From ec3da613d467680d76d66f650b76a7f875f3cc58 Mon Sep 17 00:00:00 2001
From: Jer Miller <jeremie.miller@gmail.com>
Date: Wed, 29 Jul 2026 18:54:34 -0600
Subject: [PATCH] test(secure-listener): pin prompt capacity recovery after a
 raced queue timeout

Assert that total admission capacity is recovered at queue timeout before delayed permit delivery runs, so removing the acquire-side raced-permit release is no longer masked by the later delivery callback.

Collapse duplicate queue-timeout float config warning emissions into one helper while preserving validation order, and document why the refusal writer swallows only ConnectionError after a peer reset.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 solstone/convey/secure_listener/admission.py  | 22 ++++++-------------
 solstone/convey/secure_listener/wsgi.py       |  2 ++
 .../link/test_secure_listener_queue_bound.py  |  1 +
 3 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/solstone/convey/secure_listener/admission.py b/solstone/convey/secure_listener/admission.py
index 58d58c96b..25cf76e49 100644
--- a/solstone/convey/secure_listener/admission.py
+++ b/solstone/convey/secure_listener/admission.py
@@ -228,7 +228,8 @@ def _resolve_float(
     warning_default: str,
 ) -> float:
     raw = link_cfg.get(key, default)
-    if isinstance(raw, bool):
+
+    def warn_default() -> float:
         log.warning(
             "Invalid link.%s in journal config: %r \u2014 defaulting to %s",
             key,
@@ -236,26 +237,17 @@ def _resolve_float(
             warning_default,
         )
         return default
+
+    if isinstance(raw, bool):
+        return warn_default()
     if raw == 0:
         log.info("link.%s is 0; secure listener queue timeout disabled", key)
         return 0.0
     if not isinstance(raw, (int, float)):
-        log.warning(
-            "Invalid link.%s in journal config: %r \u2014 defaulting to %s",
-            key,
-            raw,
-            warning_default,
-        )
-        return default
+        return warn_default()
     value = float(raw)
     if not (valid_min <= value <= valid_max):
-        log.warning(
-            "Invalid link.%s in journal config: %r \u2014 defaulting to %s",
-            key,
-            raw,
-            warning_default,
-        )
-        return default
+        return warn_default()
     return value
 
 
diff --git a/solstone/convey/secure_listener/wsgi.py b/solstone/convey/secure_listener/wsgi.py
index 01ada25bb..2e3e169af 100644
--- a/solstone/convey/secure_listener/wsgi.py
+++ b/solstone/convey/secure_listener/wsgi.py
@@ -454,6 +454,8 @@ async def dispatch_stream(
                 ),
             )
         except ConnectionError:
+            # The peer has already reset the stream; there is no writer left for
+            # the refusal, but drain bookkeeping and the 503 result still apply.
             pass
         stream_writer.begin_drain(RESET_CTX_BODY_DISCARD_CANCELLATION)
         return DispatchResult(endpoint=endpoint, status=503)
diff --git a/tests/link/test_secure_listener_queue_bound.py b/tests/link/test_secure_listener_queue_bound.py
index 0bb1be140..85a4fb3f2 100644
--- a/tests/link/test_secure_listener_queue_bound.py
+++ b/tests/link/test_secure_listener_queue_bound.py
@@ -553,6 +553,7 @@ async def test_timeout_reclaims_raced_permit_after_delivery_intercept(
         )
         assert status == 503
         assert invoked["count"] == 0
+        assert admission.snapshot()["active"]["total"] == 0
 
         real_deliver(captured["waiter"], captured["permit"])
         snapshot = await _wait_for_snapshot(
-- 
2.51.2