@decentnetwork/peer 0.1.94 → 0.1.97

package/dist/compat/filetransfer.d.ts

@@ -40,11 +40,13 @@ export declare function parseFileData(p: Uint8Array): {
 } | undefined;
 export type FtSend = (friendId: string, packetId: number, payload: Uint8Array) => Promise<unknown>;
 export type FtEmit = (event: string, payload: Record<string, unknown>) => void;
+export type FtIsLanPath = (friendId: string) => boolean;
 export declare class FileTransferManager {
     #private;
     private readonly send;
     private readonly emit;
-    constructor(send: FtSend, emit: FtEmit);
+    private readonly isLanPath;
+    constructor(send: FtSend, emit: FtEmit, isLanPath?: FtIsLanPath);
     /** Enable resumable receives: partials are persisted under `dir` and matched
      *  on re-offer by content-hash fileId. Unset = in-memory only (no resume). */
     setResumeDir(dir: string): void;

package/dist/compat/filetransfer.js

@@ -120,6 +120,7 @@ const PACE_CYCLE_GAINS = [1.25, 0.8, 1, 1, 1, 1, 1, 1]; // steady PROBE_BW cycle
 const PACE_FULLBW_GROWTH = 1.20; // bandwidth still "rising" if ≥20% over the plateau mark
 const PACE_FULLBW_ROUNDS = 3; // leave startup after this many non-rising rounds
 const PACE_BW_WINDOW = 10; // rounds of delivered-rate history for the max-filter
+const PACE_SAMPLE_MS = 200; // aggregate ACKs so one scheduler-jittered packet is not a "round"
 const PACE_INIT_BPS = 120_000; // initial pace rate (~120 KB/s) before any bandwidth estimate
 const PACE_BURST_MS = 20; // token-bucket burst allowance (keeps sends smooth, not bunched)
 const WATCHDOG_MS = 150; // stall poll cadence / base no-progress patience
@@ -195,14 +196,16 @@ const chunkCount = (size) => (size <= 0 ? 0 : Math.ceil(size / MAX_FILE_DATA_SIZ
 export class FileTransferManager {
     send;
     emit;
+    isLanPath;
     #sending = new Map();
     #receiving = new Map();
     // When set, incoming transfers persist their contiguous prefix here so a
     // dropped/restarted transfer resumes instead of restarting (断点续传).
     #resumeDir;
-    constructor(send, emit) {
+    constructor(send, emit, isLanPath = () => false) {
         this.send = send;
         this.emit = emit;
+        this.isLanPath = isLanPath;
     }
     /** Enable resumable receives: partials are persisted under `dir` and matched
      *  on re-offer by content-hash fileId. Unset = in-memory only (no resume). */
@@ -253,7 +256,8 @@ export class FileTransferManager {
             minRttMs: Infinity, minSrttMs: Infinity, srttMs: 0, probeOffset: -1, probeSentMs: 0,
             paceRateBps: PACE_INIT_BPS, paceTokens: 0, lastPaceMs: nowMs(),
             btlBwBps: 0, bwSamples: [], fullBwBps: 0, fullBwRounds: 0, bbrPhase: 0, roundCount: 0,
-            rateMarkMs: nowMs(), rateMarkAcked: 0,
+            rateMarkMs: nowMs(), rateMarkAcked: 0, lowRttCount: 0, lowRttMinMs: Infinity, lastCcLogMs: 0,
+            lanPath: this.isLanPath(friendId),
         };
         this.#map(this.#sending, friendId).set(fileNumber, st);
         void this.send(friendId, PACKET_ID_FILE_SENDREQUEST, req).catch(() => undefined);
@@ -677,6 +681,11 @@ export class FileTransferManager {
             // Progress. The path is delivering → additively re-open the window (up to
             // the cap) and clear the stall streak (patience shrinks back to the base).
             const nowT = nowMs();
+            // A receiver may already have a persisted prefix from an earlier UI/CLI
+            // attempt. Do not count that old data as bytes delivered by this new
+            // connection: doing so creates a fictitious multi-MB/s bandwidth sample
+            // and an unsafe startup burst.
+            const resumedPrefix = st.acked === 0 && ackedOffset > st.nextSend;
             st.acked = Math.min(ackedOffset, st.size);
             st.lastAckAdvanceMs = nowT;
             st.stalls = 0;
@@ -685,67 +694,129 @@ export class FileTransferManager {
             // instead of re-transmitting them.
             if (st.nextSend < st.acked)
                 st.nextSend = st.acked;
+            if (resumedPrefix) {
+                st.rateMarkMs = nowT;
+                st.rateMarkAcked = st.acked;
+                st.probeOffset = -1;
+            }
             // Vegas: adjust the window ONCE PER RTT, when the timed frontier byte's ack
             // returns (per-ack would fire several times before a slow path's probe
             // reported, overshooting). Estimate chunks queued from RTT inflation and
             // steer to keep it in [ALPHA, BETA].
-            if (st.probeOffset >= 0 && st.acked >= st.probeOffset) {
+            if (!resumedPrefix && st.probeOffset >= 0 && st.acked >= st.probeOffset) {
                 // One paced round completed (the timed frontier byte's ack landed).
                 const rtt = nowT - st.probeSentMs;
                 st.probeOffset = -1;
-                // Reject glitch samples: a batched / late / resume ack can make a probe
-                // byte look acked far sooner than it really was, giving a tiny rtt that
-                // would corrupt minRtt (RTprop) → shrink the BDP and collapse cwnd to the
-                // floor. Only trust a sample within a sane band of the smoothed RTT.
-                const glitch = st.srttMs > 0 && rtt < st.srttMs * 0.4;
-                if (!glitch && rtt > 0) {
-                    st.roundCount++;
+                // A single very-low sample can be a batched/late ACK that makes a probe
+                // look newer than it is. But several consecutive low samples mean the
+                // path genuinely improved (most importantly tcp-relay → LAN UDP). The
+                // old code rejected every such sample against the permanently-high srtt,
+                // so startup stayed pinned near 120 KB/s forever. Promote a stable lower
+                // RTT after three samples and rebase srtt/RTprop to the new path.
+                const lowSample = st.srttMs > 0 && rtt > 0 && rtt < st.srttMs * 0.4;
+                if (lowSample) {
+                    st.lowRttCount++;
+                    st.lowRttMinMs = Math.min(st.lowRttMinMs, rtt);
+                }
+                else {
+                    st.lowRttCount = 0;
+                    st.lowRttMinMs = Infinity;
+                }
+                const promoteLowPath = lowSample && st.lowRttCount >= 3;
+                const acceptedRtt = promoteLowPath ? st.lowRttMinMs : rtt;
+                if (promoteLowPath) {
+                    st.srttMs = acceptedRtt;
+                    st.minRttMs = acceptedRtt;
+                    st.lowRttCount = 0;
+                    st.lowRttMinMs = Infinity;
+                }
+                if ((!lowSample || promoteLowPath) && acceptedRtt > 0) {
                     // RTprop = min RTT ever seen (loss/queue only RAISE rtt → min is robust).
-                    st.srttMs = st.srttMs === 0 ? rtt : 0.85 * st.srttMs + 0.15 * rtt;
-                    if (rtt < st.minRttMs)
-                        st.minRttMs = rtt;
-                    // BtlBw = max-filtered delivered GOODPUT rate. Loss/reorder ignored as a
-                    // rate signal (they don't reduce bytes/sec; FEC + reorder-tolerant
-                    // retransmit fix correctness), so the rate model never collapses.
-                    const dtSec = Math.max(0.05, (nowT - st.rateMarkMs) / 1000);
-                    const roundRate = (st.acked - st.rateMarkAcked) / dtSec;
-                    st.rateMarkMs = nowT;
-                    st.rateMarkAcked = st.acked;
-                    if (roundRate > 0) {
-                        st.bwSamples.push(roundRate);
-                        if (st.bwSamples.length > PACE_BW_WINDOW)
-                            st.bwSamples.shift();
-                        st.btlBwBps = Math.max(...st.bwSamples);
-                    }
-                    // Wire carries goodput + FEC parity + retransmits, so to fill the LINK
-                    // we pace above goodput by the loss overhead: wire = goodput/(1 − loss).
-                    const lossMult = 1 / (1 - Math.min(0.5, st.lossEwma));
-                    // Two-phase paced control, tuned for STABILITY first (never bloat).
-                    if (st.bbrPhase === 0) {
-                        // STARTUP: ramp ×1.4/round until a real queue builds (rtt ≥1.35×RTprop
-                        // → pipe full), then cruise. The queue-based exit keeps latency
-                        // bounded: on a lossy path loss-recovery trips it sooner, so the fill
-                        // is slower — but it NEVER bloats. That's the right trade — fast on a
-                        // good path, graceful (stable, not 15 s of queue) on a bad one.
-                        const rawQueue = st.minRttMs !== Infinity ? rtt - st.minRttMs : 0;
-                        if (st.minRttMs !== Infinity && rawQueue > st.minRttMs * 0.35)
+                    st.srttMs = st.srttMs === 0 ? acceptedRtt : 0.85 * st.srttMs + 0.15 * acceptedRtt;
+                    if (acceptedRtt < st.minRttMs)
+                        st.minRttMs = acceptedRtt;
+                    // Aggregate ACKs into a time-sized delivery sample. Previously every
+                    // single ACK was treated as a BBR round and dt was clamped to 50 ms;
+                    // on a 1–2 ms LAN that made the measured rate look permanently tiny
+                    // and normal scheduler jitter immediately ended STARTUP.
+                    const sampleMs = nowT - st.rateMarkMs;
+                    if (sampleMs >= PACE_SAMPLE_MS) {
+                        st.roundCount++;
+                        const roundRate = ((st.acked - st.rateMarkAcked) * 1000) / sampleMs;
+                        st.rateMarkMs = nowT;
+                        st.rateMarkAcked = st.acked;
+                        if (roundRate > 0) {
+                            st.bwSamples.push(roundRate);
+                            if (st.bwSamples.length > PACE_BW_WINDOW)
+                                st.bwSamples.shift();
+                            st.btlBwBps = Math.max(...st.bwSamples);
+                        }
+                        // Wire carries goodput + FEC parity + retransmits, so to fill the LINK
+                        // we pace above goodput by the loss overhead: wire = goodput/(1 − loss).
+                        const lossMult = 1 / (1 - Math.min(0.5, st.lossEwma));
+                        const lanNow = this.isLanPath(friendId);
+                        if (lanNow && !st.lanPath) {
+                            // A transfer can begin on relay and then promote to a validated
+                            // physical-LAN endpoint. Restart STARTUP from the measured rate.
+                            st.bbrPhase = 0;
+                            st.fullBwBps = 0;
+                            st.fullBwRounds = 0;
+                        }
+                        st.lanPath = lanNow;
+                        if (!lanNow) {
+                            // Relay/public-NAT file traffic must remain conservative. A short
+                            // ACK burst can wildly overstate bandwidth there; allowing LAN's
+                            // exponential STARTUP filled the TCP relay with an 8.7 s queue.
+                            // This affects only file DATA/FEC — IP/video has its own path.
                             st.bbrPhase = 2;
-                        st.paceRateBps = Math.max(st.paceRateBps * 1.4, st.btlBwBps * PACE_STARTUP_GAIN * lossMult);
-                    }
-                    else {
-                        // PROBE_BW cruise: one round probes up, one DRAINS (0.8×), six at 1× →
-                        // the AVERAGE pace is exactly bandwidth, so the queue stays shallow.
-                        const gain = PACE_CYCLE_GAINS[st.roundCount % PACE_CYCLE_GAINS.length];
-                        st.paceRateBps = Math.max(PACE_INIT_BPS * 0.5, st.btlBwBps * gain * lossMult);
-                    } // Hard safety cap: never pace faster than a full window drains in 1 RTT.
-                    if (st.minRttMs !== Infinity && st.minRttMs > 0) {
-                        st.paceRateBps = Math.min(st.paceRateBps, (WINDOW_CHUNKS * MAX_FILE_DATA_SIZE) / (st.minRttMs / 1000));
+                            const gain = PACE_CYCLE_GAINS[st.roundCount % PACE_CYCLE_GAINS.length];
+                            st.paceRateBps = Math.max(PACE_INIT_BPS, Math.min(PACE_INIT_BPS * 2, st.btlBwBps * gain * lossMult));
+                        }
+                        else if (st.bbrPhase === 0) {
+                            // BBR full-bandwidth detection: remain in STARTUP while delivered
+                            // bandwidth grows. A relative RTT threshold is unusable on LAN —
+                            // 1 ms → 2 ms scheduler jitter looked like a 100% queue and pinned
+                            // every transfer near PACE_INIT_BPS. The absolute, smoothed queue
+                            // ceiling still protects a deep relay from runaway buffering.
+                            if (st.fullBwBps === 0 || st.btlBwBps >= st.fullBwBps * PACE_FULLBW_GROWTH) {
+                                st.fullBwBps = st.btlBwBps;
+                                st.fullBwRounds = 0;
+                            }
+                            else {
+                                st.fullBwRounds++;
+                            }
+                            const rawQueue = st.minRttMs !== Infinity ? st.srttMs - st.minRttMs : 0;
+                            if (st.fullBwRounds >= PACE_FULLBW_ROUNDS || rawQueue > MAX_QUEUE_MS) {
+                                st.bbrPhase = 2;
+                            }
+                            if (st.bbrPhase === 0) {
+                                st.paceRateBps = Math.max(st.paceRateBps * 1.4, st.btlBwBps * PACE_STARTUP_GAIN * lossMult);
+                            }
+                            else {
+                                st.paceRateBps = Math.max(PACE_INIT_BPS * 0.5, st.btlBwBps * lossMult);
+                            }
+                        }
+                        else {
+                            // PROBE_BW cruise: one sample probes up, one drains, six cruise.
+                            const gain = PACE_CYCLE_GAINS[st.roundCount % PACE_CYCLE_GAINS.length];
+                            st.paceRateBps = Math.max(PACE_INIT_BPS * 0.5, st.btlBwBps * gain * lossMult);
+                        }
+                        // Hard safety cap: never pace faster than a full window drains in 1 RTT.
+                        if (st.minRttMs !== Infinity && st.minRttMs > 0) {
+                            st.paceRateBps = Math.min(st.paceRateBps, (WINDOW_CHUNKS * MAX_FILE_DATA_SIZE) / (st.minRttMs / 1000));
+                        }
+                        // cwnd = safety ceiling sized to 2× pace BDP. Pacing is primary.
+                        const paceBdp = (st.minRttMs !== Infinity && st.minRttMs > 0)
+                            ? (st.paceRateBps * (st.minRttMs / 1000)) / MAX_FILE_DATA_SIZE : WINDOW_CHUNKS;
+                        st.cwnd = Math.max(CWND_MIN_CHUNKS, Math.min(WINDOW_CHUNKS, Math.ceil(paceBdp * 2)));
                     }
-                    // cwnd = SAFETY ceiling sized to the PACE rate (2×paceRate×RTprop), NOT
-                    // the measured bandwidth (which would self-limit). Pacing is primary.
-                    const paceBdp = (st.minRttMs !== Infinity && st.minRttMs > 0)
-                        ? (st.paceRateBps * (st.minRttMs / 1000)) / MAX_FILE_DATA_SIZE : WINDOW_CHUNKS;
-                    st.cwnd = Math.max(CWND_MIN_CHUNKS, Math.min(WINDOW_CHUNKS, Math.ceil(paceBdp * 2)));
+                }
+                if (process.env.DECENT_DEBUG && nowT - st.lastCcLogMs >= 1000) {
+                    st.lastCcLogMs = nowT;
+                    console.error(`[file-cc] friend=${friendId.slice(0, 8)} ack=${st.acked}/${st.size}` +
+                        ` rtt=${rtt}ms srtt=${st.srttMs.toFixed(1)}ms low=${st.lowRttCount}` +
+                        ` accepted=${(!lowSample || promoteLowPath) ? 1 : 0}` +
+                        ` pace=${Math.round(st.paceRateBps)}Bps cwnd=${st.cwnd} rounds=${st.roundCount}`);
                 }
             }
             if (st.acked - st.lastProgressAcked >= 256 * 1024 || st.acked >= st.size) {
@@ -861,7 +932,11 @@ export class FileTransferManager {
                 try {
                     await this.send(friendId, PACKET_ID_FILE_DATA, encodeFileData(st.fileNumber, off, st.data.subarray(off, end)));
                 }
-                catch {
+                catch (error) {
+                    if (process.env.DECENT_DEBUG || process.env.DECENT_DEBUG_VERBOSE) {
+                        console.error(`[file-ft] data-send-error friend=${friendId.slice(0, 8)} num=${st.fileNumber} ` +
+                            `off=${off} error=${error instanceof Error ? error.message : String(error)}`);
+                    }
                     break; // transport down; the watchdog re-kicks
                 }
                 st.paceTokens -= end - off;

package/dist/peer.js

@@ -211,7 +211,10 @@ export class Peer {
     #opts;
     #events = new EventEmitter();
     // Toxcore-standard file transfer (wire-compatible with native Carrier/toxcore).
-    #fileTransfer = new FileTransferManager((friendId, packetId, payload) => this.#sendMessengerPacket(friendId, packetId, payload), (event, payload) => { this.#events.emit(event, payload); });
+    #fileTransfer = new FileTransferManager((friendId, packetId, payload) => this.#sendMessengerPacket(friendId, packetId, payload), (event, payload) => { this.#events.emit(event, payload); }, (friendId) => {
+        const session = this.#friendSessions.get(friendId);
+        return !!session?.lanRemoteHost && session.remote?.host === session.lanRemoteHost;
+    });
     #keyPair;
     #udp = new UdpTransport();
     // TURN relay (stable fallback path). One node-level allocation on its own
@@ -358,6 +361,8 @@ export class Peer {
     // Per-friend tracking sets so we send our nickname/status/greeting once
     // per session rather than on every PACKET_ID_ONLINE arrival.
     #profileSentTo = new Set();
+    #profileRetryAttempts = new Map();
+    #profileRetryTimers = new Map();
     #greetingSentTo = new Set();
     #selfAnnouncePromise;
     #selfAnnouncePauseDepth = 0;
@@ -595,6 +600,10 @@ export class Peer {
     async stop() {
         // Stop background producers first so no keepalive/profile packet can race
         // behind the shutdown notice and make the remote session look live again.
+        for (const timer of this.#profileRetryTimers.values())
+            clearTimeout(timer);
+        this.#profileRetryTimers.clear();
+        this.#profileRetryAttempts.clear();
         if (this.#expressPollTimer) {
             clearInterval(this.#expressPollTimer);
             this.#expressPollTimer = undefined;
@@ -981,6 +990,11 @@ export class Peer {
         this.#tcpOnlyWarningShown.delete(friendId);
         this.#noEndpointWarned.delete(friendId);
         this.#profileSentTo.delete(friendId);
+        const profileRetry = this.#profileRetryTimers.get(friendId);
+        if (profileRetry)
+            clearTimeout(profileRetry);
+        this.#profileRetryTimers.delete(friendId);
+        this.#profileRetryAttempts.delete(friendId);
         this.#greetingSentTo.delete(friendId);
         if (existed) {
             this.#persistFriends();
@@ -2052,17 +2066,14 @@ export class Peer {
                 // low-water mark, like toxcore net_crypto drops below buffer_start.
                 //
                 // EXCEPT single-transport channels (bulk IP = bulkDataPacketId, and
-                // file transfer 80-82): they are NOT dual-sent, so they never produce
-                // duplicates — and the low-water mark would then only drop a
-                // legitimately REORDERED packet, which over a high-rate stream (CCTV
-                // over a long-haul China↔US path that reorders) is pure added loss /
-                // jitter. IP forwarding is order-independent (the TUN/TCP above
-                // reassembles), so deliver every packet. Must run BEFORE the nonce
-                // advance so a real duplicate doesn't desync the receive nonce.
+                // file DATA/FEC): they are NOT dual-sent, so they never produce
+                // transport duplicates — and the low-water mark would then only drop a
+                // legitimately REORDERED packet. File SENDREQUEST/CONTROL are sparse
+                // control traffic and intentionally remain dual-sent so they can confirm
+                // an optimistic UDP path before the bulk data pump begins. Must run
+                // BEFORE the nonce advance so a real duplicate doesn't desync it.
                 const innerKind = opened.payload.length > 0 ? opened.payload[0] : -1;
                 const isSingleTransportKind = (this.#opts.bulkDataPacketId !== undefined && innerKind === this.#opts.bulkDataPacketId) ||
-                    innerKind === PACKET_ID_FILE_SENDREQUEST ||
-                    innerKind === PACKET_ID_FILE_CONTROL ||
                     innerKind === PACKET_ID_FILE_DATA ||
                     innerKind === PACKET_ID_FILE_FEC;
                 // Confirm the transport path + liveness for EVERY decrypted packet —
@@ -3807,7 +3818,15 @@ export class Peer {
         // bulk-IP channel and lossy packets; the crypto nonce still advances above so
         // decryption stays in sync regardless.
         const isFileTransfer = kind === PACKET_ID_FILE_SENDREQUEST || kind === PACKET_ID_FILE_CONTROL || kind === PACKET_ID_FILE_DATA || kind === PACKET_ID_FILE_FEC;
-        const isBulkData = (this.#opts.bulkDataPacketId !== undefined && kind === this.#opts.bulkDataPacketId) || isFileTransfer;
+        // Offers and control/ACK packets are sparse path-establishment traffic, not
+        // bulk. Dual-send them over an optimistic UDP candidate plus the reliable
+        // relay copy, just like chat/control traffic. A direct FILE_SENDREQUEST or
+        // FILE_CONTROL arrival confirms UDP before FILE_DATA starts, so the data
+        // stream can select the LAN path instead of remaining pinned to tcp-relay.
+        // If UDP is not viable, the relay copy still completes the negotiation and
+        // FILE_DATA falls back to its existing reliable single-transport route.
+        const isFileBulk = kind === PACKET_ID_FILE_DATA || kind === PACKET_ID_FILE_FEC;
+        const isBulkData = (this.#opts.bulkDataPacketId !== undefined && kind === this.#opts.bulkDataPacketId) || isFileBulk;
         const isDroppable = (isBulkData && !isFileTransfer) || kind >= 192;
         if (!isDroppable) {
             session.sendPacketNumber = (packetNumber + 1) >>> 0;
@@ -3848,20 +3867,12 @@ export class Peer {
         // e.g. decentlan IP=163) stays bulk / single-transport to avoid the relay
         // backlog + duplicate fan-out that high packet rates cause. Chat is sparse
         // and net_crypto dedups by packet number, so dual-send is safe here.
-        // File transfer (80 sendrequest / 81 control / 82 data) is ALSO treated as
-        // bulk → single-transport. It is high-volume AND order-sensitive: the
-        // receiver reassembles chunks SEQUENTIALLY (position is implicit) and there
-        // is no retransmit queue. Dual-sending it over UDP + relay (two paths with
-        // different latency) reorders the chunks, and the receive-side low-water
-        // dedup then drops the late copies — so a large file (mp4) gets gaps /
-        // wrong order and never completes, while a tiny one (png, 1-2 chunks)
-        // happens to finish before reordering bites. Pinning file transfer to a
-        // single transport keeps the chunks in send order. (Reliability across a
-        // lossy path still wants a reorder buffer + retransmit — tracked separately.)
-        // File transfer rides the relay RELIABLY (never dropped under backpressure):
-        // a dropped IP/CCTV packet is fine (the stream moves on), but a dropped file
-        // chunk corrupts the file (no retransmit). So bulk IP data stays droppable
-        // while file transfer is queued. (isBulkData / isFileTransfer computed above.)
+        // File DATA/FEC is bulk and stays single-transport. SENDREQUEST and CONTROL
+        // (accept/ACK/kill) are low-volume control traffic: dual-sending those is
+        // what confirms an optimistic LAN candidate before the data pump starts.
+        // File packets ride the relay RELIABLY (never dropped under backpressure):
+        // a dropped IP/CCTV packet is fine, but a dropped file chunk can stall the
+        // transfer. (isBulkData / isFileTransfer computed above.)
         await this.#sendToFriend(friendId, encrypted, session, isBulkData, isFileTransfer);
     }
     /**
@@ -3885,6 +3896,15 @@ export class Peer {
         const udpFresh = !!realUdpRemote &&
             s?.lastUdpRecvMs !== undefined &&
             Date.now() - s.lastUdpRecvMs < 4_000;
+        // A freshly-received UDP packet proves only the peer -> us direction.
+        // That is enough for lossy IP/video bulk, whose inner TCP stream can
+        // recover a dropped packet, but not for reliable file data: returning
+        // UDP-only on a one-way public/NAT endpoint silently black-holes every
+        // chunk. A physical-LAN lock is stronger evidence because the candidate
+        // was validated against the local subnet; otherwise file bulk continues
+        // to TURN/TCP below.
+        const fileUdpOnlyConfirmed = !reliableOnRelay ||
+            (!!s?.lanRemoteHost && s.remote?.host === s.lanRemoteHost);
         // Bulk IP data rides the direct path ONLY while it's fresh. When it
         // goes stale (likely a NAT remap mid-stream), we do NOT keep firing
         // into the dead endpoint and we do NOT duplicate onto UDP — we bridge
@@ -3892,7 +3912,8 @@ export class Peer {
         // lastUdpRecvMs). This converts a multi-second blackout into a few
         // seconds of higher relay latency. Control packets always probe UDP
         // (to keep the NAT mapping warm) so we still try UDP for them.
-        const tryUdp = realUdpRemote && (isBulkData ? udpFresh : true);
+        const tryUdp = realUdpRemote &&
+            (isBulkData ? udpFresh && fileUdpOnlyConfirmed : true);
         if (tryUdp && s?.remote) {
             try {
                 await this.#sendPacket(packet, s.remote);
@@ -3902,9 +3923,9 @@ export class Peer {
                 firstError = error;
             }
         }
-        // Fresh direct path → send over UDP only — but ONLY for bulk data.
-        // Bulk is high-volume and must avoid relay fan-out / backlog, so once
-        // the direct path is fresh it rides UDP exclusively.
+        // Fresh confirmed direct path → send over UDP only, but ONLY for bulk.
+        // For files, `tryUdp` above requires the physical-LAN lock; a merely-fresh
+        // public endpoint deliberately falls through to reliable TURN/TCP.
         //
         // Low-volume traffic (chat 64 + control keepalives / endpoint offers /
         // profile) instead ALSO goes over the relay even when the direct path
@@ -3992,6 +4013,10 @@ export class Peer {
         if (info.description !== undefined)
             opts.statusMessage = info.description;
         this.#profileSentTo.clear();
+        for (const timer of this.#profileRetryTimers.values())
+            clearTimeout(timer);
+        this.#profileRetryTimers.clear();
+        this.#profileRetryAttempts.clear();
         for (const [friendId, s] of this.#friendSessions.entries()) {
             if (s.established)
                 this.#sendProfileAndGreeting(friendId);
@@ -4005,6 +4030,25 @@ export class Peer {
             description: opts.statusMessage ?? PEER_STATUS_MESSAGE,
         };
     }
+    #scheduleProfileRetry(friendId) {
+        if (this.#profileRetryTimers.has(friendId))
+            return;
+        const session = this.#friendSessions.get(friendId);
+        if (!this.#started || !session?.established)
+            return;
+        const attempt = (this.#profileRetryAttempts.get(friendId) ?? 0) + 1;
+        this.#profileRetryAttempts.set(friendId, attempt);
+        const delayMs = Math.min(30_000, 1_000 * (2 ** Math.min(attempt - 1, 5)));
+        const timer = setTimeout(() => {
+            this.#profileRetryTimers.delete(friendId);
+            if (this.#started && this.#friendSessions.get(friendId)?.established) {
+                this.#sendProfileAndGreeting(friendId);
+            }
+        }, delayMs);
+        timer.unref?.();
+        this.#profileRetryTimers.set(friendId, timer);
+        this.#debugLog(`profile retry ${attempt} for ${friendId} scheduled in ${delayMs}ms`);
+    }
     #sendProfileAndGreeting(friendId) {
         if (!this.#profileSentTo.has(friendId)) {
             this.#profileSentTo.add(friendId);
@@ -4044,9 +4088,16 @@ export class Peer {
                     });
                     await this.#sendMessengerPacket(friendId, PACKET_ID_STATUSMESSAGE, userInfo);
                     this.#debugLog(`userinfo sent to ${friendId} (name="${nick}", descr="${descr}", proto=${AGENTNET_PROTO_VERSION}, platform=${this.#opts.platform ?? process.platform})`);
+                    this.#profileRetryAttempts.delete(friendId);
                 }
                 catch (error) {
+                    // PACKET_ID_ONLINE can arrive a fraction before every transport is
+                    // ready to accept messenger packets. Do not leave the optimistic
+                    // "sent" marker wedged after that race: re-arm it and retry with
+                    // bounded backoff while this same session remains established.
+                    this.#profileSentTo.delete(friendId);
                     this.#debugLog(`send profile failed for ${friendId}: ${error.message}`);
+                    this.#scheduleProfileRetry(friendId);
                 }
             })();
         }
@@ -5378,6 +5429,11 @@ export class Peer {
         // transitions prevents the user from seeing the same greeting message
         // repeated each time the session bounces.
         this.#profileSentTo.delete(friendId);
+        const profileRetry = this.#profileRetryTimers.get(friendId);
+        if (profileRetry)
+            clearTimeout(profileRetry);
+        this.#profileRetryTimers.delete(friendId);
+        this.#profileRetryAttempts.delete(friendId);
         const friend = this.#friends.get(friendId);
         if (!friend) {
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.94",
+  "version": "0.1.97",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",