Assert that total admission capacity is recovered at queue timeout before delayed permit delivery runs, so removing the acquire-side raced-permit release is no longer masked by the later delivery callback. Collapse duplicate queue-timeout float config warning emissions into one helper while preserving validation order, and document why the refusal writer swallows only ConnectionError after a peer reset. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>