[FFI] Zero-copy FFI optimization: symbol stripping, mmap vault I/O, Rust→Dart transfers

[Adel-Ayoub]

Summary

Eliminate unnecessary data copies at the Dart↔Rust FFI boundary and within the Rust I/O pipeline. Currently all byte transfers use FRB's SSE codec which serializes/deserializes (memcpy) every Vec<u8> crossing the boundary. Vault reads allocate heap buffers via read_exact instead of memory-mapping the file. Release builds expose all internal symbols.

Motivation

Performance: One-shot vault_read of a 10MB segment currently copies the data 2-3 times: disk → heap Vec → AEAD decrypt → SSE serialize → Dart Uint8List. Each copy adds latency and doubles peak RSS.

Security: Fewer copies means fewer places where plaintext or key material lives in memory. Symbol stripping removes the "self-described API" surface that makes the .so easy to wrap/intercept. mlock() on mmap regions prevents the OS from swapping plaintext pages to disk.

Context: Feedback from r/FlutterDev raised valid concerns about dynamic library interception. While M-Security's security model doesn't rely on obscurity, reducing the FFI surface area is defense-in-depth.

Sub-Issues

• [FFI] Release profile hardening & symbol stripping #102 Release profile hardening & symbol stripping
• [FFI] mmap-based vault segment reads #103 mmap-based vault segment reads
• [FFI] Zero-copy Rust→Dart byte transfers #104 Zero-copy Rust→Dart byte transfers (FRB upgrade path)

Dependency Order

#102 Release profile (no deps)
  └→ #103 mmap vault reads
  └→ #104 Zero-copy Rust→Dart (may require FRB upgrade)

Current Data Transfer Bottlenecks

Component	Current Method	Copies	Opportunity
vault_read (monolithic)	read_exact → decrypt → SSE encode	2-3	mmap + ExternalTypedData
vault_read_stream (chunked)	per-chunk read_exact → StreamSink	1/chunk	mmap window per chunk
encrypt/decrypt	Vec through SSE codec	1	ExternalTypedData return
Release binary	All symbols exported	N/A	strip + visibility attrs

Acceptance Criteria

• Release builds strip all symbols except FRB entry points
• Vault read path uses mmap for segment access
• mmap regions use mlock() where supported
• No regression in ZeroizeOnDrop behavior
• All existing tests pass