@decentnetwork/peer 0.1.95 → 0.1.98

package/dist/compat/filetransfer.d.ts

@@ -40,11 +40,13 @@ export declare function parseFileData(p: Uint8Array): {
 } | undefined;
 export type FtSend = (friendId: string, packetId: number, payload: Uint8Array) => Promise<unknown>;
 export type FtEmit = (event: string, payload: Record<string, unknown>) => void;
+export type FtIsLanPath = (friendId: string) => boolean;
 export declare class FileTransferManager {
     #private;
     private readonly send;
     private readonly emit;
-    constructor(send: FtSend, emit: FtEmit);
+    private readonly isLanPath;
+    constructor(send: FtSend, emit: FtEmit, isLanPath?: FtIsLanPath);
     /** Enable resumable receives: partials are persisted under `dir` and matched
      *  on re-offer by content-hash fileId. Unset = in-memory only (no resume). */
     setResumeDir(dir: string): void;

package/dist/compat/filetransfer.js

@@ -86,47 +86,43 @@ export const FILEKIND = { DATA: 0, AVATAR: 1 };
 const WINDOW_CHUNKS = 768; // ~1 MB — the window CAP (fills a 200ms-RTT path at ~5 MB/s)
 const CWND_INIT_CHUNKS = 16; // ~22 KB start — small so the opening burst can't bloat a thin path
 const CWND_MIN_CHUNKS = 8; // ~11 KB floor — keeps a slow/flaky path's buffer shallow
-// Congestion control (TCP Vegas — DELAY-based). Loss/AIMD control fails on a
-// slow peer with a deep buffer (a user's laptop): ~1 MB in flight piles up as
-// 12-23 s of queue latency with NO loss, so it never backs off, and the stalls
-// trigger go-back-N resends that balloon the queue further. Vegas instead reads
-// how many chunks are QUEUED from the RTT inflation — cwnd × (1 − minRtt/RTT) —
-// and steers the window to keep that between ALPHA and BETA. When the queue is
-// below ALPHA there's spare capacity → grow (no self-limiting, unlike a
-// rate-based cap); above BETA the queue is too deep → shrink. It converges to
-// "pipe full + a couple chunks queued" on ANY path: a fast link gets a big
-// window, a thin flaky one a small window and a shallow queue, automatically.
-// Target the ABSOLUTE queue delay (rtt − minRtt), not a packet count: bound the
-// latency the transfer ADDS to the path to ≈ MAX_QUEUE_MS on ANY path. A fast
-// link keeps a big window (it drains quickly, so a big window adds little
-// delay); a thin flaky one keeps a small window (a big window there would add
-// seconds). Growing whenever the added delay is low means no self-limiting.
-// The budget is generous on purpose: for a bulk transfer to a flaky peer,
-// ~0.5s of added latency keeps ping well under a second (fine — the peer stays
-// usable), and buys far more throughput on a jittery path than a tight 150ms
-// bound, which collapsed the window to the floor (~17 KB/s observed on lili).
-const MAX_QUEUE_MS = 350; // raw-queue ceiling before draining (bulk transfer tolerates ~0.35s added latency; a tighter bound collapses the window on a 40%-loss path where recovery makes RTT noisy)
-const QUEUE_LOW_MS = 150; // grow while the smoothed (jitter-free) queue is under this
-const VEGAS_GROW = 1.25; // window ×this per RTT when under-filled
-const VEGAS_SHRINK = 0.8; // window ×this per RTT when the queue is too deep
 // PACED control (BBR-style). The window-based Vegas controller blasted the whole
 // cwnd into the buffer each round, which on a DEEP buffer (the TCP relay's
 // China↔US queue) piled up to 7-15 s of latency — the feedback loop is longer
 // than a human's patience, so it can't react. The fix is to PACE: send at the
 // estimated bottleneck bandwidth so the buffer stays near-empty regardless of
 // its depth, and RAMP the rate in a startup phase to fill the pipe for speed.
-const PACE_STARTUP_GAIN = 2.0; // startup: pace at 2× measured rate to probe up fast (exits when bandwidth plateaus)
 const PACE_CYCLE_GAINS = [1.25, 0.8, 1, 1, 1, 1, 1, 1]; // steady PROBE_BW cycle: one round up, one round DRAINS the queue, six cruise → avg≈bandwidth, shallow queue
-const PACE_FULLBW_GROWTH = 1.20; // bandwidth still "rising" if ≥20% over the plateau mark
-const PACE_FULLBW_ROUNDS = 3; // leave startup after this many non-rising rounds
 const PACE_BW_WINDOW = 10; // rounds of delivered-rate history for the max-filter
+const PACE_SAMPLE_MS = 200; // aggregate ACKs so one scheduler-jittered packet is not a "round"
 const PACE_INIT_BPS = 120_000; // initial pace rate (~120 KB/s) before any bandwidth estimate
 const PACE_BURST_MS = 20; // token-bucket burst allowance (keeps sends smooth, not bunched)
+// A LAN receiver can coalesce a backlog of ACKs after its event loop wakes. The
+// resulting delivery sample is ACK rate, not link capacity: in practice a
+// 4 MB/s Windows path briefly reported 23 MB/s, startup chased that sample,
+// overflowed the receiver, and then collapsed to the minimum window. Bound how
+// quickly a validated-LAN estimate and startup pace may grow. Real capacity is
+// still discovered quickly (25% every 200 ms), without one ACK burst taking
+// over the controller.
+const LAN_SAMPLE_MAX_GAIN = 1.25;
+const LAN_STARTUP_MAX_GAIN = 1.15;
+const LAN_STARTUP_DELIVERY_GAIN = 1.5; // never probe above 1.5x recently delivered goodput
+const LAN_STARTUP_QUEUE_MS = 500; // unmistakable raw queue spike; smaller app-level RTT outliers are normal on Windows
+const LAN_STARTUP_KEEPUP = 0.70; // delivered goodput below 70% of pace means the receiver is no longer keeping up
+const LAN_STARTUP_SLOW_ROUNDS = 5; // require sustained saturation across Windows scheduler/ACK jitter
+// FILE ACKs are coalesced and handled by the remote JS event loop. On Windows
+// the effective ACK clock is commonly 20–120 ms even when an occasional probe
+// reports a 7 ms network RTT. Sizing cwnd from that lucky minimum made a
+// 1.7 MB/s pacer use an 18-chunk (~24 KB) window, which itself capped goodput
+// and falsely ended startup. Pacing remains the primary throttle, so this floor
+// only prevents the safety window from starving a validated LAN flow.
+const LAN_BDP_RTT_FLOOR_MS = 50;
 const WATCHDOG_MS = 150; // stall poll cadence / base no-progress patience
 const WATCHDOG_MAX_MS = 8000; // cap the RTT-adaptive stall patience (must exceed a slow path's RTT so acks aren't mistaken for a stall)
 const FAST_RT_MIN_MS = 40; // min gap between fast-retransmits of the same hole (≈1 RTT)
 const ACK_THROTTLE_MS = 15; // coalesce receiver acks (fast enough to drive fast-retransmit)
 const REACK_MS = 200; // receiver keep-alive re-ack cadence
+const FINAL_ACK_GRACE_MS = 10000; // retry final cumulative ACK across loss/reorder/short session handover
 const SEND_GIVEUP_MS = 60000; // abandon a send after this long with no ack progress (peer gone)
 const PERSIST_INTERVAL_BYTES = 1024 * 1024; // flush the resume file at most once per this much progress
 function u32be(n) {
@@ -195,14 +191,16 @@ const chunkCount = (size) => (size <= 0 ? 0 : Math.ceil(size / MAX_FILE_DATA_SIZ
 export class FileTransferManager {
     send;
     emit;
+    isLanPath;
     #sending = new Map();
     #receiving = new Map();
     // When set, incoming transfers persist their contiguous prefix here so a
     // dropped/restarted transfer resumes instead of restarting (断点续传).
     #resumeDir;
-    constructor(send, emit) {
+    constructor(send, emit, isLanPath = () => false) {
         this.send = send;
         this.emit = emit;
+        this.isLanPath = isLanPath;
     }
     /** Enable resumable receives: partials are persisted under `dir` and matched
      *  on re-offer by content-hash fileId. Unset = in-memory only (no resume). */
@@ -250,10 +248,11 @@ export class FileTransferManager {
             acked: 0, nextSend: 0, pumping: false, started: false, req, startMs: nowMs(),
             lastProgressAcked: 0, lastAckAdvanceMs: nowMs(), lastResendMs: 0,
             cwnd: CWND_INIT_CHUNKS, stalls: 0, parityHighBlock: -1, lastLossMs: 0, lossEwma: 0,
-            minRttMs: Infinity, minSrttMs: Infinity, srttMs: 0, probeOffset: -1, probeSentMs: 0,
+            minRttMs: Infinity, srttMs: 0, probeOffset: -1, probeSentMs: 0,
             paceRateBps: PACE_INIT_BPS, paceTokens: 0, lastPaceMs: nowMs(),
-            btlBwBps: 0, bwSamples: [], fullBwBps: 0, fullBwRounds: 0, bbrPhase: 0, roundCount: 0,
-            rateMarkMs: nowMs(), rateMarkAcked: 0,
+            btlBwBps: 0, bwSamples: [], fullBwRounds: 0, bbrPhase: 0, roundCount: 0,
+            rateMarkMs: nowMs(), rateMarkAcked: 0, lowRttCount: 0, lowRttMinMs: Infinity, lastCcLogMs: 0,
+            lanPath: this.isLanPath(friendId),
         };
         this.#map(this.#sending, friendId).set(fileNumber, st);
         void this.send(friendId, PACKET_ID_FILE_SENDREQUEST, req).catch(() => undefined);
@@ -595,7 +594,25 @@ export class FileTransferManager {
             clearInterval(st.reackTimer);
             st.reackTimer = undefined;
         }
-        this.#sendAck(friendId, st); // final ack so the sender completes
+        this.#sendAck(friendId, st); // first final ack so the sender completes
+        // A final ACK used to be the only ACK we sent exactly once. If it landed
+        // during UDP loss, packet reordering, or a short crypto-session handover,
+        // the receiver had the complete byte-exact file but the sender/UI remained
+        // stuck at its previous cumulative offset until timeout. Keep retrying the
+        // tiny cumulative ACK while the lightweight done-marker exists. This is
+        // idempotent, and the sender drops its state after the first one it receives.
+        st.reackTimer = setInterval(() => {
+            const cur = this.#map(this.#receiving, friendId).get(st.fileNumber);
+            if (cur !== st) {
+                if (st.reackTimer)
+                    clearInterval(st.reackTimer);
+                st.reackTimer = undefined;
+                return;
+            }
+            this.#sendAck(friendId, st);
+        }, REACK_MS);
+        if (typeof st.reackTimer.unref === "function")
+            st.reackTimer.unref();
         const data = st.buf;
         // Transfer complete → the resume file is no longer needed.
         if (st.partPath) {
@@ -612,9 +629,14 @@ export class FileTransferManager {
         st.got = new Uint8Array(0);
         const t = setTimeout(() => {
             const cur = this.#map(this.#receiving, friendId).get(st.fileNumber);
-            if (cur === st)
+            if (cur === st) {
+                if (st.reackTimer) {
+                    clearInterval(st.reackTimer);
+                    st.reackTimer = undefined;
+                }
                 this.#map(this.#receiving, friendId).delete(st.fileNumber);
-        }, 10000);
+            }
+        }, FINAL_ACK_GRACE_MS);
         if (typeof t.unref === "function")
             t.unref();
     }
@@ -677,6 +699,11 @@ export class FileTransferManager {
             // Progress. The path is delivering → additively re-open the window (up to
             // the cap) and clear the stall streak (patience shrinks back to the base).
             const nowT = nowMs();
+            // A receiver may already have a persisted prefix from an earlier UI/CLI
+            // attempt. Do not count that old data as bytes delivered by this new
+            // connection: doing so creates a fictitious multi-MB/s bandwidth sample
+            // and an unsafe startup burst.
+            const resumedPrefix = st.acked === 0 && ackedOffset > st.nextSend;
             st.acked = Math.min(ackedOffset, st.size);
             st.lastAckAdvanceMs = nowT;
             st.stalls = 0;
@@ -685,67 +712,158 @@ export class FileTransferManager {
             // instead of re-transmitting them.
             if (st.nextSend < st.acked)
                 st.nextSend = st.acked;
+            if (resumedPrefix) {
+                st.rateMarkMs = nowT;
+                st.rateMarkAcked = st.acked;
+                st.probeOffset = -1;
+            }
             // Vegas: adjust the window ONCE PER RTT, when the timed frontier byte's ack
             // returns (per-ack would fire several times before a slow path's probe
             // reported, overshooting). Estimate chunks queued from RTT inflation and
             // steer to keep it in [ALPHA, BETA].
-            if (st.probeOffset >= 0 && st.acked >= st.probeOffset) {
+            if (!resumedPrefix && st.probeOffset >= 0 && st.acked >= st.probeOffset) {
                 // One paced round completed (the timed frontier byte's ack landed).
                 const rtt = nowT - st.probeSentMs;
                 st.probeOffset = -1;
-                // Reject glitch samples: a batched / late / resume ack can make a probe
-                // byte look acked far sooner than it really was, giving a tiny rtt that
-                // would corrupt minRtt (RTprop) → shrink the BDP and collapse cwnd to the
-                // floor. Only trust a sample within a sane band of the smoothed RTT.
-                const glitch = st.srttMs > 0 && rtt < st.srttMs * 0.4;
-                if (!glitch && rtt > 0) {
-                    st.roundCount++;
+                // A single very-low sample can be a batched/late ACK that makes a probe
+                // look newer than it is. But several consecutive low samples mean the
+                // path genuinely improved (most importantly tcp-relay → LAN UDP). The
+                // old code rejected every such sample against the permanently-high srtt,
+                // so startup stayed pinned near 120 KB/s forever. Promote a stable lower
+                // RTT after three samples and rebase srtt/RTprop to the new path.
+                const lowSample = st.srttMs > 0 && rtt > 0 && rtt < st.srttMs * 0.4;
+                if (lowSample) {
+                    st.lowRttCount++;
+                    st.lowRttMinMs = Math.min(st.lowRttMinMs, rtt);
+                }
+                else {
+                    st.lowRttCount = 0;
+                    st.lowRttMinMs = Infinity;
+                }
+                const promoteLowPath = lowSample && st.lowRttCount >= 3;
+                const acceptedRtt = promoteLowPath ? st.lowRttMinMs : rtt;
+                if (promoteLowPath) {
+                    st.srttMs = acceptedRtt;
+                    st.minRttMs = acceptedRtt;
+                    st.lowRttCount = 0;
+                    st.lowRttMinMs = Infinity;
+                }
+                if ((!lowSample || promoteLowPath) && acceptedRtt > 0) {
                     // RTprop = min RTT ever seen (loss/queue only RAISE rtt → min is robust).
-                    st.srttMs = st.srttMs === 0 ? rtt : 0.85 * st.srttMs + 0.15 * rtt;
-                    if (rtt < st.minRttMs)
-                        st.minRttMs = rtt;
-                    // BtlBw = max-filtered delivered GOODPUT rate. Loss/reorder ignored as a
-                    // rate signal (they don't reduce bytes/sec; FEC + reorder-tolerant
-                    // retransmit fix correctness), so the rate model never collapses.
-                    const dtSec = Math.max(0.05, (nowT - st.rateMarkMs) / 1000);
-                    const roundRate = (st.acked - st.rateMarkAcked) / dtSec;
-                    st.rateMarkMs = nowT;
-                    st.rateMarkAcked = st.acked;
-                    if (roundRate > 0) {
-                        st.bwSamples.push(roundRate);
-                        if (st.bwSamples.length > PACE_BW_WINDOW)
-                            st.bwSamples.shift();
-                        st.btlBwBps = Math.max(...st.bwSamples);
-                    }
-                    // Wire carries goodput + FEC parity + retransmits, so to fill the LINK
-                    // we pace above goodput by the loss overhead: wire = goodput/(1 − loss).
-                    const lossMult = 1 / (1 - Math.min(0.5, st.lossEwma));
-                    // Two-phase paced control, tuned for STABILITY first (never bloat).
-                    if (st.bbrPhase === 0) {
-                        // STARTUP: ramp ×1.4/round until a real queue builds (rtt ≥1.35×RTprop
-                        // → pipe full), then cruise. The queue-based exit keeps latency
-                        // bounded: on a lossy path loss-recovery trips it sooner, so the fill
-                        // is slower — but it NEVER bloats. That's the right trade — fast on a
-                        // good path, graceful (stable, not 15 s of queue) on a bad one.
-                        const rawQueue = st.minRttMs !== Infinity ? rtt - st.minRttMs : 0;
-                        if (st.minRttMs !== Infinity && rawQueue > st.minRttMs * 0.35)
+                    st.srttMs = st.srttMs === 0 ? acceptedRtt : 0.85 * st.srttMs + 0.15 * acceptedRtt;
+                    if (acceptedRtt < st.minRttMs)
+                        st.minRttMs = acceptedRtt;
+                    // Aggregate ACKs into a time-sized delivery sample. Previously every
+                    // single ACK was treated as a BBR round and dt was clamped to 50 ms;
+                    // on a 1–2 ms LAN that made the measured rate look permanently tiny
+                    // and normal scheduler jitter immediately ended STARTUP.
+                    const sampleMs = nowT - st.rateMarkMs;
+                    if (sampleMs >= PACE_SAMPLE_MS) {
+                        st.roundCount++;
+                        const roundRate = ((st.acked - st.rateMarkAcked) * 1000) / sampleMs;
+                        st.rateMarkMs = nowT;
+                        st.rateMarkAcked = st.acked;
+                        const lanNow = this.isLanPath(friendId);
+                        // On a paced LAN flow, sustainable delivery cannot suddenly be
+                        // many times faster than the bytes we are putting on the wire.
+                        // Such a sample is delayed/coalesced ACKs draining, not new
+                        // capacity. Relay samples keep their existing conservative cap.
+                        const measuredRate = lanNow
+                            ? Math.min(roundRate, Math.max(PACE_INIT_BPS, st.paceRateBps * LAN_SAMPLE_MAX_GAIN))
+                            : roundRate;
+                        if (measuredRate > 0) {
+                            st.bwSamples.push(measuredRate);
+                            if (st.bwSamples.length > PACE_BW_WINDOW)
+                                st.bwSamples.shift();
+                            st.btlBwBps = Math.max(...st.bwSamples);
+                        }
+                        // On a lossy public/relay path, wire carries goodput + FEC parity +
+                        // retransmits, so compensate by 1/(1-loss). On a physical LAN,
+                        // loss is normally self-induced receiver/socket overflow; raising
+                        // pace in response creates a positive feedback loop (up to 2x).
+                        const lossMult = lanNow ? 1 : 1 / (1 - Math.min(0.5, st.lossEwma));
+                        if (lanNow && !st.lanPath) {
+                            // A transfer can begin on relay and then promote to a validated
+                            // physical-LAN endpoint. Restart STARTUP from the measured rate.
+                            st.bbrPhase = 0;
+                            st.fullBwRounds = 0;
+                        }
+                        st.lanPath = lanNow;
+                        if (!lanNow) {
+                            // Relay/public-NAT file traffic must remain conservative. A short
+                            // ACK burst can wildly overstate bandwidth there; allowing LAN's
+                            // exponential STARTUP filled the TCP relay with an 8.7 s queue.
+                            // This affects only file DATA/FEC — IP/video has its own path.
                             st.bbrPhase = 2;
-                        st.paceRateBps = Math.max(st.paceRateBps * 1.4, st.btlBwBps * PACE_STARTUP_GAIN * lossMult);
-                    }
-                    else {
-                        // PROBE_BW cruise: one round probes up, one DRAINS (0.8×), six at 1× →
-                        // the AVERAGE pace is exactly bandwidth, so the queue stays shallow.
-                        const gain = PACE_CYCLE_GAINS[st.roundCount % PACE_CYCLE_GAINS.length];
-                        st.paceRateBps = Math.max(PACE_INIT_BPS * 0.5, st.btlBwBps * gain * lossMult);
-                    } // Hard safety cap: never pace faster than a full window drains in 1 RTT.
-                    if (st.minRttMs !== Infinity && st.minRttMs > 0) {
-                        st.paceRateBps = Math.min(st.paceRateBps, (WINDOW_CHUNKS * MAX_FILE_DATA_SIZE) / (st.minRttMs / 1000));
+                            const gain = PACE_CYCLE_GAINS[st.roundCount % PACE_CYCLE_GAINS.length];
+                            st.paceRateBps = Math.max(PACE_INIT_BPS, Math.min(PACE_INIT_BPS * 2, st.btlBwBps * gain * lossMult));
+                        }
+                        else if (st.bbrPhase === 0) {
+                            // BBR full-bandwidth detection: remain in STARTUP while delivered
+                            // bandwidth grows. A relative RTT threshold is unusable on LAN —
+                            // 1 ms → 2 ms scheduler jitter looked like a 100% queue and pinned
+                            // every transfer near PACE_INIT_BPS. The absolute, smoothed queue
+                            // ceiling still protects a deep relay from runaway buffering.
+                            // A paced flow initially delivers slightly less than its wire
+                            // pace, so max-filter plateau detection can exit at 120 KB/s
+                            // before it has actually probed the LAN. Instead, keep ramping
+                            // while the receiver sustains most of the offered rate. Stop
+                            // only after several under-delivery samples or a clear queue
+                            // spike. This is a direct closed loop: no guessed LAN speed cap.
+                            if (measuredRate >= st.paceRateBps * LAN_STARTUP_KEEPUP) {
+                                st.fullBwRounds = 0;
+                            }
+                            else {
+                                st.fullBwRounds++;
+                            }
+                            const rawQueue = st.minRttMs !== Infinity ? acceptedRtt - st.minRttMs : 0;
+                            const startupOvershot = rawQueue > LAN_STARTUP_QUEUE_MS;
+                            const startupUnderDelivering = st.fullBwRounds >= LAN_STARTUP_SLOW_ROUNDS;
+                            if (startupUnderDelivering || startupOvershot) {
+                                st.bbrPhase = 2;
+                            }
+                            if (startupUnderDelivering || startupOvershot) {
+                                // Forget ACK-compressed highs immediately and drain at 80% of
+                                // the pre-spike pace. Keeping the max-filtered high here made
+                                // the sender continue flooding for ~2 s and collapse cwnd.
+                                st.bwSamples = measuredRate > 0 ? [measuredRate] : [];
+                                st.btlBwBps = measuredRate > 0 ? measuredRate : PACE_INIT_BPS;
+                                st.paceRateBps = Math.max(PACE_INIT_BPS, Math.min(st.paceRateBps * 0.8, st.btlBwBps * 1.1));
+                            }
+                            else if (st.bbrPhase === 0) {
+                                st.paceRateBps = Math.max(st.paceRateBps, Math.min(st.paceRateBps * LAN_STARTUP_MAX_GAIN, Math.max(PACE_INIT_BPS, measuredRate * LAN_STARTUP_DELIVERY_GAIN)));
+                            }
+                            else {
+                                st.paceRateBps = Math.max(PACE_INIT_BPS * 0.5, Math.min(st.paceRateBps, st.btlBwBps * lossMult));
+                            }
+                        }
+                        else {
+                            // PROBE_BW cruise: one sample probes up, one drains, six cruise.
+                            const gain = PACE_CYCLE_GAINS[st.roundCount % PACE_CYCLE_GAINS.length];
+                            st.paceRateBps = Math.max(PACE_INIT_BPS * 0.5, st.btlBwBps * gain * lossMult);
+                        }
+                        // Hard safety cap: never pace faster than a full window drains in 1 RTT.
+                        if (st.minRttMs !== Infinity && st.minRttMs > 0) {
+                            st.paceRateBps = Math.min(st.paceRateBps, (WINDOW_CHUNKS * MAX_FILE_DATA_SIZE) / (st.minRttMs / 1000));
+                        }
+                        // cwnd = safety ceiling sized to 2× pace BDP. Pacing is primary.
+                        const bdpRttMs = st.minRttMs !== Infinity && st.minRttMs > 0
+                            ? (lanNow ? Math.max(st.minRttMs, LAN_BDP_RTT_FLOOR_MS) : st.minRttMs)
+                            : 0;
+                        const paceBdp = bdpRttMs > 0
+                            ? (st.paceRateBps * (bdpRttMs / 1000)) / MAX_FILE_DATA_SIZE : WINDOW_CHUNKS;
+                        const cwndFloor = lanNow ? CWND_INIT_CHUNKS : CWND_MIN_CHUNKS;
+                        st.cwnd = Math.max(cwndFloor, Math.min(WINDOW_CHUNKS, Math.ceil(paceBdp * 2)));
                     }
-                    // cwnd = SAFETY ceiling sized to the PACE rate (2×paceRate×RTprop), NOT
-                    // the measured bandwidth (which would self-limit). Pacing is primary.
-                    const paceBdp = (st.minRttMs !== Infinity && st.minRttMs > 0)
-                        ? (st.paceRateBps * (st.minRttMs / 1000)) / MAX_FILE_DATA_SIZE : WINDOW_CHUNKS;
-                    st.cwnd = Math.max(CWND_MIN_CHUNKS, Math.min(WINDOW_CHUNKS, Math.ceil(paceBdp * 2)));
+                }
+                if (process.env.DECENT_DEBUG && nowT - st.lastCcLogMs >= 1000) {
+                    st.lastCcLogMs = nowT;
+                    console.error(`[file-cc] friend=${friendId.slice(0, 8)} ack=${st.acked}/${st.size}` +
+                        ` rtt=${rtt}ms srtt=${st.srttMs.toFixed(1)}ms low=${st.lowRttCount}` +
+                        ` accepted=${(!lowSample || promoteLowPath) ? 1 : 0}` +
+                        ` pace=${Math.round(st.paceRateBps)}Bps bw=${Math.round(st.btlBwBps)}Bps` +
+                        ` cwnd=${st.cwnd} phase=${st.bbrPhase} slow=${st.fullBwRounds}` +
+                        ` loss=${(st.lossEwma * 100).toFixed(1)}% rounds=${st.roundCount}`);
                 }
             }
             if (st.acked - st.lastProgressAcked >= 256 * 1024 || st.acked >= st.size) {
@@ -861,7 +979,11 @@ export class FileTransferManager {
                 try {
                     await this.send(friendId, PACKET_ID_FILE_DATA, encodeFileData(st.fileNumber, off, st.data.subarray(off, end)));
                 }
-                catch {
+                catch (error) {
+                    if (process.env.DECENT_DEBUG || process.env.DECENT_DEBUG_VERBOSE) {
+                        console.error(`[file-ft] data-send-error friend=${friendId.slice(0, 8)} num=${st.fileNumber} ` +
+                            `off=${off} error=${error instanceof Error ? error.message : String(error)}`);
+                    }
                     break; // transport down; the watchdog re-kicks
                 }
                 st.paceTokens -= end - off;

package/dist/peer.js

@@ -211,7 +211,10 @@ export class Peer {
     #opts;
     #events = new EventEmitter();
     // Toxcore-standard file transfer (wire-compatible with native Carrier/toxcore).
-    #fileTransfer = new FileTransferManager((friendId, packetId, payload) => this.#sendMessengerPacket(friendId, packetId, payload), (event, payload) => { this.#events.emit(event, payload); });
+    #fileTransfer = new FileTransferManager((friendId, packetId, payload) => this.#sendMessengerPacket(friendId, packetId, payload), (event, payload) => { this.#events.emit(event, payload); }, (friendId) => {
+        const session = this.#friendSessions.get(friendId);
+        return !!session?.lanRemoteHost && session.remote?.host === session.lanRemoteHost;
+    });
     #keyPair;
     #udp = new UdpTransport();
     // TURN relay (stable fallback path). One node-level allocation on its own
@@ -2063,17 +2066,14 @@ export class Peer {
                 // low-water mark, like toxcore net_crypto drops below buffer_start.
                 //
                 // EXCEPT single-transport channels (bulk IP = bulkDataPacketId, and
-                // file transfer 80-82): they are NOT dual-sent, so they never produce
-                // duplicates — and the low-water mark would then only drop a
-                // legitimately REORDERED packet, which over a high-rate stream (CCTV
-                // over a long-haul China↔US path that reorders) is pure added loss /
-                // jitter. IP forwarding is order-independent (the TUN/TCP above
-                // reassembles), so deliver every packet. Must run BEFORE the nonce
-                // advance so a real duplicate doesn't desync the receive nonce.
+                // file DATA/FEC): they are NOT dual-sent, so they never produce
+                // transport duplicates — and the low-water mark would then only drop a
+                // legitimately REORDERED packet. File SENDREQUEST/CONTROL are sparse
+                // control traffic and intentionally remain dual-sent so they can confirm
+                // an optimistic UDP path before the bulk data pump begins. Must run
+                // BEFORE the nonce advance so a real duplicate doesn't desync it.
                 const innerKind = opened.payload.length > 0 ? opened.payload[0] : -1;
                 const isSingleTransportKind = (this.#opts.bulkDataPacketId !== undefined && innerKind === this.#opts.bulkDataPacketId) ||
-                    innerKind === PACKET_ID_FILE_SENDREQUEST ||
-                    innerKind === PACKET_ID_FILE_CONTROL ||
                     innerKind === PACKET_ID_FILE_DATA ||
                     innerKind === PACKET_ID_FILE_FEC;
                 // Confirm the transport path + liveness for EVERY decrypted packet —
@@ -3818,7 +3818,15 @@ export class Peer {
         // bulk-IP channel and lossy packets; the crypto nonce still advances above so
         // decryption stays in sync regardless.
         const isFileTransfer = kind === PACKET_ID_FILE_SENDREQUEST || kind === PACKET_ID_FILE_CONTROL || kind === PACKET_ID_FILE_DATA || kind === PACKET_ID_FILE_FEC;
-        const isBulkData = (this.#opts.bulkDataPacketId !== undefined && kind === this.#opts.bulkDataPacketId) || isFileTransfer;
+        // Offers and control/ACK packets are sparse path-establishment traffic, not
+        // bulk. Dual-send them over an optimistic UDP candidate plus the reliable
+        // relay copy, just like chat/control traffic. A direct FILE_SENDREQUEST or
+        // FILE_CONTROL arrival confirms UDP before FILE_DATA starts, so the data
+        // stream can select the LAN path instead of remaining pinned to tcp-relay.
+        // If UDP is not viable, the relay copy still completes the negotiation and
+        // FILE_DATA falls back to its existing reliable single-transport route.
+        const isFileBulk = kind === PACKET_ID_FILE_DATA || kind === PACKET_ID_FILE_FEC;
+        const isBulkData = (this.#opts.bulkDataPacketId !== undefined && kind === this.#opts.bulkDataPacketId) || isFileBulk;
         const isDroppable = (isBulkData && !isFileTransfer) || kind >= 192;
         if (!isDroppable) {
             session.sendPacketNumber = (packetNumber + 1) >>> 0;
@@ -3859,20 +3867,12 @@ export class Peer {
         // e.g. decentlan IP=163) stays bulk / single-transport to avoid the relay
         // backlog + duplicate fan-out that high packet rates cause. Chat is sparse
         // and net_crypto dedups by packet number, so dual-send is safe here.
-        // File transfer (80 sendrequest / 81 control / 82 data) is ALSO treated as
-        // bulk → single-transport. It is high-volume AND order-sensitive: the
-        // receiver reassembles chunks SEQUENTIALLY (position is implicit) and there
-        // is no retransmit queue. Dual-sending it over UDP + relay (two paths with
-        // different latency) reorders the chunks, and the receive-side low-water
-        // dedup then drops the late copies — so a large file (mp4) gets gaps /
-        // wrong order and never completes, while a tiny one (png, 1-2 chunks)
-        // happens to finish before reordering bites. Pinning file transfer to a
-        // single transport keeps the chunks in send order. (Reliability across a
-        // lossy path still wants a reorder buffer + retransmit — tracked separately.)
-        // File transfer rides the relay RELIABLY (never dropped under backpressure):
-        // a dropped IP/CCTV packet is fine (the stream moves on), but a dropped file
-        // chunk corrupts the file (no retransmit). So bulk IP data stays droppable
-        // while file transfer is queued. (isBulkData / isFileTransfer computed above.)
+        // File DATA/FEC is bulk and stays single-transport. SENDREQUEST and CONTROL
+        // (accept/ACK/kill) are low-volume control traffic: dual-sending those is
+        // what confirms an optimistic LAN candidate before the data pump starts.
+        // File packets ride the relay RELIABLY (never dropped under backpressure):
+        // a dropped IP/CCTV packet is fine, but a dropped file chunk can stall the
+        // transfer. (isBulkData / isFileTransfer computed above.)
         await this.#sendToFriend(friendId, encrypted, session, isBulkData, isFileTransfer);
     }
     /**
@@ -3896,6 +3896,15 @@ export class Peer {
         const udpFresh = !!realUdpRemote &&
             s?.lastUdpRecvMs !== undefined &&
             Date.now() - s.lastUdpRecvMs < 4_000;
+        // A freshly-received UDP packet proves only the peer -> us direction.
+        // That is enough for lossy IP/video bulk, whose inner TCP stream can
+        // recover a dropped packet, but not for reliable file data: returning
+        // UDP-only on a one-way public/NAT endpoint silently black-holes every
+        // chunk. A physical-LAN lock is stronger evidence because the candidate
+        // was validated against the local subnet; otherwise file bulk continues
+        // to TURN/TCP below.
+        const fileUdpOnlyConfirmed = !reliableOnRelay ||
+            (!!s?.lanRemoteHost && s.remote?.host === s.lanRemoteHost);
         // Bulk IP data rides the direct path ONLY while it's fresh. When it
         // goes stale (likely a NAT remap mid-stream), we do NOT keep firing
         // into the dead endpoint and we do NOT duplicate onto UDP — we bridge
@@ -3903,7 +3912,8 @@ export class Peer {
         // lastUdpRecvMs). This converts a multi-second blackout into a few
         // seconds of higher relay latency. Control packets always probe UDP
         // (to keep the NAT mapping warm) so we still try UDP for them.
-        const tryUdp = realUdpRemote && (isBulkData ? udpFresh : true);
+        const tryUdp = realUdpRemote &&
+            (isBulkData ? udpFresh && fileUdpOnlyConfirmed : true);
         if (tryUdp && s?.remote) {
             try {
                 await this.#sendPacket(packet, s.remote);
@@ -3913,9 +3923,9 @@ export class Peer {
                 firstError = error;
             }
         }
-        // Fresh direct path → send over UDP only — but ONLY for bulk data.
-        // Bulk is high-volume and must avoid relay fan-out / backlog, so once
-        // the direct path is fresh it rides UDP exclusively.
+        // Fresh confirmed direct path → send over UDP only, but ONLY for bulk.
+        // For files, `tryUdp` above requires the physical-LAN lock; a merely-fresh
+        // public endpoint deliberately falls through to reliable TURN/TCP.
         //
         // Low-volume traffic (chat 64 + control keepalives / endpoint offers /
         // profile) instead ALSO goes over the relay even when the direct path

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.95",
+  "version": "0.1.98",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",