Egress verification passes on a datapath where no session can complete

[privateip]

Summary

The egress check watches for a translated packet on the wire and stops there. It never confirms that packet arrived anywhere, and never confirms a reply came back, so it reports green on a datapath where no egress session can complete.

Both return-path faults found by driving real traffic to a host outside the fabric sat behind a passing check. The lab now has such a host permanently attached to the transit, so a round trip is available to test against.

Outcome

The egress check drives a request and its response through a shard to a destination outside the fabric, and fails when either direction breaks.

Related to #546, #549 and #550.

[privateip]

The egress check now drives a request and its response through a shard to a destination outside the fabric and fails when either direction breaks. This landed as verify:nat-datapath in PR #552 (9541e7d), which added the off-fabric remote-host and asserted both directions on both families: the far end must see the translated packet masqueraded to the shard's address, and the tenant's fetch must get a reply back.

The shallow wire-only check (verify:nat-egress) remains as the fast check. The return-path faults it used to sit behind are fixed and covered elsewhere: #549 by verify:nat-return-route, #550 by the shard stamping the tenant's own End.DT46 SID, and #565 by both legs of the shard transmitting from the driver so conntrack sees the reply. The change is in release v0.2.0.

Closing as already fixed. If the round-trip check still reports green on a broken datapath on the latest version, reopen with the lab state and I will look again.