@woosh/meep-engine 3.46.0 → 3.49.0

package/src/engine/network/transport/connection/Connection.js

@@ -0,0 +1,1262 @@
+import { assert } from "../../../../core/assert.js";
+import Signal from "../../../../core/events/signal/Signal.js";
+import { bytes_copy } from "./bytes_copy.js";
+import { RangeSet } from "./RangeSet.js";
+import { RX_ERROR, RX_NONE, RxStream } from "./RxStream.js";
+import { TxStream } from "./TxStream.js";
+import { varint_read, varint_size, varint_write } from "./varint.js";
+
+/**
+ * Reliable lanes. Each is an ordered stream of messages; the lanes are independent of each other.
+ * @readonly
+ * @enum {number}
+ */
+export const Lane = Object.freeze({
+    /** Engine control messages, one datagram each: resume answers, DISCONNECT. Not paced. */
+    CONTROL: 0,
+    /**
+     * Action-stream frames too large for a datagram. Not paced: the stream to the peer waits on
+     * them, and it cannot wait longer than its action log's ring.
+     */
+    FRAMES: 1,
+    /** Application messages that must arrive. Paced. */
+    USER: 2,
+    /** Large transfers: snapshot pages, state bursts. Paced, last. */
+    BULK: 3,
+});
+
+const LANE_COUNT = 4;
+
+/** Lanes the token bucket holds back. */
+const LANE_PACED = [false, false, true, true];
+
+/** Protocol version, in the high nibble of every datagram's flags byte. */
+const PROTOCOL_VERSION = 1;
+
+/*
+ Wire format, one datagram:
+
+   u8      flags            bit0 ACK present, bit1 packet number is 4 bytes (else 2),
+                            bits 4-7 protocol version
+   u16|u32 packet number    truncated, big-endian
+   [ACK]   varint largest acknowledged (full packet number)
+           varint ack delay, units of 8 µs
+           varint additional range count
+           varint first range (packets below largest acknowledged, contiguous)
+           count × (varint gap, varint range length)          RFC 9000 §19.3
+   frames  to the end of the datagram:
+           0x01 MESSAGE     varint length, bytes              unreliable, one datagram at most
+           0x02 PING        nothing                           asks for an ACK
+           0x10|lane STREAM varint offset, varint length, bytes   reliable
+*/
+
+const FLAG_ACK = 0x01;
+const FLAG_PN32 = 0x02;
+const FLAGS_KNOWN = FLAG_ACK | FLAG_PN32 | (PROTOCOL_VERSION << 4);
+
+const FRAME_MESSAGE = 0x01;
+const FRAME_PING = 0x02;
+const FRAME_STREAM = 0x10;
+const FRAME_STREAM_LANE_MASK = 0x03;
+
+/** flags byte + 4-byte packet number */
+const PACKET_HEADER_MAX = 5;
+/** type byte + 2-byte varint length (datagrams stay under 16,384 bytes) */
+const MESSAGE_FRAME_HEADER_MAX = 3;
+/** type byte + 8-byte offset + 2-byte length */
+const STREAM_FRAME_HEADER_MAX = 11;
+/** a stream frame is not started with less room than this for its bytes */
+const STREAM_FRAME_MIN_PAYLOAD = 16;
+
+/** RFC 9002 kPacketThreshold */
+const PACKET_THRESHOLD = 3;
+/** RFC 9002 kInitialRtt, ms */
+const INITIAL_RTT_MS = 333;
+
+/** Record kinds: what a packet carried that needs news of its fate. */
+const RECORD_MESSAGE = 1;
+const RECORD_STREAM = 2;
+
+/** In-flight packets at most; past this the oldest is given up as lost. */
+const MAX_IN_FLIGHT = 1 << 16;
+
+/** Ack delay is sent in units of 8 µs. */
+const ACK_DELAY_UNITS_PER_MS = 125;
+
+/** Most ranges one ACK frame may carry: a receiver refuses more. */
+const MAX_ACK_RANGES = 64;
+
+/**
+ * One connection to one peer over a datagram {@link Transport}: numbered packets acknowledged by
+ * ranges, unreliable messages of up to a datagram with a delivery notice each, and reliable lanes
+ * that carry messages of any size up to `max_message_bytes`, paced by a token bucket.
+ *
+ * Everything queued goes out on {@link flush}, packed into as few datagrams as fit. Everything
+ * received is handled inside the transport's receive callback. Time is whatever `clock` says; the
+ * connection never reads a clock of its own.
+ *
+ * The design is in `network/MESSAGE_TRANSPORT.md`. Loss detection, RTT and the probe timeout follow
+ * QUIC (RFC 9002), packet numbers and ACK ranges RFC 9000.
+ *
+ * @author Alex Goldring
+ * @copyright Company Named Limited (c) 2026
+ */
+export class Connection {
+    // ---------------------------------------------------------------- configuration
+
+    /** @type {{ send(bytes: Uint8Array, length: number): void, onReceive: Signal }} */
+    #transport;
+    /** @type {function(): number} */
+    #clock;
+    #max_datagram;
+    #rate_bytes_per_ms;
+    #burst_bytes;
+    #max_ack_ranges;
+    #max_ack_delay_ms;
+    /** RFC 9002 kGranularity: the clock's resolution, one tick */
+    #granularity_ms;
+    /** acknowledgements say what was delivered; nothing is lost and nothing is probed */
+    #lossless;
+    #max_queued_bytes;
+
+    // ---------------------------------------------------------------- send side
+
+    #next_pn = 0;
+    /** largest of our packet numbers the peer has acknowledged */
+    #largest_acked = -1;
+    /** every packet below this is retired (acked or lost) */
+    #oldest_unretired = 0;
+
+    // in-flight table, indexed by packet number & (capacity - 1)
+    #pkt_capacity = 256;
+    #pkt_pn = new Float64Array(256).fill(-1);
+    #pkt_sent_time = new Float64Array(256);
+    #pkt_size = new Uint16Array(256);
+    #pkt_rec_start = new Float64Array(256);
+    #pkt_rec_count = new Uint16Array(256);
+    /** largest packet number this packet's ACK reported, -1 when it carried none */
+    #pkt_ack_largest = new Float64Array(256);
+    #in_flight_count = 0;
+
+    // records ring, indexed by absolute record index % capacity
+    #rec_capacity = 1024;
+    #rec_kind = new Uint8Array(1024);
+    #rec_id = new Int32Array(1024);
+    #rec_offset = new Float64Array(1024);
+    #rec_length = new Int32Array(1024);
+    #rec_head = 0;
+
+    // RTT, RFC 9002 §5
+    #has_rtt = false;
+    #latest_rtt = 0;
+    #smoothed_rtt = INITIAL_RTT_MS;
+    #rttvar = INITIAL_RTT_MS / 2;
+    #min_rtt = 0;
+
+    #pto_count = 0;
+    #last_ack_eliciting_sent = 0;
+    #probe_pending = false;
+    /** a probe may send one paced datagram past an empty bucket */
+    #probe_credit = false;
+    /** bytes of paced lanes sent this flush: they always get one datagram's worth */
+    #paced_sent = 0;
+
+    #tokens;
+    #last_refill = -1;
+
+    /** @type {TxStream[]} */
+    #tx = [];
+
+    // unreliable queue for the next flush
+    #uq_bytes = new Uint8Array(2048);
+    #uq_used = 0;
+    #uq_count = 0;
+    #uq_offset = new Int32Array(32);
+    #uq_length = new Int32Array(32);
+    #uq_token = new Int32Array(32);
+
+    // datagram being built
+    #dgram;
+    #dgram_len = 0;
+    #dgram_open = false;
+    #dgram_pn = 0;
+    #dgram_flags = 0;
+    #dgram_ack_eliciting = false;
+    #dgram_rec_start = 0;
+    #dgram_ack_largest = -1;
+    #flush_sent_eliciting = false;
+    #flush_sent_any = false;
+
+    // ---------------------------------------------------------------- receive side
+
+    /** received packet numbers at or above {@link #rx_floor} */
+    #rx_ranges = new RangeSet(64);
+    /** packets below this are dropped: duplicates, or too old to matter */
+    #rx_floor = 0;
+    #largest_rx = -1;
+    #largest_rx_time = 0;
+    /** an ack-eliciting packet arrived since the last ACK went out */
+    #ack_pending = false;
+
+    /** @type {RxStream[]} */
+    #rx = [];
+
+    #cursor = { position: 0 };
+    #message_out = new Float64Array(1);
+    #peek_out = new Float64Array(2);
+    /** parsed ACK ranges of the packet being read, [high, low] inclusive pairs */
+    #ack_scratch = new Float64Array(2 * MAX_ACK_RANGES);
+
+    // Fates of unreliable messages, told once the walk that settled them is over: a handler may
+    // send, flush or dispose, and none of that may happen to the tables while they are being walked.
+    #notice_token = new Int32Array(64);
+    /** 1 acknowledged, 0 lost */
+    #notice_acked = new Uint8Array(64);
+    #notice_count = 0;
+    #notice_head = 0;
+
+    #disposed = false;
+
+    // ---------------------------------------------------------------- statistics
+
+    #stats = {
+        packets_sent: 0,
+        packets_received: 0,
+        packets_lost: 0,
+        packets_dropped: 0,
+        bytes_sent: 0,
+        bytes_received: 0,
+    };
+
+    /**
+     * @param {{
+     *   transport: { send(bytes: Uint8Array, length: number): void, onReceive: Signal, max_datagram_bytes?: number },
+     *   clock: function(): number,
+     *   send_rate_bytes_per_second: number,
+     *   max_message_bytes: number,
+     *   receive_window_bytes: number,
+     *   max_queued_bytes: number,
+     *   max_ack_delay_ms: number,
+     *   max_ack_ranges?: number,
+     * }} options
+     *   `clock` returns milliseconds and never runs backwards. `send_rate_bytes_per_second` paces
+     *   the BULK lane. `max_message_bytes` is the largest reliable message either side may send;
+     *   both ends must agree. `receive_window_bytes` bounds what each reliable lane may have in
+     *   flight past its acknowledged prefix, and so what a receiver holds out of order. Both ends
+     *   must agree on these two; a peer that exceeds them is a protocol error.
+     *   `max_queued_bytes` caps what one lane may hold unacknowledged: past it,
+     *   {@link send_reliable} throws rather than grow without bound.
+     *   `max_ack_delay_ms` is how long this side may sit on an ACK and the resolution of its
+     *   clock: its tick period. `max_ack_ranges` is how many ranges this side's ACKs report, at
+     *   most 64.
+     *
+     *   A transport that is itself reliable (`transport.reliable`, e.g. a WebSocket) delivers
+     *   every packet: nothing is declared lost and nothing is probed, or a stalled TCP stream
+     *   would be fed duplicates behind the originals.
+     */
+    constructor({
+                    transport,
+                    clock,
+                    send_rate_bytes_per_second,
+                    max_message_bytes,
+                    receive_window_bytes,
+                    max_queued_bytes,
+                    max_ack_delay_ms,
+                    max_ack_ranges = 32,
+                }) {
+        assert.ok(transport && typeof transport.send === 'function', 'transport must implement send()');
+        assert.ok(transport.onReceive, 'transport must expose onReceive');
+        assert.isFunction(clock, 'clock');
+        assert.isPositiveInteger(send_rate_bytes_per_second, 'send_rate_bytes_per_second');
+        assert.isPositiveInteger(max_message_bytes, 'max_message_bytes');
+        assert.isPositiveInteger(receive_window_bytes, 'receive_window_bytes');
+        assert.isPositiveInteger(max_queued_bytes, 'max_queued_bytes');
+        assert.isNumber(max_ack_delay_ms, 'max_ack_delay_ms');
+        assert.greaterThanOrEqual(max_ack_delay_ms, 0, 'max_ack_delay_ms');
+        assert.isPositiveInteger(max_ack_ranges, 'max_ack_ranges');
+        assert.lessThanOrEqual(max_ack_ranges, MAX_ACK_RANGES, 'max_ack_ranges');
+
+        const max_datagram = transport.max_datagram_bytes ?? 1200;
+        assert.isPositiveInteger(max_datagram, 'transport.max_datagram_bytes');
+        if (max_datagram < 64 || max_datagram > 16383) {
+            throw new RangeError(`Connection: transport.max_datagram_bytes ${max_datagram} must be in [64, 16383]`);
+        }
+
+        this.#transport = transport;
+        this.#clock = clock;
+        this.#max_datagram = max_datagram;
+        this.#rate_bytes_per_ms = send_rate_bytes_per_second / 1000;
+        this.#max_ack_ranges = max_ack_ranges;
+        this.#max_ack_delay_ms = max_ack_delay_ms;
+        this.#granularity_ms = Math.max(max_ack_delay_ms, 1);
+        this.#lossless = transport.reliable === true;
+        this.#max_queued_bytes = max_queued_bytes;
+        // sends happen once a tick, so the bucket holds two ticks of rate, and never less than two
+        // datagrams
+        this.#burst_bytes = Math.max(this.#rate_bytes_per_ms * 2 * this.#granularity_ms, 2 * max_datagram);
+        this.#tokens = this.#burst_bytes;
+
+        /** @type {number} @readonly */
+        this.max_message_bytes = max_message_bytes;
+
+        /**
+         * Largest unreliable message: what fits one datagram after the packet and frame headers.
+         * @type {number} @readonly
+         */
+        this.max_unreliable_message_bytes = max_datagram - PACKET_HEADER_MAX - MESSAGE_FRAME_HEADER_MAX;
+
+        for (let lane = 0; lane < LANE_COUNT; lane++) {
+            this.#tx.push(new TxStream(receive_window_bytes));
+            this.#rx.push(new RxStream(max_message_bytes, receive_window_bytes));
+        }
+
+        this.#dgram = new Uint8Array(max_datagram);
+
+        /**
+         * A message arrived: `(bytes, offset, length)`. `bytes` is the connection's or the
+         * transport's buffer, valid for the duration of the call only.
+         * @type {Signal}
+         */
+        this.onMessage = new Signal();
+
+        /**
+         * An unreliable message sent with a token arrived: `(token)`.
+         * @type {Signal}
+         */
+        this.onMessageAcked = new Signal();
+
+        /**
+         * An unreliable message sent with a token was lost: `(token)`. Lost means not confirmed:
+         * a message whose packet arrived but whose acknowledgement never got through — every ACK
+         * that could report it lost, or crowded out by newer ranges — is reported lost, as QUIC
+         * does.
+         * @type {Signal}
+         */
+        this.onMessageLost = new Signal();
+
+        /**
+         * A datagram that does not parse, or is of another protocol version, was dropped whole and
+         * unacknowledged: `(reason)`. The connection carries on; anyone can send a stray datagram.
+         * @type {Signal}
+         */
+        this.onMalformedDatagram = new Signal();
+
+        /**
+         * The connection is no longer whole: `(reason)`. The peer broke the protocol on a reliable
+         * lane — a message longer than `max_message_bytes`, bytes past the receive window, more
+         * holes than a sender keeping to its window makes — and the lane has stopped, so nothing
+         * more will arrive on it; or the peer acknowledged a packet this side never sent, so it
+         * took in a datagram that was not this side's and nothing it acknowledges can be trusted.
+         * The datagram carrying that ACK is dropped, as is every later one that repeats it.
+         *
+         * The connection does not authenticate datagrams: its transport must deliver only the
+         * peer's (DTLS and TLS do; a UDP socket filters by source address). The cure is a new
+         * connection.
+         * @type {Signal}
+         */
+        this.onProtocolError = new Signal();
+
+        transport.onReceive.add(this.#receive, this);
+    }
+
+    // ================================================================ public: sending
+
+    /**
+     * Queue an unreliable message for the next {@link flush}. With `token >= 0` the connection
+     * reports its fate: {@link onMessageAcked} once the packet carrying it is acknowledged, or
+     * {@link onMessageLost} once it is declared lost — exactly one of them.
+     *
+     * @param {Uint8Array} bytes
+     * @param {number} offset
+     * @param {number} length at most {@link max_unreliable_message_bytes}
+     * @param {number} token caller's id for the notice, or -1 for none
+     */
+    send_unreliable(bytes, offset, length, token) {
+        if (length > this.max_unreliable_message_bytes) {
+            throw new RangeError(`Connection.send_unreliable: ${length} bytes exceeds the ${this.max_unreliable_message_bytes}-byte datagram limit; send it on a reliable lane`);
+        }
+        const n = this.#uq_count;
+        if (n === this.#uq_offset.length) this.#grow_unreliable_queue();
+        if (this.#uq_used + length > this.#uq_bytes.length) {
+            let size = this.#uq_bytes.length * 2;
+            while (size < this.#uq_used + length) size *= 2;
+            const next = new Uint8Array(size);
+            next.set(this.#uq_bytes.subarray(0, this.#uq_used));
+            this.#uq_bytes = next;
+        }
+        bytes_copy(bytes, offset, this.#uq_bytes, this.#uq_used, length);
+        this.#uq_offset[n] = this.#uq_used;
+        this.#uq_length[n] = length;
+        this.#uq_token[n] = token;
+        this.#uq_used += length;
+        this.#uq_count = n + 1;
+    }
+
+    /**
+     * Queue a reliable message on `lane`. It arrives, whole and in order with the lane's other
+     * messages, unless the connection ends first.
+     *
+     * @param {number} lane one of {@link Lane}
+     * @param {Uint8Array} bytes
+     * @param {number} offset
+     * @param {number} length at most {@link max_message_bytes}
+     * @returns {number} delivery mark: see {@link is_delivered}
+     */
+    send_reliable(lane, bytes, offset, length) {
+        if (length > this.max_message_bytes) {
+            throw new RangeError(`Connection.send_reliable: ${length} bytes exceeds max_message_bytes ${this.max_message_bytes}`);
+        }
+        const tx = this.#tx[lane];
+        if (tx.end - tx.acked_prefix + length > this.#max_queued_bytes) {
+            throw new RangeError(`Connection.send_reliable: lane ${lane} already holds ${tx.end - tx.acked_prefix} unacknowledged bytes; ${length} more would pass max_queued_bytes ${this.#max_queued_bytes}`);
+        }
+        return tx.append(bytes, offset, length);
+    }
+
+    /**
+     * Whether every message on `lane` up to the one whose mark this is has been acknowledged.
+     * @param {number} lane
+     * @param {number} mark from {@link send_reliable}
+     * @returns {boolean}
+     */
+    is_delivered(lane, mark) {
+        return this.#tx[lane].acked_prefix >= mark;
+    }
+
+    /**
+     * Bytes queued on `lane` the peer has not acknowledged.
+     * @param {number} lane
+     * @returns {number}
+     */
+    unacked_bytes(lane) {
+        const tx = this.#tx[lane];
+        return tx.end - tx.acked_prefix;
+    }
+
+    /**
+     * Send everything queued that may go now, packed into as few datagrams as fit: the ACK, the
+     * CONTROL lane, unreliable messages, then the BULK lane while the token bucket allows. Also
+     * runs the loss and probe timers.
+     */
+    flush() {
+        if (this.#disposed) return;
+        const now = this.#clock();
+
+        this.#detect_lost(now);
+        this.#check_probe_timeout(now);
+        this.#refill(now);
+
+        this.#flush_sent_eliciting = false;
+        this.#flush_sent_any = false;
+
+        this.#paced_sent = 0;
+        this.#send_stream(Lane.CONTROL, now);
+        this.#send_unreliable_queue(now);
+        this.#send_stream(Lane.FRAMES, now);
+        this.#send_stream(Lane.USER, now);
+        this.#send_stream(Lane.BULK, now);
+        this.#probe_credit = false;
+
+        if (this.#probe_pending && !this.#flush_sent_eliciting && !this.#dgram_ack_eliciting) {
+            this.#ensure_room(1, now);
+            this.#dgram[this.#dgram_len++] = FRAME_PING;
+            this.#dgram_ack_eliciting = true;
+        }
+        this.#probe_pending = false;
+
+        if (this.#ack_pending && !this.#dgram_open && !this.#flush_sent_any) {
+            // An ACK with nothing else to carry it. Once a round trip it asks for an ACK itself: a
+            // side that only ever acknowledges never hears which of its ACKs arrived, so it could
+            // never stop reporting old ranges (RFC 9000 §13.2.4).
+            this.#open_packet(now);
+            if (now - this.#last_ack_eliciting_sent >= this.#smoothed_rtt) {
+                this.#dgram[this.#dgram_len++] = FRAME_PING;
+                this.#dgram_ack_eliciting = true;
+            }
+        }
+
+        this.#close_packet(now);
+        this.#emit_notices();
+    }
+
+    // ================================================================ public: diagnostics
+
+    /** Smoothed round-trip time, ms; RFC 9002's initial 333 ms until the first sample. */
+    get smoothed_rtt() {
+        return this.#smoothed_rtt;
+    }
+
+    /** Packets sent and not yet acknowledged or declared lost that asked for an ACK. */
+    get in_flight_count() {
+        return this.#in_flight_count;
+    }
+
+    /** Most bytes one reliable lane may hold unacknowledged; {@link send_reliable} throws past it. */
+    get max_queued_bytes() {
+        return this.#max_queued_bytes;
+    }
+
+    /**
+     * @returns {{packets_sent: number, packets_received: number, packets_lost: number, packets_dropped: number, bytes_sent: number, bytes_received: number}}
+     */
+    getStats() {
+        return { ...this.#stats };
+    }
+
+    /**
+     * Stop: no more receiving, and nothing queued will be sent. Call {@link flush} first for a
+     * last send.
+     */
+    dispose() {
+        if (this.#disposed) return;
+        this.#disposed = true;
+        this.#transport.onReceive.remove(this.#receive, this);
+        this.#uq_count = 0;
+        this.#uq_used = 0;
+        this.#notice_count = 0;
+        this.#notice_head = 0;
+        for (let lane = 0; lane < LANE_COUNT; lane++) {
+            this.#tx[lane].clear();
+            this.#rx[lane].clear();
+        }
+    }
+
+    // ================================================================ sending internals
+
+    #refill(now) {
+        if (this.#last_refill < 0) {
+            this.#last_refill = now;
+            return;
+        }
+        const elapsed = now - this.#last_refill;
+        if (elapsed <= 0) return;
+        this.#last_refill = now;
+        this.#tokens = Math.min(this.#burst_bytes, this.#tokens + elapsed * this.#rate_bytes_per_ms);
+    }
+
+    /**
+     * Send what `lane` has: re-sends first, then new bytes up to its window. A paced lane stops
+     * when the bucket is empty, except that paced lanes always get one datagram's worth a flush (so
+     * unpaced traffic cannot starve them) and a probe always goes.
+     */
+    #send_stream(lane, now) {
+        const tx = this.#tx[lane];
+        const paced = LANE_PACED[lane];
+        const out = this.#peek_out;
+        while (tx.has_sendable()) {
+            if (paced && this.#tokens - this.#dgram_len <= 0 && this.#paced_sent >= this.#max_datagram) {
+                if (!this.#probe_credit) return;
+                this.#probe_credit = false;
+            }
+            this.#ensure_room(STREAM_FRAME_HEADER_MAX + STREAM_FRAME_MIN_PAYLOAD, now);
+            const room = this.#max_datagram - this.#dgram_len - STREAM_FRAME_HEADER_MAX;
+            tx.peek(room, out);
+            const offset = out[0];
+            const length = out[1];
+            if (length <= 0) return;
+
+            const d = this.#dgram;
+            let p = this.#dgram_len;
+            d[p++] = FRAME_STREAM | lane;
+            p = varint_write(d, p, offset);
+            p = varint_write(d, p, length);
+            tx.copy_out(offset, length, d, p);
+            this.#dgram_len = p + length;
+            this.#dgram_ack_eliciting = true;
+
+            tx.mark_sent(offset, length);
+            this.#push_record(RECORD_STREAM, lane, offset, length);
+            if (paced) this.#paced_sent += length;
+        }
+    }
+
+    #send_unreliable_queue(now) {
+        const n = this.#uq_count;
+        for (let i = 0; i < n; i++) {
+            const length = this.#uq_length[i];
+            this.#ensure_room(1 + varint_size(length) + length, now);
+            const d = this.#dgram;
+            let p = this.#dgram_len;
+            d[p++] = FRAME_MESSAGE;
+            p = varint_write(d, p, length);
+            const from = this.#uq_offset[i];
+            bytes_copy(this.#uq_bytes, from, d, p, length);
+            this.#dgram_len = p + length;
+            this.#dgram_ack_eliciting = true;
+
+            const token = this.#uq_token[i];
+            if (token >= 0) this.#push_record(RECORD_MESSAGE, token, 0, 0);
+        }
+        this.#uq_count = 0;
+        this.#uq_used = 0;
+    }
+
+    /**
+     * Make sure the open datagram has `bytes` of room, closing it and opening the next if not.
+     */
+    #ensure_room(bytes, now) {
+        if (this.#dgram_open && this.#dgram_len + bytes <= this.#max_datagram) return;
+        this.#close_packet(now);
+        this.#open_packet(now);
+        if (this.#dgram_len + bytes > this.#max_datagram) {
+            // the ACK that opens a flush's first datagram leaves too little: it goes alone, and the
+            // next datagram carries none
+            this.#close_packet(now);
+            this.#open_packet(now);
+        }
+    }
+
+    #open_packet(now) {
+        const pn = this.#next_pn++;
+        this.#dgram_pn = pn;
+        this.#dgram_open = true;
+        this.#dgram_ack_eliciting = false;
+        this.#dgram_rec_start = this.#rec_head;
+        this.#dgram_ack_largest = -1;
+
+        // 2 bytes while the receiver can still expand it: RFC 9000 §17.1
+        const unacked = pn - this.#largest_acked;
+        const long = unacked >= 16384;
+        this.#dgram_flags = long ? FLAG_PN32 : 0;
+        const d = this.#dgram;
+        let p = 1;
+        if (long) {
+            d[p++] = (pn >>> 24) & 0xFF;
+            d[p++] = (pn >>> 16) & 0xFF;
+        }
+        d[p++] = (pn >>> 8) & 0xFF;
+        d[p++] = pn & 0xFF;
+        this.#dgram_len = p;
+
+        // the first datagram of a flush acknowledges what has been received
+        if (!this.#rx_ranges.is_empty() && !this.#flush_sent_any) {
+            this.#write_ack(now);
+        }
+    }
+
+    #write_ack(now) {
+        const ranges = this.#rx_ranges;
+        const top = ranges.count - 1;
+        const largest = ranges.end(top) - 1;
+        const delay_ms = Math.max(0, now - this.#largest_rx_time);
+        const delay = Math.min(Math.round(delay_ms * ACK_DELAY_UNITS_PER_MS), 1073741823);
+        const first = largest - ranges.start(top);
+
+        // As many ranges as fit half the datagram, newest first: the rest of it is for frames. The
+        // ranges left out are older; the peer learns of them from a later ACK, or declares them lost.
+        const room = ((this.#max_datagram - PACKET_HEADER_MAX) >> 1) - this.#dgram_len;
+        let size = varint_size(largest) + varint_size(delay) + 1 + varint_size(first);
+        let reported = 1;
+        {
+            let previous_start = ranges.start(top);
+            const most = Math.min(ranges.count, this.#max_ack_ranges);
+            for (let i = top - 1; reported < most; i--, reported++) {
+                const s = ranges.start(i);
+                const e = ranges.end(i);
+                const more = varint_size(previous_start - e - 1) + varint_size(e - 1 - s);
+                if (size + more > room) break;
+                size += more;
+                previous_start = s;
+            }
+        }
+
+        const d = this.#dgram;
+        let p = this.#dgram_len;
+        p = varint_write(d, p, largest);
+        p = varint_write(d, p, delay);
+        p = varint_write(d, p, reported - 1);
+        p = varint_write(d, p, first);
+        let previous_start = ranges.start(top);
+        for (let i = top - 1; i > top - reported; i--) {
+            const s = ranges.start(i);
+            const e = ranges.end(i);
+            p = varint_write(d, p, previous_start - e - 1);
+            p = varint_write(d, p, e - 1 - s);
+            previous_start = s;
+        }
+        this.#dgram_len = p;
+        this.#dgram_flags |= FLAG_ACK;
+        this.#dgram_ack_largest = largest;
+        this.#ack_pending = false;
+    }
+
+    #close_packet(now) {
+        if (!this.#dgram_open) return;
+        this.#dgram_open = false;
+        const d = this.#dgram;
+        d[0] = this.#dgram_flags | (PROTOCOL_VERSION << 4);
+        const length = this.#dgram_len;
+        this.#transport.send(d, length);
+
+        this.#flush_sent_any = true;
+        // unpaced traffic may take the bucket below zero, never more than a burst below
+        this.#tokens = Math.max(this.#tokens - length, -this.#burst_bytes);
+        this.#stats.packets_sent++;
+        this.#stats.bytes_sent += length;
+
+        if (!this.#dgram_ack_eliciting) return;
+        this.#flush_sent_eliciting = true;
+
+        const pn = this.#dgram_pn;
+        this.#ensure_packet_capacity(pn);
+        const slot = pn & (this.#pkt_capacity - 1);
+        this.#pkt_pn[slot] = pn;
+        this.#pkt_sent_time[slot] = now;
+        this.#pkt_size[slot] = length;
+        this.#pkt_rec_start[slot] = this.#dgram_rec_start;
+        this.#pkt_rec_count[slot] = this.#rec_head - this.#dgram_rec_start;
+        this.#pkt_ack_largest[slot] = this.#dgram_ack_largest;
+        this.#in_flight_count++;
+        this.#last_ack_eliciting_sent = now;
+    }
+
+    #push_record(kind, id, offset, length) {
+        const oldest = this.#oldest_record_in_use();
+        if (this.#rec_head - oldest >= this.#rec_capacity) this.#grow_records(oldest);
+        const i = this.#rec_head % this.#rec_capacity;
+        this.#rec_kind[i] = kind;
+        this.#rec_id[i] = id;
+        this.#rec_offset[i] = offset;
+        this.#rec_length[i] = length;
+        this.#rec_head++;
+    }
+
+    /** Absolute index of the oldest record a packet still in flight (or being built) may own. */
+    #oldest_record_in_use() {
+        if (this.#in_flight_count > 0) {
+            for (let pn = this.#oldest_unretired; pn < this.#next_pn; pn++) {
+                const slot = pn & (this.#pkt_capacity - 1);
+                if (this.#pkt_pn[slot] === pn) return this.#pkt_rec_start[slot];
+            }
+        }
+        return this.#dgram_open ? this.#dgram_rec_start : this.#rec_head;
+    }
+
+    #grow_records(oldest) {
+        const old_capacity = this.#rec_capacity;
+        const capacity = old_capacity * 2;
+        const kind = new Uint8Array(capacity);
+        const id = new Int32Array(capacity);
+        const offset = new Float64Array(capacity);
+        const length = new Int32Array(capacity);
+        for (let r = oldest; r < this.#rec_head; r++) {
+            const from = r % old_capacity;
+            const to = r % capacity;
+            kind[to] = this.#rec_kind[from];
+            id[to] = this.#rec_id[from];
+            offset[to] = this.#rec_offset[from];
+            length[to] = this.#rec_length[from];
+        }
+        this.#rec_capacity = capacity;
+        this.#rec_kind = kind;
+        this.#rec_id = id;
+        this.#rec_offset = offset;
+        this.#rec_length = length;
+    }
+
+    #ensure_packet_capacity(pn) {
+        while (pn - this.#oldest_unretired >= this.#pkt_capacity) {
+            if (this.#pkt_capacity >= MAX_IN_FLIGHT) {
+                // the peer has gone quiet for longer than any link holds packets: give the oldest up
+                this.#retire_lost(this.#oldest_unretired);
+                // never past `pn`: it is the packet being recorded, not yet in the table
+                this.#advance_oldest_unretired(pn);
+                continue;
+            }
+            this.#grow_packets();
+        }
+    }
+
+    #grow_packets() {
+        const old_capacity = this.#pkt_capacity;
+        const capacity = old_capacity * 2;
+        const pn_ = new Float64Array(capacity).fill(-1);
+        const sent = new Float64Array(capacity);
+        const size = new Uint16Array(capacity);
+        const rec_start = new Float64Array(capacity);
+        const rec_count = new Uint16Array(capacity);
+        const ack_largest = new Float64Array(capacity);
+        for (let i = 0; i < old_capacity; i++) {
+            const pn = this.#pkt_pn[i];
+            if (pn < 0) continue;
+            const to = pn % capacity;
+            pn_[to] = pn;
+            sent[to] = this.#pkt_sent_time[i];
+            size[to] = this.#pkt_size[i];
+            rec_start[to] = this.#pkt_rec_start[i];
+            rec_count[to] = this.#pkt_rec_count[i];
+            ack_largest[to] = this.#pkt_ack_largest[i];
+        }
+        this.#pkt_capacity = capacity;
+        this.#pkt_pn = pn_;
+        this.#pkt_sent_time = sent;
+        this.#pkt_size = size;
+        this.#pkt_rec_start = rec_start;
+        this.#pkt_rec_count = rec_count;
+        this.#pkt_ack_largest = ack_largest;
+    }
+
+    // ================================================================ loss, RTT, probe
+
+    #loss_delay() {
+        const rtt = this.#has_rtt ? Math.max(this.#latest_rtt, this.#smoothed_rtt) : INITIAL_RTT_MS;
+        return Math.max(rtt * 9 / 8, this.#granularity_ms);
+    }
+
+    /**
+     * RFC 9002 §6.1: a packet is lost once a packet {@link PACKET_THRESHOLD} later is acknowledged,
+     * or once it is older than the loss delay and something sent after it has been acknowledged.
+     */
+    #detect_lost(now) {
+        const largest = this.#largest_acked;
+        if (this.#lossless || largest < 0 || this.#in_flight_count === 0) return;
+        const lost_before = now - this.#loss_delay();
+        const mask = this.#pkt_capacity - 1;
+        const last = Math.min(largest - 1, this.#next_pn - 1);
+        for (let pn = this.#oldest_unretired; pn <= last; pn++) {
+            const slot = pn & mask;
+            if (this.#pkt_pn[slot] !== pn) continue;
+            if (largest - pn >= PACKET_THRESHOLD || this.#pkt_sent_time[slot] <= lost_before) {
+                this.#retire_lost(pn);
+            }
+        }
+        this.#advance_oldest_unretired();
+    }
+
+    /**
+     * RFC 9002 §6.2: with ack-eliciting packets outstanding and no ACK for a probe timeout, send
+     * the oldest outstanding reliable bytes again (or a PING when only unreliable messages are
+     * outstanding) to draw an ACK. Backs off by doubling.
+     */
+    #check_probe_timeout(now) {
+        if (this.#lossless || this.#in_flight_count === 0) {
+            this.#pto_count = 0;
+            return;
+        }
+        const pto = (this.#smoothed_rtt + Math.max(4 * this.#rttvar, this.#granularity_ms) + this.#max_ack_delay_ms)
+            * (1 << Math.min(this.#pto_count, 16));
+        if (now - this.#last_ack_eliciting_sent < pto) return;
+
+        this.#pto_count++;
+        this.#probe_credit = true;
+        const mask = this.#pkt_capacity - 1;
+        for (let pn = this.#oldest_unretired; pn < this.#next_pn; pn++) {
+            const slot = pn & mask;
+            if (this.#pkt_pn[slot] !== pn) continue;
+            if (this.#requeue_stream_records(slot)) return;
+        }
+        this.#probe_pending = true;
+    }
+
+    /**
+     * Queue the reliable bytes a packet carried for re-sending, leaving the packet in flight.
+     * @returns {boolean} whether any of them is still unacknowledged: a packet whose bytes were
+     *   all acknowledged by another (an earlier probe's, or the one it re-sent) has nothing to
+     *   probe with
+     */
+    #requeue_stream_records(slot) {
+        const start = this.#pkt_rec_start[slot];
+        const count = this.#pkt_rec_count[slot];
+        let any = false;
+        for (let r = start; r < start + count; r++) {
+            const i = r % this.#rec_capacity;
+            if (this.#rec_kind[i] !== RECORD_STREAM) continue;
+            if (this.#tx[this.#rec_id[i]].on_lost(this.#rec_offset[i], this.#rec_length[i])) any = true;
+        }
+        return any;
+    }
+
+    #retire_lost(pn) {
+        const slot = pn & (this.#pkt_capacity - 1);
+        if (this.#pkt_pn[slot] !== pn) return;
+        this.#pkt_pn[slot] = -1;
+        this.#in_flight_count--;
+        this.#stats.packets_lost++;
+
+        const start = this.#pkt_rec_start[slot];
+        const count = this.#pkt_rec_count[slot];
+        for (let r = start; r < start + count; r++) {
+            const i = r % this.#rec_capacity;
+            const kind = this.#rec_kind[i];
+            if (kind === RECORD_STREAM) {
+                this.#tx[this.#rec_id[i]].on_lost(this.#rec_offset[i], this.#rec_length[i]);
+            } else if (kind === RECORD_MESSAGE) {
+                this.#queue_notice(this.#rec_id[i], 0);
+            }
+        }
+    }
+
+    /**
+     * @param {number} token
+     * @param {number} acked 1 acknowledged, 0 lost
+     */
+    #queue_notice(token, acked) {
+        const n = this.#notice_count;
+        if (n === this.#notice_token.length) {
+            const token_next = new Int32Array(n * 2);
+            const acked_next = new Uint8Array(n * 2);
+            token_next.set(this.#notice_token);
+            acked_next.set(this.#notice_acked);
+            this.#notice_token = token_next;
+            this.#notice_acked = acked_next;
+        }
+        this.#notice_token[n] = token;
+        this.#notice_acked[n] = acked;
+        this.#notice_count = n + 1;
+    }
+
+    /**
+     * Tell the queued fates, in order. A handler may flush — which tells the rest, and its own —
+     * or dispose, after which nothing more is told.
+     */
+    #emit_notices() {
+        while (this.#notice_head < this.#notice_count && !this.#disposed) {
+            const i = this.#notice_head++;
+            const token = this.#notice_token[i];
+            if (this.#notice_acked[i] !== 0) {
+                this.onMessageAcked.send1(token);
+            } else {
+                this.onMessageLost.send1(token);
+            }
+        }
+        this.#notice_head = 0;
+        this.#notice_count = 0;
+    }
+
+    #retire_acked(pn) {
+        const slot = pn & (this.#pkt_capacity - 1);
+        this.#pkt_pn[slot] = -1;
+        this.#in_flight_count--;
+
+        // the peer has seen our ACK up to this: it need not hear of those packets again
+        const reported = this.#pkt_ack_largest[slot];
+        if (reported >= 0 && reported + 1 > this.#rx_floor) {
+            this.#rx_floor = reported + 1;
+            this.#rx_ranges.remove_below(this.#rx_floor);
+        }
+
+        const start = this.#pkt_rec_start[slot];
+        const count = this.#pkt_rec_count[slot];
+        for (let r = start; r < start + count; r++) {
+            const i = r % this.#rec_capacity;
+            const kind = this.#rec_kind[i];
+            if (kind === RECORD_STREAM) {
+                this.#tx[this.#rec_id[i]].on_acked(this.#rec_offset[i], this.#rec_length[i]);
+            } else if (kind === RECORD_MESSAGE) {
+                this.#queue_notice(this.#rec_id[i], 1);
+            }
+        }
+    }
+
+    /**
+     * Move the oldest-unretired mark up to the oldest packet still in flight, or to `limit`.
+     * @param {number} [limit]
+     */
+    #advance_oldest_unretired(limit = this.#next_pn) {
+        const mask = this.#pkt_capacity - 1;
+        let pn = this.#oldest_unretired;
+        while (pn < limit && this.#pkt_pn[pn & mask] !== pn) pn++;
+        this.#oldest_unretired = pn;
+    }
+
+    #update_rtt(latest, ack_delay) {
+        this.#latest_rtt = latest;
+        if (!this.#has_rtt) {
+            this.#has_rtt = true;
+            this.#min_rtt = latest;
+            this.#smoothed_rtt = latest;
+            this.#rttvar = latest / 2;
+            return;
+        }
+        this.#min_rtt = Math.min(this.#min_rtt, latest);
+        const delay = Math.min(ack_delay, this.#max_ack_delay_ms);
+        const adjusted = latest >= this.#min_rtt + delay ? latest - delay : latest;
+        this.#rttvar = 0.75 * this.#rttvar + 0.25 * Math.abs(this.#smoothed_rtt - adjusted);
+        this.#smoothed_rtt = 0.875 * this.#smoothed_rtt + 0.125 * adjusted;
+    }
+
+    // ================================================================ receiving
+
+    /**
+     * @param {Uint8Array} bytes
+     * @param {number} length
+     */
+    #receive(bytes, length) {
+        if (this.#disposed) return;
+        const now = this.#clock();
+        this.#stats.bytes_received += length;
+
+        if (length < 3) {
+            this.#drop('datagram shorter than a packet header');
+            return;
+        }
+        const flags = bytes[0];
+        if ((flags >>> 4) !== PROTOCOL_VERSION) {
+            this.#drop(`protocol version ${flags >>> 4}, expected ${PROTOCOL_VERSION}`);
+            return;
+        }
+        if ((flags & ~FLAGS_KNOWN) !== 0) {
+            this.#drop('unknown flags');
+            return;
+        }
+        let p = 1;
+        let truncated;
+        let bits;
+        if ((flags & FLAG_PN32) !== 0) {
+            if (length < 5) {
+                this.#drop('datagram shorter than its packet number');
+                return;
+            }
+            truncated = ((bytes[1] << 24) >>> 0) + (bytes[2] << 16) + (bytes[3] << 8) + bytes[4];
+            bits = 32;
+            p = 5;
+        } else {
+            truncated = (bytes[1] << 8) | bytes[2];
+            bits = 16;
+            p = 3;
+        }
+        const pn = this.#expand_packet_number(truncated, bits);
+
+        if (pn < this.#rx_floor || this.#rx_ranges.contains(pn)) {
+            this.#stats.packets_dropped++;
+            return; // a duplicate, or too old to matter
+        }
+
+        // Pass 1: the whole packet must parse before any of it is acted on.
+        const ack_end = this.#validate(bytes, p, length, flags);
+        if (ack_end < 0) return;
+
+        this.#stats.packets_received++;
+        this.#rx_ranges.add(pn, pn + 1);
+        if (pn > this.#largest_rx) {
+            this.#largest_rx = pn;
+            this.#largest_rx_time = now;
+        }
+        if (this.#rx_ranges.count > this.#max_ack_ranges) {
+            this.#rx_ranges.keep_highest(this.#max_ack_ranges);
+            this.#rx_floor = Math.max(this.#rx_floor, this.#rx_ranges.min());
+        }
+
+        // Pass 2.
+        if ((flags & FLAG_ACK) !== 0) {
+            this.#process_ack(bytes, p, ack_end, now);
+            this.#emit_notices();
+            if (this.#disposed) return;
+        }
+        this.#process_frames(bytes, ack_end, length);
+    }
+
+    /**
+     * RFC 9000 Appendix A.3.
+     */
+    #expand_packet_number(truncated, bits) {
+        const expected = this.#largest_rx + 1;
+        const win = 2 ** bits;
+        const hwin = win / 2;
+        let candidate = expected - (expected % win) + truncated;
+        if (candidate <= expected - hwin) {
+            candidate += win;
+        } else if (candidate > expected + hwin && candidate >= win) {
+            candidate -= win;
+        }
+        return candidate;
+    }
+
+    #drop(reason) {
+        this.#stats.packets_dropped++;
+        this.onMalformedDatagram.send1(reason);
+    }
+
+    /**
+     * Check a packet's structure without acting on it.
+     * @returns {number} where the frames start, or -1 when it is malformed (already reported)
+     */
+    #validate(bytes, start, end, flags) {
+        const cursor = this.#cursor;
+        cursor.position = start;
+        let frames_start = start;
+
+        if ((flags & FLAG_ACK) !== 0) {
+            const largest = varint_read(bytes, cursor, end);
+            const delay = varint_read(bytes, cursor, end);
+            const more = varint_read(bytes, cursor, end);
+            const first = varint_read(bytes, cursor, end);
+            if (largest < 0 || delay < 0 || more < 0 || first < 0) {
+                this.#drop('truncated ACK');
+                return -1;
+            }
+            if (first > largest || more + 1 > MAX_ACK_RANGES) {
+                this.#drop('ACK out of range');
+                return -1;
+            }
+            if (largest >= this.#next_pn) {
+                // Not a malformed datagram to shrug off: the peer took in one that was not ours,
+                // and will report it in every ACK it writes (see onProtocolError).
+                this.#stats.packets_dropped++;
+                this.onProtocolError.send1(`ACK of packet ${largest}, which was never sent (${this.#next_pn} sent): the peer took in a datagram that was not this side's`);
+                return -1;
+            }
+            let low = largest - first;
+            for (let i = 0; i < more; i++) {
+                const gap = varint_read(bytes, cursor, end);
+                const run = varint_read(bytes, cursor, end);
+                if (gap < 0 || run < 0) {
+                    this.#drop('truncated ACK range');
+                    return -1;
+                }
+                const high = low - gap - 2;
+                if (high < 0 || run > high) {
+                    this.#drop('ACK range below zero');
+                    return -1;
+                }
+                low = high - run;
+            }
+            frames_start = cursor.position;
+        }
+
+        while (cursor.position < end) {
+            const type = bytes[cursor.position++];
+            if (type === FRAME_MESSAGE) {
+                const length = varint_read(bytes, cursor, end);
+                if (length < 0 || cursor.position + length > end) {
+                    this.#drop('truncated MESSAGE');
+                    return -1;
+                }
+                cursor.position += length;
+            } else if (type === FRAME_PING) {
+                // nothing
+            } else if ((type & ~FRAME_STREAM_LANE_MASK) === FRAME_STREAM) {
+                const lane = type & FRAME_STREAM_LANE_MASK;
+                const offset = varint_read(bytes, cursor, end);
+                const length = varint_read(bytes, cursor, end);
+                if (lane >= LANE_COUNT || offset < 0 || length < 0 || cursor.position + length > end) {
+                    this.#drop('malformed STREAM');
+                    return -1;
+                }
+                cursor.position += length;
+            } else {
+                this.#drop(`unknown frame type ${type}`);
+                return -1;
+            }
+        }
+        return frames_start;
+    }
+
+    #process_ack(bytes, start, end, now) {
+        const cursor = this.#cursor;
+        cursor.position = start;
+        const largest = varint_read(bytes, cursor, end);
+        const delay = varint_read(bytes, cursor, end);
+        const more = varint_read(bytes, cursor, end);
+        const first = varint_read(bytes, cursor, end);
+
+        const ranges = this.#ack_scratch;
+        let count = 0;
+        let high = largest;
+        let low = largest - first;
+        ranges[count++] = high;
+        ranges[count++] = low;
+        for (let i = 0; i < more; i++) {
+            const gap = varint_read(bytes, cursor, end);
+            const run = varint_read(bytes, cursor, end);
+            high = low - gap - 2;
+            low = high - run;
+            ranges[count++] = high;
+            ranges[count++] = low;
+        }
+
+        const mask = this.#pkt_capacity - 1;
+
+        // RTT from the largest acknowledged, when it is newly acknowledged
+        const largest_slot = largest & mask;
+        let newly_acked_any = false;
+        if (this.#pkt_pn[largest_slot] === largest) {
+            this.#update_rtt(now - this.#pkt_sent_time[largest_slot], delay / ACK_DELAY_UNITS_PER_MS);
+        }
+
+        for (let i = 0; i < count; i += 2) {
+            const range_high = Math.min(ranges[i], this.#next_pn - 1);
+            const range_low = Math.max(ranges[i + 1], this.#oldest_unretired);
+            for (let pn = range_low; pn <= range_high; pn++) {
+                if (this.#pkt_pn[pn & mask] !== pn) continue;
+                newly_acked_any = true;
+                this.#retire_acked(pn);
+            }
+        }
+
+        if (largest > this.#largest_acked) this.#largest_acked = largest;
+        if (newly_acked_any) this.#pto_count = 0;
+
+        this.#advance_oldest_unretired();
+        this.#detect_lost(now);
+    }
+
+    #process_frames(bytes, start, end) {
+        const cursor = this.#cursor;
+        cursor.position = start;
+        let ack_eliciting = false;
+        while (cursor.position < end) {
+            const type = bytes[cursor.position++];
+            if (type === FRAME_MESSAGE) {
+                ack_eliciting = true;
+                const length = varint_read(bytes, cursor, end);
+                const at = cursor.position;
+                cursor.position = at + length;
+                const resume = cursor.position;
+                this.onMessage.send3(bytes, at, length);
+                if (this.#disposed) return;
+                cursor.position = resume;
+            } else if (type === FRAME_PING) {
+                ack_eliciting = true;
+            } else {
+                ack_eliciting = true;
+                const lane = type & FRAME_STREAM_LANE_MASK;
+                const offset = varint_read(bytes, cursor, end);
+                const length = varint_read(bytes, cursor, end);
+                const at = cursor.position;
+                cursor.position = at + length;
+                const resume = cursor.position;
+                const rx = this.#rx[lane];
+                if (rx.failed) continue;
+                if (!rx.receive(offset, bytes, at, length)) {
+                    this.onProtocolError.send1(`lane ${lane}: ${rx.failure}`);
+                    if (this.#disposed) return;
+                    cursor.position = resume;
+                    continue;
+                }
+                this.#deliver_lane(lane);
+                if (this.#disposed) return;
+                cursor.position = resume;
+            }
+        }
+        if (ack_eliciting) this.#ack_pending = true;
+    }
+
+    #deliver_lane(lane) {
+        const rx = this.#rx[lane];
+        const out = this.#message_out;
+        for (; ;) {
+            const length = rx.next_message(out);
+            if (length === RX_NONE) return;
+            if (length === RX_ERROR) {
+                this.onProtocolError.send1(`lane ${lane}: ${rx.failure}`);
+                return;
+            }
+            this.onMessage.send3(rx.bytes, out[0], length);
+            if (this.#disposed) return;
+        }
+    }
+
+    #grow_unreliable_queue() {
+        const capacity = this.#uq_offset.length * 2;
+        const offset = new Int32Array(capacity);
+        const length = new Int32Array(capacity);
+        const token = new Int32Array(capacity);
+        offset.set(this.#uq_offset);
+        length.set(this.#uq_length);
+        token.set(this.#uq_token);
+        this.#uq_offset = offset;
+        this.#uq_length = length;
+        this.#uq_token = token;
+    }
+}