Benchmark mailbox latency, overload, and typed-service isolation #4635

Agent pickup triage

Category: blocked. This classifies the next task, not completion or a verified current-source pass.

Next bounded step: Wait for the implemented mailbox paths required by each matrix cell; prepare the reproducible measurement plan now, but report harness and real-VM evidence separately.

Read the linked handoff and coordinate any active owner before implementation. Preserve the original acceptance criteria below; this triage grants no spending, credentials, publication, host reconfiguration, or landing authority.

Parent: #4622

Related to #4626, which measures current egress and shared-vsock saturation. This issue measures the mailbox path and reuses its host-resource instrumentation where applicable.

Outcome

Produce reproducible evidence that mailbox calls and casts remain bounded, fair, isolated from other typed services, and within the declared warm-path latency target under realistic concurrency and failures.

Matrix

• Local process, same host, direct same-region, customer relay, and explicitly configured public relay.
• 1, 10, 100, 250, 500, and 1,000 workload identities.
• Calls, casts, mixed calls/casts, full mailboxes, slow consumers, reconnects, partitions, and one abusive sender at its admitted limit.
• Ephemeral acknowledgement, durable acceptance, snapshot/replay, and migration cutover where implemented.
• Mixed mailbox, telemetry, FlowMux egress, and machine-control traffic.

Acceptance criteria

• Machine-readable results report p50, p95, and p99 send-to-acceptance and call-response latency, throughput, goodput, retries, duplicates, refusals, and timeouts.
• The warm, online, direct same-region path meets the Program: signed pass-by-value mailboxes for workload, host, and user messaging #4622 p95 target below 300 ms or Program: signed pass-by-value mailboxes for workload, host, and user messaging #4622 is updated with the measured limiting resource and an evidence-backed replacement contract.
• Queue depth, credit stalls, CPU, memory, descriptors, network path, fairness, and per-service latency identify the first saturation point.
• Saturating mailboxes cannot starve machine control, telemetry, or FlowMux beyond their declared bounds.
• Direct and relayed results, durable acknowledgement costs, and real-microVM versus harness results are reported separately.
• No artifact contains credentials, payload plaintext, or customer data.