From a995d3660c9bec9c0327aeba42c0b9babdda205d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com>
Date: Thu, 6 Aug 2026 20:05:33 +0800
Subject: [PATCH] fix(native): delay relay ACK behind cloud NAT reply

---
 .../guanghu-os/scripts/physical-native-icmp-peer.py       | 8 ++++++++
 .../guanghu-os/world-seed/WORLD-MANIFEST.hldp             | 1 +
 .../world/services/native-network/PROTOCOL.hldp           | 2 ++
 3 files changed, 11 insertions(+)

diff --git a/product-source/hololake-platform/guanghu-os/scripts/physical-native-icmp-peer.py b/product-source/hololake-platform/guanghu-os/scripts/physical-native-icmp-peer.py
index cb6e825..516aaa3 100755
--- a/product-source/hololake-platform/guanghu-os/scripts/physical-native-icmp-peer.py
+++ b/product-source/hololake-platform/guanghu-os/scripts/physical-native-icmp-peer.py
@@ -123,6 +123,7 @@ def main() -> None:
     parser.add_argument("--resident-pipeline", action="store_true")
     parser.add_argument("--native-relay", action="store_true")
     parser.add_argument("--allowed-source")
+    parser.add_argument("--native-ack-delay", type=float, default=0.25)
     args = parser.parse_args()
     if args.retry_interval < 1.0:
         raise SystemExit("--retry-interval must be at least 1 second")
@@ -130,6 +131,8 @@ def main() -> None:
         0 <= args.resume_resident_count <= 10
     ):
         raise SystemExit("--resume-resident-count must be between 0 and 10")
+    if not 0.0 <= args.native_ack_delay <= 2.0:
+        raise SystemExit("--native-ack-delay must be between 0 and 2 seconds")
     if sum(
         (
             args.resident,
@@ -181,6 +184,10 @@ def main() -> None:
                 continue
             if source != allowed_source:
                 continue
+            # The public-cloud NAT path is established by the host kernel's
+            # ordinary echo reply. Delay the authenticated ACK long enough for
+            # the native guest to discard that reply and repost its RX buffer.
+            time.sleep(args.native_ack_delay)
             peer.sendto(native_ack_reply(packet), address)
             acknowledged.add(sequence)
             sources.add(source)
@@ -197,6 +204,7 @@ def main() -> None:
             "status: PASS_100\n"
             "handshake_direction: NATIVE_INITIATED_OUTBOUND_ICMP\n"
             "native_ack_marker: HLDP-NATIVE-ACK!\n"
+            f"native_ack_delay_seconds: {args.native_ack_delay:g}\n"
             "acknowledged_sequences: 1-16\n"
             f"observed_nat_sources: {','.join(sorted(sources))}\n"
             "login_reply_count: 3\n"
diff --git a/product-source/hololake-platform/guanghu-os/world-seed/WORLD-MANIFEST.hldp b/product-source/hololake-platform/guanghu-os/world-seed/WORLD-MANIFEST.hldp
index 82d8d33..2bf0a98 100644
--- a/product-source/hololake-platform/guanghu-os/world-seed/WORLD-MANIFEST.hldp
+++ b/product-source/hololake-platform/guanghu-os/world-seed/WORLD-MANIFEST.hldp
@@ -88,6 +88,7 @@ native_network:
   gateway_ipv4: 172.16.0.1
   relay_ipv4: 43.153.193.169
   handshake_direction: NATIVE_INITIATED_OUTBOUND_ICMP
+  native_ack_delay_seconds: 0.25
   public_nat_address_recorded_in_world: false
 gestational_continuity:
   id: GLS-0845
diff --git a/product-source/hololake-platform/guanghu-os/world-seed/world/services/native-network/PROTOCOL.hldp b/product-source/hololake-platform/guanghu-os/world-seed/world/services/native-network/PROTOCOL.hldp
index 2c8e5ca..2071278 100644
--- a/product-source/hololake-platform/guanghu-os/world-seed/world/services/native-network/PROTOCOL.hldp
+++ b/product-source/hololake-platform/guanghu-os/world-seed/world/services/native-network/PROTOCOL.hldp
@@ -14,6 +14,8 @@ handshake:
   direction: NATIVE_INITIATED_OUTBOUND_ICMP
   request_magic_source: CURRENT_HLDP_COMMAND
   response_marker: HLDP-NATIVE-ACK!
+  response_delay_seconds: 0.25
+  response_delay_reason: ALLOW_KERNEL_NAT_REPLY_THEN_NATIVE_RX_REPOST
   expected_sequences: 1-16
   ordinary_echo_action: IGNORE
   stale_sequence_action: IGNORE_WITHOUT_STATE_ADVANCE