test: prove H2 connection backpressure recovery

[seonghobae]

Refs #51.

Ready-for-review writer-safe child of #82 exact 03c20c08ee40466037c4e7bc2dcf143c83fde23b. This increment closes the RFC 9113 shared connection-window exhaustion/recovery slice. Bounded-memory proof remains a separate follow-up and is not claimed here.

The raw verified-H2 client advertises a 1 MiB stream-level initial window so stream credit cannot manufacture the stall. It opens stream 1 to a 128 KiB origin response and deliberately sends no WINDOW_UPDATE until exactly the default 65,535-byte connection window is consumed. The fixture then opens stream 3 and requires its H1 origin response to be produced while downstream DATA credit remains exhausted. A PING barrier must still be acknowledged, and no non-empty DATA from either response may cross before connection credit is restored. Only a stream-0 WINDOW_UPDATE is then sent; stream 1 and stream 3 must both complete without reset/GOAWAY, with the original 128 KiB body intact and the sibling exact body sibling-ok.

This is intentionally distinct from #82: #82 replenishes shared connection credit to isolate a 16 KiB stream-level stall, whereas this child makes stream windows non-limiting and withholds shared connection credit. RFC 9113 defines stream and connection flow-control windows separately, applies flow control only to DATA, starts both windows at 65,535 octets, and states that SETTINGS_INITIAL_WINDOW_SIZE changes stream windows while the connection window changes only through WINDOW_UPDATE.

Effective child scope is one new real-wire integration test, tests/downstream_tls_h2_connection_backpressure_wire.rs. Production Rust, Admin Config, TLS policy, routing/retry semantics, product auth/business logic, Keyverse/Wardnet/EgressWeave authority, supplier source and deployment authority are unchanged.

Exact current 6d0bf05bae5bff0e3b4360024567716e59350236 is terminal GREEN: CI 34584075862, Supply Chain 34584075751, and PgErd bounded-origin capacity 34584076080 all completed successfully. The exact CI passed formatting, compile/test including the new real-wire acceptance, Clippy, rustdoc, owned-production coverage, dependency-lock verification, loopback load contract and OCI least-privilege runtime. Supply Chain passed dependency audit, candidate image build, SPDX SBOM generation, exact-image scans and exact-source evidence binding. Fresh review-thread enumeration is empty.

Technical COMMENT review 5177082590 is exact-current evidence only, not independent approval. This PR is Ready for independent governance review. No protected merge, release, canary, cutover or legacy-removal credit is claimed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: c2f472aa-6e5e-46e9-9364-e85d830ff280

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-current technical review for 6d0bf05bae5bff0e3b4360024567716e59350236 (evidence only, not approval). Fresh parent is #82 exact 03c20c08ee40466037c4e7bc2dcf143c83fde23b; this child adds one real-wire test and no production Rust. The oracle makes stream credit non-limiting with a 1 MiB SETTINGS_INITIAL_WINDOW_SIZE, consumes exactly the RFC 9113 default 65,535-byte shared connection window without WINDOW_UPDATE, then proves request dispatch/control-plane liveness with a sibling origin response plus PING ACK while rejecting any non-empty DATA before connection credit returns. It restores only stream-0 credit and requires both responses to complete intact. This is complementary to #82's stream-window isolation and intentionally does not claim bounded-memory behavior. Fresh exact CI/Supply Chain/capacity are queued and remain the only promotion authority; keep Draft until terminal.