quico 0.8.0 → 0.9.0

package/src/quic_connection.js

@@ -299,6 +299,7 @@ function QUICConnection(options) {
     // complete"), issues no connection IDs and sends no HANDSHAKE_DONE.
     peer_finished: false,
     handshake_done_sent: false,
+    new_token_for: null,                  // the address:port the last NEW_TOKEN was for (issueNewToken)
 
     // Connection close (RFC 9000 §10.2)
     close_frame: null,         // the CONNECTION_CLOSE frame to (re)send while closing
@@ -703,13 +704,18 @@ function QUICConnection(options) {
 
     max_packets_per_burst: 20,          // fixed cap — not CC-controlled, no current_/init_
 
-    // packet payload (MTU). current_ is the size actually used; max_ is the ceiling
-    // DPLPMTUD must not probe past; init_/floor is QUIC's guaranteed 1200-byte minimum.
+    // packet size (MTU). Datagram sizes are WHOLE UDP payloads: max_ is the
+    // ceiling DPLPMTUD must not probe past; init_ is QUIC's 1200 — RFC 9000
+    // §14: no datagram larger until a path has shown it carries one; current_
+    // is the size in use. current_limit_packet_payload is what a packet has
+    // for FRAMES: that datagram, within the peer's max_udp_payload_size, less
+    // the packet's header and AEAD tag (syncPacketPayload).
     max_limit_packet_payload:     connOpts.maxUdpPayloadSize,   // ceiling, maxUdpPayloadSize: 1452 (IPv6-safe Ethernet: 1500 − 48 hdr) —
                                               // a whole UDP datagram: what DPLPMTUD probes up to
-    init_limit_packet_payload:    1200,       // QUIC guaranteed floor — where we start
-    current_limit_packet_payload: 1200,       // = init_; DPLPMTUD raises it: the frames a packet
-                                              // carries, the datagram it confirmed less its header
+    init_limit_datagram:          1200,       // QUIC's guaranteed floor — where we start
+    current_limit_datagram:       1200,       // = init_; DPLPMTUD raises it
+    current_limit_packet_payload: 1200 - 69,  // frames; set by syncPacketPayload — until then,
+                                              // 1200 less the largest header (a 0-RTT packet, 20-byte CIDs)
     pmtu: null,                               // DPLPMTUD's state (pmtuReset)
     peer_max_udp_payload: 65527,              // its max_udp_payload_size (RFC 9000 §18.2)
 
@@ -738,7 +744,7 @@ function QUICConnection(options) {
     current_limit_packets_per_sec:   12000,   // = init_; BBR rewrites at round-end
     max_limit_bytes_per_sec:         14000000, // ceiling ~14 MB/s — coherent ↑
     min_limit_bytes_per_sec:         12000,   // floor ~96 kbps — avoid 0/deadlock
-    init_limit_bytes_per_sec:        14000000,
+    init_limit_bytes_per_sec:        14000000, // until the first RTT sample (bbrInitPacingRate)
     current_limit_bytes_per_sec:     14000000, // = init_; BBR rewrites at round-end
 
     burst_timer: null,
@@ -925,6 +931,10 @@ function QUICConnection(options) {
     // a round says how much the APPLICATION produced, not what the path can
     // carry — see the sample filter at round end.
     bbr_round_app_limited: false,
+    // The most bytes in flight in this round and in the last — whether the
+    // window is in use, for Startup's growth (growStartupWindow).
+    bbr_peak_inflight: 0,
+    bbr_prev_peak_inflight: 0,
     bbr_full_bw: 0,             // highest BtlBw seen — Startup plateau detector
     bbr_full_bw_count: 0,       // consecutive rounds without ≥25% BtlBw growth
     // ACK aggregation (BBR's extra_acked): how far ACKs ran ahead of what
@@ -1461,7 +1471,7 @@ function QUICConnection(options) {
   // the search may go there.
   function setMaxUdpPayload(v) {
     context.max_limit_packet_payload = v;
-    var now = context.current_limit_packet_payload + shortHeaderOverhead();
+    var now = context.current_limit_datagram;
     var m = context.pmtu;
     if (now > v) pmtuApply(v);
     if (m) {
@@ -1798,6 +1808,8 @@ function QUICConnection(options) {
     // as a CRYPTO_ERROR (0x100 + alert code, RFC 9001 §4.8) — the peer learns
     // why, and this side reports the close now rather than at a timeout.
     tls.on('alert', function (code) { close(0x100 + code, 'TLS alert ' + code); });
+    // The peer's quic_transport_parameters that cannot be read at all.
+    tls.on('transportParamsError', function (why) { close(0x08, why); });
     // The reason for that alert. During the handshake it is the connection's
     // failure, reported like the handshake timeout: 'error', then 'close'.
     // The alert has already closed the connection, so nothing else to do.
@@ -1923,6 +1935,7 @@ function QUICConnection(options) {
       // a bound on what DPLPMTUD probes. "Values below 1200 are invalid."
       if (typeof p.max_udp_payload_size === 'number') {
         context.peer_max_udp_payload = p.max_udp_payload_size;
+        syncPacketPayload();
       }
       // Stream-count limits the peer grants us (localStreamPermitted holds
       // back a stream past them). Seeded directly, not through set_context:
@@ -2063,10 +2076,7 @@ function QUICConnection(options) {
           queueControl('hd');     // retransmitted until acknowledged (§13.3)
           // A token for the client's next connection (NEW_TOKEN, §8.1.3):
           // it will need no proof of address then.
-          if (typeof options.newToken === 'function') {
-            var nt = options.newToken(peerPath().address, context.version);
-            if (nt && nt.byteLength > 0) queueControl('nt', { type: 'new_token', token: nt });
-          }
+          issueNewToken(peerPath());
         }
         discardSpace('handshake');
         crStart();
@@ -2081,9 +2091,10 @@ function QUICConnection(options) {
       }
     });
 
-    // Note: QUIC handles key updates via key_phase bit, not TLS KeyUpdate message.
-    // RFC 9001 §6: "endpoints MUST treat the receipt of a TLS KeyUpdate message
-    // as a connection error of type 0x010a" — but we silently ignore it.
+    // QUIC updates keys with the Key Phase bit, never a TLS KeyUpdate (RFC
+    // 9001 §6): one received, in any space, closes the connection with 0x010a
+    // (TLS_RECEIVABLE, in processCryptoFrame); one TLS would send is not sent
+    // (tls_bridge).
   }
 
 
@@ -2365,13 +2376,22 @@ function QUICConnection(options) {
       );
     }
 
-    if (!decrypted || !decrypted.plaintext || decrypted.plaintext.byteLength === 0) {
+    if (!decrypted || !decrypted.plaintext) {
       if (DEBUG) console.log('[quic] decrypt failed: ' + space + ' raw_len=' + pkt.raw.byteLength + ' first20=' + Array.from(pkt.raw.slice(0, 20)).map(function(b){ return b.toString(16).padStart(2,'0'); }).join(' ') + ' recv_cid_len=' + (recvCid ? recvCid.byteLength : 'null') + ' has_keys=' + !!readKeys + ' largest_pn=' + context.recv_pn_largest[space]);
       return;
     }
 
     if (DEBUG) console.log('[quic] decrypted ' + space + ' pn=' + decrypted.packet_number + ' len=' + decrypted.plaintext.byteLength);
 
+    // The reserved bits, now that the packet is authenticated: set, it is a
+    // PROTOCOL_VIOLATION (RFC 9000 §17.2: 0x0c of a long header; §17.3.1:
+    // 0x18 of a short one). An empty payload goes on to the frames, where a
+    // packet with none is one too (§12.4).
+    if (decrypted.first_byte & ((decrypted.first_byte & 0x80) ? 0x0c : 0x18)) {
+      close(0x0a, 'reserved header bits set in a ' + space + ' packet');
+      return;
+    }
+
     // RFC 9000 §8.1: "A server might wish to validate the client address
     // before starting the cryptographic handshake. [...] the server MAY
     // consider the peer address validated if the client uses a connection ID
@@ -2678,10 +2698,15 @@ function QUICConnection(options) {
       } else if (frame.type === 'streams_blocked_bidi' || frame.type === 'streams_blocked_uni') {
         // The peer has used every stream we granted. Ack-eliciting like any
         // frame but ACK/PADDING/CONNECTION_CLOSE (it used to fall through
-        // unacknowledged); answered with our current limit, which also
-        // recovers a lost MAX_STREAMS, as DATA_BLOCKED does for MAX_DATA.
+        // unacknowledged). Blocked below our current limit, it missed a
+        // MAX_STREAMS: sent again — as DATA_BLOCKED recovers MAX_DATA. At it,
+        // the peer has our limit already, and a MAX_STREAMS for each such
+        // frame would be one frame of ours for every one of its.
         ackEliciting = true;
-        queueControl(frame.type === 'streams_blocked_bidi' ? 'ms_bidi' : 'ms_uni');
+        var sbBidi = frame.type === 'streams_blocked_bidi';
+        if (frame.limit < (sbBidi ? context.local_max_streams_bidi : context.local_max_streams_uni)) {
+          queueControl(sbBidi ? 'ms_bidi' : 'ms_uni');
+        }
       } else if (frame.type === 'data_blocked') {
         // The peer is stalled on our connection window. Our MAX_DATA may have
         // been lost (window updates are sent once, unrecovered) — re-send the
@@ -2951,6 +2976,21 @@ function QUICConnection(options) {
   // which rides in the ticket, never came back to it.
   var NEW_SESSION_TICKET = 0x04;
 
+  // Which TLS messages each side may receive, in which space (RFC 9001 §4,
+  // Table 1; RFC 8446 §4). TLS itself does not know the spaces — they are
+  // QUIC's encryption levels — so they are held to here, for every message,
+  // before TLS sees it. Never in any space: KeyUpdate (§6 — QUIC updates its
+  // keys itself), EndOfEarlyData (§8.3), anything a client sends to a client
+  // or a server to a server. Any other: unexpected_message (§4.8, §6).
+  //   1 ClientHello · 2 ServerHello (a HelloRetryRequest included) ·
+  //   4 NewSessionTicket · 8 EncryptedExtensions · 11 Certificate ·
+  //   13 CertificateRequest · 15 CertificateVerify · 20 Finished ·
+  //   25 CompressedCertificate (RFC 8879)
+  var TLS_RECEIVABLE = {
+    server: { initial: [1], handshake: [11, 15, 20, 25], app: [] },
+    client: { initial: [2], handshake: [8, 11, 13, 15, 20, 25], app: [NEW_SESSION_TICKET] }
+  };
+
   // Reassembly, per space. In order: `q`, the bytes received and not yet
   // read as TLS messages (pieces, `qlen` of them in all), up to `end`.
   // Ahead of a gap: `ahead`, pieces sorted by offset that never overlap
@@ -3061,15 +3101,21 @@ function QUICConnection(options) {
     if (messages.length === 0) return;
     if (!tls) { if (DEBUG) console.log('[quic] initializing TLS bridge'); initTLS(); }
 
-    for (var mi = 0; mi < messages.length; mi++) {
-      var msg = messages[mi];
-      var msgType = msg[0];
-      if (space === 'app' && (context.isServer || msgType !== NEW_SESSION_TICKET)) {
+    // Every message of the batch checked before TLS sees any: a Finished
+    // followed by a KeyUpdate closes the connection without the Finished
+    // answered first (a ticket, HANDSHAKE_DONE) — not after it.
+    var receivable = TLS_RECEIVABLE[context.isServer ? 'server' : 'client'][space];
+    for (var ci = 0; ci < messages.length; ci++) {
+      if (receivable.indexOf(messages[ci][0]) < 0) {
         // TLS's unexpected_message as a CRYPTO_ERROR (RFC 9001 §4.8); a
         // KeyUpdate is named as one (§6).
-        close(0x100 + 10, 'TLS message ' + msgType + ' after the handshake');
+        close(0x100 + 10, 'TLS message ' + messages[ci][0] + ' in the ' + space + ' space');
         return;
       }
+    }
+    for (var mi = 0; mi < messages.length; mi++) {
+      var msg = messages[mi];
+      var msgType = msg[0];
       // Closed by what an earlier message brought: the rest is not read.
       if (context.state === 'closing' || context.state === 'draining' || context.state === 'closed') return;
       if (DEBUG) console.log('[quic] → TLS msg #' + mi + ' type=0x' + msgType.toString(16) + ' len=' + msg.length);
@@ -4202,6 +4248,7 @@ function QUICConnection(options) {
     if (context.srtt === null) {
       context.srtt = adjusted;
       context.rttvar = adjusted / 2;
+      bbrInitPacingRate();
     } else {
       context.rttvar = 0.75 * context.rttvar + 0.25 * Math.abs(context.srtt - adjusted);
       context.srtt = 0.875 * context.srtt + 0.125 * adjusted;
@@ -4318,10 +4365,23 @@ function QUICConnection(options) {
     if (extra > context.bbr_ea_round_max) context.bbr_ea_round_max = extra;
   }
 
+  // Whether a window of w bytes is in use: in flight reached half of it,
+  // this round or the last — slow start's test for being limited by the
+  // window (Linux tcp_is_cwnd_limited; RFC 9002 §7.8).
+  function windowInUse(w) {
+    return 2 * Math.max(context.bbr_peak_inflight, context.bbr_prev_peak_inflight) >= w;
+  }
+
   function growStartupWindow(newlyAckedBytes) {
     if (context.bbr_state !== 'startup' || !(newlyAckedBytes > 0)) return;
     var cap = startupCap(), cur = context.current_limit_bytes_in_flight;
     if (cur >= cap) return;
+    // Only a window in use grows (windowInUse). A sender with less to send
+    // than the window — media below the path's rate — grew it by every byte
+    // acknowledged, without end (1.2 Mbit/s for 3 s: 25 KB → 496 KB), a
+    // window nothing had measured, and the next burst (a keyframe) went out
+    // in it at once, into the bottleneck's queue.
+    if (!windowInUse(cur)) return;
     context.current_limit_bytes_in_flight = Math.min(context.max_limit_bytes_in_flight, cap,
       cur + newlyAckedBytes);
     context.current_limit_packets_in_flight = Math.min(context.max_limit_packets_in_flight,
@@ -4382,6 +4442,24 @@ function QUICConnection(options) {
       Math.max(context.min_limit_packets_in_flight,
         Math.round(context.current_limit_bytes_in_flight / context.current_limit_packet_payload)));
   }
+  // Startup's first pacing rate, from the first RTT sample: the initial
+  // window over the round trip, at Startup's gain (BBR's BBRInitPacingRate,
+  // §5.6.2; quiche the same). It was the ceiling, 14 MB/s — and Startup only
+  // raises the rate, so it stayed there: Startup was not paced at all, the
+  // window left at once at ~112 Mbit/s, into the queue of any slower path.
+  // A media sender rarely leaves Startup, and every keyframe went so (a
+  // 90 KB one, a 20 Mbit/s link with a 64 KB queue: ~20 drops a keyframe);
+  // on a long path the first rounds' bursts were dropped, Startup ended on
+  // those losses with ~14 of 20 Mbit/s measured, and a 4 MB transfer took
+  // 3.7-3.9 s instead of 2.6 (150 ms). The cost: the initial window takes
+  // RTT/2.89 to leave — a first page's body ~27 ms later at 150 ms, within
+  // noise at 40. A new path starts here again (resetPathEstimates: the rate
+  // back to init_, srtt null until its first sample).
+  function bbrInitPacingRate() {
+    if (context.bbr_state !== 'startup') return;
+    setPacingRate(BBR_STARTUP_GAIN * context.init_limit_bytes_in_flight / (Math.max(context.srtt, 1) / 1000));
+  }
+
   function setPacingRate(bps) {
     context.current_limit_bytes_per_sec = Math.max(context.min_limit_bytes_per_sec,
       Math.min(context.max_limit_bytes_per_sec, bps));
@@ -4968,7 +5046,10 @@ function QUICConnection(options) {
         var roundDelivered = context.delivered - context.bbr_round_start_delivered;
         // An app-limited sample is kept only if it RAISES the estimate
         // (BBR delivery-rate sampling: such a sample can show the path is at
-        // least that fast, never that it is slower).
+        // least that fast, never that it is slower). With no estimate yet,
+        // any sample raises it — BBR's max_bw starts at 0 (§5.2.1): a
+        // connection that never filled the pipe (media below the path's
+        // rate) had no estimate at all, estimatedSendRate null throughout.
         //
         // Without this, the first round of every connection — which carries
         // only a small HTML response and some ACK-only packets — measured a
@@ -4985,7 +5066,7 @@ function QUICConnection(options) {
         var crRetreat = !!(context.cr && context.cr.phase === 'safe_retreat');
         if (!crRetreat && roundDur >= 1 && roundDelivered > 0) {
           var roundRate = (roundDelivered * 1000) / roundDur;
-          if (!roundAppLimited || (context.bbr_btlbw !== null && roundRate > context.bbr_btlbw)) {
+          if (!roundAppLimited || roundRate > (context.bbr_btlbw || 0)) {
             context.bbr_btlbw_samples.push({ round: context.bbr_round_count, rate: roundRate });
           }
         }
@@ -5004,6 +5085,8 @@ function QUICConnection(options) {
         context.bbr_round_start_pn = context.send_pn.app; // next PN must be acked for the next round
         context.bbr_round_start_delivered = context.delivered;
         context.bbr_round_start_time = ackNow;
+        context.bbr_prev_peak_inflight = context.bbr_peak_inflight;
+        context.bbr_peak_inflight = context.app_bytes_in_flight;
 
         var BBR_BTLBW_WINDOW = 10; // rounds
         var cutoff = context.bbr_round_count - BBR_BTLBW_WINDOW;
@@ -5016,7 +5099,11 @@ function QUICConnection(options) {
           }
         }
         context.bbr_btlbw_samples = kept;
-        context.bbr_btlbw = maxRate;
+        // No sample left in the window — every round since app-limited and
+        // below the estimate: the estimate stands (BBR's max filter changes
+        // only on a sample it takes). It went back to null after ten such
+        // rounds, and the state machine below with it, mid-connection.
+        if (kept.length > 0) context.bbr_btlbw = maxRate;
 
         // Derived in-flight target. Uses bbr_min_rtt (RTprop, windowed) in seconds.
         if (!crRetreat && context.bbr_btlbw !== null && context.bbr_min_rtt !== null) {
@@ -5097,6 +5184,9 @@ function QUICConnection(options) {
           // ── Write the controls, clamped to [min,max] (the hard safety net). ──
           var clamp = function (v, lo, hi) { return Math.max(lo, Math.min(hi, v)); };
 
+          // The window as the ACKs left it — Startup's floor, below; read
+          // before it is written.
+          var ackGrown = context.current_limit_bytes_in_flight;
           var targetInflight = clamp(cwnd_gain * context.bbr_bdp,
             context.min_limit_bytes_in_flight, context.max_limit_bytes_in_flight);
           context.current_limit_bytes_in_flight = targetInflight;
@@ -5115,8 +5205,18 @@ function QUICConnection(options) {
           if (context.bbr_state === 'startup') {
             // …within startupCap, which may now be lower than what ACKs grew
             // the window to (the BDP of this round is the measured one).
+            // The window before the write above: compared with what was
+            // just written, the max was of a value with itself, and every
+            // round end set the window to max(IW, 2·BDP) — what the ACKs
+            // had grown it by, gone. Kept while it is in use; a window the
+            // last rounds did not fill — a burst (a keyframe) grew it, then
+            // the sender went quiet — goes back to the BDP's: the next burst
+            // left in all of it at Startup's rate, into the bottleneck's
+            // queue (RFC 7661: a window not in use is not validated). Not
+            // while Careful Resume's jump is out: that window is its own.
+            var floor = crJumpOut() || windowInUse(ackGrown) ? ackGrown : 0;
             targetInflight = Math.max(context.init_limit_bytes_in_flight,
-              Math.min(Math.max(targetInflight, context.current_limit_bytes_in_flight), startupCap()));
+              Math.min(Math.max(targetInflight, floor), startupCap()));
             context.current_limit_bytes_in_flight = targetInflight;
             context.current_limit_packets_in_flight = clamp(
               Math.round(targetInflight / context.current_limit_packet_payload),
@@ -5376,7 +5476,8 @@ function QUICConnection(options) {
     var sent = { initial: 0, handshake: 0 };
     if (context.state === 'draining' || context.state === 'closed' || context.state === 'closing') return sent;
     var path = context.path;
-    var cap = Math.max(1200, context.current_limit_packet_payload);
+    // A whole datagram: the size in use, within what the peer takes.
+    var cap = Math.min(context.current_limit_datagram, context.peer_max_udp_payload);
     var plan = [], planBytes = 0;
     var nextPn = { initial: context.send_pn.initial, handshake: context.send_pn.handshake };
     var planned = { initial: [], handshake: [] };
@@ -5813,10 +5914,27 @@ function QUICConnection(options) {
     return (prev && prev.validated) ? prev : context.path;
   }
 
+  // Server: a NEW_TOKEN for the address the client is at (§8.1.3) — after
+  // the handshake, and again each time the client turns up at a new address
+  // and proves it (§9.3: a migration, a NAT rebinding), since the client's
+  // next connection comes from there. The newest replaces one not yet sent.
+  function issueNewToken(path) {
+    if (!context.isServer || typeof options.newToken !== 'function' || !context.handshake_done_sent) return;
+    var at = path.address + ':' + path.port;
+    if (context.new_token_for === at) return;
+    var nt = options.newToken(path.address, context.version);
+    if (!nt || nt.byteLength === 0) return;
+    context.new_token_for = at;
+    queueControl('nt', { type: 'new_token', token: nt });
+  }
+
   function markValidated(path) {
     if (path.validated) return;
     path.validated = true;
-    if (path === context.path) ev.emit('path_validated', path.address, path.port);
+    if (path === context.path) {
+      ev.emit('path_validated', path.address, path.port);
+      issueNewToken(path);
+    }
     if (DEBUG) console.log('[quic] path ' + path.address + ':' + path.port + ' validated (received ' + path.received + 'B, sent ' + path.sent + 'B before)');
     if (path.queue.length > 0) releaseAmpQueue(path);
   }
@@ -5824,8 +5942,8 @@ function QUICConnection(options) {
   // ============================================================
   //  Path MTU discovery — DPLPMTUD (RFC 8899; RFC 9000 §14.3)
   //
-  //  Packets start at what every QUIC path carries (current_limit_packet_
-  //  payload, 1200 bytes of frames). Most paths carry more — ~1450 on
+  //  Packets start at what every QUIC path carries (current_limit_datagram:
+  //  datagrams of 1200 bytes, header and all). Most paths carry more — ~1450 on
   //  Ethernet — and every byte more in a packet is a packet less: an
   //  encryption, a system call, the per-packet bookkeeping, which is where a
   //  JavaScript sender spends its time. So once the handshake is confirmed,
@@ -5885,14 +6003,30 @@ function QUICConnection(options) {
   function shortHeaderOverhead() {
     return 1 + destinationCid('1rtt', context.path).byteLength + 4 + 16;
   }
-  // The datagram every packet up to the floor's frames fits in.
-  function pmtuFloor() { return context.init_limit_packet_payload + shortHeaderOverhead(); }
+  // The header and AEAD tag of the packets app data goes in now: 0-RTT's
+  // long header until 1-RTT keys, a short header after.
+  function appPacketOverhead() {
+    if (!context.app_write && zeroRttSending()) {
+      return 1 + 4 + 1 + destinationCid('0rtt', context.path).byteLength + 1 +
+             (context.my_cids[0] ? context.my_cids[0].byteLength : 0) + 2 + 4 + 16;
+    }
+    return shortHeaderOverhead();
+  }
+  // The frames a packet takes: the datagram in use — never past the peer's
+  // max_udp_payload_size (§18.2) — less its header. Again whenever either, or
+  // the connection ID, may have changed.
+  function syncPacketPayload() {
+    var d = Math.min(context.current_limit_datagram, context.peer_max_udp_payload);
+    context.current_limit_packet_payload = Math.max(64, d - appPacketOverhead());
+  }
+  // The floor: a datagram of 1200 bytes, header included.
+  function pmtuFloor() { return context.init_limit_datagram; }
   function pmtuCeiling() { return Math.min(context.max_limit_packet_payload, context.peer_max_udp_payload); }
 
-  // Packets carry the frames a `size` datagram has room for — never fewer
-  // than the floor's.
+  // Packets fill `size`-byte datagrams — never smaller than the floor.
   function pmtuApply(size) {
-    context.current_limit_packet_payload = Math.max(context.init_limit_packet_payload, size - shortHeaderOverhead());
+    context.current_limit_datagram = Math.max(context.init_limit_datagram, size);
+    syncPacketPayload();
     if (DEBUG) console.log('[quic] PMTU ' + size + ' — packets of ' + context.current_limit_packet_payload + ' bytes of frames');
   }
 
@@ -5981,7 +6115,7 @@ function QUICConnection(options) {
       m.confirming = false;
       m.lo = 0; m.fail = p.size; m.size = 0; m.tries = 0;
       m.bigLost = 0;
-      context.current_limit_packet_payload = context.init_limit_packet_payload;
+      pmtuApply(context.init_limit_datagram);
       m.nextAt = Date.now() + PMTU_RAISE_MS;
       return;
     }
@@ -6113,8 +6247,9 @@ function QUICConnection(options) {
     if (path !== context.path) return;
 
     // A path already validated, failing only the expanded re-check (§8.2.3).
-    // Every packet quico sends fits in 1200 bytes, so a path that has carried
-    // them is carrying what this connection needs; it goes on.
+    // On a new path packets are back at the floor — datagrams of 1200 bytes
+    // at most (pmtuApply) — so a path that has carried them is carrying what
+    // this connection needs; it goes on.
     if (path.validated) return;
 
     // §9.3.2: "an endpoint MUST revert to using the last validated peer
@@ -6137,6 +6272,7 @@ function QUICConnection(options) {
     if (context.candidate_path === path) context.candidate_path = null;
     if (DEBUG) console.log('[quic] now sending to ' + path.address + ':' + path.port + (path.validated ? '' : ' (unvalidated)'));
     ev.emit('path', path.address, path.port);
+    if (path.validated) issueNewToken(path);
   }
 
   // ── Connection IDs: issuing ours, keeping the peer's (RFC 9000 §5.1) ──
@@ -6341,7 +6477,7 @@ function QUICConnection(options) {
     context.current_limit_bytes_in_flight = context.init_limit_bytes_in_flight;
     context.current_limit_packets_per_sec = context.init_limit_packets_per_sec;
     context.current_limit_bytes_per_sec = context.init_limit_bytes_per_sec;
-    context.current_limit_packet_payload = context.init_limit_packet_payload;
+    pmtuApply(context.init_limit_datagram);
     context.srtt = null;
     context.rttvar = null;
     context.min_rtt = null;
@@ -6360,6 +6496,7 @@ function QUICConnection(options) {
     context.bbr_bdp = null;
     context.bbr_state = 'startup';
     context.bbr_round_app_limited = false;
+    context.bbr_peak_inflight = 0; context.bbr_prev_peak_inflight = 0;
     context.bbr_full_bw = 0;
     context.bbr_full_bw_count = 0;
     context.bbr_ea_start = 0; context.bbr_ea_delivered = 0; context.bbr_ea_round_max = 0;
@@ -6578,6 +6715,7 @@ function QUICConnection(options) {
           context.pkt_in_flight.set(pn, { bytes: encrypted.length, t: Date.now() });
           if (context.tlp_at === 0 || context.tlp_timer === null) tlpRearm(); else context.tlp_at = Date.now() + tlpDelay();
           context.app_bytes_in_flight += encrypted.length;
+          if (context.app_bytes_in_flight > context.bbr_peak_inflight) context.bbr_peak_inflight = context.app_bytes_in_flight;
         }
         // In flight = carrying STREAM data, which expireInFlight finds and
         // retires through its stream. 1-RTT CRYPTO is the control queue's to
@@ -7541,6 +7679,7 @@ function QUICConnection(options) {
 
   function plan_quic_burst() {
     context.send_scheduled = false;   // this pass takes what writes left waiting
+    syncPacketPayload();              // 0-RTT → 1-RTT, a new connection ID
     if (!zeroRttSending()) {
       if (!context.app_write) return;
       if (context.state !== 'connected') return;