONN_APP_WRITE_SLOTS: i32 = 2
 /** The same for the `i64` arguments of the methods below, where a literal is not given its parameter's type. */
 const QUIC_CONN_NONE: i64 = 0
 /** TLS's unexpected_message alert, which CRYPTO data at a level TLS is not reading is (RFC 8446 §6). */
@@ -577,6 +680,12 @@ class QuicConnSpace {
    */
   cryptoOut: u8[]
   cryptoOutLength: i32 = 0
+  /**
+   * How many ack-eliciting probe packets this space still owes, which the
+   * window does not hold back: what a probe timeout asked for (RFC 9002
+   * §6.2.4), or an early resend (§6.2.3).
+   */
+  probes: i32 = 0
   cryptoOutOffset: i64 = 0
   /** How many CRYPTO bytes the client sent here that were handed to TLS, for a duplicate arriving after the next level started. */
   cryptoInDelivered: i64 = 0
@@ -597,6 +706,12 @@ class QuicConnSpace {
   sentControlCount: i32[]
   sentControlKind: u8[]
   sentControlValue: i64[]
+  /**
+   * Where this space's packet keys live, made once for the slot (QUIC-3):
+   * the read keys' and the write keys', and for the Application Data space a
+   * second of each, which a key update derives the next generation into.
+   */
+  keySlots: QuicKeysSlot[]
   /** `TLS_LEVEL_INITIAL`, `_HANDSHAKE` or `_APPLICATION`, which is also the space's index. */
   level: i32 = 0
   cryptoOutHead: i32 = 0
@@ -609,13 +724,16 @@ class QuicConnSpace {
   discarded: boolean = false
   /** Whether the packet being built elicits an acknowledgement, and so is recorded. */
   stagedEliciting: boolean = false
-  /** Whether a probe timeout asked this space for an ack-eliciting packet, which the window does not hold back (RFC 9002 §6.2.4). */
-  probe: boolean = false
 
   constructor(level: i32) {
     this.level = level
     this.received = new QuicAckRanges()
     this.cryptoOut = []
+    this.keySlots = []
+    const slots: i32 = level === TLS_LEVEL_APPLICATION ? 4 : 2
+    for (let k: i32 = 0; k < slots; k += 1) {
+      this.keySlots.push(new QuicKeysSlot())
+    }
     const capacity: i32 =
       level === TLS_LEVEL_APPLICATION ? QUIC_RECOVERY_APPLICATION_CAPACITY : QUIC_RECOVERY_HANDSHAKE_CAPACITY
     const rows: i32 = capacity + 1
@@ -649,23 +767,44 @@ class QuicConnSpace {
     this.cryptoResendLow = -1
     this.cryptoResendHigh = -1
     this.discarded = false
-    this.probe = false
+    this.probes = 0
     this.clearStaged()
   }
 
-  /** Appends `bytes` to the CRYPTO stream kept, writing into the array's old room before growing it. */
-  appendCrypto(bytes: u8[]): void {
-    for (const b of bytes) {
+  /**
+   * Appends `bytes[0 .. length)` to the CRYPTO stream kept, writing into the
+   * array's old room before growing it: TLS's output buffer is read in
+   * place, so its flight is not copied on the way.
+   */
+  appendCrypto(bytes: u8[], length: i32): void {
+    for (let k: i32 = 0; k < length && k < toI32(bytes.length); k += 1) {
       const at: i32 = this.cryptoOutLength
       if (at >= 0 && at < toI32(this.cryptoOut.length)) {
-        this.cryptoOut[at] = b
+        this.cryptoOut[at] = bytes[k]
       } else {
-        this.cryptoOut.push(b)
+        this.cryptoOut.push(bytes[k])
       }
       this.cryptoOutLength = at + 1
     }
   }
 
+  /**
+   * Key slot `k` of this space: in the Initial and Handshake spaces 0 holds
+   * the read keys and 1 the write keys; in Application Data 0 and 1 hold
+   * the read keys' generations and 2 and 3 the write keys'.
+   */
+  keySlot(k: i32): QuicKeysSlot {
+    const at: i32 = k >= 0 && k < toI32(this.keySlots.length) ? k : 0
+    return this.keySlots[at]
+  }
+
+  /** Zeroes every key this space's slots hold, the AES schedules included. */
+  wipeKeySlots(): void {
+    for (const slot of this.keySlots) {
+      slot.wipe()
+    }
+  }
+
   /** The number of STREAM chunks row `row` holds, or 0. */
   streamCount(row: i32): i32 {
     return row >= 0 && row < toI32(this.sentStreamCount.length) ? this.sentStreamCount[row] : 0
@@ -853,7 +992,14 @@ const quicConnAead = (suite: i32): i32 => {
   return QUIC_AEAD_AES_128_GCM
 }
 
-/** Wipes a level's key, IV and header-protection key; the expanded AES schedules are out of reach (QUIC-2). */
+/** Empties a ring of skipped packet numbers. */
+const quicConnForgetSkips = (skipped: i64[]): void => {
+  for (let k: i32 = 0; k < toI32(skipped.length); k += 1) {
+    skipped[k] = -1
+  }
+}
+
+/** Wipes a level's key, IV and header-protection key; `QuicKeysSlot.wipe` takes the header-protection schedule. */
 const quicConnWipeKeys = (keys: QuicKeys | null): void => {
   quicConnWipePacketKey(keys)
   if (keys !== null) {
@@ -862,14 +1008,19 @@ const quicConnWipeKeys = (keys: QuicKeys | null): void => {
 }
 
 /**
- * Wipes a key generation's packet key and IV that a key update replaced. The
- * header-protection key is left alone: every generation shares it (RFC 9001
- * §6), so it goes only when the level does.
+ * Wipes a key generation's packet key, IV and the packet key's AES schedule,
+ * which a key update replaced. The header-protection key and its schedule are
+ * left alone: every generation shares them (RFC 9001 §6), so they go only
+ * when the level does.
  */
 const quicConnWipePacketKey = (keys: QuicKeys | null): void => {
   if (keys !== null) {
     secureZero(keys.key)
     secureZero(keys.iv)
+    const packetAes: AesKey | null = keys.packetAes
+    if (packetAes !== null) {
+      aesKeyWipe(packetAes)
+    }
   }
 }
 
@@ -888,6 +1039,59 @@ export const quicStatelessResetToken = (key: u8[], cid: u8[]): u8[] => {
   return token
 }
 
+/**
+ * `quicStatelessResetToken` of the ID `cid[at .. at + length)` into
+ * `out[outAt ..]`, computed in a connection's own HMAC scratch inside an
+ * arena block, so issuing an ID keeps nothing (QUIC-3). The scratch and the
+ * full MAC are wiped before it returns.
+ */
+export const quicConnResetTokenInto = (
+  mac: HmacSha256Scratch,
+  key: u8[],
+  cid: u8[],
+  at: i32,
+  length: i32,
+  out: u8[],
+  outAt: i32
+): void => {
+  using _scope = arena()
+  const tag: u8[] = new Array<u8>(32)
+  mac.begin(key, QUIC_CONN_FROM, toI32(key.length))
+  mac.update(cid, at, length)
+  mac.finishInto(tag, QUIC_CONN_FROM)
+  for (
+    let k: i32 = 0;
+    k < QUIC_RESET_TOKEN_SIZE && k < toI32(tag.length) && outAt + k < toI32(out.length);
+    k += 1
+  ) {
+    out[outAt + k] = tag[k]
+  }
+  secureZero(tag)
+  mac.wipe()
+}
+
+/** Puts `from[at .. at + length)` in `to`, emptied first, in the room `to` already has. */
+const quicConnRefill = (to: u8[], from: u8[], at: i32, length: i32): void => {
+  while (to.length > 0) {
+    to.pop()
+  }
+  for (let k: i32 = 0; k < length && at + k >= 0 && at + k < toI32(from.length); k += 1) {
+    to.push(from[at + k])
+  }
+}
+
+/** Zeroes the bytes a `Secret` field holds, for `exposeWith` to run outside the connection's `wipe()`; answers `answer`. */
+const quicConnZeroHeld = (held: u8[], answer: i32): i32 => {
+  wipe(held)
+  return answer
+}
+
+/** Copies the x25519 private key, `entropy[32 .. 64)`, into the held key, for `exposeWith`; answers 0. */
+const quicConnEphemeralIn = (held: u8[], entropy: u8[]): i32 => {
+  quicCidCopy(held, entropy, 32, 32)
+  return 0
+}
+
 /** Whether the configuration's limits are ones this module can honour. */
 const quicConnConfigFits = (config: QuicServerConfig): boolean =>
   config.maxStreamData >= 1 &&
@@ -931,7 +1135,8 @@ export class QuicConnection {
   /** For a transport error: the type of the frame that caused it, or 0. */
   errorFrameType: i64 = 0
   serverRandom: u8[]
-  ephemeralPrivate: u8[]
+  /** The x25519 private key `begin` takes from the entropy, until the handshake hands it to `TlsServer`. */
+  readonly ephemeral: Secret<u8[]>
   cidSeed: u8[]
   /** The DCID of the client's first Initial, which the Initial keys come from: its first `originalDcidLength` bytes. */
   originalDcid: u8[]
@@ -940,6 +1145,37 @@ export class QuicConnection {
   /** The server's first connection ID, the SCID of every long-header packet it sends. */
   localScid: u8[]
   tls: TlsServer | null = null
+  /** The slot's `TlsServer`, made by its first handshake and `restart`ed by every one after (QUIC-3). */
+  tlsSlot: TlsServer | null = null
+  /** Its configuration, made once: the parameters it carries are `localEncoded`, rewritten for each connection. */
+  tlsConfig: TlsServerConfig
+  /** The server's transport parameters, set for each connection, and their encoding. */
+  localParameters: QuicTransportParameters
+  localEncoded: u8[]
+  /** The client's transport parameters, parsed into the slot's own object. */
+  parsedParameters: QuicTransportParameters
+  /** Where every key derivation and HMAC of the connection runs. */
+  kdf: HkdfScratch
+  /** The Initial secrets of RFC 9001 §5.2, the client's and the server's. */
+  initialClient: u8[]
+  initialServer: u8[]
+  /**
+   * The 1-RTT traffic secrets (RFC 9001 §6.1), one set of SHA-256's length
+   * and one of SHA-384's, the one the suite's hash picks in use: the
+   * current read secret, the next generation's, and the current write
+   * secret, which a key update ratchets in place. The write side keeps no
+   * next secret, because the server derives its next write keys only when
+   * it moves to them.
+   */
+  readonly readSecret256: Secret<u8[]>
+  readonly nextReadSecret256: Secret<u8[]>
+  readonly writeSecret256: Secret<u8[]>
+  readonly readSecret384: Secret<u8[]>
+  readonly nextReadSecret384: Secret<u8[]>
+  readonly writeSecret384: Secret<u8[]>
+  /** A connection ID being issued and its stateless reset token, before the table copies them. */
+  cidScratch: u8[]
+  tokenScratch: u8[]
   initial: QuicConnSpace
   handshake: QuicConnSpace
   application: QuicConnSpace
@@ -980,14 +1216,10 @@ export class QuicConnection {
   /** When the idle timer last restarted (RFC 9000 §10.1), or -1 before the first packet. */
   idleSince: i64 = -1
   /**
-   * The 1-RTT secrets of the current generation, the next generation's read
-   * secret, and its read keys (RFC 9001 §6.1, §6.3). `otherReadKeys` holds
-   * the next generation's while `otherIsNext`, and for a probe timeout after
-   * an update the previous one's, for reordered packets (§6.5).
+   * The other read keys of the Application Data space (RFC 9001 §6.3):
+   * the next generation's while `otherIsNext`, and for a probe timeout
+   * after an update the previous one's, for reordered packets (§6.5).
    */
-  appReadSecret: u8[]
-  appWriteSecret: u8[]
-  nextReadSecret: u8[]
   otherReadKeys: QuicKeys | null = null
   /** The lowest and highest packet numbers opened with the current read keys, or -1. */
   readPhaseLowest: i64 = -1
@@ -996,10 +1228,49 @@ export class QuicConnection {
   writePhaseFirst: i64 = 0
   /** When the previous read keys go and the next are derived, or -1. */
   keyRetainUntil: i64 = -1
+  /**
+   * When a closed connection's closing or draining period ends (RFC 9000
+   * §10.2), and `runClocks` wipes every key it kept for it, or -1: before
+   * the close, while a close this side owes has not gone out, and once the
+   * keys are wiped.
+   */
+  closingUntil: i64 = -1
   /** The packet number of a client key update read but not applied yet, or -1. */
   phasePending: i64 = -1
   /** The largest DATAGRAM frame the client takes (its `max_datagram_frame_size`), 0 for none. */
   peerMaxDatagramFrame: i64 = 0
+  /**
+   * The AEAD limits this connection keeps (RFC 9001 §6.6): packets one 1-RTT
+   * write key seals, and packets that fail to authenticate over the
+   * connection. `afterTls` sets them from the suite when the 1-RTT keys
+   * arrive; until then they are AES-GCM's. They are fields so that a test can
+   * lower them after the handshake; nothing else should set them.
+   */
+  confidentialityLimit: i64 = 8388608
+  integrityLimit: i64 = 4503599627370496
+  /** Packets sealed under the current 1-RTT write key, and packets that failed to authenticate, against those limits. */
+  sealedUnderKey: i64 = 0
+  authFailures: i64 = 0
+  /**
+   * ECN (RFC 9000 §13.4): `ecnMarking` is the carrier's to set when it sends
+   * this connection's datagrams with the ECN bits of `datagramEcn`, which
+   * each `takeDatagramInto` sets for the datagram it wrote: ECT(0) while
+   * loss recovery's `ecnCodepoint()` asks for it, 0 otherwise and always
+   * while `ecnMarking` is false. Every packet of a marked datagram is counted
+   * as marked, and an ACK_ECN's counts are validated against them. `reset`
+   * keeps `ecnMarking`, which is the carrier's, and clears the rest.
+   */
+  ecnMarking: boolean = false
+  datagramEcn: i32 = 0
+  /**
+   * The next Application Data packet number skipped (RFC 9000 §21.4), or -1
+   * before the 1-RTT keys; a test may set it to force one. `skipped` holds
+   * the last `QUIC_CONN_SKIP_RING` skipped, -1 where none, `skipHead` where
+   * the next goes, and `skipsDrawn` how many distances were drawn.
+   */
+  nextSkip: i64 = -1
+  skipped: i64[]
+  skipsDrawn: i64 = 0
   originalDcidLength: i32 = 0
   peerScidLength: i32 = 0
   pathHead: i32 = 0
@@ -1009,6 +1280,15 @@ export class QuicConnection {
   dropped: i32 = 0
   /** Key updates the client started, against `QUIC_CONN_MAX_KEY_UPDATES`. */
   keyUpdates: i32 = 0
+  /** Where the next skipped packet number goes in `skipped`. */
+  skipHead: i32 = 0
+  /** Which of the Application Data space's two read slots, and two write slots, hold the current keys. */
+  appReadSlot: i32 = 0
+  appWriteSlot: i32 = 0
+  /** Handshake data sent again early, against `QUIC_CONN_EARLY_RESENDS` (RFC 9002 §6.2.3). */
+  earlyResends: i32 = 0
+  /** The level at which the packet just read showed the client lacks the server's handshake data, or -1. */
+  resendLevel: i32 = -1
   /** Whether `error` is an application code (CONNECTION_CLOSE 0x1d) rather than a transport error. */
   errorIsApplication: boolean = false
   /** Whether the one CONNECTION_CLOSE this side owes has gone out. */
@@ -1018,6 +1298,12 @@ export class QuicConnection {
   /** Whether the handshake is complete, which for a server is also confirmed (RFC 9001 §4.1.2). */
   handshakeComplete: boolean = false
   handshakeDonePending: boolean = false
+  /**
+   * Whether `afterTls` has taken the application traffic secrets out of
+   * `TlsServer`. It takes them once: `wipeSecret` leaves them known, so a
+   * second take would derive the 1-RTT keys from the zeros it left.
+   */
+  applicationTaken: boolean = false
   /** Whether the connection was set up by `acceptRetry`. */
   retried: boolean = false
   /** Whether an ack-eliciting packet went out since the last packet was received. */
@@ -1042,7 +1328,7 @@ export class QuicConnection {
   constructor(config: QuicServerConfig, entropy: u8[]) {
     this.config = config
     this.serverRandom = new Array<u8>(32)
-    this.ephemeralPrivate = new Array<u8>(32)
+    this.ephemeral = secret(new Array<u8>(32))
     this.localScid = new Array<u8>(QUIC_CONN_CID_LENGTH)
     this.cidSeed = new Array<u8>(32)
     this.originalDcid = new Array<u8>(QUIC_MAX_CID_LENGTH)
@@ -1080,11 +1366,33 @@ export class QuicConnection {
     this.header = new QuicHeader()
     this.packet = new QuicPacket()
     this.none = []
-    this.retryOriginalDcid = this.none
-    this.retryScid = this.none
-    this.appReadSecret = this.none
-    this.appWriteSecret = this.none
-    this.nextReadSecret = this.none
+    this.retryOriginalDcid = []
+    this.retryScid = []
+    this.localParameters = new QuicTransportParameters()
+    this.localEncoded = []
+    this.parsedParameters = new QuicTransportParameters()
+    const extra: u8[] = []
+    this.tlsConfig = {
+      certificateChain: config.certificateChain,
+      alpn: config.alpn,
+      quicTransportParameters: this.localEncoded,
+      extraExtensions: extra,
+      signatureScheme: config.signatureScheme,
+      quic: true,
+    }
+    this.kdf = new HkdfScratch()
+    this.initialClient = new Array<u8>(32)
+    this.initialServer = new Array<u8>(32)
+    this.readSecret256 = secret(new Array<u8>(32))
+    this.nextReadSecret256 = secret(new Array<u8>(32))
+    this.writeSecret256 = secret(new Array<u8>(32))
+    this.readSecret384 = secret(new Array<u8>(48))
+    this.nextReadSecret384 = secret(new Array<u8>(48))
+    this.writeSecret384 = secret(new Array<u8>(48))
+    this.cidScratch = new Array<u8>(QUIC_CONN_CID_LENGTH)
+    this.tokenScratch = new Array<u8>(QUIC_RESET_TOKEN_SIZE)
+    this.skipped = new Array<i64>(QUIC_CONN_SKIP_RING)
+    quicConnForgetSkips(this.skipped)
     this.begin(entropy)
   }
 
@@ -1094,8 +1402,8 @@ export class QuicConnection {
    * array): every secret of the last connection is wiped first, as
    * `release()` does, and every buffer is kept and emptied. The limits are
    * the constructor's configuration's. A slot reset this way allocates
-   * nothing for itself; the next handshake allocates what any handshake does
-   * (TLS-3 in `docs/security/tls.md`).
+   * nothing, and neither does the next handshake (QUIC-3 in
+   * `docs/security/quic.md`).
    */
   reset(entropy: u8[]): void {
     this.wipeAll()
@@ -1109,6 +1417,7 @@ export class QuicConnection {
     this.datagramsIn.reset()
     this.cryptoIn.reset(TLS_LEVEL_INITIAL)
     this.peerParameters = this.defaultParameters
+    // The slot keeps its `TlsServer`, wiped by `wipeAll`; the next handshake restarts it.
     this.tls = null
     this.error = 0
     this.errorFrameType = 0
@@ -1116,18 +1425,20 @@ export class QuicConnection {
     this.bytesSent = 0
     this.alpn = ""
     this.serverName = ""
-    this.retryOriginalDcid = this.none
-    this.retryScid = this.none
-    this.appReadSecret = this.none
-    this.appWriteSecret = this.none
-    this.nextReadSecret = this.none
+    quicConnRefill(this.retryOriginalDcid, this.none, QUIC_CONN_FROM, QUIC_CONN_FROM)
+    quicConnRefill(this.retryScid, this.none, QUIC_CONN_FROM, QUIC_CONN_FROM)
     this.otherReadKeys = null
+    this.appReadSlot = 0
+    this.appWriteSlot = 0
+    this.earlyResends = 0
+    this.resendLevel = -1
     this.now = 0
     this.idleSince = -1
     this.readPhaseLowest = -1
     this.readPhaseHighest = -1
     this.writePhaseFirst = 0
     this.keyRetainUntil = -1
+    this.closingUntil = -1
     this.phasePending = -1
     this.peerMaxDatagramFrame = 0
     this.originalDcidLength = 0
@@ -1137,10 +1448,20 @@ export class QuicConnection {
     this.state = QUIC_STATE_WAIT_INITIAL
     this.dropped = 0
     this.keyUpdates = 0
+    this.confidentialityLimit = QUIC_CONN_CONFIDENTIALITY_LIMIT
+    this.integrityLimit = QUIC_CONN_INTEGRITY_LIMIT_GCM
+    this.sealedUnderKey = 0
+    this.authFailures = 0
+    this.datagramEcn = 0
+    this.nextSkip = -1
+    quicConnForgetSkips(this.skipped)
+    this.skipsDrawn = 0
+    this.skipHead = 0
     this.errorIsApplication = false
     this.closeSent = false
     this.addressValidated = false
     this.handshakeComplete = false
+    this.applicationTaken = false
     this.handshakeDonePending = false
     this.retried = false
     this.elicitingSent = false
@@ -1155,7 +1476,7 @@ export class QuicConnection {
   /** Takes `entropy` (and wipes it), or closes with INTERNAL_ERROR for entropy or a configuration that does not fit. */
   begin(entropy: u8[]): void {
     quicCidCopy(this.serverRandom, entropy, 0, 32)
-    quicCidCopy(this.ephemeralPrivate, entropy, 32, 32)
+    exposeWith(this.ephemeral, entropy, quicConnEphemeralIn)
     quicCidCopy(this.localScid, entropy, 64, QUIC_CONN_CID_LENGTH)
     quicCidCopy(this.cidSeed, entropy, 72, 32)
     const fits: boolean = toI32(entropy.length) === QUIC_CONN_ENTROPY_SIZE && quicConnConfigFits(this.config)
@@ -1164,6 +1485,7 @@ export class QuicConnection {
       this.state = QUIC_STATE_CLOSING
       this.error = QUIC_ERROR_INTERNAL
       this.closeSent = true
+      this.startClosingPeriod()
     }
   }
 
@@ -1201,8 +1523,8 @@ export class QuicConnection {
     ) {
       return false
     }
-    this.retryOriginalDcid = quicConnSlice(originalDcid, 0, toI32(originalDcid.length))
-    this.retryScid = quicConnSlice(retryScid, 0, toI32(retryScid.length))
+    quicConnRefill(this.retryOriginalDcid, originalDcid, QUIC_CONN_FROM, toI32(originalDcid.length))
+    quicConnRefill(this.retryScid, retryScid, QUIC_CONN_FROM, toI32(retryScid.length))
     this.retried = true
     return true
   }
@@ -1234,6 +1556,19 @@ export class QuicConnection {
     this.errorIsApplication = true
   }
 
+  /**
+   * Starts the closing or draining period, three probe timeouts long (RFC
+   * 9000 §10.2), once nothing more is owed: when the client's
+   * CONNECTION_CLOSE arrives, when `takeCloseInto` sends this side's, or when
+   * `begin` closes before anything could be sent. The keys stay through it,
+   * as the period's state, and `runClocks` wipes them all at its end, which
+   * `deadline()` names, so that a connection nobody `release()`s does not
+   * keep them.
+   */
+  startClosingPeriod(): void {
+    this.closingUntil = this.now + this.recovery.probeTimeout() * 3
+  }
+
   /** The space of packets of `type`, or `null` for a 0-RTT or Retry packet. */
   spaceOf(type: i32): QuicConnSpace | null {
     if (type === QUIC_PACKET_INITIAL) {
@@ -1352,13 +1687,29 @@ export class QuicConnection {
     ) {
       return false
     }
-    const dcid: u8[] = quicConnSlice(buf, header.dcidStart, header.dcidLength)
-    const secrets: QuicInitialSecrets | null = quicInitialSecrets(dcid)
-    if (secrets === null) {
+    const secrets: boolean = quicInitialSecretsInto(
+      this.kdf,
+      buf,
+      header.dcidStart,
+      header.dcidLength,
+      this.initialClient,
+      this.initialServer
+    )
+    if (!secrets) {
       return false
     }
-    this.initial.readKeys = quicKeys(QUIC_AEAD_AES_128_GCM, secrets.client)
-    this.initial.writeKeys = quicKeys(QUIC_AEAD_AES_128_GCM, secrets.server)
+    this.initial.readKeys = quicKeysInto(
+      this.kdf,
+      this.initial.keySlot(QUIC_CONN_READ_SLOT),
+      QUIC_AEAD_AES_128_GCM,
+      this.initialClient
+    )
+    this.initial.writeKeys = quicKeysInto(
+      this.kdf,
+      this.initial.keySlot(QUIC_CONN_WRITE_SLOT),
+      QUIC_AEAD_AES_128_GCM,
+      this.initialServer
+    )
     quicCidCopy(this.originalDcid, buf, header.dcidStart, header.dcidLength)
     this.originalDcidLength = header.dcidLength
     quicCidCopy(this.peerScid, buf, header.scidStart, header.scidLength)
@@ -1369,14 +1720,24 @@ export class QuicConnection {
 
   /**
    * The rest of `start`, once the first Initial has opened: the first local
-   * connection ID, and a `TlsServer` whose transport parameters name both
-   * IDs (RFC 9000 §7.3), the Retry's when `acceptRetry` set one up, and the
-   * first ID's stateless reset token (§18.2).
+   * connection ID, and the slot's `TlsServer` started with transport
+   * parameters that name both IDs (RFC 9000 §7.3), the Retry's when
+   * `acceptRetry` set one up, and the first ID's stateless reset token
+   * (§18.2).
    */
   establish(): void {
     const none: u8[] = this.none
-    const resetToken: u8[] = quicStatelessResetToken(this.config.statelessResetKey, this.localScid)
-    this.cids.addLocal(this.localScid, resetToken)
+    const token: u8[] = this.tokenScratch
+    quicConnResetTokenInto(
+      this.kdf.sha256,
+      this.config.statelessResetKey,
+      this.localScid,
+      QUIC_CONN_FROM,
+      QUIC_CONN_CID_LENGTH,
+      token,
+      QUIC_CONN_FROM
+    )
+    this.cids.addLocal(this.localScid, token)
     this.cids.addPeerAt(
       QUIC_CONN_NONE,
       QUIC_CONN_NONE,
@@ -1390,17 +1751,27 @@ export class QuicConnection {
     // §8.1.2: a Retry token the listener checked has validated the address.
     this.addressValidated = this.retried
 
-    const params: QuicTransportParameters = new QuicTransportParameters()
-    params.originalDcid = this.retried
-      ? this.retryOriginalDcid
-      : quicConnSlice(this.originalDcid, 0, this.originalDcidLength)
+    // The parameters, and their encoding, are rewritten in the slot's own
+    // arrays, which grow only when a connection needs more than any before.
+    const params: QuicTransportParameters = this.localParameters
+    if (this.retried) {
+      quicConnRefill(
+        params.originalDcid,
+        this.retryOriginalDcid,
+        QUIC_CONN_FROM,
+        toI32(this.retryOriginalDcid.length)
+      )
+    } else {
+      quicConnRefill(params.originalDcid, this.originalDcid, QUIC_CONN_FROM, this.originalDcidLength)
+    }
     params.hasOriginalDcid = true
     params.initialScid = this.localScid
     params.hasInitialScid = true
-    params.retryScid = this.retryScid
+    quicConnRefill(params.retryScid, this.retryScid, QUIC_CONN_FROM, toI32(this.retryScid.length))
     params.hasRetryScid = this.retried
-    params.statelessResetToken = resetToken
+    quicConnRefill(params.statelessResetToken, token, QUIC_CONN_FROM, QUIC_RESET_TOKEN_SIZE)
     params.hasStatelessResetToken = true
+    secureZero(token)
     params.maxIdleTimeout = this.config.maxIdleTimeout
     params.initialMaxData = this.config.maxData
     params.initialMaxStreamDataBidiRemote = this.config.maxStreamData
@@ -1415,16 +1786,27 @@ export class QuicConnection {
     // The server never migrates and asks the client not to (§9): path
     // validation beyond answering PATH_CHALLENGE is not here.
     params.disableActiveMigration = true
-    const extra: u8[] = []
-    const tlsConfig: TlsServerConfig = {
-      certificateChain: this.config.certificateChain,
-      alpn: this.config.alpn,
-      quicTransportParameters: quicEncodeTransportParameters(params),
-      extraExtensions: extra,
-      signatureScheme: this.config.signatureScheme,
-      quic: true,
+    quicEncodeTransportParametersInto(params, this.localEncoded)
+    // One `TlsServer` a slot, made by its first handshake (so its flight is
+    // sized for these parameters) and restarted, wiped, by each after it.
+    // The ephemeral key goes from the connection's `Secret` to the
+    // server's: a restart takes a plain copy, which it zeroes, made in an
+    // arena block; a new server takes a zero key that ours is copied over.
+    // Either way ours is zeroed once it is handed on.
+    const tls: TlsServer | null = this.tlsSlot
+    if (tls !== null) {
+      {
+        using _scope = arena()
+        tls.restart(this.serverRandom, expose(this.ephemeral, tlsHeldClone))
+      }
+      this.tls = tls
+    } else {
+      const made: TlsServer = new TlsServer(this.tlsConfig, this.serverRandom, new Array<u8>(32))
+      exposeWith(this.ephemeral, made.ephemeral, tlsHeldCopyOver)
+      this.tlsSlot = made
+      this.tls = made
     }
-    this.tls = new TlsServer(tlsConfig, this.serverRandom, this.ephemeralPrivate)
+    exposeWith(this.ephemeral, QUIC_CONN_FROM, quicConnZeroHeld)
   }
 
   /**
@@ -1460,10 +1842,10 @@ export class QuicConnection {
   /**
    * Opens one packet of a connection already started, and acts on its frames.
    * The opening and the frames run inside an arena block (`openScoped`), so
-   * their temporaries go when it ends; what has to keep memory — a first
-   * Initial's `TlsServer`, a key update's new keys, TLS reading the CRYPTO
-   * bytes and what it answers — runs after it. Answers whether the packet
-   * was used.
+   * their temporaries go when it ends; what may grow a buffer of the slot —
+   * a first Initial's `TlsServer` and parameters, a key update, TLS reading
+   * the CRYPTO bytes and what it answers — runs after it. Answers whether
+   * the packet was used.
    */
   openPacket(buf: u8[], header: QuicHeader, first: boolean): boolean {
     const type: i32 = header.type
@@ -1481,10 +1863,22 @@ export class QuicConnection {
     this.cryptoArrived = false
     this.topUpOwed = false
     this.phasePending = -1
+    this.resendLevel = -1
     let used: boolean = false
+    // A STREAM frame's first byte borrows a receive buffer, and no pool may
+    // take one inside the scope, so the reserve is primed before it with what
+    // this packet could want. Only 0-RTT and 1-RTT packets carry STREAM
+    // frames (RFC 9000 §12.4); any other still makes a standalone
+    // connection's private pools, so the handshake, not the first 1-RTT
+    // packet, pays for them.
+    if (type === QUIC_PACKET_SHORT || type === QUIC_PACKET_ZERO_RTT) {
+      this.streams.prime(header.end - header.pnOffset)
+    } else {
+      this.streams.ownPools()
+    }
     {
       using _scope = arena()
-      used = this.openScoped(buf, header, space, keys)
+      used = this.openScoped(buf, header, space, keys, first)
     }
     if (!used) {
       return false
@@ -1511,6 +1905,9 @@ export class QuicConnection {
     if (this.topUpOwed) {
       this.topUpConnectionIds()
     }
+    if (this.resendLevel >= 0 && !this.closed()) {
+      this.resendEarly(this.resendLevel)
+    }
     return true
   }
 
@@ -1521,7 +1918,7 @@ export class QuicConnection {
    * an allocation, which is what lets the block release the packet's
    * temporaries. Answers whether the packet was used rather than dropped.
    */
-  openScoped(buf: u8[], header: QuicHeader, space: QuicConnSpace, keys: QuicKeys): boolean {
+  openScoped(buf: u8[], header: QuicHeader, space: QuicConnSpace, keys: QuicKeys, first: boolean): boolean {
     const packet: QuicPacket = this.packet
     // Every key generation shares the header-protection key (RFC 9001 §6),
     // so the current keys take it off whatever the Key Phase bit says.
@@ -1536,6 +1933,15 @@ export class QuicConnection {
     const payload: u8[] | null = quicDecryptPayload(open, buf, header, clear, packet)
     if (payload === null) {
       this.drop()
+      // RFC 9001 §6.6: past the integrity limit, the connection closes and
+      // reads nothing more. A first Initial that fails is not counted: the
+      // connection is not started, and the next one starts afresh.
+      if (!first) {
+        this.authFailures = this.authFailures + 1
+        if (this.authFailures > this.integrityLimit) {
+          this.fail(QUIC_ERROR_AEAD_LIMIT_REACHED, QUIC_CONN_NONE)
+        }
+      }
       return false
     }
     // §17.2, §17.3.1: reserved bits set under a valid tag close the connection.
@@ -1555,6 +1961,11 @@ export class QuicConnection {
     if (this.closed()) {
       return true
     }
+    // RFC 9002 §6.2.3: a client that sends an ack-eliciting Handshake packet
+    // while the server's Handshake data is in flight may not have it all.
+    if (eliciting && type === QUIC_PACKET_HANDSHAKE) {
+      this.resendLevel = TLS_LEVEL_HANDSHAKE
+    }
     space.received.record(pn, eliciting)
     // §10.1: a packet received and processed restarts the idle timer.
     this.idleSince = this.now
@@ -1619,9 +2030,14 @@ export class QuicConnection {
     this.application.readKeys = this.otherReadKeys
     this.otherReadKeys = previous
     this.otherIsNext = false
-    secureZero(this.appReadSecret)
-    this.appReadSecret = this.nextReadSecret
-    this.nextReadSecret = this.none
+    this.appReadSlot = 1 - this.appReadSlot
+    // The next read secret becomes the current one, over the secret it
+    // replaces, and is zeroed where it was. Both widths move: the one the
+    // suite does not use holds zeros.
+    exposeWith(this.nextReadSecret256, this.readSecret256, tlsHeldCopyOver)
+    exposeWith(this.nextReadSecret384, this.readSecret384, tlsHeldCopyOver)
+    exposeWith(this.nextReadSecret256, QUIC_CONN_FROM, quicConnZeroHeld)
+    exposeWith(this.nextReadSecret384, QUIC_CONN_FROM, quicConnZeroHeld)
     this.readPhase = !this.readPhase
     this.readPhaseLowest = pn
     this.readPhaseHighest = pn
@@ -1639,24 +2055,68 @@ export class QuicConnection {
     if (keys === null) {
       return false
     }
-    const secret: u8[] | null = quicKeyUpdateSecret(keys.aead, this.appWriteSecret)
-    if (secret === null) {
-      return false
-    }
-    const next: QuicKeys | null = quicKeysUpdate(keys, secret)
+    const slot: QuicKeysSlot = this.application.keySlot(QUIC_CONN_APP_WRITE_SLOTS + 1 - this.appWriteSlot)
+    const next: QuicKeys | null =
+      keys.aead === QUIC_AEAD_AES_256_GCM
+        ? this.nextKeys(slot, keys, this.writeSecret384, this.writeSecret384)
+        : this.nextKeys(slot, keys, this.writeSecret256, this.writeSecret256)
     if (next === null) {
-      secureZero(secret)
       return false
     }
     quicConnWipePacketKey(keys)
-    secureZero(this.appWriteSecret)
     this.application.writeKeys = next
-    this.appWriteSecret = secret
+    this.appWriteSlot = 1 - this.appWriteSlot
     this.writePhase = !this.writePhase
     this.writePhaseFirst = this.application.nextPn
+    this.sealedUnderKey = 0
     return true
   }
 
+  /**
+   * A level's keys from a held traffic secret, derived into `slot` through
+   * the connection's own HKDF scratch, as `quicKeys` derives them: the
+   * derivation reads a plain copy made in an arena block, which is zeroed
+   * before it ends, so the call keeps nothing in the arena. Answers the
+   * slot's keys, or `null` for a secret of the wrong length.
+   */
+  keysFrom(slot: QuicKeysSlot, aead: i32, held: Secret<u8[]>): QuicKeys | null {
+    let made: boolean = false
+    {
+      using _scope = arena()
+      const plain: u8[] = expose(held, tlsHeldClone)
+      made = quicKeysInto(this.kdf, slot, aead, plain) !== null
+      secureZero(plain)
+    }
+    return made ? slot.keys : null
+  }
+
+  /**
+   * The next generation of `keys` into `slot` (RFC 9001 §6.1): the next
+   * traffic secret, `quic ku` of `current`, and its packet key and IV, with
+   * the header-protection key and its schedule shared, as every generation
+   * shares them. The secret is written into `next`, which may be `current`
+   * and then ratchets it. The derivation reads plain copies made in an arena
+   * block, which are zeroed before it ends. Answers the slot's keys, or
+   * `null`, leaving `next` as it was, for keys `quicKeys` did not make.
+   */
+  nextKeys(slot: QuicKeysSlot, keys: QuicKeys, current: Secret<u8[]>, next: Secret<u8[]>): QuicKeys | null {
+    let made: boolean = false
+    {
+      using _scope = arena()
+      const plain: u8[] = expose(current, tlsHeldClone)
+      const out: u8[] = new Array<u8>(plain.length)
+      made =
+        quicKeyUpdateSecretInto(this.kdf, keys.aead, plain, out) &&
+        quicKeysUpdateInto(this.kdf, slot, keys, out) !== null
+      if (made) {
+        exposeWith(next, out, tlsHeldCopyIn)
+      }
+      secureZero(plain)
+      secureZero(out)
+    }
+    return made ? slot.keys : null
+  }
+
   /**
    * Derives the next generation's read secret and keys from the current
    * ones, into `otherReadKeys`, wiping the previous generation's key and IV
@@ -1673,12 +2133,11 @@ export class QuicConnection {
     if (keys === null) {
       return
     }
-    const secret: u8[] | null = quicKeyUpdateSecret(keys.aead, this.appReadSecret)
-    if (secret === null) {
-      return
-    }
-    this.nextReadSecret = secret
-    this.otherReadKeys = quicKeysUpdate(keys, secret)
+    const slot: QuicKeysSlot = this.application.keySlot(1 - this.appReadSlot)
+    this.otherReadKeys =
+      keys.aead === QUIC_AEAD_AES_256_GCM
+        ? this.nextKeys(slot, keys, this.readSecret384, this.nextReadSecret384)
+        : this.nextKeys(slot, keys, this.readSecret256, this.nextReadSecret256)
     this.otherIsNext = this.otherReadKeys !== null
   }
 
@@ -1873,6 +2332,7 @@ export class QuicConnection {
     this.error = code
     this.errorIsApplication = application
     this.closeSent = true
+    this.startClosingPeriod()
   }
 
   /**
@@ -1882,7 +2342,7 @@ export class QuicConnection {
    * carried, and each it shows lost has its frames queued again.
    */
   receiveAck(space: QuicConnSpace, frame: QuicFrame): void {
-    if (frame.largest >= space.nextPn) {
+    if (frame.largest >= space.nextPn || (space.level === TLS_LEVEL_APPLICATION && this.acksSkipped(frame))) {
       this.fail(QUIC_ERROR_PROTOCOL_VIOLATION, toI64(frame.type))
       return
     }
@@ -1891,9 +2351,24 @@ export class QuicConnection {
     }
     const sent: QuicSentPackets | null = this.recovery.space(space.level)
     const delay: i64 = this.ackDelayOf(frame.ackDelay)
+    // ACK_ECN's counts (RFC 9002 §7.1), or -1 each for a plain ACK.
+    const ecn: boolean = frame.type === QUIC_FRAME_ACK_ECN
+    const none: i64 = -1
+    const ect0: i64 = ecn ? frame.ect0 : none
+    const ect1: i64 = ecn ? frame.ect1 : none
+    const ce: i64 = ecn ? frame.ce : none
     if (
       sent === null ||
-      this.recovery.onAck(space.level, frame.ackRanges, frame.ackRangeCount, delay, this.now) <= 0
+      this.recovery.onAckEcn(
+        space.level,
+        frame.ackRanges,
+        frame.ackRangeCount,
+        delay,
+        this.now,
+        ect0,
+        ect1,
+        ce
+      ) <= 0
     ) {
       return
     }
@@ -1903,6 +2378,26 @@ export class QuicConnection {
     this.packetsLost(space, sent)
   }
 
+  /**
+   * Whether `frame` acknowledges a packet number the server skipped and
+   * still remembers (RFC 9000 §21.4): a client that does is acknowledging
+   * what it never received. Every range the frame stored is read; one past
+   * `QUIC_FRAME_MAX_ACK_RANGES` is not, and loss recovery does not act on
+   * it either.
+   */
+  acksSkipped(frame: QuicFrame): boolean {
+    const ranges: i64[] = frame.ackRanges
+    for (let k: i32 = 0; k < toI32(this.skipped.length); k += 1) {
+      const pn: i64 = this.skipped[k]
+      for (let r: i32 = 0; pn >= 0 && r < frame.ackRangeCount && r * 2 + 1 < toI32(ranges.length); r += 1) {
+        if (pn >= ranges[r * 2] && pn <= ranges[r * 2 + 1]) {
+          return true
+        }
+      }
+    }
+    return false
+  }
+
   /**
    * An ACK frame's ACK Delay in milliseconds: the field scaled by the
    * client's `ack_delay_exponent` (RFC 9000 §19.3, §18.2). A value too large
@@ -1984,10 +2479,12 @@ export class QuicConnection {
 
   /**
    * A probe timeout fired (RFC 9002 §6.2.4): in every space with packets in
-   * flight, everything they carry is queued again and the next packet is a
-   * probe, sent whatever the window says, with a PING if nothing is left to
+   * flight, everything they carry is queued again and the next packets are
+   * probes, sent whatever the window says, with a PING if nothing is left to
    * carry. During the handshake that resends the Initial and the Handshake
-   * flight together, which is what a client that lost both needs.
+   * flight together, which is what a client that lost both needs, and does
+   * it twice (`QUIC_CONN_HANDSHAKE_PROBES`), so that one more lost datagram
+   * does not cost another, doubled, probe timeout.
    */
   probe(): void {
     for (let level: i32 = 0; level < 3; level += 1) {
@@ -2002,7 +2499,56 @@ export class QuicConnection {
           this.requeue(space, slot)
         }
       }
-      space.probe = true
+      space.probes = QUIC_CONN_HANDSHAKE_PROBES
+      if (level === TLS_LEVEL_APPLICATION) {
+        space.probes = 1
+      }
+    }
+  }
+
+  /**
+   * Speeds up the handshake (RFC 9002 §6.2.3): the client showed at `level`
+   * that it lacks the server's handshake data there — an Initial with CRYPTO
+   * data the server already read, or an ack-eliciting Handshake packet —
+   * so, while the server's own packets at that level are in flight, the
+   * oldest one's CRYPTO data at that level and at Handshake goes again now,
+   * as one probe datagram, rather than at the probe timeout. It does so at
+   * most `QUIC_CONN_EARLY_RESENDS` times a connection, and not while an
+   * earlier probe is still owed, so each packet the client sends asks for
+   * one datagram at most. The anti-amplification limit holds it like any
+   * datagram (`takeDatagramInto`).
+   */
+  resendEarly(level: i32): void {
+    if (
+      this.earlyResends >= QUIC_CONN_EARLY_RESENDS ||
+      this.initial.probes > 0 ||
+      this.handshake.probes > 0
+    ) {
+      return
+    }
+    const asked: QuicSentPackets | null = this.recovery.space(level)
+    if (asked === null || asked.inFlight === 0) {
+      return
+    }
+    let queued: boolean = false
+    for (let at: i32 = level; at <= TLS_LEVEL_HANDSHAKE; at += 1) {
+      const space: QuicConnSpace = this.spaceAt(at)
+      const sent: QuicSentPackets | null = this.recovery.space(at)
+      if (sent === null || space.discarded || sent.inFlight === 0) {
+        continue
+      }
+      // Compacted, the ring's oldest slot is the oldest packet in flight.
+      sent.compact()
+      const oldest: i32 = sent.slot(QUIC_CONN_FROM)
+      const length: i32 = space.cryptoLength(oldest)
+      if (length > 0) {
+        space.resendCrypto(space.cryptoOffset(oldest), length)
+        space.probes = 1
+        queued = true
+      }
+    }
+    if (queued) {
+      this.earlyResends += 1
     }
   }
 
@@ -2026,6 +2572,11 @@ export class QuicConnection {
       this.spaceAt(reassembly.level).cryptoInDelivered = reassembly.delivered
       reassembly.reset(space.level)
     }
+    // RFC 9002 §6.2.3: an Initial with CRYPTO data the server already read
+    // says the client did not get the server's Initial flight.
+    if (space.level === TLS_LEVEL_INITIAL && frame.offset < reassembly.delivered) {
+      this.resendLevel = TLS_LEVEL_INITIAL
+    }
     if (!reassembly.insert(frame.offset, payload, frame.dataStart, frame.dataLength)) {
       this.fail(QUIC_ERROR_CRYPTO_BUFFER_EXCEEDED, toI64(QUIC_FRAME_CRYPTO))
       return
@@ -2116,10 +2667,12 @@ export class QuicConnection {
       return
     }
     if (!this.initial.discarded) {
-      this.initial.appendCrypto(tls.takeOutput(TLS_LEVEL_INITIAL))
+      this.initial.appendCrypto(tls.outputInitial, tls.outputInitialLength)
+      tls.clearOutput(TLS_LEVEL_INITIAL)
     }
     if (!this.handshake.discarded) {
-      this.handshake.appendCrypto(tls.takeOutput(TLS_LEVEL_HANDSHAKE))
+      this.handshake.appendCrypto(tls.outputHandshake, tls.outputHandshakeLength)
+      tls.clearOutput(TLS_LEVEL_HANDSHAKE)
     }
     const aead: i32 = quicConnAead(tls.suite)
     if (
@@ -2132,23 +2685,59 @@ export class QuicConnection {
       }
       this.alpn = tls.alpn
       this.serverName = tls.serverName
-      this.handshake.readKeys = this.keysFor(aead, tls.readSecret(TLS_LEVEL_HANDSHAKE))
-      this.handshake.writeKeys = this.keysFor(aead, tls.writeSecret(TLS_LEVEL_HANDSHAKE))
+      if (tls.readKnown(TLS_LEVEL_HANDSHAKE)) {
+        this.handshake.readKeys = this.keysFrom(
+          this.handshake.keySlot(QUIC_CONN_READ_SLOT),
+          aead,
+          tls.secrets().clientHandshake
+        )
+      }
+      if (tls.writeKnown(TLS_LEVEL_HANDSHAKE)) {
+        this.handshake.writeKeys = this.keysFrom(
+          this.handshake.keySlot(QUIC_CONN_WRITE_SLOT),
+          aead,
+          tls.secrets().serverHandshake
+        )
+      }
     }
     if (
+      !this.applicationTaken &&
       !this.application.discarded &&
       this.application.writeKeys === null &&
       tls.state !== TLS_STATE_WAIT_SIGNATURE
     ) {
-      const write: u8[] | null = tls.writeSecret(TLS_LEVEL_APPLICATION)
-      const read: u8[] | null = tls.readSecret(TLS_LEVEL_APPLICATION)
-      if (write !== null && read !== null) {
-        this.application.writeKeys = this.keysFor(aead, write)
-        this.application.readKeys = this.keysFor(aead, read)
-        // The key update secrets start from `TlsServer`'s own arrays, so the
-        // first update wipes those too, rather than leaving a copy behind.
-        this.appWriteSecret = write
-        this.appReadSecret = read
+      if (tls.writeKnown(TLS_LEVEL_APPLICATION) && tls.readKnown(TLS_LEVEL_APPLICATION)) {
+        // The key updates derive from the connection's own `Secret`
+        // fields, so the application secrets are copied into those of the
+        // suite's width and wiped in `TlsServer`, leaving one copy of each.
+        const pool: TlsSecretPool = tls.secrets()
+        const writeSlot: QuicKeysSlot = this.application.keySlot(
+          QUIC_CONN_APP_WRITE_SLOTS + this.appWriteSlot
+        )
+        const readSlot: QuicKeysSlot = this.application.keySlot(this.appReadSlot)
+        if (aead === QUIC_AEAD_AES_256_GCM) {
+          exposeWith(pool.serverApplication, this.writeSecret384, tlsHeldCopyOver)
+          exposeWith(pool.clientApplication, this.readSecret384, tlsHeldCopyOver)
+        } else {
+          exposeWith(pool.serverApplication, this.writeSecret256, tlsHeldCopyOver)
+          exposeWith(pool.clientApplication, this.readSecret256, tlsHeldCopyOver)
+        }
+        this.applicationTaken = true
+        // ChaCha20-Poly1305 has no confidentiality limit, and no packet
+        // number, so no count of packets, reaches `QUIC_MAX_VARINT`.
+        const chacha: boolean = aead === QUIC_AEAD_CHACHA20_POLY1305
+        this.integrityLimit = chacha ? QUIC_CONN_INTEGRITY_LIMIT_CHACHA : QUIC_CONN_INTEGRITY_LIMIT_GCM
+        this.confidentialityLimit = chacha ? QUIC_MAX_VARINT : QUIC_CONN_CONFIDENTIALITY_LIMIT
+        this.scheduleSkip(this.application.nextPn)
+        tls.wipeSecret(TLS_SECRET_SERVER_APPLICATION)
+        tls.wipeSecret(TLS_SECRET_CLIENT_APPLICATION)
+        if (aead === QUIC_AEAD_AES_256_GCM) {
+          this.application.writeKeys = this.keysFrom(writeSlot, aead, this.writeSecret384)
+          this.application.readKeys = this.keysFrom(readSlot, aead, this.readSecret384)
+        } else {
+          this.application.writeKeys = this.keysFrom(writeSlot, aead, this.writeSecret256)
+          this.application.readKeys = this.keysFrom(readSlot, aead, this.readSecret256)
+        }
         this.prepareNextReadKeys()
       }
     }
@@ -2158,18 +2747,14 @@ export class QuicConnection {
       this.handshakeDonePending = true
       this.state = QUIC_STATE_CONNECTED
       this.discard(this.handshake)
+      // The Handshake level's traffic secrets have nothing left to derive
+      // once it is discarded (TLS wipes the handshake secret itself).
+      tls.wipeSecret(TLS_SECRET_CLIENT_HANDSHAKE)
+      tls.wipeSecret(TLS_SECRET_SERVER_HANDSHAKE)
       this.topUpConnectionIds()
     }
   }
 
-  /** `quicKeys` of a secret TLS has, or `null` when it has none yet. */
-  keysFor(aead: i32, secret: u8[] | null): QuicKeys | null {
-    if (secret === null) {
-      return null
-    }
-    return quicKeys(aead, secret)
-  }
-
   /**
    * The client's transport parameters (RFC 9000 §7.3, §7.4, §18.2): they must
    * parse, and must name as `initial_source_connection_id` the SCID its first
@@ -2179,7 +2764,11 @@ export class QuicConnection {
    * the datagrams its `max_datagram_frame_size`.
    */
   checkPeerParameters(tls: TlsServer): boolean {
-    const p: QuicTransportParameters = quicParseTransportParameters(tls.clientTransportParameters, false)
+    const p: QuicTransportParameters = quicParseTransportParametersInto(
+      this.parsedParameters,
+      tls.clientTransportParameters,
+      false
+    )
     if (p.error !== QUIC_ERROR_NO_ERROR || !p.hasInitialScid) {
       this.fail(QUIC_ERROR_TRANSPORT_PARAMETER, toI64(QUIC_FRAME_CRYPTO))
       return false
@@ -2215,9 +2804,10 @@ export class QuicConnection {
     this.recovery.discardSpace(space.level)
     space.cryptoResendLow = -1
     space.cryptoResendHigh = -1
-    space.probe = false
+    space.probes = 0
     quicConnWipeKeys(space.readKeys)
     quicConnWipeKeys(space.writeKeys)
+    space.wipeKeySlots()
     space.readKeys = null
     space.writeKeys = null
     space.cryptoOutLength = 0
@@ -2227,15 +2817,30 @@ export class QuicConnection {
   /**
    * The HMAC-SHA256 under the connection's seed of the sequence number
    * `sequence`, whose first 8 bytes are the local connection ID of that
-   * number: so the IDs are unlinkable to anyone without the seed and need no
-   * more entropy.
+   * number, into `cidScratch`: so the IDs are unlinkable to anyone without
+   * the seed and need no more entropy. It runs in the connection's HMAC
+   * scratch inside an arena block, and wipes the MAC and the scratch.
    */
-  deriveConnectionId(sequence: i64): u8[] {
+  deriveConnectionId(sequence: i64): void {
+    const mac: HmacSha256Scratch = this.kdf.sha256
+    using _scope = arena()
     const counter: u8[] = new Array<u8>(8)
     for (let k: i32 = 0; k < 8 && k < toI32(counter.length); k += 1) {
       counter[k] = toU8(toI32((sequence >> (toI64(7 - k) * 8)) & 255))
     }
-    return hmacSha256(this.cidSeed, counter)
+    const tag: u8[] = new Array<u8>(32)
+    mac.begin(this.cidSeed, QUIC_CONN_FROM, toI32(this.cidSeed.length))
+    mac.update(counter, QUIC_CONN_FROM, toI32(counter.length))
+    mac.finishInto(tag, QUIC_CONN_FROM)
+    for (
+      let k: i32 = 0;
+      k < QUIC_CONN_CID_LENGTH && k < toI32(tag.length) && k < toI32(this.cidScratch.length);
+      k += 1
+    ) {
+      this.cidScratch[k] = tag[k]
+    }
+    secureZero(tag)
+    mac.wipe()
   }
 
   /**
@@ -2243,27 +2848,34 @@ export class QuicConnection {
    * would take (its `active_connection_id_limit`), up to
    * `QUIC_CONN_LOCAL_CIDS` at once and `QUIC_CONN_MAX_ISSUED_CIDS` in all;
    * each goes out in a NEW_CONNECTION_ID frame with the stateless reset
-   * token the configuration's static key gives it. One ID at a time, each
-   * call issuing one and then topping up the rest, since each leaves its
-   * HMAC's temporaries in the arena (QUIC-3) and a loop would hold them
-   * across its passes for no reason.
+   * token the configuration's static key gives it. Each ID and token is made
+   * in the slot's scratch and copied into the table, so issuing keeps
+   * nothing (QUIC-3).
    */
   topUpConnectionIds(): void {
-    if (!this.handshakeComplete || this.cids.nextLocal >= QUIC_CONN_MAX_ISSUED_CIDS) {
+    if (!this.handshakeComplete) {
       return
     }
     let want: i64 = this.peerParameters.activeConnectionIdLimit
     if (want > toI64(QUIC_CONN_LOCAL_CIDS)) {
       want = toI64(QUIC_CONN_LOCAL_CIDS)
     }
-    if (toI64(this.cids.activeLocal()) >= want) {
-      return
-    }
-    const mac: u8[] = this.deriveConnectionId(this.cids.nextLocal)
-    const cid: u8[] = quicConnSlice(mac, 0, QUIC_CONN_CID_LENGTH)
-    secureZero(mac)
-    if (this.cids.addLocal(cid, quicStatelessResetToken(this.config.statelessResetKey, cid)) >= 0) {
-      this.topUpConnectionIds()
+    while (this.cids.nextLocal < QUIC_CONN_MAX_ISSUED_CIDS && toI64(this.cids.activeLocal()) < want) {
+      this.deriveConnectionId(this.cids.nextLocal)
+      quicConnResetTokenInto(
+        this.kdf.sha256,
+        this.config.statelessResetKey,
+        this.cidScratch,
+        QUIC_CONN_FROM,
+        QUIC_CONN_CID_LENGTH,
+        this.tokenScratch,
+        QUIC_CONN_FROM
+      )
+      const added: i64 = this.cids.addLocal(this.cidScratch, this.tokenScratch)
+      secureZero(this.tokenScratch)
+      if (added < 0) {
+        return
+      }
     }
   }
 
@@ -2330,12 +2942,17 @@ export class QuicConnection {
    * When `handleTimer` is next due, in the caller's milliseconds: the idle
    * timeout, loss recovery's timer (a time-threshold loss or the probe
    * timeout), or the end of a key update's probe timeout, whichever comes
-   * first. -1 when nothing is timed: before the first packet, once the
-   * connection has closed, and with no idle timeout, nothing in flight and
-   * no update pending.
+   * first; once the connection has closed, the end of its closing or
+   * draining period, when its keys are wiped. -1 when nothing is timed:
+   * before the first packet, while a closed connection's own close has not
+   * gone out (`takeDatagram` sends it), once a closed connection's keys are
+   * wiped, and with no idle timeout, nothing in flight and no update pending.
    */
   deadline(): i64 {
-    if (this.closed() || this.state === QUIC_STATE_WAIT_INITIAL) {
+    if (this.closed()) {
+      return this.closingUntil
+    }
+    if (this.state === QUIC_STATE_WAIT_INITIAL) {
       return -1
     }
     let due: i64 = this.idleDeadline()
@@ -2362,9 +2979,10 @@ export class QuicConnection {
    * Runs whatever is due by `now`, the caller's monotonic time in
    * milliseconds; call it at `deadline()`, or any time. Past the idle timeout
    * the connection closes silently (`QUIC_STATE_TIMED_OUT`, RFC 9000 §10.1):
-   * no CONNECTION_CLOSE, every key wiped. Past a key update's probe timeout
-   * the previous read keys are wiped and the next generation's derived (RFC
-   * 9001 §6.5). Past loss recovery's timer, packets lost by the time
+   * no CONNECTION_CLOSE, every key wiped. Past the closing or draining
+   * period of a connection that closed, every key is wiped (§10.2). Past a
+   * key update's probe timeout the previous read keys are wiped and the next
+   * generation's derived (RFC 9001 §6.5). Past loss recovery's timer, packets lost by the time
    * threshold have their frames queued again, or a probe timeout queues
    * every space's packets in flight and asks for a probe (RFC 9002 §6.1.2,
    * §6.2.4): `takeDatagram` then sends it. `receive` and `takeDatagram` run
@@ -2376,12 +2994,24 @@ export class QuicConnection {
     this.runRecoveryTimer()
   }
 
-  /** `handleTimer`'s idle timeout and key retention, which `receive` runs before it reads a datagram. */
+  /**
+   * `handleTimer`'s idle timeout, key retention and the end of the closing
+   * or draining period, which `receive` runs before it reads a datagram.
+   */
   runClocks(now: i64): void {
     if (now > this.now) {
       this.now = now
     }
-    if (this.closed() || this.state === QUIC_STATE_WAIT_INITIAL) {
+    if (this.closed()) {
+      // RFC 9000 §10.2: past the period, nothing more goes out, so the keys
+      // kept for the CONNECTION_CLOSE are wiped (QUIC-2).
+      if (this.closingUntil >= 0 && this.now >= this.closingUntil) {
+        this.closeSent = true
+        this.wipeAll()
+      }
+      return
+    }
+    if (this.state === QUIC_STATE_WAIT_INITIAL) {
       return
     }
     const idle: i64 = this.idleDeadline()
@@ -2436,6 +3066,24 @@ export class QuicConnection {
     return this.updateWriteKeys()
   }
 
+  /**
+   * Draws where the next Application Data packet number is skipped (RFC
+   * 9000 §21.4): `QUIC_CONN_SKIP_MIN` plus up to `QUIC_CONN_SKIP_SPREAD - 1`
+   * packets past `from`, the distance taken from the ID seed's HMAC under
+   * `QUIC_CONN_SKIP_SEQUENCE`, so a client that saw where the last gaps fell
+   * cannot tell where the next will.
+   */
+  scheduleSkip(from: i64): void {
+    this.deriveConnectionId(QUIC_CONN_SKIP_SEQUENCE + this.skipsDrawn)
+    this.skipsDrawn = this.skipsDrawn + 1
+    let draw: i64 = 0
+    for (let k: i32 = 0; k < 4 && k < toI32(this.cidScratch.length); k += 1) {
+      draw = (draw << 8) | toI64(this.cidScratch[k])
+    }
+    secureZero(this.cidScratch)
+    this.nextSkip = from + QUIC_CONN_SKIP_MIN + (draw % QUIC_CONN_SKIP_SPREAD)
+  }
+
   // ---- Streams ------------------------------------------------------------------
 
   /**
@@ -2681,6 +3329,7 @@ export class QuicConnection {
       return 0
     }
     let n: i32 = 0
+    this.datagramEcn = 0
     if (this.state === QUIC_STATE_CLOSING) {
       using _scope = arena()
       n = this.takeCloseInto(out, at)
@@ -2694,6 +3343,8 @@ export class QuicConnection {
     if (this.amplificationBlocked()) {
       return 0
     }
+    this.beforeDatagram()
+    this.datagramEcn = this.ecnMarking ? this.recovery.ecnCodepoint() : 0
     {
       using _scope = arena()
       n = this.buildDatagram(out, at)
@@ -2701,6 +3352,32 @@ export class QuicConnection {
     return n
   }
 
+  /**
+   * What the next datagram's Application Data packet needs before it is
+   * built, outside the arena block because a key update stores the keys it
+   * derives. A datagram carries at most one such packet, so this runs once
+   * a packet. From three quarters of the confidentiality limit, each tries a
+   * key update, which goes when `updateKeys` allows (RFC 9001 §6.6). And
+   * the packet number due to be skipped is (RFC 9000 §21.4): remembered,
+   * never sealed nor recorded, and the next skip drawn.
+   */
+  beforeDatagram(): void {
+    const limit: i64 = this.confidentialityLimit
+    if (this.sealedUnderKey >= limit - limit / 4) {
+      this.updateKeys()
+    }
+    const pn: i64 = this.application.nextPn
+    if (pn !== this.nextSkip) {
+      return
+    }
+    if (this.skipHead >= 0 && this.skipHead < toI32(this.skipped.length)) {
+      this.skipped[this.skipHead] = pn
+    }
+    this.skipHead = (this.skipHead + 1) % QUIC_CONN_SKIP_RING
+    this.application.nextPn = pn + 1
+    this.scheduleSkip(pn + 1)
+  }
+
   /**
    * `takeDatagramInto`'s datagram, built and sealed into `out` at `at`: one
    * packet per space with something to carry, each written in place, the
@@ -2722,7 +3399,7 @@ export class QuicConnection {
       if (sent === null || overhead === 0 || remaining <= overhead + 8) {
         continue
       }
-      if (space.probe && sent.full()) {
+      if (space.probes > 0 && sent.full()) {
         // A probe has to be recorded: the oldest packet gives up its slot,
         // and what it carried, already queued again by the probe, stays queued.
         const slot: i32 = this.recovery.evictOldest(level)
@@ -2730,7 +3407,7 @@ export class QuicConnection {
           this.requeue(space, slot)
         }
       }
-      const elicit: boolean = space.probe || (open && !sent.full())
+      const elicit: boolean = space.probes > 0 || (open && !sent.full())
       const headerLength: i32 = overhead - QUIC_AEAD_TAG_SIZE
       const payloadStart: i32 = position + headerLength
       let payloadEnd: i32 = this.buildPayloadInto(
@@ -2842,7 +3519,7 @@ export class QuicConnection {
     if (space.level === TLS_LEVEL_APPLICATION) {
       at = this.buildApplication(space, out, at, end)
     }
-    if (space.probe && !space.stagedEliciting && at < end) {
+    if (space.probes > 0 && !space.stagedEliciting && at < end) {
       at = quicPutTypeOnly(out, at, end, QUIC_FRAME_PING)
       space.stagedEliciting = true
     }
@@ -3001,6 +3678,13 @@ export class QuicConnection {
    * `quicKeys` did not make cause.
    */
   sealAt(space: QuicConnSpace, out: u8[], start: i32, payloadEnd: i32): i32 {
+    // RFC 9001 §6.6: at the confidentiality limit, with no key update made
+    // (`beforeDatagram`), the connection closes, and no packet, its
+    // CONNECTION_CLOSE included, is sealed under the key again.
+    if (space.level === TLS_LEVEL_APPLICATION && this.sealedUnderKey >= this.confidentialityLimit) {
+      this.fail(QUIC_ERROR_AEAD_LIMIT_REACHED, QUIC_CONN_NONE)
+      return 0
+    }
     const keys: QuicKeys | null = space.writeKeys
     const pn: i64 = space.nextPn
     const pnLength: i32 = quicPacketNumberLength(pn, space.largestAcked)
@@ -3040,7 +3724,13 @@ export class QuicConnection {
       return 0
     }
     space.nextPn = pn + 1
-    this.recordSent(space, pn, end - start)
+    if (space.level === TLS_LEVEL_APPLICATION) {
+      this.sealedUnderKey = this.sealedUnderKey + 1
+    }
+    const slot: i32 = this.recordSent(space, pn, end - start)
+    if (this.datagramEcn !== 0) {
+      this.recovery.onEctSent(space.level, slot)
+    }
     return end - start
   }
 
@@ -3051,19 +3741,29 @@ export class QuicConnection {
    * recorded. `buildDatagram` builds nothing ack-eliciting into a space
    * whose record is full, so recovery does not refuse one; if it ever did,
    * what the packet carried is queued again at once, as though lost.
+   * Answers the slot recovery recorded it in, or -1.
    */
-  recordSent(space: QuicConnSpace, pn: i64, size: i32): void {
+  recordSent(space: QuicConnSpace, pn: i64, size: i32): i32 {
     if (!space.stagedEliciting) {
-      return
+      return -1
     }
     const slot: i32 = this.recovery.onPacketSent(space.level, pn, size, this.now)
     if (slot >= 0) {
       space.commitStaged(slot)
-      space.probe = false
+      if (space.probes > 0) {
+        space.probes -= 1
+        // §6.2.4: a second probe carries unacknowledged data too. When the
+        // first took everything queued, the oldest — what it just carried —
+        // goes again.
+        if (space.probes > 0 && space.cryptoResendLow < 0) {
+          this.requeue(space, slot)
+        }
+      }
     } else {
       this.requeue(space, space.staging)
     }
     space.clearStaged()
+    return slot
   }
 
   /** An acknowledged packet in row `row`: each stream chunk and stream control frame it carried is settled. */
@@ -3109,6 +3809,7 @@ export class QuicConnection {
       return 0
     }
     this.closeSent = true
+    this.startClosingPeriod()
     let position: i32 = at
     const limit: i32 = at + QUIC_CONN_DATAGRAM_SIZE
     for (let level: i32 = 0; level < 3; level += 1) {
@@ -3159,10 +3860,13 @@ export class QuicConnection {
    * secrets and expected client Finished, the ephemeral key, the
    * connection-ID seed and the stateless reset tokens (QUIC-2). Call it when
    * the connection is done with (or `reset` the slot, which does the same
-   * first); the connection is closed after it and sends nothing more.
+   * first); the connection is closed after it and sends nothing more. Every
+   * stream buffer it borrowed goes back to its pool, zeroed: nothing is sent
+   * again from a closed connection.
    */
   release(): void {
     this.wipeAll()
+    this.streams.giveBack()
     if (!this.closed()) {
       this.state = QUIC_STATE_CLOSING
       this.error = QUIC_ERROR_NO_ERROR
@@ -3172,9 +3876,10 @@ export class QuicConnection {
 
   /**
    * Wipes every key and secret the connection holds and discards every
-   * level: `release()`'s work, the idle timeout's and `reset`'s. That takes
-   * in both sides' stateless reset tokens and `TlsServer`'s expected client
-   * Finished.
+   * level: `release()`'s work, the idle timeout's, the end of the closing or
+   * draining period's and `reset`'s. That takes in both sides' stateless
+   * reset tokens and `TlsServer`'s expected client Finished and resumption
+   * secret.
    */
   wipeAll(): void {
     this.discard(this.initial)
@@ -3184,11 +3889,11 @@ export class QuicConnection {
     this.otherReadKeys = null
     this.otherIsNext = false
     this.keyRetainUntil = -1
-    secureZero(this.appReadSecret)
-    secureZero(this.appWriteSecret)
-    secureZero(this.nextReadSecret)
+    this.closingUntil = -1
+    this.wipe()
+    secureZero(this.initialClient)
+    secureZero(this.initialServer)
     secureZero(this.cidSeed)
-    secureZero(this.ephemeralPrivate)
     // The stateless reset tokens of both sides' IDs: either one ends the
     // connection for whoever learns it (RFC 9000 §10.3).
     for (const entry of this.cids.local) {
@@ -3198,17 +3903,28 @@ export class QuicConnection {
       secureZero(entry.resetToken)
     }
     secureZero(this.peerParameters.statelessResetToken)
+    secureZero(this.localParameters.statelessResetToken)
     const tls: TlsServer | null = this.tls
     if (tls !== null) {
       // The server's encoded transport parameters carry its first ID's token.
       secureZero(tls.config.quicTransportParameters)
-      secureZero(tls.expectedClientFinished)
-      secureZero(tls.handshakeSecret)
-      secureZero(tls.clientHandshakeSecret)
-      secureZero(tls.serverHandshakeSecret)
-      secureZero(tls.clientApplicationSecret)
-      secureZero(tls.serverApplicationSecret)
-      secureZero(tls.exporterSecret)
+      tls.wipe()
     }
   }
+
+  /**
+   * Wipes the connection's `Secret` fields: the ephemeral key and both
+   * widths' 1-RTT read, next read and write secrets. `wipeAll` calls it,
+   * and so `release()`, `reset`, the idle timeout and the end of the
+   * closing or draining period.
+   */
+  wipe(): void {
+    wipe(this.ephemeral)
+    wipe(this.readSecret256)
+    wipe(this.nextReadSecret256)
+    wipe(this.writeSecret256)
+    wipe(this.readSecret384)
+    wipe(this.nextReadSecret384)
+    wipe(this.writeSecret384)
+  }
 }