@woosh/meep-engine 3.46.0 → 3.49.0

package/src/engine/network/NetworkSession.js

@@ -9,7 +9,8 @@ import { NetworkIdentity } from "./ecs/components/NetworkIdentity.js";
 import { make_owner_authorization } from "./ecs/owner_authorization.js";
 import { NetworkSystem } from "./ecs/NetworkSystem.js";
 import { NetworkIdentitySerializationAdapter, } from "./ecs/serialization/NetworkIdentitySerializationAdapter.js";
-import { NetworkPeer, ResumeRejectReason, } from "./orchestrator/NetworkPeer.js";
+import { InitialSyncPage, NetworkPeer, ResumeRejectReason, } from "./orchestrator/NetworkPeer.js";
+import { HostJoin, JoinProgress } from "./orchestrator/HostJoin.js";
 import { ServerAuthoritativeClient } from "./orchestrator/ServerAuthoritativeClient.js";
 import { LateInput, ServerAuthoritativeServer } from "./orchestrator/ServerAuthoritativeServer.js";
 import { OwnerAwareScope } from "./replication/ScopeFilter.js";
@@ -19,7 +20,6 @@ import { Interpolated, INTERPOLATION_SOURCE_LOCAL } from "../interpolation/Inter
 import { InterpolationLog } from "../interpolation/InterpolationLog.js";
 import { InterpolationSystem } from "../interpolation/InterpolationSystem.js";
 import { SimAction } from "./sim/SimAction.js";
-import { snapshotter_emit } from "./sim/Snapshotter.js";
 import { PredictionHistory } from "./state/PredictionHistory.js";
 import { AdaptiveRenderDelay } from "./time/AdaptiveRenderDelay.js";
 import { RenderPlayout } from "./time/RenderPlayout.js";
@@ -143,13 +143,15 @@ const ReconnectState = Object.freeze({
 /**
  * Client-side: how the host has answered the transport binding in use. A new binding does not know
  * which world the client is in until the host says: the one it has been predicting on, which the
- * host resumes (RESUME_ACCEPT), or the host's own, sent as a snapshot (INITIAL_SYNC). The first
- * answer is the answer; the host's handshake arriving after it is stale.
+ * host resumes (RESUME_ACCEPT), or the host's own, sent as pages of a snapshot (INITIAL_SYNC). The
+ * first answer is the answer; the host's handshake arriving after it is stale. The first page is
+ * the answer (Syncing); the FINAL page completes it (Synced).
  * @readonly @enum {string}
  */
 const BindingAnswer = Object.freeze({
     Pending: 'pending',
     Resumed: 'resumed',
+    Syncing: 'syncing',
     Synced: 'synced',
 });
 
@@ -229,6 +231,18 @@ function assert_copies_itself(method, name, ComponentClass) {
  * @param {number} length
  * @returns {boolean}
  */
+/**
+ * Close a transport the session is giving up on. Best effort: one already closed, or failing to
+ * close, changes nothing about what follows.
+ * @param {{disconnect?: function(): void}} transport
+ */
+function close_transport(transport) {
+    try {
+        transport.disconnect();
+    } catch (_) { /* swallow */
+    }
+}
+
 function bytes_equal(a, b, length) {
     for (let i = 0; i < length; i++) {
         if (a[i] !== b[i]) return false;
@@ -255,8 +269,17 @@ function bytes_equal_lengths(a, a_length, b, b_length) {
  *
  * Replication is component-driven: attaching a {@link NetworkIdentity}
  * to an entity registers it with the session via an `EntityObserver`.
- * Mutation is event-driven: callers fire
- * `dataset.sendEvent(entity, "net_mutate_component", payload)`.
+ *
+ * **What travels is what goes through the action executor**, and nothing
+ * else: actions (`send`, a client's input), and direct writes their writer
+ * reports — `dataset.sendEvent(entity, "net_mutate_component", payload)`.
+ * The session never looks for changes by itself. That is what keeps a tick's
+ * cost in what changed and what is owned, never in the size of the world;
+ * the stack is built for worlds of millions of networked objects. A
+ * replicated component written directly and not reported stays where it was
+ * written. Ownership is set when an identity attaches, or by the join, and
+ * `owner_peer_id` / `network_id` are not written afterwards. The README's
+ * "What the session assumes" has the whole contract and its measured costs.
  *
  * **The session runs on the engine's clock.** The `EntityManager`'s fixed
  * step is the network tick: each step opens a network frame before any
@@ -329,6 +352,11 @@ export class NetworkSession {
     #client = null;
     /** @private @type {NetworkPeer|null} */
     #peer = null;
+    /**
+     * The session's place in the engine loop, added by `start()` and removed by `stop()`.
+     * @private @type {NetworkSystem|null}
+     */
+    #network_system = null;
     /** @private @type {EntityObserver|null} */
     #identity_observer = null;
     /** @private @type {InterpolationLog|null} */
@@ -352,6 +380,22 @@ export class NetworkSession {
      */
     #remote_entities = new Set();
 
+    /**
+     * Networked entities by owner: peer id → its entities. What a tick does per owned entity —
+     * the host's AUTH_STATE to each peer, the client's record of what it predicted — walks this,
+     * never every networked entity: the cost of a tick is in what is owned and what changed, not
+     * in the size of the world. Kept exact by attach, detach and {@link #apply_ownership}, the
+     * only places ownership is set.
+     * @private @type {Map<number, Set<number>>}
+     */
+    #owned_by = new Map();
+
+    /**
+     * Owner each networked entity is filed under in {@link #owned_by}.
+     * @private @type {Map<number, number>}
+     */
+    #owner_of = new Map();
+
     // ---- Render-frame interpolation state ----
 
     /**
@@ -416,26 +460,11 @@ export class NetworkSession {
      */
     #inbound = new Map();
 
-    // ---- Host: publishing what the simulation changed ----
-
-    /** @private @type {boolean} */
-    #publish_changes;
+    // ---- Host ----
 
     /** @private @type {string} */
     #late_input;
 
-    /**
-     * What the peers hold for each networked entity, per replicated component type id, as the
-     * replication adapter's bytes — so "changed" means "changed on the wire". Updated by every
-     * record the host publishes and by every action it executes (the peers apply the action and
-     * arrive at the same value), and compared with the live state at the end of each step.
-     * @private @type {Map<number, Array<{bytes: Uint8Array, length: number}|null>>}
-     */
-    #published = new Map();
-
-    /** @private @type {BinaryBuffer} */
-    #scratch_publish_buf = new BinaryBuffer();
-
     // ---- Client: reconciliation by comparison ----
 
     /** @private @type {string} */
@@ -491,6 +520,16 @@ export class NetworkSession {
      */
     correction_skipped_count = 0;
 
+    /**
+     * Client: how many times it found itself more than the host's input window behind the frame the
+     * host last named, or was told by the host's depth feedback that its input lands below the
+     * host's window, and re-took the host's time. A tab in the background, a debugger, a laptop
+     * asleep — see {@link #retake_host_time_if_stalled}. Diagnostic: a game that sees these on a
+     * machine that never left the foreground has a client that cannot keep the step.
+     * @type {number}
+     */
+    stall_count = 0;
+
     /**
      * Client, {@link NetworkSessionReconcile.Correct}: a component of an authoritative state
      * differed from the prediction, and the present was corrected. Once per component corrected.
@@ -506,19 +545,21 @@ export class NetworkSession {
     #connected_peers = new Set();
 
     /**
-     * Host-only: peer_id → remaining-resends. Drained in
-     * `#on_host_tick_complete` once `current_sim_frame >= 0`. Sent twice
-     * for loss tolerance, and never queued again on the peer's say-so: each
-     * send serializes the whole world, and a sync the peer could ask for is one
-     * it could keep asking for. Filled only by {@link #queue_initial_sync}.
-     * (A fragment of one that goes missing is re-sent on the receiver's
-     * NACK_FRAGMENT. That repair is `NetworkPeer`'s: a NACK re-sends each
-     * chunk of the sync at most once, for at most
-     * `FRAGMENT_RETENTION_MAX_RETRIES` NACKs, so it adds at most that many
-     * copies of each sync, however the peer asks.)
-     * @private @type {Map<number, number>}
+     * Host-only: peer_id → its join, while one is going on. Advanced in
+     * `#on_host_tick_complete`; created only by {@link #queue_initial_sync}, so never on the
+     * peer's say-so: a join the peer could ask for is one it could keep asking for. The pages ride
+     * the connection's BULK lane, which re-sends what is lost; what a join costs beyond the world
+     * once is the entities that changed while it was going out, for at most
+     * {@link JOIN_MAX_ROUNDS} rounds.
+     * @private @type {Map<number, HostJoin>}
      */
-    #pending_initial_sync = new Map();
+    #joins = new Map();
+
+    /**
+     * Host-only: scratch every join builds its pages in.
+     * @private @type {BinaryBuffer}
+     */
+    #page_buffer = new BinaryBuffer();
 
     /**
      * Host-only: peers whose current connection has been given its
@@ -541,6 +582,13 @@ export class NetworkSession {
     /** @private @type {boolean} */
     #started = false;
 
+    /**
+     * {@link stop} has run. A session is one match: what it knew of its peers outlives the stop, so
+     * it does not start again.
+     * @private @type {boolean}
+     */
+    #stopped = false;
+
     // ---- Host-side: per-peer session token + grace state ----
 
     /**
@@ -613,14 +661,47 @@ export class NetworkSession {
     /**
      * Client-side: how the host has answered the binding the last `connect()`
      * made. Once it has, what the binding carries about the handshake is news
-     * no longer: the host sends each sync more than once against loss, and a
-     * host that has finished with our old session takes the new transport for
-     * a fresh peer and sends its sync before reading the RESUME_HELLO the
-     * transport carried, so the RESUME_REJECT it answers that with arrives
-     * after the resync it asks for.
+     * no longer: a host that has finished with our old session takes the new
+     * transport for a fresh peer and starts its join before reading the
+     * RESUME_HELLO the transport carried, so the RESUME_REJECT it answers that
+     * with arrives after the resync it asks for.
      * @private @type {BindingAnswer|string}
      */
     #binding_answer = BindingAnswer.Pending;
+
+    /**
+     * Client: the newest sim frame the host has named on this binding — every TIME_DILATION
+     * carries it — or -1. A join's pages can take a while to arrive, and the frame a page names
+     * is as old as its trip; this is the freshest word of where the host is.
+     * @private @type {number}
+     */
+    #host_frame_seen = -1;
+
+    /**
+     * Client: the host's newest depth feedback — its latest sight of this client's frame minus its
+     * own sim frame, measured where this client's input lands — and that latest sight itself (the
+     * frame the host named plus the depth). The dilation steers by the depth; the stall rule reads
+     * it for what the host's window makes of our input, latency included. 0 and -1 on a new binding.
+     * @private @type {number}
+     */
+    #host_depth_seen = 0;
+    /** @private @type {number} */
+    #host_marker_seen = -1;
+
+    /**
+     * Client: the peer whose held inbound — action stream and AUTH_STATE, held from `connect()`
+     * until the binding's answer is whole — is to be released as the step's inbound is done, or -1.
+     * Released there rather than inside the answer's own dispatch: the release applies what was
+     * held, through the same receive buffer the answer is still being read from.
+     * @private @type {number}
+     */
+    #inbound_release_peer = -1;
+
+    /**
+     * Client: whether that release completes a join, so {@link onSynced} follows it.
+     * @private @type {boolean}
+     */
+    #inbound_release_syncs = false;
     /**
      * Client-side: the first frame predicted on the world this client holds —
      * where the last INITIAL_SYNC it applied set the frame counter, 0 before
@@ -671,6 +752,14 @@ export class NetworkSession {
      */
     onReconnected = new Signal();
 
+    /**
+     * Client: a join has completed — the host's FINAL page has landed, every networked entity's
+     * state is here, and from now on this client's input is sent. No arguments. A world is sent
+     * as pages over as many ticks as its size takes; until this fires it is still arriving.
+     * @type {Signal}
+     */
+    onSynced = new Signal();
+
     /**
      * Client: the reconnect ladder is exhausted, or the host explicitly
      * kicked us with a DISCONNECT packet, or `reconnect.enabled` is
@@ -762,12 +851,6 @@ export class NetworkSession {
      * - `reconnect` (client role): policy for the reconnect ladder. See
      *   {@link DEFAULT_RECONNECT_POLICY}. Set `enabled: false` to opt
      *   out entirely.
-     * - `publish_changes` (host role, default true): at the end of every
-     *   step, send each replicated component the simulation changed — physics,
-     *   controllers, anything that wrote it directly. Components an action
-     *   wrote are already on the wire and are not sent twice. Publishing never
-     *   writes back into the host's own state. Set false to publish by hand
-     *   (`net_mutate_component`).
      * - `reconcile` (client role): see {@link NetworkSessionReconcile}. Default
      *   `'correct'`.
      * - `late_input` (host role): what to do with client input that arrives
@@ -791,7 +874,6 @@ export class NetworkSession {
                     server_resume_grace_ms = DEFAULT_SERVER_RESUME_GRACE_MS,
                     connection_timeout_ms = DEFAULT_CONNECTION_TIMEOUT_MS,
                     reconnect = null,
-                    publish_changes = true,
                     late_input = LateInput.Apply,
                     reconcile = NetworkSessionReconcile.Correct,
                 } = {}) {
@@ -904,7 +986,6 @@ export class NetworkSession {
         this.#connection_timeout_ms = connection_timeout_ms;
         this.#reconnect_policy = Object.freeze({ ...DEFAULT_RECONNECT_POLICY, ...(reconnect || {}) });
         this.#transport_factory = transport_factory;
-        this.#publish_changes = publish_changes;
         this.#late_input = late_input;
         if (reconcile !== NetworkSessionReconcile.Correct && reconcile !== NetworkSessionReconcile.Replay) {
             throw new Error(`NetworkSession: reconcile must be one of ${Object.values(NetworkSessionReconcile).join(', ')}, got '${reconcile}'`);
@@ -1092,7 +1173,7 @@ export class NetworkSession {
     /**
      * Wire the session to the engine. After this, the EntityObserver
      * is active, the right orchestrator is constructed, and a
-     * {@link NetworkSystem} is attached. Subsequent `replicate_*`
+     * {@link NetworkSystem} is attached until {@link stop}. Subsequent `replicate_*`
      * / {@link defineAction} / {@link defineInputSampler} calls throw.
      *
      * Pre-condition: every replicated component class must already have a
@@ -1101,6 +1182,7 @@ export class NetworkSession {
      */
     async start() {
         if (this.#started) throw new Error("NetworkSession.start: already started");
+        if (this.#stopped) throw new Error("NetworkSession.start: a stopped session does not start again; the next match is a new NetworkSession");
 
         // Auto-register the NetworkIdentity adapter so initial-sync can
         // ship it across the wire. Allow caller-supplied registrations
@@ -1156,6 +1238,11 @@ export class NetworkSession {
             replicated_components,
             action_classes,
             frame_capacity: this.frame_capacity,
+            // The session's one clock: render-paced, so the fixed steps one update runs all see
+            // the same time, and a burst of catch-up steps cannot age packets whose
+            // acknowledgements could not have arrived yet.
+            clock: () => this.#clock_ms,
+            tick_period_ms: this.tick_period_ms,
         };
 
         if (this.role === NetworkSessionRole.Host) {
@@ -1171,9 +1258,6 @@ export class NetworkSession {
                 identity_class: NetworkIdentity,
             });
             this.#server.onTickComplete.add((sim_frame) => this.#on_host_tick_complete(sim_frame));
-            if (this.#publish_changes) {
-                this.#server.onBeforeTickClose.add(() => this.#publish_simulated_changes());
-            }
         } else {
             // Client role: covers both "playing" (input sampler registered)
             // and "spectator" (no sampler — sampler-driven onPredict
@@ -1204,13 +1288,6 @@ export class NetworkSession {
         // blended component on the first execute after a render pass.
         this.#peer.executor.before_execute = this.#bound_normalize_if_dirty;
 
-        if (this.role === NetworkSessionRole.Host && this.#publish_changes) {
-            // an action carries its own change to the peers: what it wrote is what they will hold
-            this.#peer.executor.on_component_written = (entity_id, component_class) => {
-                this.#note_published(entity_id, component_class);
-            };
-        }
-
         // Secure-by-default inbound authorization on the host: a remote client
         // may only mutate entities it owns (NetworkIdentity.owner_peer_id ===
         // sender); the authoritative server (sender === local_peer_id) may
@@ -1234,11 +1311,12 @@ export class NetworkSession {
         //
         // It is also the session's place in the engine loop: each fixed step opens a network frame
         // and closes it, and every rendered frame runs the session's wall-paced work.
-        await this.entity_manager.addSystem(new NetworkSystem(this.#peer, {
+        this.#network_system = new NetworkSystem(this.#peer, {
             open_step: () => this.#open_step(),
             close_step: () => this.#close_step(),
             frame: (dt) => this.#on_frame(dt),
-        }));
+        });
+        await this.entity_manager.addSystem(this.#network_system);
 
         // The network timeline: per-frame state of every remote entity, blended at render time on
         // the render-delayed playout by the engine's InterpolationSystem.
@@ -1267,65 +1345,34 @@ export class NetworkSession {
         // action-stream processing, and finalize any in-flight Tier-3
         // resync state.
         if (this.role === NetworkSessionRole.Client) {
-            this.#peer.onInitialSync.add((peer_id, session_token, frame_number, buf, payload_end) => {
-                if (this.#binding_answer === BindingAnswer.Synced && this.#reconnect_state !== ReconnectState.Resyncing) {
-                    // A copy: the host sends every sync more than once, against loss, and this
-                    // binding already has its world. The client has been predicting on it since;
-                    // applied again, it would put what the client owns back behind input already
-                    // sent, and seek the frame counter over frames already predicted.
+            this.#peer.onInitialSync.add((peer_id, session_token, frame_number, flags, buf, payload_end) => {
+                const first = (flags & InitialSyncPage.FIRST) !== 0;
+                const final = (flags & InitialSyncPage.FINAL) !== 0;
+
+                if (first) {
+                    if (this.#binding_answer !== BindingAnswer.Pending) {
+                        // This binding has had its answer — a resume, or a join already under
+                        // way or done. The host starts one join per connection, so this is not
+                        // ours to act on: the client has been predicting on the world it holds.
+                        return;
+                    }
+                    this.#begin_sync(peer_id, session_token, frame_number);
+                } else if (this.#binding_answer !== BindingAnswer.Syncing) {
+                    // a page of a join this binding is not in
                     return;
                 }
 
-                const token = new UUID();
-                token.data = session_token;
-                this.session_token = token;
-
-                /*
-                 Align to the host's clock. This argument has always been on the wire and in this
-                 signature -- it was named `_frame_number` and dropped -- and without it a client
-                 joining a match in progress tags its inputs from 0 against a host at frame 6,000,
-                 which trims every one of them silently. GAP-042.
-
-                 The lead is the buffer depth the time dilation is already steering toward: an
-                 input authored now arrives in the host's future, and this is how far ahead it has
-                 to be tagged to land in the window rather than behind it. It only has to be in the
-                 right neighbourhood -- `TimeDilation` converges on the real depth from the host's
-                 feedback within a second or two -- but starting six thousand frames out is not a
-                 neighbourhood, which is what made this total rather than approximate.
-                */
-                this.seek_to_frame(frame_number + 1 + this.#time_dilation.target_buffer_depth);
-
-                // The world is about to be the host's. What this client predicted, sampled or was
-                // told about the one it had is about a world, and a frame numbering, that is gone.
-                this.#prediction_history.clear();
-                this.#pending_auth.clear();
-                this.#reconciled_frame.clear();
-                this.#sampled_actions_per_frame.clear();
-
                 this.#apply_initial_sync(buf, payload_end);
-                this.#binding_answer = BindingAnswer.Synced;
-
-                // Input from here on is predicted on the host's world. What was predicted before —
-                // held since this binding was made, or still in the log from before it — was
-                // predicted on the world just replaced, and is never sent.
-                this.#world_start_frame = this.#local_frame;
-                this.#peer.release_outbound(peer_id, this.#world_start_frame);
 
-                // Reconnecting counts as well as Resyncing: a host that has
-                // finished with our old session readmits us as a fresh peer,
-                // so the snapshot arrives with no RESUME_ACCEPT ahead of it.
-                // That is the reconnection — staying in the ladder would burn
-                // attempts while holding the world the host just sent, and
-                // recovering later via RESUME_ACCEPT would report
-                // `state_resynced: false` over a world that was wholly
-                // replaced. `Lost` is excluded on purpose: the application has
-                // already been told that session is over.
-                if (this.#reconnect_state === ReconnectState.Resyncing
-                    || this.#reconnect_state === ReconnectState.Reconnecting) {
-                    this.#enter_connected();
-                    this.onReconnected.send1({ state_resynced: true });
+                if (final) {
+                    this.#finish_sync(peer_id, frame_number);
                 }
             });
+            this.#peer.onTimeDilationFeedback.add((_peer_id, depth, frame_number) => {
+                if (frame_number > this.#host_frame_seen) this.#host_frame_seen = frame_number;
+                this.#host_depth_seen = depth;
+                this.#host_marker_seen = frame_number + depth;
+            });
             // Host's response to our RESUME_HELLO during reconnect.
             this.#peer.onResumeAccept.add((peer_id) => {
                 if (this.#binding_answer !== BindingAnswer.Pending) {
@@ -1336,6 +1383,9 @@ export class NetworkSession {
                 // The host kept the world this client holds, so what the client predicted on it —
                 // while cut off, and since — is owed to the host like any input, late as it is.
                 this.#peer.release_outbound(peer_id, this.#world_start_frame);
+                // and what the host sent on it meanwhile is about that world
+                this.#inbound_release_peer = peer_id;
+                this.#inbound_release_syncs = false;
                 if (this.#reconnect_state === ReconnectState.Reconnecting
                     || this.#reconnect_state === ReconnectState.Resyncing) {
                     this.#enter_connected();
@@ -1370,6 +1420,7 @@ export class NetworkSession {
             this.#peer.onDisconnectPacket.add((_peer_id, reason_label) => {
                 this.#permanently_lose_connection(reason_label || 'disconnected_by_host');
             });
+            this.#peer.onProtocolError.add((_peer_id, reason) => this.#on_client_protocol_error(reason));
         } else {
             // Host: RESUME_HELLO validation + peer-initiated disconnects.
             this.#peer.onResumeHello.add((peer_id, local_peer_id, last_acked_frame, has_token, session_token) => {
@@ -1380,6 +1431,7 @@ export class NetworkSession {
                 // and free state immediately.
                 this.drop_peer(peer_id, reason_label || 'client_disconnect');
             });
+            this.#peer.onProtocolError.add((peer_id, reason) => this.#on_peer_protocol_error(peer_id, reason));
         }
 
         // EntityObserver for NetworkIdentity: patches owner/network_id on
@@ -1478,7 +1530,15 @@ export class NetworkSession {
             // snapshot replaces must never reach the host. So what the client predicts meanwhile is
             // held: sent on an accept, dropped on a sync.
             this.#binding_answer = BindingAnswer.Pending;
+            this.#host_frame_seen = -1;
+            this.#host_depth_seen = 0;
+            this.#host_marker_seen = -1;
             this.#peer.hold_outbound(remote_peer_id);
+            // Inbound too, until the answer is whole: an action stream that arrives ahead of it —
+            // a join's stream can, when the pages are lost on the way — is about the world the
+            // answer settles, a resumed one or a new one, and is applied once it is settled.
+            this.#peer.hold_inbound(remote_peer_id);
+            this.#inbound_release_peer = -1;
 
             // Announce ourselves whenever this connect could be a claim on an
             // id the host still holds a record for: we have a token to prove
@@ -1499,6 +1559,9 @@ export class NetworkSession {
                     remote_peer_id, this.local_peer_id, last_acked,
                     token !== null, token !== null ? token.data : NO_SESSION_TOKEN,
                 );
+                // Out at once rather than with the next tick: a connect is an event, not part of
+                // a frame, and the host can answer nothing until it has heard the claim.
+                this.#peer.flush_peer(remote_peer_id);
             }
             this.#has_ever_connected = true;
         }
@@ -1542,6 +1605,7 @@ export class NetworkSession {
             // Best-effort notification — peer may have already dropped.
             try {
                 this.#peer.send_disconnect(peer_id, reason);
+                this.#peer.flush_peer(peer_id);
             } catch (_) { /* swallow */
             }
             this.#server.disconnect_peer(peer_id);
@@ -1551,10 +1615,23 @@ export class NetworkSession {
         this.#peer_inbound_mark.delete(peer_id);
         this.#peer_grace_state.delete(peer_id);
         this.#peer_session_tokens.delete(peer_id);
-        this.#pending_initial_sync.delete(peer_id);
+        this.#joins.delete(peer_id);
         this.onPeerPermanentlyDropped.send2(peer_id, reason);
     }
 
+    /**
+     * Send what is queued for `peer_id` — a kick's RESUME_REJECT and DISCONNECT — before its
+     * connection is torn down. One best-effort flush: a transport that refuses it (closed, say)
+     * changes nothing about the teardown that follows.
+     * @param {number} peer_id
+     */
+    #flush_last_word(peer_id) {
+        try {
+            this.#peer.flush_peer(peer_id);
+        } catch (_) { /* swallow */
+        }
+    }
+
     /**
      * Client-only: voluntarily disconnect from the server. Sends a
      * DISCONNECT packet so the host can free state immediately and
@@ -1570,6 +1647,7 @@ export class NetworkSession {
         const peer_id = this.#remote_peer_id;
         try {
             this.#peer.send_disconnect(peer_id, reason);
+            this.#peer.flush_peer(peer_id);
         } catch (_) { /* swallow */
         }
         // Tear down the channel binding so a subsequent connect() with a
@@ -1598,9 +1676,19 @@ export class NetworkSession {
 
     /**
      * Tear down. Idempotent — safe to call from cleanup paths.
+     *
+     * Takes back from the engine what {@link start} put in it: the {@link NetworkSystem} is out of
+     * the engine's loop when this returns, so another session can start on the same engine; this one
+     * does not start again. The
+     * networked entities stay in the world, and their `network_id`s are released — an id means
+     * nothing without the session that gave it. The {@link InterpolationSystem} stays too, whoever
+     * added it: it is the engine's, and blends whatever else is interpolated; the session only
+     * withdraws its own source from it.
+     *
+     * @returns {Promise} resolves once the engine has shut the {@link NetworkSystem} down
      */
     stop() {
-        if (!this.#started) return;
+        if (!this.#started) return Promise.resolve();
 
         this.entity_manager.fixedStepTimeScale = 1;
 
@@ -1634,6 +1722,8 @@ export class NetworkSession {
         }
         this.#event_listeners.clear();
         this.#remote_entities.clear();
+        this.#owned_by.clear();
+        this.#owner_of.clear();
         this.#sampled_actions_per_frame.clear();
         this.#peer_inbound_mark.clear();
         for (const transport of this.#inbound.values()) {
@@ -1641,6 +1731,13 @@ export class NetworkSession {
         }
         this.#inbound.clear();
         this.#started = false;
+        this.#stopped = true;
+
+        // last: removing the system unlinks every networked entity, and nothing of the session's
+        // may still be listening to that
+        const network_system = this.#network_system;
+        this.#network_system = null;
+        return this.entity_manager.removeSystem(network_system);
     }
 
     // ----------------------------------------------------------------
@@ -1679,6 +1776,11 @@ export class NetworkSession {
         this.#interpolation.settle();
 
         this.#flush_inbound();
+        this.#release_held_inbound();
+
+        if (this.#client !== null) {
+            this.#retake_host_time_if_stalled();
+        }
 
         this.#apply_pending_interpolation();
 
@@ -1710,11 +1812,12 @@ export class NetworkSession {
 
         try {
             if (this.#server !== null) {
-                // runs the frame's local sim, then publishes (onBeforeTickClose), then closes it
+                // runs the frame's local sim, then closes it
                 this.#server.end_tick();
             } else {
-                this.#client.end_tick();
+                // queued before end_tick, which sends: the marker leaves with the tick's stream
                 this.#send_frame_marker(this.#local_frame);
+                this.#client.end_tick();
                 if (this.#reconcile === NetworkSessionReconcile.Correct) {
                     this.#record_prediction(this.#local_frame);
                 }
@@ -1769,102 +1872,6 @@ export class NetworkSession {
         return deferred;
     }
 
-    /**
-     * Host, end of step: record every replicated component whose wire image differs from what the
-     * peers hold, into the still-open frame, for the action stream to carry. Recorded, not
-     * executed — see {@link SimActionExecutor#record}. A component an action wrote this step and
-     * nothing changed since is not sent again: the peers apply the action.
-     */
-    #publish_simulated_changes() {
-        const world = this.world;
-        const executor = this.#peer.executor;
-        const scratch = this.#scratch_publish_buf;
-        const changed_entities = executor.changed_entities;
-
-        for (const entity_id of this.#event_listeners.keys()) {
-            const identity = world.getComponent(entity_id, NetworkIdentity);
-            if (identity === undefined || identity.network_id < 0) continue;
-
-            for (const [ComponentClass, desc] of this.#replicated) {
-                if (ComponentClass === NetworkIdentity) continue;
-
-                const live = world.getComponent(entity_id, ComponentClass);
-                if (live === undefined) continue;
-
-                const type_id = desc.interp_type_id;
-
-                scratch.position = 0;
-                this.binary_registry.getAdapter(ComponentClass.typeName).serialize(scratch, live);
-                const length = scratch.position;
-
-                if (!this.#remember_published(entity_id, type_id, scratch.raw_bytes, length)) continue;
-
-                const action = this.#peer.action_registry.acquire(this.#ReplaceComponentAction);
-                try {
-                    action.network_id = identity.network_id;
-                    action.component_type_id = type_id;
-                    action.payload_buf.position = 0;
-                    action.payload_buf.writeBytes(scratch.raw_bytes, 0, length);
-                    action.payload_length = length;
-                    executor.record(action);
-                } finally {
-                    this.#peer.action_registry.release(action);
-                }
-
-                if (changed_entities !== null) changed_entities.add(identity.network_id);
-            }
-        }
-    }
-
-    /**
-     * Host: an action wrote `ComponentClass` of `entity_id`; the peers will hold what it wrote.
-     * @param {number} entity_id
-     * @param {Function} ComponentClass
-     */
-    #note_published(entity_id, ComponentClass) {
-        const desc = this.#replicated.get(ComponentClass);
-        if (desc === undefined || ComponentClass === NetworkIdentity) return;
-
-        const live = this.world.getComponent(entity_id, ComponentClass);
-        if (live === undefined) return;
-
-        const scratch = this.#scratch_publish_buf;
-        scratch.position = 0;
-        this.binary_registry.getAdapter(ComponentClass.typeName).serialize(scratch, live);
-        this.#remember_published(entity_id, desc.interp_type_id, scratch.raw_bytes, scratch.position);
-    }
-
-    /**
-     * Set what the peers hold for `(entity_id, type_id)`.
-     * @param {number} entity_id
-     * @param {number} type_id
-     * @param {Uint8Array} bytes
-     * @param {number} length
-     * @returns {boolean} whether it differs from what was held before
-     */
-    #remember_published(entity_id, type_id, bytes, length) {
-        let published = this.#published.get(entity_id);
-        if (published === undefined) {
-            published = [];
-            this.#published.set(entity_id, published);
-        }
-        while (published.length <= type_id) published.push(null);
-
-        let held = published[type_id];
-        if (held !== null && held.length === length && bytes_equal(bytes, held.bytes, length)) {
-            return false;
-        }
-
-        if (held === null || held.bytes.length < length) {
-            held = { bytes: new Uint8Array(Math.max(length, 32)), length: 0 };
-            published[type_id] = held;
-        }
-        held.bytes.set(bytes.subarray(0, length), 0);
-        held.length = length;
-
-        return true;
-    }
-
     /**
      * Once per rendered frame: the work paced by wall time rather than by the simulation.
      * @param {number} dt_seconds
@@ -2056,9 +2063,9 @@ export class NetworkSession {
      * frame 6,000; a client has to start tagging its inputs near 6,000 or the host discards every
      * one of them — `ServerAuthoritativeServer.tick` trims pending actions older than
      * `sim_frame - frame_capacity + 1`, and a client tagging frame 0 against a host at 6,000 has
-     * every input dropped **silently**. It moves on its own screen, never moves on the host's, and
-     * no signal fires: `onPendingActionDropped` covers the future-lead and capacity bounds, not
-     * this one.
+     * every input dropped. It moves on its own screen and never moves on the host's — and until
+     * 2026-10-15 no signal fired; the host's `onPendingActionDropped` now reports each such drop
+     * as `'window'`.
      *
      * Everything needed was already there except the setter. INITIAL_SYNC carries the host's frame,
      * `NetworkPeer` writes it, and `onInitialSync` dispatches it — and the handler named it
@@ -2067,8 +2074,10 @@ export class NetworkSession {
      * with the input sampler silenced until its counter caught up: 28,801 calls and 62 ms of wall
      * clock for an hour-old host. Reported as GAP-042.
      *
-     * A client now seeks automatically on INITIAL_SYNC. This is the manual door, for a caller that
-     * computes its own lead.
+     * A client now seeks automatically on INITIAL_SYNC, and again whenever it finds itself more than
+     * the host's input window behind the frame the host last named — a stall, see
+     * {@link #retake_host_time_if_stalled}. This is the manual door, for a caller that computes its
+     * own lead.
      *
      * A client sends the host nothing it predicted before its last sync, and knows it by frame: its
      * input starts at the frame the sync sought to. A caller whose own lead is shorter moves that
@@ -2109,6 +2118,7 @@ export class NetworkSession {
         if (identity.owner_peer_id !== this.local_peer_id) {
             this.#remote_entities.add(entity_id);
         }
+        this.#file_owner(entity_id, identity.owner_peer_id);
         this.#interpolation_pending.add(entity_id);
         // Per-entity event listener for net_mutate_component.
         const listener = (payload) => this.#on_net_mutate_component(entity_id, payload);
@@ -2123,23 +2133,26 @@ export class NetworkSession {
             this.#event_listeners.delete(entity_id);
         }
         this.#remote_entities.delete(entity_id);
-        this.#published.delete(entity_id);
+        this.#file_owner(entity_id, -1);
         this.#prediction_history.forget(entity_id);
         // take back our Interpolated at the next step or frame, if the entity outlives its identity
         this.#interpolation_pending.add(entity_id);
     }
 
     /**
-     * Handler for `"net_mutate_component"` events. Translates the payload
-     * into a `ReplaceComponentAction` and dispatches via the executor.
+     * Handler for `"net_mutate_component"` events: a replicated component changed outside an
+     * action, and goes through the executor as a `ReplaceComponentAction`. The session finds no
+     * change by itself (see the README, "What travels"); this is the door for a system that writes
+     * replicated state directly — physics publishing its moving bodies, say — at a cost per
+     * change, never per entity.
      *
      * Payload:
-     *   - `{ component_type, new_state }` — recommended; engine captures
-     *     current bytes as prior, then applies `new_state` via the
-     *     replication adapter.
-     *   - `{ component_type }` — caller has already mutated live; prior
-     *     bytes equal post bytes (rewind for this mutation is a no-op).
-     *
+     *   - `{ component_type, new_state }` — the engine captures the current bytes as prior, then
+     *     applies `new_state` through the replication adapter.
+     *   - `{ component_type }` — the caller has already written live. On the host it is recorded,
+     *     not executed ({@link SimActionExecutor#record}): live is the truth, at full precision,
+     *     and executing would write the wire's quantised image back over it. On a client it is
+     *     executed, so prediction and rewind keep their prior state.
      */
     #on_net_mutate_component(entity_id, payload) {
         const { component_type, new_state } = payload || {};
@@ -2174,8 +2187,15 @@ export class NetworkSession {
         }
         action.payload_length = action.payload_buf.position;
 
+        const executor = this.#peer.executor;
         try {
-            this.#peer.executor.execute(action, this.local_peer_id);
+            if (this.#server !== null && (new_state === undefined || new_state === null)) {
+                executor.record(action);
+                // recorded writes are changes too: a join re-sends an entity changed after its page
+                if (executor.changed_entities !== null) executor.changed_entities.add(network_id);
+            } else {
+                executor.execute(action, this.local_peer_id);
+            }
         } finally {
             this.#peer.action_registry.release(action);
         }
@@ -2280,41 +2300,31 @@ export class NetworkSession {
      * @param {number} sim_frame
      */
     #on_host_tick_complete(sim_frame) {
-        // Initial-sync first, so receivers have a populated world before
-        // AUTH_STATE / action-stream packets land.
-        if (this.#pending_initial_sync.size > 0) {
-
-            for (const [peer_id, sends_remaining] of this.#pending_initial_sync) {
-
-                this.#send_initial_sync_to(peer_id, sim_frame);
-
-                if (sends_remaining <= 1) {
-                    this.#pending_initial_sync.delete(peer_id);
-                } else {
-                    this.#pending_initial_sync.set(peer_id, sends_remaining - 1);
+        // Joins first: a page is the state at this frame, which has just closed.
+        if (this.#joins.size > 0) {
+            for (const [peer_id, join] of this.#joins) {
+                const progress = join.advance(sim_frame);
+                if (progress === JoinProgress.Done) {
+                    this.#joins.delete(peer_id);
+                } else if (progress === JoinProgress.DidNotConverge) {
+                    this.drop_peer(peer_id, 'join_did_not_converge');
                 }
-
             }
-
         }
 
         // AUTH_STATE per owned entity, then time-dilation feedback, to
-        // every connected peer.
+        // every connected peer. A peer still joining gets no AUTH_STATE: it
+        // does not hold the world the state would correct yet.
         for (const peer_id of this.#connected_peers) {
 
-            for (const entity_id of this.#event_listeners.keys()) {
+            const owned = this.#joins.has(peer_id) ? undefined : this.#owned_by.get(peer_id);
 
-                const identity = this.world.getComponent(entity_id, NetworkIdentity);
-
-                if (identity === undefined) {
-                    continue;
+            if (owned !== undefined) {
+                for (const entity_id of owned) {
+                    const identity = this.world.getComponent(entity_id, NetworkIdentity);
+                    if (identity === undefined) continue;
+                    this.#send_auth_state_for_entity(peer_id, sim_frame, entity_id, identity);
                 }
-                if (identity.owner_peer_id !== peer_id) {
-                    continue;
-                }
-
-                this.#send_auth_state_for_entity(peer_id, sim_frame, entity_id, identity);
-
             }
 
             this.#server.send_time_dilation_feedback(peer_id);
@@ -2323,49 +2333,215 @@ export class NetworkSession {
 
 
     /**
-     * Queue `peer_id`'s INITIAL_SYNC, unless its connection has been given
-     * one already — queued, or queued and sent. These are the host's only
-     * full-world sends, so how many a connection gets is the host's decision:
-     * one, when it takes the connection for a fresh peer — as `connect()`
-     * binds it, or after refusing its claim to resume. Nothing the peer sends
-     * afterwards earns it another.
+     * Start `peer_id`'s join, unless its connection has been given one already — started, or
+     * finished. These are the host's only whole-world sends, so how many a connection gets is the
+     * host's decision: one, when it takes the connection for a fresh peer — as `connect()` binds
+     * it, or after refusing its claim to resume. Nothing the peer sends afterwards earns it another.
+     *
+     * The peer's action stream is held from here until the join's FINAL page: what it would carry
+     * is about a world the peer does not hold yet. The session token is issued here, and goes out
+     * with every page; the receiver echoes it back via RESUME_HELLO to authenticate a later
+     * reconnect.
      * @param {number} peer_id
      */
     #queue_initial_sync(peer_id) {
         if (this.#initial_sync_given.has(peer_id)) return;
         this.#initial_sync_given.add(peer_id);
-        this.#pending_initial_sync.set(peer_id, 2);
+
+        let token = this.#peer_session_tokens.get(peer_id);
+        if (token === undefined) {
+            token = UUID.v1();
+            this.#peer_session_tokens.set(peer_id, token);
+        }
+
+        this.#peer.hold_outbound(peer_id);
+        this.#joins.set(peer_id, new HostJoin({
+            peer: this.#peer,
+            peer_id,
+            session_token: token.data,
+            world: this.world,
+            for_each_entity: this.#for_each_networked_entity,
+            page_buffer: this.#page_buffer,
+            window_bytes: 128 * 1024,
+        }));
     }
 
     /**
-     * Emit a Snapshotter-format payload to a freshly-connected peer.
-     * Generates and stashes a UUID v1 session token on first send,
-     * which the receiver echoes back via RESUME_HELLO to authenticate
-     * later reconnects.
+     * Visits every networked entity: those whose NetworkIdentity the session is listening to.
+     * @type {function(function(number): void): void}
+     */
+    #for_each_networked_entity = (visit) => {
+        for (const entity_id of this.#event_listeners.keys()) {
+            visit(entity_id);
+        }
+    };
+
+    /**
+     * Client: the first page of a join. It is this binding's answer: the world is about to be the
+     * host's, so what was predicted, sampled or told about the one the client had goes, and the
+     * reconnect ladder stops — a join of a large world takes a while, and an attempt that tore the
+     * binding down would restart it from the first page.
+     *
      * @param {number} peer_id
-     * @param {number} sim_frame
+     * @param {Uint8Array} session_token
+     * @param {number} frame_number the frame the page's state is from
+     */
+    #begin_sync(peer_id, session_token, frame_number) {
+        const token = new UUID();
+        token.data = session_token;
+        this.session_token = token;
+
+        this.#align_to_host(frame_number);
+        this.#forget_predicted_world();
+        this.#binding_answer = BindingAnswer.Syncing;
+        // The host releases its action stream, and its AUTH_STATE, from the frame after the last
+        // page; their datagrams can overtake the pages. The binding's inbound hold, taken at
+        // `connect()`, keeps them until the world is whole.
+
+        // Reconnecting counts as well as Resyncing: a host that has
+        // finished with our old session readmits us as a fresh peer,
+        // so the snapshot arrives with no RESUME_ACCEPT ahead of it.
+        // That is the reconnection — staying in the ladder would burn
+        // attempts while holding the world the host is sending, and
+        // recovering later via RESUME_ACCEPT would report
+        // `state_resynced: false` over a world that was wholly
+        // replaced. `Lost` is excluded on purpose: the application has
+        // already been told that session is over.
+        if (this.#reconnect_state === ReconnectState.Resyncing
+            || this.#reconnect_state === ReconnectState.Reconnecting) {
+            this.#enter_connected();
+            this.onReconnected.send1({ state_resynced: true });
+        }
+    }
+
+    /**
+     * Client: the FINAL page. Every entity's state at `frame_number` is here, and the host's action
+     * stream resumes after it. The client predicted on a partial world while the pages came in, and
+     * against the frame the first page named, which is as old as the join is long: both are put
+     * right here, and only then does the client's input go out.
+     *
+     * @param {number} peer_id
+     * @param {number} frame_number
      */
-    #send_initial_sync_to(peer_id, sim_frame) {
-        let token = this.#peer_session_tokens.get(peer_id);
+    #finish_sync(peer_id, frame_number) {
+        this.#align_to_host(frame_number);
+        this.#forget_predicted_world();
+        this.#binding_answer = BindingAnswer.Synced;
 
-        if (token === undefined) {
-            token = UUID.v1();
-            this.#peer_session_tokens.set(peer_id, token);
+        // Input from here on is predicted on the host's world. What was predicted before —
+        // held since this binding was made, or still in the log from before it — was
+        // predicted on a world that is gone, or half-built, and is never sent.
+        this.#world_start_frame = this.#local_frame;
+        this.#peer.release_outbound(peer_id, this.#world_start_frame);
+
+        // what the host sent after the last page, applied as the step's inbound is done, now that
+        // the world it is about is here; then onSynced
+        this.#inbound_release_peer = peer_id;
+        this.#inbound_release_syncs = true;
+    }
+
+    /**
+     * Client: apply what the binding held, once its answer is whole (see {@link #inbound_release_peer}).
+     */
+    #release_held_inbound() {
+        const peer_id = this.#inbound_release_peer;
+        if (peer_id < 0) return;
+        this.#inbound_release_peer = -1;
+        if (!this.#peer.is_connected(peer_id)) return;
+        this.#peer.release_inbound(peer_id);
+        if (this.#inbound_release_syncs) {
+            this.#inbound_release_syncs = false;
+            this.onSynced.send0();
         }
+    }
 
-        this.#peer.send_initial_sync(peer_id, token.data, sim_frame, (buf) => {
-            snapshotter_emit({
-                buffer: buf,
-                world: this.world,
-                slot_table: this.#peer.slot_table,
-                component_registry: this.#peer.component_registry,
-                entity_iter: (cb) => {
-                    for (const entity_id of this.#event_listeners.keys()) {
-                        cb(entity_id);
-                    }
-                },
-            });
-        });
+    /**
+     * Seek the frame counter to the host's `frame_number` — or the newer frame a TIME_DILATION
+     * has named since — plus the lead input needs.
+     *
+     * The frame has always been on the wire — it was named `_frame_number` and dropped — and
+     * without it a client joining a match in progress tags its inputs from 0 against a host at
+     * frame 6,000, which trims every one of them silently. GAP-042.
+     *
+     * The lead is the buffer depth the time dilation is already steering toward: an input
+     * authored now arrives in the host's future, and this is how far ahead it has to be tagged to
+     * land in the window rather than behind it. It only has to be in the right neighbourhood —
+     * `TimeDilation` converges on the real depth from the host's feedback within a second or two —
+     * but starting six thousand frames out is not a neighbourhood, which is what made this total
+     * rather than approximate.
+     *
+     * @param {number} frame_number
+     */
+    #align_to_host(frame_number) {
+        const host_frame = Math.max(frame_number, this.#host_frame_seen);
+        this.seek_to_frame(host_frame + 1 + this.#time_dilation.target_buffer_depth);
+    }
+
+    /**
+     * Drop what this client predicted, sampled or was told about the world it held: it is about a
+     * world, and a frame numbering, that is being replaced.
+     */
+    #forget_predicted_world() {
+        this.#prediction_history.clear();
+        this.#pending_auth.clear();
+        this.#reconciled_frame.clear();
+        this.#sampled_actions_per_frame.clear();
+        this.#client.forget_timeline();
+    }
+
+    /**
+     * Client, as a step opens: more than the host's input window behind, the client re-takes the
+     * host's time.
+     *
+     * A client stops stepping when its tab goes to the background (`Ticker` suspends, and discards
+     * the gap when the tab returns), under a debugger, or with the lid shut; the host runs on, and
+     * what it sent meanwhile is waiting in the held transport. Nothing told the session. Behind by N
+     * frames, the time dilation closed the gap at 5% — 20 × N frames, 190 s for a 10 s stall — and
+     * until the gap was inside the window `ServerAuthoritativeServer.begin_tick` trimmed every input
+     * the client sent, silently: the client's own entities ran off on its screen, and were yanked
+     * back by the corrections once its input landed again. Measured 2026-10-15; the spec is
+     * `NetworkSession.stall.spec.js`.
+     *
+     * The host names its frame in every TIME_DILATION packet (`#host_frame_seen`), so the gap is
+     * known the moment the held packets are applied. Past the window — where the host drops input
+     * rather than applying it late — it is a discontinuity, not something to steer: the counter is
+     * re-taken as INITIAL_SYNC takes it, and what was predicted on the old numbering is dropped.
+     * Inside the window the dilation is left to it, with the input applied late meanwhile (a 31-frame
+     * stall costs 9.8 s of that). The window is the host's; the client's own `frame_capacity` stands
+     * for it here, the host never names it, and the two default alike.
+     *
+     * The gap is exact only at zero latency: the frame the host named is a one-way trip old, and
+     * input tagged now lands a one-way trip later, so a client behind by a little less than the
+     * window as it sees it is behind by more than the window as the host does — every input
+     * dropped, and the gap never says so, for the 20 × 2 × latency frames the dilation takes to
+     * close the band (2 s at 50 ms one way). The host's depth feedback says so exactly: it is its
+     * latest sight of our frame minus its sim frame, measured where our input lands, latency
+     * included. At or past the window's depth the host is dropping our input, and the client
+     * re-takes its time — once the host has seen input from the time last taken, since the reports
+     * in flight after a re-align still carry the old depth.
+     *
+     * Keyed on the gap and on the host's word, never on the page's visibility: a debugger pause, a
+     * GC stall and a sleeping laptop look the same from here, and the session never sees the ticker.
+     */
+    #retake_host_time_if_stalled() {
+        if (this.#binding_answer !== BindingAnswer.Synced && this.#binding_answer !== BindingAnswer.Resumed) return;
+
+        const behind = this.#host_frame_seen - this.#local_frame;
+        const trimmed = this.#host_depth_seen <= -this.frame_capacity
+            && this.#host_marker_seen >= this.#world_start_frame;
+        if (behind < this.frame_capacity && !trimmed) return;
+
+        this.stall_count++;
+
+        this.#align_to_host(this.#host_frame_seen);
+        this.#forget_predicted_world();
+
+        // Input from here on is predicted on the host's time. What was predicted before it is below
+        // the host's window and would be trimmed on arrival, so it is not sent.
+        this.#world_start_frame = this.#local_frame;
+        if (this.#peer.is_connected(this.#remote_peer_id)) {
+            this.#peer.release_outbound(this.#remote_peer_id, this.#world_start_frame);
+        }
     }
 
     /**
@@ -2382,7 +2558,7 @@ export class NetworkSession {
         // written over the truth, not over a render blend that a restore would then put back
         this.normalize_if_dirty();
 
-        const entity_count = buffer.readUintVar();
+        const entity_count = buffer.readUint32();
         for (let i = 0; i < entity_count; i++) {
             const network_id = buffer.readUintVar();
             const component_count = buffer.readUint8();
@@ -2471,9 +2647,35 @@ export class NetworkSession {
         } else {
             this.#remote_entities.add(entity_id);
         }
+        this.#file_owner(entity_id, owner_peer_id);
         this.#interpolation_pending.add(entity_id);
     }
 
+    /**
+     * File `entity_id` under `owner_peer_id` in {@link #owned_by}, out of wherever it was; -1 files
+     * it nowhere.
+     * @param {number} entity_id
+     * @param {number} owner_peer_id
+     */
+    #file_owner(entity_id, owner_peer_id) {
+        const previous = this.#owner_of.get(entity_id);
+        if (previous === owner_peer_id) return;
+        if (previous !== undefined) {
+            const set = this.#owned_by.get(previous);
+            set.delete(entity_id);
+            if (set.size === 0) this.#owned_by.delete(previous);
+            this.#owner_of.delete(entity_id);
+        }
+        if (owner_peer_id < 0) return;
+        let set = this.#owned_by.get(owner_peer_id);
+        if (set === undefined) {
+            set = new Set();
+            this.#owned_by.set(owner_peer_id, set);
+        }
+        set.add(entity_id);
+        this.#owner_of.set(entity_id, owner_peer_id);
+    }
+
     /**
      *
      * @param {number} peer_id
@@ -2551,7 +2753,7 @@ export class NetworkSession {
             // session. Both calls are no-ops when there is nothing to release.
             this.#server.disconnect_peer(peer_id);
             this.#unwire_peer_transport_disconnect(peer_id);
-            this.#pending_initial_sync.delete(peer_id);
+            this.#joins.delete(peer_id);
             return;
         }
         const last_acked = this.#peer.baseline.last_acked(peer_id);
@@ -2563,15 +2765,32 @@ export class NetworkSession {
         // from `#on_host_tick_complete` and throws — before AUTH_STATE and
         // time-dilation feedback go out to *any* peer, and without ever
         // draining the entry, so every later tick throws the same way.
-        this.#pending_initial_sync.delete(peer_id);
+        // a peer that drops before its join finished holds half a world: it may not resume it
+        const join_complete = !this.#joins.has(peer_id);
+        this.#joins.delete(peer_id);
         this.#unwire_peer_transport_disconnect(peer_id);
         this.#peer_grace_state.set(peer_id, {
             deadline_ms: this.#clock_ms + this.#server_resume_grace_ms,
             last_acked,
+            join_complete,
         });
         this.onPeerLost.send2(peer_id, reason);
     }
 
+    /**
+     * Host: `peer_id`'s connection is no longer whole (see Connection.onProtocolError) and can
+     * carry nothing more. Handled as its transport dropping — the peer goes into the grace window
+     * and may resume on a new connection — and the transport is closed, so the client hears of it
+     * now rather than when silence reaps it.
+     * @param {number} peer_id
+     * @param {string} reason
+     */
+    #on_peer_protocol_error(peer_id, reason) {
+        const entry = this.#peer_transport_listeners.get(peer_id);
+        this.#on_peer_transport_disconnected(peer_id, `protocol_error: ${reason}`);
+        if (entry !== undefined) close_transport(entry.transport);
+    }
+
     /**
      * Validate a RESUME_HELLO and either welcome the peer back (restore
      * baseline + send RESUME_ACCEPT) or reject with a reason code. A claim
@@ -2603,6 +2822,7 @@ export class NetworkSession {
         if (transport_peer_id !== claimed_peer_id) {
             this.#peer.send_resume_reject(transport_peer_id, ResumeRejectReason.PeerIdCollision);
             this.#peer.send_disconnect(transport_peer_id, 'peer_id_collision');
+            this.#flush_last_word(transport_peer_id);
             this.#server.disconnect_peer(transport_peer_id);
             this.#unwire_peer_transport_disconnect(transport_peer_id);
             // The transport may have been added to the live set in connect()
@@ -2611,7 +2831,7 @@ export class NetworkSession {
             // serializes AUTH_STATE / time-dilation to a now-disposed conn and
             // throws "peer not connected", taking down the tick for all peers.
             this.#connected_peers.delete(transport_peer_id);
-            this.#pending_initial_sync.delete(transport_peer_id);
+            this.#joins.delete(transport_peer_id);
             this.#peer_inbound_mark.delete(transport_peer_id);
             return;
         }
@@ -2639,6 +2859,7 @@ export class NetworkSession {
             // INITIAL_SYNC queue.
             this.#peer.send_resume_reject(transport_peer_id, ResumeRejectReason.NoSessionToken);
             this.#peer.send_disconnect(transport_peer_id, 'no_session_token');
+            this.#flush_last_word(transport_peer_id);
             this.#server.disconnect_peer(transport_peer_id);
             this.#unwire_peer_transport_disconnect(transport_peer_id);
             return;
@@ -2679,16 +2900,28 @@ export class NetworkSession {
             // a new peer_id from the matchmaking layer.
             this.#peer.send_resume_reject(transport_peer_id, ResumeRejectReason.TokenMismatch);
             this.#peer.send_disconnect(transport_peer_id, 'token_mismatch');
+            this.#flush_last_word(transport_peer_id);
             this.#server.disconnect_peer(transport_peer_id);
             this.#unwire_peer_transport_disconnect(transport_peer_id);
             // Same cleanup as the collision branch above: if this transport was
             // a fresh peer added to the live set, drop it from both iterated
             // maps so the next host tick doesn't address a disposed conn.
             this.#connected_peers.delete(transport_peer_id);
-            this.#pending_initial_sync.delete(transport_peer_id);
+            this.#joins.delete(transport_peer_id);
             this.#peer_inbound_mark.delete(transport_peer_id);
             return;
         }
+        // A join that never finished. The client holds whatever pages reached it — part of a
+        // world — and resuming would keep it. Refused like a stale frame: the client falls through
+        // to a full resync.
+        if (grace.join_complete === false) {
+            this.#peer.send_resume_reject(transport_peer_id, ResumeRejectReason.StaleFrame);
+            this.#peer_grace_state.delete(claimed_peer_id);
+            this.#queue_initial_sync(transport_peer_id);
+            this.#connected_peers.add(transport_peer_id);
+            return;
+        }
+
         // Ring-floor gate. The client asks to resume from `last_acked_frame + 1`,
         // but the action-log ring only still holds frames back to
         // `current_sim_frame - frame_capacity + 1`. If the requested frame
@@ -2733,7 +2966,7 @@ export class NetworkSession {
                 // so release it here or the id stays unconnectable forever.
                 this.#server.disconnect_peer(peer_id);
                 this.#unwire_peer_transport_disconnect(peer_id);
-                this.#pending_initial_sync.delete(peer_id);
+                this.#joins.delete(peer_id);
                 this.onPeerPermanentlyDropped.send2(peer_id, 'grace_expired');
             }
         }
@@ -2748,6 +2981,13 @@ export class NetworkSession {
      * pinned forever (host) or never noticed (client). The per-tick keepalive
      * traffic the facade sends both directions keeps a live connection well
      * clear of the budget. Called from `tick()` only when the budget is > 0.
+     *
+     * The host closes a reaped peer's transport as well. A silent peer is not always a gone one: a
+     * client whose tab went to the background stops stepping and keeps its socket, and when it steps
+     * again the close is waiting behind the packets it was sent, so it learns of the reap then — not
+     * a whole silence budget later, on a clock that stood still with it (its budget runs on frame
+     * time). A transport with no close of its own (`NodeUDP`) leaves it to that budget.
+     * `NetworkSession.stall.spec.js`.
      * @private
      */
     #reap_silent_peers() {
@@ -2759,7 +2999,11 @@ export class NetworkSession {
             }
             if (to_reap !== null) {
                 for (let i = 0; i < to_reap.length; i++) {
-                    this.#on_peer_transport_disconnected(to_reap[i], 'timeout');
+                    const peer_id = to_reap[i];
+                    // unwired by the reap before it is closed, so the close is not taken for a second loss
+                    const entry = this.#peer_transport_listeners.get(peer_id);
+                    this.#on_peer_transport_disconnected(peer_id, 'timeout');
+                    if (entry !== undefined) close_transport(entry.transport);
                 }
             }
         } else if (this.#reconnect_state === ReconnectState.Connected && this.#remote_peer_id >= 0) {
@@ -2813,6 +3057,25 @@ export class NetworkSession {
         this.#current_transport_listener = listener;
     }
 
+    /**
+     * Client: the connection to the host is no longer whole (see Connection.onProtocolError) and
+     * can carry nothing more. Given up as a dropped transport is — the reconnect ladder resumes on
+     * a new one — and closed, so the host hears of it now rather than when silence reaps it.
+     * @param {string} reason
+     */
+    #on_client_protocol_error(reason) {
+        const transport = this.#current_transport;
+        // unhooked first: the close must not be taken for a second loss
+        if (transport !== null && this.#current_transport_listener !== null) {
+            try {
+                transport.onDisconnect.remove(this.#current_transport_listener);
+            } catch (_) { /* swallow */
+            }
+        }
+        this.#on_client_transport_disconnected(`protocol_error: ${reason}`);
+        if (transport !== null) close_transport(transport);
+    }
+
     #on_client_transport_disconnected(reason) {
         if (this.#reconnect_state === ReconnectState.Lost) return;
         // Tear down the dead peer/channel binding so a fresh transport
@@ -3001,9 +3264,10 @@ export class NetworkSession {
         const scratch = this.#scratch_send_buf;
         const world = this.world;
 
-        for (const entity_id of this.#event_listeners.keys()) {
-            if (this.#remote_entities.has(entity_id)) continue;
+        const owned = this.#owned_by.get(this.local_peer_id);
+        if (owned === undefined) return;
 
+        for (const entity_id of owned) {
             const identity = world.getComponent(entity_id, NetworkIdentity);
             if (identity === undefined || identity.network_id < 0) continue;