feat(sentinel): bound concurrent cold starts and verify client reconnects #878

Production readiness audit of Gameplane v0.4.0, commit 07bee47b. Tracking issue and PR merge order: #867.

Finding

The sentinel coalesces wake PATCHes and bounds per-listener concurrency. The first TCP connection has a 25-second window, UDP detection does not retain a session, and hostport handoff can require reconnection. Many independent servers can still boot at once.

Work

Publish per-game wake/join objectives and status that distinguishes waking from joinable. Bound fleet or pool starts to available CPU, memory and I/O, respect explicit stops and lifecycle ownership, and offer prewarming for tiers that cannot meet the client retry window.

Acceptance criteria

Drive simultaneous TCP and UDP joins against multiple heavy sleepers. Measure real join success, retries, p95/p99 startup and resource pressure for Service and hostport paths. Restart the operator during the burst and verify no duplicate boot, missed wake or stranded lifecycle ownership.

PR ownership and prior work

Own fleet wake admission and join/retry qualification. Consume H08/H09 placement and M03 measurements when running the full topology drill. Reuse one joined-client fixture with M04. Keep wake windows and the per-server retry/coalescing and traffic fixtures from #729, #840 and #860.

Idle controller · Wake budgets · PATCH retries · UDP worker · Hostport handoff

Measured cold-wake qualification

On the single-node Kind runner, all 12 real client joins finished within 300 seconds across two separate Minecraft Java 1.21.4 worlds and Teeworlds 0.7.5. The operator restarted 0.492 seconds into the first burst and 0.600 seconds into the second. A 500 ms fleet sampler observed all three starts in each round and a maximum of one starting StatefulSet at once. The Kubernetes watch recorded one game Pod UID per target per round, zero container restarts and no deletions. All six wake tokens were acknowledged and no lifecycle owner remained.

Peak sampled Kind-node cgroup memory was 4.51 GiB and 4.58 GiB by round. Peak 10-second CPU pressure (PSI some) was 33.54% and 32.32%. Memory PSI some stayed at 0.00% and I/O PSI some peaked at 0.18% and 0.00%. Kubernetes reported no memory, disk or PID pressure. There were two to four clients per cohort, so both nearest-rank percentiles select the slowest observed join. One Teeworlds CR still reported Starting immediately after its first successful join. Executed CI job · Raw reports and admission timeline