From 15e0654ca4ca43e10a3ef3ed8c94b8f419ad678c Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 00:54:56 +0200
Subject: [PATCH 01/24] Ack Cut 3: failing tests for the sender's flow window
 in Rust, C#, TypeScript and Python

A reliable packet goes on the wire only while its sequence is at most 1,023
above the lowest unacked one and the payload above that sequence stays within
4 MiB. Tests cover the span (P8: a lost packet is still delivered), the byte
bound, a lone oversize packet, FIFO admission and the direct-send refusal.
They fail on the unbounded window.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 packages/cultnet-py/tests/test_cultnet.py     |  89 +++++++++
 packages/cultnet-rs/tests/rudp_flow_window.rs | 172 ++++++++++++++++++
 packages/cultnet-ts/test/cultnet.test.ts      |  95 ++++++++++
 .../NetworkingTests.cs                        | 114 ++++++++++++
 4 files changed, 470 insertions(+)
 create mode 100644 packages/cultnet-rs/tests/rudp_flow_window.rs

diff --git a/packages/cultnet-py/tests/test_cultnet.py b/packages/cultnet-py/tests/test_cultnet.py
index 7e78c48f..2161be04 100644
--- a/packages/cultnet-py/tests/test_cultnet.py
+++ b/packages/cultnet-py/tests/test_cultnet.py
@@ -879,6 +879,95 @@ class CultNetTests(unittest.TestCase):
         self.assertEqual(old_ack.ack, oldest_sequence)
         self.assertEqual(old_ack.ack_mask, 0)
 
+    # The sender's flow window: a reliable packet goes on the wire only while its sequence is at most 1,023 above
+    # the lowest unacked one and the payload above that sequence stays within 4 MiB.
+    FLOW_CONNECTION_ID = 0x464C4F57
+    MIB = 1024 * 1024
+
+    def _connected_flow_session(self, initial_sequence: int) -> CultNetRudpSession:
+        session = CultNetRudpSession(
+            CultNetRudpSessionOptions(connection_id=self.FLOW_CONNECTION_ID, initial_sequence=initial_sequence)
+        )
+        session.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, self.FLOW_CONNECTION_ID, 0, 0, 0, "control"))
+        return session
+
+    @staticmethod
+    def _flow_send(session: CultNetRudpSession, payload_bytes: int) -> tuple[CultNetRudpPacket, ...]:
+        return session.send_many("state", bytes(payload_bytes), CultNetRudpSendOptions(reliable=True))
+
+    def _flow_ack(self, sequence: int) -> CultNetRudpPacket:
+        return CultNetRudpPacket(CultNetRudpPacketType.ACK, self.FLOW_CONNECTION_ID, 0, sequence, 0, "control")
+
+    def _lose_g_and_fill_the_span(self, session: CultNetRudpSession) -> CultNetRudpPacket:
+        g = self._flow_send(session, 1)[0]
+        for offset in range(1, 1024):
+            self.assertEqual([p.sequence for p in self._flow_send(session, 1)], [g.sequence + offset])
+            session.receive(self._flow_ack(g.sequence + offset), 1)
+        return g
+
+    def test_cultnet_rudp_a_lost_packet_holds_the_sender_1023_sequences_ahead_and_is_still_delivered(self) -> None:
+        sender = self._connected_flow_session(1)
+        receiver = self._connected_flow_session(100)
+        g = self._flow_send(sender, 1)[0]
+        admitted_after_g = 0
+        for _ in range(4200):
+            for packet in self._flow_send(sender, 1):
+                admitted_after_g += 1
+                receiver.receive(packet, 1)
+                sender.receive(receiver.create_ack(), 1)
+        self.assertEqual(admitted_after_g, 1023)
+        self.assertEqual(sender.queued_reliable_packet_count, 4200 - 1023)
+
+        retransmit = next(p for p in sender.due_resends(1000) if p.sequence == g.sequence)
+        delivered = receiver.receive(retransmit, 1000).delivered
+        self.assertEqual([frame.sequence for frame in delivered], [g.sequence])
+
+        promoted = sender.receive(receiver.create_ack_for_received(g.sequence), 1001).ready_to_send
+        self.assertEqual(promoted[0].sequence, g.sequence + 1024)
+
+    def test_cultnet_rudp_a_direct_send_past_the_span_is_refused_without_consuming_a_sequence(self) -> None:
+        sender = self._connected_flow_session(1)
+        g = self._lose_g_and_fill_the_span(sender)
+        with self.assertRaises(ValueError):
+            sender.send("state", bytes(1), CultNetRudpSendOptions(reliable=True))
+        self.assertEqual(sender.queued_reliable_packet_count, 0)
+        sender.receive(self._flow_ack(g.sequence), 2)
+        following = sender.send("state", bytes(1), CultNetRudpSendOptions(reliable=True))
+        self.assertEqual(following.sequence, g.sequence + 1024)
+
+    def test_cultnet_rudp_payload_above_the_lowest_unacked_sequence_is_bounded_by_4_mib(self) -> None:
+        sender = self._connected_flow_session(1)
+        g = self._flow_send(sender, self.MIB)[0]
+        # The lowest unacked packet's own bytes do not count: four more MiB fit above it.
+        for _ in range(4):
+            self.assertEqual(len(self._flow_send(sender, self.MIB)), 1)
+        self.assertEqual(len(self._flow_send(sender, self.MIB)), 0)
+        self.assertEqual(len(self._flow_send(sender, self.MIB)), 0)
+        self.assertEqual(sender.queued_reliable_packet_count, 2)
+
+        # Acking g moves the floor up one packet: exactly one MiB more fits.
+        promoted = sender.receive(self._flow_ack(g.sequence), 1).ready_to_send
+        self.assertEqual([p.sequence for p in promoted], [g.sequence + 5])
+        self.assertEqual(sender.queued_reliable_packet_count, 1)
+
+    def test_cultnet_rudp_a_packet_larger_than_the_window_goes_out_alone_and_waits_behind_anything_unacked(self) -> None:
+        self.assertEqual(len(self._flow_send(self._connected_flow_session(1), 5 * self.MIB)), 1)
+        sender = self._connected_flow_session(1)
+        g = self._flow_send(sender, 1)[0]
+        self.assertEqual(len(self._flow_send(sender, 5 * self.MIB)), 0)
+        promoted = sender.receive(self._flow_ack(g.sequence), 1).ready_to_send
+        self.assertEqual([p.sequence for p in promoted], [g.sequence + 1])
+
+    def test_cultnet_rudp_a_small_packet_does_not_overtake_a_queued_large_one(self) -> None:
+        sender = self._connected_flow_session(1)
+        g = self._flow_send(sender, 1)[0]
+        self.assertEqual(len(self._flow_send(sender, 3 * self.MIB)), 1)
+        self.assertEqual(len(self._flow_send(sender, 2 * self.MIB)), 0)
+        # One byte would fit above g, but the 2 MiB packet is ahead of it.
+        self.assertEqual(len(self._flow_send(sender, 1)), 0)
+        promoted = sender.receive(self._flow_ack(g.sequence), 1).ready_to_send
+        self.assertEqual([p.sequence for p in promoted], [g.sequence + 2, g.sequence + 3])
+
     def test_cultnet_rudp_socket_transport_handshakes_and_carries_reliable_ordered_schema_frames(self) -> None:
         server_socket = bind_udp_socket()
         client_socket = bind_udp_socket()
diff --git a/packages/cultnet-rs/tests/rudp_flow_window.rs b/packages/cultnet-rs/tests/rudp_flow_window.rs
new file mode 100644
index 00000000..b288de44
--- /dev/null
+++ b/packages/cultnet-rs/tests/rudp_flow_window.rs
@@ -0,0 +1,172 @@
+//! The sender's flow window: a reliable packet goes on the wire only while its
+//! sequence is at most 1,023 above the lowest unacked one and the payload above
+//! that sequence stays within 4 MiB. Everything else waits in order in the queue.
+
+use anyhow::Result;
+use cultnet_rs::*;
+
+const CONNECTION_ID: u32 = 0x464c_4f57;
+const MIB: usize = 1024 * 1024;
+
+fn connected(initial_sequence: u32) -> Result<CultNetRudpSession> {
+    let mut session = CultNetRudpSession::new(CultNetRudpSessionOptions {
+        connection_id: CONNECTION_ID,
+        initial_sequence,
+        resend_delay_ms: 25,
+        max_pending_reliable_packets: None,
+    });
+    session.receive(
+        &CultNetRudpPacket {
+            packet_type: CultNetRudpPacketType::Accept,
+            connection_id: CONNECTION_ID,
+            sequence: 0,
+            ack: 0,
+            ack_mask: 0,
+            channel_id: "control".into(),
+            reliable: false,
+            ordered: false,
+            sequenced: false,
+            fragment_id: 0,
+            fragment_index: 0,
+            fragment_count: 0,
+            payload: Vec::new(),
+        },
+        0,
+    )?;
+    Ok(session)
+}
+
+fn reliable() -> CultNetRudpSendOptions {
+    CultNetRudpSendOptions {
+        reliable: true,
+        ..Default::default()
+    }
+}
+
+/// What `send_many` puts on the wire now; the rest of the packet waits queued.
+fn send(session: &mut CultNetRudpSession, payload_bytes: usize) -> Result<Vec<CultNetRudpPacket>> {
+    session.send_many("state", vec![7; payload_bytes], reliable(), None)
+}
+
+fn ack_for(sequence: u32) -> CultNetRudpPacket {
+    CultNetRudpPacket {
+        packet_type: CultNetRudpPacketType::Ack,
+        connection_id: CONNECTION_ID,
+        sequence: 0,
+        ack: sequence,
+        ack_mask: 0,
+        channel_id: "control".into(),
+        reliable: false,
+        ordered: false,
+        sequenced: false,
+        fragment_id: 0,
+        fragment_index: 0,
+        fragment_count: 0,
+        payload: Vec::new(),
+    }
+}
+
+fn sequences(packets: &[CultNetRudpPacket]) -> Vec<u32> {
+    packets.iter().map(|packet| packet.sequence).collect()
+}
+
+/// Sends `g`, then acks every packet up to and including the one 1,023 above
+/// it, leaving `g` the only unacked sequence. Returns `g`.
+fn lose_g_and_fill_the_span(session: &mut CultNetRudpSession) -> Result<CultNetRudpPacket> {
+    let g = send(session, 1)?.remove(0);
+    for offset in 1..=1_023u32 {
+        let sent = send(session, 1)?;
+        assert_eq!(sequences(&sent), vec![g.sequence + offset]);
+        session.receive(&ack_for(g.sequence + offset), 1)?;
+    }
+    Ok(g)
+}
+
+#[test]
+fn a_lost_packet_holds_the_sender_1023_sequences_ahead_and_is_still_delivered() -> Result<()> {
+    let mut sender = connected(1)?;
+    let mut receiver = connected(100)?;
+    let g = send(&mut sender, 1)?.remove(0);
+    // g is lost. Everything after it is delivered and acked, until the sender stops.
+    let mut admitted_after_g = 0u32;
+    for _ in 0..4_200 {
+        for packet in send(&mut sender, 1)? {
+            admitted_after_g += 1;
+            receiver.receive(&packet, 1)?;
+            sender.receive(&receiver.create_ack(), 1)?;
+        }
+    }
+    assert_eq!(admitted_after_g, 1_023);
+    assert_eq!(sender.queued_reliable_packet_count(), 4_200 - 1_023);
+
+    let retransmit = sender
+        .due_resends(1_000)
+        .into_iter()
+        .find(|packet| packet.sequence == g.sequence)
+        .expect("g is still pending and due");
+    let delivered = receiver.receive(&retransmit, 1_000)?.delivered;
+    assert_eq!(delivered.len(), 1);
+    assert_eq!(delivered[0].sequence, g.sequence);
+
+    let promoted = sender
+        .receive(&receiver.create_ack_for_received(g.sequence), 1_001)?
+        .ready_to_send;
+    assert_eq!(promoted.first().map(|packet| packet.sequence), Some(g.sequence + 1_024));
+    Ok(())
+}
+
+#[test]
+fn a_direct_send_past_the_span_is_refused_without_consuming_a_sequence() -> Result<()> {
+    let mut sender = connected(1)?;
+    let g = lose_g_and_fill_the_span(&mut sender)?;
+    assert!(sender.send("state", vec![7], reliable()).is_err());
+    assert_eq!(sender.queued_reliable_packet_count(), 0);
+    sender.receive(&ack_for(g.sequence), 2)?;
+    let next = sender.send("state", vec![7], reliable())?;
+    assert_eq!(next.sequence, g.sequence + 1_024);
+    Ok(())
+}
+
+#[test]
+fn payload_above_the_lowest_unacked_sequence_is_bounded_by_4_mib() -> Result<()> {
+    let mut sender = connected(1)?;
+    let g = send(&mut sender, MIB)?.remove(0);
+    // The lowest unacked packet's own bytes do not count: four more MiB fit above it.
+    for _ in 0..4 {
+        assert_eq!(send(&mut sender, MIB)?.len(), 1);
+    }
+    assert!(send(&mut sender, MIB)?.is_empty());
+    assert!(send(&mut sender, MIB)?.is_empty());
+    assert_eq!(sender.queued_reliable_packet_count(), 2);
+
+    // Acking g moves the floor up one packet: exactly one MiB more fits.
+    let promoted = sender.receive(&ack_for(g.sequence), 1)?.ready_to_send;
+    assert_eq!(sequences(&promoted), vec![g.sequence + 5]);
+    assert_eq!(sender.queued_reliable_packet_count(), 1);
+    Ok(())
+}
+
+#[test]
+fn a_packet_larger_than_the_window_goes_out_alone_and_waits_behind_anything_unacked() -> Result<()> {
+    let mut sender = connected(1)?;
+    assert_eq!(send(&mut sender, 5 * MIB)?.len(), 1);
+    let mut sender = connected(1)?;
+    let g = send(&mut sender, 1)?.remove(0);
+    assert!(send(&mut sender, 5 * MIB)?.is_empty());
+    let promoted = sender.receive(&ack_for(g.sequence), 1)?.ready_to_send;
+    assert_eq!(sequences(&promoted), vec![g.sequence + 1]);
+    Ok(())
+}
+
+#[test]
+fn a_small_packet_does_not_overtake_a_queued_large_one() -> Result<()> {
+    let mut sender = connected(1)?;
+    let g = send(&mut sender, 1)?.remove(0);
+    assert_eq!(send(&mut sender, 3 * MIB)?.len(), 1);
+    assert!(send(&mut sender, 2 * MIB)?.is_empty());
+    // One byte would fit above g, but the 2 MiB packet is ahead of it.
+    assert!(send(&mut sender, 1)?.is_empty());
+    let promoted = sender.receive(&ack_for(g.sequence), 1)?.ready_to_send;
+    assert_eq!(sequences(&promoted), vec![g.sequence + 2, g.sequence + 3]);
+    Ok(())
+}
diff --git a/packages/cultnet-ts/test/cultnet.test.ts b/packages/cultnet-ts/test/cultnet.test.ts
index 35cba767..6751b568 100644
--- a/packages/cultnet-ts/test/cultnet.test.ts
+++ b/packages/cultnet-ts/test/cultnet.test.ts
@@ -1413,6 +1413,101 @@ test("rudp session advances large fragment sets through a bounded reliable windo
   assert.equal(oldAck.ackMask, 0);
 });
 
+// The sender's flow window: a reliable packet goes on the wire only while its sequence is at most 1,023 above the
+// lowest unacked one and the payload above that sequence stays within 4 MiB.
+const FLOW_CONNECTION_ID = 0x464c4f57;
+const MIB = 1024 * 1024;
+
+function connectedFlowSession(initialSequence: number): CultNetRudpSession {
+  const session = new CultNetRudpSession({ connectionId: FLOW_CONNECTION_ID, initialSequence, resendDelayMs: 25 });
+  session.receive({ packetType: "accept", connectionId: FLOW_CONNECTION_ID, sequence: 0, ack: 0, ackMask: 0, channelId: "control" });
+  return session;
+}
+
+function flowSend(session: CultNetRudpSession, payloadBytes: number): CultNetRudpPacket[] {
+  return session.sendMany("state", new Uint8Array(payloadBytes), { reliable: true });
+}
+
+function flowAck(sequence: number): CultNetRudpPacket {
+  return { packetType: "ack", connectionId: FLOW_CONNECTION_ID, sequence: 0, ack: sequence, ackMask: 0, channelId: "control" };
+}
+
+const sequencesOf = (packets: CultNetRudpPacket[]): number[] => packets.map((packet) => packet.sequence);
+
+function loseGAndFillTheSpan(session: CultNetRudpSession): CultNetRudpPacket {
+  const g = flowSend(session, 1)[0]!;
+  for (let offset = 1; offset <= 1023; offset++) {
+    assert.deepEqual(sequencesOf(flowSend(session, 1)), [g.sequence + offset]);
+    session.receive(flowAck(g.sequence + offset), 1);
+  }
+  return g;
+}
+
+test("a lost packet holds the sender 1023 sequences ahead and is still delivered", () => {
+  const sender = connectedFlowSession(1);
+  const receiver = connectedFlowSession(100);
+  const g = flowSend(sender, 1)[0]!;
+  let admittedAfterG = 0;
+  for (let index = 0; index < 4200; index++) {
+    for (const packet of flowSend(sender, 1)) {
+      admittedAfterG++;
+      receiver.receive(packet, 1);
+      sender.receive(receiver.createAck(), 1);
+    }
+  }
+  assert.equal(admittedAfterG, 1023);
+  assert.equal(sender.queuedReliablePacketCount, 4200 - 1023);
+
+  const retransmit = sender.dueResends(1000).find((packet) => packet.sequence === g.sequence)!;
+  const delivered = receiver.receive(retransmit, 1000).delivered;
+  assert.deepEqual(delivered.map((frame) => frame.sequence), [g.sequence]);
+
+  const promoted = sender.receive(receiver.createAckForReceived(g.sequence), 1001).readyToSend;
+  assert.equal(promoted[0]!.sequence, g.sequence + 1024);
+});
+
+test("a direct send past the span is refused without consuming a sequence", () => {
+  const sender = connectedFlowSession(1);
+  const g = loseGAndFillTheSpan(sender);
+  assert.throws(() => sender.send("state", new Uint8Array(1), { reliable: true }));
+  assert.equal(sender.queuedReliablePacketCount, 0);
+  sender.receive(flowAck(g.sequence), 2);
+  assert.equal(sender.send("state", new Uint8Array(1), { reliable: true }).sequence, g.sequence + 1024);
+});
+
+test("payload above the lowest unacked sequence is bounded by 4 MiB", () => {
+  const sender = connectedFlowSession(1);
+  const g = flowSend(sender, MIB)[0]!;
+  // The lowest unacked packet's own bytes do not count: four more MiB fit above it.
+  for (let index = 0; index < 4; index++) assert.equal(flowSend(sender, MIB).length, 1);
+  assert.equal(flowSend(sender, MIB).length, 0);
+  assert.equal(flowSend(sender, MIB).length, 0);
+  assert.equal(sender.queuedReliablePacketCount, 2);
+
+  // Acking g moves the floor up one packet: exactly one MiB more fits.
+  const promoted = sender.receive(flowAck(g.sequence), 1).readyToSend;
+  assert.deepEqual(sequencesOf(promoted), [g.sequence + 5]);
+  assert.equal(sender.queuedReliablePacketCount, 1);
+});
+
+test("a packet larger than the window goes out alone and waits behind anything unacked", () => {
+  assert.equal(flowSend(connectedFlowSession(1), 5 * MIB).length, 1);
+  const sender = connectedFlowSession(1);
+  const g = flowSend(sender, 1)[0]!;
+  assert.equal(flowSend(sender, 5 * MIB).length, 0);
+  assert.deepEqual(sequencesOf(sender.receive(flowAck(g.sequence), 1).readyToSend), [g.sequence + 1]);
+});
+
+test("a small packet does not overtake a queued large one", () => {
+  const sender = connectedFlowSession(1);
+  const g = flowSend(sender, 1)[0]!;
+  assert.equal(flowSend(sender, 3 * MIB).length, 1);
+  assert.equal(flowSend(sender, 2 * MIB).length, 0);
+  // One byte would fit above g, but the 2 MiB packet is ahead of it.
+  assert.equal(flowSend(sender, 1).length, 0);
+  assert.deepEqual(sequencesOf(sender.receive(flowAck(g.sequence), 1).readyToSend), [g.sequence + 2, g.sequence + 3]);
+});
+
 test("CultNet contracts encode legacy bytes without Node Buffer authority", () => {
   const originalBuffer = globalThis.Buffer;
   try {
diff --git a/tests/GameCult.Networking.Tests/NetworkingTests.cs b/tests/GameCult.Networking.Tests/NetworkingTests.cs
index e32ca91a..b9bda3ad 100644
--- a/tests/GameCult.Networking.Tests/NetworkingTests.cs
+++ b/tests/GameCult.Networking.Tests/NetworkingTests.cs
@@ -1160,6 +1160,120 @@ namespace GameCult.Networking.Tests
             Assert.That(delivered[0].Payload, Is.EqualTo(payload));
         }
 
+        // The sender's flow window: a reliable packet goes on the wire only while its sequence is at most 1,023
+        // above the lowest unacked one and the payload above that sequence stays within 4 MiB.
+        private const int Mib = 1024 * 1024;
+
+        private static CultNetRudpSession ConnectedFlowSession(uint initialSequence)
+        {
+            var session = new CultNetRudpSession(new CultNetRudpSessionOptions
+            {
+                ConnectionId = 0x464c4f57,
+                InitialSequence = initialSequence,
+                ResendDelayMs = 25
+            });
+            session.Receive(new CultNetRudpPacket { PacketType = CultNetRudpPacketType.Accept, ConnectionId = 0x464c4f57, Sequence = 0, ChannelId = "control" });
+            return session;
+        }
+
+        private static IReadOnlyList<CultNetRudpPacket> FlowSend(CultNetRudpSession session, int payloadBytes) =>
+            session.SendMany("state", new byte[payloadBytes], new CultNetRudpSendOptions { Reliable = true });
+
+        private static CultNetRudpPacket FlowAck(uint sequence) =>
+            new CultNetRudpPacket { PacketType = CultNetRudpPacketType.Ack, ConnectionId = 0x464c4f57, Ack = sequence, ChannelId = "control" };
+
+        private static CultNetRudpPacket LoseGAndFillTheSpan(CultNetRudpSession session)
+        {
+            var g = FlowSend(session, 1).Single();
+            for (uint offset = 1; offset <= 1023; offset++)
+            {
+                Assert.That(FlowSend(session, 1).Select(packet => packet.Sequence), Is.EqualTo(new[] { g.Sequence + offset }));
+                session.Receive(FlowAck(g.Sequence + offset), 1);
+            }
+            return g;
+        }
+
+        [Test]
+        public void RudpSession_ALostPacketHoldsTheSender1023SequencesAheadAndIsStillDelivered()
+        {
+            var sender = ConnectedFlowSession(1);
+            var receiver = ConnectedFlowSession(100);
+            var g = FlowSend(sender, 1).Single();
+            var admittedAfterG = 0;
+            for (var index = 0; index < 4200; index++)
+            {
+                foreach (var packet in FlowSend(sender, 1))
+                {
+                    admittedAfterG++;
+                    receiver.Receive(packet, 1);
+                    sender.Receive(receiver.CreateAck(), 1);
+                }
+            }
+            Assert.That(admittedAfterG, Is.EqualTo(1023));
+            Assert.That(sender.QueuedReliablePacketCount, Is.EqualTo(4200 - 1023));
+
+            var retransmit = sender.DueResends(1000).Single(packet => packet.Sequence == g.Sequence);
+            var delivered = receiver.Receive(retransmit, 1000).Delivered;
+            Assert.That(delivered.Select(frame => frame.Sequence), Is.EqualTo(new[] { g.Sequence }));
+
+            var promoted = sender.Receive(receiver.CreateAckForReceived(g.Sequence), 1001).ReadyToSend;
+            Assert.That(promoted.First().Sequence, Is.EqualTo(g.Sequence + 1024));
+        }
+
+        [Test]
+        public void RudpSession_ADirectSendPastTheSpanIsRefusedWithoutConsumingASequence()
+        {
+            var sender = ConnectedFlowSession(1);
+            var g = LoseGAndFillTheSpan(sender);
+            Assert.Throws<InvalidOperationException>(() => sender.Send("state", new byte[1], new CultNetRudpSendOptions { Reliable = true }));
+            Assert.That(sender.QueuedReliablePacketCount, Is.Zero);
+            sender.Receive(FlowAck(g.Sequence), 2);
+            var next = sender.Send("state", new byte[1], new CultNetRudpSendOptions { Reliable = true });
+            Assert.That(next.Sequence, Is.EqualTo(g.Sequence + 1024));
+        }
+
+        [Test]
+        public void RudpSession_PayloadAboveTheLowestUnackedSequenceIsBoundedBy4MiB()
+        {
+            var sender = ConnectedFlowSession(1);
+            var g = FlowSend(sender, Mib).Single();
+            // The lowest unacked packet's own bytes do not count: four more MiB fit above it.
+            for (var index = 0; index < 4; index++)
+                Assert.That(FlowSend(sender, Mib), Has.Count.EqualTo(1));
+            Assert.That(FlowSend(sender, Mib), Is.Empty);
+            Assert.That(FlowSend(sender, Mib), Is.Empty);
+            Assert.That(sender.QueuedReliablePacketCount, Is.EqualTo(2));
+
+            // Acking g moves the floor up one packet: exactly one MiB more fits.
+            var promoted = sender.Receive(FlowAck(g.Sequence), 1).ReadyToSend;
+            Assert.That(promoted.Select(packet => packet.Sequence), Is.EqualTo(new[] { g.Sequence + 5 }));
+            Assert.That(sender.QueuedReliablePacketCount, Is.EqualTo(1));
+        }
+
+        [Test]
+        public void RudpSession_APacketLargerThanTheWindowGoesOutAloneAndWaitsBehindAnythingUnacked()
+        {
+            Assert.That(FlowSend(ConnectedFlowSession(1), 5 * Mib), Has.Count.EqualTo(1));
+            var sender = ConnectedFlowSession(1);
+            var g = FlowSend(sender, 1).Single();
+            Assert.That(FlowSend(sender, 5 * Mib), Is.Empty);
+            var promoted = sender.Receive(FlowAck(g.Sequence), 1).ReadyToSend;
+            Assert.That(promoted.Select(packet => packet.Sequence), Is.EqualTo(new[] { g.Sequence + 1 }));
+        }
+
+        [Test]
+        public void RudpSession_ASmallPacketDoesNotOvertakeAQueuedLargeOne()
+        {
+            var sender = ConnectedFlowSession(1);
+            var g = FlowSend(sender, 1).Single();
+            Assert.That(FlowSend(sender, 3 * Mib), Has.Count.EqualTo(1));
+            Assert.That(FlowSend(sender, 2 * Mib), Is.Empty);
+            // One byte would fit above g, but the 2 MiB packet is ahead of it.
+            Assert.That(FlowSend(sender, 1), Is.Empty);
+            var promoted = sender.Receive(FlowAck(g.Sequence), 1).ReadyToSend;
+            Assert.That(promoted.Select(packet => packet.Sequence), Is.EqualTo(new[] { g.Sequence + 2, g.Sequence + 3 }));
+        }
+
         [Test]
         public void RudpSocketTransport_HandshakesAndCarriesReliableOrderedSchemaFrames()
         {

From eeda6d7fd61984594059c52d67399bc861faf243 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 00:55:14 +0200
Subject: [PATCH 02/24] Ack Cut 3: the sender's flow window (1,023 sequences
 and 4 MiB above the lowest unacked)

Admission in Rust, C#, TypeScript and Python goes through one predicate,
window_admits: the 32-packet slot, a sequence at most 1,023 above the lowest
unacked one, and at most 4 MiB of payload above it. With nothing pending any
packet is admissible. Admission is FIFO: nothing overtakes a queued packet.
The single-packet send refuses on the same predicate instead of queueing a
packet and then reporting that it produced none. The receive window is stated
in docs/cultnet-transport-parity.md. Kotlin trails (Cut K3).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 docs/cultnet-transport-parity.md              |  9 ++++
 .../cultnet-py/src/cultnet_py/transport.py    | 39 +++++++++++----
 packages/cultnet-rs/src/rudp.rs               | 48 +++++++++++++++----
 packages/cultnet-ts/src/rudp.ts               | 45 +++++++++++++----
 src/GameCult.Networking/CultNetTransport.cs   | 38 ++++++++++++---
 5 files changed, 146 insertions(+), 33 deletions(-)

diff --git a/docs/cultnet-transport-parity.md b/docs/cultnet-transport-parity.md
index d0779196..17fc6964 100644
--- a/docs/cultnet-transport-parity.md
+++ b/docs/cultnet-transport-parity.md
@@ -271,6 +271,15 @@ Current progress:
   flush where the runtime supports one, so callers that require confirmed
   transport delivery do not substitute a fixed sleep. TCP-framed profiles do
   not publish the field because they do not own the RUDP pending-reliable queue.
+- The receive window is a contract, not a discovery. A receiver must hold 1,023
+  sequences and 4 MiB of payload beyond its contiguous received watermark, and
+  a conforming sender never exceeds either. The sender's flow window enforces
+  it without a wire field: a reliable packet is admitted only while its
+  sequence is at most 1,023 above the lowest unacked sequence and the payload
+  above that sequence stays within 4 MiB. The first packet is always
+  admissible, so a payload larger than 4 MiB goes out alone, and packets wait
+  in the FIFO in order, so a small packet never overtakes a large one. C#,
+  Rust, TypeScript, and Python enforce it; Kotlin does not yet.
 - TypeScript, C#, Rust, Python, and Kotlin now share a portable
   `cultnet.reconnect_policy.v0` document and deterministic exponential delay
   helper, and RUDP transport profiles advertise that policy under
diff --git a/packages/cultnet-py/src/cultnet_py/transport.py b/packages/cultnet-py/src/cultnet_py/transport.py
index 0f378613..6b0ce026 100644
--- a/packages/cultnet-py/src/cultnet_py/transport.py
+++ b/packages/cultnet-py/src/cultnet_py/transport.py
@@ -402,6 +402,10 @@ def create_rudp_transport_profile(
 class CultNetRudpSession:
     RELIABLE_SEND_WINDOW_PACKETS = 32
     RECEIVED_SEQUENCE_WINDOW = 4_096
+    # Flow window: a reliable packet is admitted only while its sequence is at most FLOW_WINDOW_SEQUENCES above the
+    # lowest unacked one and the payload above that sequence stays within FLOW_WINDOW_BYTES.
+    FLOW_WINDOW_SEQUENCES = 1_023
+    FLOW_WINDOW_BYTES = 4 * 1024 * 1024
 
     def __init__(self, options: CultNetRudpSessionOptions) -> None:
         self.connection_id = _uint32(options.connection_id, "connection_id")
@@ -531,7 +535,7 @@ class CultNetRudpSession:
         options: CultNetRudpSendOptions | None = None,
     ) -> CultNetRudpPacket:
         resolved = options or CultNetRudpSendOptions()
-        if resolved.reliable and len(self._pending_reliable) >= self.RELIABLE_SEND_WINDOW_PACKETS:
+        if resolved.reliable and (self._queued_reliable or not self._window_admits(self._next_sequence, len(payload))):
             raise ValueError("RUDP reliable send window is full; receive acknowledgements before sending")
         return self.send_many(channel_id, payload, resolved)[0]
 
@@ -773,22 +777,39 @@ class CultNetRudpSession:
             last_sent_at_ms=now_ms,
         )
 
+    def _window_admits(self, sequence: int, payload_length: int) -> bool:
+        """Whether a reliable packet may go on the wire now: the window has a slot, and its sequence and the
+        payload above the lowest unacked sequence stay inside the flow window. With nothing pending, any packet
+        is admissible."""
+        if len(self._pending_reliable) >= self.RELIABLE_SEND_WINDOW_PACKETS:
+            return False
+        if not self._pending_reliable:
+            return True
+        lowest = min(self._pending_reliable)
+        bytes_above = sum(
+            len(pending.packet.payload) for pending_sequence, pending in self._pending_reliable.items() if pending_sequence > lowest
+        )
+        return sequence - lowest <= self.FLOW_WINDOW_SEQUENCES and bytes_above + payload_length <= self.FLOW_WINDOW_BYTES
+
     def _admit_reliable_packets(
         self,
         packets: tuple[CultNetRudpPacket, ...],
         now_ms: int,
     ) -> tuple[CultNetRudpPacket, ...]:
-        available = max(0, self.RELIABLE_SEND_WINDOW_PACKETS - len(self._pending_reliable))
-        ready = packets[:available]
-        for packet in ready:
-            self._track_reliable(packet, now_ms)
-        self._queued_reliable.extend(packets[available:])
-        return ready
+        ready: list[CultNetRudpPacket] = []
+        for packet in packets:
+            if not self._queued_reliable and self._window_admits(packet.sequence, len(packet.payload)):
+                self._track_reliable(packet, now_ms)
+                ready.append(packet)
+            else:
+                self._queued_reliable.append(packet)
+        return tuple(ready)
 
     def _promote_queued_reliable(self, now_ms: int) -> tuple[CultNetRudpPacket, ...]:
-        available = max(0, self.RELIABLE_SEND_WINDOW_PACKETS - len(self._pending_reliable))
         ready: list[CultNetRudpPacket] = []
-        while len(ready) < available and self._queued_reliable:
+        while self._queued_reliable and self._window_admits(
+            self._queued_reliable[0].sequence, len(self._queued_reliable[0].payload)
+        ):
             packet = self._queued_reliable.popleft()
             self._track_reliable(packet, now_ms)
             ready.append(packet)
diff --git a/packages/cultnet-rs/src/rudp.rs b/packages/cultnet-rs/src/rudp.rs
index 3b348fe3..ac4054a9 100644
--- a/packages/cultnet-rs/src/rudp.rs
+++ b/packages/cultnet-rs/src/rudp.rs
@@ -46,6 +46,13 @@ const RUDP_MAX_TRACKED_CHANNELS: usize = 64;
 const RUDP_RECEIVE_AHEAD_WINDOW: u32 = 1_024;
 const RUDP_MAX_ORDERED_BUFFERED_FRAMES: usize = 1_024;
 const RUDP_MAX_ORDERED_BUFFERED_BYTES: usize = 4 * 1024 * 1024;
+/// The sender's flow window: a reliable packet goes on the wire only while its
+/// sequence is at most this far above the lowest unacked one, and the payload
+/// above that sequence stays within the byte bound. A receiver holds
+/// `RUDP_RECEIVE_AHEAD_WINDOW - 1` sequences and `RUDP_MAX_ORDERED_BUFFERED_BYTES`
+/// beyond its watermark, so a sender that obeys this never overruns it.
+const RUDP_FLOW_WINDOW_SEQUENCES: u32 = RUDP_RECEIVE_AHEAD_WINDOW - 1;
+const RUDP_FLOW_WINDOW_BYTES: usize = RUDP_MAX_ORDERED_BUFFERED_BYTES;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum CultNetRudpPacketType {
@@ -441,7 +448,8 @@ impl CultNetRudpSession {
         options: CultNetRudpSendOptions,
     ) -> Result<CultNetRudpPacket> {
         if options.reliable
-            && self.pending_reliable.len() >= CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS
+            && (!self.queued_reliable.is_empty()
+                || !self.window_admits(self.next_sequence, payload.len()))
         {
             return Err(anyhow!(
                 "RUDP reliable send window is full; receive acknowledgements before sending"
@@ -907,17 +915,37 @@ impl CultNetRudpSession {
             .saturating_add((before - after) as u64);
     }
 
+    /// Whether a reliable packet may go on the wire now: the window has a slot,
+    /// and its sequence and the payload above the lowest unacked sequence stay
+    /// inside the flow window. With nothing pending, any packet is admissible.
+    fn window_admits(&self, sequence: u32, payload_len: usize) -> bool {
+        if self.pending_reliable.len() >= CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS {
+            return false;
+        }
+        let Some((&lowest, _)) = self.pending_reliable.first_key_value() else {
+            return true;
+        };
+        let bytes_above: usize = self
+            .pending_reliable
+            .iter()
+            .filter(|(pending_sequence, _)| **pending_sequence > lowest)
+            .map(|(_, pending)| pending.packet.payload.len())
+            .sum();
+        sequence.saturating_sub(lowest) <= RUDP_FLOW_WINDOW_SEQUENCES
+            && bytes_above + payload_len <= RUDP_FLOW_WINDOW_BYTES
+    }
+
     fn admit_reliable_packets(
         &mut self,
         packets: Vec<CultNetRudpPacket>,
         now_ms: u64,
         expires_at_ms: Option<u64>,
     ) -> Vec<CultNetRudpPacket> {
-        let available =
-            CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS.saturating_sub(self.pending_reliable.len());
-        let mut ready = Vec::with_capacity(available.min(packets.len()));
+        let mut ready = Vec::new();
         for packet in packets {
-            if ready.len() < available {
+            if self.queued_reliable.is_empty()
+                && self.window_admits(packet.sequence, packet.payload.len())
+            {
                 self.track_reliable(packet.clone(), now_ms, expires_at_ms);
                 ready.push(packet);
             } else {
@@ -928,10 +956,12 @@ impl CultNetRudpSession {
     }
 
     fn promote_queued_reliable(&mut self, now_ms: u64) -> Vec<CultNetRudpPacket> {
-        let available =
-            CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS.saturating_sub(self.pending_reliable.len());
-        let mut ready = Vec::with_capacity(available.min(self.queued_reliable.len()));
-        for _ in 0..available {
+        let mut ready = Vec::new();
+        while self
+            .queued_reliable
+            .front()
+            .is_some_and(|(packet, _)| self.window_admits(packet.sequence, packet.payload.len()))
+        {
             let Some((packet, expires_at_ms)) = self.queued_reliable.pop_front() else {
                 break;
             };
diff --git a/packages/cultnet-ts/src/rudp.ts b/packages/cultnet-ts/src/rudp.ts
index ae7ea838..10a6b9a2 100644
--- a/packages/cultnet-ts/src/rudp.ts
+++ b/packages/cultnet-ts/src/rudp.ts
@@ -18,6 +18,10 @@ const RUDP_FIXED_HEADER_BYTES = 36;
 const MAX_CHANNEL_ID_BYTES = 255;
 export const CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS = 32;
 const RUDP_RECEIVED_SEQUENCE_WINDOW = 4_096;
+// Flow window: a reliable packet is admitted only while its sequence is at most RUDP_FLOW_WINDOW_SEQUENCES above the
+// lowest unacked one and the payload above that sequence stays within RUDP_FLOW_WINDOW_BYTES.
+const RUDP_FLOW_WINDOW_SEQUENCES = 1_023;
+const RUDP_FLOW_WINDOW_BYTES = 4 * 1024 * 1024;
 
 export type CultNetRudpPacketType =
   | "connect"
@@ -295,7 +299,7 @@ export class CultNetRudpSession {
     payload: Uint8Array,
     options: { reliable?: boolean; ordered?: boolean; sequenced?: boolean; nowMs?: number } = {},
   ): CultNetRudpPacket {
-    if (options.reliable && this.#pendingReliable.size >= CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS) {
+    if (options.reliable && (this.#queuedReliable.length > 0 || !this.#windowAdmits(this.#nextSequence, payload.length))) {
       throw new Error("RUDP reliable send window is full; receive acknowledgements before sending.");
     }
     return this.sendMany(channelId, payload, options)[0]!;
@@ -583,18 +587,43 @@ export class CultNetRudpSession {
     });
   }
 
+  /**
+   * Whether a reliable packet may go on the wire now: the window has a slot, and its sequence and the payload above
+   * the lowest unacked sequence stay inside the flow window. With nothing pending, any packet is admissible.
+   */
+  #windowAdmits(sequence: number, payloadLength: number): boolean {
+    if (this.#pendingReliable.size >= CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS) return false;
+    if (this.#pendingReliable.size === 0) return true;
+    const lowest = Math.min(...this.#pendingReliable.keys());
+    let bytesAbove = 0;
+    for (const [pendingSequence, pending] of this.#pendingReliable) {
+      if (pendingSequence > lowest) bytesAbove += pending.packet.payload?.length ?? 0;
+    }
+    return sequence - lowest <= RUDP_FLOW_WINDOW_SEQUENCES && bytesAbove + payloadLength <= RUDP_FLOW_WINDOW_BYTES;
+  }
+
   #admitReliablePackets(packets: CultNetRudpPacket[], nowMs: number): CultNetRudpPacket[] {
-    const available = Math.max(0, CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS - this.#pendingReliable.size);
-    const ready = packets.slice(0, available);
-    for (const packet of ready) this.#trackReliable(packet, nowMs);
-    this.#queuedReliable.push(...packets.slice(available));
+    const ready: CultNetRudpPacket[] = [];
+    for (const packet of packets) {
+      if (this.#queuedReliable.length === 0 && this.#windowAdmits(packet.sequence, packet.payload?.length ?? 0)) {
+        this.#trackReliable(packet, nowMs);
+        ready.push(packet);
+      } else {
+        this.#queuedReliable.push(packet);
+      }
+    }
     return ready;
   }
 
   #promoteQueuedReliable(nowMs: number): CultNetRudpPacket[] {
-    const available = Math.max(0, CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS - this.#pendingReliable.size);
-    const ready = this.#queuedReliable.splice(0, available);
-    for (const packet of ready) this.#trackReliable(packet, nowMs);
+    const ready: CultNetRudpPacket[] = [];
+    while (this.#queuedReliable.length > 0) {
+      const packet = this.#queuedReliable[0];
+      if (!this.#windowAdmits(packet.sequence, packet.payload?.length ?? 0)) break;
+      this.#queuedReliable.shift();
+      this.#trackReliable(packet, nowMs);
+      ready.push(packet);
+    }
     return ready;
   }
 
diff --git a/src/GameCult.Networking/CultNetTransport.cs b/src/GameCult.Networking/CultNetTransport.cs
index e98fdc03..de61d1af 100644
--- a/src/GameCult.Networking/CultNetTransport.cs
+++ b/src/GameCult.Networking/CultNetTransport.cs
@@ -881,6 +881,10 @@ namespace GameCult.Networking
     {
         /// <summary>Maximum reliable packets admitted to the wire before acknowledgements advance the window.</summary>
         public const int ReliableSendWindowPackets = 32;
+        // Flow window: a reliable packet is admitted only while its sequence is at most FlowWindowSequences above the
+        // lowest unacked one and the payload above that sequence stays within FlowWindowBytes.
+        private const uint FlowWindowSequences = 1023;
+        private const int FlowWindowBytes = 4 * 1024 * 1024;
         private const int ReceivedSequenceWindow = 4096;
         private sealed class PendingReliablePacket
         {
@@ -1063,7 +1067,7 @@ namespace GameCult.Networking
             options ??= new CultNetRudpSendOptions();
             lock (_pendingReliableGate)
             {
-                if (options.Reliable && _pendingReliable.Count >= ReliableSendWindowPackets)
+                if (options.Reliable && (_queuedReliable.Count > 0 || !WindowAdmits(_nextSequence, payload.Length)))
                     throw new InvalidOperationException("RUDP reliable send window is full; receive acknowledgements before sending.");
             }
             return SendMany(channelId, payload, options).First();
@@ -1436,17 +1440,37 @@ namespace GameCult.Networking
             }
         }
 
+        /// <summary>
+        /// Whether a reliable packet may go on the wire now: the window has a slot, and its sequence and the
+        /// payload above the lowest unacked sequence stay inside the flow window. With nothing pending, any
+        /// packet is admissible. Callers hold the pending gate.
+        /// </summary>
+        private bool WindowAdmits(uint sequence, int payloadLength)
+        {
+            if (_pendingReliable.Count >= ReliableSendWindowPackets)
+                return false;
+            if (_pendingReliable.Count == 0)
+                return true;
+            var lowest = _pendingReliable.Keys.Min();
+            long bytesAbove = 0;
+            foreach (var pending in _pendingReliable)
+            {
+                if (pending.Key > lowest)
+                    bytesAbove += pending.Value.Packet.Payload.Length;
+            }
+            return sequence - lowest <= FlowWindowSequences && bytesAbove + payloadLength <= FlowWindowBytes;
+        }
+
         private IReadOnlyList<CultNetRudpPacket> AdmitReliablePackets(
             IReadOnlyList<CultNetRudpPacket> packets,
             long nowMs)
         {
             lock (_pendingReliableGate)
             {
-                var available = Math.Max(0, ReliableSendWindowPackets - _pendingReliable.Count);
-                var ready = new List<CultNetRudpPacket>(Math.Min(available, packets.Count));
+                var ready = new List<CultNetRudpPacket>();
                 foreach (var packet in packets)
                 {
-                    if (ready.Count < available)
+                    if (_queuedReliable.Count == 0 && WindowAdmits(packet.Sequence, packet.Payload.Length))
                     {
                         _pendingReliable[packet.Sequence] = new PendingReliablePacket
                         {
@@ -1468,9 +1492,9 @@ namespace GameCult.Networking
         {
             lock (_pendingReliableGate)
             {
-                var available = Math.Max(0, ReliableSendWindowPackets - _pendingReliable.Count);
-                var ready = new List<CultNetRudpPacket>(Math.Min(available, _queuedReliable.Count));
-                while (ready.Count < available && _queuedReliable.Count > 0)
+                var ready = new List<CultNetRudpPacket>();
+                while (_queuedReliable.Count > 0
+                    && WindowAdmits(_queuedReliable.Peek().Sequence, _queuedReliable.Peek().Payload.Length))
                 {
                     var packet = _queuedReliable.Dequeue();
                     _pendingReliable[packet.Sequence] = new PendingReliablePacket

From 4f13eb6689ce4d97644af28e0cc97e23df5f376f Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 00:57:21 +0200
Subject: [PATCH 03/24] Ack Cut 3: a direct send behind a queued packet is
 refused and takes no sequence

The FIFO test now also pins the single-packet send's refusal while an earlier
packet waits in the queue, in Rust, C#, TypeScript and Python.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 packages/cultnet-py/tests/test_cultnet.py          | 4 ++++
 packages/cultnet-rs/tests/rudp_flow_window.rs      | 3 +++
 packages/cultnet-ts/test/cultnet.test.ts           | 3 +++
 tests/GameCult.Networking.Tests/NetworkingTests.cs | 3 +++
 4 files changed, 13 insertions(+)

diff --git a/packages/cultnet-py/tests/test_cultnet.py b/packages/cultnet-py/tests/test_cultnet.py
index 2161be04..e1205fef 100644
--- a/packages/cultnet-py/tests/test_cultnet.py
+++ b/packages/cultnet-py/tests/test_cultnet.py
@@ -963,6 +963,10 @@ class CultNetTests(unittest.TestCase):
         g = self._flow_send(sender, 1)[0]
         self.assertEqual(len(self._flow_send(sender, 3 * self.MIB)), 1)
         self.assertEqual(len(self._flow_send(sender, 2 * self.MIB)), 0)
+        # A direct send refuses instead of queueing behind it, and takes no sequence.
+        with self.assertRaises(ValueError):
+            sender.send("state", bytes(1), CultNetRudpSendOptions(reliable=True))
+        self.assertEqual(sender.queued_reliable_packet_count, 1)
         # One byte would fit above g, but the 2 MiB packet is ahead of it.
         self.assertEqual(len(self._flow_send(sender, 1)), 0)
         promoted = sender.receive(self._flow_ack(g.sequence), 1).ready_to_send
diff --git a/packages/cultnet-rs/tests/rudp_flow_window.rs b/packages/cultnet-rs/tests/rudp_flow_window.rs
index b288de44..b052834c 100644
--- a/packages/cultnet-rs/tests/rudp_flow_window.rs
+++ b/packages/cultnet-rs/tests/rudp_flow_window.rs
@@ -164,6 +164,9 @@ fn a_small_packet_does_not_overtake_a_queued_large_one() -> Result<()> {
     let g = send(&mut sender, 1)?.remove(0);
     assert_eq!(send(&mut sender, 3 * MIB)?.len(), 1);
     assert!(send(&mut sender, 2 * MIB)?.is_empty());
+    // A direct send refuses instead of queueing behind it, and takes no sequence.
+    assert!(sender.send("state", vec![7], reliable()).is_err());
+    assert_eq!(sender.queued_reliable_packet_count(), 1);
     // One byte would fit above g, but the 2 MiB packet is ahead of it.
     assert!(send(&mut sender, 1)?.is_empty());
     let promoted = sender.receive(&ack_for(g.sequence), 1)?.ready_to_send;
diff --git a/packages/cultnet-ts/test/cultnet.test.ts b/packages/cultnet-ts/test/cultnet.test.ts
index 6751b568..a3efa323 100644
--- a/packages/cultnet-ts/test/cultnet.test.ts
+++ b/packages/cultnet-ts/test/cultnet.test.ts
@@ -1503,6 +1503,9 @@ test("a small packet does not overtake a queued large one", () => {
   const g = flowSend(sender, 1)[0]!;
   assert.equal(flowSend(sender, 3 * MIB).length, 1);
   assert.equal(flowSend(sender, 2 * MIB).length, 0);
+  // A direct send refuses instead of queueing behind it, and takes no sequence.
+  assert.throws(() => sender.send("state", new Uint8Array(1), { reliable: true }));
+  assert.equal(sender.queuedReliablePacketCount, 1);
   // One byte would fit above g, but the 2 MiB packet is ahead of it.
   assert.equal(flowSend(sender, 1).length, 0);
   assert.deepEqual(sequencesOf(sender.receive(flowAck(g.sequence), 1).readyToSend), [g.sequence + 2, g.sequence + 3]);
diff --git a/tests/GameCult.Networking.Tests/NetworkingTests.cs b/tests/GameCult.Networking.Tests/NetworkingTests.cs
index b9bda3ad..7cdf256f 100644
--- a/tests/GameCult.Networking.Tests/NetworkingTests.cs
+++ b/tests/GameCult.Networking.Tests/NetworkingTests.cs
@@ -1268,6 +1268,9 @@ namespace GameCult.Networking.Tests
             var g = FlowSend(sender, 1).Single();
             Assert.That(FlowSend(sender, 3 * Mib), Has.Count.EqualTo(1));
             Assert.That(FlowSend(sender, 2 * Mib), Is.Empty);
+            // A direct send refuses instead of queueing behind it, and takes no sequence.
+            Assert.Throws<InvalidOperationException>(() => sender.Send("state", new byte[1], new CultNetRudpSendOptions { Reliable = true }));
+            Assert.That(sender.QueuedReliablePacketCount, Is.EqualTo(1));
             // One byte would fit above g, but the 2 MiB packet is ahead of it.
             Assert.That(FlowSend(sender, 1), Is.Empty);
             var promoted = sender.Receive(FlowAck(g.Sequence), 1).ReadyToSend;

From a6dc231d40b3a7bcc930f9adeb6f8b8e6646de62 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 01:10:33 +0200
Subject: [PATCH 04/24] Ack Cut 3: TypeScript flow-window tests typecheck under
 noUncheckedIndexedAccess

readyToSend is optional on the receive result; the tests read it as empty
when absent.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 packages/cultnet-ts/test/cultnet.test.ts | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/cultnet-ts/test/cultnet.test.ts b/packages/cultnet-ts/test/cultnet.test.ts
index a3efa323..d2048f9d 100644
--- a/packages/cultnet-ts/test/cultnet.test.ts
+++ b/packages/cultnet-ts/test/cultnet.test.ts
@@ -1462,7 +1462,7 @@ test("a lost packet holds the sender 1023 sequences ahead and is still delivered
   const delivered = receiver.receive(retransmit, 1000).delivered;
   assert.deepEqual(delivered.map((frame) => frame.sequence), [g.sequence]);
 
-  const promoted = sender.receive(receiver.createAckForReceived(g.sequence), 1001).readyToSend;
+  const promoted = sender.receive(receiver.createAckForReceived(g.sequence), 1001).readyToSend ?? [];
   assert.equal(promoted[0]!.sequence, g.sequence + 1024);
 });
 
@@ -1485,7 +1485,7 @@ test("payload above the lowest unacked sequence is bounded by 4 MiB", () => {
   assert.equal(sender.queuedReliablePacketCount, 2);
 
   // Acking g moves the floor up one packet: exactly one MiB more fits.
-  const promoted = sender.receive(flowAck(g.sequence), 1).readyToSend;
+  const promoted = sender.receive(flowAck(g.sequence), 1).readyToSend ?? [];
   assert.deepEqual(sequencesOf(promoted), [g.sequence + 5]);
   assert.equal(sender.queuedReliablePacketCount, 1);
 });
@@ -1495,7 +1495,7 @@ test("a packet larger than the window goes out alone and waits behind anything u
   const sender = connectedFlowSession(1);
   const g = flowSend(sender, 1)[0]!;
   assert.equal(flowSend(sender, 5 * MIB).length, 0);
-  assert.deepEqual(sequencesOf(sender.receive(flowAck(g.sequence), 1).readyToSend), [g.sequence + 1]);
+  assert.deepEqual(sequencesOf(sender.receive(flowAck(g.sequence), 1).readyToSend ?? []), [g.sequence + 1]);
 });
 
 test("a small packet does not overtake a queued large one", () => {
@@ -1508,7 +1508,7 @@ test("a small packet does not overtake a queued large one", () => {
   assert.equal(sender.queuedReliablePacketCount, 1);
   // One byte would fit above g, but the 2 MiB packet is ahead of it.
   assert.equal(flowSend(sender, 1).length, 0);
-  assert.deepEqual(sequencesOf(sender.receive(flowAck(g.sequence), 1).readyToSend), [g.sequence + 2, g.sequence + 3]);
+  assert.deepEqual(sequencesOf(sender.receive(flowAck(g.sequence), 1).readyToSend ?? []), [g.sequence + 2, g.sequence + 3]);
 });
 
 test("CultNet contracts encode legacy bytes without Node Buffer authority", () => {

From ede87f7423818be14aec3f5b3d081ce1c8934690 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 10:57:53 +0200
Subject: [PATCH 05/24] Ack Cut 3: the flow-window tests shake hands the way
 Cut 1 requires

An Accept now counts only while the session's own Connect awaits it, and reliable
data is refused until the handshake seeds the watermark, so the tests' bare Accept
no longer connected the session. The helpers now pair a sender and a receiver
through CreateConnect/AcceptConnect in all four runtimes; the sender's Connect
is acknowledged, so nothing is pending on it when the tests begin. Rust also
takes initial_sequence as an Option.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 packages/cultnet-py/tests/test_cultnet.py     | 22 ++++++---
 packages/cultnet-rs/tests/rudp_flow_window.rs | 49 +++++++++----------
 packages/cultnet-ts/test/cultnet.test.ts      | 20 ++++++--
 .../NetworkingTests.cs                        | 21 +++++---
 4 files changed, 69 insertions(+), 43 deletions(-)

diff --git a/packages/cultnet-py/tests/test_cultnet.py b/packages/cultnet-py/tests/test_cultnet.py
index 12f99f2e..8105c83d 100644
--- a/packages/cultnet-py/tests/test_cultnet.py
+++ b/packages/cultnet-py/tests/test_cultnet.py
@@ -882,12 +882,23 @@ class CultNetTests(unittest.TestCase):
     FLOW_CONNECTION_ID = 0x464C4F57
     MIB = 1024 * 1024
 
-    def _connected_flow_session(self, initial_sequence: int) -> CultNetRudpSession:
-        session = CultNetRudpSession(
+    def _flow_session(self, initial_sequence: int) -> CultNetRudpSession:
+        return CultNetRudpSession(
             CultNetRudpSessionOptions(connection_id=self.FLOW_CONNECTION_ID, initial_sequence=initial_sequence)
         )
-        session.receive(CultNetRudpPacket(CultNetRudpPacketType.ACCEPT, self.FLOW_CONNECTION_ID, 0, 0, 0, "control"))
-        return session
+
+    def _connected_flow_pair(
+        self, sender_initial_sequence: int, receiver_initial_sequence: int
+    ) -> tuple[CultNetRudpSession, CultNetRudpSession]:
+        """A sender and a receiver that have shaken hands: the receiver's watermark is seeded by the sender's
+        Connect, and the sender's Connect is acknowledged, so nothing is pending on the sender."""
+        sender = self._flow_session(sender_initial_sequence)
+        receiver = self._flow_session(receiver_initial_sequence)
+        sender.receive(receiver.accept_connect(sender.create_connect(0), 0), 0)
+        return sender, receiver
+
+    def _connected_flow_session(self, initial_sequence: int) -> CultNetRudpSession:
+        return self._connected_flow_pair(initial_sequence, 900)[0]
 
     @staticmethod
     def _flow_send(session: CultNetRudpSession, payload_bytes: int) -> tuple[CultNetRudpPacket, ...]:
@@ -904,8 +915,7 @@ class CultNetTests(unittest.TestCase):
         return g
 
     def test_cultnet_rudp_a_lost_packet_holds_the_sender_1023_sequences_ahead_and_is_still_delivered(self) -> None:
-        sender = self._connected_flow_session(1)
-        receiver = self._connected_flow_session(100)
+        sender, receiver = self._connected_flow_pair(1, 100)
         g = self._flow_send(sender, 1)[0]
         admitted_after_g = 0
         for _ in range(4200):
diff --git a/packages/cultnet-rs/tests/rudp_flow_window.rs b/packages/cultnet-rs/tests/rudp_flow_window.rs
index b052834c..73b7f8e6 100644
--- a/packages/cultnet-rs/tests/rudp_flow_window.rs
+++ b/packages/cultnet-rs/tests/rudp_flow_window.rs
@@ -8,32 +8,32 @@ use cultnet_rs::*;
 const CONNECTION_ID: u32 = 0x464c_4f57;
 const MIB: usize = 1024 * 1024;
 
-fn connected(initial_sequence: u32) -> Result<CultNetRudpSession> {
-    let mut session = CultNetRudpSession::new(CultNetRudpSessionOptions {
+fn session(initial_sequence: u32) -> CultNetRudpSession {
+    CultNetRudpSession::new(CultNetRudpSessionOptions {
         connection_id: CONNECTION_ID,
-        initial_sequence,
+        initial_sequence: Some(initial_sequence),
         resend_delay_ms: 25,
         max_pending_reliable_packets: None,
-    });
-    session.receive(
-        &CultNetRudpPacket {
-            packet_type: CultNetRudpPacketType::Accept,
-            connection_id: CONNECTION_ID,
-            sequence: 0,
-            ack: 0,
-            ack_mask: 0,
-            channel_id: "control".into(),
-            reliable: false,
-            ordered: false,
-            sequenced: false,
-            fragment_id: 0,
-            fragment_index: 0,
-            fragment_count: 0,
-            payload: Vec::new(),
-        },
-        0,
-    )?;
-    Ok(session)
+    })
+}
+
+/// A sender and a receiver that have shaken hands: the receiver's watermark is
+/// seeded by the sender's Connect, and the sender's Connect is acknowledged, so
+/// nothing is pending on the sender.
+fn connected_pair(
+    sender_initial_sequence: u32,
+    receiver_initial_sequence: u32,
+) -> Result<(CultNetRudpSession, CultNetRudpSession)> {
+    let mut sender = session(sender_initial_sequence);
+    let mut receiver = session(receiver_initial_sequence);
+    let connect = sender.create_connect(0, Vec::new())?;
+    let accept = receiver.accept_connect(&connect, 0, Vec::new())?;
+    sender.receive(&accept, 0)?;
+    Ok((sender, receiver))
+}
+
+fn connected(initial_sequence: u32) -> Result<CultNetRudpSession> {
+    Ok(connected_pair(initial_sequence, 900)?.0)
 }
 
 fn reliable() -> CultNetRudpSendOptions {
@@ -84,8 +84,7 @@ fn lose_g_and_fill_the_span(session: &mut CultNetRudpSession) -> Result<CultNetR
 
 #[test]
 fn a_lost_packet_holds_the_sender_1023_sequences_ahead_and_is_still_delivered() -> Result<()> {
-    let mut sender = connected(1)?;
-    let mut receiver = connected(100)?;
+    let (mut sender, mut receiver) = connected_pair(1, 100)?;
     let g = send(&mut sender, 1)?.remove(0);
     // g is lost. Everything after it is delivered and acked, until the sender stops.
     let mut admitted_after_g = 0u32;
diff --git a/packages/cultnet-ts/test/cultnet.test.ts b/packages/cultnet-ts/test/cultnet.test.ts
index e671c2b6..f3c1612b 100644
--- a/packages/cultnet-ts/test/cultnet.test.ts
+++ b/packages/cultnet-ts/test/cultnet.test.ts
@@ -1421,10 +1421,21 @@ test("rudp session advances large fragment sets through a bounded reliable windo
 const FLOW_CONNECTION_ID = 0x464c4f57;
 const MIB = 1024 * 1024;
 
+function flowSession(initialSequence: number): CultNetRudpSession {
+  return new CultNetRudpSession({ connectionId: FLOW_CONNECTION_ID, initialSequence, resendDelayMs: 25 });
+}
+
+// A sender and a receiver that have shaken hands: the receiver's watermark is seeded by the sender's Connect, and the
+// sender's Connect is acknowledged, so nothing is pending on the sender.
+function connectedFlowPair(senderInitialSequence: number, receiverInitialSequence: number): [CultNetRudpSession, CultNetRudpSession] {
+  const sender = flowSession(senderInitialSequence);
+  const receiver = flowSession(receiverInitialSequence);
+  sender.receive(receiver.acceptConnect(sender.createConnect(0), 0), 0);
+  return [sender, receiver];
+}
+
 function connectedFlowSession(initialSequence: number): CultNetRudpSession {
-  const session = new CultNetRudpSession({ connectionId: FLOW_CONNECTION_ID, initialSequence, resendDelayMs: 25 });
-  session.receive({ packetType: "accept", connectionId: FLOW_CONNECTION_ID, sequence: 0, ack: 0, ackMask: 0, channelId: "control" });
-  return session;
+  return connectedFlowPair(initialSequence, 900)[0];
 }
 
 function flowSend(session: CultNetRudpSession, payloadBytes: number): CultNetRudpPacket[] {
@@ -1447,8 +1458,7 @@ function loseGAndFillTheSpan(session: CultNetRudpSession): CultNetRudpPacket {
 }
 
 test("a lost packet holds the sender 1023 sequences ahead and is still delivered", () => {
-  const sender = connectedFlowSession(1);
-  const receiver = connectedFlowSession(100);
+  const [sender, receiver] = connectedFlowPair(1, 100);
   const g = flowSend(sender, 1)[0]!;
   let admittedAfterG = 0;
   for (let index = 0; index < 4200; index++) {
diff --git a/tests/GameCult.Networking.Tests/NetworkingTests.cs b/tests/GameCult.Networking.Tests/NetworkingTests.cs
index 470a20f2..15091ec3 100644
--- a/tests/GameCult.Networking.Tests/NetworkingTests.cs
+++ b/tests/GameCult.Networking.Tests/NetworkingTests.cs
@@ -1145,18 +1145,26 @@ namespace GameCult.Networking.Tests
         // above the lowest unacked one and the payload above that sequence stays within 4 MiB.
         private const int Mib = 1024 * 1024;
 
-        private static CultNetRudpSession ConnectedFlowSession(uint initialSequence)
-        {
-            var session = new CultNetRudpSession(new CultNetRudpSessionOptions
+        private static CultNetRudpSession FlowSession(uint initialSequence) =>
+            new CultNetRudpSession(new CultNetRudpSessionOptions
             {
                 ConnectionId = 0x464c4f57,
                 InitialSequence = initialSequence,
                 ResendDelayMs = 25
             });
-            session.Receive(new CultNetRudpPacket { PacketType = CultNetRudpPacketType.Accept, ConnectionId = 0x464c4f57, Sequence = 0, ChannelId = "control" });
-            return session;
+
+        // A sender and a receiver that have shaken hands: the receiver's watermark is seeded by the sender's
+        // Connect, and the sender's Connect is acknowledged, so nothing is pending on the sender.
+        private static (CultNetRudpSession Sender, CultNetRudpSession Receiver) ConnectedFlowPair(uint senderInitialSequence, uint receiverInitialSequence)
+        {
+            var sender = FlowSession(senderInitialSequence);
+            var receiver = FlowSession(receiverInitialSequence);
+            sender.Receive(receiver.AcceptConnect(sender.CreateConnect(0), 0), 0);
+            return (sender, receiver);
         }
 
+        private static CultNetRudpSession ConnectedFlowSession(uint initialSequence) => ConnectedFlowPair(initialSequence, 900).Sender;
+
         private static IReadOnlyList<CultNetRudpPacket> FlowSend(CultNetRudpSession session, int payloadBytes) =>
             session.SendMany("state", new byte[payloadBytes], new CultNetRudpSendOptions { Reliable = true });
 
@@ -1177,8 +1185,7 @@ namespace GameCult.Networking.Tests
         [Test]
         public void RudpSession_ALostPacketHoldsTheSender1023SequencesAheadAndIsStillDelivered()
         {
-            var sender = ConnectedFlowSession(1);
-            var receiver = ConnectedFlowSession(100);
+            var (sender, receiver) = ConnectedFlowPair(1, 100);
             var g = FlowSend(sender, 1).Single();
             var admittedAfterG = 0;
             for (var index = 0; index < 4200; index++)

From 0996fc96f59d21bfdcae9140a5314a460dee3aa2 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 11:07:30 +0200
Subject: [PATCH 06/24] Ack Cut 3: the hold-buffer test acknowledges the gap by
 hand

Cut 1's the_hold_buffer_takes_exactly_1024_frames test held 1,024 frames behind a
sequence the receiver never sees, by sending them all above one unacked packet.
Cut 3's flow window stops a sender 1,023 sequences above its lowest unacked packet,
so the test's sender was refused at frame 1,023. The missing packet is now
acknowledged by hand (the receiver never saw it), so the window slides and what
the test probes is the receiver's hold buffer, not the sender.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .../tests/rudp_connect_generation.rs          | 28 +++++++++++++++++--
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/packages/cultnet-rs/tests/rudp_connect_generation.rs b/packages/cultnet-rs/tests/rudp_connect_generation.rs
index b456162c..92f83322 100644
--- a/packages/cultnet-rs/tests/rudp_connect_generation.rs
+++ b/packages/cultnet-rs/tests/rudp_connect_generation.rs
@@ -575,9 +575,30 @@ fn a_flush_that_a_timeout_ended_names_the_timeout() -> Result<()> {
 // Hold-buffer boundaries: 1,024 frames and 64 channels are held; one more is
 // refused.
 
+/// An acknowledgement that names only `sequence`.
+fn ack_naming(sequence: u32) -> CultNetRudpPacket {
+    CultNetRudpPacket {
+        packet_type: CultNetRudpPacketType::Ack,
+        connection_id: CONNECTION_ID,
+        sequence: 0,
+        ack: sequence,
+        ack_mask: 0,
+        channel_id: "control".into(),
+        reliable: false,
+        ordered: false,
+        sequenced: false,
+        fragment_id: 0,
+        fragment_index: 0,
+        fragment_count: 0,
+        payload: Vec::new(),
+    }
+}
+
 /// A connected pair with one sequence the receiver will never see, so every
-/// later ordered frame waits behind it. The sender's window is kept open by
-/// acknowledging what the receiver has.
+/// later ordered frame waits behind it. The sender's flow window would stop it
+/// 1,023 sequences above its lowest unacked packet, so the missing one is
+/// acknowledged by hand (the receiver never saw it) and the rest by what the
+/// receiver has: the receiver's hold buffer is what this probes, not the sender.
 fn held_behind_a_gap(
     frames: usize,
     channel_of: impl Fn(usize) -> String,
@@ -585,7 +606,8 @@ fn held_behind_a_gap(
     let mut sender = session(1);
     let mut receiver = session(500);
     handshake(&mut sender, &mut receiver)?;
-    let _missing = sender.send("gap", b"lost".to_vec(), ordered())?;
+    let missing = sender.send("gap", b"lost".to_vec(), ordered())?;
+    sender.receive(&ack_naming(missing.sequence), 1)?;
     let mut held = 0;
     for index in 0..frames {
         let packet = sender.send(&channel_of(index), vec![0], ordered())?;

From 42ba0f082a0da3c67ca421f5a865a77ddf5aadea Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 12:02:32 +0200
Subject: [PATCH 07/24] Ack map: Cuts 3 and D Soul rulings; record the
 stalled-sender liveness gap

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/cultnet-rudp-ack-cut.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/docs/cultnet-rudp-ack-cut.md b/docs/cultnet-rudp-ack-cut.md
index e8fb5656..e7c8f6ae 100644
--- a/docs/cultnet-rudp-ack-cut.md
+++ b/docs/cultnet-rudp-ack-cut.md
@@ -1584,3 +1584,12 @@ profiles.
     detection; the random default closes it. Document on the option.
   - Repeated failed attempts walk the sequence up 4095 per 3 s and clamp at `u32::MAX−1` after ~18-27 days on one session;
     make exhaustion a hard error the caller sees (the clamp removal mutant survives).
+- **Cuts 3 and D Soul pass (Self, 2026-09-30).** Cut 3: the 4 MiB bound counts every byte sent above the lowest
+  unacknowledged sequence, acked or not (the spec's wording; the first implementation counted only pending packets).
+  Cut D: a send failure is either permanent (the datagram can never be sent as built, e.g. `EMSGSIZE`) or transient;
+  a permanent failure is returned from a caller-directed send and, inside a poll, ends only that peer's session with a
+  typed reason; transient failures stay counted losses. Windows `ConnectionResetError` on receive is idle, never fatal,
+  in every server. Cut D's negative grep `send_packet(...)?;` is obsolete: the `?` now propagates encode errors only.
+- **Recorded (liveness, not fixed):** a lowest reliable packet lost forever stalls the sender 1,023 sequences ahead
+  while the peer stays alive; session timeout doesn't end it. TCP ends such a connection after a retransmission
+  limit (R2). Decide with Cut F (abandonment) whether a reliable packet outstanding past a bound ends the session.

From d7eacd1011948b690fa454ee6c847c99b77d29d8 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 12:04:19 +0200
Subject: [PATCH 08/24] Ack Cut 3 F1: the 4 MiB flow bound counts acknowledged
 bytes above the lowest unacknowledged sequence

The bound summed only packets still awaiting an ack. Once frames above a lost
packet were acknowledged they stopped counting, so a receiver could be made to
hold more than 4 MiB behind one loss, and its hold buffer ended the session.
The sender now keeps the payload size of each acknowledged sequence above the
lowest pending one until the lowest advances past it, in Rust, TypeScript,
Python and C#. Tests per runtime: one lost packet, four acknowledged 1 MiB
frames, the fifth refused until the gap closes; and the floor moving to a new
lowest sequence.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .../cultnet-py/src/cultnet_py/transport.py    | 21 ++++++++--
 packages/cultnet-py/tests/test_cultnet.py     | 33 +++++++++++++++
 packages/cultnet-rs/src/rudp.rs               | 33 +++++++++++++--
 packages/cultnet-rs/tests/rudp_flow_window.rs | 42 +++++++++++++++++++
 packages/cultnet-ts/src/rudp.ts               | 30 ++++++++++++-
 packages/cultnet-ts/test/cultnet.test.ts      | 31 ++++++++++++++
 src/GameCult.Networking/CultNetTransport.cs   | 29 ++++++++++++-
 .../NetworkingTests.cs                        | 40 ++++++++++++++++++
 8 files changed, 249 insertions(+), 10 deletions(-)

diff --git a/packages/cultnet-py/src/cultnet_py/transport.py b/packages/cultnet-py/src/cultnet_py/transport.py
index a5927070..1e718aab 100644
--- a/packages/cultnet-py/src/cultnet_py/transport.py
+++ b/packages/cultnet-py/src/cultnet_py/transport.py
@@ -482,6 +482,9 @@ class CultNetRudpSession:
         self._received_sequences: set[int] = set()
         self._latest_sequenced_by_channel: dict[str, int] = {}
         self._pending_reliable: dict[int, _PendingReliablePacket] = {}
+        # Payload sizes of acknowledged reliable sequences above the lowest unacknowledged one. The receiver still
+        # holds those bytes behind the gap, so the flow window keeps counting them until the lowest sequence passes them.
+        self._acked_above_lowest: dict[int, int] = {}
         self._queued_reliable: deque[CultNetRudpPacket] = deque()
         # Every reliable sequence up to and including this one has been received
         # since the peer state was last reset. Only the handshake seeds it: the
@@ -544,6 +547,7 @@ class CultNetRudpSession:
         self._awaiting_accept = False
         self._generation += 1
         self._pending_reliable.clear()
+        self._acked_above_lowest.clear()
         self._queued_reliable.clear()
 
     def reset_peer_state(self) -> None:
@@ -950,7 +954,7 @@ class CultNetRudpSession:
         lowest = min(self._pending_reliable)
         bytes_above = sum(
             len(pending.packet.payload) for pending_sequence, pending in self._pending_reliable.items() if pending_sequence > lowest
-        )
+        ) + sum(self._acked_above_lowest.values())
         return sequence - lowest <= self.FLOW_WINDOW_SEQUENCES and bytes_above + payload_length <= self.FLOW_WINDOW_BYTES
 
     def _admit_reliable_packets(
@@ -984,10 +988,21 @@ class CultNetRudpSession:
             raise ValueError("RUDP reliable send queue is full")
 
     def _apply_acknowledgements(self, packet: CultNetRudpPacket) -> None:
-        self._pending_reliable.pop(packet.ack, None)
+        self._acknowledge(packet.ack)
         for bit in range(32):
             if packet.ack_mask & (1 << bit):
-                self._pending_reliable.pop(packet.ack - bit - 1, None)
+                self._acknowledge(packet.ack - bit - 1)
+        # Acknowledged sizes stop counting once the lowest unacknowledged sequence passes them, and all of them stop
+        # when nothing is unacknowledged.
+        lowest = min(self._pending_reliable, default=None)
+        self._acked_above_lowest = (
+            {} if lowest is None else {sequence: length for sequence, length in self._acked_above_lowest.items() if sequence > lowest}
+        )
+
+    def _acknowledge(self, sequence: int) -> None:
+        pending = self._pending_reliable.pop(sequence, None)
+        if pending is not None:
+            self._acked_above_lowest[sequence] = len(pending.packet.payload)
 
     def _seed_received(self, sequence: int) -> None:
         """The handshake's one act on the watermark: the peer's Connect or Accept
diff --git a/packages/cultnet-py/tests/test_cultnet.py b/packages/cultnet-py/tests/test_cultnet.py
index 8105c83d..f11eb1ce 100644
--- a/packages/cultnet-py/tests/test_cultnet.py
+++ b/packages/cultnet-py/tests/test_cultnet.py
@@ -980,6 +980,39 @@ class CultNetTests(unittest.TestCase):
         promoted = sender.receive(self._flow_ack(g.sequence), 1).ready_to_send
         self.assertEqual([p.sequence for p in promoted], [g.sequence + 2, g.sequence + 3])
 
+    def test_cultnet_rudp_acknowledged_bytes_above_a_lost_packet_still_count_against_4_mib(self) -> None:
+        sender = self._connected_flow_session(1)
+        g = self._flow_send(sender, 1)[0]
+        # g is lost. Each 1 MiB frame above it is delivered and acknowledged, and the receiver still holds it behind
+        # the gap, so it keeps counting.
+        for offset in range(1, 5):
+            self.assertEqual([p.sequence for p in self._flow_send(sender, self.MIB)], [g.sequence + offset])
+            sender.receive(self._flow_ack(g.sequence + offset), 1)
+        self.assertEqual(len(self._flow_send(sender, self.MIB)), 0)
+        self.assertEqual(sender.queued_reliable_packet_count, 1)
+        with self.assertRaises(ValueError):
+            sender.send("state", bytes(self.MIB), CultNetRudpSendOptions(reliable=True))
+
+        # g arrives: nothing is held behind a gap any more, and the queue drains.
+        promoted = sender.receive(self._flow_ack(g.sequence), 2).ready_to_send
+        self.assertEqual([p.sequence for p in promoted], [g.sequence + 5])
+
+    def test_cultnet_rudp_acknowledged_bytes_count_against_the_lowest_unacked_sequence_as_it_advances(self) -> None:
+        sender = self._connected_flow_session(1)
+        g = self._flow_send(sender, 1)[0]
+        h = self._flow_send(sender, 1)[0]
+        for _ in range(3):
+            self._flow_send(sender, self.MIB)
+        # g and the 3 MiB above h are acknowledged; h is lost.
+        for offset in (2, 3, 4, 0):
+            sender.receive(self._flow_ack(g.sequence + offset), 1)
+        self.assertEqual([p.sequence for p in self._flow_send(sender, self.MIB)], [g.sequence + 5])
+        # 4 MiB sit above h, acknowledged or not: one more byte does not fit.
+        self.assertEqual(len(self._flow_send(sender, 1)), 0)
+        # h arrives, the floor moves to g + 5, and the byte fits.
+        promoted = sender.receive(self._flow_ack(h.sequence), 2).ready_to_send
+        self.assertEqual([p.sequence for p in promoted], [g.sequence + 6])
+
     def test_cultnet_rudp_socket_transport_handshakes_and_carries_reliable_ordered_schema_frames(self) -> None:
         server_socket = bind_udp_socket()
         client_socket = bind_udp_socket()
diff --git a/packages/cultnet-rs/src/rudp.rs b/packages/cultnet-rs/src/rudp.rs
index 7d8e6f12..f4b0616f 100644
--- a/packages/cultnet-rs/src/rudp.rs
+++ b/packages/cultnet-rs/src/rudp.rs
@@ -251,6 +251,11 @@ pub struct CultNetRudpSession {
     received_sequences: BTreeSet<u32>,
     latest_sequenced_by_channel: BTreeMap<String, u32>,
     pending_reliable: BTreeMap<u32, PendingReliablePacket>,
+    /// Payload sizes of acknowledged reliable sequences above the lowest
+    /// unacknowledged one. The receiver still holds those bytes behind the gap,
+    /// so the flow window keeps counting them until the lowest sequence
+    /// advances past them.
+    acked_above_lowest: BTreeMap<u32, usize>,
     queued_reliable: VecDeque<(CultNetRudpPacket, Option<u64>)>,
     reliable_packets_expired: u64,
     /// Every reliable sequence up to and including this one has been received
@@ -291,6 +296,7 @@ impl CultNetRudpSession {
             received_sequences: BTreeSet::new(),
             latest_sequenced_by_channel: BTreeMap::new(),
             pending_reliable: BTreeMap::new(),
+            acked_above_lowest: BTreeMap::new(),
             queued_reliable: VecDeque::new(),
             reliable_packets_expired: 0,
             received_through: None,
@@ -375,6 +381,7 @@ impl CultNetRudpSession {
         self.awaiting_accept = false;
         self.generation += 1;
         self.pending_reliable.clear();
+        self.acked_above_lowest.clear();
         self.queued_reliable.clear();
     }
 
@@ -1080,6 +1087,7 @@ impl CultNetRudpSession {
             .retain(|_, pending| pending.expires_at_ms.is_none_or(|at| now_ms <= at));
         self.queued_reliable
             .retain(|(_, expires_at_ms)| expires_at_ms.is_none_or(|at| now_ms <= at));
+        self.forget_acked_below_lowest();
         let after = self.pending_reliable.len() + self.queued_reliable.len();
         self.reliable_packets_expired = self
             .reliable_packets_expired
@@ -1096,12 +1104,14 @@ impl CultNetRudpSession {
         let Some((&lowest, _)) = self.pending_reliable.first_key_value() else {
             return true;
         };
-        let bytes_above: usize = self
+        let pending_bytes: usize = self
             .pending_reliable
             .iter()
             .filter(|(pending_sequence, _)| **pending_sequence > lowest)
             .map(|(_, pending)| pending.packet.payload.len())
             .sum();
+        let acked_bytes: usize = self.acked_above_lowest.values().sum();
+        let bytes_above = pending_bytes + acked_bytes;
         sequence.saturating_sub(lowest) <= RUDP_FLOW_WINDOW_SEQUENCES
             && bytes_above + payload_len <= RUDP_FLOW_WINDOW_BYTES
     }
@@ -1163,12 +1173,29 @@ impl CultNetRudpSession {
     }
 
     fn apply_acknowledgements(&mut self, packet: &CultNetRudpPacket) {
-        self.pending_reliable.remove(&packet.ack);
+        self.acknowledge(packet.ack);
         for bit in 0..32 {
             if (packet.ack_mask & (1_u32 << bit)) != 0 && packet.ack > bit {
-                self.pending_reliable.remove(&(packet.ack - bit - 1));
+                self.acknowledge(packet.ack - bit - 1);
             }
         }
+        self.forget_acked_below_lowest();
+    }
+
+    fn acknowledge(&mut self, sequence: u32) {
+        if let Some(pending) = self.pending_reliable.remove(&sequence) {
+            self.acked_above_lowest
+                .insert(sequence, pending.packet.payload.len());
+        }
+    }
+
+    /// Acknowledged sizes stop counting once the lowest unacknowledged
+    /// sequence passes them, and all of them stop when nothing is unacknowledged.
+    fn forget_acked_below_lowest(&mut self) {
+        match self.pending_reliable.first_key_value() {
+            Some((&lowest, _)) => self.acked_above_lowest.retain(|sequence, _| *sequence > lowest),
+            None => self.acked_above_lowest.clear(),
+        }
     }
 
     /// The handshake's one act on the watermark: the peer's Connect or Accept
diff --git a/packages/cultnet-rs/tests/rudp_flow_window.rs b/packages/cultnet-rs/tests/rudp_flow_window.rs
index 73b7f8e6..bc7493cc 100644
--- a/packages/cultnet-rs/tests/rudp_flow_window.rs
+++ b/packages/cultnet-rs/tests/rudp_flow_window.rs
@@ -172,3 +172,45 @@ fn a_small_packet_does_not_overtake_a_queued_large_one() -> Result<()> {
     assert_eq!(sequences(&promoted), vec![g.sequence + 2, g.sequence + 3]);
     Ok(())
 }
+
+#[test]
+fn acknowledged_bytes_above_a_lost_packet_still_count_against_4_mib() -> Result<()> {
+    let mut sender = connected(1)?;
+    let g = send(&mut sender, 1)?.remove(0);
+    // g is lost. Each 1 MiB frame above it is delivered and acknowledged, and
+    // the receiver still holds it behind the gap, so it keeps counting.
+    for offset in 1..=4u32 {
+        let sent = send(&mut sender, MIB)?;
+        assert_eq!(sequences(&sent), vec![g.sequence + offset]);
+        sender.receive(&ack_for(g.sequence + offset), 1)?;
+    }
+    assert!(send(&mut sender, MIB)?.is_empty());
+    assert_eq!(sender.queued_reliable_packet_count(), 1);
+    assert!(sender.send("state", vec![7; MIB], reliable()).is_err());
+
+    // g arrives: nothing is held behind a gap any more, and the queue drains.
+    let promoted = sender.receive(&ack_for(g.sequence), 2)?.ready_to_send;
+    assert_eq!(sequences(&promoted), vec![g.sequence + 5]);
+    Ok(())
+}
+
+#[test]
+fn acknowledged_bytes_count_against_the_lowest_unacked_sequence_as_it_advances() -> Result<()> {
+    let mut sender = connected(1)?;
+    let g = send(&mut sender, 1)?.remove(0);
+    let h = send(&mut sender, 1)?.remove(0);
+    for _ in 0..3 {
+        send(&mut sender, MIB)?;
+    }
+    // g and the 3 MiB above h are acknowledged; h is lost.
+    for offset in [2, 3, 4, 0] {
+        sender.receive(&ack_for(g.sequence + offset), 1)?;
+    }
+    assert_eq!(sequences(&send(&mut sender, MIB)?), vec![g.sequence + 5]);
+    // 4 MiB sit above h, acknowledged or not: one more byte does not fit.
+    assert!(send(&mut sender, 1)?.is_empty());
+    // h arrives, the floor moves to g + 5, and the byte fits.
+    let promoted = sender.receive(&ack_for(h.sequence), 2)?.ready_to_send;
+    assert_eq!(sequences(&promoted), vec![g.sequence + 6]);
+    Ok(())
+}
diff --git a/packages/cultnet-ts/src/rudp.ts b/packages/cultnet-ts/src/rudp.ts
index e072e225..ae696536 100644
--- a/packages/cultnet-ts/src/rudp.ts
+++ b/packages/cultnet-ts/src/rudp.ts
@@ -203,6 +203,9 @@ export class CultNetRudpSession {
   readonly #receivedSequences = new Set<number>();
   readonly #latestSequencedByChannel = new Map<string, number>();
   readonly #pendingReliable = new Map<number, PendingReliablePacket>();
+  /// Payload sizes of acknowledged reliable sequences above the lowest unacknowledged one. The receiver still holds
+  /// those bytes behind the gap, so the flow window keeps counting them until the lowest sequence passes them.
+  readonly #ackedAboveLowest = new Map<number, number>();
   readonly #queuedReliable: CultNetRudpPacket[] = [];
   /// Every reliable sequence up to and including this one has been received
   /// since the peer state was last reset. Only the handshake seeds it: the
@@ -285,6 +288,7 @@ export class CultNetRudpSession {
     this.#awaitingAccept = false;
     this.#generation += 1;
     this.#pendingReliable.clear();
+    this.#ackedAboveLowest.clear();
     this.#queuedReliable.splice(0);
   }
 
@@ -756,6 +760,7 @@ export class CultNetRudpSession {
     for (const [pendingSequence, pending] of this.#pendingReliable) {
       if (pendingSequence > lowest) bytesAbove += pending.packet.payload?.length ?? 0;
     }
+    for (const length of this.#ackedAboveLowest.values()) bytesAbove += length;
     return sequence - lowest <= RUDP_FLOW_WINDOW_SEQUENCES && bytesAbove + payloadLength <= RUDP_FLOW_WINDOW_BYTES;
   }
 
@@ -794,12 +799,33 @@ export class CultNetRudpSession {
   }
 
   #applyAcknowledgements(packet: CultNetRudpPacket): void {
-    this.#pendingReliable.delete(packet.ack);
+    this.#acknowledge(packet.ack);
     for (let bit = 0; bit < 32; bit += 1) {
       if ((packet.ackMask & (1 << bit)) !== 0) {
-        this.#pendingReliable.delete(packet.ack - bit - 1);
+        this.#acknowledge(packet.ack - bit - 1);
       }
     }
+    this.#forgetAckedBelowLowest();
+  }
+
+  #acknowledge(sequence: number): void {
+    const pending = this.#pendingReliable.get(sequence);
+    if (pending === undefined) return;
+    this.#pendingReliable.delete(sequence);
+    this.#ackedAboveLowest.set(sequence, pending.packet.payload?.length ?? 0);
+  }
+
+  /// Acknowledged sizes stop counting once the lowest unacknowledged sequence passes them, and all of them stop
+  /// when nothing is unacknowledged.
+  #forgetAckedBelowLowest(): void {
+    if (this.#pendingReliable.size === 0) {
+      this.#ackedAboveLowest.clear();
+      return;
+    }
+    const lowest = Math.min(...this.#pendingReliable.keys());
+    for (const sequence of this.#ackedAboveLowest.keys()) {
+      if (sequence <= lowest) this.#ackedAboveLowest.delete(sequence);
+    }
   }
 
   /// The handshake's one act on the watermark: the peer's Connect or Accept is
diff --git a/packages/cultnet-ts/test/cultnet.test.ts b/packages/cultnet-ts/test/cultnet.test.ts
index f3c1612b..c921cb0d 100644
--- a/packages/cultnet-ts/test/cultnet.test.ts
+++ b/packages/cultnet-ts/test/cultnet.test.ts
@@ -1524,6 +1524,37 @@ test("a small packet does not overtake a queued large one", () => {
   assert.deepEqual(sequencesOf(sender.receive(flowAck(g.sequence), 1).readyToSend ?? []), [g.sequence + 2, g.sequence + 3]);
 });
 
+test("acknowledged bytes above a lost packet still count against 4 MiB", () => {
+  const sender = connectedFlowSession(1);
+  const g = flowSend(sender, 1)[0]!;
+  // g is lost. Each 1 MiB frame above it is delivered and acknowledged, and the receiver still holds it behind the
+  // gap, so it keeps counting.
+  for (let offset = 1; offset <= 4; offset++) {
+    assert.deepEqual(sequencesOf(flowSend(sender, MIB)), [g.sequence + offset]);
+    sender.receive(flowAck(g.sequence + offset), 1);
+  }
+  assert.equal(flowSend(sender, MIB).length, 0);
+  assert.equal(sender.queuedReliablePacketCount, 1);
+  assert.throws(() => sender.send("state", new Uint8Array(MIB), { reliable: true }));
+
+  // g arrives: nothing is held behind a gap any more, and the queue drains.
+  assert.deepEqual(sequencesOf(sender.receive(flowAck(g.sequence), 2).readyToSend ?? []), [g.sequence + 5]);
+});
+
+test("acknowledged bytes count against the lowest unacked sequence as it advances", () => {
+  const sender = connectedFlowSession(1);
+  const g = flowSend(sender, 1)[0]!;
+  const h = flowSend(sender, 1)[0]!;
+  for (let index = 0; index < 3; index++) flowSend(sender, MIB);
+  // g and the 3 MiB above h are acknowledged; h is lost.
+  for (const offset of [2, 3, 4, 0]) sender.receive(flowAck(g.sequence + offset), 1);
+  assert.deepEqual(sequencesOf(flowSend(sender, MIB)), [g.sequence + 5]);
+  // 4 MiB sit above h, acknowledged or not: one more byte does not fit.
+  assert.equal(flowSend(sender, 1).length, 0);
+  // h arrives, the floor moves to g + 5, and the byte fits.
+  assert.deepEqual(sequencesOf(sender.receive(flowAck(h.sequence), 2).readyToSend ?? []), [g.sequence + 6]);
+});
+
 test("CultNet contracts encode legacy bytes without Node Buffer authority", () => {
   const originalBuffer = globalThis.Buffer;
   try {
diff --git a/src/GameCult.Networking/CultNetTransport.cs b/src/GameCult.Networking/CultNetTransport.cs
index 6501fd3d..9731b7f9 100644
--- a/src/GameCult.Networking/CultNetTransport.cs
+++ b/src/GameCult.Networking/CultNetTransport.cs
@@ -939,6 +939,9 @@ namespace GameCult.Networking
         private readonly Dictionary<string, uint> _latestSequencedByChannel = new Dictionary<string, uint>(StringComparer.Ordinal);
         private readonly object _pendingReliableGate = new object();
         private readonly Dictionary<uint, PendingReliablePacket> _pendingReliable = new Dictionary<uint, PendingReliablePacket>();
+        // Payload sizes of acknowledged reliable sequences above the lowest unacknowledged one. The receiver still
+        // holds those bytes behind the gap, so the flow window keeps counting them until the lowest sequence passes them.
+        private readonly Dictionary<uint, int> _ackedAboveLowest = new Dictionary<uint, int>();
         private readonly Queue<CultNetRudpPacket> _queuedReliable = new Queue<CultNetRudpPacket>();
         // Every reliable sequence up to and including this one has been received since the peer state
         // was last reset. Only the handshake seeds it: the peer's Connect on the accepting side, the
@@ -1424,6 +1427,7 @@ namespace GameCult.Networking
             lock (_pendingReliableGate)
             {
                 _pendingReliable.Clear();
+                _ackedAboveLowest.Clear();
                 _queuedReliable.Clear();
             }
         }
@@ -1595,6 +1599,8 @@ namespace GameCult.Networking
                 if (pending.Key > lowest)
                     bytesAbove += pending.Value.Packet.Payload.Length;
             }
+            foreach (var length in _ackedAboveLowest.Values)
+                bytesAbove += length;
             return sequence - lowest <= FlowWindowSequences && bytesAbove + payloadLength <= FlowWindowBytes;
         }
 
@@ -1665,17 +1671,36 @@ namespace GameCult.Networking
         {
             lock (_pendingReliableGate)
             {
-                _pendingReliable.Remove(packet.Ack);
+                Acknowledge(packet.Ack);
                 for (var bit = 0; bit < 32; bit++)
                 {
                     if ((packet.AckMask & (1u << bit)) != 0 && packet.Ack > bit)
                     {
-                        _pendingReliable.Remove(packet.Ack - (uint)bit - 1);
+                        Acknowledge(packet.Ack - (uint)bit - 1);
                     }
                 }
+                // Acknowledged sizes stop counting once the lowest unacknowledged sequence passes them, and all
+                // of them stop when nothing is unacknowledged.
+                if (_pendingReliable.Count == 0)
+                {
+                    _ackedAboveLowest.Clear();
+                }
+                else
+                {
+                    var lowest = _pendingReliable.Keys.Min();
+                    foreach (var sequence in _ackedAboveLowest.Keys.Where(sequence => sequence <= lowest).ToArray())
+                        _ackedAboveLowest.Remove(sequence);
+                }
             }
         }
 
+        // Callers hold the pending gate.
+        private void Acknowledge(uint sequence)
+        {
+            if (_pendingReliable.Remove(sequence, out var pending))
+                _ackedAboveLowest[sequence] = pending.Packet.Payload.Length;
+        }
+
         private static bool PacketAcknowledges(CultNetRudpPacket packet, uint sequence)
         {
             if (packet.Ack == sequence)
diff --git a/tests/GameCult.Networking.Tests/NetworkingTests.cs b/tests/GameCult.Networking.Tests/NetworkingTests.cs
index 15091ec3..fbd422ce 100644
--- a/tests/GameCult.Networking.Tests/NetworkingTests.cs
+++ b/tests/GameCult.Networking.Tests/NetworkingTests.cs
@@ -1265,6 +1265,46 @@ namespace GameCult.Networking.Tests
             Assert.That(promoted.Select(packet => packet.Sequence), Is.EqualTo(new[] { g.Sequence + 2, g.Sequence + 3 }));
         }
 
+        [Test]
+        public void RudpSession_AcknowledgedBytesAboveALostPacketStillCountAgainst4MiB()
+        {
+            var sender = ConnectedFlowSession(1);
+            var g = FlowSend(sender, 1).Single();
+            // g is lost. Each 1 MiB frame above it is delivered and acknowledged, and the receiver still holds it
+            // behind the gap, so it keeps counting.
+            for (uint offset = 1; offset <= 4; offset++)
+            {
+                Assert.That(FlowSend(sender, Mib).Select(packet => packet.Sequence), Is.EqualTo(new[] { g.Sequence + offset }));
+                sender.Receive(FlowAck(g.Sequence + offset), 1);
+            }
+            Assert.That(FlowSend(sender, Mib), Is.Empty);
+            Assert.That(sender.QueuedReliablePacketCount, Is.EqualTo(1));
+            Assert.Throws<InvalidOperationException>(() => sender.Send("state", new byte[Mib], new CultNetRudpSendOptions { Reliable = true }));
+
+            // g arrives: nothing is held behind a gap any more, and the queue drains.
+            var promoted = sender.Receive(FlowAck(g.Sequence), 2).ReadyToSend;
+            Assert.That(promoted.Select(packet => packet.Sequence), Is.EqualTo(new[] { g.Sequence + 5 }));
+        }
+
+        [Test]
+        public void RudpSession_AcknowledgedBytesCountAgainstTheLowestUnackedSequenceAsItAdvances()
+        {
+            var sender = ConnectedFlowSession(1);
+            var g = FlowSend(sender, 1).Single();
+            var h = FlowSend(sender, 1).Single();
+            for (var index = 0; index < 3; index++)
+                FlowSend(sender, Mib);
+            // g and the 3 MiB above h are acknowledged; h is lost.
+            foreach (uint offset in new uint[] { 2, 3, 4, 0 })
+                sender.Receive(FlowAck(g.Sequence + offset), 1);
+            Assert.That(FlowSend(sender, Mib).Select(packet => packet.Sequence), Is.EqualTo(new[] { g.Sequence + 5 }));
+            // 4 MiB sit above h, acknowledged or not: one more byte does not fit.
+            Assert.That(FlowSend(sender, 1), Is.Empty);
+            // h arrives, the floor moves to g + 5, and the byte fits.
+            var promoted = sender.Receive(FlowAck(h.Sequence), 2).ReadyToSend;
+            Assert.That(promoted.Select(packet => packet.Sequence), Is.EqualTo(new[] { g.Sequence + 6 }));
+        }
+
         [Test]
         public void RudpSocketTransport_HandshakesAndCarriesReliableOrderedSchemaFrames()
         {

From 0daf6f4cc0279d02738a10c0a6a4faa047c2571b Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 12:07:28 +0200
Subject: [PATCH 09/24] Ack Cut 3 F1: Rust pins that an expired lowest packet
 releases the acknowledged bytes above it

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 packages/cultnet-rs/tests/rudp_flow_window.rs | 33 +++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/packages/cultnet-rs/tests/rudp_flow_window.rs b/packages/cultnet-rs/tests/rudp_flow_window.rs
index bc7493cc..94869ce6 100644
--- a/packages/cultnet-rs/tests/rudp_flow_window.rs
+++ b/packages/cultnet-rs/tests/rudp_flow_window.rs
@@ -214,3 +214,36 @@ fn acknowledged_bytes_count_against_the_lowest_unacked_sequence_as_it_advances()
     assert_eq!(sequences(&promoted), vec![g.sequence + 6]);
     Ok(())
 }
+
+#[test]
+fn acknowledged_bytes_stop_counting_when_the_lowest_unacked_packet_expires() -> Result<()> {
+    let mut sender = connected(1)?;
+    let expiring = CultNetRudpSendOptions {
+        reliable: true,
+        now_ms: 0,
+        reliable_expire_after_ms: Some(100),
+        ..Default::default()
+    };
+    let g = sender
+        .send_many("state", vec![7], expiring, None)?
+        .remove(0);
+    for offset in 1..=4u32 {
+        assert_eq!(send(&mut sender, MIB)?.len(), 1);
+        sender.receive(&ack_for(g.sequence + offset), 1)?;
+    }
+    assert!(sender.send("state", vec![7; MIB], reliable()).is_err());
+
+    // g's deadline passes and it leaves the window; nothing is unacked, so the
+    // acknowledged bytes no longer sit above any gap.
+    let at = |now_ms| CultNetRudpSendOptions {
+        reliable: true,
+        now_ms,
+        ..Default::default()
+    };
+    let first = sender.send_many("state", vec![7], at(200), None)?;
+    assert_eq!(first.len(), 1);
+    for _ in 0..4 {
+        assert_eq!(sender.send_many("state", vec![7; MIB], at(200), None)?.len(), 1);
+    }
+    Ok(())
+}

From 436b4237629362e90386a603f6144077e489d27d Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 12:12:23 +0200
Subject: [PATCH 10/24] Ack Cut 3 F1: the acknowledged-bytes tests pin pruning
 on the ack that closes the gap

The bytes counted above a lost packet stop counting once it is acknowledged;
every runtime now asserts that another MiB is admitted after the gap closes.
Rust prunes on expiry only when something expired, so the acknowledgement path
owns the pruning it can observe.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 packages/cultnet-py/tests/test_cultnet.py          | 2 ++
 packages/cultnet-rs/src/rudp.rs                    | 4 +++-
 packages/cultnet-rs/tests/rudp_flow_window.rs      | 2 ++
 packages/cultnet-ts/test/cultnet.test.ts           | 2 ++
 tests/GameCult.Networking.Tests/NetworkingTests.cs | 2 ++
 5 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/packages/cultnet-py/tests/test_cultnet.py b/packages/cultnet-py/tests/test_cultnet.py
index f11eb1ce..4882e2d9 100644
--- a/packages/cultnet-py/tests/test_cultnet.py
+++ b/packages/cultnet-py/tests/test_cultnet.py
@@ -996,6 +996,8 @@ class CultNetTests(unittest.TestCase):
         # g arrives: nothing is held behind a gap any more, and the queue drains.
         promoted = sender.receive(self._flow_ack(g.sequence), 2).ready_to_send
         self.assertEqual([p.sequence for p in promoted], [g.sequence + 5])
+        # The bytes above the old gap no longer count: another MiB fits.
+        self.assertEqual([p.sequence for p in self._flow_send(sender, self.MIB)], [g.sequence + 6])
 
     def test_cultnet_rudp_acknowledged_bytes_count_against_the_lowest_unacked_sequence_as_it_advances(self) -> None:
         sender = self._connected_flow_session(1)
diff --git a/packages/cultnet-rs/src/rudp.rs b/packages/cultnet-rs/src/rudp.rs
index f4b0616f..bf611a15 100644
--- a/packages/cultnet-rs/src/rudp.rs
+++ b/packages/cultnet-rs/src/rudp.rs
@@ -1087,8 +1087,10 @@ impl CultNetRudpSession {
             .retain(|_, pending| pending.expires_at_ms.is_none_or(|at| now_ms <= at));
         self.queued_reliable
             .retain(|(_, expires_at_ms)| expires_at_ms.is_none_or(|at| now_ms <= at));
-        self.forget_acked_below_lowest();
         let after = self.pending_reliable.len() + self.queued_reliable.len();
+        if after != before {
+            self.forget_acked_below_lowest();
+        }
         self.reliable_packets_expired = self
             .reliable_packets_expired
             .saturating_add((before - after) as u64);
diff --git a/packages/cultnet-rs/tests/rudp_flow_window.rs b/packages/cultnet-rs/tests/rudp_flow_window.rs
index 94869ce6..85c7a864 100644
--- a/packages/cultnet-rs/tests/rudp_flow_window.rs
+++ b/packages/cultnet-rs/tests/rudp_flow_window.rs
@@ -191,6 +191,8 @@ fn acknowledged_bytes_above_a_lost_packet_still_count_against_4_mib() -> Result<
     // g arrives: nothing is held behind a gap any more, and the queue drains.
     let promoted = sender.receive(&ack_for(g.sequence), 2)?.ready_to_send;
     assert_eq!(sequences(&promoted), vec![g.sequence + 5]);
+    // The bytes above the old gap no longer count: another MiB fits.
+    assert_eq!(sequences(&send(&mut sender, MIB)?), vec![g.sequence + 6]);
     Ok(())
 }
 
diff --git a/packages/cultnet-ts/test/cultnet.test.ts b/packages/cultnet-ts/test/cultnet.test.ts
index c921cb0d..17865e03 100644
--- a/packages/cultnet-ts/test/cultnet.test.ts
+++ b/packages/cultnet-ts/test/cultnet.test.ts
@@ -1539,6 +1539,8 @@ test("acknowledged bytes above a lost packet still count against 4 MiB", () => {
 
   // g arrives: nothing is held behind a gap any more, and the queue drains.
   assert.deepEqual(sequencesOf(sender.receive(flowAck(g.sequence), 2).readyToSend ?? []), [g.sequence + 5]);
+  // The bytes above the old gap no longer count: another MiB fits.
+  assert.deepEqual(sequencesOf(flowSend(sender, MIB)), [g.sequence + 6]);
 });
 
 test("acknowledged bytes count against the lowest unacked sequence as it advances", () => {
diff --git a/tests/GameCult.Networking.Tests/NetworkingTests.cs b/tests/GameCult.Networking.Tests/NetworkingTests.cs
index fbd422ce..d66d2aff 100644
--- a/tests/GameCult.Networking.Tests/NetworkingTests.cs
+++ b/tests/GameCult.Networking.Tests/NetworkingTests.cs
@@ -1284,6 +1284,8 @@ namespace GameCult.Networking.Tests
             // g arrives: nothing is held behind a gap any more, and the queue drains.
             var promoted = sender.Receive(FlowAck(g.Sequence), 2).ReadyToSend;
             Assert.That(promoted.Select(packet => packet.Sequence), Is.EqualTo(new[] { g.Sequence + 5 }));
+            // The bytes above the old gap no longer count: another MiB fits.
+            Assert.That(FlowSend(sender, Mib).Select(packet => packet.Sequence), Is.EqualTo(new[] { g.Sequence + 6 }));
         }
 
         [Test]

From 88d2d72405831edcf5c29fc8fc9a00bb809a7b37 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 13:37:21 +0200
Subject: [PATCH 11/24] cultnet-rs: an RUDP client for a remote endpoint binds
 the unspecified address

CultMeshRudpSocketOptions defaulted bind_host to 127.0.0.1 for servers and
clients alike. On Windows a socket bound to loopback cannot send off the host
(os error 10051), so a default client could never reach a remote endpoint such
as rudp://10.77.0.1:17872.

bind_host is now Option<String>. Unset, a server still binds 127.0.0.1; a client
binds loopback for a loopback endpoint and the unspecified address of the
endpoint's family (0.0.0.0 or ::) otherwise. An explicit bind_host wins for both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/cultnet-rs/src/cultmesh.rs  | 37 +++++++++++++---
 packages/cultnet-rs/tests/cultnet.rs | 65 ++++++++++++++++++++++++++++
 2 files changed, 95 insertions(+), 7 deletions(-)

diff --git a/packages/cultnet-rs/src/cultmesh.rs b/packages/cultnet-rs/src/cultmesh.rs
index 900f4744..920a9f1f 100644
--- a/packages/cultnet-rs/src/cultmesh.rs
+++ b/packages/cultnet-rs/src/cultmesh.rs
@@ -3,6 +3,9 @@ use anyhow::anyhow;
 use chrono::DateTime;
 use chrono::Utc;
 use std::collections::BTreeMap;
+use std::net::IpAddr;
+use std::net::Ipv4Addr;
+use std::net::Ipv6Addr;
 use std::net::SocketAddr;
 use std::net::ToSocketAddrs;
 use std::net::UdpSocket;
@@ -240,7 +243,10 @@ impl CultNetRudpEndpoint {
 
 #[derive(Clone, Debug)]
 pub struct CultMeshRudpSocketOptions {
-    pub bind_host: String,
+    /// Local address to bind. Unset, a server binds loopback, and a client binds
+    /// loopback for a loopback endpoint and the unspecified address of the
+    /// endpoint's family otherwise, so it can reach a remote host.
+    pub bind_host: Option<String>,
     pub bind_port: u16,
     pub read_timeout: Option<Duration>,
     pub initial_sequence: Option<u32>,
@@ -253,7 +259,7 @@ pub struct CultMeshRudpSocketOptions {
 impl Default for CultMeshRudpSocketOptions {
     fn default() -> Self {
         Self {
-            bind_host: "127.0.0.1".to_string(),
+            bind_host: None,
             bind_port: 0,
             read_timeout: Some(Duration::from_millis(20)),
             initial_sequence: None,
@@ -316,7 +322,8 @@ impl CultMesh {
         connection_id: u32,
         options: CultMeshRudpSocketOptions,
     ) -> Result<CultNetRudpSocketTransportConnection> {
-        let socket = bind_rudp_socket(&options)?;
+        let bind_host = options.bind_host.as_deref().unwrap_or("127.0.0.1");
+        let socket = bind_rudp_socket(bind_host, &options)?;
         CultNetRudpSocketTransportConnection::new(CultNetRudpSocketTransportOptions {
             media_reliable_expire_after_ms: None,
             media_delivery: None,
@@ -341,14 +348,19 @@ impl CultMesh {
         endpoint: &CultNetRudpEndpoint,
         options: CultMeshRudpSocketOptions,
     ) -> Result<CultNetRudpSocketTransportConnection> {
-        let socket = bind_rudp_socket(&options)?;
+        let remote_addr = endpoint.socket_addr()?;
+        let bind_host = match options.bind_host.as_deref() {
+            Some(host) => host.to_string(),
+            None => client_bind_ip(remote_addr).to_string(),
+        };
+        let socket = bind_rudp_socket(&bind_host, &options)?;
         CultNetRudpSocketTransportConnection::new(CultNetRudpSocketTransportOptions {
             media_reliable_expire_after_ms: None,
             media_delivery: None,
             runtime_id: runtime_id.into(),
             socket,
             mode: CultNetRudpSocketMode::Client,
-            remote_addr: Some(endpoint.socket_addr()?),
+            remote_addr: Some(remote_addr),
             connection_id,
             initial_sequence: options.initial_sequence,
             resend_delay_ms: options.resend_delay_ms,
@@ -503,10 +515,21 @@ pub fn cultnet_rudp_endpoint(endpoint: &str) -> Result<CultNetRudpEndpoint> {
     Ok(CultNetRudpEndpoint { host, port })
 }
 
-fn bind_rudp_socket(options: &CultMeshRudpSocketOptions) -> Result<UdpSocket> {
+/// A socket bound to loopback cannot send off the host on Windows, so a client
+/// keeps loopback only when its peer is on loopback.
+fn client_bind_ip(remote_addr: SocketAddr) -> IpAddr {
+    match (remote_addr.ip().is_loopback(), remote_addr) {
+        (true, SocketAddr::V4(_)) => IpAddr::V4(Ipv4Addr::LOCALHOST),
+        (true, SocketAddr::V6(_)) => IpAddr::V6(Ipv6Addr::LOCALHOST),
+        (false, SocketAddr::V4(_)) => IpAddr::V4(Ipv4Addr::UNSPECIFIED),
+        (false, SocketAddr::V6(_)) => IpAddr::V6(Ipv6Addr::UNSPECIFIED),
+    }
+}
+
+fn bind_rudp_socket(bind_host: &str, options: &CultMeshRudpSocketOptions) -> Result<UdpSocket> {
     let socket = UdpSocket::bind(format!(
         "{}:{}",
-        socket_host(&options.bind_host),
+        socket_host(bind_host),
         options.bind_port
     ))?;
     socket.set_read_timeout(options.read_timeout)?;
diff --git a/packages/cultnet-rs/tests/cultnet.rs b/packages/cultnet-rs/tests/cultnet.rs
index 46e6b2e2..2f4572d9 100644
--- a/packages/cultnet-rs/tests/cultnet.rs
+++ b/packages/cultnet-rs/tests/cultnet.rs
@@ -1334,6 +1334,71 @@ fn rudp_socket_flush_waits_for_large_fragment_delivery() -> Result<()> {
     Ok(())
 }
 
+fn rudp_client_bound_host(endpoint: &str, bind_host: Option<&str>) -> Result<String> {
+    let client = CultMesh::create_rudp_client_for_endpoint(
+        "rust-cultmesh-bind-client",
+        0x2030_4060,
+        endpoint,
+        CultMeshRudpSocketOptions {
+            bind_host: bind_host.map(str::to_string),
+            ..CultMeshRudpSocketOptions::default()
+        },
+    )?;
+    Ok(client.profile.transports[0]
+        .host
+        .clone()
+        .expect("RUDP client profile advertises its bound host"))
+}
+
+/// A client bound to loopback cannot send to another host on Windows, so a
+/// client for a remote endpoint binds the unspecified address of its family.
+#[test]
+fn cultmesh_rudp_client_for_a_remote_endpoint_binds_the_unspecified_address() -> Result<()> {
+    assert_eq!(rudp_client_bound_host("rudp://10.77.0.1:17872", None)?, "0.0.0.0");
+    assert_eq!(rudp_client_bound_host("rudp://[2001:db8::1]:17872", None)?, "::");
+    Ok(())
+}
+
+#[test]
+fn cultmesh_rudp_client_for_a_loopback_endpoint_binds_loopback() -> Result<()> {
+    assert_eq!(rudp_client_bound_host("rudp://127.0.0.1:17872", None)?, "127.0.0.1");
+    assert_eq!(rudp_client_bound_host("rudp://[::1]:17872", None)?, "::1");
+    Ok(())
+}
+
+#[test]
+fn cultmesh_rudp_client_binds_an_explicit_bind_host_whatever_the_endpoint() -> Result<()> {
+    assert_eq!(
+        rudp_client_bound_host("rudp://10.77.0.1:17872", Some("127.0.0.1"))?,
+        "127.0.0.1"
+    );
+    assert_eq!(
+        rudp_client_bound_host("rudp://127.0.0.1:17872", Some("0.0.0.0"))?,
+        "0.0.0.0"
+    );
+    Ok(())
+}
+
+#[test]
+fn cultmesh_rudp_server_binds_loopback_unless_told_otherwise() -> Result<()> {
+    let server = CultMesh::create_rudp_server(
+        "rust-cultmesh-bind-server",
+        0x2030_4061,
+        CultMeshRudpSocketOptions::default(),
+    )?;
+    assert_eq!(server.profile.transports[0].host.as_deref(), Some("127.0.0.1"));
+    let server = CultMesh::create_rudp_server(
+        "rust-cultmesh-bind-server",
+        0x2030_4062,
+        CultMeshRudpSocketOptions {
+            bind_host: Some("0.0.0.0".to_string()),
+            ..CultMeshRudpSocketOptions::default()
+        },
+    )?;
+    assert_eq!(server.profile.transports[0].host.as_deref(), Some("0.0.0.0"));
+    Ok(())
+}
+
 #[test]
 fn cultmesh_facade_creates_rudp_client_from_peer_endpoint() -> Result<()> {
     let connection_id = 0x2030_4050;

From b68ddfe3572871d3af8d4d61140c773a16c51a63 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 13:41:44 +0200
Subject: [PATCH 12/24] cultnet-ts, cultmesh-ts: an RUDP client for a remote
 endpoint binds the unspecified address

CultMesh.createRudpClient defaulted bindHost to 127.0.0.1 on a udp4 socket, and
invokeCultNetOperation bound 127.0.0.1 unconditionally. On Windows a socket
bound to loopback cannot send off the host (os error 10051), so neither could
reach a remote endpoint.

cultnet-ts now owns the rule in rudpClientBindHost: loopback for a loopback
endpoint, otherwise the unspecified address of the endpoint's family (0.0.0.0
or ::). The operation client and the CultMesh client both use it, and the
CultMesh socket family follows the bind host. An explicit bindHost still wins;
a CultMesh server still binds 127.0.0.1 unless told otherwise.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/cultmesh-ts/src/index.ts            | 18 +++++---
 packages/cultmesh-ts/test/cultmesh.test.ts   | 38 +++++++++++++++++
 packages/cultnet-ts/src/index.ts             |  1 +
 packages/cultnet-ts/src/operation-service.ts |  6 ++-
 packages/cultnet-ts/src/rudp.ts              | 14 +++++++
 packages/cultnet-ts/test/cultnet.test.ts     | 44 +++++++++++++++++++-
 6 files changed, 113 insertions(+), 8 deletions(-)

diff --git a/packages/cultmesh-ts/src/index.ts b/packages/cultmesh-ts/src/index.ts
index b89cd823..e9813e18 100644
--- a/packages/cultmesh-ts/src/index.ts
+++ b/packages/cultmesh-ts/src/index.ts
@@ -14,6 +14,7 @@ import {
   CultNetRudpSession,
   CultNetPeer,
   CultNetRudpSocketTransportConnection,
+  rudpClientBindHost,
   CultNetSchemaCatalog,
   CultNetShardCatalog,
   cultNetBuiltinSchemaRegistry,
@@ -4330,6 +4331,11 @@ export interface CultMeshRudpEndpoint {
 }
 
 export interface CultMeshRudpSocketOptions {
+  /**
+   * Local address to bind. Unset, a server binds loopback, and a client binds
+   * loopback for a loopback endpoint and the unspecified address of the
+   * endpoint's family otherwise, so it can reach a remote host.
+   */
   bindHost?: string;
   bindPort?: number;
   socket?: Socket;
@@ -6135,7 +6141,7 @@ export class CultMesh {
     options: CultMeshRudpSocketOptions = {},
   ): Promise<CultNetRudpSocketTransportConnection> {
     requireNonEmpty(runtimeId, "runtimeId");
-    const socket = options.socket ?? (await bindRudpSocket(options));
+    const socket = options.socket ?? (await bindRudpSocket(options.bindHost ?? "127.0.0.1", options));
     return new CultNetRudpSocketTransportConnection({
       runtimeId,
       socket,
@@ -6161,7 +6167,10 @@ export class CultMesh {
     requireNonEmpty(runtimeId, "runtimeId");
     const parsedEndpoint =
       typeof endpoint === "string" ? CultMesh.parseRudpEndpoint(endpoint) : endpoint;
-    const socket = options.socket ?? (await bindRudpSocket(options));
+    const socket = options.socket ?? (await bindRudpSocket(
+      options.bindHost ?? (await rudpClientBindHost(parsedEndpoint.host)),
+      options,
+    ));
     return new CultNetRudpSocketTransportConnection({
       runtimeId,
       socket,
@@ -6586,9 +6595,8 @@ function toUint8Array(value: unknown): Uint8Array {
   throw new Error("CultNet raw document payload was not binary.");
 }
 
-async function bindRudpSocket(options: CultMeshRudpSocketOptions): Promise<Socket> {
-  const socket = createSocket("udp4");
-  const host = options.bindHost ?? "127.0.0.1";
+async function bindRudpSocket(host: string, options: CultMeshRudpSocketOptions): Promise<Socket> {
+  const socket = createSocket(host.includes(":") ? "udp6" : "udp4");
   const port = options.bindPort ?? 0;
   await new Promise<void>((resolve, reject) => {
     socket.once("error", reject);
diff --git a/packages/cultmesh-ts/test/cultmesh.test.ts b/packages/cultmesh-ts/test/cultmesh.test.ts
index 3954c697..7d0c43c4 100644
--- a/packages/cultmesh-ts/test/cultmesh.test.ts
+++ b/packages/cultmesh-ts/test/cultmesh.test.ts
@@ -2547,6 +2547,44 @@ test("CultMesh TS branded facade exposes schema and shard catalogs", () => {
   );
 });
 
+async function rudpClientBoundHost(endpoint: string, bindHost?: string): Promise<string | undefined> {
+  const client = await CultMesh.createRudpClient("cultmesh-ts-bind-client", 0x10203060, endpoint, { bindHost });
+  try {
+    return client.profile.transports[0]?.host;
+  } finally {
+    client.close();
+  }
+}
+
+// A client bound to loopback cannot send to another host on Windows, so a
+// client for a remote endpoint binds the unspecified address of its family.
+test("CultMesh TS RUDP client for a remote endpoint binds the unspecified address", async () => {
+  assert.equal(await rudpClientBoundHost("rudp://10.77.0.1:17872"), "0.0.0.0");
+  assert.equal(await rudpClientBoundHost("rudp://[2001:db8::1]:17872"), "::");
+});
+
+test("CultMesh TS RUDP client for a loopback endpoint binds loopback", async () => {
+  assert.equal(await rudpClientBoundHost("rudp://127.0.0.1:17872"), "127.0.0.1");
+  assert.equal(await rudpClientBoundHost("rudp://[::1]:17872"), "::1");
+});
+
+test("CultMesh TS RUDP client binds an explicit bindHost whatever the endpoint", async () => {
+  assert.equal(await rudpClientBoundHost("rudp://10.77.0.1:17872", "127.0.0.1"), "127.0.0.1");
+  assert.equal(await rudpClientBoundHost("rudp://127.0.0.1:17872", "0.0.0.0"), "0.0.0.0");
+});
+
+test("CultMesh TS RUDP server binds loopback unless told otherwise", async () => {
+  const loopback = await CultMesh.createRudpServer("cultmesh-ts-bind-server", 0x10203061);
+  const any = await CultMesh.createRudpServer("cultmesh-ts-bind-server", 0x10203062, { bindHost: "0.0.0.0" });
+  try {
+    assert.equal(loopback.profile.transports[0]?.host, "127.0.0.1");
+    assert.equal(any.profile.transports[0]?.host, "0.0.0.0");
+  } finally {
+    loopback.close();
+    any.close();
+  }
+});
+
 test("CultMesh TS branded facade creates RUDP clients from peer endpoints", async () => {
   const connectionId = 0x10203044;
   const server = await CultMesh.createRudpServer(
diff --git a/packages/cultnet-ts/src/index.ts b/packages/cultnet-ts/src/index.ts
index 8950f638..9309b05b 100644
--- a/packages/cultnet-ts/src/index.ts
+++ b/packages/cultnet-ts/src/index.ts
@@ -106,6 +106,7 @@ export {
   createRudpTransportProfile,
   decodeRudpPacket,
   encodeRudpPacket,
+  rudpClientBindHost,
   CULTNET_RUDP_RELIABLE_SEND_WINDOW_PACKETS,
   CultNetRudpReconnectLoop,
   CultNetRudpSession,
diff --git a/packages/cultnet-ts/src/operation-service.ts b/packages/cultnet-ts/src/operation-service.ts
index 606cd418..fa116c07 100644
--- a/packages/cultnet-ts/src/operation-service.ts
+++ b/packages/cultnet-ts/src/operation-service.ts
@@ -12,6 +12,7 @@ import {
   CultNetRudpSocketTransportConnection,
   decodeRudpPacket,
   encodeRudpPacket,
+  rudpClientBindHost,
   type CultNetRudpPacket,
 } from "./rudp";
 import { CultNetPeer } from "./peer";
@@ -112,8 +113,9 @@ export async function invokeCultNetOperation(
   options: CultNetOperationClientOptions,
 ): Promise<CultNetOperationResponseMessage> {
   const target = parseRudpEndpoint(endpoint);
-  const socket = createSocket("udp4");
-  await bindSocket(socket, 0, "127.0.0.1");
+  const bindHost = await rudpClientBindHost(target.host);
+  const socket = createSocket(bindHost.includes(":") ? "udp6" : "udp4");
+  await bindSocket(socket, 0, bindHost);
   const transport = new CultNetRudpSocketTransportConnection({
     mode: "client",
     runtimeId: options.runtimeId,
diff --git a/packages/cultnet-ts/src/rudp.ts b/packages/cultnet-ts/src/rudp.ts
index e32bb2d7..23852a3c 100644
--- a/packages/cultnet-ts/src/rudp.ts
+++ b/packages/cultnet-ts/src/rudp.ts
@@ -1,8 +1,22 @@
 import { randomInt } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { type RemoteInfo, type Socket } from "node:dgram";
+import { lookup } from "node:dns/promises";
 
 import type { CultNetTransportProfile } from "./contracts";
+
+/**
+ * The address an RUDP client binds when its caller names none: loopback for a
+ * loopback endpoint, otherwise the unspecified address of the endpoint's family.
+ * A socket bound to loopback cannot send off the host on Windows.
+ */
+export async function rudpClientBindHost(endpointHost: string): Promise<string> {
+  const { address, family } = await lookup(endpointHost.replace(/^\[(.*)\]$/, "$1"));
+  if (family === 6) {
+    return address === "::1" ? "::1" : "::";
+  }
+  return address.startsWith("127.") ? "127.0.0.1" : "0.0.0.0";
+}
 import {
   CultNetReconnectController,
   createCultNetReconnectPolicy,
diff --git a/packages/cultnet-ts/test/cultnet.test.ts b/packages/cultnet-ts/test/cultnet.test.ts
index 4a0c3bbc..5f21fe72 100644
--- a/packages/cultnet-ts/test/cultnet.test.ts
+++ b/packages/cultnet-ts/test/cultnet.test.ts
@@ -5,7 +5,7 @@ import { Duplex } from "node:stream";
 import dgram, { type Socket } from "node:dgram";
 import { rmSync, mkdtempSync } from "node:fs";
 import { join } from "node:path";
-import { tmpdir } from "node:os";
+import { networkInterfaces, tmpdir } from "node:os";
 
 import { z } from "zod";
 import { decode as decodeMsgpack, encode } from "@msgpack/msgpack";
@@ -47,6 +47,7 @@ import {
   ghostlightAgentStateGeneratedContract,
   parseCultNetMessage,
   invokeCultNetOperation,
+  rudpClientBindHost,
   startCultNetOperationServer,
   validateGhostlightAgentStateGenerated,
   validateGhostlightAgentState,
@@ -2224,6 +2225,47 @@ test("operation service frees the slots of abandoned sessions once they idle out
   }
 });
 
+test("an RUDP client binds loopback only for a loopback endpoint", async () => {
+  assert.equal(await rudpClientBindHost("10.77.0.1"), "0.0.0.0");
+  assert.equal(await rudpClientBindHost("2001:db8::1"), "::");
+  assert.equal(await rudpClientBindHost("[2001:db8::1]"), "::");
+  assert.equal(await rudpClientBindHost("127.0.0.1"), "127.0.0.1");
+  assert.equal(await rudpClientBindHost("127.0.0.2"), "127.0.0.1");
+  assert.equal(await rudpClientBindHost("::1"), "::1");
+  assert.equal(await rudpClientBindHost("[::1]"), "::1");
+});
+
+// A socket bound to loopback cannot send off the host on Windows. On Linux it
+// reaches a local non-loopback address, but from 127.0.0.1, so the source
+// address shows which one the client bound.
+test("an operation client for a non-loopback endpoint does not send from loopback", async (t) => {
+  const address = Object.values(networkInterfaces())
+    .flat()
+    .find((entry) => entry && entry.family === "IPv4" && !entry.internal)?.address;
+  if (!address) {
+    t.skip("no non-loopback IPv4 interface on this host");
+    return;
+  }
+  const listener = dgram.createSocket("udp4");
+  await new Promise<void>((resolve) => listener.bind(0, "0.0.0.0", resolve));
+  const source = new Promise<string>((resolve) => listener.once("message", (_wire, remote) => resolve(remote.address)));
+  const request: CultNetOperationRequestMessage = {
+    schemaVersion: "cultnet.operation_request.v0",
+    messageId: "bind-host",
+    serviceId: "sai.vn",
+    operation: "describe",
+    payloadSchema: "gamecult.eve.plugin_abi.request.v1",
+    payloadEncoding: "messagepack-base64",
+    payload: "gaZzY2hlbWE=",
+  };
+  try {
+    await assert.rejects(invokeCultNetOperation(`rudp://${address}:${udpPort(listener)}`, request, { runtimeId: "bind-test", timeoutMs: 300 }));
+    assert.equal(await source, address);
+  } finally {
+    listener.close();
+  }
+});
+
 test("server-mode transport replaces its peer when a Connect arrives from another endpoint", async () => {
   const serverSocket = await bindUdpSocket();
   const socketA = await bindUdpSocket();

From 99546522662a57f8640b3a8e36093ba5f9cecfa8 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 13:44:06 +0200
Subject: [PATCH 13/24] cultnet-py, cultmesh-py: an RUDP client for a remote
 endpoint binds the unspecified address

create_rudp_schema_transport and CultMesh.create_rudp_client (and create_client
and connect_client above them) defaulted bind_host to 127.0.0.1 on an AF_INET
socket. On Windows a socket bound to loopback cannot send off the host (os
error 10051), so a default client could not reach a remote endpoint.

cultnet-py now owns the rule in rudp_client_bind_host: loopback for a loopback
endpoint, otherwise the unspecified address of the endpoint's family (0.0.0.0
or ::). bind_host defaults to None on the client paths, which use the rule; the
socket family follows the bind host. An explicit bind_host still wins; a
CultMesh server still binds 127.0.0.1 unless told otherwise.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../cultmesh-py/src/cultmesh_py/facade.py     | 17 +++--
 packages/cultmesh-py/tests/test_cultmesh.py   | 31 +++++++++
 .../cultnet-py/src/cultnet_py/__init__.py     |  2 +
 packages/cultnet-py/src/cultnet_py/client.py  | 25 ++++++-
 packages/cultnet-py/tests/test_cultnet.py     | 69 +++++++++++++++++++
 5 files changed, 137 insertions(+), 7 deletions(-)

diff --git a/packages/cultmesh-py/src/cultmesh_py/facade.py b/packages/cultmesh-py/src/cultmesh_py/facade.py
index 626b1dc7..fea60610 100644
--- a/packages/cultmesh-py/src/cultmesh_py/facade.py
+++ b/packages/cultmesh-py/src/cultmesh_py/facade.py
@@ -18,6 +18,7 @@ from cultnet_py import (
     CultNetShardCatalog,
     CultNetSimulationObservationHub,
     create_rudp_schema_transport,
+    rudp_client_bind_host,
     wire_message_schema_catalog,
 )
 
@@ -188,7 +189,7 @@ class CultMesh:
         connection_id: int,
         endpoint: str | CultMeshRudpEndpoint,
         *,
-        bind_host: str = "127.0.0.1",
+        bind_host: str | None = None,
         bind_port: int = 0,
         socket: socket_module.socket | None = None,
         initial_sequence: int | None = None,
@@ -204,7 +205,10 @@ class CultMesh:
             if isinstance(endpoint, str)
             else endpoint
         )
-        transport_socket = socket or _bind_rudp_socket(bind_host, bind_port)
+        transport_socket = socket or _bind_rudp_socket(
+            bind_host if bind_host is not None else rudp_client_bind_host(parsed_endpoint.host),
+            bind_port,
+        )
         return CultNetRudpSocketTransportConnection(
             CultNetRudpSocketTransportOptions(
                 runtime_id=runtime_id,
@@ -429,7 +433,7 @@ class CultMesh:
         endpoint: str | CultMeshRudpEndpoint | None = None,
         connection_id: int = 0x43554C54,
         runtime_id: str = "cultmesh-python-rudp-client",
-        bind_host: str = "127.0.0.1",
+        bind_host: str | None = None,
         bind_port: int = 0,
     ) -> CultNetRawClient:
         if endpoint is None and host.lower().startswith("rudp://"):
@@ -465,7 +469,7 @@ class CultMesh:
         endpoint: str | CultMeshRudpEndpoint | None = None,
         connection_id: int = 0x43554C54,
         runtime_id: str = "cultmesh-python-rudp-client",
-        bind_host: str = "127.0.0.1",
+        bind_host: str | None = None,
         bind_port: int = 0,
     ) -> CultNetRawClient:
         return CultMesh.create_client(
@@ -481,7 +485,10 @@ class CultMesh:
 
 
 def _bind_rudp_socket(bind_host: str, bind_port: int) -> socket_module.socket:
-    transport_socket = socket_module.socket(socket_module.AF_INET, socket_module.SOCK_DGRAM)
+    transport_socket = socket_module.socket(
+        socket_module.AF_INET6 if ":" in bind_host else socket_module.AF_INET,
+        socket_module.SOCK_DGRAM,
+    )
     transport_socket.bind((bind_host, bind_port))
     transport_socket.settimeout(0.02)
     return transport_socket
diff --git a/packages/cultmesh-py/tests/test_cultmesh.py b/packages/cultmesh-py/tests/test_cultmesh.py
index 9a697370..2b4f5bec 100644
--- a/packages/cultmesh-py/tests/test_cultmesh.py
+++ b/packages/cultmesh-py/tests/test_cultmesh.py
@@ -213,6 +213,37 @@ class CultMeshTests(unittest.TestCase):
         self.assertEqual(received_messages[0]["schemaVersion"], "cultnet.schema_catalog_request.v0")
         self.assertEqual(received_messages[0]["messageId"], "rudp-transport-factory")
 
+    def _rudp_client_bound_host(self, endpoint: str, bind_host: str | None = None) -> str:
+        client = CultMesh.create_rudp_client("python-cultmesh-bind-client", 0x10203060, endpoint, bind_host=bind_host)
+        try:
+            return client.socket.getsockname()[0]
+        finally:
+            client.socket.close()
+
+    # A client bound to loopback cannot send to another host on Windows, so a
+    # client for a remote endpoint binds the unspecified address of its family.
+    def test_cultmesh_rudp_client_for_a_remote_endpoint_binds_the_unspecified_address(self) -> None:
+        self.assertEqual(self._rudp_client_bound_host("rudp://10.77.0.1:17872"), "0.0.0.0")
+        self.assertEqual(self._rudp_client_bound_host("rudp://[2001:db8::1]:17872"), "::")
+
+    def test_cultmesh_rudp_client_for_a_loopback_endpoint_binds_loopback(self) -> None:
+        self.assertEqual(self._rudp_client_bound_host("rudp://127.0.0.1:17872"), "127.0.0.1")
+        self.assertEqual(self._rudp_client_bound_host("rudp://[::1]:17872"), "::1")
+
+    def test_cultmesh_rudp_client_binds_an_explicit_bind_host_whatever_the_endpoint(self) -> None:
+        self.assertEqual(self._rudp_client_bound_host("rudp://10.77.0.1:17872", "127.0.0.1"), "127.0.0.1")
+        self.assertEqual(self._rudp_client_bound_host("rudp://127.0.0.1:17872", "0.0.0.0"), "0.0.0.0")
+
+    def test_cultmesh_rudp_server_binds_loopback_unless_told_otherwise(self) -> None:
+        loopback = CultMesh.create_rudp_server("python-cultmesh-bind-server", 0x10203061)
+        anywhere = CultMesh.create_rudp_server("python-cultmesh-bind-server", 0x10203062, bind_host="0.0.0.0")
+        try:
+            self.assertEqual(loopback.socket.getsockname()[0], "127.0.0.1")
+            self.assertEqual(anywhere.socket.getsockname()[0], "0.0.0.0")
+        finally:
+            loopback.socket.close()
+            anywhere.socket.close()
+
     def test_cultmesh_facade_creates_rudp_client_from_peer_endpoint(self) -> None:
         connection_id = 0x10203042
         server = CultMesh.create_rudp_server(
diff --git a/packages/cultnet-py/src/cultnet_py/__init__.py b/packages/cultnet-py/src/cultnet_py/__init__.py
index b1734f25..1e509bda 100644
--- a/packages/cultnet-py/src/cultnet_py/__init__.py
+++ b/packages/cultnet-py/src/cultnet_py/__init__.py
@@ -6,6 +6,7 @@ from .client import (
     CultNetSchemaTransportFactory,
     create_rudp_schema_transport,
     create_tcp_framed_schema_transport,
+    rudp_client_bind_host,
 )
 from .cultmesh_contracts import (
     PEER_EXCHANGE_REQUEST,
@@ -228,6 +229,7 @@ __all__ = [
     "compute_reconnect_delay_ms",
     "create_reconnect_policy",
     "create_rudp_schema_transport",
+    "rudp_client_bind_host",
     "create_tcp_framed_schema_transport",
     "create_rudp_transport_profile",
     "create_tcp_framed_transport_profile",
diff --git a/packages/cultnet-py/src/cultnet_py/client.py b/packages/cultnet-py/src/cultnet_py/client.py
index 05bc5fa6..28060753 100644
--- a/packages/cultnet-py/src/cultnet_py/client.py
+++ b/packages/cultnet-py/src/cultnet_py/client.py
@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import ipaddress
 import socket
 import time
 from collections.abc import Callable
@@ -384,6 +385,22 @@ def create_tcp_framed_schema_transport(
     )
 
 
+def rudp_client_bind_host(endpoint_host: str) -> str:
+    """Return the address an RUDP client binds when its caller names none.
+
+    Loopback for a loopback endpoint, otherwise the unspecified address of the
+    endpoint's family. A socket bound to loopback cannot send off the host on
+    Windows.
+    """
+    family, _, _, _, address = socket.getaddrinfo(
+        endpoint_host.removeprefix("[").removesuffix("]"), None, type=socket.SOCK_DGRAM
+    )[0]
+    loopback = ipaddress.ip_address(address[0]).is_loopback
+    if family == socket.AF_INET6:
+        return "::1" if loopback else "::"
+    return "127.0.0.1" if loopback else "0.0.0.0"
+
+
 def create_rudp_schema_transport(
     *,
     host: str,
@@ -391,7 +408,7 @@ def create_rudp_schema_transport(
     connection_id: int,
     timeout_seconds: float = 4.0,
     runtime_id: str = "cultnet-python-rudp-client",
-    bind_host: str = "127.0.0.1",
+    bind_host: str | None = None,
     bind_port: int = 0,
     initial_sequence: int | None = None,
     resend_delay_ms: int = 25,
@@ -400,7 +417,11 @@ def create_rudp_schema_transport(
     max_fragment_bytes: int | None = None,
     max_pending_reliable_packets: int | None = None,
 ) -> CultNetRudpSocketTransportConnection:
-    transport_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    if bind_host is None:
+        bind_host = rudp_client_bind_host(host)
+    transport_socket = socket.socket(
+        socket.AF_INET6 if ":" in bind_host else socket.AF_INET, socket.SOCK_DGRAM
+    )
     transport_socket.bind((bind_host, bind_port))
     transport_socket.settimeout(min(timeout_seconds, 0.02))
     transport = CultNetRudpSocketTransportConnection(
diff --git a/packages/cultnet-py/tests/test_cultnet.py b/packages/cultnet-py/tests/test_cultnet.py
index fb2eff54..0d707730 100644
--- a/packages/cultnet-py/tests/test_cultnet.py
+++ b/packages/cultnet-py/tests/test_cultnet.py
@@ -30,6 +30,8 @@ from cultnet_py.interop_peer import (
 )
 from cultnet_py import (
     compute_simulation_claim_hash,
+    create_rudp_schema_transport,
+    rudp_client_bind_host,
     CultNetDatabaseChange,
     CultNetRawClient,
     CultNetRawDocumentRecord,
@@ -2399,6 +2401,73 @@ class CultNetTests(unittest.TestCase):
         self.assertEqual(CultNetSimulationConsensusCandidate.from_wire(candidates[0]), typed_candidates[0])
 
 
+def _non_loopback_ipv4_address() -> str | None:
+    probe = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    try:
+        probe.connect(("192.0.2.1", 9))
+        address = probe.getsockname()[0]
+    except OSError:
+        return None
+    finally:
+        probe.close()
+    return None if address.startswith("127.") or address == "0.0.0.0" else address
+
+
+class CultNetRudpClientBindTests(unittest.TestCase):
+    def test_an_rudp_client_binds_loopback_only_for_a_loopback_endpoint(self) -> None:
+        self.assertEqual(rudp_client_bind_host("10.77.0.1"), "0.0.0.0")
+        self.assertEqual(rudp_client_bind_host("2001:db8::1"), "::")
+        self.assertEqual(rudp_client_bind_host("[2001:db8::1]"), "::")
+        self.assertEqual(rudp_client_bind_host("127.0.0.1"), "127.0.0.1")
+        self.assertEqual(rudp_client_bind_host("127.0.0.2"), "127.0.0.1")
+        self.assertEqual(rudp_client_bind_host("::1"), "::1")
+        self.assertEqual(rudp_client_bind_host("[::1]"), "::1")
+
+    # A socket bound to loopback cannot send off the host on Windows. On Linux
+    # it reaches a local non-loopback address, but from 127.0.0.1, so the
+    # source address shows which one the client bound.
+    def test_a_schema_transport_for_a_non_loopback_endpoint_does_not_send_from_loopback(self) -> None:
+        address = _non_loopback_ipv4_address()
+        if address is None:
+            self.skipTest("no non-loopback IPv4 address on this host")
+        listener = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        listener.bind(("0.0.0.0", 0))
+        listener.settimeout(2.0)
+        try:
+            with self.assertRaises(TimeoutError):
+                create_rudp_schema_transport(
+                    host=address,
+                    port=listener.getsockname()[1],
+                    connection_id=0x43554C54,
+                    timeout_seconds=0.2,
+                )
+            _, source = listener.recvfrom(65535)
+            self.assertEqual(source[0], address)
+        finally:
+            listener.close()
+
+    def test_a_schema_transport_binds_an_explicit_bind_host(self) -> None:
+        address = _non_loopback_ipv4_address()
+        if address is None:
+            self.skipTest("no non-loopback IPv4 address on this host")
+        listener = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        listener.bind(("0.0.0.0", 0))
+        listener.settimeout(2.0)
+        try:
+            with self.assertRaises(TimeoutError):
+                create_rudp_schema_transport(
+                    host=address,
+                    port=listener.getsockname()[1],
+                    connection_id=0x43554C54,
+                    timeout_seconds=0.2,
+                    bind_host="127.0.0.1",
+                )
+            _, source = listener.recvfrom(65535)
+            self.assertEqual(source[0], "127.0.0.1")
+        finally:
+            listener.close()
+
+
 class CultNetRudpFragmentBoundTests(unittest.TestCase):
     def _pair(self) -> tuple[CultNetRudpSession, CultNetRudpSession]:
         sender = CultNetRudpSession(CultNetRudpSessionOptions(connection_id=311, initial_sequence=1))

From cf624616433c9d1ccca03214a5341b674750453d Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 13:49:31 +0200
Subject: [PATCH 14/24] cultmesh-kotlin: an RUDP client for a remote endpoint
 binds the unspecified address

The CultMesh RUDP client entry points defaulted bindHost to 127.0.0.1. On
Windows a socket bound to loopback cannot send off the host (os error 10051),
so a default client could not reach a remote endpoint.

cultNetRudpClientBindAddress owns the rule: loopback for a loopback endpoint,
otherwise the unspecified address of the endpoint's family (0.0.0.0 or ::).
bindHost defaults to null on every client entry point, which uses the rule. An
explicit bindHost still wins; a CultMesh server still binds 127.0.0.1 unless
told otherwise. The self-test pins all three.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../kotlin/org/gamecult/cultmesh/CultMesh.kt  | 59 +++++++++++++++----
 1 file changed, 47 insertions(+), 12 deletions(-)

diff --git a/packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt b/packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt
index 2117c2d8..3197bb24 100644
--- a/packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt
+++ b/packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt
@@ -11,6 +11,7 @@ import java.io.InputStream
 import java.io.OutputStream
 import java.net.DatagramPacket
 import java.net.DatagramSocket
+import java.net.Inet6Address
 import java.net.InetAddress
 import java.net.InetSocketAddress
 import java.net.ServerSocket
@@ -581,7 +582,7 @@ object CultMesh {
         connectionId: Long,
         remoteHost: String,
         remotePort: Int,
-        bindHost: String = "127.0.0.1",
+        bindHost: String? = null,
         bindPort: Int = 0,
         tuning: CultNetRudpSocketTuning = CultNetRudpSocketTuning(),
     ): CultNetRudpSocketTransportConnection = cultNetRudpClient(
@@ -600,7 +601,7 @@ object CultMesh {
         runtimeId: String,
         connectionId: Long,
         endpoint: CultNetRudpEndpoint,
-        bindHost: String = "127.0.0.1",
+        bindHost: String? = null,
         bindPort: Int = 0,
         tuning: CultNetRudpSocketTuning = CultNetRudpSocketTuning(),
     ): CultNetRudpSocketTransportConnection = createRudpClient(
@@ -617,7 +618,7 @@ object CultMesh {
         runtimeId: String,
         connectionId: Long,
         endpoint: String,
-        bindHost: String = "127.0.0.1",
+        bindHost: String? = null,
         bindPort: Int = 0,
         tuning: CultNetRudpSocketTuning = CultNetRudpSocketTuning(),
     ): CultNetRudpSocketTransportConnection = createRudpClient(
@@ -633,7 +634,7 @@ object CultMesh {
         runtimeId: String,
         connectionId: Long,
         peer: CultMeshPeerCard,
-        bindHost: String = "127.0.0.1",
+        bindHost: String? = null,
         bindPort: Int = 0,
         tuning: CultNetRudpSocketTuning = CultNetRudpSocketTuning(),
     ): CultNetRudpSocketTransportConnection {
@@ -651,7 +652,7 @@ object CultMesh {
         role: String,
         shardId: String? = null,
         at: Instant = Instant.now(),
-        bindHost: String = "127.0.0.1",
+        bindHost: String? = null,
         bindPort: Int = 0,
         tuning: CultNetRudpSocketTuning = CultNetRudpSocketTuning(),
     ): CultNetRudpSocketTransportConnection {
@@ -664,7 +665,7 @@ object CultMesh {
         runtimeId: String,
         connectionId: Long,
         endpoint: CultNetRudpEndpoint,
-        bindHost: String = "127.0.0.1",
+        bindHost: String? = null,
         bindPort: Int = 0,
         tuning: CultNetRudpSocketTuning = CultNetRudpSocketTuning(),
         connectPayload: ByteArray = ByteArray(0),
@@ -683,7 +684,7 @@ object CultMesh {
         runtimeId: String,
         connectionId: Long,
         endpoint: String,
-        bindHost: String = "127.0.0.1",
+        bindHost: String? = null,
         bindPort: Int = 0,
         tuning: CultNetRudpSocketTuning = CultNetRudpSocketTuning(),
         connectPayload: ByteArray = ByteArray(0),
@@ -705,7 +706,7 @@ object CultMesh {
         runtimeId: String,
         connectionId: Long,
         peer: CultMeshPeerCard,
-        bindHost: String = "127.0.0.1",
+        bindHost: String? = null,
         bindPort: Int = 0,
         tuning: CultNetRudpSocketTuning = CultNetRudpSocketTuning(),
         connectPayload: ByteArray = ByteArray(0),
@@ -736,7 +737,7 @@ object CultMesh {
         role: String,
         shardId: String? = null,
         at: Instant = Instant.now(),
-        bindHost: String = "127.0.0.1",
+        bindHost: String? = null,
         bindPort: Int = 0,
         tuning: CultNetRudpSocketTuning = CultNetRudpSocketTuning(),
         connectPayload: ByteArray = ByteArray(0),
@@ -3028,22 +3029,36 @@ fun cultNetRudpServer(
     )
 }
 
+/**
+ * The address an RUDP client binds when its caller names none: loopback for a
+ * loopback endpoint, otherwise the unspecified address of the endpoint's family.
+ * A socket bound to loopback cannot send off the host on Windows.
+ */
+fun cultNetRudpClientBindAddress(remote: InetAddress): InetAddress = when {
+    remote is Inet6Address && remote.isLoopbackAddress -> InetAddress.getByName("::1")
+    remote is Inet6Address -> InetAddress.getByName("::")
+    remote.isLoopbackAddress -> InetAddress.getByName("127.0.0.1")
+    else -> InetAddress.getByName("0.0.0.0")
+}
+
 fun cultNetRudpClient(
     runtimeId: String,
     connectionId: Long,
     remoteHost: String,
     remotePort: Int,
-    bindHost: String = "127.0.0.1",
+    bindHost: String? = null,
     bindPort: Int = 0,
     tuning: CultNetRudpSocketTuning = CultNetRudpSocketTuning(),
 ): CultNetRudpSocketTransportConnection {
-    val socket = DatagramSocket(bindPort, InetAddress.getByName(bindHost)).also { it.soTimeout = 20 }
+    val remote = InetAddress.getByName(remoteHost)
+    val bindAddress = bindHost?.let(InetAddress::getByName) ?: cultNetRudpClientBindAddress(remote)
+    val socket = DatagramSocket(bindPort, bindAddress).also { it.soTimeout = 20 }
     return CultNetRudpSocketTransportConnection(
         socket = socket,
         mode = CultNetRudpSocketMode.Client,
         runtimeId = runtimeId,
         connectionId = connectionId,
-        remoteAddress = InetSocketAddress(InetAddress.getByName(remoteHost), remotePort),
+        remoteAddress = InetSocketAddress(remote, remotePort),
         initialSequence = tuning.initialSequence,
         resendDelayMs = tuning.resendDelayMs,
         maxFragmentBytes = tuning.maxFragmentBytes,
@@ -3368,6 +3383,7 @@ fun main(args: Array<String>) {
         rudpSessionFragmentsAndReassemblesReliableOrderedPayloads()
         rudpSessionAdvancesLargeFragmentSetsThroughBoundedReliableWindow()
         rudpSocketTransportErgonomicFactoriesCarrySchemaFrames()
+        rudpClientBindsLoopbackOnlyForALoopbackEndpoint()
         rudpSocketTransportHandshakesAndCarriesReliableOrderedSchemaFrames()
         rudpSocketTransportCarriesFragmentedReliableOrderedSchemaFrames()
         return
@@ -5378,6 +5394,25 @@ private fun rudpSessionAdvancesLargeFragmentSetsThroughBoundedReliableWindow() {
     check(oldAck.ackMask == 0L)
 }
 
+private fun rudpClientBoundHost(endpoint: String, bindHost: String? = null): InetAddress =
+    CultMesh.createRudpClient("kotlin-rudp-bind-client", 0x10203060L, endpoint, bindHost).use { client ->
+        InetAddress.getByName(client.profile.transports.single().host)
+    }
+
+// A client bound to loopback cannot send to another host on Windows, so a
+// client for a remote endpoint binds the unspecified address of its family.
+private fun rudpClientBindsLoopbackOnlyForALoopbackEndpoint() {
+    check(rudpClientBoundHost("rudp://10.77.0.1:17872") == InetAddress.getByName("0.0.0.0"))
+    check(rudpClientBoundHost("rudp://[2001:db8::1]:17872") == InetAddress.getByName("::"))
+    check(rudpClientBoundHost("rudp://127.0.0.1:17872") == InetAddress.getByName("127.0.0.1"))
+    check(rudpClientBoundHost("rudp://[::1]:17872") == InetAddress.getByName("::1"))
+    check(rudpClientBoundHost("rudp://10.77.0.1:17872", "127.0.0.1") == InetAddress.getByName("127.0.0.1"))
+    check(rudpClientBoundHost("rudp://127.0.0.1:17872", "0.0.0.0") == InetAddress.getByName("0.0.0.0"))
+    CultMesh.createRudpServer("kotlin-rudp-bind-server", 0x10203061L).use { server ->
+        check(InetAddress.getByName(server.profile.transports.single().host) == InetAddress.getByName("127.0.0.1"))
+    }
+}
+
 private fun rudpSocketTransportErgonomicFactoriesCarrySchemaFrames() {
     val connectionId = 0x10203042L
     CultMesh.createRudpServer(

From e6ddcdd6e1948cfedbe69d9126c51c010522360b Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 13:50:58 +0200
Subject: [PATCH 15/24] GameCult.Mesh: an RUDP client binds by its endpoint, as
 the other runtimes do

CultMeshRudpSocketOptions.BindHost defaulted to 0.0.0.0 for servers and
clients alike (a58daa54, so clients could reach remote routes). That bound an
IPv4 socket for every client, so a client for an IPv6 endpoint could not send,
and a client for a loopback endpoint listened on every interface.

BindHost is now nullable and unset by default. Unset, a client binds loopback
for a loopback endpoint and the unspecified address of the endpoint's family
(0.0.0.0 or ::) otherwise, matching cultnet-rs, cultnet-ts, cultnet-py and
cultmesh-kotlin. A server keeps binding 0.0.0.0. An explicit BindHost wins for
both. The test that pinned the old default's value is replaced by tests of
what each endpoint binds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/GameCult.Mesh/CultMesh.cs                 | 34 +++++++++++---
 .../NetworkingTests.cs                        | 45 +++++++++++++++++--
 2 files changed, 69 insertions(+), 10 deletions(-)

diff --git a/src/GameCult.Mesh/CultMesh.cs b/src/GameCult.Mesh/CultMesh.cs
index 76656699..0d7ebd16 100644
--- a/src/GameCult.Mesh/CultMesh.cs
+++ b/src/GameCult.Mesh/CultMesh.cs
@@ -537,8 +537,12 @@ namespace GameCult.Mesh
     /// </summary>
     public sealed class CultMeshRudpSocketOptions
     {
-        /// <summary>Gets or sets the local bind host.</summary>
-        public string BindHost { get; set; } = "0.0.0.0";
+        /// <summary>
+        /// Gets or sets the local bind host. Unset, a server binds every IPv4 interface, and a
+        /// client binds loopback for a loopback endpoint and the unspecified address of the
+        /// endpoint's family otherwise, so it can reach a remote host.
+        /// </summary>
+        public string? BindHost { get; set; }
         /// <summary>Gets or sets the local bind port.</summary>
         public int BindPort { get; set; }
         /// <summary>Gets or sets a caller-owned bound socket.</summary>
@@ -2933,7 +2937,7 @@ namespace GameCult.Mesh
             return new CultNetRudpSocketTransportConnection(new CultNetRudpSocketTransportOptions
             {
                 RuntimeId = runtimeId,
-                Socket = options.Socket ?? BindRudpSocket(options.BindHost, options.BindPort),
+                Socket = options.Socket ?? BindRudpSocket(ResolveRudpAddress(options.BindHost ?? "0.0.0.0"), options.BindPort),
                 Mode = CultNetRudpSocketMode.Server,
                 ConnectionId = connectionId,
                 InitialSequence = options.InitialSequence,
@@ -2957,12 +2961,16 @@ namespace GameCult.Mesh
         {
             if (endpoint == null) throw new ArgumentNullException(nameof(endpoint));
             options ??= new CultMeshRudpSocketOptions();
+            var remote = ResolveRudpAddress(endpoint.Host);
+            var bindAddress = options.BindHost == null
+                ? RudpClientBindAddress(remote)
+                : ResolveRudpAddress(options.BindHost);
             return new CultNetRudpSocketTransportConnection(new CultNetRudpSocketTransportOptions
             {
                 RuntimeId = runtimeId,
-                Socket = options.Socket ?? BindRudpSocket(options.BindHost, options.BindPort),
+                Socket = options.Socket ?? BindRudpSocket(bindAddress, options.BindPort),
                 Mode = CultNetRudpSocketMode.Client,
-                RemoteEndPoint = new IPEndPoint(ResolveRudpAddress(endpoint.Host), endpoint.Port),
+                RemoteEndPoint = new IPEndPoint(remote, endpoint.Port),
                 ConnectionId = connectionId,
                 InitialSequence = options.InitialSequence,
                 ResendDelayMs = options.ResendDelayMs,
@@ -3234,9 +3242,21 @@ namespace GameCult.Mesh
             return CultNetLocal.ConnectClient(host, port, security, configureClient);
         }
 
-        private static Socket BindRudpSocket(string host, int port)
+        // A socket bound to loopback cannot send off the host on Windows, so a client keeps
+        // loopback only when its peer is on loopback.
+        private static IPAddress RudpClientBindAddress(IPAddress remote)
+        {
+            var ipv6 = remote.AddressFamily == AddressFamily.InterNetworkV6;
+            if (IPAddress.IsLoopback(remote))
+            {
+                return ipv6 ? IPAddress.IPv6Loopback : IPAddress.Loopback;
+            }
+
+            return ipv6 ? IPAddress.IPv6Any : IPAddress.Any;
+        }
+
+        private static Socket BindRudpSocket(IPAddress address, int port)
         {
-            var address = ResolveRudpAddress(host);
             var socket = new Socket(address.AddressFamily, SocketType.Dgram, ProtocolType.Udp);
             socket.Bind(new IPEndPoint(address, port));
             socket.ReceiveTimeout = 20;
diff --git a/tests/GameCult.Networking.Tests/NetworkingTests.cs b/tests/GameCult.Networking.Tests/NetworkingTests.cs
index 8bf59746..8d01a7c3 100644
--- a/tests/GameCult.Networking.Tests/NetworkingTests.cs
+++ b/tests/GameCult.Networking.Tests/NetworkingTests.cs
@@ -5262,10 +5262,49 @@ namespace GameCult.Networking.Tests
 #pragma warning restore CS0618
         }
 
-        [Test]
-        public void CultMeshRudpClient_DefaultBindAllowsRemoteRoutes()
+        private static string? RudpClientBoundHost(string endpoint, string? bindHost = null)
         {
-            Assert.That(new CultMeshRudpSocketOptions().BindHost, Is.EqualTo("0.0.0.0"));
+            using var client = CultMesh.CreateRudpClient(
+                "csharp-cultmesh-bind-client",
+                0x10203060u,
+                endpoint,
+                new CultMeshRudpSocketOptions { BindHost = bindHost });
+            return client.Profile.Transports[0].Host;
+        }
+
+        // A client bound to loopback cannot send to another host on Windows, so a client for a
+        // remote endpoint binds the unspecified address of its family.
+        [Test]
+        public void CultMeshRudpClient_ForARemoteEndpoint_BindsTheUnspecifiedAddress()
+        {
+            Assert.That(RudpClientBoundHost("rudp://10.77.0.1:17872"), Is.EqualTo("0.0.0.0"));
+            Assert.That(RudpClientBoundHost("rudp://[2001:db8::1]:17872"), Is.EqualTo("::"));
+        }
+
+        [Test]
+        public void CultMeshRudpClient_ForALoopbackEndpoint_BindsLoopback()
+        {
+            Assert.That(RudpClientBoundHost("rudp://127.0.0.1:17872"), Is.EqualTo("127.0.0.1"));
+            Assert.That(RudpClientBoundHost("rudp://[::1]:17872"), Is.EqualTo("::1"));
+        }
+
+        [Test]
+        public void CultMeshRudpClient_BindsAnExplicitBindHostWhateverTheEndpoint()
+        {
+            Assert.That(RudpClientBoundHost("rudp://10.77.0.1:17872", "127.0.0.1"), Is.EqualTo("127.0.0.1"));
+            Assert.That(RudpClientBoundHost("rudp://127.0.0.1:17872", "0.0.0.0"), Is.EqualTo("0.0.0.0"));
+        }
+
+        [Test]
+        public void CultMeshRudpServer_BindsEveryIPv4InterfaceUnlessToldOtherwise()
+        {
+            using var anywhere = CultMesh.CreateRudpServer("csharp-cultmesh-bind-server", 0x10203061u);
+            using var loopback = CultMesh.CreateRudpServer(
+                "csharp-cultmesh-bind-server",
+                0x10203062u,
+                new CultMeshRudpSocketOptions { BindHost = "127.0.0.1" });
+            Assert.That(anywhere.Profile.Transports[0].Host, Is.EqualTo("0.0.0.0"));
+            Assert.That(loopback.Profile.Transports[0].Host, Is.EqualTo("127.0.0.1"));
         }
 
         [Test]

From e079ba1ad3172efc7a8c5a32e8a3c9160e4a09c6 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 13:52:26 +0200
Subject: [PATCH 16/24] cultmesh-kotlin: the bind self-test observes a
 wildcard, not its family

A JVM wildcard socket is dual-stack, so a client bound to 0.0.0.0 reports the
IPv6 wildcard as its local address and the self-test's first check failed on
Linux. Assert that a client for a remote endpoint binds a wildcard, and keep the
exact loopback checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt  | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt b/packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt
index 3197bb24..368b5338 100644
--- a/packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt
+++ b/packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt
@@ -5400,14 +5400,16 @@ private fun rudpClientBoundHost(endpoint: String, bindHost: String? = null): Ine
     }
 
 // A client bound to loopback cannot send to another host on Windows, so a
-// client for a remote endpoint binds the unspecified address of its family.
+// client for a remote endpoint binds the unspecified address. A JVM wildcard
+// socket is dual-stack and reports one wildcard for either family, so the
+// family is not observable here.
 private fun rudpClientBindsLoopbackOnlyForALoopbackEndpoint() {
-    check(rudpClientBoundHost("rudp://10.77.0.1:17872") == InetAddress.getByName("0.0.0.0"))
-    check(rudpClientBoundHost("rudp://[2001:db8::1]:17872") == InetAddress.getByName("::"))
+    check(rudpClientBoundHost("rudp://10.77.0.1:17872").isAnyLocalAddress)
+    check(rudpClientBoundHost("rudp://[2001:db8::1]:17872").isAnyLocalAddress)
     check(rudpClientBoundHost("rudp://127.0.0.1:17872") == InetAddress.getByName("127.0.0.1"))
     check(rudpClientBoundHost("rudp://[::1]:17872") == InetAddress.getByName("::1"))
     check(rudpClientBoundHost("rudp://10.77.0.1:17872", "127.0.0.1") == InetAddress.getByName("127.0.0.1"))
-    check(rudpClientBoundHost("rudp://127.0.0.1:17872", "0.0.0.0") == InetAddress.getByName("0.0.0.0"))
+    check(rudpClientBoundHost("rudp://127.0.0.1:17872", "0.0.0.0").isAnyLocalAddress)
     CultMesh.createRudpServer("kotlin-rudp-bind-server", 0x10203061L).use { server ->
         check(InetAddress.getByName(server.profile.transports.single().host) == InetAddress.getByName("127.0.0.1"))
     }

From 1833df58d46b1d7f6e8cdc15d2f05ed373cd3ab2 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 14:46:20 +0200
Subject: [PATCH 17/24] cultnet-rs: a direct send measures the window after
 reclaiming expired sends

`send` checked `window_admits` before `send_many` purged deadline-passed
packets, so the first direct send after the lowest unacked packet expired
was refused for acknowledged bytes that `send_many` would already have
released. `send` now purges first, as `send_many` does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/cultnet-rs/src/rudp.rs               |  5 +++
 packages/cultnet-rs/tests/rudp_flow_window.rs | 31 +++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/packages/cultnet-rs/src/rudp.rs b/packages/cultnet-rs/src/rudp.rs
index bf611a15..9e8c4a1c 100644
--- a/packages/cultnet-rs/src/rudp.rs
+++ b/packages/cultnet-rs/src/rudp.rs
@@ -574,6 +574,11 @@ impl CultNetRudpSession {
         payload: Vec<u8>,
         options: CultNetRudpSendOptions,
     ) -> Result<CultNetRudpPacket> {
+        // Measure the window as `send_many` will: without the deadline-passed
+        // sends it is about to reclaim.
+        if options.reliable {
+            self.purge_expired_reliable(options.now_ms);
+        }
         if options.reliable
             && (!self.queued_reliable.is_empty()
                 || !self.window_admits(self.next_sequence, payload.len()))
diff --git a/packages/cultnet-rs/tests/rudp_flow_window.rs b/packages/cultnet-rs/tests/rudp_flow_window.rs
index 85c7a864..58065970 100644
--- a/packages/cultnet-rs/tests/rudp_flow_window.rs
+++ b/packages/cultnet-rs/tests/rudp_flow_window.rs
@@ -249,3 +249,34 @@ fn acknowledged_bytes_stop_counting_when_the_lowest_unacked_packet_expires() ->
     }
     Ok(())
 }
+
+#[test]
+fn a_direct_send_is_not_refused_for_bytes_whose_lowest_packet_has_expired() -> Result<()> {
+    let mut sender = connected(1)?;
+    let expiring = CultNetRudpSendOptions {
+        reliable: true,
+        now_ms: 0,
+        reliable_expire_after_ms: Some(100),
+        ..Default::default()
+    };
+    let g = sender
+        .send_many("state", vec![7], expiring, None)?
+        .remove(0);
+    for offset in 1..=4u32 {
+        assert_eq!(send(&mut sender, MIB)?.len(), 1);
+        sender.receive(&ack_for(g.sequence + offset), 1)?;
+    }
+    assert!(sender.send("state", vec![7; MIB], reliable()).is_err());
+
+    // The first call after g's deadline is a direct send: it measures the
+    // window without g, as `send_many` would, and goes on the wire.
+    let at_200 = CultNetRudpSendOptions {
+        reliable: true,
+        now_ms: 200,
+        ..Default::default()
+    };
+    let sent = sender.send("state", vec![7; MIB], at_200)?;
+    assert_eq!(sent.sequence, g.sequence + 5);
+    assert_eq!(sender.outstanding_reliable_packet_count(), 1);
+    Ok(())
+}

From b4cee00af2fc10acaed23fdbb41e087c7927c23a Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 14:46:38 +0200
Subject: [PATCH 18/24] Ack Cut 3: a server's new generation does not inherit
 acknowledged bytes

A server accepting a fresh Connect can send before its Accept is
acknowledged, so no ack of the new generation prunes the acknowledged
sizes; only `end_session` clearing them keeps the ended generation's bytes
from counting against the new window. Rust, TypeScript, Python and C# each
pin it: 4 MiB acknowledged above a lost packet, a fresh Connect, and the
server's first 1 MiB send of the new generation goes out.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/cultnet-py/tests/test_cultnet.py     | 19 +++++++++++++
 packages/cultnet-rs/tests/rudp_flow_window.rs | 28 +++++++++++++++++++
 packages/cultnet-ts/test/cultnet.test.ts      | 20 +++++++++++++
 .../NetworkingTests.cs                        | 24 ++++++++++++++++
 4 files changed, 91 insertions(+)

diff --git a/packages/cultnet-py/tests/test_cultnet.py b/packages/cultnet-py/tests/test_cultnet.py
index df6e2340..4c740ac9 100644
--- a/packages/cultnet-py/tests/test_cultnet.py
+++ b/packages/cultnet-py/tests/test_cultnet.py
@@ -1017,6 +1017,25 @@ class CultNetTests(unittest.TestCase):
         promoted = sender.receive(self._flow_ack(h.sequence), 2).ready_to_send
         self.assertEqual([p.sequence for p in promoted], [g.sequence + 6])
 
+    def test_cultnet_rudp_a_new_generation_on_the_server_does_not_inherit_acknowledged_bytes(self) -> None:
+        # A server that accepts a fresh Connect may send before its Accept is acknowledged, so no acknowledgement of
+        # the new generation has moved the floor yet. Bytes the ended generation had acknowledged above its own lost
+        # packet belong to no receiver's hold any more and must not count.
+        server = self._flow_session(500)
+        accept = server.accept_connect(self._flow_session(1).create_connect(0), 0)
+        server.receive(self._flow_ack(accept.sequence), 0)
+        g = self._flow_send(server, 1)[0]
+        for offset in range(1, 5):
+            self.assertEqual([p.sequence for p in self._flow_send(server, self.MIB)], [g.sequence + offset])
+            server.receive(self._flow_ack(g.sequence + offset), 1)
+        self.assertEqual(len(self._flow_send(server, self.MIB)), 0)
+
+        next_accept = server.accept_connect(self._flow_session(200_000).create_connect(2), 2)
+        self.assertEqual(next_accept.packet_type, CultNetRudpPacketType.ACCEPT)
+        # The Accept is unacknowledged and the only thing pending: 1 MiB fits above it.
+        sent = server.send("state", bytes(self.MIB), CultNetRudpSendOptions(reliable=True))
+        self.assertEqual(sent.sequence, next_accept.sequence + 1)
+
     def test_cultnet_rudp_socket_transport_handshakes_and_carries_reliable_ordered_schema_frames(self) -> None:
         server_socket = bind_udp_socket()
         client_socket = bind_udp_socket()
diff --git a/packages/cultnet-rs/tests/rudp_flow_window.rs b/packages/cultnet-rs/tests/rudp_flow_window.rs
index 58065970..9f10eb50 100644
--- a/packages/cultnet-rs/tests/rudp_flow_window.rs
+++ b/packages/cultnet-rs/tests/rudp_flow_window.rs
@@ -280,3 +280,31 @@ fn a_direct_send_is_not_refused_for_bytes_whose_lowest_packet_has_expired() -> R
     assert_eq!(sender.outstanding_reliable_packet_count(), 1);
     Ok(())
 }
+
+/// A server that accepts a fresh Connect may send before its Accept is
+/// acknowledged, so no acknowledgement of the new generation has moved the
+/// floor yet. Bytes the ended generation had acknowledged above its own lost
+/// packet belong to no receiver's hold any more and must not count.
+#[test]
+fn a_new_generation_on_the_server_does_not_inherit_acknowledged_bytes() -> Result<()> {
+    let mut server = session(500);
+    let mut first_client = session(1);
+    let connect = first_client.create_connect(0, Vec::new())?;
+    let accept = server.accept_connect(&connect, 0, Vec::new())?;
+    server.receive(&ack_for(accept.sequence), 0)?;
+    let g = send(&mut server, 1)?.remove(0);
+    for offset in 1..=4u32 {
+        assert_eq!(sequences(&send(&mut server, MIB)?), vec![g.sequence + offset]);
+        server.receive(&ack_for(g.sequence + offset), 1)?;
+    }
+    assert!(send(&mut server, MIB)?.is_empty());
+
+    let mut second_client = session(200_000);
+    let connect = second_client.create_connect(2, Vec::new())?;
+    let accept = server.accept_connect(&connect, 2, Vec::new())?;
+    assert_eq!(accept.packet_type, CultNetRudpPacketType::Accept);
+    // The Accept is unacknowledged and the only thing pending: 1 MiB fits above it.
+    let sent = server.send("state", vec![7; MIB], reliable())?;
+    assert_eq!(sent.sequence, accept.sequence + 1);
+    Ok(())
+}
diff --git a/packages/cultnet-ts/test/cultnet.test.ts b/packages/cultnet-ts/test/cultnet.test.ts
index bf3f64bb..e6b62bdb 100644
--- a/packages/cultnet-ts/test/cultnet.test.ts
+++ b/packages/cultnet-ts/test/cultnet.test.ts
@@ -1558,6 +1558,26 @@ test("acknowledged bytes count against the lowest unacked sequence as it advance
   assert.deepEqual(sequencesOf(sender.receive(flowAck(h.sequence), 2).readyToSend ?? []), [g.sequence + 6]);
 });
 
+// A server that accepts a fresh Connect may send before its Accept is acknowledged, so no acknowledgement of the new
+// generation has moved the floor yet. Bytes the ended generation had acknowledged above its own lost packet belong to
+// no receiver's hold any more and must not count.
+test("a new generation on the server does not inherit acknowledged bytes", () => {
+  const server = flowSession(500);
+  const accept = server.acceptConnect(flowSession(1).createConnect(0), 0);
+  server.receive(flowAck(accept.sequence), 0);
+  const g = flowSend(server, 1)[0]!;
+  for (let offset = 1; offset <= 4; offset++) {
+    assert.deepEqual(sequencesOf(flowSend(server, MIB)), [g.sequence + offset]);
+    server.receive(flowAck(g.sequence + offset), 1);
+  }
+  assert.equal(flowSend(server, MIB).length, 0);
+
+  const nextAccept = server.acceptConnect(flowSession(200_000).createConnect(2), 2);
+  assert.equal(nextAccept.packetType, "accept");
+  // The Accept is unacknowledged and the only thing pending: 1 MiB fits above it.
+  assert.equal(server.send("state", new Uint8Array(MIB), { reliable: true }).sequence, nextAccept.sequence + 1);
+});
+
 test("CultNet contracts encode legacy bytes without Node Buffer authority", () => {
   const originalBuffer = globalThis.Buffer;
   try {
diff --git a/tests/GameCult.Networking.Tests/NetworkingTests.cs b/tests/GameCult.Networking.Tests/NetworkingTests.cs
index 56d0483b..5a1f570f 100644
--- a/tests/GameCult.Networking.Tests/NetworkingTests.cs
+++ b/tests/GameCult.Networking.Tests/NetworkingTests.cs
@@ -1307,6 +1307,30 @@ namespace GameCult.Networking.Tests
             Assert.That(promoted.Select(packet => packet.Sequence), Is.EqualTo(new[] { g.Sequence + 6 }));
         }
 
+        // A server that accepts a fresh Connect may send before its Accept is acknowledged, so no acknowledgement of
+        // the new generation has moved the floor yet. Bytes the ended generation had acknowledged above its own lost
+        // packet belong to no receiver's hold any more and must not count.
+        [Test]
+        public void RudpSession_ANewGenerationOnTheServerDoesNotInheritAcknowledgedBytes()
+        {
+            var server = FlowSession(500);
+            var accept = server.AcceptConnect(FlowSession(1).CreateConnect(0), 0);
+            server.Receive(FlowAck(accept.Sequence), 0);
+            var g = FlowSend(server, 1).Single();
+            for (uint offset = 1; offset <= 4; offset++)
+            {
+                Assert.That(FlowSend(server, Mib).Select(packet => packet.Sequence), Is.EqualTo(new[] { g.Sequence + offset }));
+                server.Receive(FlowAck(g.Sequence + offset), 1);
+            }
+            Assert.That(FlowSend(server, Mib), Is.Empty);
+
+            var nextAccept = server.AcceptConnect(FlowSession(200_000).CreateConnect(2), 2);
+            Assert.That(nextAccept.PacketType, Is.EqualTo(CultNetRudpPacketType.Accept));
+            // The Accept is unacknowledged and the only thing pending: 1 MiB fits above it.
+            var sent = server.Send("state", new byte[Mib], new CultNetRudpSendOptions { Reliable = true });
+            Assert.That(sent.Sequence, Is.EqualTo(nextAccept.Sequence + 1));
+        }
+
         [Test]
         public void RudpSocketTransport_HandshakesAndCarriesReliableOrderedSchemaFrames()
         {

From d7a98a2763758ecb5d5d13b5809d40150e79b869 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 15:12:27 +0200
Subject: [PATCH 19/24] Variants map: C2a F2 ruled B (carry unclaimed records
 untouched); batch 9 Soul result

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/document-variants-cut.md | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/docs/document-variants-cut.md b/docs/document-variants-cut.md
index 5e191df8..205488b2 100644
--- a/docs/document-variants-cut.md
+++ b/docs/document-variants-cut.md
@@ -369,6 +369,28 @@ stripped (probe). Other findings:
 refuses v3 also contains C2a, so no released reader strips ids. C0 and C1 are never released on their own.
 Raw and cross-runtime writers that cannot see ids stay sticky-only. Fix batch 4 is in Hands.
 
+**C2a F2 ruled (operator, 2026-09-30, accepting Self's recommendation B): records nobody claims are carried
+untouched.** A store may hold records under a schema id that no local type owns or lists as compatible, for
+example after a rename that declared nothing.
+- Both store kinds carry those records byte for byte under their own id. The catalog lists them as foreign
+  records.
+- Writes to other records proceed.
+- A write that would overwrite or relabel an unclaimed record is refused with a typed schema conflict.
+- The single-file store's whole-view write stops relabelling such records onto local types. The directory
+  store stops refusing every commit while it holds one.
+- Why: batches 8-9 showed that the danger is rewriting a record under a new identity (F1, F6), not an
+  undeclared old id. Batch 10's owner-beats-lister rule makes declaring an old id cheap anyway.
+- Self's first lean, "refuse loudly" (A), is superseded.
+
+**C2a batches 9-10 (Soul pass on `fdb8a60a`, 2026-09-30): hold.**
+- **F6, A-B-A lost update on the single-file store.** Ruled by Self: any write that changes a record's bytes or
+  schema id mints a later `storedAt`.
+- **F8, batch 9 over-refused.** An owner beats a lister, so v1 and v2 coexist.
+- **F9.** Compatible ids compare as a set.
+- **F10.** Typed refusal errors in TS and Python.
+- Batch 10 is in Hands.
+- **F7 (`AsSchemaAlias` order) is an open operator question.**
+
 **Operator rulings, 2026-09-30:**
 - **Duplicate unique-index values do not load** ("Duplicate indices should not load"). This covers
   plain records too, so R6-for-indexes becomes one general rule:

From 50f834e45762d2ac485b0f65ba7679ab4dd309ae Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 15:15:20 +0200
Subject: [PATCH 20/24] Map the CultNet error contract cut

The cultnet.error.v0 contract is not decodable across runtimes, and the
interop CI lane has been red for 40 main runs. Cut 0 unblocks the lane;
Q1, Q2, Q3 and Q8 must be ruled before Cut 1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/cultnet-error-contract-cut.md | 636 +++++++++++++++++++++++++++++
 1 file changed, 636 insertions(+)
 create mode 100644 docs/cultnet-error-contract-cut.md

diff --git a/docs/cultnet-error-contract-cut.md b/docs/cultnet-error-contract-cut.md
new file mode 100644
index 00000000..c15f18be
--- /dev/null
+++ b/docs/cultnet-error-contract-cut.md
@@ -0,0 +1,636 @@
+# CultNet error contract: cut map
+
+Status: cut map, not started. Imagination pass 1, 2026-09-30, against CultLib `main` at `8fc74c70`.
+This document owns the means. There is no separate target doc: section 1 holds the ends until the
+operator rules on section 3. After that, Self moves the rulings and invariants into
+`contracts/cultnet/cultnet-distributed-database.md` ("Error Codes") and the schema's own description.
+
+Open: operator questions Q1-Q8 (section 3). No cut is dispatched until Q1, Q2, Q3 and Q8 are ruled. Q4-Q7
+change only single emit sites and can be ruled during Cut 1.
+
+Depends on: `hands/cultmesh-put-serve-bound` merging first. It introduces `document_unservable` in Python
+(`fd394d54`), a codeless unservable refusal in cultmesh-ts (`0eb7434a`) and `CultMeshRudpRejectionReason` in
+cultmesh-rs (`c9cdad12`, `85288a5a`). The cuts below convert those sites. Their anchors are by commit, not by
+line, because the branch is not on main.
+
+Map branch: `main`.
+
+---
+
+## 0. What the Body does today (probed)
+
+Every claim in this table was established by running code. The C#, Rust and TypeScript probes ran on
+Yggdrasil through `ygg-verify.sh` at `8fc74c70`. The Python bytes came from `msgpack.packb` on the exact
+dicts `cultmesh_py/server.py:573-589` and `cultmesh-ts/src/index.ts:5921-5926` build. The six probe inputs:
+
+| Input | Bytes from |
+|---|---|
+| `cs_cursor_stale` | Rust `tests/error_message.rs` captured C# hex (`cursor_stale`, details `{asOf:1,current:2}`) |
+| `cs_routing` | C# `new CultNetErrorMessage { Error, RoutingHint = { Reason="not_primary", Shard=... } }` serialized with `CultNetSchemaMessageSerialization` |
+| `cs_codeless` | C# `new CultNetErrorMessage { Error = "boom" }` |
+| `cs_unknown_code` | C# with `Code = "document_unservable"`, empty `CultNetErrorDetails` |
+| `py_snapshot_byte_limit` | the Python `_error_response` shape: `messageId`, `code: "snapshot_byte_limit_exceeded"`, `details {responseBytes, maxSnapshotBytes}` |
+| `ts_two_key` | the cultmesh-ts shape `{schemaVersion, error}` |
+
+Decoded by:
+
+| Input | C# `CultNetSchemaMessageSerialization.Deserialize` | Rust `decode_cultnet_message_from_slice` | TS `parseCultNetMessage` |
+|---|---|---|---|
+| `cs_cursor_stale` | ok | ok, typed | ok |
+| `cs_routing` | ok | ok, **routingHint dropped** (`code: None, details: None`) | ok (untyped passthrough) |
+| `cs_codeless` | ok | ok | ok |
+| `cs_unknown_code` | ok (free string) | **Err: "not a recognized cultnet.error.v0 code"** | **throws: /code must be one of the allowed values** |
+| `py_snapshot_byte_limit` | ok, but **details silently become an all-null object** (`responseBytes`, `maxSnapshotBytes` lost), `messageId` dropped | **Err: not a recognized code** | **throws** (missing routingHint, extra messageId, code enum, details keys) |
+| `ts_two_key` | ok | ok | **throws: missing routingHint, code, details** — TypeScript cannot parse the errors TypeScript sends |
+
+Captured C# bytes for the two shapes Rust's vector file does not hold (for Hands' reuse):
+
+- `cs_codeless`: `85AD736368656D6156657273696F6EB063756C746E65742E6572726F722E7630A56572726F72A4626F6F6DAB726F7574696E6748696E74C0A4636F6465C0A764657461696C73C0`
+- `cs_routing`: see the probe; the shard descriptor writes ten keys, nil included.
+
+Other findings, from reading source at `8fc74c70`:
+
+1. **The interop CI lane has been red for 40 consecutive `main` runs.** It fails at "Verify CultNet schema
+   contracts stayed consolidated" (`.github/workflows/cultnet-interop.yml:67-90`). That step forbids every
+   `*.schema.json` outside `contracts/cultnet/`, and R-AB deliberately vendors 22 copies into
+   `packages/cultnet-rs/contracts/cultnet/`. Those copies are held byte-equal by
+   `packages/cultnet-rs/tests/schema_discovery_contracts.rs:74-99`. Nothing after that step (every
+   cross-runtime interop test) has run on main in that time. Run `36714768445` is the latest.
+2. **The schema contradicts itself.** `contracts/cultnet/cultnet.error.schema.json:29` says the code is
+   "Additive: a v0 peer that does not know this field ignores it" and, in the same sentence, "a closed
+   enum: Rust and TypeScript refuse". The closed-enum text came from Soul pass 4d (`3f942a57`). It
+   described what the code did; no operator ruled it. `docs/` holds no ruling on unknown codes.
+3. **Emitters that break the schema:**
+   - cultmesh-ts sends `{schemaVersion, error}` only, at `packages/cultmesh-ts/src/index.ts:5875-5878`,
+     `5885-5888`, `5913-5916` and `5922-5925`, and on the branch at `0eb7434a`.
+   - cultmesh-py `_error_response` (`packages/cultmesh-py/src/cultmesh_py/server.py:573-589`) adds a
+     top-level `messageId`, omits `routingHint`, omits `code` and `details` rather than sending nil, and
+     sends eight out-of-enum codes: `unsupported_schema_version` (`:161`), `malformed_document_put`
+     (`:358`), `unregistered_document_put` (`:365`), `malformed_document_delete` (`:386`),
+     `unregistered_document_delete` (`:393`), `snapshot_document_limit_exceeded` (`:558`),
+     `snapshot_byte_limit_exceeded` (`:567`) and `simulation_observations_disabled` (`:596`). The branch
+     adds a ninth, `document_unservable` (`fd394d54`).
+   - `packages/cultnet-py/src/cultnet_py/interop_peer.py:409-417` also sends `unsupported_schema_version`.
+     R-2 (`docs/cultnet-selection-cut.md:2046-2053`) required that code, but it never entered the schema
+     enum.
+4. **A second schema authority.** `packages/cultnet-py/src/cultnet_py/schema_catalog.py:17`, `:272` and
+   `:357-362` publish a hand-built `cultnet.error.v0` descriptor under the canonical `$id`. It has a
+   different shape: `messageId`, `code` as any string, `details` open, and only `schemaVersion` and `error`
+   required. The same file does this for every wire message (about 350 lines). This is recorded as
+   follow-up F-1, not cut here.
+5. **Silent refusals.** cultmesh-rs's RUDP document server returns every rejection to the local caller only
+   (`packages/cultmesh-rs/src/rudp_document_server.rs:470-590`, `CultMeshRudpApplicationRejection`). The
+   peer gets nothing and times out. On the branch this includes the new `DocumentUnservable`.
+6. **Receivers drop the code.**
+   - Every C# receiver turns an error into `new IOException(error.Error)` or
+     `new InvalidOperationException(error.Error)`, so a caller cannot branch on the code. The sites:
+     `src/GameCult.Mesh/CultMeshBodySessions.cs:310`, `CultMeshContentSessions.cs:178/256-260`,
+     `CultMeshPeerExchange.cs:430/466`, `CultMeshSnapshots.cs:91/107/222-226/743` and
+     `CultMeshVerseDiscovery.cs:273`, plus `src/GameCult.Networking/CultNetShardReplication.cs:440/574`.
+   - Rust reads `Error { error, .. }` at `packages/cultmesh-rs/src/lib.rs:823`.
+   - TS types `CultNetErrorMessage` as `{schemaVersion, error}` only (`packages/cultnet-ts/src/contracts.ts:167-170`).
+   - Kotlin has no error type. A request that gets an error back fails a
+     `require(response.schemaVersion == ...)` (`packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt:1278`,
+     `:1334`), and the peer's text is lost.
+7. **No correlation.** Only Python echoes `messageId`.
+   - `cultmesh-browser` rejects an error only when exactly one operation is pending
+     (`packages/cultmesh-browser/src/index.ts:724-731`); otherwise the error is dropped and the operation
+     times out.
+   - C# `CultMeshContentSessions.OnError` (`:256-260`) fails every pending request on any error.
+8. **The reference is inconsistent with itself.** `src/GameCult.Networking/CultNetDatabaseServer.cs:560`
+   refuses a variant change with a codeless error. The subscription server refuses the same condition with
+   `ForVariantUnsupported` (`CultNetDatabaseSubscriptionServer.cs:211/333/366`).
+9. **routingHint is never consumed.** No receiver in any runtime reads it. C# builds it at
+   `CultNetDatabaseServer.cs:638-650`, and Rust's decode discards it.
+10. **Consumer audit** (read-only, all of `F:\Projects` except CultLib; no git in Aetheria):
+    - Outside CultLib, nothing sets `code`, `details` or `routingHint`, and nothing branches on a code.
+    - Emitters:
+      - Huginn: `crates/huginn-daemon/src/serve.rs:288/307/312`, Rust struct literals
+        `Error { error, code: None, details: None }`, pinned at cultnet-rs `8fc74c70`.
+      - AetheriaEve: `Aetheria.State.Daemon/Program.cs:1737/1778`, C# object initializers.
+    - Decoders read `.error` only: Gjallar `Program.cs:574`, Mimir
+      `MimirOdinMoveProofEvidenceRingProvider.cs:80`, Hermodr `hermodr-daemon.cjs:1380` (hand-rolled),
+      AetheriaEve's smoke test (text match against its own emit text), and Huginn's tests (text match).
+    - Stale vendored TS:
+      - `StreamPixels/vendor/CultLib` carries the current closed schema, so any change here breaks its
+        TS error decode until it is re-vendored.
+      - `Heimdall/vendor/CultLib` carries a pre-R-X schema with `additionalProperties:false` and no
+        `routingHint`, so it already refuses every error C# sends today.
+    - Odin, Idunn, Muninn, Ghostlight and voidbot: zero hits.
+
+## 1. Ends
+
+- **One schema.** `contracts/cultnet/cultnet.error.schema.json` is the only authority on the shape and on the
+  code registry. C# embeds it (`GameCult.Networking.csproj:19`), TS mirrors it at build time, and Rust
+  vendors a copy held byte-equal by test. Nothing else publishes a `cultnet.error.v0` shape (F-1 covers
+  Python).
+- **Every runtime emits only schema-valid errors.** This is proven per emit path against the schema, and
+  byte-equal to the C# reference for every registry code.
+- **Every runtime decodes every error it can receive into a typed value.** A known code becomes its typed
+  variant with its typed details. An unknown code, if Q1 says so, becomes a typed "other" that keeps the
+  code string and the raw details. No well-formed error is ever refused, and no field is silently dropped
+  (routingHint, messageId).
+- **Code and details have one owner.** The details a message carries are decided by its code. The types in
+  every runtime make "cursor_stale with a field" unrepresentable. No free-standing code string plus a
+  grab-bag details object.
+- **A refusal is an answer, not a silence** (R-2 precedent, and Q4). A server that refuses a peer's request,
+  and can still send, sends a coded error that correlates to the request.
+- **The public surface is complete in every runtime**, per the consumer-expectation doctrine:
+  - a typed error value;
+  - a constructor per registry code;
+  - a typed exception or error that request APIs raise when the peer refuses, carrying the typed value.
+
+## 2. Identity, lifecycle and authority
+
+| Kind | What names it | Lifecycle | Who decides |
+|---|---|---|---|
+| Error message | `schemaVersion: cultnet.error.v0`; correlated to its request by `messageId` (Q3) | Sent once, in reply to one request or subscription. Never persisted. | The server that refused. |
+| Error code | A snake_case string in the schema's registry (`$defs/knownCode`) | Added by one coordinated change: schema, C# constructor, a C#-written vector, and a typed variant in every runtime. Never renamed and never reused. A retired code stays in the registry marked retired, so an old reader still decodes it. | The operator rules meaning; Self keeps the registry. |
+| Details for a code | The code | Frozen with the code. Adding a key to an existing code's details is a new code (or a v1), never an in-place edit (see Q2). | Same as the code. |
+| Unknown code, at a reader | The raw string | Preserved as typed `Other`. The reader acts on the `error` text and the absence of a known code. | The reader (Q1). |
+| Vector file | `contracts/cultnet/interop/error-vectors.cs-written.json` | Regenerated only by the C# writer test under `CULTNET_WRITE_VECTORS=1` and committed. Every other runtime judges it read-only. | C#, the reference. |
+| routingHint | Shard authority refusal | Sent with a null code (unchanged). Typed in every decoder. | CultNetDatabaseServer's authority path. |
+
+## 3. Operator questions
+
+### Q1. What does a reader do with an error code it does not know?
+
+Today Rust and TypeScript refuse the whole message. The probes above show the result: the peer's error text
+is lost and the caller sees "not a recognized code". In cultmesh-rs's snapshot client the `?` at `lib.rs:812-815`
+even turns a peer refusal into a local decode failure. So under a closed enum every new code breaks every
+reader that has not upgraded. By `docs/semver-policy.md:86-91` that makes each new code a breaking wire
+change, and nine codes are already in flight.
+
+- **A. Closed enum (today).** Readers refuse unknown codes. Every code addition is a coordinated,
+  semver-major wire change across all runtimes and consumers.
+- **B. Closed for emitters, open for readers.** The schema keeps the registry, and every runtime's emit
+  constructors can produce only registry codes (tests prove each emit path valid against the schema).
+  Readers decode an unrecognized code (matching `^[a-z][a-z0-9_]*$`) into a typed `Other { code, details }`.
+  A new code is an additive, minor change: old readers still surface the text and know "an error I cannot
+  classify". This is how gRPC status codes and protobuf open enums behave.
+- **C. Fully open.** No registry; any string, emit and decode.
+
+**Recommended: B.** A refusal must never fail to arrive because it is more specific than the reader
+expected. B keeps the registry as the single meaning authority. C loses the meaning authority, and A makes
+the error channel the most brittle message in CultNet.
+
+Depends on this: schema `code` shape, every decoder, the doc text at `cultnet-distributed-database.md:107-115`.
+
+### Q2. How are details shaped on the wire?
+
+Today C# writes all four detail keys (`field`, `value`, `asOf`, `current`), nil included, because
+`CultNetErrorDetails` (`CultNetSchemaMessages.cs:592-603`) is a MessagePack map-mode object. The codes in
+flight need new keys: `responseBytes`, `maxSnapshotBytes`, `documentCount`, `maxSnapshotDocuments` and
+`schemaVersion`.
+
+- **A. One shared details record; grow it.** Every detail key of every code sits on one record, written as
+  nil when unused. Each new key changes the bytes of every existing error that has details, so all of the
+  C# vectors must be recaptured on every addition. It also breaks every strict reader: TS Ajv, and
+  StreamPixels' vendored schema, have `additionalProperties:false`. And the type cannot tie a key to its
+  code.
+- **B. Per-code details.** `details` carries exactly the keys its code defines. A defined-but-optional key
+  is present as nil; another code's keys are absent. Keys are named for their meaning, which retires the
+  `field: "schemaId"` / `field: "subscriptionId"` indirection that exists only because the record is
+  shared. Adding a code never changes an existing code's bytes. In every runtime, code and details are
+  fused into one tagged type:
+  - Rust: an enum with data.
+  - C#: sealed subclasses, with a custom formatter for `CultNetErrorMessage`. There is precedent in
+    `src/GameCult.Mesh/CultMeshRouteRecordFormatter.cs`.
+  - TS: a discriminated union.
+  - Kotlin: a sealed class.
+  - Python: constructors per code over a frozen dataclass.
+
+  The churn is one time. The five existing C# cases with details change bytes, and all eight Rust hex
+  cases move into the shared vector file anyway (Cut 1).
+- **C. Opaque string map.** Untyped; no runtime can offer a typed accessor.
+
+**Recommended: B.** A is the churn the brief warned of, and it recurs on every future code. B pays it once,
+at the moment every vector is being recaptured regardless.
+
+Depends on this: the schema's `details`, the C# model and formatter, `encode_error_details`
+(`packages/cultnet-rs/src/contracts.rs:1339-1366`), and every decoder.
+
+### Q3. Does an error carry the `messageId` of the request it refuses?
+
+Python already sends `messageId` (`server.py:583`); the schema forbids it. Without it:
+
+- `cultmesh-browser` drops an error whenever two operations are pending (`index.ts:724-731`);
+- C# content sessions fail every pending request on any error (`CultMeshContentSessions.cs:256-260`).
+
+Adding a top-level key changes the bytes of every C# error. That happens once, in the same recapture as Q2.
+
+- **A.** Add a nullable top-level `messageId`. A reply to a request echoes the request's id, and an error
+  with no request (a subscription push, an unsolicited refusal) sends nil. Receivers correlate by it and
+  fall back to their current behavior when it is nil.
+- **B.** No correlation. Python deletes the field.
+
+**Recommended: A.** Correlation is a capability any multiplexing client needs, and one runtime already
+depends on it.
+
+### Q4. Do servers send `document_unservable` (and every other refusal they can) to the peer?
+
+Self ruled that "unservable" must be distinguishable as a typed code in every runtime. On the branch:
+Python sends it coded, TypeScript sends it codeless, and Rust tells only its local caller, so the Rust
+peer times out. The same Rust silence covers every other document-server rejection: a sink refusal, a
+failed snapshot source, too many snapshot documents, and a snapshot response that is too large.
+
+- **A.** Every refusal of a peer's request that the server can still send is answered with a coded error
+  carrying the request's `messageId`, and is also reported locally (Rust's `ApplicationRejected` stays as
+  the local report). The refusals that cannot be answered are the ones where the answer itself cannot be
+  queued: Rust `PayloadBudgetFull` and `ResponseQueueFailed`. Those stay local-only, and the doc says so.
+- **B.** Local-only in Rust; peer replies only where a runtime already sends them.
+
+**Recommended: A.** R-2 already ruled that a silence is worse than a missing feature
+(`docs/cultnet-selection-cut.md:2049-2053`), and the operator's ruling that CultMesh "refuses" puts only
+means something to the party that sent the put.
+
+### Q5. Does Python's `unregistered_document_put` / `unregistered_document_delete` become `unowned_schema`?
+
+Python sends these when the node has no registered document type for the record's schemaId
+(`cultmesh_py/node.py:653-666`). C# `unowned_schema` means "no shard owns this schema and key"
+(`CultNetSchemaMessages.cs:537-544`). To a peer both mean "this server will not take that schema here; route
+elsewhere". The put and delete variants duplicate what the peer already knows (it sent the message).
+
+- **A.** Both collapse into `unowned_schema { schemaId }`. The registry text broadens to "this server
+  stores no document for that schema (and key)".
+- **B.** Join as a separate `schema_unregistered { schemaId }`.
+- **C.** Join both codes as they are.
+
+**Recommended: A.** It is one meaning at the peer, and there is one action to take.
+
+### Q6. Does Python's `malformed_document_put` / `malformed_document_delete` become one `message_invalid { field }`?
+
+These are sent when the request lacks a required field (`server.py:355-359`, `383-387`). C# has the same
+condition, codeless, at `CultNetDatabaseServer.cs:373/415` and `CultNetDatabaseSubscriptionServer.cs:148`
+("requires a subscriptionId or messageId").
+
+- **A.** One `message_invalid { field }`, naming the missing or ill-typed field. It is used by Python's four
+  sites and C#'s three.
+- **B.** Join both per-message codes and leave C# codeless.
+
+**Recommended: A.** The per-message suffix repeats the request's own schemaVersion, and C# gains a code for
+free.
+
+### Q7. Does `simulation_observations_disabled` become `unsupported_schema_version`?
+
+Python sends it when the observation hub is off (`server.py:593-598`), with
+`details { schemaVersion: "cultnet.simulation_observation.v0" }`, which is exactly the
+`unsupported_schema_version` shape. cultmesh-ts's "no cache for snapshot requests" and "no operation
+handler" refusals (`index.ts:5875`, `5913`) mean the same thing: this server does not serve that message.
+
+- **A.** Collapse. `unsupported_schema_version` means "this server does not serve messages of this
+  schemaVersion: unknown, a newer version, or not enabled here". The three TS sites and Huginn's "answers
+  only X, Y, Z" adopt it.
+- **B.** Keep a separate `feature_disabled`-style code.
+
+**Recommended: A.** A peer cannot act differently on "not enabled" and "not known". Python's
+`verify.py:335` check follows the rename.
+
+### Q8. Is this a correction of `cultnet.error.v0` in place, or a new `cultnet.error.v1`?
+
+Under Q2-B and Q3-A, strict v0 readers (TS Ajv and vendored copies) refuse the new bytes. Tolerant readers
+(C#, Rust, Python) keep working, because the probes show they ignore unknown keys and treat a missing key
+as null.
+
+- **A. In place.** The v0 contract has never been decodable across all five runtimes (section 0). No
+  consumer outside CultLib reads code or details (finding 10). Every publishing package takes the semver
+  bump its policy requires:
+  - `org.gamecult.cultlib` major, because the public `CultNetErrorDetails` properties change;
+  - `cultnet-py` and `cultmesh-py` major, because emitted codes change;
+  - Rust pins move deliberately.
+
+  StreamPixels and Heimdall re-vendor.
+- **B. v1.** Add `cultnet.error.v1`, keep v0 emit for peers that did not advertise v1 in hello, and run
+  two error encoders in every runtime until v0 retires.
+
+**Recommended: A.** B builds a version-negotiation path for a message nobody outside CultLib parses beyond
+`.error`. The one thing every old reader does need, the `error` text, survives A in every tolerant runtime.
+
+## 4. The registry (as recommended; rewrite on each ruling)
+
+| Code | Meaning | Details (per Q2-B; `?` = present-as-nil when absent) | Emitted by after this map |
+|---|---|---|---|
+| `selection_invalid` | A selection field failed the door. | `{ field, value? }` | C#, Rust (selection) |
+| `cursor_stale` | The cursor predates the server's retained history. | `{ asOf, current }` | C#, Rust |
+| `cursor_invalid` | The cursor could not be parsed. | none (details nil) | C#, Rust |
+| `reference_outside_target` | A hop reference left the declared target. | none | C#, Rust |
+| `variant_unsupported` | The selection selects a document variant CultNet does not carry. | `{ subscriptionId? }` | C# (incl. `DatabaseServer.cs:560`) |
+| `unowned_schema` | This server stores no document for that schema (and key). | `{ schemaId }` | C#, Python (Q5) |
+| `unsupported_schema_version` | This server does not serve messages of this schemaVersion. | `{ schemaVersion }` | Python, TS, Huginn (Q7) |
+| `message_invalid` | The request lacks a required field or has an ill-typed one. | `{ field }` | C#, Python (Q6) |
+| `snapshot_document_limit_exceeded` | The snapshot answer would exceed the document bound. | `{ documentCount, maxSnapshotDocuments }` | Python, Rust (Q4) |
+| `snapshot_byte_limit_exceeded` | The snapshot answer would exceed the byte bound. | `{ responseBytes, maxSnapshotBytes }` | Python, Rust (Q4) |
+| `document_unservable` | A put was refused because no snapshot could ever return the stored document under the byte bound. | `{ responseBytes, maxSnapshotBytes }` | Python, TS, Rust (Q4) |
+
+A null code is legal and means "unclassified". Examples: an exception message from a failed snapshot
+source, an authority refusal carrying `routingHint`, and "not authorized"
+(`CultNetDatabaseSubscriptionServer.cs:165`). This map does not invent codes for those.
+
+`snapshot_byte_limit_exceeded` and `document_unservable` have identical details. That is deliberate, and it
+is the fixture trap named in the verification rules.
+
+---
+
+## 5. Cuts
+
+All cuts are made on one campaign branch, `hands/error-contract`, from `main` after
+`hands/cultmesh-put-serve-bound` merges. The branch merges to `main` once, after Cut 5's Soul pass. The
+reason: Cut 1 changes C# bytes, and Rust's static hex cases would stay green against the stale bytes
+(finding: `tests/error_message.rs` pins constants, not the reference). A partial merge would ship a
+wire split while every suite passed. Each cut gets its own worktree, created by Self. Heavy verification
+runs through `ygg-verify.sh`, never on Starfire.
+
+### Cut 0. Unblock the interop lane
+
+- **Repo/branch:** CultLib, `hands/interop-guard` from `main`, merged alone ahead of the campaign. It
+  does not depend on the rulings.
+- **Deletes first:** nothing.
+- **Per-file changes:** `.github/workflows/cultnet-interop.yml:72`. The `$stray` filter also accepts
+  `^packages/cultnet-rs/contracts/cultnet/`, with a comment naming R-AB and
+  `packages/cultnet-rs/tests/schema_discovery_contracts.rs:74-99` as the equality guard. The namespace
+  check is unchanged.
+- **Authority map:** no ownership change. The canonical owner stays `contracts/cultnet/`, and the Rust
+  mirror is derived from it, with drift judged by the Rust test.
+- **Verification:**
+  - Push the branch and run the workflow. Report every step that goes red after the guard. None of those
+    steps has run on main for 40 runs, so expect more red, and treat each failure as its own finding;
+    do not fix it in this cut.
+  - Negative: edit one byte of a vendored copy locally and check that the Rust equality test fails.
+    Reach it on Yggdrasil with `cd packages/cultnet-rs && cargo test --test schema_discovery_contracts`.
+- **Ledger:** +3 lines.
+
+### Cut 1. The contract and the C# reference
+
+- **Repo/branch:** CultLib `hands/error-contract`, worktree named by Self.
+- **First:** capture the current C# bytes for all eight factory cases, plus `cs_codeless` and `cs_routing`,
+  into the Hands report. This is the before-image a Soul pass compares against.
+- **Deletes first:**
+  - `CultNetErrorDetails` (`src/GameCult.Networking/CultNetSchemaMessages.cs:588-603`, 16 lines) as a
+    shared record.
+  - The `field`/`value`/`asOf`/`current` property block and the `[MessagePackObject]`/`[Key]` attributes
+    on `CultNetErrorMessage` (`:497-521`). Its serialization moves to one formatter.
+  - `SoulP4dProbeTests.Wire_UnownedSchemaBytes` (`tests/GameCult.Networking.Tests/SoulP4dProbeTests.cs:191-199`).
+    It is an `[Explicit]` hex printer, superseded by the vector writer.
+  - The closed-enum paragraph at `contracts/cultnet/cultnet-distributed-database.md:107-115` and
+    the `code`/`details` descriptions in the schema (`:28-42`).
+- **Adds:**
+  - **Schema** (`contracts/cultnet/cultnet.error.schema.json`, rewritten; the Rust mirror is re-copied
+    byte-equal):
+    - Top level: `schemaVersion`, `error` and `routingHint` as today, plus `messageId: string|null` (Q3)
+      and `code`. All five are required, present-as-nil (R-X is unchanged at the top level).
+    - `$defs/knownCode` is the registry enum from section 4.
+    - `code` is `null`, or a string matching `^[a-z][a-z0-9_]*$` (Q1-B).
+    - `details` is decided by a top-level `oneOf`, one branch per known code, each fixing `code` by
+      `const` and `details` by exact `properties`/`required`/`additionalProperties:false`. Two more
+      branches: a null code with null details, and an unknown code (`not: {$ref knownCode}`) with details
+      `object|null`, open.
+    - Use `oneOf`/`not`/`const` only. `tests/GameCult.Networking.Tests/MiniJsonSchemaValidator.cs:30-35`
+      implements those and **not** `if`/`then`/`allOf`, and it refuses unimplemented keywords. TS
+      compiles with Ajv2020 (`packages/cultnet-ts/src/contracts.ts:1,674`), which handles both.
+  - **C# model** (`GameCult.Networking`):
+    - `CultNetErrorMessage { SchemaVersion, Error, MessageId?, RoutingHint?, Refusal? }`, where
+      `Code => Refusal?.Code` is derived and not settable.
+    - `abstract CultNetRefusal { string Code }`, with one sealed subclass per registry code carrying its
+      typed details (`CultNetCursorStaleRefusal(ulong AsOf, ulong Current)` and so on), plus
+      `CultNetUnknownRefusal(string Code, IReadOnlyDictionary<string, object?>? Details)` for Q1-B.
+    - `CultNetErrorCodes`: string constants, one per registry code.
+    - `CultNetErrorMessageFormatter : IMessagePackFormatter<CultNetErrorMessage>`. It writes the five
+      top-level keys in order (schemaVersion, error, messageId, routingHint, code, details), and details
+      as exactly the refusal's keys. It reads by key name, tolerates unknown keys at both levels, and
+      maps an unknown code to `CultNetUnknownRefusal`. Register it through `[MessagePackFormatter]` on
+      the type, the way `CultMeshRouteRecordFormatter` is wired.
+    - Factories: keep `ForSelectionInvalid`, `ForCursor`, `ForReferenceOutsideTarget`,
+      `ForVariantUnsupported` and `ForUnownedSchema` as thin constructors over the refusal types, and add
+      one per new code. Each takes an optional `messageId`.
+    - `CultNetPeerErrorException : IOException`, carrying the `CultNetErrorMessage`.
+  - **Vector writer:** `ErrorVectorTests.WriteErrorVectors`, gated on `CULTNET_WRITE_VECTORS=1` like
+    `SelectionParityVectorTests.cs:460-552`. It writes `contracts/cultnet/interop/error-vectors.cs-written.json`:
+    one entry per registry code (both optional-key states where a key is optional), `cs_codeless`,
+    `cs_routing`, one unknown code with open details, and one error with `messageId` set. Each entry
+    holds `{ name, messagePackBase64, expected: { error, messageId, code, details, routingHint } }`,
+    where `expected` is a JSON projection every runtime compares its typed decode against.
+- **Per-file changes** (`8fc74c70`):
+  - `CultNetDatabaseServer.cs:560`: `ForVariantUnsupported(refusal.Message, subscriptionId)`.
+  - `CultNetDatabaseServer.cs:373`, `:415` and `CultNetDatabaseSubscriptionServer.cs:148` become
+    `message_invalid { field: "subscriptionId" }` (Q6-A).
+  - Every `SendCultNet(CultNetErrorMessage...)` that answers a request passes the request's `MessageId`.
+  - Each receiver listed in finding 6 throws `new CultNetPeerErrorException(error)` instead of
+    wrapping `error.Error`. `CultMeshContentSessions.OnError` (`:256-260`) fails only the pending entry
+    whose id matches `error.MessageId`, and falls back to all entries only when the id is nil.
+  - `CultNetSchemaContractTests.cs:165-214`: the per-factory tests are replaced by one test that validates
+    every vector's decoded JSON against the schema with `MiniJsonSchemaValidator`, and one test that
+    serializes each registry factory and asserts byte equality with its committed vector.
+  - Rewrite `contracts/cultnet/cultnet-distributed-database.md` "Error Codes" to the registry, and state
+    the Q1 and Q2 rules.
+- **Authority map:**
+  - Owner: the schema's registry owns code meaning and detail shape. `CultNetErrorMessageFormatter` owns
+    C# bytes. The refusal subclass owns the code-to-details binding.
+  - Inputs: the refusal instance, messageId, routingHint.
+  - Outputs: bytes, and `cs-written.json` for the other runtimes.
+  - Derived state: `CultNetErrorMessage.Code` becomes derived; the refusal decides it.
+  - Forbidden writers: any `Code = "..."` assignment (it cannot compile); `[Key]` attribute serialization
+    of the message; hand-typed hex anywhere.
+  - Shared paths: every server send uses the factories; every receiver uses `CultNetPeerErrorException`.
+  - Deletion line: `CultNetErrorDetails` and the settable `Code`.
+- **Verification** (`dotnet` image):
+  - Builds: `tests/GameCult.Networking.Tests`, `tests/GameCult.Mesh.Tests`.
+  - `ErrorVectorTests` with `CULTNET_WRITE_VECTORS=1`, then without, and check that the committed file
+    reproduces byte-for-byte.
+  - Tests and the rules they pin:
+    - vector round trip: bytes, decode, bytes are equal for every entry;
+    - a registry factory is byte-equal to its vector;
+    - every vector validates against the schema;
+    - an unknown code decodes to `CultNetUnknownRefusal` with its raw details intact;
+    - a Python-shaped error (`py_snapshot_byte_limit` above, with the Q2/Q3 shape) decodes typed with
+      `responseBytes` and `maxSnapshotBytes` intact. Today's C# silently empties those.
+    - content-session correlation: two pending requests, an error for the second, and the first still
+      completes.
+  - Mutation: Stryker.NET on the formatter and factories. The survivors that must die:
+    - swapping two known codes whose details are identical (`snapshot_byte_limit_exceeded` and
+      `document_unservable`);
+    - padding a nil key into details;
+    - dropping `messageId` on encode;
+    - mapping an unknown code to null.
+  - Negative greps (checked at HEAD, where they hit the sites being cut):
+    - `git grep -nE 'new (IOException|InvalidOperationException)\(error\.Error\)' -- src` must return 0
+      (9 hits at HEAD).
+    - `git grep -nE 'Field = "(schemaId|subscriptionId)"' -- src` must return 0 (2 at HEAD).
+  - Operator: none.
+- **Ledger:** about -60 C# (the details record, the settable code, the probe printer, and the per-factory
+  schema tests), +250 (the formatter, the refusal types, the vector writer). The schema grows by about 90
+  JSON lines. The net is positive, bought by Q1/Q2 typing in the reference.
+
+### Cut 2. Rust: cultnet-rs and cultmesh-rs
+
+- **Deletes first:**
+  - `CultNetErrorCode` and `CultNetErrorDetails` as separate types (`packages/cultnet-rs/src/contracts.rs:252-310`,
+    59 lines);
+  - `require_error_details` (`:1121-1146`);
+  - `encode_error_details` (`:1339-1366`);
+  - the eight hex `Case`s and the header comment in `packages/cultnet-rs/tests/error_message.rs:1-160`.
+    That file is rewritten to read the vector file.
+  - Keep `require_legacy_optional_u64` (`:1149`). Check with `git grep` for other callers first; at HEAD,
+    only the error details use it.
+- **Adds:**
+  - `CultNetMessage::Error { error: String, message_id: Option<String>, routing_hint: Option<CultNetShardRoutingHint>, refusal: Option<CultNetRefusal> }`.
+  - `enum CultNetRefusal`, with one variant per registry code and its typed fields, plus
+    `Other { code: String, details: Option<rmpv::Value> }`.
+  - `CultNetRefusal::code(&self) -> &str`.
+  - A constructor `CultNetMessage::error(text)` and builder-style `with_refusal` / `with_message_id`, so
+    consumers stop writing struct literals. Huginn has three.
+  - Decode reads every top-level key by name and routes unknown codes to `Other` (Q1-B).
+  - Encode writes the Cut 1 key order.
+  - `CultNetShardRoutingHint` is typed, reusing the crate's existing shard descriptor type.
+- **Per-file changes:**
+  - `packages/cultnet-rs/src/contracts.rs:361-368` (variant), `:1097-1115` (decode), `:1300-1336` (encode).
+  - `packages/cultnet-rs/src/selection.rs:1210-1255`: the four refusals build `CultNetRefusal` variants.
+  - `packages/cultnet-rs/src/content.rs:316`: uses `CultNetMessage::error`.
+  - `packages/cultmesh-rs/src/lib.rs:812-827`: a peer error becomes a typed error carrying the refusal,
+    instead of `anyhow!` text. Name it `CultMeshPeerError`, next to the crate's existing error types.
+  - `packages/cultmesh-rs/src/rudp_document_server.rs` (Q4-A): each `CultMeshRudpRejectionReason` that
+    can be answered sends the matching coded error, correlated by the request's message id, before
+    returning `ApplicationRejected`. `PayloadBudgetFull` and `ResponseQueueFailed` stay local.
+- **Authority map:**
+  - Owner: `CultNetRefusal` owns code and details. The schema owns the registry.
+  - Forbidden writers: string codes (`from_wire_str` survives only inside decode); struct literals of
+    details.
+  - Shared paths: selection refusals, document-server refusals and content errors all go through the one
+    encoder.
+- **Verification** (`rust` image, `cd packages/cultnet-rs` then `cd ../cultmesh-rs`):
+  - `cargo test --workspace`.
+  - `tests/error_message.rs` pins: every vector decodes to `expected`; encoding the decoded value
+    reproduces the vector's bytes; the unknown-code vector decodes to `Other`; the routing vector keeps
+    `routing_hint`.
+  - cultmesh-rs: a put over the bound makes the peer receive `document_unservable` with the request's
+    message id, and details equal to the computed size and the bound. Run it at two bounds so that a
+    constant or an offset in `maxSnapshotBytes` dies.
+  - A peer that sends a Python-shaped `snapshot_byte_limit_exceeded` produces a `CultMeshPeerError`, not
+    a decode failure.
+  - Mutation: `cargo mutants --in-diff` on the cut's diff. Triage every survivor by name.
+  - Negative: `git grep -n 'CultNetErrorDetails' -- packages` must return 0.
+- **Consumer note:** Huginn's `serve.rs:288/307/312` and its tests stop compiling at the next pin bump.
+  The migration is mechanical (`CultNetMessage::error(...)`), and `:312` adopts `unsupported_schema_version`
+  (Q7). Self routes it as a Huginn change; it is not part of this branch.
+
+### Cut 3. TypeScript: cultnet-ts, cultmesh-ts and cultmesh-browser
+
+- **Deletes first:**
+  - the two-field `CultNetErrorMessage` interface (`packages/cultnet-ts/src/contracts.ts:167-170`);
+  - the four literal error constructions in `packages/cultmesh-ts/src/index.ts:5875-5878`, `5885-5888`,
+    `5913-5916` and `5922-5925`, and the branch's codeless unservable site (`0eb7434a`);
+  - `rejectCorrelated`'s single-pending heuristic (`packages/cultmesh-browser/src/index.ts:724-731`).
+- **Adds:**
+  - `CultNetErrorMessage` with every field.
+  - `type CultNetRefusal` as a discriminated union on `code`, with an `{ code: string; details: Record<string, unknown> | null; known: false }` arm.
+  - `createCultNetError(text, { messageId, refusal })` as the only constructor.
+  - `class CultNetPeerError extends Error { message: CultNetErrorMessage }`.
+  - `parseCultNetMessage` keeps Ajv validation against the canonical schema; it now accepts every schema
+    branch, including unknown codes.
+- **Per-file changes:**
+  - cultmesh-ts: the three "does not serve this" sites (`5875`, `5913`, `5922`) send
+    `unsupported_schema_version` (Q7-A); the snapshot catch (`5885`) sends a null code; the unservable site
+    sends `document_unservable` with details.
+  - cultmesh-ts `6527-6529` throws `CultNetPeerError`.
+  - cultmesh-browser `163`, `584` and `690`: correlate by `messageId`, falling back to today's behavior only
+    for a nil id.
+  - `packages/cultnet-ts/src/idunn-odin-presence-publisher.ts:118-120` throws `CultNetPeerError`.
+  - The legacy `gamecult.networking.v0` path (`contracts.ts:840-844`, `:899-900`) is unchanged. That is a
+    separate legacy contract.
+- **Verification** (`kotlin` image, which carries Node 24; `npm install`, then build cultcache-ts before
+  cultnet-ts):
+  - A new `test/error-vectors.test.ts` pins that every vector parses and deep-equals `expected`, and that
+    `encode(createCultNetError(...))` is byte-equal to each registry vector.
+  - The cultmesh-ts document-server tests assert that each refusal parses with TypeScript's own
+    `parseCultNetMessage`. That is the probe's `ts_two_key` failure, pinned.
+  - Browser: two pending operations, an error for the second, and the first still resolves.
+  - Mutation: StrykerJS on the diff.
+  - Negative: `git grep -nE 'schemaVersion: "cultnet\.error\.v0",' -- packages/cultmesh-ts/src packages/cultmesh-browser/src`
+    must return 0. Exclude `cultnet-ts/src/schema-discovery.ts:302` (a descriptor) and
+    `contracts.ts:842` (legacy decode); both are legitimate hits for the unscoped pattern.
+
+### Cut 4. Python: cultnet-py and cultmesh-py
+
+- **Deletes first:**
+  - `_error_response` (`packages/cultmesh-py/src/cultmesh_py/server.py:573-589`);
+  - `unsupported_schema_version_error` (`packages/cultnet-py/src/cultnet_py/interop_peer.py:409-417`);
+  - every string literal code in `server.py` (lines in finding 3).
+- **Adds:**
+  - `cultnet_py/errors.py`, holding:
+    - `CultNetErrorCode(StrEnum)`, the registry;
+    - a frozen `CultNetError` dataclass (`error`, `message_id`, `routing_hint`, `code: CultNetErrorCode | str | None`,
+      `details: Mapping | None`);
+    - one constructor function per code, taking exactly that code's keys;
+    - `to_wire()`, which writes the five top-level keys in the Cut 1 order, nil included;
+    - `parse_cultnet_error(dict)`.
+  - `CultNetPeerError` (`client.py:46-50`) keeps `.response` and gains `.error: CultNetError`.
+- **Per-file changes:**
+  - Sites `server.py:158-163`, `355-394`, `555-569` and `593-598` and the branch's `document_unservable`
+    site use the constructors, with the Q5-A/Q6-A/Q7-A codes.
+  - `interop_peer.py` uses the constructor.
+  - `verify.py:335` reads `error.error.code`.
+  - Tests `packages/cultmesh-py/tests/test_cultmesh.py:2088`, `3791`, `4323` and `4363-4371`, and
+    `packages/cultnet-py/tests/test_cultnet.py:2342`, follow the renames.
+- **Verification** (the image the campaign already uses for Python; state it in the report):
+  - A vector test pins that every vector parses to `expected` and that each constructor's `msgpack.packb`
+    is byte-equal to its vector.
+  - Mutation: mutmut on `errors.py` and the changed server sites.
+  - Negative: `git grep -nE '"schemaVersion": "cultnet\.error\.v0"' -- packages/cultnet-py/src packages/cultmesh-py/src`
+    returns only `errors.py`.
+- **Not here:** F-1 (`schema_catalog.py` publishes its own shapes).
+
+### Cut 5. Kotlin: cultmesh-kotlin
+
+- **Adds:**
+  - A `CultNetErrorMessage` data class and a `sealed class CultNetRefusal` (known codes plus `Other`),
+    with a `CultNetMessage.asError(): CultNetErrorMessage?` view.
+  - `class CultNetPeerException(val error: CultNetErrorMessage) : IOException`.
+  - At `CultMesh.kt:1278` and `:1334`, and at every `receiveSchemaMessage` consumer that expects a
+    response, an error response throws `CultNetPeerException` before the `require`.
+- **Verification** (`kotlin` image, `pwsh -File build.ps1`):
+  - A vector test pins that every vector decodes to `expected`.
+  - Kotlin emits no errors today, so encode parity applies only if a Kotlin server path is added. Say
+    so in the report; do not invent one.
+  - There is no mutation tool. Behavioural tests cover it: an error reply to a schema-catalog request
+    raises `CultNetPeerException` carrying the code.
+
+### Cut 6. Merge, release, consumers
+
+- Soul runs over the whole branch before the merge:
+  - rerun every vector suite;
+  - decode each runtime's live emissions with every other runtime. The interop lane from Cut 0 is the
+    harness; add an error round to `tests/GameCult.Networking.InteropPeer` and
+    `packages/cultnet-ts/test/interop` if Soul finds a runtime pair unreached.
+- Release per `docs/semver-policy.md`, with a Soul pass before tags:
+  - `org.gamecult.cultlib` major, and the tracked Unity DLLs rebuilt, since they embed the schema;
+  - `cultnet-py` and `cultmesh-py` major.
+- Consumers, routed by Self as separate repo changes:
+  - Huginn: pin bump plus Cut 2's note.
+  - StreamPixels and Heimdall: re-vendor. Heimdall is already broken by R-X.
+  - AetheriaEve, Gjallar and Mimir compile against the live CultLib path and read only `.Error`, so they
+    need no change. That is inferred from the audit; the next build of each confirms it.
+  - Hermodr: none.
+
+## 6. Subtraction ledger
+
+| Cut | Removed (estimate) | Added (estimate) | Formats / targets |
+|---|---|---|---|
+| 0 | 0 | 3 | none |
+| 1 | ~60 C#, schema text | ~250 C#, ~90 schema | + `error-vectors.cs-written.json`; - `[Explicit]` hex printer |
+| 2 | ~150 (types, two helpers, 160-line hex test) | ~200 | hex constants gone; vectors read from file |
+| 3 | ~40 | ~120 | none |
+| 4 | ~40 | ~120 (`errors.py`) | 8 ad-hoc codes → registry |
+| 5 | 0 | ~80 | none |
+
+The net is positive, by roughly 500 lines, across five runtimes. It buys typed decode where there was
+none (Kotlin, TS and Python), a correlation capability, and one vector file in place of hand-copied hex.
+The pressure point: if Cut 1's formatter passes 150 lines, report it rather than trimming typing.
+
+## 7. Follow-ups outside this map
+
+- **F-1.** `packages/cultnet-py/src/cultnet_py/schema_catalog.py` publishes about 350 lines of hand-built
+  schemas under canonical `$id`s. Python should package and serve `contracts/cultnet/*.schema.json`, the
+  way Rust vendors them. It is a separate cut, because it covers every message, not errors. It can wait
+  because the catalog is advisory: no runtime validates a peer's message against a published descriptor.
+- **F-2.** Codes for the remaining codeless refusals (authorization, failed snapshot sources, routing).
+  Wait for a consumer that branches on them.
+- **F-3.** Whatever the Cut 0 lane reveals once its later steps run again.

From c8e3ef917e1d1e30f59772f42caa3f8c7d6922cd Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 15:20:03 +0200
Subject: [PATCH 21/24] Error contract map: Q1 B, Q2 B, Q3 A, Q8 A ruled

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/cultnet-error-contract-cut.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docs/cultnet-error-contract-cut.md b/docs/cultnet-error-contract-cut.md
index c15f18be..923cf51a 100644
--- a/docs/cultnet-error-contract-cut.md
+++ b/docs/cultnet-error-contract-cut.md
@@ -153,6 +153,14 @@ Other findings, from reading source at `8fc74c70`:
 
 ## 3. Operator questions
 
+**Rulings (operator, 2026-09-30):** "Q1: B / Q2: B / Q3: A / Q8: A".
+- **Q1:** closed for emitters, open for readers. An unknown code decodes to a typed `Other`.
+- **Q2:** per-code details.
+- **Q3:** a nullable top-level `messageId`.
+- **Q8:** v0 is corrected in place, with the semver bumps the policy requires.
+- Q4-Q7 are still open.
+- Cut 1 waits for `hands/cultmesh-put-serve-bound` to merge.
+
 ### Q1. What does a reader do with an error code it does not know?
 
 Today Rust and TypeScript refuse the whole message. The probes above show the result: the peer's error text

From 6d0cc96316e139ce85e11a7d77aecd30f0b51851 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 15:25:19 +0200
Subject: [PATCH 22/24] Variants map: F7 ruled, retire AsSchemaAlias

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/document-variants-cut.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/docs/document-variants-cut.md b/docs/document-variants-cut.md
index 205488b2..bd340c87 100644
--- a/docs/document-variants-cut.md
+++ b/docs/document-variants-cut.md
@@ -389,7 +389,13 @@ example after a rename that declared nothing.
 - **F9.** Compatible ids compare as a set.
 - **F10.** Typed refusal errors in TS and Python.
 - Batch 10 is in Hands.
-- **F7 (`AsSchemaAlias` order) is an open operator question.**
+- **F7 ruled (operator, 2026-09-30): retire `AsSchemaAlias`.** "Schema aliasing sounds like a really bad idea, I
+  support retiring it."
+  - C# refuses a second type for one schema, as TS, Python and Rust already do. There is one type per schema in
+    every runtime.
+  - The API, its registry path (`IsExactWireAlias`) and the tests that exercised it (7 Mesh, 2 Caching) are
+    deleted or rewritten.
+  - No consumer called it.
 
 **Operator rulings, 2026-09-30:**
 - **Duplicate unique-index values do not load** ("Duplicate indices should not load"). This covers

From cc624e934de65e30a822da357649804f90644f43 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 15:36:26 +0200
Subject: [PATCH 23/24] Ack map: Cut 3 merged (1210fdc7)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/cultnet-rudp-ack-cut.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/docs/cultnet-rudp-ack-cut.md b/docs/cultnet-rudp-ack-cut.md
index e7c8f6ae..7f414301 100644
--- a/docs/cultnet-rudp-ack-cut.md
+++ b/docs/cultnet-rudp-ack-cut.md
@@ -1590,6 +1590,16 @@ profiles.
   a permanent failure is returned from a caller-directed send and, inside a poll, ends only that peer's session with a
   typed reason; transient failures stay counted losses. Windows `ConnectionResetError` on receive is idle, never fatal,
   in every server. Cut D's negative grep `send_packet(...)?;` is obsolete: the `?` now propagates encode errors only.
+- **Cut 3 merged at `1210fdc7` (2026-09-30).**
+  - Batch 2 fixed Rust `send`, which checked the window before purging expired packets. It also added a
+    new-generation test in all four runtimes.
+  - Soul pass on batch 2: nothing found. 18 mutants were killed. Interop was 27/27, run in `ack1d-interop:2`,
+    whose Linux wrappers let the Windows-only Kotlin build run.
+  - Residual: `packages/cultmesh-rs/Cargo.lock` is stale.
+  - Also recorded: `packages/cultmesh-kotlin/build.ps1` is Windows-only, so Kotlin interop runs off Windows only
+    through an image with wrappers.
+  - P2 (the expiry hole) stays with Cut F.
+- **Cut D batch 2** is in Soul (pass 2).
 - **Recorded (liveness, not fixed):** a lowest reliable packet lost forever stalls the sender 1,023 sequences ahead
   while the peer stays alive; session timeout doesn't end it. TCP ends such a connection after a retransmission
   limit (R2). Decide with Cut F (abandonment) whether a reliable packet outstanding past a bound ends the session.

From 045f9a21b6e2f63462336078be6aece785e45b6a Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 30 Sep 2026 15:46:59 +0200
Subject: [PATCH 24/24] Ack map: Cut D Soul pass 2 result; K1 gains the Kotlin
 resend loop

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/cultnet-rudp-ack-cut.md | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/docs/cultnet-rudp-ack-cut.md b/docs/cultnet-rudp-ack-cut.md
index 7f414301..9770e1e1 100644
--- a/docs/cultnet-rudp-ack-cut.md
+++ b/docs/cultnet-rudp-ack-cut.md
@@ -1599,7 +1599,16 @@ profiles.
   - Also recorded: `packages/cultmesh-kotlin/build.ps1` is Windows-only, so Kotlin interop runs off Windows only
     through an image with wrappers.
   - P2 (the expiry hole) stays with Cut F.
-- **Cut D batch 2** is in Soul (pass 2).
+- **Cut D batch 2, Soul pass 2: fix first.**
+  - cultnet-ts emits transient send failures as `"error"`, which crashes processes with no listener. Section 10's
+    claim that "Node reports send failures on the socket's error event" is false on Node 24 without a callback:
+    they are dropped silently.
+  - C# stale peer objects write into the replacing session.
+  - cultmesh-py dies on a non-ValueError per-peer failure.
+  - Six guards are unpinned.
+  - Batch 3 is in Hands.
+  - **K1 gains:** Kotlin's idle resend loop (`CultMesh.kt:4033-4036`) is one `try`, so one peer's permanent failure
+    stops resends for every later peer. That is in addition to a refused packet not ending that peer's session.
 - **Recorded (liveness, not fixed):** a lowest reliable packet lost forever stalls the sender 1,023 sequences ahead
   while the peer stays alive; session timeout doesn't end it. TCP ends such a connection after a retransmission
   limit (R2). Decide with Cut F (abandonment) whether a reliable packet outstanding past a bound ends the session.