The combined path works in the tested cases.
Experiment 7 brings together EXP 01's response HPACK encoder and EXP 06's G0A output boundary. The combined variant PG retains the observed header-table behavior of HPACK and the selective early-output behavior of G0A. Under the checked workloads, decoded HEADERS, body hashes, HTTP/2 frame order and TLS plaintext accounting remained consistent.
One boundary or two independent gains?
Response HPACK reduces the bytes needed to represent certain repeated HTTP/2 response headers. G0A chooses a bounded nginx output boundary after a small, urgent DATA frame; it does not change BoringSSL's TLS-fragment policy. The experiment asks whether reducing the HEADERS portion moves a complete decoded response earlier, or simply changes how much plaintext is assembled before the same early output boundary.
↓ ordered HTTP/2 HEADERS and DATA frames
G0A → selective urgent-DATA output boundary
↓ nginx SSL buffer → BoringSSL TLS records → client decoding
Neither a smaller HEADERS block nor a smaller TLS record on its own establishes when the client can decode the complete response. That endpoint is reserved for the gated performance comparison.
One factorial comparison, four variants.
All tested cells use the same pinned nginx 1.31.7/BoringSSL baseline, HTTP/2 over TLS 1.3 and 16-KiB stock TLS fragment policy. The existing H2 harness exercises simultaneous and late-request workloads. The experimental patches are staged into isolated nginx builds, not the project’s vendored upstream source.
| Case | Response HPACK | Priority-aware early flush | What it isolates |
|---|---|---|---|
| B | stock | off | nginx baseline |
| P | experimental | off | Header encoding / reuse |
| G | stock | G0A | Selected early output boundary |
| PG | experimental | G0A | Combined behavior and interactions |
The comparison is useful even if PG eventually proves no faster: it separates compression, output batching and their interaction rather than attributing every improvement to a single combined build.
Smaller HEADERS change the G0A record.
The E7-2A safety campaigns provide a concrete mechanism observation. With the peer HPACK table size set to zero, P and PG make no dynamic insertions or hits, HEADERS do not shrink, and the G and PG short-write sizes match. At 1024 bytes the encoder reuses eligible entries but also evicts and reinserts them; at 4096 bytes it retains them throughout the tested fixture.
| E7-2A condition | Measured HEADERS, B | Measured HEADERS, P | Selected short write, G → PG |
|---|---|---|---|
| Table 0 / simultaneous | 245, 241, 245 B | 245, 241, 245 B | 4,627 → 4,627 B |
| Table 1024 / simultaneous | 245, 241, 245 B | 148, 144, 245 B | 4,627 → 4,530 B |
| Table 4096 / 350-ms pause / simultaneous | 245, 241, 245 B | 148, 144, 148 B | 4,627 → 4,433 B |
The repeated warm response example decreases from 241 B to 144 B, roughly 40%. The selected G0A short write likewise changes when the preceding HEADERS shrink, without forcing all subsequent TLS writes to become small. This is a byte-boundary result, not a latency result. A different record split is possible in some cells; frame and plaintext accounting remain correct.
The P and PG variants exhibited matching HPACK table hit/insertion/eviction progressions, including limited-table churn. The G and PG variants preserved the G0A cut, HEADER wire order and 16-KiB bulk-record capability. This supports coexistence for the tested workloads rather than unrestricted correctness for all state transitions.
The tested state machines survived.
E7-0 and E7-1: staging and integration
All four B/P/G/PG variants staged and built. E7-0 passed its 16 existing checks. E7-1 then completed eight integration cells with 52/52 complete responses, demonstrating both response-header reuse and the intended G0A output cut in the combined PG build.
E7-2A: bounded pressure and HPACK capacity
Across 24 cells, 156/156 responses decoded correctly. The tests covered initial table sizes 0 and 1024, plus 4096-byte tables under a 350-ms application receive pause. The trace audit correlated 641 recoverable SSL_ERROR_WANT_WRITE events with subsequent successful writes, without missing/duplicate frames or mismatched TLS plaintext. The 24-test suite passed. The pause did not produce a native selected-prefix WANT_WRITE.
E7-2B: dynamic state and lifecycle controls
The subsequent bounded stateful controls executed 32 cells over 48 connections, completed 376 responses and intentionally cancelled 12 requests, without a reported integrity defect. They exercised peer SETTINGS changes 4096 → 0 → 4096, cancellation/RST_STREAM with HPACK replay, client-side GOAWAY and bounded fairness with two/four connections. The E7-2B report records 1,514 recovered WANT_WRITE events and 38/38 tests passed.
E7-2B is nonetheless INCONCLUSIVE: the server-side graceful GOAWAY control (G2) remains unverified. One G2/PG shutdown was actually attempted: SIGQUIT with master_process off caused an immediate nginx exit, without a server GOAWAY; the client encountered EOF inside a TLS record while bulk streams 9 and 13 were unfinished. Subsequent G2 limitation records were source-checked, not additional executed trials. This is a limitation of the single-process shutdown fixture, not a demonstrated HPACK or G0A defect.
The E7-2B figures come from its full gate report; the underlying raw campaign artifacts were not independently reanalysed for this public summary.
The timing question is deliberately unanswered.
EXP 06 Phase 3E subsequently demonstrated four successful deterministically injected selected-prefix retries with the original G0A patch unchanged. Those tests started with already pending TLS output and used a test-specific readiness rearm. They do not substitute for a native socket prefix retry or fresh-record first-ciphertext acceptance; neither independent gate is closed.
The measured figures above concern sizes, completed response integrity and bounded negative paths. They do not show that HPACK makes PG faster than G, that G0A makes PG faster than P, that the two benefits add, or that the combined policy should be adopted in production. E7-3 remains intentionally blocked until the relevant safety gates are resolved.
Reproduction and provenance
Primary experiment sources, kept in the local nxTLS repository:
experiments/hpack-priority-early-flush/README.mdandrun.py— controlled B/P/G/PG stages.experiments/hpack-priority-early-flush/GATE_E7_2A_2026-10-21.md— the detailed 24-cell safety report and raw evidence inventory.experiments/hpack-priority-early-flush/GATE_E7_0_2026-10-21.mdandGATE_E7_1_2026-10-21.md— staging/build and integration evidence.experiments/hpack-priority-early-flush/GATE_E7_2B_2026-10-21.md— full stateful safety report, executed G2/PG attempt, source-checked G2 limitations and raw evidence inventory.experiments/priority-aware-dynamic-tls-record-sizing/PHASE3E_2026-10-21.md— independent G0A prefix retry evidence.
Environment: nginx 1.31.7, BoringSSL 594a44291086dcc7cef06cabec4c0b47afd674c0, Debian Testing amd64, Clang 21.1.8, HTTP/2 / TLS 1.3 / TCP. The E7-2A controls used existing verified debug binaries, stock 16-KiB nginx SSL buffering and TLS fragment sizes. The experiments preserved upstream source trees, original patches, pins and earlier evidence.