Expose connector lifecycle, policy and route diagnostics #983

Parent: #970

Deliverable

Metrics and structured diagnostics that let an engineer determine why a connector cannot forward and whether it owns an installed /96 route.

Dependencies

#980, #981, foundation #1001; live evidence may share #1000/#1002 fixtures.

Galactic Edge integration (#992)

Implement this milestone as a consumer of the Galactic Edge provider contract. #992 owns provider authorization, host attachment lifecycle, shared-state fencing and maintenance, independently enforced forwarding expiry, prefix conflict arbitration/publication, and gVPC traffic policy. MASQUE owns client authentication, connector /96 assignment and retention, session packet checks, transport behavior and its provider adapter. Use the foundation's versioned contract and existing provider helpers; do not introduce a second host-networking controller, lease store or BGP publisher. Any required foundation change must be tracked and qualified under #992 before this milestone claims integrated acceptance.

Work

• Expose active/admitted/failed connector and tunnel counts by transport, connection failure reasons, policy drops, resource usage and route programming status.
• Expose ownership expiry and revocation outcomes and distinguish admitted, programmed and forwarding-ready states.
• Provide structured correlation using stable connector, gVPC, attachment and ownership identifiers; bound metric label cardinality and exclude credentials and packet contents.
• Document a short diagnostic workflow using the emitted telemetry. Do not add a portal or public management API.

Acceptance criteria

• Automated tests or fixtures demonstrate telemetry for successful connection, authentication denial, policy denial, route-programming failure and ownership expiry.
• An engineer can correlate a connector to its active attachment and route state without inspecting secrets.
• Metric cardinality remains bounded as connector identities churn, and diagnostics distinguish HTTP/3 and HTTP/2 failures.
• The capacity harness can consume the exposed resource and connector measurements.

Additional integration acceptance

• Reuse Deliver foundation diagnostics #1001 foundation metrics/events and docs/edge/troubleshooting.md; add protocol/client-session telemetry rather than duplicate foundation state ownership.
• Correlate connector/session/transport with provider, service UID, instance/lease epoch, attachment and accepted route epoch in bounded diagnostics. Keep unique identities out of unbounded metric labels.
• Exercise a live troubleshooting flow distinguishing client denial, provider denial, programmed-but-not-ready, unaccepted claim, expired gate, policy denial and remote convergence. Confirm actual exported metrics/alerts for the pinned build, not merely a metric definition.

Scope follows #970: CONNECT-IP with HTTP/2 fallback; no public API development, plugin/portal integration, product-client development or production rollout.