A fast fling through scrollback fired hundreds of tile requests at once,
tripping the relay's per-connection frame-rate limit and dropping the
bridge to the Mac while the phone still looked connected.

Cap in-flight tile fetches (6) with a bounded pending queue and drive
re-requests from a slot-available signal paced by replies rather than a
self-scheduled refresh, so a wide viewport re-requests without busy
looping. Scope the throttle to a per-stream epoch so a session switch,
reconnect, resume, host stream-end, or reflow neutralizes stale
in-flight/queued requests (cancelling their fetches) instead of leaking
slots, wedging the pipeline, or caching one session's tiles under
another. Give each fetch a bounded deadline so a lost reply cannot pin a
slot forever, and recover flushed tiles via a 4 Hz growthTick pass that
runs regardless of zoom. Distinguish throttle drops from real failures so
a transient drop keeps its image instead of flashing a failure X, and
skip host-reported failures in the idle re-drive to avoid strobing.