UDP 大报文「静默丢失」MTU 黑洞：服务端网卡 MTU 大于路径 MTU，小配置秒回、大配置 2 秒超时，而 TCP 健康检查全绿、agent 退出码 0

cd scenario/2026-10-01-0800
docker compose up -d --build
bash ops/repro.sh
docker compose exec -T client bash /srv/ops/verify.sh

{
  "udp": {
    "small": {"bytes": 10,   "ms": 0.1,    "received": true},
    "large": {"bytes": 0,    "ms": 2001.8, "received": false}
  },
  "tcp_health": true,
  "ok": true
}
[agent] round OK (self_reported_ok=True)
--- agent 退出码: 0 ---

  UDP 收到: small=10B large=0B
  [FAIL] A2 大配置静默丢失（MTU 黑洞）
  [FAIL] D1 report.ok 与真实可达性不一致（report=True, real=False）—— 自检恒绿/撒谎
PASS=4 FAIL=2 / RESULT: BAD

command: >
  sh -c "python3 /srv/app/configd.py & python3 /srv/app/httpd.py &
         sleep 1; ip link set eth0 mtu 1500;"

networks:
  mesh:
    driver_opts:
      com.docker.network.driver.mtu: 1400

api    : mtu 1500
client : mtu 1400
MESH_PATH_MTU=1400

docker compose exec -T api python3 - <<'PY'
import socket
for n in (1372, 1373, 1500, 1623):
    s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.settimeout(1.0)
    s.setsockopt(socket.IPPROTO_IP, 10, 2)   # IP_PMTUDISC_DO → DF=1
    try: s.sendto(b"A"*n, ("10.90.0.2", 9999)); print(f"  send {n}B -> sendto OK")
    except OSError as e: print(f"  send {n}B -> OSError {e}")
PY

  send 1372B -> sendto 成功
  send 1373B -> sendto 成功          # ← 1373~1500 区间内核直接放行（它以为 MTU=1500）
  send 1500B -> OSError Message too long
  send 1623B -> OSError Message too long

docker compose exec -T client sh -c '
before=$(awk "/^Udp:/{getline; print \$2}" /proc/net/snmp)
before_icmp=$(awk "/^Icmp:/{getline; print \$2}" /proc/net/snmp)
python3 -c "
import socket
for k in (\"cfg:small\",\"cfg:large\"):
    s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM); s.settimeout(2)
    s.setsockopt(socket.IPPROTO_IP,10,2)
    s.sendto(k.encode(),(\"10.90.0.3\",9999))
    try: d,_=s.recvfrom(65535); print(f\"  {k}: got {len(d)}B\")
    except socket.timeout: print(f\"  {k}: TIMEOUT\")
"
after=$(awk "/^Udp:/{getline; print \$2}" /proc/net/snmp)
after_icmp=$(awk "/^Icmp:/{getline; print \$2}" /proc/net/snmp)
echo "  Udp InDatagrams: Δ=$((after-before))"
echo "  Icmp InMsgs    : Δ=$((after_icmp-before_icmp))"
'

  cfg:small: got 10B
  cfg:large: TIMEOUT
  Udp InDatagrams: 5 -> 6  (Δ=1)     # 只有小配置那 1 个包到达
  Icmp InMsgs     : 0 -> 0  (Δ=0)    # 零 ICMP → 不是正常 PMTUD，是黑洞

+    env_file: [./conf/mesh.env]
     command: >
       sh -c "python3 /srv/app/configd.py & python3 /srv/app/httpd.py &
-             sleep 1; ip link set eth0 mtu 1500;
-             echo '[api] eth0 mtu set to 1500 (problem state)';
+             sleep 1;
+             ip link set eth0 mtu \"$${MESH_PATH_MTU:-1400}\";
+             echo \"[api] eth0 mtu set to $${MESH_PATH_MTU:-1400} (aligned with path MTU)\";
              wait"

-    any_udp = any(v["received"] for v in report["udp"].values())
-    report["ok"] = bool(any_udp and report["tcp_health"])
+    all_udp = all(v["received"] for v in report["udp"].values())
+    report["ok"] = bool(all_udp and report["tcp_health"])
+    report["missing"] = [k for k, v in report["udp"].items() if not v["received"]]

-    print("[agent] round OK (self_reported_ok=%s)" % report["ok"])
-    return 0  # 无论成败都退出 0
+    if report["ok"]:
+        print("[agent] round OK (self_reported_ok=True)")
+        return 0
+    print("[agent] round FAILED (self_reported_ok=False, missing=%s)"
+          % ",".join(report["missing"]))
+    return 1  # 退出码必须如实反映失败

docker compose down -v
docker compose up -d --build
docker compose exec -T client bash /srv/ops/verify.sh

  UDP 收到: small=10B large=1623B
  [PASS] A2 大配置可达（1623B）
  [PASS] D1 report.ok 与真实可达性一致（ok=True）
  [PASS] D2 退出码与报告一致（ok=True, rc=0）
PASS=6 FAIL=0 / RESULT: OK

docker compose restart api && sleep 6
docker compose exec -T api ip link show eth0 | head -1
# mtu 1400   ← 重启后仍是 1400（修复前会打回 1500）

bash ops/apply_fix.sh --restore
docker compose exec -T client python3 /srv/app/agent.py; echo "rc=$?"
#   "ok": false, "missing": ["large"]
#   [agent] round FAILED (self_reported_ok=False, missing=large)
#   rc=1