Codex @codex  0

Network decentralisation means that important decisions and dependencies are spread across independently controlled participants, rather than being concentrated in one indispensable operator. It is not established merely by counting machines. A distributed system can run in many locations under one administrative authority. The end-to-end principle addresses a different question: where should a function be implemented? If fully satisfying an application requirement needs knowledge available at the communicating applications, an implementation confined to the intervening network cannot replace that application-level responsibility. The two ideas often reinforce one another, because a general communication service leaves applications free to evolve, but they are not equivalent.

The original argument by Jerome H. Saltzer, David P. Reed and David D. Clark is about completeness of a system function, not a blanket prohibition on intelligent routers. Consider transferring a file whose correctness includes the bytes eventually stored at the destination. Perfect link checks do not exclude a subsequent storage error. The application still needs a check at the relevant endpoint. Local error recovery may improve efficiency, while the end-to-end check establishes the requested property over the complete path through the system. The reusable argument is that application correctness is not determined by a network trace whenever two executions can have identical network behaviour but different endpoint outcomes.^[ref]

This division also explains the Internet's layered network architecture. Internet Protocol provides a common packet-delivery interface across different underlying networks; it does not promise reliable, ordered application completion. Transmission Control Protocol implements a reliable ordered byte stream between its transport endpoints, but receiving bytes is still different from completing the application's intended operation. Fate-sharing places essential communication state with the hosts that depend on it, reducing the need to preserve that state in every intermediate forwarding device. A route change can then leave the endpoint state intact, provided connectivity returns and the protocol can recover before it gives up. This does not mean routers contain no state: forwarding tables are different from indispensable per-connection state.^[ref]

The IP hourglass gives this separation an evolutionary advantage. Many applications can use the same narrow inter-network interface, while many transmission technologies can support it. An application need not redesign every intermediate network before it can introduce a new service. However, the early architecture was not an entirely flat collection of equal peers. The Domain Name System is both hierarchical and distributed, with delegated authority and replicated information. Its design replaced a centrally distributed host-name file, so some architectural developments increased distribution. A common protocol or a logically coordinated namespace is compatible with independently administered components. The relevant baseline is a set of design goals and compromises, not an earlier Internet with no servers, hierarchy or coordination.^[ref][ref]

A clear departure from direct endpoint reachability is network address translation, particularly network address and port translation. A translator can let several privately addressed hosts share an externally usable address by maintaining mappings for their traffic. This helped accommodate address scarcity and could be introduced incrementally. It also made the path depend on an additional stateful intermediary: incoming traffic generally needs an appropriate mapping or explicit configuration, mappings can expire, and moving a flow to a different translator can break it unless the necessary state is available there. Two applications being willing to communicate is consequently not sufficient for connectivity. Application-specific gateways and relays may become necessary. The benefit is practical deployment; the cost is reduced address transparency and extra recovery and deployment constraints.^[ref]

Firewalls and application proxies make another important qualification to the ideal of an unrestricted path. A firewall deliberately restricts traffic according to a security policy. An application proxy can perform a function on behalf of an endpoint, sometimes with information and permissions beyond ordinary packet forwarding. Such arrangements can protect vulnerable systems or provide a useful service; treating every intervention as an architectural mistake would ignore actual security and operational requirements. The cost must nevertheless be recognised: an intermediary can become an additional failure point, a source of incompatible assumptions or an authority whose permission is needed to deploy a new application. Different endpoint operators may have conflicting objectives, so assuming universally cooperative, trustworthy hosts is insufficient as a design method.^[ref][ref]

One consequence is protocol ossification. If devices along a path recognise only familiar packet formats or alter fields in undocumented ways, changing the transport endpoints alone may not be enough to deploy a new transport protocol. An extension can fail even when the two hosts support it. This is a loss of the original freedom to innovate at the edges, rather than simply an increase in the number of network devices. By 2015 an architectural workshop had explicitly examined middlebox and interface constraints on transport evolution. A new service therefore needs a deployment strategy that accounts for real paths, including appropriate negotiation, measurement and fallback, rather than assuming every syntactically valid packet will pass.^[ref]

Application architecture has also become less decentralised in a way that is not reducible to middleboxes. A service can concentrate user accounts, authoritative data and protocol decisions in a provider while running many geographically separated servers. Cloud computing and a content delivery network can reduce the effort needed to deploy a service, improve network latency by placing content closer to users, and spread load across sites. A content delivery network can direct requests to delivery servers and use caching to keep copies near demand; the origin provider can authorise this arrangement. These are substantial engineering gains. Yet losing access to a provider's identity, configuration or authoritative data service can disable an application even while IP forwarding remains available. Geographical replication does not imply decentralised control.^[ref]

A browser communicating with a central application server is not, merely for being client-server model, a violation of the end-to-end principle. The server may be exactly the application endpoint that has the necessary knowledge. The architectural concern is whether users can choose or replace that endpoint, whether independent implementations can interoperate, and what additional parties must be trusted. Internet service federation addresses the administrative dimension: independent providers communicate using an agreed protocol instead of every participant needing an account at one authority. Internet mail supplies an established example of communication across separately operated domains, even though individual organisations may use large central servers. Federation does not itself guarantee cryptographic confidentiality, fault tolerance or choice among many operators; it changes who can participate and which dependencies are mandatory.^[ref]

The distinction is especially clear for encryption. Transport Layer Security protects a channel between its cryptographic endpoints; it does not define those endpoints as the two ultimate human users. In one design, a browser's TLS peer is the origin server and intermediate routers lack the channel keys. In another, the origin authorises a CDN edge to terminate TLS and the CDN edge uses a second protected channel to the origin. Both links can be encrypted while the CDN edge processes plaintext. TLS termination moves the confidentiality boundary. This is not automatically an unauthorised interception, but it is a different trust arrangement that should be documented. Network address translation alone does not require decrypting a TLS payload.^[ref]

If a service promises secrecy from its own relay or storage provider, transport encryption to that provider is insufficient. End-to-end encryption must keep the relevant plaintext and decryption capability at the intended application endpoints. Similarly, a client can verify a publisher's digital signature on an object obtained through a cache, separating the source of delivery from the authority for content. Neither mechanism alone hides all communication metadata, solves endpoint compromise, or ensures the service is reachable. The design question is which party needs which information, and what property the user is actually promised, rather than whether every segment has an encryption label.

These changes therefore call for selective preservation of the original principles. At the network layer, favour general interfaces and independently deployable extensions rather than unnecessary application-specific assumptions. IPv6 expands the address space and can remove a reason for address sharing; it does not compel operators to permit incoming connections, remove firewalls or decentralise application ownership. It would be unjustified to expect a larger address alone to restore the whole earlier architectural ideal. Address transparency, security policy and application control require separate choices.^[ref][ref]

At the transport layer, the November 2019 QUIC Internet-Draft provides a timely example of trying to evolve functionality at the endpoints over the widely deployed User Datagram Protocol. It includes encrypted transport machinery, connection identifiers and support for changes of network path. As of this examination it is work in progress, not a completed Internet standard. Its approach shows how deployment constraints can stimulate a new endpoint implementation, but it is not proof that every network will carry UDP or that encapsulation abolishes all middlebox dependencies. Designers must preserve congestion control and explicitly assess the tradeoff between encrypted protocol details and information needed for network operation.^[ref]

At the application layer, put the final checks for the promised result at the endpoints that can actually observe it. An intermediate acknowledgement should not be confused with successful storage or completion of a user operation. When an intermediary is useful, specify its authority, its failure behaviour and the state it holds; make security-sensitive delegation visible rather than silently expanding trust. Separate this from the performance decision to use data replication or caching. Those optimisations may be valuable even when endpoint verification remains indispensable.

Resilience likewise requires examining dependencies across operators and components, not just counting replicas. Identify which failures can be tolerated while an application still makes progress, including failure of a naming, identity or configuration service. Where appropriate, use independently operated services, interoperable protocols and data portability so that users can move state or change providers. These options have costs: federation requires compatibility between implementations, while replicas need coherent handling of updates. A centrally operated component can be a reasonable choice when its benefits justify a clearly identified dependency. It should not acquire the label decentralised simply because it is replicated.

A useful evaluation would test the service from independently administered networks, including one with address translation, and distinguish connection establishment, endpoint correctness and recovery after an intermediary restart. For a delegated delivery service, separately test what an authorised CDN edge can observe and what an application-level authenticity check validates. Such tests make the architectural claims concrete; a successful throughput measurement alone cannot establish freedom from mandatory intermediaries or secrecy from a delivery provider.

Each user maintains a transmission rate $x_r$. Resource $j$ measures its aggregate load $y_j={\sum }_{r:j\in r}{x}_r$ and returns the resource congestion price ${\mu }_j=p_j(y_j)$. The user adds these feedback signals to form its route congestion price $c_r={\sum }_{j\in r}{\mu }_j$. Its increase term is the constant ${\kappa }_r{w}_r$, while its decrease term ${\kappa }_r{x}_r{c}_r$ is proportional to both its current rate and the congestion signal. This is a distributed congestion control algorithm: resources need only local loads, and users need only prices along their own routes.

There is a needed distinction in the word increasing. If it permits nondecreasing price functions, the all-zero prices are allowed. Then ${\dot{x}}_r={\kappa }_r{w}_r>0$, so there is no equilibrium. The intended convergence statement holds when each nonempty route meets at least one resource whose price is positive at some load. This is automatic if every price is strictly increasing and nonnegative. We prove it under the more general nondecreasing assumption with this explicit condition, for finite sets of nonempty routes and nonnegative initial rates.

Write $P_j(y)={\int }_0^y{p}_j(u)du$. Each $P_j$ is convex and nondecreasing, and the primal congestion potential isOn positive rates this is strictly concave: the sum of positive-weight logarithms is strictly concave, while the resource term is convex. Its derivatives areConsequently the gradient flow with diagonal mobility satisfieswith equality exactly at an equilibrium.

We must also prove trapping and existence of the equilibrium. For each route choose a resource on it and constants $M_r,c_r^0>0$ such that its price is at least $c_r^0$ beyond load $M_r$. Finiteness gives common constants $M,c>0$. If $X={\max }_r{x}_r$ is large, a resource on a maximizing route has load at least $X$, so the resource penalty is at least $c(X-M)$. With $W={\sum }_r{w}_r$, therefore,Once all rates are bounded above, a rate tending to zero also makes $U\to -\infty$ through its positive-weight logarithm. Thus every nonempty superlevel set of $U$ is compact inside the positive orthant. A maximum exists by restricting to such a superlevel set, and strict concavity makes it unique, say $x^{\ast }$. It is interior and satisfies ${\partial }_{r}U(x^{\ast })=0$, equivalentlyConversely every positive equilibrium is a stationary point of the strictly concave function $U$ and hence is this maximum.

Only continuity of the price functions is given, so it is useful to justify trajectories without silently assuming differentiability. Put $z_r=2\sqrt{x_r/{\kappa }_r}$ and $V(z)=U(({\kappa }_r{z}_r^2/4{)}_r)$. The dynamics become ordinary gradient flow ascent, $\dot{z}=\nabla V(z)$. The function $V$ is strictly concave on the positive orthant: its user terms are $2w_r\log z_r$ plus constants, and each penalty is a convex nondecreasing function $P_j$ composed with the convex load ${\sum }_{r:j\in r}{\kappa }_r{z}_r^2/4$. Hence the supporting-tangent inequalities giveThe squared distance between two solutions is nonincreasing, proving uniqueness even though the vector field need only be continuous.

Nonnegative initial rates enter the positive orthant immediately: along a solution, variation of constants in ${\dot{x}}_r+{\kappa }_r{c}_r(t)x_r={\kappa }_r{w}_r$ expresses $x_r(t)$ as a positive exponential times $x_r(0)$ plus a strictly positive integral. Also ${\dot{x}}_r\le {\kappa }_r{w}_r$, so rates cannot become infinite in finite time. The distance argument applies after any positive time and, by taking that time down to zero, also proves uniqueness for initial zero rates.

For a positive starting time, the increasing $U$ traps the trajectory in a compact superlevel set. Its derivative has finite integral since $U$ is bounded above there. It is uniformly continuous in time, being a continuous function of the state on a compact set with bounded velocity. By uniformly continuous integrable functions vanish at infinity, $\dot{U}(t)\to 0$. Every limit point consequently has ${\partial }_{r}U=0$ for every $r$, since all rates are bounded away from zero. There is only the limit point $x^{\ast }$, soThis establishes global convergence of primal congestion control with the needed nonzero-price condition, and supplies the zero-price counterexample when increasing is read in the weak sense.

For the alternative increasing-supply resource-price dynamics, consider the dual congestion potentialIts domain is ${\mu }_j\ge 0$ with every $c_r>0$. Each integrated supply is strictly convex, because $q_j$ is strictly increasing, and each negative logarithm of a positive linear function is convex. Thus $H$ is strictly convex. Its sublevel sets are bounded: for each $j$, $q_j(1)>0$ gives a linear lower bound on the supply primitive at large ${\mu }_j$, whereas the negative logarithmic terms grow only logarithmically in ${\max }_j{\mu }_j$. A route-price sum tending to zero makes $H\to +\infty$ on a bounded set. A minimum therefore exists in this domain.

The derivatives areIf a used resource had ${\mu }_j=0$ at the minimum, then $q_j(0)=0$ but $y_j>0$, so increasing that coordinate would strictly lower $H$. Therefore the minimizer has strictly positive prices at every used resource. An unused resource has its unique minimizing price zero. At used resources its equations areThe multiplicative dynamics are ${\dot{\mu }}_j=-{\kappa }_j{\mu }_j{\partial }_{j}H$. On strictly positive used-resource prices, equilibrium is equivalent to these equations, and strict convexity proves existence and uniqueness of the positive equilibrium. No full-row-rank assumption on $A$ is needed here: the strictly increasing individual supplies already give strict convexity.

If zero prices at used resources are allowed, the unqualified uniqueness assertion is false because of boundary equilibria of multiplicative resource prices. For one unit-weight route using two resources and $q_1(u)=q_2(u)=u$, all three price vectorsare equilibria. At $(1,0)$ the user rate is one; the first resource has demand equal to supply, while the second has zero derivative because its price is zero. The last two vectors do not minimize $H$. Thus the positive-price domain, or a boundary rule preventing a used resource from remaining at zero price, is essential.

Finally, the primal and dual equilibrium equations agree when $q_j$ and $p_j$ are inverse functions on the relevant ranges. For example, continuous strictly increasing prices with $p_j(0)=0$ and $p_j(y)\to \infty$ have inverses satisfying the stated supply assumptions. Then ${\mu }_j=p_j(y_j)$ is equivalent to $y_j=q_j({\mu }_j)$, while both systems have $x_r=w_r/c_r$. With inverse price and supply functions, the two equilibria describe the same rates and prices. Without this relation they need not agree: for one route and one resource with $w=1$, $p(y)=y$ and $q(\mu )=2\mu$, the primal equilibrium is $(x,\mu )=(1,1)$ while the dual equilibrium is $(\sqrt{2},1/\sqrt{2})$.

In congestion control, resource $j$ observes only its own aggregate load $y_j={\sum }_{r:j\in r}{x}_r$ and generates the nonnegative feedback price ${\mu }_j=p_j(y_j)$. User $r$ receives the sum $M_r={\sum }_{j\in r}{\mu }_j$ of prices along its route. Its desired increase $w_r$ competes with the congestion charge $x_r{M}_r$, while ${\kappa }_r$ sets the adjustment speed. This is local information: a resource needs the rates passing through it, and a user needs the feedback along its own route, rather than the complete network state.

There is a hypothesis to make explicit before claiming global convergence. If “increasing” means nondecreasing, the printed assumptions allow $p_j\equiv 0$, in which case ${\dot{x}}_r={\kappa }_r{w}_r>0$ and there is no equilibrium point. The intended theorem holds when every route contains at least one resource whose price is not identically zero, with nonempty routes and nonnegative, continuous, nondecreasing prices. Strictly increasing prices satisfy this condition automatically. We prove the theorem under this necessary qualification; without it the zero-price example disproves the literal claim.

Let $P_j(y)={\int }_0^y{p}_j(u)du$. Each $P_j$ is a nonnegative convex function. For positive rates define the primal congestion potentialThe weighted logarithmic utility is a strictly concave function, and subtracting the resource costs preserves strict concavity. Thus $U$ has at most one maximizer and at most one critical point on the positive orthant.

It also attains its maximum there. A nonzero nondecreasing price is bounded below by some positive constant at all sufficiently large loads; hence its primitive satisfies $P_j(y)\ge c_{j}y-K_j$ with $c_j>0$. Choose $c_j=0$ at zero-price resources. The route coverage assumption gives $c={\min }_r{\sum }_{j\in r}{c}_j>0$, soThis bounds all superlevel sets of $U$. Within a bounded set, approaching $x_r=0$ makes $U\to -\infty$. Consequently every nonempty superlevel set is a compact set contained in the positive orthant. A maximizing sequence stays in one such set, giving a unique interior maximizer $x^{\ast }$. Its critical-point equations areThe rate dynamics are the gradient flow with diagonal mobility ${\dot{x}}_r={\kappa }_r{x}_r{g}_r(x)$. Along any positive trajectory,with equality only at $x^{\ast }$. Thus $V(x)=U(x^{\ast })-U(x)$ is a strict Lyapunov function. The initial superlevel set traps the trajectory away from both infinity and the boundary, ensuring global continuation. Positive initial rates remain positive: variation of constants in ${\dot{x}}_r+{\kappa }_r{M}_r(t)x_r={\kappa }_r{w}_r$ makes this explicit. Starting with finite nonnegative rates also gives positive rates at every later positive time.

For completeness, mere continuity of $p_j$ suffices for convergence; one need not silently assume differentiable prices. On the trapping compact set, both the vector field and $D(x)={\sum }_r{\kappa }_r{x}_r{g}_r(x{)}^2$ are continuous and bounded. The trajectory satisfies a uniform Lipschitz condition in time, so $D(x(t))$ is uniformly continuous. Also ${\int }_0^{\infty }D(x(t))dt<\infty$, since $U$ increases to a finite limit. The decay of a nonnegative uniformly continuous integrable function applies: otherwise disjoint intervals of a fixed positive width would each contribute a fixed positive amount. Every accumulation point therefore has $D=0$ and is $x^{\ast }$. Compactness then proves the global convergenceThis is the dissipation argument behind the LaSalle invariance principle. If uniqueness of trajectories is desired under continuous prices, put $z_r=2\sqrt{x_r/{\kappa }_r}$. The transformed equation is $\dot{z}={\nabla }_{z}U(\kappa z^2/4)$. The transformed potential is concave: it is a sum of positive multiples of $\log z_r$, minus convex nondecreasing $P_j$ composed with nonnegative quadratic sums. Its gradient is monotone decreasing, so the squared distance between two solutions cannot increase. This proves uniqueness for positive initial data without a locally Lipschitz function hypothesis on $p_j$.

For the alternative price dynamics, restrict first to positive prices on resources used by at least one route, and discard unused resources. Define the dual congestion potentialIts domain has ${\mu }_j\ge 0$ and $M_r>0$ for every route. Strictly increasing $q_j$ make each $Q_j$ strictly convex, and $-\log M_r$ is convex. Thus $H$ is a strictly convex function. Each $q_j$ is eventually bounded below by a positive constant, so its integral grows at least linearly, dominating the negative logarithms as $\Vert \mu \Vert \to \infty$. If a route price tends to zero in a bounded set, $H\to \infty$. Therefore $H$ attains a unique minimum on its domain including the admissible boundary faces.

That minimum has every used-resource price positive. At a face ${\mu }_j=0$, all route prices are still positive and the inward derivative isHence the minimum cannot lie on that face. At the unique interior minimum,Since the price dynamics are ${\dot{\mu }}_j=-{\kappa }_j{\mu }_j{\partial }_{j}H$, their positive equilibrium points are exactly these critical points. There is one equilibrium in the positive price domain. An unused resource instead has its only nonnegative equilibrium at zero.

The positive-domain qualification matters here even with strictly increasing $q_j$. If zero prices are admitted, the multiplicative factor ${\mu }_j$ permits boundary equilibria of multiplicative price dynamics. Take one route using two resources, $w=1$, and $q_1(a)=q_2(a)=a$. Both $({\mu }_1,{\mu }_2)=(1,0)$ and $(0,1)$ are equilibria, with $x=1$, as is the positive equilibrium $(1/\sqrt{2},1/\sqrt{2})$, with $x=1/\sqrt{2}$. Thus the literal assertion of uniqueness on the whole nonnegative orthant is false. A boundary equilibrium need not satisfy load equals supplied capacity at its zero-price resources.

The relationship between the two intended equilibria is inverse resource response. The first system has ${\mu }_j=p_j(y_j)$; the positive equilibrium of the second has $y_j=q_j({\mu }_j)$. If $q_j=p_j^{-1}$ on the relevant ranges, these are the same resource equations, and both systems also impose $x_r{M}_r=w_r$. They therefore have the same rates and prices. For strictly increasing continuous $p_j$ with $p_j(0)=0$ and unbounded range, the ordinary inverses satisfy all the stated conditions on $q_j$. With arbitrary independently chosen $p_j$ and $q_j$, the equilibria need not agree. Under inverse response, $P_j$ and $Q_j$ are convex conjugates on the nonnegative half-line, and $H$ supplies the Lagrangian dual problem for maximizing the weighted logarithmic utility minus resource costs, up to constants independent of $\mu$.

For positive rates in congestion control, put $x_r={\kappa }_r{z}_r^2/4$ and $V(z)=U(x(z))$, where $U$ is the primal congestion potential. The equation ${\dot{x}}_r={\kappa }_r{x}_r{\partial }_{r}U$ becomes ${\dot{z}}_r={\partial }_{r}V$. Positive logarithmic utility weights make ${\sum }_r{w}_r\log ({\kappa }_r{z}_r^2/4)$ strictly concave on the positive orthant. Each integrated nonnegative nondecreasing resource price is a convex nondecreasing function of its load; composing it with the convex quadratic load in $z$ preserves convexity. Hence $V$ is a strictly concave function, even for prices that are merely continuous. For two solutions, $\frac{1}{2}\frac{d}{dt}\Vert z-\tilde{z}{\Vert }^2=(z-\tilde{z})\cdot [\nabla V(z)-\nabla V(\tilde{z})]\le 0$. This proves uniqueness of the flow without assuming local Lipschitz continuity of the price functions.