https://github.com/liulilittle/kcc
[Experimental] KCC: A Linux kernel TCP congestion control module that applies Kalman Filtering to the BBR model for noise-resistant bandwidth estimation.
https://github.com/liulilittle/kcc
bbr c cc cca driver kcc kernel net network os tcp tcp-ip
Last synced: 29 days ago
JSON representation
[Experimental] KCC: A Linux kernel TCP congestion control module that applies Kalman Filtering to the BBR model for noise-resistant bandwidth estimation.
- Host: GitHub
- URL: https://github.com/liulilittle/kcc
- Owner: liulilittle
- License: other
- Created: 2024-05-21T07:29:27.000Z (about 2 years ago)
- Default Branch: main
- Last Pushed: 2026-07-08T05:46:01.000Z (about 1 month ago)
- Last Synced: 2026-07-10T09:33:48.555Z (29 days ago)
- Topics: bbr, c, cc, cca, driver, kcc, kernel, net, network, os, tcp, tcp-ip
- Language: C
- Homepage:
- Size: 1.41 MB
- Stars: 7
- Watchers: 1
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# TCP KCC v1.0 (Kalman Congestion Control)
KCC is an independently engineered congestion control algorithm built on the three-component RTT decomposition model. Its outermost FSM is BBRv1-compatible for TCP stack integration; all inner mechanisms — Kalman propagation-delay estimation, three-component signal separation, queue-aware drain-skip, LT bandwidth estimation — are independently architected around the T_prop / T_queue / T_noise model. ECN support is retained but disabled by default (see §B34 and §ECN).
---
### Reading Guide
This document blends **mathematical proofs** with **engineering documentation**. To avoid confusion, readers should understand the distinction:
| Part | Sections | Purpose | Guarantees |
|------|----------|---------|------------|
| **I: Design Rationale** | §Proof A–F, §Three-Component Decomposition, §C.1–C.4 | Prove the three-component model is the unique minimal identifiable decomposition for CC; justify the directional update as censored Kalman | Model identifiability (FIM, CRLB); structural correctness |
| **II: Stability Proofs** | §Lemmas O.1–O.3 (Observer ISS), Q.1–Q.3 (DRAIN), Theorems C.1 (Convergence), S.2 (Contraction), 3–6, Corollary | Prove the **full closed-loop system** is stable — convergence proven from DRAIN, not assumed | ISS cascade, dwell-time GAS, fairness |
| **III: Engineering Implementation** | §Nonlinear Extensions, §Saturation Recovery, §Boundary Cases B1–B51, §Parameters, §FSM | Document the **actual running code** — nonlinear mechanisms, parameters, state machine, edge cases | Empirically bounded behavior; ISS preconditions maintained |
**Critical distinction:** The Part I proofs establish that the three-component model with a directional prior is the **correct architecture**. The Part II proofs establish that the **closed loop** is stable. Neither part claims that every ACK is processed by a textbook-Kalman MMSE-optimal update — the Part III mechanisms (outlier gate, jitter EWMA, drift correction, saturation response) intentionally deviate from linear Kalman assumptions while preserving the ISS boundedness conditions established in Lemmas O.1–Q.3 and Theorems C.1, S.2, 3–6.
**New readers:** Start with §[KCC Innovations Beyond BBRv1](#kcc-innovations-beyond-bbrv1) for a practical overview, then §[Part III](#part-iii-engineering-implementation--nonlinear-mechanisms) for how the code works. Return to Parts I–II when you need the mathematical justification. See §[Troubleshooting Guide](#troubleshooting-guide) for operational tuning.
---
## RTT Decomposition: Four-Component vs. Three-Component Model
KCC's core philosophy is that congestion control requires a different RTT decomposition than network measurement. This section rigorously proves why the three-component model is the necessary and sufficient decomposition for congestion control algorithms.
### The Four-Component Model (Network Measurement)
The standard four-component model decomposes end-to-end RTT by physical location:
$$
RTT = T_{prop} + T_{trans} + T_{queue} + T_{proc}
$$
| Component | Meaning | Magnitude | Observable end-to-end? |
|-----------|---------|-----------|----------------------|
| T_prop | Signal propagation (distance / c) | ms scale | **No** — cannot distinguish from T_trans + T_proc |
| T_trans | Bit serialization (MTU / C) | µs scale | **No** — merged into total RTT |
| T_queue | Buffer queuing | 0 to 100s of ms | **No** — cannot distinguish from T_prop |
| T_proc | Switch processing | µs or lower | **No** — invisible in end-to-end scalar |
**Fundamental limitation:** With only a scalar RTT observation, NONE of the four components can be independently identified. The model is physically complete but inferentially useless — it describes the physics without providing operational leverage for the congestion control problem, which IS an inference problem.
### The Three-Component Model (Congestion Control Inference)
KCC reclassifies RTT by **behavioral characteristics and informational value**, not by physical location:
$$
RTT_{obs} = T_{prop} + T_{queue} + T_{noise}
$$
| Component | Classification | Physical Basis | Congestion Information |
|-----------|---------------|----------------|----------------------|
| **T_prop** | **Trusted anchor** | All delay constant on a fixed path: pure propagation + constant serialization + processing. Changes only with route switch. | Zero — does not vary with congestion |
| **T_queue** | **Congestion signal** | Queue delay = buffer_occupancy / C. Varies continuously with send rate. | **100%** — the only component carrying congestion info |
| **T_noise** | **Interference** | NIC coalescing, OS jitter, ACK compression, wireless L2 retransmission, malicious injection. Transient, uncorrelated with queue. | Zero — must be structurally isolated |
**Classification criterion:** The four-component model asks "where in the network did this delay occur?" — unanswerable end-to-end. The three-component model asks "should this delay component enter my rate/cwnd decision?" — answerable through behavioral statistics.
### Formal Comparison
| Dimension | Four-Component | Three-Component |
|-----------|---------------|-----------------|
| Classification | Physical location | Behavioral characteristics & trustworthiness |
| Components | 4 (prop, trans, queue, proc) | 3 (prop, queue, noise) |
| Noise modeling | None — all RTT is "signal" | Explicit — T_noise structurally isolated |
| Serves | Network measurement | Congestion control algorithm design |
| End-to-end separability | **Impossible** — components not independently observable | **Possible** — directional update + jitter statistics separate them |
| Core question | What physical steps constitute RTT? | Which parts of RTT are trustworthy for rate decisions? |
| Inference capability | None — descriptive only | Full — provides prior structure for Bayesian/Kalman inference |
### Congestion Control IS an Inference Problem
The sender observes only a scalar $$z_k = RTT_{obs}$$ at each ACK. The true network state — T_prop, queue depth, bottleneck capacity — is a vector of **hidden variables**. Congestion control is fundamentally the task of inferring these hidden states from polluted observations and making rate decisions accordingly.
This is structurally identical to a state estimation problem with unknown disturbance — the problem class the Kalman filter was designed to solve (Kalman, 1960, _ASME J. Basic Eng._ 82:35-45).
The three-component model provides the prior structure that makes this inference possible by asking three answerable questions:
1. **Is this RTT change caused by congestion?** → Yes → T_queue, MUST NOT update baseline.
2. **Does this fluctuation contain congestion information?** → T_queue contains it; T_noise does not.
3. **Which observations should update the state?** → Only decreases and persistent downward drift update T_prop. Spikes are rejected as T_noise outliers.
The four-component model, classifying by physical location alone, cannot answer any of these questions — it provides no basis for distinguishing which RTT components are trustworthy for rate/cwnd decisions.
The two models are **not mutually exclusive**. They describe the same physical RTT at different abstraction levels: four-component for physical-layer measurement (µs-precision), three-component for inference-layer control (ms-precision). For congestion control, only the three-component classification provides an actionable framework.
---
### A Note on Proofs vs. Implementation
See the **Reading Guide** (§above) and **Part III: Nonlinear Mechanisms in Implementation** (§below) for a detailed discussion of the distinction between theoretical model proofs and engineering implementation. In brief: the proofs establish why the three-component directional architecture is correct; implementation stability is guaranteed by ISS theory, not by Kalman MMSE optimality.
---
### Mathematical Formalization of the Three-Component Model
**Definition 1 (Equivalence Class Partition).** Let r ∈ ℝ be the end-to-end RTT scalar observation. Define three equivalence classes partitioning the physical delay components by their response to congestion:
1. **T_prop (Physical Baseline Set)**: All delay components satisfying ∂/∂q ≈ 0 under congestion variations. Formally:
T_prop = {x ∈ ℝ : ∂x/∂q = 0 for all feasible queue states q}
Physical constituents: electromagnetic propagation, constant processing overhead, baseline packet serialization at constant link rate.
2. **T_queue (Congestion Signal Set)**: All delay components satisfying ∂/∂q > 0 monotonically. Formally:
T_queue = {x ∈ ℝ : ∂x/∂q > 0 and x ≥ 0}
Physical constituents: buffer queuing delay, serialization delay from link-rate reductions under congestion.
3. **T_noise (Interference Set)**: All delay components with E[∂x/∂q] = 0 (zero conditional mean) and finite variance. Formally:
T_noise = {x ∈ ℝ : E[x | q] = E[x] and Var(x) < ∞}
Physical constituents: NIC interrupt coalescing, OS scheduling jitter, ACK compression, wireless link-layer retransmissions.
**Theorem (Partition Completeness).** The three sets {T_prop, T_queue, T_noise} form a partition of the space of all end-to-end delay components. Formally: every physical delay source belongs to exactly one of the three classes by the trichotomy of its derivative ∂/∂q: negative is impossible (queuing cannot reduce delay), zero defines T_prop, positive defines T_queue (systematic) or T_noise (zero-mean random).
**Proof.** Any delay source x ∈ ℝ satisfies exactly one of: (i) E[∂x/∂q] = 0 and Var(∂x/∂q) = 0 ⇒ T_prop; (ii) ∂x/∂q > 0 and x grows monotonically with q ⇒ T_queue; (iii) E[∂x/∂q] = 0 and Var(∂x/∂q) > 0 ⇒ T_noise. Since ∂x/∂q < 0 is physically impossible (FIFO queues never reduce delay when occupancy increases), the trichotomy is exhaustive with no overlap.
**Why 3, Not 4?** The four-component physical model {T_prop, T_trans, T_queue, T_proc} partitions by PHYSICAL LOCATION, creating components that are NOT separable from scalar RTT observations. Proof E below shows the FIM is singular (rank 1 < dim 4) for scalar RTT. In contrast, the three components of the behavioral partition are separated by their response to queue variations — a CRITERION THAT IS TESTABLE from RTT observations alone, via the directional update.
**Why 3, Not 2?** A two-component model {T_base, T_queue} cannot distinguish congestion from noise. The test statistic ∂/∂q would classify all positive RTT variations as queue, including noise spikes — leading to systematically inflated T_prop estimates. The third component T_noise enables structural separation of signal from interference, which is essential for unbiased estimation (Proof A Corollary).
---
## Part I: Design Rationale — Summary (Full proofs in Appendix A)
> The complete mathematical proofs (FIM identifiability, Cramér-Rao bounds, censored-Kalman conditional optimality, AIC/BIC analysis) are in [Appendix A](#appendix-a-theoretical-proofs). This section provides the conclusions in condensed form.
### Summary of Model Comparison Proofs
| Proof | Statement | Method | Publicly Verifiable Theorem |
|-------|-----------|--------|---------------------------|
| E | Four-component is information-theoretically unidentifiable | Fisher Information rank = 1 < 4; Cramér-Rao bound infinite (Rao 1945) | Cramér-Rao theorem, any estimation theory textbook §3 |
| E1 | Bayesian priors cannot salvage four-component inference | Posterior precision Λ_post singular on T_prop vs T_queue subspace; nullspace direction v = [1,0,-1,0]^T unconstrained | Rank-1 Bayesian precision update + nullspace analysis |
| F | Three-component is identifiable through behavioral priors | Prior 1 (constant T_prop*) collapses dimension; Prior 2 (zero-mean noise); Prior 3 (directional conditioning) breaks degeneracy | Kalman's conditional minimum-variance + Bayesian posterior update |
| F Suppl | Three-component partition is unique minimal sufficient statistic for CC inference | Neyman-Fisher factorization criterion; mapping of all partitions to dimensionality | Neyman-Fisher factorization theorem (Fisher 1922, Neyman 1935) |
| L | Three-component is the minimal complete signal model for CC | Proof by exhaustion: 1-component trivial, 2-component fails signal-noise separation (Prop 1-4), 3-component is unique | Information-theoretic signal model, Blackwell dominance |
| M | BBR's implicit 2-component model is a degenerate case of KCC's 3-component | Projection π: M_3 → M_2; kernel dimension 1; Blackwell information dominance | Blackwell (1953), comparison of experiments |
| K | Three independent drain mechanisms bound T_prop error under worst-case perpetual congestion | Composite bound: PROBE_RTT drain (200ms at cwnd_min=4 MSS), drift correction virtual drop, smart recalibration | Fisher Information rank analysis (Cover & Thomas 2006), Kalman convergence |
| C1 | If T_queue(k) > ε for all samples, T_prop overestimate ≥ ε causing BDP inflation | Algebraic consequence of T_prop+T_queue singularity; min-extraction error bound | Cramér-Rao bound with singular FIM |
| C2 | KCC limits starvation error via three mechanisms with composite bound ≤ 11× at 10Gbps/10ms | Integration of PROBE_RTT drain volume, drift correction tier thresholds, recalibration timeout | Lindley's equation for queue dynamics |
| N | All five alternative approaches are special cases of or strictly dominated by KCC's 3-component model | Proof by case analysis (Timely, Copa, PCC, Remy, Sprout); structural comparison via information-theoretic privation | Blackwell (1953) comparison of experiments, Cramér-Rao bound |
| O | Directional update tightens SIGCOMM'18 congestion boundary Δ_lo | Censored-regression analysis of min(0,ν) gate; Tobit-type tightened bounds | Tobin (1958) censored regression, SIGCOMM'18 CC evaluation framework |
| Thm 6 | Unified ISS dissipation ΔV ≤ −αV + γ‖ω‖² across three-subsystem cascade with dwell-time frequency guarantees | ISS-Lyapunov cascade composition (Dashkovskiy 2007); dwell-time condition via cos² phase analogy | Sontag & Wang (1995) ISS, Jiang & Mareels (1997) small-gain, Liberzon (2003) switched systems |
| I | KCC's estimation is closed under arbitrary RTT asymmetry with bounded conservative error | Six-part proof: min-extraction immune, three-component closed under summation, BDP inflation conservative, sign preserved, forward/reverse fundamental limit | Algebra of min-extraction, structural closure under partitioned RTT |
| J | Bounded fairness gap between KCC and loss-based/BBR-family CCAs | Equilibrium analysis of queue dynamics; directional gate prevents winner-takes-all; conservative BDP maintains bounded gap | Conservation law for fair-share (small-gap, ISS) |
The three-component model {T_prop, T_queue, T_noise} is the unique minimal identifiable decomposition for congestion control. The four-component model is information-theoretically unidentifiable from scalar RTT (FIM rank 1 < dim 4; CRB infinite). The directional update with censored-data Kalman filtering achieves almost-sure convergence to T_prop under the behavioral prior T_prop ≤ min(RTT). See Appendix A for complete proofs.
## Three-Component RTT Decomposition
KCC is built on a single irreducible model:
$$
RTT_{obs} = T_{prop} + T_{queue} + T_{noise}
$$
| Component | Definition | Physical Meaning | KCC Treatment |
|-----------|-----------|-----------------|---------------|
| **T_prop** | Propagation delay | Distance / c. Constant on fixed path, changes only with route switch. **Defines the lower bound of link capacity.** | Trusted anchor. Estimated by Kalman filter (x_est). All rate/cwnd decisions bounded by this estimate. |
| **T_queue** | Queueing delay | Buffer occupancy / C. Varies continuously with congestion. **The ONLY RTT component carrying genuine congestion information.** | Actionable signal. Drives ECN backoff, gain decay, agg safety gating. Must NEVER update the T_prop baseline. |
| **T_noise** | Interference | NIC coalescing, OS jitter, ACK compression, wireless L2 retransmission, malicious delay injection. **Carries ZERO congestion information.** | Structurally isolated. Rejected by outlier gate, suppressed by directional update, diluted by Kalman R boost when jitter is high. |
**Core design rule:** T_prop anchors, T_queue signals, T_noise is isolated. KCC structurally prevents T_noise from directly triggering rate-reduction mechanisms (ECN backoff, gain decay). Residual T_noise that passes the outlier gate enters decisions only through an attenuated, Kalman-gain-mediated feedback that makes the filter MORE conservative (higher adaptive R → lower K_ss → slower convergence). This is an indirect throughput cost — slower convergence means x_est may stay conservatively below T_prop longer during path-change recovery, yielding slightly lower throughput temporarily — but it is a stability-preserving, bounded-cost response, not a deliberate "payment" for noise.
### Formal Proofs of the Three-Component Model
Seven independent proofs (A-F+E1) establish that the three-component decomposition is physically necessary, mathematically complete, operationally sufficient, and information-theoretically the only viable decomposition for congestion control. Four-component models are proven inferentially impossible from scalar RTT.
---
**Proof A (Completeness and Minimality).**
The standard four-component model (Keshav 1991, RFC 9438) decomposes end-to-end RTT by physical location:
$$
RTT = T_{prop} + T_{trans} + T_{queue} + T_{proc}
$$
where T_trans = MTU/C is serialization delay and T_proc is switch forwarding latency. On a fixed path with constant link rate C, both T_trans and T_proc are CONSTANT (independent of congestion).
Define the physical baseline:
$$
T_{base} = T_{prop} + T_{trans} + T_{proc}
$$
Then: $$RTT = T_{base} + T_{queue}$$.
However, this two-component model fails under adversarial measurement: OS jitter, NIC coalescing, and ACK compression inject transient delays NOT captured by T_queue (which models buffer occupancy only). Define:
$$
T_{noise} = RTT_{obs} - T_{base} - T_{queue}
$$
**Completeness:** $$RTT_{obs} = T_{base} + T_{queue} + T_{noise}$$ by construction. Every millisecond of observed RTT is attributed to exactly one component.
**Minimality:** The three components form the minimal complete set because:
- (a) T_base cannot be merged with T_queue — they carry opposite informational value (one is trusted anchor, the other is congestion signal).
- (b) T_noise cannot be merged with T_queue — they have opposite autocorrelation structure: queue is low-pass filtered by bottleneck capacity C (N_eff ~ C*RTT/MTU samples), noise is high-pass with inter-ACK timescale (~us).
- (c) T_noise cannot be merged with T_base — T_base is constant on a fixed path, noise is transient and zero-mean.
Therefore three components is the MINIMAL complete set. Any fewer components causes information loss; any more components creates undecidable classification (see Proof E).
#### Theorem: Uniqueness of the Three-Component Decomposition
**Theorem.** Let RTT decompose as z = Σ a_i·c_i where c_i are physical components and a_i ∈ {0,1} are observability coefficients. A decomposition is OPERATIONALLY COMPLETE for CC iff: (a) every component maps to exactly one of {anchor, signal, noise} roles, (b) no two components with the same role are separable by end-to-end observation. The partition {T_prop+E[T_trans]+E[T_proc], T_queue, T_noise} is the **unique** coarsest partition satisfying both conditions.
**Proof.** The proof proceeds in three lemmas.
**Lemma 1 (Role Uniqueness).** Under the three behavioral roles R = {anchor, signal, noise}, the assignment of physical components to roles is unique and deterministic.
Define the role classification function ρ: C → R by the following physical criteria applied to each component c_i:
| Criterion | Anchor | Signal | Noise |
|-----------|--------|--------|-------|
| Congestion dependence ∂c_i/∂q | = 0 | ≠ 0 | = 0 |
| Path stationarity Var(c_i \| path) | = 0 | > 0 | > 0 |
| Autocorrelation timescale τ(c_i) | ≫ RTT | ~ RTT | ≪ RTT |
Application to each physical component:
- **T_prop:** ∂/∂q = 0, Var|path = 0, τ ≫ RTT → **anchor**
- **E[T_trans]** (constant serialization): ∂/∂q = 0, Var|path = 0, τ = ∞ → **anchor**
- **E[T_proc]** (constant forwarding): ∂/∂q = 0, Var|path = 0, τ = ∞ → **anchor**
- **T_queue:** ∂/∂q ≠ 0, Var|path > 0, τ ~ RTT → **signal**
- **Variable T_proc** (load-dependent): ∂/∂q ≠ 0 (correlated with queue occupancy), τ ~ RTT → **signal**
- **Variable T_trans** (rate-dependent): ∂/∂q ≠ 0 (correlated with congestion-driven rate changes), τ ~ RTT → **signal**
- **ε_nic** (NIC coalescing): ∂/∂q = 0, Var > 0, τ ≪ RTT → **noise**
- **ε_sched** (OS scheduler): ∂/∂q = 0, Var > 0, τ ≪ RTT → **noise**
- **ε_ack** (ACK compression): ∂/∂q = 0, Var > 0, τ ≪ RTT → **noise**
- **Wireless rate adaptation** (variable T_trans uncorrelated with congestion): ∂/∂q = 0, Var > 0, τ ~ RTT. The congestion-dependence criterion ∂/∂q = 0 is decisive: any component with ∂/∂q = 0 is non-signal for CC purposes regardless of timescale. Since Var|path > 0, it is not anchor. Classification: **noise**. The timescale criterion distinguishes noise from anchor; it is not a separate axis for creating a fourth role.
Each component's role is determined uniquely by its physical definition. The primary criterion is congestion dependence (∂/∂q): ∂/∂q ≠ 0 → signal; ∂/∂q = 0 with Var|path = 0 → anchor; ∂/∂q = 0 with Var|path > 0 → noise. The timescale criterion is informative (distinguishing noise from anchor in ambiguous cases) but not decisive — ∂/∂q = 0 is sufficient for non-signal classification. No component satisfies the criteria of two distinct roles. Therefore ρ is a well-defined function (not a relation), and role assignment is unique. **QED Lemma 1.**
**Lemma 2 (Coarseness — Three is Minimal and Sufficient).** No partition into fewer than three behavioral classes preserves operational completeness; no partition into more than three is identifiable from scalar RTT.
**(a) Merge anchor + signal** (T_base + T_queue → single component): The merged component T_merged = T_base + T_queue varies with congestion but contains the path-constant T_base. The CC algorithm cannot extract a stable trust anchor from T_merged because ∂T_merged/∂q ≠ 0 everywhere. Route changes (ΔT_base) become indistinguishable from queue changes (ΔT_queue). The anchor role is destroyed.
**(b) Merge signal + noise** (T_queue + T_noise → single component): By Proof B, T_noise is uncorrelated with T_queue and has non-zero variance. The merged signal has variance:
$$
Var(T_{queue} + T_{noise}) = Var(T_{queue}) + Var(T_{noise}) > Var(T_{queue})
$$
The CC algorithm cannot distinguish congestion-driven RTT increases from noise-driven RTT increases. The signal role is corrupted.
**(c) Merge anchor + noise** (T_base + T_noise → single component): T_base is path-constant with Var|path = 0; T_noise is transient with Var > 0. The merged component has non-zero variance on a fixed path, destroying the stationarity property that defines the anchor role. The anchor role is destroyed.
**(d) Four or more components:** By Proof E, the observation matrix h = [1,…,1]^T for k ≥ 4 components yields FIM rank 1 < k. The (k−1)-dimensional nullspace makes k−1 parameters unidentifiable. Even Bayesian priors cannot recover full rank for k ≥ 4 (Proof E1: the T_prop vs T_queue degeneracy v = [1,0,−1,0]^T persists under any prior that constrains only T_trans, T_proc).
Therefore three is both minimal (cases a–c) and maximal (case d). **QED Lemma 2.**
**Lemma 3 (Uniqueness Under Behavioral Priors).** No alternative three-component partition achieves full-rank FIM while preserving behavioral completeness.
_Proof by exhaustion._ Any alternative three-component partition P' = {A', B', C'} must assign each physical component to one of three groups. By Lemma 1, there are exactly three behavioral equivalence classes. Consider deviations from the canonical partition P = {T_base, T_queue, T_noise}:
**Case 1:** P' reassigns a noise component (e.g., ε_nic) to the signal class. Then B' = T_queue + ε_nic. By Proof B, ε_nic is uncorrelated with T_queue with sub-RTT timescale. The behavioral prior "signal has congestion-correlated autocorrelation at RTT timescale" (Proof F, Prior 3) is violated. The directional conditioning that breaks the T_prop*↔ T_queue degeneracy fails: ε_nic introduces false innovations ν_k < 0 that corrupt T_prop* updates. FIM rank under behavioral priors drops below full rank.
**Case 2:** P' reassigns a signal component (e.g., variable T_proc) to the anchor class. Then A' = T_base + var(T_proc). Since ∂var(T_proc)/∂q ≠ 0 (Lemma 1), A' varies with congestion, violating Prior 1 (Var(anchor|path) = 0) of Proof F. The constant-anchor prior that collapses the state from 3D to 2D is invalid. FIM rank = 1 (no prior regularization), and identifiability is lost.
**Case 3:** P' reassigns an anchor component (e.g., E[T_trans]) to the noise class. Then C' = T_noise + E[T_trans]. E[T_trans] is constant (not zero-mean transient), violating Prior 2 (E[noise] = 0) of Proof F. The unbiased measurement condition E[z_t | T_prop*] = T_prop* + E[T_queue] acquires a systematic bias E[T_trans], making T_prop* unrecoverable. FIM rank under these corrupted priors is strictly less than dim(θ).
All cases produce either (i) a violated behavioral prior that destroys identifiability (FIM rank < dim(θ)), or (ii) a corrupted role that violates operational completeness. Therefore P = {T_base, T_queue, T_noise} is the **unique** three-component partition that simultaneously achieves full-rank FIM (Proof F), preserves behavioral role separation, and is minimal (Lemma 2). **QED Lemma 3.**
**By Lemmas 1–3,** the three-component behavioral partition {T_base, T_queue, T_noise} is the unique identifiable and cleanly separated decomposition for endpoint-observable scalar RTT under the {anchor, signal, noise} behavioral classification. **QED Theorem.**
**Corollary (Why 3 Components, Not 2 or 4).**
**(i) WHY NOT 4 (overparameterized):** The observation vector for the four-component model is h = [1, 1, 1, 1]^T with singular value ‖h‖ = 2. The rank-1 FIM matrix H = h·h^T has eigenvalues {‖h‖² = 4, 0, 0, 0}. Only 1 eigenvalue is nonzero → rank(H) = 1 < dim(θ) = 4. The 3-dimensional nullspace makes 3 of 4 parameters unidentifiable (Proof E). det(FIM) = 0 identically.
**(ii) WHY NOT 2 (underfitted):** A two-component model RTT = T_base + T_queue merges T_noise into T_queue. This violates the inference requirement: T_queue carries congestion information (actionable signal), T_noise does not (interference). Merging produces a BIASED congestion signal with inflated variance:
$$
Var(T_{queue_merged}) = Var(T_{queue}) + Var(T_{noise}) + 2·Cov(T_{queue}, T_{noise})
$$
Since T_noise is uncorrelated with T_queue (Proof B), Cov = 0, giving $$Var(merged) = Var(T_{queue}) + Var(T_{noise}) > Var(T_{queue})$$. The rate controller responds to noise variance as if it were congestion variance, producing spurious cwnd oscillations proportional to √Var(T_noise). A two-component model cannot distinguish "RTT rose because the queue grew" from "RTT rose because the OS scheduler delayed an ACK."
**(ii-a) Error-Probability Lower Bound for 2-Component Models:**
Under the 2-component model RTT = T_base + T_queue' where T_queue' = T_queue + T_noise (merged), any congestion detector D(RTT_obs) operating on the scalar innovation ν_k has an irreducible false-positive probability. Formally:
- H_0: ΔRTT = T_noise (no congestion, only interference)
- H_1: ΔRTT = T_queue + T_noise (genuine queue buildup)
A detector with threshold τ declares "congestion" when ν_k > τ. Under H_0, the innovation ν_k = T_noise has variance σ²_noise.
**Theorem (2-Component False-Alarm Lower Bound).** For ANY threshold τ ≥ 0 and any distribution of T_noise with variance σ²_noise > 0 and median 0:
$$
P(false alarm | H_0) ≥ min( ½ , σ²_noise / (2τ²) )
$$
_Proof._ Case 1 (τ = 0): P(ν_k > 0 | H_0) ≥ ½ for any symmetric-median distribution. The detector false-alarms on every positive noise sample. Case 2 (τ > 0): For Gaussian noise, P(T_noise > τ) = 1 − Φ(τ/σ_noise). At τ = σ_noise: P(FA) ≈ 0.159; at τ = 2σ_noise: P(FA) ≈ 0.023. Both establish P(FA) > 0 for any finite τ. As τ → ∞, P(FA) → 0 but then P(detection | H_1) → 0 also — no detections at all.
**Corollary (Detection-Power vs False-Alarm Trade-off).** For any 2-component detector with threshold τ: P(FA) + P(miss) ≥ 1 − TV(H_0, H_1) where TV is the total variation distance. Since H_0 and H_1 differ only by mean shift μ_queue, for Gaussian noise: TV = 2·Φ(|μ_queue|/(2σ)) − 1. At μ_queue/σ = 1: TV ≈ 0.383, giving P(FA) + P(miss) ≥ 0.617. The error sum **cannot** be driven to zero by any threshold choice — the distributions overlap in the convolved space.
Under the 3-component model, the directional gate φ(ν_k) = 𝟙(ν_k ≤ 0) and outlier gate ψ jointly separate T_queue from T_noise. The key insight: the directional gate does NOT aim for zero false-alarms on noisy samples — it converts positive noise innovations into **conservative gate-rejects** that structurally resist inflating T_prop (force-accept after max_consec_reject provides a bounded safety-valve exception). Expected contribution of residual noise = E[ν | ν ≤ 0]·K_ss = −σ·√(2/π)·K_ss < 0 → downward bias on T_prop (safe, conservative). No 2-component model can achieve this structural safety.
**Conclusion:** No 2-component model can separate congestion-driven RTT increases from noise-driven RTT increases; the conflated signal has an irreducible detection error. Three components is the MINIMAL decomposition that structurally separates signal from interference with bounded downward-only estimation bias.
**(iii) WHY EXACTLY 3 (Goldilocks):** Three components map to exactly three operationally distinct roles: {anchor, signal, noise}. Under behavioral priors (Proof F), the posterior precision matrix achieves full rank (3 = dim(θ_3comp)), making all parameters identifiable. Two components ARE identifiable (det > 0) but produce a congested signal where noise corrupts the queue estimate. Three is the unique minimal count that achieves BOTH identifiability AND signal-noise separation. Four is unidentifiable (singular FIM).
**Three Lines of Defense — the three-component model is protected against**
**falsification by two mathematical perspectives on the same rank-deficiency fact,**
**plus one independent behavioral argument:**
Lines 1+2 are two formulations of the same algebraic impossibility: I(θ) = (N/σ²)·H, so rank(H) = 1 directly implies I(θ) singular and CRB infinite. They are presented separately because they speak to different audiences (linear algebra vs. estimation theory), but they are logically equivalent — not independent.
**Line 1 — Linear Algebra (Proof E):** h = [1,1,1,1]^T, H = h·h^T. rank(H) = rank(h) = 1 < 4 = dim(θ). det(H) = 4·0·0·0 = 0 identically. The observation matrix is rank-1; 3 parameters are in the nullspace. This is an algebraic identity — not a statistical claim that could be "empirically refuted."
**Line 2 — Estimation Theory (Proof E, Cramér-Rao):** Any unbiased estimator θ̂ satisfies Cov(θ̂) ≥ I(θ)^(-1). Since I(θ) = (N/σ²)·H is singular (a direct consequence of Line 1), I(θ)^(-1) does not exist. The Cramér-Rao lower bound is _infinite_ in 3 of 4 directions. No amount of data (N→∞) can overcome a singular FIM.
**Line 3 — Behavioral Completeness (Proof F, independent of Lines 1-2):** Three components map to the three operationally distinct roles {anchor, signal, noise}. Under behavioral priors, the posterior precision achieves full rank (3 = dim(θ_3comp)). Two components are identifiable but lack signal-noise separation (noise inflates signal variance); four components overfit (singular FIM). Three is the unique identifiable + cleanly separated count. This argument is independent of Lines 1-2: it proves uniqueness of the three-component partition, not just impossibility of four components.
**Note on Behavioral Completeness:** The three roles are NOT arbitrary — they correspond to the three possible actions a congestion control algorithm can take on any RTT component:
1. **TRUST:** Use it as a stable reference for rate computation (anchor)
2. **ACT ON:** Respond to its changes to modulate sending rate (signal)
3. **IGNORE:** Structurally reject it from decision-making (noise)
These three actions are COMPLETE: any CC algorithm makes exactly a three-way classification of RTT information into {trusted, actionable, ignored}. Different algorithms differ only in HOW they draw the boundaries between these categories, not in the existence of the categories themselves. The 3-component model is therefore a UNIVERSAL framework for analyzing CC algorithm design.
**Conclusion:** Within the static, scalar-observation, no-prior framework: to refute Lines 1-2 is to refute linear algebra (equivalently, the Cramér-Rao theorem); to refute Line 3 is to claim either that noise is congestion OR that four components are identifiable from scalar observations. Each claim is mathematically impossible within this framework. **The three-component model is the only identifiable decomposition given endpoint-observable information.**
**Identifiability.** Within the static, scalar-observation, no-prior framework, any attempt to refute the three-component model must refute the Fisher Information rank theorem: $$\det(H) = \det(h \cdot h^T)$$. For the four-component observation vector $$h = [1, 1, 1, 1]^T$$, we have $$\|h\|^2 = 4$$, $$H = h \cdot h^T$$ has eigenvalues {4, 0, 0, 0}, and $$\det(H) = 4 \cdot 0 \cdot 0 \cdot 0 = 0$$ identically. The rank deficiency of 3 — the fact that zero is an eigenvalue of H — is an algebraic necessity, not a modeling choice. To claim that four components are simultaneously identifiable from scalar RTT is to claim that the determinant of a rank-1 matrix in $$R^{4 \times 4}$$ is nonzero — asserting that $$0 \neq 0$$. **Within the static, scalar-observation, no-prior framework, to overturn the three-component model one must overturn linear algebra.** These conclusions hold within the framework of scalar RTT observation without additional input signals. The sender also possesses packet-size knowledge and bandwidth estimates; however, these introduce circular dependencies that do not resolve the fundamental identifiability problem.
**Three boundary expansions (honest assessment):** Three potential loopholes in the FIM/CRLB argument have been identified and analyzed:
1. **T_trans computability:** The sender knows packet size L, and T_trans = L/B is computable from the bandwidth estimate. However, using an estimated B to decompose T_trans creates a circular dependency — both quantities must be jointly estimated from the same scalar RTT, and the joint FIM remains rank-deficient. Even if T_trans were perfectly known and subtracted, the residual observation `z'_k = T_prop + T_queue + T_noise` still maps to exactly the {anchor, signal, noise} partition — the same three-component model.
2. **Dynamic observability:** RTT is a time series, and the four components have different frequency spectra (T_prop: ultra-low, T_trans: high, T_queue: mid, T_noise: ultra-high). On variable-bandwidth links (WiFi, cellular), dynamic observability CAN help distinguish components by their dynamic signature. However, on fixed-bandwidth paths (the dominant case for wired infrastructure), T_prop and T_trans share identical near-identity dynamics (both constant on a fixed path), so the observability Gramian remains rank-deficient. KCC already accounts for this: slow B changes are absorbed into T_prop drift correction; fast B changes are rejected as T_noise.
3. **Bayesian priors:** Bayesian estimators with informative priors can achieve finite posterior variance even with a singular FIM. The key question is whether sufficiently MUTUALLY DISTINCT priors exist for T_prop vs T_trans. On a fixed path, both have the same prior (constant, low process noise). The three-component model succeeds precisely because its behavioral priors ARE mutually distinct: {anchor: constant, signal: non-negative excursions, noise: symmetric zero-mean}. Three is the maximum number of components that can be given mutually distinct behavioral priors from endpoint-observable data.
**Conclusion:** Each boundary expansion narrows the rank deficiency but does not eliminate it. The three-component model with behavioral priors is the unique identifiable decomposition given the information actually available to a TCP sender. The original "three lines of defense" framing has been corrected: Lines 1 and 2 (rank deficiency → FIM singularity → CRB infinite) are two formulations of the same algebraic fact, not independent arguments. Line 3 (behavioral completeness) IS independent: three components map to three operationally distinct roles {anchor, signal, noise} — two underfits, four overfits.
Reference: Cover, T.M. & Thomas, J.A., _Elements of Information Theory_, 2nd ed., Wiley, 2006, Ch.11.
---
**Proof B (Existence and Distinguishability of T_noise).**
**Claim:** T_noise exists as a physically distinct phenomenon and is statistically distinguishable from T_queue.
**Existence:** NIC interrupt coalescing (up to device-specific interrupt moderation intervals on the order of 100 µs), OS scheduling jitter (Linux CFS: up to 6 ms under load, Varela et al. 2014), and TCP ACK compression (TSO bursts produce inter-ACK gaps of MSS·burst_size/pacing_rate) are well-documented physical phenomena uncorrelated with buffer occupancy. Their existence is physically established and documented in the networking measurement literature.
**Distinguishability:** Let the RTT innovation be $$ν_k = z_k - x_k$$. Under the null hypothesis H0 (no T_queue), E[ν_k] = 0 and ν_k has variance σ_noise² from T_noise alone. Under H1 (T_queue present), E[ν_k] = μ_queue > 0 with additional variance.
The outlier gate uses a two-component threshold that provides source-dependent effective multiplier:
$$dyn\_thresh = max\left(\max\left(\frac{min\_rtt}{2^{shift}},\ floor\_us\right) \times scale,\ jitter\_ewma \times outlier\_jitter\_mult \times scale\right)$$
With defaults (rtt_frac_shift=2 → 25% RTT, min_floor_us=50µs, outlier_jitter_mult=2): on WiFi 6E (RTT=200µs, jitter=300µs), the RTT-proportional component gives 50 µs and the jitter component gives 600 µs — the jitter component dominates. On WAN (RTT=50ms, jitter=2ms), the RTT component gives 12.5 ms and the jitter component gives 4 ms — the RTT-proportional component dominates. The absolute floor (50 µs) prevents over-filtering from OS/NIC jitter on DC paths (RTT < 200 µs).
$$
P(|ν_k| > k·σ | H0) ≤ 1/k²
$$
On clean WAN paths (RTT=50ms, jitter=1ms), the RTT-proportional component dominates (threshold≈12.5ms, effective k≈12.5), giving P ≤ 1/156 ≈ 0.64%. On clean DC paths (RTT≈200µs, jitter≈10µs), the min_floor (50µs) dominates, giving k≈5 (P ≤ 1/25 = 4%). The false-negative rate depends on μ_queue / σ_noise (the signal-to-noise ratio), which exceeds 3 for congestion on paths with ≥3 ms of queue above typical jitter (1 ms) — sufficient for reliable discrimination under the `kcc_qdelay_cong_bp = 2500` (25% of min_rtt) congestion threshold.
---
**Proof C (Directional Update Separates T_prop from T_queue).**
**Claim:** Under the directional update policy (skip positive innovations), the Kalman estimate x_est converges to T_base without upward bias from T_queue.
**Proof:** Let the observation model be:
$$
z_k = T_{base} + q_k/C + η_k
$$
where q_k ≥ 0 is queue occupancy (bytes) and η_k ~ (0, σ_noise²). The innovation is:
$$
ν_k = z_k - x_k = (T_{base} - x_k) + q_k/C + η_k
$$
Under the directional update, the filter only updates when ν_k < 0. This condition implies:
$$
(T_{base} - x_k) + q_k/C + η_k < 0
$$
Since q_k ≥ 0 and η_k has zero conditional mean given no queue, the condition reduces to T_base - x_k < -η_k when q_k > 0.
For large q_k, the probability P(ν_k < 0 | q_k > 0) → 0, meaning queue-contaminated observations are STRUCTURALLY REJECTED. Only when q_k ≈ 0 (queue temporarily drains) does P(ν_k < 0) > 0.
The filter therefore conditions on the event {q_k = 0}, receiving unbiased observations of T_base. The Kalman estimate converges:
$$
lim_{k→∞} E[x_k | q_i = 0 for all i ≤ k] = T_{base}
$$
Drift correction handles the persistent-positive-innovation case where T_base genuinely increases (path change). The $$drift\_thresh = 14$$ is derived from optimal detection theory: Goal: minimize $$E[\text{detection delay}]$$ subject to $$P(\text{false alarm}) \leq 10^{-4}$$. For a fair coin ($$p=0.5$$) sequential test: $$P(D \text{ consecutive positives} \mid H_0) = (1/2)^D$$. Solving $$(1/2)^D \leq 10^{-4}$$ yields $$D \geq \log_2(10000) \approx 13.3$$. Rounding to $$D = 14$$ gives 2 RTT faster detection than the prior value 16 while keeping $$P < 2^{-14} \approx 6.1\times10^{-5}$$ (below target). This is the optimal minimax solution: minimizes worst-case detection delay while guaranteeing false-alarm probability below the specified threshold.
- Early drift (amplitude-based, quiet paths): activates after ≥3 consecutive positive skips (P < 2⁻³ = 0.125 under i.i.d.) when cumulative drift_sum exceeds min_rtt/32 (≈3.1% of path RTT); applies K-independent correction = innov/4 per step
- Tier 1 (quiet paths): activates after 14 consecutive skips (P < 2⁻¹⁴ ≈ 6.10×10⁻⁵ under i.i.d., dampened corr/4 = K·innov/4)
- Tier 2 (statistical certainty): activates after drift_thresh × kcc_drift_tier2_mult = 56 consecutive positive skips (at defaults; P < 2⁻⁵⁶ ≈ 1.39×10⁻¹⁷ under i.i.d. symmetric noise), force-corrects upward by corr/8 = K·innov/8 — converting a statistical certainty into a correction
**Theorem (Running-Minimum MLE).** Under the one-sided noise model $$z_t = T_{\mathrm{prop}} + \varepsilon_t$$ where $$\varepsilon_t \geq 0$$ a.s. (queuing + jitter are non-negative), the running minimum
$$
\hat{x}_k^{\mathrm{RM}} = \min_{t \leq k} z_t
$$
is the maximum-likelihood estimator of T_prop. This is a deterministic functional of the data requiring no model parameters.
**Theorem (Censored Kalman Conditional Minimum-Variance).** Under the Gaussian noise model with one-sided constraint, the censored Kalman filter (CKF)
$$
\hat{x}_k = \hat{x}_{k-1} + K_k \cdot \nu_k \cdot \mathbb{1}(\nu_k \leq 0)
$$
is the minimum-variance estimator of T_prop among all estimators satisfying the one-sided physical constraint — i.e., conditionally optimal on gate-accepted samples. It is NOT the unconditional MMSE estimator: truncating a normal distribution introduces the Mills-ratio bias E[ν | ν<0] = −σ√(2/π) ≠ 0. KCC does not apply a Heckman two-step correction; it accepts a small downward (conservative, safe) bias in exchange for implementation simplicity. It is a Tobit-type censored regression (Tobin 1958) with selection rule
$$
i_k = \mathbb{1}(z_k < \hat{x}_k^-)
$$
$$
, censoring from ABOVE. The constrained projection
$$
$$
\hat{x}_k^+ = \arg\min_{x \leq z_k} \|x - \hat{x}_k^-\|^2_{P^{-1}}
$$
(Simon 2010, Gupta & Hauser 2007).
**Proposition (Asymptotic Convergence).** Both estimators are consistent for T_prop:
$$
\lim_{k \to \infty} \hat{x}_k^{RM} = T_{prop} \quad \text{a.s.}
$$
$$
\lim_{k \to \infty} \hat{x}_k^{CKF} = T_{prop} \quad \text{a.s.}
$$
$$
\implies \lim_{k \to \infty} (\hat{x}_k^{CKF} - \hat{x}_k^{RM}) = 0
$$
However, their **transient behavior differs**: the running minimum updates instantaneously on new minima (gain is effectively 0 or 1), while the CKF updates gradually (Kalman gain K_k ∈ (0,1)) with outlier gating and drift correction.
**Design Rationale (CKF over Running Minimum for CC).** The CKF is the correct estimator for congestion control because:
- **(a) Uncertainty quantification** — p_est tracks estimation variance, enabling model-mismatch detection and adaptive behavior.
- **(b) Adaptive gain** — K_k adjusts to the noise level, avoiding catastrophic tracking of a single corrupted minimum (e.g., hardware timestamp error or NIC offload artifact).
- **(c) Drift detection** — consecutive positive-innovation counting detects genuine T_prop increases (path changes), which the running minimum cannot distinguish from transient noise.
The running minimum is fragile: a single anomalously low sample (negative timestamp error) permanently corrupts the estimate.
**Proof of Correctness:** Let H_0 = "T_prop has not increased" (the behavioral prior). Under H_0, P(z_k + Δ > T_prop + Δ | H_0) = 0 for Δ > 0. Therefore innovation ν_k > 0 implies either T_queue > 0 (congestion) or T_noise artifact — in either case, T_prop has NOT increased and the observation provides NO information about T_prop. The minimal sufficient statistic is z_k · 1(ν_k ≤ 0). This is the directional gate.
---
#### Directional Update: Engineering Correspondence to the Three-Component Trust Structure
The three-component model prescribes a specific trust structure that maps directly to KCC's directional Kalman update:
| Component | Trust Level | Update Rule | Engineering Rationale |
|-----------|-------------|-------------|----------------------|
| **T_prop** | Trusted anchor | Updated **ONLY** on RTT decreases (ν_k < 0) | Structural rejection of T_queue contamination — T_prop does not increase with congestion |
| **T_queue** | Congestion signal | Drives ECN backoff, gain decay, PROBE_RTT skip | Carries 100% of congestion info; NEVER used to update T_prop baseline |
| **T_noise** | Interference | Structurally isolated via outlier gate + jitter EWMA | Carries ZERO congestion info; suppressed from ALL rate/cwnd decisions |
The directional update (ν_k < 0 → accept; ν_k > 0 → reject) is NOT an ad-hoc heuristic — it is the operational realization of the behavioral prior: "T_prop does not increase with congestion." This is the direct engineering translation of the three-component classification.
The four-component model **cannot** provide this update rule's design basis — it classifies by physical location alone, making no distinction between components that should update a baseline and those that should not.
---
### Proof C.1: Directional Update as Censored-Data Kalman Filter
**Claim:** The directional update is a censored-data Kalman filter that converges to T_prop with probability 1 (almost-sure convergence) under the physical assumption that clean samples (q_k = 0) occur with positive asymptotic frequency.
**1. State-Space Model with Censoring**
The physical RTT obeys:
$$
z_k = x_k + q_k/C + η_k (observation equation)
x_{k+1} = x_k (random-walk state for T_{prop})
$$
with the physical constraint:
$$
z_k ≥ x_k (RTT ≥ T_{prop} by definition)
$$
This is a ONE-SIDED CENSORING problem. The innovation ε_k = z_k - x_k has a truncated distribution:
$$
ε_k | (ε_k ≥ 0) follows the queue-plus-noise distribution
$$
**2. Censored Kalman Filter Formulation (Gupta & Hauser 2007, §3.2)**
The optimal state estimate under the inequality constraint x_k ≤ z_k is the projection of the unconstrained estimate onto the feasible set:
$$
x̂_k⁺ = argmin_{x ≤ z_k} ‖x - x̂_k^unc‖²_{P⁻¹}
$$
The directional update IMPLEMENTS this projection:
- When ν_k < 0: z_k < x̂_k → constraint is active → project onto {x ≤ z_k} → accept innovation (pulls estimate down toward T_prop)
- When ν_k > 0: z_k ≥ x̂_k → constraint is already satisfied → no projection needed → SKIP innovation (rejects queue noise)
Thus the directional update EXACTLY implements the constrained-projection Kalman filter (Gupta & Hauser 2007, Eq. 22-24): the projection of the unconstrained update x̂^unc = x̂⁻ + K·ν onto the feasible set {x ≤ z_k} yields x̂⁺ = min(x̂^unc, x̂⁻) for the one-sided constraint x ≤ z_k with ν_k = z_k − x̂⁻. This is a closed-form solution of the projection argmin_{x ≤ z_k} ‖x − x̂^unc‖²_{P⁻¹} — not an approximation.
**Derivation of the O((1−K)²) single-step error bound.** When ν < 0, the unconstrained Kalman optimum x̂^unc = x̂⁻ + K·ν (with K < 1, ν < 0) exceeds the constraint x ≤ z_k = x̂⁻ + ν because K·ν > ν (less negative). The true constrained optimum is x̂* = z_k (push to the boundary). The directional update uses x̂_dir = x̂^unc = x̂⁻ + K·ν. The error between directional update and constrained optimum is:
$$
‖x̂_dir − x̂*‖² = ‖(x̂⁻ + K·ν) − (x̂⁻ + ν)‖² = (1−K)²·ν²
$$
The error is O((1−K)²), not O(K²). At K = K_ss ≈ 0.39: (1−0.39)² = 0.37; the directional update error is ~37% of the innovation's squared magnitude relative to the constrained optimum. When ν > 0, both the constrained optimum and the directional update keep x̂⁻ (no update), so the error is zero. As K → 0 the filter is insensitive and the error approaches ν² (full innovation); as K → 1 the directional update approaches the constrained optimum. (Gupta & Hauser 2007, §3.2, Eq. 26-28)
**3. Almost-Sure Convergence**
Under the physical assumption that clean samples (q_k = 0) occur with positive asymptotic frequency p_clean > 0:
- The innovation sequence on the censored subset {k: q_k = 0} is zero-mean: E[ν_k | censored] = 0
- The Kalman filter on this censored subset is the standard optimal estimator for the state x_k
- By the Kalman filter's asymptotic property (Anderson & Moore 1979, §4.3), the estimate converges:
$$
lim_{k→∞} E[‖x̂_k - x_k‖²] → 0
$$
at the rate determined by the steady-state Kalman gain K_ss.
With p_clean > 0, the censored subset has infinite cardinality almost surely → convergence is almost sure.
**4. Drift Correction as Censoring-Robust Backup**
The drift correction mechanism (Tiers 1 & 2) is NOT a fallback for a "broken" filter — it is a censoring-robustness mechanism in the sense of Tobin (1958):
- When p_clean is very small (e.g., persistent queue), the censored subset is too sparse for timely convergence
- Drift correction provides a bounded-bias guarantee: the estimate cannot drift below T_prop by more than the drift threshold × correction scale (~2% of T_prop in steady state)
- This is formally a Tobin-type regression model with censoring from below: the state is bounded below by T_prop, and the drift correction prevents the censoring from inducing persistent bias
**5. References**
- [Simon 2010] Simon, D. "Kalman filtering with state constraints." IET Control Theory & Applications, 4(8), 1303-1318, 2010.
- [Gupta 2007] Gupta, N. & Hauser, R. "Kalman Filtering with Equality and Inequality State Constraints." arXiv:0709.2791, 2007.
- [Koopman 2000] Koopman, S. J. & Durbin, J. "Fast Filtering and Smoothing for Multivariate State Space Models." J. Time Series Analysis, 21(3), 281-296, 2000.
- [Tobin 1958] Tobin, J. "Estimation of Relationships for Limited Dependent Variables." Econometrica, 26(1), 24-36, 1958.
- [Anderson 1979] Anderson, B. D. O. & Moore, J. B. "Optimal Filtering." Prentice-Hall, 1979.
---
#### Counter-Argument: "Standard Kalman Filter with Outlier Rejection Is Equivalent"
**Objection:** A standard Kalman filter with outlier rejection (e.g., Mahalanobis-distance gating) would achieve the same separation of T_prop from T_queue without directional updates — just reject innovations above the outlier threshold and accept everything else.
**Refutation:**
**1. Outlier gating alone fails on moderate queues.** A standard Kalman filter with outlier gating (threshold at ±5σ) accepts ALL innovations within [−5σ, +5σ]. When T_queue = 2 ms and σ_jitter = 1 ms, the outlier gate sees |ν| = 2 ms < 5 ms threshold → accepts the innovation. The Kalman update drives x̂ upward by K × 2 ms = 0.78 ms (at K_ss = 0.39). Over N consecutive queued samples, the expected upward drift is N × K × μ_queue — **the estimate inflates linearly with sustained queue exposure.** The directional update structurally rejects ALL positive innovations regardless of magnitude — it is queue-agnostic.
**2. The loss function differs — one-sided vs symmetric.** A standard KF minimizes the symmetric mean-squared error E[(x̂ − x)²] which penalizes overestimation and underestimation equally. Congestion control requires ASYMMETRIC loss: overestimating T_prop (x̂ > T_prop) causes cwnd inflation → catastrophic queue buildup; underestimating T_prop (x̂ < T_prop) causes conservative cwnd → bounded throughput loss. The directional update outperforms the symmetric KF for the asymmetric loss L(x̂, x) = c_over · max(0, x̂ − x) + c_under · max(0, x − x̂) with c_over ≫ c_under (overestimation is O(BDP) queue cost; underestimation is O(BDP·gain) throughput cost). The standard KF has c_over = c_under = 1 by construction — it is provably misaligned with the congestion control objective.
**3. One-sided Uniformly Most Powerful (UMP) test.** The directional gate φ(ν_k) = 𝟙(ν_k ≤ 0) is a one-sided decision rule: it rejects H₀ (declares T_queue present) when ν_k > 0. Under Gaussian innovations, this is a one-sided test with effective size α = P(ν_k > 0 | H₀) = 0.5. The UMP property (Neyman-Pearson Lemma) holds at the chosen significance level: for any alternative μ > 0, the threshold-0 test maximizes power at its operating point among all tests with the same size α = 0.5. The power comparison below uses a hypothetical 5%-level one-sided test to illustrate the power gap between one-sided and two-sided rejection regions — the actual KCC gate (threshold 0) has a larger size (α = 0.5) but the same directional optimality property. Under the assumption of approximately Gaussian innovations at filter convergence (applicable when outlier rejection has removed T_noise spikes and the residual is dominated by i.i.d. measurement jitter), the Neyman-Pearson Lemma guarantees maximum power for the chosen size. For bounded non-Gaussian T_noise (NIC coalescing bursts, ACK compression), the gate remains a robust one-sided test but loses formal UMP optimality — the UMP property holds to the extent that the Gaussian approximation is valid.
**4. Censored vs trimmed regression.** The directional update is Tobit-type censored regression (Tobin 1958) — observations are STRUCTURALLY partitioned by sign. A standard KF with outlier rejection is trimmed regression — observations are discarded based on magnitude relative to a dispersion parameter. Censoring has a closed-form bias correction (Heckman two-step); trimming does not. Under persistent queue (μ_q > 0 on most samples), the censored estimator remains unbiased for T_prop (any gate-passing sample has q_k = 0 by construction); the trimmed estimator is asymptotically biased (the trimming threshold MUST exceed μ_q to pass ANY sample, but then the gate passes queue-contaminated samples).
**5. Steady-state bias comparison.** Let p_clean = 0.3, μ_q = 2 ms, K_ss = 0.39:
- Symmetric KF with ±5σ outlier gate: admits all |ν| < 5σ (σ ≈ 1ms). Among p_clean = 0.3 clean samples, 96% pass (Chebyshev). Among (1−p_clean) = 0.7 queued samples with μ_q = 2ms, ν = μ_q + η ∼ N(2, 1). P(|ν| < 5 | μ = 2) = Φ(3) − Φ(−7) ≈ 0.999. So virtually ALL queued samples pass. Effective per-round bias: K_ss × [(1−p_clean) × μ_q] = 0.39 × 0.7 × 2 = 0.546 ms/round upward — estimate drifts up by 54.6 ms in 100 rounds.
- Directional KF: only ν < 0 samples accepted. For queued samples: P(ν < 0 | μ = 2) ≈ Φ(−2) ≈ 0.023 → only 2.3% of queued samples pass. For clean samples: P(ν < 0 | μ = 0) = 0.5 → 50% pass. Effective per-round bias: on clean passing samples, E[ν | ν<0, μ=0] = −σ·√(2/π) ≈ −0.8 (downward). On queued passing samples, E[ν | ν<0, μ=2] ≈ 2 − 2.373 ≈ −0.373 (still slightly downward — the truncation shifts the mean below zero). **Net bias = p_clean × 0.5 × (−0.8) + (1−p_clean) × 0.023 × (−0.373) = −0.12 − 0.006 ≈ −0.126 ms/round downward — estimate drifts conservatively DOWN (safe), not up.**
**Conclusion:** The directional update is provably superior to a standard Kalman filter with symmetric outlier rejection **for the asymmetric congestion-control loss function** where over-estimation cost (c_over → overshoot → loss) dominates under-estimation cost (c_under → conservative pacing → slight throughput reduction). The directional gate implements the UMP one-sided test (Neyman-Pearson optimal under Gaussian approximation), matches the asymmetric cost function of congestion control, and maintains downward-conservative bias through structural censoring rather than magnitude-based trimming. A symmetric KF with outlier rejection would systematically inflate the T_prop estimate by K_ss × (1−p_clean) × μ_q per round under persistent queue — producing biased, unsafe estimates.
---
### Proof C.2: Switching Kalman Filter and Neyman-Pearson Drift Detection
**Claim:** The directional Kalman update with drift correction constitutes a two-mode Switching Kalman Filter that is optimal under the Neyman-Pearson sequential testing framework.
**1. Two-Mode Switching Structure**
- **Mode 0 (Censored/Stationary):** T_prop is constant. Positive innovations are censored (skipped). This is the Tobit-type censored Kalman filter from Proof C.1.
- **Mode 1 (Boosted/Tracking):** T_prop has changed. Process noise Q is boosted and the censoring constraint is relaxed via drift correction (Tier 1: dampened corr/4, Tier 2: forced corr/8).
**2. Neyman-Pearson Sequential Test for Mode Switching**
The switching decision is a sequential hypothesis test:
- H_0: T_prop is stationary (Mode 0 correct)
- H_1: T_prop has increased (Mode 1 needed)
Test statistic: N consecutive positive innovations (`pos_skip_cnt`). Under H_0, each innovation has P(ν_k > 0) ≤ 1/2 (symmetric noise). The probability of N consecutive positives under H_0:
$$
P(pos_skip_cnt ≥ N | H_0) ≤ (1/2)^N
$$
| Tier | Threshold N | Type I Error α | Action |
|------|-------------|----------------|--------|
| Tier 1 | drift_thresh = 14 | (1/2)^14 = 6.10×10⁻⁵ | Dampened correction (corr/4), quiet paths only |
| Tier 2 | drift_thresh × kcc_drift_tier2_mult = 56 (at defaults) | (1/2)^56 = 1.39×10⁻¹⁷ | Forced correction (corr/8), unconditional |
The two-tier structure implements a **Sequential Probability Ratio Test** (SPRT, Wald 1947) with two decision boundaries. This is optimal in the Wald sense: among all sequential tests with the same error probabilities, the SPRT minimizes the expected sample size (Wald & Wolfowitz, 1948).
**3. Optimality**
In Mode 0, the censored Kalman filter is conditionally minimum-variance on accepted (ν_k < 0) samples (Proof C.1) — i.e., optimal conditional on the event that the sample passes the directional gate, not unconditionally across all samples. In Mode 1, the boosted-Q filter tracks genuine baseline drift.
**4. References**
- [Wald 1947] Wald, A. "Sequential Analysis." Wiley, 1947.
- [Wald 1948] Wald, A. & Wolfowitz, J. "Optimum character of the sequential probability ratio test." Ann. Math. Stat., 19(3), 326-339, 1948.
- [Neyman 1933] Neyman, J. & Pearson, E.S. "On the problem of the most efficient tests of statistical hypotheses." Phil. Trans. R. Soc. A, 231, 289-337, 1933.
---
### Proof C.3: Truncated Kalman Filter — Formal Optimality Theorem
The directional update is formally the **truncated Kalman filter**. This section proves its optimality under three physically-grounded assumptions that define the T_prop estimation problem.
**1. Standard vs Truncated Kalman Formulations**
**STANDARD KALMAN (Kalman 1960):**
$$
Predict: x̂_{k|k-1} = A·x̂_{k-1|k-1}
P_{k|k-1} = A·P_{k-1|k-1}·A^T + Q
$$
$$
Update: K_k = P_{k|k-1}·H^T·(H·P_{k|k-1}·H^T + R)^{-1}
x̂_{k|k} = x̂_{k|k-1} + K_k·(z_k − H·x̂_{k|k-1})
$$
**TRUNCATED KALMAN (KCC directional update):**
$$
x̂_{k|k} = x̂_{k|k-1} + K_k · min(0, z_k − H·x̂_{k|k-1})
$$
Equivalently, using the directional gate φ(ν) = 𝟙(ν ≤ 0):
$$
x̂_{k|k} = x̂_{k|k-1} + K_k · ν_k · 𝟙(ν_k ≤ 0)
$$
The `min(0,·)` form makes explicit that ONLY negative innovations (RTT decreases) drive state updates; all positive innovations are clamped to zero contribution.
**2. Optimality Theorem**
**THEOREM (Truncated Kalman Optimality).** Consider the state-space model with scalar state x_k = T_prop (piecewise-constant propagation delay) and scalar observation z_k = RTT_obs. Under the following three physically-necessary assumptions:
- **(A1) PHYSICAL CONSTRAINT:** T_prop cannot increase due to congestion. Propagation delay is determined by physical path length and medium refractive index; neither changes with buffer occupancy. Therefore any observed RTT increase above the current T_prop estimate MUST originate from T_queue or T_noise, never from T_prop.
- **(A2) INFORMATION NULLITY OF POSITIVE RESIDUALS:** Positive innovations ν_k > 0 contain ZERO Fisher information about T_prop. Formally: $$I_{T_prop}(ν_k | ν_k > 0) = 0$$ because the event $${ν_k > 0}$$ informs only about T_queue > 0 (congestion presence), not about the value of T_prop.
- **(A3) BOUNDED MEASUREMENT NOISE:** The noise component η_k satisfies |η_k| ≤ η_max < ∞ almost surely (all physical delay sources have bounded magnitude).
Then the truncated Kalman estimator $$x̂_{k|k} = x̂_{k|k-1} + K_k · min(0, z_k − H·x̂_{k|k-1})$$ is the **minimum-variance estimator** of T_prop among all estimators satisfying (A1)-(A3).
**3. Proof Sketch**
**Part I — Innovation Decomposition.** Under the three-component model: $$z_k = T_{\mathrm{prop}} + q_k/C + \eta_k$$. The innovation is $$\nu_k = (T_{\mathrm{prop}} - \hat{x}_{k|k-1}) + q_k/C + \eta_k$$. By (A1), any positive component $$q_k/C$$ is T_queue, not T_prop drift. By (A2), this carries zero information about T_prop. By (A3), η_k is bounded. Therefore the optimal estimator MUST discard the $$q_k/C$$ component before updating T_prop.
**Part II — Fisher Information.** For $$\nu_k > 0$$, the Fisher information $$I_k(T_{\mathrm{prop}} \mid \nu_k > 0) = 0$$ for magnitude (only the binary event carries information, and only about sign). For $$\nu_k < 0$$, the observation IS informative with information proportional to $$|\nu_k|^2/\sigma^2$$. The optimal estimator discards positive innovations and processes negative innovations with the standard Kalman gain.
**Part III — Minimum-Variance Property.** Any estimator $$\hat{x} = \hat{x}^- + K \cdot g(\nu)$$ with measurable g has $$\mathrm{Var}(\hat{x}) = K^2 \cdot \mathrm{Var}(g(\nu))$$. Any $$g(\nu) \neq 0$$ for $$\nu > 0$$ adds variance from $$q_k/C$$ with $$\Delta \mathrm{Var} \geq 0$$, equality iff $$g(\nu) = 0 \ \forall \nu > 0$$. For $$\nu < 0$$, the BLUE gain gives $$g(\nu) = \nu$$. Therefore $$g^*(\nu) = \min(0, \nu) = \nu \cdot \mathbb{1}(\nu \leq 0)$$ is the unique variance minimizer.
**4. Relationship to Censored Regression**
The truncated Kalman is a special case of Tobit-type censored regression (Tobin 1958) where the censoring threshold is
$$
\hat{x}_{k\mid k-1}
$$
Observations
$$
z_k \geq \hat{x}_{k\mid k-1}
$$
are censored from ABOVE. The Tobit likelihood
$$
L(x \mid z) = \prod \phi((z-x)/\sigma) \cdot \prod \Phi((x-z)/\sigma)
$$
yields the truncated update as the score-equation solution.
**Bias acknowledgement.** Truncating a normal distribution introduces a conditional mean shift: for clean samples (μ = 0), the expected innovation conditioned on ν < 0 is E[ν | ν < 0] = −σ·√(2/π) ≠ 0 — the Mills ratio term. The KCC implementation does **not** apply a Heckman two-step bias correction; it applies forced convergence (`x_est = z`, effectively K_eff=1) for clean negative innovations that pass the directional gate. This means the directional update is a **biased** (conservatively downward) estimator of T_prop — it is NOT the MMSE estimator. The bias is downward (safe for CC: biased-low T_prop → conservative BDP → no overshoot), and its magnitude (~0.13 ms/round at default parameters) is acceptable for CC purposes where the dominant error is upward T_queue contamination, not downward truncation bias. See Proposition 1 and the directional update analysis for the quantitative bias comparison between symmetric KF and directional KF.
**References:** Tobin (1958), Amemiya (1984), Kalman (1960), Heckman (1979).
---
### Proof C.4: Equivalence of Directional Update and Standard Kalman Under Physical Prior Constraint
**CLAIM:** When the physical prior constraint ΔT_prop ≤ 0 (T_prop cannot increase except through path changes) is imposed on the standard Kalman filter, the resulting constrained estimator **degenerates to the truncated Kalman filter**. The directional update is therefore not a "hack" that violates Kalman optimality — it IS standard Kalman optimality under a physically necessary state constraint.
**1. State-Constrained Kalman Filter**
The standard Kalman solves the unconstrained optimization:
$$
x̂_{k|k} = argmin_x ‖x − x̂_{k|k-1}‖²_{P⁻¹} + ‖z_k − x‖²_{R⁻¹}
$$
Now impose the PHYSICAL CONSTRAINT: "T_prop cannot increase when RTT increases due to queue." The effective observation is censored:
$$
z_k^eff = min(z_k, x̂_{k|k-1}) (clamp observation at prior)
$$
**2. KKT Resolution**
**Case A' (ν_k ≥ 0, RTT rising):** z_k^eff = x̂⁻. J(x) = (x − x̂⁻)²·(1/P⁻+1/R). Minimum at x* = x̂⁻. **No update.**
**Case B' (ν_k < 0, RTT falling):** z_k^eff = z_k. Standard Kalman optimum: x*= x̂⁻ + K·ν_k. Constraint x ≤ x̂⁻ is satisfied (K·ν_k < 0 ⇒ x* < x̂⁻).
**Combined:** x̂_{k|k} = x̂⁻ + K·ν_k·𝟙(ν_k ≤ 0) = x̂⁻ + K·min(0, ν_k). This IS the truncated Kalman filter.
**3. Why x ≤ z_k is Insufficient**
The weaker constraint x ≤ z_k (from Proof C.1) allows x to increase when z_k > x̂⁻ — physically incorrect for T_prop estimation. The correct physical constraint is:
- When RTT drops (ν_k < 0): x ≤ z_k (tighter bound)
- When RTT rises (ν_k > 0): x ≤ x̂⁻ (bound unchanged)
This encodes the PHYSICAL PRIOR: T_prop cannot increase from queue-inflated observations.
**4. Conclusion**
The directional (truncated) Kalman update is NOT an ad-hoc modification. It IS the unique solution to the Kalman optimization problem under the physically necessary state constraint "T_prop does not increase when RTT increases due to queue." This constraint is a PHYSICAL LAW of the medium — electromagnetic propagation delay is determined by distance and refractive index, neither of which changes with buffer occupancy.
The claim that KCC "abandons Kalman optimality" confuses the UNCONSTRAINED Kalman filter (optimal under zero-mean Gaussian noise, which T_queue is NOT) with the CONSTRAINED Kalman filter (optimal under the known physics of the medium).
**References:** Simon (2010), Gupta & Hauser (2007), Boyd & Vandenberghe (2004) §5.5.
---
### Theorem Λ — Directional Gate Precision Gain
**Statement.** Under i.i.d. symmetric measurement noise η_k ~ N(0, σ²_η) and non-negative queue q_k ≥ 0, the directional gate i_k = 𝟙(ν_k ≤ 0) reduces the effective innovation variance on accepted (clean) samples by a factor of 1 − 2/π ≈ 0.363, yielding a precision gain:
λ₃ = σ²_η / Var(η_k | η_k ≤ 0) = π/(π − 2) ≈ 2.752
(without queue, i.e. lower bound)
λ₃ ≥ π/(π − 2) at all times, strictly increasing with queue presence
(σ²_q > 0 → truncation point < 0 → variance lower)
**Proof.** For η_k ~ N(0, σ²_η):
E[η_k | η_k ≤ 0] = −σ_η·√(2/π) (Mills ratio)
E[η_k² | η_k ≤ 0] = σ²_η (symmetry of truncated normal)
Var(η_k | η_k ≤ 0) = σ²_η·(1 − 2/π) ≈ 0.363·σ²_η
λ₃ = Var_full / Var_gated = σ²_η / (σ²_η·(1 − 2/π)) = π/(π − 2).
When q_k > 0, the truncation shifts leftward: {η_k ≤ −q_k/C < 0}, which further reduces conditional variance. Therefore λ₃ ≥ π/(π − 2) at all times, with λ₃ >> 1 under deep congestion.
**Physical interpretation:** The directional gate is not a censoring mechanism (which would lose information). It is a signal purifier that strips queue contamination from RTT samples before they enter the Kalman filter. Each accepted sample carries 2.75× the precision of a random (ungated) sample, and under congestion this gain amplifies to 100× or more because all queue-contaminated samples are discarded.
**Empirical extension.** The normal-theoretic λ₃ = π/(π−2) ≈ 2.75 is a conservative lower bound for symmetric-noise paths. For fully distribution-free operation, λ₃ can be computed directly from the empirical variance ratio λ₃ = σ²(ν_k) / σ²(ν_k | ν_k ≤ 0), where both variances are estimated from the running innovation history. This empirical λ₃ automatically adapts to any noise distribution (Laplace, t, mixture) and any queue regime, providing a strictly tighter bound than the theoretical 2.75 whenever the directional gate is effective.
---
**Proof D (Structural Isolation of T_noise from Decisions).**
**Claim:** T_noise does not affect rate or cwnd decisions.
**Proof:** T_noise enters the system through two paths.
**Path 1:** RTT observation contains η_k (T_noise). The outlier gate rejects $$|ν_k| > max(max(min\_rtt\_us >> 2\, (25\%\ RTT),\ kcc\_outlier\_min\_floor\_us\ (50µs)),\ jitter\_ewma × 2) × scale$$, scaled into Kalman units via `<< kcc_kalman_scale_shift_val`. On clean paths (jitter ≤ 2ms) the RTT-proportional threshold dominates (e.g., 5ms gate for 20ms RTT); on low-RTT noisy paths (e.g., WiFi 6E with 200µs RTT) the jitter×mult component dominates (effective mult ≈2, Chebyshev ≤25%). Residual T_noise that passes the gate enters the Kalman update with attenuation K_ss ≈ 0.39 (derived from actual defaults: p_ss is the PREDICTED (pre-update) steady-state covariance, K_ss = p_ss/(p_ss+R). Q_nominal=100, R=400 → p_ss=256 → K_ss = 256/(256+400) = 0.39; with adaptive Q=2500 (requires raising q_max above its 2000 default), R=400 → p_ss≈2851 → K_ss = 2851/3251 = 0.88; with matched estimator Q=50000, R=32000 → p_ss≈72170 → K_ss = 72170/(72170+32000) = 0.69). A 1 ms noise spike contributes at most 390 µs to x_est — negligible relative to T_prop (10–200 ms).
**Path 2:** T_noise elevates jitter_ewma, which increases Kalman R (measurement noise). Higher R reduces K (the Kalman gain), making the filter less responsive — a conservative response that preserves stability at the cost of slightly slower convergence (bounded by Theorem S.2).
**CONCLUSION:** T_noise enters decisions only through an attenuated, stability-preserving feedback that makes the filter MORE conservative, never more aggressive. T_noise does not directly trigger KCC rate-reduction mechanisms (ECN backoff, gain decay). The indirect effect of T_noise — slower convergence via higher adaptive R — is a bounded throughput cost, not a deliberate rate cut. Noise does NOT mean the bottleneck capacity dropped. KCC structurally isolates T_noise from direct rate decisions.
All code in `tcp_kcc.c` is organized around this decomposition. Every function, struct field, and `#define` constant is annotated with `[T_prop]`, `[T_queue]`, `[T_noise]`, or `[K]` (Kalman filter machinery) to identify which component it processes.
---
## Part II: Closed-Loop Stability — ISS Framework
KCC is not a heuristic. It is a stability-oriented feedback control system whose convergence is provable under explicitly stated assumptions. The theorems below establish bounded-time convergence, bounded-input bounded-output (BIBO) stability, and input-to-state stability (ISS) — with each assumption documented and its operational implications noted.
---
### §2.0 Foundations — Observer ISS and DRAIN Monotonicity (No Circular Premises)
The stability proofs are built on a three-layer decomposition with NO circular premises. Convergence is a CONCLUSION, not an assumption.
```
Observer (Kalman) → Controller (PROBE_BW) → Plant (Queue)
Lems O.1-O.3 Lems Q.1-Q.3 Thm C.1 (convergence)
Thm S.1-S.3 (full closed loop)
```
| Assumption | Statement | Justification |
|---|---|---|
| **A1. Bounded Measurement Noise** | \|η_k\| ≤ η_max, filtered by the outlier gate (Chebyshev: ≤4% false-positive on clean paths). | Bus contention, interrupt coalescing. Kernel measurements: σ ∈ [10 µs, 1 ms]. |
| **A2. Finite Buffer** | Queue buffer is finite (switch hardware limit). Overrun → loss → congestion signal. | Physical constraint; all CC proofs assume finite buffers. |
| **A3. DRAIN Under-Pacing** | g_drain = 88/256 ≈ 0.344 (kcc_drain_gain in BBR_UNIT; the integer ratio kcc_drain_gain_num/kcc_drain_gain_den = 347/1000 ≈ 0.347 before quantization). Deficit rate = (1−g_drain)C = 0.656 C. At 10 Gbps: deficit ≈ 547 kseg/s. | Engineered parameter; identical to kernel BBR's bbr_drain_gain. |
| **A4. Dwell-Time** | Each PROBE_BW phase lasts at least kcc_drain_target_max_rtts = 4 RTTs (safety timeout). | Liberzon (2003) "Switching in Systems and Control" Theorem 3.1: τ_d > 0 ensures dwell-time switching stability. 4 RTTs ≫ τ_d_min. |
| **A5. Endogenous Convergence** | The Kalman filter declares convergence when K = p_pred/(p_pred+R) ≤ kcc_kalman_converged_k_ppm / 10⁶ (default K_thresh = 250,000 ppm, K = 0.25). At the threshold, p_est ≈ 33 raw → K ≈ 0.25, between K_floor≈0.216 and K_ss≈0.39. | Self-referential: convergence is detected from the filter's own state (p_pred, R). No external p_clean or M/D/1 model needed. |
---
### Lemma O.1 (Observer ISS) — Bounded Noise ⇒ Bounded Estimation Error
**Claim.** Under A1, the censored Kalman observer is **Input-to-State Stable** (ISS, Jiang & Wang 2001) with respect to measurement noise — the estimation error |d_k| = |x̂_k − T_prop| is uniformly bounded at all times, **before, during, and after convergence**.
**Proof.** When the gate accepts (ν_k = T_prop + η_k − x̂_k ≤ 0):
```
d_{k+1} = (1−K_k) d_k + K_k η_k
```
This is a discrete-time ISS system. The state |d_k| satisfies:
```
|d_{k+1}| ≤ (1−K_k) |d_k| + K_k |η_k|
```
For K_k ∈ (0, 1] (guaranteed: p_pred ≥ floor > 0, R ≥ 0):
```
|d_k| ≤ max(|d_0|, ‖η‖_∞) ∀k ≥ 0
```
When the gate rejects (ν_k > 0, including all T_queue-contaminated samples), |d_{k+1}| = |d_k| — no worse. The ISS gain from η_k to d_k is at most 1. ∎
**Key implication.** The observer never "diverges" — even during STARTUP, DRAIN, or prolonged queue epochs where no clean sample arrives. The bounded-error guarantee is the foundation for the full ISS cascade (Theorem S.1).
---
### Lemma O.2 (Directional Gate) — One-Sided Structural Stability
**Claim.** The gate ν_k ≤ 0 ensures: (a) x̂_k NEVER increases when T_queue > 0 (upward contamination is structurally blocked); (b) On gate-accepted samples, x̂_k moves DOWN toward T_prop by at most K_k · |ν_k| per round.
**Proof.** (a) ν_k > 0 ⇒ gate rejects ⇒ x̂_{k+1} = x̂_k — invariant. (b) ν_k ≤ 0 ⇒ x̂_{k+1} = x̂_k + K_k ν_k ≤ x̂_k (K_k ≥ 0, ν_k ≤ 0). The estimate is monotonically non-increasing over accepted samples. The directional gate trades unbiasedness (Mills-ratio conditional mean shift: E[ν | ν<0] = −σ√(2/π) < 0) for structural protection against queue contamination. In congestion control, the conservative downward bias is strictly safe: underestimated T_prop ⇒ smaller BDP ⇒ lower cwnd ⇒ no overshoot. ∎
---
### Lemma O.3 (Endogenous Convergence Detection) — p_est Threshold Derived from K_th
**Claim.** The operational convergence status is defined endogenously:
```
converged ≡ K_k = p_pred / (p_pred + R) ≤ kcc_kalman_converged_k_ppm / 10⁶
```
For K_th ≪ 1, this is equivalent to p_pred ≤ K_th · R (the exact formula
p_pred = K_th·R/(1−K_th) reduces to K_th·R when K_th ≪ 1). In raw (unscaled)
units with default ppm=250,000 (K_th=0.25), R_raw=400, Q_raw=100:
```
p_pred_raw = K_th · R_raw / (1 − K_th) = 0.25 · 400 / 0.75 ≈ 133.3
p_est_raw = p_pred_raw − Q_raw = 133.3 − 100 ≈ 33.3
```
At p_est ≈ 33 raw, the Kalman gain is K = (33+100)/(33+100+400) = 133/533 ≈ 0.25,
matching K_th = 0.25 exactly (the residual from the approximation p_pred ≈ K_th·R
is absorbed by the Q subtraction at this moderate K_th). This places convergence
between K_floor ≈ 0.216 and K_ss ≈ 0.39 — the filter exits its learning phase
before reaching steady-state, activating all confidence-gated mechanisms.
At the OLD threshold K_th = 10⁻⁶ (1 ppm): p_pred_raw = 10⁻⁶·400 = 0.0004,
p_est_raw = 0.0004 − 100 = −99.9996 < 0 — unreachable. The convergence
criterion requires K_th above the minimum achievable gain (Q/(Q+R) ≈ 0.2 at
nominal Q=100,R=400), which the 250,000 ppm default satisfies with margin. ∎
**Relationship to Mehra (1970).** The standard innovation whiteness test checks that the innovation sequence ν_k has zero autocorrelation — a filter is converged when residuals are pure white noise. In steady-state, K_k constant implies innovations are white; conversely, white innovations imply K_k stable. KCC's K_threshold test is an O(1) operational proxy for the O(N) autocorrelation test. Both are ENDOGENOUS criteria: they depend only on the filter's internal state, not on any external queue model. ∎
**Contrast with prior approach:** The original convergence threshold was a hard-coded p_est ≤ 500 with no derivation from filter internals. Lemma O.3 replaces this with the equivalent Kalman gain criterion, making the threshold's relationship to the filter's noise trust ratio explicit and mathematically grounded.
---
### Lemma Q.1 (DRAIN Monotonicity) — Queue Strictly Decreases During DRAIN
**Claim.** During the DRAIN phase (pacing_gain = g_drain < 1), the queue depth q(t) obeys dq/dt ≤ (g_drain − 1) C < 0. The queue **strictly monotonically decreases** regardless of initial depth, path RTT, or cross-traffic.
**Proof.** Sender pacing rate during DRAIN: r = g_drain · C_est. Net arrival at bottleneck:
```
dq/dt = r − C = g_drain · C_est − C
```
If C_est ≥ C (overestimate): dq/dt = g_drain·C − C = (g_drain − 1)C.
If C_est < C (underestimate): dq/dt = g_drain·C_est − C ≤ (g_drain−1)C.
In both cases, dq/dt ≤ (g_drain−1)C < 0 since g_drain < 1 and C > 0.
With g_drain = 0.344 (88/256), the drain rate is 0.656 C. ∎
**At 10 Gbps, MSS = 1500 B (C ≈ 833 kseg/s):**
- 0.656 C ≈ 547 kseg/s drain rate
- BDP at 100 ms RTT ≈ 83 kseg
- Drain time for full BDP queue: 83,000 / 547,000 ≈ 0.15 s
- 4-RTT safety timeout = 0.4 s → **>2.6× margin** (0.4 s / 0.15 s ≈ 2.67) over worst-case drain time
---
### Lemma Q.2 (Finite-Time Clean Sample) — Queue Reaches Zero Every Cycle
**Claim.** DRAIN monotonicity (Q.1) + bounded queue (A2) ⇒ q → 0 in finite time every PROBE_BW cycle ⇒ at least one clean sample (T_queue = 0) arrives every cycle.
**Proof.** Let q_0 ≤ q_max be the queue depth at DRAIN start. Integrating Q.1:
```
q(t) ≤ max(0, q_0 − (1−g_drain)C · t)
```
With g_drain = 0.344, q(t) = 0 at t = q_0 / (0.656·C). For the queue contributed by KCC's own PROBE phase (q_0 ≤ C·T_prop/2, a conservative 2× overestimate of the actual 0.25·BDP probe excess), t_drain ≤ T_prop / (2·0.656) ≈ 0.76·T_prop. The 4-RTT safety timeout provides ≥5× margin over the KCC-contributed queue. For the worst-case total queue (q_0 = BDP, cross-traffic + KCC probe), Lemma Q.1 guarantees ≥2.6× margin. Both satisfy the Liberzon dwell-time condition τ_d > 0. ∎
**Drain-skip qualification.** The engineering implementation includes drain-skip (see §Drain-Skip): when the Kalman is converged AND qdelay_avg < clean_thresh (≤10% BDP) AND at least 1/8 RTT has elapsed, the phase may transition from DRAIN to CRUISE before the queue reaches zero. When drain-skip fires, the residual queue is bounded by clean_thresh (a function of min_rtt_us, typically ≤10% BDP). This residual does not accumulate across cycles: the next PROBE phase adds to it, but the subsequent DRAIN (or drain-skip with stricter qdelay_avg threshold) clears it. The ISS cascade bound (Theorem 5) covers drain-skip; the Liberzon dwell-time argument applies to the worst-case (drain-enabled) path. Readers should interpret Lemma Q.2's "q → 0 every cycle" as applying to the full-DRAIN path; under drain-skip the residual queue is bounded by clean_thresh.
Therefore, within every 8-phase PROBE_BW cycle, at least one phase (DRAIN) guarantees q → 0, producing at least one clean sample. ∎
**Corollary Q.2.1 (Clean Sample Frequency).** Clean samples arrive with deterministic periodicity bounded by the cycle length L = 8 phases. This is a PROOF of the condition previously labeled "A1 (p_clean > 0)" — it is not an assumption about external traffic, it is a consequence of the controller design. No M/D/1 queue model or traffic utilization estimate is required.
---
### Lemma Q.3 (Cross-Traffic Non-Interference) — Co-existing Flows Do Not Block DRAIN
**Claim.** Co-existing cross-traffic may add to q_during DRAIN, but KCC's own queue contribution q_kcc obeys Lemma Q.1 independently: dq_kcc/dt ≤ (g_drain−1)C < 0. KCC's past packets see monotonically decreasing queue from KCC's past history. The directional gate already rejects cross-traffic-induced positive innovations regardless of source.
**Proof.** q_total = q_kcc + q_xt. q_xt is independent of KCC. Lemma Q.1 applies to q_kcc alone. The directional gate (O.2) operates on observed ν_k, not on a causal decomposition of T_queue — queue-induced innovations are rejected as positive, whether from KCC or cross-traffic. The structure is robust to cross-traffic. ∎
---
### Theorem C.1 (Conditional Convergence) — Convergence Is a Consequence, Not an Assumption
**Claim.** Lemmas O.1 (ISS), Q.1 (DRAIN), Q.2 (clean sample) ⇒ the Kalman estimate x̂_k converges to T_prop within the Mills-ratio conservative bias in at most O(K_ss⁻¹ · L) RTTs, where L = 8 is the PROBE_BW cycle length and K_ss is the steady-state Kalman gain.
**Proof.** By Q.2, each cycle provides ≥1 clean sample. On a clean sample (Case A), the directional update applies the full Kalman gain:
```
E[|d_{k+1}| | clean] ≤ (1−K_k) · E[|d_k|] + K_k · σ
```
After N cycles with K_k → K_ss = p_pred_ss / (p_pred_ss + R):
```
E[|d_NL|] ≤ (1−K_ss)^N · |d_0| + σ
```
The residual σ is the Mills-ratio bias E[|ν| | ν < 0] ≈ 0.798 σ for
Gaussian noise — a conservative downward offset that is safe for CC
(underestimated T_prop ⇒ smaller BDP ⇒ no overshoot).
For K_ss = 0.39, convergence to 1% of |d_0| occurs at:
N_1% = ln(0.01) / ln(0.61) ≈ 9.3 cycles ≈ 74 RTTs (clean-sample rounds only).
With adaptive gain ceiling K_max = 0.88: N_1% = ln(0.01)/ln(0.12) ≈ 2.2 cycles (≈ 18 RTTs).
**This is the direct replacement of the original Theorem 1 + Theorem 2 dependency chain.** The original chain treated convergence as a PREMISE (Assumption A2: "the Kalman filter has converged"). Theorem C.1 PROVES convergence from the DRAIN controller design (Q.1-Q.3) and the ISS observer (O.1), eliminating the circularity. ∎
---
### Theorem S.2 — Contraction (Rebuilt on ISS Foundation)
**Claim.** After convergence (Theorem C.1), the estimation error contracts geometrically on clean samples: E[|d_T|] ≤ (1−K_ss)^T |d_0| + σ.
**Proof.** Identical to the original three-case structure but grounded in Theorem C.1 rather than an assumption:
| Case | Condition | Round Result | ISS Guarantee |
|------|-----------|-------------|---------------|
| A | q=0 (clean) | \|d_{k+1}\| ≤ (1−K)\|d_k\| + Kσ | Lemma O.1 |
| B | q>0 (queue) | \|d_{k+1}\| = \|d_k\|, q↓ | Lemma Q.1 ⇒ q→0 (finite time) |
| C | d<0 (conservative) | \|d_{k+1}\| ≤ \|d_k\| + Kσ | Drift correction (GUAS, bounded-window decrease) |
Case B is temporary: Q.2 guarantees drain to Case A. Case C is self-limiting: P(acceptance) decreases as |d| grows. The overall contraction is governed by the geometric series with coefficient (1−K_ss).
At K_ss = 0.39: E[|d_T|] ≤ 0.61^T |d_0| + σ. At T = 38 clean rounds: 0.61^38 ≈ 7.0×10⁻⁹ ≤ 10⁻⁸ → residual ≤ 10⁻⁸|d_0| + σ ≈ σ. At K_max = 0.88: 0.12^T |d_0| + σ, reaching σ-level residual (|d_T| ≈ σ = 1 µs from |d_0| = 25 ms) in ≈ 5 clean rounds (0.12^5·25000 ≈ 0.62 < 1).
**Wall-clock convergence.** Since at least 1/L = 1/8 of rounds are clean (Q.2.1), convergence to σ-level takes ≤ 8 × T_clean RTTs. At default K_ss = 0.39: ≤ 304 RTTs. At adaptive maximum K_ss = 0.88: ≤ 40 RTTs. ∎
---
### Theorem 3 — Small-Gain Theorem (Global Asymptotic Stability)
**The feedback loop is:** $$cwnd → queue → RTT → x_est → BDP → cwnd$$.
**Methodological note.** The SISO DC gain product γ₁·γ₂·γ₃·γ₄ (multiplication of static transfer-function gains) is generally invalid for proving stability of nonlinear switched systems — it requires linearity, time-invariance, and no switching, none of which hold for KCC. The DC gain analysis below is therefore presented ONLY as intuition-building for the worst-case de-coupling argument (the directional gate structurally breaks the loop, making the product zero regardless of nonlinearity). The RIGOROUS stability proof is provided by the ISS-Lyapunov cascade in Theorem 5 (§5.7), which uses Lyapunov-based gains (dissipation inequalities), not DC gains, and is valid for the fully nonlinear switched system.
**DC gain decomposition for intuition (four cascade stages):**
$$
γ = γ_cwnd→q * γ_q→RTT * γ_RTT→x * γ_x→cwnd
$$
**γ_cwnd→q (cwnd impacts queue, bytes per segment):**
At cruise 1.0x: DC gain = 0 — cwnd = BDP exactly matches pipe capacity, zero net queue change.
At probe 1.25x: γ_cwnd→q = 0.25 (excess inflow per round via Lindley: Δq = cwnd*MSS - C*T_prop). Bounded by 0.25 over one 8-phase cycle.
**γ_q→RTT (queue impacts RTT, seconds per byte):**
G_queue = q_k / C. DC gain = 1/C. Queue-to-RTT transfer function: ΔRTT = Δq / C.
**γ_RTT→x (RTT impacts x_est, dimensionless):**
Directional gate. For positive innovations (queue-induced RTT increase): γ_RTT→x = 0 (REJECTED — structural break). For negative innovations: γ_RTT→x = K_ss (Kalman steady-state gain, 0.39-0.88).
**γ_x→cwnd (x_est impacts cwnd, segments per unit time):**
model_rtt → BDP → cwnd. γ_x→cwnd = C / MSS. Scaling: cwnd = C * model_rtt / MSS.
**Combined loop gain at probe (1.25x — DC intuition):**
$$
γ = 0.25 * (1/C) * 0 * (C/MSS) = 0
$$
The directional update (γ_RTT→x = 0 for positive queue innovations) **STRUCTURALLY BREAKS** the positive feedback path. Queue-induced RTT increases CANNOT propagate to x_est and inflate future cwnd. This is the single most important structural property distinguishing KCC from symmetric estimators (including BBR's windowed minimum).
**Note:** The DC gain product analysis above is qualitative intuition for the directional gate's decoupling effect. The rigorous nonlinear stability guarantee is provided by Theorem 5 (§5.7), which computes ISS-Lyapunov gains from dissipation inequalities and verifies the small-gain condition γ_cascade = γ₂∘γ₁ < 1 using Ky Fan (K∞) function composition, not DC gain multiplication. At the ISS-Lyapunov level, the condition reduces to K²/C² < 1, which is satisfied for all K < C (K_ss < 1, C ≥ 1 segment/RTT). The DC product γ = 0 demonstrates the structural decoupling that makes the ISS-Lyapunov condition easy to satisfy — the directional gate eliminates the dominant cross-coupling path, leaving only the attenuated noise path with ISS gain K_ss/MSS ≪ 1.
**Loop gain for noise path:**
$$
γ_noise = 1 (base) * (1/C) * K_ss * (C/MSS) = K_ss / MSS
$$
With MSS = 1500 bytes, K_ss = 0.39 → γ_noise ≈ 2.6×10^-4 — effectively open-loop for noise.
**Result:** The combined feedback loop has gain γ < 1 at all operating points and gain γ = 0 for the troublesome queue→x_est→cwnd positive-feedback path. The system satisfies the small-gain theorem (Jiang & Mareels 1997) for global asymptotic stability.
### Theorem 4 — Bounded-Input Bounded-Output (BIBO) Stability
For any bounded T_noise |η_k| ≤ η_max and physically-bounded T_queue (buffer limit), cwnd and queue occupancy are uniformly bounded.
$$
q_{bytes} \leq BDP \cdot \max(pacing\_gain - 1, 0) + C \cdot K_{ss} \cdot \eta_{max} / MSS
$$
Or in BDP-fraction form:
$$
q_{bytes} / BDP \leq \max(pacing\_gain - 1, 0) + K_{ss} \cdot \eta_{max} / T_{prop}
$$
In general form with variables:
$$
q_{bytes}/BDP \leq \max(g_{max} - 1, 0) + K_{ss} \cdot \eta_{max} / T_{prop}
$$
where g_max is the maximum pacing gain, K_ss = p_ss/(p_ss+R) is the Kalman steady-state gain, η_max is the outlier threshold, and T_prop is the propagation delay. The first term is the deterministic probe overshoot; the second is the stochastic Kalman noise contribution. Since K_ss < 1 and η_max/T_prop ≪ 1 for WAN paths, the noise contribution is a vanishing fraction of BDP.
The Kalman innovation gate rejects |η| > threshold outliers. Residual noise enters x_est with attenuation K_ss. The cwnd impact from noise is Δcwnd ≤ (C / MSS) · K_ss · η_max. In BDP-fraction form: Δcwnd/BDP_seg = K_ss · η_max / T_prop. The overall queue is a low-pass filtered response to gain modulation with bounded Kalman noise attenuation.
### Theorem 5 — Complete Closed-Loop Stability (ISS Cascade with Switched-Regime Controller)
This theorem provides the **full closed-loop control theory proof** that KCC, as a system composed of a nonlinear Kalman observer, a switched-regime PROBE_BW rate controller, and a network plant with bounded disturbances, is **globally asymptotically stable (GAS)**.
**Formal Statement.** _Theorem 5 (Global Asymptotic Stability of KCC Closed Loop)._
Consider the interconnection of: (P) network plant with Lindley queue dynamics
$$
q_{k+1} = \max(0, q_k + w_k \cdot \mathrm{MSS} - C \cdot T_{\mathrm{prop}})
$$
and exogenous disturbance input
$$
d_k = (q_{\mathrm{cross},k}/C, \eta_k)
$$
(O) Kalman observer S_1 with directional gate; (C) PROBE_BW switched controller S_2.
Define
$$
x = (q, e, \mathrm{cwnd}) \in \Omega \subset \mathbb{R}^3
$$
The closed-loop system is: (a) ISS with respect to bounded cross-traffic and T_noise; (b) GAS at the unique equilibrium
$$
(q^{\ast}=0, e^{\ast}=0, \mathrm{cwnd}^{\ast}=\mathrm{BDP}_{\mathrm{seg}})
$$
when exogenous inputs vanish. The proof proceeds via ISS small-gain cascade analysis (Sontag & Wang 1995; Jiang & Mareels 1997) with dwell-time GUAS for the switched PROBE_BW controller (Liberzon 2003).
**Proposition 1 (ISS-Lyapunov Cascade).** If S_1 is ISS with Lyapunov $$V_1(x_1)$$ satisfying $$V_1(f_1(x_1, u)) - V_1(x_1) \leq -\alpha_1(|x_1|) + \sigma_1(|u|)$$, and S_2 is ISS with Lyapunov $$V_2(x_2)$$ satisfying $$V_2(f_2(x_2, x_1)) - V_2(x_2) \leq -\alpha_2(|x_2|) + \sigma_2(|x_1|)$$, and the small-gain condition $$\gamma_2 \circ \gamma_1(s) < s$$ holds for all $$s>0$$, then the cascade $$x = (x_2, x_1)$$ is ISS with Lyapunov $$V(x) = V_2(x_2) + \lambda \cdot V_1(x_1)$$ for appropriate $$\lambda>0$$. (Sontag & Wang 1995, Thm 2.1; Jiang & Mareels 1997, Thm 3.1)
The proof follows a 10-section structure derived from the code header (tcp_kcc.c, Theorem 5).
---
#### 5.1 System Decomposition
The KCC system is a closed-loop interconnection of three components:
```
+----------------------------------------------------+
| KCC ALGORITHM |
| +----------+ x_est +-----------------------+ |
| | Kalman |--------->| BBR-PROBE_BW | |
| | Observer | | Controller | |
| | (S_1) | | (S_2) | |
| +----------+ | pacing_gain in | |
| ^ | {1.25,0.75,1.0^6} |----> cwnd, rate
| | | ECN backoff | |
| | | drain-skip | |
| | +-----------------------+ |
| | |
+-------+--------------------------------------------+
|
| z_k = RTT observation
|
+-------+--------------------------------------------+
| | NETWORK PLANT (P) |
| +----+------------------------------------------+ |
| | q_{k+1} = max(0, q_k + cwnd*MSS - C*T_prop) | |
| | z_k = T_prop + q_k/C + η_k | |
| +-----------------------------------------------+ |
+----------------------------------------------------+
```
**Notation:**
- `x_k` = Kalman estimate of T_prop; `T_k` = true T_prop
- $$e_k = T_k - x_k$$ = estimation error
- `q_k` = queue length (bytes); $$η_k$$ = T_noise (bounded: |η_k| ≤ η_max)
- `C` = bottleneck capacity (bytes/s); `MSS` = Maximum Segment Size
- `K_ss` = Kalman steady-state gain ∈ (0,1)
- `g_k` = PROBE_BW pacing gain ∈ {1.25, 0.75, 1.0^6}
---
#### 5.2 Network Plant: ISS-Lyapunov Function
The network plant obeys the **Lindley recursion**:
$$q_{k+1} = \max(0, q_k + w_k \cdot MSS - C \cdot T_k)$$
This is the standard fluid queue model (Kelly et al. 1998; Srikant 2004, Sec 3.2).
**ISS-Lyapunov function:** $$V_P(q_k) = q_k² / (2·MSS·C)$$
For q_k > 0: Δq = w_k·MSS - C·T_k. At cruise (g=1.0): Δq ≈ 0, ΔV_P ≤ 0. During probe (g=1.25): Δq > 0, V_P increases temporarily. During drain (g=0.75): Δq < 0, V_P recovers. Over a full 8-phase cycle: net ΔV_P ≤ -κ_cycle·V_P with κ_cycle ≈ 0.0625·C/q_peak > 0.
**Plant ISS property:** ∃ β_P ∈ KL, γ_P_u, γ_P_η ∈ K∞ such that |q_k| ≤ β_P(|q_0|, k) + γ_P_u(‖u‖_∞) + γ_P_η(‖η‖_∞). (Srikant 2004, Theorem 3.1)
---
#### 5.3 Kalman Observer: ISS Property
The scalar Kalman filter (with directional gate):
$$
Update step (gate open — downward RTT or small innovation):
x_{k+1} = x_k + K_k · (z_k − x_k)
$$
$$
Hold step (gate closed — upward RTT rejected):
x_{k+1} = x_k
$$
**ISS-Lyapunov function:** $$V_O(e_k) = e_k²$$ where $$e_k = T_k − x_k$$
For update steps ($$T_{k+1} \approx T_k$$, no routing change):
$$
z_k = T_k + q_k/C + η_k
e_{k+1} = T_k − [x_k + K_k·(T_k + q_k/C + η_k − x_k)]
= (1 − K_k)·e_k − K_k·(q_k/C + η_k)
$$
$$
ΔV_O = e_{k+1}² − e_k²
= −(2K_k−K_k²)·e_k² + K_k²·(q_k/C+η_k)² − 2K_k(1−K_k)·e_k·(q_k/C+η_k)
$$
Using Young's inequality $$2|ab| ≤ a²/ε + ε·b²$$ on the cross term with $$ε = (2K−K²)/(2K(1−K)) = (2−K)/(2(1−K))$$:
$$
ΔV_O ≤ −(2K−K²)·(1−1/(2ε))·e_k² + K²·(1+ε/2)·(q_k/C+η_k)²
= −α_O·V_O(e_k) + σ_O·‖(q_k/C, η_k)‖²
$$
where $$α_O = (2K−K²)·(1−1/(2ε))$$ and $$σ_O = K²·(1+ε/2)$$. Condition ε > 1 (required for α_O > 0) holds iff K > 0 — always satisfied. This is the defining ISS-Lyapunov inequality (Sontag 1989; Sontag & Wang 1995).
**Explicit numerical computation:**
- At K_ss = 0.39 (Q=100, R=400): ε = 0.6279/0.4758 = 1.32. α_O = 0.6279·0.621 = 0.390. σ_O = 0.1521·1.66 = 0.252.
- At K_ss = 0.88 (adaptive Q=2500, R=400): per Riccati p_ss = (2500+√(2500²+4·2500·400))/2 = 2851, K_ss = 2851/(2851+400) = 0.877. (The previously-stated value 0.93 was a numerical error; see the Riccati derivation in tcp_kcc.c §Riccati Steady State for the standard calculation.)
- Note: α_O simplifies exactly to K_ss. Proof: α_O = (2K−K²)·(1 − (1−K)/(2−K)) = (2K−K²)/(2−K) = K. The observer Lyapunov decay rate IS the Kalman gain.
As $$k → ∞$$: $$K_k → K_ss = p_ss/(p_ss+R)$$ where $$p_ss = (Q+√(Q²+4QR))/2$$ (PREDICTED steady-state covariance). For Q=100,R=400: K_ss ≈ 0.39. With adaptive Q=2500: K_ss ≈ 0.88. Worst-case: K_ss < 1 always.
**For hold steps** (gate closed): $$e_{k+1} = e_k$$ → ΔV_O = 0 ≤ RHS. The directional update FREEZES during congestion — a conservative ISS strategy.
**For routing changes** (ΔR jump): $$e_{k+N} ≤ (1−K)^N·ΔR$$ (exponential convergence). ISS holds: ‖e‖_∞ ≤ max(ΔR_max, γ_O·‖(q/C, η)‖_∞).
**Conclusion (S_1):** Kalman observer is ISS with gain γ_O ≈ K_ss from (q/C, η) to e.
---
#### 5.4 PROBE_BW Controller: ISS + Dwell-Time GAS
The controller computes: $$cwnd_k = g_k·C·min(x_k, min_rtt_k)/MSS ≈ g_k·BDP_seg$$ (when $$x_k ≈ T_{prop}$$).
**Ideal controller** (e=0): $$cwnd*_k = g_k·C·T_k/MSS$$
**Actual controller** (e>0): $$cwnd_k ≤ cwnd*_k − g_k·C·e/MSS$$
The **controller ISS property** with respect to estimation error: $$cwnd_k = cwnd*_k + δ_k$$ where $$|δ_k| ≤ 1.25·C·|e_k|/MSS$$. ISS-gain: γ_C = 1.25·C/MSS.
**Controller Lyapunov function** (Theorem C.1): $$V_C(q_k, cwnd_k) = (q_k/C)²/2 + β·(cwnd_k − BDP_seg)²/2$$
Over the 8-phase dwell-time cycle, the PROBE_BW controller is a switching system with gains [1.25, 0.75, 1.0⁶].
**Formal derivation of net cycle contraction ρ < 1:**
Phase-by-phase V_C analysis (BDP-normalized):
- **Phase 0 (PROBE, g=1.25):** Excess rate = 0.25·C. Queue grows by Δq = 0.25·BDP over 1 RTT. cwnd deviation = 0.25·BDP. V_C increases: $$ΔV_probe = (0.25·T_{prop})²/2 + β·(0.25·BDP)²/2$$.
- **Phase 1 (DRAIN, g=0.75):** Deficit rate = 0.25·C. Queue drains by 0.25·BDP. Queue returns to q₀. cwnd deviation = −0.25·BDP. The probe and drain queue contributions cancel exactly (same magnitude, opposite sign applied to the quadratic). **Net probe+drain V_C change from queue: 0 (energy conservation).** cwnd deviation terms are symmetric: both |δ| = 0.25·BDP.
- **Phases 2-7 (CRUISE, g=1.0, 6