test: prove H2 stream backpressure sibling fairness

[seonghobae]

Refs #51.

Ready-for-review writer-safe child of #81 current exact 6ce632d6ff23469d22d7e6b0746ce42c9bdc98e2. This increment narrows the remaining RFC 9113 flow-control gap to stream-scoped response backpressure and sibling fairness only; connection-window exhaustion remains a separate successor acceptance.

The raw client advertises SETTINGS_INITIAL_WINDOW_SIZE=16384, opens stream 1 to a 64 KiB origin response, and replenishes only connection-level credit while deliberately withholding stream-1 WINDOW_UPDATE. Acceptance requires stream 1 to consume exactly the advertised 16 KiB stream window and then stop emitting non-empty DATA without RST_STREAM or GOAWAY. While stream 1 is stalled, stream 3 must still dispatch to a distinct H1 origin request on the same verified H2 connection and complete with exact body sibling-ok. The client then restores only stream-1 credit and requires the original 64 KiB response to resume, terminate normally, and preserve all response bytes.

This separates RFC 9113 stream-window backpressure from connection-window exhaustion: replenishing connection credit prevents the shared connection window from manufacturing the stall, while withholding stream-1 credit makes the stalled resource explicit. The fixture therefore proves a blocked stream does not serialize or poison an independently flow-controlled sibling. It does not claim bounded memory under connection-window exhaustion, connection-level fairness, partial-body upstream cancellation, origin-failure semantics, or production performance.

The initial exact 79e6740... had Supply Chain 34580353511, capacity 34580353572, load-contract and OCI runtime GREEN, while CI 34580353492 stopped before compile/test only at Rust 1.98.0 formatting. The log contained inherited #81 body-fixture formatting plus seven layout-only deltas in this child fixture. Parent formatting was repaired in #81; this branch then applied exactly the child rustfmt output without changing the H2 flow-control oracle or production Rust. Subsequent parent movements were adopted through ordinary two-parent commits and force:false ref updates; no destructive rebase or force-push was used.

Exact 21b6d299... then proved the seven layout deltas were correct but CI 34582328034 still stopped at formatting because the child fixture itself lacked only the terminal newline; compile/test/lint/coverage were not reached. Current exact 03c20c08ee40466037c4e7bc2dcf143c83fde23b adds only that terminal newline. No semantic source, threshold, protocol oracle or production code changed.

Current exact remains based on #81 6ce632d...; parent→child effective scope is only tests/downstream_tls_h2_stream_backpressure_wire.rs. Production Rust, Admin Config, TLS policy, routing/retry semantics, product auth/business logic, Keyverse/Wardnet/EgressWeave authority, supplier source and deployment authority are unchanged.

Exact-current CI 34582855519, Supply Chain 34582855510, and PgErd bounded-origin capacity 34582855554 are all terminal GREEN on unchanged exact 03c20c08.... Formatting, compile/test, Clippy, rustdoc, owned-production coverage, loopback load contract, OCI least-privilege runtime, dependency audit, SBOM generation, image scans and capacity evidence all completed successfully. Fresh review-thread enumeration is empty. This PR is Ready for independent governance review.

Technical COMMENT evidence is not independent approval. No protected merge, release, canary, cutover or legacy-removal credit is claimed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 31f017a9-8e1e-4546-b7e8-8719c82a1dc3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-current technical review for 79e6740fea1a653cacd038b1f683d2cd452424ea (evidence only, not approval). Parent is #81 50a4bc5c1c4a5f779882abab5c6815e87198e51d; fresh compare is ahead-only/behind 0 with that exact merge base and one effective file. The oracle intentionally sends client SETTINGS_INITIAL_WINDOW_SIZE=16384, restores connection-level credit for every stream-1 DATA octet while withholding stream-1 credit, requires the response to stop at exactly 16 KiB, proves stream 3 completes with exact sibling-ok on the same H2 connection, then restores only stream-1 credit and requires the full 64 KiB body to resume intact. This isolates per-stream flow control from shared connection-window exhaustion. Connection-level backpressure remains a separate successor gap. Production Rust and policy authority are unchanged; exact-current gates remain promotion authority.

[seonghobae]

Exact-current technical review for 21b6d2997198209b41c7278cc955f4a43ea1217b (evidence only, not approval). Initial 79e6740... CI failed before compile/test only at Rust 1.98.0 formatting: inherited #81 fixture layout plus this child fixture's own seven layout-only deltas. The inherited defect is repaired in #81; the child applies only rustfmt output and is non-force restacked over current #81 6ce632d.... Fresh compare is behind 0/ahead-only with merge base exactly that parent and one effective path, tests/downstream_tls_h2_stream_backpressure_wire.rs. The 16 KiB stream-window stall, connection-credit replenishment, sibling completion and stream-1 resume oracle is unchanged. Review-thread enumeration is empty; exact-current gates remain promotion authority.

[seonghobae]

Exact-current technical review for 03c20c08ee40466037c4e7bc2dcf143c83fde23b (evidence only, not approval). Parent remains #81 exact 6ce632d6ff23469d22d7e6b0746ce42c9bdc98e2; the effective child delta is still only tests/downstream_tls_h2_stream_backpressure_wire.rs. Current source implements the intended RFC 9113 separation: client initial stream window is 16 KiB; connection-level WINDOW_UPDATE is replenished while stream-1 WINDOW_UPDATE is withheld, so a stream-1 stall cannot be manufactured by exhausting the shared connection window. The same connection must still complete stream 3 with exact sibling-ok; only then is stream-1 credit restored and the original 64 KiB response required to resume intact. Current exact CI has passed formatting, compile/test, Clippy and rustdoc and is running owned-production coverage; capacity is GREEN while CI/Supply Chain remain nonterminal. No unresolved review thread exists. Keep Draft until all exact-current gates terminate; connection-window exhaustion/bounded-memory recovery remains a distinct successor gap.