Adaptive loss-feedback loop + reactive ARQ #3

Merged

vxfemboy merged 14 commits from data-plane-feedback-arq into main

2026-07-01 01:03:27 +00:00

vxfemboy commented

2026-07-01 00:59:19 +00:00

(Migrated from github.com)

Closes the data-plane control loop and activates the throughput win the throughput pass (PR #2) set up. Spec + plan committed; executed as 8 reviewed tasks (subagent-driven).

What landed

Feedback channel: an authenticated receiver→sender Control packet (PacketType::Control=3, sealed via the session AEAD) carrying {delivered_count, high_counter, missing[]}. New yip-transport modules: feedback (LossReport), lossdetect (gap-based LossDetector), retxbuf (RetxBuffer).
Class-aware controller: ARQ-eligible (Bulk) flows decay their repair ratio to zero on a clean link (firing the dormant FEC-encode bypass + halving datagrams); Realtime/Default keep a proactive floor. Loss snaps the ratio back up instantly.
Reactive ARQ: the sender retransmits NACKed Bulk objects with fresh RaptorQ repair symbols reusing the original object_id (tops up the receiver's existing decoder); Realtime/Default/expired objects are not retransmitted.

Results (release, netns, kernel 6.18 / Ryzen 5 7640U)

Throughput win proven: bulk repair ratio converges to 0.0000 (yipd diagnostic log); clean-link single-stream TCP ~273–285 → ~457 Mbit/s (~60%).
Loss recovery holds with the loop live: yip delivers 99.7% / 99.0% UDP at 5% / 10% netem loss (bare 94.7% / 89.9%).
Tunnel survives loss: netns ping 3/3 clean, 10/10 under 10% loss.

Review

Per-task reviews + a final whole-branch opus review. The final review found and we fixed one security must-fix (control-path on_seen now runs only after AEAD authentication, so a forged Control packet can't poison the loss detector) and raised yip-transport coverage to 90.05%. Cross-task counter semantics, ARQ object-identity (u16 wrap unreachable within the bounded window), whole-loop lock discipline (no deadlock, no lock across I/O), auth-before-trust, and bounded state all verified sound.

Follow-ups (documented, non-blocking): a dedicated end-to-end Bulk-ARQ integrity harness (establish tunnel before applying loss); the gap detector only reports fully-absent counters (exact for the single-symbol zero-repair case).

🤖 Generated with Claude Code

Closes the data-plane control loop and activates the throughput win the throughput pass (PR #2) set up. Spec + plan committed; executed as 8 reviewed tasks (subagent-driven). ## What landed - **Feedback channel:** an authenticated receiver→sender `Control` packet (`PacketType::Control=3`, sealed via the session AEAD) carrying `{delivered_count, high_counter, missing[]}`. New `yip-transport` modules: `feedback` (`LossReport`), `lossdetect` (gap-based `LossDetector`), `retxbuf` (`RetxBuffer`). - **Class-aware controller:** ARQ-eligible (`Bulk`) flows decay their repair ratio to **zero** on a clean link (firing the dormant FEC-encode bypass + halving datagrams); `Realtime`/`Default` keep a proactive floor. Loss snaps the ratio back up instantly. - **Reactive ARQ:** the sender retransmits NACKed `Bulk` objects with fresh RaptorQ repair symbols reusing the original `object_id` (tops up the receiver's existing decoder); `Realtime`/`Default`/expired objects are not retransmitted. ## Results (release, netns, kernel 6.18 / Ryzen 5 7640U) - **Throughput win proven:** bulk repair ratio converges to `0.0000` (yipd diagnostic log); clean-link single-stream TCP **~273–285 → ~457 Mbit/s** (~60%). - **Loss recovery holds** with the loop live: yip delivers **99.7% / 99.0%** UDP at 5% / 10% netem loss (bare 94.7% / 89.9%). - **Tunnel survives loss:** netns ping 3/3 clean, 10/10 under 10% loss. ## Review Per-task reviews + a final whole-branch opus review. The final review found and we fixed one security must-fix (control-path `on_seen` now runs only *after* AEAD authentication, so a forged `Control` packet can't poison the loss detector) and raised `yip-transport` coverage to 90.05%. Cross-task counter semantics, ARQ object-identity (u16 wrap unreachable within the bounded window), whole-loop lock discipline (no deadlock, no lock across I/O), auth-before-trust, and bounded state all verified sound. Follow-ups (documented, non-blocking): a dedicated end-to-end Bulk-ARQ integrity harness (establish tunnel before applying loss); the gap detector only reports fully-absent counters (exact for the single-symbol zero-repair case). 🤖 Generated with [Claude Code](https://claude.com/claude-code)