release: 0.16.268

[MDA2AV]

All twelve published packages share one version, as always. The bump is only the twelve Version elements; IoxideRuntime.Version is generated from ioxide.csproj. The minor version moves because #246 renames public options.

Carries everything since 0.15.251:

• tcp, quic: time a connection out only while it waits on its peer #246: the read timeout only counts time spent waiting on the peer, on TCP and QUIC. A handler that lets go now sends a FIN.
• TCP and TLS:
  • tls: decrypt each record into the space the segment has left #252: a TLS record no longer takes a 16 KiB segment.
  • tls: skip the teardown close_notify where a raw send cannot go out cleanly #256: close_notify is skipped where a raw send can't go out cleanly.
  • tcp, tls: report a recv-queue overflow as an error, and raise the default queue to 4096 #257: a receive-queue overflow is reported as an error, and RecvQueueEntries now defaults to 4096.
  • tcp: ShutdownWrite() - a half-close for the protocol layer (#211) #262: TcpConnection.ShutdownWrite() (TcpConnection: expose ShutdownWrite() so protocol layers can honour Connection: close #211).
• QUIC and HTTP/3:
  • quic: stop the keep-alive once the handler has let go #255: the keep-alive stops once the handler lets go.
  • quic, http3: reset a stream nothing will answer, so it stops keeping the connection alive #258 and h3: reset the streams both stacks give up on, plus the Quic/Raw sample and a ping-floor test #259: streams nobody will answer are reset, and both HTTP/3 stacks reset a streamed response that fails mid-body.
  • quic: track a retransmit deadline from the send, not from the next datagram #267: a retransmit deadline is tracked from the send, so a lost answer from a handler resumed by a timer or query no longer waits ~30 s. A lost client Initial is resent too.
• HTTP/2: http2: reset a streamed response whose handler fails mid-body, on both stacks #266: both stacks reset a streamed response that fails mid-body. nghttp2 answers a pre-header failure with 500, not 200.
• Kestrel:
  • kestrel: Abort shuts the socket down, as Kestrel's own transport does #253: Abort shuts the socket down.
  • kestrel: release a connection through the reactor, behind the MarkClosed its pipe posted #254: release order.
  • kestrel: half-close through ShutdownWrite, not a raw shutdown on the fd #263: half-close through ShutdownWrite.
  • kestrel: a receive-queue overflow reaches Kestrel as an error, not a clean end #264: an overflow surfaces as an error.
• Docs and bench: docs, bench: drop the stale TLS pump wording; ab.sh stops on Ctrl-C, guards every run's port, passes the port #261.

Breaking

• Removed: TcpOptions.IdleTimeoutMs and QuicOptions.IdleTimeoutMs. Use ReadTimeoutMs, which only counts time spent waiting on the peer.
• Renamed: QuicEvictReason.IdleTimeout is now ReadTimeout.
• Default change: TcpOptions.RecvQueueEntries is 4096 (was 64).

Native

• libioxide_ngtcp2: ABI 5.
• libioxide_nghttp2 and libioxide_nghttp3: rebuilt from the commits the shipped libraries came from (verified symbol by symbol), with new shim exports only. Their build scripts are now pinned, as the ngtcp2 one already was.

On the merged main (324913b): E2E 231, Unit 60, Http 44, Tls 151, Chaos 47 and File 4 pass. The 7 kTLS tests were skipped locally because the tls module isn't loaded; CI loads it.