fix: correct throttle legacy resolution; add EXDEV temp-dir coverage

src/shared/file_send.c

@@ -185,7 +185,7 @@ bool file_send_sendfile_with_skip(File* file, int file_descriptor, bool use_meta
       return false;
     }
     protocol_note_bytes_written((unsigned long long)sent);
-    protocol_throttle_bytes((size_t)sent);
+    protocol_throttle_bytes(file_descriptor, (size_t)sent);
   }
 
   close(fd);

src/shared/protocol.c

@@ -302,11 +302,14 @@ static ProtocolSession* legacy_session(int read_fd, int write_fd) {
 }
 
 /* Pace an out-of-band write that bypassed protocol_send_n_data (the plaintext
- * sendfile fast path).  The bound/legacy session is resolved exactly as
- * send_n_data resolves it, so the same token-bucket state is throttled and the
- * TLS and plaintext transports share identical --bwlimit semantics. */
-void protocol_throttle_bytes(size_t bytes) {
-  bw_throttle_session(legacy_session(-1, -1), bytes);
+ * sendfile fast path).  The bound/legacy session is resolved exactly as the
+ * preceding send_n_data(fd, ...) resolved it, so the same token-bucket state is
+ * throttled and the TLS and plaintext transports share identical --bwlimit
+ * semantics.  Passing the wire fd (rather than -1) is essential: the sendfile
+ * send left legacy_io_session.write_fd bound to it, so resolving with -1 would
+ * mismatch, re-initialize the session and hand out a second first-call burst. */
+void protocol_throttle_bytes(int file_descriptor, size_t bytes) {
+  bw_throttle_session(legacy_session(-1, file_descriptor), bytes);
 }
 
 bool send_n_data(int file_descriptor, const void* data, size_t data_size) {

src/shared/protocol.h

@@ -225,11 +225,14 @@ unsigned long long protocol_bytes_written(void);
 unsigned long long protocol_bytes_read(void);
 void protocol_note_bytes_written(unsigned long long bytes);
 /* Apply --bwlimit pacing to bytes written outside protocol_send_n_data (the
- * plaintext zero-copy sendfile fast path).  Resolves the bound/legacy session
- * exactly as send_n_data does and runs the same token-bucket throttle, so the
- * sendfile transport is paced identically to the buffered/TLS paths.  A no-op
- * when the effective session has no bandwidth limit. */
-void protocol_throttle_bytes(size_t bytes);
+ * plaintext zero-copy sendfile fast path).  `file_descriptor` is the wire fd
+ * the bytes were written to, so the legacy session is resolved exactly as the
+ * preceding send_n_data call resolved it (the bound TLS session still wins when
+ * set); resolving with the same fd avoids re-initializing the legacy session
+ * and granting a second first-call burst.  Runs the same token-bucket throttle,
+ * so the sendfile transport is paced identically to the buffered/TLS paths.  A
+ * no-op when the effective session has no bandwidth limit. */
+void protocol_throttle_bytes(int file_descriptor, size_t bytes);
 
 void protocol_session_init(ProtocolSession* session, int read_fd, int write_fd);
 /* Transitional bridge for helpers whose signatures still carry only an fd. */