@woosh/meep-engine 3.46.0 → 3.49.0

package/src/engine/network/orchestrator/ServerAuthoritativeServer.js

@@ -1,7 +1,6 @@
 import { assert } from "../../../core/assert.js";
 import { BinaryBuffer } from "../../../core/binary/BinaryBuffer.js";
 import { binarySearchHighIndex } from "../../../core/collection/array/binarySearchHighIndex.js";
-import { fastArrayEquals } from "../../../core/collection/array/fastArrayEquals.js";
 import Signal from "../../../core/events/signal/Signal.js";
 import { number_compare_ascending } from "../../../core/primitives/numbers/number_compare_ascending.js";
 import { NetworkIdentity } from "../ecs/components/NetworkIdentity.js";
@@ -11,6 +10,7 @@ import { AlwaysRelevantScope } from "../replication/ScopeFilter.js";
 import { ActionRecordCursor } from "../sim/ActionRecordCursor.js";
 import { RewindEngine } from "../sim/RewindEngine.js";
 import { SENDER_DERIVED, SENDER_LOCAL, SENDER_RECORDED } from "../sim/SimActionExecutor.js";
+import { RecordArrivalRing } from "../state/RecordArrivalRing.js";
 import { NetworkPeer } from "./NetworkPeer.js";
 
 /**
@@ -43,10 +43,12 @@ export const LateInput = Object.freeze({
  *   1. Inbound action packets do NOT execute on arrival. Instead, a deferral
  *      hook on the {@link Replicator} drops them into a per-tick pending log
  *      tagged with `(client_frame, sender_id, type_id, payload_bytes)` —
- *      unless the action log already holds that record. The action stream
- *      re-sends every unconfirmed frame each tick, so most arrivals at any
- *      real latency are copies of applied records; those are dropped where
- *      they arrive, and pending holds only input the log does not.
+ *      unless the record has arrived before. A record is known by
+ *      `(sender, frame, ordinal)`, never by its bytes; a per-sender
+ *      {@link RecordArrivalRing} answers that. The action stream re-sends
+ *      every unconfirmed frame each tick, so most arrivals at any real latency
+ *      are copies of applied records; those are dropped where they arrive, and
+ *      pending holds only input that is new.
  *   2. Once per server tick, `tick(current_frame)` consumes the pending log:
  *      - Rejects entries older than the action_log's rewindable window.
  *      - Determines `replay_start`: the oldest pending frame, which by the
@@ -123,7 +125,7 @@ export class ServerAuthoritativeServer {
     #carried_scratch = [];
     #sort_scratch = /** @type {Array<{sender_id:number, type_id:number, payload:Uint8Array}>} */ ([]);
     #payload_buf;
-    // Walks a frame's records, for the history read and the arrival check.
+    // Walks a frame's records, for the history read.
     #cursor = new ActionRecordCursor();
     // Locally-authored actions waiting for the next fresh frame. Parallel
     // arrays, serialized at enqueue time so the caller's instance is not
@@ -133,8 +135,8 @@ export class ServerAuthoritativeServer {
     #local_payloads = /** @type {Uint8Array[]} */ ([]);
     #local_buf;
     /**
-     * Count of inbound pending entries dropped by the future-lead / total
-     * bounds. See {@link onPendingActionDropped}.
+     * Count of inbound pending entries dropped: tagged past the future horizon, below the
+     * rewindable window, or over the total cap. See {@link onPendingActionDropped}.
      * @private @type {number}
      */
     #pending_dropped = 0;
@@ -144,13 +146,15 @@ export class ServerAuthoritativeServer {
      */
     #open_sim_frame = -1;
     /**
-     * Late input already folded into a later frame under {@link LateInput.Apply}, by the frame it
-     * was tagged for. The log does not hold it at that frame, so without this a retransmission of
-     * the frame — routine until the ack round-trips — would read as new input and apply again.
-     * Trimmed to the rewindable window like pending.
-     * @type {Map<number, Array<{sender_id: number, type_id: number, payload: Uint8Array}>>}
+     * Per sender, which records of its frames have arrived — by the frame the sender tagged and the
+     * record's ordinal in that frame, which is a record's identity on the stream. The stream re-sends
+     * every unconfirmed frame each tick, and this is how a copy is told from a new record; the bytes
+     * take no part (see {@link #pending_add}). A ring spans the oldest rewindable frame to the future
+     * horizon; what is tagged outside that is dropped before it is marked. Never cleared for a peer:
+     * one that drops and resumes re-sends what was not acknowledged, some of which has been applied.
+     * @type {Map<number, RecordArrivalRing>}
      */
-    #folded = new Map();
+    #arrivals = new Map();
 
     /**
      * Most recently simulated frame. `-1` during warmup
@@ -172,11 +176,19 @@ export class ServerAuthoritativeServer {
      *   simulation_delay_ticks?: number,
      *   max_packets_per_tick?: number,
      *   late_input?: LateInput|string,
+     *   clock: function(): number,
+     *   tick_period_ms: number,
+     *   send_rate_bytes_per_second?: number,
+     *   max_message_bytes?: number,
+     *   receive_window_bytes?: number,
+     *   max_queued_bytes?: number,
      * }} options
      *
      * `max_packets_per_tick`: forwarded to {@link NetworkPeer}; how many
      * action-stream packets a tick may send one peer.
      *
+     * `clock`, `tick_period_ms` and the connection options: forwarded to {@link NetworkPeer}.
+     *
      * `late_input`: see {@link LateInput}. Default {@link LateInput.Rollback}.
      *
      * `simulation_delay_ticks`: server-side input buffer (Overwatch-style).
@@ -199,14 +211,22 @@ export class ServerAuthoritativeServer {
         simulation_delay_ticks = 0,
         max_pending_future_lead = 256,
         max_pending_total = 4096,
+        max_records_per_frame = 4096,
         identity_class = NetworkIdentity,
         server_peer_id = -1,
         max_packets_per_tick,
         late_input = LateInput.Rollback,
+        clock,
+        tick_period_ms,
+        send_rate_bytes_per_second,
+        max_message_bytes,
+        receive_window_bytes,
+        max_queued_bytes,
     }) {
         assert.isNonNegativeInteger(simulation_delay_ticks, 'simulation_delay_ticks');
         assert.isPositiveInteger(max_pending_future_lead, 'max_pending_future_lead');
         assert.isPositiveInteger(max_pending_total, 'max_pending_total');
+        assert.isPositiveInteger(max_records_per_frame, 'max_records_per_frame');
         if (late_input !== LateInput.Rollback && late_input !== LateInput.Apply) {
             throw new Error(`ServerAuthoritativeServer: late_input must be one of ${Object.values(LateInput).join(', ')}, got '${late_input}'`);
         }
@@ -227,6 +247,12 @@ export class ServerAuthoritativeServer {
             frame_capacity,
             initial_buffer_size,
             max_packets_per_tick,
+            clock,
+            tick_period_ms,
+            send_rate_bytes_per_second,
+            max_message_bytes,
+            receive_window_bytes,
+            max_queued_bytes,
         });
 
         /** @type {EntityComponentDataset} */
@@ -302,16 +328,27 @@ export class ServerAuthoritativeServer {
 
         /**
          * Absolute backstop on the number of buffered pending entries. Even
-         * within the future window a peer can vary an action's payload to
-         * defeat the per-frame dedup and pile up many distinct entries; this
-         * caps total memory (and the dedup scan cost) regardless. Legitimate
-         * pending depth is tiny (≈ delay × actions/frame × peers), so this only
-         * ever trips under abuse. Raise it for very high concurrent-player
-         * counts.
+         * within the future window a peer can claim as many ordinals per frame
+         * as it likes and pile up distinct entries; this caps total memory
+         * regardless. Legitimate pending depth is tiny (≈ delay × actions/frame
+         * × peers), so this only ever trips under abuse. Raise it for very high
+         * concurrent-player counts.
          * @type {number}
          */
         this.max_pending_total = max_pending_total;
 
+        /**
+         * Upper bound on a record's ordinal — its index in the sender's frame.
+         * The ordinal is an attacker-controlled varint and the arrival ring
+         * sizes its per-frame bitsets to the ordinals it is asked to mark, so
+         * without a ceiling one record claiming to be its frame's 2^30th is a
+         * request for gigabytes. A frame is one step of a sender's input;
+         * thousands of records in one is not input. Dropped records are
+         * reported `'ordinal'` on {@link onPendingActionDropped}.
+         * @type {number}
+         */
+        this.max_records_per_frame = max_records_per_frame;
+
         /**
          * Running watermark per peer: highest client-tagged frame received
          * from each peer. {@link buffer_depth_for_peer} reads this minus
@@ -338,10 +375,11 @@ export class ServerAuthoritativeServer {
 
         // Switch the Replicator to deferred-execute mode: incoming actions
         // accumulate in pending until tick() drains them.
-        this.peer.replicator.on_pending_action = (peer_id, frame_number, type_id, buf, off, len) => {
+        this.peer.replicator.on_pending_action = (peer_id, frame_number, type_id, buf, off, len, ordinal) => {
+            assert.isNonNegativeInteger(ordinal, 'ordinal');
             const payload = new Uint8Array(len);
             payload.set(buf.raw_bytes.subarray(off, off + len));
-            this.#pending_add(frame_number, peer_id, type_id, payload);
+            this.#pending_add(frame_number, ordinal, peer_id, type_id, payload);
             if (frame_number > this.last_client_frame_processed) {
                 this.last_client_frame_processed = frame_number;
             }
@@ -422,11 +460,21 @@ export class ServerAuthoritativeServer {
         this.onRewind = new Signal();
 
         /**
-         * Fired when an inbound pending action is dropped by the future-lead or
-         * total-capacity bound (i.e. a far-future frame tag or a flood). Args:
-         * `(sender_id, frame_number, reason)` where `reason` is `'future'` or
-         * `'capacity'`. Observable so an abusive peer can be logged / kicked;
-         * the dropped action is simply not buffered.
+         * Fired when an inbound pending action is dropped. Args:
+         * `(sender_id, frame_number, reason)` where `reason` is `'future'` (tagged
+         * past the future horizon), `'capacity'` (the total cap: a flood),
+         * `'ordinal'` (a record claiming an index in its frame past
+         * `max_records_per_frame`: not input) or `'window'` (tagged for a frame
+         * older than the log can rewind to, so it can never be applied where it
+         * was tagged — a client that stalled, or one far behind the host's
+         * time). A copy of a record that was accepted is recognised before any
+         * of these and never reported, however old its frame has become. A
+         * record that was never accepted is reported once per copy that
+         * arrives: a stalled client's frame is re-sent until its
+         * acknowledgement round-trips, so one lost input shows as a few of
+         * these. Observable so an abusive peer can be logged / kicked, and so a
+         * game can see input that vanished; until 2026-10-15 the `'window'`
+         * case was silent. The dropped action is simply not buffered.
          * @type {Signal}
          */
         this.onPendingActionDropped = new Signal();
@@ -466,12 +514,11 @@ export class ServerAuthoritativeServer {
     }
 
     /**
-     * Channel accessor for the user's manual packet plumbing (e.g. sending
-     * empty ACK packets in the prototype). Most callers won't need this.
+     * A peer's connection, for diagnostics. See {@link NetworkPeer#connection_for}.
      * @param {number} peer_id
      */
-    channel_for(peer_id) {
-        return this.peer.channel_for(peer_id);
+    connection_for(peer_id) {
+        return this.peer.connection_for(peer_id);
     }
 
     /**
@@ -484,7 +531,7 @@ export class ServerAuthoritativeServer {
      * @param {number} peer_id
      */
     send_time_dilation_feedback(peer_id) {
-        this.peer.send_time_dilation_feedback(peer_id, this.buffer_depth_for_peer(peer_id));
+        this.peer.send_time_dilation_feedback(peer_id, this.buffer_depth_for_peer(peer_id), Math.max(0, this.current_sim_frame));
     }
 
     /**
@@ -597,11 +644,6 @@ export class ServerAuthoritativeServer {
         if (this.#pending_frames.length > 0 && this.#pending_referenced_frames[0] < window_oldest) {
             this.#pending_trim_to_window(window_oldest);
         }
-        if (this.#folded.size > 0) {
-            for (const frame of this.#folded.keys()) {
-                if (frame < window_oldest) this.#folded.delete(frame);
-            }
-        }
 
         // 1a. Late input folded into this frame instead of rolled back to its own.
         if (this.late_input === LateInput.Apply) {
@@ -652,13 +694,18 @@ export class ServerAuthoritativeServer {
 
     /**
      * Second half of a tick: run {@link onLocalSim} for the open frame, close it, publish the new
-     * {@link current_sim_frame}, flush the action stream and fire {@link onTickComplete}. A no-op
-     * after a warmup {@link begin_tick}.
+     * {@link current_sim_frame}, queue the action stream, fire {@link onTickComplete}, and send
+     * everything queued — what the handlers queued included, so the tick leaves together. After a
+     * warmup {@link begin_tick} it only sends what is queued.
      */
     end_tick() {
         const sim_frame = this.#open_sim_frame;
 
-        if (sim_frame === -1) return; // warmup, or no begin_tick
+        if (sim_frame === -1) {
+            // warmup, or no begin_tick: nothing simulated, but answers and acknowledgements go
+            this.peer.send_queued();
+            return;
+        }
 
         this.#open_sim_frame = -1;
 
@@ -672,6 +719,7 @@ export class ServerAuthoritativeServer {
         this.current_sim_frame = sim_frame;
         this.peer.flush_outbound(sim_frame);
         this.onTickComplete.send1(sim_frame);
+        this.peer.send_queued();
     }
 
     /**
@@ -698,47 +746,6 @@ export class ServerAuthoritativeServer {
         return max - this.current_sim_frame;
     }
 
-    /**
-     * Walk `action_log[frame_number]` looking for a record identical to
-     * `(sender_id, type_id, payload)`. Compares the payload in place against
-     * the log's own bytes — no copy, unlike {@link __read_historical}, because
-     * this runs once per arriving action.
-     *
-     * The key can only recognise records the log actually holds. An action
-     * the executor REJECTED (owner authorization) writes nothing, so each of
-     * its retransmissions still reads as new input and still costs a rewind —
-     * self-limiting, because the sender stops re-sending the frame once it is
-     * acked.
-     *
-     * Caller must have checked `action_log.has_frame(frame_number)`, and that
-     * the frame is closed.
-     *
-     * @param {number} frame_number
-     * @param {number} sender_id
-     * @param {number} type_id
-     * @param {Uint8Array} payload
-     * @returns {boolean}
-     * @private
-     */
-    #log_holds_record(frame_number, sender_id, type_id, payload) {
-        const cursor = this.#cursor;
-        cursor.open(this.action_log, frame_number);
-        const bytes = cursor.buffer.raw_bytes;
-        while (cursor.next()) {
-            if (cursor.action_type_id !== type_id) continue;
-            if (cursor.sender_id !== sender_id) continue;
-            if (cursor.payload_len !== payload.length) continue;
-
-            const payload_start = cursor.payload_start;
-            let same = true;
-            for (let i = 0; i < payload.length; i++) {
-                if (bytes[payload_start + i] !== payload[i]) { same = false; break; }
-            }
-            if (same) return true;
-        }
-        return false;
-    }
-
     /**
      * Execute frame `f` whole: {@link #open_frame} then {@link #close_frame}.
      *
@@ -773,32 +780,17 @@ export class ServerAuthoritativeServer {
             this.#sort_scratch.push({ sender_id: h.sender_id, type_id: h.type_id, payload: h.payload });
         }
 
-        // Append the pending actions for this frame. Retransmissions of
-        // records the log already holds are dropped on arrival (see
-        // __pending_add), so in the supported call pattern nothing here
-        // duplicates history. The check stays as a safety net: a duplicate
-        // that reached this point would merge with the historical record and
-        // execute the action twice, diverging the world, and the cost of the
-        // check is a scan of a small frame's copied history.
-        //
-        // Dedup key: (sender_id, type_id, payload bytes). Two actions are
-        // "the same arrival" if all three match. (Same sender_id and
-        // type_id but different payload = legitimately distinct actions
-        // for the same frame, e.g. fire + move in the same tick.)
+        // Append the pending actions for this frame. Pending holds only records that had not
+        // arrived before (see #pending_add): a copy of what the log already holds is recognised on
+        // arrival by its identity and never gets here, so nothing in it duplicates history. Nothing
+        // is compared by bytes — two records alike in every byte are two records (a held key).
         for (let i = 0; i < this.#pending_frames.length; i++) {
             if (this.#pending_frames[i] !== f) continue;
-            const p_sender = this.#pending_senders[i];
-            const p_type   = this.#pending_type_ids[i];
-            const p_payload = this.#pending_payloads[i];
-            let is_dup = false;
-            for (let j = 0; j < this.#historical_scratch.length; j++) {
-                const h = this.#historical_scratch[j];
-                if (h.sender_id !== p_sender) continue;
-                if (h.type_id !== p_type) continue;
-                if (fastArrayEquals(h.payload, p_payload)) { is_dup = true; break; }
-            }
-            if (is_dup) continue;
-            this.#sort_scratch.push({ sender_id: p_sender, type_id: p_type, payload: p_payload });
+            this.#sort_scratch.push({
+                sender_id: this.#pending_senders[i],
+                type_id: this.#pending_type_ids[i],
+                payload: this.#pending_payloads[i],
+            });
         }
 
         // Locally-authored actions join the merge as input, and only on the
@@ -957,80 +949,88 @@ export class ServerAuthoritativeServer {
     }
 
     /**
-     * Number of inbound pending actions dropped by the future-lead / total
-     * bounds so far. See {@link onPendingActionDropped}.
+     * Number of inbound pending actions dropped so far — tagged past the future horizon, below the
+     * rewindable window, or over the total cap. See {@link onPendingActionDropped}.
      * @returns {number}
      */
     pending_dropped_count() {
         return this.#pending_dropped;
     }
 
-    /** @private */
-    #pending_add(frame_number, sender_id, type_id, payload) {
+    /**
+     * Take a record the stream delivered into pending, or drop it and say so: tagged past the
+     * future horizon (`'future'`), below the oldest frame the log can still rewind to (`'window'`),
+     * claiming an ordinal past `max_records_per_frame` (`'ordinal'`), or over the total cap
+     * (`'capacity'`). A copy of a record that has arrived already is not input
+     * and is dropped without a word: `Replicator.pack_for_peer` packs every frame in
+     * [last_acked + 1, current_frame] each tick, so a record arrives once per tick until its ack
+     * round-trips, and copies are the common case.
+     *
+     * A record is known by the frame its sender tagged it for and its ordinal in that frame — never
+     * by its bytes. Two inputs with the same payload at different ordinals, or in different frames,
+     * are two inputs; a held key is the same payload every frame. Until 2026-10-15 copies were
+     * recognised by `(sender, type, payload)` against pending, against the log's records at the
+     * frame, and against a side-table of late input folded elsewhere, and a held key whose input
+     * arrived late and was folded into one frame lost 44% of it (measured; the spec is
+     * `NetworkSession.late_input.spec.js`). The arrival ring answers in constant time, and what it
+     * admits is what pending holds, so `tick` takes the oldest pending frame as its replay window
+     * without a second look and `#open_frame` merges pending into history without comparing.
+     *
+     * @param {number} frame_number
+     * @param {number} ordinal the record's index in the sender's frame, from the wire
+     * @param {number} sender_id
+     * @param {number} type_id
+     * @param {Uint8Array} payload
+     * @private
+     */
+    #pending_add(frame_number, ordinal, sender_id, type_id, payload) {
+        const ring = this.#arrival_ring_for(sender_id);
+
+        // A copy first — already pending, already in the log, or already folded into a later
+        // frame. Before the bounds, because a record applied at the edge of the window is re-sent
+        // until its acknowledgement round-trips, and by then its frame is below the window: those
+        // copies are the stream's redundancy, not lost input, and are not reported. (`has` never
+        // grows the ring, whatever the ordinal.)
+        if (ring.has(frame_number, ordinal)) return;
+
         // Reject far-future frame numbers. `frame_number` is an attacker-
-        // controlled varint; tick() only trims the PAST side of the pending
-        // log, so without this ceiling a peer can pin unbounded memory (and
-        // O(n) per-insert cost) by tagging actions near 2^32. A well-behaved
-        // client tags at most ~simulation_delay_ticks ahead plus jitter lead.
-        // Real runtime check — asserts strip in prod.
-        const future_horizon = this.current_sim_frame + this.simulation_delay_ticks + this.max_pending_future_lead;
+        // controlled varint; without this ceiling a peer can pin unbounded
+        // memory by tagging actions near 2^32. A well-behaved client tags at
+        // most ~simulation_delay_ticks ahead plus jitter lead. Real runtime
+        // check — asserts strip in prod. The horizon is also no further than
+        // this sender's ring tells frames apart: the ring was sized from the
+        // lead at the sender's first record, and a lead raised since must not
+        // put a record in a live frame's slot.
+        const future_horizon = Math.min(
+            this.current_sim_frame + this.simulation_delay_ticks + this.max_pending_future_lead,
+            this.#window_oldest() + ring.frame_span - 1,
+        );
         if (frame_number > future_horizon) {
-            this.#pending_dropped++;
-            this.onPendingActionDropped.send3(sender_id, frame_number, 'future');
+            this.#drop_pending(sender_id, frame_number, 'future');
             return;
         }
-        // Absolute backstop: even within the future window a peer can vary the
-        // payload to defeat the dedup below and pile up distinct entries.
-        if (this.#pending_frames.length >= this.max_pending_total) {
-            this.#pending_dropped++;
-            this.onPendingActionDropped.send3(sender_id, frame_number, 'capacity');
+        // And the past: tagged below the oldest frame the log can rewind to, a record can never be
+        // applied where it was tagged — a late-applying host folds only what is inside the window
+        // (see begin_tick). Dropped here rather than by the next tick's trim, so that it is never
+        // marked: the arrival ring tells frames apart only from the window to the horizon.
+        if (frame_number < this.#window_oldest()) {
+            this.#drop_pending(sender_id, frame_number, 'window');
             return;
         }
-
-        // Retransmissions are routine on the wire: `Replicator.pack_for_peer`
-        // packs every frame in [last_acked + 1, current_frame] each tick, so
-        // an action arrives once per tick until its ack round-trips, and
-        // several copies can land in the same server tick when the round trip
-        // exceeds the tick period. A copy is recognised by its whole identity,
-        // (sender_id, type_id, payload bytes) — distinct payloads from the
-        // same sender at the same frame are legitimately different actions
-        // (move + fire) and both flow through.
-        //
-        // First against everything already pending for the frame, which
-        // catches the copies that arrive before the frame is simulated.
-        for (let i = 0; i < this.#pending_frames.length; i++) {
-            if (this.#pending_frames[i] !== frame_number) continue;
-            if (this.#pending_senders[i] !== sender_id) continue;
-            if (this.#pending_type_ids[i] !== type_id) continue;
-            if (fastArrayEquals(this.#pending_payloads[i], payload)) return; // duplicate already in pending; drop
-        }
-
-        // Then against the action log, which catches the copies that arrive
-        // after it. A record the log already holds is not input — applying it
-        // again would apply the action twice, and rewinding for it would
-        // replay the world into the state it is already in — so it is dropped
-        // here, and pending holds only input the log does not. That is what
-        // lets `tick` take the oldest pending frame as its replay window
-        // without a second look.
-        //
-        // Frames are only open inside `tick`, and packets arrive between
-        // ticks, so an open frame here means a call pattern this orchestrator
-        // does not support (a packet delivered from inside a local-sim
-        // handler). The check is skipped rather than reading an open frame's
-        // stale length; the copy then costs one spurious rewind, and
-        // `__replay_frame`'s own dedup keeps it from applying twice.
-        if (this.action_log.has_frame(frame_number)
-            && !this.action_log.has_open_frame()
-            && this.#log_holds_record(frame_number, sender_id, type_id, payload)) {
+        // And the ordinal, which sizes the arrival ring's bitsets: bounded before the ring sees it.
+        if (ordinal >= this.max_records_per_frame) {
+            this.#drop_pending(sender_id, frame_number, 'ordinal');
             return;
         }
-
-        // And against input already folded into a later frame, which the log holds at that later
-        // frame and so the check above cannot see.
-        if (this.#was_folded(frame_number, sender_id, type_id, payload)) {
+        // Absolute backstop on buffered entries: within the window and the
+        // ordinal bound a peer can still pile up distinct entries.
+        if (this.#pending_frames.length >= this.max_pending_total) {
+            this.#drop_pending(sender_id, frame_number, 'capacity');
             return;
         }
 
+        ring.mark(frame_number, ordinal);
+
         this.#pending_frames.push(frame_number);
         this.#pending_senders.push(sender_id);
         this.#pending_type_ids.push(type_id);
@@ -1038,6 +1038,45 @@ export class ServerAuthoritativeServer {
         this.#track_referenced_frame(frame_number);
     }
 
+    /**
+     * The oldest frame the log can still rewind to, as of the last simulated frame.
+     * @returns {number}
+     * @private
+     */
+    #window_oldest() {
+        return Math.max(0, this.current_sim_frame - this.action_log.frame_capacity + 1);
+    }
+
+    /**
+     * @param {number} sender_id
+     * @returns {RecordArrivalRing}
+     * @private
+     */
+    #arrival_ring_for(sender_id) {
+        let ring = this.#arrivals.get(sender_id);
+        if (ring === undefined) {
+            // every frame a record can be accepted for, from the oldest rewindable to the horizon,
+            // as the bounds stand at the sender's first record; `#pending_add` clamps the horizon
+            // to it afterwards, so raising `max_pending_future_lead` reaches new senders only
+            ring = new RecordArrivalRing({
+                frame_span: this.action_log.frame_capacity + this.simulation_delay_ticks + this.max_pending_future_lead + 1,
+            });
+            this.#arrivals.set(sender_id, ring);
+        }
+        return ring;
+    }
+
+    /**
+     * @param {number} sender_id
+     * @param {number} frame_number
+     * @param {'future'|'window'|'ordinal'|'capacity'} reason
+     * @private
+     */
+    #drop_pending(sender_id, frame_number, reason) {
+        this.#pending_dropped++;
+        this.onPendingActionDropped.send3(sender_id, frame_number, reason);
+    }
+
     /**
      * Insert `frame_number` into the monotonically-sorted referenced-frames
      * index, leaving it untouched if already present. Single source of truth
@@ -1053,7 +1092,12 @@ export class ServerAuthoritativeServer {
         if (arr[i] !== frame_number) arr.splice(i, 0, frame_number);
     }
 
-    /** @private */
+    /**
+     * Drop every pending entry tagged below `window_oldest` — input that waited in pending while the
+     * window moved past it — and report each (`'window'`).
+     * @param {number} window_oldest
+     * @private
+     */
     #pending_trim_to_window(window_oldest) {
         let kept = 0;
         for (let i = 0; i < this.#pending_frames.length; i++) {
@@ -1063,6 +1107,8 @@ export class ServerAuthoritativeServer {
                 this.#pending_type_ids[kept] = this.#pending_type_ids[i];
                 this.#pending_payloads[kept] = this.#pending_payloads[i];
                 kept++;
+            } else {
+                this.#drop_pending(this.#pending_senders[i], this.#pending_frames[i], 'window');
             }
         }
         this.#pending_frames.length   = kept;
@@ -1077,7 +1123,9 @@ export class ServerAuthoritativeServer {
 
     /**
      * {@link LateInput.Apply}: move every pending entry tagged for a frame before `sim_frame` into
-     * `sim_frame`, remembering where it came from.
+     * `sim_frame`. Only where the record is applied moves: its identity is the frame its sender
+     * tagged and its ordinal there, marked in the arrival ring when it came, so its copies are still
+     * recognised, and two folded records alike in every byte are still two records.
      * @param {number} sim_frame
      * @private
      */
@@ -1086,20 +1134,7 @@ export class ServerAuthoritativeServer {
         let folded_any = false;
 
         for (let i = 0; i < frames.length; i++) {
-            const frame = frames[i];
-            if (frame >= sim_frame) continue;
-
-            let list = this.#folded.get(frame);
-            if (list === undefined) {
-                list = [];
-                this.#folded.set(frame, list);
-            }
-            list.push({
-                sender_id: this.#pending_senders[i],
-                type_id: this.#pending_type_ids[i],
-                payload: this.#pending_payloads[i],
-            });
-
+            if (frames[i] >= sim_frame) continue;
             frames[i] = sim_frame;
             folded_any = true;
         }
@@ -1112,26 +1147,6 @@ export class ServerAuthoritativeServer {
         }
     }
 
-    /**
-     * @param {number} frame_number
-     * @param {number} sender_id
-     * @param {number} type_id
-     * @param {Uint8Array} payload
-     * @returns {boolean}
-     * @private
-     */
-    #was_folded(frame_number, sender_id, type_id, payload) {
-        const list = this.#folded.get(frame_number);
-        if (list === undefined) return false;
-        for (let i = 0; i < list.length; i++) {
-            const f = list[i];
-            if (f.sender_id === sender_id && f.type_id === type_id && fastArrayEquals(f.payload, payload)) {
-                return true;
-            }
-        }
-        return false;
-    }
-
     /** @private */
     #pending_clear() {
         this.#pending_frames.length = 0;