This article is a Halo-style decision matrix for 2026: where to apply Happy Eyeballs thinking, where QUIC 0-RTT is worth the complexity, and how to sign off handshake p95 separately for SSH and for large binary pulls. It assumes you already separate GeoDNS from automation hostnames; if not, start with GeoDNS, SSH latency and the node matrix and split-horizon vs GeoDNS for SSH and artifact p95. For edge routing and Worker-level health gates, see Cloudflare Worker routing and SSH p95; for SCP/SFTP specifics, see SCP/SFTP artifact RTT matrix. Prefer read-only probes and public health URLs so acceptance runs without interactive login beyond the keys your automation already owns.
Before the H2 sections, use this ingress decision matrix in design reviews. Rows are concerns; columns tell you which mechanism owns the problem and what you measure for p95.
| Ingress concern | Primary mechanism | p95 acceptance focus |
|---|---|---|
| Dual-stack DNS answers disagree with reality | Happy Eyeballs (RFC 8305-style racing on clients and proxies) | Wall-clock to first successful TCP connect; regressions when AAAA is broken |
| Large HTTPS artifact first byte | QUIC / HTTP/3 with optional 0-RTT session resumption | TTFB and TLS+transport setup; compare 0-RTT on vs full 1-RTT |
| Interactive shell and CI over bastions | TCP + SSH (not QUIC) | SSH connect until remote command starts (proxy + host) |
| Node selection under brownouts | GeoDNS + explicit regional aliases + health-weighted records | Failover latency: time from bad health to majority clients on new PoP |
Path splitting: control plane vs artifact plane
Path splitting is non-negotiable when you mix Happy Eyeballs, QUIC, and SSH. On the control plane, keep a dedicated hostname (or jump chain) that resolves to a small set of regional TCP endpoints. Measure end-to-end SSH time including ProxyJump hops; do not attribute QUIC wins to a path that never carried QUIC. On the artifact plane, terminate TLS at your CDN or object gateway, enable HTTP/3 where UDP is viable, and log transport protocol per request so p95 dashboards split h2 vs h3.
Happy Eyeballs mainly affects how quickly a client picks a working IP family after DNS. It does not replace node selection at the DNS layer, but it hides some broken AAAA records—until it does not, which is why you still need synthetic connects from CI VLANs. QUIC 0-RTT replays early data; never treat it as a free latency win for mutating APIs unless you have anti-replay and idempotency keys. For read-heavy artifact backhaul (container layers, SwiftPM binary artifacts, static bundles), 0-RTT is often acceptable when objects are immutable and keyed by digest.
Instrument three timestamps per workflow: (1) DNS resolution, (2) transport handshake complete, (3) first application byte. Store PoP or region ID on every row so JP/KR/HK/SG/US West comparisons stay honest when a user VPN lands in an unexpected city.
Parameter table for p95 sign-off
Use the table below as a contract between platform and SRE. Tune numbers for your fleet; the important part is that every parameter has an owner and a dashboard, and that you sample at least hundreds of connects per region per day—no dashboard, no sign-off.
| Parameter | Typical starting value | What p95 proves |
|---|---|---|
| Happy Eyeballs connection attempt delay (inter-address spacing) | 25–250 ms ladder per resolver guidance | p95 connect not worse than single-stack baseline by more than one RTT |
SSH ConnectTimeout (per hop) |
8–12 s production; 4 s in CI with fast fail | p95 total connect under your regional budget in the next section |
| QUIC idle and handshake timeouts at LB | Follow vendor defaults, then shave from p99 loss bursts | p95 TTFB for immutable GET improves when UDP path is clean |
| 0-RTT session ticket rotation | Short ticket lifetime if keys rotate frequently | 0-RTT rejection rate and replay counters stay flat after key roll |
| Synthetic probe interval | 30–60 s from two independent vantage points | Detect family-specific blackholes before humans open tickets |
/healthz on the artifact edge and use object fetches authenticated by scoped tokens—not human SSO—to keep graphs continuous.# Example: wall-clock SSH probe (BatchMode, no PTY) — store p95 in your TSDB
time ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new \
-o ConnectTimeout=10 -J bastion@edge user@mac.internal 'echo ok'Japan, Korea, Hong Kong, Singapore, and US West: handshake p95 rows
These rows are internal acceptance targets for multi-region remote Mac fleets: they combine what we see on trans-Pacific paths with what Halo-style entry should guarantee in a sign-off deck. “SSH p95” means DNS through TCP and SSH authentication to first remote byte; “Artifact p95” means DNS through TLS (1-RTT or 0-RTT) to first body byte for a cached immutable object comparable across regions.
| PoP | SSH connect p95 (home market) | Artifact QUIC TTFB p95 (CDN-aligned) | Notes |
|---|---|---|---|
| JP | < 180 ms domestic; document < 320 ms via US-West jump | < 120 ms for warm cache in Tokyo metro | Prefer in-region registry mirror; HE rarely flaps on quality transit |
| KR | < 170 ms domestic; watch Wi‑Fi IPv6 tunnels | < 130 ms when origin is SG or JP sibling PoP | Log A vs AAAA outcome; Korean mobile paths stress HE timers |
| HK | < 160 ms Greater Bay; higher if forced long-haul | < 110 ms to HK edge for digest-addressed blobs | Split corporate DNS from guest; resolver skew breaks GeoDNS |
| SG | < 200 ms ASEAN hub; validate AU secondary explicitly | < 140 ms with SG-first artifact tier | Best default SEA aggregation PoP for mixed APAC teams |
| US West | < 220 ms US-West mesh; label APAC > 350 ms as expected | < 150 ms to US-West edge; compare h2 vs h3 p95 separately | Trans-Pacific QUIC may fall back to TCP; track fallback rate |
When a row fails, fix node selection before you chase QUIC knobs: wrong PoP swamps any 0-RTT gain. Cross-check with the pricing page and the region links in the CTA so capacity matches the path you measured.
Fallback strategy when HE or QUIC cannot carry the load
Run these fallbacks in order so incidents shorten instead of spreading. First, if Happy Eyeballs consistently picks IPv6 but loss is high, pin automation runners to IPv4 for SSH and document the exception; keep humans on dual-stack with monitoring. Second, if QUIC UDP is blocked (hotel Wi‑Fi, captive portals, aggressive middleboxes), your client stack should already downgrade to TCP TLS; alert when downgrade rate crosses a floor per region. Third, disable 0-RTT for any endpoint that is not strictly replay-safe, and keep a feature flag to turn it off globally during key compromise drills. Fourth, maintain a break-glass SSH hostname per region that bypasses GeoDNS, aligned with the jump-host guidance in our other runbooks.
After fallback, re-run the same p95 queries you used for sign-off. If numbers do not return within one business day, treat it as a routing or capacity problem, not a transport knob. For product-side steps, read Help center next to your internal wiki.
When the matrix and p95 charts agree, provision remote Mac builders in the PoP you actually measured—capacity, registry mirrors, and SSH entry should move together. vpshalo publishes monthly plans across the same regions; keep sampling after every DNS or CDN change so Happy Eyeballs and QUIC behaviour stay visible.
Pick a region, then validate the path
Open Home, compare Pricing, read Help, and browse the Blog. Choose a PoP that matches your SSH and artifact measurements—no account wall for public pricing and help pages.
Region purchase pages: Tokyo · Seoul · Hong Kong · Singapore · US West