Add a saturation test that drives real concurrent mux streams until the secure listener's total worker pool is fully occupied with a request queued behind it. The scenario proves that the capacity diagnostic still answers from that state off the exhausted pool, that the responder refuses an over-capacity streaming request honestly and boundedly before any body byte, and that capacity recovers afterwards. Two negative controls pin the instrument: emptying the safe-method refusal set makes the refused stream hang instead, and monkeypatching the capacity-snapshot path away makes the diagnostic queue behind the exhausted pool. Tests only; no production code change. Co-Authored-By: GPT-5 Codex <noreply@openai.com>