A bonded tunnel is still one pipe — and one misbehaving stream can ruin it for the traffic that matters. The transport-class system gives every message a delivery contract: priority, a deadline, persistence, its own link policy, or parity. Opt-in, wire-compatible, and byte-identical when off.
Classification is DSCP-first (CS6/CS7 → Control, EF → Voice, AF41 → Video, CS1 → Bulk), then port heuristics (MAVLink 14550/14551 → Control, RTP ranges → Video), then a safe fallback. iperf lands in Bulk while a MAVLink heartbeat rides Control — with zero app changes.
| Class | Reliability contract | Default multipath | Budget / floor |
|---|---|---|---|
| Control / C2 | ReliableBounded — duplicated rather than retried, never starved | Duplicate ×2 | 80 ms · 32 kbps floor |
| Voice | BestEffort, latest-frame semantics | Duplicate ×2 | 180 ms · 16 kbps floor |
| Position | LatestValue — a newer fix always beats retransmitting an old one | SingleBest | — |
| Telemetry | BestEffort | Aggregate | 250 ms |
| Video / ISR | DeadlineBounded — too-late frames are dropped, not resent | Aggregate | 200 ms |
| Bulk | StoreCarryForward — waits out blackouts; survives reboots on the file backend | Aggregate | no deadline |
This is the shipping tactical_default policy table — used whenever the policy file is missing or corrupt, and the floor every adaptive behaviour returns to. Class + reliability pack into a previously unused header byte: old nodes simply ignore it.
Strict priority with per-class reserved-rate floors (measured over a 1-second sliding window) and a tail-drop AQM on the shared byte budget. A class sitting below its reserved floor is served before strict priority is applied at all — and the floors are on the two highest classes, 32 kbps for Control and 16 kbps for Voice, which is precisely what guarantees the command channel gets through. Classes without a floor, Video and Bulk among them, are the ones a flood is allowed to squeeze.
Every packet carries a latency budget — 3.5× the worst alive link’s RTT, clamped to 80–1000 ms — and expired packets are dropped at dequeue. A frame that sat behind a burst is discarded instead of arriving uselessly late and delaying fresher ones.
Bulk traffic to an unreachable peer is held — in memory, or in a write-ahead-log file backend that survives a reboot — and drained priority-then-FIFO the instant any link returns. Caps, lifetimes and an expiry janitor keep the store honest (16 MB / 10,000 bundles / 10 min by default).
Each class carries its own multipath policy — SingleBest, Duplicate{copies}, Aggregate, or Fec{overhead} — overriding the global scheduler. Cost is (RTT/2 + jitter) × 1/(1−loss) from live probes; dead links are never selected.
Systematic Reed–Solomon over GF(256), implemented from scratch: K data packets gain M parity shards, and any K of the K+M rebuild the block — no retransmission, no return-channel dependency, nothing asked for twice. On the send path, shards are striped across the alive links weighted by effective goodput, and parity is floored against the largest per-link share — so a whole link going dark stays a recoverable erasure while that link carries at most half the stripe (the stats report single_link_loss_recoverable honestly either way). One honest cost note: on a two-link bond the parity floor equals plain duplication — prefer Duplicate there. Triple-gated: [qos] enabled, the global fec_enabled switch, and a class whose policy is Fec.
New in 2026-08. With QoS on, classified traffic takes its links from the class policy — so the global adaptive strategies govern unclassified traffic only. The per-class adapt block closes that composition gap: a class escalates its own redundancy when the links it is using measurably degrade, and steps back down on recovery.
Duplicate{n} steps n → n+1 up to a cap (default 3). Aggregate steps to Fec{20%}, then +10 points per level to a 60% ceiling — and only when the global fec_enabled allows FEC; escalation never flips that switch itself. SingleBest classes never escalate: they chose freshness over redundancy, and duplicating LatestValue traffic only adds stale copies. The configured policy is always the floor it returns to.
Per-(peer, class) state with hysteresis matching the global loss_adaptive defaults, plus optional RTT thresholds. Unlike the global strategies, the dwell gates escalation too — deliberately, because escalation spends shared budget.
An escalation_guard bounds the estimated extra bandwidth of all escalated classes to 30% of the peer’s alive-link capacity, and nothing escalates while queues sit deep — loss caused by congestion must never trigger load amplification. Skips are recorded (budget_skip, congestion_skip), every transition is logged, and the QoS panel shows base → effective policy with a live budget meter.
The escalation suite injects 30% loss with kernel-level impairment and asserts the enter / exit / budget-refuse transitions live against two real daemons. Under that loss, Control escalates Duplicate ×2 → ×3 within seconds, and returns to ×2 after the dwell once the interference stops.
All of it sits between classification and the scheduler — and with [qos] enabled = false, none of it exists: the data path is byte-identical to the pre-QoS engine.
[qos]
enabled = true # default false — off means byte-identical
fec_enabled = false # the global Aegis switch (second gate)
fec_block_packets = 8 # K
fec_flush_ms = 60
fec_block_timeout_ms = 200
bundle_backend = "file" # Portage survives reboots
rx_release_buffer = falseThe live policy + per-class counters (enqueued, sent, dropped-late, dropped-AQM, escalation state).
Merge-update the policy — bump Video’s budget mid-demo, no restart. Absent blocks are preserved.
Runnable crate examples ship with the source: k1_no_starve, k2_bend_not_break, k4_bonding, recover, k3_blackout.
Mark the traffic (or let the classifier do it) and every message gets the delivery contract its job deserves — on the links you already bonded.