@amritk/nish-x86_64-linux 0.18.0 → 0.20.0

package/std/net/quic-recovery.ts

@@ -31,12 +31,39 @@
  * adjusted_rtt) / 8`, `rttvar = (3 × rttvar + |smoothed_rtt −
  * adjusted_rtt|) / 4`, each division truncating. Sizes are bytes.
  *
+ * **The pacer's clock.** Pacing is not a timer, and on a path whose round
+ * trip is under a millisecond a pacer that counts whole milliseconds earns
+ * nothing until the next one starts, and then waits a whole one. So a
+ * caller with a finer clock sets `micros` to the same instant in
+ * microseconds before it calls in, and the pacer, its budget and its own
+ * smoothed RTT (`pacerRtt`) count microseconds; loss detection and the
+ * probe timeout still count milliseconds, at least
+ * `QUIC_RECOVERY_GRANULARITY`. A `micros` outside the millisecond `now`
+ * names, a stale one or none, is not read: the pacer counts `now × 1000`
+ * then, and paces as a millisecond clock always did.
+ *
  * **What the server leaves out.** It is written for the server side of a
  * connection: there is no client anti-deadlock probe (§6.2.2.1), since a
- * server never has to send to unblock its peer, and nothing reads ECN
- * (§7.1, B.7). A congestion window that the sender does not use is not
- * grown (§7.8): an acknowledgement grows it only if, when it arrived, the
- * bytes in flight were at least half the window.
+ * server never has to send to unblock its peer. A congestion window that
+ * the sender does not use is not grown (§7.8): an acknowledgement grows it
+ * only if, when it arrived, the bytes in flight were at least half the
+ * window.
+ *
+ * **ECN** (§7.1, B.7; RFC 9000 §13.4.2 and its Appendix A.4). A caller that
+ * marks its packets ECT(0) asks `ecnCodepoint()` what to mark with, says so
+ * with `onEctSent` for every packet it marked, and hands an ACK_ECN frame's
+ * counts to `onAckEcn`. The counts are validated against the packets marked
+ * before they are used: an ACK that newly acknowledges a marked packet
+ * without counts, a count that falls, counts past the packets marked, or an
+ * increase in ECT(0) and ECN-CE short of the marked packets newly
+ * acknowledged fails validation, as does every packet of the testing period
+ * being lost, and a failed path is marked no more (`QUIC_RECOVERY_ECN_FAILED`).
+ * Only the first `QUIC_RECOVERY_ECN_TESTING_PACKETS` are marked until one
+ * validates. A rise in the ECN-CE count is a congestion event, from the
+ * largest packet newly acknowledged, so it halves the window once per
+ * recovery period as a loss does. Counts that arrive with an ACK that does
+ * not raise the largest acknowledged are neither validated nor used: they
+ * may be older than those already read.
  *
  * **What a peer cannot do.** Every input is checked: the ranges of an
  * acknowledgement are read only up to the count given and the array's
@@ -110,6 +137,28 @@ const QUIC_RECOVERY_SENT: i32 = 1
 const QUIC_RECOVERY_ACKED: i32 = 2
 const QUIC_RECOVERY_LOST: i32 = 3
 const QUIC_RECOVERY_LOST_NOW: i32 = 4
+/** The bit of a slot's state byte that says its packet was sent marked ECT(0), kept beside the state so a slot costs no second byte. */
+const QUIC_RECOVERY_MARKED: i32 = 128
+
+/** The ECT(0) codepoint (RFC 3168), the only one this module asks a caller to mark with. */
+export const QUIC_RECOVERY_ECT0: i32 = 2
+/** How many packets are marked while ECN is tested, before a marked one is acknowledged (RFC 9000 A.4). */
+export const QUIC_RECOVERY_ECN_TESTING_PACKETS: i32 = 10
+/** ECN's states (RFC 9000 A.4): testing, marking the first packets; unknown, those sent and none validated yet; capable; and failed, for the connection's life. */
+export const QUIC_RECOVERY_ECN_TESTING: i32 = 0
+export const QUIC_RECOVERY_ECN_UNKNOWN: i32 = 1
+export const QUIC_RECOVERY_ECN_CAPABLE: i32 = 2
+export const QUIC_RECOVERY_ECN_FAILED: i32 = 3
+
+/** Microseconds in a millisecond: the pacer's clock against the caller's `now`. */
+const QUIC_RECOVERY_MICROS: i64 = 1000
+
+/**
+ * The most window the pacer earns by, in bytes: 4 GiB a round trip, faster
+ * than any path such a window could be on. It and the minute `pacerRefill`
+ * counts at most keep the product of the two inside an `i64`.
+ */
+const QUIC_RECOVERY_PACER_WINDOW: i64 = 4294967296
 
 /** The larger of two times or durations. */
 const quicRecoveryMax = (a: i64, b: i64): i64 => (a > b ? a : b)
@@ -125,7 +174,10 @@ const quicRecoveryMax = (a: i64, b: i64): i64 => (a > b ? a : b)
 export class QuicSentPackets {
   pn: i64[]
   timeSent: i64[]
+  /** When each packet was sent on the pacer's clock, in microseconds. */
+  fineSent: i64[]
   size: i32[]
+  /** Each slot's state, with `QUIC_RECOVERY_MARKED` set if its packet was sent marked ECT(0). */
   state: u8[]
   /** The slots the last `onAck` acknowledged, `ackedCount` of them, oldest first. */
   acked: i32[]
@@ -148,11 +200,18 @@ export class QuicSentPackets {
   inFlight: i32 = 0
   ackedCount: i32 = 0
   lostCount: i32 = 0
+  /** How many of this space's packets, recorded or not, were sent marked ECT(0). */
+  ectSent: i64 = 0
+  /** The ECN counts of the last ACK_ECN frame validated in this space (RFC 9000 §19.3.2). */
+  ect0: i64 = 0
+  ect1: i64 = 0
+  ce: i64 = 0
 
   constructor(capacity: i32) {
     this.capacity = capacity
     this.pn = new Array<i64>(capacity)
     this.timeSent = new Array<i64>(capacity)
+    this.fineSent = new Array<i64>(capacity)
     this.size = new Array<i32>(capacity)
     this.state = new Array<u8>(capacity)
     this.acked = new Array<i32>(capacity)
@@ -169,13 +228,13 @@ export class QuicSentPackets {
     if (s < 0 || s >= toI32(this.state.length)) {
       return QUIC_RECOVERY_FREE
     }
-    return toI32(this.state[s])
+    return toI32(this.state[s]) & (QUIC_RECOVERY_MARKED - 1)
   }
 
   /** Sets slot `s`'s state. */
   setState(s: i32, value: i32): void {
     if (s >= 0 && s < toI32(this.state.length)) {
-      this.state[s] = toU8(value)
+      this.state[s] = toU8((toI32(this.state[s]) & QUIC_RECOVERY_MARKED) | value)
     }
   }
 
@@ -189,11 +248,28 @@ export class QuicSentPackets {
     return s >= 0 && s < toI32(this.timeSent.length) ? this.timeSent[s] : -1
   }
 
+  /** When the packet in slot `s` was sent on the pacer's clock, in microseconds, or -1. */
+  fineAt(s: i32): i64 {
+    return s >= 0 && s < toI32(this.fineSent.length) ? this.fineSent[s] : -1
+  }
+
   /** The size of the packet in slot `s`, or 0. */
   sizeAt(s: i32): i32 {
     return s >= 0 && s < toI32(this.size.length) ? this.size[s] : 0
   }
 
+  /** Whether the packet in slot `s` was sent marked ECT(0). */
+  markedAt(s: i32): boolean {
+    return s >= 0 && s < toI32(this.state.length) && (toI32(this.state[s]) & QUIC_RECOVERY_MARKED) !== 0
+  }
+
+  /** Sets whether the packet in slot `s` was sent marked ECT(0). */
+  setMarked(s: i32, value: boolean): void {
+    if (s >= 0 && s < toI32(this.state.length)) {
+      this.state[s] = toU8(this.stateAt(s) | (value ? QUIC_RECOVERY_MARKED : 0))
+    }
+  }
+
   /** The `k`-th slot the last call acknowledged, or -1. */
   ackedSlot(k: i32): i32 {
     return k >= 0 && k < this.ackedCount && k < toI32(this.acked.length) ? this.acked[k] : -1
@@ -268,6 +344,10 @@ export class QuicSentPackets {
     this.clear()
     this.largestAcked = -1
     this.lastPn = -1
+    this.ectSent = 0
+    this.ect0 = 0
+    this.ect1 = 0
+    this.ce = 0
   }
 }
 
@@ -313,9 +393,13 @@ export class QuicRecovery {
   ssthresh: i64 = 0
   /** congestion_recovery_start_time (B.2), or -1 outside recovery. */
   recoveryStart: i64 = -1
-  /** The pacer's credit in bytes (§7.7), and the time it was last topped up, or -1. */
+  /** The pacer's credit in bytes (§7.7), and the time it was last topped up in microseconds, or -1. */
   pacerBudget: i64 = 0
   pacerTime: i64 = -1
+  /** The smoothed RTT the pacer's rate is taken from, in microseconds: `smoothedRtt` on the pacer's clock. */
+  pacerRtt: i64 = 0
+  /** The caller's clock in microseconds, which it sets before each call when it keeps one, or -1. */
+  micros: i64 = -1
   /** pto_count (A.3): how many probe timeouts fired since the last acknowledgement. */
   ptoCount: i32 = 0
   /** The space the last `onTimeout` acted on, or -1. */
@@ -323,6 +407,14 @@ export class QuicRecovery {
   /** How many congestion events reduced the window, and how many of them were persistent congestion. */
   congestionEvents: i32 = 0
   persistentCongestions: i32 = 0
+  /** How many congestion events a rise in the ECN-CE count caused (§7.1). */
+  ecnCongestionEvents: i32 = 0
+  /** ECN's state, `QUIC_RECOVERY_ECN_TESTING` until a marked packet's counts validate or fail. */
+  ecnState: i32 = 0
+  /** The packets marked while testing, and of those recorded, how many and how many of them were lost. */
+  ecnTestSent: i32 = 0
+  ecnTestRecorded: i32 = 0
+  ecnTestLost: i32 = 0
   /** Whether the handshake is confirmed (RFC 9001 §4.1.2), which the caller sets: the peer's max_ack_delay then bounds its ACK delays, and the Application Data space has a probe timeout. */
   handshakeConfirmed: boolean = false
 
@@ -355,10 +447,17 @@ export class QuicRecovery {
     this.recoveryStart = -1
     this.pacerBudget = QUIC_RECOVERY_INITIAL_WINDOW
     this.pacerTime = -1
+    this.pacerRtt = QUIC_RECOVERY_INITIAL_RTT * QUIC_RECOVERY_MICROS
+    this.micros = -1
     this.ptoCount = 0
     this.timeoutSpace = -1
     this.congestionEvents = 0
     this.persistentCongestions = 0
+    this.ecnCongestionEvents = 0
+    this.ecnState = QUIC_RECOVERY_ECN_TESTING
+    this.ecnTestSent = 0
+    this.ecnTestRecorded = 0
+    this.ecnTestLost = 0
     this.handshakeConfirmed = false
   }
 
@@ -400,12 +499,20 @@ export class QuicRecovery {
       return -1
     }
     const s: i32 = sp.slot(sp.count)
-    if (s < 0 || s >= toI32(sp.pn.length) || s >= toI32(sp.timeSent.length) || s >= toI32(sp.size.length)) {
+    if (
+      s < 0 ||
+      s >= toI32(sp.pn.length) ||
+      s >= toI32(sp.timeSent.length) ||
+      s >= toI32(sp.fineSent.length) ||
+      s >= toI32(sp.size.length)
+    ) {
       return -1
     }
     sp.pn[s] = pn
     sp.timeSent[s] = now
+    sp.fineSent[s] = this.fineNow(now)
     sp.size[s] = size
+    sp.setMarked(s, false)
     sp.setState(s, QUIC_RECOVERY_SENT)
     sp.count = sp.count + 1
     sp.inFlight = sp.inFlight + 1
@@ -415,6 +522,45 @@ export class QuicRecovery {
     return s
   }
 
+  /**
+   * The ECN codepoint to mark the next packet with (RFC 9000 A.4): ECT(0)
+   * for the first `QUIC_RECOVERY_ECN_TESTING_PACKETS` and, once the path is
+   * capable, for every one; 0, Not-ECT, while the testing packets wait to be
+   * validated and once validation failed.
+   */
+  ecnCodepoint(): i32 {
+    const testing: boolean =
+      this.ecnState === QUIC_RECOVERY_ECN_TESTING && this.ecnTestSent < QUIC_RECOVERY_ECN_TESTING_PACKETS
+    return testing || this.ecnState === QUIC_RECOVERY_ECN_CAPABLE ? QUIC_RECOVERY_ECT0 : 0
+  }
+
+  /**
+   * A packet of space `space` went out marked ECT(0): `slot` is the one
+   * `onPacketSent` answered for it, or -1 for a packet that elicits no
+   * acknowledgement and so was not recorded. Every packet of a datagram
+   * marked counts, whatever `ecnCodepoint()` answers by the last of them.
+   */
+  onEctSent(space: i32, slot: i32): void {
+    const sp: QuicSentPackets | null = this.space(space)
+    if (sp === null) {
+      return
+    }
+    sp.ectSent = sp.ectSent + 1
+    const recorded: boolean = sp.inFlightAt(slot) && !sp.markedAt(slot)
+    if (recorded) {
+      sp.setMarked(slot, true)
+    }
+    if (this.ecnState === QUIC_RECOVERY_ECN_TESTING || this.ecnState === QUIC_RECOVERY_ECN_UNKNOWN) {
+      this.ecnTestSent = this.ecnTestSent + 1
+      if (recorded) {
+        this.ecnTestRecorded = this.ecnTestRecorded + 1
+      }
+      if (this.ecnTestSent >= QUIC_RECOVERY_ECN_TESTING_PACKETS) {
+        this.ecnState = QUIC_RECOVERY_ECN_UNKNOWN
+      }
+    }
+  }
+
   /**
    * An ACK frame for space `space` (A.7): `ranges` holds `count`
    * `[smallest, largest]` pairs, highest first, as `QuicFrame.ackRanges`
@@ -429,24 +575,49 @@ export class QuicRecovery {
    * elicit no acknowledgement, which are not recorded here.
    */
   onAck(space: i32, ranges: i64[], count: i32, ackDelay: i64, now: i64): i32 {
+    const none: i64 = -1
+    return this.onAckEcn(space, ranges, count, ackDelay, now, none, none, none)
+  }
+
+  /**
+   * `onAck` for an ACK frame that carries ECN counts, `ect0`, `ect1` and
+   * `ce` as ACK_ECN gives them (RFC 9000 §19.3.2), or -1 each for one that
+   * carries none. The counts are validated (RFC 9000 §13.4.2.1) and a rise
+   * in ECN-CE is a congestion event (§7.1, B.7) before loss is detected, as
+   * A.7 orders it.
+   */
+  onAckEcn(
+    space: i32,
+    ranges: i64[],
+    count: i32,
+    ackDelay: i64,
+    now: i64,
+    ect0: i64,
+    ect1: i64,
+    ce: i64
+  ): i32 {
     const sp: QuicSentPackets | null = this.space(space)
     if (sp === null || count <= 0 || toI32(ranges.length) < 2) {
       return -1
     }
     const largest: i64 = ranges[1]
+    const raised: boolean = largest > sp.largestAcked
     sp.compact()
     sp.clearResults()
-    if (largest > sp.largestAcked) {
+    if (raised) {
       sp.largestAcked = largest
     }
     // The bytes in flight before this ACK decide whether the window was in
     // use, and so whether it may grow (§7.8).
     const inUse: boolean = this.bytesInFlight() * 2 >= this.congestionWindow
     let sampleAt: i32 = -1
+    // The send time of the first recorded packet past the largest acknowledged, or `now`: no earlier than the largest's own.
+    let later: i64 = now
     for (let k: i32 = 0; k < sp.count; k += 1) {
       const s: i32 = sp.slot(k)
       // The ring is in packet-number order, so nothing past the largest acknowledged is.
       if (sp.pnAt(s) > largest) {
+        later = sp.timeAt(s)
         break
       }
       if (sp.stateAt(s) === QUIC_RECOVERY_SENT && quicRecoveryInRanges(ranges, count, sp.pnAt(s))) {
@@ -461,13 +632,25 @@ export class QuicRecovery {
       }
     }
     if (sp.ackedCount === 0) {
+      // An ACK that raises the largest to a packet never recorded (one that
+      // elicits no ACK) still carries the newest counts. Skipping them here
+      // would hide a CE rise for good, since the next ACK raises nothing.
+      if (raised && this.ecnState !== QUIC_RECOVERY_ECN_FAILED) {
+        this.processEcn(sp, raised, ect0, ect1, ce, later, now)
+      }
       return 0
     }
     if (sampleAt >= 0) {
       this.latestRtt = quicRecoveryMax(now - sp.timeAt(sampleAt), 0)
       // §5.3: the Initial space's ACKs are not delayed by the peer, so their delay is ignored.
       const none: i64 = 0
-      this.updateRtt(space === QUIC_RECOVERY_INITIAL ? none : quicRecoveryMax(ackDelay, none), now)
+      const delay: i64 = space === QUIC_RECOVERY_INITIAL ? none : quicRecoveryMax(ackDelay, none)
+      const first: boolean = this.firstSampleTime < 0
+      this.updateRtt(delay, now)
+      this.updatePacerRtt(this.fineSample(now, sp.fineAt(sampleAt)), delay, first)
+    }
+    if (this.ecnState !== QUIC_RECOVERY_ECN_FAILED) {
+      this.processEcn(sp, raised, ect0, ect1, ce, later, now)
     }
     this.detectLoss(sp, now)
     this.packetsLost(sp, now)
@@ -478,6 +661,72 @@ export class QuicRecovery {
     return sp.ackedCount
   }
 
+  /**
+   * ECN validation (RFC 9000 §13.4.2.1) and ProcessECN (B.7) for the ACK
+   * `onAckEcn` just settled in `sp`, `raised` saying whether it raised the
+   * largest acknowledged. A failure stops ECN for the connection and its
+   * counts are not used; a pass makes the path capable once a marked packet
+   * is among those acknowledged, and a rise in ECN-CE halves the window from
+   * the send time of the largest packet newly acknowledged. With none newly
+   * acknowledged it is timed from `later`, a send time no earlier than the
+   * largest acknowledged packet's, which recovery did not record.
+   */
+  processEcn(
+    sp: QuicSentPackets,
+    raised: boolean,
+    ect0: i64,
+    ect1: i64,
+    ce: i64,
+    later: i64,
+    now: i64
+  ): void {
+    let marked: i64 = 0
+    for (let k: i32 = 0; k < sp.ackedCount; k += 1) {
+      if (sp.markedAt(sp.ackedSlot(k))) {
+        marked = marked + 1
+      }
+    }
+    if (ect0 < 0 || ect1 < 0 || ce < 0) {
+      // An ACK without counts that newly acknowledges a marked packet: the path, or the peer, dropped them.
+      if (marked > 0) {
+        this.ecnState = QUIC_RECOVERY_ECN_FAILED
+      }
+      return
+    }
+    if (!raised) {
+      return
+    }
+    // A count only grows, and none of them, nor their sum, can pass the
+    // packets marked. Each is a varint, so the sum is taken by subtraction.
+    const sent: i64 = sp.ectSent
+    if (
+      ect0 < sp.ect0 ||
+      ect1 < sp.ect1 ||
+      ce < sp.ce ||
+      ect0 > sent ||
+      ect1 > sent - ect0 ||
+      ce > sent - ect0 - ect1 ||
+      ect0 - sp.ect0 + (ce - sp.ce) < marked
+    ) {
+      this.ecnState = QUIC_RECOVERY_ECN_FAILED
+      return
+    }
+    if (marked > 0) {
+      this.ecnState = QUIC_RECOVERY_ECN_CAPABLE
+    }
+    const rose: boolean = ce > sp.ce
+    sp.ect0 = ect0
+    sp.ect1 = ect1
+    sp.ce = ce
+    if (rose) {
+      const events: i32 = this.congestionEvents
+      this.congestionEvent(sp.ackedCount > 0 ? sp.timeAt(sp.ackedSlot(sp.ackedCount - 1)) : later, now)
+      if (this.congestionEvents > events) {
+        this.ecnCongestionEvents = this.ecnCongestionEvents + 1
+      }
+    }
+  }
+
   /** UpdateRtt (§5.3, A.7) with a sample in `latestRtt`, `ackDelay` the peer's delay in milliseconds. */
   updateRtt(ackDelay: i64, now: i64): void {
     const latest: i64 = this.latestRtt
@@ -491,10 +740,7 @@ export class QuicRecovery {
     if (latest < this.minRtt) {
       this.minRtt = latest
     }
-    let delay: i64 = ackDelay
-    if (this.handshakeConfirmed && delay > this.maxAckDelay) {
-      delay = this.maxAckDelay
-    }
+    const delay: i64 = this.boundAckDelay(ackDelay)
     // The delay is taken off only where that leaves the sample at or above min_rtt.
     let adjusted: i64 = latest
     if (latest >= this.minRtt + delay) {
@@ -505,6 +751,55 @@ export class QuicRecovery {
     this.smoothedRtt = (7 * this.smoothedRtt + adjusted) / 8
   }
 
+  /** The peer's ACK delay in milliseconds as §5.3 counts it: at most max_ack_delay once the handshake is confirmed. */
+  boundAckDelay(ackDelay: i64): i64 {
+    return this.handshakeConfirmed && ackDelay > this.maxAckDelay ? this.maxAckDelay : ackDelay
+  }
+
+  /**
+   * `now` on the pacer's clock: `micros` when it falls inside the
+   * millisecond `now` names, and `now × 1000` otherwise.
+   */
+  fineNow(now: i64): i64 {
+    const coarse: i64 = now * QUIC_RECOVERY_MICROS
+    return this.micros >= coarse && this.micros < coarse + QUIC_RECOVERY_MICROS ? this.micros : coarse
+  }
+
+  /**
+   * The pacer's RTT sample, in microseconds, for a packet sent at `sent` on
+   * its clock: at least a microsecond on a fine clock, and at least
+   * `QUIC_RECOVERY_GRANULARITY` on a millisecond one, where a sample of 0
+   * says only that the round trip was under a millisecond. A packet sent
+   * while `micros` was stale is stamped `now × 1000`, so a fine sample for it
+   * runs long by up to a millisecond: only a carrier that calls `clock` on
+   * some sends and not others sees that.
+   */
+  fineSample(now: i64, sent: i64): i64 {
+    const at: i64 = this.fineNow(now)
+    const floor: i64 = at === this.micros ? 1 : QUIC_RECOVERY_GRANULARITY * QUIC_RECOVERY_MICROS
+    return quicRecoveryMax(at - sent, floor)
+  }
+
+  /**
+   * UpdateRtt (§5.3) for the pacer's RTT, in microseconds: `sample` the
+   * sample, `ackDelay` the peer's delay in milliseconds, `first` whether it
+   * is the connection's first. min_rtt is the millisecond one, at most the
+   * true minimum, so a delay is taken off a little more readily than
+   * `updateRtt` takes it.
+   */
+  updatePacerRtt(sample: i64, ackDelay: i64, first: boolean): void {
+    if (first) {
+      this.pacerRtt = sample
+      return
+    }
+    const delay: i64 = this.boundAckDelay(ackDelay) * QUIC_RECOVERY_MICROS
+    let adjusted: i64 = sample
+    if (sample >= this.minRtt * QUIC_RECOVERY_MICROS + delay) {
+      adjusted = sample - delay
+    }
+    this.pacerRtt = (7 * this.pacerRtt + adjusted) / 8
+  }
+
   /** The loss delay (§6.1.2): 9/8 of the larger of the latest and the smoothed RTT, at least the granularity. */
   lossDelay(): i64 {
     const delay: i64 = (9 * quicRecoveryMax(this.latestRtt, this.smoothedRtt)) / 8
@@ -553,6 +848,17 @@ export class QuicRecovery {
     let newest: i64 = -1
     for (let k: i32 = 0; k < sp.lostCount; k += 1) {
       newest = quicRecoveryMax(newest, sp.timeAt(sp.lostSlot(k)))
+      if (sp.markedAt(sp.lostSlot(k)) && this.ecnState !== QUIC_RECOVERY_ECN_CAPABLE) {
+        this.ecnTestLost = this.ecnTestLost + 1
+      }
+    }
+    // RFC 9000 A.4: every packet marked while testing that could be lost was.
+    if (
+      this.ecnState === QUIC_RECOVERY_ECN_UNKNOWN &&
+      this.ecnTestRecorded > 0 &&
+      this.ecnTestLost >= this.ecnTestRecorded
+    ) {
+      this.ecnState = QUIC_RECOVERY_ECN_FAILED
     }
     this.congestionEvent(newest, now)
     if (this.persistentCongestion(sp)) {
@@ -800,34 +1106,43 @@ export class QuicRecovery {
     this.ptoCount = 0
   }
 
+  /** The congestion window the pacer earns by: at most `QUIC_RECOVERY_PACER_WINDOW`. */
+  pacerWindow(): i64 {
+    return this.congestionWindow < QUIC_RECOVERY_PACER_WINDOW
+      ? this.congestionWindow
+      : QUIC_RECOVERY_PACER_WINDOW
+  }
+
   /**
-   * Tops the pacer up to `now` (§7.7): it earns 5/4 of the window per
-   * smoothed RTT, and holds at most the initial window, which is the largest
-   * burst it allows.
+   * Tops the pacer up to `now` (§7.7), on its clock: it earns 5/4 of the
+   * window per `pacerRtt`, and holds at most the initial window, which is the
+   * largest burst it allows.
    */
   pacerRefill(now: i64): void {
-    if (this.pacerTime < 0 || now < this.pacerTime) {
-      this.pacerTime = now
+    const at: i64 = this.fineNow(now)
+    if (this.pacerTime < 0 || at < this.pacerTime) {
+      this.pacerTime = at
       return
     }
     // A minute is far past what fills the budget, and keeps the product in range.
-    let elapsed: i64 = now - this.pacerTime
-    if (elapsed > 60000) {
-      elapsed = 60000
+    let elapsed: i64 = at - this.pacerTime
+    if (elapsed > 60000000) {
+      elapsed = 60000000
     }
-    const rtt: i64 = quicRecoveryMax(this.smoothedRtt, QUIC_RECOVERY_GRANULARITY)
-    const earned: i64 = (elapsed * this.congestionWindow * 5) / (rtt * 4)
+    const rtt: i64 = quicRecoveryMax(this.pacerRtt, 1)
+    const earned: i64 = (elapsed * this.pacerWindow() * 5) / (rtt * 4)
     this.pacerBudget = this.pacerBudget + earned
     if (this.pacerBudget > QUIC_RECOVERY_INITIAL_WINDOW) {
       this.pacerBudget = QUIC_RECOVERY_INITIAL_WINDOW
     }
-    this.pacerTime = now
+    this.pacerTime = at
   }
 
   /**
    * How many milliseconds after `now` the pacer lets a datagram of `size`
-   * bytes go: 0 when it may go now, else at least 1. The rate is 5/4 of the
-   * window per smoothed RTT (§7.7's N of 1.25).
+   * bytes go: 0 when it may go now, else its wait in microseconds rounded
+   * up to whole milliseconds, so at least 1. The rate is 5/4 of the window per `pacerRtt`
+   * (§7.7's N of 1.25).
    */
   pacerDelay(now: i64, size: i32): i64 {
     this.pacerRefill(now)
@@ -835,10 +1150,26 @@ export class QuicRecovery {
     if (need <= 0) {
       return 0
     }
-    const rtt: i64 = quicRecoveryMax(this.smoothedRtt, QUIC_RECOVERY_GRANULARITY)
-    const rate: i64 = quicRecoveryMax(this.congestionWindow * 5, 1)
+    const rtt: i64 = quicRecoveryMax(this.pacerRtt, 1)
+    const rate: i64 = quicRecoveryMax(this.pacerWindow() * 5, 1)
     const wait: i64 = (need * rtt * 4 + rate - 1) / rate
-    return quicRecoveryMax(wait, 1)
+    return quicRecoveryMax((wait + QUIC_RECOVERY_MICROS - 1) / QUIC_RECOVERY_MICROS, 1)
+  }
+
+  /**
+   * The credit a paced flight waits for before it starts, in bytes: what the
+   * pacer earns in a millisecond, at least `least` and at most `most`. A
+   * pacer that earns by the microsecond would otherwise let a fast
+   * connection out a datagram at a time, one send each; one that earns
+   * slowly still lets a datagram go as soon as it has the credit for it.
+   */
+  pacerQuantum(least: i32, most: i32): i32 {
+    const rtt: i64 = quicRecoveryMax(this.pacerRtt, 1)
+    const milli: i64 = (this.pacerWindow() * 5 * QUIC_RECOVERY_MICROS) / (rtt * 4)
+    if (milli < toI64(least)) {
+      return least
+    }
+    return milli > toI64(most) ? most : toI32(milli)
   }
 
   /** Charges the pacer for a datagram of `size` bytes sent at `now`. */