@woosh/meep-engine 3.29.0 → 3.31.0

package/src/engine/network/orchestrator/ServerAuthoritativeServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ServerAuthoritativeServer.d.ts","sourceRoot":"","sources":["../../../../../src/engine/network/orchestrator/ServerAuthoritativeServer.js"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH;IAsCI;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,6PAxBW;QACV,KAAS,yBAAyB;QAClC,eAAmB,8BAA8B;QACjD,qBAAyB,EAAE,UAAU,CAAC;QACtC,cAAkB,EAAE,UAAU,CAAC;QAC/B,YAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,cAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,mBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,sBAA0B,CAAC,EAAE,MAAM,CAAC;QACpC,oBAAwB,CAAC,EAAE,MAAM,CAAC;KAC/B,EAiOH;IApPD;;;;;OAKG;IACH,mBAFU,MAAM,CAEO;IA6CnB,0BAA0B;IAC1B,MADW,WAAW,CAUpB;IAEF,qCAAqC;IACrC,8BAAkB;IAClB,gCAAgC;IAChC,4BAAkC;IAclC,mCAAmC;IACnC,iCAAsC;IACtC,wBAAwB;IACxB,sBAAsC;IACtC,gCAAgC;IAChC,mCAAgD;IAChD,0CAA0C;IAC1C,gDAAsD;IAEtD,2BAA2B;IAC3B,eADW,YAAY,CAKrB;IAEF;;;;;;OAMG;IACH,6BAFU,MAAM,CAEqB;IAErC;;;;OAIG;IACH,wBAFU,MAAM,CAEoC;IAEpD;;;;;;;OAOG;IACH,gBAFU,MAAM,CAEoB;IAEpC;;;;;;;;;OASG;IACH,yBAFU,MAAM,CAEsC;IAEtD;;;;;;;;;OASG;IACH,mBAFU,MAAM,CAE0B;IA+B1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,YAFU,MAAM,CAEc;IAE9B;;;;;;;OAOG;IACH,gBAFU,MAAM,CAEkB;IAElC;;;;;;;;;;;OAWG;IACH,UAFU,MAAM,CAEY;IAE5B;;;;;;;OAOG;IACH,wBAFU,MAAM,CAE0B;IAG9C;;;;;;;OAOG;IACH,sBAHW,MAAM,aACN,MAAM,QAIhB;IAED;;;OAGG;IACH,yBAFW,MAAM,QAIhB;IAED;;;;;;;;OAQG;IACH,yBALW,MAAM,gBACN,MAAM,cACN,MAAM,YACN,CAAC,GAAG,EAAE,YAAY,KAAK,IAAI,QAIrC;IAED;;;;OAIG;IACH,qBAFW,MAAM,6CAIhB;IAED;;;;;;;;OAQG;IACH,qCAFW,MAAM,QAIhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,wCA8BC;IAED;;;OAGG;IACH,6BAFa,MAAM,CAIlB;IAED;;;;;;;;;;;;OAYG;IACH,oBAFW,MAAM,QAkDhB;IAED;;;;;;;;OAQG;IACH,+BAHW,MAAM,GACJ,MAAM,CAOlB;IAyLD;;;;OAIG;IACH,yBAFa,MAAM,CAIlB;;CA8IJ;4BA52B2B,kBAAkB;6BAFjB,wBAAwB;mBAPlC,uCAAuC;6BAH7B,sCAAsC"}
+{"version":3,"file":"ServerAuthoritativeServer.d.ts","sourceRoot":"","sources":["../../../../../src/engine/network/orchestrator/ServerAuthoritativeServer.js"],"names":[],"mappings":";;;wBAmBU,MAAM;AAJhB;;;;;GAKG;AACH;IACI;;;;OAIG;;IAEH;;;;OAIG;;GAEJ;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH;IA2DI;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,yQA3BW;QACV,KAAS,yBAAyB;QAClC,eAAmB,8BAA8B;QACjD,qBAAyB,EAAE,UAAU,CAAC;QACtC,cAAkB,EAAE,UAAU,CAAC;QAC/B,YAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,cAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,mBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,sBAA0B,CAAC,EAAE,MAAM,CAAC;QACpC,oBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,UAAc,CAAC,EAAE,SAAS,GAAC,MAAM,CAAC;KAC/B,EAkQH;IAtRD;;;;;OAKG;IACH,mBAFU,MAAM,CAEO;IAqDnB;;;;OAIG;IACH,qBAFU,SAAS,GAAC,MAAM,CAEE;IAC5B,0BAA0B;IAC1B,MADW,WAAW,CAUpB;IAEF,qCAAqC;IACrC,8BAAkB;IAClB,gCAAgC;IAChC,4BAAkC;IAclC,mCAAmC;IACnC,iCAAsC;IACtC,wBAAwB;IACxB,sBAAsC;IACtC,gCAAgC;IAChC,mCAAgD;IAChD,0CAA0C;IAC1C,gDAAsD;IAEtD,2BAA2B;IAC3B,eADW,YAAY,CAKrB;IAEF;;;;;;OAMG;IACH,6BAFU,MAAM,CAEqB;IAErC;;;;OAIG;IACH,wBAFU,MAAM,CAEoC;IAEpD;;;;;;;OAOG;IACH,gBAFU,MAAM,CAEoB;IAEpC;;;;;;;;;OASG;IACH,yBAFU,MAAM,CAEsC;IAEtD;;;;;;;;;OASG;IACH,mBAFU,MAAM,CAE0B;IAyC1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,YAFU,MAAM,CAEc;IAE9B;;;;;;;OAOG;IACH,gBAFU,MAAM,CAEkB;IAElC;;;;;;;OAOG;IACH,mBAFU,MAAM,CAEqB;IAErC;;;;;;;;;;;OAWG;IACH,UAFU,MAAM,CAEY;IAE5B;;;;;;;OAOG;IACH,wBAFU,MAAM,CAE0B;IAG9C;;;;;;;OAOG;IACH,sBAHW,MAAM,aACN,MAAM,QAIhB;IAED;;;OAGG;IACH,yBAFW,MAAM,QAIhB;IAED;;;;;;;;OAQG;IACH,yBALW,MAAM,gBACN,MAAM,cACN,MAAM,YACN,CAAC,GAAG,EAAE,YAAY,KAAK,IAAI,QAIrC;IAED;;;;OAIG;IACH,qBAFW,MAAM,6CAIhB;IAED;;;;;;;;OAQG;IACH,qCAFW,MAAM,QAIhB;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,wCA8BC;IAED;;;OAGG;IACH,6BAFa,MAAM,CAIlB;IAED;;;;;;;;;;;;;OAaG;IACH,oBAFW,MAAM,QAKhB;IAED;;;;;;;;;OASG;IACH,0BAFW,MAAM,QAqEhB;IAED;;;;OAIG;IACH,iBAiBC;IAED;;;OAGG;IACH,yBAEC;IAED;;;;;;;;OAQG;IACH,+BAHW,MAAM,GACJ,MAAM,CAOlB;IAoQD;;;;OAIG;IACH,yBAFa,MAAM,CAIlB;;CA6MJ;4BAroC2B,kBAAkB;6BAFjB,wBAAwB;mBAPlC,uCAAuC;6BAH7B,sCAAsC"}

package/src/engine/network/orchestrator/ServerAuthoritativeServer.js

@@ -10,9 +10,30 @@ import { Replicator } from "../replication/Replicator.js";
 import { AlwaysRelevantScope } from "../replication/ScopeFilter.js";
 import { ActionRecordCursor } from "../sim/ActionRecordCursor.js";
 import { RewindEngine } from "../sim/RewindEngine.js";
-import { SENDER_DERIVED, SENDER_LOCAL } from "../sim/SimActionExecutor.js";
+import { SENDER_DERIVED, SENDER_LOCAL, SENDER_RECORDED } from "../sim/SimActionExecutor.js";
 import { NetworkPeer } from "./NetworkPeer.js";
 
+/**
+ * What the server does with input that arrives for a frame it has already simulated.
+ *
+ * @readonly
+ * @enum {string}
+ */
+export const LateInput = Object.freeze({
+    /**
+     * Rewind to the input's frame and replay forward, so it lands exactly where it was tagged.
+     * Exact for a simulation made entirely of actions; a replay re-executes actions only, never the
+     * engine's fixed-step systems, so for physics-driven state it buys nothing.
+     */
+    Rollback: 'rollback',
+    /**
+     * Apply it in the frame being simulated now. What input buffering (`simulation_delay_ticks`)
+     * and time dilation exist to make rare, handled the way a physics game handles it: late, not
+     * rewound.
+     */
+    Apply: 'apply',
+});
+
 /**
  * Server-authoritative orchestrator with deterministic per-tick rollback.
  *
@@ -92,6 +113,14 @@ export class ServerAuthoritativeServer {
     #peer_max_received_frame;
     // Scratch for the replay loop.
     #historical_scratch = /** @type {Array<{type_id:number, sender_id:number, payload:Uint8Array}>} */ ([]);
+
+    /**
+     * The recorded — not executed — records of the frame being replayed ({@link SENDER_RECORDED}),
+     * in log order: carried into the replayed frame as they are, since what produced them is not
+     * re-run by a replay.
+     * @type {Array<{type_id:number, payload:Uint8Array}>}
+     */
+    #carried_scratch = [];
     #sort_scratch = /** @type {Array<{sender_id:number, type_id:number, payload:Uint8Array}>} */ ([]);
     #payload_buf;
     // Walks a frame's records, for the history read and the arrival check.
@@ -109,6 +138,19 @@ export class ServerAuthoritativeServer {
      * @private @type {number}
      */
     #pending_dropped = 0;
+    /**
+     * Frame opened by {@link begin_tick} and not yet closed by {@link end_tick}; -1 when none.
+     * @type {number}
+     */
+    #open_sim_frame = -1;
+    /**
+     * Late input already folded into a later frame under {@link LateInput.Apply}, by the frame it
+     * was tagged for. The log does not hold it at that frame, so without this a retransmission of
+     * the frame — routine until the ack round-trips — would read as new input and apply again.
+     * Trimmed to the rewindable window like pending.
+     * @type {Map<number, Array<{sender_id: number, type_id: number, payload: Uint8Array}>>}
+     */
+    #folded = new Map();
 
     /**
      * Most recently simulated frame. `-1` during warmup
@@ -129,11 +171,14 @@ export class ServerAuthoritativeServer {
      *   initial_buffer_size?: number,
      *   simulation_delay_ticks?: number,
      *   max_packets_per_tick?: number,
+     *   late_input?: LateInput|string,
      * }} options
      *
      * `max_packets_per_tick`: forwarded to {@link NetworkPeer}; how many
      * action-stream packets a tick may send one peer.
      *
+     * `late_input`: see {@link LateInput}. Default {@link LateInput.Rollback}.
+     *
      * `simulation_delay_ticks`: server-side input buffer (Overwatch-style).
      * When > 0, {@link tick}(wall_frame) simulates
      * `sim_frame = wall_frame - simulation_delay_ticks`. Pending actions
@@ -157,10 +202,21 @@ export class ServerAuthoritativeServer {
         identity_class = NetworkIdentity,
         server_peer_id = -1,
         max_packets_per_tick,
+        late_input = LateInput.Rollback,
     }) {
         assert.isNonNegativeInteger(simulation_delay_ticks, 'simulation_delay_ticks');
         assert.isPositiveInteger(max_pending_future_lead, 'max_pending_future_lead');
         assert.isPositiveInteger(max_pending_total, 'max_pending_total');
+        if (late_input !== LateInput.Rollback && late_input !== LateInput.Apply) {
+            throw new Error(`ServerAuthoritativeServer: late_input must be one of ${Object.values(LateInput).join(', ')}, got '${late_input}'`);
+        }
+
+        /**
+         * What happens to input that arrives for an already-simulated frame. See {@link LateInput}.
+         * @readonly
+         * @type {LateInput|string}
+         */
+        this.late_input = late_input;
         /** @type {NetworkPeer} */
         this.peer = new NetworkPeer({
             world,
@@ -270,6 +326,16 @@ export class ServerAuthoritativeServer {
         this.#local_buf = new BinaryBuffer();
         this.#local_buf.setCapacity(64);
 
+        // A peer's frame marker says how far its clock has run whether or not the frame carried
+        // input, so the buffer depth time dilation steers by does not collapse to zero on ticks
+        // without input.
+        this.peer.onFrameMarker.add((peer_id, frame_number) => {
+            const prev = this.#peer_max_received_frame.get(peer_id);
+            if (prev === undefined || frame_number > prev) {
+                this.#peer_max_received_frame.set(peer_id, frame_number);
+            }
+        });
+
         // Switch the Replicator to deferred-execute mode: incoming actions
         // accumulate in pending until tick() drains them.
         this.peer.replicator.on_pending_action = (peer_id, frame_number, type_id, buf, off, len) => {
@@ -331,6 +397,16 @@ export class ServerAuthoritativeServer {
          */
         this.onTickComplete = new Signal();
 
+        /**
+         * Fires once per tick, for the frame being simulated for the first time, after
+         * {@link onLocalSim} and before the frame closes — the last chance to record into it. Never
+         * fires for a replayed frame. Args: `(sim_frame)`.
+         *
+         * `NetworkSession` records the state its simulation changed here.
+         * @type {Signal}
+         */
+        this.onBeforeTickClose = new Signal();
+
         /**
          * Fired when a tick triggers an actual rewind (i.e. the replay
          * window includes already-committed frames). Args:
@@ -477,7 +553,8 @@ export class ServerAuthoritativeServer {
     }
 
     /**
-     * Drive the rollback flow for one tick.
+     * Drive the rollback flow for one tick: {@link begin_tick} followed immediately by
+     * {@link end_tick}, for a caller whose simulation happens entirely inside {@link onLocalSim}.
      *
      * With `simulation_delay_ticks = 0` (default), simulates the caller's
      * `wall_frame` and drains pending. With `> 0`, simulates
@@ -490,8 +567,27 @@ export class ServerAuthoritativeServer {
      * @param {number} current_frame the caller's wall frame
      */
     tick(current_frame) {
+        this.begin_tick(current_frame);
+        this.end_tick();
+    }
+
+    /**
+     * First half of a tick: resolve late input (rewinding and replaying older frames, or folding it
+     * into this frame — see {@link late_input}), then open the frame being simulated and apply its
+     * input. The frame stays open until {@link end_tick}, so whatever runs in between — the engine's
+     * fixed-step systems — executes inside it: actions it executes are recorded into the frame.
+     *
+     * Warmup (`sim_frame < 0`) opens nothing, and the matching {@link end_tick} does nothing.
+     *
+     * @param {number} current_frame the caller's wall frame
+     */
+    begin_tick(current_frame) {
         assert.isNonNegativeInteger(current_frame, 'current_frame');
 
+        if (this.#open_sim_frame !== -1) {
+            throw new Error(`ServerAuthoritativeServer.begin_tick: frame ${this.#open_sim_frame} is still open; call end_tick first`);
+        }
+
         const sim_frame = current_frame - this.simulation_delay_ticks;
 
         if (sim_frame < 0) return; // warmup
@@ -501,6 +597,16 @@ export class ServerAuthoritativeServer {
         if (this.#pending_frames.length > 0 && this.#pending_referenced_frames[0] < window_oldest) {
             this.#pending_trim_to_window(window_oldest);
         }
+        if (this.#folded.size > 0) {
+            for (const frame of this.#folded.keys()) {
+                if (frame < window_oldest) this.#folded.delete(frame);
+            }
+        }
+
+        // 1a. Late input folded into this frame instead of rolled back to its own.
+        if (this.late_input === LateInput.Apply) {
+            this.#pending_fold_late_into(sim_frame);
+        }
 
         // 2. Pick the replay window: the OLDEST pending frame at or below
         //    `sim_frame`. Pending holds only input the log does not already
@@ -515,20 +621,49 @@ export class ServerAuthoritativeServer {
             replay_start = refs[0];
         }
 
-        // 3. Rewind only if the replay window covers committed frames.
-        const committed_top = sim_frame - 1;
-        if (replay_start <= committed_top) {
-            this.rewind_engine.rewind_to(committed_top, replay_start - 1);
-            this.onRewind.send3(committed_top, replay_start - 1, committed_top - (replay_start - 1));
-        }
+        try {
+            // 3. Rewind only if the replay window covers committed frames.
+            const committed_top = sim_frame - 1;
+            if (replay_start <= committed_top) {
+                this.rewind_engine.rewind_to(committed_top, replay_start - 1);
+                this.onRewind.send3(committed_top, replay_start - 1, committed_top - (replay_start - 1));
+            }
 
-        // 4. Replay [replay_start, sim_frame]. Only `sim_frame` is being
-        //    simulated for the first time; the rest are re-executions of
-        //    frames the log already holds.
-        for (let f = replay_start; f <= sim_frame; f++) {
-            this.#replay_frame(f, f === sim_frame);
+            // 4. Replay [replay_start, sim_frame). These are re-executions of
+            //    frames the log already holds; only `sim_frame` is simulated for
+            //    the first time, and it is opened, not closed.
+            for (let f = replay_start; f < sim_frame; f++) {
+                this.#replay_frame(f, false);
+            }
+
+            this.#open_frame(sim_frame, true);
+        } catch (e) {
+            // A failure part-way must not leave a frame open behind it: nothing would close it,
+            // and every later tick would be refused. What was applied stays; the frame is closed
+            // as it is, and the error goes on to the caller.
+            if (this.action_log.has_open_frame()) {
+                this.action_log.end_frame();
+            }
+            throw e;
         }
 
+        this.#open_sim_frame = sim_frame;
+    }
+
+    /**
+     * Second half of a tick: run {@link onLocalSim} for the open frame, close it, publish the new
+     * {@link current_sim_frame}, flush the action stream and fire {@link onTickComplete}. A no-op
+     * after a warmup {@link begin_tick}.
+     */
+    end_tick() {
+        const sim_frame = this.#open_sim_frame;
+
+        if (sim_frame === -1) return; // warmup, or no begin_tick
+
+        this.#open_sim_frame = -1;
+
+        this.#close_frame(sim_frame, true);
+
         // 5. Keep only `frame > sim_frame` pending (future buffer).
         this.#pending_filter_to_future(sim_frame);
 
@@ -539,6 +674,14 @@ export class ServerAuthoritativeServer {
         this.onTickComplete.send1(sim_frame);
     }
 
+    /**
+     * The frame opened by {@link begin_tick} and not yet closed by {@link end_tick}, or -1.
+     * @returns {number}
+     */
+    get open_frame() {
+        return this.#open_sim_frame;
+    }
+
     /**
      * Current input-buffer depth for a peer: `max_received_frame - current_sim_frame`.
      * Positive ⇒ peer is sending ahead of sim (good); zero/negative ⇒
@@ -597,15 +740,27 @@ export class ServerAuthoritativeServer {
     }
 
     /**
-     * Execute frame `f`: its history, its pending input and — when `fresh`,
-     * meaning this is the first time the frame is simulated — the
-     * locally-authored queue, merged and sorted, then the local sim.
+     * Execute frame `f` whole: {@link #open_frame} then {@link #close_frame}.
      *
      * @param {number} f
      * @param {boolean} fresh
      * @private
      */
     #replay_frame(f, fresh) {
+        this.#open_frame(f, fresh);
+        this.#close_frame(f, fresh);
+    }
+
+    /**
+     * Open frame `f` and apply its input: its history, its pending input and — when `fresh`,
+     * meaning this is the first time the frame is simulated — the locally-authored queue, merged
+     * and sorted.
+     *
+     * @param {number} f
+     * @param {boolean} fresh
+     * @private
+     */
+    #open_frame(f, fresh) {
         this.#sort_scratch.length = 0;
 
         // Read historical actions out of action_log[f] BEFORE begin_frame(f)
@@ -671,13 +826,22 @@ export class ServerAuthoritativeServer {
         // appearing before newly-arrived pending entries for the same sender.
         this.#sort_scratch.sort((a, b) => a.sender_id - b.sender_id);
 
-        // Open the frame, execute all, close.
+        // Open the frame, execute all.
         this.action_log.begin_frame(f);
         for (let i = 0; i < this.#sort_scratch.length; i++) {
             const s = this.#sort_scratch[i];
             this.#apply_payload(s.type_id, s.sender_id, s.payload);
         }
+    }
 
+    /**
+     * Run the local sim for the open frame `f` and close it.
+     *
+     * @param {number} f
+     * @param {boolean} fresh the frame is being simulated for the first time
+     * @private
+     */
+    #close_frame(f, fresh) {
         // Notify user code so server-side local sim runs at the right point in
         // the frame: after all input for the frame is applied, before the frame
         // is closed.
@@ -695,10 +859,53 @@ export class ServerAuthoritativeServer {
         } finally {
             this.executor.deriving = false;
         }
+        if (fresh) {
+            this.onBeforeTickClose.send1(f);
+        } else {
+            this.#record_carried();
+        }
         this.action_log.end_frame();
     }
 
-    /** @private */
+    /**
+     * Write the replayed frame's carried records back into it, where they stood: after the local
+     * sim, as the frame closes.
+     * @private
+     */
+    #record_carried() {
+        const carried = this.#carried_scratch;
+
+        for (let i = 0; i < carried.length; i++) {
+            const { type_id, payload } = carried[i];
+
+            const klass = this.action_registry.klass_for(type_id);
+            if (klass === undefined) continue;
+
+            const action = this.action_registry.acquire(klass);
+            try {
+                if (this.#payload_buf.raw_bytes.length < payload.length) {
+                    this.#payload_buf.setCapacity(payload.length);
+                }
+                this.#payload_buf.position = 0;
+                this.#payload_buf.writeBytes(payload, 0, payload.length);
+                this.#payload_buf.position = 0;
+                action.deserialize(this.#payload_buf);
+                this.executor.record(action);
+            } finally {
+                this.action_registry.release(action);
+            }
+        }
+
+        carried.length = 0;
+    }
+
+    /**
+     * Apply one input record. One that fails — a malformed payload, an action whose `apply` throws
+     * — is reported and passed over: the executor leaves nothing of it behind, and the rest of the
+     * frame's input, and the frame itself, go ahead. Letting it escape would leave the frame open
+     * with nothing left to close it.
+     * @private
+     */
     #apply_payload(type_id, sender_id, payload) {
         const klass = this.action_registry.klass_for(type_id);
         if (klass === undefined) return;
@@ -712,6 +919,8 @@ export class ServerAuthoritativeServer {
             this.#payload_buf.position = 0;
             action.deserialize(this.#payload_buf);
             this.executor.execute(action, sender_id);
+        } catch (e) {
+            console.error(`ServerAuthoritativeServer: input '${klass.action_type_name ?? klass.name}' from sender ${sender_id} failed to apply and was skipped:`, e);
         } finally {
             this.action_registry.release(action);
         }
@@ -720,6 +929,7 @@ export class ServerAuthoritativeServer {
     /** @private */
     #read_historical(frame_number, out_array) {
         out_array.length = 0;
+        this.#carried_scratch.length = 0;
         if (!this.action_log.has_frame(frame_number)) return;
         const cursor = this.#cursor;
         cursor.open(this.action_log, frame_number);
@@ -734,6 +944,14 @@ export class ServerAuthoritativeServer {
 
             const payload = new Uint8Array(cursor.payload_len);
             payload.set(bytes.subarray(cursor.payload_start, cursor.payload_start + cursor.payload_len));
+
+            // A record of what the engine's systems produced — the host publishing its physics, say.
+            // Neither input to reapply nor output the replay recomputes: carried over as it is.
+            if (cursor.sender_id === SENDER_RECORDED) {
+                this.#carried_scratch.push({ type_id: cursor.action_type_id, payload });
+                continue;
+            }
+
             out_array.push({ type_id: cursor.action_type_id, sender_id: cursor.sender_id, payload });
         }
     }
@@ -807,6 +1025,12 @@ export class ServerAuthoritativeServer {
             return;
         }
 
+        // And against input already folded into a later frame, which the log holds at that later
+        // frame and so the check above cannot see.
+        if (this.#was_folded(frame_number, sender_id, type_id, payload)) {
+            return;
+        }
+
         this.#pending_frames.push(frame_number);
         this.#pending_senders.push(sender_id);
         this.#pending_type_ids.push(type_id);
@@ -851,6 +1075,63 @@ export class ServerAuthoritativeServer {
         }
     }
 
+    /**
+     * {@link LateInput.Apply}: move every pending entry tagged for a frame before `sim_frame` into
+     * `sim_frame`, remembering where it came from.
+     * @param {number} sim_frame
+     * @private
+     */
+    #pending_fold_late_into(sim_frame) {
+        const frames = this.#pending_frames;
+        let folded_any = false;
+
+        for (let i = 0; i < frames.length; i++) {
+            const frame = frames[i];
+            if (frame >= sim_frame) continue;
+
+            let list = this.#folded.get(frame);
+            if (list === undefined) {
+                list = [];
+                this.#folded.set(frame, list);
+            }
+            list.push({
+                sender_id: this.#pending_senders[i],
+                type_id: this.#pending_type_ids[i],
+                payload: this.#pending_payloads[i],
+            });
+
+            frames[i] = sim_frame;
+            folded_any = true;
+        }
+
+        if (folded_any) {
+            this.#pending_referenced_frames.length = 0;
+            for (const f of frames) {
+                this.#track_referenced_frame(f);
+            }
+        }
+    }
+
+    /**
+     * @param {number} frame_number
+     * @param {number} sender_id
+     * @param {number} type_id
+     * @param {Uint8Array} payload
+     * @returns {boolean}
+     * @private
+     */
+    #was_folded(frame_number, sender_id, type_id, payload) {
+        const list = this.#folded.get(frame_number);
+        if (list === undefined) return false;
+        for (let i = 0; i < list.length; i++) {
+            const f = list[i];
+            if (f.sender_id === sender_id && f.type_id === type_id && fastArrayEquals(f.payload, payload)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     /** @private */
     #pending_clear() {
         this.#pending_frames.length = 0;

package/src/engine/network/replication/Replicator.d.ts

@@ -65,12 +65,19 @@ export class Replicator {
      * `skipped_duplicate` is the healthy counterpart — the action stream's own redundancy arriving
      * and being correctly ignored — and is expected to be large.
      *
+     * `payload_desync` counts actions whose `deserialize` left the read cursor somewhere other
+     * than the end of the payload the sender declared. The reader puts the cursor back, so the
+     * rest of the packet survives, but a non-zero count means a registered action's serialize and
+     * deserialize disagree — a version skew in the lobby, or an adapter-symmetry bug — and that
+     * action's own fields are whatever the short or long read made of them. It should be zero.
+     *
      * @param {number} peer_id
-     * @returns {{skipped_unapplied: number, skipped_duplicate: number}}
+     * @returns {{skipped_unapplied: number, skipped_duplicate: number, payload_desync: number}}
      */
     delivery_stats(peer_id: number): {
         skipped_unapplied: number;
         skipped_duplicate: number;
+        payload_desync: number;
     };
     /**
      * Fired after each per-frame action group is fully applied via

package/src/engine/network/replication/Replicator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Replicator.d.ts","sourceRoot":"","sources":["../../../../../src/engine/network/replication/Replicator.js"],"names":[],"mappings":"AAqBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH;IAsKI;;;;;;;;OAQG;IACH,iFARW;QACV,UAAc,YAAY;QAC1B,eAAmB,oBAAoB;QACvC,QAAY,oBAAoB;QAChC,UAAc,uBAAuB;QACrC,YAAgB,EAAE;YAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;KACpF,EA6BH;IAjID;;;;;;;;;;;;;;;OAeG;IACH,wBAHW,MAAM,GACJ;QAAC,iBAAiB,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAC,CAUlE;IA0BD;;;;;;;;;;;;;OAaG;IACH,gBAFU,MAAM,CAEc;IAE9B;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAFU,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAEvI;IAmBrB;;OAEG;IACH,sBAA4B;IAE5B;;OAEG;IACH,mCAAsC;IAEtC;;OAEG;IACH,4BAAwB;IAExB;;OAEG;IACH,iCAA4B;IAE5B;;;;OAIG;IACH,cAFU;QAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAE9C;IAGpC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,uBAVW,MAAM,eACN,MAAM,aACN,MAAM,cACN,YAAY,cACZ,MAAM,GACJ,MAAM,CA4ElB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,0BALW,MAAM,aACN,YAAY,iBACZ,MAAM,UACN;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAC,GAAC,IAAI,QAoEtE;IAuPD;;;;;;;OAOG;IACH,qBAFW,MAAM,QAKhB;;CA8CJ;mBA3uBkB,uCAAuC;6BAD7B,sCAAsC"}
+{"version":3,"file":"Replicator.d.ts","sourceRoot":"","sources":["../../../../../src/engine/network/replication/Replicator.js"],"names":[],"mappings":"AAqBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH;IAiLI;;;;;;;;OAQG;IACH,iFARW;QACV,UAAc,YAAY;QAC1B,eAAmB,oBAAoB;QACvC,QAAY,oBAAoB;QAChC,UAAc,uBAAuB;QACrC,YAAgB,EAAE;YAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;KACpF,EA6BH;IA5ID;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,wBAHW,MAAM,GACJ;QAAC,iBAAiB,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAC,CAc1F;IA2BD;;;;;;;;;;;;;OAaG;IACH,gBAFU,MAAM,CAEc;IAE9B;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAFU,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAEvI;IAmBrB;;OAEG;IACH,sBAA4B;IAE5B;;OAEG;IACH,mCAAsC;IAEtC;;OAEG;IACH,4BAAwB;IAExB;;OAEG;IACH,iCAA4B;IAE5B;;;;OAIG;IACH,cAFU;QAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAE9C;IAGpC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,uBAVW,MAAM,eACN,MAAM,aACN,MAAM,cACN,YAAY,cACZ,MAAM,GACJ,MAAM,CAiFlB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,0BALW,MAAM,aACN,YAAY,iBACZ,MAAM,UACN;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAC,GAAC,IAAI,QAoEtE;IAmRD;;;;;;;OAOG;IACH,qBAFW,MAAM,QAKhB;;CA8CJ;mBAvxBkB,uCAAuC;6BAD7B,sCAAsC"}

package/src/engine/network/replication/Replicator.js

@@ -122,7 +122,7 @@ export class Replicator {
      * holding is the common case, and counting a held frame as lost buries the real losses under
      * a number twenty times larger that grows with the length of the session.
      *
-     * @type {Map<number, {applied: Int32Array, skipped_unapplied: number, skipped_duplicate: number}>}
+     * @type {Map<number, {applied: Int32Array, skipped_unapplied: number, skipped_duplicate: number, payload_desync: number}>}
      * @private
      */
     #delivery = new Map();
@@ -140,22 +140,32 @@ export class Replicator {
      * `skipped_duplicate` is the healthy counterpart — the action stream's own redundancy arriving
      * and being correctly ignored — and is expected to be large.
      *
+     * `payload_desync` counts actions whose `deserialize` left the read cursor somewhere other
+     * than the end of the payload the sender declared. The reader puts the cursor back, so the
+     * rest of the packet survives, but a non-zero count means a registered action's serialize and
+     * deserialize disagree — a version skew in the lobby, or an adapter-symmetry bug — and that
+     * action's own fields are whatever the short or long read made of them. It should be zero.
+     *
      * @param {number} peer_id
-     * @returns {{skipped_unapplied: number, skipped_duplicate: number}}
+     * @returns {{skipped_unapplied: number, skipped_duplicate: number, payload_desync: number}}
      */
     delivery_stats(peer_id) {
         const d = this.#delivery.get(peer_id);
 
         if (d === undefined) {
-            return { skipped_unapplied: 0, skipped_duplicate: 0 };
+            return { skipped_unapplied: 0, skipped_duplicate: 0, payload_desync: 0 };
         }
 
-        return { skipped_unapplied: d.skipped_unapplied, skipped_duplicate: d.skipped_duplicate };
+        return {
+            skipped_unapplied: d.skipped_unapplied,
+            skipped_duplicate: d.skipped_duplicate,
+            payload_desync: d.payload_desync
+        };
     }
 
     /**
      * @param {number} peer_id
-     * @returns {{applied: Int32Array, skipped_unapplied: number, skipped_duplicate: number}}
+     * @returns {{applied: Int32Array, skipped_unapplied: number, skipped_duplicate: number, payload_desync: number}}
      * @private
      */
     #delivery_state(peer_id) {
@@ -168,7 +178,8 @@ export class Replicator {
                 // -1 is "no frame has occupied this slot"; frame numbers are non-negative
                 applied: new Int32Array(capacity).fill(-1),
                 skipped_unapplied: 0,
-                skipped_duplicate: 0
+                skipped_duplicate: 0,
+                payload_desync: 0
             };
 
             this.#delivery.set(peer_id, d);
@@ -305,6 +316,11 @@ export class Replicator {
             cursor.open(this.action_log, frame);
             let in_scope_count = 0;
             while (cursor.next()) {
+                // Never send a peer its own record back. Arrived records are logged like any other,
+                // so without this a client's outbound stream carries the host's state straight
+                // back to it — harmless where ownership rejects it, and the host overwriting its own
+                // simulation with a stale copy of itself where the entity belongs to the client.
+                if (cursor.sender_id === peer_id) continue;
                 if (!this.#record_in_scope(cursor, peer_id)) continue;
                 if ((in_scope_count + 1) * 3 > this.#in_scope_actions.length) {
                     this.#grow_in_scope_actions();
@@ -546,6 +562,28 @@ export class Replicator {
                         continue;
                     }
 
+                    /*
+                     The declared length is the authority on where this action ends, and the cursor
+                     is put back to it whatever deserialize did.
+
+                     It used to be left wherever deserialize stopped. An action whose serialize and
+                     deserialize are asymmetric by one byte — a version skew between peers, an
+                     optional field written but not read — desynchronised the cursor for every
+                     remaining action in the packet and every remaining frame group. The next header
+                     read lands mid-payload, so a garbage type id either resolves to the WRONG
+                     registered class, applying the rest of the packet as a different action against
+                     real entities, or falls into the unknown-action branch above and skips a length
+                     read out of payload bytes. The overrun guards only catch a garbage length large
+                     enough to run past the end of the packet; a small one passes and applies wrong
+                     state silently. The local side's ActionRecordCursor already advances by the
+                     declared length; the receive path was the odd one out.
+
+                     Counted, not silent: a non-zero payload_desync in delivery_stats means a
+                     registered action's two halves disagree, and that action's own fields are
+                     whatever the short or long read made of them.
+                    */
+                    const payload_start = in_buffer.position;
+
                     const action = registry.acquire(klass);
                     try {
                         action.deserialize(in_buffer);
@@ -554,6 +592,12 @@ export class Replicator {
                         this.executor.execute(action, peer_id);
                     } finally {
                         registry.release(action);
+
+                        if (in_buffer.position !== payload_start + action_payload_len) {
+                            this.#delivery_state(peer_id).payload_desync++;
+
+                            in_buffer.position = payload_start + action_payload_len;
+                        }
                     }
                 }
             } finally {

package/src/engine/network/sim/ActionLog.d.ts

@@ -27,12 +27,15 @@
  * `sender_id` says where the record came from, which is what a rollback replay
  * needs in order to decide what to do with it:
  *
- *   - a peer id `[0, 253]` — arrived from that peer;
+ *   - a peer id `[0, 252]` — arrived from that peer;
  *   - `SENDER_LOCAL` (255) — authored on this peer;
  *   - `SENDER_DERIVED` (254) — computed by this peer's simulation from the
  *     frame's own state. A replay of the frame recomputes these rather than
  *     reapplying them (see `ServerAuthoritativeServer.__read_historical`), so
- *     the sim's output does not accumulate a copy per replay.
+ *     the sim's output does not accumulate a copy per replay;
+ *   - `SENDER_RECORDED` (253) — recorded, not executed: what this peer's world
+ *     became, for the peers (see `SimActionExecutor.record`). A replay carries
+ *     these over unchanged.
  *
  * It also gives the replay a stable sort key, so multi-client action order is
  * deterministic across peers. It never crosses the wire —

package/src/engine/network/sim/ActionLog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ActionLog.d.ts","sourceRoot":"","sources":["../../../../../src/engine/network/sim/ActionLog.js"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH;IAoBI;;OAEG;IACH,qDAFW;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,EAIlE;IAED;;;OAGG;IACH,6BAEC;IAED;;;;OAIG;IACH,mBAFW,MAAM,QAShB;IAED;;OAEG;IACH,kBASC;IAED;;;;;;OAMG;IACH,kBAFa,OAAO,CAInB;IAED;;;;OAIG;IACH,+BAMC;IAED;;;;;OAKG;IACH,iBAHW,MAAM,GACJ,OAAO,CAInB;IAED;;;;;;;;;;;OAWG;IACH,kBAHW,MAAM,gBAKhB;IAED;;;;OAIG;IACH,qBAHW,MAAM,GACJ,MAAM,CAIlB;;CACJ"}
+{"version":3,"file":"ActionLog.d.ts","sourceRoot":"","sources":["../../../../../src/engine/network/sim/ActionLog.js"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH;IAoBI;;OAEG;IACH,qDAFW;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,EAIlE;IAED;;;OAGG;IACH,6BAEC;IAED;;;;OAIG;IACH,mBAFW,MAAM,QAShB;IAED;;OAEG;IACH,kBASC;IAED;;;;;;OAMG;IACH,kBAFa,OAAO,CAInB;IAED;;;;OAIG;IACH,+BAMC;IAED;;;;;OAKG;IACH,iBAHW,MAAM,GACJ,OAAO,CAInB;IAED;;;;;;;;;;;OAWG;IACH,kBAHW,MAAM,gBAKhB;IAED;;;;OAIG;IACH,qBAHW,MAAM,GACJ,MAAM,CAIlB;;CACJ"}