# LAN peers with no Internet

> **Short version:** two bodies on the same LAN can cooperate without curso.rs only when they have an explicit local discovery or rendezvous path. The current browser-only cockpit does not silently scan the LAN and must not pretend BroadcastChannel is a LAN transport.

## Three different “local” scopes

| scope | evidence | current web cockpit |
|---|---|---|
| same page/body | in-memory object identity | working |
| same browser origin/device | LocalStorage and BroadcastChannel | working across compatible tabs |
| private/link-local network | observed private endpoint, local rendezvous, or operator-owned native bridge | displayed when reported; not implemented by the page alone |

Browser sandboxing prevents ordinary pages from opening arbitrary TCP, µTP, UDP DHT, mDNS, or raw LAN sockets. WebRTC data channels can cross a LAN, but peers still need signaling: a previously shared offer/answer, a local rendezvous service, or a reachable remote signal carrier. “No Internet” removes the remote signaling option unless the session was already negotiated.

## Expected LAN-only startup

1. A saved or locally served signed Cursors release starts on each body.
2. Each body loads its encrypted Self locally.
3. One explicit mechanism introduces the bodies: QR/manual offer, local rendezvous, mDNS/native discovery, or a known private endpoint.
4. Both sides verify public identities and invitation material. Endpoint proximity is not identity.
5. A meeting curve is derived for the invited participants.
6. Encrypted mailbox envelopes and cursor records move through the selected LAN fabric.
7. Each body records transport receipts separately from application/execution receipts.

The web cockpit currently demonstrates steps 2, 4, and 5 locally and can visualize telemetry supplied by a native bridge. It does not yet ship the native discovery/listener in steps 1 and 3.

## Partitions and reconnection

LAN-only work must assume partitions:

- leased dataspace assertions expire when their publisher cannot renew;
- immutable cursor history remains available wherever it was durably stored;
- mailbox envelope IDs deduplicate replay;
- external effects need receipts and an explicit uncertain state;
- reconnecting bodies exchange signed horizons before resuming.

There is no magical global tuple space. A LAN dataspace is one authority- and membership-scoped projection that can later bridge selected assertions to another space.

## Operator checklist

- Confirm the UI says **LAN-LOCAL** because of observed endpoint evidence, not a guess.
- Pin the peer identity or invitation fingerprint out of band.
- Keep the meeting curve separate from the default device-local curve.
- Do not expose the native bridge on a public interface by accident.
- Export at least one encrypted recovery artifact before testing a partition.
- Expect stale peers and expired leases after sleep or power loss.

Continue with [Peer Locality](peer-locality.md), [Fallback Fabric](fallback-fabric.md), [Dataspaces](dataspace.md), and [Signed Swarms](signed-swarms.md).