test: prove H2 partial-body cleanup preserves sibling

[seonghobae]

Refs #51.

Ready-for-review writer-safe child of #84 exact 46682aeb9e5bb10914f88c0e87fdee7d06272ff4. This increment targets the next causal H2 request-body gap only: partial upstream cleanup when a streamed request crosses the already-versioned body limit before downstream END_STREAM.

The raw certificate-verified H2 client opens a POST without Content-Length, sends exactly the admitted eight-byte prefix without END_STREAM, and requires that prefix to reach the H1 upstream so cancellation is exercised against real partial upstream state rather than a pre-origin rejection. It then sends the ninth byte, still without END_STREAM. Acceptance requires a complete HTTP-level rejection on that stream without connection-level GOAWAY, then requires the partially opened H1 upstream connection to be released within the existing five-second upstream I/O budget before any client-side RST_STREAM is sent. The origin decodes the partial H1 chunked payload and requires exactly the admitted eight bytes; the over-limit byte must not be forwarded before cleanup.

Only after upstream release is proven does the client send RST_STREAM(CANCEL) to close its remaining request side. A compliant GET on a sibling stream of the same H2 connection must then reach a fresh H1 origin connection and complete with exact body sibling-ok. This does not make a server-side RST_STREAM mandatory: RFC 9113 permits a server to complete a response before the request body finishes and then use RST_STREAM(NO_ERROR), but the acceptance owns the causal invariants—HTTP rejection, partial-upstream release, over-limit-byte non-forwarding, and same-connection sibling survival—rather than one implementation-specific control-frame strategy.

Initial exact e7ad25caf36c9f756f6f401ee60de8804f3f88d1 and repair exact 1af0401c28704ec3b709cb6f564a65b1a5c3d84c failed before compile/test only on Rust 1.98.0 formatting output. Current exact 33f2a96c20c2b5de8e704cb5788f63479c9ae808 applies the complete hosted rustfmt output; neither predecessor failure reached production/test semantics and the traffic oracle was not weakened.

Current exact 33f2a96c20c2b5de8e704cb5788f63479c9ae808 is terminal GREEN: CI 34594433821, Supply Chain 34594433859, and PgErd bounded-origin capacity 34594433872 all succeeded. The CI exact passed formatting, compile/test including this real-wire fixture, Clippy, rustdoc, complete owned-production coverage, resolved dependency-lock verification, load-contract traffic, and least-privilege OCI runtime. Supply Chain completed dependency audit, exact candidate builds, SPDX SBOM generation, image scans, exact-source binding and evidence upload. Fresh review-thread enumeration is empty. Exact-current technical COMMENT 5178230985 re-read the one-file range after execution and found no additional writer-safe defect; it is evidence only, not independent APPROVED governance credit.

Effective child scope remains one new real-wire fixture, tests/downstream_tls_h2_partial_body_cancellation_wire.rs. Production Rust, Admin Config, body-limit value, TLS policy, routing/retry semantics, product auth/business logic, Keyverse/Wardnet/EgressWeave authority, supplier source, and deployment authority are unchanged. docs/product-technical-gap-baseline.md remains owned by dedicated lane #61 and is not touched here.

This PR is Ready for independent governance review. No predecessor receipt, protected merge, release, canary, cutover, or legacy-removal credit is claimed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 0df457b0-6b98-4da6-8c7b-2fa4836a293d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-current technical review for 33f2a96c20c2b5de8e704cb5788f63479c9ae808: re-read the one-file child range after hosted execution. The raw-H2 fixture proves a real partial upstream state by requiring the within-budget eight-byte prefix to reach an H1 chunked request before the ninth byte crosses the limit without downstream END_STREAM. It then requires a complete stream-local HTTP rejection, verifies the over-limit byte was not forwarded, requires the partial H1 upstream to release before any client-side RST_STREAM cleanup, and finally proves a compliant sibling succeeds on the same H2 connection through a fresh origin. The fixture does not promote a server-side RST_STREAM strategy into a protocol MUST. CI 34594433821, Supply Chain 34594433859, and PgErd bounded-origin capacity 34594433872 are all terminal success; formatting, compile/test (including this new real-wire case), Clippy, rustdoc, owned-production coverage, load/runtime, dependency/SBOM/image scans, and capacity evidence are GREEN. Review-thread enumeration is empty. No production Rust, body-limit value, foreign authority boundary, gate threshold, or supplier source is changed. No additional writer-safe defect is present in the exact-current range. This COMMENT is technical evidence only and is not independent APPROVED governance credit.