internal/json: Unmarshal allocates a 32 KiB stream buffer on every call #1453

Is your feature request related to a problem? Please describe.

internal/json.Unmarshal (and UnmarshalUseNumber) wrap the input in a bytes.Reader and decode it with segmentio's streaming json.Decoder. The decoder copies its input into a read buffer of at least 32 KiB (minBufferSize), and doubles it once less than 4 KiB is free, so every call allocates 32–64 KiB however small the message is.

Unmarshal runs several times per request (the batch, the JSON-RPC message, request meta, applySchema, the typed arguments), so one tools/call over streamable HTTP allocates about half a megabyte, nearly all of it these buffers. BenchmarkStreamableServing on main reports 528 KiB/op.

I hit this while profiling a server built on the SDK (stateless streamable HTTP, JSON responses): about 90% of the bytes allocated per tool call came from segmentio/encoding/json.(*Decoder).readValue, and GC took about 28% of CPU.

#1395 avoids one of these calls (the method string). Fixing the shared helper covers all of them.

Describe the solution you'd like

Unmarshal already has the whole input, so it doesn't need a stream. It can find the extent of the first JSON value in place (json.Parse into a json.RawMessage with DontCopyRawMessage runs the same parseValue that Decoder.readValue runs on its buffer), then decode exactly that value with the same flags. When that fails, the input is malformed, and it can still go through a Decoder, so errors stay exactly as they are today: io.EOF for empty input, io.ErrUnexpectedEOF for truncated input, and the same SyntaxError and UnmarshalTypeError text.

With that change on main (Go 1.26.6, Apple M1 Max, -count=8):

BenchmarkStreamableServing   368.7µs → 219.3µs  (-41%)   528 KiB → 60 KiB  (-89%)
BenchmarkUnmarshal (new)       4.0µs →   1.3µs  (-67%)    37 KiB →  5 KiB  (-86%)

In my server's own tool-call benchmark, latency drops 36–50% and bytes allocated 84–93%. In containers limited to one CPU, tool-call throughput under load roughly triples.

I have a PR ready, with a differential test and fuzz target that compare the new path against the old Decoder path: the decoded value, the error type and the error text.

Describe alternatives you've considered

• Replacing segmentio with encoding/json/v2 (internal/json: replace segmentio/encoding with encoding/json/v2 #1287) would also remove the buffer, but it raises the minimum Go version and swaps a dependency. This change is smaller, keeps today's behaviour exactly, and doesn't get in the way of internal/json: replace segmentio/encoding with encoding/json/v2 #1287 later.
• Decoding individual fields with encoding/json (jsonrpc2: avoid streaming decoder allocation for method strings #1395) helps only that call site.

Additional context

Case-sensitive field matching (#805) and the nesting-depth limit are unchanged.