main-5cc3267

perf(secret): finish the campaign — ACK knob, window floor, H-17/H-18

Closes the secret-tunnel performance and traversal campaign. Four measured
results and two instrument defects, all with repeatable procedures.

S5, the ACK experiment, is decided and the knob is completed rather than
shipped. `BORE_DIRECT_QUIC_ACK_THRESHOLD` alone was a trap: quinn's
`AckFrequencyConfig` leaves `max_ack_delay: None`, which falls back to the
PEER's transport parameter of 25 ms. On `vm-vm` (loopback-class RTT) that is
several hundred RTTs and throughput collapses bimodally — get median 0.622,
worst pair 0.020. On `vm-ws` the same constant is ~1.1 RTT (measured median
22.31 ms) and costs nothing: get 1.011, put 1.029, no pair below 0.909. Same
code, same constant, opposite outcome, which is the definition of a value that
must not be a default. `resolve_ack_frequency` now returns a three-arm
`AckFrequencyChoice` and REFUSES a threshold without an explicit
`BORE_DIRECT_QUIC_ACK_MAX_DELAY_MS`, warning instead of silently running the
trap; `sec_ack.sh` greps both peers' binaries for the second variable and
exits 3 rather than print a table of the trap under the heading of an ACK
experiment.

S3c re-runs the efficiency stage at GIB=8 and CORRECTS the GIB=2 claim that
the receiver's CPU was flat. Per-process `bore` CPU seconds, vm-ws:
server 49 -> under 1, sender 11 -> 31 (2.82x), receiver 13 -> 22 (1.69x),
total 73 -> 53 for 35% more goodput. The receiver is not flat; at 2 GiB the
3 s -> 4 s reading was inside the sampler's +/-1 s quantisation and was
correctly not claimed. On vm-vm the server goes 70 -> 1 CPU s while the two
endpoints (same host) go 25 -> 26, total 95 -> 27 at double the goodput.

The window floor is a real defect, found by `bore test-udp` while chasing a
packet-counter gap. `UdpDirectTuning::from_memory_budget` derives
`stream = budget / --max-carriers / 16`, and `--max-carriers` is the operator's
absolute ceiling, not what tunnels use: staging's 1024 with a 512 MiB budget
put the stream window on its 1 MiB floor. Measured at 19.13 ms RTT, ONE direct
stream ran 376.79 Mbit/s against the `1 MiB / 19.13 ms` = 438 Mbit/s bound,
with `loss 0 pkts` and a cwnd ten times the window — flow control, not the
network — and reported the direct path as SLOWER than the relay. The campaign's
four-connection stages could not see it because the cap is per stream.
`UdpBudgetPlan.window_at_floor` plus a `report_udp_budget` advisory that fires
whenever the derived window is below the tested default (the shipped
`--max-carriers 16` yields an eighth-sized window without touching the floor),
quoting `stream_bandwidth_mb_s` at two RTTs and naming three remedies. The
default is deliberately unchanged: it is the operator's decision, and the
defect was that nothing said there was one.

Two instrument defects, both found by running the gates:

H-17 — `/proc/stat` `busy` is not attributable on a shared machine. My own
reading that the workstation's bill nearly doubled on the direct arm was
falsified by the per-process reduction (bore 3 s -> 4 s while host busy went
41.07 -> 76.89, i.e. a browser). `cpu_window.sh` now warns when the
unattributed seconds exceed 10 AND half the host bill; verified to fire on
exactly the two shared-host rows of the S3c run and stay silent on the four
dedicated ones, including a server whose busy is 3.06 with nothing sampled.

H-18 — the leak gate was measuring below its own noise floor. It failed
`rss-consumer` on a textbook 4-phase trend (4152 KiB, 6.9 KiB/connection); the
same arm at 8 x 400 plateaus (last four phases agree to 200 KiB over 1600
further connections) and the server then failed the other half of the rule from
a level flat for five phases. The noise is glibc raising its dynamic mmap
threshold on the 256 KiB per-direction proxy buffers, which ceilings at
`concurrency x buffer x 2` = 5120 KiB. `SECLEAK_PHASES` now defaults to 8, the
slack is derived rather than chosen, and every OK verdict prints the resolution
it achieved in bytes per connection. `scripts/perf/rss_verdict_check.sh`
extracts the rule from the harness at run time and red-checks it against the
two measured plateaus and seven synthetic series.

Gates: fmt; clippy -D warnings on default/vpn/ssh-gateway/both; cargo test
588/0 default and 1030/0 with vpn,ssh-gateway; secret_leak_hunt 50/0;
rss_verdict_check 11/0; udp_nat_netns 27/0; secret_netns 34/0.

Docs: evidence 9.5/9.6/10/11, the Italian final review 5.5-5.8 with the open
questions re-scored (4 and 5 closed by the packet counters and GIB=8), README
on the budget/bandwidth trade, NAT_TRAVERSAL 21.6 on why the window floor is
not a traversal fault.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BqfehFhjLR3Yj1sgaf5KCi