Enforce resource limits and qualify connector capacity #984

Parent: #970

Deliverable

Enforced resource limits plus a repeatable benchmark report establishing supported connector counts and throughput for each transport.

Dependencies

#982, #983, #991; use #1002 foundation capacity measurements for the qualified artifact versions.

Galactic Edge integration (#992)

Implement this milestone as a consumer of the Galactic Edge provider contract. #992 owns provider authorization, host attachment lifecycle, shared-state fencing and maintenance, independently enforced forwarding expiry, prefix conflict arbitration/publication, and gVPC traffic policy. MASQUE owns client authentication, connector /96 assignment and retention, session packet checks, transport behavior and its provider adapter. Use the foundation's versioned contract and existing provider helpers; do not introduce a second host-networking controller, lease store or BGP publisher. Any required foundation change must be tracked and qualified under #992 before this milestone claims integrated acceptance.

Work

• Implement or complete the design's connection/request, buffer, queue and resource limits, including admission and overload behavior.
• Build a repeatable load harness with documented hardware, versions, packet sizes, active connector counts and traffic mix.
• Measure HTTP/3 and HTTP/2 separately, including slow readers, packet loss, request churn and overload while existing connectors carry traffic.
• Check that expiry, revocation, routing and tenant isolation remain correct under load; tune the implementation to meet the agreed targets.

Acceptance criteria

• The report includes throughput, latency, CPU/memory use, accepted/rejected work and the tested supported connector count for each transport.
• Overload causes bounded, documented rejection/backpressure rather than unbounded memory growth or stalled authority expiry.
• Resources recover after clients disconnect or requests fail; a slow connector cannot consume unbounded shared capacity.
• Agreed targets pass on the specified test environment. Any target revision is explicitly reviewed and affected tests rerun before closing.

Additional integration acceptance

• Budget provider instances, attachments, EdgeRoutes, map capacity/headroom, API operations and lease-renewal work alongside transport sessions/buffers. Account for one renewed lease per instance and multiple connector routes.
• Preserve renewal/expiry progress under request floods, stalled admission/API calls, reconnect storms and slow packet devices; one connector cannot monopolize shared locks or queues.
• Verify CONNECT-IP server lacks overload limits and tenant isolation checks #991 limits before client admission and queued-byte limits for both transports. Saturation must reject bounded work without reviving expired sessions or dropping unrelated tenants.
• Reconcile results with Qualify the foundation on the target platform #1002 foundation capacity/admission limits and the Define connector admission, addressing and ownership contracts #972 workload; report packet, API and foundation resource budgets as well as protocol throughput.

Scope follows #970: CONNECT-IP with HTTP/2 fallback; no public API development, plugin/portal integration, product-client development or production rollout.