mir-backend-jvmlisted

Make It Right (JVM runtime tier). Java 25/21 LTS and Kotlin runtime reliability footguns shared across every JVM backend framework — distinct from the generic backend gates and from any one framework's mechanics. Covers: thread-pool sizing and pool-exhaustion deadlock, blocking I/O on platform threads, virtual threads after JEP 491 (synchronized no longer pins on Java 24+, jdk.VirtualThreadPinned JFR event) and virtual threads not bounding concurrency, GC choice (G1, ZGC, Generational Shenandoah) and container-aware heap sizing (-XX:MaxRAMPercentage), cold start (Leyden AOT cache, AppCDS, GraalVM native image, CRaC), JMM visibility and data races, ThreadLocal leaks in pooled threads, and JVM-level security (untrusted deserialization and ObjectInputFilter, XXE defaults, SSRF to the cloud metadata IP, Security Manager disabled since JDK 24, Maven/Gradle dependency verification). Chains: mir-backend -> this -> framework module. TRIGGER when the backend runtime is Java or Kotlin on the JVM. SKIP for Python, Node,
anantbhandarkar/make-it-right · ★ 15 · AI & Automation · score 81

Install: claude install-skill anantbhandarkar/make-it-right

# /mir-backend-jvm · Make It Right (JVM runtime) The middle tier. `mir-backend` decides **what is correct** (any language). The framework module (e.g. `mir-backend-jvm-spring`) knows the **library's mechanics**. This tier owns what's true for **all JVM backends because they run on the HotSpot JVM** — the threading model, garbage collector, memory model, process lifecycle, and JDK-level security defaults that Spring Boot, Quarkus, Micronaut, and Vert.x all inherit. **Runtime assumed:** Java 25 LTS or Java 21 LTS, Java or Kotlin. Notes reference OpenJDK/HotSpot defaults. Load order: `mir-backend` → `mir-backend-jvm` → `<framework module>`. **Read the actual JDK version out of the build file before applying any of this.** Spring Boot 4, Quarkus 3.x, and Micronaut 4.x all still declare a **Java 17 baseline**, so a service that uses a current framework can be running a JDK where half of this file does not apply. `<maven.compiler.release>`, `java.toolchain.languageVersion`, and the base image tag are the three places to look, and they disagree often. **Version status, verified 13 Aug 2026:** | Release | Status | What it means for a new service | |---|---|---| | **Java 25** | Current LTS. GA 16 Sep 2025, OpenJDK updates through Sep 2030 | The default target. Brings the AOT cache with method profiling, Generational Shenandoah, compact object headers | | **Java 21** | Previous LTS, still supported | Fine to stay on, but `synchronized` still pins virtual threads here — see §2. Ora