quico 0.7.0 → 0.9.0

package/src/quic_connection.js

@@ -299,6 +299,7 @@ function QUICConnection(options) {
     // complete"), issues no connection IDs and sends no HANDSHAKE_DONE.
     peer_finished: false,
     handshake_done_sent: false,
+    new_token_for: null,                  // the address:port the last NEW_TOKEN was for (issueNewToken)
 
     // Connection close (RFC 9000 §10.2)
     close_frame: null,         // the CONNECTION_CLOSE frame to (re)send while closing
@@ -613,6 +614,13 @@ function QUICConnection(options) {
     stats_bytes_sent: 0,
     stats_packets_received: 0,
     stats_bytes_received: 0,
+    // The application's bytes in them, for WebTransport's getStats() (W3C
+    // WebTransportConnectionStats): DATAGRAM payloads sent (new STREAM bytes
+    // are max_data_sent), the payload of the packets acknowledged, and the
+    // size of the packets declared lost.
+    stats_datagram_bytes_sent: 0,
+    stats_payload_acked: 0,
+    stats_bytes_lost: 0,
     // Streams that hit the peer's flow-control limit since the last check —
     // for STREAM_DATA_BLOCKED (maybeSendBlockedFrames), instead of a walk of
     // every stream on every send pass.
@@ -696,13 +704,18 @@ function QUICConnection(options) {
 
     max_packets_per_burst: 20,          // fixed cap — not CC-controlled, no current_/init_
 
-    // packet payload (MTU). current_ is the size actually used; max_ is the ceiling
-    // DPLPMTUD must not probe past; init_/floor is QUIC's guaranteed 1200-byte minimum.
+    // packet size (MTU). Datagram sizes are WHOLE UDP payloads: max_ is the
+    // ceiling DPLPMTUD must not probe past; init_ is QUIC's 1200 — RFC 9000
+    // §14: no datagram larger until a path has shown it carries one; current_
+    // is the size in use. current_limit_packet_payload is what a packet has
+    // for FRAMES: that datagram, within the peer's max_udp_payload_size, less
+    // the packet's header and AEAD tag (syncPacketPayload).
     max_limit_packet_payload:     connOpts.maxUdpPayloadSize,   // ceiling, maxUdpPayloadSize: 1452 (IPv6-safe Ethernet: 1500 − 48 hdr) —
                                               // a whole UDP datagram: what DPLPMTUD probes up to
-    init_limit_packet_payload:    1200,       // QUIC guaranteed floor — where we start
-    current_limit_packet_payload: 1200,       // = init_; DPLPMTUD raises it: the frames a packet
-                                              // carries, the datagram it confirmed less its header
+    init_limit_datagram:          1200,       // QUIC's guaranteed floor — where we start
+    current_limit_datagram:       1200,       // = init_; DPLPMTUD raises it
+    current_limit_packet_payload: 1200 - 69,  // frames; set by syncPacketPayload — until then,
+                                              // 1200 less the largest header (a 0-RTT packet, 20-byte CIDs)
     pmtu: null,                               // DPLPMTUD's state (pmtuReset)
     peer_max_udp_payload: 65527,              // its max_udp_payload_size (RFC 9000 §18.2)
 
@@ -731,7 +744,7 @@ function QUICConnection(options) {
     current_limit_packets_per_sec:   12000,   // = init_; BBR rewrites at round-end
     max_limit_bytes_per_sec:         14000000, // ceiling ~14 MB/s — coherent ↑
     min_limit_bytes_per_sec:         12000,   // floor ~96 kbps — avoid 0/deadlock
-    init_limit_bytes_per_sec:        14000000,
+    init_limit_bytes_per_sec:        14000000, // until the first RTT sample (bbrInitPacingRate)
     current_limit_bytes_per_sec:     14000000, // = init_; BBR rewrites at round-end
 
     burst_timer: null,
@@ -888,6 +901,7 @@ function QUICConnection(options) {
     //   pn → { t: expiry wall-time, spans: [[sid, ranges, finLost], ...] }
     //   (ranges: the packet's flat range list of that stream)
     expired_unacked: {},
+    limbo_n: 0,                     // entries in expired_unacked (kept, not counted)
     reorder_in_count: 0,        // app packets that arrived below the highest PN seen (network reordering, peer→us)
 
     // --- BBR-lite measurement (Phase 4b, step 1+2 — measure only, no control). ---
@@ -917,6 +931,10 @@ function QUICConnection(options) {
     // a round says how much the APPLICATION produced, not what the path can
     // carry — see the sample filter at round end.
     bbr_round_app_limited: false,
+    // The most bytes in flight in this round and in the last — whether the
+    // window is in use, for Startup's growth (growStartupWindow).
+    bbr_peak_inflight: 0,
+    bbr_prev_peak_inflight: 0,
     bbr_full_bw: 0,             // highest BtlBw seen — Startup plateau detector
     bbr_full_bw_count: 0,       // consecutive rounds without ≥25% BtlBw growth
     // ACK aggregation (BBR's extra_acked): how far ACKs ran ahead of what
@@ -1122,6 +1140,18 @@ function QUICConnection(options) {
     if (changed.state && (context.state === 'draining' || context.state === 'closing' || context.state === 'closed')) handshakeEnded(false);
 
     if (changed.state && (context.state === 'draining' || context.state === 'closing')) {
+      // 'closing': the connection is over for the application now — the
+      // peer's CONNECTION_CLOSE came (draining), or ours went (closing).
+      // 'close' follows when the closing or draining period ends (RFC 9000
+      // §10.2: up to three PTOs, here at most 3 s), which is packet
+      // housekeeping, not news: a session above that waited for 'close'
+      // learned the peer was gone seconds late. With the peer's code and
+      // reason (context.peer_close) when it was the peer; null when we
+      // closed. Once.
+      if (!context.closing_emitted) {
+        context.closing_emitted = true;
+        ev.emit('closing', context.state === 'draining' ? (context.peer_close || null) : null);
+      }
       failPermitWaiters();
       clearIdleTimer();
       // A draining/closing endpoint must stop retransmitting CRYPTO — the
@@ -1441,7 +1471,7 @@ function QUICConnection(options) {
   // the search may go there.
   function setMaxUdpPayload(v) {
     context.max_limit_packet_payload = v;
-    var now = context.current_limit_packet_payload + shortHeaderOverhead();
+    var now = context.current_limit_datagram;
     var m = context.pmtu;
     if (now > v) pmtuApply(v);
     if (m) {
@@ -1660,6 +1690,7 @@ function QUICConnection(options) {
     context.sending_app_pn_in_flight.clear();
     context.pn_sids.clear();
     context.expired_unacked = {};
+    context.limbo_n = 0;
     context.no_resend_in_flight = {};
     context.control_in_flight = {};
     for (var sid in context.send_streams) {
@@ -1777,6 +1808,8 @@ function QUICConnection(options) {
     // as a CRYPTO_ERROR (0x100 + alert code, RFC 9001 §4.8) — the peer learns
     // why, and this side reports the close now rather than at a timeout.
     tls.on('alert', function (code) { close(0x100 + code, 'TLS alert ' + code); });
+    // The peer's quic_transport_parameters that cannot be read at all.
+    tls.on('transportParamsError', function (why) { close(0x08, why); });
     // The reason for that alert. During the handshake it is the connection's
     // failure, reported like the handshake timeout: 'error', then 'close'.
     // The alert has already closed the connection, so nothing else to do.
@@ -1902,6 +1935,7 @@ function QUICConnection(options) {
       // a bound on what DPLPMTUD probes. "Values below 1200 are invalid."
       if (typeof p.max_udp_payload_size === 'number') {
         context.peer_max_udp_payload = p.max_udp_payload_size;
+        syncPacketPayload();
       }
       // Stream-count limits the peer grants us (localStreamPermitted holds
       // back a stream past them). Seeded directly, not through set_context:
@@ -2042,10 +2076,7 @@ function QUICConnection(options) {
           queueControl('hd');     // retransmitted until acknowledged (§13.3)
           // A token for the client's next connection (NEW_TOKEN, §8.1.3):
           // it will need no proof of address then.
-          if (typeof options.newToken === 'function') {
-            var nt = options.newToken(peerPath().address, context.version);
-            if (nt && nt.byteLength > 0) queueControl('nt', { type: 'new_token', token: nt });
-          }
+          issueNewToken(peerPath());
         }
         discardSpace('handshake');
         crStart();
@@ -2060,9 +2091,10 @@ function QUICConnection(options) {
       }
     });
 
-    // Note: QUIC handles key updates via key_phase bit, not TLS KeyUpdate message.
-    // RFC 9001 §6: "endpoints MUST treat the receipt of a TLS KeyUpdate message
-    // as a connection error of type 0x010a" — but we silently ignore it.
+    // QUIC updates keys with the Key Phase bit, never a TLS KeyUpdate (RFC
+    // 9001 §6): one received, in any space, closes the connection with 0x010a
+    // (TLS_RECEIVABLE, in processCryptoFrame); one TLS would send is not sent
+    // (tls_bridge).
   }
 
 
@@ -2344,13 +2376,22 @@ function QUICConnection(options) {
       );
     }
 
-    if (!decrypted || !decrypted.plaintext || decrypted.plaintext.byteLength === 0) {
+    if (!decrypted || !decrypted.plaintext) {
       if (DEBUG) console.log('[quic] decrypt failed: ' + space + ' raw_len=' + pkt.raw.byteLength + ' first20=' + Array.from(pkt.raw.slice(0, 20)).map(function(b){ return b.toString(16).padStart(2,'0'); }).join(' ') + ' recv_cid_len=' + (recvCid ? recvCid.byteLength : 'null') + ' has_keys=' + !!readKeys + ' largest_pn=' + context.recv_pn_largest[space]);
       return;
     }
 
     if (DEBUG) console.log('[quic] decrypted ' + space + ' pn=' + decrypted.packet_number + ' len=' + decrypted.plaintext.byteLength);
 
+    // The reserved bits, now that the packet is authenticated: set, it is a
+    // PROTOCOL_VIOLATION (RFC 9000 §17.2: 0x0c of a long header; §17.3.1:
+    // 0x18 of a short one). An empty payload goes on to the frames, where a
+    // packet with none is one too (§12.4).
+    if (decrypted.first_byte & ((decrypted.first_byte & 0x80) ? 0x0c : 0x18)) {
+      close(0x0a, 'reserved header bits set in a ' + space + ' packet');
+      return;
+    }
+
     // RFC 9000 §8.1: "A server might wish to validate the client address
     // before starting the cryptographic handshake. [...] the server MAY
     // consider the peer address validated if the client uses a connection ID
@@ -2657,10 +2698,15 @@ function QUICConnection(options) {
       } else if (frame.type === 'streams_blocked_bidi' || frame.type === 'streams_blocked_uni') {
         // The peer has used every stream we granted. Ack-eliciting like any
         // frame but ACK/PADDING/CONNECTION_CLOSE (it used to fall through
-        // unacknowledged); answered with our current limit, which also
-        // recovers a lost MAX_STREAMS, as DATA_BLOCKED does for MAX_DATA.
+        // unacknowledged). Blocked below our current limit, it missed a
+        // MAX_STREAMS: sent again — as DATA_BLOCKED recovers MAX_DATA. At it,
+        // the peer has our limit already, and a MAX_STREAMS for each such
+        // frame would be one frame of ours for every one of its.
         ackEliciting = true;
-        queueControl(frame.type === 'streams_blocked_bidi' ? 'ms_bidi' : 'ms_uni');
+        var sbBidi = frame.type === 'streams_blocked_bidi';
+        if (frame.limit < (sbBidi ? context.local_max_streams_bidi : context.local_max_streams_uni)) {
+          queueControl(sbBidi ? 'ms_bidi' : 'ms_uni');
+        }
       } else if (frame.type === 'data_blocked') {
         // The peer is stalled on our connection window. Our MAX_DATA may have
         // been lost (window updates are sent once, unrecovered) — re-send the
@@ -2930,6 +2976,21 @@ function QUICConnection(options) {
   // which rides in the ticket, never came back to it.
   var NEW_SESSION_TICKET = 0x04;
 
+  // Which TLS messages each side may receive, in which space (RFC 9001 §4,
+  // Table 1; RFC 8446 §4). TLS itself does not know the spaces — they are
+  // QUIC's encryption levels — so they are held to here, for every message,
+  // before TLS sees it. Never in any space: KeyUpdate (§6 — QUIC updates its
+  // keys itself), EndOfEarlyData (§8.3), anything a client sends to a client
+  // or a server to a server. Any other: unexpected_message (§4.8, §6).
+  //   1 ClientHello · 2 ServerHello (a HelloRetryRequest included) ·
+  //   4 NewSessionTicket · 8 EncryptedExtensions · 11 Certificate ·
+  //   13 CertificateRequest · 15 CertificateVerify · 20 Finished ·
+  //   25 CompressedCertificate (RFC 8879)
+  var TLS_RECEIVABLE = {
+    server: { initial: [1], handshake: [11, 15, 20, 25], app: [] },
+    client: { initial: [2], handshake: [8, 11, 13, 15, 20, 25], app: [NEW_SESSION_TICKET] }
+  };
+
   // Reassembly, per space. In order: `q`, the bytes received and not yet
   // read as TLS messages (pieces, `qlen` of them in all), up to `end`.
   // Ahead of a gap: `ahead`, pieces sorted by offset that never overlap
@@ -3040,15 +3101,21 @@ function QUICConnection(options) {
     if (messages.length === 0) return;
     if (!tls) { if (DEBUG) console.log('[quic] initializing TLS bridge'); initTLS(); }
 
-    for (var mi = 0; mi < messages.length; mi++) {
-      var msg = messages[mi];
-      var msgType = msg[0];
-      if (space === 'app' && (context.isServer || msgType !== NEW_SESSION_TICKET)) {
+    // Every message of the batch checked before TLS sees any: a Finished
+    // followed by a KeyUpdate closes the connection without the Finished
+    // answered first (a ticket, HANDSHAKE_DONE) — not after it.
+    var receivable = TLS_RECEIVABLE[context.isServer ? 'server' : 'client'][space];
+    for (var ci = 0; ci < messages.length; ci++) {
+      if (receivable.indexOf(messages[ci][0]) < 0) {
         // TLS's unexpected_message as a CRYPTO_ERROR (RFC 9001 §4.8); a
         // KeyUpdate is named as one (§6).
-        close(0x100 + 10, 'TLS message ' + msgType + ' after the handshake');
+        close(0x100 + 10, 'TLS message ' + messages[ci][0] + ' in the ' + space + ' space');
         return;
       }
+    }
+    for (var mi = 0; mi < messages.length; mi++) {
+      var msg = messages[mi];
+      var msgType = msg[0];
       // Closed by what an earlier message brought: the rest is not read.
       if (context.state === 'closing' || context.state === 'draining' || context.state === 'closed') return;
       if (DEBUG) console.log('[quic] → TLS msg #' + mi + ' type=0x' + msgType.toString(16) + ' len=' + msg.length);
@@ -4181,6 +4248,7 @@ function QUICConnection(options) {
     if (context.srtt === null) {
       context.srtt = adjusted;
       context.rttvar = adjusted / 2;
+      bbrInitPacingRate();
     } else {
       context.rttvar = 0.75 * context.rttvar + 0.25 * Math.abs(context.srtt - adjusted);
       context.srtt = 0.875 * context.srtt + 0.125 * adjusted;
@@ -4297,10 +4365,23 @@ function QUICConnection(options) {
     if (extra > context.bbr_ea_round_max) context.bbr_ea_round_max = extra;
   }
 
+  // Whether a window of w bytes is in use: in flight reached half of it,
+  // this round or the last — slow start's test for being limited by the
+  // window (Linux tcp_is_cwnd_limited; RFC 9002 §7.8).
+  function windowInUse(w) {
+    return 2 * Math.max(context.bbr_peak_inflight, context.bbr_prev_peak_inflight) >= w;
+  }
+
   function growStartupWindow(newlyAckedBytes) {
     if (context.bbr_state !== 'startup' || !(newlyAckedBytes > 0)) return;
     var cap = startupCap(), cur = context.current_limit_bytes_in_flight;
     if (cur >= cap) return;
+    // Only a window in use grows (windowInUse). A sender with less to send
+    // than the window — media below the path's rate — grew it by every byte
+    // acknowledged, without end (1.2 Mbit/s for 3 s: 25 KB → 496 KB), a
+    // window nothing had measured, and the next burst (a keyframe) went out
+    // in it at once, into the bottleneck's queue.
+    if (!windowInUse(cur)) return;
     context.current_limit_bytes_in_flight = Math.min(context.max_limit_bytes_in_flight, cap,
       cur + newlyAckedBytes);
     context.current_limit_packets_in_flight = Math.min(context.max_limit_packets_in_flight,
@@ -4361,6 +4442,24 @@ function QUICConnection(options) {
       Math.max(context.min_limit_packets_in_flight,
         Math.round(context.current_limit_bytes_in_flight / context.current_limit_packet_payload)));
   }
+  // Startup's first pacing rate, from the first RTT sample: the initial
+  // window over the round trip, at Startup's gain (BBR's BBRInitPacingRate,
+  // §5.6.2; quiche the same). It was the ceiling, 14 MB/s — and Startup only
+  // raises the rate, so it stayed there: Startup was not paced at all, the
+  // window left at once at ~112 Mbit/s, into the queue of any slower path.
+  // A media sender rarely leaves Startup, and every keyframe went so (a
+  // 90 KB one, a 20 Mbit/s link with a 64 KB queue: ~20 drops a keyframe);
+  // on a long path the first rounds' bursts were dropped, Startup ended on
+  // those losses with ~14 of 20 Mbit/s measured, and a 4 MB transfer took
+  // 3.7-3.9 s instead of 2.6 (150 ms). The cost: the initial window takes
+  // RTT/2.89 to leave — a first page's body ~27 ms later at 150 ms, within
+  // noise at 40. A new path starts here again (resetPathEstimates: the rate
+  // back to init_, srtt null until its first sample).
+  function bbrInitPacingRate() {
+    if (context.bbr_state !== 'startup') return;
+    setPacingRate(BBR_STARTUP_GAIN * context.init_limit_bytes_in_flight / (Math.max(context.srtt, 1) / 1000));
+  }
+
   function setPacingRate(bps) {
     context.current_limit_bytes_per_sec = Math.max(context.min_limit_bytes_per_sec,
       Math.min(context.max_limit_bytes_per_sec, bps));
@@ -4522,6 +4621,16 @@ function QUICConnection(options) {
     }
   }
 
+  // A 1-RTT packet carrying stream data or datagrams declared lost: counted
+  // (getStats' packetsLost, and bytesLost by its size on the wire), and
+  // Careful Resume told.
+  function countLostPacket(pnum) {
+    context.lost_count++;
+    var h = context.sending_app_pn_history[pnum - (context.send_pn.app - context.sending_app_pn_history.length)];
+    if (h) context.stats_bytes_lost += h[1];
+    crOnLoss();
+  }
+
   // A packet given up on — expired, or its control frames deemed lost: out
   // of the bytes in flight. Returns its size (0: not in flight any more).
   function forgetPacket(pn) {
@@ -4532,6 +4641,58 @@ function QUICConnection(options) {
     return pk.bytes;
   }
 
+  // How many of the values in `r` (flat [from, to) pairs) `a` already
+  // covers — flat_ranges.length(flat_ranges.intersect(a, r)), found by binary
+  // search in `a` for each pair of `r` instead of a walk of both. Both are
+  // the library's sorted, merged lists; `r` not so (never seen) is answered
+  // the original way.
+  function coveredLength(a, r) {
+    var na = a.length, total = 0, prevTo = -Infinity;
+    if (na === 0 || r.length === 0) return 0;
+    for (var i = 0; i < r.length; i += 2) {
+      var f = r[i], t = r[i + 1];
+      if (f < prevTo) return flat_ranges.length(flat_ranges.intersect(a, r));
+      prevTo = t;
+      if (f >= t) continue;
+      // first pair of a whose `to` > f
+      var lo = 0, hi = na >> 1;
+      while (lo < hi) {
+        var mid = (lo + hi) >> 1;
+        if (a[(mid << 1) + 1] <= f) lo = mid + 1; else hi = mid;
+      }
+      for (var k = lo << 1; k < na && a[k] < t; k += 2) {
+        var from = a[k] > f ? a[k] : f;
+        var to = a[k + 1] < t ? a[k + 1] : t;
+        if (to > from) total += to - from;
+      }
+    }
+    return total;
+  }
+
+  // Would flat_ranges.remove(list, r) change `list`? Only if a pair of `r`
+  // overlaps one of it (half-open; flat_ranges.overlaps, a binary search).
+  function overlapsAny(list, r) {
+    if (list.length === 0) return false;
+    for (var i = 0; i < r.length; i += 2) {
+      if (flat_ranges.overlaps(list, r[i], r[i + 1])) return true;
+    }
+    return false;
+  }
+
+  // How many packet numbers a flat [from, to, from, to, ...] list of
+  // inclusive ranges covers.
+  function rangesSpan(r) {
+    var n = 0;
+    for (var i = 0; i < r.length; i += 2) n += r[i + 1] - r[i] + 1;
+    return n;
+  }
+
+  // Entries in the limbo table (kept as it changes — counting them meant
+  // walking it).
+  function limboCount() {
+    return context.limbo_n > 0 ? context.limbo_n : 0;
+  }
+
   function processAckFrame(space, frame) {
     // RFC 9000 §13.1: "An endpoint SHOULD treat receipt of an acknowledgment
     // for a packet it did not send as a connection error of type
@@ -4665,9 +4826,28 @@ function QUICConnection(options) {
       // Mark in-flight as acked. Collect the acked PNs first, then mutate —
       // deleting from a Set while iterating it with for-of is fragile.
       var ackedPns = [];
-      for (var pn of context.sending_app_pn_in_flight) {
+      // Walked from whichever side is smaller: the packets in flight, or the
+      // packet numbers this ACK covers. Every in-flight packet was tested
+      // against every range on every ACK — at a high RTT the window holds
+      // thousands, and a page's worth of ACKs cost that many times over.
+      // Ascending either way (the set is in send order), as before.
+      if (rangesSpan(ackedRanges) < context.sending_app_pn_in_flight.size) {
         for (var ri = 0; ri < ackedRanges.length; ri += 2) {
-          if (pn >= ackedRanges[ri] && pn <= ackedRanges[ri + 1]) { ackedPns.push(pn); break; }
+          for (var rpn0 = ackedRanges[ri]; rpn0 <= ackedRanges[ri + 1]; rpn0++) {
+            if (context.sending_app_pn_in_flight.has(rpn0)) ackedPns.push(rpn0);
+          }
+        }
+      } else {
+        // Both in ascending order (ack_frame_to_ranges sorts and merges the
+        // ranges; the set is in packet-number order): one pointer into the
+        // ranges, and the walk ends past the largest acknowledged — what is
+        // in flight above it cannot be in this ACK. Each packet was tested
+        // against every range, and the walk went on to the newest packet.
+        var rp1 = 0, rTop1 = ackedRanges[ackedRanges.length - 1];
+        for (var pn of context.sending_app_pn_in_flight) {
+          if (pn > rTop1) break;
+          while (ackedRanges[rp1 + 1] < pn) rp1 += 2;
+          if (pn >= ackedRanges[rp1]) ackedPns.push(pn);
         }
       }
       // A packet's ranges of a stream, acknowledged. Returns the bytes newly
@@ -4675,12 +4855,19 @@ function QUICConnection(options) {
       // transmission and a retransmission of the same range ending up ACKed
       // (routine once late ACKs for expired packets are honoured) count once.
       function creditRanges(st, ranges) {
-        var fresh = flat_ranges.length(ranges) - flat_ranges.length(flat_ranges.intersect(st.acked_ranges, ranges));
+        // The bytes of `ranges` not acknowledged before — what
+        // length(intersect(acked, ranges)) gave, without walking all of
+        // acked_ranges and building the intersection for every packet. After
+        // a loss acked_ranges holds hundreds of pieces until the hole is
+        // filled, and this ran once per acknowledged packet (coveredLength).
+        var fresh = flat_ranges.length(ranges) - coveredLength(st.acked_ranges, ranges);
         flat_ranges.add(st.acked_ranges, ranges);
         // Out of missing, whatever it was: an ACK is proof — a late one too,
         // for bytes already given up on and not yet resent (add_have would
         // leave those missing: it defers to what not_have says).
-        flat_ranges.remove(st.missing_ranges, ranges);
+        // remove() walks and rebuilds the whole list; it is called only when
+        // it would change something — when the ranges touch a missing one.
+        if (overlapsAny(st.missing_ranges, ranges)) flat_ranges.remove(st.missing_ranges, ranges);
         if (st.acked_ranges[0] === 0) sendQueueRelease(st, st.acked_ranges[1]);
         return fresh > 0 ? fresh : 0;
       }
@@ -4714,15 +4901,17 @@ function QUICConnection(options) {
       var largestAckedPn = -1;
       for (var lri = 0; lri < ackedRanges.length; lri += 2) if (ackedRanges[lri + 1] > largestAckedPn) largestAckedPn = ackedRanges[lri + 1];
       var ackedPkts = [];
+      var rp2 = 0;   // pointer into the ranges, as for ackedPns above
       for (var pke of context.pkt_in_flight) {
         var ppn = pke[0];
         if (ppn > largestAckedPn) break;
-        for (var pri = 0; pri < ackedRanges.length; pri += 2) {
-          if (ppn >= ackedRanges[pri] && ppn <= ackedRanges[pri + 1]) { ackedPkts.push(ppn); break; }
-        }
+        while (ackedRanges[rp2 + 1] < ppn) rp2 += 2;
+        if (ppn >= ackedRanges[rp2]) ackedPkts.push(ppn);
       }
       var ackedSizes = [];
       for (var api = 0; api < ackedPkts.length; api++) {
+        var apk = context.pkt_in_flight.get(ackedPkts[api]);
+        if (apk && apk.payload) context.stats_payload_acked += apk.payload;
         var asz = forgetPacket(ackedPkts[api]);
         ackedSizes.push(asz);
         ackedPacketBytes += asz;
@@ -4756,14 +4945,33 @@ function QUICConnection(options) {
       // DID arrive — the timer was simply wrong — so: credit the goodput
       // (repairing the BtlBw signal), mark the spans acked (cancelling any
       // retransmit that hasn't left yet), and take back the loss we counted.
-      for (var lpn in context.expired_unacked) {
-        var lnum = Number(lpn);
-        var hit = false;
-        for (var ri2 = 0; ri2 < ackedRanges.length; ri2 += 2) {
-          if (lnum >= ackedRanges[ri2] && lnum <= ackedRanges[ri2 + 1]) { hit = true; break; }
+      // The limbo table holds up to ~10 s of expired packets: walking all of
+      // it for each ACK (for-in, a string key made per entry) was the larger
+      // part of an ACK's cost on a lossy, distant path. The covered numbers
+      // are looked up instead when they are fewer — ascending, as for-in
+      // visits integer keys.
+      var lateHits = [];
+      if (rangesSpan(ackedRanges) < limboCount()) {
+        for (var lr = 0; lr < ackedRanges.length; lr += 2) {
+          for (var lq = ackedRanges[lr]; lq <= ackedRanges[lr + 1]; lq++) {
+            if (lq in context.expired_unacked) lateHits.push(String(lq));
+          }
         }
-        if (!hit) continue;
+      } else {
+        // Ascending (integer keys), so: one pointer into the ranges, and
+        // done past the largest acknowledged.
+        var rp3 = 0, rTop3 = ackedRanges[ackedRanges.length - 1];
+        for (var lpn0 in context.expired_unacked) {
+          var lnum = Number(lpn0);
+          if (lnum > rTop3) break;
+          while (ackedRanges[rp3 + 1] < lnum) rp3 += 2;
+          if (lnum >= ackedRanges[rp3]) lateHits.push(lpn0);
+        }
+      }
+      for (var lhi = 0; lhi < lateHits.length; lhi++) {
+        var lpn = lateHits[lhi];
         var rec = context.expired_unacked[lpn];
+        if (!rec) continue;
         for (var si2 = 0; si2 < rec.spans.length; si2++) {
           var sidL = rec.spans[si2][0];
           var stL = context.send_streams[sidL];
@@ -4776,6 +4984,7 @@ function QUICConnection(options) {
         ackedPacketBytes += rec.bytes || 0;
         if (rec.early) context.stats_spurious_early++;
         delete context.expired_unacked[lpn];
+        context.limbo_n--;
         if (context.lost_count > 0) context.lost_count--;   // it wasn't a loss after all
       }
 
@@ -4837,7 +5046,10 @@ function QUICConnection(options) {
         var roundDelivered = context.delivered - context.bbr_round_start_delivered;
         // An app-limited sample is kept only if it RAISES the estimate
         // (BBR delivery-rate sampling: such a sample can show the path is at
-        // least that fast, never that it is slower).
+        // least that fast, never that it is slower). With no estimate yet,
+        // any sample raises it — BBR's max_bw starts at 0 (§5.2.1): a
+        // connection that never filled the pipe (media below the path's
+        // rate) had no estimate at all, estimatedSendRate null throughout.
         //
         // Without this, the first round of every connection — which carries
         // only a small HTML response and some ACK-only packets — measured a
@@ -4854,7 +5066,7 @@ function QUICConnection(options) {
         var crRetreat = !!(context.cr && context.cr.phase === 'safe_retreat');
         if (!crRetreat && roundDur >= 1 && roundDelivered > 0) {
           var roundRate = (roundDelivered * 1000) / roundDur;
-          if (!roundAppLimited || (context.bbr_btlbw !== null && roundRate > context.bbr_btlbw)) {
+          if (!roundAppLimited || roundRate > (context.bbr_btlbw || 0)) {
             context.bbr_btlbw_samples.push({ round: context.bbr_round_count, rate: roundRate });
           }
         }
@@ -4873,6 +5085,8 @@ function QUICConnection(options) {
         context.bbr_round_start_pn = context.send_pn.app; // next PN must be acked for the next round
         context.bbr_round_start_delivered = context.delivered;
         context.bbr_round_start_time = ackNow;
+        context.bbr_prev_peak_inflight = context.bbr_peak_inflight;
+        context.bbr_peak_inflight = context.app_bytes_in_flight;
 
         var BBR_BTLBW_WINDOW = 10; // rounds
         var cutoff = context.bbr_round_count - BBR_BTLBW_WINDOW;
@@ -4885,7 +5099,11 @@ function QUICConnection(options) {
           }
         }
         context.bbr_btlbw_samples = kept;
-        context.bbr_btlbw = maxRate;
+        // No sample left in the window — every round since app-limited and
+        // below the estimate: the estimate stands (BBR's max filter changes
+        // only on a sample it takes). It went back to null after ten such
+        // rounds, and the state machine below with it, mid-connection.
+        if (kept.length > 0) context.bbr_btlbw = maxRate;
 
         // Derived in-flight target. Uses bbr_min_rtt (RTprop, windowed) in seconds.
         if (!crRetreat && context.bbr_btlbw !== null && context.bbr_min_rtt !== null) {
@@ -4966,6 +5184,9 @@ function QUICConnection(options) {
           // ── Write the controls, clamped to [min,max] (the hard safety net). ──
           var clamp = function (v, lo, hi) { return Math.max(lo, Math.min(hi, v)); };
 
+          // The window as the ACKs left it — Startup's floor, below; read
+          // before it is written.
+          var ackGrown = context.current_limit_bytes_in_flight;
           var targetInflight = clamp(cwnd_gain * context.bbr_bdp,
             context.min_limit_bytes_in_flight, context.max_limit_bytes_in_flight);
           context.current_limit_bytes_in_flight = targetInflight;
@@ -4984,8 +5205,18 @@ function QUICConnection(options) {
           if (context.bbr_state === 'startup') {
             // …within startupCap, which may now be lower than what ACKs grew
             // the window to (the BDP of this round is the measured one).
+            // The window before the write above: compared with what was
+            // just written, the max was of a value with itself, and every
+            // round end set the window to max(IW, 2·BDP) — what the ACKs
+            // had grown it by, gone. Kept while it is in use; a window the
+            // last rounds did not fill — a burst (a keyframe) grew it, then
+            // the sender went quiet — goes back to the BDP's: the next burst
+            // left in all of it at Startup's rate, into the bottleneck's
+            // queue (RFC 7661: a window not in use is not validated). Not
+            // while Careful Resume's jump is out: that window is its own.
+            var floor = crJumpOut() || windowInUse(ackGrown) ? ackGrown : 0;
             targetInflight = Math.max(context.init_limit_bytes_in_flight,
-              Math.min(Math.max(targetInflight, context.current_limit_bytes_in_flight), startupCap()));
+              Math.min(Math.max(targetInflight, floor), startupCap()));
             context.current_limit_bytes_in_flight = targetInflight;
             context.current_limit_packets_in_flight = clamp(
               Math.round(targetInflight / context.current_limit_packet_payload),
@@ -5245,7 +5476,8 @@ function QUICConnection(options) {
     var sent = { initial: 0, handshake: 0 };
     if (context.state === 'draining' || context.state === 'closed' || context.state === 'closing') return sent;
     var path = context.path;
-    var cap = Math.max(1200, context.current_limit_packet_payload);
+    // A whole datagram: the size in use, within what the peer takes.
+    var cap = Math.min(context.current_limit_datagram, context.peer_max_udp_payload);
     var plan = [], planBytes = 0;
     var nextPn = { initial: context.send_pn.initial, handshake: context.send_pn.handshake };
     var planned = { initial: [], handshake: [] };
@@ -5682,10 +5914,27 @@ function QUICConnection(options) {
     return (prev && prev.validated) ? prev : context.path;
   }
 
+  // Server: a NEW_TOKEN for the address the client is at (§8.1.3) — after
+  // the handshake, and again each time the client turns up at a new address
+  // and proves it (§9.3: a migration, a NAT rebinding), since the client's
+  // next connection comes from there. The newest replaces one not yet sent.
+  function issueNewToken(path) {
+    if (!context.isServer || typeof options.newToken !== 'function' || !context.handshake_done_sent) return;
+    var at = path.address + ':' + path.port;
+    if (context.new_token_for === at) return;
+    var nt = options.newToken(path.address, context.version);
+    if (!nt || nt.byteLength === 0) return;
+    context.new_token_for = at;
+    queueControl('nt', { type: 'new_token', token: nt });
+  }
+
   function markValidated(path) {
     if (path.validated) return;
     path.validated = true;
-    if (path === context.path) ev.emit('path_validated', path.address, path.port);
+    if (path === context.path) {
+      ev.emit('path_validated', path.address, path.port);
+      issueNewToken(path);
+    }
     if (DEBUG) console.log('[quic] path ' + path.address + ':' + path.port + ' validated (received ' + path.received + 'B, sent ' + path.sent + 'B before)');
     if (path.queue.length > 0) releaseAmpQueue(path);
   }
@@ -5693,8 +5942,8 @@ function QUICConnection(options) {
   // ============================================================
   //  Path MTU discovery — DPLPMTUD (RFC 8899; RFC 9000 §14.3)
   //
-  //  Packets start at what every QUIC path carries (current_limit_packet_
-  //  payload, 1200 bytes of frames). Most paths carry more — ~1450 on
+  //  Packets start at what every QUIC path carries (current_limit_datagram:
+  //  datagrams of 1200 bytes, header and all). Most paths carry more — ~1450 on
   //  Ethernet — and every byte more in a packet is a packet less: an
   //  encryption, a system call, the per-packet bookkeeping, which is where a
   //  JavaScript sender spends its time. So once the handshake is confirmed,
@@ -5754,14 +6003,30 @@ function QUICConnection(options) {
   function shortHeaderOverhead() {
     return 1 + destinationCid('1rtt', context.path).byteLength + 4 + 16;
   }
-  // The datagram every packet up to the floor's frames fits in.
-  function pmtuFloor() { return context.init_limit_packet_payload + shortHeaderOverhead(); }
+  // The header and AEAD tag of the packets app data goes in now: 0-RTT's
+  // long header until 1-RTT keys, a short header after.
+  function appPacketOverhead() {
+    if (!context.app_write && zeroRttSending()) {
+      return 1 + 4 + 1 + destinationCid('0rtt', context.path).byteLength + 1 +
+             (context.my_cids[0] ? context.my_cids[0].byteLength : 0) + 2 + 4 + 16;
+    }
+    return shortHeaderOverhead();
+  }
+  // The frames a packet takes: the datagram in use — never past the peer's
+  // max_udp_payload_size (§18.2) — less its header. Again whenever either, or
+  // the connection ID, may have changed.
+  function syncPacketPayload() {
+    var d = Math.min(context.current_limit_datagram, context.peer_max_udp_payload);
+    context.current_limit_packet_payload = Math.max(64, d - appPacketOverhead());
+  }
+  // The floor: a datagram of 1200 bytes, header included.
+  function pmtuFloor() { return context.init_limit_datagram; }
   function pmtuCeiling() { return Math.min(context.max_limit_packet_payload, context.peer_max_udp_payload); }
 
-  // Packets carry the frames a `size` datagram has room for — never fewer
-  // than the floor's.
+  // Packets fill `size`-byte datagrams — never smaller than the floor.
   function pmtuApply(size) {
-    context.current_limit_packet_payload = Math.max(context.init_limit_packet_payload, size - shortHeaderOverhead());
+    context.current_limit_datagram = Math.max(context.init_limit_datagram, size);
+    syncPacketPayload();
     if (DEBUG) console.log('[quic] PMTU ' + size + ' — packets of ' + context.current_limit_packet_payload + ' bytes of frames');
   }
 
@@ -5850,7 +6115,7 @@ function QUICConnection(options) {
       m.confirming = false;
       m.lo = 0; m.fail = p.size; m.size = 0; m.tries = 0;
       m.bigLost = 0;
-      context.current_limit_packet_payload = context.init_limit_packet_payload;
+      pmtuApply(context.init_limit_datagram);
       m.nextAt = Date.now() + PMTU_RAISE_MS;
       return;
     }
@@ -5982,8 +6247,9 @@ function QUICConnection(options) {
     if (path !== context.path) return;
 
     // A path already validated, failing only the expanded re-check (§8.2.3).
-    // Every packet quico sends fits in 1200 bytes, so a path that has carried
-    // them is carrying what this connection needs; it goes on.
+    // On a new path packets are back at the floor — datagrams of 1200 bytes
+    // at most (pmtuApply) — so a path that has carried them is carrying what
+    // this connection needs; it goes on.
     if (path.validated) return;
 
     // §9.3.2: "an endpoint MUST revert to using the last validated peer
@@ -6006,6 +6272,7 @@ function QUICConnection(options) {
     if (context.candidate_path === path) context.candidate_path = null;
     if (DEBUG) console.log('[quic] now sending to ' + path.address + ':' + path.port + (path.validated ? '' : ' (unvalidated)'));
     ev.emit('path', path.address, path.port);
+    if (path.validated) issueNewToken(path);
   }
 
   // ── Connection IDs: issuing ours, keeping the peer's (RFC 9000 §5.1) ──
@@ -6210,7 +6477,7 @@ function QUICConnection(options) {
     context.current_limit_bytes_in_flight = context.init_limit_bytes_in_flight;
     context.current_limit_packets_per_sec = context.init_limit_packets_per_sec;
     context.current_limit_bytes_per_sec = context.init_limit_bytes_per_sec;
-    context.current_limit_packet_payload = context.init_limit_packet_payload;
+    pmtuApply(context.init_limit_datagram);
     context.srtt = null;
     context.rttvar = null;
     context.min_rtt = null;
@@ -6229,6 +6496,7 @@ function QUICConnection(options) {
     context.bbr_bdp = null;
     context.bbr_state = 'startup';
     context.bbr_round_app_limited = false;
+    context.bbr_peak_inflight = 0; context.bbr_prev_peak_inflight = 0;
     context.bbr_full_bw = 0;
     context.bbr_full_bw_count = 0;
     context.bbr_ea_start = 0; context.bbr_ea_delivered = 0; context.bbr_ea_round_max = 0;
@@ -6447,6 +6715,7 @@ function QUICConnection(options) {
           context.pkt_in_flight.set(pn, { bytes: encrypted.length, t: Date.now() });
           if (context.tlp_at === 0 || context.tlp_timer === null) tlpRearm(); else context.tlp_at = Date.now() + tlpDelay();
           context.app_bytes_in_flight += encrypted.length;
+          if (context.app_bytes_in_flight > context.bbr_peak_inflight) context.bbr_peak_inflight = context.app_bytes_in_flight;
         }
         // In flight = carrying STREAM data, which expireInFlight finds and
         // retires through its stream. 1-RTT CRYPTO is the control queue's to
@@ -6454,11 +6723,14 @@ function QUICConnection(options) {
         // found by anything and held a slot of the packet budget forever.
         // DATAGRAM frames are in flight too, with nothing to resend
         // (no_resend_in_flight, see sendDatagram).
-        var has_data = false, datagramBytes = 0;
+        var has_data = false, datagramBytes = 0, payloadBytes = 0;
         for (var i = 0; i < frameList.length; i++) {
-          if (frameList[i].type === 'stream') has_data = true;
+          if (frameList[i].type === 'stream') { has_data = true; payloadBytes += frameList[i].data ? frameList[i].data.byteLength : 0; }
           else if (frameList[i].type === 'datagram') datagramBytes += frameList[i].data.byteLength;
         }
+        context.stats_datagram_bytes_sent += datagramBytes;
+        var inFlightPk = context.pkt_in_flight.get(pn);
+        if (inFlightPk) inFlightPk.payload = payloadBytes + datagramBytes;   // getStats' bytesAcknowledged
         if (has_data || datagramBytes > 0) context.sending_app_pn_in_flight.add(pn);
         if (datagramBytes > 0) {
           context.no_resend_in_flight[pn] = (context.no_resend_in_flight[pn] || 0) + datagramBytes;
@@ -6702,6 +6974,19 @@ function QUICConnection(options) {
     for (var i = 0; i < w.length; i++) w[i].cb(new Error('the connection is closing'));
   }
 
+  function streamSendWindow(streamId) {
+    var st = context.send_streams[Number(streamId)];
+    if (!st) return 0;
+    var queued = 0;
+    for (var k in context.send_streams) {
+      var o = context.send_streams[k];
+      if (o.write_offset > o.max_sent_offset) queued += o.write_offset - o.max_sent_offset;
+    }
+    var streamRoom = st.remote_max_stream_data - st.write_offset;
+    var connRoom = context.remote_max_data - context.max_data_sent - queued;
+    return Math.max(0, Math.min(streamRoom, connRoom));
+  }
+
   // The connection's figures, as WebTransport's getStats() reports them
   // (W3C WebTransportConnectionStats), and what QUICO's congestion control
   // knows besides. Times in ms; estimatedSendRate in bits per second (BBR's
@@ -6709,9 +6994,21 @@ function QUICConnection(options) {
   // An exception of ours, caught: in the connection (internal_errors, the
   // last one's stack) and the server's counters. The packet being processed
   // is dropped (above), or HTTP/3 closes with H3_INTERNAL_ERROR (h3.js).
+  // Reading e.stack formats the whole trace — a few hundred microseconds,
+  // paid for every bad packet: a peer (or a scanner) sending many of them
+  // cost the thread more in traces than in packets. The message always; the
+  // stack, and a log line, once a minute per connection — the bug it points
+  // at is the same one.
   function countInternalError(e) {
     context.internal_errors = (context.internal_errors || 0) + 1;
-    context.last_internal_error = (e && e.stack) || String(e);
+    var now = Date.now();
+    if (now - (context.internal_error_logged_at || 0) >= 60000) {
+      context.internal_error_logged_at = now;
+      context.last_internal_error = (e && e.stack) || String(e);
+      console.warn('[quic] packet dropped on an internal error (' + context.internal_errors + ' on this connection so far): ' + context.last_internal_error);
+    } else {
+      context.last_internal_error = (e && e.message) || String(e);
+    }
     if (serverStats) serverStats.internalErrors++;
   }
 
@@ -6720,6 +7017,11 @@ function QUICConnection(options) {
       bytesSent: context.stats_bytes_sent,
       packetsSent: context.stats_packets_sent,
       packetsLost: context.lost_count,
+      bytesLost: context.stats_bytes_lost,
+      // The application's bytes: new STREAM data and DATAGRAM payloads sent
+      // (no retransmissions, no framing), and the payload acknowledged.
+      payloadBytesSent: context.max_data_sent + context.stats_datagram_bytes_sent,
+      payloadBytesAcknowledged: context.stats_payload_acked,
       bytesReceived: context.stats_bytes_received,
       packetsReceived: context.stats_packets_received,
       smoothedRtt: context.srtt,
@@ -7063,7 +7365,7 @@ function QUICConnection(options) {
       // honoured (see expired_unacked above). Keyed per-PN; a packet that
       // carried several streams accumulates one entry per stream.
       var limbo = context.expired_unacked[pnum];
-      if (!limbo) limbo = context.expired_unacked[pnum] = { t: now, spans: [] };
+      if (!limbo) { limbo = context.expired_unacked[pnum] = { t: now, spans: [] }; context.limbo_n++; }
       var finLost = !!(st.fin_pns && st.fin_pns[pnum]);
       var lostRanges = st.in_flight_ranges[pn];
       limbo.spans.push([sid, lostRanges, finLost]);
@@ -7081,7 +7383,7 @@ function QUICConnection(options) {
       // Count the loss once per packet: the Set holds each PN once, so the
       // first stream to expire it returns true; later same-PN deletes (a
       // multi-stream packet) return false and don't double-count.
-      if (context.sending_app_pn_in_flight.delete(pnum)) { context.lost_count++; crOnLoss(); }
+      if (context.sending_app_pn_in_flight.delete(pnum)) countLostPacket(pnum);
     }
   }
 
@@ -7098,7 +7400,7 @@ function QUICConnection(options) {
     if (context.expired_unacked[pnum]) context.expired_unacked[pnum].early = true;
     if (pnum in context.no_resend_in_flight) {
       delete context.no_resend_in_flight[pnum];
-      if (context.sending_app_pn_in_flight.delete(pnum)) { context.lost_count++; crOnLoss(); }
+      if (context.sending_app_pn_in_flight.delete(pnum)) countLostPacket(pnum);
     }
     if (context.pkt_in_flight.has(pnum)) {
       var pBytes = forgetPacket(pnum);
@@ -7290,7 +7592,7 @@ function QUICConnection(options) {
                      (now - context.sending_app_pn_history[ridx][0] >= timeout);
       if (!rexpired) continue;
       delete context.no_resend_in_flight[rpn];
-      if (context.sending_app_pn_in_flight.delete(rnum)) { context.lost_count++; crOnLoss(); }
+      if (context.sending_app_pn_in_flight.delete(rnum)) countLostPacket(rnum);
     }
 
     // And every packet past the same timeout leaves the bytes in flight —
@@ -7306,9 +7608,15 @@ function QUICConnection(options) {
 
     // Bound the limbo table: entries older than ~8 timeouts (min 10s) will
     // never see their ACK — the peer retires ACK ranges long before that.
-    var limboCutoff = now - Math.max(10000, timeout * 8);
-    for (var lpn in context.expired_unacked) {
-      if (context.expired_unacked[lpn].t < limboCutoff) delete context.expired_unacked[lpn];
+    // At most once a second: it walks the whole table, and this runs on
+    // every send burst. An entry kept a second longer only means a late ACK
+    // for it is still honoured.
+    if (now - (context.limbo_pruned_at || 0) >= 1000) {
+      context.limbo_pruned_at = now;
+      var limboCutoff = now - Math.max(10000, timeout * 8);
+      for (var lpn in context.expired_unacked) {
+        if (context.expired_unacked[lpn].t < limboCutoff) { delete context.expired_unacked[lpn]; context.limbo_n--; }
+      }
     }
   }
 
@@ -7371,6 +7679,7 @@ function QUICConnection(options) {
 
   function plan_quic_burst() {
     context.send_scheduled = false;   // this pass takes what writes left waiting
+    syncPacketPayload();              // 0-RTT → 1-RTT, a new connection ID
     if (!zeroRttSending()) {
       if (!context.app_write) return;
       if (context.state !== 'connected') return;
@@ -8284,6 +8593,13 @@ function QUICConnection(options) {
     getJA4: function (opts) { return (tls && tls.getJA4) ? tls.getJA4(opts) : null; },
     /** The peer's certificate chain, leaf first, as DER — or null. */
     getPeerCertificateChain: function () { return (tls && tls.getPeerCertificateChain) ? tls.getPeerCertificateChain() : null; },
+    // TLS keying material (RFC 8446 §7.5), as node:tls's: WebTransport's
+    // exportKeyingMaterial builds on it. null before the handshake has it.
+    exportKeyingMaterial: function (length, label, context) { return (tls && tls.exportKeyingMaterial) ? tls.exportKeyingMaterial(length, label, context) : null; },
+    // How many new bytes stream `streamId` could send now under flow control
+    // (RFC 9000 §4.1): its own window, and the connection's less what every
+    // stream has written and not yet sent. WebTransport's atomicWrite asks.
+    streamSendWindow: streamSendWindow,
     // The client's certificate, node:tls-shaped, and whether it was verified
     // (requestCert): what req.socket answers over HTTP/3.
     getPeerCertificate: function () { return (tls && tls.getPeerCertificate) ? tls.getPeerCertificate() : {}; },