Both secure-listener 503 refusal paths were shipping without Retry-After, which AC2 requires as a 503 carrying Retry-After. Neither product code nor tests had it, so the gap was invisible to the suite. A live spot check over a real sandbox tunnel caught what fixtures missed: with the streaming lane full, the refused SSE consumer received 503 with Content-Type, Content-Length, and Connection: close, but no Retry-After. Use a single SECURE_LISTENER_REFUSAL_RETRY_AFTER_SECONDS constant set to 5 seconds so both paths stay aligned. Five seconds is short enough that transient saturation does not feel stale, and long enough that refused SSE consumers do not reconnect hard and recreate the storm this work exists to prevent. Tests assert against the constant instead of duplicating a literal. Also correct the observer-over-PL design doc's stale secure-listener identity line reference.