Data-plane follow-ups & investigations (umbrella) #11

Smaller deferrals / follow-ups / things-to-investigate accumulated across the throughput pass, feedback+ARQ, and io_uring Phase A milestones. Each is bounded; none blocks current work.

Correctness / robustness

• Wire-auth object_id binding (M5/M6 carry-forward). object_id (u16) and object_size are attacker-forgeable on the wire; a forged object_id can LRU-evict a live object in the reassembler. Bind them to authenticated peer/epoch context. Also: u16 wraps every 65536 objects (currently unreachable within the bounded retx/reassembler windows, but relevant if rates rise or windows grow). (PR feat(security): wire-auth 64-bit object binding & pre-AEAD anti-replay reassembly gating (#11) #155)
• Loss-detector partial-receive limitation (documented in lossdetect.rs). The gap model reports fully-absent counters and, since PR Data-plane follow-ups: ARQ integrity test, detector completeness, retx sizing, hardening #4, seen-but-undecoded counters too — but the seen-but-undecoded suppression (resolved_set) is best-effort under extreme reordering (evicted-far-above-watermark → a benign spurious NACK the sender drops). Exact for the single-symbol zero-repair case. Revisit if heavy-loss multi-symbol accuracy matters. (PR feat(dataplane): windowed per-class loss denominator, detector robustness, and bench polish (#11) #160)
• Per-class loss denominator is a conservative approximation (sent-log residency → biases the fraction high → over-repair, safe). An exact per-class windowed rate is hard (receiver knows window totals but not classes; sender knows classes but not the receiver's window). Only worth it if over-repair-under-loss becomes a measured cost. (PR feat(dataplane): windowed per-class loss denominator, detector robustness, and bench polish (#11) #160)
• Deadline-based FEC eviction: FlowParams.deadline is only partially honored (LRU-count eviction dominates). Honor per-class deadlines for reassembler eviction + ARQ eligibility. (PR feat(dataplane): deadline FEC reassembly eviction, zero-alloc egress scavenging & wire-format layout fix #154)
• Bidirectional flow accounting: the M5.5 classifier heuristic observes egress only. (PR feat(transport): bidirectional flow accounting via canonical flow keys and ingress observation (#11) #156)

Performance / cleanup

• drain_tun to_vec() clone (PR perf(io): eliminate redundant to_vec() egress clones in io_uring driver (#11) #157) (yip-io/poll.rs, Phase A): clones the egress scratch to drop the &mut DataPlane borrow before sending. Negligible now; a candidate to eliminate in the io_uring pass (io_uring busy-poll Phase B: UringDriver (status + remaining work) #7) by splitting the borrow.
• AF_XDP backend: still a stub. The second kernel-bypass I/O tier after io_uring (io_uring busy-poll Phase B: UringDriver (status + remaining work) #7). (PR Way C: Kernel-bypass zero-copy I/O tier (AF_XDP / io_uring multi-ring) #127)

Anti-DPI hooks still live in the data plane (feed sub-project #3)

• Static 1-byte PacketType prefix (Data=2/Control=3/handshake) + fixed handshake prefixes — a DPI signature. Fold into keyed header-protection. (PR feat(dpi): multi-engine DPI verification harness (Zeek, Suricata, tshark beyond nDPI) (#70) #143)
• Static conn_tag = linkability signature — rotate per epoch (tied to rekey, Milestone: session rekey (~120s rotation) + PQ-hybrid handshake path #9). (PR Milestone 9a: classical session rekey (~120s rotation) + epoch handling (#9) #90, PR security(anti-dpi): data-plane obf key is not rotated per epoch — 2^32 obf-nonce birthday bound over the whole connection lifetime #105)

Broader roadmap (each a future sub-project, own design→build)

• Sub-project Data-plane throughput pass: batched I/O + zero-repair FEC bypass #2 — control plane: decentralized discovery (DHT/gossip), self-certifying key-derived addresses, NAT hole-punching (rendezvous + UDP punch), relay fallback. yipd is currently two static hand-configured peers — this is "the real work" per CLAUDE.md.
• Sub-project Adaptive loss-feedback loop + reactive ARQ #3 — anti-DPI/obfuscation: the two anti-DPI items above + AmneziaWG recipe (junk/padding/jitter), optional REALITY TLS-mimicry, nDPI/nDPId wired into CI.
• Sub-project Data-plane follow-ups: ARQ integrity test, detector completeness, retx sizing, hardening #4/CI: guard the under-loss + ARQ-integrity netns tests #5: DAITA/anonymity (Arti); hardening/multi-platform (macOS/Windows).

Bench polish (optional)

• ZeroTier + AmneziaWG bench contenders (named in the brief, not installed). (PR feat(dataplane): windowed per-class loss denominator, detector robustness, and bench polish (#11) #160)
• OpenVPN currently benched with TLS+AES-256-GCM (good); could add a UDP-under-loss column for WG/OpenVPN/n2n. (PR feat(dataplane): windowed per-class loss denominator, detector robustness, and bench polish (#11) #160)
• 1000-ping samples to tighten netem loss-rate variance. (PR feat(dataplane): windowed per-class loss denominator, detector robustness, and bench polish (#11) #160)