Round 8 — AEAD allocation reduction on the receive hot path, plus the
documentation of two known-fragile-but-not-broken couplings.
* Aead gains [openRange] / [sealRange] taking (array, offset, length)
triples for AAD and plaintext/ciphertext. Default impls slice and
delegate to the existing whole-array methods so non-JCA AEADs
(Aes128Gcm singleton, ChaCha20Poly1305Aead) still work. The
JCA-backed [JcaAesGcmAead] overrides both, passing offsets straight
to `Cipher.updateAAD(byte[], offset, len)` and
`Cipher.doFinal(byte[], inputOffset, inputLen)` — JCA accepts ranges
natively and does no internal copies. Saves ~2 KB ByteArray
allocations per inbound packet (one for the header `aad`, one for
the `ciphertext`) — at audio-room receive rates (~100 packets/sec)
that's ~12 MB/min of GC churn eliminated. Same overload on the
outbound path is wired but currently exercised less because the
build path constructs `headerBytes` and `paddedPlaintext` as
separate fresh allocations.
parseAndDecrypt in both ShortHeaderPacket and LongHeaderPacket now
call openRange instead of slicing into intermediates.
* JdkCertificateValidator.dnsMatches: explicit doc note on the
public-suffix-list gap. The dot-count heuristic accepts wildcards
like `*.co.uk` / `*.github.io` / `*.s3.amazonaws.com` whose effective
TLD spans multiple labels. WebPKI / CT logging mitigates this in
practice (CAs validate against the actual PSL), but our local
validation alone wouldn't catch a rogue cert. Production callers
for sensitive endpoints should rely on OS / NetworkSecurityConfig
pinning rather than QUIC's hostname check alone. Full PSL data
shipping deferred until justified.
* QuicStream.incoming: explicit doc note on the single-collector
contract. [consumeAsFlow] cancels the underlying [Channel] when
its collector terminates, and once cancelled the parser's next
trySend fails, sets [overflowed] = true, and the parser tears down
the connection with INTERNAL_ERROR. Production callers already
follow single-collector + collect-until-FIN, but the doc lays out
the rule so a future refactor doesn't loosen it accidentally.
Long-form discussion of the `MutableSharedFlow` alternative and
why we declined it.
All 269 :quic:jvmTest tests pass. BUILD SUCCESSFUL in 40s.
https://claude.ai/code/session_01AhGvbMV8uPRse3TmAGaddM
Claude
90f59a3351