fix: close stream adaptive gaps and switch notify to stario v0.1.1

- make stream fast path honor adaptive soft payload limits end-to-end
  - split oversized fast-stream payloads into sequential frames before batching
  - use adaptive soft cap when encoding stream batch payloads
  - move timeout-like error detection into production code for adaptive tx
  - tune notify FrameReader read size explicitly to avoid throughput regression
  - drop local stario replace and depend on released b612.me/stario v0.1.1

transport_codec.go

@@ -9,12 +9,93 @@ var (
 	errTransportPayloadDecryptFailed = errors.New("transport payload decrypt failed")
 )
 
+func encryptTransportPayloadCodec(runtime *modernPSKCodecRuntime, msgEn func([]byte, []byte) []byte, secretKey []byte, data []byte) ([]byte, error) {
+	if runtime != nil {
+		encoded, err := runtime.sealPlainPayload(data)
+		if err != nil {
+			return nil, errTransportPayloadEncryptFailed
+		}
+		return encoded, nil
+	}
+	if msgEn == nil {
+		return nil, errTransportPayloadEncryptFailed
+	}
+	encoded := msgEn(secretKey, data)
+	if encoded == nil && len(data) != 0 {
+		return nil, errTransportPayloadEncryptFailed
+	}
+	return encoded, nil
+}
+
+func decryptTransportPayloadCodec(runtime *modernPSKCodecRuntime, msgDe func([]byte, []byte) []byte, secretKey []byte, data []byte) ([]byte, error) {
+	if runtime != nil {
+		plain, err := runtime.openPayload(data)
+		if err != nil {
+			return nil, errTransportPayloadDecryptFailed
+		}
+		return plain, nil
+	}
+	if msgDe == nil {
+		return nil, errTransportPayloadDecryptFailed
+	}
+	plain := msgDe(secretKey, data)
+	if plain == nil && len(data) != 0 {
+		return nil, errTransportPayloadDecryptFailed
+	}
+	return plain, nil
+}
+
+func decryptTransportPayloadCodecPooled(runtime *modernPSKCodecRuntime, msgDe func([]byte, []byte) []byte, secretKey []byte, data []byte, release func()) ([]byte, func(), error) {
+	if runtime != nil {
+		plain, plainRelease, err := runtime.openPayloadPooled(data, release)
+		if err != nil {
+			return nil, nil, errTransportPayloadDecryptFailed
+		}
+		return plain, plainRelease, nil
+	}
+	if msgDe == nil {
+		if release != nil {
+			release()
+		}
+		return nil, nil, errTransportPayloadDecryptFailed
+	}
+	plain := msgDe(secretKey, data)
+	if release != nil {
+		release()
+	}
+	if plain == nil && len(data) != 0 {
+		return nil, nil, errTransportPayloadDecryptFailed
+	}
+	return plain, nil, nil
+}
+
+func decryptTransportPayloadCodecOwnedPooled(runtime *modernPSKCodecRuntime, msgDe func([]byte, []byte) []byte, secretKey []byte, data []byte) ([]byte, func(), error) {
+	if runtime != nil {
+		plain, plainRelease, err := runtime.openPayloadOwnedPooled(data)
+		if err != nil {
+			return nil, nil, errTransportPayloadDecryptFailed
+		}
+		return plain, plainRelease, nil
+	}
+	if msgDe == nil {
+		return nil, nil, errTransportPayloadDecryptFailed
+	}
+	plain := msgDe(secretKey, data)
+	if plain == nil && len(data) != 0 {
+		return nil, nil, errTransportPayloadDecryptFailed
+	}
+	return plain, nil, nil
+}
+
 func (c *ClientCommon) encodeTransferMsg(msg TransferMsg) ([]byte, error) {
 	data, err := c.sequenceEn(msg)
 	if err != nil {
 		return nil, err
 	}
-	data = c.msgEn(c.SecretKey, data)
+	data, err = c.encryptTransportPayload(data)
+	if err != nil {
+		return nil, err
+	}
 	queue := c.clientQueueSnapshot()
 	if queue == nil {
 		return nil, errClientSessionQueueUnavailable
@@ -23,7 +104,11 @@ func (c *ClientCommon) encodeTransferMsg(msg TransferMsg) ([]byte, error) {
 }
 
 func (c *ClientCommon) decodeTransferMsg(data []byte) (TransferMsg, error) {
-	msg, err := c.sequenceDe(c.msgDe(c.SecretKey, data))
+	plain, err := c.decryptTransportPayload(data)
+	if err != nil {
+		return TransferMsg{}, err
+	}
+	msg, err := c.sequenceDe(plain)
 	if err != nil {
 		return TransferMsg{}, err
 	}
@@ -41,7 +126,10 @@ func (s *ServerCommon) encodeTransferMsg(c *ClientConn, msg TransferMsg) ([]byte
 	}
 	msgEn := c.clientConnMsgEnSnapshot()
 	secretKey := c.clientConnSecretKeySnapshot()
-	data = msgEn(secretKey, data)
+	data, err = encryptTransportPayloadCodec(c.clientConnModernPSKRuntimeSnapshot(), msgEn, secretKey, data)
+	if err != nil {
+		return nil, err
+	}
 	queue := s.serverQueueSnapshot()
 	if queue == nil {
 		return nil, errServerSessionQueueUnavailable
@@ -52,7 +140,11 @@ func (s *ServerCommon) encodeTransferMsg(c *ClientConn, msg TransferMsg) ([]byte
 func (s *ServerCommon) decodeTransferMsg(c *ClientConn, data []byte) (TransferMsg, error) {
 	msgDe := c.clientConnMsgDeSnapshot()
 	secretKey := c.clientConnSecretKeySnapshot()
-	msg, err := s.sequenceDe(msgDe(secretKey, data))
+	plain, err := decryptTransportPayloadCodec(c.clientConnModernPSKRuntimeSnapshot(), msgDe, secretKey, data)
+	if err != nil {
+		return TransferMsg{}, err
+	}
+	msg, err := s.sequenceDe(plain)
 	if err != nil {
 		return TransferMsg{}, err
 	}
@@ -80,11 +172,7 @@ func (c *ClientCommon) encodeEnvelopePlain(env Envelope) ([]byte, error) {
 }
 
 func (c *ClientCommon) encryptTransportPayload(data []byte) ([]byte, error) {
-	encoded := c.msgEn(c.SecretKey, data)
-	if encoded == nil && len(data) != 0 {
-		return nil, errTransportPayloadEncryptFailed
-	}
-	return encoded, nil
+	return encryptTransportPayloadCodec(c.modernPSKRuntime, c.msgEn, c.SecretKey, data)
 }
 
 func (c *ClientCommon) encodeEnvelope(env Envelope) ([]byte, error) {
@@ -108,11 +196,7 @@ func (c *ClientCommon) decodeEnvelope(data []byte) (Envelope, error) {
 }
 
 func (c *ClientCommon) decryptTransportPayload(data []byte) ([]byte, error) {
-	plain := c.msgDe(c.SecretKey, data)
-	if plain == nil && len(data) != 0 {
-		return nil, errTransportPayloadDecryptFailed
-	}
-	return plain, nil
+	return decryptTransportPayloadCodec(c.modernPSKRuntime, c.msgDe, c.SecretKey, data)
 }
 
 func (c *ClientCommon) decodeEnvelopePlain(data []byte) (Envelope, error) {
@@ -167,11 +251,7 @@ func (s *ServerCommon) encryptTransportPayloadLogical(logical *LogicalConn, data
 	if msgEn == nil {
 		return nil, errTransportDetached
 	}
-	encoded := msgEn(secretKey, data)
-	if encoded == nil && len(data) != 0 {
-		return nil, errTransportPayloadEncryptFailed
-	}
-	return encoded, nil
+	return encryptTransportPayloadCodec(logical.modernPSKRuntimeSnapshot(), msgEn, secretKey, data)
 }
 
 func (s *ServerCommon) encodeEnvelopeLogical(logical *LogicalConn, env Envelope) ([]byte, error) {
@@ -210,11 +290,7 @@ func (s *ServerCommon) decryptTransportPayloadLogical(logical *LogicalConn, data
 	if msgDe == nil {
 		return nil, errTransportDetached
 	}
-	plain := msgDe(secretKey, data)
-	if plain == nil && len(data) != 0 {
-		return nil, errTransportPayloadDecryptFailed
-	}
-	return plain, nil
+	return decryptTransportPayloadCodec(logical.modernPSKRuntimeSnapshot(), msgDe, secretKey, data)
 }
 
 func (s *ServerCommon) decodeEnvelopePlain(data []byte) (Envelope, error) {