feat(host): pace-aware send chunking — high-rate frames pace honestly instead of blasting

Phase 1.2: the native plane's pace chunks are rate-adaptive — 16 packets at
today's rates, coarsening until the per-chunk interval clears the 500 µs sleep
floor, capped at 64 (the GSO segment limit). Decouples the syscall batch from
the pace step, so a ≥1 Gbps frame's overflow keeps real sleeps between chunks
(and costs 4× fewer syscalls) instead of collapsing into an unpaced blast.

Phase 1.3: the auto microburst cap scales with the frame — max(128 KB, the
AU's wire bytes / 4) — so high-rate frames burst a bounded quarter and pace
the rest; PUNKTFUNK_PACE_BURST_KB now pins an absolute override.

GameStream plane untouched (its schedule stays pinned by the deterministic
tests, now also asserting budget-independence). Linux GSO latch-off warns
once (was silent; USO already warned).

Linux GSO default stays OPT-IN: the post-1.2/1.3 A/B on the 2.5GbE-hop pair
(.21 → M3 Ultra) reproduced the regression bit-for-bit — 2452 Mbps sendmmsg
vs 1909 GSO peak, 0.4% loss at 1500 where sendmmsg is clean. The super-buffer
trains lose on the constrained hop in the transport path itself (per-AU
probe sends, no video pacer involved), so the block is fabric evidence, not
pacing readiness. Control sweep on this build matched the sendmmsg baseline
exactly (2452); loss-harness recovery curve identical; workspace clippy +
tests green on .21.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-core/src/transport/udp.rs

@@ -112,13 +112,16 @@ fn mmsghdrs(iovs: &mut [libc::iovec]) -> Vec<mmsghdr> {
 }
 
 /// UDP GSO enable state (process-wide). **Opt-in** (`PUNKTFUNK_GSO=1`) — and deliberately so,
-/// measured twice on 2026-07-14: GSO cuts send-thread CPU ~30% at 1250 Mbps, but its 16-packet
-/// line-rate trains cost real delivered throughput on a constrained fabric (the 2.5GbE-hop pair:
-/// peak 2453 → 1908 Mbps, and 0.4% loss appeared at a rate the sendmmsg path carries clean).
-/// Flipping the default belongs together with pace-aware chunk scaling (plan Phase 1.2/1.3 in
-/// `design/throughput-beyond-1gbps.md`), which spaces the super-buffers instead of skipping
-/// sub-floor sleeps. NOTE the gate is value-aware: `PUNKTFUNK_GSO=0` explicitly disables (it
-/// used to key on env *presence*, so `=0` ENABLED it here while disabling Windows USO).
+/// measured three times on 2026-07-14: GSO cuts send-thread CPU ~30% at 1250 Mbps, but its
+/// line-rate super-buffer trains cost real delivered throughput on a constrained fabric (the
+/// 2.5GbE-hop pair: peak 2452 → 1909 Mbps, and 0.4% loss at a rate sendmmsg carries clean).
+/// The third A/B ran WITH pace-aware chunk scaling landed (plan Phase 1.2/1.3 in
+/// `design/throughput-beyond-1gbps.md`) and reproduced the regression bit-for-bit — the trains
+/// lose on the hop's queue in the transport path itself (per-AU super-buffers, no video pacer
+/// involved), so the default stays opt-in on fabric evidence, not on pacing readiness. Revisit
+/// with a bare-metal Linux host on a clean 10G path. NOTE the gate is value-aware:
+/// `PUNKTFUNK_GSO=0` explicitly disables (it used to key on env *presence*, so `=0` ENABLED
+/// it here while disabling Windows USO).
 #[cfg(target_os = "linux")]
 mod gso {
     use std::sync::atomic::{AtomicU8, Ordering};
@@ -137,8 +140,11 @@ mod gso {
         }
     }
     /// Latch GSO off for the process after a GSO syscall error (unsupported kernel/path).
+    /// Warns once — a mid-session downshift to sendmmsg should be visible, not silent.
     pub fn disable() {
-        STATE.store(2, Ordering::Relaxed);
+        if STATE.swap(2, Ordering::Relaxed) != 2 {
+            tracing::warn!("Linux UDP GSO unsupported on this path — falling back to sendmmsg");
+        }
     }
 }