Guard both sides of LAN fast-open races

[marcus-pousette-hp]

This prevents an initiator from claiming a direct route before the responder has committed to it.

Changes

• When a LAN attempt starts, skip the speculative initial fast-open probe while the LAN ping and coordinated holepunching continue concurrently.
• On the responder, echo holepunch probes only after local coordinated punching has started. This deliberately checks local punching, rather than the initiator's advertised intent.

Probe ordering

For an older initiator connecting to an updated responder:

Probe arrival	Responder behavior
Before any control message	Ignore
After the initial punching: false message	Ignore
After punching: true, but before local approval and p.punch()	Ignore
After local p.punch() starts	Echo

This covers both probe-before-control and control-before-probe ordering. A delayed probe cannot bypass NAT analysis, application rejection, punch rate limits, or an abort. Once local punching has started, the responder has committed and echoing is safe.

There is no wire-format change, and intentional non-LAN server fast-open remains available. Updated responders protect older initiators regardless of probe ordering; older responders retain the existing behavior outside detected LAN attempts until upgraded.

Validation

• Permanent tests cover matched and fallback LAN candidates, preservation of intentional non-LAN server fast-open, and responder echo behavior before and after local punching.
• Full Node, Bare, and integration suites pass.
• Version-pinned mixed-version evidence against hyperdht@6.33.1, including reordered-probe acceptance and rejection, is isolated in draft #288.

Co-authored with AI