Preserve UAP ping phase and add configurable retry scheduling

[NikolayChirkov]

Summary

Preserve the nominal UAP ping schedule across transport retries and expose peer receive timing without turning packet-loss recovery into schedule drift.

The client now keeps logical ping cycles anchored to the original nominal grid, extends receive windows for early sends, supports deterministic peer deadline state, and provides runtime control over how many retries are budgeted before the advertised deadline.

Retry scheduling

ReceiveSchedule::ping_retry_count is the number of additional retries whose time is reserved before the advertised deadline Tn.

Default: ping_retry_count = 0

Therefore the default path reserves only guard + R99/2 before Tn.

For N > 0:

retry_reserve = N * loss_timeout + R99/2 + N * 10ms scheduler margin + N * 60ms dispatch margin
attempt_lead = G + retry_reserve

After Tn, ping_retry_count is no longer a retry limit. The same logical ping continues recovery until a valid server response confirms it.

Phase preservation

Retries remain physical attempts of the same logical ping cycle. A late retry never establishes retry_time + interval as a new phase. After recovery the next deadline is the first future point on the original nominal grid.

Peer state

• Expected: peer has a future next_ping_deadline on the nominal grid.
• MissedDeadline: server-reported deadline has passed without a newer successful ping; recoverable after later client activity.
• Unknown: no reliable future deadline (e.g. delta <= 0, query errors, or quarantined servers).

MissedDeadline represents a missed advertised deadline and is recoverable after later client activity — not a permanent failure.

Guard / RX window

• Dynamic p99/min guard via ComputePingSendGuard.
• Optional compile-time AE_PING_GUARD_OVERRIDE_US (undefined = dynamic; 0 = fixed zero; X = fixed X microseconds).
• Early-send RX window extension when send precedes nominal anchor.
• Stale close-timer generation protection.

Fault testing

Deterministic logical-cycle fault injection replaces timing-racy bind-next behavior:

FAULT_ARMED → FAULT_MATCHED → FAULT_DROPPED

Matching is by logical_cycle_id and physical_attempt_index, not wall-clock alone.

Validation

Unit

• test-api-protocol: 79/79 PASS (final committed tree)

Deterministic first-request-loss (200 cases each)

• TCP: 199/200 strict Tn-G target
• UDP: 199/200 strict Tn-G target
• Estimated arrivals after Tn: 0/400
• Phase correct: 400/400
• False Alice MissedDeadline: 0/400

Long phase characterization

• TCP: 9142 cycles
• UDP: 7470 cycles
• p99 phase error = 0; no accumulated drift

ping_retry_count=0 runtime acceptance (15 harness-valid cases)

	TCP	UDP
harness-valid	7/10	8/10
no retry before Tn	7/7	8/8
post-Tn recovery	7/7	8/8
same logical cycle	7/7	8/8
confirm on attempt #2	7/7	8/8
phase_error = 0	7/7	8/8
duplicates	0	0
production failures	0	0

State semantics

• hard stop → MissedDeadline: 450/450 valid cases
• graceful → Unknown: 359/360 valid cases

Harness note: Alice Q2 in the focused retry_count=0 harness is flaky because of dest-cloud warm-up. This is harness/test infrastructure and did not expose a Bob production recovery failure.

Design notes

UAP ping scheduling design doc

Test plan

• test-api-protocol 79/79 on final tree
• Deterministic fault characterization scenarios (first-request-loss, phase preservation, retry_count=0 runtime)
• Manual review of peer deadline integration test against live cloud
• Long-run phase preservation (optional; scripts in scripts/)

Made with Cursor