Data-plane follow-ups: ARQ integrity test, detector completeness, retx sizing, hardening #4

Merged

vxfemboy merged 5 commits from data-plane-followups into main

2026-07-01 02:07:09 +00:00

vxfemboy commented

2026-07-01 02:02:48 +00:00

(Migrated from github.com)

Real improvements

FU-A — end-to-end ARQ integrity test (the review's main gap): establishes the tunnel on a clean link, applies 5% netem loss, drives a Bulk-classified UDP flow, and asserts ≥98% delivery AND ARQ retransmits > 0. Measured: 99.2–99.3% delivery, 133–154 (verified 145) retransmits. Both assertions load-bearing — it cannot false-green with zero ARQ. Adds an AtomicU64 ARQ-retransmit counter + periodic log for observability.
FU-B — retx buffer sizing: RETX_BUFFER_MAX 1024 → 16384. At ~100k obj/s the old cap held only ~10 ms (< feedback RTT), so NACKed objects were evicted before retransmit; 16384 covers ~160 ms (~20 MiB worst case).
FU-C — loss-detector completeness: now reports seen-but-undecoded multi-symbol objects (previously only fully-absent gaps), via a bounded resolved_below watermark + resolved_set that suppresses late-duplicate-after-delivery re-reports. Control packets are marked delivered after auth so they aren't false-reported.

Hardening + documentation

FU-D: resolved_below advance uses saturating_add (panic-free at u64::MAX); documented the per-class loss denominator as an accepted conservative approximation (biases toward more repair under loss — never under-protects) and the batch-gated feedback cadence as a non-issue (a silent inbound link has no loss to report).
FU-E: fixed a misleading AdaptiveController::new doc + a tunnel.rs comment drift; guarded RetxBuffer::put against duplicate counters (with a test).

Coverage 90.54%; all netns tests pass (ping 3/3, ping-under-loss, arq-integrity 145 retransmits).

🤖 Generated with Claude Code

Addresses all follow-ups logged during the loss-feedback + ARQ milestone reviews. Each change individually reviewed; the end-to-end ARQ test (FU-A) passing on the full branch is the cross-cutting integration proof. ## Real improvements - **FU-A — end-to-end ARQ integrity test** (the review's main gap): establishes the tunnel on a clean link, applies 5% netem loss, drives a Bulk-classified UDP flow, and asserts **≥98% delivery AND ARQ retransmits > 0**. Measured: **99.2–99.3% delivery, 133–154 (verified 145) retransmits**. Both assertions load-bearing — it cannot false-green with zero ARQ. Adds an `AtomicU64` ARQ-retransmit counter + periodic log for observability. - **FU-B — retx buffer sizing:** `RETX_BUFFER_MAX` 1024 → 16384. At ~100k obj/s the old cap held only ~10 ms (< feedback RTT), so NACKed objects were evicted before retransmit; 16384 covers ~160 ms (~20 MiB worst case). - **FU-C — loss-detector completeness:** now reports seen-but-undecoded multi-symbol objects (previously only fully-absent gaps), via a bounded `resolved_below` watermark + `resolved_set` that suppresses late-duplicate-after-delivery re-reports. Control packets are marked delivered after auth so they aren't false-reported. ## Hardening + documentation - **FU-D:** `resolved_below` advance uses `saturating_add` (panic-free at u64::MAX); documented the per-class loss denominator as an accepted conservative approximation (biases toward *more* repair under loss — never under-protects) and the batch-gated feedback cadence as a non-issue (a silent inbound link has no loss to report). - **FU-E:** fixed a misleading `AdaptiveController::new` doc + a `tunnel.rs` comment drift; guarded `RetxBuffer::put` against duplicate counters (with a test). Coverage 90.54%; all netns tests pass (ping 3/3, ping-under-loss, arq-integrity 145 retransmits). 🤖 Generated with [Claude Code](https://claude.com/claude-code)