1.9 KiB
1.9 KiB
Context
RC9 datagram-v1 uses one-byte fragment fields and caps a media unit at 16 path-MTU fragments. The reviewed Apollo assembler can recover an encoded frame up to 1,028,152 bytes, so the replacement contract must carry at least that size while rejecting proportional allocation from untrusted header claims.
Goals / Non-Goals
Goals:
- Preserve datagram-v1 byte-for-byte and add explicitly negotiated datagram-v2.
- Keep each QUIC datagram at 1,200 bytes or less.
- Bound one complete encoded unit to 1 MiB, at most 891 fragments, four incomplete units, and a 250 ms reassembly lifetime.
- Define duplicate, reorder, timeout, and malformed behavior for every validator.
Non-Goals:
- Provider packet exposure, codec parsing, decode/transcode, retransmission, or a generic transport framework.
Decisions
- Datagram-v2 widens fragment index and count to unsigned 16-bit network-order fields, making a 23-byte header and 1,177-byte media payload. This is the smallest header change that covers the reviewed provider maximum without unrelated sequences.
- Sequence identifies one complete unit. All fragments must agree on channel, sequence, timestamp, count, and flags.
- Reassembly stores only received fragment bytes, rejects conflicting duplicates, permits exact duplicates and bounded reorder, evicts oldest state above four units, and expires state after 250 ms.
- Capability validation registers
datagram-v1anddatagram-v2; exact profile equality keeps downgrade behavior fail closed.
Risks / Trade-offs
- [More fragments increase per-frame overhead] → retain the 1,200-byte PMTU envelope and the 1 MiB frame ceiling.
- [Four concurrent 1 MiB units can consume bounded memory] → allocate only received bytes and evict/expire incomplete state.
- [RC9 peers cannot validate datagram-v2] → require a new immutable Protocol release and exact consumer pins; never mutate RC9.