tigrcorn-protocols 0.3.18.dev2__py3-none-any.whl → 0.3.18.dev3__py3-none-any.whl

tigrcorn_protocols/http2/handler/connect.py

@@ -67,6 +67,7 @@ class _HTTP2ConnectTunnel:
         if self.work_lease is not None:
             self.work_lease.release()
         await close_tcp_writer(self.upstream_writer)
+        self.handler._close_inventory_session(self.stream_id, reason="connect-complete")
         self.handler._finalize_stream_if_complete(self.stream_id)
 
     async def _relay_upstream_to_client(self) -> None:
@@ -108,6 +109,7 @@ class HTTP2ConnectMixin:
                 await self._write_raw(serialize_rst_stream(stream_id, H2_CONNECT_ERROR))
             state.mark_reset_sent()
         self._cancel_stream(stream_id)
+        self._close_inventory_session(stream_id, reason="connect-reset")
         self.streams.close(stream_id)
         self._maybe_finish_after_goaway()
 
@@ -163,11 +165,17 @@ class HTTP2ConnectMixin:
             work_lease=self.stream_work_leases.get(stream_id),
         )
         state.connect_tunnel = tunnel
+        self._open_inventory_session(
+            stream_id,
+            kind="connect-tunnel",
+            metadata={"authority": request.target},
+        )
         self.state.last_stream_id = max(self.state.last_stream_id, stream_id)
         try:
             await tunnel.start()
         except Exception:
             state.connect_tunnel = None
+            self._close_inventory_session(stream_id, reason="connect-start-failed")
             await close_tcp_writer(upstream_writer)
             raise
         if state.end_stream_received:

tigrcorn_protocols/http2/handler/core.py

@@ -5,6 +5,7 @@ from .connect import HTTP2ConnectMixin
 from .flow_control import HTTP2FlowControlMixin
 from .frames import HTTP2FrameDispatchMixin
 from .headers import HTTP2HeadersMixin
+from .inventory import HTTP2InventoryMixin
 from .io import HTTP2IOMixin
 from .requests import HTTP2RequestsMixin
 from .responses import HTTP2ResponsesMixin
@@ -22,6 +23,7 @@ class HTTP2ConnectionHandler(
     HTTP2ResponsesMixin,
     HTTP2ConnectMixin,
     HTTP2WebSocketSupportMixin,
+    HTTP2InventoryMixin,
 ):
     def __init__(
         self,
@@ -38,6 +40,8 @@ class HTTP2ConnectionHandler(
         scheme: str,
         prebuffer: bytes = b"",
         scope_extensions: dict | None = None,
+        connection_id: str | None = None,
+        connection_inventory: RuntimeConnectionInventory | None = None,
     ) -> None:
         self.app = app
         self.config = config
@@ -51,6 +55,8 @@ class HTTP2ConnectionHandler(
         self.scheme = scheme
         self.prebuffer = prebuffer
         self.scope_extensions = dict(scope_extensions or {})
+        self.connection_id = connection_id
+        self.connection_inventory = connection_inventory
         self.state = H2ConnectionState()
         self.state.local_settings[SETTING_MAX_CONCURRENT_STREAMS] = self.config.http.http2_max_concurrent_streams
         self.state.local_settings[SETTING_MAX_HEADER_LIST_SIZE] = self.config.http.http2_max_headers_size

tigrcorn_protocols/http2/handler/frames.py

@@ -116,6 +116,7 @@ class HTTP2FrameDispatchMixin:
             await state.connect_tunnel.abort()
         self._cancel_stream(frame.stream_id)
         state.mark_reset_received()
+        self._close_inventory_session(frame.stream_id, reason="rst-stream")
         self.streams.close(frame.stream_id)
         self._notify_waiter(frame.stream_id)
         self._maybe_finish_after_goaway()

tigrcorn_protocols/http2/handler/imports.py

@@ -63,6 +63,7 @@ from tigrcorn_protocols.scheduler.runtime import ProductionScheduler, WorkLease
 from tigrcorn_protocols.http2.streams import H2StreamRegistry
 from tigrcorn_protocols.connect import close_tcp_writer, half_close_tcp_writer, is_connect_allowed, parse_connect_authority
 from tigrcorn_protocols.http2.websocket import H2WebSocketSession
+from tigrcorn_protocols.sessions import RuntimeConnectionInventory
 from tigrcorn_core.types import ASGIApp
 from tigrcorn_core.utils.authority import authority_allowed
 from tigrcorn_core.utils.headers import apply_response_header_policy, sanitize_early_hints_headers, strip_connection_specific_headers

tigrcorn_protocols/http2/handler/inventory.py

@@ -0,0 +1,56 @@
+from __future__ import annotations
+
+from .imports import *
+
+
+class HTTP2InventoryMixin:
+    def _inventory_session_id(self, stream_id: int) -> str | None:
+        if self.connection_inventory is None or self.connection_id is None:
+            return None
+        return f"h2:{self.connection_id}:{stream_id}"
+
+    def _open_inventory_session(
+        self,
+        stream_id: int,
+        *,
+        kind: str,
+        metadata: dict | None = None,
+    ) -> str | None:
+        session_id = self._inventory_session_id(stream_id)
+        if session_id is None:
+            return None
+        payload = {"protocol": "http2", "stream_id": stream_id}
+        payload.update(metadata or {})
+        self.connection_inventory.open_session(
+            session_id,
+            connection_id=self.connection_id,
+            kind=kind,
+            stream_ids=(str(stream_id),),
+            metadata=payload,
+        )
+        self.connection_inventory.increment_connection_counter(self.connection_id, "streams")
+        if kind == "http-request":
+            self.connection_inventory.increment_connection_counter(self.connection_id, "requests")
+        elif kind == "websocket":
+            self.connection_inventory.increment_connection_counter(self.connection_id, "websockets")
+        elif kind == "connect-tunnel":
+            self.connection_inventory.increment_connection_counter(self.connection_id, "connect_tunnels")
+        return session_id
+
+    def _update_inventory_session(
+        self,
+        stream_id: int,
+        *,
+        state: str | None = None,
+        metadata: dict | None = None,
+    ) -> None:
+        session_id = self._inventory_session_id(stream_id)
+        if session_id is None:
+            return
+        self.connection_inventory.update_session(session_id, state=state, metadata=metadata)
+
+    def _close_inventory_session(self, stream_id: int, *, reason: str | None = None) -> None:
+        session_id = self._inventory_session_id(stream_id)
+        if session_id is None:
+            return
+        self.connection_inventory.close_session(session_id, reason=reason)

tigrcorn_protocols/http2/handler/streams.py

@@ -51,6 +51,12 @@ class HTTP2StreamsMixin:
             await self._start_connect_tunnel(stream_id)
             return
         self.state.last_stream_id = max(self.state.last_stream_id, stream_id)
+        request = self._build_request(state)
+        self._open_inventory_session(
+            stream_id,
+            kind="http-request",
+            metadata={"method": request.method, "path": request.path},
+        )
         task = asyncio.create_task(self._run_stream(stream_id), name=f"tigrcorn-h2-stream-{stream_id}")
         self.stream_tasks[stream_id] = task
 
@@ -66,6 +72,7 @@ class HTTP2StreamsMixin:
         if state is not None:
             state.websocket_session = None
         self._release_stream_work_lease(stream_id)
+        self._close_inventory_session(stream_id, reason="websocket-complete")
         self._finalize_stream_if_complete(stream_id)
 
 
@@ -87,6 +94,7 @@ class HTTP2StreamsMixin:
         if state is None or state.websocket_session is not None or state.connect_tunnel is not None:
             return
         if state.local_closed and state.end_stream_received:
+            self._close_inventory_session(stream_id, reason="stream-complete")
             self._release_stream_work_lease(stream_id)
             self._cancel_stream(stream_id)
             self.streams.close(stream_id)
@@ -125,6 +133,7 @@ class HTTP2StreamsMixin:
                 self._finalize_stream_if_complete(stream_id)
             self._maybe_finish_after_goaway()
         finally:
+            self._close_inventory_session(stream_id, reason="request-complete")
             self._release_stream_work_lease(stream_id)
 
 
@@ -141,14 +150,17 @@ class HTTP2StreamsMixin:
             if state.websocket_session is not None:
                 with suppress(Exception):
                     await state.websocket_session.abort()
+                self._close_inventory_session(state.stream_id, reason="shutdown")
             if state.connect_tunnel is not None:
                 with suppress(Exception):
                     await state.connect_tunnel.abort()
+                self._close_inventory_session(state.stream_id, reason="shutdown")
         for stream_id, task in list(self.stream_tasks.items()):
             task.cancel()
             with suppress(asyncio.CancelledError):
                 await task
             self.stream_tasks.pop(stream_id, None)
+            self._close_inventory_session(stream_id, reason="shutdown")
         if not self.state.local_goaway_sent:
             self.state.local_goaway_sent = True
             self.state.local_goaway_last_stream_id = self.state.last_stream_id

tigrcorn_protocols/http2/handler/websocket_support.py

@@ -41,6 +41,15 @@ class HTTP2WebSocketSupportMixin:
             on_close=lambda stream_id=stream_id: self._on_websocket_stream_closed(stream_id),
         )
         state.websocket_session = session
+        self._open_inventory_session(
+            stream_id,
+            kind="websocket",
+            metadata={"path": request.path},
+        )
         self.state.last_stream_id = max(self.state.last_stream_id, stream_id)
-        await session.start()
+        try:
+            await session.start()
+        except Exception:
+            self._close_inventory_session(stream_id, reason="websocket-start-failed")
+            raise
 

tigrcorn_protocols/http3/codec.py

@@ -25,6 +25,7 @@ SETTING_ENABLE_CONNECT_PROTOCOL = 0x08
 SETTING_H3_DATAGRAM = 0x33
 SETTING_ENABLE_WEBTRANSPORT = 0x2B603742
 SETTING_WT_MAX_SESSIONS = 0x14E9CD29
+SETTING_WT_ENABLED = 0x2C7CF000
 
 H3_DATAGRAM_ERROR = 0x33
 H3_NO_ERROR = 0x0100
@@ -69,6 +70,7 @@ HTTP3_IANA_SETTINGS = {
     "SETTINGS_ENABLE_CONNECT_PROTOCOL": SETTING_ENABLE_CONNECT_PROTOCOL,
     "SETTINGS_H3_DATAGRAM": SETTING_H3_DATAGRAM,
     "SETTINGS_WT_MAX_SESSIONS": SETTING_WT_MAX_SESSIONS,
+    "SETTINGS_WT_ENABLED": SETTING_WT_ENABLED,
 }
 
 HTTP3_IANA_ERROR_CODES = {

tigrcorn_protocols/http3/handler/connect.py

@@ -70,6 +70,11 @@ class _HTTP3ConnectTunnel:
             with suppress(asyncio.CancelledError):
                 await self.relay_task
         self.session.connect_tunnels.pop(self.stream_id, None)
+        if self.handler.connection_inventory is not None:
+            self.handler.connection_inventory.close_session(
+                f"{self.handler._connection_id_for_session(self.session)}:connect:{self.stream_id}",
+                reason='connect-abort',
+            )
         lease = self.session.stream_work_leases.pop(self.stream_id, None)
         if lease is not None:
             lease.release()
@@ -128,7 +133,7 @@ class HTTP3ConnectMixin:
         already_locked: bool = False,
     ) -> None:
         if not already_locked:
-            async with self._lock:
+            async with session.lock:
                 await self._send_http3_tunnel_data(
                     session,
                     stream_id,
@@ -154,7 +159,7 @@ class HTTP3ConnectMixin:
         already_locked: bool = False,
     ) -> None:
         if not already_locked:
-            async with self._lock:
+            async with session.lock:
                 await self._reset_http3_tunnel_stream(
                     session,
                     stream_id,
@@ -252,6 +257,14 @@ class HTTP3ConnectMixin:
             work_lease=session.stream_work_leases.get(stream_id),
         )
         session.connect_tunnels[stream_id] = tunnel
+        if self.connection_inventory is not None:
+            self.connection_inventory.open_session(
+                f"{self._connection_id_for_session(session)}:connect:{stream_id}",
+                connection_id=self._connection_id_for_session(session),
+                kind='connect-tunnel',
+                stream_ids=(str(stream_id),),
+                metadata={'authority': authority, 'protocol': 'http3'},
+            )
         tunnel.start()
         self.access_logger.log_http(session.addr, 'CONNECT', authority, 200, 'HTTP/3')
         return self._build_http3_response_datagrams_locked(session, stream_id, 200, [], b'', end_stream=False)

tigrcorn_protocols/http3/handler/core.py

@@ -6,16 +6,19 @@ from .custom import HTTP3CustomQuicMixin
 from .lifecycle import HTTP3LifecycleMixin
 from .outbound import HTTP3OutboundMixin
 from .packet import HTTP3PacketMixin
+from .priority_lock import PriorityLock
 from .requests import HTTP3RequestsMixin
 from .responses import HTTP3ResponsesMixin
 from .websocket_runtime import HTTP3WebSocketRuntimeMixin
 from .webtransport_datagrams import HTTP3WebTransportDatagramsMixin
+from .webtransport_stream_flow import HTTP3WebTransportStreamFlowMixin
 from .webtransport_streams import HTTP3WebTransportStreamsMixin
 from .webtransport_support import HTTP3WebTransportSupportMixin
 
 
 class HTTP3DatagramHandler(
     HTTP3PacketMixin,
+    HTTP3WebTransportStreamFlowMixin,
     HTTP3WebTransportStreamsMixin,
     HTTP3WebTransportDatagramsMixin,
     HTTP3WebTransportSupportMixin,
@@ -41,6 +44,9 @@ class HTTP3DatagramHandler(
         scheduler: ProductionScheduler | None = None,
         metrics: Metrics | None = None,
         webtransport_governance: Any | None = None,
+        connection_inventory: RuntimeConnectionInventory | None = None,
+        congestion_controller_factory: Any | None = None,
+        congestion_controller_options: Any | None = None,
     ) -> None:
         self.app = app
         self.config = config
@@ -49,10 +55,13 @@ class HTTP3DatagramHandler(
         self.scheduler = scheduler
         self.metrics = metrics
         self.webtransport_governance = webtransport_governance
+        self.connection_inventory = connection_inventory
+        self.congestion_controller_factory = congestion_controller_factory
+        self.congestion_controller_options = dict(congestion_controller_options or {})
         self.sessions: dict[tuple[str, int], HTTP3Session] = {}
         self.sessions_by_local_cid: dict[bytes, HTTP3Session] = {}
         self._session_sequence = 0
-        self._lock = asyncio.Lock()
+        self._lock = PriorityLock()
         self.webtransport_trace: list[dict[str, object]] = []
 
 

tigrcorn_protocols/http3/handler/custom.py

@@ -47,7 +47,7 @@ class _CustomQuicSend:
             raise RuntimeError(f'unexpected custom quic send event: {typ!r}')
         data = bytes(message.get('data', b''))
         fin = not bool(message.get('more_data', False))
-        self.messages.append(self.session.quic.send_stream_data(self.stream_id, data, fin=fin))
+        self.messages.extend(self.session.quic.send_stream_data_packets(self.stream_id, data, fin=fin))
 
     def flush(self) -> list[bytes]:
         return list(self.messages)

tigrcorn_protocols/http3/handler/imports.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import asyncio
+import logging
+import time
 from contextlib import suppress
 from dataclasses import dataclass, field
 from typing import Any
@@ -31,6 +33,7 @@ from tigrcorn_protocols.http3.codec import (
     SETTING_MAX_FIELD_SECTION_SIZE,
     SETTING_QPACK_MAX_TABLE_CAPACITY,
     SETTING_WT_MAX_SESSIONS,
+    SETTING_WT_ENABLED,
     HTTP3ConnectionError,
     HTTP3StreamError,
     encode_frame,
@@ -42,7 +45,10 @@ from tigrcorn_protocols.http3.streams import (
     HTTP3ConnectionCore,
 )
 from tigrcorn_protocols.http3.websocket import H3WebSocketSession
+from tigrcorn_protocols.sessions import RuntimeConnectionInventory, peer_id_from_address
 from tigrcorn_protocols.webtransport.governance import WebTransportGovernanceError
+from tigrcorn_protocols.webtransport.negotiation import negotiate_profiles, settings_for_profiles
+from tigrcorn_protocols.webtransport.profiles import conflicting_request_profile, missing_peer_requirement, missing_request_requirement, profile_spec
 from tigrcorn_transports.quic.connection import QuicConnection
 from tigrcorn_transports.quic.handshake import QuicTlsHandshakeDriver, TransportParameters
 from tigrcorn_transports.quic.packets import QuicLongHeaderPacket, QuicLongHeaderType, QuicRetryPacket, QuicShortHeaderPacket, QuicVersionNegotiationPacket, decode_packet

tigrcorn_protocols/http3/handler/lifecycle.py

@@ -25,6 +25,62 @@ class HTTP3LifecycleMixin:
     def _webtransport_address(addr: tuple[str, int]) -> str:
         return f"{addr[0]}:{addr[1]}"
 
+    def _connection_id_for_session(self, session: HTTP3Session) -> str:
+        return f"conn:h3:{session.runtime_id or session.quic.local_cid.hex() or 'session'}"
+
+    def _listener_id(self) -> str:
+        return self.listener.label or f"{self.listener.kind}:{self.listener.host}:{self.listener.port}"
+
+    def _register_h3_connection(self, session: HTTP3Session) -> None:
+        inventory = self.connection_inventory
+        if inventory is None:
+            return
+        address = self._webtransport_address(session.addr)
+        handshake = session.quic.handshake_driver
+        inventory.open_connection(
+            self._connection_id_for_session(session),
+            transport='quic',
+            protocols=tuple(sorted(self.listener.enabled_protocols)),
+            listener_id=self._listener_id(),
+            peer_id=peer_id_from_address(address),
+            remote_address=address,
+            local_address=self.listener.label,
+            security={
+                'alpn': getattr(handshake, 'selected_alpn', None) if handshake is not None else None,
+                'local_cid': session.quic.local_cid.hex(),
+                'remote_cid': session.quic.remote_cid.hex() if isinstance(session.quic.remote_cid, bytes) else None,
+                'tls': bool(handshake is not None),
+            },
+        )
+
+    def _update_h3_connection(self, session: HTTP3Session) -> None:
+        inventory = self.connection_inventory
+        if inventory is None:
+            return
+        inventory.update_connection(
+            self._connection_id_for_session(session),
+            remote_address=self._webtransport_address(session.addr),
+            counters={
+                'bytes_received': session.bytes_received,
+                'bytes_sent': session.bytes_sent,
+                'requests': len(session.responded_streams),
+                'streams': len(session.h3.requests) + len(session.webtransport_streams),
+                'webtransport_sessions': len(session.webtransport_sessions),
+                'websocket_sessions': len(session.websocket_sessions),
+            },
+            security={
+                'local_cid': session.quic.local_cid.hex(),
+                'remote_cid': session.quic.remote_cid.hex() if isinstance(session.quic.remote_cid, bytes) else None,
+            },
+        )
+
+    def _close_h3_connection(self, session: HTTP3Session, *, reason: str) -> None:
+        inventory = self.connection_inventory
+        if inventory is None:
+            return
+        self._update_h3_connection(session)
+        inventory.close_connection(self._connection_id_for_session(session), reason=reason)
+
     def _webtransport_budget_snapshot(self) -> dict[str, Any] | None:
         manager = self.webtransport_governance
         if manager is None:
@@ -37,16 +93,29 @@ class HTTP3LifecycleMixin:
             return None
         return manager.open_session(
             webtransport.session_id,
-            peer_id=self._webtransport_address(session.addr),
+            peer_id=peer_id_from_address(self._webtransport_address(session.addr)),
             address=self._webtransport_address(session.addr),
         )
 
     def _webtransport_register_stream(self, webtransport: _HTTP3WebTransportSession, stream_id: int | str) -> dict[str, Any] | None:
+        if self.connection_inventory is not None:
+            self.connection_inventory.update_session(
+                webtransport.session_id,
+                stream_ids=(str(stream_id),),
+            )
         manager = self.webtransport_governance
         if manager is None:
             return None
         return manager.open_stream(webtransport.session_id, str(stream_id))
 
+    def _webtransport_release_stream(
+        self, webtransport: _HTTP3WebTransportSession, stream_id: int | str
+    ) -> dict[str, Any] | None:
+        manager = self.webtransport_governance
+        if manager is None:
+            return None
+        return manager.close_stream(webtransport.session_id, str(stream_id))
+
     def _webtransport_register_datagram(
         self,
         webtransport: _HTTP3WebTransportSession,
@@ -107,6 +176,13 @@ class HTTP3LifecycleMixin:
             max_streams_uni=self.config.scheduler.max_streams or 128,
             idle_timeout=int(self.config.quic.idle_timeout * 1000),
             max_datagram_frame_size=self.listener.max_datagram_size,
+            reset_stream_at=(
+                'webtransport' in self.listener.enabled_protocols
+                and any(
+                    profile_spec(name, max_sessions=int(self.config.webtransport.max_sessions or 1)).requires_reset_stream_at
+                    for name in self.config.webtransport.profiles
+                )
+            ),
         )
         session.quic.configure_handshake(
             QuicTlsHandshakeDriver(

tigrcorn_protocols/http3/handler/outbound.py

@@ -2,12 +2,32 @@ from __future__ import annotations
 
 from .imports import *
 
+
 class HTTP3OutboundMixin:
-    def _queue_or_send(self, session: HTTP3Session, raw: bytes, endpoint: UDPEndpoint, addr: tuple[str, int]) -> None:
+    def _queue_or_send(
+        self,
+        session: HTTP3Session,
+        raw: bytes,
+        endpoint: UDPEndpoint,
+        addr: tuple[str, int],
+        *,
+        priority: bool = False,
+    ) -> None:
         transport = getattr(endpoint, 'transport', None)
         if transport is not None and transport.is_closing():
             return
+        # Packet numbers are assigned during encoding. Drain every older
+        # datagram before admitting this one so a freshly encoded ACK, PTO
+        # probe, or control response cannot overtake queued stream data and
+        # trigger spurious packet-threshold loss at the peer.
+        if session.pending_outbound:
+            self._flush_pending_outbound(session, endpoint)
+        if session.pending_outbound:
+            session.quic.defer_datagram(raw)
+            session.pending_outbound.append(raw)
+            return
         if self._can_send_now(session, raw):
+            session.quic.confirm_datagram_sent(raw)
             endpoint.send(raw, addr)
             session.bytes_sent += len(raw)
             if self.metrics is not None:
@@ -27,6 +47,40 @@ class HTTP3OutboundMixin:
         while pto_total > session.last_quic_pto_expirations_total:
             self.metrics.quic_pto_expired()
             session.last_quic_pto_expirations_total += 1
+        recovery_totals = {
+            'pto_probes': int(getattr(session.quic, 'pto_probes_total', 0)),
+            'stream_bytes_retransmitted': int(getattr(session.quic, 'stream_bytes_retransmitted_total', 0)),
+            'crypto_bytes_retransmitted': int(getattr(session.quic, 'crypto_bytes_retransmitted_total', 0)),
+            'datagram_frames_abandoned': int(getattr(session.quic, 'datagram_frames_abandoned_total', 0)),
+            'frames_regenerated': int(getattr(session.quic, 'frames_regenerated_total', 0)),
+        }
+        last_fields = {
+            name: f'last_quic_{name}_total' for name in recovery_totals
+        }
+        deltas = {
+            name: max(0, total - int(getattr(session, last_fields[name])))
+            for name, total in recovery_totals.items()
+        }
+        self.metrics.quic_recovery_observed(**deltas)
+        for name, total in recovery_totals.items():
+            setattr(session, last_fields[name], total)
+        self.metrics.quic_transport_state_observed(
+            bytes_in_flight=session.quic.recovery.bytes_in_flight,
+            congestion_window=session.quic.recovery.congestion_window,
+            smoothed_rtt=session.quic.recovery.rtt.smoothed_rtt,
+            pacing_rate=session.quic.recovery.pacing_rate,
+            pending_outbound=len(session.pending_outbound),
+        )
+        persistent_total = int(
+            getattr(session.quic.recovery, 'persistent_congestion_total', 0)
+        )
+        while persistent_total > session.last_quic_persistent_congestion_total:
+            self.metrics.quic_persistent_congestion_observed()
+            session.last_quic_persistent_congestion_total += 1
+        controller_failed = bool(session.quic.recovery.congestion.failed)
+        if controller_failed and not session.quic_congestion_controller_failure_reported:
+            self.metrics.quic_congestion_controller_failed()
+            session.quic_congestion_controller_failure_reported = True
 
     def _flush_pending_outbound(self, session: HTTP3Session, endpoint: UDPEndpoint) -> None:
         if not session.pending_outbound:
@@ -34,17 +88,16 @@ class HTTP3OutboundMixin:
         transport = getattr(endpoint, 'transport', None)
         if transport is not None and transport.is_closing():
             return
-        remaining: list[bytes] = []
-        for raw in session.pending_outbound:
-            if self._can_send_now(session, raw):
-                session.quic.confirm_datagram_sent(raw)
-                endpoint.send(raw, session.addr)
-                session.bytes_sent += len(raw)
-                if self.metrics is not None:
-                    self.metrics.quic_datagram_sent(len(raw))
-            else:
-                remaining.append(raw)
-        session.pending_outbound = remaining
+        while session.pending_outbound:
+            raw = session.pending_outbound[0]
+            if not self._can_send_now(session, raw):
+                break
+            session.pending_outbound.pop(0)
+            session.quic.confirm_datagram_sent(raw)
+            endpoint.send(raw, session.addr)
+            session.bytes_sent += len(raw)
+            if self.metrics is not None:
+                self.metrics.quic_datagram_sent(len(raw))
 
     def _can_send_now(self, session: HTTP3Session, raw: bytes) -> bool:
         amplification_ok = session.address_validated or (session.bytes_sent + len(raw) <= (session.bytes_received * 3))
@@ -57,6 +110,11 @@ class HTTP3OutboundMixin:
 
     def _next_session_delay(self, session: HTTP3Session) -> float | None:
         delays: list[float] = []
+        idle_timeout = float(self.config.quic.idle_timeout)
+        if idle_timeout > 0:
+            delays.append(
+                max(0.0, idle_timeout - (time.monotonic() - session.last_activity_at))
+            )
         runtime_delay = session.quic.next_runtime_deadline()
         if runtime_delay is not None:
             delays.append(runtime_delay)
@@ -79,6 +137,7 @@ class HTTP3OutboundMixin:
     def _close_session(self, session: HTTP3Session) -> None:
         removed = self.sessions.pop(session.addr, None)
         if removed is session:
+            self._close_h3_connection(session, reason='quic-session-close')
             self.trace_webtransport('quic.session.close', **self._trace_session_fields(session))
             self.sessions_by_local_cid.pop(session.quic.local_cid, None)
             if self.metrics is not None:
@@ -108,16 +167,35 @@ class HTTP3OutboundMixin:
         loop.create_task(self._on_session_timer(session, endpoint))
 
     async def _on_session_timer(self, session: HTTP3Session, endpoint: UDPEndpoint) -> None:
-        async with self._lock:
+        async with session.lock:
             session.timer_handle = None
             transport = getattr(endpoint, 'transport', None)
             if transport is None or transport.is_closing():
                 return
             if session.addr not in self.sessions or self.sessions.get(session.addr) is not session:
                 return
+            idle_timeout = float(self.config.quic.idle_timeout)
+            if (
+                idle_timeout > 0
+                and time.monotonic() - session.last_activity_at >= idle_timeout
+            ):
+                self.trace_webtransport(
+                    "quic.connection.idle_timeout",
+                    **self._trace_session_fields(session),
+                    idle_timeout=idle_timeout,
+                )
+                await self._abort_session_tunnels(session)
+                await self._abort_session_websockets(session)
+                await self._abort_session_webtransports(session)
+                self._close_session(session)
+                return
             outbound = session.quic.drain_scheduled_datagrams()
             for raw in outbound:
-                self._queue_or_send(session, raw, endpoint, session.addr)
+                # ACKs, PTO probes, and loss retransmissions must not sit
+                # behind a large application-media queue.
+                self._queue_or_send(
+                    session, raw, endpoint, session.addr, priority=True
+                )
             self._flush_pending_outbound(session, endpoint)
             self._arm_session_timer(session, endpoint)
     def _ensure_server_control_stream_locked(self, session: HTTP3Session) -> list[bytes]:
@@ -136,9 +214,12 @@ class HTTP3OutboundMixin:
         if self.listener.websocket:
             control_settings[SETTING_ENABLE_CONNECT_PROTOCOL] = 1
         if 'webtransport' in self.listener.enabled_protocols:
-            control_settings[SETTING_ENABLE_CONNECT_PROTOCOL] = 1
-            control_settings[SETTING_H3_DATAGRAM] = 1
-            control_settings[SETTING_WT_MAX_SESSIONS] = int(self.config.webtransport.max_sessions or 1)
+            control_settings.update(
+                settings_for_profiles(
+                    self.config.webtransport.profiles,
+                    max_sessions=int(self.config.webtransport.max_sessions or 1),
+                )
+            )
         control_payload = session.h3.encode_control_stream(control_settings)
         session.server_control_stream_sent = True
         return [session.quic.send_stream_data(session.server_control_stream_id, control_payload, fin=False)]
@@ -163,9 +244,22 @@ class HTTP3OutboundMixin:
             outbound.append(session.quic.send_stream_data(session.server_qpack_decoder_stream_id, decoder_data, fin=False))
         return outbound
 
-    def _queue_session_outbound_locked(self, session: HTTP3Session, outbound: list[bytes], endpoint: UDPEndpoint) -> None:
+    def _queue_session_outbound_locked(
+        self,
+        session: HTTP3Session,
+        outbound: list[bytes],
+        endpoint: UDPEndpoint,
+        *,
+        priority: bool = False,
+    ) -> None:
+        # QuicConnection records packets when they are encoded. Refund the
+        # complete batch before admitting it to the wire so later packets do
+        # not consume congestion credit ahead of earlier CRYPTO segments.
         for raw in outbound:
-            self._queue_or_send(session, raw, endpoint, session.addr)
+            session.quic.defer_datagram(raw)
+        # Preserve QUIC packet-number order. Stream/lane priority must be
+        # resolved before packet encoding, never by reordering wire datagrams.
+        session.pending_outbound.extend(outbound)
         self._flush_pending_outbound(session, endpoint)
         if session.addr in self.sessions and self.sessions.get(session.addr) is session:
             self._arm_session_timer(session, endpoint)