Summary

  • RFC 9959 lets a sender retain congestion-control observations from one connection and cautiously use them to accelerate a later connection to what it treats as the same Remote Endpoint.
  • The saved congestion window and RTT are historical evidence, not present path capacity: reconnaissance, a single-use lock, a paced jump of at most half the saved window and live validation limit their authority.
  • Loss, ECN or path-change evidence must trigger Safe Retreat, delete the failed saved state, drain unvalidated work and reduce the window so an optimization does not keep externalising its error onto competing flows.

The first transfer had gone well. A server sent a large object across a high-delay path and observed that one round trip could carry far more than the initial congestion window. It kept two numbers: the capacity it had actually used and the lowest round-trip time it had seen.

An hour later, the same client address asked for another large object. If the sender began from zero knowledge, slow start would deliberately underuse the path while it rediscovered capacity. If it trusted the old numbers without qualification, it could inject a large burst into a path that no longer existed.

Both risks are concrete. A route may have changed. An anycast address may now terminate at another site. A mobile access link may be slower. Other flows may have occupied the bottleneck. A load balancer may give several workers copies of the same memory and let every new connection spend it at once.

RFC 9959, published on the IETF Standards Track in May 2026, specifies Careful Resume for that gap. The method reuses congestion-control parameters retained from a previous connection, but it treats them as a hypothesis that must earn authority again. The governing sequence is not “cache hit, send fast”. It is observe, identify, expire, reserve once, reconnoitre, pace, validate and retreat if reality disagrees.

The saved window is a dated observation

Careful Resume can save a saved_cwnd, a saved_rtt, a saved_remote_endpoint and a Lifetime. The window is derived from capacity the earlier connection actually utilised, such as bytes acknowledged during one RTT. The RTT is the minimum observed then. The endpoint value is the sender’s implementation-dependent description of the path. The Lifetime says when the record loses permission to influence a new connection.

Those fields answer a narrow question: what did one earlier flow observe under one earlier traffic and routing condition? They do not measure link rate, contracted bandwidth, current spare capacity or the share a new flow deserves.

That distinction follows the congestion duty in RFC 2914. Congestion control is not merely a way to optimise the sender’s completion time. It prevents one endpoint from imposing its preferred rate on every flow sharing a bottleneck. Retained state is attractive because it reduces relearning. It is dangerous because a local performance memory can spend capacity owned jointly by strangers.

RFC 9959 therefore allows no more than one saved set for a Remote Endpoint. A later observation should update or replace it. An implementation may decline to save a small observation below four times the initial window because the complexity would buy little acceleration. Memory is selective, replaceable and perishable; it is not an accumulated balance.

“Same endpoint” is still a path hypothesis

The Remote Endpoint includes an identifier for the sending interface and one for the destination, such as a unicast or anycast IP address. It can include DSCP or other information. More detail can distinguish paths better, but it also makes reuse rarer.

No choice makes the key a physical-path certificate. The same anycast address can land at different server farms. ECMP can choose another route. NAT, access handover, tunnelling or policy can move the smallest bottleneck. The address pair may be stable while queue capacity, RTT and competing traffic change.

That is why RFC 9959 requires both identity tests and current observations. A local signal that the path changed invalidates reuse. So does expiry. RTT supplies another warning: a current minimum at or below half the saved RTT would let a half-window jump run faster than the earlier observation justified, while a current RTT above ten times the saved value is also treated as a path change.

RTT resemblance is evidence, not identity. Two paths can have similar latency and different capacity. One path can keep its route while its queue occupancy changes. Reconnaissance reduces uncertainty; it does not abolish it.

A four-phase experiment, not a larger initial window

Careful Resume starts the new connection under normal congestion control. RFC 5681 supplies the classic TCP discipline, and RFC 6928 gives the larger modern initial-window context. The sender does not open with yesterday’s window. During reconnaissance, it sends no more than an ordinary new connection may send.

If the initial data encounters loss or ECN-CE, if the endpoint or path signal changed, if the Lifetime expired, or if another connection is already using the saved set, Careful Resume ends before a jump. Only after the initial data is acknowledged without reported congestion may the sender enter the Unvalidated Phase.

The jump is deliberately incomplete:

jump_cwnd ≤ Min(max_jump, saved_cwnd / 2)

Half the old observation is a ceiling, not a guarantee. The operator can set a lower max_jump. Every unvalidated packet must be paced using the current RTT, so a window change does not become one line-rate burst. The sender records the already used flight as PipeSize and increases that measure only as new acknowledgements prove delivery.

The phase is short. Sending the unvalidated flight, receiving an acknowledgement for its first packet or spending more than one RTT there moves the controller toward validation. If the application did not have enough data to use the jump, the unused portion does not survive as free credit. The window falls back to used capacity.

In the Validating Phase, acknowledgements can support normal controller growth, but the experiment remains revocable until the unvalidated packets have been acknowledged without congestion. A parser flag or phase transition is not the verdict. Current delivery is.

One memory cannot finance a fan-out

The single-use rule matters most in distributed services. Suppose one previous transfer records a saved_cwnd of 200 packets. A half-window ceiling limits one resumed flow to 100, subject to max_jump. If five workers independently read the same cache entry, the bottleneck can receive five individually conforming jumps whose aggregate is 500 packets.

RFC 9959 forbids that multiplication. Only one connection can use a specific saved set at a time. A single server process may enforce the invariant in a hash table. A load-balanced service that hashes connections across processes or hosts needs distributed ownership, an atomic lease or a decision not to resume.

This is not an implementation footnote. It decides who may spend historical evidence. A cache copied for availability can silently copy sending authority as well. Replication, failover and retry need the same one-use semantics as the normal path.

RFC 9040 gives a wider architecture for sharing cached TCP control-block information across connections. It shows why temporal sharing can improve performance and why cache scope matters. It does not choose the safe Lifetime for Careful Resume. The service owner still has to decide how old is too old, how configuration changes flush state and which workers share one coordination domain.

Safe Retreat pays back a failed inference

Loss, ECN-CE or a relevant path-change signal after the jump is not ordinary evidence arriving at an ordinary window. The sender acted on a memory that may have overshot the present bottleneck. Its response therefore has to be more conservative than “continue from a slightly smaller estimate”.

Safe Retreat deletes the saved parameters so a later connection cannot retry the same failed assumption. It reduces CWND to no more than half the validated PipeSize, performs recovery with that smaller window and forbids window growth while the unvalidated packets drain. On exit, ssthresh is no larger than PipeSize × Beta, with a default Beta of 0.5.

RFC 9937 defines Proportional Rate Reduction for pacing a congestion response toward a controller-selected target. RFC 9959 says PRR is not appropriate for this Safe Retreat case because a retained-state jump may have created significant overshoot. Gradual reduction could keep the mistaken flow dominant while displaced flows struggle to recover.

RFC 9438 supplies CUBIC’s ordinary controller and its 0.7 beta context. RFC 9959 also discusses how rate-based controllers such as BBR can retain an equivalent bottleneck-bandwidth observation. The variables differ; the liability does not. A failed trial must leave the path in a state where other flows can regain a share.

Persistent congestion ends the method. The sender returns to normal control. A late ACK for an unvalidated packet does not retroactively make the jump wise.

Memory expiry is a traffic policy

RFC 9959 does not specify one Lifetime. A path known to vary may justify minutes. A stable path that is not expected to be shared by many senders may justify hours. A highly shared bottleneck raises the risk that repeated resumes create prolonged overload and starvation, so the record should expire sooner.

This configuration converts uncertainty into an operating decision. A longer Lifetime improves the hit rate and can reduce completion time. It also expands the interval in which routing, traffic, access capacity or server placement can change beneath a valid-looking key. A lower max_jump limits one mistake but may erase much of the benefit. A broader endpoint key increases reuse while increasing aliasing. There is no universal optimum because the loss is paid partly by flows the sender does not own.

The older RFC 7661 manages a non-validated congestion window when a current connection is rate-limited and recommends a non-validated period no longer than five minutes. Careful Resume has extra reconnaissance, pacing, validation and retreat controls, so it can justify a different Lifetime. The two clocks should not be confused: one governs an underused current window; the other governs whether a later connection may consult historical state.

RFC 4782 offers a useful contrast. Quick-Start asked routers along the path to approve a requested rate. Careful Resume does not obtain router approval. It infers from endpoint memory, then probes present reality. Operators must not describe the result as capacity reservation or network consent.

The receiver and application retain vetoes

The receiver may know that its interface changed, hardware is constrained, the transfer will be short, or another flow needs capacity. RFC 9959 leaves room for a transport mechanism through which it can enable or inhibit Careful Resume. It does not define one universal signal.

Nor does CWND alone set the sending rate. The TCP receive window in RFC 9293 can be smaller. QUIC connection and stream credit in RFC 9000 can bind. QUIC’s anti-amplification boundary can bind before address validation. An application with no bytes ready cannot validate a large jump by intention.

RFC 9002 supplies QUIC’s initial window, pacing, loss detection and persistent-congestion context. RFC 9000 also treats path migration as a reason to establish fresh path state. Connection identity can survive while congestion authority does not.

RFC 8085 extends the shared-resource obligation beyond TCP: UDP applications and transports also need congestion discipline and appropriate pacing. Careful Resume is not a loophole by which a sender can convert a prior observation into an ungoverned application rate.

The executed phase chain is the evidence

Heng Lu’s running-code principle points to the evidence operators actually need. “Careful Resume enabled” is not enough. The record must show the cache key, observation time, old and current RTT, Lifetime, one-use acquisition, initial flight, jump, pacing, PipeSize, ACK/loss/ECN inputs, phase transitions, state deletion, retreat window and observed effect.

His minimum-specification argument fits the design. The RFC standardises safety invariants. It leaves Remote Endpoint construction, Lifetime, max_jump, cache architecture, receiver signalling and deployment scope local. Local choice is defensible when a named owner accepts the shared-bottleneck liability and proves the outcome.

The reality-layer distinction prevents a common collapse: a cache entry exists; the current path appears similar; the controller entered an unvalidated state; packets were acknowledged; the service improved without starving others. These are five different claims. Each needs its own evidence.