feat(tunnel): measure relay saturation, packet loss and latency #879

Production readiness audit of Gameplane v0.4.0, commit 07bee47b. Tracking issue and PR merge order: #867.

Finding

The Tailscale forwarder shares a bounded session budget across ports/protocols, with four queued UDP datagrams per session by default. Dropped packets and rejected connections can coincide with a Ready relay. Other providers use different forwarding paths.

Work

Instrument active flows, rejections, queue drops, packet rate and forwarding latency with bounded cardinality. Make applicable limits configurable within safe bounds. Publish provider-specific capabilities and profile allocation/CPU hot spots under a realistic high-tickrate load.

Acceptance criteria

Drive direct and tunneled traffic on the same hardware with identical clients, packet sizes and offered load. Force saturation, verify counters against client observations, and report p95/p99 latency, jitter, loss, CPU and the sustainable rate for each provider under test, explicitly marking unqualified paths.

PR ownership and prior work

Own the relay metrics and load driver. M03 consumes those metric names in dashboards/alerts. M01 uses the direct/relay baseline without forking the driver. Reuse the forwarding and health paths delivered by #765, #768 and #838. The session and queue limits cited here are specific to Tailscale.

Tailscale forwarding · Relay gauges

Qualification evidence

All four direct-versus-FRP loopback comparisons met the documented send, loss, p99 RTT and jitter budgets at 1,024 offered UDP packets/s. At 8,192 packets/s, one trial returned 81,738 of 81,920 sent datagrams. The FRP proxy independently counted the same payload volume. The report contains routes, trial order, packet sizes, CPU usage, latency distributions and the raw data for all 32 trials. FRP qualification and reproduction

At 4,096 offered packets/s the direct socket and local Tailscale forwarder each returned all 8,192 datagrams. Their p99 RTTs were 0.079 ms and 0.172 ms respectively. The accompanying amd64 CPU and allocation profiles cover the local UDP forwarding path. WAN FRP, hosted Tailscale, DERP and Playit capacity remain unqualified. Forwarder profile CI log · Implementation PR #905