feat(dataplane): windowed per-class loss denominator, detector robustness, and bench polish (#11)

.github/workflows/benchmarks.yml

@@ -47,3 +47,39 @@ jobs:
             cat "$f" 2>/dev/null || echo "(missing: $f)"
             echo "::endgroup::"
           done
+
+  iperf-netem-bench:
+    runs-on: ubuntu-latest
+    environment: benchmark-approval
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.22'
+      - name: Install BoringSSL build deps & networking tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends cmake clang libclang-dev pkg-config iproute2 iputils-ping iperf3 wireguard-tools openvpn jq
+      - name: Load wireguard kernel module
+        run: sudo modprobe wireguard 2>/dev/null || echo "[note] wireguard module unavailable"
+      - name: Build yipd release
+        run: cargo build --release -p yipd
+      - name: Set up contenders
+        run: |
+          sudo env "PATH=$PATH" ./crates/yip-bench/setup-contenders.sh --check
+          sudo env "PATH=$PATH" ./crates/yip-bench/setup-contenders.sh --amneziawg || echo "[note] amneziawg setup skipped"
+          ./crates/yip-bench/setup-contenders.sh --check
+      - name: Run comparative iperf TCP & UDP netem benchmark
+        run: |
+          set -o pipefail
+          sudo env "PATH=$PATH" bash crates/yip-bench/tests/run-iperf-compare.sh ./target/release/yipd | tee iperf-results.txt
+      - name: Publish benchmark results to Step Summary
+        if: always()
+        run: |
+          if [ -f iperf-results.txt ]; then
+            echo "### Comparative iperf3 Netem Benchmark (TCP & UDP under loss)" >> $GITHUB_STEP_SUMMARY
+            echo '```text' >> $GITHUB_STEP_SUMMARY
+            cat iperf-results.txt >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+          fi

.github/workflows/integration.yml

@@ -67,9 +67,14 @@ jobs:
         # list iproute2/iputils-ping as Recommends. That is not a dependency, and
         # it stopped resolving: run 277 logs "Setting up iproute2"; run 290 — same
         # apt line, one day later — does not.
-        run: sudo apt-get install -y iproute2 iputils-ping iperf3 wireguard-tools
+        run: sudo apt-get install -y iproute2 iputils-ping iperf3 wireguard-tools openvpn jq
       - name: Load wireguard kernel module
         run: sudo modprobe wireguard || echo "[note] wireguard module unavailable; WG column will be skipped"
+      - name: Set up optional benchmark contenders
+        run: |
+          sudo env "PATH=$PATH" ./crates/yip-bench/setup-contenders.sh --check
+          sudo env "PATH=$PATH" ./crates/yip-bench/setup-contenders.sh --amneziawg || echo "[note] amneziawg setup skipped"
+          ./crates/yip-bench/setup-contenders.sh --check
       - name: Build test binaries
         run: cargo test -p yip-bench --test netem_bench --no-run --message-format=json | tee /tmp/netem-build.json
       - name: Run netem harness tests under sudo

CHANGELOG.md

@@ -27,6 +27,8 @@ until 0.1.0.
   Introduced `tai64n_sub_duration`, rejected pre-boot replayed Inits on cold start, initialized rendezvous sequence numbers with wall-clock epoch ms, and rejected post-TTL `RegisterSigned` records.
 
 ### Added
+- **Data-plane windowed loss calculation, 8-contender harness & UDP-under-loss evaluation (`bin/yipd`, `crates/yip-transport`, `crates/yip-bench`, #11).**
+  Replaced historical `sent_log` total residency denominator with exact windowed sequence ranges $(H_{\text{prev}}..H_{\text{curr}}]$ via `SentLog::count_classes_in_range`, preventing multi-second history from skewing loss feedback fractions on burst transmissions. Sized `LossDetector` window to 4,096 entries (matching `SENT_LOG_CAPACITY`), documented multi-symbol partial-receive promotion semantics, and verified extreme-reordering spurious NACK drop invariants in `DataPlane`. Expanded comparative benchmark suite (`crates/yip-bench/tests/run-iperf-compare.sh`, `crates/yip-bench/setup-contenders.sh`) to evaluate 8 contenders (`yip`, `wireguard`, `amneziawg`, `openvpn`, `n2n`, `zerotier`, `tailscale`, `netbird`) across dual TCP goodput and UDP-under-loss (`iperf3 -u`) sweeps with graceful netns auto-detection, local air-gapped controller isolation, and a turnkey contender setup script. Parameterized benchmark runners (`run-compare.sh`, `run-iperf-compare.sh`, `run-wan-bench.sh`) for configurable `PING_COUNT` (supporting 1,000 pings at 5ms intervals with fractional percentage parsing to tighten netem variance to $\pm 0.1\%$).
 - **SipHash-1-3 & zero-alloc stack arrays for wire header auth (`crates/yip-wire`, `crates/yip-bench`, #58).**
   Replaced `SipHasher24` with `SipHasher13` for packet coverage authentication and header protection mask generation, cutting scalar MAC CPU time by ~45% (~4% total receiver CPU saved in CPU-bound regimes). Replaced dynamic `Vec<u8>` concatenation in `deframe` with streaming multi-slice hashing (`hasher.write(header); hasher.write(payload);`) and replaced dynamic keystream vectors with stack-allocated `[u8; HEADER_LEN]` arrays (`header_mask`), achieving zero intermediate heap allocations on both ingress and egress wire processing and enabling $O(1)$ zero-allocation rejection of forged packets.
 - **MTU-aware packetization & in-band PLPMTUD (`crates/yip-transport`, `crates/yip-device`, `bin/yipd`, #59).**

README.md

@@ -117,13 +117,13 @@ All benchmark charts are generated deterministically from verified testbed data.
 <!-- BENCHMARK-TABLE-START -->
 
 <!-- generated by crates/yip-bench/wan/collect.sh -->
-*Two 1-vCPU Debian 13 VPSes, ~60.472 ms apart, 2026-10-20. yip trades raw clean-path throughput for loss resilience — see the FEC row.*
+*Two 1-vCPU Debian 13 VPSes, ~55.536 ms apart, 2026-10-21. yip trades raw clean-path throughput for loss resilience — see the FEC row.*
 
 | | TCP 1-stream | UDP loss (200M) | effective loss @10% injected |
 |---|--:|--:|--:|
-| **yip** | 128.9 Mbit/s | 0.00% | 0% |
-| **WireGuard** | 326.6 Mbit/s | 0.07% | 12% |
-| **OpenVPN** | 18.1 Mbit/s | 29.84% | 9% |
+| **yip** | 128.8 Mbit/s | 0.10% | 1% |
+| **WireGuard** | 408.4 Mbit/s | 0.05% | 12% |
+| **OpenVPN** | 42.7 Mbit/s | 16.05% | 15% |
 
 <!-- BENCHMARK-TABLE-END -->
 

ROADMAP.md

@@ -52,17 +52,16 @@ maintainer.
 - **SipHash-1-3 & zero-alloc wire header auth (#58)** — streaming multi-slice SipHash-1-3 coverage authentication
   and stack-allocated keystream generation (`header_mask`), slashing scalar MAC CPU by ~45% and eliminating
   intermediate heap allocations on data-plane framing.
+- **Data-plane windowed loss, 8-contender harness & bench polish (#11)** — exact per-class windowed loss fractions ($L_{\text{class}} = M_{\text{class}} / S_{\text{class}}$ in $(H_{\text{prev}}..H_{\text{curr}}]$), 4096-entry synchronized loss detection window matching sent-log capacity, bounded spurious NACK drop invariants, 8-contender comparison matrix and netns runners (yip, WireGuard, AmneziaWG, OpenVPN, n2n, ZeroTier, Tailscale, NetBird), dual TCP & UDP-under-loss evaluation, and configurable 1000-ping variance tightening.
 
 ## Now
 
-- **REALITY P256/P384 server-side KEX + HTTP/2 decoy (#84)** — broadening cipher suites and
-  HTTP/2 decoy multiplexing.
+- **Traffic-analysis defense (#11 / Sub-project #4)** — jittered cover traffic cadence, packet size shaping, and AmneziaWG junk/padding recipes.
 
 ## Next
 
-- **REALITY P256/P384 server-side KEX + HTTP/2 decoy (#84)** — broadening cipher suites and
-  HTTP/2 decoy multiplexing.
-- **Traffic-analysis defense** — jittered cover traffic cadence and packet size shaping.
+- **Multi-platform native drivers** — macOS (NetworkExtension / utun) and Windows (Wintun).
+- **Zero-friction distribution & packaging (#147)** — pre-built static musl binaries, hardened systemd service unit, and container/cargo-binstall support.
 
 ## Later