@woosh/meep-engine 3.46.0 → 3.49.0

package/src/engine/network/orchestrator/NetworkPeer.js

@@ -2,7 +2,6 @@ import { assert } from "../../../core/assert.js";
 import { BinaryBuffer } from "../../../core/binary/BinaryBuffer.js";
 import Signal from "../../../core/events/signal/Signal.js";
 import { MalformedPacketError } from "../core/MalformedPacketError.js";
-import { seq16_advance } from "../core/sequence/seq16.js";
 import { Replicator } from "../replication/Replicator.js";
 import { AlwaysRelevantScope } from "../replication/ScopeFilter.js";
 import { ActionLog } from "../sim/ActionLog.js";
@@ -14,12 +13,9 @@ import { Baseline } from "../state/Baseline.js";
 import { ChangedEntitySet } from "../state/ChangedEntitySet.js";
 import { MutationLedger } from "../state/MutationLedger.js";
 import { ReplicationSlotTable } from "../state/ReplicationSlotTable.js";
-import { Channel } from "../transport/Channel.js";
-import { fragment_chunk_count, resend_fragment_chunk, send_fragmented } from "../transport/fragments/fragment_send.js";
-import { FragmentAssembler } from "../transport/fragments/FragmentAssembler.js";
-import { FragmentRetention } from "../transport/fragments/FragmentRetention.js";
-import { MAX_CHANNEL_PAYLOAD_BYTES, MAX_CHUNKS_PER_MESSAGE } from "../transport/fragments/packet_size.js";
-import { ReliableCommandPipeline } from "../transport/ReliableCommandPipeline.js";
+import { Connection, Lane } from "../transport/connection/Connection.js";
+import { PendingSlices } from "./PendingSlices.js";
+import { ReliableFrames } from "./ReliableFrames.js";
 
 // DISCONNECT packets carry a short UTF-8 reason label. The encoder/decoder
 // pair are stateless after construction; sharing module-level singletons
@@ -73,42 +69,18 @@ export const NetworkPacketType = {
      * like this at frame F."
      */
     AUTH_STATE: 3,
+    // 4 was FRAGMENT: messages of any size are the connection's business now
     /**
-     * One chunk of a fragmented logical payload. Used transparently by the
-     * peer when an outgoing message exceeds the channel's single-packet
-     * capacity. The fragment header (uint16 message_id, uint8 chunk_index,
-     * uint8 total_chunks) follows this type byte; the chunk payload follows
-     * that. The reassembled bytes are re-dispatched through this same
-     * switch (so any of the other packet types can be carried fragmented).
-     */
-    FRAGMENT: 4,
-    /**
-     * Reliable command. Carries a uintVar logical_seq followed by a
-     * caller-defined payload. Delivered at-least-once with sender-side
-     * retransmit and receiver-side dedup via {@link ReliableCommandPipeline}.
-     * Used for chat, level transitions, lobby state — anything where
+     * Reliable command: a caller-defined payload, on the connection's USER lane. Arrives once, in
+     * order with the other commands. For chat, level transitions, lobby state — anything where
      * loss-tolerance of the action-stream model isn't acceptable.
      */
     RELIABLE_COMMAND: 5,
-    /**
-     * Selective-retransmit request from the receiver of a fragmented
-     * message. Wire layout (after the leading type byte):
-     *
-     *   uint16  message_id (LE)
-     *   uint8   missing_count
-     *   uint8   missing_indices[missing_count]
-     *
-     * The sender's {@link FragmentRetention} looks up the retained
-     * source bytes and re-emits the listed chunks via
-     * {@link resend_fragment_chunk} — each chunk of the message once,
-     * however many times the list names it, and nothing for an index the
-     * message does not have. Receiver drives NACK timing
-     * via {@link FragmentAssembler#service}.
-     */
-    NACK_FRAGMENT: 6,
+    // 6 was NACK_FRAGMENT
     /**
      * Server → client time-dilation feedback. Wire layout:
      *   int16  buffer_depth (LE)
+     *   varint frame_number   the server's sim frame as it sent this
      *
      * `buffer_depth = max_received_frame - current_sim_frame` from the
      * server's POV. Client feeds it to {@link TimeDilation} and dilates
@@ -116,15 +88,18 @@ export const NetworkPacketType = {
      */
     TIME_DILATION: 7,
     /**
-     * Server → newly-connected peer initial-state snapshot. Wire layout:
+     * Server → joining peer: one page of the world. Wire layout:
      *   16 bytes  session_token  (UUID v1, identifies this peer-session
      *                             for later RESUME_HELLO authentication)
-     *   varint    frame_number   (server sim_frame this snapshot represents)
-     *   bytes     payload        (Snapshotter wire format)
+     *   varint    frame_number   (server sim_frame the page's state is from)
+     *   uint8     flags          ({@link InitialSyncPage})
+     *   uint32    entity_count
+     *   bytes     entities       (Snapshotter entity records)
      *
-     * Typically exceeds MTU; fragment-send handles chunking. Sent more than
-     * once, against loss: a client applies the first to reach it on a
-     * connection, and takes the rest for the copies they are.
+     * A join is a run of pages on the connection's BULK lane, each built when
+     * it is sent: the world once, then what changed while it was going out,
+     * then an empty FINAL page that names the frame the action stream resumes
+     * after. The first page carries FIRST.
      */
     INITIAL_SYNC: 8,
     /**
@@ -183,6 +158,18 @@ export const NetworkPacketType = {
     FRAME_MARKER: 13,
 };
 
+/**
+ * Flags of an INITIAL_SYNC page.
+ * @readonly
+ * @enum {number}
+ */
+export const InitialSyncPage = Object.freeze({
+    /** The first page of a join: it issues the session token, and replaces the receiver's world. */
+    FIRST: 1,
+    /** The last page: every entity's state at its frame is now with the receiver. */
+    FINAL: 2,
+});
+
 /**
  * Reason codes for {@link NetworkPacketType.RESUME_REJECT}.
  * @readonly @enum {number}
@@ -211,40 +198,20 @@ export const ResumeRejectReason = Object.freeze({
     NoSessionToken: 5,
 });
 
-/**
- * One outbound action-stream send, awaiting confirmation.
- *
- * A send occupies one transport seq when it fits the MTU and N consecutive
- * seqs when it has to be fragmented. All of those seqs map to the SAME record:
- * the receiver reassembles a fragmented message all-or-nothing, so the frame
- * range is confirmed only when `unacked` reaches zero without `abandoned`
- * having been set by a loss along the way.
- *
- * A tick may make several sends to one peer, each carrying the next slice of
- * the owed range (see {@link NetworkPeer#flush_outbound}). They confirm
- * independently, and the baseline advances only through slices confirmed in
- * order — a later slice landing says nothing about an earlier one still in
- * flight. `head` marks the first slice of a tick, whose start is the pack
- * start itself; see {@link NetworkPeer#__credit_confirmed}.
- *
- * @typedef {{frame_start: number, frame_end: number, head: boolean, unacked: number, abandoned: boolean}} PendingAck
- * @property {number} frame_start first frame in the packed range
- * @property {number} frame_end   last frame in the packed range
- * @property {boolean} head       this send began at the pack start, so nothing
- *   sendable lies before it and its confirmation credits outright
- * @property {number} unacked     seqs of this send not yet acked or declared lost
- * @property {boolean} abandoned  at least one seq was declared lost, so the
- *   message is forfeit and must never advance the baseline
- */
-
 /**
  * Per-tick orchestrator that wires the action infrastructure to one or more
  * peers over a Transport.
  *
  * Holds a single world (`EntityComponentDataset`) plus the action machinery
  * (executor, replicator, action log). For each connected peer it owns a
- * `Channel` and a `seq` → {@link PendingAck} map so that ack notifications
- * advance the `Baseline.last_acked(peer_id)` watermark.
+ * {@link Connection} and the action-stream slices sent on it and not yet
+ * resolved ({@link PendingSlices}), so that their acknowledgements advance the
+ * `Baseline.last_acked(peer_id)` watermark.
+ *
+ * Every `send_*` queues; nothing reaches a transport until {@link send_queued}
+ * (or {@link flush_peer}), which {@link end_tick} calls last. One tick's
+ * traffic to a peer thereby leaves together, packed into as few datagrams as
+ * fit.
  *
  * Use as both server (many connected peers) and client (one peer = the server).
  * The asymmetry is in *who* connects — the orchestrator itself is symmetric.
@@ -255,9 +222,9 @@ export const ResumeRejectReason = Object.freeze({
  *      - `begin_tick(frame_number)` — open the action log for this frame.
  *      - User code runs game logic, calling `executor.execute(action)` for each
  *        replicated state mutation. Inbound actions from peers also flow into
- *        the executor automatically (via the channel.onPayload wiring).
+ *        the executor automatically (via the connection's onMessage wiring).
  *      - `end_tick()` — close the frame and dispatch outgoing packets to every peer.
- *   3. `disconnect_peer(peer_id)` — release the channel + baseline state.
+ *   3. `disconnect_peer(peer_id)` — release the connection + baseline state.
  *
  * @author Alex Goldring
  * @copyright Company Named Limited (c) 2026
@@ -267,17 +234,35 @@ export class NetworkPeer {
     #peers;
     #send_buffer;
     #recv_buffer;
-    #fragment_scratch;
+    /** @type {function(): number} */
+    #clock;
     /**
-     * Monotonically-increasing identifier for fragmented messages.
-     * Wraps at uint16. The receiver's FragmentAssembler keys reassembly
-     * state on this; collisions would only matter if more than 65536
-     * messages were in flight simultaneously, which is impossible
-     * under any realistic transport pressure.
-     * @type {number}
-     * @private
+     * Options every connection is made with; see the constructor.
+     * @type {{send_rate_bytes_per_second: number, max_message_bytes: number, receive_window_bytes: number, max_queued_bytes: number, max_ack_delay_ms: number}}
      */
-    #next_fragment_message_id = 0;
+    #connection_options;
+    /**
+     * Frame each network id was last changed by an action this peer executed or applied, -1 for
+     * never. What a joining peer's catch-up compares the frame its state was sent at against.
+     * @type {Float64Array}
+     */
+    #last_changed = new Float64Array(256).fill(-1);
+    /** frame {@link #stamp_changed} writes */
+    #stamp_frame = 0;
+    /**
+     * Bound once: stamps one changed network id with {@link #stamp_frame}.
+     * @type {function(number): void}
+     */
+    #stamp_changed = (network_id) => {
+        if (network_id >= this.#last_changed.length) {
+            let size = this.#last_changed.length * 2;
+            while (size <= network_id) size *= 2;
+            const next = new Float64Array(size).fill(-1);
+            next.set(this.#last_changed);
+            this.#last_changed = next;
+        }
+        this.#last_changed[network_id] = this.#stamp_frame;
+    };
     /** @type {boolean} @private */
     #tick_open = false;
     #current_frame;
@@ -291,16 +276,6 @@ export class NetworkPeer {
      */
     #malformed_packets_dropped = 0;
 
-    /**
-     * Scratch list of the transport seqs one send produced — one entry for a
-     * single-packet send, one per fragment for a fragmented one. Reused across
-     * sends so the common path allocates nothing; only valid until the next
-     * `__send_to_peer` call.
-     * @type {number[]}
-     * @private
-     */
-    #sent_seqs = [];
-
     /**
      * Scratch for the slice header of the ACTION_STREAM packet being
      * dispatched, handed to `Replicator.unpack_from_peer`, which copies what
@@ -310,14 +285,6 @@ export class NetworkPeer {
      */
     #slice = { frame_start: 0, frame_end: 0, head: false };
 
-    /**
-     * Scratch for the NACK_FRAGMENT being dispatched: 1 at a chunk index the
-     * NACK has already had re-sent. Only valid for the duration of that case.
-     * @type {Uint8Array}
-     * @private
-     */
-    #nack_requested = new Uint8Array(MAX_CHUNKS_PER_MESSAGE);
-
     /**
      * @param {{
      *   world: EntityComponentDataset,
@@ -331,7 +298,18 @@ export class NetworkPeer {
      *   mutation_ledger_retention_frames?: number,
      *   changed_set_capacity?: number,
      *   max_packets_per_tick?: number,
+     *   clock: function(): number,
+     *   tick_period_ms: number,
+     *   send_rate_bytes_per_second?: number,
+     *   max_message_bytes?: number,
+     *   receive_window_bytes?: number,
+     *   max_queued_bytes?: number,
      * }} options
+     *   `clock` returns milliseconds and never runs backwards: every network timer (loss, probe,
+     *   pacing) runs on it, and nothing in the stack reads a clock of its own. `tick_period_ms` is
+     *   how often this peer sends: the longest it sits on an acknowledgement, and the resolution
+     *   of its timers. The remaining four configure every {@link Connection}; see there.
+     *   `max_message_bytes` and `receive_window_bytes` must be the same on both ends.
      */
     constructor({
         world,
@@ -345,12 +323,30 @@ export class NetworkPeer {
         mutation_ledger_retention_frames = 600,
         changed_set_capacity = 256,
         max_packets_per_tick = 8,
+        clock,
+        tick_period_ms,
+        send_rate_bytes_per_second = 262144,
+        max_message_bytes = 1 << 20,
+        receive_window_bytes = 256 * 1024,
+        max_queued_bytes = 4 << 20,
     }) {
         assert.ok(world && typeof world.createEntity === 'function', 'world must be an EntityComponentDataset');
         assert.ok(binary_registry, 'binary_registry required');
         assert.isFunction(replicated_components.forEach, 'replicated_components must be iterable');
         assert.isFunction(action_classes.forEach, 'action_classes must be iterable');
         assert.isPositiveInteger(max_packets_per_tick, 'max_packets_per_tick');
+        assert.isFunction(clock, 'clock');
+        assert.isNumber(tick_period_ms, 'tick_period_ms');
+        assert.greaterThan(tick_period_ms, 0, 'tick_period_ms');
+
+        this.#clock = clock;
+        this.#connection_options = {
+            send_rate_bytes_per_second,
+            max_message_bytes,
+            receive_window_bytes,
+            max_queued_bytes,
+            max_ack_delay_ms: tick_period_ms,
+        };
 
         /** @type {EntityComponentDataset} */
         this.world = world;
@@ -384,17 +380,9 @@ export class NetworkPeer {
          * fit one packet; past that the owed range grows until it meets the
          * ring floor and frames are lost.
          *
-         * It is also the bandwidth ceiling under catch-up — this many MTUs per
-         * tick per peer — and it has to stay inside the channel's ack window.
-         * A peer's ack header covers its latest 33 seqs, so with a peer that
-         * replies once a tick, `33 / max_packets_per_tick` consecutive lost
-         * replies leave a delivered packet outside the window and it is
-         * declared lost: a wasted re-send rather than a defect, since the
-         * receiver skips frames it has already applied. Eight tolerates three
-         * such losses in a row (one tick in sixteen at 50% loss, one in ten
-         * thousand at 10%), and lets a 60 Hz stream at 100 ms RTT carry a full
-         * packet of actions per frame. Lower it for peers that reply less often
-         * than every tick.
+         * It is also the bandwidth ceiling under catch-up — this many datagrams
+         * of actions per tick per peer. Eight lets a 60 Hz stream at 100 ms RTT
+         * carry a full datagram of actions per frame.
          *
          * @type {number}
          */
@@ -424,15 +412,13 @@ export class NetworkPeer {
         this.mutation_ledger_retention_frames = mutation_ledger_retention_frames;
 
         /**
-         * Per-tick "what mutated this tick" sink, used only when
-         * {@link mutation_ledger} is set. Cleared at the start of each tick;
-         * compacted into the ledger at end-of-tick.
-         * @type {ChangedEntitySet|null}
+         * Per-tick "what mutated this tick" sink. Cleared at the start of each tick; at its end,
+         * folded into {@link #last_changed} and, when a {@link mutation_ledger} is set, compacted
+         * into the ledger.
+         * @type {ChangedEntitySet}
          * @private
          */
-        this.#changed_entities = mutation_ledger === null
-            ? null
-            : new ChangedEntitySet({ capacity: changed_set_capacity });
+        this.#changed_entities = new ChangedEntitySet({ capacity: changed_set_capacity });
 
         /** @type {SimActionExecutor} */
         this.executor = new SimActionExecutor({
@@ -457,8 +443,8 @@ export class NetworkPeer {
         this.baseline = new Baseline();
 
         /**
-         * peer_id → { channel, transport, seq_to_pending, confirmed, on_payload, on_acked }
-         * @type {Map<number, { channel: Channel, transport: Object, seq_to_pending: Map<number, PendingAck>, confirmed: Int32Array, on_payload: Function, on_acked: Function }>}
+         * peer_id → its connection and action-stream bookkeeping.
+         * @type {Map<number, { connection: Connection, transport: Object, pending: PendingSlices, confirmed: Int32Array, on_receive: Function, inbound_count: number, outbound_floor: number, reliable_frames: ReliableFrames }>}
          * @private
          */
         this.#peers = new Map();
@@ -478,14 +464,6 @@ export class NetworkPeer {
          */
         this.#recv_buffer = new BinaryBuffer();
 
-        /**
-         * Reusable scratch buffer for outgoing fragment packets. Sized for one
-         * channel-level packet (MTU minus channel header).
-         * @type {Uint8Array}
-         * @private
-         */
-        this.#fragment_scratch = new Uint8Array(MAX_CHANNEL_PAYLOAD_BYTES);
-
         /**
          * Fired when an inbound packet is dropped as malformed. Args:
          * `(peer_id, error)`. Lets callers log / rate-limit / disconnect an
@@ -495,6 +473,26 @@ export class NetworkPeer {
          */
         this.onMalformedPacket = new Signal();
 
+        /**
+         * The connection to a peer is no longer whole: `(peer_id, reason)`. Its connection said so
+         * (Connection.onProtocolError: a reliable lane broke its limits and stopped, or the peer
+         * acknowledged a packet never sent), or more of the peer's action stream arrived during
+         * {@link hold_inbound} than may be held. Nothing more can be trusted to arrive whole on it:
+         * give the connection up.
+         * @type {Signal}
+         */
+        this.onProtocolError = new Signal();
+
+        /**
+         * An action-stream frame larger than any message the connection may carry
+         * (`max_message_bytes`) was given up rather than sent: `(peer_id, frame_start, frame_end,
+         * bytes)`. It can never be delivered, so it is stepped over — the peer never applies it —
+         * and the stream goes on behind it. Raise `max_message_bytes` on both ends for frames that
+         * large.
+         * @type {Signal}
+         */
+        this.onFrameTooLarge = new Signal();
+
         /**
          * Fired when an inbound packet is a `RECOVERY_REQUEST` (peer is asking
          * which entities mutated in a tick range so it can request their state).
@@ -528,7 +526,8 @@ export class NetworkPeer {
 
         /**
          * Fires on TIME_DILATION packet arrival.
-         * Args: `(peer_id, buffer_depth)` — signed int16.
+         * Args: `(peer_id, buffer_depth, frame_number)` — signed int16, and the sender's sim frame
+         * as it sent it: the freshest word of where the host is, every tick.
          * @type {Signal}
          */
         this.onTimeDilationFeedback = new Signal();
@@ -540,10 +539,11 @@ export class NetworkPeer {
         this.onFrameMarker = new Signal();
 
         /**
-         * Fires on INITIAL_SYNC packet arrival.
-         * Args: `(peer_id, session_token, frame_number, buffer, payload_end)`.
-         * `session_token` is a `Uint8Array(16)` (UUID v1 raw bytes); the
-         * buffer is positioned at the start of the Snapshotter payload.
+         * Fires on each INITIAL_SYNC page.
+         * Args: `(peer_id, session_token, frame_number, flags, buffer, payload_end)`.
+         * `session_token` is a `Uint8Array(16)` (UUID v1 raw bytes); `flags`
+         * is {@link InitialSyncPage}; the buffer is positioned at the page's
+         * uint32 entity count.
          * @type {Signal}
          */
         this.onInitialSync = new Signal();
@@ -584,7 +584,7 @@ export class NetworkPeer {
 
         /**
          * Fired when a reliable command arrives from a peer (delivered via
-         * {@link ReliableCommandPipeline}, dedup'd against retransmits).
+         * the connection's USER lane, once and in order).
          *
          * Args: `(peer_id, buffer, payload_offset, payload_length)`. The
          * buffer is the per-peer scratch and may be reused after the handler
@@ -600,7 +600,7 @@ export class NetworkPeer {
     }
 
     /**
-     * Wire `transport` to the peer identified by `peer_id`. Creates a Channel
+     * Wire `transport` to the peer identified by `peer_id`. Creates a Connection
      * over the transport and connects ack/payload notifications to the local
      * Baseline / Replicator.
      *
@@ -616,69 +616,34 @@ export class NetworkPeer {
         // first rollback replay of its frame, so refuse the connection rather
         // than lose its input later. Real runtime check — asserts strip in prod.
         if (peer_id > MAX_PEER_ID) {
-            throw new Error(`NetworkPeer.connect_peer: peer id ${peer_id} is out of range; must be in [0, ${MAX_PEER_ID}] — 253, 254 and 255 are reserved provenance markers in the action log`);
+            throw new Error(`NetworkPeer.connect_peer: peer id ${peer_id} is out of range; must be in [0, ${MAX_PEER_ID}] — 252 to 255 are reserved provenance markers in the action log`);
         }
         if (this.#peers.has(peer_id)) {
             throw new Error(`NetworkPeer.connect_peer: peer ${peer_id} already connected`);
         }
 
-        const channel = new Channel({ transport });
-        const seq_to_pending = new Map();
+        const connection = new Connection({
+            transport,
+            clock: this.#clock,
+            ...this.#connection_options,
+        });
+        const pending = new PendingSlices();
         // Frames this peer has confirmed that the baseline has not reached yet,
         // because a slice before them is still in flight. A ring indexed by
         // frame modulo capacity holding the frame number — see
         // __credit_confirmed.
         const confirmed = new Int32Array(this.action_log.frame_capacity).fill(-1);
-        // The reassembly window is sized from the burst. A frame too big for
-        // one packet goes out as a fragmented slice, and a tick may send
-        // `max_packets_per_tick` of them; jitter that holds a message's later
-        // fragments behind the next ticks' first fragments leaves that many
-        // partial messages per tick in flight at once. The assembler evicts
-        // the oldest partial when its window is full, both fragments of the
-        // evicted message are still acked, and the sender credits the slice —
-        // a silent loss. Four ticks of burst keeps the window ahead of any
-        // jitter the NACK timer would not already have caught.
-        const fragment_assembler = new FragmentAssembler({
-            max_pending_messages: Math.max(8, 4 * this.max_packets_per_tick),
-        });
-        const fragment_retention = new FragmentRetention();
-        const reliable_pipeline = new ReliableCommandPipeline({
-            channel,
-            packet_type: NetworkPacketType.RELIABLE_COMMAND,
-        });
 
-        // Closure captured once at connect time so the per-tick service
-        // call doesn't allocate. Builds a NACK_FRAGMENT packet inside
-        // the orchestrator's shared __send_buffer and ships it over the
-        // peer's channel. `indices[0..count)` is a reused internal
-        // scratch from the assembler — only valid for the call.
-        const on_nack = (message_id, indices, count) => {
-            this.#send_buffer.position = 0;
-            this.#send_buffer.writeUint8(NetworkPacketType.NACK_FRAGMENT);
-            this.#send_buffer.writeUint16LE(message_id);
-            this.#send_buffer.writeUint8(count);
-            for (let i = 0; i < count; i++) {
-                this.#send_buffer.writeUint8(indices[i]);
-            }
-            channel.send(this.#send_buffer.raw_bytes, this.#send_buffer.position);
-        };
-        // Forward pipeline deliveries to the user-facing signal, attributing
-        // them to the originating peer.
-        reliable_pipeline.onCommand.add((buf, payload_offset, payload_length) => {
-            this.onReliableCommand.send4(peer_id, buf, payload_offset, payload_length);
-        });
-
-        // Recursive dispatch helper. Used for both incoming transport bytes
-        // AND for reassembled FRAGMENT payloads (so the same switch handles
-        // both transparent and fragmented delivery of any packet type).
-        const dispatch = (bytes, length) => {
+        // Every message the connection hands over, unreliable or from a lane, is one of
+        // NetworkPacketType: its first byte picks the path.
+        const dispatch = (bytes, offset, length) => {
             if (length < 1) {
                 // malformed: no type byte
                 return;
             }
 
             this.#recv_buffer.position = 0;
-            this.#recv_buffer.writeBytes(bytes, 0, length);
+            this.#recv_buffer.writeBytes(bytes, offset, length);
             this.#recv_buffer.position = 0;
 
             const packet_type = this.#recv_buffer.readUint8();
@@ -718,70 +683,14 @@ export class NetworkPeer {
                     this.onAuthState.send4(peer_id, frame_number, network_id, this.#recv_buffer);
                     break;
                 }
-                case NetworkPacketType.FRAGMENT: {
-                    // Fragment header layout (after the leading type byte):
-                    //   uint16 message_id (LE), uint8 chunk_index, uint8 total_chunks
-                    const message_id = this.#recv_buffer.readUint16LE();
-                    const chunk_index = this.#recv_buffer.readUint8();
-                    const total_chunks = this.#recv_buffer.readUint8();
-                    const chunk_offset = this.#recv_buffer.position;
-                    const chunk_length = length - chunk_offset;
-                    const reassembled = fragment_assembler.receive(
-                        message_id, chunk_index, total_chunks,
-                        bytes, chunk_offset, chunk_length,
-                    );
-                    if (reassembled !== null) {
-                        // Defence-in-depth: don't allow nested fragmentation
-                        // (would indicate a sender bug; ignore silently).
-                        if (reassembled[0] !== NetworkPacketType.FRAGMENT) {
-                            dispatch(reassembled, reassembled.length);
-                        }
-                    }
-                    break;
-                }
-                case NetworkPacketType.NACK_FRAGMENT: {
-                    // Receiver is asking for specific chunks of a
-                    // previously-sent fragmented message.
-                    //   uint16 message_id (LE), uint8 missing_count,
-                    //   uint8 missing_indices[missing_count]
-                    const message_id = this.#recv_buffer.readUint16LE();
-                    const missing_count = this.#recv_buffer.readUint8();
-                    const entry = fragment_retention.consume_nack(message_id);
-                    if (entry === null) {
-                        // Either we never retained this id (already evicted /
-                        // never sent), or the retry budget for it is exhausted.
-                        // Either way: nothing to retransmit. Drop silently.
-                        break;
-                    }
-                    // The list is the peer's word. A NACK re-sends each chunk
-                    // of the message at most once, and nothing for an index
-                    // the message does not have: what one costs is bounded by
-                    // the message we chose to send, not by what is asked. It
-                    // used to re-send a chunk as often as it was named — 255
-                    // times in one NACK, three NACKs for each INITIAL_SYNC.
-                    const total_chunks = fragment_chunk_count(entry.length);
-                    const requested = this.#nack_requested;
-                    requested.fill(0, 0, total_chunks);
-                    for (let i = 0; i < missing_count; i++) {
-                        const chunk_index = this.#recv_buffer.readUint8();
-                        if (chunk_index >= total_chunks || requested[chunk_index] !== 0) continue;
-                        requested[chunk_index] = 1;
-                        resend_fragment_chunk(
-                            entry.payload, entry.length, message_id, chunk_index,
-                            NetworkPacketType.FRAGMENT, this.#fragment_scratch,
-                            (chunk_bytes, chunk_length) => channel.send(chunk_bytes, chunk_length),
-                        );
-                    }
-                    break;
-                }
                 case NetworkPacketType.RELIABLE_COMMAND:
-                    // Pipeline reads logical_seq, dedups, fires its onCommand
-                    // (which we forward to the user's onReliableCommand above).
-                    reliable_pipeline.handle_inbound(this.#recv_buffer, length);
+                    // the payload is everything after the type byte
+                    this.onReliableCommand.send4(peer_id, this.#recv_buffer, 1, length - 1);
                     break;
                 case NetworkPacketType.TIME_DILATION: {
                     const depth = this.#recv_buffer.readInt16();
-                    this.onTimeDilationFeedback.send2(peer_id, depth);
+                    const frame_number = this.#recv_buffer.readUintVar();
+                    this.onTimeDilationFeedback.send3(peer_id, depth, frame_number);
                     break;
                 }
                 case NetworkPacketType.INITIAL_SYNC: {
@@ -791,7 +700,8 @@ export class NetworkPeer {
                     const session_token = new Uint8Array(16);
                     this.#recv_buffer.readBytes(session_token, 0, 16);
                     const frame_number = this.#recv_buffer.readUintVar();
-                    this.onInitialSync.send5(peer_id, session_token, frame_number, this.#recv_buffer, length);
+                    const flags = this.#recv_buffer.readUint8();
+                    this.onInitialSync.send6(peer_id, session_token, frame_number, flags, this.#recv_buffer, length);
                     break;
                 }
                 case NetworkPacketType.RESUME_HELLO: {
@@ -840,61 +750,45 @@ export class NetworkPeer {
             }
         };
 
-        // Ack: a send is confirmed once every seq it went out under has been
-        // acked. For a single-packet send that is the one seq. For a
-        // fragmented send it is all N fragments, because the receiver applies
-        // nothing until it has reassembled the whole message; advancing on the
-        // first fragment's ack would retire a frame range the receiver never
-        // saw, from the only mechanism that could still re-send it. What a
-        // confirmed send credits to the baseline is decided in order, by
-        // __credit_confirmed.
-        const on_acked = (seq) => {
-            const pending = seq_to_pending.get(seq);
-            if (pending === undefined) return;
-            seq_to_pending.delete(seq);
-            pending.unacked--;
-            if (pending.unacked === 0 && !pending.abandoned) {
-                this.#credit_confirmed(peer_id, confirmed, pending);
-            }
+        // A slice is one unreliable message, so one datagram: its acknowledgement is its delivery.
+        // What a delivered slice credits to the baseline is decided in order, by
+        // #credit_confirmed. A lost one credits nothing: the frames stay owed and the back-fill
+        // packs them again. Every slice is resolved exactly once, acked or lost.
+        const on_acked = (token) => {
+            this.#credit_confirmed(peer_id, confirmed, pending.frame_start(token), pending.frame_end(token), pending.head(token));
+            pending.release(token);
         };
-
-        // Loss: a packet that aged out of the ack window without being acked
-        // leaves a dead seq→record entry. The baseline must NOT advance (the
-        // frame range was never confirmed; the back-fill re-sends it under a
-        // fresh seq), and the record is marked abandoned so that siblings
-        // acking afterwards cannot complete it — one lost fragment forfeits the
-        // whole message. The mapping is reclaimed either way, otherwise
-        // lost-packet entries accumulate across the session until the seq value
-        // is reused on wrap.
-        //
-        // Every outstanding seq is resolved by Channel as exactly one of acked
-        // or lost — via the ack bitfield, the 33-seq window age-out, or the
-        // max_in_flight eviction — so no record can be stranded by a seq that
-        // never reports.
-        const on_lost = (seq) => {
-            const pending = seq_to_pending.get(seq);
-            if (pending === undefined) return;
-            seq_to_pending.delete(seq);
-            pending.unacked--;
-            pending.abandoned = true;
+        const on_lost = (token) => {
+            pending.release(token);
         };
 
         // Untrusted-input boundary. A structurally-malformed or truncated
-        // packet (truncated datagram, spoofed/corrupt bytes, mismatched peer
-        // build) is dropped and counted — the "discard the bad record, keep the
-        // connection" posture — rather than throwing out of the transport's
-        // receive callback and crashing the process. A RangeError is a
-        // BinaryBuffer read past its backing store, i.e. the same malformed-
-        // input symptom. Any OTHER error is a genuine bug in a packet handler
-        // and is rethrown so it is not silently swallowed.
-        const payload_handler = (bytes, length) => {
-            // Liveness: any packet that reaches dispatch — including empty-ack,
-            // and malformed ones dropped below — is evidence the peer/transport
-            // is alive. Bump the per-peer inbound counter idle-detection polls.
-            const conn = this.#peers.get(peer_id);
-            if (conn !== undefined) conn.inbound_count++;
+        // message (spoofed/corrupt bytes, mismatched peer build) is dropped and
+        // counted — the "discard the bad record, keep the connection" posture —
+        // rather than throwing out of the transport's receive callback and
+        // crashing the process. A RangeError is a BinaryBuffer read past its
+        // backing store, i.e. the same malformed-input symptom. Any OTHER error
+        // is a genuine bug in a packet handler and is rethrown so it is not
+        // silently swallowed.
+        const on_message = (bytes, offset, length) => {
+            const held = this.#peers.get(peer_id);
+            if (held !== undefined && held.inbound_held && length > 0) {
+                const type = bytes[offset];
+                if (type === NetworkPacketType.ACTION_STREAM || type === NetworkPacketType.AUTH_STATE) {
+                    // about a world this peer is still being given: kept for release_inbound
+                    if (held.inbound_held_bytes + length > this.#connection_options.max_queued_bytes) {
+                        // Dropped, it would be a frame missing from the stream for good: the
+                        // connection can no longer give this peer a whole world.
+                        this.onProtocolError.send2(peer_id, `held action stream past max_queued_bytes ${this.#connection_options.max_queued_bytes} while the world arrives`);
+                        return;
+                    }
+                    held.inbound_queue.push(bytes.slice(offset, offset + length));
+                    held.inbound_held_bytes += length;
+                    return;
+                }
+            }
             try {
-                dispatch(bytes, length);
+                dispatch(bytes, offset, length);
             } catch (e) {
                 if (e instanceof MalformedPacketError || e instanceof RangeError) {
                     this.#malformed_packets_dropped++;
@@ -905,23 +799,45 @@ export class NetworkPeer {
             }
         };
 
-        channel.onPayload.add(payload_handler);
-        channel.onPacketAcked.add(on_acked);
-        channel.onPacketLost.add(on_lost);
+        connection.onMessage.add(on_message);
+        connection.onMessageAcked.add(on_acked);
+        connection.onMessageLost.add(on_lost);
+        connection.onMalformedDatagram.add((reason) => {
+            this.#malformed_packets_dropped++;
+            this.onMalformedPacket.send2(peer_id, new MalformedPacketError(`NetworkPeer: datagram dropped: ${reason}`));
+        });
+        connection.onProtocolError.add((reason) => {
+            this.onProtocolError.send2(peer_id, reason);
+        });
 
-        this.#peers.set(peer_id, {
-            channel, transport, seq_to_pending, confirmed,
-            on_payload: payload_handler, on_acked, on_lost, on_nack,
-            fragment_assembler, fragment_retention,
-            reliable_pipeline,
+        // Liveness: any datagram at all — an ACK alone, a malformed one — is evidence the peer is
+        // there. Counted at the transport, ahead of the connection.
+        const conn = {
+            connection, transport, pending, confirmed,
+            on_receive: null,
             inbound_count: 0,
             // the first frame the action stream may carry to this peer; see hold_outbound
             outbound_floor: 0,
-        });
+            // action-stream frames too large for a datagram, in flight on Lane.FRAMES
+            reliable_frames: new ReliableFrames(),
+            // see hold_inbound
+            inbound_held: false,
+            /** @type {Uint8Array[]} */
+            inbound_queue: [],
+            inbound_held_bytes: 0,
+            on_message,
+        };
+        conn.on_receive = () => {
+            conn.inbound_count++;
+        };
+        transport.onReceive.add(conn.on_receive);
+
+        this.#peers.set(peer_id, conn);
     }
 
     /**
-     * Unwire and forget a peer.
+     * Unwire and forget a peer. Sends nothing: the transport may already be gone. To say a last
+     * word first — a DISCONNECT — queue it and call {@link flush_peer}.
      * @param {number} peer_id
      */
     disconnect_peer(peer_id) {
@@ -929,25 +845,11 @@ export class NetworkPeer {
         const conn = this.#peers.get(peer_id);
         if (conn === undefined) return;
 
-        conn.channel.onPayload.remove(conn.on_payload);
-        conn.channel.onPacketAcked.remove(conn.on_acked);
-        conn.channel.onPacketLost.remove(conn.on_lost);
-        // Drop the channel's subscription on the transport. Required for the
-        // common case of reusing the same transport on a subsequent reconnect:
-        // without this, the orphaned channel keeps consuming inbound packets
-        // and corrupts ack state in parallel with whatever channel replaces it.
-        conn.channel.dispose();
-
-        // Drop any in-flight fragment reassemblies for this peer — a fresh
-        // connection on the same peer_id should start clean.
-        conn.fragment_assembler.clear();
-        // Same for the sender-side retention buffer: nothing about the
-        // previous connection's retransmit history should leak across.
-        conn.fragment_retention.clear();
-
-        // Detach the reliable pipeline (drops its channel subscriptions and
-        // any unacked / received state).
-        conn.reliable_pipeline.dispose();
+        // Detach from the transport — it may be reused by the next connection on this peer id,
+        // and an orphaned connection would keep consuming its packets — and drop everything queued
+        // or in flight. Safe from inside the connection's own dispatch: it stops at the next message.
+        conn.transport.onReceive.remove(conn.on_receive);
+        conn.connection.dispose();
 
         this.#peers.delete(peer_id);
         this.baseline.forget(peer_id);
@@ -989,28 +891,27 @@ export class NetworkPeer {
     }
 
     /**
-     * Number of outbound action-stream seqs for `peer_id` still awaiting an
+     * Number of action-stream slices sent to `peer_id` still awaiting an
      * ack-or-lost verdict. Returns 0 for an unknown peer.
      *
-     * Diagnostics: this is bounded by the channel's in-flight window and must
-     * fall back to 0 once a stream of acks has resolved everything sent. A
-     * value that only grows is a leak in the ack accounting.
+     * Diagnostics: this must fall back to 0 once a stream of acks has resolved
+     * everything sent. A value that only grows is a leak in the ack accounting.
      * @param {number} peer_id
      * @returns {number}
      */
     pending_ack_count(peer_id) {
         const conn = this.#peers.get(peer_id);
-        return conn === undefined ? 0 : conn.seq_to_pending.size;
+        return conn === undefined ? 0 : conn.pending.size;
     }
 
     /**
-     * Direct access to a peer's channel (for sending acks-only packets, raw payloads, etc.).
+     * A peer's connection, for diagnostics: round-trip time, statistics, what is in flight.
      * @param {number} peer_id
-     * @returns {Channel|undefined}
+     * @returns {Connection|undefined}
      */
-    channel_for(peer_id) {
+    connection_for(peer_id) {
         const conn = this.#peers.get(peer_id);
-        return conn === undefined ? undefined : conn.channel;
+        return conn === undefined ? undefined : conn.connection;
     }
 
     /**
@@ -1049,6 +950,49 @@ export class NetworkPeer {
         conn.outbound_floor = from_frame;
     }
 
+    /**
+     * Keep the action stream and AUTH_STATE that `peer_id` sends, unapplied, until
+     * {@link release_inbound}; everything else it sends is handled as ever.
+     *
+     * For a client being given a world in pages. The host releases its action stream from the frame
+     * after the last page, so the stream's datagrams can overtake the last pages on the way; what
+     * they carry is about entities the client may not hold yet. Held, they are applied after the
+     * world is complete, in the order they came.
+     *
+     * Held messages are copies, bounded by `max_queued_bytes`; past that the connection can no
+     * longer give the peer a whole stream, and says so on {@link onProtocolError}.
+     *
+     * @param {number} peer_id
+     */
+    hold_inbound(peer_id) {
+        assert.isNonNegativeInteger(peer_id, 'peer_id');
+        const conn = this.#peers.get(peer_id);
+        if (conn === undefined) throw new Error(`NetworkPeer.hold_inbound: peer ${peer_id} not connected`);
+
+        conn.inbound_held = true;
+    }
+
+    /**
+     * Stop holding `peer_id`'s action stream and AUTH_STATE, and handle what was held, in the order
+     * it arrived.
+     *
+     * @param {number} peer_id
+     */
+    release_inbound(peer_id) {
+        assert.isNonNegativeInteger(peer_id, 'peer_id');
+        const conn = this.#peers.get(peer_id);
+        if (conn === undefined) throw new Error(`NetworkPeer.release_inbound: peer ${peer_id} not connected`);
+
+        conn.inbound_held = false;
+        const queue = conn.inbound_queue;
+        conn.inbound_queue = [];
+        conn.inbound_held_bytes = 0;
+        for (let i = 0; i < queue.length; i++) {
+            conn.on_message(queue[i], 0, queue[i].length);
+            if (!this.#peers.has(peer_id)) return;
+        }
+    }
+
     /**
      * Open the action log for `frame_number`. Call before running game logic
      * for the tick. The user's code (or the engine's `EntityManager.simulate`)
@@ -1070,13 +1014,8 @@ export class NetworkPeer {
     }
 
     /**
-     * Close the current tick and send pending action records to every peer.
-     * For each peer, packs frames `[Baseline.last_acked(peer) + 1, current_frame]`
-     * and sends via the channel; records the seqs the send went out under so
-     * that acks for all of them advance the baseline.
-     *
-     * If a {@link MutationLedger} was supplied at construction, this tick's
-     * accumulated changed-entity set is also compacted into the ledger.
+     * Close the current tick, queue the action stream for every peer (see
+     * {@link flush_outbound}), and send everything queued ({@link send_queued}).
      */
     end_tick() {
         if (!this.#tick_open) {
@@ -1086,6 +1025,38 @@ export class NetworkPeer {
         this.#tick_open = false;
 
         this.flush_outbound(this.#current_frame);
+        this.send_queued();
+    }
+
+    /**
+     * Send what is queued for every peer: one flush of each connection, packing the tick's
+     * messages into as few datagrams as fit, and running its loss and probe timers. Also sends a
+     * bare acknowledgement to a peer that has sent something since the last one.
+     */
+    send_queued() {
+        for (const conn of this.#peers.values()) {
+            conn.connection.flush();
+        }
+    }
+
+    /**
+     * Send what is queued for one peer now. For a last word before {@link disconnect_peer}:
+     * queue the DISCONNECT, flush, then disconnect.
+     * @param {number} peer_id
+     */
+    flush_peer(peer_id) {
+        const conn = this.#peers.get(peer_id);
+        if (conn !== undefined) conn.connection.flush();
+    }
+
+    /**
+     * The frame `network_id` was last changed by an action this peer executed or applied, or -1.
+     * Stamped at the end of each tick, by {@link flush_outbound}.
+     * @param {number} network_id
+     * @returns {number}
+     */
+    last_changed_frame(network_id) {
+        return network_id < this.#last_changed.length ? this.#last_changed[network_id] : -1;
     }
 
     /**
@@ -1101,9 +1072,12 @@ export class NetworkPeer {
      * MutationLedger (if configured), then packs frames
      * `[last_acked+1, current_frame]` for each peer via
      * `Replicator.pack_for_peer` into up to {@link max_packets_per_tick}
-     * channel packets, each the next slice of that range. Empty packs (no
-     * in-scope actions) are not sent. Clears the per-tick changed-entity set
-     * after recording.
+     * slices, each the next part of that range and one datagram at most; a
+     * frame too large for a datagram goes on {@link Lane.FRAMES}. Empty packs
+     * (no in-scope actions) are not sent. Stamps and clears the per-tick
+     * changed-entity set.
+     *
+     * Only queues: {@link send_queued} sends.
      *
      * @param {number} current_frame
      */
@@ -1114,7 +1088,10 @@ export class NetworkPeer {
         // (Order doesn't strictly matter for correctness, but keeping the ledger
         // up-to-date as soon as possible reduces edge-case race windows for
         // recovery requests that arrive immediately after.)
-        if (this.mutation_ledger !== null && this.#changed_entities !== null) {
+        this.#stamp_frame = current_frame;
+        this.#changed_entities.for_each(this.#stamp_changed);
+
+        if (this.mutation_ledger !== null) {
             this.mutation_ledger.record_tick(current_frame, this.#changed_entities);
 
             // ...and trim. The ledger documents that "caller invokes drop_through periodically",
@@ -1175,7 +1152,7 @@ export class NetworkPeer {
             //
             // Last, the peer's outbound floor: nothing before it is ever sent,
             // and a held peer's floor is past every frame (see hold_outbound).
-            const start = Math.max(
+            let start = Math.max(
                 last_acked + 1,
                 current_frame - this.action_log.frame_capacity + 1,
                 0,
@@ -1183,42 +1160,62 @@ export class NetworkPeer {
             );
             if (start > current_frame) continue;
 
-            // Up to `max_packets_per_tick` sends, each bounded to one channel
-            // packet and each taking the next slice of the owed range.
+            // Frames too large for a datagram went on Lane.FRAMES, which delivers them in order:
+            // credit each once it has arrived. Until then the pack skips the frames one covers.
+            const reliable_frames = conn.reliable_frames;
+            while (reliable_frames.count > 0 && conn.connection.is_delivered(Lane.FRAMES, reliable_frames.front_mark())) {
+                this.#credit_confirmed(peer_id, conn.confirmed,
+                    reliable_frames.front_start(), reliable_frames.front_end(), reliable_frames.front_head());
+                reliable_frames.shift();
+            }
+
+            let from = start;
+            let at_pack_start = true;
+
+            // Up to `max_packets_per_tick` slices, each bounded to one datagram
+            // and each taking the next part of the owed range.
             //
-            // Bounding a send to one packet is load-bearing. A fragmented
-            // action stream is confirmed only if EVERY fragment survives, so a
+            // Bounding a slice to one datagram is load-bearing. A multi-datagram
+            // unreliable message is confirmed only if EVERY datagram survives, so a
             // send that grows with the owed range is self-defeating under
-            // loss: one lost fragment pins the baseline, which widens the next
-            // pack, which raises the fragment count N, which drops
+            // loss: one lost datagram pins the baseline, which widens the next
+            // pack, which raises the datagram count N, which drops
             // P(all arrive) = (1-p)^N geometrically — the range then widens
             // faster than it drains and delivery collapses. Split into whole
-            // packets instead, each slice is confirmed on its own and a loss
+            // datagrams instead, each slice is confirmed on its own and a loss
             // forfeits one slice, not the tick.
             //
             // Sending more than one is what keeps the stream up with the
             // simulation. A slice is re-sent every tick until its ack returns,
             // so the baseline moves by at most a tick's worth of slices per
-            // round trip, while the sim produces a frame per tick. One packet
+            // round trip, while the sim produces a frame per tick. One datagram
             // a tick therefore keeps up only while a round trip's frames fit
-            // one packet; past that the owed range grows until it meets the
+            // one datagram; past that the owed range grows until it meets the
             // ring floor, a ring of frames is lost crossing it, and everything
             // after arrives a ring late — on a link that loses nothing. The
             // pack is oldest-owed-first, which is what the range order already
             // gives.
             //
-            // The budget is what is left of one payload after the prefix and
-            // the slice header, read from the buffer rather than written as a
-            // constant: `pack_for_peer` measures its budget from the current
-            // position, so a hard-coded allowance would have to be edited in
-            // step with every byte added here, and getting that wrong puts
-            // each full pack one byte over the limit and quietly fragments it
-            // again.
-            let from = start;
+            // The budget is what is left of one unreliable message after the
+            // prefix and the slice header, read from the buffer rather than
+            // written as a constant: `pack_for_peer` measures its budget from the
+            // current position.
+            const budget = conn.connection.max_unreliable_message_bytes;
             for (let n = 0; n < this.max_packets_per_tick && from <= current_frame; n++) {
+                // Skip what is already on its way reliably. Whatever follows it is not a
+                // head: the receiver holds it until the reliable frame lands.
+                for (let covered = reliable_frames.covering_end(from); covered >= 0; covered = reliable_frames.covering_end(from)) {
+                    from = covered + 1;
+                    at_pack_start = false;
+                }
+                if (from > current_frame) break;
+
+                // A slice is a head when it begins at the pack start: nothing the
+                // sender can still send lies before it.
+                const head = at_pack_start && from === start;
                 this.#send_buffer.position = 0;
                 // Packet-type prefix, then the slice header: the range this
-                // packet covers and whether it is the tick's first, which is
+                // packet covers and whether it is a head, which is
                 // what lets the receiver apply slices in frame order (see
                 // Replicator.unpack_from_peer). frame_end is back-patched once
                 // the pack has decided how far it got.
@@ -1226,10 +1223,10 @@ export class NetworkPeer {
                 this.#send_buffer.writeUint32(from);
                 const frame_end_position = this.#send_buffer.position;
                 this.#send_buffer.writeUint32(0);
-                this.#send_buffer.writeUint8(n === 0 ? 1 : 0);
+                this.#send_buffer.writeUint8(head ? 1 : 0);
                 const packed_through = this.replicator.pack_for_peer(
                     peer_id, from, current_frame, this.#send_buffer,
-                    MAX_CHANNEL_PAYLOAD_BYTES - this.#send_buffer.position,
+                    budget - this.#send_buffer.position,
                 );
                 const length = this.#send_buffer.position;
                 // Just the prefix and header → nothing in scope left to send
@@ -1239,35 +1236,44 @@ export class NetworkPeer {
                 this.#send_buffer.writeUint32(packed_through);
                 this.#send_buffer.position = length;
 
-                this.#send_to_peer(conn, this.#send_buffer.raw_bytes, length, this.#sent_seqs);
+                if (length > budget) {
+                    // One frame larger than a datagram: `pack_for_peer` writes a first group
+                    // that cannot fit anywhere, since no smaller pack could carry it. It goes
+                    // reliably on Lane.FRAMES, once: re-sending a frame of this size every tick
+                    // until its ack returns is what the back-fill would do with it. It keeps the
+                    // head flag the slice was given, so one that does not start the pack is held
+                    // by the receiver until the frames before it land. A lane already holding
+                    // all it may waits for room.
+                    if (length > conn.connection.max_message_bytes) {
+                        // Larger than any message: it can never be delivered. Given up — said so —
+                        // once it is the pack start, so the stream goes on behind it instead of
+                        // stopping at it until the ring retires it. Never a throw: one peer's
+                        // frame must not stop the tick for every other peer.
+                        if (!head) break;
+                        this.onFrameTooLarge.send4(peer_id, from, packed_through, length);
+                        this.#credit_confirmed(peer_id, conn.confirmed, from, packed_through, true);
+                        start = packed_through + 1;
+                        from = start;
+                        continue;
+                    }
+                    if (conn.connection.unacked_bytes(Lane.FRAMES) + length > this.#connection_options.max_queued_bytes) break;
+                    const mark = conn.connection.send_reliable(Lane.FRAMES, this.#send_buffer.raw_bytes, 0, length);
+                    reliable_frames.push(from, packed_through, head, mark);
+                    from = packed_through + 1;
+                    at_pack_start = false;
+                    continue;
+                }
 
-                // One record shared by every seq the send produced. Frames
-                // [from, packed_through] are confirmed only when all of those
-                // seqs ack; a loss on any of them abandons the record and
-                // leaves the range owed, so a later tick's pack picks it up
-                // again.
-                //
                 // frame_end is what the pack actually held, NOT current_frame:
                 // the budget may have stopped it short, and crediting frames
-                // that were left out of the packet would retire them from the
-                // back-fill unsent — the same defect as crediting a whole
-                // message to its first fragment, one layer up.
+                // that were left out of the slice would retire them from the
+                // back-fill unsent.
                 //
-                // Only the first slice starts at the pack start. The rest start
-                // where the previous slice stopped, and their confirmation is
-                // held until everything before them is confirmed too — see
-                // __credit_confirmed.
-                const seq_count = this.#sent_seqs.length;
-                const pending = {
-                    frame_start: from,
-                    frame_end: packed_through,
-                    head: n === 0,
-                    unacked: seq_count,
-                    abandoned: false,
-                };
-                for (let i = 0; i < seq_count; i++) {
-                    conn.seq_to_pending.set(this.#sent_seqs[i], pending);
-                }
+                // Only a head starts at the pack start. The rest start where the
+                // previous slice stopped, and their confirmation is held until
+                // everything before them is confirmed too — see #credit_confirmed.
+                const token = conn.pending.acquire(from, packed_through, head);
+                conn.connection.send_unreliable(this.#send_buffer.raw_bytes, 0, length, token);
 
                 from = packed_through + 1;
             }
@@ -1275,41 +1281,25 @@ export class NetworkPeer {
 
         // Reset the per-tick changed-entity set so the next tick starts clean.
         // (begin_tick also clears it; the dual call is harmless.)
-        if (this.#changed_entities !== null) this.#changed_entities.clear();
-
-        // Per-tick fragment maintenance: age out sender-side retention and drive NACK emission for
-        // any incomplete inbound messages. Runs AFTER the action-stream send loop so the shared
-        // #send_buffer is free for the on_nack closure to reuse.
-        //
-        // Here and not in `end_tick`: a host never calls `end_tick`. ServerAuthoritativeServer
-        // bypasses it and drives `flush_outbound` directly because it manages action_log frames
-        // itself across the rollback replay, so with these two calls one level up, NACK recovery and
-        // retention age-out were inoperative in the client -> host direction — the direction that
-        // carries player input.
-        const now_ms = performance.now();
-        for (const [, conn] of this.#peers) {
-            conn.fragment_retention.service(now_ms);
-            conn.fragment_assembler.service(now_ms, conn.on_nack);
-        }
+        this.#changed_entities.clear();
     }
 
     /**
-     * A send has been confirmed in full — every seq it went out under acked,
-     * none lost — so the receiver has applied every frame it carried. Record
-     * those frames, then advance the peer's baseline as far as the frames
-     * confirmed so far run contiguously.
+     * A slice has been delivered, so the receiver has applied every frame it
+     * carried. Record those frames, then advance the peer's baseline as far as
+     * the frames confirmed so far run contiguously.
      *
      * The order matters because a tick may send several slices and they
      * confirm independently. A later slice landing while an earlier one is
      * still in flight must not credit the earlier one's frames: they are
      * still owed, and crediting them would retire them from the back-fill
      * unsent. So a slice is credited only once the baseline has reached the
-     * frame before it. The exception is the head of a tick's burst. Its start
-     * IS the pack start — `last_acked + 1`, the ring floor or the peer's
-     * outbound floor, whichever is newest — so nothing sendable lies before it
-     * and its confirmation credits outright. That is also how the baseline
-     * gets past frames the ring has already retired, and frames below the
-     * outbound floor, which no ack could ever confirm.
+     * frame before it. The exception is a head. Its start IS the pack start —
+     * `last_acked + 1`, the ring floor or the peer's outbound floor, whichever
+     * is newest — so nothing sendable lies before it and its confirmation
+     * credits outright. That is also how the baseline gets past frames the ring
+     * has already retired, and frames below the outbound floor, which no ack
+     * could ever confirm.
      *
      * `confirmed` is a ring indexed by frame modulo capacity that stores the
      * frame number, so a slot whose frame has since been overwritten reads as
@@ -1321,19 +1311,21 @@ export class NetworkPeer {
      *
      * @param {number} peer_id
      * @param {Int32Array} confirmed the peer's confirmed-frame ring
-     * @param {PendingAck} pending the record that just drained
+     * @param {number} frame_start first frame of the delivered slice
+     * @param {number} frame_end last frame of the delivered slice
+     * @param {boolean} head the slice began at the pack start
      * @private
      */
-    #credit_confirmed(peer_id, confirmed, pending) {
+    #credit_confirmed(peer_id, confirmed, frame_start, frame_end, head) {
         const capacity = confirmed.length;
-        for (let f = pending.frame_start; f <= pending.frame_end; f++) {
+        for (let f = frame_start; f <= frame_end; f++) {
             confirmed[f % capacity] = f;
         }
 
         const before = this.baseline.last_acked(peer_id);
         let last_acked = before;
-        if (pending.head && pending.frame_end > last_acked) {
-            last_acked = pending.frame_end;
+        if (head && frame_end > last_acked) {
+            last_acked = frame_end;
         }
         while (confirmed[(last_acked + 1) % capacity] === last_acked + 1) {
             last_acked++;
@@ -1343,60 +1335,13 @@ export class NetworkPeer {
         }
     }
 
-    /**
-     * Send a logical payload to a connected peer, fragmenting transparently
-     * if it exceeds the channel's single-packet capacity.
-     *
-     * Fragments either all arrive (and the receiver reassembles) or the
-     * message is lost — there is no partial delivery, and the receiver never
-     * applies a message it could not reassemble.
-     *
-     * A caller that ties delivery state to the ack must therefore wait on
-     * EVERY seq the send produced, not just the first. The action stream's
-     * back-fill does recover a lost message, but only for as long as the
-     * frames stay owed: crediting the range to the first fragment's ack
-     * retires it from the back-fill, and a message whose later fragments were
-     * dropped is then never re-sent and never applied. Pass `seqs_out` to
-     * collect the seqs; {@link NetworkPeer#flush_outbound} does exactly that.
-     *
-     * @param {object} conn  entry from __peers
-     * @param {Uint8Array} payload  starts with the packet-type byte
-     * @param {number} length
-     * @param {number[]} [seqs_out]  when given, cleared and then filled with the
-     *   seq of every transport packet emitted, in send order
-     * @private
-     */
-    #send_to_peer(conn, payload, length, seqs_out = null) {
-        if (seqs_out !== null) seqs_out.length = 0;
-        if (length <= MAX_CHANNEL_PAYLOAD_BYTES) {
-            const seq = conn.channel.send(payload, length);
-            if (seqs_out !== null) seqs_out.push(seq);
-            return;
-        }
-        const message_id = this.#next_fragment_message_id;
-        this.#next_fragment_message_id = seq16_advance(this.#next_fragment_message_id);
-        // Retain the source bytes so we can satisfy NACK retransmits.
-        // Copy happens inside retain(); `payload` is the orchestrator's
-        // shared send buffer and will be overwritten by the next call.
-        conn.fragment_retention.retain(message_id, payload, length, performance.now());
-        send_fragmented(
-            payload, length, message_id,
-            NetworkPacketType.FRAGMENT, this.#fragment_scratch,
-            (chunk_bytes, chunk_length) => {
-                const seq = conn.channel.send(chunk_bytes, chunk_length);
-                if (seqs_out !== null) seqs_out.push(seq);
-            },
-        );
-    }
-
     /**
      * Send a recovery request to `peer_id`: "tell me the current state of every
      * entity that mutated between `start_tick` and `end_tick`." The peer's
      * server-side handler ({@link onRecoveryRequest}) is expected to respond by
      * calling {@link send_state_burst_for_range}.
      *
-     * Best-effort delivery via the same UDP-style channel — if the request is
-     * lost, the client is expected to retry.
+     * Reliable, on the CONTROL lane.
      *
      * @param {number} peer_id
      * @param {number} start_tick
@@ -1413,7 +1358,7 @@ export class NetworkPeer {
         this.#send_buffer.writeUint8(NetworkPacketType.RECOVERY_REQUEST);
         this.#send_buffer.writeUintVar(start_tick);
         this.#send_buffer.writeUintVar(end_tick);
-        this.#send_to_peer(conn, this.#send_buffer.raw_bytes, this.#send_buffer.position);
+        conn.connection.send_reliable(Lane.CONTROL, this.#send_buffer.raw_bytes, 0, this.#send_buffer.position);
     }
 
     /**
@@ -1470,10 +1415,9 @@ export class NetworkPeer {
                 });
             },
         });
-        // STATE_BURST is the primary path that can exceed MTU — a recovery
-        // response covering many entities easily lands in the multi-KB range.
-        // The fragmenting wrapper splits it across packets transparently.
-        this.#send_to_peer(conn, this.#send_buffer.raw_bytes, this.#send_buffer.position);
+        // a recovery response covering many entities easily lands in the
+        // multi-KB range: the BULK lane carries it at the paced rate
+        return conn.connection.send_reliable(Lane.BULK, this.#send_buffer.raw_bytes, 0, this.#send_buffer.position);
     }
 
     /**
@@ -1506,34 +1450,37 @@ export class NetworkPeer {
         this.#send_buffer.writeUintVar(frame_number);
         this.#send_buffer.writeUintVar(network_id);
         write_fn(this.#send_buffer);
-        this.#send_to_peer(conn, this.#send_buffer.raw_bytes, this.#send_buffer.position);
+        conn.connection.send_unreliable(this.#send_buffer.raw_bytes, 0, this.#send_buffer.position, -1);
     }
 
     /**
-     * Send an INITIAL_SYNC packet. `write_fn` receives the send-buffer
-     * positioned just past the `(packet_type, session_token, frame_number)`
-     * header and writes the Snapshotter payload. Fragments transparently.
+     * Queue one INITIAL_SYNC page on the BULK lane: the header, then `length` bytes of
+     * `entities` — a uint32 entity count and that many Snapshotter entity records.
      *
      * @param {number} peer_id
      * @param {Uint8Array} session_token 16-byte UUID v1 identifying this peer-session
-     * @param {number} frame_number server sim frame this snapshot represents
-     * @param {function(BinaryBuffer): void} write_fn
+     * @param {number} frame_number server sim frame the page's state is from
+     * @param {number} flags {@link InitialSyncPage}
+     * @param {Uint8Array} entities
+     * @param {number} length
+     * @returns {number} delivery mark on {@link Lane.BULK}
      */
-    send_initial_sync(peer_id, session_token, frame_number, write_fn) {
+    send_sync_page(peer_id, session_token, frame_number, flags, entities, length) {
         assert.isNonNegativeInteger(peer_id, 'peer_id');
         assert.ok(session_token instanceof Uint8Array && session_token.length === 16,
             'session_token must be a 16-byte Uint8Array');
         assert.isNonNegativeInteger(frame_number, 'frame_number');
-        assert.isFunction(write_fn, 'write_fn');
+        assert.isNonNegativeInteger(flags, 'flags');
         const conn = this.#peers.get(peer_id);
-        if (conn === undefined) throw new Error(`NetworkPeer.send_initial_sync: peer ${peer_id} not connected`);
+        if (conn === undefined) throw new Error(`NetworkPeer.send_sync_page: peer ${peer_id} not connected`);
 
         this.#send_buffer.position = 0;
         this.#send_buffer.writeUint8(NetworkPacketType.INITIAL_SYNC);
         this.#send_buffer.writeBytes(session_token, 0, 16);
         this.#send_buffer.writeUintVar(frame_number);
-        write_fn(this.#send_buffer);
-        this.#send_to_peer(conn, this.#send_buffer.raw_bytes, this.#send_buffer.position);
+        this.#send_buffer.writeUint8(flags);
+        this.#send_buffer.writeBytes(entities, 0, length);
+        return conn.connection.send_reliable(Lane.BULK, this.#send_buffer.raw_bytes, 0, this.#send_buffer.position);
     }
 
     /**
@@ -1563,7 +1510,7 @@ export class NetworkPeer {
         this.#send_buffer.writeUintVar(last_acked_frame);
         this.#send_buffer.writeUint8(has_token ? 1 : 0);
         this.#send_buffer.writeBytes(session_token, 0, 16);
-        this.#send_to_peer(conn, this.#send_buffer.raw_bytes, this.#send_buffer.position);
+        conn.connection.send_reliable(Lane.CONTROL, this.#send_buffer.raw_bytes, 0, this.#send_buffer.position);
     }
 
     /**
@@ -1577,7 +1524,7 @@ export class NetworkPeer {
 
         this.#send_buffer.position = 0;
         this.#send_buffer.writeUint8(NetworkPacketType.RESUME_ACCEPT);
-        this.#send_to_peer(conn, this.#send_buffer.raw_bytes, this.#send_buffer.position);
+        conn.connection.send_reliable(Lane.CONTROL, this.#send_buffer.raw_bytes, 0, this.#send_buffer.position);
     }
 
     /**
@@ -1594,7 +1541,7 @@ export class NetworkPeer {
         this.#send_buffer.position = 0;
         this.#send_buffer.writeUint8(NetworkPacketType.RESUME_REJECT);
         this.#send_buffer.writeUint8(reason_code & 0xFF);
-        this.#send_to_peer(conn, this.#send_buffer.raw_bytes, this.#send_buffer.position);
+        conn.connection.send_reliable(Lane.CONTROL, this.#send_buffer.raw_bytes, 0, this.#send_buffer.position);
     }
 
     /**
@@ -1617,7 +1564,7 @@ export class NetworkPeer {
         this.#send_buffer.writeUint8(NetworkPacketType.DISCONNECT);
         this.#send_buffer.writeUint8(len);
         if (len > 0) this.#send_buffer.writeBytes(encoded, 0, len);
-        this.#send_to_peer(conn, this.#send_buffer.raw_bytes, this.#send_buffer.position);
+        conn.connection.send_reliable(Lane.CONTROL, this.#send_buffer.raw_bytes, 0, this.#send_buffer.position);
     }
 
     /**
@@ -1627,10 +1574,12 @@ export class NetworkPeer {
      *
      * @param {number} peer_id
      * @param {number} buffer_depth signed integer; clamped to int16
+     * @param {number} frame_number this side's sim frame
      */
-    send_time_dilation_feedback(peer_id, buffer_depth) {
+    send_time_dilation_feedback(peer_id, buffer_depth, frame_number) {
         assert.isNonNegativeInteger(peer_id, 'peer_id');
         assert.isNumber(buffer_depth, 'buffer_depth');
+        assert.isNonNegativeInteger(frame_number, 'frame_number');
         const conn = this.#peers.get(peer_id);
         if (conn === undefined) throw new Error(`NetworkPeer.send_time_dilation_feedback: peer ${peer_id} not connected`);
 
@@ -1641,13 +1590,14 @@ export class NetworkPeer {
         this.#send_buffer.position = 0;
         this.#send_buffer.writeUint8(NetworkPacketType.TIME_DILATION);
         this.#send_buffer.writeInt16(depth);
-        this.#send_to_peer(conn, this.#send_buffer.raw_bytes, this.#send_buffer.position);
+        this.#send_buffer.writeUintVar(frame_number);
+        conn.connection.send_unreliable(this.#send_buffer.raw_bytes, 0, this.#send_buffer.position, -1);
     }
 
     /**
      * Tell a peer which frame this one has just finished simulating. See
      * {@link NetworkPacketType.FRAME_MARKER}. Also serves as the tick's keep-alive: it advances the
-     * channel's seq/ack like any packet.
+     * connection's acknowledgements like any message.
      *
      * @param {number} peer_id
      * @param {number} frame_number
@@ -1661,23 +1611,21 @@ export class NetworkPeer {
         this.#send_buffer.position = 0;
         this.#send_buffer.writeUint8(NetworkPacketType.FRAME_MARKER);
         this.#send_buffer.writeUintVar(frame_number);
-        this.#send_to_peer(conn, this.#send_buffer.raw_bytes, this.#send_buffer.position);
+        conn.connection.send_unreliable(this.#send_buffer.raw_bytes, 0, this.#send_buffer.position, -1);
     }
 
     /**
-     * Send a reliable command to a connected peer. Delivered at-least-once
-     * with sender-side retransmit on Channel-detected loss and receiver-
-     * side dedup by logical seq. Use for messages where the action-stream
-     * model (best-effort, per-frame back-fill) isn't suitable — chat,
-     * lobby/room state, level transitions.
-     *
-     * Returns the logical seq the pipeline assigned (diagnostic only; the
-     * receiver dedups internally regardless).
+     * Queue a reliable command for a connected peer, on the connection's USER
+     * lane: it arrives once, whole, and in order with the peer's other
+     * commands, unless the connection ends first. Up to the connection's
+     * `max_message_bytes` (less the type byte). Use for messages where the
+     * action-stream model (best-effort, per-frame back-fill) isn't suitable —
+     * chat, lobby/room state, level transitions.
      *
      * @param {number} peer_id
      * @param {Uint8Array} payload
      * @param {number} length
-     * @returns {number} logical seq
+     * @returns {number} delivery mark: see {@link Connection#is_delivered} with {@link Lane.USER}
      */
     send_reliable_command(peer_id, payload, length) {
         assert.isNonNegativeInteger(peer_id, 'peer_id');
@@ -1686,6 +1634,9 @@ export class NetworkPeer {
         if (conn === undefined) {
             throw new Error(`NetworkPeer.send_reliable_command: peer ${peer_id} not connected`);
         }
-        return conn.reliable_pipeline.send(payload, length);
+        this.#send_buffer.position = 0;
+        this.#send_buffer.writeUint8(NetworkPacketType.RELIABLE_COMMAND);
+        this.#send_buffer.writeBytes(payload, 0, length);
+        return conn.connection.send_reliable(Lane.USER, this.#send_buffer.raw_bytes, 0, this.#send_buffer.position);
     }
 }