Carrier Router exp90.3 — 2026-09-20

Changes / 修改內容
- Bound native packet-generator rate credit before unsigned conversion. Recover safely from backward/non-finite time deltas and invalid accumulated credit; retain fractional pacing and frame-size limits.
- 修正 VPP worker 發包器異常配額可能導致限速失效的問題；時鐘回退後重設配額，避免持續全速發包。
- Reject invalid rate/count input and avoid overflow when applying finite packet limits.
- Rebuild native VPP packages and the exact-version-pinned carrier-iftop monitor; retain WAN lock-scope and table/JSON fixes from exp90.1/90.2.
- 本次依使用者明確要求使用 exp90.3 編號，但採完整 VPP 套件與 ISO 建置，不是僅替換顯示檔案。

Validation / 驗證
- Standalone sanitizer tests cover fractional credit, negative/non-finite values, overflow, frame caps and recovery.
- In an isolated process, injected backward time made the old 1 Mpps / 60 million packet stream finish in 2.83 seconds. Fixed code completed the same test in approximately 60 seconds.
- Both workers passed 180-second, 1.3 Mpps internal-drop pacing tests (234 million packets each). These are generator pacing tests, not forwarding-throughput or zero-loss certification.
- Three final-ISO checks: worker/main pacing with fault injection and monitor plugin loading; dual-stack VPP/kernel WireGuard; restrictive-umask install/upgrade and installed disk boot. No source overlays.
- The exact ISO was installed and booted on the authorized lab device; configuration, CPU 2+1, BGP, OSPF/OSPFv3, tunnel reachability and permissions verified. The other router is intentionally deferred.

Upgrade / 升級
- Back up configuration and retain a previous boot image and independent console. This qualified full-ISO upgrade requires a router reboot and interrupts that router's services. No qualified reboot-free bundle is published.
- 修改 libvnet 並不會即時替換已執行中的 VPP；不可只複製函式庫就宣稱完成升級。
- Repair missing migration provenance before upgrade; never overwrite saved configuration with a partially loaded configuration.
- This is targeted qualification, not a full historical regression or a maximum-Mpps certification.

Retained limitations
- Use the configuration CLI and update every reference when renaming a VRF. This fixes single-commit configuration ordering; direct kernel interface renaming is not supported and can terminate FRR. Interface reattachment may interrupt traffic; retain an independent management path.
- Configuration-daemon initialization now tolerates brief scheduling delays and fails the commit explicitly on a ten-second handshake timeout. An unavailable configuration service must recover before retrying; this is not an automatic daemon restart or a guarantee against every possible routing failure.
- rotation-interval under WAN member is a first-dial delay per router boot, not a periodic timer. Already-running PPP clients are not stopped; daemon restarts do not reset the countdown. Legacy periodic pppoe-handover settings are retained rather than silently changed.
- Hard failure bypasses optional scoring and hold timers, not the need for a working backup or configuration locking/dataplane application. Unknown monitoring data is not declared a failure. There is no promise of zero-time or zero-loss switching.
- Experimental release: retain a backup, previous image and independent console. Three targeted final-ISO VM checks and one physical installation/reboot passed; this is not a full historical regression run or universal production qualification.
- UPGRADE PREREQUISITE: older modular config-db stores may lack migration-version metadata. Prepare provenance before installing/rebooting. The old installer does not gain the new preflight guard merely by receiving this ISO. Never save a partially loaded configuration over the original saved data.
- Recover provenance only from an identical versioned backup, or explicitly version a verified complete healthy running configuration that matches saved values, using the fixed helpers. Do not guess a source schema. Already-lost customer settings are not reconstructed.
- No qualified reboot-free upgrade bundle is published. Kernel remains 6.18.48 and VPP native packages are b90.3; carrier-iftop adds a native monitoring plugin requiring VPP restart on initial installation. ISO installation/reboot interrupts services.
- PPPoE handover retains exp82 requirements: concurrent ISP sessions, separate non-default underlay VRFs and healthy peers. IPv4 outer transport, dual-stack inside WireGuard. No guarantee of zero loss/delay, circuit redundancy or unrelated NAT-session preservation.
- Boot skips missing OSPF/OSPFv3 interface references individually, retains their settings and protects saving until repaired. This does not bypass routing policy/firewall errors or guarantee access when management itself is misconfigured. No general fix for all static-ARP migration or stale VPP route cases is claimed. Site-specific settings and runtime repairs are not included.
- VPP interface completion now uses configured names, but bmon may still show native wg names in its counter rows. tcpdump completion filtering does not add native VPP packet capture.
- WAN handover initially requires distinct non-default underlay VRFs and IPv4 outer/probe transport. Kernel WireGuard source-group requires explicit vrf bind-udp-to-all, which also affects other unbound UDP listeners. Existing PPPoE scheduled rotation remains a separate controller; members cannot be shared between controllers.
- WAN latency compares a full configured moving arithmetic mean. Percent-only has no implicit ms floor; both explicitly configured thresholds must pass. Group static routes initially support IPv4 and retain a fail-closed guard when no usable next-hop exists.
- VPP connection monitoring defaults to 1:100 sampling for at most 60 seconds. Estimated flow rates are not exact accounting. Short flows may be missed; full-rate overhead has not been benchmarked. Only unicast IPv4/IPv6 is covered.